@mstar-harness/dsh 3.8.2 → 3.9.0

package/harness-skills/mstar-iteration/references/phase-2-worktree-lease.md

@@ -1,4 +1,4 @@
-# Phase 2: Autonomous Execute — per-plan loop + control worktree + lease
+# Phase 2: Autonomous Execute — per-plan loop + integration worktree + lease
 
 > Loaded by `mstar-iteration` SKILL.md on the **execute / resume** route, and by the Phase 2+ command layer. **Read `mstar-harness-core` first.** Entry = §2.0 五道闸全过；continuous execution / push 纪律（§2.6）的 SSOT 仍在 `mstar-iteration` SKILL.md。
 
@@ -14,14 +14,15 @@ full protocol here.
 **Phase 2**（SKILL.md execute/resume route + `iteration-drive` / `iteration-loop`
 command layer；`iteration-start` ends before this）. Defaults are **hard** unless the current turn
 explicitly waives via Assignment `Worktree mode: waived` (or equivalent user
-instruction). `Plan parallelism: serial` is **not** a waiver — it only forces
-serial cross-plan **implement** scheduling while control worktree + leases remain
+instruction), within the limited scope in § Waiver; main residency and the
+dedicated integration checkout remain mandatory. `Plan parallelism: serial` is **not** a waiver — it only forces
+serial cross-plan **implement** scheduling while the worktree + lease gates remain
 required.
 
-Phase 1 Review & Edit may stay on the primary checkout. The control-worktree gate
+Phase 1 Review & Edit may edit uncommitted docs on the primary checkout under the Prepare policy (bounded exception; the main worktree never switches branch). The integration-worktree + lease gate
 starts at **Phase 2 entry**.
 
-**Phase scope**：本参考仅约束 **Phase 2**（含 serial integration merge 与「control 禁止产品编辑 / 每 plan feature worktree」）。**Phase 5** PR merge-ready 修复 **不**沿用该产品编辑隔离——直接在 control / `spec_integration_branch` 上改，**禁止**另开 Phase 5 fix worktree → **`phase-4-5-pr-delivery.md`** §5.0。
+**Phase scope**：本参考仅约束 **Phase 2**（含 serial integration merge 与「control root / integration worktree 禁止产品编辑 / 每 plan feature worktree」）。**Phase 5** PR merge-ready 修复同样 **不**直接在 integration checkout 上改——产品修复走独立 fix feature worktree，review 后 merge 回 integration worktree → **`phase-4-5-pr-delivery.md`** §5.0。
 
 **本 Phase 定义 per-plan 派发循环的完整流程**：前置条件检查、session todos、backlog 读取、integration 分支管理、per-plan dispatch 循环（分支→实现→QC→**QA gate**→Done→合并）、dispatch-first 约束。PM 读取本 Phase（含 §2.0–§2.5 与下方 lease 细则）即可执行迭代。
 
@@ -35,7 +36,7 @@ starts at **Phase 2 entry**.
 2. **Pre-implement gate = GO**：plan 已 locked、tasks ready（见 `mstar-phase-gates`）
 3. 用户意图为 **continue Autonomous Execute**（推进迭代 Execute、继续 per-plan 循环等）
 4. **Branch metadata gate**：snapshot `branch.base`（`iteration_base_branch`）、`branch.target`（`target_branch`）已登记，且至少一条 active plan 有 `metadata.spec_integration_branch`（或可从 compass 同轮 backfill）。**缺失 → STOP**，不得用 `main`/`master` 补位。
-5. **Control-worktree + lease defaults**（iteration 命令；可被 `Worktree mode: waived` 豁免）：除非本轮 Assignment 显式 `Worktree mode: waived`（或等价用户指令），Phase 2 **必须**在入口建立 control worktree、经 control 路径读写默认 gitignored 的 harness 进程产物（根 `status.json`、`workflows/`、`projects/`、`{PLAN_DIR}`、`{ITERATION_DIR}`、`{SDD_DIR}` 等），并在可写派发前 claim workflow snapshot 的 `plans[].execution_lease` / 顶层 `integration_merge_lease`。可写 Assignment 须含绝对 feature **`Worktree path`** + 绝对 control 系 **`Plan Path`** / **`SDD dir`**（见 **`mstar-branch-worktree`**「Harness path SSOT under default gitignore」）。**禁止**因 feature worktree 在默认 gitignore 下看不到 plans 而推断 `Worktree mode: waived`。`Plan parallelism: serial` **不** waive 本闸——仅强制跨 plan **implement** 串行调度；control worktree + lease 仍须满足。**跨 plan 并行安全闸**（**不可**被 `Worktree mode: waived` 豁免）：跨 plan **并行可写 implement** 须满足下列之一——(a) coordination 路径（control snapshot 或 waived 时主 checkout `{HARNESS_DIR}/status.json`）上 **same-host 独占写锁可用且每次 status/协调变更持锁**；(b) 默认 **`Plan parallelism: serial`**（**waived 时尤其优先默认串行**；**无 flock / 无共享锁时只触发本条，不豁免 worktree**）；(c) 用户本轮显式 `Cross-host lease race: accepted`（或等价）+ `plans[].notes` 审计。**禁止**将 `Worktree mode: waived` 当作跨主机无锁并行的授权。细则 → 下方「Control worktree」「Execution lease」「Multi-plan parallelism」「Waiver」各节。
+5. **Worktree + lease defaults**（iteration 命令；waiver 范围见下方「Waiver」）：所有模式的 Phase 2 **必须**在入口确认 control root（= **主 checkout / main worktree**，进程 SSOT；其驻留分支 = 主 plan 头记录的 **`Main worktree branch`**，且非任何未终结 workflow 的分支）并建立独立 integration worktree、经 control 绝对路径读写默认 gitignored 的 harness 进程产物（根 `status.json`、`workflows/`、`projects/`、`{PLAN_DIR}`、`{ITERATION_DIR}`、`{SDD_DIR}` 等），；未 waive 时在可写派发前 claim workflow snapshot 的 `plans[].execution_lease` / 顶层 `integration_merge_lease`。可写 Assignment 须含绝对 feature **`Worktree path`** + 绝对 control 系 **`Plan Path`** / **`SDD dir`**（见 **`mstar-branch-worktree`**「Harness path SSOT under default gitignore」三域表）。**禁止**因 feature worktree 在默认 gitignore 下看不到 plans 而推断 `Worktree mode: waived`。`Plan parallelism: serial` **不** waive 本闸——仅强制跨 plan **implement** 串行调度；integration worktree + lease 仍须满足（**串行不豁免 worktree**）。**跨 plan 并行安全闸**（**不可**被 `Worktree mode: waived` 豁免）：跨 plan **并行可写 implement** 须满足下列之一——(a) coordination 路径（control root = 主 checkout `{HARNESS_DIR}/` 下 snapshot / `status.json`）上 **same-host 独占写锁可用且每次 status/协调变更持锁**；(b) 默认 **`Plan parallelism: serial`**（**waived 时尤其优先默认串行**；**无 flock / 无共享锁时只触发本条，不豁免 worktree**）；(c) 用户本轮显式 `Cross-host lease race: accepted`（或等价）+ `plans[].notes` 审计。**禁止**将 `Worktree mode: waived` 当作跨主机无锁并行的授权。细则 → 下方「Integration worktree (Phase 2 entry)」「Execution lease」「Multi-plan parallelism」「Waiver」各节。
 
