@mstar-harness/opencode 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the `@mstar-harness/opencode` package are documented in t
 
 The monorepo root [CHANGELOG.md](../../CHANGELOG.md) summarizes cross-surface releases.
 
+## 1.5.0
+
+- Version alignment with harness **1.5.0** (bundled skills/commands: iteration Phase 2 worktree/lease + Phase 5 babysit-first helpers).
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **1.5.0**.
+
 ## 1.4.0
 
 - Version alignment with harness **1.4.0** (Kimi Code host support lives in shared skills / `.kimi-plugin`; OpenCode package unchanged beyond version bump).

package/harness-commands/iteration-drive.md

@@ -1,6 +1,6 @@
 ---
 name: iteration-drive
-description: Drive the active iteration to completion — Phase 2 Autonomous Execute, Phase 3 iteration-close, Phase 4 Create PR, Phase 5 PR merge-ready loop (greploop / babysit / CI fallback) until mergeable. Not Done until Phase 5 exit checklist passes.
+description: Drive the active iteration to completion — Phase 2 Autonomous Execute, Phase 3 iteration-close, Phase 4 Create PR, Phase 5 PR merge-ready loop (prefer babysit/*-babysit; optional greploop when repo has it; else CI fallback) until mergeable. Not Done until Phase 5 exit checklist passes.
 agent: project-manager
 ---
 
@@ -32,9 +32,9 @@ Phase 2: Autonomous Execute  →  Phase 3: iteration-close  →  Phase 4: Create
 | 禁止 | 必须 |
 |------|------|
 | plan / task / phase 边界问用户「是否继续」「要不要现在启动」「是否开 PR」等例行 yes/no | 进度摘要后**下一条动作** = **dispatch**（`Task`）或下一 phase 步骤（打印 checklist → 执行） |
-| 用完整 Phase 2 汇报收束 turn 后等待用户 | 同 plan 内 task 间 → **`mstar-sdd` Continuous execution**；当前 plan Done 后 → **立刻**下一 plan dispatch |
+| 用完整 Phase 2 汇报收束 turn 后等待用户 | 同 plan 内 task 间 → **`mstar-sdd` Continuous execution**；其他 plan 可 **lease 门控并行** implement；merge 仍串行 |
 | 把 `## Phase 3/4/5` 标题当作可停下协商点（除合法 STOP） | Phase 3 checklist `[x]` → **立刻** Phase 4；PR 创建后 → **立刻** Phase 5 loop |
-| 跨 plan **并行** implement dispatch（多 plan 同时跑 implementer） | Per-plan **串行**：plan A implement→QC→QA→Done 后再 plan B（除非用户书面 override） |
+| 跨 plan **无 lease** 并行 implement | **默认 lease 门控并行**（distinct `execution_lease` + feature worktree）；显式 `Plan parallelism: serial` 可恢复逐 plan 串行 |
 
 **合法 STOP（仅此升级用户）**：
 
@@ -79,12 +79,13 @@ SSOT 细化：`mstar-sdd`（task 级）· `mstar-iteration` §2.6（push 纪律
 6. **`mstar-sdd`** — **before first implement dispatch** in Phase 2（per-task loop SSOT；多 task plan 默认 `Execution mode: sdd`）
 7. `mstar-review-qc` — before first QC dispatch in Phase 2
 8. `mstar-plan-artifacts`, `mstar-plan-conventions`, `mstar-branch-worktree`
+9. **`mstar-iteration/references/phase-2-worktree-lease.md`** — Phase 2 control worktree、`execution_lease`、serial `integration_merge_lease`（§2.0 #5 未 waive）
 
 ## Phase 2: Autonomous Execute
 
 **Continuous execution applies** — 本节全程遵守上节 **Continuous execution（HARD）**；Completion Report / 进度同步后不得 check-in，下一条必须是 dispatch 或下一 plan。
 
-**Branch policy first** — before any plan dispatch（`mstar-iteration` §2.3）:
+**Branch policy + control worktree first** — before any plan dispatch（`mstar-iteration` §2.3 + **`references/phase-2-worktree-lease.md`**）:
 
 | Field | SSOT | If missing |
 |-------|------|------------|
@@ -94,12 +95,13 @@ SSOT 细化：`mstar-sdd`（task 级）· `mstar-iteration` §2.6（push 纪律
 
 Execute **`mstar-iteration` § Phase 2** exactly. Summary:
 
-1. **Precondition gate** (§ 2.0) — **four** checks（含 branch metadata #4）
+1. **Precondition gate** (§ 2.0) — **five** checks（含 branch metadata #4 + control-worktree/lease #5）
 2. **Session todos** (§ 2.1) — set host todos per plan wave
 3. **Read backlog** (§ 2.2) — `status.json` + branch metadata
-4. **Integration branch** (§ 2.3) — `git checkout -b <spec_integration_branch> <iteration_base_branch>` when creating（**not** implicit `main`）
-5. **Per-plan loop** (§ 2.4) — for each non-`Done` plan:
-   - Create plan feature branch from integration
+4. **Integration branch + control worktree** (§ 2.3) — establish control worktree on `spec_integration_branch`; record `metadata.control_worktree_path`; status/SDD via control path
+5. **Per-plan loop** (§ 2.4) — for each active plan（**lease-gated parallel** across plan IDs unless `Plan parallelism: serial`）:
+   - Claim or resume `execution_lease`（same `holder` → verify-held-lease; different holder → Blocked）
+   - Create/verify plan feature worktree + branch（`Worktree path` in Assignment）
    - **SDD implement**（默认 `Execution mode: sdd`；`mstar-sdd` 已载入）— per task **串行**：
      1. `sdd-workspace <plan-id>` → `{SDD_DIR}`
      2. `task-brief <plan> N` → `{SDD_DIR}/task-N-brief.md`
@@ -111,9 +113,9 @@ Execute **`mstar-iteration` § Phase 2** exactly. Summary:
    - **禁止**：把整份 plan 或 T1–Tn 全文贴进 implement dispatch；文件交接 SSOT → `mstar-sdd/references/file-handoffs.md`
    - Update `status.json` + main plan after each Completion Report v2
    - QC **full tri-review** (`QC mode: full tri-review`, **N=3**, `mstar-review-qc`) + branch `review-package` + QA per plan
-   - Merge plan branch → integration branch
+   - **Serial merge** plan branch → integration（`metadata.integration_merge_lease` from control worktree）
    - Cross-plan progress sync → compass
-   - Next plan
+   - Next plan / parallel wave
 6. Repeat until **all** plans `Done` → **STOP**（见 Phase state machine）→ 打印 `## Phase 3: iteration-close` → 执行 **`mstar-iteration` §3**；**不得**进入 Phase 4
 
 派发回合纪律 → **`mstar-dispatch-gates`** + **`mstar-iteration` §2.5**。
@@ -170,20 +172,22 @@ Before the first loop pass, search for bundled/host skills（first readable `SKI
 
 | Skill | Search paths（示例，按宿主扩展） |
 |-------|----------------------------------|
-| `greploop` | `skills/greploop/SKILL.md`；`~/.cursor/skills-cursor/greploop/SKILL.md`；`~/.agents/skills/greploop/SKILL.md`；Codex plugin `skills/greploop/` |
-| `babysit` | `skills/babysit/SKILL.md`；`~/.cursor/skills-cursor/babysit/SKILL.md`；`~/.agents/skills/babysit/SKILL.md` |
+| `babysit` / `*-babysit` | `skills/babysit/SKILL.md`；`skills/*-babysit/SKILL.md`；`~/.cursor/skills-cursor/babysit/SKILL.md`；`~/.cursor/skills-cursor/*-babysit/SKILL.md`；`~/.agents/skills/babysit/SKILL.md`；`~/.agents/skills/*-babysit/SKILL.md` |
+| `greploop`（optional） | `skills/greploop/SKILL.md`；`~/.cursor/skills-cursor/greploop/SKILL.md`；`~/.agents/skills/greploop/SKILL.md`；Codex plugin `skills/greploop/` — **only adopt when the repo uses Greptile / has greploop** |
 
-**Mode selection**:
+**Mode selection**（**babysit-first**）:
 
 | Priority | Condition | Read before loop | Primary done signal |
 |----------|-----------|------------------|---------------------|
-| 1 | `greploop` found | `greploop` SKILL.md | Greptile score **5/5** on this PR |
-| 2 | else `babysit` found | `babysit` SKILL.md | Required CI **all green** + **all** review threads **resolved** |
-| 3 | else neither | —（本 command §5.2–§5.4） | Required CI **all green** + **all** review threads **resolved** |
+| 1 | `babysit` **or** any `*-babysit` found | that skill’s `SKILL.md`（prefer exact `babysit`, else first matching `*-babysit`） | Required CI **all green** + **all** review threads **resolved** |
+| 2 | `greploop` found **and** repo has Greptile/greploop | `greploop` SKILL.md | Greptile score **5/5** on this PR（**additive** — does not replace priority-1 gates） |
+| 3 | else neither babysit/`*-babysit` | —（本 command §5.2–§5.4） | Required CI **all green** + **all** review threads **resolved** |
 
-**Both greploop and babysit present**: run greploop until **5/5**, then babysit until CI green + reviews resolved（串行；§5.5 仍须满足全部 exit 项）.
+**Both babysit/`*-babysit` and greploop apply**: run **babysit/`*-babysit` first**（CI + reviews），then optional greploop until Greptile **5/5**（串行；§5.5 仍须满足全部 exit 项）. Do **not** prefer greploop over babysit.
 
-**All modes** share §5.5 exit checklist（CI + reviews + mergeable；Greptile 5/5 按 mode / repo 条件）.
+**No greploop / repo without Greptile**: skip greploop entirely — babysit/`*-babysit` or fallback only.
+
+**All modes** share §5.5 exit checklist（CI + reviews + mergeable；Greptile 5/5 only when greploop mode ran or repo shows a Greptile score）.
 
 ### 5.1 PM invariants（Phase 5）
 
@@ -204,12 +208,12 @@ Repeat until §5.5 exit checklist passes:
 3. **Active reviews** — fetch **unresolved** review threads only；triage valid change requests
 4. **CI** — list failing required checks；dispatch or fix in-scope → push
 5. **Mode-specific pass**:
-   - **greploop**: follow greploop SKILL until Greptile **5/5**
-   - **babysit**: follow babysit SKILL（comments + CI loop）
-   - **fallback**: triage unresolved review threads（§5.3）+ poll CI until all required checks green（no skill Read；**与 babysit 同级的 CI + reviews 门禁**）
+   - **babysit / `*-babysit`**: follow that SKILL（comments + CI loop）— **primary**
+   - **greploop**（optional, repo has it）: follow greploop SKILL until Greptile **5/5** — **after** babysit/`*-babysit` gates when both apply
+   - **fallback**（no babysit/`*-babysit`）: triage unresolved review threads（§5.3）+ poll CI until all required checks green（no skill Read；**与 babysit 同级的 CI + reviews 门禁**）
 6. After each push → §5.3 → return to step 1
 
-**Stop looping only when** §5.5 全 `[x]`。若多轮仍 blocked → 升级用户（列出 failing checks / unresolved threads / Greptile score）。
+**Stop looping only when** §5.5 全 `[x]`。若多轮仍 blocked → 升级用户（列出 failing checks / unresolved threads / Greptile score if greploop mode）。
 
 ### 5.3 Review fix hygiene（HARD — all modes）
 
@@ -221,9 +225,9 @@ Whenever a push addresses PR review feedback（human or bot, including Bugbot /
 
 Do not bulk-resolve without a per-thread reply. Disagree or uncertain → reply explaining why; leave unresolved and escalate.
 
