dorfl 0.14.2 → 0.15.0

package/src/advance-lifecycle-template.ts

@@ -17,38 +17,41 @@
  *
  *   - the LIFECYCLE rungs (triage observations / surface declared blockers / apply
  *     a committed answer), gated by the two calm-default lifecycle gates below;
- *   - the on-answer-committed trigger `on: push work/questions/**`, which re-runs
- *     the loop promptly when a question sidecar is answered;
+ *   - the on-answer-committed trigger `on: push work/questions/**` (on the
+ *     default branch only), which re-runs the loop promptly when a question
+ *     sidecar is answered;
  *   - (already in the absorbed seed) capability F — the `reap-merged-branches` job
  *     (`gc --remote-branches`) on the same `schedule:` cron, opt-out via the
- *     `sweepMergedBranches` dispatch input.
+ *     `sweepMergedBranches` dispatch input;
+ *   - (also in the seed) the no-agent `surface-merge-questions` job (`dorfl
+ *     surface-merge-questions`, task `wire-merge-questions-into-the-advance-tick`),
+ *     which asks a merge question for each unmerged work branch with no open PR,
+ *     behind the `mergeQuestions` config gate.
  *
- * The discipline is VERBATIM from the seed:
+ * THE SPLIT (spec `ci-agent-job-without-write-token`, ADR
+ * `ci-agent-job-holds-no-write-token`, task `ci-split-generate-workflows`): the
+ * tick runs NO agent itself. `enumerate` (`contents: read`) lists the eligible
+ * items; a `dispatch` job (`actions: write` ONLY, no checkout, no setup) starts
+ * one `dorfl-item-dispatch.yml` run per item, which calls `dorfl-item.yml`
+ * (lock, agent, apply; `dorfl-item-template.ts`). There is no matrix any more:
+ * a matrix would put every item's artifact in one shared namespace (decision 1).
  *
- *   - CI ALWAYS invokes `advance` (ADR `ci-config-policy-and-gate-family` §1):
- *     `advance` is a strict superset of `do`, and with the lifecycle gates at their
- *     calm defaults it degrades to exactly `do`'s build/task behaviour. The verb
- *     is NEVER a user decision; the workflow tunes behaviour via the
- *     `DORFL_*` env block, not by swapping the verb. There is NO
- *     `autoAdvance` gate.
- *   - The two LIFECYCLE gates are ORTHOGONAL peers, both calm by default:
- *     `DORFL_OBSERVATION_TRIAGE` (`off`/`ask`/`auto`, calm `off`) governs the
- *     raw observation INBOX; `DORFL_SURFACE_BLOCKERS` (`true`/`false`, calm
- *     `false`) governs DECLARED `needsAnswers` work. "Groom my observations but
- *     leave my blocked work alone" = `OBSERVATION_TRIAGE: ask` + `SURFACE_BLOCKERS:
- *     false`. Applying a committed answer has NO gate.
- *   - ONE word `integrationMode` drives BOTH the job SHAPE AND the
- *     `--propose`/`--merge` flag (they can never desync): `propose` ⇒ a DYNAMIC
- *     matrix (`dorfl scan --json | jq` enumerates one leg per eligible id,
- *     each leg carries `--propose` so it can NEVER merge to `main`); `merge` ⇒ ALSO
- *     a MATRIX (one leg per item; build/gate/review fan out, the LAND tail is
- *     serialised by the engine's `mergeRetries` CAS-retry loop — the git-alone
- *     floor — NOT by the workflow shape; SPEC
- *     `land-time-reverify-and-parallel-merge-ceiling`). This is integration-mode
- *     behaviour, IDENTICAL to the build tick (integration mode is
- *     verb-independent).
+ * The discipline:
+ *
+ *   - CI ALWAYS invokes `advance` (ADR `ci-config-policy-and-gate-family` §1),
+ *     now inside the per-item workflow. There is NO `autoAdvance` gate.
+ *   - The two LIFECYCLE gates are ORTHOGONAL peers, both calm by default
+ *     (`observationTriage` off, `surfaceBlockers` false). Applying a committed
+ *     answer has NO gate.
+ *   - ONE word `integrationMode` drives the `--propose`/`--merge` flag every
+ *     item run passes (the `dispatch` job forwards it). In merge mode the LAND
+ *     tail (rebase + CAS push to `main`) is serialised by the engine's
+ *     `mergeRetries` CAS-retry loop in the apply job, NOT by the workflow
+ *     shape; a lost CAS re-runs the rebase and the push only, never the gate
+ *     (decision 2), and the apply phase reports every land whose tree differs
+ *     from the gated one.
  *   - CI runs IN-PLACE (the CI container IS the isolation): no
- *     `--isolated`/`--remote`/registry. A CI concurrency group (per-ref) prevents
+ *     `--isolated`/`--remote`/registry. A per-ref concurrency group prevents
  *     overlapping ticks; the claim CAS is the real cross-run serialiser.
  *   - All invocations use explicit slug prefixes (`task:`/`spec:`), never bare
  *     (ADR `command-surface-and-journeys` §3a).
@@ -60,8 +63,15 @@
  * the test generates this artifact under `--fake` and asserts every invariant.
  */
 
+import {ACTION_PINS, pinnedUses} from './install-ci-action-pins.js';
 import type {ResolvedCIConfig} from './install-ci-core.js';
-import {providerSecretsWithBlock} from './install-ci-core.js';
+import {WRITER_SETUP_ACTION_USES} from './install-ci-core.js';
+import {
+	GATE_OVERRIDES,
+	ITEM_DISPATCH_WORKFLOW_FILE,
+	ITEM_RUN_NAME_PREFIX,
+	gateOverridesStep,
+} from './dorfl-item-template.js';
 
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const ADVANCE_LIFECYCLE_CAPABILITY_ID = 'advance-lifecycle';
@@ -74,31 +84,64 @@ export const ADVANCE_LIFECYCLE_CAPABILITY_LABEL =
 export const ADVANCE_LIFECYCLE_WORKFLOW_PATH =
 	'workflows/advance-lifecycle.yml';
 