 > **Engine-check（lease verify / verify-integration）唯一规范体：** `mstar-artifacts` `SKILL.md`（Engine check lease 行；standalone 保证同文）。
 
@@ -59,7 +60,7 @@ SSOT = `{WORKFLOW_DIR}/<id>/snapshot.json` + `{PLAN_DIR}/`。todos 只追踪本
 2. 列出 snapshot 中 `status` ∈ `{Todo, InProgress, InReview, Blocked}` 的 plan（优先级：`InProgress` → `InReview` → `Todo` → unblock `Blocked`）
 3. 读 snapshot `branch.base` / `branch.target`，以及 plan `metadata.spec_integration_branch` / `merge_target` / `primary_spec` 链接
 
-## 2.3 Branch anchors + integration branch + control worktree（Phase 2 入口）
+## 2.3 Branch anchors + integration branch + integration worktree（Phase 2 入口）
 
 **Branch anchors 解析顺序**（任一环节缺失则 STOP，**禁止**默认 `main`/`master`）：
 
@@ -69,35 +70,44 @@ SSOT = `{WORKFLOW_DIR}/<id>/snapshot.json` + `{PLAN_DIR}/`。todos 只追踪本
 4. 仍缺 → 向用户确认 base / PR target；**不得**因 `git symbolic-ref refs/remotes/origin/HEAD` 指向 `main` 就自动采用
 5. 所有参与本轮迭代的 active plan **必须**解析到**同一** `spec_integration_branch`；不一致 → **STOP**
 
-**Control worktree（§2.0 #5 未 waive 时 — HARD）**按下方「Control worktree (Phase 2 entry)」checklist 执行（含：若 integration 分支尚不存在，在 control worktree 内 `git checkout -b <spec_integration_branch> <iteration_base_branch>`——**必须**从记录的 base 创建）。
+**Integration worktree（所有模式 — HARD）**按下方「Integration worktree (Phase 2 entry)」checklist 执行（integration 分支不存在时**必须**从记录的 base 创建，命令见下方）。
 
-**Git 操作（无 control worktree 时 — 仅 `Worktree mode: waived`）**：
+**Git 操作（含 `Worktree mode: waived`）**：
 
-1. `git fetch`（按需）确认 `iteration_base_branch` 存在
-2. **checkout 或创建** `spec_integration_branch`（同上）
-3. `git branch --show-current` 确认在 `spec_integration_branch`
+1. 在主 checkout 按需 `git fetch` 确认记录的 `iteration_base_branch` 存在；主 checkout 保持记录分支。
+2. 用 `git worktree add <integration-path> <spec_integration_branch>` 建立独立 integration checkout；分支不存在时用 `git worktree add -b <spec_integration_branch> <integration-path> <iteration_base_branch>`。
+3. `git -C <integration-path> branch --show-current` 确认 integration 分支；后续 merge 仅在该 checkout。waiver 仅豁免每 plan feature worktree 默认，不豁免 integration 协调 checkout；产品写入仍须避开主 checkout 和 integration checkout。
 
 `spec_integration_branch` 是本迭代内所有 plan feature branch 的 merge target。QC **`Review range` / `Diff basis`** 的 merge-base 参照优先用 snapshot `branch.target`（或 PM 书面指定的 base ref），**禁止**无 Assignment 依据写死 `origin/main`。
 
-## Control worktree (Phase 2 entry)
+## Integration worktree (Phase 2 entry) + control root
 
 1. Resolve all active plans' `metadata.spec_integration_branch` to the **same**
    integration branch (STOP if mismatch).
-2. Resolve or create the **control worktree** (usually primary checkout or
-   PM-designated path) checked out to that `spec_integration_branch`.
-3. Verify `git branch --show-current` equals `spec_integration_branch`; working
-   tree clean before merge operations.
-4. Record canonical absolute repository-root path in the workflow
-   snapshot top-level `control_worktree_path` (not `{HARNESS_DIR}`; canonicalize symlinks).
-5. Resolve coordination paths from that root (default-gitignored process artifacts live on the **control filesystem**, not as Git blobs):
-   - status register: `<control_worktree_path>/{HARNESS_DIR}/status.json` (v2 root — active workflow entries)
-   - snapshot SSOT: `<control_worktree_path>/{WORKFLOW_DIR}/<id>/snapshot.json` (plan rows + leases + branch anchors)
-   - project register: `<control_worktree_path>/{PROJECT_DIR}/<id>/residuals.json`
-   - plans SSOT: `<control_worktree_path>/{PLAN_DIR}/` (or `<control>/{HARNESS_DIR}/plans/`)
-   - iterations SSOT: `<control_worktree_path>/{ITERATION_DIR}/`
-   - SDD tree: `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/`
-
-All sessions MUST reread the **control copy** of the workflow snapshot immediately before
+2. Resolve the **control root** = the **primary checkout** (main worktree) via
+   Git (`readMainWorktree`); verify its attached branch equals the recorded
+   **`Main worktree branch`** from the main plan header and is not owned by any
+   non-terminal workflow — mismatch → **STOP** (never switch main; never
+   substitute `branch.base`).
+3. Create the dedicated **integration worktree**:
+   `git worktree add <path> <spec_integration_branch>` (create the branch from
+   the recorded base first if absent) — a linked checkout **distinct from the
+   main worktree**; never reuse the primary checkout for integration.
+4. Verify `git -C <integration> branch --show-current` equals
+   `spec_integration_branch`; working tree clean before merge operations.
+5. Record canonical absolute repository-root path in the workflow snapshot
+   top-level `integration_worktree_path` (not `{HARNESS_DIR}`; canonicalize
+   symlinks). The main worktree is **not** recorded in the snapshot — it is
+   derived from Git every session.
+6. Resolve coordination paths from the **control root** (default-gitignored process artifacts live on the **main-worktree filesystem**, not as Git blobs):
+   - status register: `<main-repo-root>/{HARNESS_DIR}/status.json` (v2 root — active workflow entries)
+   - snapshot SSOT: `<main-repo-root>/{WORKFLOW_DIR}/<id>/snapshot.json` (plan rows + leases + branch anchors)
+   - project register: `<main-repo-root>/{PROJECT_DIR}/<id>/residuals.json`
+   - plans SSOT: `<main-repo-root>/{PLAN_DIR}/`
+   - iterations SSOT: `<main-repo-root>/{ITERATION_DIR}/`
+   - SDD tree: `<main-repo-root>/{HARNESS_DIR}/sdd/<plan-id>/`
+
+All sessions MUST reread the **control-root copy** of the workflow snapshot immediately before
 claim, release, transfer, plan-status transition, or merge-lease mutation.
 
