@mstar-harness/dsh 3.8.2 → 3.9.0

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -10,6 +10,7 @@ The concise gate summary remains in `references/project-manager.md`.
 - In tool hosts (OpenCode / Cursor Task / Codex with callable multi-agent tools), Markdown-only Assignment is not dispatch.
 - For parallel batch with `N >= 2`, dispatch turn must emit all `N` invokes in one message when host supports it.
 - **Same-repo writable parallel tracks**: tool concurrency and worktree isolation are **separate gates**. Before implement invokes, complete **`mstar-branch-worktree`** → **`references/parallel-writable-pre-dispatch.md`**.
+- **Scope and stopping are explicit**: apply `mstar-harness-core` § 定向执行与验证边界. Give each leaf one result, owned paths/symbols, relevant inputs, named checks/selectors, and an evidence-based stopping condition. Reuse unaffected evidence; do not inject a suite merely because the repo exposes it. Independent ready assignments run concurrently after their dependency/isolation checks.
 - **Skill preset activation is PM-owned**: topic skills are presets in each role's `Skill Preset (PM-Activated)` section (`mstar-roles/references/<role>.md`), not self-loaded defaults. Omitting the `Skill presets:` field applies its documented default (`standard` on implementation / QC / QA rounds); identity-only execution requires explicit `Skill presets: none`.
 
