Fleet Command

# Fleet Command

> Conductor for the `-fleet` family — one tier above the members, coordinating the fleets themselves rather than fanning out over an item-queue. It derives the run as a hybrid DAG whose wave boundaries come from a dependency edge **or** an evidence-fidelity exclusivity requirement — either one alone sufficient — instead of accepting a hand-picked order, enforces **one global** leaf-slot budget across every fleet in flight rather than the sum of their per-fleet governors, deconflicts the lanes whose emissions collide before any of them runs, presents each ready member's own human CONFIRM gate verbatim in one batched round per wave **without ever answering it**, verifies every lane from its emitted artifacts rather than its self-report, and hands back one consolidated report. It **never merges**.

Thirteen `-fleet` skills exist, and each is a competent orchestrator over exactly one SDLC work-queue. What does not exist is anything that can run **more than one of them in the same session** without the operator personally holding the whole shape in their head — which fleets may run together, in what order, under what aggregate load, colliding on what, and arriving as how many separate reports.

That gap costs three specific things, and none of them is reachable from inside a single member. **Fan-out².** Each member caps its concurrent subagents at the family's machine-storm limit, and that cap is **per fleet**; nothing enforces it across fleets, so two well-behaved members at their own caps is double the load and a naive "run all the sweeps" is an order of magnitude more. A cap that every participant honors locally and nobody enforces globally is not a cap. **Dependency.** The conveyor is a real chain, not a menu — intake produces the queue that decide and build consume, and land lands what all of them produced — so members run concurrently consume their predecessors' _stale_ output, while members run fully serially waste the genuine parallelism of the quality sweeps, whose **inputs** depend on none of the spine even though several of their **outputs** file back into it. **Collision.** Members write shared generated artifacts, allocate from shared number sequences, edit the same source regions, and file the same defect several times over, because no member can see the others.

The conductor is **Tier 3** of Skills → Pipelines → Fleets → Conductor — a position on the **composition** ladder, which counts how deeply orchestrators nest. That is a different axis from the `tier` field in the skill's own manifest, which classifies **loading** (how eagerly the body is pulled into context) and says nothing about what the skill composes; the two numbers measure different things and are not comparable. Its authority is deliberately **coordinator plus global governor, never dictator**: it owns the scheduling, the budget, the deconfliction, and the reporting, and it owns none of the judgment inside the fleets it runs. It builds on the shared spine documented in `docs/reference/fleet-family.md` — the five-phase skeleton, the worktree-isolated fan-out, the front-load / park-unforeseen interaction model, and the never-silent-merge invariant — and on the family decisions recorded as _Subagent worktree fan-out (vs the Workflow primitive) for `-fleet` execution_, _The front-load / park-unforeseen interaction model for the `-fleet` family_, _The `pr-fleet` land-stage human-merge-gate model_, _The `adr-fleet` decide-stage batch-sign-off-gate model_, and its own _The `fleet-command` conductor-tier authority model_. It keeps the family's phase **names** deliberately — a conductor that invented a private vocabulary would be harder to reason about standing next to the members it runs — with **one stated substitution: at this tier SELECT enumerates fleets and DISPATCH dispatches fleet lanes**, where a member's SELECT enumerates items and its DISPATCH dispatches item subagents. It is **not** a `-fleet` and is deliberately not named one: a member fans out over an item-queue into outcomes, while this one's queue is other orchestrators.

## When to Use

- Running several fleets in one session, where the aggregate load, the dependency order, and the cross-fleet collisions would otherwise be held in the operator's head
- A periodic full-conveyor or full-maintenance sweep whose outputs must arrive as **one** report rather than as many separate piles to collate by hand
- When the interruption budget is the binding constraint: one run-plan authorization plus one batched gate round per wave, instead of every member's gate arriving at an unpredictable moment
- When the run must be provably bounded — a global cap, one pass per fleet, a fleet cap, and a wall-clock budget, with everything shed named rather than silently dropped
- NOT for running a single fleet — invoke that member directly; the conductor's scheduling overhead only pays off across several lanes
- NOT for merging anything — the merge-order plan is advice handed to the land member or to the human, never an action
- NOT for answering a member's CONFIRM — batching a gate is scheduling, and answering it is the collapse this tier exists to reject
- NOT for scheduling a convergence pipeline — pipelines are the primitive a fleet runs, and conducting them directly collapses the tier distinction the family is built on
- NOT for re-verifying every item a member produced — the member already verified them to the family standard, and duplicating that roughly doubles the run's cost for no new evidence
- NOT for adding a member to the family or changing an existing member's behavior — a fleet that needs a change to be conductable owns that change itself

## Capability Roles

<!-- Capability seam: this skill participates in a real extension point whose three roles are named and concrete. A seam with only one role filled is accidental single-implementation lock-in. See harness-skill-authoring Phase 1C. -->

