@mstar-harness/dsh 3.10.2 → 3.11.0

package/harness-skills/mstar-host/references/omp.md

@@ -267,19 +267,30 @@ Not a user activation command: nothing is spawned, merged, leased or written to
 
 1. **`bind`** — the **`phase-2-entry`** anchor (→ **§ Host hooks**): the coordinator's **Phase 2 execute/resume entry** (immediately before the per-plan loop, after the §2.0 gates; §2.3's Phase-1-reused integration-worktree step is not this anchor), independent of any setting or model handoff, and also required on a no-argument `/iteration-drive` resume. Call shape, authority derivation, the rejection set and its refusal codes live in that section.
 2. **`checkpoint`** — the **`rescheduling-checkpoint`** anchor (→ **§ Host hooks**): acknowledge that PM ran the shared scheduling procedure against the sample taken at that moment, with `reason` from the five frozen names and `decision` ∈ `dispatched | wait | blocked`. The runtime attaches the sampled key; the caller cannot choose or reset it. `blocked` suppresses advisory continuation until a new explicit user turn or a later checkpoint clears it — never a timer or incidental snapshot churn. A checkpoint carries a decision and note, never a ready list.
-3. **`reserve-launch`** — `{operation:"reserve-launch", planId, transport:"herdr"|"tmux", skill:{name,source}, capability:{executable,version,target}}`. Admission additionally requires the enabled opt-in, a valid latest capacity, a coordinator-prepared row with no plan binding/lease/handoff, the identical prepared Assignment hash, an existing canonical **distinct** feature worktree on its assigned branch, and the transport prerequisites. Only `applied:true` authorizes a side effect; an identical duplicate returns the recorded intent with `applied:false` and authorizes nothing, while a different live intent/binding for that plan refuses. Intents are journaled at `<workflow dir>/omp-launches.json` — a plugin-owned transport journal, never a lifecycle register.
+3. **`reserve-launch`** — `{operation:"reserve-launch", planId, transport:"herdr"|"tmux", skill:{name,source}, capability:{executable,version,target}}`. Admission additionally requires the enabled opt-in, a valid latest capacity, a coordinator-prepared row — prepared by **`mstar plan prepare`**, the coordinator step that writes `coordination.prepared` and its pinned Assignment path (verb preconditions and sequence → `mstar-use-cli/references/plan-and-workflow.md`) — with no plan binding/lease/handoff, the identical prepared Assignment hash, an existing canonical **distinct** feature worktree on its assigned branch, and the transport prerequisites. Only `applied:true` authorizes a side effect; an identical duplicate returns the recorded intent with `applied:false` and authorizes nothing, while a different live intent/binding for that plan refuses. Intents are journaled at `<workflow dir>/omp-launches.json` — a plugin-owned transport journal, never a lifecycle register.
 4. **`record-launch`** — one transition per observed step, each recorded **before** its matching side effect: `{operation:"record-launch", intentId, observation, target?, evidencePath}` with `observation` ∈ `starting | created | submitting | submitted | refused | uncertain`. Strict forward order `reserved → starting → created → submitting → submitted`; `starting` permits pane creation, `created` (which **requires the returned opaque target**) permits starting OMP in it, `submitting` permits the single scoped prompt. Only a newly persisted transition reports `applied:true`; PM acts only on that. `refused` is legal only for an observed failure that provably precedes any process/prompt side effect; from `submitting` onward a lost outcome is `uncertain`, which is terminal. A recorded target is never re-pointed, and settings/capacity/ownership are re-read before each side-effecting transition.
 
+Ordered summary of the extra-primary route: the plan row is **registered during Prepare** and still `Todo` → its assigned feature worktree exists → the coordinator is bound → **`mstar plan prepare`** prepares the row and produces the prepared Assignment → `reserve-launch` (item 3) → the record-before-side-effect transitions of item 4, then the pane/start/submission sequence in **§ Optional transport** below. Launch through this journaled sequence only; never invent a shorter unjournaled path. Row admission closes with Phase 1 — earlier once any row starts preparation or execution — so a row that was not admitted by then does not exist and cannot be launched. `mstar plan prepare` itself has no phase gate: it requires only a claimable unprepared row, so an already-registered eligible row may be prepared during Phase 2. Row admission and row preparation are different operations, and nothing here widens an engine rule. The host-agnostic statement of this precondition lives in `mstar-iteration/references/plan-scoped-pm.md` § Transport.
+
 Refusal codes for `reserve-launch` / `record-launch` — **not** anchor-triggered (the optional extra-primary path carries no shared anchor moment, so these belong to no anchor row): `launch.invalid-request`, `launch.session-denied`, `launch.phase-inactive`, `launch.snapshot-unreadable`, `launch.journal-corrupt`, `launch.plan-not-found`, `launch.plan-unavailable`, `launch.plan-not-prepared`, `launch.plan-occupied`, `launch.prepared-hash-drift`, `launch.worktree-unavailable`, `launch.capability-unavailable`, `launch.settings-disabled`, `launch.settings-invalid`, `launch.settings-read-failed`, `launch.capacity-exceeded`, `launch.intent-not-found`, `launch.transition-invalid`, plus the shared `tool-error`. Every one is a visible refusal that authorizes nothing; success codes are `reserved` / `recorded`, and `replayed` (`applied:false`) for an identical duplicate that likewise authorizes no side effect.
 
 ### Optional transport (skill-driven — no compiled bridge)
 
 Every prerequisite is required and checked per launch: the **corresponding optional skill actually present in the catalog and read** (the `herdr` skill today; a tmux skill only if one truly exists — binary existence is not skill availability), the CLI executable available, and this session actually inside the matching managed environment (`HERDR_ENV=1`; `TMUX` set for tmux). Two managed environments visible at once is a visible refusal, not a focus-based choice. A missing prerequisite is a **visible no-op**: no process start, no silently substituted plan, native background scheduling intact, never a fabricated success. This never becomes a mandatory load-order dependency of the standalone `mstar-*` skill set.
 
-**Herdr** (the currently available contract — read the skill and its current group help/status at use): create the pane with `herdr pane split --current --direction <chosen> --cwd <prepared-worktree> --no-focus` and use the returned `result.pane.pane_id` verbatim as the opaque target; then `herdr agent start <unique-name> --kind omp --pane <returned-id>`; then submit exactly once with `herdr agent prompt <unique-name> "/iteration-drive --assignment <absolute-prepared-assignment>"`, without waiting for plan completion. Preserve CLI argument boundaries.
+**Herdr** (the currently available contract — read the skill and its current group help/status at use): create the pane with `herdr pane split --current --direction <chosen> --cwd <prepared-worktree> --no-focus` and use the returned `result.pane.pane_id` verbatim as the opaque target; then `herdr agent start <unique-name> --kind omp --pane <returned-id>`; then submit exactly once with `herdr agent prompt <unique-name> "/iteration-drive --assignment <absolute-prepared-assignment>"`, without waiting for plan completion. Preserve CLI argument boundaries. `<absolute-prepared-assignment>` is the absolute `coordination.prepared.assignment_path` pinned when the coordinator ran **`mstar plan prepare`** for this row (see the ordered summary under **§ PM call sequence**); submission is defined only for a row whose preparation already produced that artifact, never for a merely registered one. *Exactly once* bounds the **initial** command only: any further context is steering sent after the session has bound (its `InProgress` row and execution lease identify the new session) — sent earlier it either duplicates the command or becomes the session's first instruction.
 
 **tmux** (conditional): only where a matching tmux skill is actually present **and read**, the CLI supports that skill's command forms, `TMUX` identifies this caller, and its explicit target is resolved. Use the skill's detached/non-focus creation with explicit cwd and returned pane id, launch OMP in it, and submit the same absolute scoped route; inspect help instead of guessing flags, and never shell-type into the user's focused pane. **No tmux skill exists in the current catalog**, so tmux is unavailable here — an unsupported seam to be named honestly, not a failed implementation and not a silent Herdr substitution.
 
