@oneie/claude 0.6.0 → 0.8.0

package/commands/do.md

@@ -10,47 +10,23 @@ The human owns one thing: the goal sentence. `/do` owns everything below it.
 
 ---
 
-## Principles, underneath every phase
+## Principles · parallelism · substrate signals
 
-**Docs-first — the doc is the spec *and* the oracle.** Write the documentation set (and the tests drawn from it) **before** building, not after. A doc written in the reader's language is a sharper spec than a plan written in the builder's — so it produces a sharper plan and sharper tests. The same docs are then the **acceptance oracle**: at the end, PROVE validates the shipped thing against the docs, and the tests assert the observable claims the docs make. Docs are written *first* and made *true last* — if BUILD can't make a documented claim true, either the code is wrong (fix it) or the doc was wrong (correct it), but every doc ends true. This replaces the old seed-then-refine draft: the first write is the real spec, not a sketch; the last touch is validation, not authorship.
+Moved to `text/do-reference.md` — read it ONLY on a miss (a decision
+the core below does not settle). The four rules it carries, in one line each:
 
-**Progressive disclosure.** Each phase loads only what it needs. Recon reads the last few turns + the most relevant files, never the whole history. A reference doc loads only when the work touches it. Skills are invoked, not inlined. Widen context only on a miss.
+- **Docs-first** — the doc is the spec AND the acceptance oracle; written before
+  BUILD, made true by PROVE.
+- **Progressive disclosure** — each phase loads only what it needs; widen on a miss.
+- **Tool ladder** — bash → Haiku → Sonnet → Opus → Fable; stop at the first that
+  decides. Fable is apex judgment ×1, never sweeps, never edits.
+- **Parallel by default** — `C_n → C_m` exists ONLY when C_m reads a file C_n
+  writes. Every other arrow is an imaginary blocker; reject on sight.
 
-**Skills are first-class.** W2 declares which skills apply to each file. W3 invokes them before editing to get domain guidance (patterns, examples, gotchas, best practices). If a skill is missing or stale (>30 days), W3 creates/updates it automatically via `/skill-creator`. Every edit is guided by live expertise — no guessing on patterns.
+Every phase emits `signal("world:do-event", payload)`; the router fans to
+followers and `mark()` closes the loop. Payloads + tag list: the reference.
 
-**Parallel agents at the right model · effort.** Reach for the cheapest tool that can answer, then run as many as the work allows in one message. Two dials:
-
-```
-bash    none              bit-equal checks, greps, schema validation, test exit codes
-Haiku   low | medium      recon (low) · binary judgment / rubric (medium)
-Sonnet  low | medium      mechanical edit (low) · genuine restructure / prose (medium)
-Opus    high | xhigh      architecture (high) · substrate / schema reconciliation (xhigh)
-Fable   high · ×1         apex judgment — verdicts that compound across ≥3 cycles or the
-                          whole substrate (audit severity, cut lines, wire-vs-kill, canon).
-                          Never sweeps, never edits: Haiku extracts → Sonnet condenses into
-                          a context pack → Fable reads the pack, returns verdicts/diff specs.
-                          Escalation from Opus, never the default — with TWO standing
-                          exceptions: (1) SCHEMA-tier W2 (do-tier.sh emits w2_model=fable;
-                          substrate verdicts compound across every future cycle — and the
-                          classifier counts D1 .sql migrations and on-chain contract
-                          sources (.move/.sol, tests excluded) as SCHEMA, since applied
-                          migrations are append-only and deployed contracts can't be
-                          patched) and
-                          (2) the W4 UI Taste gate (one Fable verdict per UI-heavy cycle —
-                          keep/refine/reject, never sweeps/edits).
-```
-
-> **✅ FABLE AVAILABLE (restored 2026-07-04).** `FABLE_AVAILABLE=on` is set in
-> `.claude/settings.json`'s `env` block, so Fable-pinned/Fable-mandatory cycles
-> (including SCHEMA-tier W2 and `do-tier.sh w2_model=fable`) spawn on **Fable·high**
-> as designed. `hook:fable-fallback` is the backstop: if Fable access is ever
-> revoked again, unset `FABLE_AVAILABLE` and every `model: "fable"` spawn falls
-> back to Opus automatically. New plans should set `parallel_budget.fable: 1`
-> and mark apex-judgment cycles `[Fable — mandatory]` per the rule above.
-
-Fan-out: independent agents in ONE message, capped by the plan's `parallel_budget`. Recon + verify fan wide (Haiku × N). Edits run one-per-file (Sonnet × N). Only W2 stays single — understanding is not delegable, but it runs as a **spawned single Opus `w2-decide` agent** (model-override to **Fable** when the cycle is marked Fable-mandatory in the plan), not inline. The conductor/session model runs Sonnet; W2 stays Opus·high (or Fable·high when pinned). W2 is in the spawn list (W1·**W2**·W3·W4-rubric); the "never delegated → run inline" constraint is replaced by "stays single — one apex agent, never fanned."
-
-> **Two execution paths (effort & parallelism).** The **Agent tool has no `effort` param** — so this default Agent-spawn path controls *model* per wave but not *effort* (the `· high/· low` columns are intent the conductor approximates, not an enforced knob). For **true per-wave effort** + managed parallel fan-out + worktree isolation, use **Path 2: the Workflow engine** (`.claude/workflows/do-engine.js`) — the interactive session runs `Workflow({name:"do-engine", args:{slug}})`; each wave's `agent({model, effort})` is explicit (W1 haiku·low · W2 opus·high · W3 sonnet·low · W4 haiku·medium), cycles in a batch run in parallel, and the plan worktree is the shared edit surface. Path 1 (`do-auto.sh`, shell `--auto`) stays the proven fire-and-forget loop and now passes the conductor's session `--effort`. **Both paths report identically** (shipped 2026-07-04, workflow-bridge C1): do-engine emits `world:do-event` at cycle open (`type:aim`) + close (`type:learn` with `{shape, model, composite}`) via a shell-quoted, fire-and-forget haiku curl — a Path 2 run lands in the inbox Build space and teaches the shape→model router exactly like Path 1. Architecture + when-to-use each: `text/do-engine-plan.md`. The wider seam (routing fan-out stages to workflows automatically, do-engine as a priced skill): `text/workflow-bridge-plan.md` — seed table + gates designed; the auto-routing default lands as its C6, not yet wired here.
+---
 
 ### The coherence ratchet
 
@@ -73,13 +49,15 @@ Comprehensive and fast are not in tension: the **tier decides which gates run**,
 
