@sylad/cadence 0.10.0 → 0.11.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.10.0",
+      "version": "0.11.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -19,6 +19,17 @@ several projects through subagents — plus three reviewer agents: `ux-reviewer`
 gate, and `qa-reviewer`, which walks the delivered app in a real browser and
 reports a page left empty or in error.
 
+## What's new
+
+**0.11.0**: waves on different repositories run side by side under a shared cap of
+simultaneous sessions (`--max-sessions`, 2 by default), and every release now has its
+changelog section and GitHub release. **0.10.1**: the QA expectations file (`docs/qa/expectations.md`) is kept with the plan —
+a commit that only touches it no longer has to cite a lot. **0.10.0**: `cadence orchestrate`
+sends an already-committed lot straight to review, and sessions only ask questions that
+name what they would change.
+
+Every version, with what it brings and since when: [CHANGELOG.md](CHANGELOG.md).
+
 ## raf
 
 - The plan is a YAML file in the repo (`docs/plan/raf.yaml`), edited by the CLI.
@@ -36,7 +47,8 @@ reports a page left empty or in error.
   touches is a plan file**: the plan itself, its Gantt page (only at its default place, `gantt.html` next to the plan — written elsewhere with `raf gantt -o`, declare it under `plan.files`), the `plan:` key of the config file in use (`cadence.yaml`, or
   the `--config` file; a change to `deliver:`/`session:` is work), or a file the
   project lists under `plan.files` in `cadence.yaml` (a page it generates from
-  the plan, a journal). Such a commit is never a "commit without a lot", and it
+  the plan, a journal), or the QA expectations file (`docs/qa/expectations.md`,
+  or the file named by `qa.expectations`; the lead commits the `qa-reviewer`'s draft of it). Such a commit is never a "commit without a lot", and it
   does not count as work on the lots it cites: it is absent from `raf commits`,
   does not start a `todo` lot, does not make a code review stale, and
   `cadence deliver` does not announce the lots it cites as delivered. The files
@@ -274,8 +286,8 @@ The counterpart of the UX review, off by default. With the rule on, `raf done`
 refuses a lot that has at least one commit citing it and no recorded verdict
 (`--force` to override), and `raf check` reports such lots finished after the
 `reviewSince` day. A lot with no commit has nothing to review; neither does a
-lot whose only commits touch plan files alone (the plan, or a file listed under
-`plan.files`), predate the plan's `since` or match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
+lot whose only commits touch plan files alone (the plan, a file listed under
+`plan.files`, or the QA expectations file), predate the plan's `since` or match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
 
 The verdict is tied to what was reviewed: `raf review` stores it on the lot with
 the sha of the lot's latest counted commit (`review: { date, verdict, commit }`,
@@ -346,7 +358,7 @@ qa:
   expectations: docs/quality/pages.md
 ```
 
-Only the agent reads that key; the CLI does not use it. Without an expectations file the agent walks
+The agent reads that key, and so does `raf check`: a commit touching only that file is plan upkeep (no lot to cite, see above). Without an expectations file the agent walks
 the routes it discovers and still runs its universal checks: an error shown, a failed API call
 whose content is missing on screen, a broken or missing content image are defects with or without a
 file; an empty 2xx body, like whatever else would need an expectation to judge, is suspect at most
@@ -631,13 +643,14 @@ exception is a **formatting retry** (below).
 cadence orchestrate finance-tracker:L41 ol-companion:L22 cadence:L18@haiku
 cadence orchestrate L18                      # from inside a project
 cadence orchestrate … --budget 1.5M          # 1500000, 1.5M, 800k; default 2M
+cadence orchestrate … --max-sessions 3       # sessions running at the same moment, all waves together; default 2
 cadence orchestrate … --dry-run              # preconditions + the plan of the wave; nothing is started
-cadence orchestrate --status [<wave>]        # the table, read back from the state (default: the last wave)
+cadence orchestrate --status [<wave>]        # the live waves and the repositories they hold, then the table (default: the last wave of this folder)
 cadence orchestrate --resume [<wave>] [--budget 1M] [--answer ol-companion:L22 "reply"]
 ```
 
-You choose the lots; the order is the order given (one queue per repository, two repositories at most
-at the same time). `@haiku|@sonnet|@opus` sets the model of the implementation and corrections of that
+You choose the lots; the order is the order given (one queue per repository, as many repositories at the
+same time as the session cap allows — 2 by default). `@haiku|@sonnet|@opus` sets the model of the implementation and corrections of that
 lot (default Sonnet; reviews are always Opus; Haiku only when you write it, for a mechanical lot). Run it
 in the background and read `--status`: it prints one line per transition and the final table.
 
@@ -677,9 +690,24 @@ review with minors: it concludes on that review instead of staying suspended.
 after the wave (`git log`, tests, `raf check`), `raf done`, **`raf ux`** (the orchestrator reports the UX
 verdict and screenshots, it does not record it), the push and the deliveries, one project at a time.
 