+/**
+ * The `dispatch` job's shell (a `run: |` body, 10-space indented): list the
+ * `dorfl-item-dispatch.yml` runs that are not completed, then start one run per
+ * item of `ITEMS` (slot = index mod `MAX_PARALLEL`), skipping an item whose
+ * `dorfl-item <item>` run is still queued, pending or in progress. Every value
+ * arrives through `env:`; it prints one line per item (dispatched or skipped).
+ * Exported for the template test, which runs it with `gh` stubbed.
+ */
+export const DISPATCH_SCRIPT = `\
+          set -euo pipefail
+          # The item runs that have not completed yet (queued, waiting in a
+          # slot, or in progress), by run name.
+          active="$(gh run list -R "\${REPO}" --workflow ${ITEM_DISPATCH_WORKFLOW_FILE} --limit 1000 --json displayTitle,status --jq '.[] | select(.status != "completed") | .displayTitle')"
+          mapfile -t items < <(printf '%s' "\${ITEMS}" | jq -r '.[]')
+          i=0
+          for item in "\${items[@]}"; do
+            slot=$(( i % MAX_PARALLEL ))
+            i=$(( i + 1 ))
+            if printf '%s\\n' "\${active}" | grep -Fxq -- "${ITEM_RUN_NAME_PREFIX} \${item}"; then
+              echo "skipped    \${item}  slot \${slot}  (its '${ITEM_RUN_NAME_PREFIX} \${item}' run is not completed)"
+              continue
+            fi
+            args=(-f "item=\${item}" -f "slot=\${slot}" -f "integrationMode=\${INTEGRATION_MODE}")
+${GATE_OVERRIDES.map(
+	(g) =>
+		`            if [ -n "\${${g.env.replace(/^DORFL_/, 'DISPATCH_')}}" ]; then args+=(-f "${g.input}=\${${g.env.replace(/^DORFL_/, 'DISPATCH_')}}"); fi`,
+).join('\n')}
+            gh workflow run ${ITEM_DISPATCH_WORKFLOW_FILE} -R "\${REPO}" --ref "\${DEFAULT_BRANCH}" "\${args[@]}"
+            echo "dispatched \${item}  slot \${slot}  (run '${ITEM_RUN_NAME_PREFIX} \${item}')"
+          done`;
+
 /**
  * Generate the advance-lifecycle workflow YAML by PARAMETERISING the seed
  * `docs/ci/advance-loop.yml.template`. Deterministic: the same config produces
- * byte-identical output. The workflow is a FIXED shell (ADR §6: all policy is
- * env/config, so the artifact carries no config-derived policy beyond the env-block
- * scaffolding) — `config` is accepted for parity with the `CapabilityEmitter` seam
- * and future per-config wiring, but the advance-lifecycle shape itself is
- * config-independent.
- *
- * This is the absorbed seed, with two parameterisations: (1) it wires the SHARED
- * composite setup action (`./.github/actions/dorfl-setup`, emitted by the
- * core task) into every job; (2) it surfaces the engine gate family — including
- * the two calm-default LIFECYCLE gates — as the `DORFL_*` env block, so the
- * out-of-the-box tick asks nothing until the user opts in. The seed's capability-F
- * reap job + `sweepMergedBranches` input are PRESERVED verbatim (NOT stripped); no
- * separate gc-sweep workflow is emitted.
+ * byte-identical output. The only config it reads is `maxParallel` (the number
+ * of concurrency slots the `dispatch` job spreads the item runs over).
  */
 export function generateAdvanceLifecycleWorkflow(
 	config: ResolvedCIConfig,
 ): string {
-	// The agent-running jobs (propose / merge) pass the configured provider
-	// secret(s) to the setup action ONCE via `with:`; the action forwards them to
-	// `$GITHUB_ENV` so `pi` can authenticate (models-json mode). auth-json mode has
-	// no provider keys here (it uses auth.json), so the block is empty.
-	const setupWith = providerSecretsWithBlock(config);
+	const enumerateGate = gateOverridesStep({
+		source: 'github.event.inputs',
+		ifDispatch: true,
+		comment: `\
+        # MUST run BEFORE \`scan\`: scan's pools are gated by the SAME engine
+        # gate family (autoTask/autoBuild + lifecycle observationTriage/
+        # surfaceBlockers), so an override that does not reach this job empties
+        # the item list and is silently inert. \`if:\` + the inner \`[ -n ... ]\`
+        # guard keep schedule/push (and a blank dispatch field) exporting
+        # NOTHING: an empty DORFL_* would make env-config coercion throw. The
+        # inputs reach the shell through \`env:\` as DATA, never as \`\${{ }}\` text
+        # spliced into the script, and the \`case\` guards stop a value from
+        # appending its own lines to $GITHUB_ENV.`,
+	});
+	const dispatchGateEnv = GATE_OVERRIDES.map(
+		(g) =>
+			`          ${g.env.replace(/^DORFL_/, 'DISPATCH_')}: \${{ github.event.inputs.${g.input} }}`,
+	).join('\n');
 	return `\
 # dorfl — the ADVANCE LIFECYCLE loop in CI (capability C: auto-triage
 # observations + surface declared blockers + apply committed answers, spec
@@ -112,36 +155,40 @@ export function generateAdvanceLifecycleWorkflow(
 # on their own time.
 #
 # CI ALWAYS invokes \`advance\` (NEVER a user-chosen verb): \`advance\` is a strict
-# superset of \`do\`, and with the lifecycle gates at their calm defaults (below) it
+# superset of \`do\`, and with the lifecycle gates at their calm defaults it
 # degrades to exactly \`do\`'s build/task behaviour (ADR
-# ci-config-policy-and-gate-family §1). The triage/surface/apply rungs + the
-# on-answer-committed trigger are EXACTLY what \`advance\` adds over the build/task
-# tick. There is NO \`autoAdvance\` gate — the lifecycle decomposes into the gate
-# family in the env block.
+# ci-config-policy-and-gate-family §1). There is NO \`autoAdvance\` gate.
+#
+# THE SPLIT (ADR ci-agent-job-holds-no-write-token): THIS workflow runs no agent.
+# \`enumerate\` lists the eligible items; \`dispatch\` starts ONE
+# dorfl-item-dispatch.yml run per item, which calls dorfl-item.yml: a lock job
+# (write token, no agent), an agent job (read-only token, no persisted
+# credential) and an apply job (write token, no agent). One run per item gives
+# each item its own artifact namespace. Parallelism: the item runs spread over
+# maxParallel concurrency slots (\`queue: max\`), so at most that many run at
+# once and the rest wait without using runner minutes.
 #
-# ONE WORD, ONE MEANING — \`integrationMode\` drives BOTH the job SHAPE AND the
-# \`--propose\`/\`--merge\` flag the legs pass, so they can NEVER desync:
-#   * propose ⇒ a DYNAMIC matrix (one leg per eligible id, enumerated via
-#               \`dorfl scan --json | jq\`), each leg \`advance --propose\`
-#               opening its OWN PR — a leg can NEVER merge to main.
-#   * merge   ⇒ ALSO a MATRIX (one leg per item; build/gate/review fan out, the
-#               LAND tail — rebase + CAS push to \`main\` — is serialised by the
-#               engine's \`mergeRetries\` CAS-retry loop, NOT by the workflow shape.
-#               SPEC \`land-time-reverify-and-parallel-merge-ceiling\`: a
-#               non-fast-forward push triggers re-rebase + re-gate + retry, never
-#               a \`--force\`. The cross-job serialiser is the CAS-retry FLOOR;
-#               there is NO host-specific \`concurrency:\` group on the merge job).
-# This is integration-mode behaviour, IDENTICAL to the build/task tick
-# (integration mode is verb-independent). The CLAIM CAS, not the matrix, is the
-# real cross-run serialiser: a leg that loses the claim race exits clean.
+# ONE WORD, ONE MEANING — \`integrationMode\` is forwarded to every item run,
+# which passes it to \`advance\` as \`--propose\`/\`--merge\`:
+#   * propose ⇒ each item opens its OWN PR; an item run can NEVER merge to main.
+#   * merge   ⇒ each item lands on main. The LAND tail (rebase + CAS push) is
+#               serialised by the engine's \`mergeRetries\` CAS-retry loop in the
+#               apply job, NOT by a workflow shape: a non-fast-forward push
+#               re-rebases and retries, never a \`--force\`. A lost CAS does NOT
+#               re-run the gate (the gate ran in the agent job, minutes
+#               earlier); the apply phase reports every land whose tree differs
+#               from the gated tree ("landed without re-gate after N lost
+#               races") in its output and the landed commit's trailer.
+# The CLAIM CAS, not the workflow, is the real cross-run serialiser: an item run
+# that loses the claim race exits clean, and a duplicate run re-classifies at the
+# fresh arbiter tip.
 #
 # CI runs IN-PLACE (the CI container IS the isolation): NO --isolated/--remote/
 # registry (laptop-only affordances). The concurrency group below stops
 # overlapping ticks of the same ref from colliding.
 #
-# SAFETY (US #9): the running job is FORBIDDEN from editing the workflows tree
-# under .github. It requests NO \`workflows\` permission, so it can never rewrite
-# its own triggers.
+# SAFETY (US #9): no job here requests a \`workflows\` permission, so none can
+# rewrite its own triggers.
 
 name: advance-lifecycle
 
@@ -152,15 +199,18 @@ on:
     # (here: hourly).
     - cron: '0 * * * *'
   push:
-    # On-answer-committed: a push that touches an answered question sidecar
-    # (\`work/questions/**\`) re-runs the loop so the human's answer is applied
-    # promptly. This is the lifecycle-specific trigger \`do\` cannot provide.
+    # On-answer-committed: a push to the DEFAULT BRANCH that touches an answered
+    # question sidecar (\`work/questions/**\`) re-runs the loop so the human's
+    # answer is applied promptly. Pinned to main: a work-branch push touching a
+    # sidecar must never run the lifecycle on that branch.
+    branches:
+      - main
     paths:
       - 'work/questions/**'
   workflow_dispatch:
     inputs:
       integrationMode:
-        description: "Integration mode (drives BOTH the integration flag passed to \`advance\` AND the job shape): propose ⇒ a matrix, each leg \`advance --propose\` (one PR per item); merge ⇒ a matrix, each leg \`advance --merge\` (one item — build/gate/review fan out in parallel; the LAND tail is serialised by the engine's \`mergeRetries\` CAS-retry loop, not by the workflow shape)."
+        description: "Integration mode, forwarded to every item run as \`advance --propose\`/\`--merge\`: propose ⇒ one PR per item; merge ⇒ each item lands on main (the LAND tail is serialised by the engine's \`mergeRetries\` CAS-retry loop, not by the workflow shape)."
         required: false
         default: 'propose'
         type: choice
@@ -176,10 +226,9 @@ on:
       # Override an engine gate for THIS manual run only, riding the env layer of
       # flag > env > per-repo > global > default. Modelled as \`type: choice\` with a
       # BLANK first option (not \`type: boolean\`, which cannot represent "unset"):
-      # blank ⇒ emit NOTHING (the committed dorfl.json wins, today's
-      # behaviour); a non-blank choice ⇒ export the matching DORFL_* for this
-      # run. The blank is load-bearing: env-config coercion THROWS on an empty
-      # string, so the per-job step below only writes when the input is non-blank.
+      # blank ⇒ emit NOTHING (the committed dorfl.json wins); a non-blank choice ⇒
+      # export the matching DORFL_* in \`enumerate\` and forward it to every item
+      # run (its lock, agent and apply jobs).
       autoBuild:
         description: 'One-shot override of the autoBuild gate (DORFL_AUTO_BUILD) for THIS dispatch run only. Blank ⇒ no override (config wins).'
         required: false
@@ -224,126 +273,60 @@ concurrency:
   group: advance-lifecycle-\${{ github.ref }}
   cancel-in-progress: false
 
