task-pipeline-skill 1.91.0 → 1.92.0

package/CHANGELOG.md

@@ -1,3 +1,94 @@
+## v1.92.0 — wave mode: the whole board, closed in its final form; the grill asks one batch
+
+The operator's standard approach, decided on 2026-10-11 and codified here: when the request
+is not one change but **the whole board** — every open item plus the new requests — gather
+it all first, close every question the sources can close, ask what remains **once, as one
+batch, at the end of planning**, lay the target state over the current logic on one canvas,
+plan from the post-integration target, and cut the work into waves that each close in one
+pass, with a verification, finishing, fixing and documentation pass after every wave. The
+run takes the next wave without asking, says once when the board is empty, and leaves every
+sign-in, consent, payment, message to a person and outward act to a human. The rule under
+all of it: **build the system in its final form, never through intermediate states.**
+
+- **`references/waves.md`, invoked as `/task-pipeline waves`** — a third mode beside `setup`
+  and `checkup`, and a program mode of the existing stages, not a parallel cycle: stages 0–4
+  once for the whole board, 5–8 per wave, 9–10 to close the release. Wave 0 is the survey
+  (with `project-audit` as a read-only sidecar for whole-project scope) and **one
+  machine-readable inventory**, every item by id with `id`, `source`, `status`, `area`,
+  `node`, `wave`, `release`, verified against the code — stale rows closed with their
+  receipt, duplicates clustered — and assigned to nodes and waves by a committed,
+  deterministic script. The **canvas** extends the module map: as-is → to-be per module and
+  contract, the integration seams, REQ → module → wave, and what the new version deletes.
+  No wave builds a shape a later wave undoes; a stub only at a declared contract with its
+  removal named. Wave 1 is the walking skeleton, and each wave names its exit criteria
+  before it starts. The close pass after each wave certifies, re-measures `audit.md`'s
+  exit, runs **one fix round** under the loop guard's caps, documents through the Doc Loop
+  scoped to the wave, marks the canvas, re-reads the goal, and re-cuts what is left. A board
+  bigger than one release becomes a program, carried on the canvas by node, never dropped.
+  The name is not "dynamic": that word is `run.loop.mode: dynamic`'s.
+- **The grill's default changed — a decision by the operator, 2026-10-11.** It was *one
+  question per turn, never bundle*. It is now: close from the sources first, then ONE batch
+  of the material unknowns, ordered by dependency, each with a recommended answer and what
+  each answer changes; one question at a time only where answers depend on each other
+  (then depth-first) or when the operator asks for it. The reason is the operator's time: a
+  question asked alone costs a human round and a batch costs one, and
+  `prioritisation.md` → *5. Where the human goes* already said so for the rest of the run.
+  Mirrored in `grill.md`, `stages.md` (stages 0 and 2), `brainstorm.md`, the command, the
+  Cursor rule, `HOW-IT-WORKS.md`, the README, `pipeline.example.json`, this repository's
+  `pipeline.json`, and eval TRIG-01; TRIG-11 is the wave-mode trigger in Russian.
+- **`continuity.md`: a block or an ambiguity stops its node, not the run.** The node is
+  parked `needs-operator` with the question written into it, the run continues on what it
+  does not block, and stops only when the whole frontier is blocked. An empty board is said
+  once. A goal re-read that moves the queue is a committed `revisions` entry.
+- **`planning.md`: a wave re-cut keeps the static-graph decision** — every move is a
+  `revisions` entry plus a canvas edit, written before the next pass begins.
+  **`decomposition.md`**: the whole board runs one wave at a time, and a wave may hold several
+  bricks. **`build.md`**: "fix wave" is now "fix round", so *wave* means one thing.
+  **`project-audit`**: its rows and sidecar are wave mode's wave-0 input.
+- **The work graph carries the wave.** `graph.schema.json` gains `nodes[].wave` (an integer
+  from 1) and the `wave` revision verb. `graph.py validate` refuses an edge from a later
+  wave's node into an earlier wave's node; `graph.py next --wave N` prints that wave's
+  frontier only, exiting `3` when the wave is done; `graph.py wave N-007 --to 3 --why …`
+  moves a node, writes the revision, and refuses a move that breaks the order, a `done`
+  node, or no reason. `test/graph_test.py` 158 → **166** cases.
+- **The description names the mode** and paid for it: `'waves' / 'волнами' closes the whole
+  board`, while the stage list reads *through gated stages: …* instead of *… with explicit
+  gates*, `docs study` reads `docs`, and `docs/wiki sync` reads `docs/wiki`. 901 → 909 of
+  1024 chars — inside the umbrella's 60-character reserve below the 970 working limit,
+  which a longer description would have broken. The `SKILL.md` body is 4736 tokens
+  (cl100k), one under where it was: the new sentence in *How to run* displaced a restated
+  kernel clause and the compiler sentence's tail.
+
+Guards: 430 → **433**. The three new negatives live in `test/plant_wave.py` (the workflow
+sits near GitHub's 512 000-byte limit) and disarm the order check, the `--wave` filter and
+the re-cut's revision in turn; each was watched turning `test/graph_test.py` red before the
+step was written.
+
+## v1.91.2 — v1.91.1's payload, released with its no-stamp declaration
+
+`release.yml` refused the `v1.91.1` tag's own tree: the release carried no run stamp and was
+not named in `## Releases that carry no stamp`. Nothing was published under it. This
+release is the same payload with the declaration in `docs/evidence/retro.md`. What v1.91.1
+ships is described in its section below.
+
+## v1.91.1 — the gates read the current run only, and a broken python3 stops only releases
+
+- **The release gate read every run in the ledger.** `.task-pipeline/run.md` is
+  append-only, and a project that reuses it holds earlier runs above the current one.
+  The gate took the FIRST `stage: … tests … verdict pass` in the whole file, so a
+  previous release's pass admitted `git tag` while this run's tests were still PENDING
+  (reported 2026-10-11 from a live ledger: the 0.2.0 pass would have released 0.4.0).
+  Both gates now read only what follows the last `Run:` header — the line
+  `templates/run.md` writes once per run; a ledger with no header is one run.
+- **The build gate had the same leak.** A previous run that had entered dev silenced
+  the ask for a new run still in planning. Same scoping, same fixture shape.
+- **A failed python3 no longer blocks every command.** With the disk full, python3
+  could not start, and the gate refused `ls` in any project with a run in flight. A
+  shell pre-filter now lets a command through when it carries none of
+  `tag`/`push`/`release`/`publish`; anything that could release still fails closed.
+
+Four fixtures in `test/release_gate_test.py`, each watched failing before its fix.
+
 ## v1.91.0 — the description says «баг», and a lightweight tag is refused before release
 
 v1.90.0 added `bug` to the description so "fix this bug" routes here by name. The Russian

package/HOW-IT-WORKS.md

@@ -46,7 +46,9 @@ It is written in three parts, and the middle one was learned the hard way:
   the pipeline entirely.
 
 Two modes need no task at all. `checkup` reports what has shipped without anyone
-confirming it. `setup` audits the documentation a project already has.
+confirming it. `setup` audits the documentation a project already has. A third,
+`waves`, takes the whole board as the task: one inventory, one canvas of the target
+state, one batch of questions, then waves that each close in one pass.
 
 **Honest limit:** this measures the *description's* discriminating power, not the
 host's selection machinery. Three measured runs scored 7/10, 9/10 and 8/10 — and
@@ -92,8 +94,10 @@ An absent source that is never named looks identical to a source that was read.
 
 ### Then the grill, and it is mandatory
 
-One question per turn, each with a recommended answer, exploring the codebase
-before asking, until every decision branch is resolved.
+Close what the sources can answer, then ask the material unknowns in one batch,
+ordered by dependency, each with a recommended answer — one at a time only where the
+answers depend on each other or the operator asks — until every decision branch is
+resolved.
 
 - **Every answer is validated against the harvested sources.** The operator
   outranks any document — but only *out loud*, and a document the run proves stale

package/README.md

@@ -214,9 +214,11 @@ an external provider.
 
 ### The intake grill (stage 0) — mandatory
 
-Before any technical work, task-pipeline interviews you relentlessly — one question
-per turn, each with a recommended answer, exploring the codebase before asking —
-until every decision branch is resolved and locked into a **task brief**. There is
+Before any technical work, task-pipeline closes every question the codebase and the
+project's records can answer, then asks you the rest in **one batch**, ordered by
+dependency, each with a recommended answer — one at a time only where the answers
+depend on each other or you ask for it — until every decision branch is resolved and
+locked into a **task brief**. There is
 no "clear enough task" exemption: no stage-1 work starts without a committed,
 confirmed brief.
 
@@ -444,6 +446,29 @@ stopped. Each module's spec is a full dossier: architecture, entities and
 ownership, contracts in and out with their failure behavior, business rules, edge
 and failure cases, UI/Figma chain, limits, open questions.
 
