@open-agent-toolkit/cli 0.2.77 → 0.2.79

package/assets/agents/recon-worker.md

@@ -1,16 +1,17 @@
 ---
 name: recon-worker
-version: 1.0.1
+version: 1.0.2
 description: Executes one bounded recon packet assignment as a non-interactive leaf worker and writes exactly one declared artifact.
 tools: Read, Bash, Grep, Glob, Write, WebSearch, WebFetch
 color: cyan
+is_background: true
 ---
 
 ## Role
 
 You are a non-interactive recon leaf worker. Execute exactly one assignment in
-one declared mode: `map`, `gather`, `compile`, `verify`, `adversary`, `coverage`,
-or `reconcile`. No other mode is valid.
+one declared mode: `map`, `gather`, `compile`, `verify`, `adversary`, or
+`coverage`. No other mode is valid.
 
 The controller maps approved manifest waves to this closed vocabulary:
 
@@ -22,7 +23,6 @@ The controller maps approved manifest waves to this closed vocabulary:
 | `semantic-verification`    | `verify`               |
 | `adversarial`              | `adversary`            |
 | `coverage`                 | `coverage`             |
-| `reconciliation`           | `reconcile`            |
 | `redundant-gather`         | `gather`               |
 | `redundant-verification`   | `verify`               |
 | `contradiction-resolution` | `adversary`            |
@@ -75,7 +75,9 @@ canonical claim status.
 
 Consume only the designated dossiers. Deduplicate their findings into a
 provisional claim-ledger candidate and cite direct input artifacts. Do not
-reopen excluded sources or invent evidence.
+reopen excluded sources or invent evidence. Every persisted display excerpt
+must be an exact contiguous substring of the cited source, except for the
+declared `redacted-exact` representation.
 
 ### `verify`
 
@@ -99,13 +101,6 @@ Compare the declared scope and questions with the permitted ledger projection.
 Emit covered items, missing areas, and material gaps. Do not read gatherer
 reasoning.
 
-### `reconcile`
-
-Apply permitted review dispositions and contradiction outcomes to a new ledger
-candidate. Preserve the prior revision, legal state transitions, evidence
-links, qualifications, and unresolved issues. Never invent evidence or update
-the existing ledger in place.
-
 ## Output
 
 Write one JSON artifact using only the supplied closed schema's fields. A
@@ -121,6 +116,11 @@ Do not add a second mode field or any other unknown field. The controller
 validates `waveId` and `mode`, or `reviewerLane` and `reviewKind`, against the
 approved manifest wave before promoting the artifact.
 
+Before returning, run the supplied deterministic validator against the sole
+unpromoted `writePath`. Correct an invalid candidate within this same accepted
+task and validate it again. If it remains invalid, return terminal
+`PASS_FAILED`; the controller must not retry or replace the worker.
+
 Return only the artifact path and compact outcome. Do not return source bodies,
 worker reasoning, or dossier contents to the controller.
 

package/assets/bundle-metadata.json

@@ -1,4 +1,4 @@
 {
   "schemaVersion": 1,
-  "oatVersion": "0.2.77"
+  "oatVersion": "0.2.79"
 }

package/assets/docs/workflows/skills/recon.md

@@ -69,19 +69,21 @@ context source, output directory, or strict authority:
 The default profile is `standard`. Each homogeneous wave has an independently
 selected and approved exact target. Bounded mapping, extraction, citation
 reopening, counterexample search, and mechanical dossier compilation start with
-economical qualified routes. A wave that genuinely requires interpretation or
-reconciliation judgment can use a stronger approved target without raising the
-cost of unrelated evidence waves.
+economical qualified routes. Reconciliation is deterministic controller work
+rather than a separately approved worker target.
 