+**Scoped-route dispatch checklist** — every item is checked at this handover point; each states its reason:
+
+1. Target a **fresh** session, never one already acting as a leaf: the harness itself refuses promotion (`commands/iteration-drive.md:32` refuses a leaf that receives the scoped command), and the field observation is that a session's role is fixed by its first instruction — that is the operational reason for the rule, not a universal transport API guarantee.
+2. Confirm the row is **prepared, not merely registered**: `coordination.prepared` carries the pinned Assignment path, a current `coordination.revision` is observed, the row is still `Todo`, and there is no plan session/lease/handoff. A revision alone is insufficient. The coordinator runs **`mstar plan prepare`** at this handover point.
+3. Use the absolute prepared Assignment path, and finish handover content **before** preparation so the prepared bytes survive the fresh bind. Both SHA-256 fields are stored at **prepare**, not first created at bind (`coordination.ts:1882-1884`); bind rechecks the Assignment hash and refuses `coordination.assignment-stale` when it changed (`:1094-1108`, `:1582`). Current source does not recheck `plan_sha256`, so the user-reported plan-edit refusal stays **mechanism-unconfirmed** — not a new engine guarantee and not an eternal ban on authorized plan evidence updates.
+4. Submit the initial scoped command **exactly once**; no preliminary leaf/role prompt and no coordinator credentials.
+5. Read the returned explicit target to confirm execution — submission is not execution. The reported trailing Enter being consumed before readiness is an **observation about a CLI this repository does not own**. Only if the readback unambiguously shows the same command waiting unexecuted, recover with one Enter/key press using the optional skill's verified command form; never resubmit. Otherwise stop with uncertainty: a timeout, a lost response and `agent_not_ready` remain terminal, not retry opportunities.
+6. Send subsequent handover notes/corrections only as **steering**, after `InProgress` and the execution lease identify the new session; never prepend them as another first instruction.
+
 **Uncertainty, scope and ownership**: PM uses only returned opaque targets, records the observed command output before proceeding, and treats `agent_not_ready`, blocked UI, a timeout, a vanished response or a stalled submission as terminal — reported, never re-sent, never retried, with no fabricated id and no credential passed (no session JSON path, no `--expect` revision, no `--resume`). A created empty pane may be removed only with proven ownership and no possibly-active primary; panes are never killed to free capacity. Pane ready/idle/done means prompt transport is ready — never plan completion, lease release or ownership. The child obtains its own engine session through a fresh `plan bind`, runs only the prepared scope and stops at its durable handoff; the coordinator alone keeps serial integration and Phase 3–6 closure.
 
 **Evidence boundary**: this transport guidance is supported by **simulated** scripted skill/CLI observation traces (PM action sequences scored for command order, prepared cwd, non-focus creation, credential absence, opaque-target reuse, stopping on uncertainty and no blind resend) — not by a native end-to-end Herdr/tmux run, not by any probe of user terminals, and not by a real OMP child process.
@@ -306,6 +317,19 @@ Neither extension ever arms, binds or checkpoints by itself:
 
 Enabling `modelHandoff` or `phase2PlanInstances` in `/settings` **never retro-arms or retro-binds** an iteration already under way (the preference is re-read at entry *and* again at fire time), and disabling it suppresses the action without terminalizing the binding. A coordinator that never calls therefore produces **no state and no signal at all** — not a refusal, not a warning, not a log line. That silence is the failure mode this anchor contract fixes: both mechanisms shipped with zero PM call sites in the load chain, so every anchor below is an explicit **required** call, never something the host does for the PM.
 
+### Coordinator-visible notices
+
+Both mechanisms emit durable, coordinator-visible notices, and each family keeps its existing custom type: **`mstar:phase2-notice`** for the Phase-2 observation's diagnostics (`extensions/phase2-orchestration.js`) and **`mstar:model-handoff-notice`** for coordinator model-handoff transitions (`extensions/model-handoff.js`). Neither type is renamed, re-typed or extended elsewhere.
+
+Every notice is rendered through the shared Morning Star title shape as `<title>: <detail>`, with the observed condition or refusal code preserved in the detail:
+
+- **Status-bearing title** — when the workflow's own snapshot was successfully read at notice time, the title states a Morning Star status: the workflow id plus its actual lifecycle status, verbatim (`Workflow <id> is <status>`). It reports workflow lifecycle status only — never `snapshot.phase`, a refusal code, or the model-handoff ledger state (`pending`, `cancelled`, `handed_off`).
+- **Fallback title** — when no readable snapshot supplied the id/status, the title states only the observed operation or condition (`… needs attention`) and asserts no workflow status. Missing or unreadable status evidence never suppresses a notice and never substitutes a guessed `running`/`completed` value.
+
+A terminal lifecycle no longer produces a notice asserting the Phase-2 phase: a terminal workflow refuses `phase2.workflow-terminal` with its observed status, and no notice or refusal text on either path carries a fixed inactivity prefix or a detail sentence asserting a current Phase-2 position.
+
+The Phase-2 diagnostic path stays deduplicated by code per generation — at most one notice per distinct refusal code until the generation resets. The model-handoff notices do not share that dedup mechanism.
+
 ### Anchor declarations
 
 | Anchor | Call (exact) | When | Prerequisite | Required |
@@ -318,10 +342,11 @@ Enabling `modelHandoff` or `phase2PlanInstances` in `/settings` **never retro-ar
 #### `iteration-entry` — `mstar_model_handoff {operation:"start", workflowId}`
 
 - **Exact parameters**: `workflowId` (string, required) — the only field a caller supplies that matters here; `coordinatorSessionPath` / `mainWorktreeBranch` are accepted by the schema but unused on this path. Authority, entry route, intent and task-session state are host-derived, never call-declared.
+- **Two structural routes (host-derived)**: the public tool keeps `{operation:"start", workflowId}` — no mode, session credential or authority claim is accepted from the caller. The adapter classifies the branch from the validated root register for that explicit id, never from a newest/unique-workflow inference. **Unregistered workflow** → the unchanged reservation path: root validation unchanged, and the three existing-artifact refusals keep their code and byte-identical messages — `already-bound`: `workflow <id> is already registered in the root register — a new start never adopts it` · `a workflow snapshot already exists at <snapshotPath>` · `an iteration compass already exists at <compassPath>`. **Already-registered workflow** → attach: the named active register row (exactly one) and the workflow's actual own snapshot, identity and canonical paths are revalidated rather than trusted from the branch classification — on this branch an existing own snapshot/compass is expected, not an adoption refusal — and the start proceeds through the unchanged one-shot arm protocol to `pending` only after the existing authority derivation allows this session. Attach structural failures refuse through the existing vocabulary — `invalid-root` (absent register, vanished or malformed row, missing or mismatched snapshot, wrong canonical path), plus the pre-existing `not-coordinator` / `invalid-workflow` input checks unchanged — with no fallback into reservation and no state write. No new refusal code and no public tool mode is introduced by either branch.
 - **When**: once the workflow is registered to the v2 status surface and its **id is known** (`mstar-iteration/references/phase-1-prepare.md` §1.5 tail) — the PM's first preparation action that can name it. Never at the head of §1.1: the id does not exist yet, and the id must name a registered workflow so its coordinator envelope exists.
 - **Required or optional**: **required** and unconditional — make the call even when the preference is off, because `preference-off` is then the expected non-fatal answer and its absence from the ledger is what makes the silence undiagnosable. One call per iteration; a second arm of the same workflow is refused.
-- **No-op refusals** (visible in the tool result, **nothing changed**, model unchanged — not failures to fix beyond the stated cause): `preference-off` (not an error) · `already-bound` · `suspended` (state `none`; a navigation is in flight, retry in a moment) · `in-flight` / `arm-in-flight` (a previous handoff action is still running).
-- **Authority refusals** (this session is not the iteration coordinator — fix the session, not the call; no model action, no binding written): `task-session` (leaf/subagent session, or a session with no id) · `scoped-plan-route` (the last observed entry was the scoped-plan PM route, which restores a binding and never arms a new one) · `plan-pm-session` · `coordinator-elsewhere` (this session coordinates another workflow, or the workflow belongs to another session) · `envelope-invalid` · `register-invalid` (unreadable or invalid v2 root register / workflow snapshot).
+- **No-op refusals** (visible in the tool result, **nothing changed**, model unchanged — not failures to fix beyond the stated cause): `preference-off` (not an error) · `already-bound` (the three reservation refusals under **Two structural routes** above; a pending/uncertain/terminal same-workflow binding in this session's ledger — a terminal binding is never re-armed; or, on the attach branch, the foreign-coordinator outcome described under **Authority refusals** below) · `suspended` (state `none`; a navigation is in flight, retry in a moment) · `in-flight` / `arm-in-flight` (a previous handoff action is still running).
+- **Authority refusals** (this session is not the iteration coordinator — fix the session, not the call; no model action, no binding written): `task-session` (leaf/subagent session, or a session with no id) · `scoped-plan-route` (the last observed entry was the scoped-plan PM route, which restores a binding and never arms a new one) · `plan-pm-session` · `coordinator-elsewhere` (this session coordinates another workflow, or the workflow belongs to another session) · `envelope-invalid` · `register-invalid` (unreadable or invalid v2 root register / workflow snapshot). The derivation and its six-code vocabulary are the same on both routes. One approved observable mapping exists on the attach branch only: when the named registered workflow's own coordinator envelope names a different session, that decision — carrying an internal typed discriminator, itself not a refusal code or exported symbol — surfaces as `already-bound` with the original detail, `workflow <id> is bound to coordinator session <sessionId>, not to this session`. Every other authority failure keeps its original code on both routes, including `coordinator-elsewhere` when this session coordinates a different workflow.
 - **Visible arm failures** (reported as failures; **no automatic retry**): `settings-read-failed` · `record-failed` · `slow-unresolved` · `slow-selection-failed` · `slow-selection-refused` · `arm-evidence-conflict`.
 - **Host-level**: `tool-error` (the tool threw without touching model, ledger or engine state).
 - **Success code**: `armed` (state `pending`) — the coordinator holds it until `phase-1-lock` fires or the handoff is cancelled.
@@ -330,7 +355,7 @@ Enabling `modelHandoff` or `phase2PlanInstances` in `/settings` **never retro-ar
 