+### Wave mode — the whole board, closed in its final form
+
+`/task-pipeline waves` takes every open item a project carries — the board, the
+carry-over ledgers, plan rows, unverified rows, uncovered scenarios, other products'
+asks — plus your new requests, and closes them **in the system's final form rather
+than through intermediate states**
+([`waves.md`](plugins/task-pipeline/skills/task-pipeline/references/waves.md)). It is
+a program mode of the same stages: 0–4 once for the whole board, 5–8 once per wave,
+9–10 to close.
+
+Wave 0 is the survey: one machine-readable inventory of every item by id, each verified
+against the code — stale rows closed with their receipt, duplicates clustered. Questions
+are closed from the sources first; what is genuinely yours (access, consent, money,
+direction, an outward act) reaches you **once, as one batch, at the end of planning**,
+each with a recommendation. A committed **canvas** lays the target state over the
+current logic — as-is → to-be per module and contract, the integration seams, REQ →
+module → wave, and what the new version deletes. The work is then cut into waves that
+each close in one pass, the walking skeleton first, each with its exit criteria named
+before it starts, and no wave builds a shape a later wave undoes. After every wave a
+close pass verifies, runs one fix round, updates the docs, re-measures the inventory
+and re-cuts what is left. The run takes the next wave without asking; a board too big
+for one release becomes a program, carried on the canvas, never dropped.
+
 ### Loop guard — churn is detected, not endured
 
 Any repeating pass can start undoing the previous one: two shapes alternating, the
@@ -587,7 +612,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 901/1024 chars, `SKILL.md` 278/500 lines, all 39 references
+13/64 chars, `description` 909/1024 chars, `SKILL.md` 277/500 lines, all 40 references
 linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 
@@ -942,6 +967,7 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | [`references/model-tiering.md`](plugins/task-pipeline/skills/task-pipeline/references/model-tiering.md) | model policy, the `/model` reminder, overrides |
 | [`templates/`](plugins/task-pipeline/skills/task-pipeline/templates/README.md) | brief, carry-over ledger, `CONTEXT.md` and ADR skeletons, the doc map, both registers, the retro and its archive, the seeded `docgate.sh` and `hygiene.sh`, a worked hook |
 | [`references/adoption.md`](plugins/task-pipeline/skills/task-pipeline/references/adoption.md) | the first run in a project: greenfield seeding, and the brownfield walkthrough |
+| [`references/waves.md`](plugins/task-pipeline/skills/task-pipeline/references/waves.md) | wave mode: the whole board as one inventory, one canvas of the target state, one question batch, then waves that each close in one pass |
 | [`references/setup.md`](plugins/task-pipeline/skills/task-pipeline/references/setup.md) | the entry audit: seven passes over the docs a project already has, offered once, output as a fix plan |
 | [`references/portability.md`](plugins/task-pipeline/skills/task-pipeline/references/portability.md) | the manifest of workflow decisions and their homes in the bundle, and the boundary against a project's own answers |
 | [`references/learned.md`](plugins/task-pipeline/skills/task-pipeline/references/learned.md) | rules earned by failure on a real multi-repository build, each with its incident, its check and its exit criterion — the table is the count, and it grows |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.91.0 |
+| **Version** | 1.92.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -108,7 +108,9 @@ built, recommend it once and continue: `uv tool install graphifyy` →
 
 **Phase 2 — grill the user against that harvest**, then run the rest without
 mid-flight questions:
-1. One question per turn — never bundle.
+1. Close what the sources answer; ask the rest in ONE batch, ordered by
+   dependency. One at a time only when answers depend on each other or the user
+   asks.
 2. Give a recommended answer with every question (+ one-line rationale).
 3. Explore the codebase before asking — if a search/read answers it, do that.
 4. **Validate every answer against the harvest.** When what the user says
@@ -211,7 +213,14 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
    first**, then topologically, no cycles (a cycle means the cut is wrong). Every REQ
    maps to exactly one module. Then stages 3→10 run **per module**, one brick at a
    time; stages 0–2 run once, and the map's status column is the resume point. Single
-   module → record "single module: <name>" and move on.
+   module → record "single module: <name>" and move on. **If the request is the whole
+   board** (wave mode, `waves`) — every open item plus the new requests — stages 0–4
+   run once over one machine-readable inventory verified against the code and a
+   committed canvas of the target state; the work is cut into waves that each close
+   in one pass (wave 1 the walking skeleton, exit criteria named first); stages 5–8
+   run per wave with a close pass after each — verify, one fix round, docs,
+   re-measure, re-cut — and 9–10 close the release. No wave builds a shape a later
+   wave undoes.
 3. **Spec** (manual) — write and commit the design; lock every shared contract
    (types, schemas, signatures, file layout) plus a **Global Constraints** block of
    exact values every later task inherits. Self-review it for placeholders,

package/evals/RESULTS.md

@@ -40,7 +40,7 @@ or it belongs in a check.
 
 | Metric | Value | Computed by | As of |
 |---|---|---|---|
-| Evals authored | 46 (three suites: task-pipeline 28, evidence-docs 9, project-audit 9) | `python3 evals/run.py` → `suite: N evals` | 2026-08-31 |
+| Evals authored | 47 (three suites: task-pipeline 29, evidence-docs 9, project-audit 9) | `python3 evals/run.py` → `suite: N evals` | 2026-10-11 |
 | Categories covered | 5 of 5, per suite | the suite's own `category` fields | 2026-08-31 |
 | Dated runs recorded | **4** | `python3 evals/run.py` → `recorded runs: N` | 2026-08-31 |
 | …of those, **blind** | **3** | run headings not marked `self-observed` | 2026-08-31 |

package/evals/task-pipeline.evals.json

@@ -17,7 +17,7 @@
       "expected_behavior": [
         "Invokes the task-pipeline skill rather than starting to design or code inline",
         "Runs the stage-0 knowledge harvest BEFORE the first interview question, and writes a source ledger",
-        "Asks interview questions one at a time, each with a recommended answer",
+        "Asks the material interview questions in one batch ordered by dependency, each with a recommended answer, after closing what the sources answer",
         "Writes no implementation code before a brief is committed and confirmed"
       ],
       "why": "The explicit invocation phrase is the primary trigger; the failure it guards is jumping to code."
@@ -361,6 +361,21 @@
       ],
       "why": "Measured before the change: answered `none` because no description offered a phrase for reviewing a PR, while review.md owns exactly that contract."
     },
+    {
+      "id": "TRIG-11",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "собери все задачи с доски и новые запросы и закрой их волнами",
+      "expected_behavior": [
+        "Recognises this as wave mode and runs `/task-pipeline waves`, not one change at a time",
+        "Builds one machine-readable inventory of every open item by id, each verified against the code, before any design",
+        "Closes questions from the sources first and asks the operator the rest once, as one batch with a recommendation each, at the end of planning",
+        "Cuts the work into waves that each close in one pass, wave 1 the walking skeleton, each with its exit criteria named before it starts"
+      ],
+      "why": "Wave mode is the operator's standard approach for a whole board (2026-10-11). A model that cannot reach it from the natural Russian request runs the board item by item and builds the intermediate states the mode exists to refuse."
+    },
     {
       "id": "NOTRIG-06",
       "category": "should_not_trigger",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.91.0",
+  "version": "1.92.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
-  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.91.0",
+  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
+  "version": "1.92.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -1,6 +1,6 @@
 ---
-description: "Run a task through task-pipeline's gated stages (intake grill → docs → brainstorm → spec → plan → build → tests → deploy → post-deploy → docs/wiki → acceptance). Also: `setup` — audit the docs you already have; `checkup` — what has shipped unverified, with no task running."
-argument-hint: "<one-line task> | setup | checkup"
+description: "Run a task through task-pipeline's gated stages (intake grill → docs → brainstorm → spec → plan → build → tests → deploy → post-deploy → docs/wiki → acceptance). Also: `waves` — close the whole board in waves; `setup` — audit the docs you already have; `checkup` — what has shipped unverified, with no task running."
+argument-hint: "<one-line task> | waves | setup | checkup"
 ---
 Run the task below through `task-pipeline`'s gated stages. **Every stage's doctrine
 ships inside the skill** — no companion plugin is required for any of it. The
@@ -8,9 +8,10 @@ reference files are indexed in `SKILL.md`; this page is the run order, not the i
 
 Task: $ARGUMENTS
 
-> **Two other modes.** `setup` audits the documentation this project already has;
-> `checkup` reports what has shipped without a person confirming it, with no task in
-> flight. Both are at the bottom of this page.
+> **Three other modes.** `waves` takes the whole board instead of one task;
+> `setup` audits the documentation this project already has; `checkup` reports what
+> has shipped without a person confirming it, with no task in flight. All three are at
+> the bottom of this page.
 
 **Idempotent entry — inspect state first, never restart blindly.** If a pipeline
 TaskList from a previous run exists for this task, **resume** from the first incomplete
@@ -59,9 +60,10 @@ Pull what the project already knows about *this task*:
 
 Write the **source ledger** into the brief: a row per source, or an explicit *none found*.
 
-**Then the grill, and it is mandatory** (`references/grill.md`). One question per turn,
-each with a recommended answer, exploring the codebase before asking, until every
-decision branch is resolved.
+**Then the grill, and it is mandatory** (`references/grill.md`). Close what the sources
+can, then ask the material unknowns in ONE batch, ordered by dependency, each with a
+recommended answer — one at a time only where answers depend on each other or the
+operator asks — until every decision branch is resolved.
 