 | Lever | Fires at | Saves by |
 |---|---|---|
-| Tier prune | Step 1 | PATCH walks `code` only; a gate never runs above the phases it guards |
+| Tier prune | Step 1 | PATCH walks `BUILD → VERIFY` only; a gate never runs above the phases it guards |
 | Tool ladder | every decision | bash → Haiku → Sonnet → Opus → Fable; stop at the first that decides |
 | **Context reset** | cycle boundary | multi-cycle plans run each cycle in a fresh subprocess (`do-auto.sh`) — prior-cycle chatter (~15–25k/cycle) never accumulates; ~90–150k saved on a 6-cycle plan |
 | **TRIVIAL fast-path** | BUILD | **0 agent spawns** — read ≤3 files inline, edit, bash verify, inline rubric, 1 learnings line |
-| Recon cache | W1 | `do-recon-cache.sh check` — sha-keyed local store, <14d → **0 tokens**, skip all spawns (saves ~12k/recon) |
-| W1 prefix cache | W1 miss | `w1-recon.ts` caches the ~5,400-token rules+agent prefix across Haiku calls (~4,900 saved/repeat). Needs `ANTHROPIC_API_KEY` — `do-auto.sh` lifts it from `one.ie/web/.env`; absent → uncached agent-spawn fallback |
-| W4 rubric cache | W4 | `w4-rubric.ts` caches the ~10,900-token rubric+spec block across 6 Haiku calls — 1 write + 5 reads (~46k saved/run). Same key requirement as W1 |
+| **Deterministic W1** | W1 | `do-recon-pack.sh` — brief + per-file exports/imports/consumers + the prior cycle's improvements, **0 model tokens in 0.28s**. Removes the ~6.4KB `w1-recon` prompt from the default path entirely |
+| **Deterministic W4 gates** | W4 | `do-w4-gates.sh` — the whole gate battery in ONE call (~1.3s), four-state receipt. Removes the ~34.3KB `w4-verify` + `w4-tools` spawn; only the rubric verdict stays a model judgment, scored by the in-context conductor |
+| Recon cache | W1 | `do-recon-cache.sh check` — sha-keyed local store, <14d → **0 tokens**; folded into the recon pack, still runnable standalone (saves ~12k/recon) |
+| ~~W1 prefix cache~~ | — | **Does not exist.** `w1-recon.ts` is a 6-line stub that writes `[w1-recon] using agent spawn` and exits 2 *unconditionally* — the API key is irrelevant. Kept as the escalation door, not as a saving. Do not quote its numbers |
+| W4 rubric judge | W4 | `w4-rubric.ts` — **one** OpenRouter Haiku call scoring the 5 *task* axes (not 6 parallel Haiku, and no prefix cache: it has neither). Needs `OPENROUTER_API_KEY`; absent → exit 2, and the conductor scores from `do-w4-gates.sh` instead |
 | Verify-only-changed | W3→W4 | dependency cone from `git diff`; full verify only at cycle close |
 | Cross-cycle pre-warm | W4 close | one fire-and-forget Haiku pre-reads the next cycle's W1 targets |
 | Recon cap | W1 | 400-word receipt; high-signal slices → `.w2-spec.json`, not the raw dump |
@@ -88,63 +66,6 @@ Comprehensive and fast are not in tension: the **tier decides which gates run**,
 
 A cycle that runs **zero LLM calls** is a *good* cycle. The comprehensiveness lives in the gates (DoD, rubric, RECONCILES, ANALYZE, PROVE); the tier decides how many of them you pay for.
 
-### Maximize parallelism — read the graph, reject imaginary blockers
-
-Every multi-cycle plan carries a **Mermaid dependency graph**. `/do` reads it to fire the **maximum safe fan-out**: cycles with no edge between them run their waves *at the same time*, and their independent edits merge into ONE spawn message. The default is parallel — serial is the exception you must justify.
-
-```mermaid
-graph TD
-  C1[C1 foundation] --> C2[C2]
-  C1 --> C3[C3]
-  C1 --> C4[C4]
-  C2 --> C5[C5 composes]
-  C3 --> C5
-  C4 --> C5
-  C5 --> C6[C6 polish]
-```
-
-C2·C3·C4 are siblings → their W1/W2 run concurrently and their W3a edits merge into one message. C5 waits *only* because it reads files C2–C4 write.
-
-**The only valid arrow.** `C_n → C_m` exists **only** when C_m reads a file C_n writes. Before drawing one, fill the blank or delete it:
-> `C_n → C_m because C_m imports/reads {exact file path} that C_n creates.`
-
-**Imaginary blockers — reject on sight** (full list in `text/template-todo.md`): "same feature area" · "same folder" · "both touch the DB" (unless the *same* entity) · "logical/reading order" · "don't want too many agents at once" (`parallel_budget` already caps it) · "want to review C_n first" (policy, not a dependency) · "C_m depends on what we *learn* in C_n" (W2 learning ≠ a file dependency).
-
-**Cross-cycle W3 batch (the big win).** A batch of 3 cycles with 8 + 6 + 4 independent edits = **18 `w3-edit` agents in ONE message**, not 3 sequential rounds. Only a named same-file collision serializes (→ W3b). Same rule for waves: W1 recon across all cycles in a batch is one Haiku spawn; W4 rubric is 5 Haiku × N cycles in one message — all capped by `parallel_budget`.
-
----
-
-## Substrate signals — the loop feeds the world
-
-Every phase emits a `signal("world:do-event", payload)` into the substrate. Actors (human or agent) who follow the relevant tags receive it in their inbox at `/u/[slug]/in`. The receiver is the world; the router fans to followers; `mark()` closes the loop. Full routing spec: `text/routing.md`. Schema: `schema/do.tql`.
-
-| Phase | Signal | Tags emitted |
-|-------|--------|-------------|
-| **AIM** | `{ type:"aim", slug, tier, goal }` | `do:aim` · `do:cycle` · `tier:<tier>` · `slug:<slug>` |
-| **W1 recon** | `{ type:"wave", slug, cycle, wave:"W1" }` | `do:wave` · `do:build` · `slug:<slug>` |
-| **W2 decide** | `{ type:"wave", slug, cycle, wave:"W2" }` | `do:wave` · `do:build` · `slug:<slug>` |
-| **W3 edit** | `{ type:"wave", slug, cycle, wave:"W3" }` | `do:wave` · `do:build` · `slug:<slug>` |
-| **W4 verify** | `{ type:"verify", slug, cycle, composite, axis }` | `do:verify` · `do:cycle` · `slug:<slug>` · `s:<axis>` |
-| **LEARN/close** | `{ type:"learn", slug, tier, cycle, composite, deliverable, axis }` | `do:learn` · `do:cycle` · `tier:<tier>` · `slug:<slug>` · `s:<axis>` |
-| **HALT** | `{ type:"halt", slug, cycle, reason }` | `do:halt` · `slug:<slug>` |
-
-`axis` is the subset of the five axes a cycle measurably advanced — **Security · Stability · Speed · Structure · Integration** (the W4 rubric: `rubric-security`, `rubric-stability`, `rubric-speed`, `rubric-simplicity` = Structure, and `rubric-integration` = wired-not-orphaned). A cycle that raised the security score emits `s:security`; one that wired an orphaned surface emits `s:integration`; an agent following `s:security` watches that axis compound. The number is the rubric score, not a vibe.
-
-```bash
-# emitted by BOTH paths — do-auto.sh (Path 1) and do-engine.js emitDoEvent()
-# (Path 2, cycle open/close) — at each phase boundary (signal has no tag attribute —
-# tags ride in the payload and the receiver matches them at fan-out)
-signal("world:do-event", JSON.stringify({
-  type: "learn", slug: SLUG, tier: TIER, cycle: N, composite: C, deliverable: D,
-  axis: ["security","structure"],
-  tags: ["do:learn","do:cycle","tier:"+TIER.toLowerCase(),"slug:"+SLUG,"s:security","s:structure"]
-}))
-```
-
-The receiver is **`world:do-event` in `one.ie/web/src/lib/world-receivers.ts` `HANDLERS`** (a receiver, not a new route). It (1) gates to a trusted internal sender and scopes D1 to `ctx.ownerSlug` (IDOR); (2) finds every actor whose follow-paths match the payload tags **exactly**; (3) writes a D1 `thread` + `entity_tags` `["do-event","lifecycle:do:<stage>"]` so it renders in the inbox Build space; (4) `mark`s the `shape → model` path so the model router learns; (5) `mark`s each delivery (closed loop); (6) broadcasts `inbox:refresh` on the `inbox:{slug}` SSE topic. Actors subscribe with `sdk.follow("do:learn")` / `sdk.follow("slug:<slug>")` / `sdk.follow("s:security")`.
-
----
-
 ## Step 0 — Classify the input
 