-### 5.4 Fallback mode detail（no greploop / babysit）
+### 5.4 Fallback mode detail（no babysit / `*-babysit`）
 
-When neither skill is found, **本 command 承担 babysit 同级职责**（无外部 SKILL，但 exit 标准相同）:
+When no `babysit` / `*-babysit` skill is found, **本 command 承担 babysit 同级职责**（无外部 SKILL，但 exit 标准相同）。`greploop` alone does **not** replace babysit — if only greploop is present and the repo has Greptile, still run §5.4 for CI + reviews, and optionally greploop for score:
 
 1. Fetch **unresolved** review threads；triage valid change requests → dispatch fix → push → §5.3 comment + resolve
 2. Poll PR required checks until **all green**（reasonable backoff between polls）
@@ -238,7 +242,7 @@ When neither skill is found, **本 command 承担 babysit 同级职责**（无
 - [ ] PR mergeable（无 blocking merge conflicts）
 - [ ] All **required** CI checks green on latest head
 - [ ] All review threads **resolved**（或用户书面 waive 特定 thread）
-- [ ] Greptile **5/5**（若运行了 greploop mode，或 repo 启用 Greptile 且 PR 上可见分数）
+- [ ] Greptile **5/5**（**仅当**采用了可选 greploop mode，或 repo 启用 Greptile 且 PR 上可见分数；无 Greptile 则本项 N/A）
 - [ ] §5.3 comment + resolve 已完成于本轮所有 addressed reviews
 - [ ] Host todo `phase-5-pr-merge-ready` 可勾选
 

package/harness-commands/iteration-loop.md

@@ -62,8 +62,8 @@ Phase 1: Autonomous start  →  Phase 2: Autonomous Execute  →  Phase 3: close
 | 禁止 | 必须 |
 |------|------|
 | 方向 / plan / phase 边界例行 yes/no（「是否同意该方向」「要不要继续」「是否开 PR」） | 进度摘要后**下一条** = dispatch 或下一 phase 步骤 |
-| 用 Phase 汇报收束 turn 后等待用户 | Phase 1 lock → **立刻** Phase 2；plan Done → 下一 plan 或 Phase 3 |
-| 跨 plan 并行 implement | Per-plan **串行** |
+| 用 Phase 汇报收束 turn 后等待用户 | Phase 1 lock → **立刻** Phase 2；plan 可 lease 门控并行 implement；merge 串行 |
+| 跨 plan 无 lease 并行 implement | **默认 lease 门控并行**；`Plan parallelism: serial` 恢复逐 plan 串行 |
 
 **合法 STOP（仅此升级用户）**：
 
@@ -119,6 +119,7 @@ Phase 1: Autonomous start  →  Phase 2: Autonomous Execute  →  Phase 3: close
 9. **`mstar-sdd`** — before first implement dispatch in Phase 2
 10. `mstar-review-qc` — before first QC dispatch in Phase 2
 11. `mstar-branch-worktree` — when Git/write or QC checkout
+12. **`mstar-iteration/references/phase-2-worktree-lease.md`** — Phase 2 control worktree + lease（§2.0 #5 未 waive）
 
 **Do not** Read `skills/grill-me/SKILL.md` for this command.
 
@@ -218,15 +219,15 @@ Register branch fields in compass + `status.json`. Commit docs; push.
 
 ## Phase 2: Autonomous Execute
 
-**Continuous execution applies.** Branch policy first（`mstar-iteration` §2.3）.
+**Continuous execution applies.** Branch policy + control worktree first（`mstar-iteration` §2.3 + **`references/phase-2-worktree-lease.md`**）.
 
 Execute **`mstar-iteration` § Phase 2** exactly. Summary:
 
-1. Precondition gate §2.0（four checks）
+1. Precondition gate §2.0（five checks；含 control-worktree + lease defaults）
 2. Session todos §2.1
 3. Read backlog §2.2
-4. Integration branch §2.3
-5. Per-plan loop §2.4 — **SDD** default; serial implementer → task reviewer; QC **full tri-review** N=3; QA gate; merge to integration; next plan
+4. Integration branch + control worktree §2.3
+5. Per-plan loop §2.4 — **lease-gated parallel** across plan IDs（unless `Plan parallelism: serial`）；claim/resume `execution_lease`；feature worktree；**SDD** default；serial merge via `integration_merge_lease`
 6. All plans `Done` → print `## Phase 3: iteration-close` → **`mstar-iteration` §3**（不得开 PR）
 
 派发纪律 → **`mstar-dispatch-gates`** + **`mstar-iteration` §2.5**。
@@ -264,16 +265,16 @@ Execute **`mstar-iteration` § Phase 5**。**§5.5 exit 全 `[x]` = iteration-lo
 
 | Skill | Search paths（示例） |
 |-------|----------------------|
-| `greploop` | `skills/greploop/SKILL.md`；`~/.cursor/skills-cursor/greploop/SKILL.md`；`~/.agents/skills/greploop/SKILL.md` |
-| `babysit` | `skills/babysit/SKILL.md`；`~/.cursor/skills-cursor/babysit/SKILL.md`；`~/.agents/skills/babysit/SKILL.md` |
+| `babysit` / `*-babysit` | `skills/babysit/SKILL.md`；`skills/*-babysit/SKILL.md`；`~/.cursor/skills-cursor/babysit/`；`~/.agents/skills/babysit/`（及 `*-babysit`） |
+| `greploop`（optional） | `skills/greploop/…`；host skill dirs — **only when repo has Greptile/greploop** |
 
 | Priority | Condition | Primary done signal |
 |----------|-----------|---------------------|
-| 1 | `greploop` found | Greptile **5/5** |
-| 2 | else `babysit` | Required CI green + reviews resolved |
-| 3 | else neither | Same as babysit（本 command fallback） |
+| 1 | `babysit` or any `*-babysit` | Required CI green + reviews resolved |
+| 2 | `greploop` **and** repo has Greptile | Greptile **5/5**（additive） |
+| 3 | else neither babysit/`*-babysit` | Same as babysit（本 command fallback） |
 
-Both present: greploop to 5/5, then babysit（串行）.
+Both apply: **babysit/`*-babysit` first**, then optional greploop（串行）. Do not prefer greploop over babysit.
 
 ### 5.1–5.4 Loop
 
@@ -288,7 +289,7 @@ Fixes push to `spec_integration_branch` only. PM does not rewrite product code i
 - [ ] PR mergeable
 - [ ] All **required** CI checks green on latest head
 - [ ] All review threads **resolved**（或用户书面 waive）
-- [ ] Greptile **5/5**（若 greploop mode / repo 可见分数）
+- [ ] Greptile **5/5**（**仅当**可选 greploop mode / repo 可见分数；否则 N/A）
 - [ ] Review comment + resolve 已覆盖本轮 addressed feedback
 - [ ] Host todo `phase-5-pr-merge-ready` 可勾选
 

package/harness-commands/iteration-start.md

@@ -280,4 +280,6 @@ git checkout -b <spec_integration_branch> <iteration_base_branch>
 - Register `iteration_base_branch`, `spec_integration_branch`, and `target_branch` in compass frontmatter **and** `{HARNESS_DIR}/status.json` root `metadata`
 - Commit all documents to the integration branch and push to remote
 
+**Phase 2 note**：integration 分支在此创建；**control worktree + `execution_lease` 门控在 Phase 2 入口**（`iteration-drive` / `iteration-loop`）——见 **`mstar-iteration/references/phase-2-worktree-lease.md`**。
+
 **STOP** if `iteration_base_branch` or `target_branch` is missing. Ask the user or derive only from an already documented project/iteration policy; never silently substitute `main`.

package/harness-skills/mstar-branch-worktree/SKILL.md

@@ -1,19 +1,20 @@
 ---
 name: mstar-branch-worktree
-description: Morning Star business-repo Git feature branches, same-repo concurrent `git worktree` isolation (N parallel Task invokes do NOT satisfy isolation — worktrees must exist before writable dispatch), plan/Spec integration branches, and QC/QA checkout alignment (`Review cwd`, `Working branch`, `plan_id`, `Review range` / `Diff basis` must match verbatim across three QC reviewers and QA). Read when PM writes `Working branch` / `Branch policy`, dispatches ≥2 concurrent writable implement tracks on one repo, `Worktree isolation: required`, two or more writable streams touch one repo, dispatching QC tri-review or QA after merging to a single `HEAD`, dev/QA/ops before first `git commit`, or explaining worktree paths. Required for `project-manager` parallel implement or pre-QC orchestration; `fullstack-dev*` / `frontend-dev` / `qa-engineer` / `ops-engineer` on repo writes; `qc-specialist*` before review. Does not replace the state machine (`mstar-harness-core`).
+description: Morning Star business-repo Git feature branches, worktree isolation layers **L1** (iteration cross-plan — control worktree + per-plan feature worktrees + `execution_lease`) and **L2** (within-plan — `references/parallel-writable-pre-dispatch.md`; N parallel Task invokes do NOT satisfy isolation), plan/Spec integration branches, and QC/QA checkout alignment (`Review cwd`, `Working branch`, `plan_id`, `Review range` / `Diff basis` must match verbatim across three QC reviewers and QA). Read when PM writes `Working branch` / `Branch policy`, iteration Phase 2 control vs feature worktree paths, dispatches ≥2 concurrent writable implement tracks on one repo, `Worktree isolation: required`, two or more writable streams touch one repo, dispatching QC tri-review or QA after merging to a single `HEAD`, dev/QA/ops before first `git commit`, or explaining worktree paths. Required for `project-manager` parallel implement or pre-QC orchestration; `fullstack-dev*` / `frontend-dev` / `qa-engineer` / `ops-engineer` on repo writes; `qc-specialist*` before review. Does not replace the state machine (`mstar-harness-core`).
 ---
 