 | Profile    | Use it for                                  | Required assurance work                                                                                            | Claim ceiling |
 | ---------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------- |
 | `quick`    | Bounded orientation                         | Mapping, gathering, compilation, schema validation, and locator validation; no independent semantic pass by design | `supported`   |
-| `standard` | Load-bearing evidence                       | Quick work plus blind semantic verification, adversarial review, coverage, and reconcile                           | `verified`    |
+| `standard` | Load-bearing evidence                       | Quick work plus blind semantic verification, adversarial review, coverage, and deterministic reconciliation        | `verified`    |
 | `thorough` | Expensive failure or correlated blind spots | Standard work plus required redundant gathering and redundant verification                                         | `verified`    |
 
 A thorough run may additionally predeclare an optional, condition-bound
 `contradiction-resolution` evidence wave. It runs only when its approved
 predicate triggers and is not required when that branch is not triggered.
+Gather and redundant-gather waves may partition source work across lanes. Each
+typed review wave uses exactly one lane so deterministic reconciliation has one
+result per review kind, at the fixed path bound by the approved manifest.
 
 The approval manifest shows each wave's exact target, task class, class floor,
 selection rationale, adaptive lane count, conditional rule, concurrency,
@@ -93,11 +95,16 @@ change requires renewed approval; there is no silent substitution after
 approval.
 
 Before any worker launches, recon confirms that the live launch surface can run
-the approved role, model, effort, and authority level. If it cannot, the run
-stays at `awaiting-approval` with a provider/dispatch diagnostic and nothing is
-launched. Deadlines are approved execution limits chosen for the task class,
-not short watchdogs; an accepted lane is never interrupted by hand because a
-displayed deadline elapsed.
+the approved role, model, effort, and authority level. A materialized Cursor
+role file is configuration, not evidence that the current Task catalog exposes
+that role; the live catalog controls eligibility, with the approved generic
+fallback used when needed. If the launch surface cannot run the selected
+target, the run stays at `awaiting-approval` with a provider/dispatch diagnostic
+and nothing is launched. Every Cursor leaf runs in the background so later
+parent-chat messages cannot interrupt multi-minute evidence work. Deadlines are
+approved execution limits chosen for the task class, not short watchdogs; an
+accepted lane is never interrupted by hand because a displayed deadline
+elapsed.
 