 - **Validate every answer against the harvested sources.** The operator outranks any
   document — but only out loud, and a doc the run proves stale is logged for stage 9.
@@ -188,6 +190,19 @@ Where you ask it to file what it found, it appends board rows whose `Source` nam
 checkup and its date — printing what it would add first, never silently.
 Doctrine: `references/exposure.md`.
 
+## `/task-pipeline waves`
+
+**The whole board, closed in its final form.** Every open item — board, ledgers, plan
+rows, unverified rows, uncovered scenarios, other products' asks — plus the new requests,
+in one machine-readable inventory verified against the code. Questions are closed from
+the sources; what remains goes to the operator once, as one batch, at the end of
+planning. A committed canvas lays the target state over the current logic, and the work
+is cut into waves that each close in one pass. Stages 0–4 run once, 5–8 per wave with a
+close pass after each (verify, one fix round, docs, re-measure, re-cut), 9–10 to close.
+It takes the next wave without asking, says once when the board is empty, and leaves
+every sign-in, consent, payment and outward act to a person.
+Doctrine: `references/waves.md`.
+
 ## `/task-pipeline setup`
 
 **The entry audit instead of a feature.** Seven passes over the documentation this

package/plugins/task-pipeline/hooks/build-gate.sh

@@ -54,6 +54,12 @@ try:
 except Exception:
     raise SystemExit(0)
 
+# Only the CURRENT run speaks: everything after the last `Run:` header. A previous
+# run that entered dev in a reused, append-only ledger silenced this gate (B-151).
+_lines = text.splitlines()
+_starts = [i for i, l in enumerate(_lines) if l.strip().startswith("Run:")]
+text = "\n".join(_lines[_starts[-1]:] if _starts else _lines)
+
 stage_lines = [l.strip() for l in text.splitlines() if l.strip().startswith("stage:")]
 if not stage_lines:
     raise SystemExit(0)

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -155,6 +155,14 @@ except Exception:
     # gate cannot tell. Fail closed, and say which file to look at.
     print("block\t%s\tthe run ledger could not be read" % act); raise SystemExit(0)
 
+# B-151: the ledger is append-only, and a project that reuses it holds earlier runs
+# above this one. Only the CURRENT run speaks — everything after the last `Run:`
+# header (templates/run.md writes one per run); a ledger with no header is one run.
+# A previous release's `verdict pass` admitted a tag whose own tests were PENDING.
+_lines = text.splitlines()
+_starts = [i for i, l in enumerate(_lines) if l.strip().startswith("Run:")]
+text = "\n".join(_lines[_starts[-1]:] if _starts else _lines)
+
 stage_lines = [l.strip() for l in text.splitlines() if l.strip().startswith("stage:")]
 
 
@@ -243,6 +251,13 @@ status=$?
 # A gate that cannot reach its own decision must not wave the release through.
 if [ $status -ne 0 ] || [ -z "$verdict" ]; then
   [ -f "$ledger" ] || exit 0
+  # B-152: without python3 the command cannot be classified, and refusing EVERY
+  # Bash call took the whole session down on a full disk. A word-level pre-filter
+  # keeps fail-closed exactly where it matters: anything that could tag, push,
+  # release or publish is still refused; `ls` is not.
+  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_])(tag|tags|push|release|publish)([^[:alnum:]_]|$)'; then
+    exit 0
+  fi
   echo "task-pipeline: the stage-7 gate could not run (python3 missing or failed), and this project has a run in flight ($ledger). Refusing an outward act rather than failing open." >&2
   exit 2
 fi

package/plugins/task-pipeline/skills/project-audit/SKILL.md

@@ -121,7 +121,8 @@ default is `Sev × Blast + age_bonus` ([`references/portable-method.md`](referen
 the local priority contract) — and the operator accepts them. Effort never ranks inside an
 audit: what a fix costs is the fixer's decision, not the finder's
 ([`references/portable-method.md`](references/portable-method.md)). An audit
-that edits while it reads cannot be re-run to check itself.
+that edits while it reads cannot be re-run to check itself. In `task-pipeline`'s wave
+mode these rows and the JSON sidecar are wave 0's input: they join its inventory by id.
 
 ## A finding keeps its axes apart, or it is a guess wearing a verdict
 

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through an intake grill, docs study, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki sync and acceptance with explicit gates. 'checkup' / 'чекап' reports unconfirmed releases; 'setup' audits existing docs. Not for: answering a question, explaining code, a typo or a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
+description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves' / 'волнами' closes the whole board; 'checkup' / 'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining code, a typo, a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
 license: MIT
 compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---
@@ -17,8 +17,8 @@ GAP CHECK before it is an interview: the brief is built from the request, the
 files and the harvest first, and a question is asked only for a **material
 unknown** the sources cannot answer. A complete brief yields ZERO intake
 questions; what the request or the project already decided is recorded, never
-re-negotiated. The interview, where gaps remain, is one-question-at-a-time and
-sweeps stages 1→10 for anything that would stop the run later — then locks the
+re-negotiated. The interview, where gaps remain, is ONE batch ordered by dependency
+and sweeps stages 1→10 for anything that would stop the run later — then locks the
 answers into a brief. Autonomy is bought there or not at all; every MATERIAL
 question skipped at stage 0 comes back as an interruption at stage 6.
 
@@ -176,15 +176,16 @@ Three things the grill does beyond clarifying the request, each in full in
    stages and gates run** (FIX-TP-03.02): the numbers "1→10" name the DEFAULT
    profile, and a custom profile with three stages runs three — no hidden stage
    0, 7 or 10 is injected because the default profile has one. What a custom
-   profile does NOT escape is the KERNEL (03.01): scope, evidence, deps and
-   resume are owed by every stage of every profile, so dropping stages never
-   drops the evidence gate. And an unknown MANDATORY capability blocks the
+   profile does NOT escape is the KERNEL (03.01): dropping stages never drops
+   the evidence gate. And an unknown MANDATORY capability blocks the
    compile — a profile whose `must_understand` names a capability this runtime
    does not have is refused, never run with the capability silently absent.
    **Is the brief a platform rather than a change?** Then stage 2 also cuts it into
    modules (`references/decomposition.md`) and stages 3→10 run **per module** in
    build order, one brick at a time — stages 0–2 run once, and the module map's
    status column is the resume point (`references/stages.md` → *The program loop*).
+   **The whole board?** `/task-pipeline waves` (`references/waves.md`): stages
+   0–4 once, 5–8 per wave, 9–10 to close.
 4. Do **not** advance until the stage **gate** passes (`references/stages.md`).
    Honor the gate **type**: for `auto`, verify the gate's `check` yourself and
    stop/return on fail; for `judgment`, record the named judge's ruling as
@@ -272,7 +273,5 @@ substitute for, and a ResultEnvelope whose stale candidate (older revision, or
 a superseded fence) re-plans instead of landing as current
 (`scripts/packet.py validate-result`). The compiler's first stage maps an
 audit report onto parent tasks (`scripts/context_packets.py compile|verify`):
-ids derived from finding ids — never positional, so a shuffled report compiles
-byte-identically — evidence/limits/priority in their own fields separate from
-status, and any row it cannot map blocks the whole compile rather than being
-dropped silently.
+ids derived from finding ids, never positional; evidence, limits and priority
+kept apart from status; and any row it cannot map blocks the compile.

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -205,6 +205,11 @@
           ],
           "description": "The class of the user-facing surface this node builds, copied from the brief's `surface_class` (stage 0). It selects the gate profile, and `graph.py certify` reads it: on `flagship` or `product` the fourth, `visual` tier report is REQUIRED, because none of unit, seam or product opens the contact sheet; on any other class a `visual` report is accepted when given. Absent on a node that builds no user-facing surface. `references/certification.md` → *The fourth reading*."
         },
+        "wave": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Wave mode only (`references/waves.md`): the pass of stages 5–8 that closes this node, from 1, where wave 1 is the walking skeleton. `graph.py validate` refuses an edge from a later wave's node into an earlier wave's node, because an earlier wave waiting on a later one cannot close in its own pass; `graph.py next --wave N` prints that wave's frontier only; `graph.py wave` moves a node and records the re-cut as a revision. Absent outside wave mode."
+        },
         "certification": {
           "type": "object",
           "description": "What the tiered certification recorded for this node. Written by `graph.py certify` on every round, pass or fail: a failing round that wrote nothing would erase the only evidence that a node is churning, which is the number the loop-guard ceiling reads.",
@@ -444,9 +449,10 @@
             "park",
             "close",
             "invalidate",
-            "waive"
+            "waive",
+            "wave"
           ],
-          "description": "Which mutation made this entry. `close` joined the two on 2026-08-17 with T-5 — and it was caught by a probe rather than by the fixture asserting *the graph after a close still validates*, because `violations()` never reaches an enum. The same disagreement B-084 records, one field over. `invalidate` joined with PF-02.02: a REQ/interface/brief change supersedes a node and resets its downstream proofs."
+          "description": "Which mutation made this entry. `close` joined the two on 2026-08-17 with T-5 — and it was caught by a probe rather than by the fixture asserting *the graph after a close still validates*, because `violations()` never reaches an enum. The same disagreement B-084 records, one field over. `invalidate` joined with PF-02.02: a REQ/interface/brief change supersedes a node and resets its downstream proofs. `wave` joined with wave mode: the re-cut after every wave moves nodes between waves, and a move nobody recorded is the quiet re-plan `references/planning.md` refuses."
         },
         "node": {
           "type": "string",

