@mgiles/perk 3.0.0 → 3.1.0

package/shared/contracts.md

@@ -1,7 +1,7 @@
 # perk cross-plane contracts
 
 The language-neutral contracts both planes obey, authored once here and bundled into each
-build artifact. This document holds the numbered **prose contract sections** (`§8.1`–`§8.57`,
+build artifact. This document holds the numbered **prose contract sections** (`§8.1`–`§8.65`,
 non-contiguous: `§8.8` is skipped and `§8.6a` exists; no parser): the Python CLI (`perk`)
 and the TS extension (`@mgiles/perk`) each implement one side, against the exact names/paths/
 fields pinned in each section. `perk doctor` verifies conformance. The numbering convention:
@@ -32,7 +32,8 @@ The local cache tier — written and read by **both** the CLI (exterior) and the
 ├── plan.md                 # cache.plan: the per-worktree plan snapshot for review fidelity (Python-only; transient)
 ├── plan-ref.json           # cache.plan-ref: the active plan->branch ref pointer (local mirror)
 ├── scratch/runs/<run_id>/  # per-run inter-process workflow files (diffs, generated bodies)
-│   └── data/               # the session data dir (Node 1.2): run-scoped session artifacts
+│   ├── agent/              # disposable, non-authoritative model intermediates (mode 0700)
+│   └── data/               # pointer-validated run-scoped session artifacts
 ├── handoff/<run_id>.json   # pre-session CLI->extension cold-door state (claimed on session_start)
 ├── agent-session.json      # cache.agent-session: the Linear AgentSession pointer (§8.22)
 ├── hunk-watch/             # the watch-feedback bridge (§8.58): worktree-local, disposable
@@ -132,12 +133,18 @@ The local cache tier — written and read by **both** the CLI (exterior) and the
   fixed constant `objective-draft.json` — `OBJECTIVE_DRAFT_ARTIFACT`,
   `extension/factories/objectiveDraft.ts` — and the path derives exclusively through the accessor seam;
   the gate's `edit`/`write`/bash blocking is unchanged). The artifact is a **single JSON file**
-  carrying `{schema_version: 1, title?, prose, roadmap}` — the structured roadmap rides
+  carrying `{schema_version: 1, title?, prose, roadmap}` — plus, in a `perk learn dream`
+  session, the **tool-written** `dream_report` block `{input, generated_at, parts}` (§8.63;
+  `readObjectiveDraft` refuses the WHOLE draft on a malformed block — deliberately stricter
+  than the lenient junk→absent `base`/`delivery` handling, because silently dropping a
+  malformed report is exactly what §8.63 forbids) — the structured roadmap rides
   **verbatim** (node-shape validation stays with the Python plane at save time, the
   `parse_structured_roadmap` path; an empty roadmap is allowed — only creation rejects
   roadmap-free objectives). **The JSON is storage/transport only** — the human review surface
   (node 2.2, Plannotator or the first-party editor) displays rendered markdown (the prose + a
-  markdown roadmap table) derived from the artifact, never raw JSON. Semantics: full rewrite per
+  markdown roadmap table; when the draft carries `dream_report`, the stored CANONICAL parts
+  append as the final section — the render is the objective+report **approval bundle**,
+  §8.63) derived from the artifact, never raw JSON. Semantics: full rewrite per
   call, non-terminating, NOT a save — `objective_save`/`/objective-save` remain the canonical
   GitHub persist surface. Failure taxonomy (soft results, never throws): mistyped params →
   `bad_input`; empty/whitespace prose → `invalid_input`; no session `run_id` → `no_run_id`;
@@ -172,6 +179,61 @@ The local cache tier — written and read by **both** the CLI (exterior) and the
   dir persist through the LWW rebuild. Consumers fail open to their fallback when validation
   refuses (the reader returns `null`; mismatched-run_id refusals are silent by design, broken
   promises — missing file, digest mismatch — warn on stderr).
+- **Agent scratch.** `.perk/workflow/scratch/runs/<run_id>/agent/` is the run-owned directory for
+  disposable command/model intermediates. Interior run-directory creation shares one hardened
+  boundary (`extension/substrate/cache.ts::ensureRunScratch`): before any write, `run_id` must be
+  one non-empty path segment (not `.`/`..`, with no `/`, `\\`, or NUL); every existing component
+  from the checkout's `.perk` child through the run root must be a real directory, never a symlink
+  or non-directory, and must have no group/world write bit; missing components are materialized in
+  order with an explicit maximum mode `0755` even under a permissive umask; and the run root's
+  realpath must equal the expected descendant of `realpath(cwd)` (a symlink above `cwd` remains
+  legal). All interior run-root writers use that boundary. `ensureAgentScratch` then applies the
+  same symlink/non-directory and resolved-containment checks to `agent/`, creates it as POSIX mode
+  `0700` from the outset, and re-applies `0700` on reuse. This is static redirected-path protection
+  and privacy from other OS users, not a defense against a concurrent process running as the same
+  user.
+
+  The extension provisions the directory before every eligible model turn and injects one hidden
+  `customType: "perk:agent-scratch"` block naming the repository-relative current-run path. A
+  context is eligible unless branch-LWW workflow mode is explicitly `read-only` or
+  `PI_SUBAGENT_CHILD_AGENT` names one of perk's report-only children (`perk.adversarial-reviewer`,
+  `perk.draft-reviewer`, `perk.dream-analyst`, `perk.dream-reducer`, `perk.harvest-analyst`, `perk.learn-analyst`,
+  `perk.objective-explorer`, `perk.pr-reviewer`, `perk.review-angle-selector`,
+  `perk.review-classifier`). Main sessions, `perk.conflict-resolver`, and unknown/custom children
+  remain eligible; absent generic foreign-agent metadata, inherited parent mode is the fallback.
+  Directory repair happens before prompt deduplication. The exact run-id/path-derived block is
+  deduplicated only inside the active post-compaction context window; context filtering keeps one
+  exact current-run **scratch custom block** and strips direct inherited/stale scratch custom blocks
+  (or all direct copies while ineligible), so a compacted-away block is re-injected. Compaction
+  summary prose is not a scratch custom block and may quote an older marker/path; it is deliberately
+  not redacted and is neither a live guidance delivery nor authoritative provenance. Only the
+  current-run direct block counts as live scratch guidance, and durable decisions still re-read the
+  canonical repository/backend source.
+  Because this is a universal pre-turn side effect that can become eligible after an in-session
+  read-only gate exit, every registry stage declares the existing `cache.scratch` key in `writes`.
+
+  A write-capable `/btw` side session receives the same rendered block once in its effective
+  appended system prompt after scratch custom messages are removed from its seed. Provisioning is
+  rechecked before every side-model prompt: deletion is repaired while reusing the session, and a
+  transition between unavailable and available scratch recreates the cached session so its
+  immutable prompt matches the current turn. The same gate that selects its tools excludes the
+  block from the read-only side-session shape; the tool-less summary shape also receives none.
+  Direct SDK read-only sessions remain unguided:
+  they load with `noExtensions: true` and the bounded `read`/`grep`/`find`/`ls` tool set. With no
+  settled run id the resolver is silent; an unsafe id or filesystem/permission failure injects no
+  path, warns through the report seam, and continues the turn. A failure is retried on later
+  eligible turns, with duplicate warnings suppressed per run within one extension activation and
+  suppression cleared after a successful retry. Fork/adopt run-root setup likewise reports and
+  continues after settling the derived workflow identity, without an unsafe fallback write.
+
+  The guidance asks agents to use descriptive non-colliding names instead of shared `/tmp` and to
+  re-read canonical repository/backend sources before durable decisions. Agent scratch is never
+  canonical evidence: it has no filename policy, atomic per-file writer, manifest, digest, or
+  `session_artifacts` pointer. Remote run diagnostics explicitly include hidden `.perk` files but
+  exclude the matching `agent/**` subtree from `actions/upload-artifact`; local cleanup remains the
+  enclosing run directory's existing `perk state prune` policy (no exit-time deletion). Non-goals:
+  no model-facing scratch writer, `PERK_SCRATCH_DIR`, `TMPDIR`, FFF/search change, shell/path
+  enforcement, OS sandbox, provenance protocol, or session-exit cleanup.
 - **Atomic workflow writes + corruption posture.** Every `.perk/workflow/` file write on both
   planes goes through the per-plane atomic-write seam — `perk/state/cache.py::atomic_write_text`
   (exterior) / `extension/substrate/cache.ts::atomicWriteFileSync` (interior): a temp file in the
@@ -253,6 +315,25 @@ The local cache tier — written and read by **both** the CLI (exterior) and the
     dispatch and never re-read from the mutable selector after selection. `--worktree NAME` is
     directory positioning only (never plan identity or branch — the branch is always
     `plan-<id>` from selection) and is refused with `--remote` (`invalid_input`).
+  - **Positive plan identification (the kind guard).** Explicit-id selection at the four
+    guarded doors — the three `select_plan` callers (`implement`, `pr address`/flat `address`,
+    `pr ready`) plus `plan resume`'s own read — refuses an existing issue that carries **no
+    plan-header** (`PlanState.has_plan_header`, presence-only kind evidence from the backend's
+    own storage: body metadata blocks on GitHub, perk attachments on Linear — never a payload
+    decode): typed `issue_kind_mismatch` via `plan_selection.require_plan_kind`. A GitHub
+    objective-header'd issue names the right door (`perk objective plan <N>`); the hint is
+    GitHub-only — a Linear metadata-sentinel issue refuses with the generic message, and a
+    Linear **Project** id never reaches the arm (`get_plan` returns `None` → `plan_not_found`,
+    the honest miss). A present-but-malformed header still identifies a plan (kind vs health
+    are separate concerns) — a **GitHub-only** reachable state: GitHub's tolerant body-block
+    read degrades a damaged block to `header={}` with `has_plan_header` true, while a corrupt
+    Linear plan-header attachment fails loud inside `get_plan`'s strict decode before
+    selection ever classifies kind. A **both-headers** carrier still selects as a plan (its plan
+    side can be legitimate mid-incident; `perk objective doctor`'s corruption check is the
+    both-headers surface, §8.54). `plan watch`/the positioner are explicitly **not**
+    entry-guarded — their wrong-kind protection is the §8.4 merge-only write seam. `pr ready
+    --dry-run` performs no backend read, so the offline preview classifies nothing (kind
+    included; the existing exception, kept).
 
 State keys (registry vocabulary): `cache.plan`, `cache.plan-ref`, `cache.scratch`,
 `cache.handoff`, `cache.markers`, `cache.session-data`.
@@ -384,13 +465,23 @@ end of the section).
 | `active_plan_ref` | object \| null | the provider-agnostic plan ref (§8.4); null during early `plan` |
 | `active_objective` | string \| null | the active objective id (`/objective <id>` sets it, `/objective clear` nulls it) |
 | `last_review_batch` | object \| null | the last fully processed review batch, appended by `finalize_address` only after publication and thread resolution succeed: `{ pr, counts:{actionable,informational,praise,question}, resolved_thread_ids:[…], at:ISO }` |
-| `last_pr_review` | object \| null | the last `/pr-review` (or the experimental `/pr-review-dynamic`) outcome posted via the shared warm `post_pr_review` tool: `{ pr, verdict, angles, comment_count, mode, at:ISO }`; best-effort tier (the PR review is the canonical record) |
+| `last_pr_review` | object \| null | the last `/pr-review` (or the experimental `/pr-review-dynamic`) outcome posted via the shared warm `post_pr_review` tool: `{ pr, verdict, angles, covered_angles, comment_count, mode, at:ISO }`; a recorded wave is PR-bound and single-use, and supplies authoritative ordered `angles` / schema-valid `covered_angles`; standalone posting before any valid wave uses caller-supplied angles for both (or `[]`); best-effort tier (the PR review is the canonical record) |
 | `last_review` | object \| null | the last review-door outcome posted via the warm `submit_pr_review` tool: `{ pr, event, comment_count, mode, at:ISO }`; best-effort tier (the submitted PR review is the canonical record) |
 | `session_artifacts` | object \| null | per-name session-artifact provenance pointers `{run_id, name, path, digest, at}` (§8.1); appends carry the **whole merged map** (per-field LWW); strict-append tier |
 | `objective_node_claim` | object \| null | the objective node this session has claimed `planning` (`{ objective, node }`); written by the warm `objective_node` tool on a successful `planning` transition, cleared on a successful non-planning transition for the same node and after a successful node-linked plan save; best-effort tier (cheaply reconstructable; loud-but-non-fatal) |
 | `conflict_resolution_attempts` | number | the bounded conflict-resolution re-drive counter: incremented each time `/submit` drives the `perk.conflict-resolver` subagent on a definitively-unmergeable PR (cap `CONFLICT_RESOLUTION_ATTEMPT_CAP = 2`), reset to 0 on a clean submit; best-effort tier (cheaply reconstructable) |
+| `dream_bundle_digest` | string | the dream-wave finalized-bundle digest marker (§8.61): `""` = invalidated (cleared unconditionally at wave entry, BEFORE the stale-bundle removal attempt — the invalidation record); `sha256:<hex>` = the digest of the current finalized run-scratch bundle bytes, set only after a successful finalize write; the §8.63 dream-report recovery refuses unless the marker is present, non-empty, and byte-matches the bundle just read; per-field LWW, no rebuild change |
 | `perk_version` | string | the running perk (extension) version, stamped when run identity is established (the claim/fork/adopt/mint arms, §8.2) — the session-audit **exact-vintage** basis (the key literal is the cross-plane coordination point; the read side is `perk-dev`'s audit corpus/vintage layer); omitted when only the `perkVersion()` failure sentinel is available; best-effort tier |
 
+Automated PR-review postability is session-local interior state, not an appended workflow-state
+field: `null` permits the backwards-compatible standalone post; valid static/dynamic wave input
+moves immediately to `pending` before target resolution (`review_wave_unavailable` on either
+verdict); every normalized outcome records `{pr, complete, attempted, covered}`; one successful
+post consumes it (`review_wave_consumed` thereafter). Bad wave input preserves the prior state.
+A mutation-time PR mismatch returns `stale_review_wave` and moves back to `pending`; other post
+failures keep the recorded outcome retryable. `last_pr_review` is appended only after the
+mutation succeeds.
+
 **Persistence channel:** `pi.appendEntry("perk:workflow-state", data)`. (The *other* Pi
 channel — tool-result `details` — is for state that *is* a tool's output; this is not that.)
 
@@ -456,10 +547,13 @@ make the engine-required `structured_output` completion call — stripping it fa
 `outputSchema` run with `structuredOutputFailed`) — a static union of foreign
 tool names, inert when a package is absent — plus `run_audit_wave` (the gated audit-judge
 session's wave call: its one write is structurally bound to the cold door's handoff
-`audit_bundle_dir`, §8.50 — no caller-supplied path exists) and `run_harvest_wave` (the gated
+`audit_bundle_dir`, §8.50 — no caller-supplied path exists), `run_harvest_wave` (the gated
 learn-harvest session's wave call: its manifest read is structurally bound to the session's
 claimed run-scoped scratch path, §8.48 — the relayed param is verified against it and any
-other path refused; no worktree writes)) via `pi.setActiveTools`, **snapshot-then-restore** (the restore
+other path refused; no worktree writes), and `run_dream_wave` (the gated learn-dream session's
+wave call: NO parameters — its manifest read AND its one write, the fixed-name run-scratch
+bundle beside that manifest, are both derived from the claimed run's manifest path, §8.61 —
+the no-aimable-writer posture on both sides)) via `pi.setActiveTools`, **snapshot-then-restore** (the restore
 falls back to the full configured `pi.getAllTools()` set — never a hardcoded list); (2) blocks
 `edit`/`write` and non-allowlisted `bash` at `tool_call`. The bash sub-allowlist covers read-only
 inspection commands (read-only `git` queries, `jq`, `curl`, …), read-only `gh` **query**
@@ -597,7 +691,11 @@ create_plan_issue{ title, body, labels[], run_id }  -> PlanIssue{ number, url, e
 add_issue_comment{ issue, body }                    -> CommentResult{ posted }
     # POST repos/{o}/{r}/issues/{n}/comments (the plan-body first comment)
 find_plan_issue{ run_id }                           -> PlanIssue | null
-    # GET repos/{o}/{r}/issues?labels=perk:plan&state=open + header run_id match
+    # GET repos/{o}/{r}/issues?labels=perk:plan&state=open + header run_id match. EXHAUSTIVE on
+    # GitHub: `gh api --paginate --slurp` with per_page=100 scans the FULL open set (never just
+    # the default ~30-row first page — a first-page miss would mint a duplicate issue); the
+    # parameterized learn/gist/objective finders inherit the same scan. An unexpected slurped
+    # page shape raises GitHubError (fail-closed — no partial census).
 update_plan_issue{ number, title, body_comment }    -> PlanUpdate{ number, body_updated, title_updated, dry_run }
     # find the plan-body comment by marker -> PATCH .../issues/comments/{id} (-F body=@file)
     #   (fallback: POST a fresh comment, body_updated:false) ; PATCH .../issues/{n} (-f title=)
@@ -647,12 +745,27 @@ reopen_pr{ number }                                 -> void
 update_plan_header{ issue, fields }                 -> PlanHeaderUpdate{ fields_updated[], dry_run }
     # GET issue body -> merge fields into the plan-header block -> PATCH .../issues/{n}
     # rejects unknown header keys (LBYL on the schema); submit sets branch/pr/lifecycle_stage=impl
+    # MERGE-ONLY on both backends: refuses (before the dry-run return) when the backend's own
+    # storage carries no plan-header for the issue — GitHub: no plan-header body block;
+    # Linear: no plan-header attachment (the old run_id-keyed creation fallback is gone).
+    # Plan-header creation is confined to create_plan_issue, §8.29 adoption, and the Linear
+    # node-plan unification writer (save_node_plan). The refusal rides the backend error
+    # channel (GitHubError/IssueBackendError ⇒ github_error at CLI boundaries) — an invariant
+    # violation of a later-lifecycle write, not a selection error. Malformed-but-present
+    # GitHub shapes keep today's behavior (presence is kind evidence either way): open+close
+    # markers with unparseable YAML merge over {} (block replaced wholesale — an incidental
+    # self-heal); an open marker with no close marker makes replace_metadata_block a no-op
+    # (the write PATCHes an unchanged body while reporting fields updated).
 prepend_plan_callout{ issue, callout, command }     -> bool
     # GET issue body -> plan.prepend_callout(body, callout, command=) -> PATCH .../issues/{n}
     # idempotent on `command`; True iff a write occurred (False when already present / dry-run)
-get_plan{ number }                                  -> PlanState{ number, url, title, header, pr, state } | null
+get_plan{ number }                                  -> PlanState{ number, url, title, header, pr, state,
+                                                                  has_plan_header, has_objective_header } | null
     # gh issue view --json (+ pulls/{n} when the header carries pr); the `perk resume` read.
     # `state` is the issue's OPEN/CLOSED state (the `replan` OPEN guard reads it).
+    # has_plan_header/has_objective_header: presence-only kind evidence from the body's own
+    # metadata blocks (the §8.1 kind guard reads them); a malformed block still reads
+    # header={} with its flag true.
 ```
 
 - **PR body:** `Closes #<issue>` (so the squash-merge closes the plan) + a `Plan: #<issue>` link
@@ -670,24 +783,54 @@ merge_pr{ number, commit_message? }                 -> PullRequest (state MERGED
 - **`Closes #<issue>`** rides in the PR body so the squash-merge closes the plan issue;
   `commit_message` repeats it belt-and-suspenders. Post-merge state is **derived from PR**, never
   stored (Q8).
-- **Stacked lineage refuses before any mutation.** `perk pr land` (and the delegating `/land`)
-  applies the §8.47 routing discriminator — stacked ⟺ the cache plan-ref carries
-  `delivery_lineage` OR the fetched plan header does (**header wins**: a stale cached ref must
-  not silently land a stacked layer) — and refuses fail-closed (`stacked_plan`) before
-  mark-ready/merge: stacked layers land only as one atomic train, never individually.
-  `--dry-run` refuses on the cached ref only (dry-run stays fully offline by contract; the real
-  run enforces the header half).
-- **The pre-merge plan read is load-bearing.** Land fetches the plan (`get_plan`) right after
-  the dry-run early-return, before any mutation: a missing plan fails as `plan_not_found`
-  (submit/ready's exact posture), the header feeds the stacked discriminator, and the squash
-  title rides the same read.
+- **`perk pr land` is a thin mapper over `Delivery.land`.** The command reconstructs the cached
+  plan-ref into one `LandRequest(kind="plan", plan_id, branch, objective_id, consumed_learn,
+  delivery_lineage, dry_run)` and makes exactly one
+  `resolve_delivery(repo_root).land(request)` call — never a consent callback: the plan
+  variant (and the objective dry-run) has no confirmation boundary and the façade rejects
+  one with `ValueError` (consent belongs to the objective mutation, §8.56). The flat
+  kind-guarded request family gives the plan-ref-derived intent fields
+  (`objective_id`/`consumed_learn`/`delivery_lineage`) dataclass defaults — an **accepted
+  residual**: their omission on a plan request is no longer construction-detectable,
+  mitigated because the header-half stacked refusal still protects every real run (only the
+  fully offline dry-run relies on the cached half) and the single production construction
+  site passes every field explicitly under exact-request pins; `plan_id`/`branch` omission
+  stays guard-detectable, and a plan request rejects `run_id` (objective-mutation-only). The
+  façade (engine:
+  `perk.delivery.land_plan`) owns refusal ordering, the mutation protocol, and the
+  finalization dispatch, and returns the strict kind↔detail `LandResult` (nested
+  `PrSummary`/`ObjectiveUpdate`/`LearnUpdate`/`Plan` records — the `--json` envelope maps them
+  field-for-field, byte-unchanged). Façade failures are the bounded `DeliveryError` vocabulary
+  with `phase="land"`: domain refusals (`stacked_plan`, `plan_not_found`, `no_pr`) carry
+  `origin="domain"` and render **bare**; infra failures translate to `github_error` with
+  `origin="github"` and keep the CLI's `PR land failed\n<detail>` prefix (no Git authority
+  call exists on this path, so no speculative `git_error` arm).
+- **Stacked lineage refuses before any mutation.** `Delivery.land` applies the §8.47 routing
+  discriminator — stacked ⟺ the request carries the cached ref's `delivery_lineage` OR the
+  fetched plan header does (**header wins**: a stale cached ref must not silently land a stacked
+  layer) — and refuses fail-closed (`stacked_plan`) before mark-ready/merge: stacked layers land
+  only as one atomic train, never individually. The cached half refuses **before** the dry-run
+  early return (`--dry-run` stays fully offline by contract — zero authority access before the
+  early return, pinned for GitHub and Linear configuration; the real run enforces the header
+  half).
+- **The pre-merge plan read is load-bearing.** Land reads the plan
+  (`DeliveryPersistence.get_plan`) right after the dry-run early-return, before any mutation: a
+  missing plan fails as `plan_not_found` (submit/ready's exact posture), the header feeds the
+  stacked discriminator, and the squash title/url ride the same read.
 - **Deepened squash commit message.** Land passes `merge_pr(commit_message=)` = plain
-  `"<plan title>\n\nCloses #<issue>"` (the title from the hoisted pre-merge plan read, fallback
-  `Closes #<issue>` on an empty title). Plain text only — the second of the **two PR targets**
-  (the GitHub HTML body is the other); HTML never leaks into `git log`.
-- **Post-merge finalization is a reusable delivery seam.** The four durable bookkeeping effects
-  (learn-state stamp §8.36 → explicit plan-issue close → objective reconciliation → learn-issue
-  consume) live in `perk.delivery.finalize.finalize_landed_plan` — **reconstructed inputs only**
+  `"<plan title>\n\n<footer>"` composed façade-side from the **authoritative** `PlanState`
+  title/url + the persistence backend identity (`DeliveryPersistence.backend_id`): GitHub keeps
+  the `Closes #<issue>` footer, non-github backends the `Plan: <id> — <url>` line (fallback to
+  the bare footer on an empty title; one shared implementation with the stacked singleton —
+  `landing.squash_commit_message`). The PR's real `base_ref` is captured **before** the merge
+  (the synthetic merged `PullRequest` carries none; an idempotent re-land still sees it). Plain
+  text only — the second of the **two PR targets** (the GitHub HTML body is the other); HTML
+  never leaks into `git log`.
+- **Post-merge finalization is a package-internal delivery seam.** The four durable bookkeeping
+  effects (learn-state stamp §8.36 → explicit plan-issue close → objective reconciliation →
+  learn-issue consume) live in `perk.delivery.finalize.finalize_landed_plan` — **no public
+  export**; `Delivery.land` binds it through its private land runtime, and stacked
+  landing/recovery keep their module-path bindings. **Reconstructed inputs only**
   (a narrow `LandedPlan` + the captured `pr_base` merge evidence), never the worktree cache, and
   **convergent-final-state idempotency** over the four effects (never-downgrade stamp,
   terminal-node skip, backend-idempotent re-closes; sub-steps may re-issue idempotent backend
@@ -696,7 +839,9 @@ merge_pr{ number, commit_message? }                 -> PullRequest (state MERGED
   never calls `close_objective` — the aggregate objective close is that caller's obligation after
   every layer verifies; incremental land keeps the default. Activity reporting (the Linear agent
   "landed" emission) is worktree-session-scoped and **caller-owned** — it stays in `land_cmd.py`,
-  outside the seam; the pending-learn marker (worktree-cache state) likewise stays in the caller.
+  outside the façade; the pending-learn marker (worktree-cache state) likewise stays in the
+  caller (written after the façade call — the durable §8.36 stamp is the authority; the marker
+  is the local retry signal).
 
 ### Learn ops
 
@@ -711,8 +856,11 @@ create_learn_issue{ title, body, run_id, plan_number } -> PlanIssue{ number, url
     # renders a learn-header block { run_id, created, plan } into the body so the finder matches.
 list_learn_issues{}                                 -> LearnIssueSummary[]{ number, title, url, body }
     # GET .../issues?labels=perk:learn&state=open (the find_plan_issue list call, label-scoped to
-    # perk:learn). Returns every open learn issue's full body for the factory inbox; raises on
-    # infra failure (never masks as empty); skips non-dict / pull_request entries.
+    # perk:learn). Returns every open learn issue's full body for the factory inbox — "every
+    # open" backed by full pagination on GitHub (`gh api --paginate --slurp`, per_page=100;
+    # Linear already cursor-paginates); an unexpected page shape raises (fail-closed, no partial
+    # census). Raises on infra failure (never masks as empty); skips non-dict / pull_request
+    # entries.
 list_plans_pending_learn{ limit }                   -> PendingLearnPlan[]{ id, title, url, closed_at }
     # GET .../issues?labels=perk:plan&state=closed&sort=updated&direction=desc&per_page=<limit>
     # (Linear: terminal-state label query + plan-header attachment decode, paginated then truncated).
@@ -773,9 +921,10 @@ get_pr_review_context{ pr_number, branch, plan_body } -> PrReviewContext{ pr_num
     # (`perk pr review-context`) — the materialized `cache.plan` mirror first, else
     # `IssueBackend.get_plan_body` via the resolver — and passed straight in (best-effort; null
     # lets the review run from the diff). What the spawned child runs.
-    # CLI arm: `perk pr review-context --pr <n>` resolves an arbitrary PR by number (existence +
-    # head ref via `get_pr`, `plan_body` null, clean `pr_not_found` arm); the flagless plan-ref
-    # resolution is byte-identical.
+    # CLI arms: `--pr <n>` resolves an arbitrary PR by number (existence + head ref via `get_pr`,
+    # `plan_body` null, clean `pr_not_found` arm). `--expected-pr <n>` stays on the active-plan,
+    # plan-body-preserving arm and compares the branch-selected target before context fetch;
+    # mismatch is `review_target_changed`. The two flags are mutually exclusive.
 post_pr_review{ pr_number, summary, comments:[{path,line,body,side?}], event? } -> ReviewPostResult{ ok, mode, pr_number, comment_count }
     # ONE atomic review via POST .../pulls/{n}/reviews — comments + body + event land together or
     # not at all. `event` defaults to COMMENT (wire spelling: COMMENT|APPROVE|REQUEST_CHANGES) and
@@ -794,18 +943,41 @@ post_pr_review{ pr_number, summary, comments:[{path,line,body,side?}], event? }
     # `/pr-review`'s parent-side `post_pr_review` tool, which delegates via
     # `perk pr review-post --json --batch <path>` (the reviewer children report findings to the
     # parent; they never post; review-post never passes `event` — hardcoded-COMMENT posture).
+    # A recorded wave adds strict positive `expected_pr` to that batch; the CLI compares it with
+    # the freshly resolved active PR before mutation (`review_target_changed` on drift). Dry-run
+    # validates the field while remaining offline. Standalone batches omit it.
 add_pr_reaction{ pr_number }                        -> void
     # the clean-verdict 👍 (issues-reactions endpoint — idempotent on rerun); a hard error on
     # failure (mutations raise; nothing review-shaped is lost).
 ```
 
-The experimental `/pr-review-dynamic` door shares `post_pr_review`/`review-post` and the clean
-guard unchanged — angle selection is delegated to a fresh `perk.review-angle-selector` lane and
-normalized in module-rendered code (`extension/waves/prReviewDynamicWave.ts`); the baseline
-`/pr-review` stays canonical. The selector picks from the six-slug additional-angle allowlist
+The static `/pr-review` input remains 2–4 selected angles with `plan-fidelity` mandatory. After
+parameter decode the parent invalidates any older report state, resolves the active target once via
+`perk pr url --json`, and binds every child to that number. Its effective manifest is those angles
+followed by exactly one **required automatic** final `ponytail` lane, outside the input menu/cap.
+Every reviewer uses only `perk pr review-context --expected-pr <bound-number> --json`; target drift
+therefore yields no schema-valid report. Ponytail uses the same `perk.pr-reviewer` model, directive,
+timeout, and report schema family, with invocation-private `skill: "ponytail-review"` source-bound
+by the agent's exact package `skillPath`. Perk preflights package name, `pi.skills`, the exact
+readable skill file, and its frontmatter name. A failed preflight never dispatches/spawns that
+child; static report waves additionally omit it from rendered lane items. The keyed non-retryable
+`skill-unavailable` failure retains Ponytail in the logical attempted manifest and leaves it
+uncovered/incomplete; ordinary failed lanes retain the one bounded retry. No same-named
+project/user skill fallback is possible. A normalized result records the bound PR plus explicit
+effective attempted and covered arrays for §8.3's single-use post state.
+
+The experimental `/pr-review-dynamic` door shares the same PR-bound, single-use
+`post_pr_review`/`review-post` state — angle selection is delegated to a fresh
+`perk.review-angle-selector` lane and normalized in module-rendered code
+(`extension/waves/prReviewDynamicWave.ts`); the baseline
+`/pr-review` stays canonical. One Ponytail promise starts independently alongside plan-fidelity
+and the selector, never consumes selector output, and is appended last to `selection.effective`;
+`ponytail` is a reserved custom key and the lane remains outside the selector cap. The selector
+picks from the six-slug additional-angle allowlist
 (`correctness`/`tests`/`quality`/`api-design`/`code-organization`/`idioms` — the shared
 seven-angle vocabulary minus the structural `plan-fidelity`), capped at 3 additional angles
-(2–4 lanes total, the same window as `/pr-review`; `force_angles` takes 1–3 slugs, merged
+(2–4 selectable lanes, the same window as `/pr-review`, plus automatic final Ponytail;
+`force_angles` takes 1–3 slugs, merged
 forced → picks → custom). The selector may additionally propose AT MOST ONE change-specific
 custom angle: validated deterministically in the module-rendered normalization (kebab-case slug
 3–32 chars, not a reserved lane key, whitespace-collapsed non-empty scope ≤ 300 chars; an
@@ -813,10 +985,21 @@ invalid proposal degrades to no-custom, never a failed selector lane), its lane
 a fixed scope-definition-only template (the one sanctioned exception to "reviewer tasks come
 only from the embedded vocabulary"), its per-item report schema locked to echo the custom slug,
 and the lane retryable through the per-lane `outputSchema` seam on `WaveLane`; the
-correctness+tests fallback fires only with zero valid picks AND no valid custom. Both wave
-tools (`run_pr_review_wave`, `run_pr_review_dynamic_wave`) persist ordered attempt receipts in
-their tool-result details (observability only — §8.35's output-free receipt contract; the clean
-guard and completeness are unchanged).
+correctness+tests fallback fires only with zero valid picks AND no valid custom. Dynamic Ponytail
+uses the same source-bound preflight/non-retryable failure semantics as static review; its
+pre-launch receipt manifest is `plan-fidelity`, `angle-selector`, `ponytail`, and a pre-selection
+failure still records the deterministic attempted reviewer manifest `plan-fidelity`, `ponytail`.
+The selector, plan-fidelity, Ponytail, fixed/custom fan-out, and static retry tasks all carry the
+same parent-resolved expected PR. Both wave tools persist ordered attempt receipts in their
+tool-result details (observability only — §8.35's output-free receipt contract; completeness is
+unchanged).
+
+**Residual source-binding race.** Source-bound waves perform one exact-path preflight per pass and
+each Ponytail child makes the exact file/frontmatter check its first action. Perk cannot atomically
+pin upstream package name resolution between those reads; package files are assumed stable for the
+short pass. If a file changes or disappears after preflight, the child terminates without a
+schema-valid report, so Ponytail remains uncovered and the wave incomplete—never accepted as
+coverage from another source.
 