 ### Preview and Check Routing
 
@@ -117,29 +124,30 @@ compare the constructed target with that wave's approved exact target:
 node .agents/skills/recon/scripts/prepare-routing.mjs --manifest manifest.json --wave gather-1 --check-target candidate-target.json
 ```
 
-These commands validate structure, approval integrity, and exact identity. They
-do not launch a worker, rank model names, attest actual runtime identity, or
-measure cost.
+These commands validate structure, approval integrity, and exact identity. Like
+the other recon command-line helpers, they use a shared realpath-aware entry
+check, so direct and symlinked invocations execute identically. They do not
+launch a worker, rank model names, attest actual runtime identity, or measure
+cost.
 
 ### Bounded Conditional Evidence
 
-Standard and thorough may predeclare finite conditional
-`contradiction-resolution` evidence waves. A completed predecessor can trigger
-one such wave to seek discriminating evidence; accepted failure, cancellation,
+Standard and thorough may each predeclare at most one conditional
+`contradiction-resolution` evidence wave. A completed predecessor can trigger
+that wave to seek discriminating evidence; accepted failure, cancellation,
 timeout, or missing output cannot trigger a replacement. Triggered,
 not-triggered, and unresolved dispositions remain visible. Both branches feed
-the same single mandatory terminal reconciliation.
+the same deterministic controller reconciliation.
 
 A triggered condition must cite complete, digest-bound evidence from an approved
 predecessor in the same run. Evidence copied from another run cannot activate
 the destination wave and fails packet validation with
 `CONDITION_EVIDENCE_RUN_MISMATCH`.
 
-If a need for stronger reconciliation judgment is foreseeable, select that one
-terminal target before approval. If it appears only after approval, recon
-preserves completed evidence and returns an unresolved, out-of-envelope gap for
-renewed approval or a new run. It never mutates the target, silently retries,
-or launches a second reconciliation.
+If reconciliation exposes a need for new semantic judgment, recon preserves
+completed evidence and returns an unresolved, out-of-envelope gap for renewed
+approval or a new run. It never converts deterministic reconciliation into a
+worker wave or silently retries an accepted worker.
 
 ## Destination Precedence
 
@@ -173,8 +181,8 @@ non-publishable candidate generation withdraws any existing `packet.md`:
 - `claims.json` is the canonical claim ledger.
 - `manifest.json` records request, source, approved execution envelope, and
   gap provenance.
-- `reviews/` contains compact semantic, adversarial, coverage, and
-  reconciliation evidence.
+- `reviews/` contains compact semantic, adversarial, coverage, and the
+  controller-produced reconciliation record.
 - `raw/` contains worker dossiers, candidate artifacts, and safe failure
   diagnostics. It is not normal consumer input.
 
@@ -198,6 +206,20 @@ ledger must reference every completed primary and redundant gather dossier by
 exact path and digest before review briefs are created. Missing provenance fails
 with `MISSING_THOROUGH_GATHER_LEDGER_INPUT`.
 
+Compile workers copy each evidence excerpt as one contiguous exact substring of
+the reopened source. A source-required redaction may replace only the sensitive
+span while preserving the surrounding bytes and recording the redaction. Recon
+does not repair stale locators after compilation. Each accepted worker validates
+its own closed artifact schema once, within the same accepted task, before
+returning. An invalid accepted artifact is terminal; the controller neither
+retries the schema nor substitutes another worker.
+
+When an accepted lane has already written a schema-valid, lane-matching artifact
+at its approved path, that durable artifact remains the result even if the
+provider stream later closes with an error. Recon records the stream failure as
+a provider diagnostic and does not relaunch the lane. A missing or invalid
+artifact remains a failed pass.
+
 The ledger compiler and packet validator enforce categorical referential
 integrity on `synthesis.keyClaimIds` and `synthesis.unresolvedQuestionIds`. Any
 reference to an unknown claim or question ID fails validation with
@@ -228,10 +250,14 @@ the caller assesses sufficiency and conclusions. Stronger profiles can promote
 claims only when their required independent review artifacts validate and were
 written by approved lanes.
 
-When an independent semantic review rejects a proposed claim, the reconciler
-transitions it to `unsupported` rather than deleting it. This preserves the
-claim statement, cited evidence, and transition history in `claims.json`, and
-renders the finding under Contradictions and Qualifications.
+When an independent semantic review rejects a proposed claim, deterministic
+controller reconciliation transitions it to `unsupported` rather than deleting
+it. The controller validates the digest-bound input ledger and required review
+set, writes `raw/drafts/claims-v2.json` and
+`reviews/reconciliation.json`, validates both, then atomically promotes the
+candidate ledger to `claims.json`. This preserves the claim statement, cited
+evidence, and transition history and renders the finding under Contradictions
+and Qualifications.
 
 An adversarial challenge transitions a claim to `contested`. A run with
 contested claims may publish as `complete` when all declared questions and

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.2.77",
-  "docs-config": "0.2.77",
-  "docs-theme": "0.2.77",
-  "docs-transforms": "0.2.77"
+  "cli": "0.2.79",
+  "docs-config": "0.2.79",
+  "docs-theme": "0.2.79",
+  "docs-transforms": "0.2.79"
 }

package/assets/skills/recon/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Glob, Grep, Bash, AskUserQuestion, Agent, mcp__*
 metadata:
-  version: 1.1.3
+  version: 1.1.5
 ---
 
 # Recon
@@ -127,8 +127,8 @@ Use the complete mode policy from `references/profiles.md` and
 `scripts/lib/routing.mjs`. Map manifest wave modes to the worker's closed
 assignment vocabulary: `redundant-gather` to `gather`;
 `semantic-verification` and `redundant-verification` to `verify`; `adversarial`
-and `contradiction-resolution` to `adversary`; and only `reconciliation` to
-`reconcile`. The remaining modes keep their same-named assignment. All lanes
+and `contradiction-resolution` to `adversary`. The remaining worker modes keep
+their same-named assignment; reconciliation is controller-owned. All lanes
 within one launch are a homogeneous wave. Select each wave independently; a
 stronger wave never raises unrelated waves' targets or effort.
 
@@ -164,9 +164,14 @@ task class and class floor. Preserve provider, route, role, model, effort,
 reasoning mode, and service tier as separate provider-native axes. A null axis
 means the adapter exposes no independently requested control; never translate
 effort between harnesses or normalize an opaque selector. Prefer the canonical
-`recon-worker` role. If that role is unavailable, plan the generic role with the
-complete worker contract as a visible generic role fallback before approval. A
-fallback after approval is forbidden.
+`recon-worker` role only when the current live Task catalog exposes it. A
+materialized `.cursor/agents/recon-worker.md` file proves installation, not that
+the current Cursor Task catalog can launch the role. If the role is absent from
+that observed catalog, plan the generic role with the complete worker contract
+as a visible generic role fallback before approval. A fallback after approval
+is forbidden. Every Cursor recon leaf, including that generic fallback, must be
+launched as a background task so a new parent-chat message cannot turn parent
+turn interruption into an apparent worker crash.
 
 Prepare a `schemaVersion: 2` draft manifest. Its execution object contains a
 complete inherited `target`, limits, waves, conditions, and later the approval.
@@ -218,7 +223,8 @@ result. If any approved axis cannot be satisfied, stop with a
 launch nothing. Never substitute a different axis to make the launch fit.
 
 Launch each wave through the dispatch dependency with exactly the approved
-axes. Immediately before each launch, check the constructed target through the
+axes. On Cursor, launch both the custom worker role and the pre-approved generic
+fallback in the background. Immediately before each launch, check the constructed target through the
 same production helper used by preview:
 