 | Input | Treat as | Entry |
@@ -174,6 +95,9 @@ If the **first word** after `/do` is one of these reserved verbs, it routes to t
 | `/do reject <slug>` | record a branch you abandoned | `.claude/scripts/do-accept.sh <slug> reject` |
 | `/do prove` | prove the anti-fabrication gate (4/4) | `.claude/scripts/do-orchestrate.sh --prove-gate` |
 | `/do rubric [pkg]` | score security · stability · simplicity · integration · speed; writes W0 baseline the loop reads | `python3 .claude/scripts/do-rubric.py ${pkg:-"--all"}` |
+| `/do turn` | **one wavefront turn of ONE LOOP** — 4 haiku senses ∥ → opus pick (fable on anomaly) → 1–4 disjoint moves ∥ (worktree-isolated, model per move) → haiku skeptics re-run every receipt → one sonnet close (marks, log, state, rotation) | `Workflow({scriptPath: ".claude/workflows/one-loop.js"})` — contract: `text/one-loop.md` |
+
+`/do turn` is the company loop, not a plan loop: it picks across ALL lanes (SETTLE·BUILD·SHIP·DISTRIBUTE·SELL·MINE·LEARN), and its **verify-before-mark law** is absolute — an executor's claimed success is worthless until an independent skeptic reproduces the receipt; unverified success closes as `warn`. Self-grading corrupts weights at scale. Code moves land on `loop/<slug>` branches; merge stays human.
 
 `/do auto` builds **nothing** when no plan is hermetic ∧ genuine-armed ∧ no-open-judgment — that's correct (it refuses unsafe work with a receipt). Give it fuel: a `tier: fix` plan with a LOCAL `outcome:` (see `text/orchestrator-how-to.md` §8). Full runbook: `text/orchestrator-how-to.md`.
 
@@ -192,6 +116,36 @@ Headless, the four asking-gates **must not call `AskUserQuestion`** — there is
 
 ---
 
+## Step 0.5 — COMPILE the brief (do this FIRST; it answers most of what follows)
+
+```bash
+.claude/scripts/do-brief.sh <slug>            # a plan cycle
+.claude/scripts/do-brief.sh --files <path>... # a loose change
+```
+
+One JSON object, zero model tokens: `{slug, plan, ready, files, folders, tier,
+spine, classifier, ceiling_tokens, w2_model}`. It is a JOIN over `do-plan-json`,
+`do-next`, `do-tier` and `do-folder` — the four scripts the waves used to make a
+model re-derive in prose.
+
+**Read the brief; never re-derive a field it already answers.** `tier` and `spine`
+settle Step 1. `folders` settles the verify command in W0/W4. `ready` settles
+which cycles may run now (the DAG, not the batch barrier). `plan.worktree`
+settles where. A wave that re-asks one of these is spending tokens on a fact that
+is already on disk.
+
+Consequence for the wave count: with the brief compiled, a cycle needs at most
+**two** model calls — W2 (decide what the edit is; not delegable) and W3 (make
+it). W1 collapses into the brief plus `do-recon-cache.sh check`; W4's gates are
+already bash and only the rubric verdict is a model call. A TRIVIAL/PATCH cycle
+needs **one**.
+
+`do-brief.sh --self-test` proves it: it refuses a missing plan with empty stdout,
+emits every required key, and — the red proof — asserts the tier actually
+discriminates (a doc edit and a `schema/*.tql` edit must not size the same).
+
+---
+
 ## Step 1 — Goal + tier (the one human gate)
 
 1. **Restate as a goal**, one sentence: *"a {persona} can {outcome} they couldn't before."* Not "ship X" — "user can do Y" / "system enforces Z".
@@ -200,6 +154,16 @@ Headless, the four asking-gates **must not call `AskUserQuestion`** — there is
    .claude/scripts/do-tier.sh --intent "<idea>" $(git diff --name-only 2>/dev/null)
    ```
    Emits **tier** (PATCH | FIX | FEATURE | SCHEMA), the **pruned spine** (which stops run), the **inner classifier** (TRIVIAL | SIMPLE | COMPLEX for BUILD), and a **token ceiling**. Default down when unsure — an under-built FIX reopens cheaply at PROVE; an over-built PATCH is tokens you can't refund.
+
+   **`UNSIZED` (exit 3) is the expected answer at AIM on a clean tree.** `git diff` is
+   empty before any edit exists, and `do-tier` sizes a *diff*, never a sentence — so it
+   refuses rather than guessing. It used to fall through to PATCH/TRIVIAL/5k here, which
+   silently mis-sized real work twice on record (`text/learnings.md:485`,
+   `text/remote-suspend-todo.md:5`). On `UNSIZED`: name the files the idea would touch
+   (a grep or a `w1-recon` spawn — this is what SURVEY does anyway), then re-run
+   `do-tier` with those paths. Never treat `UNSIZED` as PATCH. Note it exits non-zero,
+   so under `pipefail` a `do-tier … | grep` returns 3 even when the grep matches —
+   capture the output first.
 3. **Confirm once** — goal sentence + tier, in a single `AskUserQuestion`. Never interrogate. A pre-agreed backlog item auto-skips this gate.
 
 The pruned spine by tier:
@@ -234,7 +198,7 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | ↳ *SPEC docs* | `-features.md` if scope is multi-capability; `-ui.md` if the feature ships a user-visible surface | `docs` skill picks the types → `text/template-features.md` / `text/template-ui.md` (conditional — see Doc artifacts below) | sonnet · medium |
 | **DOCS** | doc set exists ∧ reconciles | the **full** doc set, written as the spec — `docs` skill picks the types, `writer` drafts: always `-docs.md`; + `-tutorial`/`-how-to`/`-reference`/`-agents-docs` per condition. Written in the reader's language *before* code — this is the acceptance spec PROVE validates against. Not a draft: the real thing | sonnet · medium |
 | **PLAN** | `test -f text/<slug>-todo.md` | `/create todo` + `text/template-todo.md` — cycles + deliverables derived from the docs (each cycle ships a documented observable) | sonnet · medium |
-| ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md` — CRITICAL exit 1 blocks BUILD | bash · none |
+| ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md [--strict-promise]` — CRITICAL exit 1 blocks BUILD. Also reads `text/<slug>.md` and HIGH-warns any promise `accept:` no `C<n>` cycle carries (the todo's `outcome:` and `Correct-course` blocks are not corpus — that's where the gap hides); `--strict-promise` makes an uncovered deliverable CRITICAL | bash · none |
 | **TEST** | test file in the repo folder | test-first **from the docs** — one assertion per documented observable; the docs' claims become the executable acceptance tests *before* code exists | sonnet · low |
 | **BUILD** | survey verdict = `build` (≥70% match → `expose`/`extend` instead) | the BUILD engine (Step 3) — make the docs + tests true | sonnet · low–medium |
 | **VERIFY** | rubric + ratchet pass | `do-reconcile.sh <canon>` per category + rubric composite ≥ 0.65 | haiku · medium |
@@ -292,7 +256,14 @@ Forward-only — a `[x]` is never un-ticked except by `/do --wave N --redo`. If
 
 After the spine: **LEARN / close** — validate `text/<slug>-docs.md` against the shipped behavior (the doc was authored at DOCS as the spec; close is where every documented observable is confirmed true and any drift reconciled — no plan closes with a doc that lies about what shipped); write one `learnings.md` entry (slug, tier, composite, deliverable, proof line), emit `signal("cost:cycle", {tokens, model, composite})` and `signal("world:do-event", { type:"learn", slug, tier, cycle, composite, deliverable, tags:["do:learn","do:cycle","tier:"+tier,"slug:"+slug] })`, delete `.w3-receipts.json`, write `.do-trust.json {level, consecutive, composite}` (in a worktree loop, `do-auto.sh` syncs trust + improvements back to the main tree every iteration — state never strands), and append `.w4-improvements.json` (an open item recurring in 3+ consecutive cycles = systemic gap → emit `substrate:systemic-gap`; next W1 reads it as a mandatory recon target).
 