 - **Exact parameters**: `workflowId` (must equal the bound workflow) · `coordinatorSessionPath` (non-empty string) · `mainWorktreeBranch` (string — the recorded integration branch) · `reviews[]` — **exactly three ordered specialist returns** · `plans[]` — **at least one** bound-plan evidence entry. A missing or wrong-length input is refused, never inferred.
 - **When**: Phase 1 completion — **after** the integration worktree exists (recorded `integration_worktree_path`), the reviewed changes are committed on that checkout and `spec_integration_branch` is pushed: the tail of the §2.3 integration-worktree checklist, whose **step 7** performs that transfer + commit + push (Phase 1 reaches it through `iteration-start` §6). The compass/PM lock alone is **not** the moment — it leaves readiness items 3–4 unmet, so `not-ready` returns, the binding stays `pending`, and no later marker retries it. The call is made once, on the Phase 1 route; a Phase 2 resume that walks the same section must not repeat it — the binding is already terminal, so a repeat call returns `not-pending` (flagged as an error, since no `pending` binding exists any more) and is not required.
-- **Required or optional**: **required**, and never a silent skip — every refusal lands in the tool result, and every state transition additionally as a durable session notice.
+- **Required or optional**: **required**, and never a silent skip — every refusal lands in the tool result, and every state transition additionally as a durable session notice under `mstar:model-handoff-notice` (title semantics → **Coordinator-visible notices** above).
 - **Readiness prerequisite (all four, re-checked at fire time)**: the sequential specialist returns for that iteration; the PM-confirmed Prepare gate for every registered plan with `compass status: locked`; a distinct same-repository integration checkout on its recorded branch; a remote tip equal to the validated integration HEAD. `evaluatePhaseGate` is a later-phase gate and is never readiness evidence; a draft compass, a lock alone, a missing checkout or an unpushed commit is not ready.
 - **Refusals that leave the binding `pending`** (fix the stated cause and call again — **nothing was switched**): `not-ready` (carries `codes[]` naming the unmet readiness facts; not an error) · `preference-off` (`modelHandoff` off at fire time; not an error) · `settings-read-failed` (read once before and once after the readiness work) · `suspended` · `in-flight` · `record-failed` · `not-pending` (no binding — run `iteration-entry` first) · `binding-mismatch` (the call names a different workflow) · `invalid-completion-input` (the evidence shape above).
 - **Terminal refusals** (**no retry**; the session keeps the model it actually has): `cancelled` (an unowned model change arrived while pending; not an error) · `target-unresolved` (`handoffTarget` unresolvable) · `switch-refused` / `switch-threw` (the host refused the selection).

package/harness-skills/mstar-iteration/references/iteration-artifact-boundaries.md

@@ -78,11 +78,13 @@ iteration-close (§3.2)
 
 ## §1.6 各角色编辑范围
 
-| 角色 | 必须编辑 | 禁止 |
-|------|----------|------|
-| **product-manager** | compass、plans、`{SPECS_DIR}/`、`{ITERATION_DIR}/<iteration-id>/`（guides/specs） | `{KNOWLEDGE_DIR}/` **新增**；迭代草案写入 `{SPECS_DIR}/` |
-| **architect** | 同上 + package `specs/` 技术向 | 同上；在 `{SPECS_DIR}/` 堆实施踩坑 |
-| **writing-specialist** | 当轮文档 + `{SPECS_DIR}/` corpus hygiene + 既有 knowledge 卫生 | 代替 compound **提升**；跳过 specs 全库审查 |
+| 角色 | 必须编辑 | 禁止 | Draft markers it must clear |
+|------|----------|------|------------------------------|
+| **product-manager** | compass、plans、`{SPECS_DIR}/`、`{ITERATION_DIR}/<iteration-id>/`（guides/specs） | `{KNOWLEDGE_DIR}/` **新增**；迭代草案写入 `{SPECS_DIR}/` | 产品范围 / 优先级 / 验收类 marker |
+| **architect** | 同上 + package `specs/` 技术向 | 同上；在 `{SPECS_DIR}/` 堆实施踩坑 | 架构 / 契约 / 技术设计类 marker |
+| **writing-specialist** | 当轮文档 + `{SPECS_DIR}/` corpus hygiene + 既有 knowledge 卫生 | 代替 compound **提升**；跳过 specs 全库审查 | 行文与 corpus hygiene 类 marker，外加收口「无 marker 残留」核对 |
+
+> 新增列是**清除义务**（marker 语法与 owner 词汇 → **`phase-1-prepare.md`** §1.3；义务正文 → §1.6），**不**改变上方「必须编辑」的写入范围。
 
 Phase 2 执行期：各角色可继续向 **`<iteration-id>/`** 追加 guides/specs；**仍不**直写 `{KNOWLEDGE_DIR}/`。
 

package/harness-skills/mstar-iteration/references/iteration-compass-template.md

@@ -21,6 +21,22 @@ plans: []
 - <spec point 1>
 - <spec point 2>
 
+## Decisions
+
+> Settled direction-lock items — the record a dispatched role reads instead of re-deriving context from a conversation it never saw.
+
+| # | Decision | Rationale | Source |
+|---|----------|-----------|--------|
+| D1 | <settled decision> | <why it was settled this way> | user instruction / grill-me / autonomous ranking |
+
+## Open Questions
+
+> Unresolved items, each owned by a Phase 1 chain role. Row disposition before the §1.6 lock → `phase-1-prepare.md` §1.3. Write `None` in place of the table when there are no open questions.
+
+| # | Question | Owner | Blocking? |
+|---|----------|-------|-----------|
+| Q1 | <open question> | product-manager / architect / writing-specialist / PM | Yes / No |
+
 ## Plans
 
 | plan_id | Name | Status | Notes |
@@ -46,8 +62,8 @@ Status values: `Todo` | `InProgress` | `InReview` | `Done` | `Blocked`
 
 ## Non-Goals
 
-- <明确排除项 1>
-- <明确排除项 2>
+- <明确排除项 1> — <排除理由>
+- <明确排除项 2> — <排除理由>
 
 ## Roadmap Position
 
@@ -125,7 +141,9 @@ Notes:
 | `## Plans` table | Yes | Phase 2 (sync status), Phase 3 (final) |
 | `## Milestones` | Recommended | Phase 1, Phase 2 (update) |
 | `## Acceptance Criteria` | Yes | Phase 1 |
-| `## Non-Goals` | Yes | Phase 1 |
+| `## Non-Goals` | Yes | Phase 1; each entry carries its rationale |
+| `## Decisions` | Yes | Phase 1 draft (appended in Phase 2); settled items with rationale and source |
+| `## Open Questions` | Yes（`None` allowed） | Phase 1 draft; each item carries an owner from the Phase 1 chain — row disposition before the lock → `phase-1-prepare.md` §1.3 |
 | `## Roadmap Position` | **Yes** | Phase 1（必填节，非散落于 general context prose）；Phase 3 §3.3（current iteration → `delivered`） |
 | `## Risk Register` | Optional | Phase 1, Phase 2 (update) |
 | Iteration package (`guides/` / `specs/`) | Optional | Phase 1 §1.5.5; root index one row → `{ITERATION_DIR}/README.md` |

package/harness-skills/mstar-iteration/references/phase-1-prepare.md

@@ -31,7 +31,7 @@ PM 在新迭代启动时执行。
 
 ### Direction lock modes
 
-compass/plans 初稿落盘前，必须锁定**单一**迭代方向、成功标准、非目标，并确认 delivery branch policy；决策写入 compass `## Scope` / `## Acceptance Criteria` / `## Non-Goals` 与 Delivery Branch Policy。
+compass/plans 初稿落盘前，必须锁定**单一**迭代方向、成功标准、非目标，并确认 delivery branch policy；决策写入 compass `## Scope` / `## Acceptance Criteria` / `## Non-Goals` 与 Delivery Branch Policy。**已决事项**另须落入 compass **`## Decisions`**（每条 = `decision` + `rationale` + `source`：user instruction / grill-me / autonomous ranking），**未决事项**落入 **`## Open Questions`**（每条带 owner —— `product-manager` / `architect` / `writing-specialist` / `PM` —— 与 blocking 标记；无未决项写 `None`）。两节形态 → **`references/iteration-compass-template.md`**；初稿深度与清除义务 → §1.3 **Draft contract**。
 
 | Mode | 何时选用 | 行为 |
 |------|----------|------|
@@ -72,6 +72,18 @@ plans: []
 ## Scope
 <本迭代要锁定的 spec 点>
 