- **Defines (Service Definition):** the shared `-fleet` handoff contract — the five-phase skeleton, worktree-isolated fan-out, gate-free `--report-only` probe path, and never-silent-merge invariant documented in `docs/reference/fleet-family.md`, concretized as the canonical `FleetHandoffRecord` in `@harness-engineering/types` (`packages/types/src/fleet-handoff.ts`, validated via `validateFleetHandoffRecord`; landed in #1414). fleet-command consumes this contract; it does not own it and never modifies a member to make it conductable.
- **Provides (Provider):** the `-fleet` members — `roadmap-fleet`, `bug-fleet`, `cicd-fleet`, `cleanup-fleet`, `security-fleet`, `issue-fleet`, `pr-fleet`, `test-fleet`, `adr-fleet`, `ideate-fleet`, `craft-fleet`, `perf-fleet`, `docs-fleet` — each emitting the shared handoff shape through its gate-free probe path.
- **Consumes (Consumer):** **this skill** — fleet-command probes each member through the gate-free path only and verifies every lane from its emitted handoff artifacts, so any new `-fleet` member is conductable with zero conductor change.

## Flags

| Flag                  | Effect                                                                                                                                                                                                                                                                                                             |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--fleets`            | Restrict the run to a comma-separated subset of the installed fleets; the selection is confirmed at CONFIRM either way                                                                                                                                                                                             |
| `--slots`             | Global cap on concurrent per-item subagents across **every** fleet in flight (default 3, **hard max 4**), with no single fleet ever allocated more than **2** of that pool                                                                                                                                         |
| `--max-fleets`        | Cap on how many fleets one run schedules (default 6); the shed is **structural** (see below) and every fleet beyond the cap is reported as shed **with its reason**                                                                                                                                                |
| `--wall-clock`        | Wall-clock budget for the run (default 8h); the deadline is checked at each wave boundary, and exhausting it stops scheduling new lanes rather than killing in-flight work                                                                                                                                         |
| `--report-only`       | **Non-interactive.** Probe the queues, derive the DAG and the contention map, print the run plan, and stop — no CONFIRM is presented and no lane is dispatched                                                                                                                                                     |
| `--dry-run`           | Run SELECT **and CONFIRM**; stop before any lane is dispatched. Unlike `--report-only` this presents the run-plan gate, so it is not a gate-free path                                                                                                                                                              |
| `--lease-seconds <n>` | Passed through **verbatim** to each ID-based member lane (`roadmap-fleet`, `issue-fleet`, `pr-fleet`) to override the cross-run claim-lease TTL; the conductor owns scheduling and budget, not the per-item claim, so the lease stays member-owned (see `docs/reference/fleet-family.md` §"Cross-run claim lease") |
| `--no-claim`          | Passed through **verbatim** to each ID-based member lane, disabling the cross-run claim lease for that run (falls back to open-PR-cross-check-only); claims remain member-owned — the conductor only forwards the flag (see `docs/reference/fleet-family.md` §"Cross-run claim lease")                             |

**`--report-only` and `--dry-run` are not synonyms, and the difference is the human gate.** `--report-only` is the **gate-free** path: it never presents CONFIRM, so it is safe to invoke from tooling, from a wrapper, or from another skill's SELECT without raising a decision the caller cannot answer. `--dry-run` is the **gated** path: it runs SELECT and then presents the run-plan CONFIRM, and only then stops. This is the same split the members keep, and the conductor depends on it in both directions — it honors the split in its own flags and it relies on the members honoring it when it probes them.

**The `--max-fleets` shed is structural, not a ranking.** When more fleets are schedulable than the cap allows, the run sheds in a fixed order: the **CI trust gate and the terminal lander are never shed** — dropping the trust gate discards the run's only read on evidence quality, and dropping the lander leaves every emission unlanded with nothing scheduled to look at it. The **independent quality sweeps are shed first, lowest probed queue depth first**, because they are the lanes whose omission costs the run the least and whose queues survive to the next run intact. That category is defined **by input, not by wave**, so `perf-fleet` belongs to it: it reads standing code, consumes nothing the spine produces, and is therefore shed by probed depth like any other sweep **despite occupying a wave of its own**. An exclusive wave is not a reason to protect a member — the trust gate and the lander are exempt because dropping them costs the run its evidence base or its reviewable terminal state, and neither applies to a benchmark sweep; a shed `perf-fleet` simply empties its wave, which is then skipped rather than renumbered. (Everywhere else in this body "the sweeps" is scoped to wave 2. Here alone it names the whole input-independent group, wave-2 and wave-5 alike, and the distinction is load-bearing precisely because the exclusive wave split the two readings apart.) A **conveyor-spine member is shed only if the human trims it at CONFIRM** — the conductor never sheds a spine member to fit a cap, because the spine is the dependency chain the derived order exists to respect. Every schedulable member falls into exactly one of these three categories — never-shed, independent quality sweep, conveyor spine — so the question "which reason shed this lane?" is always answerable, and everything shed is reported by name with the reason that applied.

**One pass per fleet per run is fixed, and is deliberately not a flag.** A fleet is never re-run inside a run to clear more of its queue. Exposing that as a lever would invite the "just one more sweep" drift the bound exists to prevent, and an unbounded conductor is indistinguishable from no conductor at all.

