@mstar-harness/dsh 3.9.3 → 3.10.0

package/harness-skills/mstar-iteration/references/phase-2-worktree-lease.md

@@ -9,6 +9,8 @@ protocol prose** (single canonical copy) → `mstar-engine-legacy/references/lea
 checklist** — do not invent alternate lease field names; do not re-state the
 full protocol here.
 
+**Scoped primary route**（`/iteration-drive --assignment|--workflow/--plan|--resume`）: this file is the **whole-iteration** execution checklist. On the scoped route every handwritten snapshot / register mutation below is replaced by a frozen `mstar plan …` state verb (which owns the same-host lock) → **`plan-scoped-pm.md`**. The §2.0 gates, per-plan loop, worktree layout and read-only validators still apply; the plan session's finish is a **handoff**, not `Done`.
+
 ## When it applies
 
 **Phase 2**（SKILL.md execute/resume route + `iteration-drive` / `iteration-loop`
@@ -26,7 +28,7 @@ starts at **Phase 2 entry**.
 
 **本 Phase 定义 per-plan 派发循环的完整流程**：前置条件检查、session todos、backlog 读取、integration 分支管理、per-plan dispatch 循环（分支→实现→QC→**QA gate**→Done→合并）、dispatch-first 约束。PM 读取本 Phase（含 §2.0–§2.5 与下方 lease 细则）即可执行迭代。
 
-**Findings cleanup（默认）**：Phase 2 每个 plan Assignment 默认 **`Findings cleanup: zero-residual`**（可修 findings 当轮 fix→re-review 清干净；仅真 blocker-defer + Durable Roadmap 可留 open R#，`critical` 不属 defer）。compass 或 Assignment 可显式覆写为 `allow-residual`。SSOT → **`mstar-artifacts`**「Findings cleanup modes」。
+**Findings cleanup（默认）**：Phase 2 每个 plan Assignment 默认 **`Findings cleanup: allow-residual`**（open R# 先登记 project register，再离 InReview；各决策面披露 id/severity/跟踪位置；unresolved `critical` 仍阻断 Approve）。compass 或 Assignment 可显式覆写为 `zero-residual`（可修 findings 当轮 fix→re-review 清干净；仅真 blocker-defer + Durable Roadmap 可留 open R#，`critical` 不属 defer）。登记与披露职责 SSOT → **`mstar-artifacts`**「Findings cleanup modes」。
 
 ## 2.0 前置条件（五道闸）
 
@@ -54,12 +56,18 @@ starts at **Phase 2 entry**.
 
 SSOT = `{WORKFLOW_DIR}/<id>/snapshot.json` + `{PLAN_DIR}/`。todos 只追踪本轮下一步。
 
+Phase/gate 转换时按 **`mstar-host`**「Phase-transition todo refresh (host-agnostic)」刷新：先按 snapshot / plan 证据勾掉已完成条目，保留未决 gate 条目，再追加下一批条目；todos 只是投影，不授权状态转换。
+
+**Scoped route**：todos 是 **plan-local 任务列表**（本 plan 的 task / gate），**不**追加 `phase-3-*` / `phase-4-*` / `phase-5-*` / `phase-6-*`；scoped finish = handoff → **`plan-scoped-pm.md`** §4–§5。
+
 ## 2.2 Read backlog
 
 1. 读 `mstar-artifacts` + workflow snapshot（`{WORKFLOW_DIR}/<id>/snapshot.json`）与根 `status.json`
 2. 列出 snapshot 中 `status` ∈ `{Todo, InProgress, InReview, Blocked}` 的 plan（优先级：`InProgress` → `InReview` → `Todo` → unblock `Blocked`）
 3. 读 snapshot `branch.base` / `branch.target`，以及 plan `metadata.spec_integration_branch` / `merge_target` / `primary_spec` 链接
 
+**Scoped route**：backlog **就是 `bind` 返回的那一行**（`--workflow/--plan` 从 `row.coordination.prepared.assignment_path` 解析）——**禁止**按「第一个未完成 plan」或整迭代优先级列表选择。
+
 ## 2.3 Branch anchors + integration branch + integration worktree（Phase 2 入口）
 
 **Branch anchors 解析顺序**（任一环节缺失则 STOP，**禁止**默认 `main`/`master`）：
@@ -122,11 +130,31 @@ claim/release) **MUST** run inside a same-host exclusive write lock for the full
 read-check-replace-verify sequence. Engine writers acquire the lock
 automatically (`writeWorkflowSnapshot` / `registerWorkflow` use
 `<status-file dir>/.status-write.lockdir/` — for snapshots the lockdir lands
-inside `workflows/<id>/`); for manual edits prefer the engine-check commands
+inside `workflows/<id>/`); when no engine writer is available, prefer the read-only engine-check commands
 (`mstar lease verify --workflow <id>`, `mstar worktree check`) over hand-rolled
-`flock`. The atomic-mkdir alternative (`.status-write.lockdir/` in the same
-directory as the file) remains the documented fallback. Do **not** invent a
-distributed CAS CLI.
+`flock`, and never substitute them for a mutation verb. The atomic-mkdir alternative (`.status-write.lockdir/` in the same
+directory as the file) remains the documented fallback for the whole-iteration
+route when no engine writer exists. Do **not** invent a distributed CAS CLI.
+
+**Scoped route (plan-scoped primary).** The lock is **available and required**
+here too — but it is **not sufficient**, and the atomic-mkdir / hand-rolled
+`flock` fallback above does **not** re-open a manual path on this route. The
+lock is acquired **inside** the `mstar plan …` state verbs, which replace every
+handwritten snapshot mutation:
+
+| Snapshot mutation | Scoped call（owns the lock） |
+| --- | --- |
+| execution claim / resume | `mstar plan bind` |
+| progress / residual rows | `mstar plan progress` / `residual-add` / `residual-close` |
+| plan finish（no ownership change） | `mstar plan handoff` |
+| ownership transfer | `mstar plan accept` / `return` |
+| integration attempt + atomic completion | `mstar plan integration-start` → Git merge → `integration-accept` → `complete` |
+| crash recovery | `mstar plan reconcile` |
+
+Holding this lock, or passing the **read-only** validators (`mstar lease
+verify` / `mstar worktree check` — still required), **does not** authorize a raw
+snapshot write, `--force`, a takeover, or a manual lease release. Scoped route
+details → **`plan-scoped-pm.md`**; field semantics → **`mstar-artifacts/references/status-and-residuals.md`**.
 
 **Cross-plan parallel hard gate:** Applies **whether or not** `Worktree mode: waived`.
 Lease-gated **cross-plan parallel** writable implement is allowed **only when**
@@ -153,9 +181,42 @@ mismatch → **STOP**.
 
 **跨 plan 默认**（**无论** `Worktree mode: waived`）：**不同 `plan_id` 可并行 implement** 须满足 §2.0 #5 跨 plan 并行安全闸——(a) coordination 路径 same-host 独占写锁可用且每次 status/协调变更持锁，或 (b) **`Plan parallelism: serial`**（waived 时默认），或 (c) 用户本轮 `Cross-host lease race: accepted` + audit `notes`；否则 Assignment 仍写并行 → **Blocked**。**merge 入 `spec_integration_branch` 仍串行**（snapshot 顶层 `integration_merge_lease`；waived 时无 merge lease 仍须串行 merge）。未 waive 时 **禁止**无 verified `execution_lease` 的跨 plan 可写派发。
 