+## Decisions
+
+| # | Decision | Rationale | Source |
+|---|----------|-----------|--------|
+| D1 | <已决事项> | <依据> | user instruction / grill-me / autonomous ranking |
+
+## Open Questions
+
+| # | Question | Owner | Blocking? |
+|---|----------|-------|-----------|
+| Q1 | <未决事项> | product-manager / architect / writing-specialist / PM | Yes / No |
+
 ## Plans
 
 | plan_id | Name | Status | Notes |
@@ -104,6 +116,26 @@ plans: []
 
 > **Engine check (when available):** import `validateCompassFrontmatter` from `@mstar-harness/engine` in a host hook to validate the compass frontmatter above (no CLI form yet). On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 
+### Draft contract（PM 初稿的深度契约）
+
+PM 的初稿是**上下文载体**：被派发角色看不到 PM 的会话，只从磁盘读（`delivery-compass.md` + plans + `<iteration-id>/` package）。所以初稿按 **「骨架 + 完整上下文」** 交付，深度边界如下。
+
+**(i) 初稿必须携带**：锁定方向；已决事项（→ compass `## Decisions`）；带 owner 的未决事项（→ `## Open Questions`）；**非目标及其理由**；约束来源（用户指令 / 既有 spec / knowledge / roadmap）；acceptance seed（可长成 `## Acceptance Criteria` 的条目）；branch policy。
+
+**(ii) 初稿可以合法留粗**：候选方案分析、模块/接口细节、per-task 分解、plan 级技术设计。这些**标记**为待补，**不**编造。留粗是允许的；**不加标记**则不允许 —— 未标记的空洞无人认领，等于把上下文缺口丢给一个看不到会话的承接方。
+
+**(iii) 标记形态（语法只在本节定义；其它文件按 path + 节号引用本处）**：
+
+```text
+<!-- TODO(owner: <role-id>): <what is missing and what must be decided> -->
+```
+
+owner 取值仅限 Phase 1 链：`product-manager` / `architect` / `writing-specialist` / `PM`（需回到用户决策时）。**无 owner 的 `TBD` / `...` / `etc.` 在任何阶段都仍然禁止** —— 没有 owner，就没有清除它的地方。
+
+**(iv) 清除期限**：compass `status: locked` 是终线。lock 前，owner 属于链条三角色的 marker **必须**全部清除；无法清除的，在 lock 前**显式重新归属给 `PM`** 并上报用户（`PM` 归属项是 lock 之后唯一允许存在的 marker 形态）。**禁止**静默删除，也**禁止**让无 owner 的 placeholder 越过终线。各角色的清除义务与报数 → §1.6。
+
+**(v) `## Open Questions` 行的处置**：§1.2 落盘的每一行在终线前必须落到三者之一：收敛为已决事项（撤出该行并计入 `## Decisions`）；或转入 (iii) 的 marker 形态（行的 owner 即 marker 的 owner，随 (iv) 一同清除或重新归属给 `PM`）；或**显式重新归属给 `PM`** 并上报用户。**禁止**静默删除行 —— 与 (iv) 共用同一终线。`Blocking?` 决定该行**能否**越过终线：标记 `Yes` 的行**必须**在 lock 前收敛为已决事项，**不论**它本会重新归属给谁；不能收敛即 Prepare 未通过（`Gate decision: blocked`），compass **不得**置 `status: locked`。lock 之后 `## Open Questions` 中唯一允许存在的行，即**非阻塞**且 owner 为 `PM` 的行。行转入 marker 形态后，其清除义务与报数按 §1.6 计。
+
 ## 1.4 更新索引
 
 在 `{ITERATION_DIR}/README.md` 中添加**一行**（首次创建时建立表头；**一行 = 一次迭代**，不拆 compass/workspace 双行）：
@@ -118,13 +150,13 @@ plans: []
 
 iteration 正式全流程**必须**登记 `{HARNESS_DIR}/status.json`（v2 根）+ `{WORKFLOW_DIR}/<id>/snapshot.json`：
 
-- 根 `status.json` `workflows[]` 增一条 active entry：`{ "id": "<iteration-id>", "type": "iteration", "started_at", "dir": "workflows/<iteration-id>" }`（engine `registerWorkflow`）。
+- 用 **`mstar iteration register`** 一次写入两份文档：create-only 的 `type: "iteration"` snapshot（`{WORKFLOW_DIR}/<id>/snapshot.json`）+ 根 `status.json` `workflows[]` active entry（`{ "id": "<iteration-id>", "type": "iteration", "started_at", "dir": "workflows/<iteration-id>" }`），二者在同一把根锁内完成。snapshot 已存在而 root entry 缺失（两次写入之间崩溃）时，重跑即恢复：保留既有 snapshot 字节，只补写缺失的 root entry。必填输入：workflow id、compass ref、三个 branch anchors、Todo plan 行（registration 从不授权实现）。store-pinning / 写入顺序 / rollback 语义 → **`mstar-artifacts`** `references/plan-workflow-lifecycle-contract.md` §4a。flag 集合与措辞以命令 help 为准（`mstar iteration register --help`），本文件不复述。
 - snapshot 顶层 `branch` anchors：`base`（= `iteration_base_branch`，创建 `spec_integration_branch` 的祖先 ref——**不是**隐式 `main`）、`integration`（= `spec_integration_branch`）、`target`（= iteration-close 后 PR 的目标分支）。
-- 各 plan 行 `metadata.iteration_refs`、`spec_integration_branch`、`merge_target`（`merge_target` 通常为 `spec_integration_branch`）。
+- 各 plan 行 `metadata.iteration_refs`、`spec_integration_branch`、`merge_target`（`merge_target` 通常为 `spec_integration_branch`）由 producer 从 compass / integration 输入**派生**——PM 无需也不应手工构造这些字段。
 
 compass frontmatter 的 `iteration_base_branch` / `target_branch` **必须与** snapshot `branch` 一致；若仅写在 compass 而 snapshot 缺失，Phase 2 §2.3 同轮 backfill。
 
-**中途增减范围（已存在且仍在 Prepare 的 workflow）**：用户/产品批准的范围扩张**不得**手改受保护状态。先以 `mstar plan bind --coordinator --workflow <id>` 建立该 workflow 的 coordinator 会话，再经受守卫入口 `mstar workflow show-prepare` 读取快照与 compass 两个字节版本，并以 `mstar workflow amend-prepare` 追加已批准的 Todo 行、登记已 review 的 integration checkout 与 `plan_parallelism`（仅 Prepare 且无执行所有权时可用；无 force/replace/init 通道）。守卫与字段权威 → **`mstar-artifacts`** `references/status-and-residuals.md`「Prepare workflow amendment」；forms / exit codes → `docs/cli.md` § `mstar-harness workflow`。
+**中途增减范围（已存在且仍在 Prepare 的 workflow）**：用户/产品批准的范围扩张**不得**手改受保护状态。先以 `mstar plan bind --coordinator --workflow <id>` 建立该 workflow 的 coordinator 会话，再经受守卫入口 `mstar workflow show-prepare` 读取快照与 compass 两个字节版本，并以 `mstar workflow amend-prepare` 追加已批准的 Todo 行、登记已 review 的 integration checkout 与 `plan_parallelism`（仅 Prepare 且无执行所有权时可用；无 force/replace/init 通道）。守卫与字段权威 → **`mstar-artifacts`** `references/status-and-residuals.md`「Prepare workflow amendment」；forms / exit codes → **`mstar-use-cli`** `references/plan-and-workflow.md`。
 
 <!-- host-hook: iteration-entry -->
 > Execute the active host reference's `## Host hooks` declaration for `iteration-entry`; this file defines no host action.
@@ -155,6 +187,8 @@ Phase 1 与 §1.6 须遵守 **`references/iteration-artifact-boundaries.md`**（
 2. **writing-specialist** 完成 **corpus hygiene**：仅本轮修改的 `{SPECS_DIR}/` / iteration package 与直接相关 knowledge 引用；错放迁回 **`<iteration-id>/`** package；细则 → **`iteration-corpus-hygiene.md`**、**`iteration-artifact-boundaries.md`**
 3. PM 将 compass `status` 设为 `locked`，并确认各 plan 的 Prepare gate（specify / clarify / plan）
 