-**Guards, imposed by the code**: at most two sessions, one per repository (a lock in the repository's
-shared state, `orchestrate.lock`, which also makes `cadence deliver` refuse that repository) and one wave
-per folder; `Agent`, `git push`, `cadence deliver`, `raf done|review|ux` are denied to the sessions; a
+**Several waves at once**: the lock is per **repository** (a lock in the repository's shared state,
+`orchestrate.lock`, which also makes `cadence deliver` refuse that repository), not per folder. A wave is
+refused only when one of its repositories is held by a live wave (`<repo> : une orchestration y est déjà en
+cours`; the lock of a dead process is detected and cleared); two waves on different repositories run side by
+side, even when started from the same parent folder. They share a **cap on simultaneous sessions**, counted
+across all live waves: 2 by default, `--max-sessions N` (or `CADENCE_MAX_SESSIONS=N`) to change it — give
+every wave the same value: each wave counts ALL live sessions, whatever their slot, and waits while that
+count has reached ITS OWN cap, so with different caps the highest one can push the total past the lowest
+(which then waits). A session that finds no free slot **waits** (the wave is not refused; the journal says
+`en attente d'un créneau de session depuis …`, repeated every minute, then `créneau de session obtenu après …`).
+A slot or a registry entry is owned by a pid **and** its start time: a reused pid is a dead owner. Wave
+identifiers are reserved atomically (`-2`, `-3` suffix when two waves start in the same minute; an existing
+`--wave` is refused). The registry of live waves and the slots live under `~/.cadence/orchestrate/` (`CADENCE_HOME`
+to move it): `cadence orchestrate --status` lists, from any folder, the live waves, the repositories each
+holds, the cap of each wave and the slots in use.
+
+**Guards, imposed by the code**: a global cap of simultaneous sessions, one wave per repository at
+a time (above); `Agent`, `git push`, `cadence deliver`, `raf done|review|ux` are denied to the sessions; a
 temporary `pre-push` hook, installed for the duration of the wave and removed at its end, refuses any push
 from a session (`CADENCE_ORCHESTRATED` is in their environment; a repository that already has another
 `pre-push` hook is refused before anything starts — `pushurl` is never touched); after every session the
@@ -725,7 +753,7 @@ orchestrate:
 
 Without `start`, a read-only plan's `todo` lot is refused (start it with the project's tool); without
 `verdict`, the review verdict stays in the wave's state and you report it. Only the plan's files
-(`plan.path`, `plan.files`) are committed from those commands; anything else dirty stops the lot.
+(`plan.path`, `plan.files`, the QA expectations file) are committed from those commands; anything else dirty stops the lot.
 
 ## Claude Code skills
 
@@ -801,13 +829,18 @@ A version exists in three places and is published in two; a release does all of
 
 1. Bump `version` in `package.json` (then `npm install` to refresh `package-lock.json`),
    `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, in the commit that closes the lot.
+   Write the version's section of `CHANGELOG.md` (`## [x.y.z] - date`, what changes for the user, lots cited)
+   and refresh the « What's new » summary of this README in that same commit.
 2. `git tag v<version> && git push origin main v<version>` — the tag starts `.github/workflows/publish.yml`,
    which publishes to npm through Trusted Publishing (OIDC, no token stored anywhere): it checks the tag
-   matches `package.json`, `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, then `npm publish --provenance`, where `prepublishOnly` runs the type-check and the
-   tests and `prepare` builds `dist/`; a red suite stops the publication. The trusted publisher is declared
+   matches `package.json`, `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json` and that `CHANGELOG.md` has a `## [x.y.z]` section for it (no section, no publication), then `npm publish --provenance`, where `prepublishOnly` runs the type-check and the
+   tests and `prepare` builds `dist/`; a red suite stops the publication; then it creates the GitHub release with that CHANGELOG section as its text. The trusted publisher is declared
    once on npmjs.com (package settings → Trusted Publisher → GitHub Actions, `Sylad/cadence`, `publish.yml`).
 3. Watch the run: `gh run watch` (or `gh run list --workflow publish.yml`).
 4. Check the effect: `npm view @sylad/cadence version` answers the new version.
+   If the package is on npm but the GitHub release is missing (the release step failed after `npm publish`),
+   re-running the job fails at `npm publish`: create the release by hand with
+   `gh release create v<version> --title v<version> --notes-file <the section of CHANGELOG.md> --verify-tag`.
 
 The Claude Code plugin is read from the repository, so pushing `main` is what updates it; npm is what
 `npx @sylad/cadence` and a global install read, and only the tag publishes there. A missing tag, or a red

package/bin/cadence.js

@@ -34,8 +34,9 @@ if (tool === 'raf') {
   cadence verify [--retry secondes] [--sha rév]
                     rejoue les vérifications d'effet (deliver.verify) hors livraison, une passe, en parallèle ;
                     code 0 tout vert, 1 un effet rouge, 2 rien à vérifier ; « session start » la lance aussi
-  cadence orchestrate <projet>:<lot>[@modèle]… [--budget 2M] [--dry-run]
-                    une session claude neuve par étape (implémentation, revues, corrections) ; --status, --resume
+  cadence orchestrate <projet>:<lot>[@modèle]… [--budget 2M] [--max-sessions 2] [--wave id] [--dry-run]
+                    une session claude neuve par étape (implémentation, revues, corrections) ; --status, --resume ;
+                    --max-sessions : sessions simultanées, toutes vagues confondues (CADENCE_MAX_SESSIONS)
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;

package/dist/audit.js

@@ -12,7 +12,7 @@ function configRel(plan, root) {
 }
 /** Le plan, sa page Gantt, la configuration lue (cadence.yaml) et les fichiers tenus avec lui (plan.files). */
 function ownFiles(plan, root) {
-    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), configRel(plan, root), ...plan.files]);
+    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), configRel(plan, root), ...plan.maintained]);
 }
 function withoutPlanKey(text) {
     if (text === null)
@@ -39,7 +39,7 @@ export function planCommits(plan, root, opts = {}) {
 }
 /**
  * Commit d'entretien du plan : TOUS ses fichiers sont des fichiers du plan (le plan, sa page Gantt,
- * plan.files — son plan publié par exemple — et la configuration lue, mais celle-ci seulement quand la
+ * plan.files — son plan publié par exemple —, les attendus QA et la configuration lue, mais celle-ci seulement quand la
  * clé `plan:` est la seule à changer : deliver/session/… sont du travail). Les fichiers décident,
  * jamais le sujet : « chore(plan): … » qui touche un fichier source est un commit comme un autre.
  */