-**Plan-outcome kill-switch (zero LLM).** The switch must be **armed before it can fire**: at PLAN close (before the first BUILD cycle), run the `outcome:` command once and require a **non-zero exit**. Exit 0 at plan start means either the goal is already met (close the plan, build nothing) or the outcome is too weak to gate anything (rewrite it before any cycle runs) — red before green, at plan level. Then re-run the command every cycle close. Exit 0 → the goal is met: remaining cycles enter justify-or-drop (default drop), `--auto` halts. Over the tier ceiling → `warn` + justify. Weak rubric 3× → halt, the *plan* is wrong, not the code. Goal-drift (outcome fails 3× with green rubrics) → force a re-plan.
+**Plan-outcome kill-switch (zero LLM).** The switch must be **armed before it can fire**: at PLAN close (before the first BUILD cycle), run the `outcome:` command once and require a **non-zero exit**. Exit 0 at plan start means either the goal is already met (close the plan, build nothing) or the outcome is too weak to gate anything (rewrite it before any cycle runs) — red before green, at plan level. Then re-run the command every cycle close. Exit 0 → the goal is met: remaining cycles enter justify-or-drop (default drop), `--auto` halts. Over the tier ceiling → `warn` + justify. Weak rubric 3× → halt, the *plan* is wrong, not the code.
+
+**Correct-course — mid-plan triage, tier-sized.** When reality diverges from the plan mid-loop — goal-drift (outcome fails 3× with green rubrics), a W3 anchor-miss that survives the autonomous re-plan-once, or INVESTIGATE surfacing a wider blast radius than the plan assumed — size the *correction*, not the feature, with the same tier lens Step 1 already uses:
+- **PATCH-sized** (a wrong assumption in one cycle, no scope change) → fix inline in the current cycle; append one line to the todo's `## Correct-course` log; continue the loop.
+- **FIX-sized** (a cycle's tasks/deliverables need adding, splitting, or dropping, but the promise still holds) → reopen PLAN: edit `text/<slug>-todo.md` cycles in place, append a `## Correct-course: <date>` block (old → new, one-line rationale, which cycle triggered it), re-run `do-analyze.sh` (the ANALYZE gate), resume the loop.
+- **FEATURE-sized** (a `deliverables:`/`assumes:` entry in the promise no longer holds, or the goal itself must change) → reopen DESIGN (and PROMISE, if the schedule of work changed): append the same `## Correct-course` block, re-derive PLAN from it, `do-promise-lint.sh` re-checks the schedule⇄proof law before the loop resumes.
+
+The block is the only new artifact — appended to the todo/plan already on disk, never a separate document. `--autonomous` treats a FEATURE-sized correction the same as CLARIFY: park, don't guess.
 
 **One command, complexity-sized.** `/do <anything>` is the only thing a human types — an idea, a slug, or a `text/<slug>-todo.md` path. The tier sizes the work and the spine prunes itself: a typo is edited and verified inline (one cycle, no loop); a feature writes its promise, plan, todo, tests, and docs and then runs every cycle. The human never picks the mode, never types a flag, never runs a second command.
 
@@ -341,7 +312,7 @@ What is intentionally discarded each reset: prior-cycle conversation and agent o
 | context-isolated (the default) | ~1–2k (fresh invocation) | ~1–2k every cycle |
 | **Saving** | — | **~90–150k tokens** |
 
-This compounds with the W1 cache and W4 rubric cache: a cycle 6 run with context isolation + both SDK caches costs roughly **1/10th** of the same cycle run inline in a long session.
+This compounds with the deterministic W1 and W4 above: a 6-cycle run with context isolation, `do-recon-pack.sh` and `do-w4-gates.sh` pays two agent prompts per cycle instead of five.
 