## Process

### Iron Law

**GLOBAL BUDGET, DERIVED ORDER, UNTOUCHED GATES, NEVER MERGE — no lane is dispatched outside the global governor; no fleet runs before the fleets it depends on have finished; no member's human gate is answered, skipped, or summarized by the conductor; and nothing is merged.**

All four are stated as law rather than guidance because each has an obvious-feeling shortcut, and each shortcut is available at precisely the moment it is most tempting. "Just this once, run them all" arrives when the queues are long and the wall-clock looks generous. "The spine is probably fine out of order" arrives when intake looks quiet and the sweeps are ready first. "That gate's answer is clearly yes" arrives after the fourth identical-looking gate in a batched round. "It is all green, land it" arrives at the end, when the merge order is already computed and sitting in the report. A property that survives only when it is convenient is not a property.

They are also the four that make a multi-fleet run **safe to authorize at all**. The human approving a run plan is approving a bounded amount of machine load, a correct consumption order, an unchanged set of decision rights, and a terminal state that is reviewable rather than landed. Violating any one of them retroactively invalidates the authorization that started the run — which is why a violation is a gate violation and a stop, never a tuning decision made mid-flight.

The corollary matters as much as the law. **A quiet run — every fleet reporting an empty queue — is a valid, valuable result.** It says the backlog is clear, which is worth knowing and worth reporting as such. It is never a reason to lower a member's noise floor, widen a queue, or re-probe with looser criteria so that some lane produces something. The conductor is the one actor in the family positioned to apply that pressure across every member at once, which is exactly why it is the one actor forbidden to.

```
Phase 1: SELECT --> Phase 2: CONFIRM --> Phase 3: DISPATCH
                                                    |
                                                    v
                     Phase 5: REPORT <-- Phase 4: VERIFY
```

| Phase       | Purpose                                                                                        | Exit Condition                                                                                      |
| ----------- | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| 1. SELECT   | Enumerate installed fleets, probe their queues, derive the wave DAG, build the contention map  | A `RunPlan` with wave-assigned lanes, probed queue depths, a contention map, and a merge-order plan |
| 2. CONFIRM  | One human round authorizing the **schedule and the budget** — never the work inside the fleets | An authorized `RunPlan`, possibly with fleets trimmed and the DAG re-derived                        |
| 3. DISPATCH | Schedule lanes wave by wave under the global governor, batching each wave's member gates       | Every scheduled lane returned, parked, or shed — each recorded with its reason                      |
| 4. VERIFY   | Confirm each lane from its emitted artifacts, with independent spot-checks of its references   | Every lane carries exactly one verdict: verified, parked, rejected, unscheduled, or quiet           |
| 5. REPORT   | Emit one consolidated dashboard, the deduped filings, and the merge-order advice               | Report delivered; nothing merged and no land authorized                                             |

### Phase 1: SELECT — Enumerate Fleets, Probe Queues, Derive the DAG, Build the Contention Map

1. **Determine which members are installed.** A missing member does not abort the run: the DAG **degrades to the members present** and the absence is **recorded** in the run plan and the report, never silently dropped. A degraded DAG the human can see is a schedule; a silently degraded one is a surprise. If no member at all is available, stop and report — there is nothing to conduct.

2. **Probe each member's queue depth through its own gate-free path only** — never by reimplementing its SELECT, and never through a path that presents that member's human gate. A member's selection logic is that member's, including its scoring, its noise floor, and its cross-checks; a conductor that re-derived it would drift from the member on the first change to either.

   The probe contract distinguishes two kinds of path, and they are **not** interchangeable:
   - A **gate-free probe path** (a member's `--report-only`) enumerates and presents its queue and stops without asking the human anything. This is the only path SELECT may use.
   - A **gated path** (a member's `--dry-run`) runs that member's SELECT **and its CONFIRM**. Using it to probe would fire a member's own gate during the conductor's Phase 1 — before the run plan exists, let alone is authorized — and would falsify the promise that CONFIRM is the only guaranteed human touchpoint before the first lane starts.

   **A member with no gate-free probe path is not probed.** Some members deliberately ship none: a member that files nothing has no destructive mode to suppress, so a report-only flag would do nothing for it. Such a member is recorded as **queue depth unknown**, presented that way at CONFIRM alongside every probed depth, and scheduled or not **on the human's call** rather than on a guess. Unknown is a fact worth reporting; a fabricated depth is not.

   A member whose queue comes back empty is **unscheduled, not run**, and is reported as such. A member that errors on its probe degrades exactly like a missing one: recorded, excluded, reported.