package/dist/cli.js

@@ -47,7 +47,7 @@ Quand la portée du sujet cite des lots — « feat(L3): … », « chore(L31,L3
 mention en passage (« page équipe (L27) »), une plage (« L28–L31 », « L45 à L48 ») ou le corps n'y comptent pas.
 Sans portée citant un lot, tout le message est lu : « fix: L3 corrigé », « L3/t1 ».
 Un commit qui ne touche que le plan, la clé plan: de cadence.yaml (deliver/session sont du travail) (et les fichiers déclarés sous plan.files, un plan
-publié par exemple) n'a pas à en citer, et ne compte pas pour les lots qu'il cite ; le sujet n'y change rien.
+publié par exemple, ainsi que le fichier d'attendus QA : docs/qa/expectations.md ou qa.expectations) n'a pas à en citer, et ne compte pas pour les lots qu'il cite ; le sujet n'y change rien.
 Un lot --visible attend une entrée Nouveautés (docs/nouveautes/, --dir) avec capture ; raf check le vérifie.
 Un texte qui commence par « - » se passe après « -- » : raf note L1 -- "-5 %".
 Le plan est docs/plan/raf.yaml, ou celui que nomme « plan: » dans cadence.yaml ; un plan tenu par un

package/dist/config.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { dirname, isAbsolute, posix, relative } from 'node:path';
 import { parse } from 'yaml';
 import { isDay } from './dates.js';
 import { FIELDS, RafError, STATUSES } from './plan.js';
@@ -6,6 +7,29 @@ const KEYS = ['path', 'project', 'since', 'ignore', 'files', 'lots', 'fields', '
 const FORMAT_KEYS = ['lots', 'fields', 'statuses', 'estimates'];
 const isObject = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const list = (v) => (v == null ? [] : Array.isArray(v) ? v.map(String) : [String(v)]);
+/**
+ * Clé `qa:` : le fichier d'attendus QA, ramené à la forme que git rapporte (relatif à la racine du dépôt,
+ * séparateurs posix, sans `./`). Une valeur vide vaut absente ; un type faux ou un chemin hors du dépôt est refusé.
+ */
+function readQa(qa, file) {
+    if (qa == null)
+        return undefined;
+    if (!isObject(qa))
+        throw new RafError(`${file} : qa doit être un objet`);
+    const v = qa.expectations;
+    if (v == null)
+        return undefined;
+    if (typeof v !== 'string')
+        throw new RafError(`${file} : qa.expectations doit être un chemin`);
+    const raw = v.trim().replace(/\\/g, '/');
+    if (raw === '')
+        return undefined;
+    const root = dirname(file);
+    const rel = posix.normalize(isAbsolute(raw) ? relative(root, raw).replace(/\\/g, '/') : raw);
+    if (rel === '.' || rel === '..' || rel.startsWith('../') || isAbsolute(rel))
+        throw new RafError(`${file} : qa.expectations « ${v.trim()} » est hors du dépôt`);
+    return rel;
+}
 /**
  * Clé `plan:` de cadence.yaml : où est le plan et, s'il est tenu par un autre outil, comment le lire.
  * Null quand le fichier ou la clé manque — le plan est alors docs/plan/raf.yaml au format de raf.
@@ -20,18 +44,22 @@ export function readPlanConfig(file) {
     catch (e) {
         throw new RafError(`${file} illisible : ${e.message.split('\n')[0]}`);
     }
-    const p = raw?.plan;
+    const doc = raw;
+    const qa = readQa(doc?.qa, file);
+    const p = doc?.plan;
     if (p == null)
-        return null;
+        return qa ? { settings: { qaExpectations: qa } } : null;
     const bad = (what) => new RafError(`${file} : plan.${what}`);
     if (typeof p === 'string' && p.trim() !== '')
-        return { path: p, settings: {} };
+        return { path: p, settings: { ...(qa ? { qaExpectations: qa } : {}) } };
     if (!isObject(p))
         throw new RafError(`${file} : plan doit être un chemin ou un objet`);
     for (const k of Object.keys(p))
         if (!KEYS.includes(k))
             throw bad(`${k} inconnu (attendu : ${KEYS.join(', ')})`);
     const settings = {};
+    if (qa)
+        settings.qaExpectations = qa;
     if (p.project != null)
         settings.project = String(p.project);
     if (p.since != null) {