 ---
 
@@ -358,25 +329,84 @@ echo "$RESOLVED" | jq -se 'all(.doc_only)' >/dev/null \
 TSC=$(bunx tsc --noEmit 2>&1 | grep -c "error TS" || echo 0)   # write .w0-baseline.json {tscErrors, loc, tests}
 ```
 
-**W1 — Recon.** Read `.w4-improvements.json` open items first — they're mandatory recon targets. Then consume the improvements queue: `grep -i "<slug-or-touched-paths>" .claude/improvements.queue.md | head -5` — matching proposals become recon targets too, and W4 deletes any line this cycle resolves (the queue shrinks or the loop is hoarding).
+**W1 — Recon.** If the task was picked up from the substrate queue (`tasks:mine`/`tasks:everywhere`, MCP `tasks_mine`/`tasks_everywhere`, or a board claim), read its `contextDocs` and `notes` FIRST — mandatory recon targets, same tier as `.w4-improvements.json` below. `contextDocs` names the doc-family stems that already exist for this slug (`do-rank.py`'s `task_context_for()` builds this list: `""`, `-plan`, `-features`, `-ui`, `-todo`, `-docs`, filtered to what's actually on disk); `notes` is the prose goal a human or a prior cycle attached. A picked task never starts bare. Read `.w4-improvements.json` open items next — they're mandatory recon targets. Then consume the improvements queue: `grep -i "<slug-or-touched-paths>" .claude/improvements.queue.md | head -5` — matching proposals become recon targets too, and W4 deletes any line this cycle resolves (the queue shrinks or the loop is hoarding). After W1 settles, append `{"cycle":"C<n>","wave":"W1","model":"<script|haiku>","ts":"<iso>"}` to `$WT/.do-census.jsonl` — **`script` on the default deterministic path, `haiku` only when the `w1-recon` agent was actually spawned.** The census is the cost ledger; a script-run W1 logged as a haiku spawn overstates the very bill this wave stopped paying.
 
-**Cache check (zero tokens):**
+**W1 IS A SCRIPT, NOT A SPAWN (default path, zero model tokens):**
 ```bash
-.claude/scripts/do-recon-cache.sh check $CYCLE_TARGET_PATHS 2>/dev/null && RECON_CACHE_HIT=true || true
+.claude/scripts/do-recon-pack.sh <slug>              # or --files <path>...
 ```
-Hit → load findings from stdout, skip all agent spawns. Also run `do-recon-cache.sh prune` once per session to evict entries older than 14 days.
-
-Miss → ≤5 files → read inline. ≥6 → run the SDK script (prompt-cached rules + agent-prompt block, writes result to `.w1-cache/`):
+One JSON object: `{brief, inventory, doc_family, improvements_open,
+improvements_queue, recon_cache}`. `inventory` is per target file — `loc`,
+`sha`, `exports`, `imports`, `consumers` — which is what the recon receipt
+narrated in prose. `improvements_open` + `improvements_queue` carry the
+prior-cycle obligations above (they are recon *inputs*, and losing them was the
+real risk in dropping the spawn); `recon_cache` folds in
+`.claude/scripts/do-recon-cache.sh check` for the same file shas (still runnable
+standalone), so a warm hit costs nothing.
+Measured: **0.28s**, and `--self-test` carries the red proof (a target that does
+not exist comes back `exists:false` with `exports: []`, never fabricated).
+
+Also run `do-recon-cache.sh prune` once per session to evict entries older than 14 days.
+
+**Escalate to the `w1-recon` AGENT only on a genuine miss** — the pack's
+`inventory` is empty or every entry is `exists:false`, or the cycle needs
+INVESTIGATE-grade forensics (root cause, blast radius, `must_not_break`). Then
+spawn `w1-recon` (Haiku · low) for ALL files in ONE message, or run the SDK
+script if an API key is present:
 ```bash
 bun .claude/scripts/w1-recon.ts --targets "$FILES" --mode RECON
 ```
-Script exits 2 if `ANTHROPIC_API_KEY` is absent → fall back to spawning `w1-recon` agent (Haiku · low) for ALL files in ONE message. Either path: skip `relevance_score < 0.4`; all-filtered → halt and broaden (zero-findings guard). Receipt capped at 400 words; persist high-signal slices into `.w2-spec.json`. *(The `w1-recon` agent carries the two-track existing-code + primitive-inventory contract.)*
+Reading a file list off disk is not judgment; deciding a root cause is. Only the
+second buys an agent. *(SURVEY and INVESTIGATE on the Step 2 spine still spawn
+`w1-recon` — those fire once per PLAN and are not the per-cycle bill.)*
+Script exits 2 if `ANTHROPIC_API_KEY` is absent (measured 2026-09-01: it exits 2
+unconditionally — the "prefix cache" lever below has never once fired) → fall
+back to spawning `w1-recon` agent (Haiku · low) for ALL files in ONE message. Either path: skip `relevance_score < 0.4`; all-filtered → halt and broaden (zero-findings guard). Receipt capped at 400 words; persist high-signal slices into `.w2-spec.json`. *(The `w1-recon` agent carries the two-track existing-code + primitive-inventory contract.)*
+
+**W2 — Decide (spawned single `w2-decide` agent — Opus · high; Fable · high when the cycle is Fable-pinned).** W2 is NOT run inline; the conductor spawns one `w2-decide` agent at Opus·high (model-override `fable` if the plan marks this cycle Fable-mandatory) and waits for its result. Understanding is not delegable; it stays single, never fanned — but pinning it to the conductor process is not required. The conductor/session model runs Sonnet; W2 stays Opus. W2 writes the goal/deliverable/UX gate (3 sentences) first. Then: reconcile names against `dictionary.md`; run the **compress check** before any new primitive (name 3 existing primitives that compose it → `compose` removes it from the diff, `new` needs a one-line justification + same-diff doc edit). The pre-mortem + trade-offs were already captured at the DESIGN stop (`template-plan.md`) — carry the failure modes forward as test cases, don't redo them. Classify each W1 finding Act / Keep / Defer. Output diff specs + write `.w2-spec.json` (+ `.w2-doc-plan.json` if a doc trigger fires). **Output surface checklist (mandatory, every cycle):** W2 always writes `.w2-surface-checklist.json` — either the surface layers or `{"surface":"none","reason":"<why no user-visible surface>"}`. For each route/page/component being added, fill it with: which nav parent it links under, what inbound links to add + from which pages, which SDK/MCP/CLI exports are needed, all UI states. A cycle with no user-visible surface must say so explicitly — `surface: "none"` plus a `reason` string — so the escape hatch is auditable, never implicit. W4 fails the cycle if the file is absent. If a surface is being added but nav_entry/inbound_links are null, W4 will fail — they are not optional. Pin the **Interface Contract** (shared names, CLI signatures, decisions that multiple downstream tasks reference — pins let them run parallel, not serial). Emit the maximal-width batch DAG (arrow test applied: arrows exist only where one cycle reads a file another writes). *(The `w2-decide` agent carries the compose-target table — which canonical doc to check per primitive type — plus context-triggers for surgical doc injection.)* After the spawned `w2-decide` agent settles, append `{"cycle":"C<n>","wave":"W2","model":"opus|fable","ts":"<iso>"}` to `$WT/.do-census.jsonl`.
 