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -18,7 +18,7 @@
       ],
       "gate": {
         "type": "manual",
-        "check": "MANDATORY stage — never skipped (only sanctioned bypass: the entry-from-super-ux short-circuit). PHASE 1, before the first question: harvest the knowledge sources (references/knowledge-sources.md) — code, THE CODE GRAPH when one is built (references/knowledge-graph.md: graphify query/affected/god-nodes answer reach, which grep cannot; detect graphify-out/graph.json — recommended, never required), CLAUDE.md/AGENTS.md, CONTEXT.md + docs/adr, docs/ + docs/ux, past pipeline briefs and carry-over ledgers, THE RETRO'S STANDING INSTRUCTIONS (docs/evidence/retro.md — read IN FULL, not queried: they are capped at ten and they BIND this run; stamp each one the moment it fires, since that date is the only evidence behind stage 10's cold-retirement rule — references/retrospective.md), the knowledge wiki when installed (obsidian-wiki — recommended, never required; detect ~/.obsidian-wiki/config), and any other repo or hosted doc system the project names as its docs — queried by this task's own terms, with the SOURCE LEDGER written into the brief (a row per source consulted, or an explicit 'none found'; THE GRAPH'S ROW CARRIES ITS MEASURED LAG — commits and days behind HEAD, the signal it was measured with (built_at_commit exact / mtime approximate / unresolvable), and the marker '⚠ not trusted for reach until refreshed' — that exact string, so one marker is greppable across every ledger — on anything but current. A bare build date does NOT satisfy this: it is the graph's own reply about itself, true and self-reported and silent about whether the graph describes the tree this run is about to change — references/knowledge-graph.md -> Measure the lag, and references/gates.md -> False success for the class). PHASE 2, the grill, built into the skill (references/grill.md) — no companion to install. Per its contract: one question at a time, a recommended answer with each, explore the codebase/docs before asking, depth-first, contradictions reconciled; EVERY answer that touches a harvested source is validated against that source — the operator outranks any document, but only out loud, and the losing side is logged for the stage-9 doc update; domain awareness applied (terms challenged against CONTEXT.md, ADRs recorded for hard-to-reverse calls). The autonomy sweep is covered — every stage 1-10 has its blockers pre-resolved (docs sources, branch/tracker policy, test + lint commands, deploy target and authorization, log/health locations, docs+wiki targets, and for UI tasks the design surface: Figma on or text-only, is the Figma MCP connected, and if it is not — ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; plus, with Figma on, the DESIGN DESTINATION — which team/org by name and which file per surface, App / Web / ASO (the recorded one, a URL the operator gives, or creation in that named team with the creation explicitly authorized), written into the project's canonical record before the first frame, and never created while a recorded file resolves — an unreachable recorded file means stop and ask, never make a replacement) or is explicitly marked 'stop and ask here'. UI verdict recorded (arms super-ux), and for a user-facing task its SURFACE CLASS — surface_class: flagship | product | internal | ad — which selects the visual gate profile for stages 3, 6 and 10 (references/stages.md -> The surface class); model decision recorded. All of it locked into a committed task brief the operator confirms before stage 1. The REQ table is written — one row per independently verifiable deliverable, each naming how it is verified — and frozen: adding later is free, removing or narrowing needs the operator's explicit agreement. The carry-over ledger is seeded. PHASE 1b, THE DOCUMENTATION INVENTORY (references/documentation.md): four questions answered into docs/DOCMAP.md before the interview — where settled things live (the DECISION HOME, and there is exactly one per project: an existing docs/adr/ IS the register and is recorded as such, never duplicated), what each fact's single home is, what a change of type X obliges (THE PROPAGATION MATRIX, non-empty, every row naming the check that enforces it or the word 'review' with a one-line reason), and what proves it (the gate command). A project with no answers gets them seeded — registers, matrix and scripts/check-docs.sh from the skill's templates — and the seeding is recorded as the register's first entry; the seeded gate must exit 0 on its own seeds, because a project that starts red teaches everyone on day one that the gate is noise. The regime is recorded. PHASE 1c, RECONCILE: git says how it should be, the run record says how it turned out — read both for the area about to be touched and resolve every divergence (the document is stale, the record is wrong, or they genuinely disagree and that is a decision), because starting on an unresolved divergence means building against a system that does not exist. The retro's in-force sections are read IN FULL and its archive is QUERIED by the task's nouns."
+        "check": "MANDATORY stage — never skipped (only sanctioned bypass: the entry-from-super-ux short-circuit). PHASE 1, before the first question: harvest the knowledge sources (references/knowledge-sources.md) — code, THE CODE GRAPH when one is built (references/knowledge-graph.md: graphify query/affected/god-nodes answer reach, which grep cannot; detect graphify-out/graph.json — recommended, never required), CLAUDE.md/AGENTS.md, CONTEXT.md + docs/adr, docs/ + docs/ux, past pipeline briefs and carry-over ledgers, THE RETRO'S STANDING INSTRUCTIONS (docs/evidence/retro.md — read IN FULL, not queried: they are capped at ten and they BIND this run; stamp each one the moment it fires, since that date is the only evidence behind stage 10's cold-retirement rule — references/retrospective.md), the knowledge wiki when installed (obsidian-wiki — recommended, never required; detect ~/.obsidian-wiki/config), and any other repo or hosted doc system the project names as its docs — queried by this task's own terms, with the SOURCE LEDGER written into the brief (a row per source consulted, or an explicit 'none found'; THE GRAPH'S ROW CARRIES ITS MEASURED LAG — commits and days behind HEAD, the signal it was measured with (built_at_commit exact / mtime approximate / unresolvable), and the marker '⚠ not trusted for reach until refreshed' — that exact string, so one marker is greppable across every ledger — on anything but current. A bare build date does NOT satisfy this: it is the graph's own reply about itself, true and self-reported and silent about whether the graph describes the tree this run is about to change — references/knowledge-graph.md -> Measure the lag, and references/gates.md -> False success for the class). PHASE 2, the grill, built into the skill (references/grill.md) — no companion to install. Per its contract: close what the code/docs answer first, then ONE batch of the material unknowns ordered by dependency, a recommended answer with each (one at a time only where answers depend on each other or the operator asks), contradictions reconciled; EVERY answer that touches a harvested source is validated against that source — the operator outranks any document, but only out loud, and the losing side is logged for the stage-9 doc update; domain awareness applied (terms challenged against CONTEXT.md, ADRs recorded for hard-to-reverse calls). The autonomy sweep is covered — every stage 1-10 has its blockers pre-resolved (docs sources, branch/tracker policy, test + lint commands, deploy target and authorization, log/health locations, docs+wiki targets, and for UI tasks the design surface: Figma on or text-only, is the Figma MCP connected, and if it is not — ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; plus, with Figma on, the DESIGN DESTINATION — which team/org by name and which file per surface, App / Web / ASO (the recorded one, a URL the operator gives, or creation in that named team with the creation explicitly authorized), written into the project's canonical record before the first frame, and never created while a recorded file resolves — an unreachable recorded file means stop and ask, never make a replacement) or is explicitly marked 'stop and ask here'. UI verdict recorded (arms super-ux), and for a user-facing task its SURFACE CLASS — surface_class: flagship | product | internal | ad — which selects the visual gate profile for stages 3, 6 and 10 (references/stages.md -> The surface class); model decision recorded. All of it locked into a committed task brief the operator confirms before stage 1. The REQ table is written — one row per independently verifiable deliverable, each naming how it is verified — and frozen: adding later is free, removing or narrowing needs the operator's explicit agreement. The carry-over ledger is seeded. PHASE 1b, THE DOCUMENTATION INVENTORY (references/documentation.md): four questions answered into docs/DOCMAP.md before the interview — where settled things live (the DECISION HOME, and there is exactly one per project: an existing docs/adr/ IS the register and is recorded as such, never duplicated), what each fact's single home is, what a change of type X obliges (THE PROPAGATION MATRIX, non-empty, every row naming the check that enforces it or the word 'review' with a one-line reason), and what proves it (the gate command). A project with no answers gets them seeded — registers, matrix and scripts/check-docs.sh from the skill's templates — and the seeding is recorded as the register's first entry; the seeded gate must exit 0 on its own seeds, because a project that starts red teaches everyone on day one that the gate is noise. The regime is recorded. PHASE 1c, RECONCILE: git says how it should be, the run record says how it turned out — read both for the area about to be touched and resolve every divergence (the document is stale, the record is wrong, or they genuinely disagree and that is a decision), because starting on an unresolved divergence means building against a system that does not exist. The retro's in-force sections are read IN FULL and its archive is QUERIED by the task's nouns."
       }
     },
     {