3. **Derive the wave assignment from the fixed dependency shape and the fixed evidence-fidelity requirements.** Scheduling is derived, never hand-picked. **Two criteria create a wave boundary**, and either one alone is enough: a **dependency edge** between members, or an **evidence-fidelity exclusivity requirement** — a member whose evidence is silently corrupted by co-scheduled load takes a wave of its own even though no dependency edge explains it (ADR 0125). Both are fixed ahead of the run, so the assignment stays derived rather than chosen. The dependency criterion alone would place `perf-fleet` in wave 2 beside the sweeps, since it consumes nothing the spine produces — which is exactly the co-scheduled benchmark the second criterion exists to prevent:

   | Wave                     | Fleets                                                                                                   | Why this wave                                                                                                                                                                                                                                                                                                                                                                       |
   | ------------------------ | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | 0 — CI trust gate        | `cicd-fleet`                                                                                             | Every downstream fleet's VERIFY treats all-OS CI green as its evidence, so the run reads **how trustworthy that signal is** before anything else rests on it. A trust gate, not a repair — see below.                                                                                                                                                                               |
   | 1 — ideate               | `ideate-fleet`                                                                                           | Ideation feeds intake, so it is its own wave rather than a sequential pair inside one. A dependency edge belongs between waves; a wave holding one would make "wave" mean two different things.                                                                                                                                                                                     |
   | 2 — intake + sweeps      | `issue-fleet`; `test-fleet`, `cleanup-fleet`, `bug-fleet`, `security-fleet`, `craft-fleet`, `docs-fleet` | Intake consumes ideation. The quality sweeps read standing code, so **none of their inputs** comes from the spine and they are genuinely parallel — subject to the global governor, to deconfliction, and to the output-coupling note below. `docs-fleet` joins as an ordinary sweep — it reads standing code, takes no input from the spine, and its evidence is load-insensitive. |
   | 3 — decide               | `adr-fleet`                                                                                              | Consumes intake's routed decisions.                                                                                                                                                                                                                                                                                                                                                 |
   | 4 — build                | `roadmap-fleet`                                                                                          | Consumes the ranked queue plus the decisions above it.                                                                                                                                                                                                                                                                                                                              |
   | 5 — perf (**exclusive**) | `perf-fleet`                                                                                             | Its verdicts are **measurements**, and a measurement taken under co-scheduled load is silently wrong rather than visibly broken. Runs alone — see below.                                                                                                                                                                                                                            |
   | 6 — terminal             | `pr-fleet`                                                                                               | Lands what every other lane produced, so it must run last or it lands a stale subset.                                                                                                                                                                                                                                                                                               |

   **A wave is a barrier, and it holds no dependency edges inside it.** Every member in a wave is independent of every other member in that wave; anything with a real edge between them belongs in different waves. That property is **necessary but not sufficient** to explain the wave list: a wave may also exist because a member's evidence requires exclusivity, and **wave 5 is exactly such a wave — no dependency edge explains it**. Reading "no wave contains a dependency edge" as the whole derivation rule would collapse the exclusive wave back into wave 2. The barrier property is what makes "at most one batched gate round per wave" satisfiable and what makes a wave boundary a meaningful place to check the budget. Wave **indices come from the fixed dependency shape plus the fixed evidence-fidelity exclusivity requirements** — the two admission criteria above — so a wave with no scheduled members is **skipped, not renumbered and not a barrier** — trimming or shedding a fleet empties its wave rather than shifting the ones after it. Excluding a fleet at CONFIRM **re-derives its dependents** rather than leaving them scheduled against something that will not run.

   **Wave 0 is a trust gate, not a repair — and the distinction is load-bearing.** The CI lane's terminal act is a report: it hands back **unmerged remediation PRs** and merges nothing, the conductor merges nothing, and the terminal lander runs at the last wave. So within a single run, waves 1 through N execute against **the same CI signal wave 0 found**. A run cannot repair its own evidence base. What wave 0 actually produces this run is two things: **evidence-quality information** — a read on whether downstream verdicts can be trusted — and **remediation PRs whose payoff lands on the next run**, once a human has merged them. Anything that claims wave 0 heals the signal in-run is claiming something the schedule cannot deliver.

   The trust read itself is available before dispatch, for free: SELECT already probes the CI lane's own queue, and **a red/flaky queue depth _is_ the signal's trust level**. So the trust gate's product is surfaced as a **fork at CONFIRM with a recommended default**, not as a silent precondition. When that probe comes back non-empty, the human is shown: _the CI signal is untrustworthy, so every downstream verdict this run would rest on degraded evidence_ — and offered, in order of recommendation, to **run the CI lane alone this session** and conduct the rest on the next run once its remediation PRs have landed (the default), to **proceed with the full run** with every downstream verdict explicitly recorded as resting on degraded evidence, or to **trim the fleets whose verdicts lean hardest on the CI signal** and run the rest. A degraded run the human chose and the report labels is honest; a degraded run presented as clean is not.

   **The sweeps are input-independent of the spine and output-coupled to it, and only the first half is a scheduling fact.** The wave-2 sweeps read standing code, so nothing they consume comes from intake — which is what makes them safe to run beside it. But several of them **file** issues and roadmap items into exactly the queue intake triages, so whatever they file this run is **intake for the next run**, not for this one. The conductor states this rather than hiding it, and records it in the run's assumptions-made note. It does **not** serialize the sweeps behind intake, and the reason is a tradeoff rather than an oversight: doing so would spend the sweeps' entire parallelism — the single largest source of concurrency the schedule has — to freshen a queue the next run picks up anyway, for filings the human has not yet even seen. "Depends on none of the spine" is true of the sweeps' inputs and false of their outputs, and leaving that unqualified would be the same stale-consumption error the derived order exists to prevent.