 ### PR-review toolbox ops (checkout / cleanup / review-submit)
 
@@ -971,12 +1154,18 @@ prompt; the contracts pin the output shape, not the judgment rubric.
 - **Input (per-spawn task prompt):** the assigned angle, the PR number, and the absolute path to
   the detached read-only head worktree (the checkout above). The child fetches its own context
   via `perk pr review-context --pr <n> --json` (`plan_body` may be null).
-- **Angles** (one per spawn; the adversarial menu is exactly these four — `pr-reviewer`'s
-  autonomous menu is wider, seven fixed angles plus the dynamic flow's custom lane): `claimed-intent` (the PR text's claims
-  checked against the diff, plus a first-class hunt for **undisclosed scope**; the parent always
-  includes this angle) · `correctness` (incl. the untrusted-code supply-chain axes: CI/workflow
-  edits, dependency pins, install/build scripts, secrets handling, obfuscated code) · `tests`
-  (adequacy by reasoning only) · `quality`.
+- **Angles** (one per spawn; the adversarial selectable menu is exactly these four —
+  `pr-reviewer`'s autonomous menu is wider, seven fixed angles plus the dynamic flow's custom
+  lane): `claimed-intent` (the PR text's claims checked against the diff, plus a first-class hunt
+  for **undisclosed scope**; the parent always includes this angle) · `correctness` (incl. the
+  untrusted-code supply-chain axes: CI/workflow edits, dependency pins, install/build scripts,
+  secrets handling, obfuscated code) · `tests` (adequacy by reasoning only) · `quality`. Every
+  PR-backed adversarial wave appends exactly one **required automatic** final `ponytail` lane
+  outside the 2–3 selection cap, using the same model/directive/report schema plus
+  invocation-private `ponytail-review` from the exact package `skillPath`.
+  Package/file/frontmatter preflight failure never dispatches/spawns that child, records
+  non-retryable `skill-unavailable`, and leaves it uncovered without fallback; after successful
+  preflight, the child's first-action recheck enforces the residual source-race posture above.
 - **Posture:** all fetched text is untrusted DATA, and the PR title/body are **unverified claims
   by the PR author** (an author not trusted by default) — checked against the diff, never built
   on. **Never-execute-the-head:** inside the head worktree the child uses
@@ -1040,13 +1229,14 @@ pieces; a neutral re-home is a deferred residual).
   (2–3 unique angle slugs, `claimed-intent` mandatory), the `pr`/`worktree` relayed verbatim
   from the guidance and the operator focus passed verbatim as `directive` — and the tool renders
   and launches the wave itself, NON-BLOCKING (module-owned mechanics; the model never authors
-  workflowScripts): one fresh-context `perk.adversarial-reviewer` lane per angle, a task naming
-  the angle, the PR number, and the worktree path ONLY — the surface handle is structurally
-  unrepresentable (no URL parameter exists). The tool resolves the
-  `[models.subagents] adversarial-reviewer` override at execute time (the doors read no config);
-  a pending (launched, uncollected) wave makes a second start refuse `wave_active`; a launch
-  failure is a LOUD soft-fail (`error_type` = the wave reason) with no retry — ZERO retries by
-  design, honest incompleteness. The parent then holds the model-held
+  workflowScripts): one fresh-context `perk.adversarial-reviewer` lane per selected angle, then
+  the automatic final source-bound Ponytail lane, each task naming the angle, the PR number, and
+  the worktree path ONLY — the surface handle is structurally unrepresentable (no URL parameter
+  exists). The effective manifest/receipts/coverage denominator is selected + Ponytail. The tool
+  resolves the `[models.subagents] adversarial-reviewer` override at execute time (the doors read
+  no config); a pending (launched, uncollected) wave makes a second start refuse `wave_active`; a
+  launch failure is a LOUD soft-fail (`error_type` = the wave reason) with no retry — ZERO retries
+  by design, honest incompleteness. The parent then holds the model-held
   `subagent_wait({ timeoutMs })` relay loop — unchanged as the streaming cadence: progress
   updates never wake `subagent_wait` and never enter pi-subagents' `pending` map — delivery is
   an injected (`triggerTurn`-bearing) message when a tool call returns — so the timed wait loop
@@ -1374,8 +1564,8 @@ resolution fallback (and the `worktree wipe` guard).
 
 The objective tier's full storage contract lives in **§8.24** (the `ObjectiveStore` seam); the
 mechanics live in `src/perk/objective/` + `src/perk/backends/github/objectives.py`, the land-path
-handlers in `src/perk/cli/commands/pr/land_cmd.py` + `src/perk/delivery/finalize.py`. The
-gateway-level facts:
+handlers in `src/perk/cli/commands/pr/land_cmd.py` (via `Delivery.land`) + the package-internal
+`src/perk/delivery/finalize.py`. The gateway-level facts:
 
 - **Storage blocks (perk-namespaced, schema 1).** An objective is an issue + first comment:
   `objective-header` (issue body — compact, queryable: `{ run_id, created, objective_comment_id,
@@ -1539,7 +1729,10 @@ pin + the report-only `cli-version` CLI-vs-repo-pin warning (warn, never fail) +
 fail, no `--fix` arm — §8.6a) + the report-only `subagent-compat` pi-subagents surface probe
 (installed version + source-file markers for the orchestration surfaces perk's guidance assumes;
 `info` when not installed; warn on divergence, never fail; no `--fix` arm — the package stays
-unpinned) + the report-only `subagent-bridge-config` check (reads
+unpinned) + the report-only `ponytail-compat` exact package/`pi.skills`/two-skill-file/frontmatter
+probe (`info` when the lazy install is absent; warn on divergence, never fail; no `--fix` arm because
+operator pins are preserved; known-good remediation `npm:@dietrichgebert/ponytail@4.9.0` +
+`perk init` + session restart) + the report-only `subagent-bridge-config` check (reads
 `subagents.intercomBridge.mode` from the project `.pi/settings.json` and the user-global
 `~/.pi/agent/settings.json`; warns — never fails, no `--fix` arm — when either scope sets
 `"off"` or `"fork-only"`, either of which silently disables the supervisor channel perk's
@@ -1567,9 +1760,15 @@ Keeping a consumer's pi-loaded perk extension runnable rests on two invariants:
   own `packages` entry **in place** (list position preserved) when its `@mgiles/perk` identity already
   exists but the full spec differs from the desired pin — so a stale `npm:@mgiles/perk@0.0.0` is
   reconciled to `@{__version__}` (extra string duplicates of that identity collapse to one). Only
-  perk's own npm identity is version-reconciled; the borrowed npm packages stay unpinned/append-only
-  (distinguished by `_npm_name` identity vs `_npm_name(NPM_PACKAGE)`), and a user's other packages
-  are never in the desired set so they stay untouched/append-only. The in-body migration strips a
+  perk's own npm identity is version-reconciled; borrowed npm packages normally stay
+  unpinned/append-only (distinguished by `_npm_name` identity vs `_npm_name(NPM_PACKAGE)`), and a
+  user's other packages are never in the desired set so they stay untouched/append-only. The one
+  managed-filter exception is `npm:@dietrichgebert/ponytail`: desired settings always carry one
+  object entry with `extensions`/`skills`/`prompts`/`themes: []`. Reconciliation chooses the first
+  object donor else first match, preserves its exact source pin, non-filter metadata, position
+  relative to unrelated entries, forces all four filters empty, converts a string donor, and drops
+  duplicate identities. Managed-state health canonicalizes a correctly filtered donor to npm
+  identity while ignoring pin/metadata; any omitted or nonempty managed filter is drift. The in-body migration strips a
   repo's legacy **`git:` perk** entry (any ref, **any entry form** — by
   `_package_identity == GIT_PACKAGE`, covering a user-rewritten object-form entry) so the flip from
   the old git wiring converges; a user's unrelated `git:` packages are preserved. **Presence is
@@ -1760,6 +1959,7 @@ perk's workflow skills are prompt-hidden; `transclude` exists for the user-bindi
 | `command:learn-docs` | `perk-learn-docs` | `nudge` |
 | `command:learn-code` | `perk-learn-code` | `nudge` |
 | `command:learn-harvest` | `perk-learn-harvest` | `nudge` |
+| `command:learn-dream` | `perk-learn-dream` | `nudge` |
 | `command:pr-review` | `perk-pr-review` | `nudge` |
 | `command:pr-review-dynamic` | `perk-pr-review-dynamic` | `nudge` |
 | `command:pr-review-terminal` | `perk-pr-review-terminal` | `nudge` |
@@ -1834,15 +2034,18 @@ The **cross-plane dedup marker is the render header itself** — `BINDING_HEADER
 byte-for-byte to the cold `_HEADER` (Python) by a literal test in **both** planes. The cold door
 already puts `stage:<id>` bindings in a cold-launched session's **initial prompt**, and
 `before_agent_start` fires for that same session, so Mechanism A injects **iff** a launched `stage`
-exists, the resolved render is non-empty, no entry on `ctx.sessionManager.getBranch()`
+exists, the resolved render is non-empty, no entry in the branch's **compaction-active window**
 already carries `BINDING_HEADER` (the cold prompt OR a prior warm inject), **and** the submitting
-turn's prompt (`event.prompt`) does not carry it either. The prompt scan is load-bearing on the
+turn's prompt (`event.prompt`) does not carry it either. Before compaction the active window is the
+full branch; after compaction it begins at the latest compaction's `firstKeptEntryId`, excludes
+compaction entries themselves, and includes later entries. This distinction is load-bearing because
+Pi's branch is append-only: historical entries remain readable after they leave model context, and a
+compaction summary quoting the header is not a live delivery. The prompt scan is load-bearing on the
 launch turn: at `before_agent_start` the just-submitted prompt is **not yet** on the branch, so the
 branch scan alone missed the cold seed on that turn and double-delivered (the fixed hole). The
-injected custom and the
-cold prompt both carry the header → idempotent across turns/reloads; after compaction drops the
-original the header disappears and it **re-delivers** (its ongoing value — later prompts don't
-carry the header, so the prompt scan stays inert there). Mechanism B is a one-shot
+injected custom and the cold prompt both carry the header → idempotent across turns/reloads; after
+compaction drops the original from the active window it **re-delivers** (its ongoing value — later
+prompts don't carry the header, so the prompt scan stays inert there). Mechanism B is a one-shot
 `sendUserMessage` suffix at an invocation distinct from any cold launch, so it cannot auto-double. A
 narrower-than-`planMode` `context` strip removes a **stale** `perk:binding-context` custom (stage
 changed / overlay removed) while **never** stripping a user message that carries the header (a cold
@@ -2632,12 +2835,14 @@ so `init` writes them and `doctor` verifies/repairs them through the one shared
   **`gh auth setup-git`** before invoking
   `perk run-worker` — it installs `gh` as git's https credential helper using the step's
   `GH_TOKEN` (= `PERK_GH_PAT`), so the skills CLI's sync during positioning (step 4 below) can
-  clone private skill sources. A final **`Upload run diagnostics`** step (`actions/upload-artifact@v4`) uploads
-  `.perk/workflow/scratch/runs/<run_id>/` — the §8.12 durable run-event stream (`events.ndjson`
-  and friends), which is otherwise written into the runner's checkout and lost at teardown — as
-  artifact `perk-run-<run_id>` for **every real run, pass or fail**
-  (`if: always() && inputs.smoke != 'true'`, `if-no-files-found: ignore`; smoke runs write nothing
-  and upload nothing). An opt-out repo variable `PERK_ENABLED=false` disables the job without
+  clone private skill sources. A final **`Upload run diagnostics`** step (`actions/upload-artifact@v4`)
+  uploads `.perk/workflow/scratch/runs/<run_id>/` — the §8.12 durable run-event stream
+  (`events.ndjson` and friends), which is otherwise written into the runner's checkout and lost at
+  teardown — as artifact `perk-run-<run_id>` for **every real run, pass or fail**. The upload sets
+  `include-hidden-files: true` so the hidden `.perk` tree is actually retained, and its multiline
+  path excludes `!.perk/workflow/scratch/runs/<run_id>/agent/**` so model-authored agent scratch is
+  never retained remotely (`if: always() && inputs.smoke != 'true'`, `if-no-files-found: ignore`;
+  smoke runs write nothing and upload nothing). An opt-out repo variable `PERK_ENABLED=false` disables the job without
   removing the file. **Auth model:** checkout + push use the `PERK_GH_PAT` PAT, **not** `github.token` — a
   PAT-pushed commit triggers downstream CI (the implement drive commits + `submit` pushes);
   `GITHUB_TOKEN`-pushed commits do not. This is a stated decision Node 2.4 inherited (the
@@ -3483,6 +3688,32 @@ one-stop current shape.
   (`ok:false` + `error`/`error_type` on unavailable / save-failed / bad_input / no_plan /
   no_objective_draft; `ok:true` on verdicts and the sanctioned fail-open skips), so `tool_outcome`
   run events classify it via `details.ok` rather than the `!isError` fallback.
+
+  **The launch chooser (the plannotator arms' wave opt-in).** The moment `plan_review`
+  dispatches to a plannotator arm on an **eligible** round — the injected `WaveLaunch` deps
+  present (the plannotator presence probe + the two door open cores, composed at the
+  `registerPlanReview` call site in `extension/index.ts`; the factory imports nothing from door
+  modules), plannotator loaded, and the review source a **validated draft artifact** (plan arm:
+  `source === "plan-draft"`; objective arm: a non-null raw `objective-draft.json` baseline
+  captured **before** the validated read — the door's fail-closed stale-guard ordering) — an
+  in-TUI chooser is shown BEFORE anything launches: "Browser review + reviewer wave" vs
+  "Browser review only". Shown **every** eligible round (no config key); Esc/dismiss selects the
+  plain flavor (the chooser picks a flavor, never cancels the review); **abort outranks Esc,
+  every dialog result, and the awaited opener** (`signal?.aborted` is checked at entry,
+  re-checked immediately after each awaited dialog before interpreting it, and re-checked after
+  the awaited open core — an interrupted turn never reports a launched wave). The wave choice collects an optional **trimmed**
+  custom review angle (Esc/blank ⇒ none) and delegates to the door-shared open core
+  (`openPlanReviewSurface` / `openObjectiveReviewSurface`), returning the **non-terminating**
+  `details.status: "wave_launched"` result (`subject: "objective"` on the objective arm)
+  carrying the door's guidance **verbatim** — the model launches the wave in the same turn, and
+  the human's browser decision routes back through the door's background decision task (stale
+  guards, degrade token, untrusted-feedback delimiting — all the door's existing code, shared
+  not duplicated). A **synchronous port-pick failure** (a null core return, loudly reported
+  there) falls **open** to the plain blocking review in the same call; an **asynchronous**
+  readiness degrade follows the door's existing loud degrade path and recovers through the next
+  `plan_review` round's chooser ("Browser review only" is one keystroke away — no forced-wave
+  mode exists). Ineligible rounds — a param-tier source, plannotator absent, no injected deps,
+  or the gist arm (no gist wave door exists) — keep today's plain blocking review silently.
 - **The three backends.** All three speak review-first
   (`plan_draft` → `plan_review` → auto-save on approval):
 
@@ -3492,6 +3723,11 @@ one-stop current shape.
   | `plannotator-plan` | `PLAN_ADAPTER_PLANNOTATOR_CONTEXT` | browser bridge | present + `/plan-save` |
   | `tombell-plan` | `PLAN_ADAPTER_TOMBELL_CONTEXT` (conditioned injection, Node 2.6) | first-party in-TUI review | present + `/plan-save` (incl. tombell's own interactive `/plan` `setActiveTools` restriction arm) |
 
+  Under the plannotator selection the authoring context is **flavor-dispatched per stage** (one
+  customType, three contents — §8.42's per-flavor marker dedup): the plan flavor by default, the
+  **objective** flavor in **both** objective stages (`objective-author` **and** `objective-save`
+  — matching `plan_review`'s objective-arm stage routing), and the gist flavor in `gist-author`.
+
 - **Plannotator "Direct Edits" (browser edits of the reviewed document).** Plannotator's
   plan-review browser lets the reviewer edit the reviewed document directly; the edits arrive as
   PROSE inside the existing `feedback` string, never a new envelope field — a `# Direct Edits`
@@ -3553,6 +3789,13 @@ one-stop current shape.
     against a code-review server) → the prior env value ALWAYS restored when the poll ends. The
     URL is deterministic the moment the port is picked, so the door primes its companions and
     injects the guidance immediately, then ends its turn.
+  - **The shared open core:** the door's whole open path is the exported guidance-RETURNING
+    core `openPlanReviewSurface` (start the browser → prime both surfaces → the background
+    readiness + decision tasks → return the composed guidance string, or null on the loudly
+    reported port-pick failure); the command handler is a thin `sendUserMessage` wrapper, and
+    `plan_review`'s wave arm consumes the SAME core — one open path, byte-identical semantics
+    (the `applyPlannotatorDirectEdits` sharing precedent). The wave-arm guidance carries the
+    same `command:plan-review-browser` skill-binding suffix.
   - **The dual prime/clear lifecycle:** the moment the port is picked the door primes BOTH
     companion surfaces — `primeAnnotationSurface({mode: "plan", url})` (the `push_annotations`
     plan mode, §8.4) and `primeDraftReviewContext({draftType: "plan", draft, custom?})`
@@ -3569,12 +3812,21 @@ one-stop current shape.
     construction. The **custom lane is the draft doors' user-input channel** (no `directive`
     param exists), riding the primed context automatically as its own `custom` lane; the
     surface handle is structurally unrepresentable in the wave (no URL parameter exists).
-    **Zero retries** — honest incompleteness surfaced to the human (the uncovered lane(s)
-    named, never papered over); a pending wave makes a second start refuse `wave_active`;
-    `collect_draft_review_wave` mirrors the PR pair (`no_wave` / grace-raced `wave_running`
-    with the pending wave retained / the typed aggregate `{complete, covered, reports,
-    failures}`, `covered` including the custom lane). The `[models.subagents] draft-reviewer`
-    override is resolved by the tool at execute time (the door reads no config); the per-call
+    After selected lanes and the optional custom lane, the tool appends exactly one **required
+    automatic** final `ponytail` lane outside both menus/caps. It uses the same
+    `perk.draft-reviewer` model,
+    timeout, and report schema with invocation-private `skill: "ponytail"` source-bound by the
+    agent's exact package `skillPath`; package/file/frontmatter preflight failure omits only that
+    child, records non-retryable `skill-unavailable`, and leaves it in the requested manifest but
+    uncovered, with no same-name fallback. The child's first action rechecks the exact source;
+    post-preflight instability therefore yields no report and remains incomplete under the
+    residual source-race posture above. **Zero retries** — honest incompleteness surfaced to
+    the human (the uncovered lane(s) named, never papered over); a pending wave makes a second
+    start refuse `wave_active`; `collect_draft_review_wave` mirrors the PR pair (`no_wave` /
+    grace-raced `wave_running` with the pending wave retained / the typed aggregate `{complete,
+    covered, reports, failures}`, `covered` ordered across selected + optional custom + Ponytail).
+    The `[models.subagents] draft-reviewer` override is resolved by the tool at execute time (the
+    door reads no config); the per-call
     signal is deliberately not threaded (the wave outlives the call; the module timeout is the
     orphan insurance). Findings are the plan-mode `PlanFinding` shape (`{phrase, severity,
     confidence, body}`), pushed phrase-byte-exact via `push_annotations` (streamed batches
@@ -3635,6 +3887,11 @@ one-stop current shape.
     `plan-review` bridge action carries the rendered objective as `planContent` (arbitrary
     markdown bytes; no plan-specific validation). The door primes its companions and injects
     the guidance immediately, then ends its turn.
+  - **The shared open core:** identical — the exported guidance-RETURNING core
+    `openObjectiveReviewSurface` with the command handler as a thin `sendUserMessage` wrapper;
+    `plan_review`'s objective wave arm consumes the SAME core — one open path, byte-identical
+    semantics — and the wave-arm guidance carries the same `command:objective-review-browser`
+    skill-binding suffix.
   - **The dual prime/clear lifecycle:** identical — `primeAnnotationSurface({mode: "plan",
     url})` + `primeDraftReviewContext({draftType: "objective", draft: rendered, custom?})`;
     both cleared when the bridge settles AND on the readiness-degrade arm (idempotent).
@@ -4068,6 +4325,61 @@ Reconcilable region markers, the `Adopted-from` archive note, and the copyable c
   plan-header)`, Linear the plan-header attachment), consumed by `plan from`'s `already_a_plan`
   refusal.
 
+**Objective #1892 Node 1.1 amendment — objective `origin` + the open-by-origin lookup.**
+Additive, store-tier only (no CLI flag, no extension/TS change): machine-created objectives carry
+a provenance stamp, and the store tier can answer "is an open objective with this origin already
+live?" authoritatively — the foundation for the dream-launch guard and the save-time conflict
+re-check (the guard's first save-time consumer is the §8.64 dream save door).
+
+- **The `origin` header field.** A **closed vocabulary** (`objective.ObjectiveOrigin`, a
+  `StrEnum`; first value `learn-dream`), stored as a `str` in the `objective-header` (typed like
+  `status`/`delivery`, the enum is the domain vocabulary). **Absence-compatible:** rendered only
+  when set (the §8.42 additive-field rule) — every existing objective and every origin-less
+  create/supersede renders byte-identically. **Launch-owned:** never model- or human-supplied —
+  the launch flow injects it from claimed machine state; no interactive surface passes it.
+- **Write surface = create + the supersession carry, structurally enforced.** `origin` is stamped
+  atomically into the INITIAL header by `create_objective(origin=…)` (never create-then-merge),
+  and both live stores' `supersede_objective` automatically carry the predecessor's stored origin
+  into the successor header (store-side, no parameter; validated — a junk stored value raises
+  BEFORE the successor create; a header-less/sentinel-less predecessor carries nothing).
+  `origin` is deliberately **excluded from `OBJECTIVE_HEADER_FIELDS`**, so the three
+  `update_objective_header` writers reject any post-create origin merge via their existing LBYL
+  check — while a stored origin round-trips untouched through unrelated merges (all three
+  writers merge into the *parsed existing* mapping). The dormant issue-backed store's
+  `create_objective` still stamps origin (it composes a real header); `adopt_source_as_objective`
+  never stamps one (a machine-originated objective is never adopted-from).
+- **The `origin_value` validator** (`objective/parse.py`): `None` → `None`; a value in the closed
+  vocabulary → the enum; **anything else raises `ValueError`** (fail-closed on junk/tampering,
+  mirroring `delivery_policy`). Stores translate the `ValueError` into their native error at the
+  boundary. (The header-dict origin classifier — the `delivery_policy` twin — is deferred to the
+  first node that reads a specific objective's origin.)
+- **`find_open_objective_by_origin(origin, exclude_run_id=None) → ObjectiveRef | None`**
+  (declared after `find_objective`): the first **open** match whose header `run_id` ≠
+  `exclude_run_id` (`existed=True`); `None` means *authoritatively none in the exhaustively
+  enumerated open population*. `exclude_run_id` is the caller-exclusion that makes a save-time
+  re-check sound with a single-ref API (the consumer excludes its own run; any returned ref IS a
+  conflict); a candidate with a missing/non-str `run_id` is never treated as excluded
+  (fail-closed). **Exhaustive-or-raise:** an infra failure raises; a **present-but-malformed**
+  header block/attachment raises (uncertainty about a real objective never reads as
+  authoritatively-none); an origin outside the closed vocabulary raises (via `origin_value`);
+  absent/different-known origins are non-matches (skip); the enumeration covers the full relevant
+  open population — never one bounded page. A store that cannot answer authoritatively must
+  RAISE, never return `None`.
+- **Per-store scope.** GitHub: **all pages** of the open `perk:objective` label population
+  (a new paginated `_list_label_issues_all_pages` sibling; the bounded default-page reads are
+  untouched). Linear project store: **team-scoped in v1** (a cross-team origin-stamped objective
+  is invisible — documented limitation) — every team project swept via its metadata **sentinel**
+  (the sentinel IS the identity; never the Reconcilable-marker heuristic); a sentinel-less
+  project is skipped (the same accepted create-crash window as `find_objective`); a surviving
+  match costs one project-state read (`completed`/`canceled` ⇒ closed, anything else including
+  missing ⇒ open). The dormant issue-backed Linear store **raises**
+  (`"the issue-backed Linear objective store does not support origin lookups"`) — deliberately
+  OUTSIDE the `→ None`/`→ False` no-op family, which would falsely assert authoritatively-none
+  and silently open a fail-closed guard.
+- **Closed under replan.** The supersession carry keeps the guarded origin population closed
+  across re-authoring; during a deferred-close transfer window (§8.53) both predecessor and
+  successor are visibly origin-stamped, so a concurrent origin-guarded launch correctly refuses.
+
 ## §8.25 · The human-engagement read contract (Objective #682, Node 1.2)
 
 A backend-neutral **READ** surface for human engagement — comments, description edits, and
@@ -4340,9 +4652,11 @@ are verbatim human content". A normally-authored plan leaves it `None`.
 (mirrors `replan`/`resume`; `from` is a valid Click command string). It performs every Linear/GitHub
 read up front (the read-only plan-mode session has no `gh`/Linear access), then re-launches the
 `plan` stage seeded to author a plan over the materialized source. It **refuses** when: the issue is
-not found (`adopt_not_found`), not OPEN (`adopt_not_open`), or already a perk plan
+not found (`adopt_not_found`), not OPEN (`adopt_not_open`), already a perk plan
 (`AdoptableIssue.already_plan` — backend-decided: GitHub the body block, Linear the plan-header
-attachment → `already_a_plan`, hinting `perk plan replan <id>`).
+attachment → `already_a_plan`, hinting `perk plan replan <id>`), or a perk **objective**
+(`AdoptableIssue.already_objective` — presence-only, backend-decided like `already_plan` →
+`issue_kind_mismatch`; the GitHub message names the right door, `perk objective plan <N>`).
 Engagement is read fail-soft (`render_adopted_engagement` → `<untrusted_adopted_issue_engagement>`;
 `IssueBackendError` → omitted). The source is materialized to `scratch/adopt-<issue_id>.md` (title +
 body wrapped in `<untrusted_adopted_issue>` + the optional engagement block). A **fresh** `run_id`
@@ -4365,6 +4679,17 @@ prints the header/body (now including `adopted_from`) without writes.
 `adopted_from` plan-header field; `doctor` does **not** rewrite or validate the human prose/title —
 the substantive deliverable is this contract section, not a new validating check.
 
+**Wrong-kind refusal at the writer (the mutation boundary).** `adopt_issue_as_plan` itself
+refuses an **objective-metadata carrier** before its first mutation, on both backends — GitHub:
+an `objective-header` body block on the source read it already performs; Linear: an
+`objective-header` attachment (one extra presence-only read on this rare mutation) — raising the
+backend error (“wrong kind for plan adoption”). This closes the `perk plan save --adopt-from`
+direct-invocation bypass and the door-gather→save race window; the door's `already_objective`
+refusal above is the friendlier typed UX layer over the same rule. **Gists are exempt** in both
+directions: a gist carries `gist-header`, so no refusal fires and the sanctioned
+plan-header-beside-gist-header stamp keeps working. Residual: the writer's read→PATCH race
+window is inherent to non-transactional backends (accepted).
+
 **Backend parity.** Honest on **both** GitHub and Linear (+ clean fake conformers). Live validation
 is a preview-grade observation here (Mode 7); final live
 proof is node 4.3.
@@ -4463,6 +4788,10 @@ reconcile. Mapped issues' titles/bodies are independently preserved verbatim by
 `adopt_not_found` (source `None`); GitHub-only `adopt_not_open` (the source issue is CLOSED, via the
 issue tier's `read_issue.state` — skipped for Linear projects, which have no OPEN/CLOSED);
 `already_an_objective` (the source prose already carries an `objective-header` block);
+GitHub-only `already_a_plan` (the source issue carries perk's plan metadata —
+`read_issue.already_plan`, checked in the same issue-tier read arm as the OPEN check; the
+message points at `perk plan replan <id>` or a fresh objective; Linear sources are Projects
+with no issue-tier read — honestly skipped, matching the OPEN check's scoping);
 `adopt_unsupported` (a `None` adoption return — in practice the resolver never returns the dormant
 store). Project-level engagement is read fail-soft (`render_adopted_engagement(comments, ())` →
 `<untrusted_adopted_issue_engagement>`; `ObjectiveStoreError` → omitted; per-issue engagement is
@@ -4483,6 +4812,14 @@ produces a fresh perk objective, `existed=False`). `--dry-run` falls through to
 `create_objective(dry_run=True)` compose-preview (the writer returns `None` on dry-run). No
 mutual-exclusion guard is needed (`objective create` has no `--node-id`).
 
+**Wrong-kind refusal at the writer (the mutation boundary).** GitHub
+`objectives.adopt_issue_as_objective` (the `adopt_source_as_objective` substrate) refuses a
+**plan-header carrier** before any mutation, keyed on the source body it already reads
+(“wrong kind for objective adoption”) — closing the `objective create --adopt-from` direct
+bypass, symmetric with §8.29's writer guard. The Linear **project** store adopts Projects (no
+issue-tier carrier — nothing to guard); the dormant issue-backed Linear store's adoption writer
+is out of scope. Gists stay exempt (a gist carries `gist-header`).
+
 **Backend parity.** Honest on **both** GitHub and Linear (+ clean fake conformers). Live validation
 is preview-grade here (Mode 8); final live proof is Node
 4.3 — no new config key, provider seam, or `EXPECTED_SURFACE` change (a flag, not a new
@@ -4523,8 +4860,9 @@ nothing, the subset being shared).
   `prompts/contexts/adapters/` — with each module's identity marker passed as the `{{ marker }}`
   render var (never a template literal), so the marker the strip handler scans for cannot drift
   from the injected prose; the marker-as-render-var invariant now serves both the strip **and**
-  the dedup key (plannotator's two flavors share one customType but dedup per-flavor on their
-  distinct markers).
+  the dedup key (plannotator's three flavors — plan / objective / gist, the objective flavor
+  serving both objective stages — share one customType but dedup per-flavor on their distinct
+  markers).
 
 **Fail loudly on a missing var.** jinja2 uses `StrictUndefined` (raises `jinja2.UndefinedError`);
 the vendored `miniJinja` renderer matches it — a referenced name that is **absent OR non-string**
@@ -4609,6 +4947,13 @@ Everything outside (1)–(4) is **outside the subset** — `{% for %}`/`{% endfo
 with an allowlist posture (fail on any block matching no recognized construct):
 `tests/test_prompt_grammar.py` (Python) and `extension/substrate/promptGrammar.test.ts` (TS).
 `shared/contracts.md §8.31` is the SSOT for the shared scan algorithm; the two guards mirror it.
+The Python guard's scanner implementation lives in `perk_dev.prompt_grammar.scan_template`
+(consumed by both `tests/test_prompt_grammar.py` and the prose-review Assembly preview gate) and
+scans **whole-source** — unterminated, multiline, stray, nested, or partially matched delimiters
+are violations rather than unexamined text. That lexical completeness is a deliberate Python-side
+narrowing relative to the TS runtime tokenizer (`miniJinja.ts` accepts multiline tags and treats
+stray closers as literal text); the frozen construct set, the TS guard, and both runtime
+renderers are unchanged.
 The guard checks **construct membership only**, not if/endif nesting balance — structural balance
 is already proven by the golden harness rendering every real template. Widening the subset later
 (e.g. a future template needing `in` or parentheses) is a deliberate decision that amends this
@@ -4632,9 +4977,12 @@ create-new shape sidesteps that gap. The structural siblings are §8.27 (replan
 stage) that *borrows* the `objective-author` stage for launch (exactly like `plan replan` borrows
 `plan` and `objective author --from` borrows `objective-author`). It mints a **fresh** `run_id`
 (the new objective is net-new — no `run_id_override`), refuses `--remote` (objective-author is
-`cold_remote:false`), and refuses a not-found / already-superseded / non-OPEN (GitHub) objective
-(`objective_not_found` / `objective_not_open`). `("replan", ())` joins the `objective` group in the
-parity-smoke `EXPECTED_SURFACE`.
+`cold_remote:false`), and obtains its one-snapshot title/URL/nodes plus delivery constraints from
+`Delivery.prepare(PrepareRequest(kind="replan", objective_id=...))`. Prepare owns not-found,
+already-superseded, non-open, fail-closed policy, journal, train, and claimed-prefix checks; the
+command retains the objective store only for fail-soft engagement/prose reads and backend wording.
+Refusals remain `objective_not_found` / `objective_not_open` and the §8.53 codes. `("replan", ())`
+joins the `objective` group in the parity-smoke `EXPECTED_SURFACE`.
 
 **The carry model.** Only the **unfinished** nodes carry forward (status ∈ {`pending`, `planning`,
 `in_progress`, `blocked`}); `done`/`skipped` nodes stay as **history on the closed old objective**
@@ -4676,11 +5024,12 @@ node-issues), `False` from the dormant issue-backed store (the no-op-family sign
 `supersede_objective(close_predecessor=True)` wraps it fail-open — one implementation, two
 postures.
 
-**Transfer-aware routing.** The `--supersedes` dispatch performs §8.53's D1 classification
-read first: only incremental→incremental takes the plain mutation above; a stacked
-predecessor — or an incremental→stacked conversion — routes through the §8.53 transfer
-protocol (which owns lineage copy-or-mint, prefix preservation, ownership transfer, deferred
-close, and verification).
+**Transfer-aware routing.** Every real `--supersedes` save submits one immutable
+`TransferRequest` to `Delivery.transfer`. The façade acquires the shared operation lock before its
+single authoritative D1 predecessor read/classification and holds it through the selected
+mutation. Only incremental→incremental takes the plain mutation above; a stacked predecessor —
+or an incremental→stacked conversion — routes through the §8.53 transfer protocol (which owns
+lineage copy-or-mint, prefix preservation, ownership transfer, deferred close, and verification).
 
 **Backend-specific carry-forward.**
 - **GitHub** (a node is a row in one objective issue body): the new objective's roadmap rows are
@@ -4701,8 +5050,10 @@ close, and verification).
 `--adopt-from`: a `--supersedes` worker flag (recovered from the handoff via
 `_supersedes_from_handoff`; explicit flag wins) parses the carry map via the reused
 `objective.parse_adopt_mapping(raw_roadmap)` (the node→issue side-map, interpreted as **move**
-semantics here) and calls `store.supersede_objective(...)`; a `None` return raises
-`supersede_unsupported`. `--supersedes` and `--adopt-from` are **mutually exclusive** (`invalid_input`).
+semantics here), constructs exactly one `TransferRequest` from raw intent, and consumes only
+`TransferResult.successor`. Provider filtering, D1 classification, route choice, writer probes,
+and mutation stay behind Delivery; a `None` store result becomes `supersede_unsupported` there.
+`--supersedes` and `--adopt-from` are **mutually exclusive** (`invalid_input`).
 