+**Marker 清除义务（§1.3，每个被派发角色）**：角色在自己这一轮编辑中**必须**清除 owner 指向自己的 marker，无法清除的在完成前**重新归属给 `PM`** 并写明理由；两种情况都在 Completion Report 中报出**清除计数**（已清 N / 已重新归属 M）。**writing-specialist** 额外承担**收口核对**：除显式重新归属给 `PM` 的 marker 外，**无** marker 残留（语法的唯一 home 是 §1.3；本行不重述其形态）—— 该核对是 PM 置 `status: locked` 的前置。
+
 **顺序理由**：产品范围与优先级 → 架构与长期契约（specs）→ 行文、规格库卫生与错放纠正（在 PM/architect 定稿后核对受影响文档）。本共享产物链存在真实依赖；独立文档可按 ownership 隔离并行。早期全局探索的既有结果复用，不因每次编辑重新扫全库。角色名写法（role id 提及 hygiene）→ active host reference（**`mstar-host`** → `references/<host>.md`）。
 
 **完成证据** = 磁盘上的 compass / plans / specs / iteration 文档修订 + specs（与既有 knowledge）卫生/归档（如有）+ 索引与 metadata 更新 + compass `status: locked`。**不**要求单独的迭代审查报告——迭代审查的 SSOT 是被编辑的文档本身，无 per-plan QC 式审计链。

package/harness-skills/mstar-iteration/references/phase-2-worktree-lease.md

@@ -252,7 +252,7 @@ Phase 2 缺的不是新调度器，而是一个**具名的重新评估时刻**
    - PM 载入 **`mstar-sdd`** 后，按依赖与 ownership 派发 **独立 ready tasks 并行** 的 per-task 循环（**不是**一次派发 dev 做全部 tasks）：
      1. `mstar sdd workspace <plan-id>` → `{SDD_DIR}`
      2. `mstar sdd task-brief <plan-file> N` → `{SDD_DIR}/task-N-brief.md`；记录 `BASE_SHA`
-     3. Dispatch **one** implementer subagent（`references/implementer-prompt.md`：brief 路径 + report 路径 + `Model tier`；**禁止**贴整份 plan）
+     3. Dispatch **one** implementer subagent（`references/implementer-prompt.md`：brief 路径 + report 路径；**禁止**贴整份 plan）
      4. Implementer `DONE` → `mstar sdd review-package BASE HEAD` → task diff 文件
      5. Dispatch **one** task reviewer subagent（brief + report + diff + Global Constraints）
      6. Fix loop 直至 review clean；append `{SDD_DIR}/progress.md`；更新 snapshot plan 行 / plan checkbox
@@ -283,7 +283,7 @@ Phase 2 缺的不是新调度器，而是一个**具名的重新评估时刻**
 integration merge 成功且 plan 行 `Done`、`execution_lease` 已删除的**同一轮**，即可回收该 plan/track 的 feature worktree + 已合并分支 —— **父迭代仍在运行不影响资格**：不存在「父须终结」的一刀切，这是 cleanup 的明确设计而非遗漏。命令与守卫契约本体（ownership、合并证据、refusals、apply 顺序）→ **`mstar-branch-worktree`**「Worktree / branch cleanup」（唯一 home；本节只放 call site）：
 
 ```text
-mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--worktree <path>]
+mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>] [--all-workflows] [--verbose] [--ignore-unreadable-snapshots]
 ```
 
 - 先 dry-run 看 `verdict | kind | ref | reason`（merge 刚完成 → 该 Done 行 eligible）；`--apply` 才变更。lane 1 只清**本地面**（无 `--remote`；远端残留留给 Phase 6）。
@@ -302,7 +302,7 @@ mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--worktree
 | 并行 | 独立 ready tasks 各自 fresh implementer + 隔离 worktree；单一 canonical per-plan SDD root 内分离 task artifact 路径，context/progress 仅 PM 串行写；leaf 直接消费不可变绝对路径，不调用共享 context helper；每 task 后一位 fresh reviewer；真实依赖与 merge 串行（`mstar-sdd`） |
 | Sticky（可选） | Assignment **`SDD implementer session: sticky`** + `implementer-session.json`；implementer **resume**，reviewer **fresh** — `mstar-sdd/references/sticky-implementer-session.md` |
 | 文件交接 | brief / report / diff / `progress.md` 在 `{SDD_DIR}`；dispatch prompt **只给路径**，不贴 plan 全文或 task 历史 |
-| Assignment 字段 | 每个 implement dispatch 须含 `Execution mode: sdd`、`SDD dir`、`Model tier`；§2.0 #5 未 waive 时还须含绝对 `Worktree path` + verified `execution_lease`；**禁止**省略 `Model tier` |
+| Assignment 字段 | 每个 implement dispatch 须含 `Execution mode: sdd`、`SDD dir`；§2.0 #5 未 waive 时还须含绝对 `Worktree path` + verified `execution_lease`；**禁止**省略 `Execution mode` / `SDD dir` |
 | 大包 inline | **禁止**把 T1–Tn 或整份 plan 写进 **一个** `fullstack-dev` leaf Assignment 冒充 SDD |
 | 分支 diff | 全部 task 完成后 `mstar sdd review-package MERGE_BASE HEAD` → `{SDD_DIR}/review/` branch diff → plan QC tri（N=3） |
 

package/harness-skills/mstar-iteration/references/phase-3-iteration-close.md

@@ -19,6 +19,7 @@ PM 在迭代内全部 plan Done 后执行。**本 Phase 在 integration worktree
 | 检查 | 缺则补齐 |
 |------|----------|
 | YAML frontmatter：`iteration_id`, `start_date`, `status` | 从文件名 / 正文提取；收口前 `status` 保持 `active` 或 `locked` |
+| `## Decisions` / `## Open Questions`（模板中紧跟 `## Scope`） | 从 general context / 正文迁移为本节，无内容则按模板补节；行处置 → `phase-1-prepare.md` §1.3 |
 | `## Roadmap Position` | 从 general context / roadmap prose 迁移为本节 |
 | `## Quality Gate Summary` | 按模板补占位，§3.4 填写 |
 | `## Compound Round Summary` | 按模板补占位，§3.4 填写 |

package/harness-skills/mstar-iteration/references/phase-6-post-merge-close.md

@@ -49,7 +49,7 @@ mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date
 物理清理（integration worktree / 本地分支 / 远端分支删除）是 §6.1–§6.3 之后的**显式独立步骤**——即 **timing lane 2**：valid terminal close + PR verified merged 之后才清理 integration 面。Phase 6 只固定顺序与守卫，不在本 phase 内实现删除：
 
 - cleanup **永不自动**、永不绕过 ownership / merge-evidence 守卫 —— 契约本体（ownership、合并证据、refusals、apply 顺序）唯一 home → **`mstar-branch-worktree`**「Worktree / branch cleanup」；本节只放 call site，不复制规则
-- `mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>]` —— dry-run 默认，逐候选打印 `verdict | kind | ref | reason`；先 dry-run 核对受保护行全部 `keep`/`refuse`，再 `--apply`
+- `mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>] [--all-workflows] [--verbose] [--ignore-unreadable-snapshots]` —— dry-run 默认，逐候选打印 `verdict | kind | ref | reason`（标志语义、默认候选范围与守卫本体见上方 owning-contract 指针）；先 dry-run 核对受保护行全部 `keep`/`refuse`，再 `--apply`
 - **lease 释放是手工 owner 动作、cleanup 范围外**：§6.1 close 已拒绝 dangling lease，但 cleanup 仍**从不**替 owner 释放——残留 lease 的候选只会得到 `cleanup.refuse.active-lease`；先手工释放，再重跑 dry-run/apply
 - squash-merged 分支（tip 非 base 祖先）→ STOP → residual；禁止 `git branch -D`
 

package/harness-skills/mstar-iteration/references/plan-scoped-pm.md

@@ -3,7 +3,7 @@
 **Single home for the scoped route.** This file owns: accepted addressing forms, scoped boot, the plan-local driving loop, the scoped stop, and the coordinator command sequence. It does **not** own field/schema tables, executable flag syntax, or Assignment header templates.
 