   **Wave 5 is exclusive, and an exclusive wave is not a valid deferral target.** `perf-fleet`'s verdicts are **measurements**, and that makes its evidence fail differently from every other member's. A contended **test** fails **loudly** — the flake is visible, a rerun exposes it, and the family already treats "prove the failure is outside your diff, then rerun once" as routine. A contended **benchmark succeeds with a plausible wrong number**: nothing in the artifact distinguishes a clean 40ms from a contended 40ms, so the lane gates a fix on corrupted evidence and reports it as verified. That corruption is **silent rather than exposable**, and no downstream verification recovers from it, because there is nothing to recover — the artifact is well-formed and wrong. This is why wave 5 admits `perf-fleet` and nothing else. Load-sensitive evidence is not new here (`.husky/pre-push` already caps parallel test load for the same reason, and a throughput cap is the right instrument when the corruption announces itself); what is new is corruption that cannot be seen. **The exclusivity has a second consequence: wave 5 is not a place a deferral may land.**

   **A wave is _non-admitting_ when it is exclusive or terminal**, and neither is a matter of how many members it holds. Waves 0, 1, 3 and 4 each hold exactly one named member too, and **every one of them will take a deferred lane** — holding one member is not what makes a wave closed. An **exclusive** wave admits _only_ its named member and **refuses deferrals outright**, because a deferred lane is precisely the co-scheduled load that corrupts the measurement. A **terminal** wave admits nothing scheduled after it. So wave 5 is non-admitting by exclusivity and wave 6 by terminality, while wave 3 is admitting — which is why the worked example below defers `craft-fleet` **into** wave 3 rather than shedding it. The serialization deferral stop below is therefore bound to the **first non-admitting wave** — today wave 5 — and not to the lander's index. Moving the lander from wave 5 to wave 6 nominally opened a wave of headroom; it did not, because the wave it opened refuses deferrals by construction. A lane whose deferral would reach wave 5 is **shed with its reason**, exactly as before the renumber.

4. **Apply the fleet cap structurally.** If more fleets are schedulable than `--max-fleets` allows, shed in the fixed order stated under _Flags_: the CI trust gate and the terminal lander are **never** shed; the independent quality sweeps are shed first, **lowest probed queue depth first**; and a conveyor-spine member is shed only if the human trims it at CONFIRM. A member whose queue depth is unknown is not sheddable by depth — it is carried to CONFIRM as a fork. Every shed fleet is recorded with the reason that shed it, and the reasons are distinguishable: over the cap, empty queue, missing or errored on its probe, or trimmed by the human.

5. **Build the contention map and the derived merge-order plan** over the four collision classes — see _The Contention Map_ below. This happens **before** dispatch, because its whole product is a scheduling constraint: a serialization decided after two lanes are already running is not a serialization.

6. **Detect run-level forks** worth surfacing. Each is carried to CONFIRM **with a recommended default**, so the human confirms a decision rather than makes one from scratch. The recurring ones are: an **untrustworthy CI signal**, read from the CI lane's own queue probe, with its three options above; a member with **no gate-free probe path**, whose queue depth is unknown and whose scheduling is therefore the human's call; a member whose queue is far larger than one pass can absorb; two sweeps whose contention resolution could go either way; and a spine member whose predecessor came back empty.

7. **Build the records.**

   ```
   FleetLane {
     member,        // the fleet this lane runs
     wave,          // derived wave index
     dependsOn,     // the lanes that must finish first
     queueDepth,    // probed via the member's own gate-free path, or "unknown"
     state,         // "scheduled" | "running" | "parked" | "unscheduled" | "shed"
     slots,         // leaf slots allocated from the global pool, passed as --concurrency
     artifacts,     // emitted PRs / filed items / drafted decision records / shortlists
     verdictRefs,   // per-item verdict references the conductor spot-checks
     verdict,       // "verified" | "parked" | "rejected" | "unscheduled" | "quiet"
     parkedForks,   // unforeseen run-level forks this lane parked on
   }
   ```

   ```
   RunPlan {
     waves,         // the wave-ordered DAG
     selection,     // the fleets scheduled, with queue depths
     budget,        // { slots, passesPerFleet: 1, maxFleets, wallClock }
     contention,    // the contention map (see below)
     mergeOrder,    // derived merge-order plan — advice, never executed
     authorization, // the human's single run-plan approval
   }
   ```