-对每个本轮要推进的 active `plan_id`（可交错/并行，非强制 plan A 全 Done 再 plan B）：
+### Rescheduling checkpoint（主动调度检查点）
+
+Phase 2 缺的不是新调度器，而是一个**具名的重新评估时刻** —— `Rescheduling checkpoint` 就是它。本文件是 procedure 的**唯一 home**：**不**新增 scheduler / DAG / 第二 ready-state register，判断仍由 PM 按下列步骤做出，结果只落在 PM 正常 transcript / ledger。
+
+**五个冻结 reason**（checkpoint 触发词；OMP 侧 `mstar_phase2` checkpoint receipt 消费**同一词汇**，但只记录「已按本 procedure 评估」的事实 + decision/reason —— 它**不**推断依赖就绪、**不**选择派发；**禁止**自造同义词）：
+
+| reason | 触发时刻 |
+| --- | --- |
+| `before-wait` | 进入任何 wait **之前** |
+| `result-settled` | 结果落定后：子任务完成、review 返回，或消费已返回结果 |
+| `dependency-changed` | 依赖事实变化（例如已审 prerequisite 已进入 dependent 的 assigned base） |
+| `ownership-changed` | ownership 事实变化（lease claim / release / transfer、handoff / accept、作用域 holder 变化） |
+| `capacity-changed` | 容量事实变化（槽位因完成释放、primary 起停、可选 transport 可用性变化） |
+
+**决策步骤**（每次 checkpoint 按序执行）：
+
+1. **用户 steering 与真实 blocker 优先于**任何调度续行；已返回结果**只消费一次**并判定其 acceptance —— **禁止**把 job completion 当作 accepted work。
+2. **确定作用域**：iteration coordinator 同时考虑其**已准备的独立 plan** 与 plan 本地 task；scoped plan primary 只考虑**自己的 tasks**（`plan-scoped-pm.md`）。任一方都**不得**把自己提升为对方的权限。
+3. **排除不可派发项**：已派发 / 已有 owner / 已终结 / 未准备 / 契约已漂移 / 真依赖未满足。prerequisite 仅在**已审 / 已接受 commit 进入 dependent task 的 assigned base** 时才满足（`mstar-sdd` § Dependent-task readiness）。活动 Assignment 的 scope 与 `BASE_SHA` **不可变**；**仅未派发**工作可 re-split / 重排，且依赖 / 接口变化须在派发前写回。
+4. **对剩余有用工作套用约束**：当前用户 / plan 的 serial 策略、task 容量、plan-primary 容量、engine scope / revision / lease 校验、same-host 锁与 L1/L2 隔离（首段 §2.0 #5）。**成立的具体串行边**：共享文件 / session / ledger、缺集成接口；**不成立**：task 编号、无关的 QC / QA。
+5. **启动完整已授权 ready batch**：默认传输是**原生 background task** —— transport 被禁用 / 不可用**不**关闭 task 并发；已准备的独立 plan 可走条件性 primary transport。只有 coordinator 的 integration merge 串行。
+6. **没有有用且已授权动作 → native wait 一次**，并写下真实 wait reason：`dependency` / `ownership` / `capacity` / `user-blocked` / `no-ready-work`。
 
-1. **Claim / resume — execution lease**（§2.0 #5 未 waive）：按下方「Execution lease」claim/resume 规则——同 `holder` → resume（校验 `worktree_path` / `working_branch` 与 Assignment 一致）；异 `holder` → **Blocked**；`InProgress` 无 lease → **STOP** 升级（孤儿恢复 → **`mstar-artifacts`**）；verify 通过前 **禁止**可写派发
+**结果记录**：正常 PM transcript / ledger 的一行即可 —— checkpoint reason、考虑过的作用域、已派发 ID 或具体 wait / block reason。**禁止**：重复完成投递、tick 计数、「still waiting」报告、对**不变的空 ready 集合**反复自证或重跑同一推理、为保持忙碌而造工作、timer / 轮询循环。等待是合法结论 —— 同一组未变事实**只陈述一次**；只有新事实（显式用户消息、新的已接受结果、dependency / ownership / capacity 观察变化）才重新打开 checkpoint，「turn 结束」不是理由。
+
+**checkpoint 不放宽任何既有安全条件**：
+
+- 原生 background task 仍是默认 task 传输；额外 primary 是可选 plan 级工具，只受其自身配置 gate。
+- `ctx.isIdle()` 仅表示未在流式输出，**不**代表没有未落定的 task / bash / eval job 或 plan primary；native adaptive wait 与 completion delivery 仍由宿主控制，**禁止**自建轮询替代。
+- lease / revision / ownership 语义不变：**禁止**重复 owned / running / completed 工作、偷 lease、改活动 base；pane idle / age / 终端标签**不是** ownership 或完成依据（§ Execution lease · Hold, release, override）。
+- integration merge 入 `spec_integration_branch` 仍**串行**；跨 plan 并行仍受本节首段跨 plan 安全闸约束。
+- `execution_policy` 取值（如 `serial`）是 accepted-but-opaque：**禁止**描述为引擎强制的线性调度器；实际策略从当前用户 / plan 推导，并保留显式 serial 约束。
+
+对每个本轮要推进的 active `plan_id`（**可交错 / 并行**是默认读法：非强制 plan A 全 Done 再 plan B，plan 编号或 task 编号本身都不是串行理由）：
+
+1. **Claim / resume — execution lease**（§2.0 #5 未 waive）：按下方「Execution lease」claim/resume 规则——同 `holder` → resume（校验 `worktree_path` / `working_branch` 与 Assignment 一致）；异 `holder` → **Blocked**；`InProgress` 无 lease → **STOP** 升级（孤儿恢复 → **`mstar-artifacts`**）；verify 通过前 **禁止**可写派发。**Scoped route**：fresh claim 的唯一入口是 `mstar plan bind`（`--assignment` / `--workflow --plan`）——同 plan 的第二个 fresh 形态 → `coordination.duplicate-holder`；续接只经 `mstar plan bind --resume`，且为**只读校验**（不重新获取 ownership、不重启执行、不改 revision；无自动 attach / fallback plan / TTL 夺取）。
 2. **Plan start — feature worktree + branch**：创建/校验 dedicated feature worktree（默认 `<repoRoot>/.worktrees/<plan-id>-<slug>`）；Assignment 须含绝对 `Worktree path` + `Working branch`（与 lease 一致）。plan 内多可写并行轨 → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**
 3. **Implement → InReview**（产品编辑在 feature worktree；plans / snapshot / iterations / SDD 经 control root 绝对路径）：
    - **默认 `Execution mode: sdd`**（多 task plan；hotfix 可 `inline`）。
@@ -167,9 +228,18 @@ mismatch → **STOP**.
      5. Dispatch **one** task reviewer subagent（brief + report + diff + Global Constraints）
      6. Fix loop 直至 review clean；append `{SDD_DIR}/progress.md`；更新 snapshot plan 行 / plan checkbox
      7. 放行已满足依赖的 next task；不等待无依赖任务，PM 独占共享 progress / snapshot 写入
-   - 每次 Completion Report 后更新 snapshot（`workflows/<id>/snapshot.json`）+ 主 plan
-4. **QC → QA gate**（plan 保持 **`InReview`**；**保留** `execution_lease`）：per-plan 审查链 → **`mstar-sdd`**（L1–L2）+ **`mstar-review-qc/references/review-responsibility-boundaries.md`**（L3 tri / inline 单席；raw reports in `{SDD_DIR}/review/`，durable summary in main plan/snapshot）+ **`QA gate`**（`mandatory` → `qa-engineer`；`pm-acceptance` → PM checklist）。**禁止**在 integration merge 成功前设 `Done` 或删除 `execution_lease`。
-5. **Plan complete — serial merge back**（§2.0 #5 未 waive）：自 **integration worktree** claim/resume snapshot 顶层 `integration_merge_lease` → 将 plan feature branch 合并入 `spec_integration_branch`（仅 merge-lease holder；细则 → 下方「Integration merge lease」）→ 记录 merge commit 证据 → 释放 merge lease；**同轮**设 `Done` 并删除 `execution_lease`（此即 owner 的 lease 释放动作），并在**同一 locked update** 内把 `metadata.working_branch` / `metadata.worktree_path` 持久化到该 plan 行（归属生产者义务；语义唯一 home → `mstar-branch-worktree`「Worktree / branch cleanup」Ownership）。merge 失败：保持 `InReview` + 保留 lease，不得标 `Done`。merge 成功即打开该 plan 的**同轮 cleanup 资格**（timing lane 1 → 下方「Same-round plan cleanup」）。
+   - **整迭代路线**：每次 Completion Report 后更新 snapshot（`workflows/<id>/snapshot.json`）+ 主 plan。**Scoped route**：每次 Completion Report 后的 row 更新只经 `mstar plan progress --session <plan-session> --file <abs-json> --expect <revision>`（仅 `InProgress` / `InReview` / `Blocked` 子集；**禁止** `Todo` / `Done` / lease 删除）；leaf 与 plan 会话**不得**直接写 snapshot / 根 register。
+4. **QC → QA gate**（plan 保持 **`InReview`**；**保留** `execution_lease`）：per-plan 审查链 → **`mstar-sdd`**（L1–L2）+ **`mstar-review-qc/references/review-responsibility-boundaries.md`**（L3 tri / inline 单席；raw reports in `{SDD_DIR}/review/`，durable summary in main plan/snapshot）+ **`QA gate`**（`mandatory` → `qa-engineer`；`pm-acceptance` → PM checklist）。**禁止**在 integration merge 成功前设 `Done` 或删除 `execution_lease`。**Scoped route**：QA 证据齐备后的写点是 `mstar plan handoff --session <plan-session> --file <abs-json> --expect <revision>`，随后 **STOP**（row 保持 `InReview`、保留 lease）——`Done` 与 lease 释放不是 plan 会话的动作。
+5. **Plan complete — serial merge back**（§2.0 #5 未 waive；**整迭代路线**，语义未变 —— scoped route 见紧随其后的冻结序列，plan 会话不得执行本步骤）：自 **integration worktree** claim/resume snapshot 顶层 `integration_merge_lease` → 将 plan feature branch 合并入 `spec_integration_branch`（仅 merge-lease holder；细则 → 下方「Integration merge lease」）→ 记录 merge commit 证据 → 释放 merge lease；**同轮**设 `Done` 并删除 `execution_lease`（此即 owner 的 lease 释放动作），并在**同一 locked update** 内把 `metadata.working_branch` / `metadata.worktree_path` 持久化到该 plan 行（归属生产者义务；语义唯一 home → `mstar-branch-worktree`「Worktree / branch cleanup」Ownership）。merge 失败：保持 `InReview` + 保留 lease，不得标 `Done`。merge 成功即打开该 plan 的**同轮 cleanup 资格**（timing lane 1 → 下方「Same-round plan cleanup」）。
+
+   **Scoped route（冻结调用序列 — 取代上面的手工步骤；仅 coordinator 席位执行）**：
+
+   1. `mstar plan accept --session <coordinator-session> --plan <id> --handoff <id> --expect <revision>` — 所有权移交（`submitted → accepted`；**不是**合并验收，worktree/branch 不变）。
+   2. `mstar plan integration-start --session <coordinator-session> --plan <id> --handoff <id> --expect <revision>` — 在干净、检出 `snapshot.branch.integration` 的 integration checkout 上固定 `base_sha` + source pin，且**先于** Git；拒绝外来 merge lease。
+   3. **coordinator 显式执行唯一 Git 动作**（参数数组、字符串直传、不拼接 shell）：`git -C <integration-worktree-path> merge --no-ff --no-edit <pinned-source-sha>` — 无 squash / rebase / 按分支名合并；CLI 状态动词**从不**代跑 merge。
+   4. `mstar plan integration-accept …` → `mstar plan complete …` — 验证证据后**一次原子完成**：`status: Done`、保留 `metadata.working_branch` / `metadata.worktree_path` 与既有 track branches、删除该行 `execution_lease` **与** coordinator 的 `integration_merge_lease`。
+
+   **Plan 会话不执行以上任何一步**（`accept` / `integration-*` / `complete` 对 plan session 被拒绝）。失败恢复**只用** `mstar plan reconcile --session <coordinator-session> --plan <id> --handoff <id> --expect <revision>`：回退到 `accepted` + 释放本次 merge lease（`retry-ready`）／已具备唯一合并证据则补记证据并原子完成（`completed`，**不重复 merge**）；`integrating` 且存在 `MERGE_HEAD`、冲突或脏树 → `coordination.integration-unresolved`，全部状态与 lease 保留；无法证明的图 → `coordination.integration-diverged`。**禁止**传调用方成功标志、**禁止**重复 merge。
 6. **Cross-plan 进度同步**：更新 `{ITERATION_DIR}/<iteration-id>/delivery-compass.md` 的 `## Plans` 表状态列
 7. **Next plan / parallel wave** 从步骤 1 继续（可并行推进其他已 claim 的 plan；merge 仍排队串行）
 