 - Command frontmatter/argument surface → **`commands/iteration-drive.md`**
-- Executable flags, exit codes, JSON envelopes → **`docs/cli.md`**（CLI owner）
+- Executable flags, exit codes, JSON envelopes → **`mstar-use-cli`**（CLI owner）
 - `coordination` / session / handoff / revision fields and row/register ownership → **`mstar-artifacts/references/status-and-residuals.md`**（sole runtime schema home）
 - Portable primary Assignment header → **`mstar-roles/references/project-manager/dispatch-and-assignment.md`**
 - Dispatch mechanics, isolation gates → **`mstar-dispatch-gates`**, **`mstar-sdd`**, **`mstar-branch-worktree`**
@@ -179,3 +179,5 @@ The scoped route **requires** `mstar plan …`. Without it（engine/CLI absent o
 Herdr / tmux (or any multiplexer) is only a way to open a terminal. It is **not** a prerequisite, dependency, ownership signal or session identity. Nothing in this route reads pane state, TTL or terminal labels to decide ownership.
 
 Where the active host reference declares an optional skill-driven extra-primary launch protocol (its native opt-in, its bind/checkpoint/reserve/record calls, non-focus pane creation at the prepared worktree, the absolute `--assignment` submission and terminal uncertainty handling), **`mstar-host`** → that reference's Phase-2 section is the only home for those calls; this file defines none of them. The protocol stays optional there too and adds no load-order dependency here.
+
+Such a conditional extra-primary launch is available only for a plan row the coordinator has already registered **and** prepared, and whose feature worktree exists; a row that does not yet exist cannot be launched, because row admission closes with Phase 1. Registration and preparation are distinct row states — the launch precondition is a prepared row, never registration alone.

package/harness-skills/mstar-phase-gates/SKILL.md

@@ -50,7 +50,7 @@ description: "Morning Star Spec-Driven 双阶段门禁：Prepare（`specify →
 
 - **`plan locked`**
   - 最小动作：在 plan 或 notes 记录当前锁定版本（日期或 hash）。
-  - **Plan 质量门**（新 plan / 大改）：无 placeholder（`...`、`TBD`、`etc.`）；含 **Global Constraints** 与 per-task **Interfaces**；PM self-review 四问（每 task 可独立验证？依赖顺序清晰？无隐含假设？每 task 可单轮闭合其 Files 与验证门 — Task shape / session fit？→ **`mstar-artifacts/references/plan-quality-bar.md`** item 7）— 见 `mstar-artifacts/templates/plan.main.md` + **`mstar-artifacts/references/plan-quality-bar.md`**（自包含/验证门/STOP 条件/drift check/done criteria）。
+  - **Plan 质量门**（新 plan / 大改）：无 placeholder（`...`、`TBD`、`etc.`）—— 该判定在 **`plan(locked)`** 时点执行。Prepare 期间**唯一**被认可的未完成形态是带 owner 的 `TODO(owner: …)` marker（语法、owner 词汇与清除口径 → **`mstar-iteration/references/phase-1-prepare.md`** §1.3；清除期限按路线取：迭代初稿 = compass `status: locked`（**不是**该 plan 的 `plan(locked)` 时点）；独立 plan（无 compass）= 本节 `plan(locked)` 时点）；无 owner 的 placeholder 在任何阶段都不被接受。含 **Global Constraints** 与 per-task **Interfaces**；PM self-review 四问（每 task 可独立验证？依赖顺序清晰？无隐含假设？每 task 可单轮闭合其 Files 与验证门 — Task shape / session fit？→ **`mstar-artifacts/references/plan-quality-bar.md`** item 7）— 见 `mstar-artifacts/templates/plan.main.md` + **`mstar-artifacts/references/plan-quality-bar.md`**（自包含/验证门/STOP 条件/drift check/done criteria）。
 - **`implement`**
   - 最小产物：实现 diff、自检证据、回报与 handoff；行为准则 → **`mstar-coding-behavior`**；编辑纪律 → 上文「可验证编辑与上下文纪律」。
   - **知识库 / 迭代 compass**：**默认**开工前扫 `{KNOWLEDGE_DIR}/README.md` 索引（若存在）并阅读与当轮相关的 **Active** 行（**即使 metadata 无 knowledge 链接**）；若 `plans[].metadata` 登记了 `primary_spec` / `spec_refs` / `iteration_compass` / `iteration_refs`，所链接文档**仍须**阅读；两类阅读均须在回报中说明已对齐 → **`mstar-conventions`** · **`mstar-artifacts/references/knowledge-and-designs.md`**。该 implement 时阅读是输入变化时的 re-alignment，不替代 Prepare 的锁前 recall receipt（见上文 Prepare `plan` 节）。

package/harness-skills/mstar-roles/SKILL.md

@@ -43,14 +43,15 @@ PM-owned activation; the omission / `none` / named-preset / resume / unknown-pre
 
 | Role | Preset menu |
 | --- | --- |
-| `project-manager` | `mstar-dispatch-gates`, `mstar-phase-gates`, `mstar-conventions`, `mstar-roles` ref; + `references/project-manager/qa-trigger-matrix.md` for QA gate tiers; + `mstar-review-qc` before QC; + `mstar-branch-worktree` / `mstar-artifacts` as the round requires; + `mstar-skill-authoring` for skill work; + `mstar-iteration` for iteration lifecycle (start/drive/close); + `mstar-strategy` for strategic alignment; + `mstar-compound` / `mstar-compound-refresh` pre-loaded by `mstar-iteration` § iteration-close |
-| `fullstack-dev*`, `frontend-dev` | `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (if repo writes); plan path symbols from `mstar-conventions` (minimal); `mstar-design-md` when implementing styled UI |
-| `qc-specialist*` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (review bundle paths); `mstar-design-md` when reviewing UI. Role-owned (never gated): `references/qc-specialist/` workflow/checklist/template (+ lenses on demand) |
-| `qa-engineer` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (closing R#); `mstar-design-md` when verifying visual output. Role-owned (never gated): `references/qa-engineer/acceptance-gate.md` |
-| `architect`, `product-manager` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance) |
-| `code-reviewer` | `mstar-sdd` (per-task review mode); `mstar-audit` (audit mode: full workflow); `mstar-conventions` (paths); `mstar-artifacts` (plan-quality-bar for audit plans) |
-| `ops-engineer` | `mstar-coding-behavior`, `mstar-branch-worktree` |
-| `prompt-engineer` | All topic skills when editing harness text |
+| `project-manager` | `mstar-dispatch-gates`, `mstar-phase-gates`, `mstar-conventions`, `mstar-roles` ref; + `references/project-manager/qa-trigger-matrix.md` for QA gate tiers; + `mstar-review-qc` before QC; + `mstar-branch-worktree` / `mstar-artifacts` as the round requires; + `mstar-skill-authoring` for skill work; + `mstar-iteration` for iteration lifecycle (start/drive/close); + `mstar-strategy` for strategic alignment; + `mstar-use-cli` when the round runs or interprets CLI commands; + `mstar-compound` / `mstar-compound-refresh` pre-loaded by `mstar-iteration` § iteration-close |
+| `fullstack-dev*`, `frontend-dev` | `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (if repo writes); plan path symbols from `mstar-conventions` (minimal); `mstar-design-md` when implementing styled UI; `mstar-use-cli` when the round runs or interprets CLI commands |
+| `qc-specialist*` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (review bundle paths); `mstar-design-md` when reviewing UI; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qc-specialist/` workflow/checklist/template (+ lenses on demand) |
+| `qa-engineer` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (closing R#); `mstar-design-md` when verifying visual output; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qa-engineer/acceptance-gate.md` |
+| `architect` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance); `mstar-use-cli` when the round runs or interprets CLI commands |
+| `product-manager` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance) |
+| `code-reviewer` | `mstar-sdd` (per-task review mode); `mstar-audit` (audit mode: full workflow); `mstar-conventions` (paths); `mstar-artifacts` (plan-quality-bar for audit plans); `mstar-use-cli` when the round runs or interprets CLI commands |
+| `ops-engineer` | `mstar-coding-behavior`, `mstar-branch-worktree`; `mstar-use-cli` when the round runs or interprets CLI commands |
+| `prompt-engineer` | All topic skills when editing harness text; `mstar-use-cli` when the round runs or interprets CLI commands |
 
 Use skill names (not absolute filesystem paths) in role references.
 

package/harness-skills/mstar-roles/references/architect.md

@@ -97,7 +97,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-dispatch-gates` → `mstar-phase-gates` (Prepare: specify/clarify/plan) → `mstar-conventions` (`{PLAN_DIR}`, plan-writing path)
 2. Typically: `mstar-artifacts` (specs, **`{ITERATION_DIR}/<id>/` package**); `mstar-coding-behavior`. Boundaries → **`mstar-iteration/references/iteration-artifact-boundaries.md`**
-3. On demand: `mstar-branch-worktree` (committing architecture docs to the business repo); `mstar-design-md` (plan involves UI work / design tokens — read DESIGN.md for design specs)
+3. On demand: `mstar-branch-worktree` (committing architecture docs to the business repo); `mstar-design-md` (plan involves UI work / design tokens — read DESIGN.md for design specs); `mstar-use-cli` (round runs or interprets CLI commands — resolving a plan path, validating a coordination document)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/code-reviewer.md