 **Do not** set `Worktree mode: waived` because a feature worktree lacks
@@ -121,11 +131,11 @@ distributed CAS CLI.
 **Cross-plan parallel hard gate:** Applies **whether or not** `Worktree mode: waived`.
 Lease-gated **cross-plan parallel** writable implement is allowed **only when**
 this same-host lock is **available on the coordination snapshot path and
-used for every coordination mutation** in that Phase 2 session (control path
-when lease gate active; primary checkout `{HARNESS_DIR}/status.json` + snapshot
-when waived). Agents on **different hosts** or with **no shared flock/lockdir** →
+used for every coordination mutation** in that Phase 2 session (the snapshot
+under the **control root** = the primary checkout / main worktree — waived
+included). Agents on **different hosts** or with **no shared flock/lockdir** →
 default **`Plan parallelism: serial`** (preferred when waived). **No flock
-does not waive** control worktree / feature worktree / leases — serial
+does not waive** the integration worktree / feature worktree / leases — serial
 scheduling only. Assignment still
 claiming cross-plan parallel without lock availability → **Blocked** until PM
 sets serial scheduling or the user gives current-turn override
@@ -147,19 +157,19 @@ mismatch → **STOP**.
 
 1. **Claim / resume — execution lease**（§2.0 #5 未 waive）：按下方「Execution lease」claim/resume 规则——同 `holder` → resume（校验 `worktree_path` / `working_branch` 与 Assignment 一致）；异 `holder` → **Blocked**；`InProgress` 无 lease → **STOP** 升级（孤儿恢复 → **`mstar-artifacts`**）；verify 通过前 **禁止**可写派发
 2. **Plan start — feature worktree + branch**：创建/校验 dedicated feature worktree（默认 `<repoRoot>/.worktrees/<plan-id>-<slug>`）；Assignment 须含绝对 `Worktree path` + `Working branch`（与 lease 一致）。plan 内多可写并行轨 → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**
-3. **Implement → InReview**（产品编辑在 feature worktree；plans / snapshot / iterations / SDD 经 control 绝对路径）：
+3. **Implement → InReview**（产品编辑在 feature worktree；plans / snapshot / iterations / SDD 经 control root 绝对路径）：
    - **默认 `Execution mode: sdd`**（多 task plan；hotfix 可 `inline`）。
-   - PM 载入 **`mstar-sdd`** 后，按 plan task 顺序 **串行** per-task 循环（**不是**一次派发 dev 做全部 tasks）：
+   - PM 载入 **`mstar-sdd`** 后，按依赖与 ownership 派发 **独立 ready tasks 并行** 的 per-task 循环（**不是**一次派发 dev 做全部 tasks）：
      1. `mstar sdd workspace <plan-id>` → `{SDD_DIR}`
      2. `mstar sdd task-brief <plan-file> N` → `{SDD_DIR}/task-N-brief.md`；记录 `BASE_SHA`
      3. Dispatch **one** implementer subagent（`references/implementer-prompt.md`：brief 路径 + report 路径 + `Model tier`；**禁止**贴整份 plan）
      4. Implementer `DONE` → `mstar sdd review-package BASE HEAD` → task diff 文件
      5. Dispatch **one** task reviewer subagent（brief + report + diff + Global Constraints）
      6. Fix loop 直至 review clean；append `{SDD_DIR}/progress.md`；更新 snapshot plan 行 / plan checkbox
-     7. Next task
+     7. 放行已满足依赖的 next task；不等待无依赖任务，PM 独占共享 progress / snapshot 写入
    - 每次 Completion Report 后更新 snapshot（`workflows/<id>/snapshot.json`）+ 主 plan
 4. **QC → QA gate**（plan 保持 **`InReview`**；**保留** `execution_lease`）：per-plan 审查链 → **`mstar-sdd`**（L1–L2）+ **`mstar-review-qc/references/review-responsibility-boundaries.md`**（L3 tri / inline 单席；raw reports in `{SDD_DIR}/review/`，durable summary in main plan/snapshot）+ **`QA gate`**（`mandatory` → `qa-engineer`；`pm-acceptance` → PM checklist）。**禁止**在 integration merge 成功前设 `Done` 或删除 `execution_lease`。
-5. **Plan complete — serial merge back**（§2.0 #5 未 waive）：自 **control worktree** claim/resume snapshot 顶层 `integration_merge_lease` → 将 plan feature branch 合并入 `spec_integration_branch`（仅 merge-lease holder；细则 → 下方「Integration merge lease」）→ 记录 merge commit 证据 → 释放 merge lease；**同轮**设 `Done` 并删除 `execution_lease`。merge 失败：保持 `InReview` + 保留 lease，不得标 `Done`。
+5. **Plan complete — serial merge back**（§2.0 #5 未 waive）：自 **integration worktree** claim/resume snapshot 顶层 `integration_merge_lease` → 将 plan feature branch 合并入 `spec_integration_branch`（仅 merge-lease holder；细则 → 下方「Integration merge lease」）→ 记录 merge commit 证据 → 释放 merge lease；**同轮**设 `Done` 并删除 `execution_lease`（此即 owner 的 lease 释放动作），并在**同一 locked update** 内把 `metadata.working_branch` / `metadata.worktree_path` 持久化到该 plan 行（归属生产者义务；语义唯一 home → `mstar-branch-worktree`「Worktree / branch cleanup」Ownership）。merge 失败：保持 `InReview` + 保留 lease，不得标 `Done`。merge 成功即打开该 plan 的**同轮 cleanup 资格**（timing lane 1 → 下方「Same-round plan cleanup」）。
 6. **Cross-plan 进度同步**：更新 `{ITERATION_DIR}/<iteration-id>/delivery-compass.md` 的 `## Plans` 表状态列
 7. **Next plan / parallel wave** 从步骤 1 继续（可并行推进其他已 claim 的 plan；merge 仍排队串行）
 
@@ -169,6 +179,19 @@ mismatch → **STOP**.
 2. 打印 **`## Phase 3: iteration-close`**。
 3. 按 **`references/phase-3-iteration-close.md`** §3.0 起独立执行至 §3.5。final plan 的 Assignment / closure 仅作输入，**不能**替代 Phase 3 gate。
 
+### Same-round plan cleanup（timing lane 1；merge 成功同轮）
+
+integration merge 成功且 plan 行 `Done`、`execution_lease` 已删除的**同一轮**，即可回收该 plan/track 的 feature worktree + 已合并分支 —— **父迭代仍在运行不影响资格**：不存在「父须终结」的一刀切，这是 cleanup 的明确设计而非遗漏。命令与守卫契约本体（ownership、合并证据、refusals、apply 顺序）→ **`mstar-branch-worktree`**「Worktree / branch cleanup」（唯一 home；本节只放 call site）：
+
+```text
+mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--worktree <path>]
+```
+
+- 先 dry-run 看 `verdict | kind | ref | reason`（merge 刚完成 → 该 Done 行 eligible）；`--apply` 才变更。lane 1 只清**本地面**（无 `--remote`；远端残留留给 Phase 6）。
+- 分支可能仍被该 Done-child worktree 检出 → apply 内部先移 worktree，再 re-probe / re-plan 删分支（**worktree 移除 ≠ 分支删除**；细则 → 契约本体）。
+- **lease 释放是手工 owner 动作、cleanup 范围外**：上方步骤 5 的 `Done` + `execution_lease` 删除就是 owner 释放动作；cleanup **从不**替 owner 释放任何 lease。standalone plan（无 integration）以 `branch.target` 为证据 base，且须**先 terminal close**。
+- **禁止**为让 cleanup 通过而推进/终结父迭代或改 snapshot 状态；受保护行保持 `refuse` 是正确行为，不是失败。
+
 ## 2.5 Dispatch-first（implement 派发约束）
 