-**W2 — Decide (spawned single `w2-decide` agent — Opus · high; Fable · high when the cycle is Fable-pinned).** W2 is NOT run inline; the conductor spawns one `w2-decide` agent at Opus·high (model-override `fable` if the plan marks this cycle Fable-mandatory) and waits for its result. Understanding is not delegable; it stays single, never fanned — but pinning it to the conductor process is not required. The conductor/session model runs Sonnet; W2 stays Opus. W2 writes the goal/deliverable/UX gate (3 sentences) first. Then: reconcile names against `dictionary.md`; run the **compress check** before any new primitive (name 3 existing primitives that compose it → `compose` removes it from the diff, `new` needs a one-line justification + same-diff doc edit). The pre-mortem + trade-offs were already captured at the DESIGN stop (`template-plan.md`) — carry the failure modes forward as test cases, don't redo them. Classify each W1 finding Act / Keep / Defer. Output diff specs + write `.w2-spec.json` (+ `.w2-doc-plan.json` if a doc trigger fires). **Output surface checklist:** for each route/page/component being added, fill `.w2-surface-checklist.json` with: which nav parent it links under, what inbound links to add + from which pages, which SDK/MCP/CLI exports are needed, all UI states. If a surface is being added but nav_entry/inbound_links are null, W4 will fail — they are not optional. Pin the **Interface Contract** (shared names, CLI signatures, decisions that multiple downstream tasks reference — pins let them run parallel, not serial). Emit the maximal-width batch DAG (arrow test applied: arrows exist only where one cycle reads a file another writes). *(The `w2-decide` agent carries the compose-target table — which canonical doc to check per primitive type — plus context-triggers for surgical doc injection.)*
+**W3 — Edit (Sonnet × N parallel).** Soft-resume first: if `.w3-receipts.json` has fewer receipts than `.w2-spec.json` diff specs, a prior W3 was interrupted — skip W0–W2 and resume from the first unapplied spec. Pre-validate every anchor with `grep -qF` in parallel. No file overlap → spawn all `w3-edit` agents in ONE message (W3a). Overlap → W3a (independent) then W3b (same-file, sequential). Append a receipt per edit; anchor miss twice → halt, ask user. **Surface build order (mandatory, every cycle):** `schema → types → receiver/SDK → API route → MCP tool → CLI verb → component → page → route registration → navigation → inbound links → doc updates → UI states` (full-stack composition example: `text/sdk-mcp-cli-schema-design-integration.md`). MCP/CLI layers run only when `.w2-surface-checklist.json` declares `mcp_tool`/`cli_verb` — agent-facing or operator-facing capabilities, not every UI tweak. **Docs are parallel to code** — do not wait for W3a to complete; doc edits spawn in the same W3a message as code edits. **Navigation is mandatory** — if `.w2-surface-checklist.json` declares `nav_entry`, W3 must wire it (add route to nav system + create link from specified parent page); if omitted from checklist, W4 will fail. Same for inbound links. UI states (empty / loading / error / edge) rendered inline with page/component; not separate edits. After each `w3-edit` agent settles, append `{"cycle":"C<n>","wave":"W3","model":"sonnet","ts":"<iso>"}` to `$WT/.do-census.jsonl`.
 
-**W3 — Edit (Sonnet × N parallel).** Soft-resume first: if `.w3-receipts.json` has fewer receipts than `.w2-spec.json` diff specs, a prior W3 was interrupted — skip W0–W2 and resume from the first unapplied spec. Pre-validate every anchor with `grep -qF` in parallel. No file overlap → spawn all `w3-edit` agents in ONE message (W3a). Overlap → W3a (independent) then W3b (same-file, sequential). Append a receipt per edit; anchor miss twice → halt, ask user. **Surface build order (mandatory, every cycle):** `schema → types → receiver/SDK → API route → MCP tool → CLI verb → component → page → route registration → navigation → inbound links → doc updates → UI states` (full-stack composition example: `text/sdk-mcp-cli-schema-design-integration.md`). MCP/CLI layers run only when `.w2-surface-checklist.json` declares `mcp_tool`/`cli_verb` — agent-facing or operator-facing capabilities, not every UI tweak. **Docs are parallel to code** — do not wait for W3a to complete; doc edits spawn in the same W3a message as code edits. **Navigation is mandatory** — if `.w2-surface-checklist.json` declares `nav_entry`, W3 must wire it (add route to nav system + create link from specified parent page); if omitted from checklist, W4 will fail. Same for inbound links. UI states (empty / loading / error / edge) rendered inline with page/component; not separate edits.
+**W4 — Verify (bash first, zero tokens). W4 IS NOT A SPAWN.**
 
-**W4 — Verify (bash first, zero tokens).**
+Run the whole deterministic battery in ONE call and read the receipt:
+```bash
+.claude/scripts/do-w4-gates.sh --demo '<cycle.demo.command>' --slug <slug>
+#                              [--files <changed-path>...]   # default: git diff HEAD
+```
+It emits `{files, gates[], fails, unrun, deterministic_pass}`, each gate with a
+**four-state** status: `pass | fail | unrun | n/a`. `deterministic_pass` is true
+only on **zero fails AND zero unruns**: an absent tool is an unrun check, never
+a green one, and an unrun gate is not a passed gate.
+
+**Pass `--demo` and `--slug`.** The script runs everything derivable from the
+diff (verify lane · gitleaks · dep audit · security greps · surface checklist ·
+per-surface nav/inbound/SDK/MCP/CLI wiring greps · the 7 canons · consumer sweep
+· tsc delta). It cannot invent the other two: the **goal gate**
+(`$(cycle.demo.command)`) lives in the cycle and the **promise oracle**
+(`do-prove.sh <slug>`) needs the slug. Without those flags both come back
+`unrun`, which by the law above makes the verdict RED — so a bare run can never
+green a cycle whose goal gate never executed. Supply them.
+
+Measured 2026-09-01: **1.3s with a warm `do-reconcile.sh types` cache**; the
+first run after any tree change pays a cold `tsc --noEmit` (minutes, and it may
+queue behind `gate-run.sh`). `--self-test` drives the surface-checklist gate
+green → red → green and the goal gate unrun → pass → fail, so both are proven
+able to move in both directions.
+
+**Who scores the verdict.** The gates are bash and need no model. Only the
+rubric verdict does — and `w4-rubric.ts` cannot supply `goal-fit`, the one hard
+gate (see the note below). The **conductor** scores it, inline, from the
+evidence pack + the todo's `outcome:` line. Not a spawned agent: the conductor
+is already in context, so the verdict costs no fresh 28.9KB prompt. Not W3
+either — an executor grading its own edit is self-grading, which the
+verify-before-mark law forbids. **The verdict may only LOWER the outcome, never
+raise a `fail`/`unrun` to a pass.** Spawn `w4-verify` only for the taste gate on
+a UI-heavy cycle, or when the conductor's own context is exhausted.
+
+The full gate list — this remains the contract. `do-w4-gates.sh` runs all of it
+except the two the caller supplies (`--demo`, `--slug`), and reports those
+`unrun` when it is not given them:
 ```bash
 ( cd $folder && bun run verify )            # biome + tsc + vitest
 $(cycle.demo.command)                       # the goal gate — exit 0 = pass
@@ -387,8 +417,17 @@ if command -v gitleaks >/dev/null; then gitleaks detect --no-git --source . --re
 if git diff HEAD --name-only | grep -qE '(bun\.lock|package\.json)$'; then bun audit --audit-level moderate || exit 1; fi  # dep audit (only when deps moved)
 # do-auto.sh runs the same _secret_gate before every per-cycle commit — the secret never lands on the branch.
 