-# NO \`workflows\` permission: the running job can NEVER edit the workflows tree
-# under .github (US #9). \`contents: write\` + \`pull-requests: write\` are all this
-# tick needs (commit work, open PRs); it never rewrites its triggers.
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  # The resolved integration mode: the dispatch input when present, else \`propose\`
-  # (the conservative default — one PR per item, a human merges). This single value
-  # selects BOTH the job shape (via the \`if:\` guards below) AND the integration flag
-  # the \`advance\` legs pass (\`--propose\`/\`--merge\`), so they can never desync.
-  INTEGRATION_MODE: \${{ github.event.inputs.integrationMode || 'propose' }}
-  # Reap merged remote work/* branches on the scheduled tick (capability F). ON by
-  # default (the empty dispatch input on a \`schedule\`/\`push\` trigger reads as the
-  # default); set the \`sweepMergedBranches\` dispatch input to \`false\` to opt out.
-  # This is the provider-agnostic hygiene sweep (\`gc --remote-branches\`) for
-  # out-of-band human/UI PR merges, whose work/<slug> branch nothing else deletes.
-  SWEEP_MERGED_BRANCHES: \${{ github.event.inputs.sweepMergedBranches || 'true' }}
-
-  # ── The engine GATE FAMILY is resolved FROM CONFIG, not carried here ─────────
-  # CI is NOT a special policy surface (ADR ci-config-policy-and-gate-family §5):
-  # it runs the SAME engine gates, resolved through flag > env > per-repo > global
-  # > default. The SAME dorfl.json the laptop uses applies here. This
-  # workflow emits NO DORFL_AUTO_BUILD / DORFL_AUTO_TASK /
-  # DORFL_OBSERVATION_TRIAGE / DORFL_SURFACE_BLOCKERS line on a
-  # SCHEDULE/PUSH tick, so the env layer carries NO defaults there — your committed
-  # dorfl.json wins (then the global config, then the strict built-in
-  # defaults autoBuild:false / autoTask:false / observationTriage:'off' /
-  # surfaceBlockers:false). The ONE exception is a manual \`workflow_dispatch\` where
-  # you fill a gate override input (above): the per-job step then exports that ONE
-  # DORFL_* for that run only (blank input ⇒ still nothing). The override
-  # MUST be wired into every job that resolves the gate family — including the
-  # \`enumerate\` scan (it gates the matrix pools via observationTriage/surfaceBlockers
-  # /autoTask/autoBuild), not just the agent-running jobs — or the override is inert
-  # for the very pools it targets. To enable CI autonomy durably, set the gate(s) in
-  # dorfl.json (applies everywhere) — NOT by re-running install-ci (ADR §6:
-  # install-ci is one-time).
+# Nothing at workflow level: each job grants its own scopes. NO job requests a
+# \`workflows\` permission (US #9).
+permissions: {}
+
+# ── The engine GATE FAMILY is resolved FROM CONFIG, not carried here ─────────
+# CI is NOT a special policy surface (ADR ci-config-policy-and-gate-family §5):
+# it runs the SAME engine gates, resolved through flag > env > per-repo > global
+# > default. This workflow emits NO DORFL_AUTO_BUILD / DORFL_AUTO_TASK /
+# DORFL_OBSERVATION_TRIAGE / DORFL_SURFACE_BLOCKERS line on a SCHEDULE/PUSH tick,
+# so your committed dorfl.json wins (then the global config, then the strict
+# built-in defaults autoBuild:false / autoTask:false / observationTriage:'off' /
+# surfaceBlockers:false). The ONE exception is a manual \`workflow_dispatch\` where
+# you fill a gate override input (above): \`enumerate\` exports it for its scan and
+# \`dispatch\` forwards it to every item run. To enable CI autonomy durably, set
+# the gate(s) in dorfl.json (applies everywhere) — NOT by re-running install-ci
+# (ADR §6: install-ci is one-time).
 