package/dist/orchestrate/command.js

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 import { readOrchestrateConfig, readPlanConfig } from '../config.js';
@@ -9,6 +9,7 @@ import { onTermination } from '../proc.js';
 import { Plan, RafError, isOpen } from '../plan.js';
 import { AGENTS_DIR } from '../skills.js';
 import { pidAlive, sharedStateDir } from '../state.js';
+import { acquireSlot, cadenceHome, liveSlots, liveWaves, registerWave, unregisterWave } from './registry.js';
 import { loadTemplates, objective, renderBrief } from './briefs.js';
 import { Budget, MAX_PASSES, countInterrupted } from './cycle.js';
 import { canInstallPrePush, installPrePush, removePrePush, snapshot } from './guard.js';
@@ -19,6 +20,8 @@ import { schemaFor } from './schemas.js';
 import { excludeState, lotKey, newLot, RunStore } from './state.js';
 import { quotaText, renderTable } from './table.js';
 export const DEFAULT_BUDGET = 2_000_000;
+/** Sessions simultanées, toutes vagues confondues (`--max-sessions`, ou CADENCE_MAX_SESSIONS). */
+export const DEFAULT_MAX_SESSIONS = 2;
 /** `1500000`, `1.5M`, `800k`. */
 export function parseBudget(text) {
     const m = /^(\d+(?:[.,]\d+)?)\s*([kKmM]?)$/.exec(text.trim());
@@ -29,6 +32,11 @@ export function parseBudget(text) {
         throw new RafError(`--budget invalide : ${text}`);
     return Math.round(n);
 }
+export function parseMaxSessions(text, what = '--max-sessions') {
+    if (!/^\d+$/.test(text.trim()) || Number(text) < 1)
+        throw new RafError(`${what} invalide : ${text} (entier ≥ 1)`);
+    return Number(text);
+}
 const LOT_LIKE = /^(?:[\w.-]+:)?[A-Za-z]+\d+(?:@\w+)?$/;
 const MODELS = ['sonnet', 'opus', 'haiku'];
 function lotArg(text) {
@@ -59,6 +67,8 @@ export function parseOrchestrateArgs(argv) {
         }
         else if (t === '--budget')
             a.budget = parseBudget(value(t));
+        else if (t === '--max-sessions')
+            a.maxSessions = parseMaxSessions(value(t));
         else if (t === '--wave')
             a.wave = value(t);
         else if (t === '--answer') {
@@ -122,9 +132,6 @@ async function preflight(args, targets, io, deps, launch, opts = {}) {
         refusals.push('claude introuvable (CADENCE_CLAUDE_BIN, ou claude dans le PATH)');
     else if (!info.jsonSchema)
         refusals.push(`claude ${info.version} n'a pas --json-schema : mettre claude à jour`);
-    const held = activeLock(join(launch, '.cadence', 'orchestrate.lock'));
-    if (held && !opts.resume)
-        refusals.push(`une vague est déjà en cours dans ${launch} (${held.wave}, pid ${held.pid})`);
     const lots = [];
     const repoChecked = new Set();
     const byProject = new Map();
@@ -185,14 +192,17 @@ async function preflight(args, targets, io, deps, launch, opts = {}) {
 function agentsOf(deps) {
     return readAgents(deps.agentsDir);
 }
+const WAVE_ID_RE = /^[\w.-]+$/;
+/** Identifiant par défaut : jour et minute de lancement ; le suffixe qui départage deux vagues vient de `RunStore.reserve`. */
+function defaultWaveBase(io) {
+    const n = io.now();
+    return `${toDay(n)}-${String(n.getHours()).padStart(2, '0')}${String(n.getMinutes()).padStart(2, '0')}`;
+}
+/** Identifiant d'une simulation : le premier libre, sans rien réserver ni écrire. */
 function waveId(io, requested, launch) {
-    if (requested) {
-        if (!/^[\w.-]+$/.test(requested))
-            throw new RafError(`--wave invalide : ${requested}`);
+    if (requested)
         return requested;
-    }
-    const n = io.now();
-    const base = `${toDay(n)}-${String(n.getHours()).padStart(2, '0')}${String(n.getMinutes()).padStart(2, '0')}`;
+    const base = defaultWaveBase(io);
     let id = base;
     for (let i = 2; existsSync(join(RunStore.runsDir(launch), id)); i++)
         id = `${base}-${i}`;
@@ -231,6 +241,33 @@ function dryRun(lots, io, deps, budget, id) {
         }
     }
 }
+function maxSessions(args, io) {
+    if (args.maxSessions !== undefined)
+        return args.maxSessions;
+    const env = io.env.CADENCE_MAX_SESSIONS;
+    return env ? parseMaxSessions(env, 'CADENCE_MAX_SESSIONS') : DEFAULT_MAX_SESSIONS;
+}
+function duration(ms) {
+    const s = Math.round(ms / 1000);
+    return s < 60 ? `${s} s` : `${Math.floor(s / 60)} min ${String(s % 60).padStart(2, '0')} s`;
+}
+/** Vagues vivantes (toutes, quel que soit leur dossier de départ) et dépôts qu'elles tiennent. */
+function liveLines() {
+    const home = cadenceHome();
+    const waves = liveWaves(home);
+    if (waves.length === 0)
+        return [];
+    const slots = liveSlots(home).length;
+    const lines = [`vagues en cours : ${waves.length} · sessions en cours : ${slots}`];
+    for (const w of waves)
+        lines.push(`  ${w.wave} (pid ${w.pid}, depuis ${w.started}) lancée depuis ${w.cwd} · plafond ${w.cap ?? '?'} · dépôts : ${w.repos.join(', ')}`);
+    return lines;
+}
+/** Refus d'une `--wave` déjà existante, identique en simulation et au vrai lancement. */
+function waveExists(wave, io) {
+    io.err(`orchestrate : --wave ${wave} : cette vague existe déjà`);
+    return 2;
+}
 /** Point d'entrée de `cadence orchestrate`. 0 prêts · 1 rendus au lead · 2 refus avant d'agir · 3 suspendue (budget, quota). */
 export async function orchestrate(argv, io, deps) {
     const args = parseOrchestrateArgs(argv);
@@ -238,8 +275,16 @@ export async function orchestrate(argv, io, deps) {
     const today = io.env.RAF_TODAY && isDay(io.env.RAF_TODAY) ? io.env.RAF_TODAY : toDay(io.now());
     if (args.status !== undefined) {
         const store = typeof args.status === 'string' ? RunStore.find(launch, args.status) : RunStore.last(launch);
+        maxSessions(args, io); // une valeur invalide est refusée ici aussi
+        const live = liveLines();
+        for (const line of live)
+            io.out(line);
+        if (!store && live.length && args.status === true)
+            return 0; // sans identifiant : les vagues vivantes suffisent
         if (!store)
             throw new RafError(typeof args.status === 'string' ? `vague inconnue : ${args.status}` : 'aucune vague dans ce dossier');
+        if (live.length)
+            io.out('');
         for (const line of renderTable(store.readWave(), store.lots()))
             io.out(line);
         return 0;
@@ -247,7 +292,7 @@ export async function orchestrate(argv, io, deps) {
     if (args.resume !== undefined)
         return resume(args, io, deps, launch, today);
     if (args.lots.length === 0)
-        throw new RafError('usage : cadence orchestrate <projet>:<lot>… [--budget 2M] [--dry-run] | --status [vague] | --resume [vague] [--answer projet:lot "réponse"]');
+        throw new RafError('usage : cadence orchestrate <projet>:<lot>… [--budget 2M] [--max-sessions 2] [--dry-run] | --status [vague] | --resume [vague] [--answer projet:lot "réponse"]');
     const refusals = [];