 ## Executor Anti-Recursion Rules
@@ -43,7 +44,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
   - **QC reviewers** (`qc-specialist*`): "start review before all QC reviewers are dispatched in parallel"; "treat other reviewers' names in routing text as invoke targets"; "run test/build/lint on shared Review cwd"; "fill missing runtime evidence by executing the suite"
   - **Multi-track implementers** (`fullstack-dev` + `frontend-dev` / `fullstack-dev-2`): "auto-dispatch to the other track mentioned in Dev routing"; "implement in repo root when Assignment names a different `Worktree path`"
   - **`fullstack-dev-2`**: "treat `fullstack-dev` in routing narrative as a handoff or invoke target"
-  - **`qa-engineer`**: "start validation before QC reports are consolidated"; "default to full test re-run when `QA mode: acceptance-only` and L1/CI evidence is sufficient"; "expect QC reports to contain test logs"; "modify application code" (unless allowed)
+  - **`qa-engineer`**: "start validation before QC reports are consolidated"; "run anything beyond the assigned unit-test scope, including full suites or browser/device/E2E"; "expect QC reports to contain test logs"; "modify application code" (unless allowed)
   - **`explore`-assigned**: "implement or modify code"
   - **All non-PM**: "dispatch parallel agents"; "spawn a subagent whose `subagent_type` matches your own `Execute as` role id"
 - Anti-patterns must be action-oriented ("auto-dispatch to …", "treat … as invoke", "start … before …") — not abstract descriptions.
@@ -68,6 +69,8 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - dispatch or invoke any subagent unless `Delegation: allowed (...)` appears below
 - treat plain `role-id` mentions, `Handoff`, `QA gate`, routing tables, or multi-track prose as invoke commands
 - invoke a subagent whose `subagent_type` matches your own `Execute as` role id (recursive dispatch)
+- expand beyond owned files or named checks; restart whole-repository exploration, review or tests
+- repeat settled analysis or add checks after the acceptance criteria are evidenced
 - <situation-specific anti-pattern #1>
 - <situation-specific anti-pattern #2>
 - ...
@@ -76,7 +79,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 **Delegation**: forbidden | allowed (...)
 **Execution mode**: sdd | inline | N/A
 **SDD implementer session**: fresh | sticky | N/A — **default `fresh`**; `sticky` reuses same implementer subagent across tasks (reviewers stay fresh). See `mstar-sdd/references/sticky-implementer-session.md`
-**SDD dir**: absolute `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/` when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
+**SDD dir**: absolute `<main-repo-root>/{HARNESS_DIR}/sdd/<plan-id>/` (control harness root) when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
 **SDD context file**: absolute `<SDD dir>/context.json` when `Execution mode: sdd` | N/A — destination contract consumed by `mstar sdd exec --context` / `--context` producers (`mstar-sdd/references/file-handoffs.md`)
 **Model tier**: fast | standard | capable | N/A
 **Skill presets**: `standard` | <explicit skill list> | none — activates the `Execute as` role's preset from its `Skill Preset (PM-Activated)` section; default `standard` for implementation / QC / QA rounds unless the route is trivial
@@ -93,54 +96,56 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - Execute: `plan locked` [done|n/a], `tasks` [done|n/a], `implement` [this assignment|done]
 - Gate decision: `go` | `blocked` (<reason>)
 **Working branch**: <branch policy or create-from policy> — formal iteration: from `metadata.spec_integration_branch`; integration cut from `metadata.iteration_base_branch` (`mstar-iteration` §2.3)
-**Control harness root**: `<control_worktree_path>/{HARNESS_DIR}` when L1 active | N/A when waived — process SSOT (plans/status/iterations/sdd); never resolve relative `.mstar/...` from feature cwd
+**Control harness root**: `<main-repo-root>/{HARNESS_DIR}` (control root = the primary checkout / main worktree, derived from Git) when L1 active | N/A when waived — process SSOT (plans/status/iterations/sdd); never resolve relative `.mstar/...` from feature cwd
 **Review cwd / Worktree path**: <absolute path or N/A>
 **plan_id**: <plan-id or N/A + scope label>
 **Review range / Diff basis**: <reproducible basis; merge-base = `metadata.target_branch` or PM-specified ref — not assumed `origin/main`>
-**Worktree path**: <absolute feature implementer path when L1/L2 isolation used; default `<repoRoot>/.worktrees/<plan-id>-<slug>` (L2 tracks: `<track-slug>`); must ≠ control_worktree_path>
+**Worktree path**: <absolute feature implementer path when L1/L2 isolation used; default `<repoRoot>/.worktrees/<plan-id>-<slug>` (L2 tracks: `<track-slug>`); must ≠ the main worktree (control root) ≠ `integration_worktree_path`>
+**Main worktree branch**: <recorded residency branch of the primary checkout (main worktree), from the main plan header — passed unchanged; never a lifecycle-owned branch>
 **QA gate**: mandatory | pm-acceptance | report-only — see `references/project-manager/qa-trigger-matrix.md`
 **QA gate reason**: <tier label, e.g. hotfix-inline | small-feature-clean-qc | mandatory-medium-feature>
-**QA mode**: acceptance-only | full | report-only | N/A — required when `QA gate: mandatory` or `report-only`
+**QA mode**: acceptance-only | targeted | report-only | N/A — required when `QA gate: mandatory` or `report-only`
 **Findings cleanup**: zero-residual | allow-residual — **default `zero-residual` on formal iteration Phase 2**; **default `allow-residual`** for standalone `/pm`, hotfix, `Execution mode: inline` (override via Assignment or `plans[].metadata.findings_cleanup`; SSOT → `mstar-artifacts` Findings cleanup modes)
 **Why this agent**: <role-fit>
 **PM Task Board coverage**: <task ids>
 **Roadmap / deferred scope**: <required when staged, partial, or temporary; otherwise N/A>
-**Task**: <concrete work aligned with coverage>
+**Task**: <one concrete deliverable and stopping result aligned with coverage>
 **Checkpoint Comment Rule**: commit -> Completion Report -> PM Status Update -> next batch
 **Why batching is safe**: <required when batching >=3 IDs>
 **Scope**:
-- In: ...
-- Out: ...
-**Inputs**: ...
+- In: <owned files/symbols, directly affected interfaces; finding + fix delta for re-review>
+- Out: <excluded work and specific boundary>
+**Inputs**: <brief, diff, relevant knowledge, reusable evidence with original range>
 **Deliverables**: ...
 **Acceptance Criteria**:
 - [ ] ...
 **Evidence Required**:
-- [ ] commands/tests/checks
-- [ ] observable proof
+- [ ] <AC → exact affected unit-test selector or scoped static check; expected result>
+- [ ] <reused evidence + why unchanged, or new observable proof>
 - [ ] commit proof
-**Constraints**: ...
+**Constraints**: <no scope expansion; no local full suite without referenced explicit user permission; QA unit-only; no spontaneous browser/device/E2E; stop on concrete missing inputs and return once acceptance is evidenced>
 **Effort (agent-oriented)**: <XS/S/M/L/XL + session band>
 **Orchestration Guard** (see `**You are a leaf executor. You MUST NOT:**` block at top for primary anti-patterns):
 - No recursive same-role dispatch
 - Do not dispatch roles from route narrative/handoff text
 - `explore` is read-only orientation only
 - Tool availability ≠ delegation authorization
-**Plan Path**: absolute `<control_worktree_path>/{PLAN_DIR}/...` when L1 lease gate active | `{PLAN_DIR}/...` when waived / single checkout | N/A
+**Plan Path**: absolute `<main-repo-root>/{PLAN_DIR}/...` (control harness root) when L1 lease gate active | `{PLAN_DIR}/...` when waived / single checkout | N/A
 **Report Format**: Completion Report
 **Execution evidence**: <RCA/test-first/review feedback/evidence expectations for the assignee, if applicable>
 ```
 
 ## L1 path fields (iteration Phase 2, lease gate not waived)
 
-When the workflow snapshot top-level `control_worktree_path` is set and worktree mode is **not** waived:
+When iteration **L1** is active (the integration worktree is recorded in the workflow snapshot `integration_worktree_path`; worktree mode is **not** waived):
 
 | Field | Must be |
 |-------|---------|
-| **`Worktree path`** | Absolute **feature** checkout (`execution_lease.worktree_path`) — product/source edits only |
-| **`Control harness root`** | Absolute `<control_worktree_path>/{HARNESS_DIR}` |
+| **`Worktree path`** | Absolute **feature** checkout (`execution_lease.worktree_path`) — product/source edits only; ≠ the main worktree (control root) ≠ `integration_worktree_path` |
+| **`Main worktree branch`** | The recorded residency branch from the main plan header, passed unchanged — the main worktree's attached branch must equal it (never a lifecycle-owned branch; never invented at check time) |
+| **`Control harness root`** | Absolute `<main-repo-root>/{HARNESS_DIR}` — the control root is the primary checkout (main worktree), derived from Git (`readMainWorktree`) |
 | **`Plan Path`** | Absolute under control harness (not relative from feature cwd) |
-| **`SDD dir`** | Absolute under control harness; run `mstar sdd workspace <plan-id>` with `MSTAR_CONTROL_ROOT=<control_worktree_path>` when cwd is the feature tree |
+| **`SDD dir`** | Absolute under control harness; run `mstar sdd workspace <plan-id>` with `MSTAR_CONTROL_ROOT=<main-repo-root>` (the derived main worktree root, verified before the fail-closed guard) when cwd is the feature tree |
 | **`SDD context file`** | Absolute `<SDD dir>/context.json` — the bound destination contract (`controlHarnessRoot`/`featureCwd`/`workingBranch`/`planFile`/`sddDir`, all absolute) |
 
 Every implementer/reviewer handoff cites these absolute destinations; native hosted subagents observe pwd/branch first and write only to the declared destinations (`mstar-sdd` prompt templates). CLI-launchable children start via `mstar sdd exec --context <context.json> -- <argv>`. State the boundary, never overclaim: the context/launcher binds starting cwd and validated destinations — it does NOT block a later deliberate `chdir`, absolute-path write, or host-native edit tool (`apply_patch`).

package/harness-skills/mstar-roles/references/project-manager/qa-trigger-matrix.md

@@ -10,11 +10,13 @@ Extension of `references/project-manager.md`. Use when choosing **`QA gate`** an
 | | `pm-acceptance` | Do **not** dispatch QA; PM completes acceptance checklist and may mark `Done` |
 | | `report-only` | Primary route is investigation/repro only; dispatch `qa-engineer` (QC tri may be skipped per rules) |
 | **`QA mode`** | `acceptance-only` (default when QA dispatched) | Evidence reuse first; map plan DoD to **implementer / CI / prior QA** evidence (QC reports are review findings, not the test log) |
-| | `full` | Full verification when **L1 evidence** is insufficient, fix wave, high-risk, or user override |
+| | `targeted` | Run only specified affected unit tests for changed behavior or a concrete evidence gap |
 | | `report-only` | No business-code changes unless explicitly allowed |
 
 **Deprecated:** `QA note: skipped / self-check` — use **`QA gate: pm-acceptance`** plus **`QA gate reason: <tier>`**.
 
+All modes keep QA execution **unit-only**. Scope/authorization → `mstar-harness-core` § 定向执行与验证边界. No `full` QA mode: user-authorized full suites go to a separate implementer/ops action; QA reuses its evidence. Real browser/device/E2E goes to separately requested `mstar-e2e`, not an iteration QA gate.