 派发纪律 SSOT → **`mstar-dispatch-gates`** · **`mstar-sdd`** · **`mstar-host/references/parallel-dispatch.md`**。
@@ -177,7 +200,7 @@ mismatch → **STOP**.
 
 | 规则 | 说明 |
 |------|------|
-| 串行 | 同一 plan 内 **one implementer at a time**；每 task 后 **one fresh task reviewer** |
+| 并行 | 独立 ready tasks 各自 fresh implementer + 隔离 worktree；单一 canonical per-plan SDD root 内分离 task artifact 路径，context/progress 仅 PM 串行写；leaf 直接消费不可变绝对路径，不调用共享 context helper；每 task 后一位 fresh reviewer；真实依赖与 merge 串行（`mstar-sdd`） |
 | Sticky（可选） | Assignment **`SDD implementer session: sticky`** + `implementer-session.json`；implementer **resume**，reviewer **fresh** — `mstar-sdd/references/sticky-implementer-session.md` |
 | 文件交接 | brief / report / diff / `progress.md` 在 `{SDD_DIR}`；dispatch prompt **只给路径**，不贴 plan 全文或 task 历史 |
 | Assignment 字段 | 每个 implement dispatch 须含 `Execution mode: sdd`、`SDD dir`、`Model tier`；§2.0 #5 未 waive 时还须含绝对 `Worktree path` + verified `execution_lease`；**禁止**省略 `Model tier` |
@@ -195,9 +218,9 @@ Iteration Phase 2 附加：
 
 - Each concurrently active plan uses a **distinct** absolute feature-worktree
   path and dedicated feature branch from `spec_integration_branch`.
-- `execution_lease.worktree_path` MUST differ from
-  `control_worktree_path` (never reuse the control checkout for product
-  edits).
+- `execution_lease.worktree_path` MUST differ from the main worktree (control
+  root) and from snapshot `integration_worktree_path` — never product-edit
+  either the primary checkout or the integration checkout.
 - `Worktree path` MUST appear in the writable Assignment and in the snapshot
   plan row's `execution_lease.worktree_path` before first writable implement dispatch.
 - Product/source edits run from the feature worktree; plans, iterations,
@@ -257,8 +280,8 @@ waived` is in effect — waiver does **not** authorize lockless cross-host paral
 - **Feature implementation** MAY proceed in parallel across **different plan IDs**
   only when **one** of:
   1. Same-host exclusive write lock is available on the coordination
-     snapshot path (control path when lease gate active; primary checkout
-     `{HARNESS_DIR}/status.json` + snapshot when waived) and used for every coordination
+     snapshot path under the **control root** (the primary checkout /
+     main worktree — waived included) and used for every coordination
      mutation in that session; **and** when lease gate is not waived, each plan
      holds a verified, distinct `execution_lease` and feature worktree.
   2. **`Plan parallelism: serial`** (default when waived; preferred default under
@@ -276,18 +299,18 @@ Required shape (v1): `holder`, `claimed_at`, `plan_id`, `source_branch`,
 `target_branch` (= resolved `spec_integration_branch`); optional `session_label`.
 Lives top-level on the snapshot — `{WORKFLOW_DIR}/<id>/snapshot.json`.
 
-1. From control worktree: clean tree; branch = `spec_integration_branch`.
+1. From the **integration worktree** (`integration_worktree_path`): clean tree; branch = `spec_integration_branch`. Never run the merge from the primary checkout.
 2. Under write lock, re-read the snapshot. If `integration_merge_lease` exists:
    - **Same `holder` as this session** → **resume**: verify `plan_id`,
-     `source_branch`, `target_branch` match intended merge; confirm control
+     `source_branch`, `target_branch` match intended merge; confirm integration
      worktree state; continue (not steal/block).
    - **Different `holder`** → **Blocked** (cannot expire or steal).
 3. If unclaimed, claim merge lease (same read-check-replace-verify as execution claim).
-4. Only merge-lease holder runs integration from `control_worktree_path`.
+4. Only merge-lease holder runs integration from `integration_worktree_path`.
 5. On success: record merge commit/evidence; delete merge lease; set plan
    **`Done`** and delete `execution_lease` in the same locked update.
 6. On conflict/failure: retain leases; plan stays **`InReview`** — do not set
-   `Done`. Release merge lease only after control worktree is clean and known state.
+   `Done`. Release merge lease only after the integration worktree is clean and known state.
 
 Execution and merge leases may coexist; merge lease does not grant execution
 ownership for the source plan.
@@ -297,8 +320,9 @@ ownership for the source plan.
 Explicit `Worktree mode: waived` (or equivalent user instruction) this turn
 waives **only**:
 
-- Control worktree establishment and control-path SSOT routing
-- Per-plan feature worktree defaults
+- Per-plan feature worktree defaults. The dedicated integration coordination
+  checkout remains required; the primary checkout keeps its recorded branch
+  and remains the process-SSOT holder via absolute control-root paths.
 - Snapshot lease claim/hold/release defaults (`plans[].execution_lease` and top-level `integration_merge_lease`)
 
 It does **not** waive the **cross-plan parallel safety gate**. Under waiver,
@@ -309,7 +333,7 @@ snapshot plan `notes` / `notes.jsonl`. **Prefer serial scheduling when waived**;
 only with the race-accepted override (or same-host lock when mutating shared
 state).
 
-`Plan parallelism: serial` does **not** waive control worktree or leases.
+`Plan parallelism: serial` does **not** waive the worktree or lease gates.
 