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -33,6 +33,8 @@ docs/
       YYYY-MM-DD-<topic>-brief.md     # stage 0 — locked intake brief (grill output)
       YYYY-MM-DD-<topic>-carryover.md # stage 0 seeds it; EVERY stage appends; stage 10 reads it
       YYYY-MM-DD-<topic>-modules.md   # stage 2 — module map + build order (platforms only)
+      YYYY-MM-DD-<topic>-inventory.json # wave mode, stage 0 — every open item by id, verified
+      YYYY-MM-DD-<topic>-canvas.md    # wave mode, stages 2–3 — the target state over the current logic
       YYYY-MM-DD-<topic>-design.md    # stage 3 — the spec / module dossier (locks shared contracts)
       YYYY-MM-DD-<topic>-acceptance.md # stage 10 — REQ coverage table + evidence
     plans/
@@ -170,6 +172,8 @@ them is a finding, not a tie-break ([`knowledge-sources.md`](knowledge-sources.m
 | 10 Board resolution | `<artifacts>/backlog.md` — every unresolved ledger row — homed `backlog` or still `open` — arrives with a real id, and the ledger row is updated to name it; priority re-derived ([`backlog.md`](backlog.md)) | the next run's harvest, and every loop iteration |
 | 10 Retro rotation | `<artifacts>/retro/YYYY-QN.md` — entries older than five stamps, plus every retirement, each with its commit | queried by a later run's harvest |
 | 2 Decompose | `specs/<topic>-modules.md` — module map, build order, contracts, per-module status (platforms only) | stages 3–10, every module's run |
+| 0 Wave mode | `specs/<topic>-inventory.json` — every open item: id, source, status, area, node, wave, release ([`waves.md`](waves.md)) | stages 2–10, every wave's re-measure |
+| 2–3 Wave mode | `specs/<topic>-canvas.md` — as-is → to-be per module and contract, the seams, REQ → module → wave, what is deleted | every wave, and each re-cut |
 | 3 Spec | `specs/<topic>-design.md` — module dossier for a decomposed platform (+ links `docs/ux/*` for UI) | stage 4 |
 | 4 Plan | `plans/<topic>.md` | stage 5 |
 | 3 UX track | `docs/ux/{foundation,flows,screens,scenarios}.md` | stages 4–9 + `/ux-lint` |

package/plugins/task-pipeline/skills/task-pipeline/references/brainstorm.md

@@ -56,9 +56,12 @@ not a question to re-open from scratch.
    the platform's shape — the pieces, how they relate, what order they land in —
    not the details of one corner; those belong to each module's own stage-3
    dossier. Don't refine something that needs splitting first.
-3. **Questions one at a time.** Never bundle. Multiple choice where it fits, open
-   where it doesn't. Purpose, constraints, success criteria — anything the brief
-   left at design level.
+3. **Questions in one batch, after the sources.** What the brief, the code and the
+   recorded decisions cannot answer goes in one message, ordered by dependency, each
+   with a recommendation; one at a time only where an answer reshapes the next
+   question or the operator asks ([`grill.md`](grill.md)). Multiple choice where it
+   fits, open where it doesn't. Purpose, constraints, success criteria — anything the
+   brief left at design level.
 4. **Propose 2–3 approaches with trade-offs**, lead with your recommendation and
    the reason for it. **YAGNI ruthlessly** — strip anything the task doesn't need
    from every option before presenting.

package/plugins/task-pipeline/skills/task-pipeline/references/build.md

@@ -610,9 +610,9 @@ merge.
 
 If it returns findings, dispatch **ONE** fix subagent with the complete list — not
 one fixer per finding; per-finding fixers each rebuild context and re-run suites.
-Then exactly **one** scoped re-review of the fix wave. Adjudicate residuals as in
+Then exactly **one** scoped re-review of the fix round. Adjudicate residuals as in
 the breaker: park with rulings, or stop on load-bearing ones. There is no second
-fix wave.
+fix round.
 
 ## 6. Integrate, then finish
 

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -47,13 +47,21 @@ This spans the whole run, not one stage:
 
 - the plan's tasks at stage 5;
 - the boundary between stages whose gate is `auto`;
-- the per-module program loop when the brief was a platform;
+- the per-module program loop when the brief was a platform, and the waves when
+  the request was the whole board ([`waves.md`](waves.md));
 - the acceptance → retro tail, which is where runs most often stall one step from
   finished.
 
 It stops for exactly four things: a `manual` gate, a block it cannot resolve, a
 genuine ambiguity the brief does not answer, and completion.
 
+**A block or an ambiguity stops its node, not the run.** The node is parked with the
+question as its reason, marked `needs-operator` and answerable without context
+([`prioritisation.md`](prioritisation.md) → *5. Where the human goes*), and the run
+continues on every node it does not block. The run itself stops only when the whole
+frontier is blocked — `graph.py next` exits `4` — and the questions are then asked
+together. **When the board is empty, say so once**, and do not invent work to fill it.
+
 **This extends [`build.md`](build.md); it does not replace it.** That file's
 *Continuous execution* rule governs the inside of a stage-5 execution — do not
 check in between the tasks of a plan you were told to execute. It is unconditional
@@ -122,7 +130,9 @@ So at the bottom of an iteration, beside the re-derived `prio`:
 2. state whether the next item still serves it;
 3. if it does not, **re-order or re-scope the queue and say what moved and why.** A row
    that stops serving the goal leaves for the board with its reason
-   ([`backlog.md`](backlog.md)), it does not get worked because it was next.
+   ([`backlog.md`](backlog.md)), it does not get worked because it was next. On a work
+   graph the move is a committed `revisions` entry — `park`, `add`, or `wave` between
+   waves — never an untracked edit.
 
 A queue re-derived only by `age` and `sev` is a queue that is honest about priority and
 silent about purpose. Both numbers can be right while the run is finishing something the

package/plugins/task-pipeline/skills/task-pipeline/references/decomposition.md

@@ -137,6 +137,10 @@ Rules for the loop:
   lands, or build several and deploy once. Record it; don't decide it per module.
 - **Update the map's status column as each module closes**, in the same commit as
   that module's acceptance. The map is the resume point after a lost context.
+- **The whole board is waves, not bricks** ([`waves.md`](waves.md)). When the request
+  is every open item rather than one platform, stages 0–2 still run once, the map
+  becomes the canvas, and the loop runs **one wave at a time**. A wave may hold several
+  bricks or nodes, provided they close together in one pass.
 - **Loop discipline:** a module re-entering the same stage a third time trips the
   loop guard ([`loop-guard.md`](loop-guard.md)) — stop, name the oscillation, and
   fix the layer that owns it instead of iterating.

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -27,6 +27,7 @@ UX track on a user-facing task.
 | 0 Intake grill | `references/grill.md` |
 | 2 Brainstorm | `references/brainstorm.md` |
 | 2 Decompose (platforms only) | `references/decomposition.md` |
+| 0–10 · **wave mode** — the whole board: 0–4 once, 5–8 per wave, 9–10 to close | `references/waves.md` |
 | 3 Spec | `references/spec.md` |
 | 4 Plan | `references/planning.md` |
 | the queue the loop walks | `references/work-graph.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/grill.md

@@ -63,16 +63,25 @@ not depend on it.
 
 Where material unknowns remain, interview the operator about THOSE until you
 reach a **shared understanding**. Walk down each unresolved branch of the
-decision tree, resolving dependencies between decisions one by one.
-
-1. **One question per turn.** Never bundle. Wait for the answer before the next.
+decision tree, resolving dependencies between decisions in order.
+
+1. **Close from the sources first, then ask ONE batch.** Every material unknown
+   the harvest, the code and the recorded decisions leave open goes into one
+   message, ordered by dependency, each with a recommended answer and what each
+   answer changes. **One question at a time only when the answers depend on each
+   other** — the next question cannot be written until this one is answered, and
+   then you go depth-first — **or when the operator asks for it.** Decided by the
+   operator on 2026-10-11: a question asked alone costs a human round, and a batch
+   costs one. [`prioritisation.md`](prioritisation.md) → *5. Where the human goes*
+   says the same about the rest of the run.
 2. **Recommend an answer with every question** (+ a one-line rationale). "What do
    you think?" is lazy — you have the codebase in front of you, they don't.
 3. **If the codebase can answer it, go read the codebase.** Spending the
    operator's turn on something `grep`/`Read`/context7 would have told you is the
    most common way to waste a grill.
-4. **Depth-first.** Finish a branch before opening another; ask prerequisite
-   decisions first, so later answers don't invalidate earlier ones.
+4. **Prerequisites first.** Order the batch so prerequisite decisions come before
+   the ones they shape; where an answer can invalidate a later question, ask the
+   prerequisite alone and go depth-first.
 5. **Reconcile contradictions immediately**, and chase dodges: "we'll decide
    later" → "what's the latest you can decide and still ship?"
 6. **Cover the autonomy sweep** (below). An unasked MATERIAL question is not

package/plugins/task-pipeline/skills/task-pipeline/references/planning.md

@@ -112,6 +112,14 @@ which grows but never reorders a stage. Discovery that lands in a committed
 artifact is not a dynamic graph; discovery that changes what runs next, silently,
 is.
 