@@ -189,7 +259,7 @@ mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--worktree
 
 - 先 dry-run 看 `verdict | kind | ref | reason`（merge 刚完成 → 该 Done 行 eligible）；`--apply` 才变更。lane 1 只清**本地面**（无 `--remote`；远端残留留给 Phase 6）。
 - 分支可能仍被该 Done-child worktree 检出 → apply 内部先移 worktree，再 re-probe / re-plan 删分支（**worktree 移除 ≠ 分支删除**；细则 → 契约本体）。
-- **lease 释放是手工 owner 动作、cleanup 范围外**：上方步骤 5 的 `Done` + `execution_lease` 删除就是 owner 释放动作；cleanup **从不**替 owner 释放任何 lease。standalone plan（无 integration）以 `branch.target` 为证据 base，且须**先 terminal close**。
+- **lease 释放不在 cleanup 范围内，scoped route 也没有手工释放动作**：scoped route 由 coordinator 的 `mstar plan complete` 在**一次原子写入**中同时删除该行 `execution_lease` 与 `integration_merge_lease`；整迭代路线仍是步骤 5 的 owner 同轮 `Done` + 删 lease（未变）。cleanup **从不**替 owner 释放任何 lease，也**不**依赖已删除的 lease 判断归属（归属由保留的行 `metadata.working_branch` / `metadata.worktree_path` 与 track Assignments 追溯）。standalone plan（无 integration）以 `branch.target` 为证据 base，且须**先 terminal close**。
 - **禁止**为让 cleanup 通过而推进/终结父迭代或改 snapshot 状态；受保护行保持 `refuse` 是正确行为，不是失败。
 
 ## 2.5 Dispatch-first（implement 派发约束）
@@ -212,7 +282,7 @@ Iteration Phase 2 附加：
 - PM **NEVER** 在 PM 线程实现产品代码（delegate dev；hotfix 例外见 **`mstar-phase-gates`**）
 - `Subagent invokes issued: 0` 而 Assignment 已写出 → **`dispatch incomplete`**；下一条补发 invoke，禁止 PM 顶替
 - QC 初轮：**SDD → N=3**；**inline → N=1**；plan QC tri 三席 **同条消息 N=3**（非 implement 轨数）
-- **`Findings cleanup: zero-residual`（默认）**：QC 后可修 Warning/Suggestion → 继续 fix→targeted re-review，直至 clean `Approve` 或仅剩真 blocker-defer（`critical` 不属 defer —— 定义 → **`mstar-artifacts`**「Findings cleanup modes」）；**禁止**把可修项登记为 open residual 草草 `Approve with residuals`
+- **`Findings cleanup: allow-residual`（默认）**：open R# 先登记 project register，且各决策面披露（清单 + severity + 跟踪位置；close 面另含 blocker-defer 标记），`Approve with residuals` 仅当无 unresolved `critical`；`zero-residual` 仍为显式 opt-in —— QC 后可修 Warning/Suggestion → fix→targeted re-review 直至 clean `Approve` 或仅剩真 blocker-defer（`critical` 不属 defer —— 定义与登记/披露职责 → **`mstar-artifacts`**「Findings cleanup modes」）
 
 ## Feature worktree (per plan)
 
@@ -251,18 +321,47 @@ Lives on the snapshot plan row — `{WORKFLOW_DIR}/<id>/snapshot.json` → `plan
 6. Re-read and verify `holder`, `worktree_path`, `working_branch` match before
    any writable dispatch.
 