 ```bash
@@ -235,13 +241,22 @@ approved `waveId` and `laneId`. This structured identity is required for
 conditional and non-conditional lanes alike; prose is descriptive, not
 identity.
 
+Worker completion is decided from the approved-path artifact before interpreting
+a later provider transport error. When the artifact's identity, closed schema,
+bytes, and digest validate, the lane is complete; a subsequent stream-close or
+RPC error is recorded as a non-material diagnostic and never triggers a
+replacement launch. Missing or invalid output remains a terminal `PASS_FAILED`
+outcome with no retry or replacement.
+
 Run the passes in this order:
 
 1. `map` and `gather` workers write unique dossiers under `raw/dossiers/`.
    Thorough runs complete their independent `redundant-gather` wave here too.
 2. `compile` writes a candidate canonical claim ledger. A thorough candidate
    directly references a complete dossier from every approved primary and
-   redundant gather lane before any review brief is created.
+   redundant gather lane before any review brief is created. Every display
+   excerpt is an exact contiguous substring of its cited source, apart from the
+   declared `redacted-exact` representation; paraphrase is invalid evidence.
 3. Source preflight: run `scripts/validate-artifact.mjs` on the candidate
    manifest and ledger, then reopen every declared source and evidence locator
    with the checks in `scripts/validate-packet.mjs`. Resolve source roots to
@@ -251,23 +266,26 @@ Run the passes in this order:
    manifest and ledger pair validates.
 4. Profile-required `verify`, `adversary`, and `coverage` workers consume only
    immutable selectively blind briefs created by
-   `scripts/create-review-brief.mjs` at unique paths.
+   `scripts/create-review-brief.mjs` at unique paths. Each review-producing
+   wave has exactly one lane; partition source or question fan-out in the
+   applicable gather wave instead.
 5. Evaluate each predeclared evidence condition only after its completed
    predecessor artifacts exist. Record exactly one root-authored condition
    outcome. A triggered `contradiction-resolution` wave runs once as an
    `adversary` evidence assignment; a not-triggered or unresolved wave supplies
    no artifact. Accepted failure, cancellation, timeout, or missing output never
    authorizes replacement work.
-6. Standard and thorough execute exactly one terminal `reconciliation` wave,
-   mapped to `reconcile`, after required review evidence and any triggered
-   contradiction investigation. It writes a new candidate ledger without
-   mutating the prior ledger.
-
-If `reconciliation-needs-judgment` is foreseeable, select an adequate target
-for that one terminal wave before approval. If it appears after approval and
-the approved target is inadequate, preserve completed evidence and return an
-explicit unresolved, out-of-envelope gap for renewed approval or a new run.
-Never mutate the target, launch a second reconciliation, or substitute a
+6. Standard and thorough run one deterministic controller reconciliation after
+   required review evidence and any triggered contradiction investigation. The
+   controller invokes `scripts/reconcile-ledger.mjs` once using the manifest's
+   `execution.reconciliation` paths and literal producer
+   `controller:reconcile-ledger-v1`, validates both candidate outputs, copies
+   the exact ledger bytes to a packet-contained temporary file, and atomically
+   renames it to `claims.json`. No reconciliation worker is dispatched.
+
+If reconciliation requires new semantic judgment, preserve completed evidence
+and return an explicit unresolved caller-owned gap. Never mutate the target or
+substitute a
 contradiction search for synthesis.
 