### Phase 2: CONFIRM — The Single Up-Front Run-Plan Authorization `[checkpoint:human-verify]`

1. **Present the whole run plan in one surface.** This is the only guaranteed human touchpoint before the first lane starts, and everything in it is a scheduling decision the human can still change cheaply:
   - The **wave DAG**, with each fleet's wave and **the criterion that placed it there** — the dependency edge, or the evidence-fidelity exclusivity requirement where no edge explains the wave.
   - The **fleet selection** with its probed queue depths, and — listed explicitly rather than omitted — the fleets whose **queue depth is unknown** because they expose no gate-free probe path, the **empty-queue fleets that will not be scheduled**, the fleets **shed by the cap** with the structural reason that shed them, and any member that was missing or errored on its probe.
   - The **global budget**: the slot cap with its default of 3 and hard max of 4, the **per-fleet sub-cap of 2**, **one pass per fleet**, the fleet cap, and the wall-clock budget.
   - The **contention map** with its consequences made concrete — which lanes are serialized into different waves, and what merge order the generated-artifact class implies.
   - The **detected forks**, each with a recommended default — including the CI-trust fork whenever the wave-0 probe found the signal red or flaky, and a schedule-or-not call for every member whose queue depth is unknown.

2. **The human approves, trims fleets, or re-tunes the budget — once.** Trimming a fleet **re-derives the DAG**, including its dependents, rather than leaving a consumer scheduled against a producer that will not run. Under `--dry-run` the skill stops at the end of this phase. Under `--report-only` this phase **does not run at all**: the run plan is printed and the skill exits without presenting a gate, which is what makes `--report-only` safe to call from tooling.

3. **Why this is a run-plan authorization and not a batch approval.** At this tier the human is authorizing a **schedule and a budget** — how much machine load the run may create, in what order, with what collisions already resolved. They are **not** authorizing the work itself. Each member's own approvals still belong to that member's gate and arrive later, per wave, in the member's own words. Conflating the two would be exactly the dictator design this tier rejects: it would convert every member's human taste-check into a single machine judgment made before any of the work was even enumerated, at the largest blast radius in the family.

### Phase 3: DISPATCH — Wave-by-Wave Lane Scheduling Under the Global Governor

1. **One worktree-isolated lane per scheduled fleet**, each running the **real** member skill for its stage — never a reimplementation of what that fleet does. This is the family's dogfooding invariant applied one tier up, and it is also what makes VERIFY possible: the artifacts the real member leaves behind are exactly what VERIFY checks for, and a reimplementation would leave different ones.

2. **The governor allocates leaf slots from one global pool** — default 3, hard max 4, with no single fleet ever allocated more than **2** of that pool. The sub-cap is the family's per-fleet **default**, not its ceiling: pinning it to the ceiling would let one lane hold the whole pool at the default setting, which is a single-fleet run wearing a conductor's name. At 2 there are always **at least two lanes genuinely in flight** at the default pool, which is the property that makes the run a run.

   The unit argument is the whole design: the scarce resource is consumed by the **leaf** subagents a member's DISPATCH fans out, not by a member's cheap select, confirm, verify, or report phases. So **a fleet in a cheap phase holds no slot**, which is precisely what lets several lanes be genuinely in flight while the aggregate load stays at single-fleet scale.

3. **The allocation is imposed at dispatch time, through each member's own `--concurrency` flag.** This is the seam, and it is the only one: every member of the family exposes `--concurrency`, and the conductor dispatches each lane with `--concurrency <allocated>` set to that lane's allocation from the global pool. **A member dispatched without it runs at its own default of 2**, chosen against a single-fleet world with no knowledge of the other lanes — which is exactly the cap-everyone-honors-locally-and-nobody-enforces-globally failure, reproduced one tier up by the very actor built to prevent it. Dispatching a lane without an explicit `--concurrency` is therefore a gate violation, not an omission.

   Capping **fleets** instead would be the wrong unit in both directions at once: one fleet deep in its fan-out outweighs three fleets sitting in their select phases, so a fleet-count cap is simultaneously too permissive and too restrictive. And **summing the per-fleet governors** is the failure mode this skill exists to prevent — it is not a cap, it is an addition. **Never raise the cap to "go faster."** Beyond the family's ceiling the compound load produces flaky failures indistinguishable from real ones, and a stormed run is slower once the re-runs are counted.

4. **Serialized pairs from the contention map never share a wave.** If two lanes were serialized because they edit the same region or allocate from the same sequence, co-scheduling them discards the entire product of SELECT's contention analysis.

5. **Each wave's ready fleets present their own CONFIRM gates together, in one batched round.** A member's CONFIRM is presented **verbatim and unmodified** — its own text, its own options, its own framing. The conductor **never pre-answers, never defaults, never skips, and never summarizes a member's gate into a yes/no**. It is a scheduler for these gates, not a proxy holding a delegated vote. If a fleet blocks on its gate, **its lane parks and the other lanes continue** — one unanswered gate stalls one lane, never the run.

6. **Park the unforeseen.** A lane that hits a genuinely-unforeseen run-level fork — a member reporting a queue shape nobody anticipated, a contention resolution that turns out not to hold — **parks that lane and reports it**, carrying the fork verbatim. The rest of the run continues uninterrupted.