+
 Set **`QA gate`** on the **first implement Assignment** (or plan frontmatter) and keep it consistent through QC closure unless scope/risk changes force an upgrade to `mandatory`.
 
 ## Trigger matrix (default)
@@ -26,11 +28,11 @@ Set **`QA gate`** on the **first implement Assignment** (or plan frontmatter) an
 | Bug fix (RCA + regression scope; default route) | `mandatory` | `acceptance-only` |
 | Medium / Large feature | `mandatory` | `acceptance-only` |
 | `Approve with residuals` or any open R# in `status.json` | `mandatory` | `acceptance-only` (includes R# verify) |
-| UI-visible change (`Task category: visual` or observable evidence gate) | `mandatory` | `acceptance-only` (UI observable evidence required; escalate to `full` if missing) |
-| High-risk ops | `mandatory` | `full` |
+| UI-visible change (`Task category: visual` or observable evidence gate) | `mandatory` | `acceptance-only` (unit evidence; record unverified UI behavior for independent E2E) |
+| High-risk ops | `mandatory` | `acceptance-only` (reuse ops evidence; named unit-test gaps only) |
 | QA report-only primary route | `report-only` | `report-only` |
 | Product-docs-only / tech-spec-only (no runtime diff) | N/A | — |
-| User explicit full QA request | `mandatory` | `full` |
+| User explicitly permits a local full suite | Preserve existing gate | QA consumes separately assigned implementer/ops evidence; permission does not authorize E2E |
 
 **Upgrade rule:** If conditions change mid-round (e.g. QC becomes `Approve with residuals`, UI scope added, open R# registered), change `QA gate` from `pm-acceptance` to `mandatory` before `Done`.
 
@@ -41,7 +43,7 @@ Set **`QA gate`** on the **first implement Assignment** (or plan frontmatter) an
 PM completes this in **Status Update** (or plan closure note). PM **does not** run bash tests or reproduction in the orchestration thread.
 
 1. **QC verdict:** `{SDD_DIR}/review/qc-consolidated.md` or `{SDD_DIR}/review/qc.md` shows `Approve` with **Critical = 0** and **Warning = 0** (not `Approve with residuals`), and the main plan has a durable gate summary.
-2. **DoD mapping:** Each plan Acceptance Criterion maps to **existing** evidence (dev Completion Report, SDD TDD triple, CI links; QC report for review verdict/findings only) — cite paths/commands, do not re-execute.
+2. **DoD mapping:** Each plan Acceptance Criterion maps to **existing** evidence (dev Completion Report, SDD test triple or applicable scoped-check, CI links; QC report for review verdict/findings only) — cite paths/commands, do not re-execute.
 3. **Residuals:** `status.json` has **no open R#** for this `plan_id` (or documented waiver per `mstar-artifacts`).
 4. **Checkout alignment:** `Working branch` and `Review range / Diff basis` match QC report verified lines.
 5. **`QA gate reason`:** One line naming the tier (e.g. `hotfix-inline`, `small-feature-clean-qc`).

package/harness-skills/mstar-roles/references/project-manager/qc-and-residuals.md

@@ -17,7 +17,7 @@ Use this reference when PM is dispatching QC, consolidating review verdicts, or
 0. Pre-dispatch: read `mstar-review-qc`.
 1. `review-package MERGE_BASE HEAD` → branch diff under `{SDD_DIR}/review/`.
 2. Dispatch **three** QC seats in **one** message (**N=3**); alignment fields text-identical across reports and Assignment.
-3. PM writes `{SDD_DIR}/review/qc-consolidated.md` + main plan durable summary; after fixes → targeted re-review (default) or `QC re-review: full tri-review` for new wave files.
+3. PM writes `{SDD_DIR}/review/qc-consolidated.md` + main plan durable summary; after fixes → targeted re-review of affected findings and fix delta; three seats only when all three have affected findings (new wave files do not broaden scope).
 
 **NEVER** end an SDD plan with only a single final `qc-specialist` unless user override: `QC mode: single — override: <reason>`.
 
@@ -39,7 +39,7 @@ Use this reference when PM is dispatching QC, consolidating review verdicts, or
 - **NEVER** under `Findings cleanup: zero-residual`, use `Approve with residuals` or open R# for fixable findings — fix-now + re-review; residual only for true blocker-defer + roadmap.
 - **NEVER** drop residual tracking to chat-only when `Approve with residuals` applies.
 - **NEVER** treat "two of three QC reports arrived" as sufficient — missing seat → `Blocked`.
-- **NEVER** re-dispatch all three after routine fix when only one or two had blockers — **targeted re-review** unless `QC re-review: full tri-review`.
+- **NEVER** re-dispatch all three after routine fix when only one or two had blockers — **targeted re-review**; the `full tri-review` label changes seats, never the allowed delta.
 - **NEVER** create `qc1-rev2.md` for **targeted** re-review; update original bundle `qcN.md` in place.
 
 ## Consolidated Decision Template

package/harness-skills/mstar-roles/references/project-manager/routing-and-dev-allocation.md

@@ -15,7 +15,7 @@ When multiple routes apply, set one `Primary` route in Assignment and treat othe
 6. Bug fix
 7. Refactor
 8. Feature size bucket (large/medium/small)
-9. User-visible UI/critical-flow evidence requirement (additional gate, usually not primary)
+9. User-visible UI/critical-flow unit evidence (additional gate); real browser/device/E2E requires an explicit independent `mstar-e2e` request, never an automatic iteration QA gate
 
 ## Size Heuristics
 
@@ -96,4 +96,4 @@ Document override as `Dev owner tie-break: single id — <reason>`.
 - `Dev routing` matches task board ownership
 - Parallel intent and branch/worktree policy align
 - **`QA gate`** and **`QA gate reason`** set per `qa-trigger-matrix.md`
-- If UI-visible changes: `QA gate: mandatory` and observable evidence gate planned
+- If UI-visible changes: `QA gate: mandatory` with unit-evidence mapping per `qa-trigger-matrix.md`; record unverified real-environment behavior for a separately requested `mstar-e2e` workflow, not an iteration gate

package/harness-skills/mstar-roles/references/project-manager.md

@@ -124,7 +124,7 @@ If any item below matches, fix the dispatch/plan state or mark `Blocked`—do **
 - **NEVER** dispatch same-repo **≥2 concurrent writable implement** tracks without **`references/parallel-writable-pre-dispatch.md`**（per-track worktree + absolute **`Worktree path`**；**N invokes ≠ isolation** — also `mstar-dispatch-gates` dual-gate table).
 - **NEVER** point QC at a single dev worktree/`Review cwd` that cannot contain **all** claimed changes from parallel tracks until Git integration lands on one `Working branch` `HEAD` (`mstar-branch-worktree` QC/QA alignment).
 - **NEVER** skip `qa-engineer` on `QA gate: report-only` primary routes—still dispatch with `QA mode: report-only`; QC skip rules are separate and explicit.
-- **NEVER** use `QA gate: pm-acceptance` when open R# exist, UI observable gate is unmet, or QC verdict is not clean `Approve`.
+- **NEVER** use `QA gate: pm-acceptance` outside the tiers in `qa-trigger-matrix.md` (open R# or unclean QC require QA). Missing real UI evidence is a separately requested `mstar-e2e` concern, not permission for iteration QA to run browser/device tests.
 - **NEVER** mark plan `Done` on runtime/behavior change without `QA gate: mandatory` fulfilled or completed PM acceptance checklist (`qa-trigger-matrix.md`).
 - **NEVER** run tests/repro in the PM orchestration thread to substitute for `QA gate: mandatory` dispatch.
 - **NEVER** let non-PM/non-QA roles mark plan `Done`.
@@ -132,11 +132,12 @@ If any item below matches, fix the dispatch/plan state or mark `Blocked`—do **
 - **NEVER** perform specialist document edits in the PM thread when host invoke is required — that is `dispatch incomplete` (`mstar-dispatch-gates`, `mstar-iteration/references/phase-1-prepare.md` §1.6).
 - **NEVER** mark the last plan `Done` and then create a PR or declare the iteration complete without **`## Phase 3: iteration-close`** and `mstar-iteration/references/phase-3-iteration-close.md` §3.1–§3.5 checklists.
 - **NEVER** treat final plan closure prose as iteration-close — compound, roadmap `delivered`, and compass `status: completed` require Phase 3.
+- **NEVER** declare the iteration delivered at §5.5 exit or PR merge — delivery completes only after Phase 6 post-merge close finishes (`mstar status workflow-close --workflow <id>` terminal snapshot + root unregister + projections reconcile; `mstar-iteration/references/phase-6-post-merge-close.md` §6.1–§6.4).
 - **NEVER** steal or overwrite an active `execution_lease` or `integration_merge_lease` (no TTL, age, or inactivity authority); override only on explicit current-turn user instruction + audit snapshot plan `notes` / `notes.jsonl` (`mstar-engine-legacy` `references/lease-protocol.md` — “Lease prohibitions”; field semantics → `mstar-artifacts/references/status-and-residuals.md` — “Iteration execution leases”).
 - **NEVER** writable-dispatch for a plan without a **verified** `execution_lease` for that plan (resume only when same `holder` passes verify-held-lease against Assignment `Worktree path` / `Working branch`).
 - **NEVER** writable-dispatch when a plan is `InProgress` but has **no** `execution_lease` — complete orphan recovery first (`mstar-engine-legacy` `references/lease-protocol.md` — “Orphan recovery”; engine-present: `mstar lease verify --workflow <id>` + iteration checklist).
-- **NEVER** run or dispatch **parallel** integration merges into `spec_integration_branch` — merge is **serial** via the snapshot top-level `integration_merge_lease` from the control worktree (`mstar-iteration` §2.6 · `mstar-branch-worktree` L1).
-- **NEVER** cross-plan writable implement without distinct per-plan verified `execution_lease` + feature worktree; `Plan parallelism: serial` forces serial **scheduling** only — it does **not** waive control worktree or lease gates (`mstar-iteration/references/phase-2-worktree-lease.md` §2.0 #5).
+- **NEVER** run or dispatch **parallel** integration merges into `spec_integration_branch` — merge is **serial** via the snapshot top-level `integration_merge_lease` from the integration worktree (`mstar-iteration` §2.6 · `mstar-branch-worktree` L1).
+- **NEVER** cross-plan writable implement without distinct per-plan verified `execution_lease` + feature worktree; `Plan parallelism: serial` forces serial **scheduling** only — it does **not** waive the worktree or lease gates (`mstar-iteration/references/phase-2-worktree-lease.md` §2.0 #5).
 - **NEVER** dispatch **cross-plan parallel** writable implement when same-host exclusive write lock is **not** available on the coordination snapshot path (`workflows/<id>/snapshot.json`; cross-host / no shared flock) — default **`Plan parallelism: serial`** or **Blocked** if Assignment still claims parallel; exception only on current-turn user `Cross-host lease race: accepted` (or equivalent) + audit `plans[].notes` — **including when `Worktree mode: waived`** (`mstar-engine-legacy` `references/lease-protocol.md` — full protocol; `mstar-iteration` `references/phase-2-worktree-lease.md` — execution checklist).
 - **NEVER** set `Worktree mode: waived` because default-gitignored `plans/` are missing under a feature worktree — keep feature worktrees; put absolute control **`Plan Path`** / **`SDD dir`** / **`Control harness root`** on Assignments (`mstar-branch-worktree` 「Harness path SSOT under default gitignore」). No flock → serial scheduling only, not worktree waiver.
 