 ## Load order（必读顺序）
 
 **首次 Read 本 skill 前：必须先 Read `mstar-harness-core`（SKILL.md）。** 冲突时 **以 `mstar-harness-core` 为准**。
 
-**Spec 多 plan 命名**（`iteration_base_branch`、`spec_integration_branch`、`target_branch` PR 门禁）→ **`mstar-plan-conventions`**。同仓并行可写派发前清单 → **`references/parallel-writable-pre-dispatch.md`**；下文为分支与 QC/QA 检出对齐主文。
+**Spec 多 plan 命名**（`iteration_base_branch`、`spec_integration_branch`、`target_branch` PR 门禁）→ **`mstar-plan-conventions`**。**L1/L2 worktree 分层**（迭代 control vs feature、plan 内并行轨）→ 下文 **「Worktree isolation layers」**；**L2** 同仓并行可写派发前清单 → **`references/parallel-writable-pre-dispatch.md`**；迭代 lease claim/merge 细则 → **`mstar-iteration`** `references/phase-2-worktree-lease.md`（勿在本 skill 重复完整协议表）。下文为分支与 QC/QA 检出对齐主文。
 
 ## Scope（摘要）
 
 - **仅 PM 决定分支**；其他可写角色不得自行新开分支或切回 `main`。
 - **Assignment 须含其一**：`Working branch: <existing>` | `create <new> from <base>` | `Branch policy: direct on <branch> — <reason>`。
-- **同仓 ≥2 可写并发**：派发 **前** 完成 **`references/parallel-writable-pre-dispatch.md`**（含 `git worktree`、绝对 **`Worktree path`**；**N 次并行 invoke ≠ 已隔离**）。
+- **L1（跨 plan / 迭代 Phase 2）**：control worktree（`metadata.control_worktree_path`，检出 `spec_integration_branch`）+ 每 plan 独立 feature worktree（`execution_lease.worktree_path` **≠** control 路径）+ lease；见 **「Worktree isolation layers」**。
+- **L2（同 plan 内 ≥2 可写并发）**：派发 **前** 完成 **`references/parallel-writable-pre-dispatch.md`**（含 `git worktree`、绝对 **`Worktree path`**；**N 次并行 invoke ≠ 已隔离**）。单 plan 多轨时 **L1 不替代 L2**。
 - **QC/QA 前**：待审提交归并到 **单一 `Working branch` `HEAD`**；三审 + QA 共用一套 **`Review cwd` + `plan_id` + `Review range` / `Diff basis`**（逐字相同）。
 
 ## Git 功能分支、同仓并发与 Worktree 对齐
@@ -99,9 +100,46 @@ description: Morning Star business-repo Git feature branches, same-repo concurre
 
 - `Working branch used: <branch-name>`
 
+## Worktree isolation layers (L1 vs L2)
+
+Two complementary **worktree** isolation layers coexist. Do **not** conflate them with SDD **review** layers (L1–L4 in `mstar-review-qc/references/review-responsibility-boundaries.md`).
+
+| Layer | Scope | When | Mechanism |
+|-------|-------|------|-----------|
+| **L1** | Cross-plan (iteration Phase 2) | Multiple plans may implement concurrently in one iteration | **Control worktree** + per-plan **feature worktrees** + `plans[].execution_lease` |
+| **L2** | Within-plan | Same `plan_id`, same business repo, **≥2 concurrent writable implement tracks** | **`references/parallel-writable-pre-dispatch.md`** — distinct absolute **`Worktree path`** per track |
+
+**Stacking rules**
+
+- Default **L1** capacity is **one writable track per plan**. If one plan runs **≥2** concurrent writable tracks, each track **also** satisfies **L2**; L1 does **not** replace L2.
+- **L1** applies under iteration commands with Phase 2 control-worktree defaults (unless explicit `Worktree mode: waived` this turn). Single-plan waves without iteration leases still require **L2** when **≥2** parallel writable tracks share one repo.
+- Cross-plan **integration merge** into `spec_integration_branch` remains **serial** (`metadata.integration_merge_lease`) even when L1 feature implementation runs in parallel.
+
+### Control worktree vs feature worktree (iteration / L1)
+
+Established at iteration **Phase 2 entry** (Phase 1 Review & Edit may stay on the primary checkout). Normative field names and claim/release/merge protocol → **`mstar-iteration`** `references/phase-2-worktree-lease.md` and maintenance ADR `2026-07-22-iteration-worktree-plan-lease.md`. **Do not invent alternate lease field names in this skill.**
+
+| Worktree role | Checked-out branch | Path recorded in `status.json` | Writable product edits |
+|---------------|-------------------|-------------------------------|------------------------|
+| **Control worktree** | Resolved `spec_integration_branch` (same across active plans) | `metadata.control_worktree_path` — canonical **repository root** (not `{HARNESS_DIR}`) | **Forbidden** — coordination, status/SDD SSOT, serial integration merge only |
+| **Feature worktree** (per plan) | Plan `Working branch` / feature branch from integration | `plans[].execution_lease.worktree_path` | **Required cwd** for that plan's product/source edits |
+
+**Hard rules**
+
+- `execution_lease.worktree_path` **MUST** differ from `metadata.control_worktree_path`.
+- Status SSOT: `<control_worktree_path>/{HARNESS_DIR}/status.json`. SDD SSOT: `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/`. A feature worktree's same-looking `{HARNESS_DIR}` path is **not** the SSOT.
+- Absolute **`Worktree path`** MUST appear in the writable Assignment and in `execution_lease.worktree_path` before first writable implement dispatch for that plan.
+- Writable dispatch for a plan requires a **verified** `execution_lease` (same read-check-replace-verify discipline as the iteration reference). Full claim tables are **not** duplicated here.
+
+**Naming conventions (PM / ops; examples only — paths MUST be canonical absolute)**
+
+1. **Control worktree** — usually the primary checkout or a PM-designated path on `spec_integration_branch`; record once in `metadata.control_worktree_path`.
+2. **Feature worktree (per plan)** — one distinct sibling directory per active `plan_id`, e.g. `<repo-parent>/worktrees/<plan-id>` or team `.worktrees/<plan-id>`; Assignment **`Worktree path`** must match lease `worktree_path`.
+3. **L2 track worktrees (within-plan)** — additional distinct directories per parallel implement track under the **same** plan (see **`references/parallel-writable-pre-dispatch.md`**), each with its own PM-approved **`Working branch`**.
+
 ## 同仓并发写入与 Git worktree（强制）
 
-**首要场景是开发阶段**：多条可写流 **并发** 改 **同一仓库** 时，用 worktree 做 **写入侧目录隔离**。派发前清单 → **`references/parallel-writable-pre-dispatch.md`**。下列规则针对该类开发并发；**QC / QA 阶段的检出约定**见下一小节。
+**首要场景是开发阶段（L2；迭代多 plan 时另见上文 L1）**：多条可写流 **并发** 改 **同一仓库** 时，用 worktree 做 **写入侧目录隔离**。派发前清单 → **`references/parallel-writable-pre-dispatch.md`**。下列规则针对该类开发并发；**QC / QA 阶段的检出约定**见下一小节。
 
 当 **`project-manager` 在同一调度轮次内并发启动多个** subagent（含宿主侧「并行 Task / 并行 subagent」），且 **≥2 个承接方**可能对 **同一 Git 仓库的同一工作区（同一 cwd 检出目录）**产生写文件或 `git commit` 级改动时：
 

package/harness-skills/mstar-branch-worktree/references/parallel-writable-pre-dispatch.md

@@ -1,5 +1,17 @@
 # Parallel writable pre-dispatch gate (PM)
 
+## Layer: L2 (within-plan)
+
+This reference is **L2** worktree isolation: **same `plan_id`**, **same business repo**, **≥2 concurrent writable implement tracks**.
+
+**L1 (cross-plan)** is separate and stacks on top when iteration Phase 2 defaults apply:
+
+- A **control worktree** on `spec_integration_branch` (`metadata.control_worktree_path`) holds status/SDD SSOT and serial integration merge.
+- Each concurrently active plan uses a **distinct feature worktree** (`execution_lease.worktree_path` **≠** `control_worktree_path`) with verified `plans[].execution_lease` before writable dispatch.
+- Claim/hold/release/merge rules → **`mstar-iteration`** `references/phase-2-worktree-lease.md` (not repeated here).
+
+When **one plan** runs **≥2** concurrent writable tracks, **L2 still applies** inside that plan even if L1 leases already isolate plans from each other. Run this checklist **per plan** that has multiple parallel implement tracks.
+
 ## Why this exists
 
 Host dispatch can satisfy **「N Assignments ⇒ N invokes in one message」** while every writer still shares **one checkout directory**. That may satisfy `mstar-dispatch-gates` tool concurrency but **violates** same-repo write isolation.
@@ -8,9 +20,9 @@ Host dispatch can satisfy **「N Assignments ⇒ N invokes in one message」** w
 
 ## Mode switch (do not carry single-track habits)
 
-Serial single-plan waves (one feature branch, one checkout, PM on integration) do **not** authorize multi-writer parallel tracks without re-running this gate.
+Serial single-plan waves (one feature branch, one checkout, PM on integration) do **not** authorize multi-writer parallel tracks without re-running this **L2** gate.
 
-When the round adds a second **concurrent** writable implement track on the **same business repo**, treat it as a **mode switch** — even if earlier plans in the iteration were serial.
+When the round adds a second **concurrent** writable implement track on the **same business repo** within one plan, treat it as a **mode switch** — even if earlier plans in the iteration were serial or L1 already assigned each plan its own feature worktree.
 