+**Wave mode's re-cut is the same kind of discovery** ([`waves.md`](waves.md)). After
+each wave the remaining waves are re-cut from the re-measured inventory, and every move
+lands twice in committed form: a `revisions` entry in the work graph (`graph.py wave`,
+which refuses a move that breaks the wave order) and the canvas edit that says why. The
+stage list does not change and no stage is invented; what changes is which nodes the
+next pass of stages 5–8 takes, and that is written down before the pass begins. So the
+static-graph decision holds.
+
 ## Task right-sizing
 
 A task is the smallest unit that carries its own test cycle and is worth a fresh

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -71,6 +71,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | What a stage reads, and which host files bind it | `references/artifacts.md` |
 | The design conversation, its hard gate, UI detection, user paths | `references/brainstorm.md` |
 | Cutting a platform into modules, brick criteria, build order | `references/decomposition.md` |
+| **Wave mode** — the whole board: the inventory, the canvas, the one question batch, the wave cut and the close pass | `references/waves.md` |
 | What a spec must lock, the UX-track order, the module dossier | `references/spec.md` |
 | The zero-context plan format, parallel groups, set equality | `references/planning.md` |
 | The work graph: its fields, the verbs and their exit codes, and the three invariants a schema cannot state | `references/work-graph.md`, `scripts/graph.py`, `graph.schema.json` |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -166,9 +166,10 @@ never that the work was skipped quietly.
   ([`progress.md`](progress.md)), and a skip nobody can see is indistinguishable from a
   stage that was never entered.
 - **How it runs: [`grill.md`](grill.md)** — the full doctrine, built into this
-  skill (nothing to install). In short: one question per turn, a recommended
-  answer with each, explore the codebase before asking, depth-first through the
-  decision tree, contradictions reconciled on the spot; **every answer that touches
+  skill (nothing to install). In short: close what the sources can, then ONE batch
+  of the material unknowns, ordered by dependency, a recommended answer with each —
+  one at a time only where answers depend on each other or the operator asks;
+  contradictions reconciled on the spot; **every answer that touches
   a harvested source is checked against it** — the operator outranks any document,
   but only out loud, and the losing side is logged for the stage-9 doc update; plus
   **domain awareness**
@@ -267,9 +268,9 @@ never that the work was skipped quietly.
 - **Freedom: high** — many designs are valid — this is the open field, and the only fixed thing is the gate ([`gates.md`](gates.md) → *Axis C*).
 - **How it runs: [`brainstorm.md`](brainstorm.md)** — built into this skill. Read
   the brief first (stage 0 already answered scope/constraints/done-criteria), then
-  explore the codebase, scope-check for decomposition, one question at a time, 2–3
-  approaches with a recommendation, design presented in sections and approved
-  section by section. **Hard gate:** no code, no scaffolding, no implementation
+  explore the codebase, scope-check for decomposition, the open questions in one
+  batch, 2–3 approaches with a recommendation, design presented in sections and
+  approved section by section. **Hard gate:** no code, no scaffolding, no implementation
   skill before the operator approves the design — including on "obviously simple"
   tasks.
 - **UI detection (mandatory check):** decide whether the task touches any
@@ -859,6 +860,9 @@ module N → 3 spec (dossier) → 4 plan → 5 build → 6 tests → 7 lint+depl
 - **Program done** when every row is `done` or `deferred` with an agreed home, the
   cross-module contracts are covered by tests that cross the seam, and a final
   acceptance covers the platform's whole REQ table — not module by module.
+- **The whole board, rather than one platform, is wave mode**
+  ([`waves.md`](waves.md)): stages 0–4 once over every open item, 5–8 per wave with a
+  close pass after each, 9–10 to close the release.
 