 Iteration commands MUST NOT infer waiver from missing worktrees or single-session
 starts. Explicit override this turn only.

package/harness-skills/mstar-iteration/references/phase-3-iteration-close.md

@@ -2,7 +2,7 @@
 
 > Loaded by `mstar-iteration` SKILL.md when entering Phase 3. **Read `mstar-harness-core` first.** Phase 2 全部 plan `Done` 后按 **Phase transition gates** 进入本 Phase。
 
-PM 在迭代内全部 plan Done 后执行。**本 Phase 在 integration 分支上运行**，产出物 commit 到 integration 分支，随迭代 PR 合入 snapshot `branch.target`（`target_branch`）。入口：Phase 2 全部 plan `Done` 后按 **Phase transition gates** 进入。
+PM 在迭代内全部 plan Done 后执行。**本 Phase 在 integration worktree（snapshot `integration_worktree_path`，检出 `spec_integration_branch` 的专用检出）中运行**，产出物 commit 到 integration 分支，随迭代 PR 合入 snapshot `branch.target`（`target_branch`）。入口：Phase 2 全部 plan `Done` 后按 **Phase transition gates** 进入。
 
 **Close Done 定义**：§3.1→§3.5 全部完成；compass frontmatter 写入 `status: completed` + `end_date`；每篇新增 knowledge doc 已登记 `{KNOWLEDGE_DIR}/README.md`。只在 final plan 中写了 compound / roadmap / PR 说明，不算 iteration-close 完成。
 
@@ -80,13 +80,13 @@ PM 打印 **iteration-close exit checklist**；全部为 `[x]` 后方可 `git co
 - [ ] 当前分支是 `spec_integration_branch`
 - [ ] PR base = snapshot `branch.target`（`target_branch`，与 compass frontmatter 一致）；**不是**未记录的 `main`
 
-**Commit 前提（HARD — branch-anchored，防递交到控制分支）**：§3.5 的 commit 是 **branch 锚定**的——`git commit` 落在**当前检出分支**，`<spec_integration_branch>` 只出现在 push 参数里。当控制 worktree（或任一检出）不在 integration 分支时，未经下述核对直接执行本配方，compound 会把 tracked 的 `{KNOWLEDGE_DIR}/`、`{SPECS_DIR}/`、`CONCEPTS.md` 递交到控制分支（如 `main`），integration 分支的 PR 永远带不上这些 shared 产物。因此 **任何 `git add` 之前**必须先验分支；mismatch → **STOP**（不得 commit、不得 push、不得「先提交后挪」），改在正确检出上重做（见下）。
+**Commit 前提（HARD — branch-anchored，防递交到主 checkout 驻留分支）**：§3.5 的 close commit **在 integration worktree（`integration_worktree_path`）中执行，**绝不**在主 checkout（control root）或任一 feature worktree 上执行**——`git commit` 落在**当前检出分支**，`<spec_integration_branch>` 只出现在 push 参数里。当执行 commit 的检出不在 integration 分支时，未经下述核对直接执行本配方，compound 会把 tracked 的 `{KNOWLEDGE_DIR}/`、`{SPECS_DIR}/`、`CONCEPTS.md` 递交到主 checkout 驻留分支（如 `main`），integration 分支的 PR 永远带不上这些 shared 产物。因此 **任何 `git add` 之前**必须先验分支；mismatch → **STOP**（不得 commit、不得 push、不得「先提交后挪」），改在正确检出上重做（见下）。
 
 1. 解析 `<spec_integration_branch>`：snapshot `branch.integration`（workflows/<id>/snapshot.json）→ 缺失时 compass frontmatter `spec_integration_branch`；仍缺 → STOP 补齐，不得默认 `main`。
 2. **先验后提交**（在执行 commit 的检出处）：`git branch --show-current` === `<spec_integration_branch>`。§3.2–§3.4 产生的 tracked close 产物本就应处于未提交状态等待本 commit，**不要求**此处工作树干净。engine 可用 → 在 add/commit **前**运行 `mstar iteration gate --workflow <id> --compass <delivery-compass.md> --branch <current> --integration <spec_integration_branch> --target <target_branch>` 并确认 exit 无 `EXIT_BRANCH_MISMATCH` / `EXIT_PR_BASE_MISMATCH`（Phase-3 窗口预期的其它 exit-1 除外，见 Phase transition gates 注）。
-3. **mismatch 时**：不产生任何提交。tracked 子树（`{KNOWLEDGE_DIR}/`、`{SPECS_DIR}/`、`CONCEPTS.md`、迭代 package 中 tracked 部分）在**检出 `<spec_integration_branch>` 的 worktree** 重新写入或在 commit 前恢复（它们默认 tracked、随 Git 分支走；进程产物 plans/iterations/status/sdd 经 control 绝对路径不受影响）。然后重跑本 checklist。
+3. **mismatch 时**：不产生任何提交。tracked 子树（`{KNOWLEDGE_DIR}/`、`{SPECS_DIR}/`、`CONCEPTS.md`、迭代 package 中 tracked 部分）在 **integration worktree**（检出 `<spec_integration_branch>` 的专用检出）重新写入或在 commit 前恢复（它们默认 tracked、随 Git 分支走；进程产物 plans/iterations/status/sdd 经 control root 绝对路径不受影响）。然后重跑本 checklist。
 