 Use `references/worker-contract.md` for every assignment. Never allow two

package/assets/skills/recon/references/packet-contract.md

@@ -125,18 +125,21 @@ condition contains `conditionId`, `destinationWaveId`, `afterWaveIds`, one of
 `insufficient-evidence` or `unresolved-material-challenge`, and
 `maxActivations: 1`. Each conditional destination is a uniquely identified
 `contradiction-resolution` evidence wave, has exactly one condition, appears
-after every named predecessor and before the one terminal reconciliation, and
+after every named predecessor and before controller reconciliation, and
 owns unique lane IDs and write roots. Conversely, every wave marked
 `conditional: true` must be the destination of exactly one activating condition;
 dead conditional waves are invalid. Quick permits no conditional wave;
-standard permits one and thorough two. The profile's 4/10/20 adaptive-lane cap
+standard and thorough each permit one. The profile's 4/10/20 evidence-lane cap
 counts `gather`, `semantic-verification`, `adversarial`, `coverage`,
 `redundant-gather`, `redundant-verification`, and
 `contradiction-resolution` when those modes are permitted by the profile.
-Every permitted mode outside that counted set is fixed at exactly one lane:
-`map` and `compile` for quick, plus terminal `reconciliation` for standard and
-thorough. The resulting total lane maxima are 6/13/23, and concurrency remains
-capped at 4/6/8.
+Only `gather` and `redundant-gather` may partition a wave across multiple lanes.
+Every typed review wave and every permitted mode outside the counted set is
+fixed at exactly one lane, including `map` and `compile`. The resulting
+worker-lane maxima are 6/12/22, and concurrency remains capped at 4/6/8.
+Each review lane's approved write root must contain the corresponding fixed
+path in `execution.reconciliation`; a different approved root is invalid before
+launch.
 
 Triggered dispositions require exact complete same-run artifacts from every
 approved predecessor and concrete typed predicate evidence from those same-run
@@ -150,17 +153,14 @@ no achieved pass. Accepted failed, cancelled, timed-out, or missing predecessor
 work cannot activate replacement work. Required profile passes remain required
 regardless of conditional annotations.
 
-`reconciliation-needs-judgment` is a controller escalation outcome, never a
-condition predicate. Foreseeable judgment changes the one terminal target before
-approval. A need discovered later preserves completed work and records an
-unresolved out-of-envelope gap until renewed approval or a new run; it never
-mutates the approved target or launches a second reconciliation.
+`reconciliation-needs-judgment` is a caller-owned unresolved outcome, never a
+condition predicate or target escalation. The controller preserves completed
+work and records the gap; it never dispatches reconciliation work.
 