 jobs:
-  # ── ENUMERATE (propose only) ────────────────────────────────────────────────
-  # Build the DYNAMIC matrix from the eligible-pool scan. \`scan --json\` reports
-  # BOTH the registry/hub-mirror pool (\`repos[].items[]\`, \`repos[].specs[]\`,
-  # \`repos[].lifecycle\`) AND the in-place working checkout (\`cwd.repo.items[]\`,
-  # \`cwd.repo.specs[]\`, \`cwd.repo.lifecycle\`); CI runs IN-PLACE so the items live
-  # in the latter (a fresh runner has no registered mirror). \`jq\` unions + dedups
-  # the build/task pools AND the LIFECYCLE pools into a deduplicated GitHub
-  # Actions matrix list of explicit \`task:<slug>\` / \`spec:<slug>\` / \`obs:<slug>\`
-  # ids (CI MUST use explicit prefixes). The lifecycle legs run the WHOLE
-  # answer-loop in propose mode (not only merge): \`obs:\` (triage untriaged
-  # observations), surface \`task:\`/\`spec:\` (\`needsAnswers\`, no answered sidecar)
-  # AND apply \`task:\`/\`spec:\` (\`needsAnswers\`, answered sidecar — consume the
-  # committed answer, closing the on-answer \`push: work/questions/**\` loop). Each
-  # becomes one matrix leg → one independent \`advance --propose\`. Skipped in merge
-  # mode. Inert with calm-default gates (empty triage/surface pools).
+  # ── ENUMERATE ───────────────────────────────────────────────────────────────
+  # List the eligible items. \`scan --json\` reports BOTH the registry/hub-mirror
+  # pool (\`repos[].items[]\`, \`repos[].specs[]\`, \`repos[].lifecycle\`) AND the
+  # in-place working checkout (\`cwd.repo.items[]\`, \`cwd.repo.specs[]\`,
+  # \`cwd.repo.lifecycle\`); CI runs IN-PLACE so the items live in the latter (a
+  # fresh runner has no registered mirror). \`jq\` unions + dedups the build/task
+  # pools AND the LIFECYCLE pools into a list of explicit \`task:<slug>\` /
+  # \`spec:<slug>\` / \`obs:<slug>\` ids (CI MUST use explicit prefixes): \`obs:\`
+  # (triage untriaged observations), surface \`task:\`/\`spec:\` (\`needsAnswers\`,
+  # no answered sidecar) AND apply \`task:\`/\`spec:\`/\`observation:\` (an answered
+  # sidecar — consume the committed answer, closing the on-answer
+  # \`push: work/questions/**\` loop). Read-only: it runs no agent and writes
+  # nothing.
   enumerate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       items: \${{ steps.scan.outputs.items }}
       any: \${{ steps.scan.outputs.any }}
-      # Dynamic GitHub-backstop cap (spec
-      # \`graceful-pre-timeout-wip-checkpoint\`): the agent-leg jobs
-      # (advance-propose / advance-merge) read this as their
-      # \`timeout-minutes\` — replacing the retired static
-      # \`legTimeoutMinutes\`. Computed at run time from the committed
-      # \`dorfl.json\` (via \`dorfl config --json\`) as
-      # \`agentDeadlineMinutes + checkpointHeadroomMinutes\`, so an edit to
-      # \`dorfl.json\` reflects EVERYWHERE (the internal deadline the legs
-      # honour AND this GitHub cap) on the NEXT tick — no \`install-ci\`
-      # re-run, no baked-in YAML number.
-      githubTimeout: \${{ steps.timeout.outputs.githubTimeout }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/dorfl-setup
-      - name: apply dispatch gate overrides (one-shot, this run only)
-        # MUST run BEFORE \`scan\`: scan's matrix pools are gated by the SAME engine
-        # gate family (autoTask/autoBuild + lifecycle observationTriage/
-        # surfaceBlockers), so an override that does not reach this job produces an
-        # empty matrix and is silently inert. \`if:\` + the inner \`[ -n ... ]\` guard
-        # keep schedule/push (and a blank dispatch field) exporting NOTHING — an
-        # empty DORFL_* would make env-config coercion throw. The inputs reach the
-        # shell through \`env:\` as DATA, never as \`\${{ }}\` text spliced into the
-        # script (GitHub's script-injection guidance), and the \`case\` guard stops a
-        # value from appending its own lines to $GITHUB_ENV. Both only matter if an
-        # input ever stops being a fixed \`type: choice\`; for the choices below the
-        # step writes exactly what it always did.
-        if: \${{ github.event_name == 'workflow_dispatch' }}
-        env:
-          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
-          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
-          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
-          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
-        run: |
-          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
-            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
-          esac
-          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
-          true
+      - uses: ${WRITER_SETUP_ACTION_USES}
+${enumerateGate}
       - id: scan
-        # Enumerate eligible items as namespaced ids, one matrix leg per id. CI
-        # uses explicit \`task:\` / \`spec:\` / \`obs:\` prefixes, never bare (ADR
-        # command-surface §3a). Eligible TASKS ⇒ \`task:<slug>\` legs (\`advance\`
-        # builds them); TASKABLE SPECS ⇒ \`spec:<slug>\` legs (\`advance\` auto-tasks
-        # them, capability B — \`DORFL_AUTO_TASK\` above). LIFECYCLE pools:
-        # \`lifecycle.triage[]\` ⇒ \`obs:<slug>\` (the \`obs:\` prefix is fixed here),
-        # \`lifecycle.surface[]\` + \`lifecycle.apply[]\` ⇒ \`.namespace + ":" + .slug\`
-        # (surface: \`task:\`/\`spec:\` blocker-question legs; apply: \`task:\`/\`spec:\`
-        # AND \`observation:\` legs — an answered observation sidecar is consumed by
-        # the apply rung too, so it MUST carry through here). CI runs IN-PLACE, so we use
-        # \`scan --here\`: it reports ONLY the cwd checkout (\`cwd.repo.*\`) and SKIPS
-        # the cross-repo registry loop (no N-mirror fetches; a fresh runner has no
-        # registered mirror anyway). The \`cwd\` arbiter is the checkout's own clone,
-        # so the fetch-first is a near-noop. \`jq\` still reads the (now-empty)
-        # \`repos[]\` branches harmlessly; we union + dedup so the matrix has one
-        # leg per item.
+        # Enumerate eligible items as namespaced ids, one item run per id.
+        # Eligible TASKS ⇒ \`task:<slug>\` (\`advance\` builds them); TASKABLE SPECS
+        # ⇒ \`spec:<slug>\` (\`advance\` auto-tasks them, capability B). LIFECYCLE
+        # pools: \`lifecycle.triage[]\` ⇒ \`obs:<slug>\`, \`lifecycle.surface[]\` +
+        # \`lifecycle.apply[]\` ⇒ \`.namespace + ":" + .slug\` (an answered
+        # observation sidecar is consumed by the apply rung too, so
+        # \`observation:\` MUST carry through here). \`scan --here\` reports ONLY
+        # the cwd checkout (\`cwd.repo.*\`) and skips the cross-repo registry
+        # loop; \`jq\` still reads the (now-empty) \`repos[]\` branches harmlessly.
         run: |
           items="$(dorfl scan --json --here \\
             | jq -c '[(.repos[].items[]?, .cwd.repo.items[]?) | select(.eligibility.eligible == true) | "task:" + .slug] + [(.repos[].specs[]?, .cwd.repo.specs[]?) | select(.eligibility.eligible == true) | "spec:" + .slug] + [(.repos[].lifecycle.triage[]?, .cwd.repo.lifecycle.triage[]?) | "obs:" + .slug] + [(.repos[].lifecycle.surface[]?, .cwd.repo.lifecycle.surface[]?, .repos[].lifecycle.apply[]?, .cwd.repo.lifecycle.apply[]?) | .namespace + ":" + .slug] | unique')"
@@ -353,192 +336,76 @@ jobs:
           else
             echo "any=false" >> "$GITHUB_OUTPUT"
           fi
-      - id: timeout
-        # Dynamic GitHub-backstop cap (spec
-        # \`graceful-pre-timeout-wip-checkpoint\` — step 5): read the committed
-        # \`dorfl.json\` via \`dorfl config --json\` (in-place, so the resolution
-        # chain reads THIS repo's file exactly like \`scan --here\`), and emit
-        # \`githubTimeout = agentDeadlineMinutes + checkpointHeadroomMinutes\` as
-        # a job OUTPUT the agent-leg jobs consume via
-        # \`timeout-minutes: \${{ needs.enumerate.outputs.githubTimeout }}\`. So
-        # the SAME committed config drives BOTH the legs' internal deadline AND
-        # this GitHub cap — edit + commit, next tick uses it for both, no
-        # \`install-ci\` re-run, no baked YAML number. \`dorfl.json\` is the
-        # single source read at run time by BOTH consumers.
-        run: |
-          cap="$(dorfl config --json \\
-            | jq '.agentDeadlineMinutes + .checkpointHeadroomMinutes')"
-          echo "githubTimeout=\${cap}" >> "$GITHUB_OUTPUT"
-
-  # ── PROPOSE: a MATRIX of independent jobs (one PR per item) ──────────────────
-  # True parallelism — each item is an independent PR, so a matrix is the right
-  # parallel shape and \`-n\` is NOT needed. Each leg passes \`--propose\`, tying the
-  # integration mode to THIS shape: it sits at the top of the precedence chain, so
-  # the workflow mode always wins over the repo config default and a leg can NEVER
-  # merge to main. Explicit \`task:\`/\`spec:\` prefixes only, never bare.
-  advance-propose:
+
+  # ── DISPATCH: one dorfl-item-dispatch.yml run per item ──────────────────────
+  # \`actions: write\` and NOTHING else, NO checkout and NO setup: no repository
+  # code runs next to \`actions: write\`, only the runner's preinstalled \`gh\` and
+  # \`jq\`. Each item run joins the slot dorfl-slot-<index mod maxParallel>
+  # (\`queue: max\`), so at most maxParallel (install-ci --max-parallel) item runs
+  # execute at once: each spawns a full agent session, and an unbounded fan-out
+  # exhausts the model provider's rate limit and thrashes the arbiter-main CAS.
+  # An item whose \`dorfl-item <item>\` run has not completed yet is SKIPPED (a
+  # tick ends as soon as it has dispatched, so the next tick can come while
+  # earlier runs still wait in a slot); a duplicate that slips through a race is
+  # harmless (its lock job re-classifies at the fresh arbiter tip). Every value
+  # reaches the script through \`env:\`; the log lists each item, its slot and
+  # whether it was dispatched or skipped.
+  dispatch:
     needs: enumerate
-    if: \${{ (github.event.inputs.integrationMode || 'propose') == 'propose' && needs.enumerate.outputs.any == 'true' }}
+    if: \${{ needs.enumerate.outputs.any == 'true' }}
     runs-on: ubuntu-latest
-    # Per-leg wall-clock cap: the DYNAMIC GitHub backstop the enumerate job
-    # emits (spec \`graceful-pre-timeout-wip-checkpoint\`), computed at run
-    # time from the committed \`dorfl.json\` as
-    # \`agentDeadlineMinutes + checkpointHeadroomMinutes\`. It is a STRICTLY
-    # LARGER backstop than the dorfl-internal deadline the leg self-stops at
-    # (which SAVES its WIP + auto-continues on the next tick), so the GitHub
-    # SIGKILL only fires if the graceful save itself wedges. Editing
-    # \`dorfl.json\` flips BOTH the internal deadline AND this cap on the
-    # next tick — no \`install-ci\` re-run, no baked-in YAML number.
-    # A job output is always a STRING; \`timeout-minutes\` needs an INTEGER, so
-    # coerce it with \`fromJson(...)\` (the same pattern the \`item\` matrix uses).
-    # A raw \`\${{ ... }}\` substitution makes GitHub reject it ("Unexpected
-    # value '45'").
-    timeout-minutes: \${{ fromJson(needs.enumerate.outputs.githubTimeout) }}
-    strategy:
-      # Independent PRs: one failing item must NOT cancel the others.
-      fail-fast: false
-      # Cap concurrent legs (config \`maxParallel\`, install-ci --max-parallel):
-      # each leg spawns a FULL agent session (build + Gate-2 review), so an
-      # unbounded fan-out over a large item set exhausts the model-provider API
-      # rate limit (429s that strand legs as transient-infra stuck) AND thrashes
-      # the arbiter-main CAS. A bounded fan-out drains steadily instead.
-      max-parallel: ${config.maxParallel}
-      matrix:
-        item: \${{ fromJson(needs.enumerate.outputs.items) }}
+    permissions:
+      actions: write
     steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-      - uses: ./.github/actions/dorfl-setup${setupWith}
-      - name: apply dispatch gate overrides (one-shot, this run only)
-        # Mirror of the enumerate-job override (see there): export each gate's
-        # DORFL_* ONLY on a workflow_dispatch with a non-blank input, so the
-        # one-shot override also reaches the \`advance\` leg that builds the item.
-        if: \${{ github.event_name == 'workflow_dispatch' }}
+      - name: dispatch one item run per item
         env:
-          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
-          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
-          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
-          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          REPO: \${{ github.repository }}
+          DEFAULT_BRANCH: \${{ github.event.repository.default_branch || 'main' }}
+          ITEMS: \${{ needs.enumerate.outputs.items }}
+          MAX_PARALLEL: '${config.maxParallel}'
+          INTEGRATION_MODE: \${{ github.event.inputs.integrationMode || 'propose' }}
+${dispatchGateEnv}
         run: |
-          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
-            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
-          esac
-          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
-          true
-      - name: advance one item in-place (propose ⇒ opens a PR)
-        # In-place in this checkout (no --isolated/--remote): the CI container IS
-        # the isolation. \`--propose\` can ONLY ride a matrix leg, never the merge
-        # job, so a parallel merge-to-main is structurally impossible.
-        # \`--propose\` shells \`gh\` to open the PR, which reads \`GH_TOKEN\` from the
-        # env (a workflow PERMISSION is not a credential). Prefer a dedicated
-        # \`DORFL_GH_TOKEN\` secret (a PAT / App token) so PRs carry YOUR
-        # identity AND trigger downstream workflows (PRs opened with the built-in
-        # \`GITHUB_TOKEN\` are \`github-actions[bot]\` and do NOT trigger further
-        # \`on: pull_request\` runs). Falls back to the auto \`GITHUB_TOKEN\` so it
-        # works zero-config; the job's \`pull-requests: write\` scopes that token.
-        env:
-          GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
-          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
-          # file name). dorfl sanitises the slugs it mints, but a hand-written
-          # one is only checked when \`advance\` resolves it, so it reaches the
-          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
-          # spliced into the script.
-          WORK_ITEM: \${{ matrix.item }}
-        # \`--watch\` streams the build agent's high-signal turns (assistant text,
-        # tool calls, finish) into THIS job log live, so the run shows the agent
-        # working instead of freezing after "Start work". A read-only observer (no
-        # outcome/gate/git effect). It fits because each matrix leg names ONE item
-        # (one pi session to tail) — the merge job is now a per-item matrix too
-        # (see below) and streams the same way.
-        run: dorfl advance "\${WORK_ITEM}" --propose --watch --arbiter origin
-
-  # ── MERGE: a MATRIX of independent jobs (parallel build/gate/review, serialised land) ──
-  # SPEC \`land-time-reverify-and-parallel-merge-ceiling\` (stories 4 + 6): each item
-  # gets its own leg; build/gate/review run concurrently across siblings; the LAND
-  # TAIL is serialised by the engine's \`mergeRetries\` CAS-retry loop — the
-  # git-alone floor — NOT by the workflow shape. A non-fast-forward push triggers
-  # re-rebase + re-gate + retry up to the resolved \`mergeRetries\` cap; never a
-  # \`--force\`. NO host-specific \`concurrency:\` group on this job (it would be
-  # load-bearing for cross-job safety, breaking the floor framing).
-  # The fully-autonomous-to-main path (this job + all gates on) is still a LOUD,
-  # NON-DEFAULT opt-in: the default integrationMode is \`propose\`, so reaching
-  # merge-to-main requires deliberately dispatching/pinning \`merge\`.
-  advance-merge:
-    needs: enumerate
-    if: \${{ (github.event.inputs.integrationMode || 'propose') == 'merge' && needs.enumerate.outputs.any == 'true' }}
+${DISPATCH_SCRIPT}
+
+  # ── SURFACE MERGE QUESTIONS (no agent) ──────────────────────────────────────
+  # Ask a merge question (a \`kind: merge\` sidecar entry the human answers
+  # \`merge | hold | drop\`) for every unmerged \`work/task-<slug>\` branch with no
+  # open PR (an open PR already is the land decision), whose task rests in
+  # tasks/ready/ or tasks/backlog/, whose lock is free or kept by its finished
+  # propose build, and whose tip carries the done-move; then publish the
+  # questions to main. An answered \`merge\` is enumerated like any answered
+  # sidecar and lands through the item run's apply rung. Gated by the
+  # \`mergeQuestions\` config (off|ask, default ask): \`off\` surfaces nothing.
+  # Deterministic: it runs no agent, so the writer-role setup (Node and dorfl
+  # only). It fetches the arbiter before listing the branches. \`gh\` reads the
+  # open PRs with the built-in token (\`pull-requests: read\`); a failed PR
+  # listing fails the job loudly rather than skipping every branch silently.
+  surface-merge-questions:
     runs-on: ubuntu-latest
-    # Per-leg wall-clock cap: the DYNAMIC GitHub backstop the enumerate job
-    # emits (see advance-propose for the rationale). \`fromJson(...)\` coerces the
-    # string job output to the INTEGER \`timeout-minutes\` requires.
-    timeout-minutes: \${{ fromJson(needs.enumerate.outputs.githubTimeout) }}
-    strategy:
-      # Independent landings: one failing item must NOT cancel the others; a
-      # loser of the CAS race re-rebases + re-gates + retries.
-      fail-fast: false
-      # Cap concurrent legs (config \`maxParallel\`, see advance-propose): a FULL
-      # agent session per leg, so bound the fan-out to avoid API-429s + CAS thrash.
-      max-parallel: ${config.maxParallel}
-      matrix:
-        item: \${{ fromJson(needs.enumerate.outputs.items) }}
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/dorfl-setup${setupWith}
-      - name: apply dispatch gate overrides (one-shot, this run only)
-        # Mirror of the enumerate-job override (see there): export each gate's
-        # DORFL_* ONLY on a workflow_dispatch with a non-blank input. The
-        # merge job re-scans the pool inside \`advance -n\`, so it needs the override
-        # too for the lifecycle/task pools to reflect it.
-        if: \${{ github.event_name == 'workflow_dispatch' }}
-        env:
-          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
-          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
-          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
-          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
-        run: |
-          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
-            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
-          esac
-          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
-          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
-          true
-      - name: advance one item in-place (merge ⇒ rebase + CAS land on main)
-        # In-place (no --isolated/--remote). \`--merge\` ties the integration mode
-        # to THIS (matrix) shape: it sits at the top of the precedence chain, so
-        # the workflow mode always wins over the repo's \`dorfl.json\` default.
-        # Cross-job land safety comes from the engine's CAS-retry loop, not from
-        # this workflow's job shape. \`gh\` (merge / PR housekeeping) reads
-        # \`GH_TOKEN\` from the env.
+      - uses: ${WRITER_SETUP_ACTION_USES}
+      - name: surface merge questions for unmerged work/* branches (surface-merge-questions)
         env:
-          GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
-          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
-          # file name). dorfl sanitises the slugs it mints, but a hand-written
-          # one is only checked when \`advance\` resolves it, so it reaches the
-          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
-          # spliced into the script.
-          WORK_ITEM: \${{ matrix.item }}
-        # \`--watch\` streams the build agent's high-signal turns into THIS job
-        # log live; each leg names ONE item, so it fits the same way it does on
-        # the propose legs.
-        run: dorfl advance "\${WORK_ITEM}" --merge --watch --arbiter origin
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: dorfl surface-merge-questions --arbiter origin
 