@@ -23,13 +23,19 @@ Layering anchor: `mstar-review-qc/references/review-responsibility-boundaries.md
 ## Mode A — SDD Task Reviewer (default)
 
 - **Inputs:** task brief path, implementer report path, task diff file path, Global Constraints (verbatim).
+- **Output:** `REPORT_FILE` = `${SDD_DIR}/task-N-review.md` — always written for a completed task under `Execution mode: sdd`, and the only file this mode writes. The implementer's `task-N-report.md` is an input you read and never write; this output is L2 only, never formal QC (`{SDD_DIR}/review/qcN.md`) or QA.
 - **Behavior:** diff-first. Spec compliance first, then code quality. Read the diff once; do not re-run git; do not mutate the checkout; do not re-run the full test suite.
 - **Discipline:** fresh per task (no sticky resume); never pre-judge the verdict.
 - **Template SSOT:** `skills/mstar-sdd/references/task-reviewer-prompt.md`.
 
 ### Output (Mode A)
 
+Written to `REPORT_FILE` (`${SDD_DIR}/task-N-review.md`):
+
 ```
+## Scope                            # only when a bound actually stopped expansion; a complete review omits this section and its label
+- `- Truncated coverage: <budget reached; specific interfaces/files left unexamined>`
+
 ### Spec Compliance
 - ✅ Spec compliant | ❌ Issues found (file:line)
 - ⚠️ Cannot verify from diff: [items for PM to check]
@@ -43,7 +49,7 @@ Layering anchor: `mstar-review-qc/references/review-responsibility-boundaries.md
 **Task quality:** Approved | Needs fixes
 ```
 
-`⚠️ Cannot verify from diff` items do not block other findings — PM resolves them before marking the task complete.
+`⚠️ Cannot verify from diff` items do not block other findings — PM resolves them before marking the task complete. A budget stop keeps the `Task quality` earned for reviewed scope and is never relabelled `Unconfirmed`; PM reads this report and cannot mark the whole task complete while the assigned review scope remains uncovered.
 
 ### Issue severity (Mode A)
 
@@ -99,7 +105,7 @@ Follow the `pr` variant output shape in **`references/pr-review.md`** § Output
 
 If any item below matches, **stop** and return `Blocked` to `project-manager` instead of improvising:
 
-- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports under `{SDD_DIR}` (Mode A), plans under `{PLAN_DIR}/audit-<date>/` (Mode B), or **evidence files under `{PROJECT_DIR}/<project-id>/reports/pr-review/`** (Mode C — path SSOT `references/pr-review.md` § Local report archive; gitignored, never the reviewed worktree).
+- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports at `${SDD_DIR}/task-N-review.md` (Mode A), plans under `{PLAN_DIR}/audit-<date>/` (Mode B), or **evidence files under `{PROJECT_DIR}/<project-id>/reports/pr-review/`** (Mode C — path SSOT `references/pr-review.md` § Local report archive; gitignored, never the reviewed worktree).
 - **NEVER** execute tests or builds (no test running, no re-runs) — trust implementer evidence; missing runtime evidence is a ⚠️ (`Cannot verify`) item for PM/QA to resolve, never executed by the reviewer.
 - **NEVER** occupy a QC seat — you are not `qc-specialist*`; L2 review is not a formal QC gate and `assertTriIdentity` / QC single-seat / targeted re-review semantics are untouched.
 - Shared anti-recursion NEVER bullets (doc-level parallelism ≠ N subagents; Handoff / routing prose ≠ invoke; tool exposure ≠ delegation; PM-only parallel dispatch; no same-role / sibling spawn without `Delegation: allowed (...)`): **`references/_shared/leaf-executor-core.md`**「Shared anti-recursion NEVER」.
@@ -128,7 +134,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
    - Mode A (SDD task reviewer): `mstar-sdd` → `references/task-reviewer-prompt.md`, `references/file-handoffs.md`
    - Mode B (audit executor): `mstar-audit` SKILL.md (common core) + `references/codebase-audit.md`
    - Mode C (PR review): `mstar-audit` SKILL.md + `references/pr-review.md` + `mstar-branch-worktree` (worktree isolation)
-3. Paths: `mstar-conventions`; add `mstar-artifacts` (plan-quality-bar) when writing audit plans
+3. Paths: `mstar-conventions`; add `mstar-artifacts` (plan-quality-bar) when writing audit plans; add `mstar-use-cli` when the round runs or interprets CLI commands (audit plan scaffold/promote, PR-review helpers, reading a refusal code)
 4. Host: `mstar-host` (detect; active host reference)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/frontend-dev.md

@@ -58,7 +58,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates`
 2. Typically: `mstar-conventions` (paths + spec metadata)
-3. On demand: `mstar-branch-worktree` (repo writes); `mstar-phase-gates` (Execute / hotfix when referenced in assignment); `mstar-design-md` (styled UI — read DESIGN.md tokens before writing components)
+3. On demand: `mstar-branch-worktree` (repo writes); `mstar-phase-gates` (Execute / hotfix when referenced in assignment); `mstar-design-md` (styled UI — read DESIGN.md tokens before writing components); `mstar-use-cli` (task must run or interpret CLI commands — path resolution, a verification command, reading a refusal or exit code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/fullstack-dev-shared.md

@@ -77,7 +77,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` (leaf anti-recursion before any Task/subagent)
 2. Typically: `mstar-conventions` (path symbols + `metadata.primary_spec` / `spec_refs`)
-3. On demand: `mstar-branch-worktree` (repo writes, `Working branch`); `mstar-phase-gates` (Execute / hotfix sections when gate fields are in the assignment); `mstar-design-md` (task includes UI implementation — read DESIGN.md for design tokens)
+3. On demand: `mstar-branch-worktree` (repo writes, `Working branch`); `mstar-phase-gates` (Execute / hotfix sections when gate fields are in the assignment); `mstar-design-md` (task includes UI implementation — read DESIGN.md for design tokens); `mstar-use-cli` (task must run or interpret CLI commands — SDD evidence capture, path resolution, reading a refusal or exit code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/ops-engineer.md

@@ -63,7 +63,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` → `mstar-branch-worktree` (repo writes, production-touching branches)
 2. Typically: `mstar-conventions` (paths)
-3. On demand: `mstar-phase-gates` (hotfix compressed path when assignment says hotfix)
+3. On demand: `mstar-phase-gates` (hotfix compressed path when assignment says hotfix); `mstar-use-cli` (round runs or interprets CLI commands — worktree/lease checks, reading a refusal code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -87,7 +87,6 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 **SDD implementer session**: fresh | sticky | N/A — **default `fresh`**; `sticky` reuses same implementer subagent across tasks (reviewers stay fresh). See `mstar-sdd/references/sticky-implementer-session.md`
 **SDD dir**: absolute `<main-repo-root>/{HARNESS_DIR}/sdd/<plan-id>/` (control harness root) when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
 **SDD context file**: absolute `<SDD dir>/context.json` when `Execution mode: sdd` | N/A — destination contract consumed by `mstar sdd exec --context` / `--context` producers (`mstar-sdd/references/file-handoffs.md`)
-**Model tier**: fast | standard | capable | N/A
 **Skill presets**: `standard` | <explicit skill list> | none — activates the `Execute as` role's preset from its `Skill Preset (PM-Activated)` section; default `standard` for implementation / QC / QA rounds unless the route is trivial
 **QC mode**: full tri-review | single | N/A — **default `full tri-review` when `Execution mode: sdd`**; `single` only for `inline` / override
 **Review package path**: <branch-review diff file> | N/A
@@ -228,5 +227,5 @@ The **scoped primary route** never appears as a subagent invoke on any host: `/i
 **NEVER（SDD）**：
 