 **Binding + skill.** `command:objective-replan → perk-objective-replan` (nudge) joins
 `shared/bindings.yaml` (mirroring `command:objective-reconcile`) and `DELIVERABLE_COMMAND_TARGETS`
@@ -5091,6 +5442,17 @@ text), derives `manifest.json` itself (`bad_input` when absent), and resolves th
 from `[models.subagents] learn-analyst` at execute time (the wave's workflow-level `model`
 default). The manifest write rule above and the DECISION vocabulary are unchanged.
 
+**Streaming launch manifests.** `startReportWave` returns one preflight-derived
+`WaveLaunchManifest = {requested, runnable, preflightFailures}` on both result arms. `requested`
+preserves the declared lane order; `runnable` is the ordered subset eligible for the rendered
+workflow after required-skill preflight; `preflightFailures` contains one ordered keyed
+`skill-unavailable` row per omission. The streaming adversarial/draft start tools expose this
+nested `launch` shape and say only runnable lanes launched; pending collection still keeps the full
+requested denominator. If every lane is skipped, no workflow is spawned: the start is unavailable,
+its receipt has no children, and the same keyed failures appear in the manifest/result without a
+synthetic wave-level failure. `WaveAttemptReceipt.requestedKeys` remains the pre-launch logical
+manifest and is not narrowed by this launch vocabulary.
+
 **Attempt receipts (flow-generic).** Every code-owned wave flow records an **output-free**
 `WaveAttemptReceipt` per top-level workflow launch when the completion payload carries the
 projection (pi-subagents ≥ 0.45.0): the child lane key ↔ child `runId` ↔ artifact paths —
@@ -5099,7 +5461,7 @@ attempt (a failed lane and its relaunch stay distinguishable). `status.json.work
 remains the SOLE authority for reports and completeness; receipt absence (an identity-only
 completion) never changes a verdict, completeness, retry selection, or mutation decision —
 receipts are write-only correlation telemetry. The flow tools (`run_learn_wave`,
-`run_harvest_wave`, `run_pr_review_wave`, `run_pr_review_dynamic_wave`, and the single-lane
+`run_harvest_wave`, `run_dream_wave`, `run_pr_review_wave`, `run_pr_review_dynamic_wave`, and the single-lane
 `classify_review_feedback` / `explore_objective_node`) persist `attempts` in their structured
 tool-result details only (never the model-facing prose); a wave-level soft-failure retains any
 receipt known before the failure in its fail details.
@@ -5263,7 +5625,7 @@ identity).
 | 2 | prompt generation (local vs worker) | canonical templates `prompts/stages/*` via the §8.31 render seam; `_implement_prompt`/`_address_prompt` ↔ `initialPromptFor` ↔ `implementHandoffPrompt`/`addressGuidance` | `tests/test_prompt_parity.py` (live cross-engine byte parity) + goldens; reciprocal substring suites `tests/test_worker_prompt_parity.py` ↔ `extension/worker/worker.test.ts`; binding-content byte parity `tests/test_binding_render_parity.py` (via `extension/testing/renderBindingsLive.ts`) |
 | 3 | submit side effects | one Python door, `perk pr submit --json`; the warm `submit` tool/`/submit` command delegate via `submitPr` (`extension/doors/submit.ts`), and the remote worker drives that same registered tool | `extension/worker/workerE2e.test.ts` (implement HAPPY drives the real tool through the real extension into a stubbed `PERK_BIN` router), `extension/doors/submit.test.ts`, `tests/test_pr_submit.py` |
 | 4 | address terminal criteria | `finalize_address` (`extension/doors/address.ts`) runs submit first, delegates its internal resolve half to `perk pr resolve-threads --json`, and appends `last_review_batch`; the worker requires finalizer success + that write + successful effective submit evidence with `mergeable !== false` | `workerE2e.test.ts` (address HAPPY binds both real door writes to classification), `worker.test.ts` `evaluateTerminal` matrix; post-address the supervisor re-classifies via row 1 |
-| 5 | plan-ref reconstruction + positioning | one function, `resume.reconstruct_plan_ref` — all reconstruction sites converge on it (`cli/plan_selection.py::select_plan` for the explicit-id doors, `plan/resume_cmd.py`, `objective/run_cmd.py`, `run/run_worker.py`, the positioner's restore arm); one validating selector/positioner, `launch.resolve_worktree` (see the positioning semantics below) used by every cold door needing a plan checkout (`implement`/`submit`/`address`/`land`/`learn`/`plan watch`); `run_worker.position_worktree` mirrors `launch_stage`'s positioning, and stacked branch starts share `prepare_stacked_layer` (`require_ready_layer` + `prepare_layer_start`, §8.46) across `resolve_worktree` and `run_worker.position_branch` | `tests/test_plan_ref_parity.py` (the save→reconstruct round trip + the `PlanRef` field census), `tests/test_plan_selection.py`, `tests/test_resume.py`, `tests/test_launch_restore.py` (the non-destructive restore matrix), `tests/test_run_worker.py::test_positioning_parity_local_launch_vs_remote_worker` (artifact byte parity, `run_id` excepted; the explicit-ref twin pins the direct-ref arm), `tests/test_run_worker.py::test_positioning_parity_stacked_local_create_vs_remote_position` (same start SHA + `layer-context.json` parity, timestamps excepted) |
+| 5 | plan-ref reconstruction + positioning | one function, `resume.reconstruct_plan_ref` — all reconstruction sites converge on it (`cli/plan_selection.py::select_plan` for the explicit-id doors, `plan/resume_cmd.py`, `objective/run_cmd.py`, `run/run_worker.py`, the positioner's restore arm); one validating selector/positioner, `launch.resolve_worktree` (see the positioning semantics below) used by every cold door needing a plan checkout (`implement`/`submit`/`address`/`land`/`learn`/`plan watch`); `run_worker.position_worktree` mirrors `launch_stage`'s positioning, and fresh stacked starts independently call the same execution `Delivery.prepare(PrepareRequest(kind="layer_start", mode="execution", …))` boundary (§8.46) from `resolve_worktree` and `run_worker.position_branch` | `tests/test_plan_ref_parity.py` (the save→reconstruct round trip + the `PlanRef` field census), `tests/test_plan_selection.py`, `tests/test_resume.py`, `tests/test_launch_restore.py` (the non-destructive restore matrix), `tests/test_run_worker.py::test_positioning_parity_local_launch_vs_remote_worker` (artifact byte parity, `run_id` excepted; the explicit-ref twin pins the direct-ref arm), `tests/test_run_worker.py::test_positioning_parity_stacked_local_create_vs_remote_position` (same start SHA + `layer-context.json` parity, timestamps excepted) |
 | 6 | run reporting | **remote-only by design**: `perk/run/run_report.py` derives the §8.15 plan-issue comments + job summary solely from the §8.12 events stream + exit code | `tests/test_run_report.py` (incl. the `RunOutcome` lockstep literals) ↔ `worker.test.ts` (the frozen `assembleOutcome` shapes) |
 
 ### Positioning semantics (`launch.resolve_worktree` — the one selector/positioner)
@@ -5350,9 +5712,9 @@ asymmetry). Selection precedence + the two roots are §8.1. The rest of the post
    scoping applies there. Warm sessions and bare interactive `pi` are likewise untouched.
 8. **The stacked branch-creation gesture differs; the prepared start does not.** A fresh
    stacked layer starts locally via `git worktree add … <parent_sha>` and remotely via an
-   in-place `git checkout -b plan-<N> <parent_sha>` (§8.46) — both consume the same
-   `LayerContext` + `prepare_layer_start`, land on the same verified parent commit, and write
-   the same `layer-context.json` (timestamps excepted).
+   in-place `git checkout -b plan-<N> <parent_sha>` (§8.46) — both independently call the same
+   execution Prepare variant, consume its internal `LayerContext` + verified `parent_sha`, land
+   on the same commit, and write the same `layer-context.json` (timestamps excepted).
 9. **The resume prior-work advisory is `plan resume`-cold-local-only.** When `perk plan resume`
    resolves to `implement` and the plan worktree already exists locally (the D4 reuse arm), the
    door appends `prompts/common/resume-advisory.md` to the implement primer via `launch_stage`'s
@@ -5438,8 +5800,10 @@ an extra user `--skill` stays additive — pi merges explicit skill paths even u
 1. `--no-skills`;
 2. the `include_dirs` whitelist entries (absolute `--skill <dir>`, config order);
 3. the **npm-package skills** (unless `include_packages = false`): from `.pi/settings.json`
-   `packages` (strings or `{source}` rows), **`npm:` sources only** →
-   `.pi/npm/node_modules/<name>`. Local-path sources (the self-repo's `".."`) and `git:` sources
+   `packages` (strings or `{source}` rows), except an object-form package whose `skills` key is
+   exactly `[]` is excluded before package-directory probing and cannot trigger the package-tier
+   wholesale fail-open. Remaining **`npm:` sources only** → `.pi/npm/node_modules/<name>`.
+   Local-path sources (the self-repo's `".."`) and `git:` sources
    are deliberately **not** enumerated — first-party skills come from `.agents/skills` full stop
    (no committed-`skills/` fallback); enumerating the self-repo's local-path (`..`) package would
    also re-import the committed-`skills/` vs `.agents/skills` name-collision noise (the 16-way
@@ -5495,7 +5859,8 @@ stage (§8.50) carries `ask_user_question` + `run_audit_wave` + the research fam
 sessions run GATED (read-only mode), where the gate-ON set governs, so the row exists for the
 keys≡registry pin and the defensive gate-off arm; `run_audit_wave` also joins `PERK_TOOLS`
 and `READ_ONLY_TOOLS` (§8.3's carve-in — the write target is handoff-bound, never
-caller-supplied). **Scoped universe:
+caller-supplied). `run_harvest_wave` and `run_dream_wave` likewise join `PERK_TOOLS` +
+`READ_ONLY_TOOLS` with NO stage row at all (cold-only, gate-on — §8.48/§8.61). **Scoped universe:
 `PERK_TOOLS ∪ BORROWED_TOOLS`** — perk's own name-keyed census plus the enumerated
 borrowed-package census (the web-provider union, pi-mono-linear's 25 tools, pi-subagents'
 delegation four, pi-fff's search names — both mode name-sets, `fffind`/`ffgrep`/`fff-multi-grep`
@@ -5611,7 +5976,10 @@ lenient read — an unknown stored scope parses to `None`). Per-backend storage:
 `find_gist_issue{run_id}` (label + header-key scoped — cannot return a plan/learn issue),
 `create_gist_issue{title, body, run_id, scope, dry_run}` (idempotent via the finder; stamps
 `scope` into the header), and `list_gist_issues{} -> GistSummary[]{id, title, url, body, scope,
-adopted}` — every OPEN `perk:gist` issue; raises on infra failure, never masks as empty. The
+adopted}` — every OPEN `perk:gist` issue; raises on infra failure, never masks as empty. On
+GitHub `find_gist_issue` / `list_gist_issues` ride the same exhaustive full-open-set read as the
+plan/learn ops (`gh api --paginate --slurp`, per_page=100; fail-closed on an unexpected page
+shape). The
 `ObjectiveStore` grows the project-tier pair in the no-op-return family:
 `create_gist_source{title, prose, run_id, dry_run} -> ObjectiveRef | None` (`None` = "no project
 surface" — the CLI falls back to the issue tier; the Linear project store creates/finds the gist
@@ -5715,9 +6083,13 @@ fields are now **written** by stacked authoring: the `objective create` cold doo
 capability preflight; the TS plane carries the reviewed choice
 end-to-end (`objective_draft`/`objective_save` → `--delivery`). The **layer-identity trio**
 (`objective_node_id`/`delivery_lineage`/`predecessor_plan_id`) is now written at node-linked
-plan save (§8.46); the checkpoint pair (`parent_checkpoint_sha`/`published_head_sha`) is
-written by the §8.47 publish operation — together, in one write, only after publication
-verification.
+plan save through `PrepareRequest(kind="plan_identity", mode=…)` (§8.46): Prepare owns the
+single objective read and returns the independently optional objective base plus nested
+`PlanIdentity {objective_node_id, delivery_lineage, predecessor_plan_id}`. Every header write arm
+receives all three identity fields; `PlanRef` remains deliberately narrower and stores **only**
+`delivery_lineage` as its routing field (no node/predecessor/schema growth). The checkpoint pair
+(`parent_checkpoint_sha`/`published_head_sha`) is written by the §8.47 publish operation —
+together, in one write, only after publication verification.
 
 ## §8.45 · Stacked authoring: the reviewed delivery choice + capability preflight
 
@@ -5746,18 +6118,24 @@ facts and the seed instructs `delivery: stacked` without re-asking — the save
 `validate_stacked_roadmap` (errors verbatim under the existing `invalid_roadmap` error_type —
 including the one-node "save it as a standalone plan" message; a fan-out/fan-in DAG passes) →
 the `--adopt-from` refusal (`invalid_input`: in-place adoption of a stacked objective is
-deferred — no roadmap node owns it) → effective probe-base resolution → capability preflight
-(**skipped on `--dry-run`**, which stays offline and still validates the bounds) → the write
-gate (checked **last**, so the operator gets full honest capability feedback even while
-gated) → the store mutation. Stored `base` semantics are unchanged; the **effective probe
-base** is explicit `--base` → `[workflow] base` → `git.detect_trunk_branch(repo_root)`
-(mirroring the train read path's `header.base or trunk`).
-
-**The capability preflight** is `perk.delivery.capability.preflight_stacked_authoring(repo_root,
-*, base)` → a `CapabilityReport` of `CapabilityCheck {name, ok, detail}` rows, probe callables
-keyword-injectable (production defaults; tests pass fakes). Import direction stays §8.44's
-(delivery → github/substrate; the CLI imports delivery). The checks, each with honest
-expected-vs-observed detail:
+deferred — no roadmap node owns it) → authoring Prepare (**skipped on `--dry-run`**, which stays
+offline and still validates the bounds) → the write gate (retired below) → the store mutation.
+Stored `base` semantics are unchanged. The CLI passes the stored base intent — explicit `--base`
+→ `[workflow] base` → `None` — to Prepare; optional-base trunk fallback now belongs to the
+façade and still yields the same effective probe base.
+
+**The capability boundary** is
+`resolve_delivery(repo_root).prepare(PrepareRequest(kind="authoring",
+base=<stored-base-or-null>))` → `PrepareResult(kind="authoring", base=<effective-base>)`.
+`resolve_delivery` remains zero-I/O; `Delivery.prepare` resolves a null base through
+`DeliveryGit.trunk_branch`, invokes the authorities in the order below, and returns only after
+every check passes. Capability rows are private implementation details: a complete failed-row set
+raises one `DeliveryError(error_type="capability_unsupported")` whose message is
+`This repository cannot take a stacked delivery train against base <repr>:` followed by every
+`- <name>: <detail>` row in observation order. Import direction stays §8.44's (delivery →
+github/substrate; the CLI imports delivery). A stacked `--dry-run` does not resolve a `Delivery`
+or invoke Prepare at all, so its compose-preview remains fully offline. The checks, each with
+honest expected-vs-observed detail:
 
 - **`native-stack`** — `stacks.stack_capability(repo_root)`: a GraphQL schema-introspection
   read (`__type(name: "PullRequest")` → a `stack` field exists). **Fail closed** (introspection
@@ -5766,8 +6144,9 @@ expected-vs-observed detail:
 - **`merge-rules`** — `stacks.base_merge_rules(repo_root, base)` → `MergeRules
   {squash_allowed, merge_queue_required}`: GraphQL `repository { squashMergeAllowed }` (squash
   direct merge must be allowed) + REST `GET repos/{owner}/{repo}/rules/branches/{base}` (any
-  effective `merge_queue` rule ⇒ reject). Strict reads — an infra failure raises
-  `GitHubError`, which the composer converts to a failed check (can't verify ⇒ don't promise).
+  effective `merge_queue` rule ⇒ reject). Strict reads — the real authority adapter converts an
+  expected `GitHubError` into its frozen `ProbeError`; Prepare records that discriminant as a
+  failed check and continues (can't verify ⇒ don't promise).
 - **`remote-base`** — `git.remote_branch_head`: the observed remote base SHA. An absent remote
   base branch is a **failed check** (honest message), never a crash; without it the push
   probes are skipped.
@@ -5778,10 +6157,10 @@ expected-vs-observed detail:
   failure). The detail states — on success AND failure — that the probe proves **server
   capability and authentication, not branch write permission**.
 
-A preflight failure fails the save with `error_type="capability_unsupported"`, the message
-carrying every failed check's expected-vs-observed detail. The probes run against the
-Git/GitHub plane **regardless of issue backend** (GitHub is the universal PR plane even when
-objectives live on Linear).
+Prepare aggregates independent failures: native stack, merge rules, and remote base are always
+observed in order; push-URL resolution and one atomic probe per URL run only after a positive
+remote-base SHA, and all URLs must pass. The probes run against the Git/GitHub plane **regardless
+of issue backend** (GitHub is the universal PR plane even when objectives live on Linear).
 
 **The write gate (retired).** Stacked authoring shipped behind a development-only environment
 opt-in (a missing opt-in failed the save with a typed gated refusal) until the publication
@@ -5901,14 +6280,15 @@ ambiguous** — it proves neither presence nor absence, so it raises `JournalApp
 without a retry (only a rescan that proved absence earns the retry). The remote effect an event
 guards must not proceed past an ambiguous append.
 
-**The rest of the stored train state** writes through `TrainPersistence`'s typed writers — thin
-compositions over the §8.42 merge-write seams, enforcing the write-together rules structurally
-(no single-field surface): `write_checkpoints` (the `parent_checkpoint_sha` +
-`published_head_sha` pair in ONE `update_plan_header` write), `transfer_plan_ownership`
-(`objective_id` + `objective_node_id`), `stamp_layer_identity` (`delivery_lineage` +
-`predecessor_plan_id`; an explicit null predecessor is contract-legal for the bottom layer), and
-`write_delivery_lineage` (`update_objective_header`; lineage *minting* stays the authoring
-node's concern).
+**The rest of the stored train state** uses the §8.42 merge-write seams. `TrainPersistence`
+retains the reusable typed writers: `write_checkpoints` writes the `parent_checkpoint_sha` +
+`published_head_sha` pair in ONE `update_plan_header` call, and `write_delivery_lineage` delegates
+to `update_objective_header` (lineage *minting* stays the authoring node's concern). Transfer's
+private roll-forward core instead uses its issue seam's generic `update_plan_header` once per
+atomic group: ownership (`objective_id` + `objective_node_id`), stacked identity
+(`delivery_lineage` + `predecessor_plan_id`, whose bottom value may be null), or all four explicit
+nulls when clearing stacked metadata. Read-before-write checks preserve idempotence; no
+transfer-only persistence wrappers remain.
 
 **Engagement exclusion.** Journal comments carry a `perk:*` sentinel in either encoding, so the
 existing engagement classifier (§8.25) classifies them `perk` and the engagement renderers drop
@@ -5923,20 +6303,155 @@ deliberately untouched (no cross-plane consumer yet — mirroring §8.42's postu
 
 ## §8.44 · The DeliveryTrain projection + stack status (read path)
 
-**The projection.** `perk.delivery.train.reconstruct_train` rebuilds one **immutable**
-`DeliveryTrain` projection of a stacked objective from the durable authorities — the objective
-store (policy, lineage, roadmap), the plan issues (layer identity + checkpoints), the journal
-fold (§8.43), Git refs, and GitHub PR + native-stack state. Pure orchestration over narrow
-injected Protocols declared in `train.py` (`ObjectiveReader`/`PlanReader`/`JournalReader`/
-`GitProbe`/`GitHubProbe`); the production wiring is the leaf `perk/delivery/observe.py`
-(`RepoGitProbe`, `GatewayGitHubProbe`, `resolve_train_reads(repo_root)`, and the composed
-`reconstruct_repo_train` convenience) — `observe.py` + `capability.py` (§8.45) + `layer.py`
-(§8.46) + `finalize.py` (the land path) are the delivery leaves touching `perk.substrate.git` /
-`perk.github`. Import
-direction stays §8.43's: nothing in
-`perk/backends/` or `perk/github/` imports `perk.delivery`. Read-only end to end; the
-projection works from a **fresh clone** — no local worktree or branch is authoritative, and
-local absence is never an error.
+**The projection and public façade boundary.** `perk.delivery.train.reconstruct_train` remains the
+internal pure core that rebuilds one **immutable** `DeliveryTrain` projection from the durable
+authorities — the objective store (policy, lineage, roadmap), plan issues (layer identity +
+checkpoints), the journal fold (§8.43), Git refs, and GitHub PR + native-stack state. The canonical
+repository-scoped APIs are `resolve_delivery(repo_root).status(StatusRequest(objective_id))`,
+one flat frozen `Delivery.prepare(PrepareRequest(...))` family,
+`Delivery.transfer(TransferRequest(...))`, `Delivery.publish(PublishRequest(...))`, and
+`Delivery.sync(SyncRequest(...), consent=...)`.
+The sync keyword is required at the call
+boundary: a caller must explicitly pass a callback or deliberately pass `None` for automation's
+auto-approval policy; omission can never silently select mutation consent. `resolve_delivery`
+performs ZERO I/O. `Delivery.status` returns a `StatusResult` whose invariant is exactly one
+non-null branch:
+`train` OR the successful incremental `no_train_reason`, alongside `objective_id`, `objective_url`,
+and `redirected_from`.
+
+Prepare's legal request/result variants are closed shapes (an unknown `kind` retains the exact
+`unknown prepare kind: <repr>` diagnostic; every other illegal shape raises `ValueError`):
+
+- `authoring`: optional request `base`, no mode/ids; result carries only effective `base`;
+- `replan`: required nonblank objective, no other fields; result carries one nested
+  `ReplanContext` from the single objective snapshot (`objective_id`/URL/title/nodes, policy,
+  base/lineage) plus claimed `ReplanClaim` rows and open-PR plan pairs in delivery order. An
+  incremental objective has empty claimed/open-PR facts; stacked preparation additionally gates
+  the journal, bound status projection, structural blockers, and claimed prefix;
+- `plan_identity`: explicit `mode=strict|best_effort`, required objective, optional node (strict
+  requires it), no base/plan request fields; result carries independently optional objective
+  `base` and nested `PlanIdentity`, or — only for a best-effort expected read failure —
+  `notice=str(exc)` with base/identity absent. The empty string is a valid notice and
+  `notice is not None` is the failure discriminator;
+- planning `layer_start`: `mode=planning`, required objective, optional requested node; result
+  carries exactly one internally-valid nested `PlanningDecision`; and
+- execution `layer_start`: `mode=execution`, required plan, nullable objective solely for the
+  defensive missing-objective refusal; result carries the internal `layer.LayerContext` plus a
+  nonblank verified `parent_sha`.
+
+`TransferRequest` is frozen intent only: predecessor id, run id, title, prose, nullable base,
+immutable roadmap nodes, ordered immutable raw `(node_id, issue_id)` carries, and successor
+`delivery=incremental|stacked`. It deliberately performs no constructor normalization or
+validation. `Delivery.transfer` applies the pure recoverability predicate before lock/I/O: closed
+delivery value, non-empty unique-node roadmap, known dependencies, acyclic delivery order,
+unique/nonblank/subset carry keys, and nonblank string carry identities. `TransferResult` preserves
+the existing `{predecessor_id, successor, operation_id, abandoned_operation_id, rolled_forward,
+journaled}` shape without a constructor matrix; plain incremental→incremental returns the
+null-operation arm.
+
+`SyncRequest` is the other closed flat family. It carries `mode=cascade|continue|abort` plus a
+required nonblank objective. Cascade requires a nonblank journal `run_id`; optional `include_base`,
+`dry_run`, `adopt_node`, `trigger_plan_id`, and raw `trigger_run_id` obey this matrix: base and
+adoption are exclusive; a trigger plan composes with neither; trigger run requires trigger plan;
+dry run may compose with base, adoption, or trigger. Continue/abort carry no cascade field.
+`SyncResult` moves the existing flat operation result unchanged and deliberately has no new
+constructor combination guards: its additive historically reachable arms are enforced by the
+operation protocol, not a partial discriminator. Its frozen nested records are `Layer`, `Cascade`
+(the consent preview), and `AbortPreview`; these add no separate package-root names.
+
+`PublishRequest` is the closed flat publish/ready family:
+
+- common fields are `kind=layer|ready`, required nonblank `plan_id` (accepted with or without one
+  leading `#`), and `dry_run=false`;
+- either dry-run kind accepts only those common fields and returns before route classification or
+  any authority call;
+- a real layer requires nonblank journal `run_id`, permits one optional nonblank raw
+  `trigger_run_id`, and rejects delivery/objective fields; and
+- a real ready requires `delivery=incremental|stacked`, rejects run fields, requires no objective
+  for incremental, and permits a null stacked objective solely for the defensive `not_stacked`
+  refusal (a present objective is nonblank).
+
+`PublishResult {kind, plan_id, dry_run, layer?, ready?}` carries the canonical bare plan id and
+exactly one matching nested detail. `Ready {pr, was_draft}` preserves the gateway PR and its
+pre-mutation draft fact. `Layer` is exactly `{pr, branch, header_update, plan_embedded, pr_checked,
+parent_branch, operation_id, stack_number, stack_size, stack_position, parent_checkpoint_sha,
+published_head_sha, resumed, converged_noop, cascade}`. The stack triple is all-null or all-positive
+with position within size. A real layer has nonblank branches/checkpoints, a non-dry-run header
+update, and `pr_checked=true`; a direct result has no operation id exactly on a converged no-op. A
+cascade carries `SyncResult` directly, mirrors its operation/resume/no-op fields, and carries no
+stack triple. There is no replacement operation wrapper. The dry-run layer and ready sentinels,
+including PR number/url/draft/state/existed facts and the layer's exact synthetic header update,
+are constructor-validated; malformed combinations raise `ValueError`.
+
+The nested detail vocabulary adds no package-root exports: `PlanIdentity`; `PlanningNode`;
+`PlanningContext {position, layer_count, delivery_lineage, base, predecessor_node_id,
+predecessor_plan_id, parent_branch, observed_parent_head_sha}` (one-based position/count); and
+`PlanningDecision {kind, objective_id, objective_title, objective_url, requested_node_id, node,
+reason, skipped_claim_ids, context}`. Decision `kind` is exactly `ready | build_blocked |
+in_flight | wrong_candidate | complete | node_not_found | terminal | blocked | no_actionable`;
+node/reason/skipped/context presence is shape-validated (context only on train-derived `ready`; the
+all-layers-published graph fallback may be `ready` without context). The package root exports
+`PublishRequest`, `PublishResult`, `TransferRequest`, and `TransferResult` but no publication or
+transfer core/runtime/error. Removing `DeliveryOperationFacts`, `LayerBodyFacts`,
+`PublicationError`, `PublicationResult`, `TrainRowFacts`, and `publish_layer` plus adding the two
+Transfer values left the exact 61-name `perk.delivery.__all__` of that era; the atomic
+objective-landing migration has since completed the cut to the **canonical 20-name surface**
+(`Delivery`, `resolve_delivery`, `DeliveryError`, the three authority ABCs, and the seven
+request/result families) — every operation module, the journal/persistence machinery, and
+the landing readiness/mutation internals are module-path-internal only.
+
+The façade composes three nominal ABC authorities, with each interface, real adapter, and owned
+constructor-configured fake moving in lockstep. `DeliveryPersistence` aggregates objective, plan,
+and journal reads plus `get_plan_body(*, issue_id)`, `update_plan_header(*, issue_id, fields)`,
+prepared/outcome appends, checkpoint-pair writes, transfer carry normalization, objective lookup
+by run id, supersede creation, and supersession finalization. `DeliveryGit` exposes its bound `repo_root`,
+aggregates trunk/fetch/exact-ref-fetch/local-commit-resolution/ref/ancestry/worktree/base reads,
+adds `push_with_exact_lease(branch, *, expected_remote_sha)`, plus Prepare's push-URL resolution and
+no-op atomic probe, and owns
+the genuine sync Git behavior: exact-leased atomic push; temp-ref update/delete/list; detached
+worktree add/remove/prune; detached checkout/rebase; retained-worktree rebase/dirty state; and
+worktree-scoped commit resolution. It reuses substrate `RefUpdate`, rebase results, `GitError`, and
+`PushRejectedError` unchanged. `DeliveryGitHub` aggregates stable PR and tolerant native-stack
+reads plus Prepare's host stack-capability/base merge-rule facts. Its existing branch lookup is the
+rich all-state `pr_for_branch(branch) -> PullRequest|null`; its strict read is
+`strict_stack(number) -> StackRestFacts|null`. Publication/ready add the distinct `get_pr`,
+`create_pr`, `update_pr_body`, `update_pr_base`, `reopen_pr`, `mark_pr_ready`, `create_stack`, and
+`append_stack` effects; sync adds active-writer plan observation. No duplicate branch/stack/full-PR
+endpoint exists. The production
+`RepoDeliveryPersistence`, `RepoDeliveryGit`, and
+`RepoDeliveryGitHub` adapters live in `perk/delivery/observe.py`. Persistence resolves the
+backend-aligned objective store, issue backend, and `TrainPersistence` only on its first read,
+caches them only after backend identities agree, and keeps no partial cache after a failed attempt.
+The Git and GitHub adapters likewise store only constructor data and observe on method calls.
+Publication binds these same instances plus bound `status`/`sync` into private `_PublishContext`;
+private immutable `_PublishRuntime` owns only operation-id minting, clock, sleep, and PR-body
+validation. Transfer binds the same instances into private `TransferSeams` plus aggregate Git and
+GitHub authorities; recovery continues to compose `TransferSeams` directly. Its private runtime
+owns only the operation lock, operation-id minting, and clock. The bound-status bridge unwraps only
+the exact reconstruction/store/issue/persistence causes expected by the shared transfer core.
+Cause-aware bridges around the status-oriented Git/GitHub reads unwrap only a
+`TrainReconstructionError` whose direct cause is the matching raw `GitError`/`GitHubError`; every
+other typed failure stays typed and fails closed. Both Publish dry-run arms return before every
+context method, so assignment-only resolution remains offline under GitHub and Linear config.
+
+For a new authority call whose consumer must record a failure and continue independent checks, the
+aggregate ABC owns frozen nested success/error discriminants: Git `PushUrlsResult`,
+`AtomicPushResult`, and `ProbeError`; GitHub `MergeRules` and `ProbeError`. Only the real adapter
+catches the expected substrate/gateway exception and converts it; fakes return constructor-seeded
+discriminants without catching programming errors. The existing terminal status methods retain
+their typed exceptions. No speculative subgateway split is warranted: each capability belongs to
+one existing aggregate authority, while narrow pure-core reader roles remain internal. There is no
+dry-run authority implementation because objective-create dry run omits Prepare entirely.
+
+Import direction stays §8.43's: nothing in `perk/backends/` or `perk/github/` imports
+`perk.delivery`. The projection is read-only and works from a **fresh clone** — no local worktree
+or branch is authoritative, and local absence is never an error. Branch-sensitive laziness is
+load-bearing: status reads objective policy before fallback trunk resolution, so an incremental
+objective returns the no-train branch without Git or GitHub work; authoring Prepare never resolves
+persistence, issue backends, credentials, or configuration and touches only its Git/GitHub
+authorities. Identity Prepare performs exactly one objective read and no Git/GitHub call; planning
+delegates to exactly one status reconstruction; execution delegates to status and then exact
+parent-ref verification.
 
 **Layer axes.** Layer state is orthogonal, never one lossy enum: `intent`
 (`skipped|unplanned|planned|canceled` — skipped nodes contract out of the rendered layers;
@@ -6031,25 +6546,68 @@ projection-only PENDING ordering surrogates, never returned/persisted) → roadm
 `delivery_order` over the effective nodes → the node↔plan join (idempotent per layer — a plan
 preloaded by the cancellation proof is never re-joined, so canonical findings emit once) →
 PUBLISH coverage + checkpoint topology → predecessors → Git observation (reusing the fetch) →
-PRs → publication → membership → prefix → base → readiness. `DeliveryTrain` additionally
+PRs → publication → membership → prefix → base → readiness. Production reconstruction also
+captures `objective_title` and the exact active-state `objective_nodes` tuple on the immutable
+train for planning Prepare; both are defaulted internal projection inputs and are deliberately
+absent from `TrainOut`, so status human/JSON bytes do not grow. `DeliveryTrain` additionally
 carries the §8.54 projection facts `projected_canceled_nodes` /
 `repairable_canceled_nodes` (default-empty tuples of `ProjectedCancellation(node_id,
 persisted_status)`).
 