 ## Pre-dispatch checklist (HARD)
 

package/harness-skills/mstar-dispatch-gates/SKILL.md

@@ -84,8 +84,11 @@ When **`Execution mode: sdd`** (`mstar-sdd`):
 | **工具并发** | 同条消息发满 N 次 invoke | 已发 2 个 Task ⇒ 误以为「并行合规」 |
 | **同仓写隔离** | 派发 **前** 每轨独立 `Worktree path` | 只写了 `Working branch` / `checkout -b` |
 
-- 独立模块可并行 **implement 轨道**（不同 dev Assignment）；**同仓 ≥2 可写并发** → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**（先于 invoke）。
-- **SDD 单 plan 内 task** 仍串行（`mstar-sdd`）；plan 间默认串行（`mstar-iteration` §2.6）— 用户书面 override 时仍须 worktree 隔离。
+- 独立模块可并行 **implement 轨道**（不同 dev Assignment）；**同仓 ≥2 可写并发** → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**（先于 invoke；同 plan 多轨 = L2）。
+- **SDD 单 plan 内**：task / implementer **仍串行**（`mstar-sdd`）；**禁止**同一 plan 内并行 SDD implementer（写冲突）。
+- **跨 plan（迭代 Phase 2）≠ 单 plan 内并行**：不同 `plan_id` 的 feature implement **允许** lease 门控并行（每 plan 独立 verified `plans[].execution_lease` + feature worktree，L1）**仅当** coordination 路径 same-host 独占写锁可用且每次协调变更持锁 → **`mstar-iteration`** §2.0 #5 · **`mstar-plan-artifacts`**。**跨主机 / 无共享 flock** → 默认 **`Plan parallelism: serial`** 或 Assignment 仍写并行 → **Blocked**（用户本轮 `Cross-host lease race: accepted` + audit `notes` 除外）。**`Worktree mode: waived` 不豁免**跨 plan 并行安全闸。**禁止**无 lease 的跨 plan 可写派发（lease 闸未 waive 时）。
+- **`integration_merge_lease`**：`spec_integration_branch` 上的 merge **始终串行**（一次仅一 holder）→ **`mstar-iteration`** · **`mstar-plan-artifacts`**。
+- **`Plan parallelism: serial`**：仅强制跨 plan implement **调度串行**；**不** waive control worktree / `execution_lease` / `integration_merge_lease`（`Worktree mode: waived` 才是 lease/worktree 豁免）→ **`mstar-iteration`** §2.0 #5。
 - **Plan QC tri** after SDD task loop（`Execution mode: sdd`）；**单席**仅 `inline` / hotfix。共用 `Review cwd` / `Working branch` / `plan_id` / `Review range`（**`mstar-branch-worktree`**）。
 - **Tri 同消息规则**：plan QC tri（SDD 或 Assignment 显式 `QC mode: full tri-review`）时三席 **同一条消息**、**同一套** scope 字段。
 
@@ -104,8 +107,12 @@ When **`Execution mode: sdd`** (`mstar-sdd`):
 
 - QC 三审拆在多条消息（tri 模式）或单席却未附 review-package 路径。
 - 仅 1 次 invoke 却声称「tri-review 已并行启动」（tri 模式 N=3）。
-- SDD 并行 implementer dispatch（**同一 plan 内**多 task）。
-- 同仓多轨 writable implement：**N invoke ≠ worktree 隔离** → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**。
+- SDD 并行 implementer dispatch（**同一 plan 内**多 task）— **不同于**跨 plan lease 门控并行（后者见上节 L1）。
+- 跨 plan 可写派发无 verified `execution_lease`；steal / 覆盖活跃 `execution_lease` 或 `integration_merge_lease`；并行 integration merge。
+- 跨 plan **并行**可写派发在 **无** same-host 独占写锁（跨主机 / 无共享 flock）且 **无** 用户本轮 `Cross-host lease race: accepted` + audit `notes` — **无论** `Worktree mode: waived`。
+- 将 **`Worktree mode: waived`** 当作跨 plan 无锁并行授权（须 serial 或 race-accepted + audit）。
+- `InProgress` 无 `execution_lease` 未走 orphan recovery 即 writable-dispatch。
+- 同仓多轨 writable implement：**N invoke ≠ worktree 隔离**（L2）→ **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**。
 - 递归同角色 subagent；把 Handoff / 多轨编排措辞当 invoke。
 - Review-and-edit 链未完成即 commit integration 分支；PM 代做专业角色编辑而不 invoke。
 - Phase 1 review-and-edit 链三角色并行派发，或未等上一角色返回即派发下一角色。

package/harness-skills/mstar-harness-core/SKILL.md

@@ -143,7 +143,10 @@ Read **`mstar-host`** after this skill; detect host per its table, then Read the
 | 递归误派 / 误读 Handoff | `mstar-dispatch-gates` |
 | `quick` 跳过 Prepare | 上表 + `mstar-phase-gates` |
 | 多 worktree 未归并就 QC | `mstar-branch-worktree` |
-| 并行 implement：N invoke 无 worktree | `mstar-branch-worktree` → `references/parallel-writable-pre-dispatch.md` |
+| 并行 writable implement 无隔离（L2 同 plan 多轨：N invoke ≠ worktree；L1 跨 plan：无 verified `execution_lease` + feature worktree） | `mstar-branch-worktree` L1/L2 · `mstar-iteration` §2.6 · `references/parallel-writable-pre-dispatch.md` |
+| 跨 plan 可写派发无 verified `execution_lease` / steal 活跃 lease / 并行 merge 入 `spec_integration_branch` | `mstar-iteration` · `mstar-plan-artifacts`（leases）· `mstar-branch-worktree` L1 |
+| `InProgress` 无 `execution_lease` 未恢复即可写派发 | `mstar-plan-artifacts` — orphan recovery |
+| 混淆跨 plan lease 门控并行与单 plan 内 SDD 并行 implementer | `mstar-dispatch-gates` · `mstar-sdd` |
 | residual 只写 plan 不写 SSOT | `mstar-plan-artifacts` |
 | 角色文件塞流程长文 | 用专题 skill |
 | 无证据宣称完成 | `mstar-coding-behavior` / verification |

package/harness-skills/mstar-iteration/SKILL.md

@@ -7,7 +7,7 @@ description: Morning Star 迭代管理 —— Phase 1（默认 interactive direc
 
 ## Load order
 
-**Read `mstar-harness-core` first.** Path symbols → **`mstar-plan-conventions`**. Per-plan gates → **`mstar-phase-gates`**. Knowledge crystallization → **`mstar-compound`**. **Phase 2 implement 波次**（进入 per-plan implement 前）→ **`mstar-sdd`** + **`mstar-dispatch-gates`**。Phase 2 QC 前 → **`mstar-review-qc`**。On conflict, **`mstar-harness-core` wins**.
+**Read `mstar-harness-core` first.** Path symbols → **`mstar-plan-conventions`**. Per-plan gates → **`mstar-phase-gates`**. Knowledge crystallization → **`mstar-compound`**. **Phase 2 entry**（control worktree + lease）→ **`references/phase-2-worktree-lease.md`** + **`mstar-branch-worktree`**。**Phase 2 implement 波次**（进入 per-plan implement 前）→ **`mstar-sdd`** + **`mstar-dispatch-gates`**。Phase 2 QC 前 → **`mstar-review-qc`**。On conflict, **`mstar-harness-core` wins**.
 
 ## 设计思路
 
@@ -32,7 +32,7 @@ Phase 5: PR merge-ready loop —— 至 mergeable + CI 全绿 + reviews resolved
 **关键定位**：
 
 - **Phase 3** 在 integration 分支收口 compound / roadmap；**开 PR（Phase 4）≠ 迭代交付完成**。
-- **Phase 5** 是 **merge-ready loop**：修复 → push → 再验证，直至 §5.5 exit。**Loop 理念 SSOT 在本 skill**；宿主 command 可叠加额外 helper，但不写入 `mstar-*` load order。
+- **Phase 5** 是 **merge-ready loop**：修复 → push → 再验证，直至 §5.5 exit。**Loop 理念 SSOT 在本 skill**；宿主 command 可叠加额外 **non-`mstar-*`** helper（**优先** `babysit` / `*-babysit`；**`greploop` 可选** — 仅当仓库具备 Greptile/`greploop` 时采用），但不写入 `mstar-*` load order。
 - 一次迭代 = 一个 PR；compound 产物随 PR 合入 `metadata.target_branch`。
 
 ## Phase transition gates（HARD — 防跳步）
@@ -208,7 +208,7 @@ Phase 1 与 §1.6 须遵守 **`references/iteration-artifact-boundaries.md`**（
 
 **本 Phase 是本 skill 的核心**——定义 per-plan 派发循环的完整流程：前置条件检查、session todos、backlog 读取、integration 分支管理、per-plan dispatch 循环（分支→实现→QC→**QA gate**→Done→合并）、dispatch-first 约束、push 纪律。PM 读取本 Phase 即可执行迭代。
 
-### 2.0 前置条件（四道闸）
+### 2.0 前置条件（五道闸）
 
 进入 Autonomous Execute 前必须满足：
 
@@ -216,6 +216,7 @@ Phase 1 与 §1.6 须遵守 **`references/iteration-artifact-boundaries.md`**（
 2. **Pre-implement gate = GO**：plan 已 locked、tasks ready（见 `mstar-phase-gates`）
 3. 用户意图为 **continue Autonomous Execute**（推进迭代 Execute、继续 per-plan 循环等）
 4. **Branch metadata gate**：root `metadata.iteration_base_branch`、`metadata.target_branch` 已登记，且至少一条 active plan 有 `metadata.spec_integration_branch`（或可从 compass 同轮 backfill）。**缺失 → STOP**，不得用 `main`/`master` 补位。
+5. **Control-worktree + lease defaults**（iteration 命令；可被 `Worktree mode: waived` 豁免）：除非本轮 Assignment 显式 `Worktree mode: waived`（或等价用户指令），Phase 2 **必须**在入口建立 control worktree、经 control 路径读写 `status.json` / `{SDD_DIR}`，并在可写派发前 claim `plans[].execution_lease` / `integration_merge_lease`。`Plan parallelism: serial` **不** waive 本闸——仅强制跨 plan **implement** 串行调度；control worktree + lease 仍须满足。**跨 plan 并行安全闸**（**不可**被 `Worktree mode: waived` 豁免）：跨 plan **并行可写 implement** 须满足下列之一——(a) coordination 路径（control 或 waived 时主 checkout `{HARNESS_DIR}/status.json`）上 **same-host 独占写锁可用且每次 status/协调变更持锁**；(b) 默认 **`Plan parallelism: serial`**（**waived 时尤其优先默认串行**）；(c) 用户本轮显式 `Cross-host lease race: accepted`（或等价）+ `plans[].notes` 审计。**禁止**将 `Worktree mode: waived` 当作跨主机无锁并行的授权。细则 → **`references/phase-2-worktree-lease.md`**。
 
 任一 false → **stop**。Phase 1 / Prepare 未完成 → 先完成 Phase 1 或 per-plan Prepare，再进入本 Phase。
 
@@ -237,7 +238,7 @@ SSOT = `{HARNESS_DIR}/status.json` + `{PLAN_DIR}/`。todos 只追踪本轮下一
 2. 列出 `status` ∈ `{Todo, InProgress, InReview, Blocked}` 的 plan（优先级：`InProgress` → `InReview` → `Todo` → unblock `Blocked`）
 3. 读 root `metadata.iteration_base_branch` / `metadata.target_branch`，以及 plan `metadata.spec_integration_branch` / `merge_target` / `primary_spec` 链接
 
-### 2.3 Integration branch
+### 2.3 Integration branch + control worktree（Phase 2 入口）
 
 **Metadata 解析顺序**（任一环节缺失则 STOP，**禁止**默认 `main`/`master`）：
 
@@ -245,23 +246,40 @@ SSOT = `{HARNESS_DIR}/status.json` + `{PLAN_DIR}/`。todos 只追踪本轮下一
 2. 若 (1) 缺字段 → 读当前迭代 compass frontmatter 同名键：优先 `{ITERATION_DIR}/<iteration-id>/delivery-compass.md`；若无则 legacy `{ITERATION_DIR}/<iteration-id>-delivery-compass.md`
 3. 若 compass 有值而 `status.json` 无 → **同轮 backfill** `status.json`
 4. 仍缺 → 向用户确认 base / PR target；**不得**因 `git symbolic-ref refs/remotes/origin/HEAD` 指向 `main` 就自动采用
+5. 所有参与本轮迭代的 active plan **必须**解析到**同一** `spec_integration_branch`；不一致 → **STOP**
 