-# SURFACE LAYER VERIFICATION (the missing piece)
-if [ -f .w2-surface-checklist.json ]; then
+# SURFACE LAYER VERIFICATION — checklist is mandatory. W2 always writes
+# .w2-surface-checklist.json: either the surface layers, or {"surface":"none","reason":"..."}
+# (an explicit, auditable "no user-visible surface, because X"). Missing file = W4 FAIL —
+# a forgotten checklist is exactly the cycle where W2 forgot the UI, so the gate must not vanish.
+if [ ! -f .w2-surface-checklist.json ]; then
+  echo "W4 FAIL: .w2-surface-checklist.json missing — W2 must declare surfaces or surface:none+reason" >&2
+  exit 1
+fi
+if [ "$(jq -r '.surface // empty' .w2-surface-checklist.json)" = "none" ]; then
+  [ -n "$(jq -r '.reason // empty' .w2-surface-checklist.json)" ] || { echo "W4 FAIL: surface:none without a reason" >&2; exit 1; }
+else
   jq -r '.surfaces[] | select(.nav_entry) | .nav_entry' .w2-surface-checklist.json | while read -r route; do
     grep -q "path:.*$route" src/lib/navigation.ts || exit 1  # route registered
   done
@@ -402,10 +441,10 @@ if [ -f .w2-surface-checklist.json ]; then
     grep -q "export.*from.*$export" packages/sdk/src/index.ts || exit 1
   done
   jq -r '.surfaces[] | select(.mcp_tool) | .mcp_tool' .w2-surface-checklist.json | while read -r tool; do
-    grep -rq "$tool" packages/mcp/src/tools/index.ts || exit 1    # tool registered
+    grep -rq "$tool" packages/mcp/src/index.ts || exit 1          # tool registered
   done
   jq -r '.surfaces[] | select(.cli_verb) | .cli_verb' .w2-surface-checklist.json | while read -r verb; do
-    grep -rq "$verb" packages/cli/src/commands/index.ts || exit 1 # verb registered
+    grep -rq "$verb" packages/cli/src/index.ts || exit 1          # verb registered
   done
 fi
 # RECONCILES gate: per-category reconcile calls
@@ -416,6 +455,7 @@ do-reconcile.sh sdk         <file>          # GATEWAY tasks — joins a receiver
 do-reconcile.sh navigation  <surface>       # SURFACE tasks — registered + ≥1 inbound link
 do-reconcile.sh design      <file>          # SURFACE tasks — composes shadcn/tokens
 do-reconcile.sh authority   <file>          # GATEWAY tasks — walk-up resolves, no ad-hoc role bypass, no slug/workspace-from-request without authorizeWorkspace() (IDOR)
+bash .claude/scripts/do-consumer-sweep.sh --exec $(git diff HEAD --name-only)  # sweep every changed public surface's consumers (SDK/schema/receivers)
 # PROMISE CHECK (verify shipped feature matches text/<slug>.md promise)
 if [ -f "text/$(cycle.slug).md" ]; then
   # Cycle demo must prove the observable from text/<slug>.md exists
@@ -425,20 +465,27 @@ fi
 # TEACH tasks: do-reconcile.sh dictionary + do-reconcile.sh types on doc files
 DELTA_TSC=$((TSC_NOW - TSC_BASELINE))       # hard gate: ≤ 0, no new type errors ever
 ```
-Rubric (inline for TRIVIAL/SIMPLE; for COMPLEX — run the SDK script first (6 Haiku in parallel, rubric + spec block cached across all calls):
+Rubric (inline for TRIVIAL/SIMPLE; for COMPLEX — run the SDK script first: **one** OpenRouter Haiku call over the diff, scoring the 5 task axes):
 ```bash
 bun .claude/scripts/w4-rubric.ts --files "$(git diff HEAD --name-only | tr '\n' ',')"
 ```
-Script exits 2 if key absent → fall back to spawning 6 Haiku agents · medium. Either path runs alongside `pr-review-toolkit` (code-reviewer, silent-failure-hunter, type-design-analyzer) + `find-bugs` + `accessibility` on UI):
+Script exits 2 if `OPENROUTER_API_KEY` is absent → the conductor scores the axes itself from the `do-w4-gates.sh` receipt (append `{"cycle":"C<n>","wave":"W4","model":"conductor","ts":"<iso>"}` to `$WT/.do-census.jsonl`). Spawning a fan of Haiku graders is the *last* resort, not the default — six spawns to score one diff is the cost this section exists to remove. Either path runs alongside `pr-review-toolkit` (code-reviewer, silent-failure-hunter, type-design-analyzer) + `find-bugs` + `accessibility` on UI):
 ```
 composite = 0.30·goal-fit + 0.18·security + 0.18·stability + 0.12·simplicity + 0.12·integration + 0.10·speed
 gate: composite ≥ 0.65  AND  goal-fit ≥ 0.50 (hard)  AND  no adversarial > 0.5  AND  delta_tsc ≤ 0
 ```
-**Integration is scored deterministically** — from `.w2-surface-checklist.json` (nav entry registered · inbound links present · SDK/MCP/CLI exports wired) + the `do-reconcile.sh sdk|navigation|docs` results: fraction of declared surfaces verified. Pass it to the rubric as `w4-rubric.ts --integration=0.NN`; only when no checklist exists does the LLM score it from the diff. The surface hard gates above still block independently — the score makes the axis *compound* (mark amount, `s:integration` signal), the gates make it *mandatory*.
+Weights and axis definitions are data, not prose — `.claude/scripts/rubric-weights.json` (`cycle` block) is the single source; the line above is a readable copy of it.
+
+> **`w4-rubric.ts` supplies the five code axes, not this verdict.** It computes the `task` rubric and prints `task-composite=` — five axes, no goal-fit, because a bare diff has no plan context. **W4 scores goal-fit itself** (against the todo's `outcome:` line) and applies the `≥ 0.50` hard gate; the script cannot. Take its axis scores, add goal-fit, recompute with the `cycle` weights. Its exit code is a task-rubric verdict — never the cycle's.
+**Integration is scored deterministically** — from `.w2-surface-checklist.json` (nav entry registered · inbound links present · SDK/MCP/CLI exports wired) + the `do-reconcile.sh sdk|navigation` results: fraction of declared surfaces verified. Pass it to the rubric as `w4-rubric.ts --integration=0.NN`; only when the checklist declares `surface:"none"` (with its reason) is integration scored from the diff — an *absent* checklist is a W4 fail, never a fallback. The surface hard gates above still block independently — the score makes the axis *compound* (mark amount, `s:integration` signal), the gates make it *mandatory*.
 **Taste gate (UI-heavy cycles only).** When a cycle's deliverable is primarily a component/page, the design canon checks composition (shadcn/tokens) but not whether the result is *good*. Spawn one Fable verdict — fed the screenshot/render + the surface checklist, returning keep / refine / reject with one sentence why. Counts toward the simplicity score; reject → W3.5. Skipped for internal-only or non-UI cycles.
 
 Verify scope is the **dependency cone** of `git diff` (full verify only at cycle close — speed). Then compress sweep (ts-prune + noUnusedLocals → delete orphans/dead code), write `.w4-improvements.json`, and fire one pre-warm Haiku at the next cycle's W1 targets. Verify or demo failure on touched files → W3.5 (one Sonnet per dirty file), max 3 W4 loops then halt.
 
+**in-wave-race.** Parallel W3a agents editing disjoint files can still race the type checker: agent A creates `foo.ts` while agent B, in the same wave, writes an import of it — if B's `tsc` snapshot runs before A's file lands on disk, B sees a false `TS2307: Cannot find module`. A TS2307 whose missing specifier resolves to a file listed in another SAME-WAVE diff spec is classified `in-wave-race`: re-run `tsc` once after all wave agents settle; only a persisting error fails the cycle. This is a same-wave-only allowance — a TS2307 pointing at a file no diff spec in this wave creates is a real missing-file error, not a race.
+
+Consumer sweep runs alongside RECONCILES: `do-consumer-sweep.sh` maps a changed public surface (SDK export, schema, receiver) to the commands that prove its consumers still build — `packages/sdk/src/` → cli test + mcp typecheck, `schema/one.tql` → SDK codegen diff-clean, `packages/sdk/src/receivers.ts` → the surfaces vitest suite. A sibling consumer broken by this cycle's surface change fails here, not three cycles later when someone else's build goes red for no visible reason.
+
 **Testing policy** (full detail in `text/templates-plan.md` § Todo doctrine): Vitest-first; Playwright only when the cycle declares `requires_playwright: true`; one goal-based `expect()` per deliverable (assert the destination, not the path); ≤1 test file per cycle; a cycle needing >5 tasks splits unless `mode: lean`; N-variant split-test → winner `mark()`, losers `warn(0.5)`.
 
 ---
@@ -478,6 +525,7 @@ PATCH clears {1, 3, 11, 12}. FIX clears {1, 2, 3, 4, 11, 12}. FEATURE clears all
 - **Closed loop** — every cycle ends in `mark`/`warn`, never a silent return.
 - **Cheapest tool that decides wins** — a phase that needs no LLM call is the best kind.
 - **Arm the kill-switch.** The plan `outcome:` command must exit non-zero at PLAN close, before the first cycle. An outcome that passes before the work starts gates nothing.
+- **Correct-course, don't silently absorb.** A discovery that widens blast radius, breaks a promise assumption, or drifts the goal gets sized (PATCH/FIX/FEATURE) and logged in a `## Correct-course` block on the todo/plan — never quietly folded into the current cycle's diff unremarked.
 - **W4 max 3 loops**, then halt and report.
 - **One command.** A human types `/do <anything>` and nothing else. Complexity sizing, spine pruning, and (for multi-cycle plans) the context-isolated loop are all automatic — never a flag, never a second command.