+**Scoped route — fresh bind:** steps 1–6 are executed **inside** `mstar plan bind`
+(`--assignment` / `--workflow --plan`) under its own lock — no handwritten
+complete-file update and no hand-rolled atomic replace. A second **fresh** bind
+on a row already held → `coordination.duplicate-holder` (with the active holder,
+workflow and plan).
+
+**Scoped route — `--resume`:** `mstar plan bind --resume` is **read-only** and is
+the only continuation path for the original session: it validates the pinned
+binding (the current session plus lease `worktree_path` / `working_branch`) and
+continues — it never re-runs step 5, never re-acquires ownership, never restarts
+execution and never changes the row revision. It may report handed-off /
+accepted / completed context read-only, and a released lease is never
+reacquired. Cross-primary references are **absolute control-root paths**
+(`local://` is not a portable handoff address).
+
 ### Hold, release, override
 
 - Lease stays active across `InProgress` and `InReview` (including post-QC/QA
-  ready-to-merge) unless released or transferred.
+  ready-to-merge) unless released or transferred. **Scoped route:** a plan
+  session's normal exit is `mstar plan handoff` — it **keeps** the lease and the
+  row stays `InReview`; a lease is never dropped at handoff.
 - Normal release: re-read the control snapshot under write lock; confirm stored `holder` matches
   this session — mismatch → **Blocked**; then **delete** `execution_lease`
-  (never `null` or tombstone).
+  (never `null` or tombstone). **Scoped route:** there is **no standalone
+  release verb** — release happens only inside a state verb: `mstar plan accept`
+  / `return` (ownership transfer) or `mstar plan complete` (deletes
+  `execution_lease` **and** the coordinator's `integration_merge_lease` in one
+  atomic write).
 - `Done` authority deletes `execution_lease` in the same update as `status: "Done"`
   — **only after** successful integration merge (when lease gate not waived).
+  **Scoped route:** that authority is the coordinator's `mstar plan complete`
+  (after `integration-accept`, whose pinned verified Git result proves the
+  merge); the plan session **cannot** set `Done` or delete a lease.
 - Override of another holder requires **explicit user instruction this turn** +
   audit note on snapshot plan `notes` / `notes.jsonl` (prior holder, new holder/release, user authorized).
+  **Scoped route:** there is **no** `--force`, takeover, or automatic abandonment
+  flag; an abandoned active owner needs explicit human recovery outside these
+  commands.
 - V1: **manual release only** — no `expires_at`, TTL, or heartbeat authority.
+  **Scoped route:** no pane-state, idle, TTL, or terminal-label basis for
+  releasing or stealing a lease.
 
 ### Orphan `InProgress` without lease
 
@@ -312,6 +411,13 @@ Lives top-level on the snapshot — `{WORKFLOW_DIR}/<id>/snapshot.json`.
 6. On conflict/failure: retain leases; plan stays **`InReview`** — do not set
    `Done`. Release merge lease only after the integration worktree is clean and known state.
 
+**Scoped route:** steps 1–6 are the **coordinator's** `mstar plan
+integration-start` → explicit Git merge → `integration-accept` → `complete`
+(§2.4 step 5). `integration-start` pins `base_sha` + the source pin **before**
+Git runs and refuses a foreign merge lease; `reconcile` is the **only** recovery
+verb (never a caller-supplied success flag, never a second merge). A plan
+session can neither claim, resume, nor release this lease.
+
 Execution and merge leases may coexist; merge lease does not grant execution
 ownership for the source plan.
 
@@ -323,7 +429,7 @@ waives **only**:
 - Per-plan feature worktree defaults. The dedicated integration coordination
   checkout remains required; the primary checkout keeps its recorded branch
   and remains the process-SSOT holder via absolute control-root paths.
-- Snapshot lease claim/hold/release defaults (`plans[].execution_lease` and top-level `integration_merge_lease`)
+- Snapshot lease claim/hold/release defaults (`plans[].execution_lease` and top-level `integration_merge_lease`) — **scoped route 不可豁免**：该路线本就不做手工 lease 写入（只经 `mstar plan …`），waiver 也不解除其 CLI 前置（CLI 缺失 → fail closed）
 
 It does **not** waive the **cross-plan parallel safety gate**. Under waiver,
 cross-plan **parallel writable** implement still requires same-host exclusive

package/harness-skills/mstar-iteration/references/phase-3-iteration-close.md

@@ -31,7 +31,7 @@ PM 在迭代内全部 plan Done 后执行。**本 Phase 在 integration worktree
 **STOP**: 打印下方 checklist，且全部为 `[x]` 后，才可进入 §3.2 Compound。
 
 - [ ] 所有 compass 中登记的 plan 在 workflow snapshot（`{WORKFLOW_DIR}/<id>/snapshot.json`）均为 `Done`
-- [ ] 所有 plan 的 residual findings 已收口：优先 empty register 条目（`projects/<id>/residuals.json` → `entries[<plan-id>]`）；若仍有 open R#，须均为 Phase 2 `zero-residual` 允许的 blocker-defer + roadmap，或已 closed（`lifecycle` / `closed_at` / `closure_note`，见 `mstar-artifacts` Findings cleanup modes）
+- [ ] 所有 plan 的 residual findings 已按各自 Assignment `Findings cleanup` mode 收口：优先 empty register 条目（`projects/<id>/residuals.json` → `entries[<plan-id>]`）；`allow-residual` 下已登记且披露的非阻断 open R# 可保持 open，`zero-residual` 下仅允许 blocker-defer + roadmap，或已 closed（`lifecycle` / `closed_at` / `closure_note`）；任一 plan 有 unresolved `critical` → 不得通过本项（见 `mstar-artifacts` Findings cleanup modes）
 - [ ] compass `## Plans` 表状态列已与 snapshot 同步
 - [ ] 迭代 `## Acceptance Criteria` 已达成或显式豁免（compass 或对话记录原因）
 - [ ] compass shape 已满足（frontmatter + `## Roadmap Position` + close 占位节）
@@ -65,7 +65,7 @@ PM 批量触发后须：
 
 1. compass **YAML frontmatter**：`status: completed`，`end_date: YYYY-MM-DD`（必须；见 §3.0.5）
 2. 更新 `{ITERATION_DIR}/README.md` 索引中该迭代行 Status 为 `completed`
-3. 填充 compass `## Quality Gate Summary`、`## Compound Round Summary` 与 `## Iteration Retrospective (minimal)`（见模板）
+3. 填充 compass `## Quality Gate Summary`、`## Compound Round Summary` 与 `## Iteration Retrospective (minimal)`（见模板）；`## Quality Gate Summary` 须含 residual 披露 —— 每个 plan 的 open R# 清单（id + severity + 跟踪位置 + blocker-defer 标记；无 open 时写 `N/A — none open`；unresolved `critical` 仍阻断完成）
 
 ## 3.5 Close exit checklist + commit
 
@@ -76,7 +76,7 @@ PM 打印 **iteration-close exit checklist**；全部为 `[x]` 后方可 `git co
 - [ ] §3.1 前置 gate 已打印并满足
 - [ ] §3.2 compound 完成；**`<iteration-id>/` package 已盘点**（提升 / 保留 / 跳过已记入 Compound Summary）；新增 knowledge doc 均已登记 `{KNOWLEDGE_DIR}/README.md`（或已记录无可结晶原因）
 - [ ] §3.3 `## Roadmap Position` current iteration 已标 `delivered`；tracker / STRATEGY 已按需更新
-- [ ] §3.4 frontmatter `status: completed` + `end_date`；Quality Gate Summary + Compound Summary + Retrospective 已填
+- [ ] §3.4 frontmatter `status: completed` + `end_date`；Quality Gate Summary（含 open R# 披露：id + severity + 跟踪位置 + blocker-defer 标记；无 open 时 `N/A — none open`；unresolved `critical` 仍阻断）+ Compound Summary + Retrospective 已填
 - [ ] 当前分支是 `spec_integration_branch`
 - [ ] PR base = snapshot `branch.target`（`target_branch`，与 compass frontmatter 一致）；**不是**未记录的 `main`
 

package/harness-skills/mstar-iteration/references/phase-4-5-pr-delivery.md

@@ -9,8 +9,9 @@
 1. 打印 **`## Phase 4: PR delivery`**
 2. Resolve target：snapshot `branch.target`（`target_branch`；compass frontmatter 镜像）；缺失 → **STOP**，问用户
 3. 创建 PR：`spec_integration_branch` → `target_branch`
-4. 记录 PR URL / number（Phase 5 会话 SSOT）
-5. **Immediately** 进入 **Phase 5** — **Phase 4 exit ≠ 迭代交付完成**
+4. PR 正文须含 residual 披露节：本迭代各 plan 的 open R# 清单（id + severity + 跟踪位置 + blocker-defer 标记；无 open 时写 `N/A — none open`）—— 职责 → **`mstar-artifacts`**「Findings cleanup modes」
+5. 记录 PR URL / number（Phase 5 会话 SSOT）
+6. **Immediately** 进入 **Phase 5** — **Phase 4 exit ≠ 迭代交付完成**
 