@@ -257,7 +258,7 @@ PM must:
 
 - Dispatch QC with aligned scope fields
 - Consolidate to one gate verdict
-- Assign fixes; default **targeted QC re-review** (same `{SDD_DIR}/review/qcN.md`); full tri only when Assignment says `QC re-review: full tri-review`
+- Assign fixes; default **targeted QC re-review** by the owning seat (same `{SDD_DIR}/review/qcN.md`), limited to its findings, fix delta and direct contracts. `QC re-review: full tri-review` changes seat count only, not review scope (`mstar-harness-core` § 定向执行与验证边界).
 - Record non-blocking leftovers as residual findings
 - Keep open vs archived residual state coherent at closure
 - Sync plan/status in the same coordination round

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -35,7 +35,7 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 When creating a new skill, making a major skill rewrite, changing frontmatter `description`, or changing behavior-shaping skill text:
 
 1. MUST read `mstar-skill-authoring` before editing.
-2. MUST follow the repository **`skill-creator`** requirement when the change is a new skill or major rewrite (`AGENTS.md` → Skill-Creator Requirement).
+2. MUST follow the repository **`skill-creator`** requirement when the change is a new skill or major rewrite (`AGENTS.md` → Skills and host consistency).
 3. MUST include validation evidence for behavior-shaping changes, or explicitly state why only manual/search validation is practical.
 
 ## Prompt Change Minimal Checklist

package/harness-skills/mstar-roles/references/qa-engineer/acceptance-gate.md

@@ -11,8 +11,8 @@ Layer **L4** runs after the QC gate. **`QA gate: pm-acceptance`** is PM-only —
 | L3 Plan QC (`qc-specialist*`) | L4 QA (`qa-engineer`) |
 | --- | --- |
 | **Code review** — independent lenses on branch **diff** (logic, security, contracts) | Acceptance against plan DoD + review bundle + **L1** evidence |
-| Find defects in source; `Request Changes` / residual registration via PM | Verify fixes, R# lifecycle, run **targeted/full** checks when needed, Done recommendation |
-| **Does not** run test/build suites (shared tri worktree) | May run verification commands; default **reuse L1 / prior QA evidence** |
+| Find defects in source; `Request Changes` / residual registration via PM | Verify fixes, R# lifecycle, run only assigned **targeted unit tests** when needed, Done recommendation |
+| **Does not** run test/build suites (shared tri worktree) | May run named unit-test checks; default **reuse L1 / prior QA evidence** |
 
 **Do not collapse L4 into L3.** QC reviewers do not close residuals, mark plan `Done`, or produce the runtime test log that acceptance depends on — that is L1 (implement) and/or L4 (QA).
 
@@ -21,26 +21,40 @@ Layer **L4** runs after the QC gate. **`QA gate: pm-acceptance`** is PM-only —
 | `QA mode` | When | Behavior |
 | --- | --- | --- |
 | **`acceptance-only`** (default) | Most `mandatory` dispatches | Map DoD to **dev Completion Report / SDD TDD / CI** evidence; re-run only gaps listed below |
-| **`full`** | High-risk ops, user override, or gaps below | Full verification commands for assigned scope |
-| **`report-only`** | `QA gate: report-only` | Structured findings; no business-code edits unless allowed |
+| **`targeted`** | A specific changed behavior or unit-test evidence gap | Run only named affected unit-test files/cases/selectors |
+| **`report-only`** | `QA gate: report-only` | Structured findings within assigned evidence/unit-test scope; no business-code edits unless allowed |
 
 ## Evidence reuse first (`acceptance-only`)
 
 When **`QA mode: acceptance-only`**:
 
-1. Read implementer Completion Report(s) / SDD TDD triple and any CI links for the same **`Review range / Diff basis`**. Read QC consolidated (or `qc.md`) for **findings and “Needs L4/QA verification”** notes — **not** as a substitute test log (QC is diff review).
-2. If **L1** (or prior QA) already provides **reproducible test/build commands + output** for that range → **verify mapping** to plan Acceptance Criteria; **do not** default to a full suite re-run.
+1. Read implementer Completion Report(s) / SDD verification evidence and relevant CI links. Map each item to **`Review range / Diff basis`**; older-range evidence is reusable when its covered behavior remains unchanged, with the original range and applicability reason recorded. Read QC consolidated (or `qc.md`) for **findings and “Needs L4/QA verification”** notes — **not** as a substitute test log (QC is diff review).
+2. If **L1** (or prior QA/CI) already provides reproducible relevant evidence → **verify mapping** to plan Acceptance Criteria; do not re-execute covered checks. Non-executable docs/policy may supply `scoped-check` evidence (`mstar-sdd/references/file-handoffs.md`), not a fabricated test log.
 3. Document in Completion Report **Validation**: which ACs are covered by reused evidence vs newly executed checks.
 
-## Mandatory full re-run
+### Captured evidence mapping (`sdd evidence`)
 
-Run full verification (or escalate to **`QA mode: full`**) when **any** applies:
+Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes and exit meanings → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns:
 
-- Assignment says **`QA mode: full`**
-- **Implementer / prior evidence** lacks reproducible commands+output for behavior-critical ACs (QC noting a gap counts as a signal to run, not as evidence)
-- Post–fix-wave scope: `Review range` changed since QC consolidated
-- UI observable gate required and QC/dev left no screenshot, preview URL, or equivalent
-- Open R# marked resolved this round — verify each with targeted repro/tests
+| AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
+- **Run/manual reference**: `{SDD_DIR}/evidence/<run-uuid>/` with the record and raw `stdout.log`/`stderr.log` paths — or the manual report/CI citation with provenance.
+- **Original input identity**: the recorded run's Git HEAD plus declared-input digest from `record.json` — the basis any target comparison reuses.
+- **Coverage judgment** is reviewer reasoning: the assessment always reports `review-required`, supplies no pass/fail counts and no automatic coverage inference; skips and behavior coverage need raw-log/code review when material.
+- Evaluate candidate assumptions, never inherit them: a `reviewed` declaration, an empty environment allowlist, or a lockfile-only dependency rationale is the caller's assumption, not automatic completeness — name the unverified scope as the targeted gap when material.
+- Reuse outcomes: tested bytes equal after a later commit → reuse, no rerun; docs-only change → reuse; a changed shared runtime/config/fixture/dependency input → name the affected gap instead of rerunning everything; failed/incomplete or unknown-scope proof stays uncertain; no assessed target → `not-assessed`.
+- A pre-fix failing run keeps outcome `failed` and is never relabeled a pre-feature baseline; the fix needs its own passing evidence for the affected AC.
+- Manual historical evidence is unverified/manual — cite it with provenance and reviewer reasoning; NEVER convert it into a v1 runner record.
+
+## Fill only the affected gap
+
+Scope authority → `mstar-harness-core` § 定向执行与验证边界. All QA modes remain unit-only; a mode, risk level or absent evidence does not grant wider execution.
+
+- Missing behavior-critical evidence: name the uncovered AC and its targeted unit-test check; run only that assigned check, or return the concrete gap to PM if it is not specified.
+- A fix or changed `Review range`: invalidate only evidence affected by the fix; preserve the rest. Resolved R# items need only their corresponding unit-test evidence or scoped documentation/policy evidence.
+- Missing screenshot or other real-environment evidence: record the unverified behavior and a pending independent E2E request for PM. Never launch a browser/device/E2E, change roles, or block/reopen routine iteration QA solely for that separate workflow. Unit acceptance cannot claim real-environment acceptance.
+- User-authorized local full-suite execution belongs to a separate implementer/ops action; QA may consume its result but has no `full` mode. Refer the authorization scope to PM instead of executing it here.
 
 ## Unchanged hard duties
 

package/harness-skills/mstar-roles/references/qa-engineer.md

@@ -6,7 +6,7 @@ Detailed L4 procedures: `references/qa-engineer/*.md`.
 
 ## Role Mission
 
-You are `qa-engineer`, the L4 **acceptance seat**: map plan DoD to evidence, verify residuals when assigned, return reproducible QA outputs. You are dispatched by `project-manager` only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
+You are `qa-engineer`, the L4 **acceptance seat**: map plan DoD to evidence, verify assigned residuals with targeted unit tests, return reproducible QA outputs. You are dispatched by `project-manager` only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
 
 ## Non-Recursive Dispatch Rule (Hard)
 
@@ -22,11 +22,12 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 - **NEVER** switch to an unprescribed worktree/branch to “pick up the other half” of parallel development; if the current `HEAD` cannot contain the claimed diff scope, **Blocked** and ask PM for Git integration or a corrected assignment (`mstar-branch-worktree`).
 - **NEVER** delegate test design, execution, evidence, or QA reports to `explore`.
 - **NEVER** issue pass / sign-off language when checkout alignment, `Review range / Diff basis`, or mandatory commands cannot be verified—use `Blocked` with the concrete gap.
-- **NEVER** default to a full test-suite re-run when **`QA mode: acceptance-only`** and **implementer / prior QA / CI** already provide reproducible commands + output for the same `Review range` — follow `references/qa-engineer/acceptance-gate.md`. Do not expect QC reports to contain test logs (L3 is diff review).
+- **NEVER** execute beyond targeted unit tests, under any QA mode or preset (including `report-only` / `none`). No full suite, browser, device, E2E, real install/deployment probe, or self-switch to ops. Refer unmet environment verification to PM for a separately requested `mstar-e2e` workflow; keep its pending results separate from iteration QA.
+- **NEVER** rerun unaffected evidence merely because HEAD changed or a fix landed. Follow `references/qa-engineer/acceptance-gate.md`; QC reports contain review findings, not runtime logs. Explicit user-authorized full tests are assigned to an implementer/ops separately; QA consumes their evidence.
 
 ## Core QA Gate Duties
 
-Before sign-off: validate phase-gate prerequisites, Assignment metadata alignment, and reproducible evidence for any **new** checks. Full mode/mapping rules → **`references/qa-engineer/acceptance-gate.md`**.
+Before sign-off: validate phase-gate prerequisites, Assignment metadata alignment, and reproducible evidence for any **new** checks. Mode/mapping rules → **`references/qa-engineer/acceptance-gate.md`**. Retained `sdd evidence` bundles are integrity-checked and mapped read-only (captured-evidence mapping columns → **`references/qa-engineer/acceptance-gate.md`** § Captured evidence mapping); QA never repeats a captured child command, and manual historical evidence is never converted into a v1 runner record.
 
 ## Branch & Review Context Gate
 
@@ -49,13 +50,15 @@ When Assignment provides a report path, write report-only output under `{SDD_DIR
 ## Recommended owners
 ```
 