-The controller maps the ten manifest wave modes onto the worker contract's
-seven assignment modes: redundant gathering uses `gather`; semantic and
+The controller maps the nine manifest wave modes onto the worker contract's
+six assignment modes: redundant gathering uses `gather`; semantic and
 redundant verification use `verify`; adversarial and contradiction-resolution
-use `adversary`; and only terminal reconciliation uses `reconcile`. This mapping
-does not change the approved manifest mode used for artifact and pass checks.
+use `adversary`. Reconciliation is not a worker mode or approval target.
 
 Approval is `{ type: "explicit-user-approval", approvedAt }`. It is valid only
 for the exact proposal shown in the same uninterrupted controller flow. Resume,
@@ -183,7 +183,6 @@ complete typed artifacts of the same run:
 | `semantic-verification`    | a `recon.review-result` with kind `semantic`                              |
 | `adversarial`              | a `recon.review-result` with kind `adversarial`                           |
 | `coverage`                 | a `recon.review-result` with kind `coverage`                              |
-| `reconciliation`           | a `recon.review-result` with kind `reconciliation`                        |
 | `redundant-gather`         | a complete `gather` dossier owned by the approved `redundant-gather` wave |
 | `redundant-verification`   | a `recon.review-result` with kind `redundant-verification`                |
 | `contradiction-resolution` | a `recon.review-result` with kind `contradiction-resolution`              |
@@ -191,11 +190,11 @@ complete typed artifacts of the same run:
 `quick` requires `map` and `gather`; the canonical ledger itself is the
 compile result, so an approved `compile` lane needs no separate artifact, and
 locator validation is performed by the validator.
-`standard` adds `semantic-verification`, `adversarial`, `coverage`, and
-`reconciliation`. `thorough` adds `redundant-gather` and
+`standard` adds `semantic-verification`, `adversarial`, and `coverage`, then
+requires the manifest-bound controller reconciliation. `thorough` adds `redundant-gather` and
 `redundant-verification`. A predeclared conditional
 `contradiction-resolution` evidence pass may feed the same mandatory terminal
-reconciliation when its predicate triggers; it is not a second terminal pass.
+controller reconciliation when its predicate triggers.
 
 Thorough routing completes `redundant-gather` before `compile`. The compiled
 ledger must directly reference by exact path and digest at least one complete
@@ -346,17 +345,21 @@ branch; source ineligibility never bypasses persistence safety.
   claim/evidence associations, coverage findings, unresolved issues, and
   completion status. Every new evidence record has at least one exact
   association, and an association cannot name evidence absent from that result
-  or a claim without a disposition in that result. Reconciliation results
-  replace the brief reference with prior-ledger/revision, additions/removals,
-  exact transitions, and coverage-disposition bindings. Coverage findings are
-  closed records bound to affected claims and exact manifest gaps. Accepted
-  material gaps require a legal downgrade for every affected claim; a resolved
-  finding instead names exact typed evidence. Non-material coverage gaps
-  downgrade verified claims and transition provisional claims to unresolved,
-  while existing supported claims remain supported without verified promotion.
-  Thorough redundant verification and contradiction resolution are
-  claim-bearing typed review results, not raw dossiers: they bind immutable
-  briefs, claim dispositions, and explicit affected-contradiction dispositions.
+  or a claim without a disposition in that result.
+
+Every `unresolvedIssues` member is a string. Review results are closed objects:
+unknown fields and object-valued issue entries are invalid.
+Reconciliation results replace the brief reference with prior-ledger/revision,
+additions/removals, exact transitions, and coverage-disposition bindings.
+Coverage findings are closed records bound to affected claims and exact
+manifest gaps. Accepted
+material gaps require a legal downgrade for every affected claim; a resolved
+finding instead names exact typed evidence. Non-material coverage gaps
+downgrade verified claims and transition provisional claims to unresolved,
+while existing supported claims remain supported without verified promotion.
+Thorough redundant verification and contradiction resolution are
+claim-bearing typed review results, not raw dossiers: they bind immutable
+briefs, claim dispositions, and explicit affected-contradiction dispositions.
 