     const targets = resolveTargets(args, io, refusals);
     const pre = await preflight(args, targets, io, deps, launch);
@@ -258,22 +303,43 @@ export async function orchestrate(argv, io, deps) {
             io.err(`orchestrate : ${r}`);
         return 2;
     }
-    const id = waveId(io, args.wave, launch);
+    if (args.wave !== undefined && !WAVE_ID_RE.test(args.wave))
+        throw new RafError(`--wave invalide : ${args.wave}`);
     if (args.dryRun) {
+        const id = waveId(io, args.wave, launch);
+        if (args.wave && existsSync(join(RunStore.runsDir(launch), id)))
+            return waveExists(args.wave, io);
         dryRun(pre.lots, io, deps, budget, id);
         return 0;
     }
-    const store = new RunStore(launch, id);
+    const store = RunStore.reserve(launch, args.wave ?? defaultWaveBase(io), { exact: args.wave !== undefined });
+    if (!store)
+        return waveExists(args.wave, io);
+    const id = store.id;
     const wave = { id, created: io.now().toISOString(), cwd: launch, budget, consumed: 0, cacheRead: 0, status: 'running', pid: process.pid, lots: pre.lots.map((l) => lotKey(l.project, l.lot)) };
     for (const l of pre.lots)
         store.writeLot(l);
-    return execute(wave, pre.lots, store, io, deps, today);
+    // Une vague qui n'a pas atteint `wave.json` (refus au verrou, démarrage en échec) ne laisse pas son dossier réservé :
+    // le même `--wave` se relance, et `reserve` ne le prend pas pour une vague existante.
+    const abandon = () => {
+        if (!existsSync(join(store.dir, 'wave.json')))
+            rmSync(store.dir, { recursive: true, force: true });
+    };
+    try {
+        const code = await execute(wave, pre.lots, store, io, deps, today, maxSessions(args, io));
+        abandon();
+        return code;
+    }
+    catch (e) {
+        abandon();
+        throw e;
+    }
 }
 function contexts(lots, envs, wctx) {
     return lots.map((lot, i) => ({ wave: wctx, lot, config: envs[i].config, loadPlan: envs[i].loadPlan }));
 }
 /** Pose les verrous et les hooks, joue la vague, range l'état, rend le tableau et le code de sortie. */
-async function execute(wave, lots, store, io, deps, today, all = lots) {
+async function execute(wave, lots, store, io, deps, today, cap, all = lots) {
     const launch = store.launchDir;
     // La configuration des projets est lue avant de poser quoi que ce soit : un cadence.yaml illisible ne laisse ni verrou ni hook.
     const envs = lots.map((lot) => projectEnv(lot.repo));
@@ -281,7 +347,7 @@ async function execute(wave, lots, store, io, deps, today, all = lots) {
     const templates = loadTemplates(deps.templatesDir);
     mkdirSync(join(launch, '.cadence'), { recursive: true });
     excludeState(launch);
-    const waveLock = join(launch, '.cadence', 'orchestrate.lock');
+    const home = cadenceHome();
     const held = [];
     const repos = [...new Set(lots.map((l) => l.repo))];
     const release = () => {
@@ -290,15 +356,13 @@ async function execute(wave, lots, store, io, deps, today, all = lots) {
         held.length = 0;
         for (const r of repos)
             removePrePush(r, wave.id);
+        try {
+            unregisterWave(home, process.pid);
+        }
+        catch {
+            // registre illisible : l'entrée d'un processus mort est écartée à la prochaine inscription
+        }
     };
-    const got = takeLock(waveLock, { pid: process.pid, wave: wave.id, started: new Date().toISOString() });
-    if (!got.ok) {
-        io.err(`orchestrate : une vague est déjà en cours dans ${launch} (${got.held.wave}, pid ${got.held.pid})`);
-        return 2;
-    }
-    held.push(waveLock);
-    if (got.stale)
-        io.err(`orchestrate : verrou de vague périmé retiré (${got.stale.wave}, pid ${got.stale.pid} mort)`);
     for (const r of repos) {
         const file = join(sharedStateDir(r), REPO_LOCK);
         const l = takeLock(file, { pid: process.pid, wave: wave.id, started: new Date().toISOString() });
@@ -317,6 +381,28 @@ async function execute(wave, lots, store, io, deps, today, all = lots) {
             return 2;
         }
     }
+    try {
+        registerWave(home, { pid: process.pid, wave: wave.id, started: new Date().toISOString(), cwd: launch, repos, cap });
+    }
+    catch (e) {
+        release(); // verrous et hooks ne restent pas posés si le démarrage échoue
+        throw e;
+    }
+    // Plafond de sessions simultanées, toutes vagues confondues : chaque session attend un créneau libre avant de partir.
+    const claude = async (args, o) => {
+        const free = await acquireSlot(home, cap, {
+            wave: wave.id,
+            pollMs: deps.slotPollMs,
+            onWait: (h, ms) => wctx.log(`en attente d'un créneau de session depuis ${duration(ms)} (${h.length}/${cap} en cours : ${[...new Set(h.map((x) => x.wave))].join(', ')})`),
+            onGot: (ms) => wctx.log(`créneau de session obtenu après ${duration(ms)} d'attente`),
+        });
+        try {
+            return await deps.claude(args, o);
+        }
+        finally {
+            free();
+        }
+    };
     const budget = new Budget(wave.budget);
     budget.consumed = wave.consumed;
     budget.cacheRead = wave.cacheRead;
@@ -330,7 +416,7 @@ async function execute(wave, lots, store, io, deps, today, all = lots) {
         id: wave.id,
         store,
         budget,
-        claude: deps.claude,
+        claude,
         agents: agentsOf(deps),
         today,
         claudeHome: deps.claudeHome,
@@ -367,7 +453,7 @@ async function execute(wave, lots, store, io, deps, today, all = lots) {
         release();
     });
     try {
-        await runPool(ctxs, undefined, all);
+        await runPool(ctxs, cap, all);
     }
     finally {
         forget();
@@ -396,8 +482,8 @@ async function resume(args, io, deps, launch, today) {
     const info = deps.claudeInfo();
     if (!info)
         refusals.push('claude introuvable (CADENCE_CLAUDE_BIN, ou claude dans le PATH)');
-    const alive = activeLock(join(launch, '.cadence', 'orchestrate.lock'));
-    if (alive && alive.pid !== process.pid)
+    const alive = liveWaves(cadenceHome()).find((w) => w.wave === wave.id && w.cwd === launch && w.pid !== process.pid);
+    if (alive)
         refusals.push(`la vague ${alive.wave} tourne encore (pid ${alive.pid})`);
     if (wave.status === 'done')
         refusals.push(`la vague ${wave.id} est terminée`);
@@ -475,7 +561,7 @@ async function resume(args, io, deps, launch, today) {
             io.out(line);
         return 0;
     }
-    return execute(wave, live, store, io, deps, today, lots);
+    return execute(wave, live, store, io, deps, today, maxSessions(args, io), lots);
 }
 /** Dépendances réelles : `claude` (ou CADENCE_CLAUDE_BIN), agents et gabarits du paquet, journaux de ~/.claude. */
 export function realOrchestrateDeps(env) {