+The acceptance AC mapping uses the evidence columns defined in **`references/qa-engineer/acceptance-gate.md`** § Captured evidence mapping (`AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap`).
+
 ## Skill Preset (PM-Activated)
 
 External topic skills below are **presets activated by PM**, not unconditional role dependencies — the L4 acceptance identity and NEVER rules above stand alone, and role-owned `references/qa-engineer/acceptance-gate.md` is always part of this role (never preset-gated; role-owned obligations hold under every preset including `none`). The omission / `none` / named-preset / resume / unknown-preset selection rule is owned by the **`mstar-roles`** hub § Load Order; this section lists only this role's preset members. When active, load in order:
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` + `mstar-branch-worktree` (anti-recursion; checkout alignment with QC)
 2. Host adapter: `mstar-host` (detect; Read `references/opencode.md`, `cursor.md`, or `codex.md`)
-3. On demand: `mstar-artifacts` (closing R#); `mstar-conventions` (paths); `mstar-design-md` (UI verify against DESIGN.md); `mstar-phase-gates` (Assignment references verification phase); review bundle files and QC consolidated inputs named in Assignment
+3. On demand: `mstar-artifacts` (closing R#); `mstar-conventions` (paths); `mstar-design-md` (map supplied UI evidence to DESIGN.md; no environment execution); `mstar-phase-gates` (Assignment references verification phase); review bundle files and QC consolidated inputs named in Assignment
 