 **Failure-posture split.** Stable authorities hard-fail: a failed objective read, plan join,
-journal **carrier** read, or `git fetch` is a command failure — `TrainReconstructionError`
-with a stable `error_type` (`objective_not_found | invalid_delivery_policy | invalid_train |
-git_error | github_error | supersession_corruption`). Only two reads degrade: the **preview**
-native-stack read (membership `unknown` + information `stack_read_unavailable`, never a
-blocker — but unverifiable membership still declassifies the affected layers' publication to
-drift: the information posture governs the *finding*, not the verification bar) and journal
-**corruption** (`JournalCorruptionError` → the `journal_corruption` blocker; unresolved-
-operation facts report unknown). A superseded objective **redirects forward** along
-`superseded_by` (cycle guard + depth cap 50; breach ⇒ `supersession_corruption`) to the active
-objective and reports `redirected_from`. An incremental objective short-circuits before any
-Git/GitHub work into the successful `NoDeliveryTrain` answer; a junk `delivery` value fails
-closed (`invalid_delivery_policy`). `delivery: stacked` without a lineage renders the train
-with the `missing_lineage` blocker and skips the journal fold (report, don't abort).
+journal **carrier** read, or `git fetch` is a status failure. At the pure-core seam this remains
+`TrainReconstructionError`; `Delivery.status` translates ONLY the declared status codes into
+`DeliveryError` with the same message and stable `error_type` (`objective_not_found |
+invalid_delivery_policy | invalid_train | git_error | github_error |
+supersession_corruption`). The private status allowlist remains exactly those six even though
+`DeliveryError`'s façade-wide vocabulary is the bounded union of status, Prepare, Transfer,
+Publish, and sync codes.
+Prepare adds `capability_unsupported | invalid_input | missing_lineage |
+stacked_predecessor_missing | unknown_layer | node_not_build_ready | parent_missing |
+parent_unverified`. Expected
+objective-store, issue-backend, and train-persistence exceptions normalize to `github_error`.
+`DeliveryError` rejects unknown codes, and a status error outside its six-code subset propagates
+rather than silently widening status. Prepare reuses the status-owned
+trunk and remote-branch methods without changing their status messages: for a typed `git_error`
+wrapper it preserves the chained substrate `GitError` text when that guarded cause exists, else the
+wrapper text; a non-`git_error` reconstruction failure remains unexpected and propagates.
+`DeliveryError` additionally owns sync's bounded operation codes (`not_stacked`,
+`unresolved_operation`, `sync_conflict_pending`, `claimed_prefix_malformed`, `active_writer`,
+`dirty_worktree`, `writer_observation_unavailable`, `remote_drift`, `pr_drift`,
+`membership_drift`, `stale_parent`, `base_unobserved`, `multiple_push_urls`,
+`atomic_push_unsupported`, `rebase_conflict`, `push_rejected`, `sync_drift`,
+`postcondition_unverified`, `adopt_blocked`, `no_continuation`, `continuation_stale`,
+`continuation_invalid`, `rebase_in_progress`, `operation_in_progress`) and boundary codes
+`journal_corruption`, `journal_record_too_large`, and `invalid_config`. Publish/ready add only
+`delivery_error`, `stack_capability_lost`, `pr_already_merged`, `remote_settling_timeout`,
+`stack_registration_drift`, `stack_registration_failed`, `publication_drift`, `no_pr`,
+`pr_not_open`, `layer_not_published`, and `structural_blockers`; status's private subset remains
+exactly the six codes above.
+
+Every `DeliveryError` emitted by `Delivery.publish` carries a jointly-present constrained
+`phase=layer|cascade|ready` and `origin=domain|git|github|delivery`; existing operations may leave
+both absent. Package-internal `PublicationError` and pure layer refusals become domain errors with
+their original code/message. Bound sync errors become `(cascade,delivery)`; bound layer status,
+objective-store/persistence/journal/reconstruction failures become `delivery_error/(layer,delivery)` except
+record-size, which preserves `journal_record_too_large`; raw exact-lease rejection and Git failures
+become `(layer,git)`; raw GitHub/issue failures become `(layer,github)`. Ready's pure selection and
+reviewability refusals become `(ready,domain)`; a status reconstruction cause preserves its domain
+code/message, while backend/objective/persistence/journal and raw GitHub failures become
+`github_error/(ready,github)`. Unexpected exceptions are not wrapped. CLI presentation maps these
+facts back to the established submit/ready prefixes and bytes.
+
+Only two reads
+degrade: the **preview** native-stack read (membership `unknown` + information
+`stack_read_unavailable`, never a blocker — but unverifiable membership still declassifies the
+affected layers' publication to drift: the information posture governs the *finding*, not the
+verification bar) and journal **corruption** (`JournalCorruptionError` → the
+`journal_corruption` blocker; unresolved-operation facts report unknown). A superseded objective
+**redirects forward** along `superseded_by` (cycle guard + depth cap 50; breach ⇒
+`supersession_corruption`) to the active objective and reports `redirected_from`. An incremental
+objective short-circuits before fallback trunk detection, fetch, or any GitHub work into the
+successful `StatusResult.no_train_reason` branch; a junk `delivery` value fails closed
+(`invalid_delivery_policy`). `delivery: stacked` without a lineage renders the train with the
+`missing_lineage` blocker and skips the journal fold (report, don't abort).
 
 **The GitHub-native read adapter.** `perk/github/stacks.py` splits the reads by schema
 stability: `pr_delivery_facts(number, repo_root)` reads the **stable** GraphQL surface
@@ -6096,7 +6654,10 @@ reports no pending continuation, and an unparseable manifest file reports a
 than being hidden; (b) the orphaned-sync-residue observation through recover's shared
 classifier (§8.51), **fail-honest**: a Config-load or git/fs read failure — and the
 classifier's own unparseable-manifest skip — reports `observed: false` plus the reason;
-`observed: true` with empty lists means *genuinely clean*. The reported worktrees include
+`observed: true` with empty lists means *genuinely clean*. This status-only path calls the
+package-internal read-only `recover.observe_orphans` classifier directly; it is deliberately not a
+second `RecoverRequest` variant, takes no operation lock, and performs no cleanup. The reported
+worktrees include
 the stale worktree-admin entries (directory gone, inventory record left) beside the on-disk
 ones — both are would-be sweep targets. An unobserved state is never
 serialized as clean empty lists (the Config load is tolerant only in that it degrades the
@@ -6106,9 +6667,12 @@ observation, never the command).
 (`commands/objective/stack/`, the recursive group-dir template; the group carries `status` +
 `sync` (§8.49) + `recover` (§8.51) + `land` (§8.55 dry-run readiness + §8.56 the landing
 mutation); the shared objective resolution and run-id resolution live in
-`stack/shared.py`). Resolution:
-explicit argument → the plan worktree's `cache.plan-ref` `objective_id` → a typed
-`no_objective` refusal. Envelope (`ObjectiveStackStatusOut`, snapshotted at
+`stack/shared.py`). It is a migrated façade consumer: after objective-id resolution it constructs
+one lazy repository service and makes one `Delivery.status(StatusRequest(...))` call; it never
+imports or assembles the pure reconstruction readers. Resolution: explicit argument → the plan
+worktree's `cache.plan-ref` `objective_id` → a typed `no_objective` refusal. A `DeliveryError`
+preserves the declared status error type/message at the command boundary. Envelope
+(`ObjectiveStackStatusOut`, snapshotted at
 `shared/schemas/outputs/objective-stack-status.schema.json`): `{success, error_type,
 objective{id,url,redirected_from}, delivery: incremental|stacked, train|null, no_train|null,
 operations[], continuation|null, orphaned_residue}` — the last three are the additive
@@ -6134,13 +6698,14 @@ remain read-only (the dry-run push is a no-op); build-ready derivation now rides
 projection (§8.46); suffix synchronization has since landed as its own operation (§8.49);
 recovery and the warm stack surface (`/objective-stack` + the typed stack tools) have since
 landed (§8.51); atomic landing has since landed (§8.55 readiness + §8.56 the mutation);
-doctor findings are a later node's contract.
+doctor findings have since landed (§8.54, the unified drift-finding policy).
 
 ## §8.46 · Stacked build readiness + parent-aware execution
 
-**Build readiness is a derived fact of the projection — never a node status.**
-`reconstruct_train` computes a frozen `BuildReadiness {next_node_id, ready, reason}` at the end
-of the pipeline and carries it on `DeliveryTrain.build_readiness`. `next_node_id` is the first
+**Build readiness is a derived fact of the projection — never a node status.** The internal pure
+projection computes a frozen `BuildReadiness {next_node_id, ready, reason}` at the end of the
+pipeline and carries it on `DeliveryTrain.build_readiness`; repository consumers obtain that
+projection through `Delivery.status`, never by assembling the pure readers. `next_node_id` is the first
 layer in delivery order whose `publication` is not `PUBLISHED` (`None` when every layer is
 published, or the layer list is empty/all-skipped — the contiguous-prefix invariant makes the
 candidate's predecessor published by construction; a violation is already a `prefix_gap`
@@ -6153,57 +6718,68 @@ untouched. `perk objective stack status` surfaces it additively: the `--json` `t
 gains `next_build_ready {node_id, ready, reason}` (schema snapshot regenerated) and the human
 render one line (`next build-ready: <id>` / `build blocked: <reason>`).
 
-**Stacked selection replaces dep-terminal planning gating.** For a stacked objective the single
-planning candidate is the readiness-derived next node — roadmap DAG deps still shape
-`delivery_order` but stop acting as a separate terminal-status planning gate, which is what
-permits planning layer k+1 while layer k is published-but-unmerged. The one shared seam is
-`stacked_selection(repo_root, state)` (`commands/objective/shared.py`): `None` for incremental
-(byte-identical behavior), else a `StackedSelection {kind, node, ready, reason, train}` with
-`kind ∈ build_blocked | plannable | in_flight | no_candidate` (`no_candidate` = every layer
-published → consumers fall through to the existing graph classification; completion semantics
-unchanged). It reconstructs the train live (`reconstruct_repo_train`, the composed
-`observe.py` convenience); `TrainReconstructionError` maps to a typed CLI error preserving its
-`error_type`. Three consumers: the **plan door** (`perk objective plan` — auto-select takes the
-candidate; `build_blocked` refuses with `error_type="node_not_build_ready"` + a
-`perk objective stack status <N>` hint; an explicit `--node` must equal the candidate or the
-same refusal names the actually-ready node; `in_flight` keeps the incremental
-`objective_in_flight` message shape), **`perk objective next`** (`next_node` becomes the
-plannable candidate or `null`, plus an additive `build_ready {ready, reason}` block), and the
-**`objective run` supervisor** (a new honest `action: "build_blocked"` report arm, exit 0,
-carrying `reason` + the stack-status remediation). **`--dry-run` skips train reconstruction**
-on the plan door and the run supervisor (offline graph classification kept) — and BOTH
-dry-run payloads gain `"build_readiness": "unchecked (dry-run)"` (stacked only; incremental
-payloads stay byte-identical), saying so rather than pretending the check ran. `objective show`
-stays a status renderer; the run supervisor's repair and lower-address prioritization has landed
-in §8.52.
+**Stacked planning replaces dep-terminal gating with one planning Prepare snapshot.** For a
+stacked objective the single live planning candidate is the readiness-derived next node — roadmap
+DAG deps still shape `delivery_order` but stop acting as a separate terminal-status planning gate,
+which permits planning layer k+1 while layer k is published-but-unmerged. After the plan door's
+initial objective read chooses stacked versus incremental, a real stacked launch calls exactly
+one `Delivery.prepare(PrepareRequest(kind="layer_start", mode="planning", objective_id,
+node_id?))`; that operation calls `Delivery.status` exactly once and performs no extra persistence
+read. The returned train is the sole post-Prepare authority: title/URL/node presentation, graph
+fallback, and resumable claims come from its captured objective snapshot; base/lineage/order,
+position/count, predecessor branch/head, blockers, and readiness come from the same immutable
+projection. The initial read is never reused for those facts. Incremental planning stays
+byte-identical; stacked `--dry-run` remains offline on the existing graph path and reports
+`"build_readiness": "unchecked (dry-run)"`.
+
+Planning classification returns the nested decision vocabulary from §8.44. A non-ready train is
+`build_blocked`; a pending or planning-without-plan candidate is `ready` unless an explicit other
+node was requested (`wrong_candidate`); in-progress or planning-with-plan is `in_flight` before
+that comparison; another candidate status is `build_blocked`. Without a readiness candidate, the
+captured dependency graph yields explicit `ready | in_flight | node_not_found | terminal |
+blocked`, or automatic `ready | in_flight | complete | no_actionable`; a graph-fallback `ready`
+contains no train context. `skipped_claim_ids` comes from that same graph and excludes the selected
+node. The CLI mapper preserves every existing refusal code/message (`node_not_build_ready`,
+`objective_in_flight`, `no_actionable_node`) and consumes the decision's title/URL/node/context for
+seed, lookup completion, mark, engagement, notes, and handoff.
+
+Hard failures are distinct from decisions and preserve exact precedence: `redirected_from` (the
+only supersession signal — provider normalization such as `007`→`7` with no redirect is accepted)
+is checked before train/no-train; no train is `invalid_train`; a readiness candidate absent from
+`train.layers` is `unknown_layer`; and a ready child whose predecessor has no plan/branch is
+`stacked_predecessor_missing`. Planning never exact-fetches a parent or returns a parent SHA.
+Prepare runs before the existing `update_objective_node(..., planning)` write, but this is an
+**observation followed by a non-CAS mark, not a lease or atomic claim**: concurrent edits,
+supersession after observation, and duplicate launches remain possible and are outside this
+contract.
+
+`stacked_selection(repo_root, state)` remains unchanged for **`perk objective next`** and the
+**`objective run` supervisor**: it still returns `StackedSelection {kind, node, ready, reason,
+train}`, calls status once, supplies `build_ready {ready, reason}` to next, and drives the
+supervisor's honest `action: "build_blocked"`/remediation arms. The run supervisor's dry-run status
+omission and repair/lower-address prioritization remain §8.52 behavior.
 
 **Predecessor context seeds stacked planning.** The plan door's seed gains a stacked-only DATA
-block (`_layer_context_block` → the `layer_context` template var; incremental seeds stay
+block (`_layer_context_block` is pure presentation over `PlanningContext`; incremental seeds stay
 byte-identical): the layer's position in the delivery order; for a child layer the predecessor
-node/plan, its branch, and the verified remote head from the reconstructed train's observed
-facts (the objective base for the bottom layer); a note that `origin/<parent branch>` is
-already fetched and locally inspectable; and the explicit statement that perk records **no
-planning-time parent SHA** — later movement of the predecessor/codebase is a normal
-implementation danger.
-
-**Save-time layer identity.** A **node-linked** save (`objective_id` + `node_id`, real run)
-reads the linked objective **strictly** — a failed read fails the save (`github_error`) and a
-proven-missing objective is a typed `objective_not_found` refusal; a save that cannot
-determine the delivery policy must not guess or proceed unstamped (unlinked saves keep the
-fail-soft base lookup). When the objective is
-stacked, `perk plan save` composes the **layer-identity trio** into the plan header on every
-write arm (initial create, the re-save `update_plan_header` merge, and the `save_node_plan`
-unification arm via the same rendered fields): `objective_node_id = node_id`,
-`delivery_lineage` = the objective header's lineage, `predecessor_plan_id` = the
-delivery-order predecessor node's linked plan id (`None`/absent on the bottom layer). Two
-typed refusals fire **before any write**: a stacked objective with a missing/invalid
-`delivery_lineage` is **`missing_lineage`** (an unstamped routing field would silently send a
-child layer down the incremental path), and a
-non-bottom save whose predecessor node has no linked plan is
-**`stacked_predecessor_missing`**. `parent_checkpoint_sha`/
-`published_head_sha` stay unwritten — the durable checkpoint pair is publication-owned.
-Incremental saves stay byte-identical. A dry run composes the trio best-effort from the same
-read and omits it when the objective is unreadable.
+node/plan, its branch, and the status-observed remote head (the objective base for the bottom
+layer); a note that `origin/<parent branch>` is already fetched and locally inspectable; and the
+explicit statement that perk records **no planning-time parent SHA** — later movement of the
+predecessor/codebase is a normal implementation danger.
+
+**Save-time layer identity.** `perk plan save` delegates its one objective read and identity
+policy to `PrepareRequest(kind="plan_identity")`: `mode=strict` only for a real node-linked save;
+objective-only real saves and every dry run use `best_effort`. Strict expected read failures map
+to the established `github_error`, and proven absence to `objective_not_found`. Best-effort
+returns `notice=str(exc)` (including the empty string) for an expected read failure and otherwise
+treats absence silently; unexpected exceptions propagate. The independently optional normalized
+objective base and nested `PlanIdentity` come from the same snapshot. A no-node request returns
+the base without policy/lineage/order validation. A node request applies the existing pure policy:
+incremental has no identity; stacked requires a nonblank lineage, target membership, and a linked
+predecessor for non-bottom layers (`missing_lineage`, `invalid_input`, or
+`stacked_predecessor_missing` before any write). Every initial/re-save/unification arm receives all
+three identity fields. `PlanRef` persists only lineage, and the publication-owned checkpoint pair
+stays unwritten. Dry-run output prints a best-effort notice when one exists and omits identity.
 
 **The `PlanRef` routing field.** `PlanRef`/`PlanRefModel`/`PlanRefOut` grow one nullable field,
 `delivery_lineage` (amending §8.42's deliberate-non-growth note): stamped at save, recovered by
@@ -6211,47 +6787,33 @@ read and omits it when the objective is unreadable.
 reconstructor in lockstep). It only **routes** a launch into the stacked path — every decision
 still reconstructs the train fresh; the ref is never train-authoritative.
 
-**`LayerContext` + the one parent-preparation path** (`perk/delivery/layer.py`, a delivery leaf
-touching `perk.substrate.git` alongside `observe.py`/`capability.py`). Frozen
-`LayerContext {objective_id, node_id, plan_id, delivery_lineage, predecessor_plan_id, base,
-parent_branch, branch}` — `parent_branch` equals `base` for the bottom layer, else the
-predecessor layer's branch (the train's branch resolution: plan-header `branch` else
-`plan-<plan-id>`); `branch` is this layer's `plan-<plan_id>`. `derive_layer_context(train, *,
-plan_id)` is pure (typed `unknown_layer`/`stacked_predecessor_missing` errors);
-`require_ready_layer` additionally requires the layer to BE the readiness candidate
-(`node_not_build_ready` carrying the exact veto). `prepare_layer_start(repo_root, ctx, *,
-fetch=…, remote_head=…, resolve_commit=…)` (keyword-injectable probes, the `capability.py`
-precedent) fetches exactly the parent ref, reads the live remote head, and verifies the commit
-resolves locally — **always the LATEST head, never a stored checkpoint**; an absent remote
-parent (`parent_missing`) or an unresolvable head (`parent_unverified`) is a typed error naming
-the expected ref. The result is the **operational** record: `cache.write_layer_context(root,
-ctx, parent_sha)` atomically writes `.perk/workflow/layer-context.json` (`LayerContextOut`:
-the full context + verified `parent_sha` + `prepared_at`) — session-scoped, gitignored with the
-workflow dir, and **NEVER authoritative** (publication re-verifies live; the durable
-`parent_checkpoint_sha`/`published_head_sha` pair stays publication-owned).
-
-**Local launch (fresh creation only).** `resolve_worktree`'s fresh-create arm, when
-`plan_ref.delivery_lineage` is set and no `origin/plan-<id>` exists: reconstruct the train,
-require the ready candidate, `prepare_layer_start`, then `git worktree add` **at the verified
-`parent_sha`** (a real commit, not a moving ref) and write `layer-context.json` into the fresh
-worktree. An explicit `--base` on a stacked layer is a typed `invalid_input` refusal (the
-parent is derived, never chosen). Explicit `--worktree NAME`, reuse, `worktree: none`, and the
-resume arm (an existing `origin/plan-<id>`) are untouched — the parent-aware path only governs
-creation; a stacked dry run reports `"stacked layer — parent derived at create"` and stays
-offline.
-
-**Remote positioning relocates into `run_worker`.** The managed workflow's "Check out the plan
-branch" shell step is **deleted** (§8.14 amended; the §8.13 input contract and `gh auth
-setup-git` are unchanged); `run_worker` now calls `position_branch(repo_root, plan_ref, base)`
-before `position_worktree`: an existing remote `plan-<N>` (either policy) → checkout +
-`reset --hard origin/plan-<N>`; absent + incremental → create from `origin/<base>`
-(behavior-equivalent to the removed shell arms; `base` = the dispatched input, else the plan's
-pinned base, else the detected trunk — the `base` param is now consumed); absent + stacked →
-the same readiness gate + `prepare_layer_start`, then `git checkout -b plan-<N> <parent_sha>`
-and `layer-context.json`. The branch-creation **gesture** intentionally differs (local
-`worktree add` vs remote in-place `checkout -b`) — a named §8.38 difference; both consume the
-same `LayerContext` + `prepare_layer_start`, and local/remote parity is proven for fresh
-creation (same start SHA, byte-identical `layer-context.json`, timestamps excepted).
+**`LayerContext` is internal; execution Prepare is the sole fresh-start proof.** The frozen
+internal `LayerContext {objective_id, node_id, plan_id, delivery_lineage, predecessor_plan_id,
+base, parent_branch, branch}` and pure `derive_layer_context`/`require_ready_layer` core remain in
+`perk.delivery.layer`, but none is exported from `perk.delivery`. Both launch paths independently
+call `Delivery.prepare(PrepareRequest(kind="layer_start", mode="execution", plan_id,
+objective_id?))`; there is no launch wrapper. It refuses a missing objective id before lookup,
+performs one status reconstruction, rejects no-train, locates the plan layer, proves it is
+build-ready, then derives the context. Execution does not inspect `redirected_from`; the freshly
+reconstructed active train remains authoritative. The bottom layer uses objective base; a child
+requires predecessor identity/plan/branch.
+
+Prepare next calls `DeliveryGit.fetch_refs` once for the exact parent branch,
+`remote_branch_sha(parent_branch)` once, then `resolve_commit(observed_sha)` once. A fetch or remote
+observation failure is `git_error`; an absent remote branch is `parent_missing`; an observed SHA
+that does not resolve locally is `parent_unverified`. No fallback is permitted: the result's
+nonblank `parent_sha` is the verified latest remote head, never a stored checkpoint. Deferred
+publication still calls callback-only `prepare_layer_start` internally; that core has no
+repository/global defaults.
+
+**Local and remote creation consume the same result.** Local `resolve_worktree` runs execution
+Prepare immediately before `git worktree add … <parent_sha>`; remote `position_branch` runs it
+immediately before `git checkout -b plan-<N> <parent_sha>`. Neither path fetches or derives the
+parent independently. Both write the returned context and SHA to `layer-context.json`; commit
+start and artifact match (timestamps and path gesture excepted). `DeliveryError` remains a typed
+CLI refusal, and an explicit local `--base` remains `invalid_input`. Existing branch/worktree reuse,
+`worktree: none`, resume, incremental creation, and stacked dry-run behavior are unchanged; the
+boundary governs fresh creation and never resets an active layer.
 
 **Status.** Everything here is inert for incremental objectives; stacked authoring and layer
 publication are supported (the §8.45 dogfood gate passed —
@@ -6273,20 +6835,29 @@ reconstruction, byte-identical behavior (the additive envelope fields serialize
 (The §8.45 development write gate, which this route reused while stacked delivery was under
 development, is retired — the dogfood gate passed.)
 
-**The publish operation** is `perk.delivery.publish.publish_layer` (a gateway-touching
-delivery leaf; every effectful callable keyword-injectable, the `capability.py` pattern). Its
-required automatic-cascade dependencies are `remote_writers` and `worktree_root`; the injectable
-`synchronize` seam defaults to §8.49's operation. Submit owns the identity-field composition
-(`header_fields`, a `pr_number → fields` builder
-reusing the incremental fields + `_merge_impl_run_ids`) and the PR-body composition; the
-operation owns WHEN they are written. `PreparedRecord.run_id` resolves `--run-id` → the plan
-header's `run_id`; both absent is a typed `invalid_input` refusal (a defensive arm — the
-header run id is stamped at save). The protocol, in order:
-
-1. **Reconstruct** the train fresh (`reconstruct_repo_train`, via the plan header's
-   `objective_id`); no train / plan not a layer → `not_stacked`.
+**The publish operation** is
+`resolve_delivery(repo_root).publish(PublishRequest(kind="layer", ...))`; the private
+`perk.delivery.publish._dispatch` engine is bound to the façade's three aggregate authorities and
+bound `status`/`sync` methods. Its immutable private runtime contains only clock/sleep/id minting
+and PR-body validation. Publication acquires no stack-operation lock. Automatic cascade calls the
+same façade's bound `sync`, whose dispatcher acquires the non-reentrant lock exactly once; there is
+no resolver or callback bundle inside publish.
+
+For a real layer, the façade re-reads the current plan, requires only presence plus nonblank
+`objective_id` (never a fresh lineage-header gate), and best-effort reads its body (`IssueBackendError`
+means no embed). That one fresh plan owns title, body truth, header merge, and route facts. The
+operation composes the exact stacked PR body and identity fields internally: canonical branch, PR
+id, lifecycle stage, and explicit-trigger-only order-preserving `impl_run_ids` merge via
+`plan.merge_untrusted_str_list`. Submit retains route selection, eager config validation,
+resolved journal/raw trigger ids, Linear emission, mergeability probing, envelope, and rendering;
+it performs no stacked body/header/operation inference. `PreparedRecord.run_id` resolves
+`--run-id` → the plan header's `run_id`; both absent is a typed `invalid_input` refusal (a defensive
+arm — the header run id is stamped at save). The protocol, in order:
+
+1. **Reconstruct** the train fresh through the bound `Delivery.status` using the plan header's
+   `objective_id`; no train / plan not a layer → `not_stacked`.
 2. **Route on the checkpoint-claimed prefix before reading the publish journal fold.** Derive it
-   through §8.49's public `derive_claimed_prefix` helper. If this plan is claimed and a claimed
+   through §8.49's package-internal `derive_claimed_prefix` helper. If this plan is claimed and a claimed
    successor exists, delegate immediately to trigger-scoped synchronization (§8.52); sync owns the
    journal routing for this arm, including unresolved SYNC/ADOPT and pending continuations. Never
    route on `published_prefix_len`: operational drift may declassify a claimed successor and must
@@ -6388,7 +6959,18 @@ before) and prepare FRESH in the same invocation. Anything mixed/unrelated →
 `stack_registration_failed`, `postcondition_unverified`, `publication_drift`, `git_error`,
 `github_error` — plus the §8.46 layer codes passed through verbatim (`parent_missing`,
 `parent_unverified`, `stacked_predecessor_missing`): honest self-describing preparation
-failures, deliberately not folded into a vaguer code.
+failures, deliberately not folded into a vaguer code. It remains package-internal and is
+translated once to `(phase=layer, origin=domain)`; aggregate infrastructure and bound-status/sync
+failures follow §8.44's contextual table.
+
+**Result and caller boundary.** Direct publication returns the backend's real identity
+`PlanHeaderUpdate`; direct convergence returns an exact empty synthetic update. Cascade returns the
+bound `SyncResult` directly and performs only the explicit-trigger `impl_run_ids` merge-write (or an
+empty update without a trigger). `PublishResult.Layer` carries those facts plus embed/body-check,
+stack, checkpoint, resume/no-op, and parent-target facts. Submit's local mergeability probe targets
+the returned parent branch and published head; Linear PR-opened emission is suppressed exactly when
+`cascade` is present. JSON and human bytes remain unchanged because serialization supplies the fixed
+operation `kind="sync"` around the nested result.
 
 **Surface changes.** The github tier gains the `stack` state key; the submit stage reads
 `[cache.plan-ref, github.plan, github.objective, github.stack]` and writes
@@ -6510,21 +7092,23 @@ evidence report).
 
 ## §8.49 · Published-suffix synchronization (the sync operation + `perk objective stack sync`)
 
-**The operation** is `perk.delivery.sync.synchronize_train` (a gateway-touching delivery leaf
-mirroring §8.47's publish shape: every effectful callable keyword-injectable, production
-defaults, tests pass fakes): change a published stacked layer — or re-anchor the whole train
-onto an advanced objective base (`--base`) — and move every published successor with it, as
-one transaction. `RemoteWriterProbe` is a **required** parameter (no fail-open default); the
-delivery plane declares the Protocol (`active_plan_ids(plan_ids) → frozenset`, raising
-`WriterObservationError` on ANY observation failure), the CLI wires the production adapter.
+**The operation** is the public `Delivery.sync(SyncRequest(...), consent=...)` façade over the
+private `perk.delivery.sync` transactional engine: change a published stacked layer — or re-anchor
+the whole train onto an advanced objective base (`--base`) — and move every published successor
+with it as one transaction. `Delivery.sync` uses one documented local import, binds its three
+aggregate authorities plus `self.status`, and reads the immutable private `_DEFAULT_SYNC_RUNTIME`
+at invocation time. The runtime owns only worktree-root configuration, the operation lock,
+continuation-manifest/containment/path helpers, clock, sleep, and operation-id minting; no
+persistence/Git/GitHub behavior or public constructor seam lives there. Tests replace the whole
+frozen runtime symbol in a scoped monkeypatch, never mutate it.
 
 **The operation universe is the checkpoint-claimed prefix — never `published_prefix_len`.**
 The train classifier truncates its verified prefix on exactly the discrepancies sync exists
 to diagnose (publication drift, membership divergence), which would make the drift refusals
 unreachable — a drifted bottom layer would read as a false no-op; a drifted upper layer would
 silently shrink a lower-layer cascade. `published_prefix_len` stays a status fact only. The
-public `derive_claimed_prefix(train)` helper is the single derivation consumed by sync and
-publish routing. The claimed prefix: the maximal contiguous run, from the bottom of delivery order, of layers
+package-internal `derive_claimed_prefix(train)` helper remains the single derivation consumed by
+sync, publish routing, transfer, and deferred recovery. The claimed prefix: the maximal contiguous run, from the bottom of delivery order, of layers
 carrying plan identity, a branch, a PR number, and the FULL checkpoint pair — **starting
 above the bottom-contiguous LANDED run** (§8.44): landed layers are terminal, never claimed,
 so a partially-landed train's remainder cascades over the advanced base (`claimed[0]` expects
@@ -6535,9 +7119,11 @@ deletion/retarget). Malformed claims
 a LANDED layer above a non-landed claimed layer)
 are the typed refusal `claimed_prefix_malformed`.
 
-**The operation lock.** Every mutating stack operation on a repo — sync (all modes),
-continue, abort, recover (§8.51), and land (§8.56) — runs under ONE machine-local
-non-blocking `flock` at
+**The operation lock.** Every `Delivery.sync` request (cascade, continue, or abort) acquires the
+private runtime's operation lock exactly ONCE around dispatch; recover (§8.51), transfer (§8.53),
+and land (§8.56) use the same lock in their own dispatches (land's is runtime-bound inside
+`Delivery.land`'s objective mutation arm; its dry-run preview is lock-free). It is a machine-local non-blocking
+`flock` at
 the main checkout (`.perk/workflow/stack-operation.lock`,
 `perk/delivery/oplock.py::stack_operation_lock`); a busy lock is the typed refusal
 `operation_in_progress` (never a wait — concurrent invocations are an operator error to
@@ -6559,7 +7145,9 @@ Post-push arms never need the temp refs (an applied push holds the candidates re
 unapplied push's resume arm abandons and recomputes fresh). Orphaned (process-killed,
 manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51) collects it.
 
-1. **Reconstruct fresh** (`reconstruct_repo_train`); no train / no lineage → `not_stacked`.
+1. **Reconstruct fresh** through the context's bound `Delivery.status(StatusRequest(...))`; every
+   fresh/re-entry reconstruction uses that same service and authority instances. A successful
+   no-train result / no lineage → `not_stacked`; a status `DeliveryError` propagates unchanged.
 2. **Continuation gate**: any manifest for this lineage → `sync_conflict_pending` (the
    message names the manifest path and the retained worktree; clearing is manual until the
    continue/abort surface). An unparseable manifest is treated as PRESENT — fail closed,
@@ -6578,7 +7166,8 @@ manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51)
    `missing_lineage`; that member is unreachable here because step 1 already classifies a
    lineage-less train as `not_stacked`, but the shared set is context-free for §8.52 consumers.
 5. **Preflight every claimed layer** (all refusals before any candidate work): remote head ==
-   the `published_head_sha` checkpoint → else `remote_drift` (adoption is a later node); a
+   the `published_head_sha` checkpoint → else `remote_drift` (the `--adopt` arm below
+   re-anchors exactly one such layer); a
    fresh strict PR-facts read per layer — OPEN, base == the expected predecessor branch (the
    objective base for the bottom layer), head == the checkpoint → else `pr_drift`; native
    membership exactly the claimed PRs (`not_applicable` below two) → else `membership_drift`;
@@ -6602,11 +7191,12 @@ manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51)
    locally-changed head that lacks it → `stale_parent` (the actionable rebase-first arm); an
    UNCHANGED claimed layer whose published head lacks it → `claimed_prefix_malformed`
    (an internally inconsistent stored pair — broken stored state).
-7. **Capability**: >1 configured push URL → `multiple_push_urls` (`--atomic` is atomic within
-   ONE receiving repository — no pretended distributed atomicity); then the shared
-   per-push-URL no-op probe (`capability.probe_atomic_push_urls`, the §8.45 probe factored
-   out) pinned to the bottom affected layer's branch at its verified remote head → failure is
-   `atomic_push_unsupported`. This discharges §8.47's recorded deviation.
+7. **Capability**: the Git authority resolves configured push URLs; >1 URL →
+   `multiple_push_urls` (`--atomic` is atomic within ONE receiving repository — no pretended
+   distributed atomicity). The same authority runs the no-op atomic probe against the sole URL,
+   pinned to the bottom affected layer's branch at its verified remote head; private capability
+   formatters preserve §8.45's caveat strings. Failure is `atomic_push_unsupported`. This
+   discharges §8.47's recorded deviation without a public probe helper.
 8. **Candidate calculation** in ONE isolated worktree (`<worktree_root>/sync-<operation_id>`;
    temp refs `refs/perk/sync/<operation_id>/<branch>`; the freshly minted operation ULID
    names all residue). Bottom-up over the affected set: source = the local head when locally
@@ -6620,7 +7210,7 @@ manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51)
    A manifest WRITE failure keeps the guard armed — residue is cleaned, nothing is retained
    — and still classifies as `rebase_conflict` inside the typed boundary (the message says
    retention failed and why).
-9. **Approval gate**: the ordered `SyncCascade` (per-ref before→after, node ids, PR numbers,
+9. **Approval gate**: the ordered `SyncResult.Cascade` (per-ref before→after, node ids, PR numbers,
    base facts) → the `approve` callback (`None` = auto-approve). Declined → the guard
    cleans; the declined result returns — no journal record, nothing mutated.
 10. **Post-approval re-observation** (closing the arbitrary-pause race before the journal
@@ -6636,15 +7226,18 @@ manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51)
     `after: {branches: [{ref, sha}], prs: [{number, head_sha, base}], base_parent:
     sha|null}` — the candidates; PR bases unchanged by construction (sync moves heads,
     never branch names).
-12. **One atomic push** (`git.push_atomic_with_leases`): every affected ref in ONE
+12. **Zero or one atomic push.** Build the update set by excluding every affected ref whose
+    candidate equals its observed before SHA. An empty set (including checkpoint-only adoption)
+    issues **zero pushes**; otherwise `git.push_atomic_with_leases` issues ONE
     `push --atomic --porcelain --no-verify --no-signed --no-follow-tags
-    --recurse-submodules=no` to `origin` with `-c push.pushOption=` cleared, each ref under
-    `--force-with-lease=refs/heads/<branch>:<exact before sha>` (never an absence lease —
+    --recurse-submodules=no` to `origin` with `-c push.pushOption=` cleared, each included ref
+    under `--force-with-lease=refs/heads/<branch>:<exact before sha>` (never an absence lease —
     sync never pushes creations). A rejection → refetch and classify: all-at-before →
     append `abandoned` (observed = the all-before proof) + `push_rejected` (retry = rerun
     sync); an unreadable refetch → `postcondition_unverified` (unresolved); mixed →
     `sync_drift` (unresolved, fail closed). Individual refs are NEVER retried.
-13. **Verify postconditions**: refetch every affected branch — head == candidate (else
+13. **Verify postconditions**: refetch **every affected branch**, including refs excluded as
+    no-op updates — head == candidate (else
     `sync_drift`); PR facts through the bounded settle poll (up to five observations through
     the injectable observe/sleep seam — GitHub's PR-head propagation lags a push) before a
     mismatch classifies as `pr_drift`; an unreadable read → `postcondition_unverified`;
@@ -6656,10 +7249,12 @@ manifest-less) `sync-*` residue is inert until `recover`'s orphan sweep (§8.51)
     verified branches + PR heads). A crash between the checkpoint writes and completion
     reconstructs as roll-forward — merge-writes + idempotent byte-identical appends.
 