-**Git 操作**：
+**Control worktree（§2.0 #5 未 waive 时 — HARD）**：
+
+1. 解析或创建 **control worktree**（通常 primary checkout 或 PM 指定路径），检出到上一步的 `spec_integration_branch`
+2. `git fetch`（按需）；`git branch --show-current` 确认在 `spec_integration_branch`
+3. 将规范绝对仓库根路径写入 control 副本 `metadata.control_worktree_path`（仓库根，非 `{HARNESS_DIR}` 子路径）
+4. 此后 **status / SDD SSOT** 均经 control 路径解析：
+   - `<control_worktree_path>/{HARNESS_DIR}/status.json`
+   - `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/`
+5. 若 integration 分支尚不存在：在 control worktree 内 `git checkout -b <spec_integration_branch> <iteration_base_branch>`（**必须**从记录的 base 创建）
+
+**Git 操作（无 control worktree 时 — 仅 `Worktree mode: waived`）**：
 
 1. `git fetch`（按需）确认 `iteration_base_branch` 存在
-2. **checkout 或创建** `spec_integration_branch`：
-   - 已存在 → `git checkout <spec_integration_branch>`
-   - 不存在 → `git checkout -b <spec_integration_branch> <iteration_base_branch>`（**必须**从记录的 base 创建，不是从当前未记录的 `main` 检出）
+2. **checkout 或创建** `spec_integration_branch`（同上）
 3. `git branch --show-current` 确认在 `spec_integration_branch`
 
-此分支是本迭代内所有 plan feature branch 的 merge target。QC **`Review range` / `Diff basis`** 的 merge-base 参照优先用 `metadata.target_branch`（或 PM 书面指定的 base ref），**禁止**无 Assignment 依据写死 `origin/main`。
+`spec_integration_branch` 是本迭代内所有 plan feature branch 的 merge target。QC **`Review range` / `Diff basis`** 的 merge-base 参照优先用 `metadata.target_branch`（或 PM 书面指定的 base ref），**禁止**无 Assignment 依据写死 `origin/main`。
 
 ### 2.4 Per-plan loop（直到全部 Done）
 
-对每个 active `plan_id`：
+**跨 plan 默认**（**无论** `Worktree mode: waived`）：**不同 `plan_id` 可并行 implement** 须满足 §2.0 #5 跨 plan 并行安全闸——(a) coordination 路径 same-host 独占写锁可用且每次 status/协调变更持锁，或 (b) **`Plan parallelism: serial`**（waived 时默认），或 (c) 用户本轮 `Cross-host lease race: accepted` + audit `notes`；否则 Assignment 仍写并行 → **Blocked**。**merge 入 `spec_integration_branch` 仍串行**（`metadata.integration_merge_lease`；waived 时无 merge lease 仍须串行 merge）。未 waive 时 **禁止**无 verified `execution_lease` 的跨 plan 可写派发。
+
+对每个本轮要推进的 active `plan_id`（可交错/并行，非强制 plan A 全 Done 再 plan B）：
 
-1. **Plan start — feature branch**：Assignment 用 `Working branch: create <plan-feature-branch> from <spec_integration_branch>`。一个 plan 一条专用实现分支；plan 内多可写并行轨 → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**
-2. **Implement → InReview**（`§ 2.5`）：
+1. **Claim / resume — execution lease**（§2.0 #5 未 waive）：
+   - 自 control 路径 **重读** `status.json` 定位 plan 行
+   - 若已有 `execution_lease` 且 `holder` **等于本 session** → **resume**：校验 `worktree_path` / `working_branch` 与 Assignment 一致后继续（**不是** steal / Blocked）
+   - 若 `execution_lease` 存在且 `holder` **不同** → **Blocked**
+   - 若 `status: InProgress` 但 **无** `execution_lease` → **STOP** 升级（孤儿状态恢复 → **`mstar-plan-artifacts`**；本 skill 不自行补 lease）
+   - 否则按 **`references/phase-2-worktree-lease.md`** claim：`Todo`/`Blocked` → `InProgress` + 写入完整 `execution_lease`；verify 通过前 **禁止**可写派发
+2. **Plan start — feature worktree + branch**：创建/校验 dedicated feature worktree；Assignment 须含绝对 `Worktree path` + `Working branch`（与 lease 一致）。plan 内多可写并行轨 → **`mstar-branch-worktree`** **`references/parallel-writable-pre-dispatch.md`**
+3. **Implement → InReview**（`§ 2.5`；产品编辑在 feature worktree，status/SDD 经 control 路径）：
    - **默认 `Execution mode: sdd`**（多 task plan；hotfix 可 `inline`）。
    - PM 载入 **`mstar-sdd`** 后，按 plan task 顺序 **串行** per-task 循环（**不是**一次派发 dev 做全部 tasks）：
      1. `sdd-workspace <plan-id>` → `{SDD_DIR}`
@@ -272,10 +290,10 @@ SSOT = `{HARNESS_DIR}/status.json` + `{PLAN_DIR}/`。todos 只追踪本轮下一
      6. Fix loop 直至 review clean；append `{SDD_DIR}/progress.md`；更新 `status.json` / plan checkbox
      7. Next task
    - 每次 Completion Report v2 后更新 `status.json` + 主 plan
-3. **QC → QA gate → Done**：per-plan 审查链 → **`mstar-sdd`**（L1–L2）+ **`mstar-review-qc/references/review-responsibility-boundaries.md`**（L3 tri / inline 单席；raw reports in `{SDD_DIR}/review/`，durable summary in main plan/status）+ **`QA gate`**（`mandatory` → `qa-engineer`；`pm-acceptance` → PM checklist）。
-4. **Plan complete — merge back**：合并 plan feature branch → `spec_integration_branch`；在下一 plan 或 QC 前解决冲突
-5. **Cross-plan 进度同步**：更新 `{ITERATION_DIR}/<iteration-id>/delivery-compass.md` 的 `## Plans` 表状态列
-6. **Next plan** 从步骤 1 继续
+4. **QC → QA gate**（plan 保持 **`InReview`**；**保留** `execution_lease`）：per-plan 审查链 → **`mstar-sdd`**（L1–L2）+ **`mstar-review-qc/references/review-responsibility-boundaries.md`**（L3 tri / inline 单席；raw reports in `{SDD_DIR}/review/`，durable summary in main plan/status）+ **`QA gate`**（`mandatory` → `qa-engineer`；`pm-acceptance` → PM checklist）。**禁止**在 integration merge 成功前设 `Done` 或删除 `execution_lease`。
+5. **Plan complete — serial merge back**（§2.0 #5 未 waive）：自 **control worktree** claim/resume `metadata.integration_merge_lease` → 将 plan feature branch 合并入 `spec_integration_branch`（仅 merge-lease holder；细则 → **`references/phase-2-worktree-lease.md`**）→ 记录 merge commit 证据 → 释放 merge lease；**同轮**设 `Done` 并删除 `execution_lease`。merge 失败：保持 `InReview` + 保留 lease，不得标 `Done`。
+6. **Cross-plan 进度同步**：更新 `{ITERATION_DIR}/<iteration-id>/delivery-compass.md` 的 `## Plans` 表状态列
+7. **Next plan / parallel wave** 从步骤 1 继续（可并行推进其他已 claim 的 plan；merge 仍排队串行）
 
 全部 plan `Done` → **Phase transition gate**（见上文 **Phase transition gates**）：
 
@@ -294,7 +312,7 @@ SSOT = `{HARNESS_DIR}/status.json` + `{PLAN_DIR}/`。todos 只追踪本轮下一
 | 串行 | 同一 plan 内 **one implementer at a time**；每 task 后 **one fresh task reviewer** |
 | Sticky（可选） | Assignment **`SDD implementer session: sticky`** + `implementer-session.json`；implementer **resume**，reviewer **fresh** — `mstar-sdd/references/sticky-implementer-session.md` |
 | 文件交接 | brief / report / diff / `progress.md` 在 `{SDD_DIR}`；dispatch prompt **只给路径**，不贴 plan 全文或 task 历史 |
-| Assignment 字段 | 每个 implement dispatch 须含 `Execution mode: sdd`、`SDD dir`、`Model tier`；**禁止**省略 `Model tier` |
+| Assignment 字段 | 每个 implement dispatch 须含 `Execution mode: sdd`、`SDD dir`、`Model tier`；§2.0 #5 未 waive 时还须含绝对 `Worktree path` + verified `execution_lease`；**禁止**省略 `Model tier` |
 | 大包 inline | **禁止**把 T1–Tn 或整份 plan 写进 **一个** `fullstack-dev` leaf Assignment 冒充 SDD |
 | 分支 diff | 全部 task 完成后 `review-package MERGE_BASE HEAD` → `{SDD_DIR}/review/` branch diff → plan QC tri（N=3） |
 
@@ -311,8 +329,9 @@ Iteration Phase 2 附加：
 - 不因 harness 流程问题常问「是否继续」「要不要现在启动」—— **决策、记录、dispatch**
 - 进度汇报 / subagent Completion Report 后，下一条必须是 **dispatch 或下一 gate 动作**，不得以确认问句收束 turn
 - 未知 → 读 `mstar-*`；仅 **`Blocked`**、secrets、不可逆范围缺口、branch metadata 缺失、或 Phase 5 多轮仍 blocked 时升级用户
-- 实际 Git ≠ `working_branch` → **同轮**更新 plan + status
-- Per-plan loop **串行**（plan A Done 后再 plan B）；plan 内 SDD task **串行** — 见 §2.4、§2.5、`mstar-sdd` Continuous execution
+- 实际 Git ≠ `working_branch` → **同轮**更新 plan + status + `execution_lease.working_branch`（如适用）
+- **跨 plan implement**（**无论** `Worktree mode: waived`）：并行可写 implement 须满足 §2.0 #5 跨 plan 并行安全闸——same-host 独占写锁 + 每次协调变更持锁，或默认 **`Plan parallelism: serial`**（waived 时尤其优先），或用户本轮 `Cross-host lease race: accepted` + audit `notes`；**禁止**将 waived 当作无锁跨主机并行授权；未 waive 时另须 verified `execution_lease` + feature worktree。**integration merge 串行**（`integration_merge_lease` 或 waived 下无 lease 仍须串行 merge）
+- plan 内 SDD task **串行** — 见 §2.4、§2.5、`mstar-sdd` Continuous execution
 
 ---
 
@@ -447,6 +466,16 @@ PR 目标使用 root `metadata.target_branch`；缺失时停止并补齐，不
    - **Resolve** when addressed
 6. Return to step 1
 