 ## Completion Report
 

package/harness-skills/mstar-roles/references/qc-specialist/deep-review-lenses.md

@@ -9,7 +9,7 @@ Extension of `references/qc-specialist-shared.md`. Read at QC session start when
 
 ## Deep review 触发规则（自动判定，无需人工指定）
 
-QC reviewer 在开工时根据以下信号自判是否启用 deep review。满足 **≥2 条**即触发。
+QC reviewer 在开工时根据以下信号自判是否启用 deep review。满足 **≥2 条**时仅选择与 Assignment 变更问题相关的透镜；触发不会扩大 review 范围。
 
 ### 触发信号
 
@@ -17,12 +17,12 @@ QC reviewer 在开工时根据以下信号自判是否启用 deep review。满
 |---|------|---------|
 | S1 | **变更规模大** | `git diff --stat <Review range>` → 变更行数 ≥ 200 或 变更文件数 ≥ 8 |
 | S2 | **触及敏感模块** | diff 中包含 `auth/`、`payment/`、`security/`、`permission/`、`login/`、`migration/`、`db/migrate/`、`schema/` 路径 |
-| S3 | **首次涉足新领域** | `{KNOWLEDGE_DIR}` 中不存在 diff 触及的模块名；或 plan metadata 标记为首次实现 |
+| S3 | **首次涉足新领域** | 已提供的相关 knowledge / 索引未覆盖 diff 模块，或 plan 标记首次实现；禁止为证明缺失扫描全知识库 |
 | S4 | **数据结构变更** | diff 中包含 DDL（`CREATE TABLE`、`ALTER TABLE`、`ADD COLUMN`、schema 文件、migration 文件） |
 | S5 | **plan 显式声明高风险** | plan 正文或 workflow snapshot plan 行的 metadata 中包含 `high-risk`、`critical-path`、`breaking-change` 标记 |
 | S6 | **多模块耦合** | diff 跨越 ≥3 个不同模块/包/目录边界 |
 
-**判定**：满足 ≥2 条 → 启用 deep review。QC reviewer 在报告 `## Scope` 节中写明判定依据（例：`Deep review: triggered (S1: 350 lines / 12 files, S2: auth/ + payment/)`）。
+**判定**：满足 ≥2 条 → 在既定 changed scope 内启用相关透镜。QC reviewer 在报告 `## Scope` 节中写明判定依据（例：`Deep review: triggered (S1: 350 lines / 12 files, S2: auth/ + payment/)`）。
 
 ## 透镜选择
 
@@ -43,7 +43,7 @@ QC reviewer 在开工时根据以下信号自判是否启用 deep review。满
 | S2 (敏感模块) | **Auth Lens**（若涉及 auth/login）、**Data Migration Lens**（若涉及 DDL/migration）、**Input Validation Lens**（若涉及用户输入/API） | 全体 |
 | S3 (新领域) | **Standards Lens**、**Testing Lens** | 全体 |
 | S4 (数据结构变更) | **Data Migration Lens** | 全体 |
-| S5 (显式高风险) | **全部透镜**（每个 reviewer 覆盖自己身份相关的所有透镜） | 全体 |
+| S5 (显式高风险) | **与该变更风险直接相关的透镜**（不因 high-risk 全量扩审） | 全体 |
 
 ---
 
@@ -100,5 +100,5 @@ QC reviewer 在开工时根据以下信号自判是否启用 deep review。满
 即使触发信号阈值达标，以下情况 QC reviewer 仍按默认单透镜模式审查：
 
 - **Re-review（targeted re-review）**：只在原报告基础上验证修复点，不重新扩展审查范围
-- **Hotfix**：时间窗口不允许扩展审查，按 hotfix 压缩路径处理（事后在 plan notes 中补 deep review 追记）
+- **Hotfix**：时间窗口不允许扩展审查，按 hotfix 压缩路径处理（不自动追加事后全量审查）
 - **上下文限制**：宿主会话上下文不足以加载透镜内容时，标记为 `Deep review: skipped (context constraint)` 并仅执行默认审查

package/harness-skills/mstar-roles/references/qc-specialist/report-template.md

@@ -17,6 +17,8 @@ Write under the Assignment-provided **`{SDD_DIR}/review/qc#.md`** (`qc1`…`qc3`
 - Report Timestamp: {ISO-8601}
 
 ## Scope
+- Changed scope: {assigned changed hunks and directly affected interfaces; re-review: finding IDs + fix delta}
+- Reused evidence: {unchanged L2 / prior-review evidence; do not rerun it}
 - plan_id: {same as Assignment — or `N/A` + Feature / scope label from Assignment}
 - Review range / Diff basis: {exact copy from Assignment}
 - Working branch (verified): {name}

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-checklist.md

@@ -2,7 +2,7 @@
 
 Extension of `references/qc-specialist-shared.md`. Use during step 5 of `reviewer-workflow.md`.
 
-Apply by **reading the diff and related source** — do not run project test/build/lint suites to tick these boxes (see `reviewer-workflow.md`).
+Apply only affected items by **reading the assigned changed diff and directly related source** — do not run project test/build/lint suites to tick these boxes (see `reviewer-workflow.md`).
 