 ## Cross-cutting — the Doc Loop
 

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -0,0 +1,225 @@
+# Wave mode — closing a whole board in its final form
+
+`/task-pipeline waves`. The request is not one change but **the whole board**: every open
+item a project carries — the board and its lanes, carry-over ledgers, plan rows,
+verification rows still at `never`, scenarios with no coverage, open PRs and unlanded
+branches, asks from other products' sessions — plus the operator's new requests.
+
+**It is a program mode of the existing stages, not a parallel cycle.** Stages 0–4 run
+once, for the whole board. Stages 5–8 run once per wave. Stages 9–10 close the release.
+Every gate in [`stages.md`](stages.md) still holds where its stage runs; what the mode
+changes is how many times each stage runs, and over what.
+
+Decided by the operator on 2026-10-11 and first applied that day to a board of 701 items.
+
+## Contents
+
+- The rule it exists for
+- How the stages map
+- Wave 0 — the survey and the inventory
+- The questions — closed from sources, then one batch
+- The canvas — the target state over the current logic
+- Cutting the waves
+- The wave loop
+- The close pass, after every wave
+- A board bigger than one release
+- What stays human
+- The graph carries the wave
+- Rationalizations
+
+## The rule it exists for
+
+**Build the system in its final form, never through intermediate states.** An
+intermediate state that a later task undoes is the most expensive thing an agent
+produces: the build, the review, the migration and the operator's attention are each
+paid twice, and the second payment is for removing the first. So every item is designed
+against the target state of the whole system first, and only then cut into waves.
+
+**No wave builds a shape a later wave undoes.** A stub is allowed only at a contract the
+canvas declares, and the wave that removes it is named beside it. A stub with no named
+removal is the intermediate state this mode exists to refuse.
+
+What the mode buys, in the order the operator named it: transparency (the inventory,
+the canvas and the wave plan live in the repository, so any agent can resume from them),
+stability, autonomy, predictability (each wave says before it starts what it closes and
+how that is proved), minimum operator time, fast real results, and a strategy corrected
+on real agents, tasks and users rather than on the first guess.
+
+## How the stages map
+
+| Stage | In wave mode |
+|---|---|
+| 0 Intake | once, over the whole board: wave 0's survey is the harvest, the inventory is the work-list, and every in-scope item becomes or joins a REQ row in the operator's words |
+| 1 Docs study | once, for every contract the canvas locks |
+| 2 Brainstorm + decompose | once: the canvas extends the module map ([`decomposition.md`](decomposition.md)), and the work graph carries each node's wave |
+| 3 Spec | once: the canvas is the committed target-state spec; a wave's dossier may deepen a section, never contradict it |
+| 4 Plan | once: every wave's nodes, its exit criteria and the question batch. Re-cut at each wave boundary, as a recorded revision |
+| 5–8 Build → post-deploy | per wave, then the close pass |
+| 9 Docs + wiki · 10 Acceptance | once, to close the release, over everything the waves shipped |
+
+**One planning gate, not three prompts.** The manual gates of stages 0, 2 and 3 are
+presented together at the end of planning: the brief, the canvas, the wave plan and the
+question batch in one message. Each gate's criteria are still checked and printed; the
+operator is asked once, and the go names the gates it closes. Silence closes none.
+
+## Wave 0 — the survey and the inventory
+
+**Harvest every source of open work, by id** ([`knowledge-sources.md`](knowledge-sources.md)
+supplies the sources; [`backlog.md`](backlog.md) the board). For whole-project scope, run
+`project-audit` beside it as a read-only sidecar: its HTML and JSON are measured
+findings, and its proposed rows join the inventory like any other source. Where the
+product has users, walk their real path in the built app on a fresh profile with
+disposable data. A finding is a fact with a receipt, never an impression.
+
+**One machine-readable inventory, nothing outside it.** A single committed file,
+`<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:
+
+| Field | Carries |
+|---|---|
+| `id` | the item's id in its owning register; an item without one gets one there, in the same change |
+| `source` | where it was found, as `file:line` |
+| `status` | as measured, not as the register last said |
+| `area` | the part of the system it touches |
+| `node` | the canvas node it lands on |
+| `wave` | the wave that closes it, or the release it is carried to |
+| `release` | this release, or `program` |
+
+`blocked_by`, `closable_in_one_pass` and `notes` are worth carrying beside them.
+
+**Verify each open item against the code before trusting it.** A stale item is closed
+in its owning register with the receipt that shows it done; duplicates are clustered,
+both ids kept. A register that says *open* about shipped work is the commonest thing a
+survey finds.
+
+**Assign nodes and waves with a committed script, not by hand.** A deterministic script
+reads the inventory and a short wave table and writes `node`, `wave` and `release` onto
+every entry, then prints the counts per wave and per node. A re-cut is then a diff to a
+table and a re-run, which a reviewer can read; seven hundred hand-edited rows are not.
+
+## The questions — closed from sources, then one batch
+
+**Close every question from the sources first**, in this order: the operator's recorded
+decisions, ADRs and principles, the knowledge base, the code, the neighbours' contracts.
+A question answered there is recorded with its citation — *resolved from the sources,
+not asked* — and closed. What remains is only what is genuinely the operator's: access,
+consent, money, a business or product direction, an outward or irreversible act.
+
+**Those go once, as one batch, at the end of planning.** Each carries a recommended
+answer and the consequence of each answer, ordered so prerequisite decisions come first
+([`grill.md`](grill.md)). A go that leaves a question unanswered takes the
+recommendation, recorded as **assumed** in the decisions table, and every wave that
+depends on an assumption names it — so a different answer later re-plans exactly those
+waves and no others. After planning, a question is asked only at a wave boundary, in the
+hand-back's DECISIONS WAITING ([`progress.md`](progress.md)).
+
+**An outward or irreversible act is never assumed.** Publishing, tagging, deploying
+without a specific standing authorization, sending to a person, spending money,
+deleting data: each waits for the operator's explicit go, asked with a verified direct
+link. A recommendation is not an authorization.
+
+## The canvas — the target state over the current logic
+
+One committed spec, `<artifacts>/specs/YYYY-MM-DD-<topic>-canvas.md`, extending the module
+map. It is the current system with every change laid over it:
+
+1. **As-is → to-be per module and per contract** — data and events, screens and flows,
+   cross-product links.
+2. **The integration seams** — how each integration happens, who owns each side, what
+   crosses it.
+3. **REQ → module → wave**, one row per requirement.
+4. **Deleted or superseded** — what the new version removes (code, screens, contracts,
+   docs) and which wave removes it. A removal nobody wrote down survives the release.
+
+**Every inventory item lands on a node.** An item that lands nowhere is either out of
+scope — said, with a register row — or a gap in the canvas. **The canvas is reviewed for
+coherence before any wave is cut:** two items that change one seam are designed together,
+because designed apart they are the intermediate state the rule above forbids.
+
+## Cutting the waves
+
+**A wave holds only items closable in one pass.** All four, for every item in it:
+
+- its dependencies are done, or inside the same wave;
+- it touches one seam, or a few adjacent ones;
+- its verification can run together with the rest of the wave;
+- the wave leaves the system working — landable, with no half-built shape exposed.
+
+**Wave 1 is the walking skeleton**: the thinnest end-to-end path of the target that
+proves the spine, for the reason [`decomposition.md`](decomposition.md) gives for a
+platform's first brick. **Each wave names its exit criteria before it starts** — the
+tests, the live walk, the gates and the documents that will prove it closed. Criteria
+written after the wave are a description of what happened.
+
+An item that cannot close in one pass because it needs a person stays on its node,
+marked `needs-operator`, out of every wave until it is unblocked.
+
+## The wave loop
+
+Each wave runs stages 5–8 as [`stages.md`](stages.md) states them, then the close pass.
+Between waves the run does not ask whether to continue: it takes the next wave
+([`continuity.md`](continuity.md)). A genuine ambiguity parks its node `needs-operator`
+and the wave goes on with the nodes it does not block; the run stops only when the whole
+frontier is blocked. When the board is empty, it says so once.
+
+Research, the audit and the blind readings run in parallel agents; builds stay sequential
+wherever two of them share a seam ([`planning.md`](planning.md) → file ownership).
+
+## The close pass, after every wave
+
+In this order, inside the wave rather than after it:
+
+1. **Verify.** Every node the wave closes is certified ([`certification.md`](certification.md)),
+   and [`audit.md`](audit.md)'s exit is re-measured over what the wave touched.
+2. **Finish and fix — one fix round**, inside [`loop-guard.md`](loop-guard.md)'s caps.
+   Every finding is fixed in the wave or parked with a board row and its reason; nothing
+   is dropped silently.
+3. **Document** — the Doc Loop and the stage-9 propagation matrix
+   ([`documentation.md`](documentation.md)), scoped to the wave: scenarios, decisions,
+   docs and registers in the same change as the code.
+4. **Mark the canvas.** Each node the wave closed carries its status and the commit.
+5. **Re-read the goal** ([`continuity.md`](continuity.md) → *The goal is re-read between
+   items, not only the board*). A re-plan is a committed `revisions` entry plus a canvas
+   edit, never a quiet change.
+6. **Re-measure the inventory and re-cut the remaining waves** from the updated target —
+   never from the original guess. New findings join the inventory with ids.
+
+## A board bigger than one release
+
+**It becomes a program.** The release takes the first waves; the rest stays on the
+canvas by node, `release: program`, never dropped. The next release resumes from the
+canvas: it re-measures the inventory rather than re-running wave 0 from nothing, and its
+waves are cut from the nodes still open.
+
+## What stays human
+
+Sign-ins, consents, payments, sending to people, and every outward or irreversible act.
+The mode removes *"shall I continue?"* between waves and *"what did you mean?"* where a
+source already says; it never removes a person from a decision that is theirs. A
+`manual` gate still waits for its go ([`continuity.md`](continuity.md) → *The limit,
+before the capability*).
+
+## The graph carries the wave
+
+The work graph ([`work-graph.md`](work-graph.md)) carries `wave` on a node, an integer from
+1. Three verbs read it:
+
+- `graph.py validate` refuses an edge from a later wave's node into an earlier wave's
+  node: an earlier wave that waits on a later one cannot close in its own pass.
+- `graph.py next --wave N` prints wave N's frontier only. Exit `3` says the wave is done,
+  `4` that nothing in it is runnable, `1` that no node is in wave N.
+- `graph.py wave N-007 --to 3 --why "<reason>"` moves a node and writes the revision.
+  It refuses a move that would break the order above.
+
+Without python3 the same three facts live in the wave plan's table, checked by hand and
+said to be checked by hand.
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "Ship the simple version now, the real one later" | That is the intermediate state. Its removal is a second build nobody planned |
+| "Ask each question as it comes up" | Each one is a human round. Close it from the sources, or put it in the batch |
+| "The board is too big to inventory" | The inventory is the plan. Without it the waves are cut from memory |
+| "Re-cutting waves makes the pipeline dynamic" | A re-cut is a committed revision and a canvas edit. The static-graph decision in [`planning.md`](planning.md) holds |
+| "The recommendation is obviously right, so assume the deploy go" | An outward act is never assumed. Ask for the specific go once, in the batch |
+| "Wave 3 can stub what wave 5 will build properly" | Only at a declared contract, with wave 5 named as the stub's removal |

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -41,6 +41,7 @@ turn of every loop.
 | `nodes[].blocked_by` | what must PRODUCE first. The frontier obeys a satisfaction predicate, and only `done` satisfies — a PARKED producer blocks its consumer, because a park is a decision not to produce, not a production. `next` names each held consumer with the park's reason; a valid alternative producer is an explicit, versioned edge change, never an implicit unblock |
 | `nodes[].touches` | what it **mutates**. Two runnable nodes writing one file is the false parallelism [`planning.md`](planning.md) refuses — *distinct is not the same as independent, and the check is what they touch, never what they are called* |
 | `nodes[].check` | **how this node will be closed** — one command, or the named judgement where no command can decide it. Required on every node except a `parked` one. The certification's `unit` tier runs it and reports its output as the evidence row ([`certification.md`](certification.md) — three blind tiers close a node, not one reader); before this field existed that instruction pointed at an absence, leaving a verifier the two things it forbids — invent a check, or run everything (B-080) |
+| `nodes[].wave` | wave mode only ([`waves.md`](waves.md)): the pass of stages 5–8 that closes the node, from 1. **An earlier wave may not wait on a later one** — `validate` refuses the edge, because a wave holds only what closes in its own pass |
 | `nodes[].evidence` | required when `status` is `done`. A node called done by assertion is what evidence exists to prevent |
 | `nodes[].parked_reason` | required when `status` is `parked`. A park with no reason is indistinguishable, a week later, from work quietly dropped |
 | `edges[].payload` | what the dependency hands over. **An edge carrying no named artifact is chronology drawn as architecture** |
@@ -54,11 +55,12 @@ conditional on the code, never merely sequenced after it.**
 | Verb | Prints | Codes |
 |---|---|---|
 | `validate` | every violation, in a stable order | `0` clean · `1` any |
-| `next` | the frontier, ordered by how much each node unblocks — **and nothing else** | `0` printed · `3` all done · `4` nothing runnable |
+| `next` | the frontier, ordered by how much each node unblocks — **and nothing else**. `--wave N` narrows it to one wave, and `3` then means *this wave is done* | `0` printed · `3` all done · `4` nothing runnable · `1` with `--wave`, a wave no node is in |
 | `coverage` | each requirement with the nodes serving it | `0` covered · `1` a gap, named |
 | `goal` | the release goal | `0` · `3` unstated |
 | `add` | the id it allocated | `0` · `1` refused |
 | `park` | the id and the reason | `0` · `1` refused |
+| `wave` | wave mode's re-cut: the node, its old and new wave, and the reason, which enters the revision log. Refuses a move that would leave an earlier wave waiting on a later one, and a `done` node | `0` · `1` refused |
 | `certify` | the round, and on a failure every `breaks` finding with its fix and its check | `0` every owed tier passed — three, or four with `visual` on a flagship or product node · `1` a tier failed, a required one is missing, or a report is malformed |
 | `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused **or the verdict stops the run** |
 | `producer` | what produced this proof — actor, model, runtime, skill, config, commit, trace | `0` |