-**在 `<spec_integration_branch>` 检出上执行**：
+**在 integration worktree（`integration_worktree_path`，检出 `<spec_integration_branch>`）中执行 —— never the primary checkout**：
 
 ```bash
 git branch --show-current   # must print <spec_integration_branch> — mismatch → STOP, see above

package/harness-skills/mstar-iteration/references/phase-4-5-pr-delivery.md

@@ -23,8 +23,8 @@
 ### 5.0 Phase boundary
 
 - Phase 5 在 PR head（`spec_integration_branch`）上 push 修复；**禁止**另开替代分支
-- **Checkout / worktree（HARD）**：Phase 5 是 PR 级 **hotfix** loop，**不是** Phase 2 plan 实现。修复直接在 **control worktree**（已检出 `spec_integration_branch` 的 checkout）上编辑、commit、再按 §5.1a push。**禁止**为 Phase 5 另开 feature / fix worktree；**禁止**把 Phase 2「control 禁止产品编辑 / 须 feature worktree」套用到 Phase 5。另开 worktree 浪费时间、磁盘与计算，与 Phase 5 快速收敛 CI/review 的目标相悖。
-- 产品代码修复 → PM **dispatch** dev/ops（`mstar-dispatch-gates`）；Assignment **`Worktree path`** / cwd = control（snapshot `control_worktree_path` 或当前已在集成分支上的 checkout）；PM 线程不代写实现
+- **Checkout / worktree（HARD）**：Phase 5 是 PR 级 **hotfix** loop，**不是** Phase 2 plan 实现。产品修复在 **fix feature worktree**（从 `spec_integration_branch` 出的 fix 分支）上编辑、commit；review 后在 **integration worktree**（snapshot `integration_worktree_path`）merge 回 `spec_integration_branch`，再按 §5.1a push。**禁止**在 integration worktree 或主 checkout（control root）上直接编辑产品代码——三域表（`mstar-branch-worktree`）规定 product source → feature worktree only；merge 一次一个 holder。
+- 产品代码修复 → PM **dispatch** dev/ops（`mstar-dispatch-gates`）；Assignment **`Worktree path`** / cwd = 绝对 fix feature worktree 路径；merge 回 integration 由 PM 在 **integration worktree** 执行；PM 线程不代写实现
 - 禁止为「让 CI 变绿」而改 workflow，除非用户明确授权
 - **Push cadence** → **§5.1a**（本地可提前修；**禁止**在 CI / AI review 波次未结束时 push）
 
@@ -72,14 +72,15 @@ History rewrite / force-with-lease / 改写后证据失效规则 SSOT → `mstar
 
 When both babysit/`*-babysit` and greploop apply: **babysit/`*-babysit` first**（CI + reviews），then optional greploop for Greptile score. Discovery paths → `mstar-iteration` §5 (iteration command layer).
 
-### 5.2 Phase 5 exit checklist（迭代交付完成）
+### 5.2 Phase 5 exit checklist（merge-ready → enter Phase 6）
 
-打印 **`## Phase 5 exit checklist`**；全 `[x]` 后方可宣称 **迭代交付完成**：
+打印 **`## Phase 5 exit checklist`**；前 5 项全 `[x]` = **merge-ready**（第 6 项为 transition marker，merged 后才可勾），此后唯一出口是 **Phase 6**（PR merged 后执行 `references/phase-6-post-merge-close.md` §6.1–§6.4）——本 checklist **不是**「迭代交付完成」：
 
 - [ ] PR mergeable（无 blocking merge conflicts）
 - [ ] All **required** CI checks green on latest head
 - [ ] All review threads **resolved**（或用户书面 waive 特定 thread）
 - [ ] §5.1 review comment + resolve 已覆盖本轮所有 addressed feedback
 - [ ] Host todo `phase-5-pr-merge-ready` 可勾选
+- [ ] PR **merge** 完成后进入 **Phase 6**：追加 todo `phase-6-post-merge-close`，执行 post-merge close（`references/phase-6-post-merge-close.md` §6.1–§6.4）
 
-PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权 auto-merge。
+PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权 auto-merge。Merge 完成（手动或授权 auto-merge）即进入 **Phase 6** —— merge 不是生命周期终点。

package/harness-skills/mstar-iteration/references/phase-6-post-merge-close.md

@@ -0,0 +1,71 @@
+# Phase 6: post-merge close（terminal snapshot → unregister → reconcile → cleanup handoff）
+
+> Loaded by `mstar-iteration` SKILL.md when entering Phase 6. **Read `mstar-harness-core` first.** 进入前置：§5.2 exit checklist 全 `[x]` **且 PR 已 merge**（verified merged）。mergeable ≠ merged；引擎无法探测远端 PR 状态 —— merged 与否由 PM 核实后再调用，close verb **不**充当 merge 验证器。
+
+## Entry
+
+1. 打印 **`## Phase 6: post-merge close`**
+2. 追加 host todo `phase-6-post-merge-close`（session todos SSOT → `references/command-shared-invariants.md`）
+3. 可恢复：Phase 6 允许在后续会话补跑；对已 terminal 的 lifecycle 幂等（fully closed retry 不改任何文件、不重写 `ended_at`）
+
+Ordered pipeline（HARD —— 顺序固定，禁止跳步/倒置）：
+
+**§6.1 terminal snapshot write → §6.2 unregister → §6.3 projection reconciliation → §6.4 cleanup handoff。**
+
+## §6.1 Terminal snapshot write（先写终态）
+
+```text
+mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date>]
+```
+
+- 引擎 `closeWorkflow`：在 snapshot 写锁内**重读最新快照** → identity/shape 校验 → 已 valid terminal 则 no-op；否则要求全部 plan 行 `Done` 且**无任何** `execution_lease` / `integration_merge_lease` → 写 `completed` + `ended_at`
+- fail-loud：dangling lease / 非 `Done` 行 / snapshot 缺失或身份不符 → exit 1，**snapshot 字节不变**（无部分写）
+- **禁止**为通过 close 释放 lease —— lease release 是独立的 owner 动作，close 从不释放（甚至 caller 自己的）
+- `--ended-at` 省略时由 CLI 提供当天时间戳；引擎不接受自身时钟读数
+
+## §6.2 Unregister（removal-at-terminal）
+
+同一命令内、**仅在 §6.1 成功后**执行：从根 `{HARNESS_DIR}/status.json` 注销该 lifecycle（`unregisterWorkflow`，幂等）。
+
+- 顺序固定：**snapshot 先 terminal，再注销根条目**；禁止反向
+- unregister 失败 = exit 1 + **partial close** 显式报告；**禁止**回滚到 running —— 重试重读 terminal snapshot 后**只补 unregister**（不改 `ended_at`）
+- fully closed retry：两个文件都不再改动，输出 already-closed 通知
+
+## §6.3 Projection reconciliation（snapshot 权威）
+
+把本地状态面对齐到 terminal snapshot（snapshot 行权威，投影跟随）：
+
+1. `{PLAN_DIR}` plan 文件
+2. compass `## Plans` + `{ITERATION_DIR}/README.md` 索引
+3. project roadmap / register
+
+- **禁止**伪造 `Done` 行、**禁止**为对齐而 close open residual —— 真实 remaining finding 阻塞 zero-residual 交付，而不是被静默关闭；reconciliation **不发明** Done/closed
+- **禁止**把新 tracked 产品/文档 commit 夹带进 Phase 6 —— 新发现的产品修复另开授权 workflow
+
+## §6.4 Cleanup handoff（最后一步；显式、不自动）
+
+物理清理（integration worktree / 本地分支 / 远端分支删除）是 §6.1–§6.3 之后的**显式独立步骤**——即 **timing lane 2**：valid terminal close + PR verified merged 之后才清理 integration 面。Phase 6 只固定顺序与守卫，不在本 phase 内实现删除：
+
+- cleanup **永不自动**、永不绕过 ownership / merge-evidence 守卫 —— 契约本体（ownership、合并证据、refusals、apply 顺序）唯一 home → **`mstar-branch-worktree`**「Worktree / branch cleanup」；本节只放 call site，不复制规则
+- `mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>]` —— dry-run 默认，逐候选打印 `verdict | kind | ref | reason`；先 dry-run 核对受保护行全部 `keep`/`refuse`，再 `--apply`
+- **lease 释放是手工 owner 动作、cleanup 范围外**：§6.1 close 已拒绝 dangling lease，但 cleanup 仍**从不**替 owner 释放——残留 lease 的候选只会得到 `cleanup.refuse.active-lease`；先手工释放，再重跑 dry-run/apply
+- squash-merged 分支（tip 非 base 祖先）→ STOP → residual；禁止 `git branch -D`
+
+Phase-6 gate 只查**本地 state**（valid terminal shape + 无 dangling lease + root 条目已注销），**不**验证远端 merged 证据，**不**检查物理清理是否完成。
+
+> **Engine check (when available):** run `mstar iteration gate --phase 6 --workflow <id>` (or `import { evaluatePostMergeClose } from "@mstar-harness/engine"` in a host hook) to gate the local post-merge close state（valid terminal shape + 无 dangling lease + root 条目已注销；稳定码 `PHASE6_*`；invalid/unreadable root 不是条目已注销的证明）. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