 - **Every cycle gets a fresh context.** A multi-cycle `/do` runs each cycle in a clean subprocess via the internal loop. Prior-cycle conversation is noise; the todo checkboxes are the only state that carries forward.
@@ -487,13 +535,15 @@ PATCH clears {1, 3, 11, 12}. FIX clears {1, 2, 3, 4, 11, 12}. FEATURE clears all
 
 ## Available to /do — the toolbox
 
-**Scripts** (`.claude/scripts/`): `do-auto.sh` (*internal* — the context-isolated, worktree-isolated loop `/do` drives for multi-cycle plans; builds on branch `do/<slug>`, merges to trunk only on a human's say-so; writes a zero-LLM merge digest (`.do-digest.md`) at plan-complete so the human merges informed, not blind; conductor pinned `--model sonnet`; syncs trust/improvements back to main tree every iteration; `--gc` sweeps merged worktrees; **`--setup-only` cuts+links the worktree and prints its path then exits — the seam the inline single-cycle/PATCH/FIX path uses to build in a worktree without the subprocess loop**) · `do-tier.sh` (tier + pruned spine + classifier + ceiling) · `do-folder.sh` (folder-aware verify/build) · `do-survey.sh` (reuse verdict) · `do-reconcile.sh <canon>` (**one predicate over 7 canons** — `substrate|dictionary|authority|sdk|design|navigation|types` — subsumes the old RECONCILE, COMPRESS, PROMISE-CHECK, DOC-SYNC gates; `navigation` branch enforces surface reachability; `--self-test` drives fixtures) · `do-analyze.sh` (deliverable↔cycle coverage gate) · `do-prove.sh` (surface-detect proof — pure PROVE, promise-check moved into `do-reconcile.sh design`) · `do-promise-settle.sh <slug> [--composite 0.NN]` (zero-LLM promise settle at close — re-runs the promise's `proof:`; kept → `mark` on `promise:<slug>→proof` + `world:announce`, broken → `warn`, no observable → dissolved; `--self-test` drives kept/broken/dissolved fixtures; thesis `text/marketplace.md`) · `do-smoke.sh` (deterministic outcome — drives ≥1 fixture per canon branch + orphan/reachable nav fixtures) · `w1-recon.ts` (prompt-cached recon) · `w4-rubric.ts` (cached parallel rubric).
+**Scripts** (`.claude/scripts/`): `do-auto.sh` (*internal* — the context-isolated, worktree-isolated loop `/do` drives for multi-cycle plans; builds on branch `do/<slug>`, merges to trunk only on a human's say-so; writes a zero-LLM merge digest (`.do-digest.md`) at plan-complete so the human merges informed, not blind; conductor pinned `--model sonnet`; syncs trust/improvements back to main tree every iteration; `--gc` sweeps merged worktrees; **`--setup-only` cuts+links the worktree and prints its path then exits — the seam the inline single-cycle/PATCH/FIX path uses to build in a worktree without the subprocess loop**) · `do-tier.sh` (tier + pruned spine + classifier + ceiling) · `do-folder.sh` (folder-aware verify/build) · `do-survey.sh` (reuse verdict) · `do-reconcile.sh <canon>` (**one predicate over 7 canons** — `substrate|dictionary|authority|sdk|design|navigation|types` — subsumes the old RECONCILE, COMPRESS, PROMISE-CHECK, DOC-SYNC gates; `navigation` branch enforces surface reachability; `--self-test` drives fixtures) · `do-analyze.sh` (deliverable↔cycle coverage gate) · `do-prove.sh` (surface-detect proof — pure PROVE, promise-check moved into `do-reconcile.sh design`; **landing rule** — a `--route` counts as proven only if the run ended on the path requested, so a signed-out `/u/<slug>/*` bouncing to `/signin` fails instead of scoring the sign-in page green; acquires a dev session itself against a localhost base, `PROVE_SESSION_COOKIE` overrides) · `do-promise-settle.sh <slug> [--composite 0.NN]` (zero-LLM promise settle at close — re-runs the promise's `proof:`; kept → `mark` on `promise:<slug>→proof` + `world:announce`, broken → `warn`, no observable → dissolved; `--self-test` drives kept/broken/dissolved fixtures; thesis `text/marketplace.md`) · `do-smoke.sh` (deterministic outcome — drives ≥1 fixture per canon branch + orphan/reachable nav fixtures) · `w1-recon.ts` (prompt-cached recon) · `w4-rubric.ts` (cached parallel rubric).
+
+**Workflows** (`.claude/workflows/`): `one-loop.js` (`/do turn` — one wavefront company turn; phase-pinned model ladder Sense=haiku · Pick=opus/fable-on-anomaly · Execute=pick-assigned per move · Verify=haiku skeptics · Close=sonnet; contract `text/one-loop.md`, log `text/loop-log.md`, state `text/loop-state.json`) · `do-engine` (per-wave model+effort plan runner, `text/do-engine-plan.md`).
 
 **Templates**: `text/template-feature.md` (promise/PROMISE — uncomment its `contract:` block for a contract-backed promise that mints on-chain, worked example `text/playbook.md`) · `text/template-plan.md` (design + pre-mortem + decisions/DESIGN) · `text/template-todo.md` (plan + parallel budget + testing policy/PLAN) · `text/template-agent.md` (agent definition/BUILD).
 
 **Agents**: `w1-recon` · `w2-decide` (spawned single Opus; carries the full W2 contract — compress check, Interface Contract pin, maximal batch DAG) · `w3-edit` · `w4-verify` · `Explore` · `Plan` · `pr-review-toolkit:*` (code-reviewer, silent-failure-hunter, type-design-analyzer, pr-test-analyzer, code-simplifier) · `find-bugs`.
 
-**Skills** (per-stage routing in `text/templates-plan.md`): PROMISE → `docs`, `writer`, `copywriting` · DESIGN → `docs`, `typedb`, `signal`, `frontend-design` (if UI) · BUILD → `astro`, `react19`, `shadcn`, `ai-ui`, `ai-sdk`, `sdk`, `mcp`, `cli`, `reactflow`, `hono`, `cloudflare`, `wrangler`, `durable-objects` · TEST → `vitest`, `playwright-best-practices`, `webapp-testing` · VERIFY → `accessibility`, `find-bugs`, `perf`, `typecheck` · TEACH → `docs`, `writer`.
+**Skills** (per-stage routing in `text/templates-plan.md`): PROMISE → `docs`, `writer`, `copywriting` · DESIGN → `docs`, `typedb`, `signal`, `frontend-design` (if UI) · BUILD → `astro`, `react19`, `shadcn`, `ai-ui`, `reactflow`, `puck` (page-shaped deliverables route through the Puck page editor / views registry — `one.ie/web/src/lib/views/registry.ts` — not hand-rolled pages), `ai-sdk`, `sdk`, `mcp`, `cli`, `hono`, `cloudflare`, `wrangler`, `durable-objects` · TEST → `vitest`, `playwright-best-practices`, `webapp-testing` · VERIFY → `accessibility`, `find-bugs`, `perf`, `typecheck` · TEACH → `docs`, `writer`.
 
 **Skill-per-layer routing (W3 surface build order):** schema → `typedb` · types → `sdk` · API route → `ai-sdk` · receiver/SDK → `sdk` · MCP tool → `mcp` · CLI verb → `cli` · component/page → `react19` + `shadcn` · docs → `writer`. W3 loads the layer's skill before editing; missing/stale (>30d) → `/skill-creator` first (contract: `text/skill-invocation.md`).
 

package/commands/fast.md

@@ -0,0 +1,67 @@
+---
+description: /fast — write the page, look at it, iterate. No tests.
+---
+
+# /fast — page-building mode
+
+`/fast <what to build or change>`
+
+For UI work where the loop is **edit → render → look → edit**. Tests, ratchets,
+reconcile canons and the /do spine are all OFF. Nothing is committed, nothing is
+deployed, nothing is promised.
+
+Use when: building or tweaking a page, component, layout, or copy and you want
+to see it in a browser now.
+
+Do NOT use when: touching `schema/`, `packages/sdk/`, auth/authority code, or
+anything with a money path. Those take the normal lane — say so and stop.
+
+## The loop
+
+**0 — server up (once).** Reuse it for every later iteration.
+```bash
+curl -sf -o /dev/null http://localhost:4321 && echo UP || echo DOWN
+```
+DOWN → start it in the background and move on:
+```bash
+cd /Users/toc/Server/one-ie/one.ie/web && bun run dev
+```
+(run_in_background: true). If the port is wedged, `/restart`.
+
+**1 — edit.** Write the code. Match the surrounding file's idiom. Rules under
+`.claude/rules/` (astro/react/ui/design) still apply — they are how the page
+comes out right the first time, not a gate.
+
+**2 — look.** Astro HMRs; no rebuild needed.
+```bash
+node .claude/scripts/chrome.mjs --url http://localhost:4321/<path> --screenshot /tmp/fast.png
+```
+Then Read `/tmp/fast.png`. Read the screenshot yourself before saying it works —
+`httpStatus: 200` is not a rendered page.
+
+**3 — read the errors.** chrome.mjs returns `jsErrors` and `consoleErrors`.
+A non-empty either one means broken, even if the shot looks fine. Fix, re-shoot.
+
+**4 — repeat** from 1 until it looks right.
+
+## What is skipped, and what is not
+
+| Skipped | Kept |
+|---|---|
+| `bun run verify` / `verify:fast` | the TypeScript the editor already shows you |
+| vitest, ratchets, honesty checks | design + a11y rules under `.claude/rules/` |
+| do-reconcile canons | never inventing a receiver — `grep` it in `packages/sdk/src/receivers.ts` first |
+| the /do spine, promises, TEACH | never editing schema/SDK/auth in this mode |
+| commit, push, deploy | |
+
+## Exit
+
+Fast mode ends the moment the page is right. Before the work is committed or
+merged, run the real gate once:
+
+```bash
+cd /Users/toc/Server/one-ie/one.ie/web && bun run verify:fast
+```
+
+Say plainly which lane ran. **A page proven only by screenshot is not a tested
+page** — never report a `/fast` iteration as verified.