+**Optional host helpers（command 层发现；非 `mstar-*` load order）**：
+
+| Priority | Helper | When |
+|----------|--------|------|
+| 1 | `babysit` or any `*-babysit` skill（first readable `SKILL.md`） | **Default prefer** — CI green + reviews resolved loop |
+| 2 | `greploop` | **Optional** — only when the **repo** uses Greptile / has `greploop` available; then run for Greptile **5/5** in addition to babysit/`*-babysit` (or fallback) gates |
+| 3 | neither | Command fallback = babysit-equivalent CI + reviews gates |
+
+When both babysit/`*-babysit` and `greploop` apply: **babysit/`*-babysit` first**（CI + reviews），then optional greploop for Greptile score. Discovery paths → host `commands/iteration-drive` / `iteration-loop` Phase 5.
+
 ### 5.2 Phase 5 exit checklist（迭代交付完成）
 
 打印 **`## Phase 5 exit checklist`**；全 `[x]` 后方可宣称 **迭代交付完成**：
@@ -482,6 +511,7 @@ PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权
 | `references/iteration-workspace-readme-template.md` | `<iteration-id>/README.md` 可选模板（Documents 单表） |
 | `references/iteration-corpus-hygiene.md` | §1.6 writing-specialist specs 卫生细则 |
 | `references/autonomous-direction-lock.md` | §1.2 autonomous direction lock、scale budget、branch resolve |
+| `references/phase-2-worktree-lease.md` | Phase 2 control worktree、`execution_lease`、`integration_merge_lease` |
 | `mstar-strategy` | iteration-start 时读 `STRATEGY.md` 对齐方向 |
 
 ## NOT to do
@@ -507,3 +537,7 @@ PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权
 - **不要在未显式 `Direction lock mode: autonomous` 时跳过与用户收敛方向**（interactive 仍为默认）
 - **不要在 `autonomous` mode 下例行问用户「是否同意该方向」**（须落盘 rationale；无候选且无约束时 STOP）
 - **不要把 harness 流程（Review 链 / QC / QA / compound / close / PR 等）计进 Scale budget 的 plan 数量**，也不得为此单独建 process plan 占坑
+- **不要在 Phase 2 无 verified `execution_lease` 就做可写 implement 派发**（resume 仅限同 `holder` verify-held-lease）
+- **不要 steal / 覆盖他人 `execution_lease` 或 `integration_merge_lease`**（除非用户本轮显式 override + audit `notes`）
+- **不要从 feature worktree 的 `{HARNESS_DIR}` 路径当作 status/SDD SSOT**（control worktree 路径为准）
+- **不要并行 merge 入 `spec_integration_branch`**（merge 必须经 `integration_merge_lease` 串行）

package/harness-skills/mstar-iteration/references/phase-2-worktree-lease.md

@@ -0,0 +1,179 @@
+# Phase 2 control worktree + execution lease
+
+Normative field names and claim/release/merge semantics → maintenance ADR
+`.harness/docs/2026-07-22-iteration-worktree-plan-lease.md` (this repo) or
+`mstar-plan-artifacts/references/status-and-residuals.md` (runtime SSOT after
+plan-artifacts sync). This reference is the **iteration-command execution
+checklist**; do not invent alternate lease field names.
+
+## When it applies
+
+**Iteration commands only** (`iteration-start` ends before this; `iteration-drive`
+/ `iteration-loop` Phase 2+). Defaults are **hard** unless the current turn
+explicitly waives via Assignment `Worktree mode: waived` (or equivalent user
+instruction). `Plan parallelism: serial` is **not** a waiver — it only forces
+serial cross-plan **implement** scheduling while control worktree + leases remain
+required.
+
+Phase 1 Review & Edit may stay on the primary checkout. The control-worktree gate
+starts at **Phase 2 entry**.
+
+## Control worktree (Phase 2 entry)
+
+1. Resolve all active plans' `metadata.spec_integration_branch` to the **same**
+   integration branch (STOP if mismatch).
+2. Resolve or create the **control worktree** (usually primary checkout or
+   PM-designated path) checked out to that `spec_integration_branch`.
+3. Verify `git branch --show-current` equals `spec_integration_branch`; working
+   tree clean before merge operations.
+4. Record canonical absolute repository-root path in
+   `metadata.control_worktree_path` (not `{HARNESS_DIR}`; canonicalize symlinks).
+5. Resolve coordination paths from that root:
+   - status SSOT: `<control_worktree_path>/{HARNESS_DIR}/status.json`
+   - SDD tree: `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/`
+
+All sessions MUST reread the **control copy** of `status.json` immediately before
+claim, release, transfer, plan-status transition, or merge-lease mutation.
+
+### Same-host exclusive write lock
+
+All control-path lease mutations (claim, release, transfer, merge-lease
+claim/release) **MUST** run inside a same-host exclusive write lock for the full
+read-check-replace-verify sequence. Prefer `flock` on
+`{HARNESS_DIR}/.status-write.lock`; alternative: atomic `mkdir` on
+`{HARNESS_DIR}/.status-write.lockdir/`. Do **not** invent a distributed CAS CLI.
+
+**Cross-plan parallel hard gate:** Applies **whether or not** `Worktree mode: waived`.
+Lease-gated **cross-plan parallel** writable implement is allowed **only when**
+this same-host lock is **available on the coordination `status.json` path and
+used for every status/coordination mutation** in that Phase 2 session (control
+path when lease gate active; primary checkout `{HARNESS_DIR}/status.json` when
+waived). Agents on **different hosts** or with **no shared flock/lockdir** →
+default **`Plan parallelism: serial`** (preferred when waived). Assignment still
+claiming cross-plan parallel without lock availability → **Blocked** until PM
+sets serial scheduling or the user gives current-turn override
+`Cross-host lease race: accepted` (or equivalent) + audit on `plans[].notes`.
+**`Worktree mode: waived` alone is not** this override.
+
+Immediately before **any** writable implement dispatch, re-read control
+`status.json` and re-verify `execution_lease` holder + paths match this session;
+mismatch → **STOP**.
+
+## Feature worktree (per plan)
+
+- Each concurrently active plan uses a **distinct** absolute feature-worktree
+  path and dedicated feature branch from `spec_integration_branch`.
+- `execution_lease.worktree_path` MUST differ from
+  `metadata.control_worktree_path` (never reuse the control checkout for product
+  edits).
+- `Worktree path` MUST appear in the writable Assignment and in
+  `plans[].execution_lease.worktree_path` before first writable implement dispatch.
+- Product/source edits run from the feature worktree; status and SDD
+  coordination reads/writes run through the control path.
+- Default **L1**: one writable track per plan. Within-plan multi-writable tracks
+  still follow L2 `parallel-writable-pre-dispatch` (`mstar-branch-worktree`).
+
+## Execution lease (`plans[].execution_lease`)
+
+Required shape (v1): `holder`, `claimed_at` (RFC 3339 UTC with `Z`),
+`worktree_path`, `working_branch`; optional `session_label` (display only).
+
+### Claim (before `InProgress` or writable dispatch)
+
+1. Read control `status.json`; locate exactly one plan row (`id` or `plan_id`).
+2. If `execution_lease` exists:
+   - **Same `holder` as this session** → **resume**: verify `worktree_path` and
+     `working_branch` match the Assignment; continue (not steal/block).
+   - **Different `holder`** → **Blocked** (no timestamp makes it stealable).
+3. Create or verify dedicated feature worktree + branch.
+4. Re-read `status.json` under write lock; if row/status/lease changed, restart claim.
+5. One complete-file update (still under lock): `status: "InProgress"` + full `execution_lease`.
+   Use temp file + atomic replace; never expose partial JSON.
+6. Re-read and verify `holder`, `worktree_path`, `working_branch` match before
+   any writable dispatch.
+
+### Hold, release, override
+
+- Lease stays active across `InProgress` and `InReview` (including post-QC/QA
+  ready-to-merge) unless released or transferred.
+- Normal release: re-read control `status.json` under write lock; confirm stored `holder` matches
+  this session — mismatch → **Blocked**; then **delete** `execution_lease`
+  (never `null` or tombstone).
+- `Done` authority deletes `execution_lease` in the same update as `status: "Done"`
+  — **only after** successful integration merge (when lease gate not waived).
+- Override of another holder requires **explicit user instruction this turn** +
+  audit note on plan `notes` (prior holder, new holder/release, user authorized).
+- V1: **manual release only** — no `expires_at`, TTL, or heartbeat authority.
+
+### Orphan `InProgress` without lease
+
+If a plan row is `InProgress` but has **no** `execution_lease`, STOP and
+escalate — do not invent a lease or writable-dispatch. Unattended "Recover with
+claim" is permitted **only** for the **same** stable `holder`; different holder
+requires verified quiescence + handoff or current-turn user override + audit.
+Recovery semantics → `mstar-plan-artifacts` (not iteration skill).
+
+## Multi-plan parallelism
+
+**Cross-plan parallel safety gate** applies **whether or not** `Worktree mode:
+waived` is in effect — waiver does **not** authorize lockless cross-host parallel.
+
+- **Feature implementation** MAY proceed in parallel across **different plan IDs**
+  only when **one** of:
+  1. Same-host exclusive write lock is available on the coordination
+     `status.json` path (control path when lease gate active; primary checkout
+     `{HARNESS_DIR}/status.json` when waived) and used for every status/coordination
+     mutation in that session; **and** when lease gate is not waived, each plan
+     holds a verified, distinct `execution_lease` and feature worktree.
+  2. **`Plan parallelism: serial`** (default when waived; preferred default under
+     waiver).
+  3. Current-turn `Cross-host lease race: accepted` (or equivalent) + audit
+     `plans[].notes`.
+  Cross-host / no shared lock without (2) or (3) → **Blocked** if Assignment still
+  claims cross-plan parallel writable implement.
+- **Integration merge** into `spec_integration_branch` is **serial** (one at a time),
+  with or without lease gate.
+
+## Integration merge lease (`metadata.integration_merge_lease`)
+
+Required shape (v1): `holder`, `claimed_at`, `plan_id`, `source_branch`,
+`target_branch` (= resolved `spec_integration_branch`); optional `session_label`.
+
+1. From control worktree: clean tree; branch = `spec_integration_branch`.
+2. Under write lock, reread root `metadata`. If `integration_merge_lease` exists:
+   - **Same `holder` as this session** → **resume**: verify `plan_id`,
+     `source_branch`, `target_branch` match intended merge; confirm control
+     worktree state; continue (not steal/block).
+   - **Different `holder`** → **Blocked** (cannot expire or steal).
+3. If unclaimed, claim merge lease (same read-check-replace-verify as execution claim).
+4. Only merge-lease holder runs integration from `control_worktree_path`.
+5. On success: record merge commit/evidence; delete merge lease; set plan
+   **`Done`** and delete `execution_lease` in the same locked update.
+6. On conflict/failure: retain leases; plan stays **`InReview`** — do not set
+   `Done`. Release merge lease only after control worktree is clean and known state.
+
+Execution and merge leases may coexist; merge lease does not grant execution
+ownership for the source plan.
+
+## Waiver
+
+Explicit `Worktree mode: waived` (or equivalent user instruction) this turn
+waives **only**:
+
+- Control worktree establishment and control-path SSOT routing
+- Per-plan feature worktree defaults
+- `plans[].execution_lease` and `metadata.integration_merge_lease` claim/hold/release
+  defaults
+
+It does **not** waive the **cross-plan parallel safety gate**. Under waiver,
+cross-plan **parallel writable** implement still requires same-host exclusive
+write lock on the coordination `status.json` path, default **`Plan parallelism:
+serial`**, or current-turn `Cross-host lease race: accepted` + audit
+`plans[].notes`. **Prefer serial scheduling when waived**; parallel under waiver
+only with the race-accepted override (or same-host lock when mutating shared
+status).
+
+`Plan parallelism: serial` does **not** waive control worktree or leases.
+
+Iteration commands MUST NOT infer waiver from missing worktrees or single-session
+starts. Explicit override this turn only.