 ---
 

package/harness-skills/mstar-iteration/references/phase-6-post-merge-close.md

@@ -20,6 +20,8 @@ mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date
 
 - 引擎 `closeWorkflow`：在 snapshot 写锁内**重读最新快照** → identity/shape 校验 → 已 valid terminal 则 no-op；否则要求全部 plan 行 `Done` 且**无任何** `execution_lease` / `integration_merge_lease` → 写 `completed` + `ended_at`
 - fail-loud：dangling lease / 非 `Done` 行 / snapshot 缺失或身份不符 → exit 1，**snapshot 字节不变**（无部分写）
+- **`type: plan` 交付证据 consult**：写终态**前** engine 咨询已注册 delivery kind 的证据（`consultDeliveryEvidence`）——`development` 缺 compound 处置 / PR 身份 / 已核实合并记录（或 PR 的 `head`/`target` 不等于注册的 `branch.source`/`branch.target`），或 `verification/report-only` 缺其完成策略的履行记录 → `PHASE6_DELIVERY_*` 拒绝，snapshot 保持 `running`、根条目保持注册（字节不变、可恢复）；补齐用 `mstar workflow evidence --workflow <id> --file <payload.json> [--session <path>]`（与 close 同一 coordinator-session 门、幂等；**PR 身份一次写入**，compound/merge 可覆写）。仅 `completed` close 咨询：`failed`/`stopped` 永不要求交付证据（§5）。write path 与 read-only `mstar iteration gate --phase 6` **共享同一实现**，两侧判定不走偏
+- **kind 在注册期显式声明**（§1/§4a）：`workflow register` / `audit promote --delivery-kind`（必填）/ `migrate --delivery-kind`（会产生 ACTIVE 无 kind plan 快照却缺 flag → exit 2；声明是**一个**交付身份，故一次 lift 若产生 2+ 个 ACTIVE standalone plan 同样以 exit 2 拒绝并列出 plan id —— 分批迁移，每批单 plan 声明）——绝不推断、绝不在代码内默认；`development` 需 `--branch-source`/`--branch-target`，`verification/report-only` 需 `--completion-policy`。历史遗留在 **ACTIVE** 无 kind 快照用 `mstar workflow evidence --workflow <id> --declare-kind <kind> [--branch-source <b> --branch-target <b> | --completion-policy <text>] [--session <path>]` 一次性修复（二次声明含同值一律拒绝、terminal 快照拒绝；supplied 锚只**填缺失**或与已注册锚同值复述，冲突值拒绝——已注册锚即交付身份，永不覆盖；legacy **terminal** 无 kind 死路按既有 owner amendment 路径）
 - **禁止**为通过 close 释放 lease —— lease release 是独立的 owner 动作，close 从不释放（甚至 caller 自己的）
 - `--ended-at` 省略时由 CLI 提供当天时间戳；引擎不接受自身时钟读数
 
@@ -39,7 +41,7 @@ mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date
 2. compass `## Plans` + `{ITERATION_DIR}/README.md` 索引
 3. project roadmap / register
 
-- **禁止**伪造 `Done` 行、**禁止**为对齐而 close open residual —— 真实 remaining finding 阻塞 zero-residual 交付，而不是被静默关闭；reconciliation **不发明** Done/closed
+- **禁止**伪造 `Done` 行、**禁止**为对齐而 close open residual —— reconciliation **不发明** Done/closed，也不为对齐关闭条目或放宽 `zero-residual` 规则；`allow-residual` 下已登记且披露的非阻断 open R# **保持 open**，不随 lifecycle 终结而“随之关闭”（真实 remaining finding 阻塞 `zero-residual` 交付，而不是被静默关闭）
 - **禁止**把新 tracked 产品/文档 commit 夹带进 Phase 6 —— 新发现的产品修复另开授权 workflow
 
 ## §6.4 Cleanup handoff（最后一步；显式、不自动）
@@ -51,12 +53,13 @@ mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date
 - **lease 释放是手工 owner 动作、cleanup 范围外**：§6.1 close 已拒绝 dangling lease，但 cleanup 仍**从不**替 owner 释放——残留 lease 的候选只会得到 `cleanup.refuse.active-lease`；先手工释放，再重跑 dry-run/apply
 - squash-merged 分支（tip 非 base 祖先）→ STOP → residual；禁止 `git branch -D`
 
-Phase-6 gate 只查**本地 state**（valid terminal shape + 无 dangling lease + root 条目已注销），**不**验证远端 merged 证据，**不**检查物理清理是否完成。
+Phase-6 gate 只查**本地 state**（valid terminal shape + 无 dangling lease + root 条目已注销 + `type: plan` 交付证据，§6.1），**不**验证远端 merged 证据，**不**检查物理清理是否完成。
 
 > **Engine check (when available):** run `mstar iteration gate --phase 6 --workflow <id>` (or `import { evaluatePostMergeClose } from "@mstar-harness/engine"` in a host hook) to gate the local post-merge close state（valid terminal shape + 无 dangling lease + root 条目已注销；稳定码 `PHASE6_*`；invalid/unreadable root 不是条目已注销的证明）. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 
 ## Standalone plans & abandonment
 
+- 独立 plan 交付生命周期的语义权威（注册 → 交付尾段 → verified merge → terminal close）→ 冻结契约 `mstar-artifacts/references/plan-workflow-lifecycle-contract.md`；本节仅固定 close 侧契约（同一命令 close、本地 gate 不验证远端 merged 证据）
 - `type: plan` 独立 lifecycle 在其 PR merge 后用**同一** completed-close 命令关闭（无第二 verb、无 `--outcome` / `--force`）
 - abandoned lifecycle **不得**静默跑 completed close：已 terminal（`failed` / `stopped`）的 snapshot 保持原状态，CLI 如实报告实际 status；completed close 只属于 verified-merged 完成
 