 - 把整份 plan 或 T1–Tn 全文贴进 **一个** `fullstack-dev` leaf Assignment。
-- 省略 `Execution mode` / `SDD dir` / `Model tier` 却期望 SDD 产物（`progress.md`、per-task review）。
+- 省略 `Execution mode` / `SDD dir` 却期望 SDD 产物（`progress.md`、per-task review）。
 - 期望 leaf `fullstack-dev` 载入 `mstar-sdd` 并自编排 per-task 循环 — **编排仅 PM**（`mstar-iteration` §2.4–2.5）。

package/harness-skills/mstar-roles/references/project-manager/plan-management.md

@@ -53,6 +53,11 @@ If legacy plan directories already exist, reuse them; avoid dual-structure dupli
     [--branch-source <branch> --branch-target <branch> | --completion-policy <text>] [--session <path>]
   ```
   The declaration is one-time (a second one, even with the same kind, is refused) and refuses a terminal snapshot; a supplied `--branch-source`/`--branch-target` fills a MISSING anchor or restates the registered one — a value conflicting with an anchor the snapshot already carries is refused (the registered anchor is the delivery identity, never overwritten); delivery evidence itself is recorded with `mstar workflow evidence --workflow <id> --file <payload.json>` (PR identity recorded once; `head`/`target` must be the registered `branch.source`/`branch.target`).
+- **Row completion routes (engine-selected):** after `accept`, the coordinator follows one of two routes — never inferred from missing integration anchors.
+  - **Iteration** (`type: iteration`, or any non-standalone workflow): `integration-start` → coordinator merge in the recorded integration checkout → `integration-accept` → `complete`. `complete` sets the row `Done`, completes the handoff, and releases the row `execution_lease` and the workflow `integration_merge_lease`.
+  - **Standalone development** (`type: plan`, `delivery_kind: development`, exactly one owned row): `complete` directly from the accepted handoff with no integration verbs. `complete` sets `Done`, completes the handoff, retains cleanup metadata, releases only the row `execution_lease`, and leaves the workflow `running` until the delivery tail and `status workflow-close`.
+- **Legacy delivery-source repair (not a normal step):** `mstar plan repair-delivery-source` applies only when a pre-fix snapshot registered `branch.source === branch.target` while the accepted handoff names the true feature branch. It replaces only `branch.source` under the row revision lock, derived from the sealed handoff — no user-supplied branch, no `Done`, no delivery-evidence rewrite. Continue with ordinary `complete` after repair. Future registrations must record the true delivery source at `workflow register` time; `workflow evidence --declare-kind --branch-source` cannot amend an already-registered anchor (one-time kind declaration only).
+
 - Delivery tail (standalone `development` plans, after Done): compound disposition (`created` / `updated` / reasoned `skipped`; review → **`mstar-compound`**) on the delivery branch before the PR head is finalized → submit PR with its identity (repo / head / target) recorded → merge-ready declared (resumable milestone; workflow stays registered) → PM-verified merge (provider evidence; never the close verb) → common close reusing the post-merge-close ordering (`mstar-iteration/references/phase-6-post-merge-close.md`). Stage semantics and failure behavior → frozen contract `mstar-artifacts/references/plan-workflow-lifecycle-contract.md`.
 - **Merge-ready precondition — standalone `development` plans only.** Before merge-ready is declared, run the read-only close-state gate and record its output with the milestone (`mstar iteration gate --phase 6 --workflow <id> [--harness <absolute-path>]`; same implementation as the close's delivery-evidence consultation, no `--compass`). Pre-merge the snapshot is still `running`, so `PHASE6_NOT_TERMINAL` / `PHASE6_ROOT_ENTRY_PRESENT` are the expected readings and the recorded note says so; any other code (`PHASE6_INVALID_SNAPSHOT`, `PHASE6_INVALID_ROOT`) is a real defect to clear before merge-ready. Iteration workflows are unaffected — they keep their own Phase 4/5 exit checklist (`mstar-iteration/references/phase-4-5-pr-delivery.md` §5.2).
 

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -53,7 +53,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 1. `mstar-harness-core` → `mstar-dispatch-gates`
 2. Harness-text editing trigger (activation implies): read **all** topic skills you touch — at minimum `mstar-phase-gates`, `mstar-conventions`, `mstar-artifacts`, `mstar-branch-worktree`, `mstar-review-qc`, `mstar-coding-behavior`, plus host adapters — so prompts stay aligned with SSOT and do not re-duplicate rules
 3. New skill / major skill rewrite / trigger-description change (activation implies): MUST read `mstar-skill-authoring` before editing
-4. Typically: `mstar-conventions` (path symbols in examples)
+4. Typically: `mstar-conventions` (path symbols in examples); `mstar-use-cli` (round runs or interprets CLI commands — the roles / skill lints this role invokes, reading a validator's exit code)
 5. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/qa-engineer/acceptance-gate.md

@@ -34,10 +34,7 @@ When **`QA mode: acceptance-only`**:
 
 ### Captured evidence mapping (`sdd evidence`)
 
-Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes and exit meanings → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns:
-
-| AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap |
-| --- | --- | --- | --- | --- | --- | --- | --- |
+Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes, exit meanings and the four separate `verify` outputs → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns of the report's AC table (**`references/qa-engineer.md`** § QA Report Landing and Template); for a retained bundle each column carries:
 
 - **Run/manual reference**: `{SDD_DIR}/evidence/<run-uuid>/` with the record and raw `stdout.log`/`stderr.log` paths — or the manual report/CI citation with provenance.
 - **Original input identity**: the recorded run's Git HEAD plus declared-input digest from `record.json` — the basis any target comparison reuses.
@@ -56,6 +53,28 @@ Scope authority → `mstar-harness-core` § 定向执行与验证边界. All QA
 - Missing screenshot or other real-environment evidence: record the unverified behavior and a pending independent E2E request for PM. Never launch a browser/device/E2E, change roles, or block/reopen routine iteration QA solely for that separate workflow. Unit acceptance cannot claim real-environment acceptance.
 - User-authorized local full-suite execution belongs to a separate implementer/ops action; QA may consume its result but has no `full` mode. Refer the authorization scope to PM instead of executing it here.
 
+## Budget stop and coverage readback
+
+Ceiling and scope authority → **`mstar-harness-core`** § 定向执行与验证边界; the role wording is in `references/qa-engineer.md` § Budget and Stopping. Honour the Assignment **`Budget`** / **`Return shape`** and never widen the core default. A bound stop keeps the AC outcomes and findings already verified and never invents elapsed time or file counts.
+
+- **Label only a real cut.** Emit `- Truncated coverage: <budget reached; specific ACs/interfaces not covered>` in the report `## Scope` only when a bound actually stopped expansion, naming the required ACs/interfaces left unchecked, and record those ACs as unverified. Omit the line on a complete run — a negation value is still a line, and consumers read the label's presence, not its wording.
+- **Exhaustion is not a channel failure.** A cap stop never rewrites an observed result, never becomes `Unconfirmed`, and never invents new QA vocabulary. A required evidence channel that is unavailable is a verification gap, handled by the existing `Blocked` result.
+- **Coverage readback, per assigned AC.** A checked AC keeps its observed `outcome` and its `run/manual reference`, including a witnessed failure; a required AC left without supported evidence is recorded as unverified and is not a pass.
+
+| Readback | Required coverage | Result |
+| --- | --- | --- |
+| Every assigned AC has supported evidence | covered | ordinary acceptance may proceed |
+| A required AC has no supported evidence (unverified, or its channel unavailable) | uncovered | return the existing **`Blocked`**; name the uncovered ACs and hand PM the targeted remaining scope |
+| An assigned AC failed with witnessed evidence | covered — the finding is retained | report the observed failure with its evidence; coverage ending never turns it into a coverage-only conclusion |
+
+A clean checked subset with `findings: []` is compatible with `unverified` ACs: `findings: []` describes the checked scope only and is never presented as full mandatory acceptance or `Done`.
+
+## Durable acceptance mapping (before Done)
+
+The landed report is the raw record; its landing obligation is defined once in `references/qa-engineer.md` § QA Report Landing and Template and is unchanged when the Assignment names no output path. Before `Done`, the report's compact AC → evidence → result mapping is preserved in the existing durable main-plan **`## QA Gate Summary`** (`mstar-artifacts/references/plan-files-and-reports.md`) — per-AC result, evidence reference, coverage/gap disclosure and the exact report pointer — which QA supplies from its report.
+
+Reuse that existing summary: no second archive, manifest or report format is created. Retain the raw report while the gate is active, so a later permitted bundle cleanup never leaves the only AC mapping in a deleted file.
+
 ## Unchanged hard duties
 
 Before sign-off or Done recommendation:
@@ -69,6 +88,8 @@ Before sign-off or Done recommendation:
 
 Use template in `references/qa-engineer.md`. May skip QC tri only when no implementation/test/config artifacts were committed.
 
+`report-only` is a mode, not the landing condition: the mandatory landing, scope/truncation disclosure and coverage readback above are unchanged, and an advisory report acquires no acceptance authority from its filename.
+
 ## Related
 
 - PM trigger matrix: `references/project-manager/qa-trigger-matrix.md`