package/harness-skills/mstar-plan-artifacts/SKILL.md

@@ -27,6 +27,7 @@ description: Morning Star plan harness artifacts — `{PLAN_DIR}` main plans and
 - **Canonical**: register new findings only at root `residual_findings`; **`metadata.residual_findings`** is legacy read-only — **do not** dual-write.
 - **Lifecycle**: open → verified close → **`archived/residuals/<plan-id>.json`**; machine **`severity`** enum in reference.
 - **`notes.json`**, optional **`tech_debt_summary`** (rollup view; compute via **`scripts/tech-debt-rollup.sh`**).
+- **Iteration Phase 2 leases** (`metadata.control_worktree_path`, `plans[].execution_lease`, `metadata.integration_merge_lease`): claim-before-`InProgress`, resume vs steal, orphan recovery → **`references/status-and-residuals.md`** (“Iteration execution leases”).
 
 Field semantics, severity mapping, archive flow, and `jq` examples → **`references/status-and-residuals.md`**.
 

package/harness-skills/mstar-plan-artifacts/references/status-and-residuals.md

@@ -130,6 +130,20 @@ In old JSON, **`"severity": "warning"`** is read and rolled up as **`low`**. **F
 | `review_bundle` | string | Optional pointer to `{SDD_DIR}/review/` for current ephemeral QC/QA evidence |
 | `task_commits` | array\<object\> | SDD recovery: `{ "task_id": "T1", "base": "<sha>", "head": "<sha>" }` per completed task |
 
+### `plans[].execution_lease` (iteration Phase 2)
+
+Optional when a plan is not owned; **required** while a Phase 2 session owns writable execution for that plan. Normative protocol below; iteration command checklist → `mstar-iteration/references/phase-2-worktree-lease.md`.
+
+| Field | Type | Required | Semantics |
+| --- | --- | --- | --- |
+| `holder` | non-empty string | Yes | Opaque cooperative owner identity (recommended `<host>:<stable-session-id>`, e.g. `cursor:bc-1234`). Stable for claim lifetime; **no credentials**; used for ownership comparison — not `session_label`. |
+| `claimed_at` | RFC 3339 UTC (`Z`) | Yes | Acquisition time (audit only; **not** an expiry clock). |
+| `worktree_path` | absolute path string | Yes | Dedicated feature-worktree root; **MUST** differ from `metadata.control_worktree_path`. |
+| `working_branch` | non-empty string | Yes | Feature branch at `worktree_path`; MUST agree with Assignment **`Working branch`**. |
+| `session_label` | string | No | Human display only — **MUST NOT** authorize or compare ownership. |
+
+Writers **delete** `execution_lease` on release; `null` and tombstone objects are invalid.
+
 ### Optional delivery ledger (`phase` + `batches` + `verification`)
 
 For multi-batch or multi-role plans:
@@ -161,6 +175,8 @@ Legacy string `plans[].notes` is OK; new repos should use arrays with time + eve
 | `notes` | array | **Legacy** — prefer **`{HARNESS_DIR}/notes.json`** |
 | `residual_findings_history` | object | **Legacy** — prefer **`archived/residuals/<plan-id>.json`** |
 | `tech_debt_summary` | object | Optional rollup over open R#; maintain via script (below) |
+| `control_worktree_path` | absolute path string | Iteration Phase 2: canonical **repository root** (not `{HARNESS_DIR}`) checked out to active `spec_integration_branch`; coordination + serial merge cwd |
+| `integration_merge_lease` | object | While one integration merge is owned; **absent** = unclaimed. Writers **delete** the key on release — never write `null` or tombstone objects |
 