-**`--dry-run` (the side-effect-free preview).** Runs the full protocol up to the approval
-boundary — preflight, capability, candidate calculation in the isolated worktree — then stops
-and returns the would-be cascade as the `dry_run: true` result arm: **no journal record, no
-push, no checkpoint write, no confirmation** (the preview needs no consent — nothing mutates).
+**`--dry-run` (the pre-consent preview).** Runs the full protocol up to the approval boundary —
+preflight, capability, candidate calculation in the isolated worktree — then stops and returns
+the would-be cascade as the `dry_run: true` result arm: **no consent call, journal record, remote
+push, checkpoint write, or continuation manifest**. Candidate calculation can create local temp
+refs/worktree residue; cleanup is best-effort, each failure is a loud result note, and noted residue
+is valid orphan-sweep input — “dry run” never falsely promises no local side effects.
 The conflict arm is retention-free: a dry-run rebase conflict writes NO manifest (the guard
 stays armed, residue is cleaned) and classifies as `rebase_conflict` with a message naming the
 dry run. A pending unresolved operation still routes per step 3 — but the unresolved-kind
@@ -6825,7 +7420,10 @@ operation simply never happened. Like `--continue`, no cascade flags compose.
 **The result arms** (`SyncResult`; invariant: `operation_id` non-null ⟺ a prepared record was
 journaled by, or resumed by, this invocation). Identity fields (`objective_id`,
 `objective_url`, `redirected_from`) ride the result so the CLI never re-reconstructs;
-`base_advanced` is the §8.44 status notice, independent of `base_cascaded`.
+`base_advanced` is the §8.44 status notice, independent of `base_cascaded`. The moved frozen data
+is `SyncResult` plus nested `Layer`, `Cascade`, and `AbortPreview`; only `SyncRequest` and
+`SyncResult` are package-root sync-family exports. No `SyncResult.__post_init__` combination matrix
+is added: the table below and operation protocol remain the authority for additive reachable arms.
 
 | arm | operation_id | abandoned_operation_id | no_op | declined | resumed | base_cascaded | affected |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -6849,39 +7447,38 @@ non-refusal notes, e.g. failed cleanup or manifest retirement). The JSON envelop
 `notes` verbatim; both the cold human renderer and the warm TypeScript tools render every
 one, so machine-routed success can never hide leftover residue.
 
-**The error vocabulary is bounded.** `SyncError.error_type` ∈ {`not_stacked`,
-`unresolved_operation`, `sync_conflict_pending`, `claimed_prefix_malformed`, `active_writer`,
-`dirty_worktree`, `writer_observation_unavailable`, `remote_drift`, `pr_drift`,
-`membership_drift`, `stale_parent`, `base_unobserved`, `multiple_push_urls`,
-`atomic_push_unsupported`, `rebase_conflict`, `push_rejected`, `sync_drift`,
-`postcondition_unverified`, `invalid_input`, `adopt_blocked`, `no_continuation`,
-`continuation_stale`, `continuation_invalid`, `rebase_in_progress`,
-`operation_in_progress`}. The operation deliberately PROPAGATES raw
-infra errors (`GitError`/`GitHubError`); the CLI boundary maps those to `git_error`/
-`github_error`, passes `TrainReconstructionError.error_type` through verbatim, and adds its
-own boundary codes (`confirmation_required`, `journal_corruption`, `no_objective`,
-`not_a_repo`) — the full envelope vocabulary is the union of those layers.
+**The error vocabulary is bounded.** Private `SyncError` is a named `DeliveryError` subclass
+retained for recover/transfer compatibility; it accepts the same façade-wide bounded vocabulary.
+`Delivery.sync` preserves any `DeliveryError` unchanged and maps only expected boundary failures:
+raw `GitError` → `git_error`; `GitHubError` and backend/store/persistence failures →
+`github_error`; an allowed `TrainReconstructionError` code/message passes through;
+`JournalCorruptionError` → `journal_corruption`; `JournalRecordTooLarge` →
+`journal_record_too_large` with the exact cap detail (an outcome-append failure may leave the
+prepared operation unresolved); and private config failure → `invalid_config`. Unexpected
+exceptions propagate. The command adds only its separately-owned `confirmation_required`,
+`no_objective`, and `not_a_repo` arms.
 
 **The cold worker.** `perk objective stack sync [OBJECTIVE] [--base] [--dry-run]
 [--adopt NODE] [--continue] [--abort] [--run-id RUN_ID] [--yes] [--json]`
 (`commands/objective/stack/sync_cmd.py`). The control-flag matrix is validated FIRST as
 typed `invalid_input`: `--continue`/`--abort` are mutually exclusive with each other and
 with every cascade flag; `--adopt` × `--base` is refused; `--adopt`/`--base` × `--dry-run`
-compose. Objective resolution mirrors
-`status`'s exactly; `run_id` resolves `--run-id` → the **ACTIVE** objective header's
+compose. After repo resolution the command keeps its existing eager validation-only
+`require_config(ctx)` call (same `invalid_input` precedence and malformed-TOML wording), then
+objective resolution mirrors `status`'s exactly. It resolves one zero-I/O `Delivery`, builds one
+`SyncRequest`, and calls `Delivery.sync` exactly once. Cascade `run_id` resolves `--run-id` → the **ACTIVE** objective header's
 `run_id` (the fallback follows `superseded_by` forward, the same walk the reconstruction
 performs — syncing through a superseded objective never journals the predecessor's run
-identity), both absent → `invalid_input`. The production `GhaRemoteWriterProbe` lives in
-`perk.run.writer_probe` and queries the gateway run listing with a **server-side status filter**
-(queued + in-progress, one call each — active runs can
-never be displaced off a newest-first page by completed runs; the existing 100-cap bounds
-*simultaneously active* runs) and matches plan ids via the managed run-name convention; any
-listing failure propagates as the probe's typed error → `writer_observation_unavailable`.
-Explicit sync passes no exclusion. Automatic submit excludes a writer only as the pair
-`(exclude_run_id, exclude_plan_id)`, after `PERK_RUN_ID`, a consumed implement/address handoff,
-and the active plan-ref corroborate the caller-supplied id as this process's run on this plan.
-Neither field excludes alone; uncorroborated ids exclude nothing. Only that exact run+plan pair is
-skipped because its already-committed work is the trigger; every other active writer still blocks.
+identity), both absent → `invalid_input`. Continue/abort set no cascade fields and never resolve a
+run id. `RepoDeliveryGitHub.active_writer_plan_ids` owns the production observation. It queries the
+gateway run listing with a **server-side status filter** (queued + in-progress, one call each —
+active runs can never be displaced off a newest-first page by completed runs; the existing 100-cap
+bounds *simultaneously active* runs) and matches plan ids via the managed run-name convention; any
+listing failure becomes `WriterObservationError` → `writer_observation_unavailable`. Explicit sync
+passes no trigger context. Automatic submit supplies raw `(trigger_plan_id, trigger_run_id)`; the
+adapter excludes a writer only after `PERK_RUN_ID`, a consumed implement/address handoff, and the
+active plan-ref corroborate that exact pair. Neither field excludes alone; uncorroborated ids
+exclude nothing. Only the exact run+plan pair is skipped; every other active writer still blocks.
 Confirmation: the `approve` callback renders the cascade to **stderr** and confirms via
 `click.confirm(..., err=True)` — interactive `--json` never contaminates stdout; `--yes`
 auto-approves; non-interactive without `--yes` → the typed `confirmation_required` refusal
@@ -6889,19 +7486,17 @@ auto-approves; non-interactive without `--yes` → the typed `confirmation_requi
 `--abort` gets its own confirmation render (the preview: operation id, conflict node,
 retained worktree, and — on the uncontained/unparseable arms — that ONLY the manifest file
 will be deleted) under the same `--yes`/non-interactive discipline; `--dry-run` needs no
-confirmation (it stops before the approval boundary); `--continue` routes to
-`continue_train_sync` and journals under the manifest's captured run identity (`--run-id`
+confirmation (it stops before the approval boundary); `--continue` uses
+`SyncRequest(mode="continue")` and journals under the manifest's captured run identity (`--run-id`
 is ignored). The `--json` envelope `ObjectiveStackSyncOut` (snapshotted at
 `shared/schemas/outputs/objective-stack-sync.schema.json`), declaration order pinned:
 `{success, objective{id,url,redirected_from}, operation_id|null,
 abandoned_operation_id|null, no_op, declined, resumed, base_cascaded, base_advanced,
-affected: [{node_id, plan_id, branch, pr_number, before_sha, after_sha}], dry_run,
+affected: [{node_id, plan_id, branch, pr_number, before_sha, after_sha}], notes:[str], dry_run,
 adopted_node|null, continued, aborted}` (the last four are the additive control-surface
-growth); failures use the
-`{success, error_type, message}` fail shape with `SyncError.error_type` verbatim; the
-reconstruction seam's `TrainReconstructionError.error_type` vocabulary passes through the
-same way (the stack-status convention), and a corrupt journal read fails as
-`journal_corruption`. Exit
+growth); failures use the `{success, error_type, message}` fail shape with one caught
+`DeliveryError`'s code/message verbatim; command-owned `UserFacingCliError` still covers
+flag/config/confirmation/no-objective validation. Exit
 discipline: 0 = success (incl. no-op, declined, dry-run, continued, aborted), 1 = typed
 operation failures, 2 = not-a-repo. The explicit command remains the owner of base advancement,
 adoption, conflict continuation, abort, and preview; ordinary submit/address propagation delegates
@@ -7037,13 +7632,68 @@ exits 2.
 
 ## §8.51 · Stack recovery (`perk objective stack recover`) + the warm stack surface
 
-**The operation** is `perk.delivery.recover.recover_operations` — **conclude-only** recovery:
-classify every unresolved stack operation against fresh authority, conclude the one selected
-target (deterministic roll-forward, a confirmed abandon-with-proof, or a confirmed
-accept-prefix breach), run the LAND finalization-convergence pass, then sweep orphaned
-machine-local sync residue. Retry is never recover's verb — the report's detail names the
-owning command (`stack sync`, `/submit`, `stack land`). Runs under the shared operation lock (§8.49);
-`--dry-run` reports everything and mutates nothing.
+**The operation** is `Delivery.recover(RecoverRequest(...), consent=...)` behind the
+repository-scoped delivery façade. The closed request family is a strict TWO-kind
+discriminator: `operation_conclusion` (conclude-only recovery) and `cancellation_metadata`
+(the §8.54 metadata repair), each with the flat fields `{objective_id, action, dry_run,
+operation_id}`. For `operation_conclusion`, `action ∈ {report, abandon, accept_prefix}`
+replaces the old pair of service booleans, and a supplied operation id is carried verbatim
+(including `""`) so target selection remains the authority and returns `operation_not_found`
+for a nonmatch. `cancellation_metadata` accepts only a nonblank `objective_id` plus optional
+`dry_run`: an acting action or ANY operation id (even `""`) is rejected at construction, and
+a non-`None` consent callback is rejected with `ValueError` before dispatch or authority
+access — the variant has no operation target, no generic action verb, and no confirmation
+boundary.
+
+The frozen `RecoverResult` is the matching strict wrapper: `kind` plus exactly the one
+detail matching it (`operation_conclusion: OperationConclusion | None`,
+`cancellation_metadata: CancellationMetadata | None` — one kind↔detail constructor guard,
+no forwarding properties, no cross-variant "must stay empty" matrix). Nested
+`OperationConclusion` carries the complete operation report (`objective_id, objective_url,
+redirected_from, dry_run, selection_required, operations, swept_worktrees, swept_refs,
+sweep_failures, sweep_skipped, landed_layers, objective_closed, reconcile_evidence, notes`)
+over the existing nested `Operation`, `MergedPrefix`, `RemainderPr`, `LandedLayer`,
+`SweepFailure`, `AbandonPreview`, and `AcceptPrefixPreview` records, with additive
+operation-produced combinations and no new guards; its `reconcile_evidence` annotation stays
+deferred/type-only to avoid a façade↔landing import cycle. Nested `CancellationMetadata`
+carries `{objective_id, actions, failed, aborted, dry_run, unavailable}` over
+`CancellationAction{code, node_id, outcome, error}` — the §8.54 repair pass without exposing
+the internal diagnostics vocabulary (`failed` stays separate from `actions`).
+
+**The `cancellation_metadata` lifecycle** is pinned against operation-conclusion
+**machinery**: dispatched before worktree-root/config resolution and before the operation
+lock, it resolves no worktree config, takes no stack-operation lock, appends no journal
+event and writes no checkpoint, classifies/concludes no operation, asks for no consent, runs
+no finalization/convergence/close, and sweeps no residue. Read-only train reconstruction is
+explicitly retained and required — it IS the repair's fresh safety proof, and it inherently
+reads the journal fold, runs `git fetch`, and observes branches/PRs/stack membership through
+the façade's reconstruction bridge; the only mutation is the conditional attachment write
+through the §8.54 writer capability. A backend whose persistence authority answers no writer
+is a successful empty pass before any reconstruction. `perk objective stack recover` remains
+an operation-conclusion-only command — the repair's sole production caller is doctor's
+`--fix` (§8.54).
+
+The operation-conclusion variant classifies every unresolved stack operation against fresh
+authority, concludes the
+one selected target (deterministic roll-forward, a consented abandon-with-proof, or a consented
+accept-prefix breach), runs the LAND finalization-convergence pass, then sweeps orphaned
+machine-local sync residue. `consent` receives either preview type; `None` auto-approves an
+explicitly requested library action, while the cold command always supplies its
+interactive/headless callback. Retry is never recover's verb — the report's detail names the owning command (`stack
+sync`, `/submit`, `stack land`). Runs under the shared operation lock (§8.49); `--dry-run` reports
+everything and mutates nothing.
+
+The private engine receives one `_RecoverContext` bound to the same three aggregate authorities as
+all other façade operations plus `_RecoverRuntime` for worktree-root loading (the existing sync
+config helper), lock, continuation/on-disk enumeration, per-layer finalization, sleep, and clock.
+The aggregate growth is exact: persistence adds `close_objective`; Git adds
+`worktree_admin_paths`; GitHub adds `merge_async_probe` and `merged_evidence`. Every other
+journal/objective/plan/ref/PR/stack effect reuses an existing authority method. Runtime and
+aggregate adapters are package-internal; no repo path, config, backend, lock, clock, factory, or
+probe callback crosses `RecoverRequest`. Config resolves before one lock acquisition, and that
+single non-reentrant lock stays held through classification, consent, from-scratch
+reclassification, conclusion/convergence, result metadata reads, and the final sweep (the
+cancellation variant branches away before both, above).
 
 **The phased protocol.** (0) **Fold-first TRANSFER routing (§8.53)**: read the REQUESTED
 objective's succession journal before any train gate — a sole unresolved TRANSFER dispatches
@@ -7056,10 +7706,16 @@ recorded manifest + the `run_id` successor lookup: successor found + corroborate
 supersedes/lineage corroboration) → `all_after`, rolled forward automatically through
 `transfer.roll_forward_transfer` under the same held lock; absent → `all_before`, abandonable
 with the `successor_absent` proof under `--abandon` (confirmed + re-classified); an
-undecodable manifest or a corroboration mismatch → a report-only `mixed` row. Hints name the
+undecodable manifest or a corroboration mismatch → a report-only `mixed` row. `accept_prefix` is
+LAND-only: fold-first TRANSFER rejects it as `accept_blocked` before successor classification,
+mutation, finalization, or sweep, including the otherwise-automatic all-after arm. Hints name the
 predecessor id (the documented recovery entry for an interrupted transfer is
-`recover <predecessor-id>`); the transfer seams ride an injectable factory
-(`transfer_seams_factory`); `TransferError` passes through the CLI under §8.53's vocabulary.
+`recover <predecessor-id>`). Recovery binds `TransferSeams` from the same aggregate persistence
+authority plus the façade's cause-aware reconstruction bridge; `TransferError` remains a
+package-internal `DeliveryError` subtype and passes through unchanged. After the selected TRANSFER
+report/conclusion, the result objective URL/state is read before `_sweep`; a typed metadata-read
+failure therefore leaves every orphan untouched and cleanup is truly the final authority/effect
+phase.
 (0b) **Fold-first sole-PUBLISH routing (§8.54)**: when the ACTIVE train's fold — read after
 reconstruction (which follows supersession forward), the SAME snapshot the classifier
 consumes; the requested fold walks predecessors only, so a successor-recorded PUBLISH is
@@ -7226,7 +7882,7 @@ still classified), except under `--abandon`/`--accept-prefix`, where acting ambi
 LAND rolls forward automatically through `landing.roll_forward_land` (above); `all_after`
 PUBLISH reports (its roll-forward already lives in `/submit`'s own resume — the report says
 so). `--abandon` requires `all_before` (else `abandon_blocked`), renders the
-`AbandonPreview` through the `approve` callback, and **re-classifies after confirmation**
+`AbandonPreview` through the union `consent` callback, and **re-classifies after confirmation**
 (the human may pause arbitrarily long on the prompt; a post-confirmation observation change
 is `abandon_blocked`, nothing journaled) before appending the `abandoned` outcome (observed
 = the all-before proof; for LAND, reason `recovered_before_state` + the reobserved rows).
@@ -7254,12 +7910,14 @@ are collected as explicit
 `sweep_failures: [{target, error}]`, never silent, never aborting the remaining sweep.
 Typed refusals never sweep (the sweep runs only after a successful conclude/report phase).
 
-**Errors.** `RecoverError.error_type` ∈ {`operation_ambiguous`, `operation_not_found`,
-`abandon_blocked`, `accept_blocked`, `unsupported_operation_kind`, `operation_in_progress`,
-`not_stacked`,
-`invalid_input`}; the roll-forward tail raises §8.49's own arms (`sync_drift`, `pr_drift`,
-`postcondition_unverified`, …) which pass through verbatim; infra and reconstruction errors
-map at the CLI boundary exactly as sync's.
+**Errors.** Recovery uses the single bounded `DeliveryError`; its recovery-specific additions are
+`operation_ambiguous`, `operation_not_found`, `abandon_blocked`, `accept_blocked`, and
+`unsupported_operation_kind`, while it reuses `operation_in_progress`, `not_stacked`,
+`invalid_input`, the sync/transfer tail codes, and journal/config/infra codes already in the façade
+vocabulary. Existing `DeliveryError`s pass unchanged. The façade boundary translates allowed
+reconstruction codes, journal corruption/oversize, raw Git, GitHub/backend/persistence, and sync
+config failures; unexpected programming/filesystem exceptions propagate. The cold worker catches
+that one error family without changing code/message.
 
 **The cold worker.** `perk objective stack recover [OBJECTIVE] [--dry-run]
 [--operation ULID] [--abandon] [--accept-prefix] [--yes] [--json]`
@@ -7268,7 +7926,11 @@ conclude-only recovery needs no run identity. `--dry-run` × `--abandon`/`--acce
 and `--abandon` × `--accept-prefix` are `invalid_input`
 (preview first, then act; one conclusion per invocation). Both confirmations follow sync's
 discipline (stderr
-render, `--yes` auto-approve, non-interactive without `--yes` → `confirmation_required`).
+render, `--yes` auto-approve, non-interactive without `--yes` → `confirmation_required`). After
+flag-first validation and the retained eager validation-only config read, the command resolves one
+Delivery, maps the booleans to one closed action, constructs one `RecoverRequest`, calls
+`Delivery.recover` once with the union consent callback, and renders the existing DTO. It catches
+one `DeliveryError`; no low-level recovery/Git/GitHub/backend error ladder remains.
 Envelope `ObjectiveStackRecoverOut` (snapshotted at
 `shared/schemas/outputs/objective-stack-recover.schema.json`), declaration order pinned:
 `{success, objective{id,url,redirected_from}, dry_run, selection_required, operations:
@@ -7282,7 +7944,9 @@ objective_closed, reconcile_evidence|null (§8.56's shape), notes[]}` with `clas
 {reported, rolled_forward,
 abandoned, accepted_prefix, declined}`; the LAND fields are trailing additive growth
 (`merged_layers`/`remainder` are the external-prefix structured preview, dry-run included —
-empty on other rows); under `dry_run` the swept lists carry the WOULD-BE targets. The human
+empty on other rows); the DTO serializes the unwrapped `OperationConclusion` detail — the
+wrapper discriminator never reaches the envelope; under `dry_run` the swept
+lists carry the WOULD-BE targets. The human
 render prints the landed rows, the close line, and the copyable `/objective-reconcile <id>`
 hint on close-with-evidence. Exit
 discipline: 0 = successful classification/report/no-op/actions (including declined and
@@ -7343,16 +8007,19 @@ since §8.54, the non-recoverable cancellation/checkpoint-topology/journal-histo
 `checkpoint_after_abandoned_publish`); only the two PENDING codes (`publish_outcome_pending`,
 `canceled_publication_pending`) are excluded — a live unresolved PUBLISH concludes via
 recover / the owning `/submit` (§8.51's sole-PUBLISH route), never as identity corruption.
-Sync's
-structural gate, supervisor veto classification, and reviewability consume this same public set;
-no caller maintains a context-specific copy. Public `ClaimedLayer` facts plus
-`derive_claimed_prefix(train) -> tuple[ClaimedLayer, ...]` are likewise the one
-checkpoint-claimed-universe contract shared by publish routing and sync mutation.
-
-**Automatic lower-layer submit.** After reconstructing, `publish_layer` derives the claimed prefix
-*before* reading publish's journal fold. A claimed plan with a claimed successor delegates to
-`synchronize_train(..., trigger_plan_id=<plan>, approve=None)`; the submit gesture is the consent,
-so there is no second prompt and no warm/headless split. Sync therefore owns unresolved-operation
+Sync's structural gate, supervisor veto classification, and reviewability consume this same
+public set; no caller maintains a context-specific copy. Package-internal `ClaimedLayer` facts plus
+`derive_claimed_prefix(train) -> tuple[ClaimedLayer, ...]` remain the one
+checkpoint-claimed-universe contract shared by publish routing, sync mutation, transfer, and
+recovery; they are no longer package-root API.
+
+**Automatic lower-layer submit.** After reconstructing, the bound Publish context derives the
+claimed prefix *before* reading publish's journal fold. A claimed plan with a claimed successor
+calls the same façade instance's `sync(SyncRequest(mode="cascade", objective_id=<objective>,
+run_id=<resolved journal id>, trigger_plan_id=<plan>, trigger_run_id=<raw invoking id>),
+consent=None)`; the submit gesture is the consent, so there is no second prompt and no
+warm/headless split. Publish takes no operation lock; the nested sync dispatcher takes its ordinary
+lock exactly once, so a non-reentrant lock is never self-entered. Sync therefore owns unresolved-operation
 and pending-continuation routing for this arm. `published_prefix_len` never selects it: a successor
 declassified by PR/membership/remote drift remains checkpoint-claimed and reaches sync's typed
 preflight instead of turning a lower submit into a top republish. The automatic path never includes
@@ -7377,16 +8044,15 @@ null on no-op), with a note naming the concluded id: `concluded unresolved opera
 (roll-forward) before cascading`. A completed older operation can therefore never report that it
 published a newer trigger head.
 
-**Writer exclusion and result contract.** The production probe is
-`perk.run.writer_probe.GhaRemoteWriterProbe`. Automatic submit supplies an exclusion only when
-`_corroborated_remote_run_id` matches the caller-supplied id to inherited `PERK_RUN_ID`, a consumed
-implement/address handoff, and this worktree's active plan-ref. The probe then excludes exactly the
-matching `(run_id, plan_id)` pair; neither field excludes alone, an arbitrary/header-derived id
-excludes nothing, and every other active writer (including one on the same plan) still blocks.
-Explicit sync passes no exclusion. Cascade success returns frozen
-`DeliveryOperationFacts {kind:"sync", operation_id|null, abandoned_operation_id|null, resumed,
-no_op, affected: tuple[SyncedLayer,…], notes: tuple[str,…]}` on `PublicationResult.operation`;
-non-cascade publish/republish/converge arms keep `operation=None`. Publish reconstructs after sync
+**Writer exclusion and result contract.** `RepoDeliveryGitHub` owns the private
+`_corroborated_remote_run_id` proof and active-writer observation. Automatic submit passes the raw
+caller id as trigger context, distinct from the separately resolved journal run id; the adapter
+excludes only when inherited `PERK_RUN_ID`, a consumed implement/address handoff, and this
+worktree's active plan-ref corroborate the exact `(run_id, plan_id)` pair. Neither field excludes
+alone, an arbitrary/header-derived id excludes nothing, and every other active writer (including
+one on the same plan) still blocks. Explicit sync passes no trigger context. Cascade success returns the exact frozen `SyncResult` in
+`PublishResult.Layer.cascade`; there is no copied operation record. Non-cascade
+publish/republish/converge arms keep `cascade=None`. Publish reconstructs after sync
 so a roll-forward-then-fresh-no-op cannot return the pre-roll-forward checkpoint snapshot. The
 target layer's PR is fetched from that fresh projection-correlated number, and its published
 checkpoint must agree with the affected after-row (or the fresh checkpoint on a sync no-op);
@@ -7397,10 +8063,12 @@ affected:[{node_id, plan_id, branch, pr_number, before_sha, after_sha}], notes:[
 `operation_id` remains the compatibility alias and carries the sync id. The warm submit decoder
 reduces a valid block to `{kind, operation_id, no_op, affected_count, notes}`, drops the whole block
 when malformed without sinking submit, renders cascade/no-op suffixes, and reports every note.
-`SyncError.error_type` passes through the submit fail envelope verbatim. On cascades an explicit
-`--run-id` merges into `impl_run_ids`; a header-derived run id is not newly stamped, and the
-already-existing PR emits no duplicate Linear PR-opened event. Worktree config/probe construction
-exists only on the stacked route; incremental submit remains independent of it.
+`DeliveryError.error_type` passes through the submit fail envelope verbatim. On cascades an
+explicit `--run-id` merges into `impl_run_ids`; a header-derived run id is not newly stamped, and
+the already-existing PR emits no duplicate Linear PR-opened event. Stacked submit preserves its
+eager config validation and `invalid_config` envelope but passes no worktree root or writer probe;
+the private runtime may read config again only when sync candidate/continuation work needs it.
+Incremental submit remains independent of config.
 
 **`finalize_address` is the only model-facing address finalizer.** Parameters remain
 `{threads:[{thread_id, comment?}], pr?, counts?}`. After the parent commits its own fixes, the tool
@@ -7439,24 +8107,31 @@ fetch feedback. `objective run` renders the additive `repair_required` action wi
 copyable owning remedy, but never auto-runs sync/recover. Dry-run remains the existing offline graph
 classification.
 
-**Stacked `/ready` consumes the train.** `require_reviewable_layer(train, plan_id, mutating)` first
-requires a known layer whose publication axis is exactly `PUBLISHED`; failure is
-`layer_not_published` with axes and findings. A mutating draft additionally requires no unresolved
+**`/ready` delegates selected intent to Publish.** Selection remains command policy. Explicit
+input is parse-normalized even offline and a real run uses `select_plan(main_repo_root(...))` with
+its one canonical read; the no-argument form reads the invoking checkout's `cache.plan-ref` and
+performs its existing one plan read there. The command never writes a selector. From that selected
+snapshot it derives only plan id, header-wins `delivery=stacked|incremental`, and the stacked
+objective id, then calls one `Delivery.publish(PublishRequest(kind="ready", ...))`. Dry-run passes
+only kind/id/dry-run and returns through the façade before backend/config/credential/GitHub calls.
+
+Incremental ready derives canonical `plan-<id>` internally and uses the all-state
+`DeliveryGitHub.pr_for_branch`: absence is `no_pr`; any returned draft is sent to `mark_pr_ready`
+regardless of OPEN/CLOSED/MERGED and a gateway rejection remains `github_error/(ready,github)`;
+any non-draft is the idempotent already-ready result regardless of state. This intentionally
+preserves the pre-migration all-state edge rather than adding an OPEN gate.
+
+Stacked ready calls bound status once, derives the target, and fetches the full `PullRequest` from
+the projection-correlated number before any gate/mutation (`no_pr` on absent number/object).
+`require_reviewable_layer(train, plan_id, mutating=false)` first requires a known target whose
+publication axis is exactly `PUBLISHED`; failure is `layer_not_published` with axes/findings and
+therefore precedes interpretation of a fresh close race. A fetched non-OPEN PR is then
+`pr_not_open`. Only an OPEN draft enters `mutating=true`, which additionally requires no unresolved
 operation (`unresolved_operation`) and no train-wide structural blocker (`structural_blockers`,
-including `missing_lineage`). Operational drift on unrelated layers does not block review.
-`mutating=false` validates only target identity/publication, so an already-ready PR remains
-idempotent even when a later global veto exists.
-
-The worker keeps dry-run offline and first, then reads the plan and applies submit's header-wins
-lineage discriminator. Incremental behavior is unchanged. Stacked ready reconstructs the train,
-locates the layer, and fetches the full `PullRequest` from the projection-correlated number before
-any gate/mutation (`no_pr` on absent number/object). The validation-only target gate then preserves
-`layer_not_published` for a projection-classified merged/closed/wrong-base or otherwise drifted
-target. Only when the projection still says `PUBLISHED` does the fetched state apply: a non-OPEN PR
-(the post-reconstruction close race) refuses as `pr_not_open`; an OPEN draft enters the mutating gate
-then `mark_pr_ready`; OPEN already-ready succeeds without a write after the validation-only gate.
-`LayerError`/`TrainReconstructionError` codes pass through; backend/persistence failures map to
-`github_error`. The fetched PR supplies the unchanged output envelope's number and URL.
+including `missing_lineage`), before `mark_pr_ready`. OPEN already-ready succeeds without a write
+after the validation-only gate, even when a later global veto exists. Operational drift on
+unrelated layers does not block review. Publish returns the fetched PR plus its original
+`was_draft`; contextual errors map back to the unchanged ready envelope and bytes.
 
 **Status.** Ordinary `/submit` and `/address` now converge published suffixes automatically;
 explicit sync remains the owner of base advancement, adoption, continuation/abort, preview, and
@@ -7465,19 +8140,21 @@ Atomic landing and ordinary-land stacked refusal remain separate later contracts
 
 ## §8.53 · Objective replan transfer (stacked supersession — the convergence protocol)
 
-**When it engages (the D1 routing matrix).** `objective create --supersedes` performs ONE
-fail-closed predecessor classification read before the supersede mutation —
-`get_objective(old)` → `objective.delivery_policy(header)`: not-found → `objective_not_found`;
-a classifier `ValueError` → `invalid_delivery_policy` (junk never silently classifies a stacked
-predecessor as incremental); an infra failure fails the save. The resulting state snapshot +
-policy are threaded into `run_transfer` (which never re-reads/re-classifies the predecessor), and
-the already-resolved store instance is reused: routing and planning consume the same ONE read.
-Routing keys on the **authoritative policy classifier**, never on lineage presence:
+**The public boundary and D1 routing matrix.** `objective create --supersedes` submits one frozen
+intent-only `TransferRequest` to `Delivery.transfer`; no predecessor snapshot, policy, provider,
+store, probe, callback, clock, lock, or factory crosses the boundary. Transfer validates the
+roadmap/dependency/carry shape before any authority call, canonicalizes the predecessor id, then
+acquires the shared operation lock. While holding it, the façade performs exactly ONE fail-closed
+authoritative predecessor read/classification — `get_objective(old)` →
+`objective.delivery_policy(header)`: not-found → `objective_not_found`; a classifier `ValueError`
+→ `invalid_delivery_policy`; an infra failure fails the save — and completes the selected
+mutation without a second read. Routing keys on the **authoritative policy classifier**, never on
+lineage presence:
 
 | predecessor → successor | path |
 | --- | --- |
-| incremental → incremental | the plain §8.32 store mutation, byte-identical apart from the classification read |
-| stacked → any | the full **journaled** transfer protocol (`perk.delivery.transfer.run_transfer`) |
+| incremental → incremental | the plain §8.32 store mutation under the same lock; no journal/Git/GitHub/status work |
+| stacked → any | the full **journaled** transfer protocol behind `Delivery.transfer` |
 | incremental → stacked | the transfer orchestration **minus the journal** (the §8.43 append gate requires stored-lineage equality and the predecessor stores none); interruption tolerance is by-construction — run_id-keyed convergent creation + idempotent merge-writes + close-last. Residual: cross-session abandonment of this arm is not journal-discoverable (drift-diagnostic territory). |
 
 A stacked-policy predecessor with a missing/blank/junk `delivery_lineage` refuses fail-closed
@@ -7486,12 +8163,14 @@ A stacked-policy predecessor with a missing/blank/junk `delivery_lineage` refuse
 the completed TRANSFER) stays readable via the predecessor id. `--dry-run` stays offline (the
 transfer never engages).
 