+
+## Standalone plans & abandonment
+
+- `type: plan` 独立 lifecycle 在其 PR merge 后用**同一** completed-close 命令关闭（无第二 verb、无 `--outcome` / `--force`）
+- abandoned lifecycle **不得**静默跑 completed close：已 terminal（`failed` / `stopped`）的 snapshot 保持原状态，CLI 如实报告实际 status；completed close 只属于 verified-merged 完成
+
+## Evidence
+
+Phase 6 完成 = `jq -r '.status, .ended_at'` `{HARNESS_DIR}/workflows/<id>/snapshot.json` → `completed` + 日期；根 `{HARNESS_DIR}/status.json` 不含该 id 且 `mstar status validate <root status.json>` exit 0；无 dangling lease；投影一致；host todo `phase-6-post-merge-close` 可勾掉。Phase-6 post-merge close gate（`mstar iteration gate --phase 6 --workflow <id>`，只查本地 close state）exit 0。
+
+## References
+
+- Route / transition-gate SSOT → `mstar-iteration` SKILL.md「Phase route map」+「Phase transition gates」
+- 终态字段 / lease 语义 / `unregisterWorkflow` → `mstar-artifacts/references/status-and-residuals.md`
+- cleanup ownership / guard 契约本体（两条时序车道）→ `mstar-branch-worktree`「Worktree / branch cleanup」

package/harness-skills/mstar-review-qc/SKILL.md

@@ -13,16 +13,17 @@ description: "Morning Star QC orchestration — **SDD mandatory plan QC tri-revi
 
 ## L3 是什么（派发前对齐）
 
-- Plan QC seats are **reviewers**: whole-branch **diff / logic / risk** lenses — same family as PR review, not a parallel QA test lane.
+- Plan QC seats are **reviewers**: assigned changed **diff / logic / risk** lenses and directly affected interfaces — same family as PR review, not a parallel QA test lane.
 - **Do not** instruct QC in Assignment to “run the suite / build / lint to confirm” on shared tri cwd; that causes peer `Blocked` and collapses L3 into L4.
-- Runtime proof stays with **implementer evidence** and **`QA gate`** (`qa-engineer` or PM acceptance).
+- Runtime proof stays with scoped **implementer evidence** and **`QA gate`** (targeted unit evidence only). `full tri-review` describes seats, not full-repository review. Scope SSOT → **`mstar-harness-core`** § 定向执行与验证边界; QC never broadens exploration or repeats unchanged L2 evidence.
+- Retained `sdd evidence` bundles are review **inputs, not something QC executes**: QC reviews the code and the declared coverage rationale; it never runs `sdd evidence capture`, never repeats the recorded child, and a record's integrity/outcome is not acceptance — coverage stays `review-required` (command semantics → **`mstar-sdd`** `references/file-handoffs.md` § Verification evidence).
 
 ## 分派时机（与 plan / batch 对齐）
 
 - **`Execution mode: sdd`**：全部 task + L2 task reviewers 完成后 → **强制 tri-review**（`QC mode: full tri-review`，**N=3**）。Assignment 须含 **branch review-package** 路径与 `{SDD_DIR}/review/qcN.md` report paths。PM 汇总 `{SDD_DIR}/review/qc-consolidated.md` 并回写主 plan durable summary。
 - **`Execution mode: inline`**：单席 `qc-specialist` → `{SDD_DIR}/review/qc.md`（**N=1**），或按 hotfix 路由跳过。
 - **After `Request Changes` (default)**：**Targeted re-review** — PM dispatches only seats that **raised** blocking findings; each updates **the same** `{SDD_DIR}/review/qcN.md` (`## Revalidation`, update verdict). **Do not** spawn `qcN-rev2.md` for targeted re-review. Naming → **`mstar-artifacts/references/plan-files-and-reports.md`** § QC 三审触发时机.
-- **Full tri re-review (exception)**：Assignment **`QC re-review: full tri-review`** → new basenames (`qc1-rev2.md` …); PM marks **active wave** in consolidated decision.
+- **Three-seat re-review**：only when all three seats have affected findings. `QC re-review: full tri-review` denotes seat count, never broader scope; each seat still checks its findings and fix delta. New wave basenames may distinguish reports, but do not reopen unchanged review coverage.
 
 > **Engine check (when available):** run `mstar review seats <assignment-file> [--mode sdd|inline|targeted] [--reviewers <role1,role2,...>]` (or `import { executionModeToN, assertTriIdentity } from "@mstar-harness/engine"` in a host hook) to map `Execution mode` to its QC seat count N above and assert tri identity. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 
@@ -55,7 +56,7 @@ Leaf reviewers apply verdict per **`mstar-roles/references/qc-specialist/report-
 
 ### 覆盖语义（未提及 = 未审查）
 
-- **未提及 = 未审查**：某 finding / severity 项 / 声明未被任何席位报告提及 → 不得在汇总中标记为已解决或通过；如实标注 `unreviewed`，按需转 targeted re-review 或补充席位。
+- **未提及 = 未审查**：某 finding / severity 项 / 声明未被任何席位报告提及 → 不得在汇总中标记为已解决或通过；如实标注 `unreviewed`，仅对受影响项按需转 targeted re-review 或补充席位；不据此重审无关内容。
 - **汇总层零注入**：consolidated 中每条发现可溯源到某 `qcN.md`；PM 不得在汇总层引入席位报告之外的新声明（PM 自身观察走独立 Status Update，不混入 gate 决策输入）。
 - **Unconfirmed 传导**：任一席位 verdict = `Unconfirmed`（`report-template.md` 定义的证据通道失败态）→ gate 决策不得为 `Approve`——先补证据（重发 review-package / 修 diff 基线）再收敛；受影响席位走既有 targeted re-review 机制（同 `qcN.md` `## Revalidation` 原位更新 verdict），不新增 re-review 形态、不改 N 规则。
 

package/harness-skills/mstar-review-qc/references/review-responsibility-boundaries.md

@@ -4,10 +4,10 @@
 
 | Layer | Who | When | Scope | Input |
 |-------|-----|------|-------|--------|
-| **L1** Implementer | dev subagent | Per task | Write code + **run** TDD / verification evidence | `task-N-brief.md` |
+| **L1** Implementer | dev subagent | Per task | Write code + affected unit evidence; non-executable docs/policy may use `scoped-check` | `task-N-brief.md` |
 | **L2** Task reviewer | `code-reviewer` (default; generic fallback when the host agent list lacks it) — PM-dispatched subagent (SDD) | Per task, after implementer | Spec + quality for **one task** (diff-first; no full suite) | brief, report, **task-level** diff |
-| **L3** Plan QC tri (cross-review) | `qc-specialist` + `qc-specialist-2` + `qc-specialist-3` | After **all** tasks on branch | **Code-review seat** — diff, language/logic, security & contract lenses on **whole branch**; **not** the test-execution path | Branch `review-package` MERGE_BASE..HEAD |
-| **L4** QA | `qa-engineer` when **`QA gate: mandatory`**; else PM acceptance | After QC gate | DoD acceptance, residual verify, targeted/full **command** verification, Done recommendation | Review bundle + plan + **L1 evidence** + `status.json` |
+| **L3** Plan QC tri (cross-review) | `qc-specialist` + `qc-specialist-2` + `qc-specialist-3` | After **all** tasks on branch | **Code-review seat** — diff, language/logic, security & contract lenses on **the assigned change and directly affected interfaces**; **not** the test-execution path | Branch `review-package` MERGE_BASE..HEAD |
+| **L4** QA | `qa-engineer` when **`QA gate: mandatory`**; else PM acceptance | After QC gate | DoD acceptance, residual verify, named affected **unit-test** verification only, Done recommendation | Review bundle + plan + **L1 evidence** + `status.json` |
 