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -88,7 +88,7 @@ TERMINAL = {"done", "parked"}
 NO_GRAPH = {"producer", "doctrine"}
 # One place, and the schema enumerates the same three. Two homes for this set is
 # what let `close` write a verb the format forbade.
-REVISION_VERBS = {"add", "park", "close", "invalidate", "waive"}
+REVISION_VERBS = {"add", "park", "close", "invalidate", "waive", "wave"}
 # Parking a node PROMOTES its dependents: `parked` is terminal, so anything
 # blocked on it becomes runnable even though the payload it waited on never
 # arrived. That is deliberate — `can_continue_around` in the verdict is the
@@ -276,6 +276,13 @@ def violations(graph):
                        f"{', '.join(SURFACE_CLASSES)}. A class nobody recognises requires no "
                        "visual reading, so a typo here would drop the tier that reads the pixels")
 
+        # Wave mode (`references/waves.md`). `True` is an int in Python, and a wave of
+        # `true` is a typo the ordering check below would read as wave 1.
+        if "wave" in n and not _is_wave(n["wave"]):
+            out.append(f"{nid}: wave is {n['wave']!r} — it must be an integer from 1. A wave "
+                       "nobody can order is a node no `next --wave` ever prints, and the "
+                       "order check below cannot see it")
+
         if n.get("status") == "done":
             ev = n.get("evidence")
             if not isinstance(ev, list) or not [e for e in ev
@@ -322,6 +329,17 @@ def violations(graph):
                            "and a dependency handing over nothing is the one this check "
                            "exists to refuse")
 
+    # An earlier wave may not wait on a later one: a wave holds only what closes in one
+    # pass, and a node whose producer is scheduled after it cannot close in its own.
+    wave_of = {n.get("id"): n.get("wave") for n in nodes if _is_wave(n.get("wave"))}
+    for e in graph.get("edges") or []:
+        src, dst = e.get("from"), e.get("to")
+        if src in wave_of and dst in wave_of and wave_of[src] > wave_of[dst]:
+            out.append(f"edge {src}→{dst}: {src} is in wave {wave_of[src]} and {dst} in "
+                       f"wave {wave_of[dst]} — an earlier wave would wait on a later one, "
+                       "so it cannot close in its own pass (references/waves.md). Move "
+                       f"{dst} to wave {wave_of[src]} or later, or {src} earlier")
+
     for i, r in enumerate(graph.get("revisions") or []):
         if not isinstance(r, dict):
             out.append(f"revisions[{i}] is not an object")
@@ -603,6 +621,11 @@ TIERS = ("unit", "seam", "product")
 VISUAL_TIER = "visual"
 ALL_TIERS = TIERS + (VISUAL_TIER,)
 SURFACE_CLASSES = ("flagship", "product", "internal", "ad")
+
+
+def _is_wave(w):
+    """A wave is an integer from 1 — and never a bool, which Python counts as an int."""
+    return isinstance(w, int) and not isinstance(w, bool) and w >= 1
 VISUAL_REQUIRED = ("flagship", "product")
 TIER_KEYS = ("node", "tier", "verdict", "scope", "confirms", "findings",
              "evidence", "not_examined")
@@ -746,13 +769,24 @@ def cmd_next(graph, args):
     if violations(graph):
         die("graph does not validate — run `validate` first", 1)
     nodes = graph.get("nodes") or []
+    wave = getattr(args, "wave", None)
+    if wave is not None:
+        # One wave's frontier, and its own endings: `3` is *this wave is done*, which is
+        # the close pass's cue, not the release's (references/waves.md).
+        if not _is_wave(wave):
+            die("--wave %r is not a wave — waves are integers from 1" % wave, 2)
+        nodes = [n for n in nodes if n.get("wave") == wave]
+        if not nodes:
+            die("no node is in wave %d — nothing to walk, and an empty wave is a wave plan "
+                "and a graph that disagree" % wave)
     if nodes and all(n.get("status") in TERMINAL for n in nodes):
         return 3
-    ready = frontier(graph)
+    in_scope = {n.get("id") for n in nodes}
+    ready = [n for n in frontier(graph) if n.get("id") in in_scope]
     # A consumer whose producer is PARKED is not runnable and never will be by
     # itself (FIX-PF-04.01) — say so BEFORE the empty-frontier exit, or the one
     # moment the operator most needs the reason is the one moment it is silent.
-    _by_id = {n.get("id"): n for n in nodes}
+    _by_id = {n.get("id"): n for n in graph.get("nodes") or []}
     for n in nodes:
         if n.get("status") in TERMINAL or n.get("status") == "running":
             continue
@@ -1123,6 +1157,46 @@ def cmd_park(graph, args):
     return 0
 
 
+def cmd_wave(graph, args):
+    """Move one node to another wave, carrying the reason — wave mode's re-cut.
+
+    The re-cut after every wave is a plan revision, and a revision nobody recorded is
+    the dynamic graph `references/planning.md` refuses. So the move is a verb: it
+    writes the `revisions` entry, and it refuses a move that would leave an earlier
+    wave waiting on a later one (`references/waves.md`).
+    """
+    guard(graph, args.graph)
+    why = (args.why or "").strip()
+    if not why:
+        die("`wave` needs a --why with something in it: a re-cut nobody gave a reason for "
+            "is the quiet edit the revision log exists to refuse — nothing was written")
+    if any(c in why for c in "\n\r"):
+        die("--why contains a line break — nothing was written")
+    if not _is_wave(args.to):
+        die("--to %r is not a wave — waves are integers from 1. Nothing was written"
+            % args.to)
+    node = next((n for n in graph.get("nodes") or [] if n.get("id") == args.node), None)
+    if node is None:
+        die("no node %s in this graph — nothing was written" % args.node)
+    if node.get("status") == "done":
+        die("%s is done, in wave %s — moving it would rewrite which pass closed it. "
+            "Nothing was written" % (args.node, node.get("wave")))
+    if node.get("wave") == args.to:
+        die("%s is already in wave %d — nothing was written" % (args.node, args.to))
+
+    before = node.get("wave")
+    node["wave"] = args.to
+    revise(graph, "wave", args.node, why)
+    bad = violations(graph)
+    if bad:
+        die("moving %s to wave %d would break the graph — nothing was written:\n  %s"
+            % (args.node, args.to, "\n  ".join(bad)))
+    save(args.graph, graph)
+    print("%s: wave %s → %d: %s" % (args.node, before if before is not None else "none",
+                                     args.to, why))
+    return 0
+
+
 def next_id(known):
     """The next id, from the MAXIMUM rather than from the count.
 
@@ -1359,7 +1433,7 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 39 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 40 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 
@@ -1825,6 +1899,7 @@ VERBS = {
     "coverage": (cmd_coverage, "every requirement and the nodes serving it; exits 1 on a gap"),
     "add": (cmd_add, "add a node mid-run"),
     "park": (cmd_park, "park a node, carrying the reason"),
+    "wave": (cmd_wave, "move a node to another wave, carrying the reason"),
     "certify": (cmd_certify, "require three independent tier reports (four on a "
                              "flagship or product surface), then emit the verdict "
                              "`close` consumes"),
@@ -1905,6 +1980,15 @@ def main(argv=None):
     made["waive"].add_argument("--by", required=True,
                                help="the identity that authorized the exception")
 
+    made["next"].add_argument("--wave", type=int, default=None,
+                              help="print only this wave's frontier; exit 3 when the wave "
+                                   "is done (references/waves.md)")
+    p_wave = made["wave"]
+    p_wave.add_argument("node")
+    p_wave.add_argument("--to", type=int, required=True, help="the wave to move it to")
+    p_wave.add_argument("--why", required=True,
+                        help="why the re-cut moved it — it enters the revision log")
+
     p_park = made["park"]
     p_park.add_argument("node")
     # `required=True` makes the MISSING flag a usage error (exit 2). The empty and
@@ -1916,7 +2000,7 @@ def main(argv=None):
     verbs = {k: v[0] for k, v in VERBS.items()}
     if args.verb in NO_GRAPH:
         return verbs[args.verb](None, args)
-    if args.verb in ("add", "park", "close", "certify", "invalidate", "waive"):
+    if args.verb in ("add", "park", "wave", "close", "certify", "invalidate", "waive"):
         # The READ happens inside the lock too. Loading first and locking second is the
         # same lost update with an extra step: the stale copy is already in memory.
         with held(args.graph):

package/plugins/task-pipeline/skills/task-pipeline/templates/run.md

@@ -20,7 +20,7 @@ Run: `<topic>` · started `<YYYY-MM-DD>` · module map: `<path or "none">`
 
 ## `read:` — which doctrine this run actually opened
 
-The bundle is 39 reference files and nothing recorded which of them a run read, so **a
+The bundle is 40 reference files and nothing recorded which of them a run read, so **a
 skipped file and a read one were indistinguishable** — the class every guard in this
 pipeline exists to catch, left standing over the doctrine itself.
 
@@ -48,7 +48,7 @@ same claim one level down.
 |---|---|---|
 | `unmeasured — no run ledger` | there is no ledger | nothing to read from |
 | `unmeasured — the ledger carries no read: lines` | the hook is absent, **or** the run opened no doctrine | two opposite facts, and the ledger cannot separate them, so neither is claimed |
-| `N of 39 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
+| `N of 40 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
 
 **It is a disclosure: no floor, no direction, never a target.** A run that needs four files
 and reads four is not worse than one that reads thirty — and the moment the number becomes