-**The protocol** (lock-first — the §8.49 machine-local operation lock is acquired before the
-journal fold, planning, and probes, and held through completion): fold → rerun routing → plan →
-**prepare → create → stamp → verify → finalize → complete**. The module is
-`perk/delivery/transfer.py` (every effectful callable keyword-injectable with production
-defaults); `roll_forward_transfer(seams, record)` is the lock-ASSUMED conclusion core shared by
-the save's same-run rerun and recover's all-after arm.
+**The protocol** (the lock is acquired before D1, journal fold, planning, and probes, and held
+through completion): fold → rerun routing → plan → **prepare → create → stamp → verify → finalize
+→ complete**. Fresh dispatch is private `perk/delivery/transfer.py` machinery reached only through
+`Delivery.transfer`; its `_FreshTransfer` carries `TransferSeams`, aggregate Git/GitHub
+authorities, and the explicitly typed carry-normalization callable required only by fresh
+dispatch. `_TransferRuntime` is the whole private clock/id/lock test seam. There is no
+`run_transfer` compatibility entrypoint. `roll_forward_transfer(seams, record)` remains the
+lock-ASSUMED conclusion core shared by same-run rerun and recover's all-after arm.
 
 **Planning (the preflight, split by predecessor policy — D13).** A stacked predecessor:
 reconstruct the train, `refuse_structural_blockers`, `derive_claimed_prefix` (**"published" for
@@ -7513,10 +8192,10 @@ detail, **nothing written when planning raises**:
   the K claimed plans **in exact order, each exactly once, none dropped** → `prefix_mismatch`
   (also: a duplicate carry, or a cited plan that does not exist on the predecessor). A node's
   carried plan identity is its `carry_map` entry (Linear — the plan IS the node-issue) else its
-  `pr` backlink (GitHub), bare-normalized. The save boundary filters `adopt_issue` identities by
-  backend before manifest construction: Linear retains them; GitHub passes an empty carry map
-  because its store contract ignores `adopt_issue`. Node ids/descriptions may change freely
-  (ownership writes the NEW node id).
+  `pr` backlink (GitHub), bare-normalized. The persistence authority normalizes raw request
+  carries behind the façade: Linear preserves insertion order; GitHub returns an empty map because
+  its store contract ignores `adopt_issue`. No caller or transfer core reads a provider id. Node
+  ids/descriptions may change freely (ownership writes the NEW node id).
 - **Suffix reshaping + the open-PR guards**: below the prefix, reshaping is arbitrary — except
   every predecessor plan with an OPEN PR is **mandatory-carry** (dropping one → `dropped_open_pr`
   until the PR closes), and a policy-**changing** replan (stacked↔incremental, either direction)
@@ -7567,16 +8246,17 @@ fingerprint (target project + node-id-prefixed title + clean description + phase
 label); if its later objective-node attachment write was interrupted, the found-arm resumes the
 unique matching issue, refuses ambiguity/conflict, and only mints when no match exists. Each write
 is idempotent. Stamp: per carried plan, derived from the
-manifest alone — claimed-prefix plans get `transfer_plan_ownership` (objective + NEW node id)
-only; carried-unpublished plans under a stacked successor additionally get
-`stamp_layer_identity` (lineage + the successor-delivery-order predecessor plan id, explicit
-null when the layer below is unplanned); carried plans under an incremental successor instead
-get `clear_delivery_metadata` (the four stacked fields to explicit null in ONE write). Every
-stamp is skipped when the stored values already match (idempotent rerun, no duplicate header
-effects). Verify (**before finalize**; failure → `transfer_unverified`, journal unresolved,
-predecessor open, no auto-abandon): a stacked successor requires a fresh
-`reconstruct_repo_train` whose full `(node_id, plan_id|null)` projection equals the recorded
-manifest projection exactly (a never-materialized carried node fails here), zero structural
+manifest alone — claimed-prefix plans receive one generic grouped `update_plan_header` ownership
+write (`objective_id` + NEW `objective_node_id`); carried-unpublished plans under a stacked
+successor additionally receive one grouped identity write (`delivery_lineage` + the
+successor-delivery-order `predecessor_plan_id`, explicit null when the layer below is unplanned);
+carried plans under an incremental successor instead receive the four stacked fields as explicit
+nulls in ONE generic write. Every group is skipped when stored values already match (idempotent
+rerun, no duplicate header effects); the former three transfer-only persistence wrappers do not
+exist. Verify (**before finalize**; failure → `transfer_unverified`, journal unresolved,
+predecessor open, no auto-abandon): a stacked successor requires a fresh train reconstruction
+through the seams' bound `reconstruct` (the façade's cause-preserving bridge) whose full
+`(node_id, plan_id|null)` projection equals the recorded manifest projection exactly (a never-materialized carried node fails here), zero structural
 blockers, and `derive_claimed_prefix` equal to `before.claimed_prefix` (plan ids, branches,
 checkpoint pairs, order); an incremental successor verifies by direct reads (roadmap rows match
 the projection; every carried plan re-reads with the successor ownership pair and all four
@@ -7599,26 +8279,37 @@ stamped by THIS run's successor re-finalizes idempotently and returns success (t
 interrupted-finalize tail and the idempotent re-save); any other stamp → `objective_not_open`.
 The incremental→stacked arm's lineage resolution is likewise rerun-convergent: a same-run
 successor's stored lineage wins over copy-or-mint (a fresh mint mid-convergence would fork the
-train identity). `perk objective stack recover` owns cross-session conclusion (§8.51's TRANSFER
-arm).
-
-**The door posture** (`objective replan`, §8.32). The door classifies the predecessor policy
-fail-closed and, for a stacked predecessor, refuses on any unresolved journal operation
-(TRANSFER → `transfer_incomplete` + the recover hint; other kinds → `unresolved_operation`),
-reconstructs the train, applies the same structural identity/topology blocker gate as save, and
-renders a `<stacked_delivery_facts>` scratch block: the
+train identity). `perk objective stack recover` owns cross-session conclusion through
+`Delivery.recover(RecoverRequest(kind="operation_conclusion", ...))` (§8.51's TRANSFER arm).
+That arm binds `TransferSeams` directly from the façade's aggregate persistence and cause-aware
+status bridge—never from a caller factory—and rejects the LAND-only `accept_prefix` action before
+successor observation or any effect.
+
+**The door posture** (`objective replan`, §8.32). The door calls
+`Delivery.prepare(PrepareRequest(kind="replan", objective_id=...))` once. Prepare reads the
+objective once, classifies policy fail-closed and, for a stacked predecessor, refuses on any
+unresolved journal operation (TRANSFER → `transfer_incomplete` + the recover hint; other kinds →
+`unresolved_operation`), calls bound `Delivery.status`, applies the same structural
+identity/topology blocker gate as save, and returns only the facts needed to render a
+`<stacked_delivery_facts>` scratch block: the
 claimed-prefix MUST-carry listing (exact order), the mandatory-carry open-PR plans, and the
 immutability facts. The seed's delivery re-ask is **pre-publication only** (§8.45): a published
 predecessor's seed instructs `delivery: stacked` without re-asking.
 
-**Errors.** `TransferError.error_type` ∈ {`policy_immutable`, `base_immutable`,
-`prefix_mismatch`, `dropped_open_pr`, `pr_exists`, `missing_lineage`, `transfer_incomplete`,
-`transfer_unverified`, `transfer_manifest_oversize`, `unresolved_operation`, `dirty_worktree`,
-`active_writer`, `writer_observation_unavailable`, `claimed_prefix_malformed`,
-`operation_in_progress`, `objective_not_found`, `objective_not_open`,
-`invalid_delivery_policy`, `invalid_roadmap`, `supersede_unsupported`, `invalid_input`} — the
-CLI maps them verbatim; infra raises (git/GitHub/store/persistence) propagate under their own
-vocabulary, always leaving any prepared operation unresolved (recoverable).
+**Errors.** Package-internal `TransferError` subclasses `DeliveryError` for recovery reuse;
+`Delivery.transfer` is the sole fresh boundary. Its bounded domain codes are
+{`policy_immutable`, `base_immutable`, `prefix_mismatch`, `dropped_open_pr`, `pr_exists`,
+`missing_lineage`, `transfer_incomplete`, `transfer_unverified`, `transfer_manifest_oversize`,
+`unresolved_operation`, `dirty_worktree`, `active_writer`, `writer_observation_unavailable`,
+`claimed_prefix_malformed`, `operation_in_progress`, `objective_not_found`,
+`objective_not_open`, `invalid_delivery_policy`, `invalid_roadmap`, `supersede_unsupported`,
+`invalid_input`}. Existing Delivery/Transfer errors pass unchanged; reconstruction keeps its
+bounded code/message; journal corruption → `journal_corruption`; raw Git → `git_error`; raw
+GitHub/issue/train-persistence → `github_error`; objective-store failure → `github_error` with
+`objective create failed\n…`. A cause-aware bound-status bridge restores the original
+reconstruction/store/issue/persistence exception to the shared core, preserving domain versus
+infrastructure verification behavior. Unexpected programming errors propagate. The CLI consumes
+one `DeliveryError` envelope; any prepared failure remains unresolved and recoverable.
 
 **Residuals (flagged).** The **D14 Linear creation window**: Linear cannot make its first write
 run-id-discoverable (discovery IS the sentinel header attachment), so a crash inside the
@@ -7627,11 +8318,15 @@ sentinel ⇒ invisible to `find_objective`/journal/train, and no predecessor-tou
 happened (carried moves run only after the sentinel — the pinned ordering invariant), so the
 rerun's all-before proof stays safe; re-creation may strand the residue project (inherited from
 the plain create path; GitHub has no such window — its issue POST carries the run-id header
-atomically). This is the ONLY accepted Linear materialization window: after the sentinel, even a
-fresh node issue whose create succeeded before its attachment is recoverable through the atomic
-create-time fingerprint described above. The non-journaled incremental→stacked arm's cross-session abandonment is not
-journal-discoverable. An oversize manifest refuses rather than truncating. The Linear transfer
-path is fake-proven; live proof belongs to the Linear smoke gate.
+atomically). This is the ONLY accepted Linear materialization window for the journaled route:
+after the sentinel, even a fresh node issue whose create succeeded before its attachment is
+recoverable through the atomic create-time fingerprint described above. The non-journaled
+incremental→stacked arm's cross-session abandonment is not journal-discoverable. In particular,
+real Linear process death after a carried node MOVE but before plan ownership/finalization is
+**not proven** by this refactor: no durable operation record binds a later run to the preflighted
+request. Designing that recovery posture is a separately reviewed behavior change, not a
+permissive inference from partial state. An oversize manifest refuses rather than truncating. The
+journaled Linear transfer path is fake-proven; live proof belongs to the Linear smoke gate.
 
 ## §8.54 · Native cancellation projection + unified train drift diagnostics
 
@@ -7720,6 +8415,17 @@ Protocol (declared in `diagnostics.py`, implemented only by `LinearProjectObject
 `write_node_cancellation_status`) is the ONE narrow train repair: a conditional, ATTACHMENT-ONLY
 compare-and-write (`expected_status`/`new_status`, `require_native_canceled: bool|None`,
 `require_no_raw_publish_claims`, `dry_run`) returning `APPLIED | ALREADY_CONVERGED | STALE`.
+Production ownership lives behind `Delivery.recover(RecoverRequest(kind=
+"cancellation_metadata", objective_id, dry_run))` (§8.51): the persistence authority exposes
+the writer through the optional capability `DeliveryPersistence.
+native_cancellation_metadata_writer()` — a concrete default-`None` method (the
+unsupported-backend posture) with a quoted type-only annotation, overridden only by the lazy
+production adapter (which returns the resolved objective store exactly when it structurally
+satisfies the Protocol, through its one aligned resolution, with no extra objective read and
+failed-resolution non-caching) and the owned fake. `None` is a successful empty pass before
+any reconstruction; only the Recover engine consumes the Protocol and
+`repair_projected_cancellations` in production — the Protocol is never a package-root export
+or a fourth aggregate authority.
 The writer performs a FRESH state-bearing read at the effect boundary, compares the attachment
 status, requires native canceled for the forward write, rechecks raw PR/checkpoint claims, and
 upserts ONLY the `objective-node` attachment — never the generic status update, never a
@@ -7739,15 +8445,33 @@ conditional validation with no write/compensation. This is not distributed atomi
 prevents stale snapshots from writing and compensates observed drift. Doctor never repairs plan
 identity, checkpoints, journal history, branches, PRs, or native stack membership.
 
-**The two-part doctor.** Expected authority-read failures (issue-backend / objective-store /
-train-persistence errors) normalize onto the typed reconstruction failure at doctor's
-diagnosis and repair boundaries — a routine plan/journal outage is the modeled `unavailable`
-state, never an escape. `perk objective doctor` resolves the requested objective through
-`train.resolve_active_objective` ONCE — manifest detection/repair and train
-reconstruction/repair all target the ACTIVE id (`objective` reports it; additive
-`redirected_from` preserves the requested id; a predecessor is never mutated by
-`doctor OLD --fix`). The report is two parts: the existing Linear manifest drift plus the exact
-`DeliveryTrain` findings on every backend, each annotated with the diagnosis policy
+**The two-part doctor.** Both report diagnosis and the train repair are façade consumers. One
+zero-I/O `Delivery`
+is constructed per command and reused for initial diagnosis, post-manifest re-diagnosis, the
+cancellation Recover pass, and the
+final remaining-findings read. Each diagnosis calls
+`Delivery.status(StatusRequest(objective_id=active_id))`; its bounded `DeliveryError` becomes the
+modeled `unavailable` state with the same error type/message, so a routine plan/journal/store
+outage is never an escape. The cancellation repair's effect-boundary proof lives inside the
+Recover engine: a private reconstruction closure over the façade's cause-aware bridge, pinned
+to the request objective on every call, normalizing expected
+issue/objective/train-persistence read failures to
+`TrainReconstructionError(error_type="github_error")` so the repair core answers its modeled
+unavailable arm; no public read API is reintroduced. Doctor itself is a thin request/result
+mapper: for a currently stacked diagnosis it constructs exactly
+`RecoverRequest(kind="cancellation_metadata", objective_id=active_id, dry_run=dry_run)`,
+calls the shared `Delivery.recover` once with no consent, and maps the strict
+`CancellationMetadata` detail into `_TrainFixOut`; a bounded `DeliveryError` raised before a
+modeled detail exists (e.g. lazy persistence capability resolution failed) is treated as an
+unavailable/aborted repair pass — the final diagnosis still runs and the assembled report
+keeps `success: true` with the exit-1 posture. Current incremental/unavailable diagnoses
+short-circuit before any Recover call, exactly as before.
+
+`perk objective doctor` resolves the requested objective through `train.resolve_active_objective`
+ONCE — manifest detection/repair and train reconstruction/repair all target the ACTIVE id
+(`objective` reports it; additive `redirected_from` preserves the requested id; a predecessor is
+never mutated by `doctor OLD --fix`). The report is two parts: the existing Linear manifest drift
+plus the exact `DeliveryTrain` findings on every backend, each annotated with the diagnosis policy
 (`TrainFindingOut: code, severity, node_id, plan_id, message, repairable, remediation`).
 `TrainDiagnosisOut` (field order load-bearing): `state: stacked|incremental|unavailable,
 objective_id, redirected_from, error_type, message, blockers[], information[]` — stacked
@@ -7764,12 +8488,31 @@ repair aborted first — no train action, initial diagnosis remains), `unavailab
 records the verification failure)). Sequence: initial manifest/train reports → existing
 manifest repair → reconstruct if the manifest changed → per-action fresh conditional repair →
 final diagnosis in `remaining`. Top-level payload order stays
-`success,error_type,objective,drift,fix` then appends `redirected_from,train,train_fix`
-(without `--fix`, `train_fix` is null). An assembled report keeps `success: true`/null error;
-the EXIT code conveys unavailability/aborted repair: detect-with-findings 0; detect-unavailable
-1; manifest-abort 1; current-train-unavailable 1; write/verification abort 1; fix-succeeded
-(report-only drift remaining) 0; not-a-repo the fail envelope 2; active-resolution/store
-failure the fail envelope 1.
+`success,error_type,objective,drift,fix` then appends `redirected_from,train,train_fix,
+corruption` (without `--fix`, `train_fix` is null). An assembled report keeps `success:
+true`/null error; the EXIT code conveys unavailability/aborted repair: detect-with-findings 0;
+detect-unavailable 1; manifest-abort 1; current-train-unavailable 1; write/verification abort
+1; fix-succeeded (report-only drift remaining) 0; not-a-repo the fail envelope 2;
+active-resolution/store failure the fail envelope 1.
+
+**The both-headers corruption signature (report-only).** A third check rides every doctor
+report: `corruption: [_CorruptionFindingOut{code, carrier, message, remediation}]` (appended
+last — additive). The check resolves the ACTIVE objective's **issue-tier carrier** via the
+§8.43 `journal_carrier_id` (GitHub → the objective issue; Linear project store → the metadata
+**sentinel** issue's identifier — so a sentinel bearing both attachments is detected) and reads
+it **presence-only** via `IssueBackend.read_issue` (never `get_plan`, whose header-`pr` chase
+could abort the whole report on a PR-lookup infra failure). A carrier whose read shows
+`already_plan AND already_objective` yields exactly one `both_headers` finding (its `carrier`
+field = the resolved carrier id); a healthy or unresolvable carrier yields `[]`. Cost: up to
+two bounded reads per report. Semantics: **report-only** (`--fix` never touches it — no repair
+code path exists), **direction-neutral** (the signature cannot prove which header is the
+stray one; remediation is provenance inspection — issue history, each header's `run_id` — with
+manual removal, or supersession via `perk objective replan <active>` when the objective side is
+live), **active-objective-targeted** (a superseded predecessor is redirected away — the
+supersession IS the worked remediation), **exit-0** (a detected finding is still a clean
+report), and the human render prints the `Corruption:` part only when detected (clean runs'
+output is byte-unchanged). An `IssueBackendError` from the check fails the report as
+`github_error` (the assembly boundary's posture).
 
 **Compatibility.** No provenance ⇒ byte-existing behavior; the stack-status JSON shape is
 unchanged (new findings and `intent: canceled` are values inside existing string fields);
@@ -7795,10 +8538,14 @@ wires *this* module and `sync.py` imports `observe`); it owns its observation vi
 `LandObservationError`) and never sees `perk.github` types. The shared remote-writer seam
 (`RemoteWriterProbe` + `WriterObservationError`) lives in the leaf `perk/delivery/writers.py`
 (moved from `sync.py`, which re-exports both names) so mutating and readiness preflights share
-one fail-closed observation contract. Production wiring:
-`observe.GatewayLandObservations(repo_root, base=…)` over `perk/github/stacks.py`
-(`pr_land_facts` / `base_merge_rules` / `stack_capability`), wrapping `GitHubError` into
-`LandObservationError` — except the capability bool, which passes through (below).
+one fail-closed observation contract. Production wiring is aggregate-backed: the landing
+engine constructs `observe.GatewayLandObservations(github, base=…)` over the bound
+`DeliveryGitHub` (`pr_land_facts` / `base_merge_rules` / `stack_capability`), wrapping the
+aggregate's failures (`GitHubError` on the readiness read; the frozen merge-rules
+`ProbeError`, whose message is the same `str(exc)` bytes) into `LandObservationError` —
+except the capability bool, which passes through (below) — plus the fail-closed
+`observe._AggregateWriterProbe` over `DeliveryGitHub.active_writer_plan_ids` (exact
+forwarding, no trigger exclusions).
 
 **Dispositions.** `READY | BLOCKED | NOTHING_TO_LAND`. READY iff ≥1 **non-landed** layer and ZERO blockers
 (information never vetoes — advisory threads, failed optional checks, and a clean ACTIVE
@@ -7932,9 +8679,13 @@ GitHub's own `mergeStateStatus: BLOCKED` is the covering authority for that case
 (`commands/objective/stack/land_cmd.py`; the group's land verb). **No remote mutation
 anywhere in this section**: bare `land` (no `--dry-run`) is the §8.56 landing mutation on
 this same argv shape (it replaced the historical `land_unimplemented` refusal).
-`--dry-run` resolves the objective (explicit arg → worktree plan-ref → `no_objective`),
-reconstructs the train with exactly `stack status`'s exception→envelope mapping, maps
-`NoDeliveryTrain` → typed `not_stacked` (exit 1), assesses, and reports. Envelope
+`--dry-run` resolves the objective (explicit arg → worktree plan-ref → `no_objective`) and
+makes exactly one `Delivery.land(LandRequest(kind="objective", objective_id, dry_run=True))`
+call — lock-free, consent-free, run-id-free; the engine reconstructs the train (a
+train-less objective is the typed `not_stacked` with the `Objective #N: <reason>` dry-run
+message shape, exit 1; reconstruction failures keep exactly `stack status`'s typed
+envelope mapping through the façade's land boundary), assesses, and returns the
+readiness-only detail the command maps onto the envelope. Envelope
 (`ObjectiveStackLandOut`, snapshotted at
 `shared/schemas/outputs/objective-stack-land.schema.json`; field order load-bearing):
 `{success, error_type, objective{id,url,redirected_from}, dry_run, disposition, base,
@@ -7968,21 +8719,27 @@ train is only the `NOTHING_TO_LAND` disposition.
 
 ## §8.56 · Objective landing (the journaled atomic merge)
 
-**The operation.** `perk.delivery.landing.land_train(repo_root, *, objective_id, run_id,
-remote_writers, approve=…, …seams)` is the landing **mutation** behind bare
-`perk objective stack land` — a thin consumer of the §8.55 readiness projection
-(`assess_land_readiness`, consumed as-is, never re-derived) plus the §8.43 journal
-(`TrainPersistence.append_prepared`/`append_outcome`), the per-layer finalize seam
-(`perk.delivery.finalize.finalize_landed_plan`), and the machine-local operation lock
-(oplock scope grows to sync + recover + **land**; a busy lock is the typed
-`operation_in_progress`). No extra merge modes, no queue emulation, no generalized landing
-abstraction. Injection shape mirrors `sync.py`: one public entry with keyword-injectable
-seams defaulting to production wiring. `land.py` stays the pure readiness core (its import
-direction forbids `observe`/gateway imports); the mutation lives in the new
-`perk/delivery/landing.py`. The squash-message helper is the public pure
+**The operation.** `Delivery.land(LandRequest(kind="objective", objective_id, run_id,
+dry_run=False), consent=…)` is the landing **mutation** behind bare
+`perk objective stack land` — the façade-bound engine (`perk/delivery/landing.py`, no
+public entry) is a thin consumer of the §8.55 readiness projection
+(`assess_land_readiness`, consumed as-is, never re-derived) plus the §8.43 journal through
+the aggregate persistence (`append_prepared`/`append_outcome`), the per-layer finalize seam
+(`perk.delivery.finalize.finalize_landed_plan`, bound through the private landing runtime),
+and the machine-local operation lock (oplock scope grows to sync + recover + **land**; a
+busy lock is the typed `operation_in_progress`; acquired before reconstruction and held
+through consent, merge, verification, finalization, and close — the dry-run preview is
+lock-free). `consent` is the Land family's confirmation callback over the composed
+`LandReadiness` (`None` auto-approves); it fires for both the READY land plan and the
+NOTHING_TO_LAND completion preview, and the façade rejects a callback on the non-mutating
+shapes (`kind="plan"` and the objective dry-run) with `ValueError` — never
+accept-and-ignore. The request always carries a nonblank `run_id` on the mutation and never
+on the preview (construction-guarded). No extra merge modes, no queue emulation, no
+generalized landing abstraction. `land.py` stays the pure readiness core (its import
+direction forbids `observe`/gateway imports). The squash-message helper stays the pure
 `landing.squash_commit_message(*, issue, url, backend_id, title)` (byte-identical to the
 incremental `pr land` footer format — GitHub `Closes #N`, non-github `Plan: <id> — <url>`;
-`pr/land_cmd.py` imports it — one implementation, no drift).
+one implementation, no drift) — module-path internal, no root export.
 
 **The wire contract (GitHub's stacked-PR merge API, public preview).** Submit:
 `PUT /repos/{owner}/{repo}/pulls/{top}/merge-async` with EXACTLY
@@ -8005,14 +8762,29 @@ must land even where merge-async preview enrollment is absent). Gateway surface
 (`perk/github/stacks.py`): `submit_merge_async` / `merge_pr_direct` are **total** (the
 `--include` status + `Retry-After` classification; a spawn failure folds into the ambiguous
 `status=None` arm; an unparseable 2xx/409 body leaves `state=None` — ambiguous, never a
-guessed success); `merge_async_result` / `pr_merged_evidence` (per-PR
+guessed success); `pr_merged_evidence` (per-PR
 `state + baseRefName + headRefName + headRefOid + mergeCommit.oid` — the identity fields
 the verification corroborates; a zero-exit reply carrying an explicitly-null PR node is the
-ordinary lookup miss, `None`) are **strict** (they decide whether a journal outcome may be
-appended — junk raises, never degrades).
-
-**The protocol, in order.** (1) The operation lock. (2) Reconstruct
-(`observe.resolve_train_reads` + `reconstruct_train`); `NoDeliveryTrain` or a null
+ordinary lookup miss, `None`) is **strict** (it decides whether a journal outcome may be
+appended — junk raises, never degrades). The landing engine reaches every landing effect
+and observation through the aggregate `DeliveryGitHub`: `submit_merge_async` /
+`merge_pr_direct` (the two mutations above), the **total** `merge_async_probe` as the poll
+(the four live states pass through — `merged` carries `details.sha`; an `expired`/
+`unreadable` probe consumes the tick exactly like the historical tolerated per-tick
+strict-reader failure), and `merged_evidence` for the post-approval re-observation, per-PR
+verification, and abandon proof (`merge_commit_sha` is ignored pre-merge; the raw
+`GitHubError` posture and drift/unproven message bytes are unchanged).
+Operation-conclusion recovery reaches the same handle probe and strict merged evidence
+through `DeliveryGitHub.merge_async_probe` and
+`DeliveryGitHub.merged_evidence`; objective close likewise uses
+`DeliveryPersistence.close_objective`. Recovery binds LAND issue reads only to the existing
+`train.PlanReader` shape; the landing mutation additionally reads the provider identity
+through `DeliveryPersistence.backend_id()`. The package-internal
+per-layer `finalize_landed_plan(close_objective_on_complete=False)` calls are private
+`_RecoverRuntime`/`_LandingRuntime` machinery, not a fourth public authority or request field.
+
+**The protocol, in order.** (1) The operation lock. (2) Reconstruct (the façade's
+cause-preserving train-reconstruction bridge); `NoDeliveryTrain` or a null
 `delivery_lineage` → typed `not_stacked`. (3) Assess (§8.55). (4) **NOTHING_TO_LAND** →
 `approve` with the completion preview ("nothing to merge; close objective #N") — declined ⇒
 `outcome: declined`; approved ⇒ the **state-aware close** (`landing.state_aware_close`,
@@ -8023,12 +8795,16 @@ failure is a typed error, never fail-open) ⇒ `outcome: completed_without_merge
 note). The approval pause is a race boundary: node terminality is REVALIDATED on the fresh
 fetch — a node added/reopened during the pause ⇒ typed `land_drift`, nothing closed (a
 stale NOTHING_TO_LAND snapshot never closes an incomplete objective). **No journal** (no remote train mutation to guard; the close is
-idempotent/convergent). (5) **BLOCKED** → the typed refusal `land_blocked` carrying the full
-composed readiness. (6) **READY**: for `singleton_squash` the load-bearing pre-merge
+idempotent/convergent). (5) **BLOCKED** → the **in-band refusal detail**: the mutation arm
+returns the readiness-only `LandResult.Objective` (`outcome: null`, the full composed
+readiness embedded) before consent — no exception, `DeliveryError` stays payload-free; the
+CLI maps it to its exit-1 `land_blocked` envelope (below). (6) **READY**: for `singleton_squash` the load-bearing pre-merge
 `get_plan` read happens NOW (missing ⇒ typed `plan_not_found`; it supplies the squash
 title/url + the tolerantly-parsed `consumed_learn`); then `approve(readiness)` — the
 rendered land plan; declined ⇒ `outcome: declined`, nothing journaled. (7) **Re-observe**
-every layer PR after the arbitrary approval pause (`stacks.pr_delivery_facts`: OPEN, head ==
+every layer PR after the arbitrary approval pause (the strict aggregate
+`DeliveryGitHub.merged_evidence` — `PrMergedEvidence` carries every inspected identity
+fact, `merge_commit_sha` ignored pre-merge: OPEN, head ==
 plan `head_sha`, base == expected base ref, head ref == branch); any mismatch/read failure →
 typed `land_drift`, nothing journaled. (8) **Prepared** (journal-first, read back; the
 one-unresolved gate and `JournalAppendAmbiguous` propagate typed). (9) **Submit** — classification
@@ -8055,10 +8831,11 @@ one identical retry, with the same preserved-ambiguity rule — only a `merged`
 (including the already-merged idempotent arm, which recovers an applied-but-unconfirmed
 first attempt) concludes it; anything else leaves `pending`. **No `accepted` event ever on
 the singleton** — there is no handle. (10) **Poll** (async
-arm): up to 60 ticks, injected `sleep(1)`; `pending` continues; `merged` ⇒ verification;
+arm): up to 60 ticks, injected `sleep(1)`, over the total `merge_async_probe`; `pending`
+continues; `merged` ⇒ verification (its `sha` is the journaled `reported_sha`);
 `failed` ⇒ abandon-with-proof then `land_failed`; `enqueued` ⇒ stop immediately,
-`outcome: unexpected_enqueued` (unresolved); per-tick read failures are tolerated within the
-budget; exhaustion ⇒ `outcome: pending`. (11) **Abandon-with-proof** (terminal
+`outcome: unexpected_enqueued` (unresolved); an `expired`/`unreadable` probe consumes the
+tick (the historical tolerated per-tick read failure); exhaustion ⇒ `outcome: pending`. (11) **Abandon-with-proof** (terminal
 non-application only): every layer PR re-observed OPEN at its exact expected head ⇒ append
 `abandoned` and let the typed failure propagate (retry is legal — the operation is
 resolved); ANY contradiction or read failure ⇒ NO outcome append, `outcome: pending` (never
@@ -8135,24 +8912,44 @@ pre-merge objects reachable) / Git objects.
 `unexpected_enqueued` mean the LAND operation stays **unresolved** — never success, never
 failure (§8.51's `stack recover` concludes it once the merge settles or expires — the
 recorded operation identity, the journaled `accepted` UUID handle or the prepared `mode`,
-is the recovery probe's input). `LandError.error_type` (exit 1): `not_stacked | land_blocked |
-land_drift | land_failed | merge_async_unavailable | merge_request_conflict | plan_not_found
-| operation_in_progress | confirmation_required`; reconstruction/persistence/backend errors
-keep their existing typed passthrough at the CLI boundary (the `sync_cmd` ladder, plus
-`journal_corruption` and `git_error`); exit 2 = not-a-repo. `land_blocked` renders the full
-readiness report to stderr (the shared human renderer with a "landing readiness" heading)
-and attaches the dry-run-shaped readiness payload to the JSON fail envelope under the
-`readiness` key.
+is the recovery probe's input). Failures are the bounded `DeliveryError` vocabulary with
+`phase="land"` (exit 1). Engine refusals/protocol classifications — `not_stacked` (both
+message shapes preserved: the dry-run's `Objective #N: <reason>` and the mutation's
+`objective N has no delivery train (<reason>)`), `plan_not_found`, `land_drift`,
+`merge_request_conflict`, `merge_async_unavailable`, `land_failed`,
+`operation_in_progress` — carry `origin="domain"`. The boundary origin rule:
+`train.TrainReconstructionError` passes its code through when it is a known delivery code
+(else normalizes to `github_error`), with origin derived from the final code (`git_error` →
+`git`; `github_error`, including the unknown-code fallback → `github`; every other
+recognized code → `domain`); `GitHubError`/`IssueBackendError`/`ObjectiveStoreError`/
+`TrainPersistenceError` (including `JournalAppendAmbiguous`) → `github_error`/`github`;
+`JournalCorruptionError` → `journal_corruption`/`delivery`; a defensive `GitError` →
+`git_error`/`git` (the engine makes no Git authority calls). `JournalRecordTooLarge` is
+deliberately **not** translated — an oversize append propagates as the unexpected
+programming error it always was (both phases; a typed mapping would be a behavior change
+and a façade-only translation would break invariant 20 post-verification). A consent
+callback raising (the CLI's typed `confirmation_required` refusal) propagates
+untranslated. Exit 2 = not-a-repo. `land_blocked` is a **CLI-authored envelope code** (like
+`confirmation_required`/`no_objective`): the CLI maps the in-band BLOCKED detail to the
+exit-1 fail envelope carrying the verbatim message
+`objective <id> is not ready to land: <"[code] message"-joined blockers or 'blocked'>`,
+renders the full readiness report to stderr (the shared human renderer with a "landing
+readiness" heading), and attaches the dry-run-shaped readiness payload to the JSON fail
+envelope under the `readiness` key.
 