7. **The wall-clock budget is observed at wave boundaries.** The run stamps a **start timestamp** when DISPATCH begins, and at **each wave boundary — before scheduling the next wave** — compares elapsed time against the deadline. A wave boundary is the only point where the check is both cheap and actionable: it is where no lane is mid-fan-out, so declining to schedule costs nothing half-written. There is no mid-wave timer and none is claimed; a wave that overruns the deadline finishes, and the next one is simply never scheduled.

8. **The spend envelope is consulted at each lane boundary, exactly like the wall-clock budget.** Where the wall-clock budget bounds _how long_ the run may take, the **global spend envelope** (the companion to the slot pool) bounds _how much it may spend_ — a slot cap is not a spend cap. Before scheduling each lane the conductor runs **`harness fleet budget-check --envelope <units> [--fleet <name> --fleet-envelope <units>] --json`**, which reads observed spend from burn's existing per-fleet/per-lane attribution and returns `within | exhausted | unconfigured` (exit `0` within/unconfigured, `10` exhausted). This is the concrete seam that makes the envelope enforceable rather than prose; it consults the SAME `evaluateSpendEnvelope` primitive (`@harness-engineering/core`, `fleet/spend-budget`) the orchestrator engine's budget governor uses. Absent an envelope the check reports `unconfigured` and the run is unbounded — byte-identical to before. See `docs/reference/fleet-family.md` §"The global spend envelope (fleet-command)".

9. **Budget exhaustion stops scheduling new lanes.** When the wall-clock budget or the spend envelope (`budget-check` → `exhausted`) is spent, in-flight lanes are allowed to finish or park cleanly and are **never killed mid-write** — a lane killed halfway through its terminal act leaves exactly the half-written artifacts VERIFY would then have to interpret. The run reports partial results, with everything shed **named and reasoned**.

10. **Record an assumptions-made note per lane** — the derived wave and the criterion that placed it there (a dependency edge, or an evidence-fidelity exclusivity requirement), including **whether that wave is exclusive**, the budget in force (the slot allocation, the spend envelope consulted, and the `--concurrency` the lane was dispatched with), the contention resolutions applied to that lane, and every default taken on its behalf. A consolidated report is only trustworthy when the reader can see what was assumed on their behalf.

11. **Push-path caveat.** A worktree created under a nested agent-config path breaks the local pre-push documentation gate: it self-excludes and scans zero files. Lanes push via the GitHub API or from a non-nested throwaway worktree. **Never `--no-verify`** — bypassing the gate defeats the verification every lane verdict rests on.

### The Contention Map — Four Collision Classes

The map is built **before dispatch**, over collision **classes** rather than as a hard-coded playbook of known conflicting pairs, and each class is resolved with the **cheapest sufficient mechanism** for it. Building it early is what makes it a scheduling input rather than a post-mortem; describing it as classes is what keeps it correct in a project whose shared surfaces are not this one's.

| Collision class              | Example surface                                                                     | Mechanism                                                                                                                                                  |
| ---------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Generated artifacts**      | the generated skills catalog, the platform command manifests, the roadmap aggregate | **Merge-order plan plus regeneration sequencing**, emitted with the report and handed to the land stage — the conductor plans the order, never executes it |
| **Allocated sequences**      | decision-record numbers, roadmap shard slugs                                        | **Serialize the writers into different waves**; where two same-wave sweeps would allocate from one sequence, one is deferred to the next wave              |
| **Same-region source edits** | two sweeps elevating or cleaning the same module                                    | **Serialize the lanes, not the merges** — two fleets rewriting one region produce a semantic conflict no merge order fixes                                 |
| **Duplicate filings**        | one defect filed independently by several quality sweeps                            | **Cross-fleet dedup at report time** — filings are collated across lanes, near-duplicates grouped into one row citing every lane that raised it            |

**Deferral has a terminal stop.** Both serializing mechanisms push a lane into a later wave, and that push is bounded: **a deferral that would place a lane at or past the first non-admitting wave (today wave 5, the exclusive perf wave) sheds that lane instead, with its reason**. The stop is stated against the first wave that will not admit the lane rather than against the lander's index, because two different walls stand in front of a deferred lane and the nearer one binds: an **exclusive** wave admits _only_ its named member and refuses deferrals, and nothing at all is scheduled after the lane that lands — a lane that runs after the lander emits work the lander cannot see, which is the stale-subset failure that put the lander last in the first place. A deferral chain with no stop would quietly convert a serialization into an unbounded push, and the lane would arrive too late to be either landed or honestly reported as unrun.

The mechanisms are deliberately unequal in strength, because the collisions are. A generated-artifact conflict is **textual**: both lanes are right, both regenerated correctly from their own inputs, and a merge order with a regeneration step resolves it completely. A same-region source conflict is **semantic**: two fleets that each rewrote the same module produce something no ordering can reconcile, because the second rewrite was reasoning about code the first one replaced — so those lanes are serialized outright rather than merge-ordered. Applying the cheap mechanism to the expensive class is the failure mode worth naming: a merge order over a semantic conflict looks like a resolution and is not.