package/dist/orchestrate/cycle.js

@@ -72,7 +72,7 @@ function trackedPaths(s) {
 async function commitPlan(c, message) {
     const repo = c.lot.repo;
     const plan = c.loadPlan();
-    const own = new Set([relative(repo, plan.path), ...plan.files]);
+    const own = new Set([relative(repo, plan.path), ...plan.maintained]);
     const dirty = trackedPaths(await snapshot(repo, { remote: false }));
     if (dirty.length === 0)
         return null;

package/dist/orchestrate/lock.js

@@ -1,6 +1,19 @@
 import { linkSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { processStart } from '../proc.js';
 import { pidAlive } from '../state.js';
+/**
+ * Le porteur vit encore : son pid existe ET, quand l'heure de démarrage est connue des deux côtés, c'est la même.
+ * Un pid repris par un autre processus est un porteur mort.
+ */
+export function holderAlive(pid, start) {
+    if (!pidAlive(pid))
+        return false;
+    if (!start)
+        return true;
+    const now = processStart(pid);
+    return now === null || now === start;
+}
 /** Nom du verrou d'orchestration d'un dépôt, dans l'état commun aux worktrees (celui de `deliver`). */
 export const REPO_LOCK = 'orchestrate.lock';
 function read(file) {
@@ -15,13 +28,13 @@ function read(file) {
     }
     try {
         const raw = JSON.parse(text);
-        return { pid: Number(raw.pid), wave: String(raw.wave), started: String(raw.started), ageMs };
+        return { pid: Number(raw.pid), wave: String(raw.wave), started: String(raw.started), start: raw.start === undefined ? undefined : String(raw.start), ageMs };
     }
     catch {
         return { pid: 0, wave: '?', started: '?', unreadable: true, ageMs };
     }
 }
-const alive = (l) => (l.unreadable ? l.ageMs < 5_000 : pidAlive(l.pid));
+const alive = (l) => (l.unreadable ? l.ageMs < 5_000 : holderAlive(l.pid, l.start));
 /** Le verrou s'il est tenu par un processus vivant, sinon null (absent ou périmé). */
 export function activeLock(file) {
     const l = read(file);
@@ -31,7 +44,8 @@ export function activeLock(file) {
  * Pose le verrou (lien vers un fichier complet : atomique). Un verrou de pid mort est retiré — `stale` le
  * dit pour avertir. `held` : le porteur vivant quand la pose échoue.
  */
-export function takeLock(file, lock) {
+export function takeLock(file, given) {
+    const lock = { ...given, start: given.start ?? processStart(given.pid) ?? undefined };
     let stale;
     for (let attempt = 0; attempt < 3; attempt++) {
         const tmp = join(dirname(file), `.orchestrate.lock.${lock.pid}.${Date.now()}.${attempt}.tmp`);
@@ -60,8 +74,8 @@ export function takeLock(file, lock) {
             continue;
         }
         const now = read(aside);
-        if (now && now.pid === seen.pid && now.wave === seen.wave && now.started === seen.started) {
-            stale = { pid: seen.pid, wave: seen.wave, started: seen.started };
+        if (now && now.pid === seen.pid && now.wave === seen.wave && now.started === seen.started && now.start === seen.start) {
+            stale = { pid: seen.pid, wave: seen.wave, started: seen.started, start: seen.start };
             rmSync(aside, { force: true });
         }
         else {