   # ── REAP merged remote work/* branches (capability F, the hygiene sweep) ─────
   # PRESERVED from the seed (NOT a separate gc-sweep workflow): the provider-
   # agnostic counterpart of the worktree reaper. Deletes remote \`work/<slug>\`
   # branches that are PROVABLY MERGED into \`origin/main\`, so an out-of-band
   # human/UI PR merge stops leaving its branch lingering on the arbiter.
-  # Independent of the integration mode (both propose- and merge-mode repos
-  # accumulate out-of-band-merged branches), so it runs on EVERY tick regardless
+  # Independent of the integration mode, so it runs on EVERY tick regardless
   # of \`integrationMode\` — gated ONLY by the \`sweepMergedBranches\` opt-out (ON by
   # default). It NEVER touches an un-merged/in-flight branch and NEVER \`--force\`s.
-  # Plain git, so it works against any provider (incl. a \`--bare\` arbiter).
+  # It runs no agent: the writer-role setup (Node and dorfl only).
   #
   # OPTIONAL belt-and-suspenders for a GitHub arbiter: enable the repo-level
   # "Automatically delete head branches" setting (\`delete_branch_on_merge\`), owned
@@ -548,11 +415,13 @@ jobs:
   reap-merged-branches:
     if: \${{ (github.event.inputs.sweepMergedBranches || 'true') == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
-      - uses: ./.github/actions/dorfl-setup
+      - uses: ${WRITER_SETUP_ACTION_USES}
       - name: reap merged remote work/* branches + orphan sidecars (gc --remote-branches)
         # Deletes ONLY branches provably merged into origin/main; reports
         # deleted-vs-retained-with-reason. Safe to run every tick (idempotent).
@@ -606,14 +475,23 @@ export function validateAdvanceLifecycleWorkflow(
 		.filter((line) => !/^\s*#/.test(line))
 		.join('\n');
 
-	// --- Always invokes `advance`, NEVER `do` ----------------------------------
-	require('invokes-advance', /dorfl advance\b/.test(
-		text,
-	), 'the workflow must invoke the `advance` driver (CI always runs `advance`).');
+	// --- The tick runs NO agent: it dispatches one item run per item ------------
+	require('dispatches-item-runs', /gh workflow run dorfl-item-dispatch\.yml\b/.test(
+		operative,
+	), 'the `dispatch` job must start one `dorfl-item-dispatch.yml` run per item ' +
+		'(`gh workflow run dorfl-item-dispatch.yml`), which calls dorfl-item.yml.');
+	require('no-agent-verb-in-tick', !/dorfl (?:advance|do|intake|run)\b/.test(
+		operative,
+	), 'the tick itself must run NO agent-spawning verb: `advance` runs inside ' +
+		'the per-item workflow (lock, agent, apply jobs).');
 	require('never-invokes-do', !/dorfl do\b/.test(
 		operative,
 	), 'the workflow must NEVER invoke `do` directly (CI always invokes `advance`, ' +
 		'ADR ci-config-policy-and-gate-family §1).');
+	require('no-matrix', !/\bstrategy:\s*[\s\S]*?matrix:/.test(
+		operative,
+	), 'no job may use a `strategy.matrix`: one item per workflow run (a matrix ' +
+		'shares one artifact namespace across items, decision 1).');
 
 	// --- Triggers: cron + workflow_dispatch + the on-answer-committed push -------
 	require('trigger-cron', /\bschedule:\s*[\s\S]*?-\s*cron:/.test(
@@ -632,62 +510,43 @@ export function validateAdvanceLifecycleWorkflow(
 		text,
 	), 'must trigger on-answer-committed (a push touching `work/questions/**`) — ' +
 		'the lifecycle answer loop.');
+	// ... on the DEFAULT BRANCH only: a work-branch push touching a sidecar must
+	// never run the lifecycle (observation
+	// `advance-lifecycle-push-trigger-lands-an-unreviewed-work-branch-on-main`).
+	require('push-pinned-to-main', /\bpush:\s*\n\s+(?:#[^\n]*\n\s+)*branches:\s*\n\s+-\s*main\b/.test(
+		text,
+	), 'the on-answer-committed `push` trigger must be pinned to the default ' +
+		'branch (`branches: [main]`).');
 