 **The cold worker.** `perk objective stack land [OBJECTIVE] [--dry-run] [--run-id ID]
-[--yes] [--json]` — `--dry-run` stays the §8.55 read-only preview (behavior unchanged; the
+[--yes] [--json]` — a thin request→façade→map on **both arms** (envelope/exit semantics
+unchanged). `--dry-run` maps the §8.55 read-only preview (behavior unchanged; the
 envelope preserves the §8.55 field prefix/order with the §8.56 mutation fields appended as
 trailing nulls/empties; no consent, `--yes`/`--run-id` ignored). Bare
 `land` requires GitHub auth (`require_github`), resolves the run id (explicit `--run-id` →
 the ACTIVE objective header's `run_id` → typed `invalid_input`; `stack/shared.py::
-resolve_run_id`, shared with sync), and confirms: `--yes` auto-approves (still rendering
+resolve_run_id`, shared with sync — caller intent reconstruction stays CLI-side, and its
+store-walk failures keep their typed envelopes at the command boundary), passes the
+consent callback to `Delivery.land`, and confirms: `--yes` auto-approves (still rendering
 what it approved); a non-interactive session without `--yes` is the typed
-`confirmation_required` refusal BEFORE any prompt. The success envelope grows the trailing
+`confirmation_required` refusal BEFORE any prompt (raised inside the callback,
+propagating through the façade untranslated). The success envelope grows the trailing
 fields `{outcome, operation_id, merge_async_uuid, landed_layers: [{node_id, plan_id,
 pr_number, merge_commit_sha, learn_state, plan_issue_closed, nodes_marked, finalized,
 base_sha, head_sha}],
@@ -8283,6 +9080,12 @@ suites that pin the edited prose in the same change (prompt-prose edits touch no
 fixture — §8.31's Tier B is engine-vs-engine — but extension context/factory tests and binding
 guards may pin strings).
 