package/harness-skills/mstar-iteration/references/plan-scoped-pm.md

@@ -0,0 +1,181 @@
+# Plan-scoped primary PM (scoped `iteration-drive` route)
+
+**Single home for the scoped route.** This file owns: accepted addressing forms, scoped boot, the plan-local driving loop, the scoped stop, and the coordinator command sequence. It does **not** own field/schema tables, executable flag syntax, or Assignment header templates.
+
+- Command frontmatter/argument surface → **`commands/iteration-drive.md`**
+- Executable flags, exit codes, JSON envelopes → **`docs/cli.md`**（CLI owner）
+- `coordination` / session / handoff / revision fields and row/register ownership → **`mstar-artifacts/references/status-and-residuals.md`**（sole runtime schema home）
+- Portable primary Assignment header → **`mstar-roles/references/project-manager/dispatch-and-assignment.md`**
+- Dispatch mechanics, isolation gates → **`mstar-dispatch-gates`**, **`mstar-sdd`**, **`mstar-branch-worktree`**
+
+No command aliases and no second vocabulary for the operations below.
+
+## 0. Route selection (before any whole-iteration boot)
+
+| Invocation | Route |
+|---|---|
+| `/iteration-drive`（**no args**） | unchanged whole-iteration boot and Phase 2 → 3 → 4 → 5 → 6 route（`commands/iteration-drive.md`） |
+| `/iteration-drive --assignment <abs.md>` \| `--workflow <id> --plan <id>` \| `--resume <abs-session.json>` | **this file** — scoped primary route |
+| any other nonempty argument shape | **fail closed before boot and before claim**; never broaden to the whole-iteration route |
+
+Scoped boot does **not** load `mstar-compound` or the Phase 3–6 detail files merely because whole-iteration boot does. A leaf executor that finds this command in its own Assignment is refused by the role boundary (`mstar-dispatch-gates`), never promoted to PM.
+
+## 1. Addressing forms (strict parse)
+
+```text
+/iteration-drive --assignment <absolute-md-path>
+/iteration-drive --workflow <id> --plan <id>
+/iteration-drive --resume <absolute-session-json-path>
+```
+
+- The first two are **fresh** addressing forms; the third explicitly **resumes** an already bound session.
+- Fail **before any bind** on: duplicate flags, unknown flags, positional arguments, missing/blank values, mixed forms, partial `--workflow`/`--plan` pairs, and any path that is not absolute.
+- Rejection is terminal for the turn: report the malformed form and the accepted forms. There is no fallback plan, no "first unfinished row", and no whole-iteration fallback.
+- Both fresh forms resolve the **same** registered Assignment: `--workflow/--plan` reads `row.coordination.prepared.assignment_path`; it never selects the first unfinished row.
+
+## 2. Scoped boot
+
+1. **Load PM identity in the current primary session**: `mstar-harness-core` → `mstar-roles` → `references/project-manager.md`. No PM subagent is spawned or dispatched for any address form — PM runs in the **primary session** on every host（rule home → `mstar-roles/references/project-manager.md` § Plan-scoped authority；omp dispatch surface → `mstar-host/references/omp.md` § C5）.
+2. **Bind once**, matching the form exactly:
+
+   ```bash
+   mstar plan bind --assignment <absolute-md-path> [--json]
+   mstar plan bind --workflow <id> --plan <id> [--harness <absolute-path>] [--json]
+   mstar plan bind --resume <absolute-session-json-path> [--json]
+   mstar plan bind --coordinator --workflow <id> [--harness <absolute-path>] [--json]   # coordinator seat only
+   ```
+
+   `bind` is the only operation without an external `--expect`: it reads, checks and claims atomically against current ownership. Fresh coordinator bind initializes the workflow's coordinator only when absent; a second fresh coordinator fails exactly like a duplicate plan holder. Plan fresh bind requires a row that was **prepared** by the coordinator.
+3. **Re-read with `show` and constrain the session to the returned scope**:
+
+   ```bash
+   mstar plan show --session <plan-session.json> [--json]
+   mstar plan show --session <coordinator-session.json> --plan <id> [--json]
+   ```
+
+   `show` returns the selected row, resolved scoped paths, `allowed_operations`, snapshot byte version and project-register byte version, and `revision`. It never returns an editable sibling snapshot. A plan session passes no `--plan`; a coordinator session requires it.
+4. **Constrain everything that follows to that scope**: loaded skills, dispatched child inputs, session backlog, goal text, session todos, STOP conditions, and every writable path.
+5. **Stale input stops.** If a later `show` reports the Assignment hash changed, the session/scope/holder no longer matches, or the revision is behind, stop and report — do not re-bind silently and do not fall back to generic iteration drive.
+
+## 3. Scope boundary (writable surface)
+
+A scoped actor writes **only its own row and its registered project residual bucket**. Concretely:
+
+| Permitted | Forbidden |
+|---|---|
+| row `coordination.*`（`prepared` / `progress` / `handoff`）, row `status`, row `revision`, retained `metadata.working_branch` / `metadata.worktree_path` / `metadata.track_branches` | sibling rows, lifecycle anchors, snapshot `branch` / `integration_worktree_path` / `execution_policy`, `compass_ref` |
+| `entries[<planId>]` in `projects/<project-id>/residuals.json` via `residual-add` / `residual-close` | other register buckets, the v2 root `status.json` register, shared indexes (`{KNOWLEDGE_DIR}` / `{ITERATION_DIR}`), iteration PR, Phase 3–6 |
+| `progress` / `residual-add` / `residual-close` / `handoff`（plan session） | any raw `writeWorkflowSnapshot` / direct snapshot or register edit, `--force`, arbitrary holder input, takeover, a lease-release verb |
+
+Field semantics, ownership and lock rules → **`mstar-artifacts/references/status-and-residuals.md`**（「Plan coordination」）.
+
+## 4. Plan-local driving
+
+Drive the bound plan with the **existing** SDD / gate machinery; scope is inherited by every child input.
+
+1. **Prepare gate**: the coordinator prepared this row (`mstar plan prepare`, §6). A plan session never prepares itself.
+2. **Implement**: `mstar sdd workspace` → `mstar sdd task-brief` → dispatch implementers → fresh L2 task reviewer（`mstar-sdd` § Per-task loop）. `Execution mode: sdd` stays the default for multi-task plans.
+3. **Plan QC tri**: after all tasks, branch `review-package` → **N=3** tri-review（`mstar-review-qc`, `mstar-dispatch-gates`）; then the `QA gate` from the Assignment (`mandatory` → `qa-engineer`; `pm-acceptance` → PM acceptance artifact).
+4. **Progress**（row status + summary + evidence paths）:
+
+   ```bash
+   mstar plan progress --session <plan-session> --file <absolute-json-path> --expect <revision> [--json]
+   ```
+
+   Allowed transitions: `InProgress` → `InProgress|InReview|Blocked`; `Blocked` → `Blocked|InProgress`; `InReview` → `InReview|InProgress|Blocked` **before handoff**. Never `Todo`/`Done`, never lease removal.
+5. **Residuals**（findings cleanup mode from the Assignment）:
+
+   ```bash
+   mstar plan residual-add   --session <plan-session> --file <absolute-json-path> --expect <revision> --expect-register <version> [--json]
+   mstar plan residual-close --session <plan-session> --entry <id> --note <text> --expect <revision> --expect-register <version> [--json]
+   ```
+
+   Register ownership, entry provenance and the fail-loud validation handoff → **`mstar-artifacts/references/status-and-residuals.md`**.
+
+**Backlog / goals / todos / STOP are plan-local**: the session backlog is this plan's tasks; goal text covers **this plan's** flow only（`mstar-host` § `/goal` directive）; todos are the plan's task list, and no global phase entry（Phase 3/PR/compound）is seeded; the STOP is the handoff in §5, not plan `Done`.
+
+## 5. Finish = durable handoff（not `Done`）
+
+When QC/QA evidence is complete and no child writer is active:
+
+```bash
+mstar plan handoff --session <plan-session> --file <absolute-json-path> --expect <revision> [--json]
+```
+
+- Requires row `InReview`, no active child writes, a clean feature worktree, `review_head === source_sha === feature branch HEAD === feature worktree HEAD`, and the QC/QA evidence pins.
+- The handoff record is immutable; the plan keeps its `execution_lease` and stays **`InReview`**.