-	// --- integrationMode drives BOTH shape and flag (one word, one meaning) -----
+	// --- integrationMode is forwarded to every item run (one word) -------------
 	require('integration-mode-one-word', /integrationMode:/.test(text) &&
 		/github\.event\.inputs\.integrationMode/.test(
 			text,
-		), 'the dispatch input must be `integrationMode` (one word driving BOTH the ' +
-		'flag and the derived job shape).');
-
-	// --- propose ⇒ a DYNAMIC matrix enumerated via `scan --json` ----------------
-	require('propose-matrix', /strategy:\s*[\s\S]*?matrix:/.test(
-		text,
-	), '`propose` mode must emit a MATRIX of jobs (`strategy.matrix`).');
-	require('propose-enumerates-via-scan', /dorfl scan --json/.test(
-		text,
-	), 'the matrix items must be ENUMERATED via the eligible-pool scan ' +
-		'(`dorfl scan --json`).');
-	require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(
-		text,
-	), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-		'(one PR per item), reading the item from the step env (`WORK_ITEM`).');
-	// The item id is a slug that may be hand-written (only minted slugs are
-	// sanitised), so it must reach the shell as DATA through `env:`, never as `${{ }}` text
-	// spliced into the `run:` script (GitHub Actions script injection).
-	require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(
+		), 'the dispatch input must be `integrationMode` (one word, forwarded to ' +
+		'every item run as `--propose`/`--merge`).');
+	require('dispatch-forwards-integration-mode', /-f "integrationMode=\$\{INTEGRATION_MODE\}"/.test(
 		operative,
-	), 'the matrix item must NOT be interpolated into the `run:` script as ' +
-		'`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
-		'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
-	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(
-		text,
-	), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
-		'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
-		'dispatch mode).');
-
-	// --- merge ⇒ a MATRIX per item (parallel build/gate/review, serialised land) -
-	// SPEC `land-time-reverify-and-parallel-merge-ceiling` stories 4 + 6: build/
-	// gate/review fan out; the LAND tail is serialised by the engine's
-	// `mergeRetries` CAS-retry loop (the git-alone floor), NOT the workflow.
-	require('merge-matrix', /advance-merge:[\s\S]*?strategy:\s*[\s\S]*?matrix:/.test(
-		text,
-	), 'the `merge` job must use a MATRIX (parallel build/gate/review per item; ' +
-		"the land tail is serialised by the engine's `mergeRetries` CAS-retry " +
-		"loop, not by the workflow's job shape).");
-	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(
-		text,
-	), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
-		'TIED to the matrix shape (a leg can never propose-only / desync from the ' +
-		'dispatch mode).');
-	// No host-specific cross-job serialiser on the merge job: a GitHub Actions
-	// `concurrency:` block there would make cross-job land safety depend on a host
-	// feature, breaking the git-alone-floor framing (Applied Answer q1).
-	require('merge-no-host-concurrency-serialiser', !/advance-merge:[\s\S]*?\n\s{4}concurrency:/.test(
+	), 'the `dispatch` job must forward `integrationMode` to each item run.');
+	require('dispatch-slot', /-f "slot=\$\{slot\}"/.test(operative) &&
+		/i % MAX_PARALLEL/.test(
+			operative,
+		), 'the `dispatch` job must give each item run a slot (index mod ' +
+		'maxParallel), the concurrency group that caps the parallelism.');
+	require('dispatch-skips-active-runs', /gh run list[^\n]*--workflow dorfl-item-dispatch\.yml[^\n]*displayTitle,status/.test(
+		operative,
+	), 'the `dispatch` job must list the non-completed `dorfl-item-dispatch.yml` ' +
+		'runs and skip an item whose `dorfl-item <item>` run is still active.');
+	require('dispatch-actions-write-only', /\n {2}dispatch:[\s\S]*?\n {4}permissions:\s*\n {6}actions: write\s*\n {4}steps:/.test(
 		text,
-	), 'the `merge` job must NOT carry a `concurrency:` group: a host-specific ' +
-		'serialiser would make the cross-job land safety depend on a GitHub Actions ' +
-		"feature; the engine's `mergeRetries` CAS-retry loop is the git-alone floor.");
+	), 'the `dispatch` job must hold `actions: write` and nothing else.');
+	require('dispatch-no-checkout-no-setup', !/\n {2}dispatch:[\s\S]*?(?:\n {2}\S|$)/
+		.exec(operative)?.[0]
+		.match(/uses:/), 'the `dispatch` job must have NO checkout and NO setup ' +
+		'(no repository code runs next to `actions: write`).');
+	require('item-values-not-spliced-into-run', !/gh workflow run[^\n]*\$\{\{/.test(
+		operative,
+	), 'the item list and inputs must reach the dispatch script through `env:`, ' +
+		'never as `${{ }}` text in the `run:` script.');
 