package/dist/orchestrate/pool.js

@@ -1,10 +1,11 @@
 import { runLot } from './cycle.js';
 import { lotKey } from './state.js';
-/** Deux sessions au plus en même temps (imposé ici, pas de --parallel) : deux dépôts à la fois. */
+/** Valeur de repli de `runPool` quand l'appelant ne donne pas de plafond ; le réglage réel est DEFAULT_MAX_SESSIONS, `--max-sessions` ou CADENCE_MAX_SESSIONS (command.ts). */
 export const SLOTS = 2;
 /**
- * Ordonnanceur : une file par dépôt, les lots d'un dépôt l'un après l'autre dans l'ordre donné, deux dépôts
- * au plus en parallèle. Le budget, le quota et les incidents sont vérifiés par le cycle avant chaque session.
+ * Ordonnanceur : une file par dépôt, les lots d'un dépôt l'un après l'autre dans l'ordre donné, `slots` dépôts
+ * au plus en parallèle (le plafond global des sessions de toutes
+ * les vagues est tenu par command.ts). Le budget, le quota et les incidents sont vérifiés par le cycle avant chaque session.
  */
 export async function runPool(ctxs, slots = SLOTS, known = []) {
     const queues = new Map();

package/dist/orchestrate/registry.js

@@ -0,0 +1,119 @@
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { processStart } from '../proc.js';
+import { activeLock, holderAlive, releaseLock, takeLock } from './lock.js';
+/**
+ * État commun à toutes les vagues de l'utilisateur, quel que soit le dossier d'où elles partent : le registre
+ * des vagues vivantes (`waves/<pid>.json`) et les créneaux de sessions simultanées (`slots/slot-<n>.lock`).
+ * Les verrous de DÉPÔT restent dans le dépôt (`.git/cadence/orchestrate.lock`).
+ */
+export function cadenceHome(env = process.env) {
+    return env.CADENCE_HOME || join(env.HOME || homedir(), '.cadence', 'orchestrate');
+}
+const wavesDir = (home) => join(home, 'waves');
+const slotsDir = (home) => join(home, 'slots');
+function readWave(file) {
+    try {
+        const raw = JSON.parse(readFileSync(file, 'utf8'));
+        const w = { pid: Number(raw.pid), wave: String(raw.wave), started: String(raw.started), cwd: String(raw.cwd), repos: Array.isArray(raw.repos) ? raw.repos.map(String) : [] };
+        if (raw.cap !== undefined)
+            w.cap = Number(raw.cap);
+        if (raw.start !== undefined)
+            w.start = String(raw.start);
+        return w;
+    }
+    catch {
+        return null;
+    }
+}
+/** Les vagues dont le processus vit encore. */
+export function liveWaves(home) {
+    let names;
+    try {
+        names = readdirSync(wavesDir(home)).filter((n) => n.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const n of names) {
+        const w = readWave(join(wavesDir(home), n));
+        if (w && holderAlive(w.pid, w.start))
+            out.push(w);
+    }
+    return out.sort((a, b) => a.started.localeCompare(b.started));
+}
+/** Inscrit la vague ; écarte au passage les entrées de processus morts (les `.tmp` d'une inscription en cours ne sont pas touchés). */
+export function registerWave(home, given) {
+    const w = { ...given, start: given.start ?? processStart(given.pid) ?? undefined };
+    mkdirSync(wavesDir(home), { recursive: true });
+    for (const n of readdirSync(wavesDir(home))) {
+        if (!n.endsWith('.json'))
+            continue;
+        const old = readWave(join(wavesDir(home), n));
+        if (!old || !holderAlive(old.pid, old.start))
+            rmSync(join(wavesDir(home), n), { force: true });
+    }
+    const file = join(wavesDir(home), `${w.pid}.json`);
+    writeFileSync(`${file}.tmp`, JSON.stringify(w));
+    renameSync(`${file}.tmp`, file);
+}
+export function unregisterWave(home, pid) {
+    rmSync(join(wavesDir(home), `${pid}.json`), { force: true });
+}
+/** Les sessions en cours en ce moment, toutes vagues confondues. */
+export function liveSlots(home) {
+    let names;
+    try {
+        names = readdirSync(slotsDir(home)).filter((n) => /^slot-\d+\.lock$/.test(n));
+    }
+    catch {
+        return [];
+    }
+    return names.map((n) => activeLock(join(slotsDir(home), n))).filter((l) => l !== null);
+}
+/** Index de créneau le plus haut essayé : le plafond de chaque vague est le sien, les fichiers sont communs. */
+const MAX_SLOT_INDEX = 64;
+/** Intervalle des rappels d'attente dans le journal. */
+const WAIT_REPORT_MS = 60_000;
+/**
+ * Attend que le nombre de sessions vivantes, TOUTES vagues confondues et quel que soit l'index de leur créneau,
+ * soit sous `cap` (le plafond de cette vague), puis prend le premier créneau libre (un pid mort est repris) et
+ * rend sa libération. Chaque vague applique SON plafond au total commun : avec des plafonds différents, la
+ * vague au plafond le plus haut peut porter le total au-dessus du plafond de l'autre, qui attend alors.
+ * Deux vagues qui prennent en même temps se départagent au recomptage : si le total dépasse `cap` une fois
+ * le créneau pris, il est rendu et l'attente reprend.
+ *
+ * `onWait(holders, waitedMs)` : appelé quand on commence à attendre (0 ms), puis toutes les minutes.
+ * `onGot(waitedMs)` : appelé à l'obtention, seulement si on a attendu.
+ */
+export async function acquireSlot(home, cap, opts) {
+    mkdirSync(slotsDir(home), { recursive: true });
+    const t0 = Date.now();
+    let reportedAt = null;
+    const pollMs = opts.pollMs ?? 2000;
+    const live = opts.slots ?? liveSlots; // injectable : les tests simulent une vague qui prend un créneau entre les deux comptées
+    for (;;) {
+        if (live(home).length < cap) {
+            for (let k = 0; k < MAX_SLOT_INDEX; k++) {
+                const file = join(slotsDir(home), `slot-${k}.lock`);
+                const got = takeLock(file, { pid: process.pid, wave: opts.wave, started: new Date().toISOString() });
+                if (!got.ok)
+                    continue;
+                if (live(home).length <= cap) {
+                    if (reportedAt !== null)
+                        opts.onGot?.(Date.now() - t0);
+                    return () => releaseLock(file, process.pid);
+                }
+                releaseLock(file, process.pid); // pris à plusieurs en même temps : on rend, on retente
+                break;
+            }
+        }
+        if (reportedAt === null || Date.now() - reportedAt >= (opts.reportMs ?? WAIT_REPORT_MS)) {
+            reportedAt = Date.now();
+            opts.onWait?.(live(home), reportedAt - t0);
+        }
+        await new Promise((r) => setTimeout(r, pollMs + Math.random() * pollMs * 0.25));
+    }
+}