+- **Then STOP the scoped session.** Handoff is the scoped finish line. Do **not** set `Done`, do **not** delete `execution_lease`, do **not** open Phase 3 / PR, do **not** run compound, and do **not** treat "last unfinished plan" as an exception that advances the iteration.
+- A user asking to mark `Done` before integration is rejected: `Done` + lease release is the coordinator's atomic completion after a verified merge（§6）.
+- After handoff, further `progress` / `residual-*` mutations are rejected by the engine until a coordinator `return`; the session reports the handoff id and waits.
+
+## 6. Coordinator sequence（one coordinator seat per workflow）
+
+```bash
+mstar plan prepare           --session <coordinator-session> --plan <id> --assignment <absolute-md-path> --expect <revision> [--json]
+mstar plan accept            --session <coordinator-session> --plan <id> --handoff <id> --expect <revision> [--json]
+mstar plan return            --session <coordinator-session> --plan <id> --handoff <id> --reason <text> --expect <revision> [--json]
+mstar plan integration-start --session <coordinator-session> --plan <id> --handoff <id> --expect <revision> [--json]
+mstar plan integration-accept --session <coordinator-session> --plan <id> --handoff <id> --expect <revision> [--json]
+mstar plan complete          --session <coordinator-session> --plan <id> --handoff <id> --expect <revision> [--json]
+mstar plan reconcile         --session <coordinator-session> --plan <id> --handoff <id> --expect <revision> [--json]
+```
+
+1. **`prepare`** registers the reviewed Assignment on a `Todo`/`Blocked` row after checking path, branch, status and lock inputs and after dependency readiness. It is preparation, not a second business plan; dependency and task-readiness judgment stays PM's.
+2. **`accept`** is ownership transfer, not integration acceptance: `submitted → accepted`, `execution_lease.holder` moves to the coordinator while worktree/branch stay. No merge, no `Done`.
+3. **`return`** restores the original plan session as execution holder, sets `InProgress` and records the reason. It cannot return an un-reconciled integrating/merged/completed record: abort the Git merge, `reconcile` to `retry-ready`, then `return`.
+4. **`integration-start`** reads the clean recorded integration checkout on `snapshot.branch.integration`, refuses any foreign merge lease, and pins the integration HEAD as `base_sha` plus the source pin — all **before** Git runs. Retrying a started attempt is a no-op after a revision refresh; `base_sha` never moves.
+5. **Git merge is the coordinator's own explicit action**, the only Git mutation in this flow:
+
+   ```bash
+   git -C <integration-worktree-path> merge --no-ff --no-edit <pinned-source-sha>
+   ```
+
+   Argument-array invocation, never shell interpolation; no squash, no rebase, no moving branch-name merge. CLI state verbs never execute this merge.
+6. **`integration-accept`** records the observed verified result（`integrating → merged`）and keeps both leases and `InReview`. Then **`complete`** performs the single atomic completion: verified Git proof + evidence + findings gate → `status: Done`, retain `metadata.working_branch` / `metadata.worktree_path` / existing track branches, and delete the row `execution_lease` **and** the coordinator's `integration_merge_lease` in **one** snapshot write.
+7. **Crash recovery uses `reconcile` only** — never a caller-supplied success flag and never a second merge:
+
+   | Observed state | `reconcile` result |
+   |---|---|
+   | `integrating`; HEAD == base; clean; source not yet an ancestor | back to `accepted`, drop the attempt + this holder's merge lease, keep coordinator execution lease and `InReview`; outcome `retry-ready` |
+   | `integrating` or `merged`; source already ancestor, or unique exact merge proof is an ancestor of HEAD | record proof, apply the atomic completion; outcome `completed`; no duplicate merge |
+   | `integrating`; `MERGE_HEAD` / conflicts / dirty checkout | refuse `coordination.integration-unresolved`; all state and leases preserved; resolve or explicitly abort Git, then re-run |
+   | moved/missing branch, unexpected parent graph, multiple matching results, changed evidence | refuse `coordination.integration-diverged` / `coordination.evidence-stale`; no `Done`, no lease release |
+   | `completed`; proof still valid | read-only no-op `already-completed` |
+
+8. The coordinator — not the plan session — retains dependency release, compass / index / root projections, the iteration PR, and Phase 3–6.
+
+## 7. Revision protocol（`--expect`）
+
+- `--expect` is the nonnegative row `coordination.revision` from `show`（absent coordination = 0）— **not** the snapshot `schema_version` or a date.
+- Every mutating row verb requires it. A sibling row's mutation does not change this row's revision; same-row stale input fails `coordination.version-conflict`.
+- After any successful changed row mutation the revision increments **once**; a no-op replay does not increment it. The precondition is still checked on replay, so a stale retry first refreshes with `show`.
+- `bind` is the only exception（§2）. Document/register byte versions are separate CAS values（`--expect-register`, `--expect-version`）and never substitute for the row revision.
+
+## 8. Sessions and credentials
+
+- Fresh claims allocate a new session UUID; a holder is never derived from a plan id, Assignment path, PID or terminal label. Assignment identity is not session identity.
+- Session envelopes are credentials/pointers, not a second process-SSOT copy. **Never pass a session path — coordinator or plan — into a child Assignment or child invocation.** Children receive the plan's `Worktree path`, `Working branch`, `Plan Path`, `SDD dir` and task-specific brief/report/diff paths only（`mstar-sdd/references/file-handoffs.md`）.
+- `--resume` validates the current session and lease and may report handed-off / accepted / completed context read-only. It never reacquires a released lease, never restarts execution, and never attaches to an active foreign holder automatically.
+- A duplicate fresh entry for the same plan — by **either** address — fails with code `coordination.duplicate-holder` plus the active holder, workflow and plan. Only explicit `--resume` of the original session continues；no automatic attach, fallback plan, TTL/idle/pane-state theft.
+- Cross-primary references are readable **absolute control-root filesystem paths**；`local://` is not a portable handoff address.
+- Lost credentials or an abandoned active owner need explicit human recovery outside these commands. No `--force`, takeover or automatic abandonment flag exists.
+
+## 9. Evidence, STOP and failures
+
+- Session todos and the final report stay **plan-scoped**: scoped checks / before-after pressure traces and the plan's own gates. Never claim whole-iteration evidence.
+- STOP conditions: handoff submitted（§5）, invalid input（§1）, stale scope/revision（§2/§7）, duplicate holder（§8）, un-reconciled Git（§6.7）, or a blocked dependency. Report the code, the holder, and the exact next command.
+- Failures are reported from the CLI envelope（`ok:false` + `code`）, never invented: exit 2 = invalid input shape, exit 1 = scope / ownership / revision / state / Git / path / lock rejection.
+
+## 10. Missing CLI = fail closed
+
+The scoped route **requires** `mstar plan …`. Without it（engine/CLI absent or older than this contract）:
+
+- **Fail closed with install/upgrade guidance**（name `mstar plan` and the required version or feature）.
+- **Never** substitute raw snapshot/register edits, a prompt-only manual protocol, or the engine-absent legacy fallback for the scoped feature. `mstar-engine-legacy` does not provide it.
+- Unscoped no-argument `iteration-drive` behavior is unchanged in that environment.
+
+## 11. Transport（optional）
+
+Herdr / tmux (or any multiplexer) is only a way to open a terminal. It is **not** a prerequisite, dependency, ownership signal or session identity. Nothing in this route reads pane state, TTL or terminal labels to decide ownership.
+
+On **omp** only, the optional skill-driven extra-primary launch protocol — native `phase2PlanInstances` opt-in, the `mstar_phase2` bind/checkpoint/reserve/record calls, non-focus pane creation at the prepared worktree, the absolute `--assignment` submission and terminal uncertainty handling — is documented in **`mstar-host` → `references/omp.md` § Phase-2 plan instances**. It is optional there too and adds no load-order dependency here.