 Create immutable mode-specific review projections with
 `scripts/create-review-brief.mjs`. Verification briefs expose only claim

package/assets/skills/recon/references/profiles.md

@@ -28,19 +28,20 @@ claims are sufficient.
 Use for load-bearing evidence that needs independent semantic challenge.
 
 - Required: quick topology plus selectively blind semantic verification,
-  adversarial review, coverage review, and reconciliation.
-- Adaptive evidence lanes: `gather`, `semantic-verification`, `adversarial`,
+  adversarial review, coverage review, and deterministic controller reconciliation.
+- Counted evidence lanes: `gather`, `semantic-verification`, `adversarial`,
   `coverage`, and any predeclared `contradiction-resolution`; hard cap 10
-  across those counted modes. Required `map`, `compile`, and terminal
-  `reconciliation` waves are fixed at exactly one lane each, so the total
-  maximum is 13 lanes.
+  across those modes. `gather` may partition work across lanes. Every typed
+  review wave, plus required `map` and `compile`, is fixed at exactly one lane,
+  so the total maximum is 12 worker lanes.
+  One deterministic controller reconciliation follows.
 - Maximum concurrency: 6.
 - Assurance ceiling: `verified` only after exact locator validation, affirmative
   independent semantic review, no unresolved material challenge, and adequate
   coverage.
 - Conditional work: at most one predeclared `contradiction-resolution`
   evidence wave for a material challenge, followed when triggered or not by
-  the same one mandatory terminal reconciliation.
+  the same one mandatory controller reconciliation.
 
 ## thorough
 
@@ -51,17 +52,19 @@ reopening and verification.
   redundant verification for load-bearing claims. Redundant gathering finishes
   before compilation, and every completed primary or redundant gather lane is
   represented in the compiled ledger inputs before review briefs are created.
-- Adaptive evidence lanes: the standard counted modes plus `redundant-gather`
+- Counted evidence lanes: the standard counted modes plus `redundant-gather`
   and `redundant-verification`; hard cap 20 across those counted modes.
-  Required `map`, `compile`, and terminal `reconciliation` waves are fixed at
-  exactly one lane each, so the total maximum is 23 lanes.
+  `gather` and `redundant-gather` may partition work across lanes. Every typed
+  review wave, plus required `map` and `compile`, is fixed at exactly one lane,
+  so the total maximum is 22 worker lanes.
+  One deterministic controller reconciliation follows.
 - Maximum concurrency: 8.
 - Assurance ceiling: `verified` only for claims affirmed by the required
   independent passes and left without unresolved material challenge.
-- Conditional work: optionally predeclare up to two condition-bound
-  `contradiction-resolution` evidence waves within the manifest's hard cap.
-  Each runs only when its approved predicate triggers; both branches feed
-  exactly one mandatory terminal reconciliation.
+- Conditional work: optionally predeclare one condition-bound
+  `contradiction-resolution` evidence wave within the manifest's hard cap. It
+  runs only when its approved predicate triggers; both branches feed exactly
+  one mandatory controller reconciliation.
 
 ## Planning Rules
 
@@ -69,8 +72,8 @@ reopening and verification.
 2. Classify required and conditional waves before target preparation.
 3. Classify the actual bounded assignment. Citation reopening, explicit
    inventory comparison, counterexample search, and mechanical dossier
-   compilation can remain economical; judgment-bearing interpretation or
-   reconciliation may require a stronger independently approved wave.
+   compilation can remain economical. Reconciliation is deterministic
+   controller work; new semantic judgment is a caller-owned unresolved gap.
 4. Resolve and explain each wave's exact provider-native target and unsupported
    controls without cross-harness normalization.
 5. Reduce lanes when scope is small; never invent work to fill a profile cap.