 PM sets **`QA gate`** per `mstar-roles/references/project-manager/qa-trigger-matrix.md`. L4 execution when dispatched → `mstar-roles/references/qa-engineer/acceptance-gate.md`.
 
@@ -18,15 +18,17 @@ PM sets **`QA gate`** per `mstar-roles/references/project-manager/qa-trigger-mat
 | Produce runnable test/build evidence | **L1** implementer | **Does not** own |
 | Diff / logic / vulnerability / contract review | **L3** QC (and L2 task reviewer) | **Primary job** |
 | Map DoD → evidence; re-run gaps; close residuals | **L4** QA (or PM acceptance) | **Does not** own |
-| Full / targeted test suites, builds, installs | **L1** and/or **L4** | **NEVER** — leave to QA/dev |
+| Affected unit tests / evidence gaps | **L1** and/or **L4** | **NEVER** — consume evidence |
+| Explicitly user-authorized full local suite | Separate bounded action by implementer/ops; core authorization contract | **NEVER** |
+| Real browser / device / E2E | Explicit independent **`mstar-e2e`** workflow; ops executor | **NEVER**; not an L4 gate |
 
 **Why:** SDD plan QC is **N=3 parallel** on a **shared** `Review cwd`. Build/test/lint toolchains contend for caches and locks and falsely `Blocked` peer reviewers. QC is a **reviewer**, not a second QA lane.
 
-**SDD rule:** Layers L1–L2 run **per task** (serial). Layer L3 is **mandatory full tri-review** (`N=3`) whenever **`Execution mode: sdd`** — single-plan **and** iteration **and** multi-plan iteration. Layer L3 is **not** optional “final single review”.
+**SDD rule:** Layers L1–L2 run **per task**; independent ready tasks use isolated parallel tracks (`mstar-sdd` § Ready-task scheduling). Layer L3 is **mandatory full tri-review** (`N=3`) whenever **`Execution mode: sdd`** — single-plan **and** iteration **and** multi-plan iteration. Layer L3 is **not** optional “final single review”.
 
 **Non-SDD (`Execution mode: inline`):** hotfix / single-stream — plan QC may be **single-seat** (`qc.md`) or skipped per PM routing.
 
-Per-task spec/quality is **done** in L2 before L3. QC seats do not re-derive each task from scratch; they cross-review the **whole branch** for gaps L2 could not see.
+Per-task spec/quality is **done** in L2 before L3. QC seats do not re-derive each task from scratch; they review changed cross-task interfaces for gaps L2 could not see. Full tri denotes three seats, not full scope; do not repeat unchanged L2 work or survey the repository.
 
 ## Plan QC tri (SDD mandatory)
 
@@ -47,7 +49,7 @@ Per-task spec/quality is **done** in L2 before L3. QC seats do not re-derive eac
 | After | Fix dispatch |
 |-------|----------------|
 | Task review Critical/Important | Task fix subagent → task re-review (L2) |
-| Plan QC Critical/Important | **One** fix subagent with **complete** finding list → **targeted** QC re-review (listed seats) |
+| Plan QC Critical/Important | Owned fix assignments, independent ones in parallel; PM retains complete ledger → **targeted** QC re-review (listed seats) |
 
 ## Minor findings
 

package/harness-skills/mstar-roles/SKILL.md

@@ -103,3 +103,5 @@ PM consolidated (tri mode): `{SDD_DIR}/review/qc-consolidated.md` (same folder;
 
 - 角色正文 → `references/<role>.md`（本 skill 内；leaf QC / QA 等子目录见 `references/qc-specialist/`、`references/qa-engineer/`）
 - 全局角色 → `mstar-harness-core` 加载矩阵与专题 skill 索引
+
+- Explicit independent E2E/browser/device requests → `mstar-e2e` (PM orchestrates; `ops-engineer` executes; routine QA does not trigger it).

package/harness-skills/mstar-roles/references/_shared/leaf-executor-core.md

@@ -2,6 +2,15 @@
 
 > Shared by all leaf-executor role references in `mstar-roles/references/`. Each role file references this for the identical Completion Report template, repo-write Git discipline, the shared anti-recursion NEVER section, and plan/documentation rules. **Load selection follows the `mstar-roles` hub § Load Order** (Assignment `Skill presets:` decision): under explicit `none` this boundary plus the role identity carry the load-bearing semantics — no optional topic skill (including `mstar-harness-core`) is required, and `none` never grants delegation or waives gates. Whenever `mstar-harness-core` IS loaded (standard routes, PM rounds, direct topic invocation) it remains the global lifecycle/authority entry. Role-specific NEVER rules, mission, and responsibilities stay in each role file — this file holds only the uniform blocks.
 
+## Assignment scope boundary
+
+Applies under every preset, including explicit `none`. Canonical policy when loaded: `mstar-harness-core` § 定向执行与验证边界.
+
+- Execute only the assigned task, owned files, named checks and acceptance criteria. Read the supplied inputs and relevant knowledge; during implement/fix/QC/QA do not restart whole-repository exploration, review, or scans.
+- Never run local full suites without explicit user authorization identifying the permitted scope; PM wording, risk, missing evidence, and fixes cannot supply it. Full suites belong to CI by default. Do not disguise a full suite as unrelated small checks.
+- Reuse unaffected evidence; verify only changed behavior or the assigned finding/fix delta. QA executes targeted unit tests only; QC runs no test/build/install. Browser/device/E2E belongs to an explicitly requested independent workflow, never routine QA.
+- Stop when the assigned result is evidenced. Do not over-analyze settled questions, invent extra checks, expand into downstream tasks, or repair unrelated findings. Report the concrete missing input/permission to PM if scope is insufficient; preserve completed work.
+
 ## Completion Report
 
 Every leaf executor returns this template (only `**Agent**` and content fields change per role):

package/harness-skills/mstar-roles/references/ops-engineer.md

@@ -23,6 +23,7 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 2. Deploy/runbook execution
 3. Monitoring/alerting integration
 4. Rollback and recovery readiness
+5. Separately requested E2E/browser/device verification — `mstar-e2e` (PM dispatch only; never inferred from routine QA).
 
 ## High-Risk Gate
 
@@ -44,6 +45,8 @@ When assignment is marked `high-risk`:
 
 ## Deliverable Template
 
+For verification-only assignments, use `mstar-e2e` → `references/report-template.md` instead of the Deploy Plan below. The role does not require deployment, production changes, or rollback work when those actions are outside the assignment.
+
 ```markdown
 # Deploy Plan: <release/feature>