 	// --- The DORFL_* gate family must NOT be carried as workflow env -----
 	// The workflow emits NO active gate env line for any of AUTO_BUILD / AUTO_TASK
@@ -695,56 +554,34 @@ export function validateAdvanceLifecycleWorkflow(
 	// override layer, NOT the carrier of defaults. Emitting any of them would FORCE
 	// env to win over the repo's own dorfl.json (the precedence is
 	// flag > env > per-repo > global > default), silently shadowing per-repo gate
-	// config in CI — exactly the bug this task closes. A user who genuinely wants a
-	// CI-SPECIFIC override adds the env var themselves (the opt-in CI override the
-	// env layer is FOR). Check the OPERATIVE (non-comment) lines so the explanatory
+	// config in CI. Check the OPERATIVE (non-comment) lines so the explanatory
 	// header comment that NAMES these keys is not a false positive.
-	require('no-gate-env-auto-build', !/DORFL_AUTO_BUILD\s*:/.test(
-		operative,
-	), 'the workflow must NOT emit an `DORFL_AUTO_BUILD:` env assignment ' +
-		'(env carries no defaults; the gate is resolved from per-repo config / built-in default).');
-	require('no-gate-env-auto-task', !/DORFL_AUTO_TASK\s*:/.test(
-		operative,
-	), 'the workflow must NOT emit an `DORFL_AUTO_TASK:` env assignment ' +
-		'(env carries no defaults; the gate is resolved from per-repo config / built-in default).');
-	require('no-gate-env-observation-triage', !/DORFL_OBSERVATION_TRIAGE\s*:/.test(
-		operative,
-	), 'the workflow must NOT emit an `DORFL_OBSERVATION_TRIAGE:` env ' +
-		'assignment (env carries no defaults; resolved from per-repo config / built-in default).');
-	require('no-gate-env-surface-blockers', !/DORFL_SURFACE_BLOCKERS\s*:/.test(
-		operative,
-	), 'the workflow must NOT emit an `DORFL_SURFACE_BLOCKERS:` env ' +
-		'assignment (env carries no defaults; resolved from per-repo config / built-in default).');
-	// --- Gate-family DISPATCH OVERRIDES (one-shot, dispatch only) ---------------
-	// Each gate is exposed as a `workflow_dispatch` input AND its override is wired
-	// (as a guarded `$GITHUB_ENV` write, NOT a YAML `env:` key — so the
-	// `no-gate-env-*` invariants above still hold) into EVERY job that resolves the
-	// gate family: `enumerate` (it gates the matrix pools via `scan`), plus the two
-	// agent-running jobs. The enumerate wiring is the load-bearing one: without it a
-	// dispatch override of `observationTriage`/`surfaceBlockers`/`autoTask` produces
-	// an empty matrix and is silently inert (the bug this task's review caught).
-	for (const input of [
-		'autoBuild',
-		'autoTask',
-		'observationTriage',
-		'surfaceBlockers',
-	]) {
-		require(`dispatch-${input}-input`, new RegExp(
-			`workflow_dispatch:[\\s\\S]*?inputs:[\\s\\S]*?\\b${input}:`,
-		).test(
-			text,
-		), `the \`workflow_dispatch\` must carry a \`${input}\` gate-override input.`);
+	for (const [id, envVar] of [
+		['no-gate-env-auto-build', 'DORFL_AUTO_BUILD'],
+		['no-gate-env-auto-task', 'DORFL_AUTO_TASK'],
+		['no-gate-env-observation-triage', 'DORFL_OBSERVATION_TRIAGE'],
+		['no-gate-env-surface-blockers', 'DORFL_SURFACE_BLOCKERS'],
+	] as const) {
+		require(id, !new RegExp(`${envVar}\\s*:`).test(
+			operative,
+		), `the workflow must NOT emit an \`${envVar}:\` env assignment ` +
+			'(env carries no defaults; the gate is resolved from per-repo config / built-in default).');
 	}
+	// --- Gate-family DISPATCH OVERRIDES (one-shot, dispatch only) ---------------
+	// Each gate is a `workflow_dispatch` input, exported (a guarded `$GITHUB_ENV`
+	// write, NOT a YAML `env:` key) in `enumerate` BEFORE its scan, and forwarded
+	// by `dispatch` to every item run (whose lock, agent and apply jobs export it).
 	for (const [input, envVar] of [
 		['autoBuild', 'DORFL_AUTO_BUILD'],
 		['autoTask', 'DORFL_AUTO_TASK'],
 		['observationTriage', 'DORFL_OBSERVATION_TRIAGE'],
 		['surfaceBlockers', 'DORFL_SURFACE_BLOCKERS'],
 	] as const) {
-		// The override is a guarded shell write of a step-env copy of the input:
-		// `env: DISPATCH_<X>: ${{ inputs.<x> }}` then
-		// `[ -n "${DISPATCH_<X>}" ] && echo "<ENV>=${DISPATCH_<X>}" >> $GITHUB_ENV`.
-		// The input never appears as `${{ }}` text inside the `run:` script.
+		require(`dispatch-${input}-input`, new RegExp(
+			`workflow_dispatch:[\\s\\S]*?inputs:[\\s\\S]*?\\b${input}:`,
+		).test(
+			text,
+		), `the \`workflow_dispatch\` must carry a \`${input}\` gate-override input.`);
 		const dispatchVar = envVar.replace(/^DORFL_/, 'DISPATCH_');
 		const guardedWrite = new RegExp(
 			`${dispatchVar}:\\s*\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}` +
@@ -754,13 +591,19 @@ export function validateAdvanceLifecycleWorkflow(
 			text,
 		), `the \`${input}\` override must be a blank-guarded write of \`${envVar}\` ` +
 			'to `$GITHUB_ENV` (blank dispatch input / schedule / push emit nothing).');
+		require(`dispatch-forwards-${input}`, new RegExp(
+			`args\\+=\\(-f "${input}=\\$\\{${dispatchVar}\\}"\\)`,
+		).test(
+			operative,
+		), `the \`dispatch\` job must forward a non-blank \`${input}\` override to ` +
+			'each item run.');
 	}
 	// The ENUMERATE job MUST carry the override before its `scan` step — else the
-	// matrix pools are built from the un-overridden gates and the override is inert.
+	// item list is built from the un-overridden gates and the override is inert.
 	require('enumerate-carries-gate-override', /enumerate:[\s\S]*?DORFL_OBSERVATION_TRIAGE=[\s\S]*?id: scan/.test(
 		text,
 	), 'the `enumerate` job must apply the dispatch gate override BEFORE its `scan` ' +
-		'step (scan gates the matrix pools by the gate family; otherwise the ' +
+		'step (scan gates the item pools by the gate family; otherwise the ' +
 		'override is silently inert for the lifecycle/task pools).');
 	// The override must be GUARDED by the workflow_dispatch event so schedule/push
 	// runs never even enter the write step.
@@ -789,15 +632,9 @@ export function validateAdvanceLifecycleWorkflow(
 		text,
 	), 'the `sweepMergedBranches` dispatch input (capability F, opt-out) must be ' +
 		'preserved.');
-	// The ORPHAN-SIDECAR reap (spec
-	// `agentic-question-resolution-retire-disposition-vocabulary`, US #10) rides
-	// the SAME scheduled `dorfl gc --remote-branches` invocation, so it provably
-	// FIRES on the cron tick (not behind an un-passed flag). The reap step that
-	// runs `gc --remote-branches` MUST be checked out WITH a working tree (the
-	// orphan sweep is working-tree based: it reads `work/questions/` + the
-	// lifecycle folders from the checkout). `actions/checkout` provides that, and
-	// the step's name/comment names the orphan-sidecar duty so the linkage is not
-	// silently lost on a future template edit.
+	// The ORPHAN-SIDECAR reap rides the SAME scheduled `dorfl gc
+	// --remote-branches` invocation, which reads the working tree, so the reap
+	// job must check one out, and its step must name the orphan-sidecar duty.
 	require('reap-checks-out-working-tree', /reap-merged-branches:[\s\S]*?uses:\s*actions\/checkout/.test(
 		text,
 	), 'the reap job must `actions/checkout` a working tree before ' +
@@ -808,14 +645,41 @@ export function validateAdvanceLifecycleWorkflow(
 	), 'the reap step (running `gc --remote-branches`) must name the ORPHAN ' +
 		'SIDECAR reap it ALSO performs (US #10), so the scheduled invocation that ' +
 		'fires it is visible and not silently dropped on a future edit.');
+	require('reap-writer-role', /reap-merged-branches:[\s\S]*?uses:\s*\.\/\.github\/actions\/dorfl-setup-writer\b/.test(
+		text,
+	), 'the reap job runs no agent: it must use the writer-role setup ' +
+		'(`./.github/actions/dorfl-setup-writer`: Node and dorfl only).');
+
+	// --- The merge-question writer job (no agent) -------------------------------
+	// Task `wire-merge-questions-into-the-advance-tick` (decision 5): surfacing is
+	// deterministic, so a no-agent writer job runs it; `enumerate` stays
+	// read-only.
+	require('surface-merge-questions-job', /\n {2}surface-merge-questions:\s*\n {4}runs-on: ubuntu-latest\s*\n {4}permissions:\s*\n {6}contents: write\s*\n {6}pull-requests: read\s*\n {4}steps:/.test(
+		text,
+	), 'the workflow must carry the `surface-merge-questions` job (contents: write, ' +
+		'pull-requests: read, no agent) that asks the merge questions.');
+	// Gate-3 (PR #459): `gh pr list` needs a credential, or every branch is
+	// skipped as `pr-state-unknown` on a GitHub arbiter. The built-in token
+	// suffices (a read), so the step carries `GH_TOKEN: secrets.GITHUB_TOKEN`.
+	require('surface-merge-questions-gh-token', /surface-merge-questions:[\s\S]*?env:\s*\n\s*GH_TOKEN: \$\{\{ secrets\.GITHUB_TOKEN \}\}\s*\n\s*run: dorfl surface-merge-questions\b/.test(
+		operative,
+	), 'the `surface-merge-questions` step must give `gh` a credential ' +
+		'(`env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`), else the open-PR listing ' +
+		'fails and every branch is skipped.');
+	require('surface-merge-questions-runs-the-command', /surface-merge-questions:[\s\S]*?run: dorfl surface-merge-questions\b/.test(
+		operative,
+	), 'the `surface-merge-questions` job must run `dorfl surface-merge-questions`.');
+	require('surface-merge-questions-writer-role', /surface-merge-questions:[\s\S]*?uses:\s*\.\/\.github\/actions\/dorfl-setup-writer\b/.test(
+		text,
+	), 'the `surface-merge-questions` job runs no agent: it must use the ' +
+		'writer-role setup (`./.github/actions/dorfl-setup-writer`).');
 
 	// --- CI runs IN-PLACE: no isolation machinery ------------------------------
 	require('no-isolated-flag', !/--isolated\b/.test(
 		operative,
 	), 'CI runs IN-PLACE (the container IS the isolation): no `--isolated` flag.');
 	// Guard `--remote` the LAPTOP affordance, but NOT `--remote-branches` (the
-	// preserved capability-F `gc --remote-branches` sweep): a negative lookahead
-	// for a following `-`/word char so the gc flag is not a false positive.
+	// preserved capability-F `gc --remote-branches` sweep).
 	require('no-remote-flag', !/--remote(?![-\w])/.test(
 		operative,
 	), 'CI runs IN-PLACE: no `--remote` flag (laptop-only affordance).');
@@ -825,7 +689,14 @@ export function validateAdvanceLifecycleWorkflow(
 		text,
 	), 'must carry a CI `concurrency.group` so overlapping ticks never collide.');
 
-	// --- US #9: NO `workflows` permission; cannot self-edit triggers ------------
+	// --- Permissions: nothing at workflow level; NO `workflows` permission -----
+	require('workflow-permissions-empty', /^permissions: \{\}$/m.test(
+		text,
+	), 'the workflow must grant nothing at workflow level (`permissions: {}`); ' +
+		'each job grants its own scopes.');
+	require('enumerate-contents-read', /\n {2}enumerate:\s*\n {4}runs-on: ubuntu-latest\s*\n {4}permissions:\s*\n {6}contents: read\s*\n {4}outputs:/.test(
+		text,
+	), 'the `enumerate` job must hold `contents: read` only.');
 	require('no-workflows-permission', !/\bworkflows:\s*write\b/.test(
 		text,
 	), 'the running job must request NO `workflows` permission (US #9: it can ' +
@@ -835,96 +706,62 @@ export function validateAdvanceLifecycleWorkflow(
 	), 'no emitted job step may touch `.github/workflows/**` (US #9).');
 
 	// --- Explicit slug prefixes, never bare ------------------------------------
-	require('explicit-task-prefix', /"task:" \+ \.slug/.test(text) ||
-		/task:/.test(
-			text,
-		), 'CI must use explicit `task:`/`spec:` slug prefixes, never bare (ADR ' +
+	require('explicit-task-prefix', /"task:" \+ \.slug/.test(
+		text,
+	), 'CI must use explicit `task:`/`spec:` slug prefixes, never bare (ADR ' +
 		'command-surface-and-journeys §3a).');
 