 ## Code quality
 

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-workflow.md

@@ -4,7 +4,7 @@ Extension of `references/qc-specialist-shared.md`. Read when dispatched as `qc-s
 
 ## What this seat is
 
-**L3 plan QC = independent code review** on the whole-branch diff: logic, contracts, security, maintainability, reliability — same job family as a human PR reviewer.
+**L3 plan QC = independent code review** on the assigned changed diff and directly affected interfaces: logic, contracts, security, maintainability, reliability — same job family as a human PR reviewer.
 
 | This seat does | This seat does **not** |
 |----------------|-------------------------|
@@ -26,10 +26,10 @@ Layer SSOT → `mstar-review-qc/references/review-responsibility-boundaries.md`.
 ## Standard review workflow
 
 1. **Align checkout:** Enter **`Review cwd` / `Worktree path`** from Assignment; verify with `git rev-parse --show-toplevel` and `git branch --show-current`. Confirm **`plan_id`** and **`Review range` / `Diff basis`** are present; if missing → `Blocked` to PM. All `git diff` / `git log` must reproduce the assigned range.
-2. **Build context from the diff** with `git diff` / `git show` / review-package file / `glob` / `grep` / `read`. Optional short `@explore` for navigation only — **never** outsource review steps to `@explore`.
+2. **Build context from the diff** with `git diff` / `git show` / review-package file / `glob` / `grep` / `read`. Use the supplied relevant knowledge/context; do not launch global exploration or delegate navigation.
 3. Re-verify branch vs **`Working branch` / `Branch policy`** before concluding.
 4. **Static judgment on the source** (naming, error paths, boundaries, contracts). Default tooling = read/grep only. **Do not** start lint/typecheck/test/build on shared tri-review cwd (see NEVER in `qc-specialist-shared.md`).
-5. Execute **`reviewer-checklist.md`** manually against the diff.
+5. Apply only the **`reviewer-checklist.md`** items affected by the diff. Reuse unchanged L2 evidence; re-review only the assigned findings and fix delta. Stop when these questions have evidence.
 6. Produce structured findings with severity and evidence. PM maps report sections to register **`severity`** (`projects/<id>/residuals.json` → `entries[<plan-id>]`) per `mstar-artifacts/references/status-and-residuals.md` — do not invent non-canonical severity strings.
 7. **Write report:** Write `.md` to the Assignment-provided `{SDD_DIR}/review/` report path. Do not commit raw bundle reports unless Assignment explicitly says `Review archive mode: tracked reports`.
 8. **No stall:** When done, emit **Completion Report** in the same turn — no “notify PM?” choosers.
@@ -38,7 +38,8 @@ Layer SSOT → `mstar-review-qc/references/review-responsibility-boundaries.md`.
 
 If Acceptance Criteria or high-risk paths need **runtime** proof and L1 reports leave a gap:
 
-- Record in findings / Summary: `Needs L4/QA verification: <what command or check>` with confidence Medium/Low as appropriate.
+- Record in findings / Summary: `Needs targeted unit evidence: <affected behavior and named case>` with confidence Medium/Low as appropriate.
+- Browser/device/E2E gaps become an explicitly requested independent **`mstar-e2e`** workflow, not QA commands or an automatic iteration gate.
 - Still complete the **diff review** and return a verdict for what you *can* judge from source.
 - Do **not** run the missing commands yourself to fill the gap.
 

package/harness-skills/mstar-roles/references/qc-specialist-shared.md

@@ -17,7 +17,9 @@ You are QC reviewer #{reviewer_index} (or sole reviewer when `QC mode: single`),
 You are a **code reviewer** (diff + language/logic + risk lenses) — **not** a test runner and **not** a substitute for `qa-engineer`.
 Your output is a structured QC report plus Completion Report.
 
-**Default (SDD):** plan QC tri on whole-branch review-package (`QC mode: full tri-review`). **Exception:** `Execution mode: inline` → single-seat `qc.md`.
+**Default (SDD):** plan QC tri on the assigned change review-package (`QC mode: full tri-review`). **Exception:** `Execution mode: inline` → single-seat `qc.md`.
+
+**Scope:** follow **`mstar-harness-core`** § 定向执行与验证边界. Initial review covers assigned changed hunks and directly affected interfaces; reuse L2 evidence. Re-review covers only assigned findings and fix delta. Seat count never authorizes full-repository review or fresh global exploration.
 
 **Do (L3):** Read `git diff` / review-package; reason about correctness, security, contracts, maintainability, reliability; flag coverage **gaps in the diff** (missing tests for changed behavior); write findings with evidence from source.
 

package/harness-skills/mstar-sdd/SKILL.md

@@ -19,7 +19,7 @@ If you were dispatched as an SDD implementer or task reviewer, skip PM orchestra
 
 ## Core principle
 
-**Default:** fresh implementer subagent per task + task review (spec + quality) + plan-level QC on whole branch = quality with isolated context.
+**Default:** fresh implementer per ready task + task-scoped review + plan QC on the changed diff and directly affected interfaces. Execution scope → **`mstar-harness-core`** § 定向执行与验证边界.
 
 **Optional:** **`SDD implementer session: sticky`** — same implementer subagent across sequential tasks on one plan/branch; **task reviewers stay fresh per task**. SSOT → **`references/sticky-implementer-session.md`**.
 
@@ -38,10 +38,16 @@ Before Task 1, scan plan once for:
 
 Batch all findings for the human in one message. If clean, proceed silently.
 
+## Ready-task scheduling (PM only · Decision Rules)
+
+Dispatch independent ready tasks concurrently after L2 worktree isolation. Keep one canonical per-plan `{SDD_DIR}`. PM alone writes its `context.json`, `progress.md` and workflow snapshot; prepare context-dependent helper outputs serially. Each writable track has its own worktree/branch and immutable task-specific absolute brief/report/diff paths. Artifact subdirectories are namespaces inside that SDD root, never a second SDD root. Parallel leaves use the supplied paths directly and do not invoke shared-context helpers or read mutable context to choose their checkout; never share a writable session or `implementer-session.json`. Use **fresh** implementers for parallel tasks. Serialize only actual dependencies, overlapping write ownership, one sticky session, and integration merges; state the dependency when serializing. A task reviewer may run alongside an unrelated ready implementer. PM alone reconciles reports into the shared `progress.md` and workflow snapshot.
+
+**Dependent-task readiness:** review approval alone does not make a prerequisite available. PM serially integrates the reviewed prerequisite commits, then creates or updates the idle dependent worktree from that integrated state before recording its `BASE_SHA` and dispatching. For each required reviewed commit, record `git -C "$FEATURE_CWD" merge-base --is-ancestor <prerequisite-sha> <BASE_SHA>` with exit 0; a missing commit blocks only that dependent task. Do not move an active task's base; independent ready tasks continue concurrently.
+
 ## Per-task loop (PM only · Workflow)
 