package/dist/orchestrate/state.js

@@ -22,6 +22,28 @@ export class RunStore {
         this.dir = join(launchDir, '.cadence', 'runs', id);
         mkdirSync(this.dir, { recursive: true });
     }
+    /**
+     * Réserve l'identifiant de vague : `mkdir` sans `recursive` échoue (EEXIST) si une autre vague l'a pris, même à
+     * la même seconde. Sans identifiant demandé, on passe au suffixe suivant (`-2`, `-3`…) ; avec un identifiant
+     * demandé, null (refus : jamais deux vagues dans le même dossier d'état).
+     */
+    static reserve(launchDir, base, opts = {}) {
+        mkdirSync(RunStore.runsDir(launchDir), { recursive: true });
+        for (let i = 1;; i++) {
+            const id = i === 1 ? base : `${base}-${i}`;
+            try {
+                mkdirSync(join(RunStore.runsDir(launchDir), id));
+            }
+            catch (e) {
+                if (e.code !== 'EEXIST')
+                    throw e;
+                if (opts.exact)
+                    return null;
+                continue;
+            }
+            return new RunStore(launchDir, id);
+        }
+    }
     static runsDir(launchDir) {
         return join(launchDir, '.cadence', 'runs');
     }

package/dist/plan.js

@@ -130,6 +130,14 @@ export class Plan {
     get files() {
         return this.settings.files ?? [];
     }
+    /** Fichier d'attendus QA du `qa-reviewer`, relatif à la racine du dépôt. */
+    get qaExpectations() {
+        return this.settings.qaExpectations ?? 'docs/qa/expectations.md';
+    }
+    /** Tout ce qui est tenu avec le plan sans être du travail : plan.files et le fichier d'attendus QA. Source unique de l'audit et de l'orchestrateur. */
+    get maintained() {
+        return [...this.files, this.qaExpectations];
+    }
     /**
      * Références citées par un texte. Format de raf : préfixe et numéro (`L3`, `L3/t1`). Autre format :
      * les identifiants du plan eux-mêmes, quelle que soit leur forme (`E-A2`, `NC2.4`, `B33/t1-fusion`).

package/dist/proc.js

@@ -90,6 +90,25 @@ export function readProcs() {
     }
     return procs;
 }
+/** Heure de démarrage d'un processus (son identité : un pid se réutilise) ; null s'il est mort ou illisible. */
+export function processStart(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+        return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
+    }
+    catch {
+        // pas de /proc (macOS) ou processus sorti : ps
+    }
+    try {
+        const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Âge au-delà duquel un relevé de secours (le relevé suivant a échoué) n'est plus cru : un pid y a pu être repris. */
 export const MAX_SNAPSHOT_AGE_MS = 1_000;
 /** Intervalle du relevé des descendants d'une commande de deliver pendant qu'elle tourne. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",