-	// --- The propose `enumerate` matrix must UNION taskable prds --------------
+	// --- The `enumerate` list must UNION taskable specs -------------------------
 	// (`ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`): a
-	// task-only `jq` would render `DORFL_AUTO_TASK: 'true'` dead on the
-	// hourly cron — a ready ungated SPEC would never become a matrix leg. The `jq`
-	// must enumerate `spec:<slug>` ids from `scan --json`'s taskable-SPEC pool
-	// (`repos[].specs[]` + `cwd.repo.specs[]`) alongside the eligible-task legs.
+	// task-only `jq` would render `DORFL_AUTO_TASK: 'true'` dead on the hourly
+	// cron — a ready ungated SPEC would never become an item run.
 	require('propose-enumerates-taskable-specs', /"spec:" \+ \.slug/.test(text) &&
 		/\.specs\[\]/.test(
 			text,
-		), 'the propose-mode `enumerate` `jq` must union taskable specs into the ' +
-		"matrix as `spec:<slug>` legs (read from `scan --json`'s `repos[].specs[]` " +
-		'+ `cwd.repo.specs[]` pools), so a ready ungated SPEC becomes one auto-task ' +
-		'matrix leg per item alongside the eligible-task legs ' +
+		), 'the `enumerate` `jq` must union taskable specs into the item list as ' +
+		"`spec:<slug>` ids (read from `scan --json`'s `repos[].specs[]` + " +
+		'`cwd.repo.specs[]` pools), so a ready ungated SPEC becomes one auto-task ' +
+		'item run alongside the eligible-task items ' +
 		'(`ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`).');
+	require('propose-enumerates-via-scan', /dorfl scan --json/.test(
+		text,
+	), 'the items must be ENUMERATED via the eligible-pool scan ' +
+		'(`dorfl scan --json`).');
 
-	// --- The propose `enumerate` matrix must UNION the LIFECYCLE pools ----------
-	// (`ci-propose-matrix-enumerates-lifecycle-items`): a build/task-only `jq`
-	// runs the answer-loop ONLY in merge mode — a `needsAnswers` item is
-	// `eligible:false` and untriaged observations are not in the task/spec pools at
-	// all, so NO lifecycle rung (triage/surface/apply) ever gets a propose leg. The
-	// `jq` must enumerate the three lifecycle sub-pools from `scan --json`
-	// (`repos[].lifecycle.*` + `cwd.repo.lifecycle.*`): `triage[]` → `obs:<slug>`,
-	// and `surface[]`/`apply[]` → `.namespace + ":" + .slug`. Match all four shape
-	// signals so a regression that drops any one leg is caught.
+	// --- The `enumerate` list must UNION the LIFECYCLE pools --------------------
+	// (`ci-propose-matrix-enumerates-lifecycle-items`): `triage[]` → `obs:<slug>`,
+	// and `surface[]`/`apply[]` → `.namespace + ":" + .slug`, so the WHOLE
+	// answer-loop runs in propose mode too.
 	require('propose-enumerates-lifecycle-items', /"obs:" \+ \.slug/.test(text) &&
 		/\.lifecycle\.triage\[\]/.test(text) &&
 		/\.lifecycle\.surface\[\]/.test(text) &&
 		/\.lifecycle\.apply\[\]/.test(text) &&
 		/\.namespace \+ ":" \+ \.slug/.test(
 			text,
-		), 'the propose-mode `enumerate` `jq` must union the LIFECYCLE pools into the ' +
-		"matrix (read from `scan --json`'s `repos[].lifecycle.*` + " +
-		'`cwd.repo.lifecycle.*`): `triage[]` as `obs:<slug>` legs, and ' +
-		'`surface[]`/`apply[]` as `.namespace + ":" + .slug` (`task:`/`spec:`, plus ' +
-		'`observation:` for an answered-observation apply leg) legs, ' +
-		'so the WHOLE answer-loop (triage + surface + apply) runs in propose mode, ' +
-		'not only in merge mode ' +
+		), 'the `enumerate` `jq` must union the LIFECYCLE pools into the item list ' +
+		"(read from `scan --json`'s `repos[].lifecycle.*` + " +
+		'`cwd.repo.lifecycle.*`): `triage[]` as `obs:<slug>`, and ' +
+		'`surface[]`/`apply[]` as `.namespace + ":" + .slug` ' +
 		'(`ci-propose-matrix-enumerates-lifecycle-items`).');
 
-	// --- DYNAMIC GitHub backstop (spec `graceful-pre-timeout-wip-checkpoint`) ---
-	// The agent-leg jobs (advance-propose / advance-merge) must consume the
-	// enumerate job's dynamic `githubTimeout` output, NOT a baked-in number. This
-	// closes the drift where the static `legTimeoutMinutes` render only refreshed
-	// on `install-ci` re-run; now the same committed `dorfl.json` drives BOTH the
-	// internal deadline AND the GitHub cap on every tick.
-	require('enumerate-emits-github-timeout-output', /enumerate:[\s\S]*?outputs:[\s\S]*?githubTimeout:/.test(
-		text,
-	), 'the `enumerate` job must declare a `githubTimeout` job OUTPUT (computed ' +
-		'from the committed `dorfl.json` as ' +
-		'`agentDeadlineMinutes + checkpointHeadroomMinutes`).');
-	require('enumerate-reads-dorfl-config-json', /dorfl config --json/.test(
-		text,
-	), 'the `enumerate` job must read the committed config via ' +
-		'`dorfl config --json` at run time (so an edit to `dorfl.json` ' +
-		'reflects on the next tick without an `install-ci` re-run).');
-	require('enumerate-computes-deadline-plus-headroom', /agentDeadlineMinutes \+ checkpointHeadroomMinutes/.test(
-		text,
-	), 'the `enumerate` job must compute `githubTimeout` as ' +
-		'`agentDeadlineMinutes + checkpointHeadroomMinutes` (the backstop is ' +
-		'DELIBERATELY head-room above the internal deadline).');
-	require('propose-uses-dynamic-github-timeout', /advance-propose:[\s\S]*?timeout-minutes:\s*\$\{\{\s*fromJson\(needs\.enumerate\.outputs\.githubTimeout\)\s*\}\}/.test(
-		text,
-	), 'the `advance-propose` job must set `timeout-minutes: ${{ ' +
-		'fromJson(needs.enumerate.outputs.githubTimeout) }}` (the DYNAMIC GitHub ' +
-		'backstop, fromJson-coerced to an integer, not a baked-in number).');
-	require('merge-uses-dynamic-github-timeout', /advance-merge:[\s\S]*?timeout-minutes:\s*\$\{\{\s*fromJson\(needs\.enumerate\.outputs\.githubTimeout\)\s*\}\}/.test(
-		text,
-	), 'the `advance-merge` job must set `timeout-minutes: ${{ ' +
-		'fromJson(needs.enumerate.outputs.githubTimeout) }}` (the DYNAMIC GitHub ' +
-		'backstop, fromJson-coerced to an integer).');
-	// A baked static `timeout-minutes: <number>` on an agent-leg job is the
-	// retired `legTimeoutMinutes` render — forbid it so a future edit cannot
-	// silently re-introduce the drift the dynamic backstop is fixing.
-	require('no-static-agent-leg-timeout', !/(?:advance-propose|advance-merge):[\s\S]*?timeout-minutes:\s*\d/.test(
-		text,
-	), 'no agent-leg job may set a baked-in numeric `timeout-minutes` ' +
-		'(the retired `legTimeoutMinutes` render); the GitHub backstop is ' +
-		'DYNAMIC (read from `dorfl.json` at run time).');
+	// --- No timeout is computed here: the item's lock job owns it ---------------
+	// The agent job's `timeout-minutes` is the lock job's `agentTimeoutMinutes`
+	// output (dorfl.json at the item's base), in dorfl-item.yml; no job here may
+	// bake a numeric `timeout-minutes` either (the retired `legTimeoutMinutes`).
+	require('no-static-timeout', !/timeout-minutes:\s*\d/.test(
+		operative,
+	), 'no job may set a baked-in numeric `timeout-minutes`: the agent timeout ' +
+		"is the item lock job's `agentTimeoutMinutes` (dorfl.json at the base).");
 
-	// --- Wires the SHARED composite setup action -------------------------------
-	require('uses-shared-setup-action', /uses:\s*\.\/\.github\/actions\/dorfl-setup\b/.test(
+	// --- Wires the writer-role setup action (no agent runs here) ---------------
+	require('uses-writer-setup-action', /uses:\s*\.\/\.github\/actions\/dorfl-setup-writer\b/.test(
 		text,
-	), 'every job must wire the shared composite setup action ' +
-		'(`./.github/actions/dorfl-setup`, emitted by the core task).');
+	), 'the jobs that set up dorfl here run no agent, so they must use the ' +
+		'writer-role setup (`./.github/actions/dorfl-setup-writer`).');
+	require('no-agent-setup-action', !/uses:\s*\.\/\.github\/actions\/dorfl-setup\s*$/m.test(
+		operative,
+	), 'no job here runs an agent, so none may use the agent-role setup ' +
+		'(`./.github/actions/dorfl-setup`: the harness and the provider key).');
 
 	return {ok: problems.length === 0, problems};
 }