 1. Record `BASE_SHA` (never use `HEAD~1` later)
-2. `mstar sdd workspace <plan-id>` → `SDD_DIR`（iteration L1 从 feature cwd 调用时：`MSTAR_CONTROL_ROOT=<control_worktree_path>` 或 `mstar sdd workspace <plan-id> <control_worktree_path>`；probe 以 v2 根 `status.json`（`workflows[]`）或 workflow snapshot 存在为准，linked worktree 缺文件会 fail closed）
+2. `mstar sdd workspace <plan-id>` → `SDD_DIR`（iteration L1 从 feature cwd 调用时：`MSTAR_CONTROL_ROOT=<main-repo-root>`（= **Git 派生的主 worktree 根**；先完成派生验证，fail-closed 守卫在其后）或 `mstar sdd workspace <plan-id> <main-repo-root>`；显式值必须与派生主根 canonicalize 一致，integration/外来检出被拒而非静默重定向；probe 以 v2 根 `status.json`（`workflows[]`）或 workflow snapshot 存在为准，linked worktree 缺文件会 fail closed）
 3. `mstar sdd task-brief <plan> N` → brief file
 4. Dispatch implementer:
     - **`SDD implementer session: fresh`** (default) — new subagent; templates: `references/implementer-prompt.md`
@@ -50,9 +56,9 @@ Batch all findings for the human in one message. If clean, proceed silently.
 6. Dispatch **fresh** task reviewer — role **`code-reviewer`** (L2; **not** `qc-specialist*`; host fallback generic + C5b → `mstar-host` C5) — brief, report, diff, Global Constraints — `references/task-reviewer-prompt.md` — **never** sticky resume for reviewers
 7. Fix loop for Critical/Important; re-review until approved
 8. Append `progress.md`; update the workflow snapshot plan row (`workflows/<id>/snapshot.json` → `plans[]`) `task_commits[]` and `implementer-session.json` `last_task` if sticky
-9. Next task
+9. Release dependent tasks only after reviewed prerequisite commits are present in their assigned base, per Dependent-task readiness above; independent ready tasks need not wait
 
-**Never** dispatch multiple implementers in parallel (write conflicts).
+**Never** dispatch parallel writers without isolated worktrees and disjoint ownership. Merge their outputs serially before producing the plan review-package.
 
 Detail: **`references/file-handoffs.md`**.
 
@@ -87,20 +93,20 @@ Host mapping → **`mstar-host`** references (`model` / Task field).
 
 1. `mstar sdd review-package MERGE_BASE HEAD` → branch diff in `{SDD_DIR}/review/`
 2. PM dispatches **plan QC tri-review (L3)** — **`QC mode: full tri-review`**, **N=3** — with branch review-package path and report paths under `{SDD_DIR}/review/` → **`mstar-review-qc`** · **`mstar-dispatch-gates`**. Layer SSOT → **`mstar-review-qc/references/review-responsibility-boundaries.md`**. PM writes `{SDD_DIR}/review/qc-consolidated.md` and durable main-plan gate summary. **Mandatory whenever `Execution mode: sdd`** (single-plan or iteration).
-3. Critical/Important QC findings → **one** fix dispatch (full list), then targeted re-review. Fix rounds run on four mechanics — the per-task fix loop applies the same (`references/file-handoffs.md`):
+3. Critical/Important QC findings → fix assignments partitioned by ownership/dependency, then targeted re-review. Independent fixes run concurrently; PM retains the complete findings ledger. Fix rounds run on four mechanics — the per-task fix loop applies the same (`references/file-handoffs.md`):
     - **Unverified rounds count**: a fix round without verification evidence (reviewer not confirmed / report not on disk) is **not clean** — re-check and count the round; never enter the convergence branch.
-    - **Full re-entry**: the next fix dispatch carries **all** open findings (including last round's unverified items) — never slice a subset.
-    - **Capped cross-round excerpt**: from round ≥2, the fix dispatch attaches an excerpt of prior rounds' findings and dispositions (advisory caps: ~500 words per round, ~1500 total — suggested values, not hard limits).
+    - **Complete ledger, scoped dispatch**: PM retains every open finding, including unverified items; each fix assignment carries only its owned findings and relevant fix delta. Unrelated findings do not expand a leaf task.
+    - **Capped cross-round excerpt**: from round ≥2, the fix dispatch attaches only relevant prior findings and dispositions (advisory caps: ~500 words per round, ~1500 total — suggested values, not hard limits).
     - **Honest non-convergence**: open findings at wave close → list them in detail and state the disposition — re-feed to the next fix round **or** transfer to residual tracking — never silently close.
 4. QA gate → **`mstar-harness-core`** Done rules; PM **`mstar-roles/references/project-manager/qa-trigger-matrix.md`**
 
-> **On dsh:** the plan QC tri MAY run through the native **`workflow`** tool instead of three `subagent` dispatches — take the `script` + `meta` (`meta.name: mstar-qc-tri`) from skill **`mstar-host`** → `references/dsh-workflow-scripts.md` (§ `mstar-qc-tri`); the three seats stay read-only and PM persists `{SDD_DIR}/review/qc1.md`…`qc3.md` from their returned envelopes. Per-task implementers stay **serial `subagent`** — the `workflow` channel is read-only fan-out only; when the tool is unmounted (`ptc` preset) dispatch the three seats as background `subagent` calls (skill **`mstar-host`** → `references/dsh.md`).
+> **On dsh:** the plan QC tri MAY run through the native **`workflow`** tool instead of three `subagent` dispatches — take the `script` + `meta` (`meta.name: mstar-qc-tri`) from skill **`mstar-host`** → `references/dsh-workflow-scripts.md` (§ `mstar-qc-tri`); the three seats stay read-only and PM persists `{SDD_DIR}/review/qc1.md`…`qc3.md` from their returned envelopes. Independent ready implementers use background **`subagent`** dispatches with isolated writable tracks — the `workflow` channel is read-only fan-out only; when the tool is unmounted (`ptc` preset) dispatch the three seats as background `subagent` calls (skill **`mstar-host`** → `references/dsh.md`).
 
 ## Progress ledger（Evidence）
 
-At start: `cat {SDD_DIR}/progress.md`. Tasks marked complete are DONE — do not re-dispatch after compaction.
+PM at start: `cat {SDD_DIR}/progress.md`. Tasks marked complete are DONE — do not re-dispatch after compaction.
 
-Append on clean review: `Task N: complete (<base>..<head>, review clean)`.
+PM appends on clean review: `Task N: complete (<base>..<head>, review clean)`.
 
 Minor findings → `## Minor (for plan QC)` section in same file.
 
@@ -108,7 +114,7 @@ Minor findings → `## Minor (for plan QC)` section in same file.
 
 ## Red flags (NEVER)
 
-- Parallel implementer dispatches
+- Parallel implementers sharing a worktree, ownership, or session
 - Paste plan, diffs, or task history into dispatch prompts
 - Dispatch reviewer without diff file
 - `HEAD~1` as review BASE
@@ -129,6 +135,8 @@ The SDD helpers are engine-backed commands under **`mstar sdd`**（引擎 CLI；
 | `mstar sdd task-brief` | `PLAN_FILE TASK_N [OUTFILE]` |
 | `mstar sdd review-package` | `BASE HEAD [OUTFILE]` |
 
+Developer check evidence: `mstar sdd evidence capture|verify` — capture runs an already-authorized argv once and retains raw evidence; verify is read-only. Command shapes, exit meanings and role boundaries → **`references/file-handoffs.md`** § Verification evidence. `mstar sdd exec` stays PM-only.
+
 ## References
 
 - `references/file-handoffs.md` — paths and fix-loop evidence