package/harness-skills/mstar-phase-gates/SKILL.md

@@ -23,11 +23,12 @@ description: "Morning Star Spec-Driven 双阶段门禁：Prepare（`specify →
   - **意图门禁**：锁 plan 前须能书面写清**真实目标 / 成功判据 / 非目标**三项；否则 Prepare 未通过。
   - **长期方案优先**：默认先设计目标状态，再裁剪本轮可交付切片；不得以“临时方案 / 混合方案 / 以后再说”替代目标设计。
   - **Durable Roadmap Gate**：若本轮只做部分范围，plan 必须写明 roadmap（批次、依赖、暂缓项、owner/触发条件、最终完成定义）。只有一句“后续再做 / next plan”视为未通过 plan gate。
+  - **Recall receipt（锁 plan 前）**：记录相关 knowledge/research 输入——复用与被否决策一并注明；无适用输入时**如实记空**。不做全库扫描、不发明知识；收据缺失不进入 plan lock。语义 → `mstar-artifacts/references/plan-workflow-lifecycle-contract.md`。
 
 ### B. Execute：`plan(locked) → tasks → implement`
 
 - **`plan(locked)`** — 冻结基线；实现中出现新约束时**先回写 plan 再继续**。
-- **`tasks`** — 含依赖顺序、并行标记、完成判据；每任务可追踪到 plan、roadmap 批次与验收标准。
+- **`tasks`** — 含依赖顺序、并行标记、完成判据；每任务可追踪到 plan、roadmap 批次与验收标准。每任务还须满足单轮容量判据（声明 Effort band、单轮闭合其 Files 与验证门、写明 split point）→ **`mstar-artifacts/references/plan-quality-bar.md`** item 7（Task shape / session fit）。
   - **并行标签**：≥2 条实现轨同时分派 → `Dispatch mode: parallel independent tracks`；同仓可写并发 → `Worktree isolation: required`（清单 **`mstar-branch-worktree`** → **`references/parallel-writable-pre-dispatch.md`**）。
 - **`implement`** — 按 tasks 顺序执行；多 task plan **默认** `Execution mode: sdd`（`mstar-sdd`）；hotfix 可 `inline`。完成进入 `InReview`；遵循 **`mstar-coding-behavior`**。
 
@@ -49,10 +50,10 @@ description: "Morning Star Spec-Driven 双阶段门禁：Prepare（`specify →
 
 - **`plan locked`**
   - 最小动作：在 plan 或 notes 记录当前锁定版本（日期或 hash）。
-  - **Plan 质量门**（新 plan / 大改）：无 placeholder（`...`、`TBD`、`etc.`）；含 **Global Constraints** 与 per-task **Interfaces**；PM self-review 三问（每 task 可独立验证？依赖顺序清晰？无隐含假设？）— 见 `mstar-artifacts/templates/plan.main.md` + **`mstar-artifacts/references/plan-quality-bar.md`**（自包含/验证门/STOP 条件/drift check/done criteria）。
+  - **Plan 质量门**（新 plan / 大改）：无 placeholder（`...`、`TBD`、`etc.`）；含 **Global Constraints** 与 per-task **Interfaces**；PM self-review 四问（每 task 可独立验证？依赖顺序清晰？无隐含假设？每 task 可单轮闭合其 Files 与验证门 — Task shape / session fit？→ **`mstar-artifacts/references/plan-quality-bar.md`** item 7）— 见 `mstar-artifacts/templates/plan.main.md` + **`mstar-artifacts/references/plan-quality-bar.md`**（自包含/验证门/STOP 条件/drift check/done criteria）。
 - **`implement`**
   - 最小产物：实现 diff、自检证据、回报与 handoff；行为准则 → **`mstar-coding-behavior`**；编辑纪律 → 上文「可验证编辑与上下文纪律」。
-  - **知识库 / 迭代 compass**：**默认**开工前扫 `{KNOWLEDGE_DIR}/README.md` 索引（若存在）并阅读与当轮相关的 **Active** 行（**即使 metadata 无 knowledge 链接**）；若 `plans[].metadata` 登记了 `primary_spec` / `spec_refs` / `iteration_compass` / `iteration_refs`，所链接文档**仍须**阅读；两类阅读均须在回报中说明已对齐 → **`mstar-conventions`** · **`mstar-artifacts/references/knowledge-and-designs.md`**。
+  - **知识库 / 迭代 compass**：**默认**开工前扫 `{KNOWLEDGE_DIR}/README.md` 索引（若存在）并阅读与当轮相关的 **Active** 行（**即使 metadata 无 knowledge 链接**）；若 `plans[].metadata` 登记了 `primary_spec` / `spec_refs` / `iteration_compass` / `iteration_refs`，所链接文档**仍须**阅读；两类阅读均须在回报中说明已对齐 → **`mstar-conventions`** · **`mstar-artifacts/references/knowledge-and-designs.md`**。该 implement 时阅读是输入变化时的 re-alignment，不替代 Prepare 的锁前 recall receipt（见上文 Prepare `plan` 节）。
 
 ## 角色职责
 
@@ -72,7 +73,7 @@ per-plan 门禁通过后，PM 在**迭代层面**管理以下活动（不计入
 - **迭代驱动**（`mstar-iteration` § Phase 2 Autonomous Execute）：per-plan 派发循环（分支→实现→QC→**QA gate**→Done→合并），跨 plan 进度追踪，更新 compass 中各 plan 状态。
 - **迭代收口**（`mstar-iteration` § Phase 3 iteration-close）：迭代内所有 plan Done 后，执行一轮知识结晶（`mstar-compound`）沉淀迭代经验，更新 roadmap，标记迭代完成。
 
-per-plan Done 是 per-plan 的闭环终点；compound 是迭代级收口活动，不影响 per-plan 状态判定。
+per-plan Done 是 per-plan 的闭环终点；compound 是迭代级收口活动，不影响 per-plan 状态判定。此句不否定独立交付 plan 的 disposition 义务——它在交付 PR head 定稿前运行（迭代内 plan 行不各自触发）；语义权威 → `mstar-artifacts/references/plan-workflow-lifecycle-contract.md`。
 
 > **Engine check (when available):** run `mstar iteration gate --workflow <id> --compass <delivery-compass.md>` (or `import { evaluatePhaseGate } from "@mstar-harness/engine"` in a host hook) to evaluate the iteration phase-transition gate (Phase 2 → 3 → 4) against the workflow snapshot when iteration-level activities above are reached — per-plan Prepare/Execute gate judgment stays prompt. On `fail` (gate-blocking violations) -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 
@@ -93,10 +94,11 @@ per-plan Done 是 per-plan 的闭环终点；compound 是迭代级收口活动
 8. Assignment 是否含 **`Task category`**（实现类任务）并与 Owner 一致？
 9. 若中途出现 plan drift，是否先回写再继续？
 10. 实现说明中是否体现"最小耐久切片 + 手术式改动 + 可验证检查"？
+11. 每个任务是否满足容量判据：声明 Effort band、单轮闭合其 Files 与验证门、写明 split point（Task shape / session fit → `mstar-artifacts/references/plan-quality-bar.md` item 7）？
 
 **任一项为「否」时，`Gate decision` 必须是 `blocked`**。
 
-> 迭代级活动（compound / iteration-close）见 `mstar-iteration`；不属于 per-plan gate 判定项。
+> 迭代级活动（compound / iteration-close）见 `mstar-iteration`；不属于 per-plan gate 判定项。独立交付 plan 的 compound disposition 属交付尾段义务（PR head 定稿前），见 `mstar-harness-core`「最小交付循环」。
 
 ## Hotfix 例外
 

package/harness-skills/mstar-project-governance/SKILL.md

@@ -88,9 +88,9 @@ Register 文档形状（`entries[<plan-id>]` 数组 JSON）、**9 个必填字
 
 ### Findings cleanup（与 Assignment 联动）
 
-- Assignment **`Findings cleanup: zero-residual | allow-residual`** 是唯一 mode 来源（`metadata.findings_cleanup` mirror 已删）；迭代 Phase 2 默认 `zero-residual`。
-- `zero-residual`：可修 findings 当轮 fix → re-review 清干净；仅真 blocker 可 defer 且须 Durable Roadmap + `target`（`critical` 不属 defer —— 定义 → **`mstar-artifacts`**「Findings cleanup modes」）；`nit` 必须当场修或删；waived/risk-accepted 必须关闭，不得留 open。
-- `allow-residual`：仅 unresolved **critical** 阻止 Approve。
+- Assignment **`Findings cleanup: zero-residual | allow-residual`** 是唯一 mode 来源（`metadata.findings_cleanup` mirror 已删）；迭代 Phase 2 默认 `allow-residual`。
+- `allow-residual`（默认）：仅 unresolved **critical** 阻止 Approve；open R# 须在离 InReview 前登记 project register，且各决策面披露（id + severity + 跟踪位置；close 面另含 blocker-defer 标记）—— 登记与披露职责 → **`mstar-artifacts`**「Findings cleanup modes」。
+- `zero-residual`（显式 opt-in）：可修 findings 当轮 fix → re-review 清干净；仅真 blocker 可 defer 且须 Durable Roadmap + `target`（`critical` 不属 defer —— 定义 → **`mstar-artifacts`**「Findings cleanup modes」）；`nit` 必须当场修或删；waived/risk-accepted 必须关闭，不得留 open。
 - mode 全文与 enforcement → **`mstar-artifacts`** `references/status-and-residuals.md`（「Findings cleanup modes」+ 其 engine check）。
 
 ## Workflow