+**Review-flow application.** The automated, adversarial, and draft-review launch statements own
+only flow choreography and compact labels: they name Ponytail as required automatic coverage and
+teach the requested/runnable launch vocabulary, but never restate its full rubric or source-check
+procedure. The bound review skills and reviewer agent definitions remain the canonical detail and
+judgment carriers for ownership, exact-source recheck, and the residual filesystem race.
+
 **Scope.** The objective's migration nodes cover the named stage families; all other perk-owned
 stage prose (e.g. the `skills` door family) is held to this rule as ordinary maintenance going
 forward.
@@ -8462,3 +9265,876 @@ construction site — it ships standalone into the wheel and cannot import the c
 two sites are pinned together by a path-parity test). The family is disposable local cache:
 ignored by run GC, retained for the worktree's life, removed with the worktree; never copied to
 GitHub/Linear.
+
+## §8.59 · The learn-dream gather core (manifest contract)
+
+The pure exterior gather core for the `perk learn dream` factory (`perk/learn/dream.py`);
+the public door is `perk learn dream` (§8.65 — the §8.48-style door text), and the TS
+analyst wave is the decoder side (§8.60 pins this same schema version). `commit_sha` and
+`run_id` are **door-supplied parameters** — the core never captures HEAD, syncs, or
+preflights clean-tree/origin (the door owns all of that, §8.65).
+
+**The manifest.** Versioned JSON (schema_version the string `"1"` — dream's own version line,
+independent of harvest's), written run-scoped at
+`.perk/workflow/scratch/runs/<run_id>/dream-manifest.json` (`DREAM_MANIFEST_FILENAME`):
+
+```json
+{ "schema_version": "1",
+  "commit_sha": "<door-supplied>",
+  "registry_mode": "clusters",
+  "doc_count": 63,
+  "total_bytes": 1160620,
+  "findings": {
+    "structural": {
+      "stale_pointers": [ { "doc": "docs/learned/pi/context-injection.md",
+                            "pointer": "perk/run/launch.py::_gone",
+                            "reason": "missing-symbol" } ],
+      "broken_doc_paths": [ { "doc": "docs/learned/pi/context-injection.md",
+                              "target": "../workflow/renamed.md" } ],
+      "duplicate_cues": [ { "key": "when touching the extension api.",
+                            "docs": [ "docs/learned/pi/context-injection.md",
+                                      "docs/learned/pi/extension-api.md" ] } ],
+      "missing_frontmatter": [ "docs/learned/pi/untitled.md" ] },
+    "advisory": {
+      "distillation_issues": [ { "doc": "docs/learned/pi/context-system.md",
+                                 "problem": "missing" } ],
+      "source_code_blocks": [ { "doc": "docs/learned/pi/extension-api.md",
+                                "language": "ts", "lines": 14 } ],
+      "overlong_cues": [ { "doc": "docs/learned/pi/tui-surfaces.md", "length": 214 } ],
+      "cue_hazards": [ { "doc": "docs/learned/pi/subagents.md",
+                         "hazard": "space-hash" } ],
+      "empty_clusters": [ "prose-governance" ] } },
+  "lanes": [
+    { "id": "pi-extension-1",
+      "rollup": "Pi SDK/extension substrate craft — …",
+      "docs": [ { "path": "docs/learned/pi/context-injection.md",
+                  "title": "…", "read_when": "…",
+                  "cluster": "pi-extension", "bytes": 12345 } ] } ] }
+```
+
+`registry_mode` ∈ `"clusters" | "categories"`; per-doc `bytes` is the raw file byte size;
+`doc_count`/`total_bytes` are the corpus count and the per-doc-bytes sum; the per-doc cue field
+is named `read_when` (matching the harvest manifest and the frontmatter key); `None`
+title/cue/cluster/rollup values are carried as JSON `null`, never dropped.
+
+**The two-source partition.** Lanes join the committed cluster registry
+(`docs/learned/clusters.yaml` — ids + rollups + **file order**, the presentation SSOT matching
+the `docs-sync` rendering) with each doc's `cluster` frontmatter: per registry cluster, members
+= the docs whose `cluster` matches, path-sorted, chunked sequentially at `MAX_LANE_DOCS` (the
+shared harvest cap, 8); lane ids `<cluster>-<n>`, 1-based per cluster; **every chunk lane of a
+cluster carries that cluster's `rollup`**; an empty cluster emits no lane. The **category
+fallback** applies only to a **truly absent** registry (`load_cluster_registry` → `None`):
+`partition_lanes` semantics — `<category>-<n>` ids in sorted-group order — with `rollup: null`
+and `registry_mode: "categories"`.
+
+**The refusal vocabulary** (all `UserFacingCliError`s): `no_learned_docs` (empty corpus);
+`invalid_registry` (a present-but-broken registry — the loader's precise reason relayed);
+`incomplete_registry` (any doc whose `cluster` is undeclared or names no registry id — every
+offending doc listed; the docs-sync posture, never a silent fallback); `invalid_input` (the
+symlinked corpus root, escaping docs, and unreadable doc bytes — snapshot honesty, never a
+silent 0). Byte measurement runs **before** the partition, so an unreadable doc is refused
+`invalid_input`, never misnamed `incomplete_registry` (the never-raising scan degrades an
+unreadable doc's frontmatter — its `cluster` included — to `null`): readability precedes
+membership. **Dream refuses where harvest filters**: an enumerated doc whose resolved path
+escapes `docs/learned/` is a refusal naming every escaping doc — a complete-corpus audit never
+silently narrows the corpus, so a completed gather's doc set is exactly the
+`read_learned_docs` enumeration.
+
+**Findings.** One `check_docs` call mapped into the pinned **closed** sets above (the field
+vocabularies are `docs_sync`/`docs_scan`'s, by reference — dream only *reads* the existing
+scanners, never widens the docs-check report). Every family is filtered by its **owner-doc
+field only** against the manifest path set: a `broken_doc_paths` row's `target` (and a
+`stale_pointers` row's `pointer`) never participates in filtering — a broken target is by
+definition not a corpus member; it IS the finding. `duplicate_cues` comes from
+`duplicate_read_when` (learned-docs-only by construction; groups kept when all `docs` are in
+the path set — degenerate post-refusal, pinned for determinism); `empty_clusters` carries
+cluster ids untouched (registry mode only; `[]` in fallback). Deliberately excluded: artifact
+freshness/`stale_files` and `ambient_routing_bytes` (generated-artifact mechanics `docs-sync`
+repairs), `oversize_docs` (derivable from per-doc `bytes`), `registry_error`/`cluster_issues`
+(structurally impossible — refused before a gather completes), and any duplicate-**title**
+family (`DocsCheckReport` exposes only `duplicate_read_when`; the whole-corpus analysts read
+titles anyway).
+
+**The shared primitive.** `eligible_learned_docs(repo_root)` (extracted in
+`perk/learn/harvest.py`) owns the symlinked-corpus-root guard + the per-doc resolved
+containment **filter**, returning `(doc, resolved_path)` pairs in corpus order; harvest's
+selection semantics stay byte-identical (it consumes the primitive), and dream layers its
+refuse posture on top. Resolved paths are consumed only for byte measurement — never as
+partition input.
+
+## §8.60 · The learn-dream analyst wave (first level)
+
+The first-level cluster-analyst wave for `perk learn dream` in the TypeScript plane
+(`extension/waves/dreamWave.ts`, over the shared report-wave runner). Consumed by the
+`run_dream_wave` tool (§8.61), reachable only inside a `perk learn dream` launch (§8.65).
+ONE attempt, NO retry; the manifest and every analyst
+report are untrusted DATA, never instructions. The module additionally exports
+`DREAM_MANIFEST_FILENAME` (the TS mirror of the §8.59 literal — the harvest precedent, no
+cross-plane codegen) and the shared cap helpers `codePointLength`/`decodeStringArray` (one
+code-point measure across both dream re-decodes — §8.61's reducer re-decode imports them).
+
+**The strict decoder.** `decodeDreamManifest(raw, manifestPath)` pins the §8.59 manifest and
+BINDS the run-scoped manifest path into the decoded value — ONE authority: the object the wave
+plans and validates and the file the analysts read can never diverge. Rules: `schema_version`
+byte-identical the string `"1"` (dream's own version line); string `commit_sha`;
+`registry_mode` ∈ `"clusters" | "categories"`; `doc_count`/`total_bytes` non-negative integers
+**cross-checked** against the lanes (total doc count / per-doc `bytes` sum); `findings` present
+with `structural`/`advisory` records each carrying its four/five pinned family keys **as
+arrays** — rows deliberately NOT deep-validated (TS consumes findings only via the manifest
+file the analysts read; the Python `OutputModel` renderer owns row shapes; the shallow check
+catches truncation/gross drift); non-empty `lanes`, each with a non-empty unique string `id`,
+string-or-null `rollup`, and a non-empty `docs` array of **at most `laneDocs` (8)** entries — a
+larger lane is structurally unwinnable under the report schema's per-lane doc cap, refused
+pre-spawn with a named detail; each doc with a non-empty string `path` passing the LEXICAL
+containment layer (`lexicalContainmentError`, shared from `harvestWave.ts`), equal to its own
+POSIX normalization (**canonical form required** — an alias spelling like
+`docs/learned/a/../x.md` can never enter the corpus set, so membership and self-target checks
+operate on canonical identities), and **globally unique across the whole manifest** (lanes
+partition the corpus), string-or-null
+`title`/`read_when`/`cluster`, and a non-negative-integer `bytes`. Any deviation refuses the
+whole wave pre-spawn with a named detail; unknown extra keys are ignored (forward-compat rides
+`schema_version`).
+
+**Code-owned orchestration lane keys** (the §8.50 audit-wave pattern): the run key is
+`<sanitized lane id>.<ordinal>` (invalid chars collapsed to `-`, leading non-alnum stripped,
+stem clamped, global 1-based ordinal); the SEMANTIC manifest lane id rides the lane `label`,
+the module-private lane plan, and the task text — producer lane ids are deliberately NOT
+run-key-bounded (category-fallback and long-cluster ids never fail the run-key contract), so
+the decoder performs no run-key conformance check. Lane planning is module-private: callers
+see only the entrypoint's typed outcome, never orchestration keys or the plan shape.
+
+**The closed report schema.** `DREAM_ANALYST_REPORT_SCHEMA`: `additionalProperties: false` at
+every level, all fields required, no if/then conditionals, no `pattern` constraints on
+path/pointer fields. Every `maxItems`/`maxLength` reads from the ONE exported
+`DREAM_ANALYST_CAPS` SSOT — `laneDocs: 8` (also the decoder's lane bound and `docs.maxItems`),
+`rationaleChars: 500`, `preserveItems: 4`, `preserveItemChars: 300`, `evidenceItems: 6`,
+`evidenceItemChars: 250`, `overlapSignals: 8`, `overlapNoteChars: 250`, `harvestFollowups: 5`,
+`followupTitleChars: 150`, `followupEvidenceChars: 250`, `uncertainties: 6`,
+`uncertaintyChars: 300` — consumed by the schema, the decoder, and the re-decode alike. String
+caps are measured in **Unicode code points** (JSON Schema `maxLength` semantics; UTF-16
+`.length` would reject engine-valid astral strings). Per-doc rows carry
+`{path, disposition (keep|revise|merge-into|retire), merge_target (string|null), rationale,
+preserve[], evidence_checked[], confidence (high|medium|low)}`; report-level fields are
+`overlap_signals[] {doc, counterpart, note}`, `harvest_followups[] {title, pointer, evidence}`,
+`uncertainties[]`, and the three required omission counters `overlap_signals_omitted`/
+`harvest_followups_omitted`/`uncertainties_omitted` (non-negative integers — omission
+accounting is report-level only).
+
+**The composed defensive re-decode.** `decodeDreamAnalystReport(report, laneDocPaths,
+corpusDocPaths)` — whitelisted construction (an extra input key never survives; every miss a
+named detail): `docs` rows' path set EXACTLY the lane's doc set (no duplicates/extras/missing),
+normalized to **manifest lane-doc order** (deterministic downstream bundles); the
+**merge-target rule** — `merge-into` ⇒ `merge_target` a **byte-exact member of the manifest's
+corpus path set** (membership in the canonical producer-written set subsumes containment and
+defeats `docs/learned/a/../x.md` aliases) and ≠ the row's own path, any other disposition ⇒
+`merge_target === null`; overlap `counterpart` follows the same membership + ≠ rule (`doc` ∈
+the lane's docs); follow-up `pointer` non-empty, no pointer stamping (destination survival is
+the dream-report node's validation); every cap re-checked in code points.
+
+**Strict completeness.** `runDreamAnalystWave(adapter, {manifest, model?}, signal?)` (the
+manifest carries its decode-time-bound `manifestPath`) runs `flow: "dream-analyst"` under
+`completeness: "strict"`, forwarding the caller's `signal` (cancellation at the glue boundary)
+— one failed/undecodable lane ⇒ `complete: false`; a schema-valid report failing the re-decode
+is a `malformed-report` failure. Failures surface in the dream-specific
+`DreamLaneFailure {lane, reason, detail}` shape — `lane` is the SEMANTIC manifest lane id, or
+`null` for wave-level failures and the defensive unplanned-key arm (a raw orchestration key is
+named only in `detail`, never surfaced as a lane identity). Decoded analyses are RETAINED even
+when incomplete — honest coverage for the tool's refusal and the incomplete-analysis outcome.
+The outcome additionally carries `requestedKeys` — the code-owned orchestration keys in launch
+order, receipt-correlation telemetry ONLY (they correlate with `receipt.children[*].key`; the
+semantic lane identity stays `lane`) — the additive widening the §8.61 attempt receipts build
+from. **Single-lane manifests are valid** — dream has NO direct-analysis path (the harvest
+single-lane refusal is deliberately not mirrored).
+
+**Containment posture.** Lexical containment lives in the decoder (per doc path); the resolved
+layer is the existing shared `verifyDocContainment` (`harvestWave.ts` — `DreamManifest` is
+structurally assignable to its manifest parameter, pinned by test), invoked pre-spawn by the
+`run_dream_wave` tool (§8.61) exactly as `harvestWaveTools.ts` invokes it for harvest (the
+§8.48 sequence).
+
+**Model threading.** The wave takes the caller's `model?` as the workflow-level default; the
+`[models.subagents] dream-analyst` config key is resolved by the `run_dream_wave` tool at
+execute time (§8.61) and threaded here.
+
+**The agent.** `perk.dream-analyst` (`agents/dream-analyst.md`): report-only
+(`REPORT_ONLY_CHILD_AGENTS` + the §8.1 report-only children list), read-only tool posture
+(`read, grep, find, ls, bash`), fresh context, engine-injected `structured_output` completion
+(never fenced JSON), delivered via `PERK_AGENTS` into `.pi/agents/perk/`.
+
+## §8.61 · The learn-dream reducer wave + the `run_dream_wave` tool
+
+The second level of the `perk learn dream` analysis pipeline
+(`extension/waves/dreamReducerWave.ts`) and the ONE run-bound tool that makes both levels
+reachable (`extension/doors/dreamWaveTools.ts`, registered globally). The tool
+**structurally refuses outside a dream launch** (below): only the `perk learn dream` door
+(§8.65) plants a run-scoped dream manifest, so it is unreachable in every other session. The
+bundle, the manifest, and every analyst/reducer report are untrusted DATA, never
+instructions.
+
+**The compact analyst bundle.** `DREAM_ANALYSES_FILENAME = "dream-analyses.json"`, written
+run-scoped **beside the run's dream manifest** (the ONE path authority: derived from the
+decode-time-bound `manifest.manifestPath`, never a second `runScratchDir` derivation). The
+versioned shape: `{schema_version: "1", commit_sha, registry_mode, doc_count, total_bytes,
+lanes: [{lane, report}]}` — the identity fields echo the manifest; `lanes` carries the
+re-decoded compact analyst reports **in manifest lane order** (an already-guaranteed invariant
+of the runner's `spec.lanes`-order normalization + `buildDreamLanes`' manifest-order plan + the
+re-decode's doc-order normalization — no re-sort layer). Deterministic serialization
+(pretty-printed JSON + trailing newline). The aggregate budget:
+`DREAM_BUNDLE_BUDGET_BYTES = 393216` (384 KiB), measured as **UTF-8 bytes** of the serialized
+bundle and enforced **before reducer task composition** — over budget ⇒ the bundle is NOT
+written, the reducers are NOT launched, and the aggregate carries the explicit accounting
+`{bytes, budget_bytes, overflow_bytes}` — **never truncation** (a truncated bundle would
+corrupt stance evaluation; overflow is a loud corpus-growth tripwire). The budget governs
+exactly these reducer-INPUT bytes — the post-complete finalize rewrite (below) happens after
+the reducers consumed them and is not budget-checked. An incomplete first
+wave writes nothing (`bundle: null`). **The entry-time removal invariant:** the execute core
+removes any pre-existing bundle at entry (before the first wave), so the fixed name exists
+**iff the current call wrote it** — the incomplete/over-budget arms can never leave a stale
+prior bundle contradicting the returned aggregate, and after an `io_error` the target is
+absent (entry removal ran; the atomic temp+rename never landed). A repeat call (the
+blocking-tool retry — no guard state, the audit/harvest posture) is therefore always
+self-consistent. A **failed entry-time removal** refuses `io_error` BEFORE any spawn — a
+typed refusal with empty `{analyses, attempts}` extras, never an uncaught throw (launching
+over an irremovable stale bundle would break the invariant); the digest marker (below) was
+already cleared, so whatever files the failed cleanup left behind are refused by the
+dream-report recovery.
+
+**The finalize-in-place rewrite + the `dream_bundle_digest` marker (the reviewed §8.61
+widening).** Reducer stances were previously never persisted (reducer reports lived only in
+the tool result); the dream-report draft path (§8.63) needs them to survive pi restarts, so
+after a **fully complete** two-level wave — and only after the **post-wave revalidation
+bracket** (§8.65) passes: evaluated only when BOTH waves completed, BEFORE the finalize
+write; drift ⇒ NO finalize, NO marker set (the entry clear stands — the analyses-only shape
+is left behind and recovery refuses it, so a drifted wave is structurally undraftable), the
+aggregate records the drift and `complete: false` — the execute core atomically REWRITES the
+existing `dream-analyses.json` via
+`finalizeDreamBundle(manifest, analyses, reducers, manifestDigest)`:
+the same wrapper fields (`schema_version` stays `"1"`) plus `manifest_digest` — the
+`sha256:<hex>` digest of the on-disk manifest BYTES the wave read and decoded, extending the
+marker's bundle-byte authentication to the manifest itself (an at-rest manifest edit that
+preserves the echoed identity fields still refuses at recovery) — plus `reducers`, an array
+in the fixed `DREAM_REDUCER_ANGLES` order, each entry the **raw echo shape**
+`{angle, ...report}` (exactly the shape `decodeDreamReducerReport` accepts, the angle
+echoed). Deliberately NOT a second
+file: one fixed name means the analyses-only mid-wave shape and the finalized shape are
+mutually exclusive states of one path — a cross-attempt MIXED state is structurally
+impossible; the `reducers` key is present **iff** finalized, and an incomplete reducer wave
+naturally leaves the analyses-only shape behind (recovery refuses it). The recovery-side
+decode is `decodeFinalizedDreamBundle(raw, manifest, manifestDigest)` — strict, fail-closed,
+every miss a named detail: **the pinned unknown-key policy** — the persisted format is CLOSED
+at every level this decoder authors (the wrapper: exactly `{schema_version, commit_sha,
+registry_mode, doc_count, total_bytes, manifest_digest, lanes, reducers}`; each lane entry:
+`{lane, report}`; each reducer entry: the raw echo keys) with unknown keys refusing; a
+missing `reducers` key refuses as not-finalized; the identity fields must equal the
+manifest's; `manifest_digest` must equal the caller's digest of the manifest bytes just read
+(the manifest-authentication link); `lanes` must pair the
+manifest's lanes EXACTLY (same ids, same order); `reducers` must carry exactly the three
+angles in fixed order (the byte-exact angle echo refuses duplicates/reorders); INSIDE a row
+the reused row decoders (`decodeDreamAnalystReport` over the manifest-derived lane/corpus
+path sets, `decodeDreamReducerReport` over `nonKeepProposals(analyses)`) stay the **single
+row authorities** — whitelisted construction means an extra row-level key is IGNORED and
+never survives into typed values (no fork of the row decoders). This
+closed-wrapper/whitelist-projected-row split is the decided policy, pinned by tests on both
+sides. **The marker lifecycle:** the freshness authority is the `dream_bundle_digest`
+workflow-state field (§8.3) — a bare run-scratch file is never trusted by the recovery
+consumer (the session-artifacts digest-pointer doctrine). The execute clears it (`""`)
+unconditionally at entry BEFORE the stale-bundle removal attempt — the invalidation record
+that keeps the removal `io_error` refusal fail-closed for downstream consumers — and sets it
+to the sha256 of the finalized bytes (`digestSessionData`, the `sha256:<hex>` convention)
+only after the finalize write succeeds. The entry clear is **verified**: `markers.clear()`
+returns the append+read-back result, and an UNVERIFIED clear refuses `io_error` before ANY
+filesystem work or spawn — with the old digest possibly still live, proceeding into a failed
+removal would leave the prior bundle + prior digest PAIR recoverable as fresh, so the wave
+stops instead (no mutation happens, and the untouched prior finalized state remains exactly
+what it was). The marker seam is injected into the execute core (`markers: {clear, set}`;
+the registered tool wires the production `appendWorkflowState` pair); `set` stays
+loud-but-non-fatal — a failed set warns via the read-back check and leaves the marker
+cleared by the entry clear, so recovery refuses; re-running the wave repairs it. A
+finalize-write throw is the SECOND post-launch `io_error` fail arm, mirroring the
+analyst-bundle arm's `{analyses, attempts}` extras retention (the message names the
+finalize).
+
+**The three fixed reducer angles** (`DREAM_REDUCER_ANGLES`, fixed order everywhere — lanes,
+normalized reports, and the vocabulary the dream-report validation's disagreement rule
+references): `consolidation-preservation` (reconcile merge/retire proposals, detect
+cross-cluster redundancy, ensure unique durable content has a surviving home, reject merge
+cycles and retiring merge targets), `currency-accuracy` (challenge claims against current
+repository truth, distinguish obsolete knowledge from still-valid rationale, prioritize
+misleading guidance), `knowledge-architecture` (document boundaries, clusters, routing cues,
+distillation/read cost, harvest-follow-up quality). **The agent:** `perk.dream-reducer`
+(`agents/dream-reducer.md`): report-only (`REPORT_ONLY_CHILD_AGENTS` + the §8.1 report-only
+children list), read-only tool posture (`read, grep, find, ls, bash`), fresh context,
+engine-injected `structured_output` completion (never fenced JSON), stronger-tier default
+model (`anthropic/claude-fable-5`, fallback `anthropic/claude-sonnet-4-5` — the reducers are
+the judgment-heaviest lanes), delivered via `PERK_AGENTS` into `.pi/agents/perk/`.
+
+**The closed reducer schema.** `DREAM_REDUCER_REPORT_SCHEMA`: `additionalProperties: false`
+at every level, all fields required, no if/then, no `pattern`; every `maxItems`/`maxLength`
+reads from the ONE `DREAM_REDUCER_CAPS` SSOT — `stances: 120`, `stanceReasonChars: 300`,
+`stanceEvidenceItems: 4`, `stanceEvidenceItemChars: 250`, `angleFindings: 8`,
+`angleFindingChars: 400`, `uncertainties: 6`, `uncertaintyChars: 300` (string caps in Unicode
+code points, the shared `codePointLength`). Fields: `angle` (the echoed identity, enum =
+the three slugs), `stances[]` `{doc, disposition ∈ revise|merge-into|retire, stance ∈
+endorse|challenge, reason, evidence_checked[]}`, `angle_findings[]`, `uncertainties[]`, and
+the three non-negative-integer omission counters `stances_omitted`/`angle_findings_omitted`/
+`uncertainties_omitted`.
+
+**The stance vocabulary.** A stance is `endorse` or `challenge` with a required non-empty
+`reason` — there is deliberately **no abstain value**; `disposition` is a **defensive echo**
+of the analyst proposal being stanced (mismatch = malformed lane — the audit echoed-identity
+precedent); `evidence_checked` records what the selective verification actually touched (the
+dream-report node's destructive evidence bar consumes it). **Silence counts as
+non-endorsement**: the re-decode never requires stance coverage — empty `stances` is valid —
+and the consumption rule (an unstanced destructive proposal cannot proceed) is the
+dream-report node's evidence bar, not this decode. **The destructive-first priority** (an
+instruction-layer obligation bounded by the schema cap, pinned in the def prose): the two gate
+angles (consolidation-preservation, currency-accuracy) stance every `merge-into`/`retire`
+proposal FIRST and only then `revise` proposals; if the cap truncates, the overflow is counted
+in `stances_omitted` and the resulting silence is **explicitly conservative** — a documented,
+accounted, fail-safe form of incomplete stance coverage (no pre-wave refusal on proposal
+count; `stances: 120` ≥ the non-keep proposal count of any plausible corpus). **The
+selective-evidence posture** (def prose): verify cited evidence — follow the analysts'
+`evidence_checked` pointers and read the specific named docs/code sites, read-only — never
+broadly rescan the corpus, never re-run gather commands, never read docs beyond the
+cited/named ones.
+
+**The re-decode + the wave.** `decodeDreamReducerReport(report, angle, proposals)` —
+whitelisted construction, named details, code-point caps via the shared helpers: the echoed
+`angle` must equal the assigned angle byte-exact and the typed result OMITS it (the aggregate
+names the angle once, on `DreamReducerAnalysis.angle`); each stance row's `doc` must be a
+member of the ordered non-keep proposal universe (`nonKeepProposals(analyses)` — a flat-map
+over the analyses' docs filtered to `revise`/`merge-into`/`retire`, inheriting the manifest
+ordering) with the disposition echo rule above, no duplicate rows, stances normalized to the
+proposal order. `runDreamReducerWave(adapter, {manifestPath, bundlePath, proposals, model?},
+signal?)` runs `flow: "dream-reducer"` under `completeness: "strict"`, ONE attempt, NO retry,
+three fixed lanes — key = label = the angle slug (code-owned, run-key-safe by construction),
+agent `perk.dream-reducer`, short code-composed task text (the angle, the bundle path read
+FIRST, the manifest path, the untrusted-DATA + structured_output lines — the judgment rubric
+lives in the def). Failures surface in the angle-named `DreamReducerFailure {angle, reason,
+detail}` shape (`null` = wave-level); a schema-valid report failing the re-decode is a
+`malformed-report` failure with the angle identity; `complete` = runner complete AND zero
+decode failures; decoded reports retained when incomplete, normalized to the fixed angle
+order. `DreamReducerOutcome` carries `requestedKeys` (= the three slugs) from birth — the
+receipt-correlation twin of §8.60's outcome field. Reducers launch even when the proposal
+universe is EMPTY (a keep-heavy corpus still gets angle findings/uncertainties).
+
+**The tool binding (`run_dream_wave`).** NO parameters (the §8.50 no-param shape,
+`additionalProperties: false`, empty `properties`): the execute recovers the session's claimed
+`run_id` from the rebuilt workflow-state and derives the ONE manifest path
+`runScratchDir(run_id)/dream-manifest.json` (`DREAM_MANIFEST_FILENAME`) — the manifest read
+AND the bundle write are both derived from the claimed run, so no caller-supplied path exists
+(the `run_audit_wave` no-aimable-writer posture, BOTH sides) — the structural boundary
+justifying the `READ_ONLY_TOOLS` carve-in (§8.3), beside `PERK_TOOLS`; deliberately NO
+`STAGE_TOOLS`/drive coverage (cold-only, gate-on — the harvest census posture). The pre-launch
+refusal ladder (each arm before any spawn): no claimed run ⇒ `bad_state`; no run-scoped dream
+manifest ⇒ `bad_state` (the structural refusal outside a dream launch); unparseable JSON ⇒
+`bad_input`; `decodeDreamManifest(raw, manifestPath)` refusal ⇒ `bad_input`;
+`verifyDocContainment` refusal ⇒ `bad_input` (the §8.48 sequence). Both `[models.subagents]`
+keys (`dream-analyst`, `dream-reducer`) are resolved at execute time via `subagentModel` and
+threaded as each wave's workflow-level `model?` default; production runs the RPC adapter,
+tests the in-memory adapter.
+
+**The result posture.** Every post-launch outcome — with the exception of the two write
+`io_error` fail arms below — is **ok** with the full typed normalized
+aggregate — `{complete, analysis: {complete, analyses, failures}, bracket, bundle, reducers:
+{launched, skip_reason, complete, reports, failures}, attempts}` — `complete` = both waves
+complete AND the bracket ok; `bracket` is `{ok, detail}` when evaluated and `null` when an
+earlier incomplete **ok** arm skipped it (incomplete analysis, budget-exceeded, incomplete
+reducers — the bracket fn is never invoked on those arms; the `io_error` **fail** arms return
+the failure-details shape below — error fields plus `{analyses, attempts}` — which carries no
+`bracket` field at all);
+the `skip_reason` vocabulary is `incomplete-analysis` (strict first wave failed —
+no bundle write, **no reducer launch**) and `budget-exceeded` (composed but over budget —
+nothing written, no reducer launch). A drifted bracket retains the analyses AND reducer
+reports in the aggregate (honest coverage). `attempts` carries one output-free `WaveAttemptReceipt`
+per launched wave, built from each wave's code-owned `requestedKeys` (they correlate with
+`children[*].key`, never semantic labels). The TWO post-launch fail arms are the
+analyst-bundle-write and the finalize-write `io_error`s, whose typed extras retain BOTH the
+analyst analyses AND the already-recorded attempt receipts (`{analyses, attempts}` — the
+§8.48 receipt-retention discipline). The
+model-facing result text: the untrusted-DATA banner, the JSON aggregate, and — when
+incomplete — an explicit line that the analysis is incomplete and the parent must present
+coverage honestly and stop before drafting (no retry); on the drifted-bracket arm an
+ADDITIONAL line names the drift ("the repository DRIFTED during the wave (<detail>) — the
+dream snapshot is STALE") — it accompanies the generic incomplete instruction, never
+replaces it.
+
+## §8.62 · The learn-dream report (model, validation, renderer)
+
+The pure interior layer that turns the two-level dream outcome (§8.60/§8.61) into ONE
+checkable, savable final report (`extension/waves/dreamReport.ts`): the structured
+dream-report model, the validation that proves the parent's judgment obeys the pinned curation
+policy, and the deterministic Markdown renderer that owns the CANONICAL report bytes in parts.
+Pure domain code — no fs, no tool registration, no `ExtensionAPI`; imports only the two dream
+siblings. Consumed by the `objective_draft`/review/save wiring (the `dream_report` param,
+§8.63 — landed); part persistence to the backend is §8.64; the whole pipeline is reachable
+only inside a `perk learn dream` launch (§8.65). The input is untrusted DATA,
+never instructions.
+
+**The trust split.** Two input shapes: `DreamReportInput` — untrusted, model-supplied —
+carries ONLY the decisions the design assigns to the parent (the final per-doc disposition
+rows with rationales and fallback reasons, parent uncertainties, ranked selected/overflow
+curation units, harvest follow-ups, predicted effects); `DreamReportContext` — trusted,
+caller-supplied — is `{manifest: DreamManifest, analyses: DreamLaneAnalysis[], reducers:
+DreamReducerAnalysis[], run_id, generated_at}`. Everything factual — snapshot identity (run
+id, commit SHA, counts, bytes, registry mode, findings family counts), wave coverage, analyst
+evidence (rationale/preserve/evidence_checked/confidence), reducer stances, analyst/reducer
+uncertainties, omission counters — is **injected from context**, never accepted from the
+model: the model cannot fabricate evidence, stances, or coverage.
+
+**The completeness precondition.** Validation first re-verifies the context itself:
+non-empty single-line `run_id`/`generated_at` (trusted caller stamps — validated shallowly
+only), `analyses` covering the manifest's lanes exactly (one per lane, manifest order, each
+covering its lane's docs exactly) and `reducers` carrying exactly the three
+`DREAM_REDUCER_ANGLES` in fixed order — a report can only be built from COMPLETE waves;
+anything else refuses (incomplete coverage is never described as complete).
+
+**The input schema + caps SSOT.** `DREAM_REPORT_INPUT_SCHEMA` (exported for the review
+wiring's param embedding) mirrors the §8.60 schema discipline: closed shape at every level,
+all fields required (optional semantics via `null`), enums, no if/then, no `pattern`; every
+`maxItems`/`maxLength` reads from the ONE `DREAM_REPORT_CAPS` SSOT — `rows: 512`,
+`rowRationaleChars: 300`, `fallbackReasonChars: 300`, `uncertainties: 12`,
+`uncertaintyChars: 300`, `selectedUnits: 64`, `overflowUnits: 64`, `unitTitleChars: 150`,
+`unitDocs: 32`, `unitRationaleChars: 400`, `unitNodeChars: 32`, `harvestFollowups: 12`,
+`followupTitleChars: 150`, `followupPointerChars: 250`, `followupEvidenceChars: 250`,
+`followupDestinationChars: 400`, `predictedNoteChars: 300` (string caps in Unicode code
+points, the shared `codePointLength`; `rows`/`selectedUnits`/`overflowUnits` are static
+schema bounds — the real gates are the exact path-set equality, the ≤12-distinct-node cap,
+and the exact partition). **The single-line rule:** every model-supplied string field refuses
+`\r`/`\n` and other C0 control characters with a named detail — the renderer places these
+strings in table cells and bullets, so line structure stays renderer-owned.
+
+**Per-doc validation (downgrade-only).** `rows` path set = the manifest's authored-doc path
+set EXACTLY (no missing/extra/duplicate rows; byte comparison over the §8.60 canonical
+identities), normalized to manifest lane/doc order in the composed report. Exactly one
+disposition per doc from `DREAM_DISPOSITIONS`; `merge_target` non-null iff
+`disposition === "merge-into"`; `rationale` required non-empty on every row.
+**Downgrade-only against the analyst proposal** (destructiveness order `keep(0) < revise(1) <
+merge-into/retire(2)`, the two destructive dispositions incomparable): the final level must
+be ≤ the analyst level; a final destructive row must match the analyst proposal EXACTLY —
+same disposition AND byte-identical `merge_target` (a different target or a merge↔retire swap
+is an unendorsed new action, refused); `keep → revise` is an escalation and refuses.
+`fallback_reason` is REQUIRED non-empty exactly when the final disposition differs from the
+analyst proposal and must be `null` when it doesn't.
+
+**The destructive evidence bar.** For every row whose FINAL disposition is `merge-into` or
+`retire`, over the INJECTED reducer stances for that doc's proposal: an explicit `endorse`
+from `consolidation-preservation` AND from `currency-accuracy`, and NO `challenge` from ANY
+of the three reducers (knowledge-architecture included); silence counts as non-endorsement (a
+missing gate-angle stance blocks eligibility). Anything else refuses with a named detail
+naming the only legal moves — downgrade to `revise`/`keep` with a `fallback_reason`; the
+parent never resolves upward. Eligibility is computed only from context stances, never from
+model input; the bar is necessary, not sufficient (an eligible proposal MAY still be
+downgraded).
+
+**Merge-target survival.** Over FINAL dispositions: every `merge_target` must be a member of
+the manifest corpus path set (existence — revalidated even though analyst-matching rows
+already guarantee it) and must have a final disposition of `keep` or `revise` (survival).
+Survival structurally forbids merge chains and cycles — a merge-into doc can never be a
+target — so acyclicity is subsumed (2-cycles and chains refuse via the survival detail).
+
+**The unit partition.** A curation unit is `{title, docs, rationale}`; selected units
+additionally carry a non-empty `roadmap_node`. **Many-to-one node mapping**: several selected
+units MAY name the same node; the cap is `DREAM_REPORT_MAX_ROADMAP_NODES = 12` DISTINCT
+`roadmap_node` values across the selected units. **Exact partition**: the union of all units'
+`docs` (selected + overflow) must equal EXACTLY the set of docs whose final disposition is
+non-keep — no doc in two units, no empty unit, no final-keep doc in any unit, every unit doc
+a corpus member (accepted work can neither vanish silently nor double-count; final-`keep`
+merge targets are named by the row's `merge_target`, not re-listed). Rank is positional
+(input order), selected and overflow ranked independently; overflow units carry no node.
+Unit atomicity is execution-time guidance owned by the activation prose — the validator
+checks only mapping shape, cap, and partition.
+
+**Harvest follow-ups.** Each `destination` must be a corpus doc path whose final disposition
+is `keep`/`revise`, or a cluster id (the manifest's per-doc `cluster` values) named by at
+least one final-`keep`/`revise` doc — a destination pointing at a merged-away or retired doc
+refuses (repoint at the survivor). `pointer` non-empty; `pointer`/`evidence` capped strings.
+
+**Predicted effects.** Model-supplied `docs_after`/`bytes_after` (non-negative integers) plus
+an optional single-line `note`; `docs_before`/`bytes_before` are injected from the manifest.
+TYPE sanity only — deliberately NO directional/quota rule (a growth prediction is valid,
+pinned by a vacuity-proof test); the renderer states “predictions are not quotas”.
+
+**Two-stage bounded error collection** (the deliberate deviation from the fail-fast decoder
+posture, justified by the interactive redraft loop this validator gates): **structural decode
+fails fast** (context re-verification, non-object input, schema-shape misses including caps
+and the single-line rule — whitelisted construction cannot proceed over malformed input;
+first named detail wins, a one-element `details`); **semantic rules collect** (the per-doc,
+evidence-bar, survival, partition, and destination rules plus the renderer's defensive arm)
+up to `DREAM_REPORT_MAX_VALIDATION_DETAILS = 25` named details in deterministic order
+(validation phase order, then manifest doc order within a phase), overflow appending one
+final synthetic detail counting the omitted violations.
+`validateDreamReport(input, context)` returns `{ok: true, report}` (the composed
+JSON-serializable `DreamReport` — snapshot, findings counts, coverage, rows joined with
+analyst evidence + stances, uncertainties by source, reducer findings, units, follow-ups,
+effects) or `{ok: false, details}`.
+
+**The deterministic renderer.** `renderDreamReport(report)` → `{ok: true, parts: string[]}`
+or `{ok: false, detail}` — a pure function of the composed report (no clock, no locale, no
+environment); the renderer owns the CANONICAL report bytes. Constants:
+`DREAM_REPORT_PART_MAX_CHARS = 60_000` — the per-part cap measured in Unicode CODE POINTS
+(the `journal.py` `JOURNAL_EVENT_MAX_CHARS` precedent — that precedent is a single-body
+refusal cap; the part-splitting semantics are new here), under GitHub's 65,536-char comment
+limit with margin for the persistence-side storage markers (the renderer never emits marker
+HTML) — and `DREAM_REPORT_PART_HEADER_RESERVE = 200`, the fixed per-part packing allowance
+for the part header. Pipeline: the report renders to an ordered stream of Markdown blocks;
+blocks are greedily packed into parts under `cap − reserve`; splits happen only at block
+boundaries; a table split re-emits the table header row in the next part; bullet-list
+sections (§7 Uncertainties, §8 Reducer findings) pack per bullet line — a block group splits
+at line boundaries, header re-emission applying only to tables — keeping the single-block
+defensive refusal structurally unreachable under the caps arithmetic; after packing, each
+part is prefixed with its header — part 1 `# Dream report — <run_id>`, continuations
+`# Dream report — <run_id> (continued, part <i> of <n>)`. A single block exceeding the budget
+is a defensive refusal (named, never truncated). Fixed section order: 1 Snapshot (run id, `DREAM_REPORT_SCHEMA_VERSION = "1"`,
+commit SHA, generated-at, registry mode, doc count, total bytes) · 2 Findings summary
+(per-family counts) · 3 Wave coverage (analyst lanes + reducer angles tables with omission
+counters) · 4 Dispositions (ONE table, manifest order: path, cluster, analyst proposal, final,
+merge target, analyst confidence, rationale) · 5 Non-keep evidence (per FINAL non-keep doc:
+injected analyst rationale/preserve/evidence_checked + every injected reducer stance) ·
+6 Fallbacks (rendered directly from the rows carrying a non-null `fallback_reason`, manifest
+order: doc, analyst proposal, final, reason — a final-`keep` fallback renders its stances
+here, so every reducer stance renders exactly once, §5 or §6) · 7 Uncertainties
+(parent, then analyst by lane, reducer by angle, labeled) · 8 Reducer findings (the injected
+`angle_findings` — a deliberate minor addition beyond the node's section list) · 9 Selected
+curation units (rank-ordered) · 10 Overflow · 11 Harvest follow-ups · 12 Predicted effects
+(with the explicit not-quotas line). Rendering hygiene: model strings are single-line by
+validation; INJECTED strings may carry newlines/pipes — in a table cell or bullet, `|` is
+escaped and internal newline runs collapse to a single space (deterministic sanitization; the
+typed report retains exact strings).
+
+**The entry point.** `buildDreamReport(input, context)` — validate, compose, render, and
+enforce the part budget in ONE call, returning `{ok: true, report, parts}` or
+`{ok: false, details}` (the renderer's single-detail defensive arm wrapped into a one-element
+`details`) — so the draft path validates BEFORE review and an approved report is always
+savable.
+
+## §8.63 · The `dream_report` objective draft/review wiring
+
+The concrete `dream_report` field on the objective draft/review/save path — deliberately NOT
+a generic companion abstraction (one consumer, one kind). The dream arms are structurally
+reachable only inside a `perk learn dream` launch (§8.65 — a session outside one has no
+run-scoped `dream-manifest.json`). Absence-compatible by construction: every existing
+objective path stays **byte-identical** without the field.
+
+**The shared param vocabulary.** `objective_draft` and `objective_save` both carry an
+optional `dream_report` parameter embedding the §8.62 `DREAM_REPORT_INPUT_SCHEMA` by
+identifier as `DREAM_REPORT_PARAM_SCHEMA` (`extension/factories/objectiveDraft.ts` — the leaf
+owning the shared vocabulary, the `DELIVERY_PARAM_SCHEMA`/`ROADMAP_PARAM_SCHEMA` pattern)
+plus the gate description ("required inside a dream session, refused outside one"). The
+shared `decodeObjectiveSaveParams` decodes it as a tri-state plain object (absent →
+`undefined`, present-but-not-a-plain-object → strict-fail); deep validation stays with the
+gate resolver.
+
+**The ONE gate resolver.** `resolveDreamReportGate(ctx, input, generatedAt)`
+(`extension/factories/objectiveDreamReport.ts`) implements the whole matrix ONCE — both
+`writeObjectiveDraft` and `saveObjective` consume its typed outcome
+(`absent` | `block` | `refuse{errorType, detail}`); no parallel branch/message
+implementations. "Dream session" is detected structurally, exactly like `run_dream_wave`: the
+session's claimed `run_id` + the existence of `runScratchDir(run_id)/dream-manifest.json` (no
+claimed run counts as non-dream). The matrix (identical at draft-write and save): non-dream +
+absent → `absent` (unchanged, byte-identical behavior); non-dream + present → refuse
+`invalid_input` (refusing rather than silently dropping it); dream + absent → refuse
+`invalid_input` (the objective and its report review as ONE bundle — draft-time enforcement
+means a report-less dream bundle can never reach review, so an approval is always savable,
+the §8.62 "validates BEFORE review" promise); dream + present → recover trusted context →
+**the revalidation-bracket re-check** (§8.65 — after context recovery authenticates the
+manifest, `bracket(ctx.cwd, manifest.commit_sha)` runs at draft-write AND save, both
+consumers flowing through this one resolver; drift refuses `bad_state` — "the repository
+moved since the dream snapshot (<detail>) — the analysis is stale; re-run perk learn dream";
+non-dream paths never reach the bracket; the resolver's optional fourth parameter defaults to
+the production `revalidationBracket`, injected only by tests) →
+`buildDreamReport(input, context)` → refuse on any failure, else yield the block. The gate
+reads ONE workflow-state snapshot with error distinction: an UNREADABLE state (a throwing
+branch read) refuses `bad_state` BEFORE the matrix — never conflated with a confirmed
+non-dream session (a transient read failure must not surface as `absent`). Failure
+taxonomy (soft results, never throws): gate violations and `buildDreamReport` validation
+refusals → `invalid_input` (the bounded ≤25 named details ride the message, newline-joined);
+an unreadable workflow state, context-recovery failures (missing/stale/tampered/undecodable
+run-scratch state — "re-run the dream wave"), and the save-time stored-parts mismatch →
+`bad_state`.
+
+**Trusted-context recovery** (module-internal, fail-closed, every arm a named detail):
+(1) read + parse the run-scoped manifest and `decodeDreamManifest(raw, manifestPath)` (the
+strict §8.60 decoder, path bound at decode time; no `verifyDocContainment` — the report path
+reads no doc files, so the lexical decode suffices; resolved containment stays the wave
+tool's pre-spawn concern); (2) **the freshness check** — the `dream_bundle_digest` marker
+(§8.3/§8.61, read from the gate's one workflow-state snapshot) must be present, non-empty,
+and equal the digest of the bundle bytes just read (missing/empty/mismatch refuses); (3)
+`decodeFinalizedDreamBundle(parsedBundle, manifest, digest-of-manifest-bytes-just-read)`
+(§8.61 — the analyses-only mid-wave shape refuses here, and the bundle's bound
+`manifest_digest` authenticates the manifest itself: the marker covers the bundle bytes and
+the bundle covers the manifest bytes, so an at-rest manifest edit refuses); the recovered
+context is `{manifest, analyses, reducers, run_id, generated_at}`.
+
+**The artifact block.** A valid dream draft stores `dream_report: {input, generated_at,
+parts}` in `objective-draft.json` — **tool-written only** (the model never writes the
+artifact): `writeObjectiveDraft` runs the gate, stamps `generated_at` ONCE
+(`new Date().toISOString()`), and stores the validated input beside the rendered CANONICAL
+parts. `readObjectiveDraft` validates the block via `decodeDreamReportBlock` (a plain-object
+`input`, a non-blank `generated_at`, a non-empty all-string `parts`) and refuses the WHOLE
+draft on a malformed block (warn + `null`) — deliberately stricter than the lenient
+junk→absent handling of `base`/`delivery` (§8.1).
+
+**One approval bundle.** `renderObjectiveDraft` appends the stored parts as the final section
+(`trimEnd()` + `"\n\n"` + `parts.join("\n\n")` + `"\n"`; the parts carry their own
+`# Dream report — <run_id>` headers), so the review surfaces need ZERO plumbing:
+`plan_review`'s objective arm and the browser door both review via
+`readObjectiveDraft` + `renderObjectiveDraft`, the browser's stale-draft guard covers the
+report bytes for free (it compares raw artifact bytes), and DENY routes the ordinary
+full-redraft `objective_draft` loop (no new machinery).
+
+**Save-time re-validation.** `saveObjective` accepts `dream_report` as ONE carrier with two
+sources: the direct tool path wraps only a PRESENT decoded value as `{input}` (the save
+stamps `generated_at`; an `{input: undefined}` carrier is never constructed — presence is the
+`opts.dream_report === undefined` boundary); the approval path (`objectiveApprovalSave`)
+passes the artifact block through whole — stored stamp AND stored parts. Before the cold-door
+call the gate re-runs against freshly recovered context, and when stored parts are present
+they are byte-compared (`JSON.stringify` equality) against the re-rendered parts — a mismatch
+(run-scratch drift or artifact tamper between draft-write and save) refuses `bad_state` with
+nothing saved and the read-only gate left on. The one `generated_at` stamp is what keeps the
+re-render deterministic. On success the parts cross to the Python save door through the
+run-scoped transfer file and are durably persisted as the report companion — **§8.64** (which
+superseded the original §8.63 deferral); no new cold-door flag exists.
+No new ok-details fields on either tool (the visible review bundle and the normal ok results
+already carry the signal). `STAGE_TOOLS`/`READ_ONLY_TOOLS` are untouched: `objective_draft`
+stays read-only-safe (the dream arm only READS run scratch; the marker rides the ordinary
+session-entry channel), `objective_save` stays gate-excluded.
+
+## §8.64 · Dream companion persistence + convergent save ordering
+
+The dream save's durable half (Objective #1892 Node 4.3): the run-scoped **transfer file**
+carries the reviewed CANONICAL parts from the extension to the `perk objective create` save
+door; the door stamps `origin` (§8.24), re-checks the open-by-origin conflict, persists the
+parts as the immutable **dream report companion** on the objective's **report carrier**, and
+publishes the per-backend human artifact — all BEFORE activation (activation stays LAST, cold-
+door success only). The producing session is the `perk learn dream` launch (§8.65).
+
+**The transfer file.** `dream-report-transfer.json`, run-scoped scratch
+(`run_scratch_dir(root, run_id)`), filename constant mirrored in both planes
+(`perk.learn.dream_companion.DREAM_REPORT_TRANSFER_FILENAME` ↔
+`extension/factories/objectiveSave.ts` — parity-pinned): `{schema_version: "1", run_id, parts}`.
+Written atomically by `saveObjective` on the dream arm only — after the gate yields `block`
+(and after the approval-path byte-compare), BEFORE the cold door; a write throw is the soft
+`errorType: "scratch_failed"` failure (the `runColdDoor` stdin-staging precedent) — the cold
+door is NOT invoked, nothing activates, the read-only gate stays on. Non-dream saves write
+nothing (byte-identical). **No `origin` field**: the transfer has one producer and one meaning,
+so the door derives `ObjectiveOrigin.LEARN_DREAM` on the validated dream arm itself — origin
+stays launch-owned (no `--origin` flag exists; manual/direct saves have no transfer file and
+never stamp it; a manual retry with the same `--run-id` IS convergence). `run_id` is the
+cross-run mismatch guard. Door-side decode is a `StrictInputModel`
+(`DreamReportTransferModel`): `schema_version` literal `"1"`, `run_id` must equal the door's
+resolved run id, `parts` a non-empty list of non-empty strings — malformed refuses
+`invalid_input` (never ignored). **Structural launch evidence:** a present transfer requires
+the run-scoped `dream-manifest.json`; transfer-without-manifest refuses `invalid_input`. A
+transfer combined with `--supersedes`/`--adopt-from` refuses `invalid_input`. `--dry-run`
+stays fully offline and byte-identical (the transfer arc, the guard, and the companion are all
+skipped; payload unchanged).
+
+**Save-door ordering (the dream arm, strictly).** (1) transfer decode + the shared
+part-invariance rule — before ANY network, the GitHub auth probe included (`require_github`
+runs only after the offline refusal ladder, so a malformed transfer refuses `invalid_input`
+even unauthed — never masked by `github_unauthed`); an unreadable / invalid-UTF-8 transfer
+file refuses the same `invalid_input`, never a raw crash; (2) the existing stacked block stays byte-positioned (strict train validation +
+`Delivery.prepare` exactly where they run today — a dream+stacked save keeps the
+pre-persistence capability gate); (3) the **origin conflict re-check** immediately before
+create: `find_open_objective_by_origin(origin=LEARN_DREAM, exclude_run_id=<run id>)` — a
+returned ref refuses `error_type="origin_conflict"` naming the existing objective id + url;
+exhaustive-or-raise means a lookup failure fails closed; the residual re-check→create race is
+documented (below), not closed — guard adjacency to create minimizes the window; (4)
+`create_objective(…, origin=LEARN_DREAM)` — origin stamped atomically at initial creation;
+the find-then-return `run_id` idempotency recovers an interrupted dream save's later steps;
+(5) companion convergence: carrier = `journal_carrier_id(objective_id)` (`None` → raise) →
+`persist_parts` (create-once, byte-compared) → `publish_dream_artifact` (Linear real / GitHub
+no-op) → `update_objective_header({"dream_report": <carrier_id>})` LAST; (6)
+`post_status_update` stays byte-positioned (after the try-block, fresh-create only) — the
+accepted consequence: a companion failure after create skips it, and the converging retry
+(`existed=True`) skips it permanently (bookkeeping, never load-bearing); (7) the `--json`
+payload is byte-identical (no new machine fields — the header field is the durable reference);
+one `user_output` narration line reports the converged part count + carrier; (8) activation
+LAST: `saveObjective` appends `active_objective` + the budget marker only after cold-door
+success — any failure in 1–5 exits non-zero, nothing activates, the gate stays on, retry
+converges. Failure mapping: `CompanionConflictError` → `error_type="companion_conflict"`;
+`CompanionAppendAmbiguous` → `"companion_ambiguous"`.
+
+**The companion core** (`perk/learn/dream_companion.py` — backend contracts only; mirrors the
+§8.43 journal disciplines without reusing the journal). The **report carrier** is
+`ObjectiveStore.journal_carrier_id` — GitHub: the objective issue itself (normalized id);
+Linear: the Project metadata sentinel's identifier. **Marker grammar** (dual-encoding):
+canonical HTML `<!-- perk:learn-dream-report:<run_id>:<i> -->`; the parser also accepts the
+inline-code rewrite `` `perk:learn-dream-report:<run_id>:<i>` ``. `<i>` is a canonical 1-based
+decimal (no leading zeros/signs — any other spelling in a marked comment is corruption).
+Marker-text detection is substring-based; a comment carrying the marker text MUST parse
+strictly (marker on the PHYSICAL first line — leading blank lines/indentation are corruption,
+never normalized away, for foreign-run comments identically; identity from the first line;
+marker-text count > 1 in one body = corruption; an edited marked comment = corruption); an
+unmarked comment is unrelated untrusted DATA. A comment body is `marker + blank line + part`. **Dual-candidate
+byte-identity:** a stored body converges iff byte-equal to the verbatim render OR the local
+transcode candidate (the marker-line inline-code rewrite derived by the same rule as
+`to_linear_markdown`, never imported from the Linear backend — with invariant content the only
+rewritten line is perk's own marker line, so the candidate is exact). **`persist_parts`**: one
+complete `read_comments` scan (foreign-run companion comments parse strictly but never
+participate; an index outside `1..N` for this run is corruption — a stale longer render never
+silently tolerated; conflicting duplicates under one key are corruption); per index, present +
+byte-equal → idempotent skip, differing → loud `CompanionConflictError`; absent → POST with
+the rescan-one-retry ambiguity policy (a raised POST is AMBIGUOUS; the complete rescan
+decides; only proven absence earns the one retry; a failed rescan or a still-unproven write
+raises `CompanionAppendAmbiguous` — never a blind re-POST).
+
+**The three-point invariance rule** (ONE shared rule, parity-pinned fixtures across both
+planes — `tests/parity/dream_report_invariance.json`): parts must be **transcode-invariant** —
+non-empty; no perk HTML-comment marker; no literal `perk:learn-dream-report` marker text; no
+exact `<details><summary><code>…</code></summary>` / `</details>` wrapper line (the shapes
+`to_linear_markdown` rewrites/drops); no line boundary other than `\n` (`\r`, VT, FF, FS/GS/RS,
+NEL, U+2028/U+2029 — the transcoder's `splitlines()` + `"\n".join` normalizes every other form,
+which would defeat the dual-candidate byte comparison forever); full comment body ≤ 65,000 chars
+(`COMPANION_COMMENT_MAX_CHARS`, the backstop under GitHub's 65,536; §8.62 already caps parts
+at 60,000 code points). Enforced at THREE points: TS-side in the gate resolver (draft-write
+AND save — approved ⇒ savable), door-side at transfer decode (before anything durable), and as
+the `persist_parts` pre-POST backstop.
+
+**The per-backend human artifact** (`publish_dream_artifact(repo_root, …)` in
+`perk/backends/resolve.py`, ONE function keyed off the committed `[issues]` selection — no
+strategy objects). GitHub → an **immediate return** (the marker-keyed parts on the objective
+issue ARE the visible artifact). Linear → the `perk/backends/linear/dream_report.py`
+`publish_dream_artifact` flow: presence probe first (the new `project_external_links` read —
+skip when a Resources link labeled `Dream report (<run_id>)` exists), else
+`LinearClient.upload_file(filename="dream-report-<run_id>.md", content_type="text/markdown",
+content)` — one call owning the whole `fileUpload` reservation (sized by the actual bytes) +
+signed-PUT choreography (the PUT rides the same injectable transport, propagating the
+reservation headers + `Content-Type`) and returning the asset URL — → the existing
+`create_entity_external_link(project_id, label, url=<assetUrl>)`. The uploaded bytes are the
+canonical parts joined `"\n\n"` — verbatim, never transcoded (a file asset, not a comment).
+**Fail-loud** (part of the convergent sequence, never fail-open bookkeeping) — each boundary
+failure fails the save; retry converges. Uploaded assets are workspace-auth-gated (fine — the
+artifact serves workspace humans). Non-binding recorded intent: once `gh` grows general-file
+issue attachment (cli/cli#14194; today's preview `--attach` is images/video only), the GitHub
+arm may attach the rendered report file — a desire, not a promise.
+
+**The `dream_report` header field.** `OBJECTIVE_HEADER_FIELDS` gains `dream_report` —
+merge-writable by design (recorded AFTER create per the activation-last ordering; `origin`
+stays excluded). Value = the carrier id only (GitHub: the objective issue's own normalized
+number; Linear: the sentinel identifier) — the header already carries the run's `run_id`,
+parts are keyed `(run_id, index)`, and discovery is the marker scan (no comment-id list). No
+`ObjectiveHeader` dataclass field; a superseding successor deliberately does not carry it (the
+report stays with the run that produced it).
+
+**Documented residuals** (accepted, not closed): (1) the origin-guard re-check→create race
+(non-atomic by design; adjacency minimizes the window); (2) the store-tier interrupted-create
+posture — `create_objective`'s find-then-return on a `run_id` hit does not converge a
+partially created objective (a pre-existing window shared by every objective save; this node's
+OWN steps are each convergent); (3) the Linear pre-sentinel orphan window — a project created
+but its sentinel create crashed is invisible to `find_objective` AND
+`find_open_objective_by_origin`; a dream retry creates a fresh project and the orphan lingers.
+Guidance: an orphan is a project with no `Perk: objective metadata` issue and no perk header
+attachment — delete it manually; it carries no perk state and no report parts; (4) the Linear
+orphan-asset window — a crash after `fileUpload`/PUT but before the link write leaves an
+uploaded asset with no discoverable run key; the retry uploads a fresh asset and links it;
+unreferenced workspace assets are inert.
+
+## §8.65 · The learn-dream activation (door + preflight + revalidation bracket)
+
+**The door.** `perk learn dream` — a seeded cold door (the seeded-door pipeline,
+`perk/cli/commands/learn/dream_cmd.py`) borrowing the `objective-author` stage descriptor via
+`prompt_override` (no new registry stage), `binding_trigger="command:learn-dream"`, options =
+exactly the shared seeded-door family (`--worktree`, `--dry-run`, `--remote` local-only,
+`--json`, `--no-sync` phrased for the pre-gather sync, trailing `pi_args`). **No `--from`
+exists, and the door actively rejects the spelling**: the gather closure scans `pi_args`
+FIRST — before the banner, the sync, or any side effect — and any token `== "--from"` or
+starting with `--from=` refuses `invalid_input` naming `perk learn harvest --from` as the
+partial-corpus door; every other unknown token keeps the family's pi passthrough semantics.
+Cold-only (no warm `/learn-dream` door — an objective non-goal) and backend-light: no
+`require_github`, `backend_errors=()` — the only backend read is the origin guard below,
+wrapped explicitly.
+
+**The preflight (ordering, exact).** (1) the `--from` rejection above; (2)
+`launch.resolve_target(stage, remote)` — the local-only rejection before any side effect;
+(3) the gated launch banner; (4) the **`GitError → git_error` fail-closed boundary** opens —
+one `try/except git.GitError` around every git probe below (the `create_cmd.py` precedent):
+an unprovable probe (e.g. `git status` cannot run) becomes a typed `git_error` refusal, never
+a traceback and never an assumed-clean snapshot; (4a) the ONE pre-gather guarded fast-forward
+(`_sync_main_checkout`, only when `not dry_run and not no_sync`; `run_seeded_door` gets
+`no_sync=True` unconditionally so the in-launch sync never fires — the harvest
+one-revision-boundary discipline); (4b) the **single SHA capture** — the STRICT resolver
+`git.head_commit` runs exactly ONCE per invocation: an UNBORN head (a `--verify --quiet`
+verification failure) refuses `invalid_input` ("commit once"), while any other probe failure
+raises `GitError` into the boundary's `git_error` arm — a broken probe never misreports as
+"commit once"; (4c) the **clean-checkout requirement** — `git.is_dirty` (untracked included)
+refuses the distinct type `dirty_checkout` (a distinct repair action: commit/stash); runs on
+`--dry-run` too; (4d) the **index-flag refusal** — `git.index_flagged_paths` (any
+assume-unchanged or skip-worktree entry, the `ls-files -v` lowercase/`S` tags) refuses
+`invalid_input` naming the flagged paths (≤10 shown): either bit hides edits from
+`git status`, so 4c's proof would not be a proof (a sparse checkout is the common producer);
+(5) the gather (`gather_dream`) — its §8.59 refusals pass through the door envelope
+unchanged; (6) the **tracked-corpus rule** (still inside the GitError boundary), BOTH
+directions — the gathered doc-path set must EQUAL the tracked learned corpus (the tracked
+`docs/learned/**/*.md` set minus the generated `index.md` — the `read_learned_docs`
+enumeration rule): gathered ⊆ tracked because `git status --porcelain` omits gitignored
+files, so an IGNORED doc could be gathered while the tree reports clean (refused
+`invalid_input` naming every offender as not reproducible from the stamped commit;
+plain-untracked docs already refused at 4c); tracked ⊆ gathered because the gather
+enumerates the FILESYSTEM, so a tracked doc absent from disk (a sparse/skip-worktree
+checkout) would silently narrow a "whole-corpus" audit (refused `invalid_input` naming every
+missing doc); (7)
+the **pre-launch active-origin guard** (real launch only — skipped entirely on `--dry-run`,
+which stays offline): `resolve_objective_store(repo_root)` +
+`find_open_objective_by_origin(origin=LEARN_DREAM, exclude_run_id=None)` wrapped in ONE
+`try/except (ObjectiveStoreError, IssueBackendError)` → `origin_lookup_failed` (**fail-closed**
+— the wrap covers the store resolution AND the lookup); a returned ref refuses
+`origin_conflict` naming `#<id>` + url ("complete or close it before dreaming again"); the
+guard runs BEFORE the run id is minted and before any scratch write (`exclude_run_id=None`
+because a freshly minted run can have no stored objective; the §8.64 save-time re-check owns
+the current-run exclusion); (8) mint + `write_manifest` (`OSError` → `manifest_write_failed`);
+(9) the seed render — `stages/learn-dream.md` with exactly three string vars
+(`manifest_path`, `doc_count`, `lane_count`; lane ids/cluster names stay DATA in the
+manifest, never interpolated into instruction text).
+
+**The `--dry-run` posture.** Offline (the origin guard is never evaluated), side-effect-free
+outside run scratch, validates ALL local preconditions (the `--from` rejection, HEAD, the
+clean check, the gather refusals, the tracked-corpus rule), and **materializes on dry-run**
+(the manifest is written — the harvest posture). The full `--json` dry-run payload keys,
+exactly: `{success, error_type, manifest_path, commit_sha, registry_mode, doc_count,
+lane_count, lane_ids, total_bytes, origin_guard: "not-evaluated", launched: false}`.
+
+**The error vocabulary** (one envelope): `remote_blocked`, `invalid_input` (the `--from`
+spelling, an unborn HEAD, the index-flag refusal, the gather's §8.59 `invalid_input` arms,
+both tracked-corpus arms), `dirty_checkout`, `git_error`, `no_learned_docs`, `invalid_registry`, `incomplete_registry`,
+`origin_conflict`, `origin_lookup_failed`, `manifest_write_failed`, `not_a_repo`. Stable
+exits: `0` ok · `1` op-failure/refusal · `2` not-a-repo.
+
+**The carrier map** (§8.57): the seed (`prompts/stages/learn-dream.md`) is the launch-flow
+carrier — the manifest read, the ONE no-argument `run_dream_wave` call (single-lane included
+— dream has no direct-analysis path), the uniform incomplete rule (ANY tool failure — a
+pre-spawn `bad_state`/`bad_input` refusal, any `io_error` arm, or an ok aggregate with
+`complete: false`, the drifted bracket included — is an INCOMPLETE audit: report honestly,
+STOP before `objective_draft`, no retry, never a direct corpus read), the clean-audit stop,
+and the review-first authoring loop. The seed hardcodes NO skill pointer; the
+`perk-learn-dream` skill's read path rides the `command:learn-dream` nudge binding (§8.9),
+and the skill carries the judgment detail only: the closed dispositions, the destructive
+evidence bar + disagreement rule (downgrade-only), the truth-then-leverage ranking, the
+unit/≤12-distinct-node selection shape, the report-only harvest follow-ups, the
+`dream_report` param fields, and the `perk-objective-author` cross-reference.
+
+**The revalidation bracket.** `revalidationBracket(cwd, expectedSha, probes?)`
+(`extension/substrate/git.ts`) — the module's ONE deliberately **fail-closed** composition:
+drift when HEAD cannot be resolved, when HEAD ≠ `expectedSha` (naming both SHAs), when
+cleanliness cannot be verified, when the tree is dirty, when the index-flag state cannot be
+verified, or when the index carries assume-unchanged/skip-worktree flags
+(`indexHidesChanges` — either bit hides edits from the status probe, the same hazard the
+door's 4d refusal closes at launch time); ok otherwise. `/.perk/workflow/`
+is gitignored, so run-scratch writes (the manifest, `dream-analyses.json`) never trip the
+tree-clean check. Two wiring points, by reference: the post-wave check inside
+`executeDreamWave` (§8.61 — after both waves complete, BEFORE the finalize write; drift skips
+the finalize AND the marker set, so a drifted wave is structurally undraftable) and the
+before-drafting/save re-check inside `resolveDreamReportGate` (§8.63 — after context
+recovery, at draft-write AND save; drift refuses `bad_state` with "re-run perk learn dream").
+
+**The claim, narrowed honestly.** The bracket proves **end-state equality** — HEAD unchanged
+and tree clean at each check against the stamped `commit_sha` — never mid-wave byte
+immutability. Accepted residuals (documented, not closed): (1) a transient
+modify-and-restore during the wave window is invisible (a revalidation bracket, not a frozen
+checkout — no physically frozen/materialized-commit snapshot in v1, the objective's stated
+non-goal — a transient flag-edit-unflag inside the window is the same class); (2) an
+ignored `docs/learned` file appearing MID-session is invisible to the
+tree-clean check (launch-time trackedness is door-enforced; the mid-session blind spot is the
+same window class); (3) the §8.64 gate-check→create race window is unchanged (the save-time
+origin re-check + adjacency own it).