 **Formal iteration example** (root `metadata`; values are project-specific — **do not** copy `main` by default):
 
@@ -181,6 +197,157 @@ Plan row (per active iteration plan):
 }
 ```
 
+---
+
+## Iteration execution leases (Phase 2)
+
+Cooperative coordination through the **control worktree** copy of `{HARNESS_DIR}/status.json`. Not a distributed lock service — non-cooperating processes are out of scope. **Same-host** writers use an exclusive write lock (below) around lease mutations; **cross-plan parallel writable implement** is permitted only when that lock is available on the control path and held for every lease mutation (see hard gate below).
+
+**When fields apply:** iteration Phase 2 (after control worktree entry, or primary checkout when `Worktree mode: waived`). Control worktree + lease fields are waived only by explicit current-turn user instruction (`Worktree mode: waived` or equivalent). `Plan parallelism: serial` does **not** waive leases. **`Worktree mode: waived` does not waive the cross-plan parallel safety gate** (see hard gate below).
+
+**Path SSOT:** status and SDD reads/writes use `<control_worktree_path>/{HARNESS_DIR}/…`. A feature worktree's same-looking `{HARNESS_DIR}` path is **not** the SSOT.
+
+### Same-host exclusive write lock (control `status.json`)
+
+Lease mutations on the **control** copy of `{HARNESS_DIR}/status.json` — execution claim/release/transfer, plan-status transitions that touch leases, and `integration_merge_lease` claim/release — **MUST** run inside a **same-host exclusive write lock** for the full read-check-replace-verify sequence.
+
+**Preferred (same machine, shared filesystem):** advisory lock on `{HARNESS_DIR}/.status-write.lock` via `flock` (or equivalent). Hold from first read through post-write verify; release on all exit paths (success or failure).
+
+```bash
+CONTROL_ROOT="<metadata.control_worktree_path>"
+HARNESS=".harness"   # or resolved {HARNESS_DIR}
+STATUS="$CONTROL_ROOT/$HARNESS/status.json"
+LOCK="$CONTROL_ROOT/$HARNESS/.status-write.lock"
+(
+  flock -x 9 || exit 1
+  # read → mutate → temp file + atomic replace → re-read verify
+) 9>"$LOCK"
+```
+
+**Alternative when `flock` unavailable:** atomic `mkdir` on `{HARNESS_DIR}/.status-write.lockdir/` — success acquires; existing dir → **Blocked** (another writer holds the lock); remove the directory only after successful verify or explicit rollback.
+
+**Hard gate — cross-plan parallel writable implement:** Applies **whether or not** `Worktree mode: waived`. Lease-gated **cross-plan parallel** writable implement (when lease gate active) is allowed **only when** a same-host exclusive write lock is **available on the coordination `status.json` filesystem and held for every status/coordination mutation** in that Phase 2 session (execution claim/release/transfer, plan-status transitions, `integration_merge_lease` claim/release when lease gate active). When waived, the coordination path is primary checkout `{HARNESS_DIR}/status.json` — the same lock discipline applies to any shared status mutation before parallel writable dispatch. If agents span hosts or the coordination path has **no shared flock/lockdir** (distinct machines, non-shared mount), **default `Plan parallelism: serial`** for cross-plan implement scheduling — one plan writable wave at a time (**preferred default when waived**). If Assignment still claims cross-plan parallel implement without same-host lock availability → **Blocked** until PM aligns Assignment (`Plan parallelism: serial`) or the user supplies the override below. **`Worktree mode: waived` alone is not** the cross-host parallel override. v1 does **not** add a distributed CAS CLI.
+
+**Exception — documented cross-host residual:** Explicit **current-turn** user instruction such as `Cross-host lease race: accepted` (or equally unambiguous equivalent) **plus** audit entry on affected `plans[].notes` (timestamp, hosts/sessions involved, residual race risk acknowledged) permits cooperative multi-host cross-plan parallel with documented residual risk.
+
+**Pre-dispatch re-verify:** Immediately before **any** writable implement dispatch, reread control `status.json` and confirm this session still passes verify-held-lease (`holder`, `worktree_path`, `working_branch` match Assignment). Mismatch or absent lease → **STOP** — do not dispatch.
+
+### Root `metadata.integration_merge_lease` (v1)
+
+Single global lease authorizing one plan feature branch integration into `spec_integration_branch`.
+
+| Field | Type | Required | Semantics |
+| --- | --- | --- | --- |
+| `holder` | non-empty string | Yes | Same format and comparison rules as `execution_lease.holder`. |
+| `claimed_at` | RFC 3339 UTC (`Z`) | Yes | Acquisition time (audit only). |
+| `plan_id` | non-empty string | Yes | `plans[].id` (or legacy `plan_id`) of the feature being integrated. |
+| `source_branch` | non-empty string | Yes | Plan feature branch to integrate. |
+| `target_branch` | non-empty string | Yes | Resolved `spec_integration_branch` — no other target is valid. |
+| `session_label` | string | No | Display only. |
+
+Example fragments:
+
+```json
+{
+  "metadata": {
+    "control_worktree_path": "/repo",
+    "integration_merge_lease": {
+      "holder": "cursor:bc-1234",
+      "claimed_at": "2026-07-22T04:00:00Z",
+      "plan_id": "plan-a",
+      "source_branch": "feature/plan-a",
+      "target_branch": "iteration/2026-07",
+      "session_label": "Integrate plan A"
+    }
+  },
+  "plans": [
+    {
+      "id": "plan-a",
+      "status": "InProgress",
+      "execution_lease": {
+        "holder": "cursor:bc-1234",
+        "claimed_at": "2026-07-22T02:30:00Z",
+        "worktree_path": "/repo-worktrees/plan-a",
+        "working_branch": "feature/plan-a",
+        "session_label": "Plan A implementation"
+      },
+      "metadata": {
+        "spec_integration_branch": "iteration/2026-07",
+        "merge_target": "iteration/2026-07"
+      }
+    }
+  ]
+}
+```
+
+### Claim-before-`InProgress` (execution lease)
+
+A Phase 2 session **MUST** claim **before** moving a plan from `Todo` or `Blocked` to `InProgress` and **before** any writable dispatch for that plan:
+
+1. Reread the control copy of `status.json`; locate exactly one plan row (`id` or `plan_id` read compatibility).
+2. **Resume (not steal):** if `execution_lease` exists and `holder` **equals this session** → verify-held-lease: confirm `worktree_path` and `working_branch` match the Assignment; continue (this is **not** Blocked and **not** a new claim).
+3. **Blocked:** if `execution_lease` exists and `holder` **differs** → stop. No timestamp, TTL, or inactivity makes it stealable.
+4. **Orphan:** if `status` is `InProgress` but `execution_lease` is absent → **STOP** (see “Orphan recovery” below). Do not writable-dispatch or invent a lease.
+5. Create or verify the dedicated feature worktree and branch (`worktree_path` ≠ `control_worktree_path`).
+6. Acquire same-host write lock (see above); reread `status.json`; if row, status, or lease state changed, restart from step 1.
+7. In **one complete-file update** (under lock), set `status: "InProgress"` and write the full `execution_lease` object. Use a temp file in the same directory and atomically replace `status.json`.
+8. Reread the stored row; verify `holder`, `worktree_path`, and `working_branch` exactly match the attempted claim. Writable dispatch is forbidden until verification succeeds.
+
+V1: **manual release only** — omit `expires_at`; readers **MUST NOT** treat unknown or draft `expires_at` as authority to steal or release.
+
+### Hold, release, and override
+
+- Lease remains active across `InProgress` and `InReview` (including review fix rounds) unless deliberately released or transferred.
+- **Release:** reread control `status.json`; stored `holder` must match this session (mismatch → **Blocked**, not permission to delete). Delete `execution_lease` in the same complete-file update — never `null`.
+- Voluntary abandonment: may set `status: "Blocked"` and delete the lease in one update.
+- **`Done` authority** deletes any `execution_lease` in the **same** complete-file update as `status: "Done"` — **only after** successful integration merge into `spec_integration_branch` when Phase 2 lease gate is not waived (see “Integration merge protocol” and `mstar-iteration` §2.4). After QC/QA pass, plan stays **`InReview`** with lease retained until merge succeeds.
+- Temporary blockage may retain the lease when the same holder remains responsible and the plan record explains the next action.
+- **Override (only exception to no-steal):** explicit **user instruction in the current turn** may remove or replace another holder's lease. Append an audit entry to `plans[].notes` with timestamp, prior holder, new holder (or release), and that the user authorized override. Agents **MUST NOT** infer override from age, inactivity, `Blocked` status, or a failed session.
+- Cooperative handoff: current holder explicitly agrees; receiving worktree/branch verified; one complete-file update — otherwise old holder releases and new holder follows normal claim.
+
+### Integration merge protocol
+
+Feature implementation may run in parallel across plan IDs **only when** the cross-plan parallel hard gate above is satisfied (same-host lock on coordination `status.json`, default **`Plan parallelism: serial`**, or current-turn `Cross-host lease race: accepted` + audit `plans[].notes` — **not** by `Worktree mode: waived` alone); when lease gate is active, each plan also needs a verified `execution_lease` and distinct feature worktree. Mutations of `spec_integration_branch` are **serial**. Plan status after QC/QA is **`InReview`** with `execution_lease` retained until merge succeeds (when lease gate active); **`Done`** + lease deletion happen **after** the integration merge commit is recorded.
+
+1. From `control_worktree_path`: clean working tree; checked-out branch = resolved `spec_integration_branch`.
+2. Reread root `metadata` under the same-host write lock (above). If `integration_merge_lease` exists:
+   - **Resume (not steal):** `holder` **equals this session** → verify-held-merge-lease: confirm `plan_id`, `source_branch`, and `target_branch` match the intended merge; confirm control worktree state (clean or documented in-progress resolution); continue (this is **not** Blocked).
+   - **Blocked:** `holder` **differs** → stop. No timestamp, TTL, or inactivity makes it stealable.
+3. If unclaimed, claim merge lease with the same read-check-replace-verify discipline as execution claims. `source_branch` and `plan_id` must match the feature; `target_branch` must match `spec_integration_branch`.
+4. Only the stored merge-lease `holder` runs integration from `control_worktree_path`.
+5. On success: record merge commit/evidence per plan/status conventions; **delete** `integration_merge_lease`; in the **same** locked update set plan `status: "Done"` and **delete** `execution_lease`.
+6. On conflict/failure: retain both leases; plan stays **`InReview`** — do **not** set `Done`. Release merge lease only after control worktree is clean and in a known state.
+
+Execution and merge leases may coexist; merge lease does not grant execution ownership for the source plan.
+
+### Orphan recovery (`InProgress` without `execution_lease`)
+
+Runtime skills that detect this state (e.g. `mstar-iteration`) **STOP** and defer recovery here — they **MUST NOT** silently add a lease or writable-dispatch.
+
+**Immediate gate:** no writable dispatch until recovery completes and a verified `execution_lease` exists (or plan is returned to a non-active status).
+
+**Resolver:** `@project-manager` (or explicit human/PM ownership resolution after race or corruption).
+
+| Path | When | Actions |
+| ---- | ---- | ------- |
+| **Reset to `Todo`** | Work abandoned, unknown owner, or safe to restart claim | One complete-file update under write lock: `status: "Todo"`; ensure `execution_lease` absent; append `plans[].notes` audit (timestamp, reason, actor). |
+| **Recover with claim (same holder)** | Legitimate in-progress work; feature worktree/branch verified on disk; **this session's stable `holder`** matches the prior owner | Unattended recovery permitted **only** for the **same** stable `holder`. Follow claim-before-`InProgress` from step 5 under write lock; append `plans[].notes` audit (orphan recovery, same `holder`, paths verified). |
+| **Recover with claim (different holder)** | New session must take over live work | **Blocked** for unattended recovery. Requires **verified quiescence** of the prior writer (no live writable work on the feature branch/worktree) **and** explicit cooperative handoff from the prior holder, **or** **current-turn user override** + audit `notes` (prior holder, new holder, user authorized). Then normal claim under write lock. |
+| **Escalate / `Blocked`** | Ambiguous ownership, conflicting worktrees, or partial/corrupt `status.json` | Set `status: "Blocked"` with `metadata.blocked_reason`; do **not** writable-dispatch until human/PM resolves. Restore coherent `status.json` from latest complete state if needed. |
+
+After any recovery path, the next session must pass verify-held-lease before writable dispatch.
+
+### Agent prohibitions (lease SSOT)
+
+- **MUST NOT** steal or overwrite an active `execution_lease` or `integration_merge_lease` (no TTL, age, or inactivity authority in v1).
+- **MUST NOT** writable-dispatch without a verified `execution_lease` for that plan (resume counts only when same `holder` passes verify-held-lease).
+- **MUST NOT** write `null` or tombstone objects for lease keys — **delete** the key on release.
+- **PM NEVER** steal an active lease without explicit current-turn user override + audit `notes` (full list → `mstar-roles/references/project-manager.md` § PM-Specific NEVER Rules).
+
+Preservation: writers **MUST** preserve unrelated plan rows, root metadata, and `residual_findings` on every lease mutation.
+
+---
+
 ## General constraints
 
 - Each `plans[]` row may include optional **`metadata`** (`{}` or omit).

package/harness-skills/mstar-plan-artifacts/templates/README.md

@@ -4,6 +4,6 @@ Copy these into `{HARNESS_DIR}` when bootstrapping a project. Path symbols (`{HA
 
 | File | Copy to | Notes |
 |------|---------|--------|
-| `status.empty.json` | `{HARNESS_DIR}/status.json` | Root `residual_findings` only (see **`mstar-plan-artifacts` SKILL.md**). Replace `updated_at` with the real date. |
+| `status.empty.json` | `{HARNESS_DIR}/status.json` | Root `residual_findings` only (see **`mstar-plan-artifacts` SKILL.md**). Replace `updated_at` with the real date. Iteration Phase 2 lease fields (`control_worktree_path`, `execution_lease`, `integration_merge_lease`) are added at runtime — not in the empty template. |
 | `notes.empty.json` | `{HARNESS_DIR}/notes.json` | Optional program timeline. Replace `updated_at` when first edited. |
 | `plans-done.empty.json` | `{HARNESS_DIR}/archived/plans-done.json` | **Profile B only** — `{ "plans": [<plan-id>, ...] }` **only** (`references/done-compaction.md`). Append id on each `Done` compaction; no other keys or object elements. |

package/harness-skills/mstar-roles/references/project-manager.md

@@ -127,6 +127,12 @@ If any item below matches, fix the dispatch/plan state or mark `Blocked`—do **
 - **NEVER** perform specialist document edits in the PM thread when host invoke is required — that is `dispatch incomplete` (`mstar-dispatch-gates`, `mstar-iteration` §1.6).
 - **NEVER** mark the last plan `Done` and then create a PR or declare the iteration complete without **`## Phase 3: iteration-close`** and `mstar-iteration` §3.1–§3.5 checklists.
 - **NEVER** treat final plan closure prose as iteration-close — compound, roadmap `delivered`, and compass `status: completed` require Phase 3.
+- **NEVER** steal or overwrite an active `execution_lease` or `integration_merge_lease` (no TTL, age, or inactivity authority); override only on explicit current-turn user instruction + audit `plans[].notes` (`mstar-plan-artifacts/references/status-and-residuals.md` — “Iteration execution leases”).
+- **NEVER** writable-dispatch for a plan without a **verified** `execution_lease` for that plan (resume only when same `holder` passes verify-held-lease against Assignment `Worktree path` / `Working branch`).
+- **NEVER** writable-dispatch when a plan is `InProgress` but has **no** `execution_lease` — complete orphan recovery first (`mstar-plan-artifacts` — “Orphan recovery”).
+- **NEVER** run or dispatch **parallel** integration merges into `spec_integration_branch` — merge is **serial** via `metadata.integration_merge_lease` from the control worktree (`mstar-iteration` §2.6 · `mstar-branch-worktree` L1).
+- **NEVER** cross-plan writable implement without distinct per-plan verified `execution_lease` + feature worktree; `Plan parallelism: serial` forces serial **scheduling** only — it does **not** waive control worktree or lease gates (`mstar-iteration` §2.0 #5).
+- **NEVER** dispatch **cross-plan parallel** writable implement when same-host exclusive write lock is **not** available on the coordination `status.json` path (cross-host / no shared flock) — default **`Plan parallelism: serial`** or **Blocked** if Assignment still claims parallel; exception only on current-turn user `Cross-host lease race: accepted` (or equivalent) + audit `plans[].notes` — **including when `Worktree mode: waived`** (`mstar-plan-artifacts` — “Hard gate — cross-plan parallel writable implement”).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/opencode",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Morning Star harness OpenCode plugin (skills bootstrap and agent loading).",
   "license": "MIT",
   "repository": {