**The map degrades to empty, and that is a success.** If a collision class is eliminated upstream — for instance by removing derived counters from generated prose and moving regeneration to a post-merge job on the main branch — then that row of the map simply comes back **empty**, and the merge-order plan becomes a **no-op rather than an error or a stale playbook**. This is designed in, not tolerated. A coordination mechanism written against today's specific conflict shape would need rewriting the moment the underlying tax was fixed, which means it would quietly reward leaving the tax in place. This one shrinks to nothing without breaking, so improving the project's conflict surface is never in tension with conducting it.

**Duplicate filings are the class no single member can see at all**, which is why dedup is a conductor-tier product rather than a member's oversight. Each quality sweep enumerates its own queue, finds the defect, and files it — correctly, independently, and with no way to know that three sibling sweeps did the same thing an hour earlier. Every filing is individually right and the aggregate is four tracker items for one defect, spending exactly the human attention the family exists to save. Only an actor that can see every lane's filings at once can collate them, so the conductor groups near-duplicates into **one row citing every lane that raised it** — preserving each lane's evidence while presenting one item.

### Phase 4: VERIFY — Confirm Each Lane From Its Emitted Artifacts, Never Self-Report

This is the one place a conductor could plausibly cheat by trusting its children, and simultaneously the one place duplicating their work would double the cost of the entire run. A fleet reporting "ran, verified 4 items, 3 PRs open" is a **claim**, and the family's invariant is that a self-report is never verification. But re-verifying every item the member dispatched duplicates work that member already did to the same standard, against the same artifacts, with the same tooling. Verifying **the lane** — its emissions, its evidence, and its adherence to the run's invariants — is the seam that satisfies the invariant without paying for it twice.

1. **The terminal artifact exists** in the form that member's contract specifies. The emitted PRs, filed items, drafted decision records, or ranked shortlist actually exist and are reachable — checked by the conductor, in the artifact store, not read out of the lane's summary.

2. **The member's VERIFY actually ran.** The lane's report carries a per-item verdict for **every** dispatched item, each with the reference it was drawn from, and the conductor **independently spot-checks those references** rather than reading the verdicts. Checking a sample of references is the cheap, decisive test: a lane that ran the family standard can produce references that resolve, and a lane that did not cannot fabricate ones that do. **A lane reporting outcomes with no per-item verdicts did not run the family standard and is rejected**, however plausible its summary reads.

   **Parse every lane's worker output as the canonical `FleetHandoffRecord`, uniformly.** Each `-fleet` member's workers emit the ONE bounded handoff envelope defined in `@harness-engineering/types` (the canonical handoff record — see `docs/reference/fleet-family.md`), so the conductor validates each dispatched item's record with `validateFleetHandoffRecord` **the same way for every fleet**, rather than special-casing each member's ad hoc report shape. The record's `status` (`done | parked | blocked | failed`) is the item's disposition, its `evidence[]` supplies exactly the verifiable references this check spot-checks, and its `blocker` (required on any non-`done` status) is what surfaces as a parked fork upward. A record that fails validation — an unknown key, a missing required field, or a non-`done` status with no `blocker` — is **rejected, never silently misread**: a lane that cannot produce a well-formed handoff record for its items did not run the family standard. Uniform parsing is the whole point of the shared primitive — the conductor gains a fleet-agnostic seam and no longer grows a special case per member.

3. **The invariants held — and the two are not evidenced alike, so they are not stated alike.**
   - **Nothing was merged** by any lane other than a land the human authorized inside the land member's own gate. This is a **verified check**: a merge leaves a durable trace, so the conductor reads the merge state of every branch and PR the lanes touched and confirms it directly.
   - **The lane stayed within its allocation.** No artifact records a lane's **peak** concurrency — the leaf subagents come and go inside the member's own run and leave nothing behind that counts them — so this is **not** a verified check and is not reported as one. It is a **dispatch-time-enforced property**: the lane was launched with `--concurrency <allocated>`, which is itself checkable, and the conductor confirms that much. Beyond it the property is **recorded as an assumption** in the run's assumptions-made note. Asserting a check with no evidence behind it is precisely the self-report failure this whole phase exists to reject, and a conductor exempting itself from that standard would be the worst place in the family to start.

   A merge outside an authorized land is a gate violation. A lane dispatched without an explicit `--concurrency` is likewise a gate violation — it is the enforcement seam being skipped, which is a stronger failure than the lane merely running hot.

4. **All-OS CI is not applicable at this tier and is recorded as such**, with its reason: the conductor emits no code and opens no PR of its own, so it has no CI subject. Per the family's own rule an inapplicable check is **recorded as not-applicable, never dropped silently** — a skipped check and an inapplicable one must not look alike in a report, because one is a gap and the other is a fact. The per-lane CI evidence stays where it belongs, inside each member's own VERIFY, and is spot-checked there as part of check 2. **Base freshness is inherited from the lanes (spine clause).** The conductor consumes each lane's CI-derived verdicts — and its own CI trust gate consumes them to judge a whole run — so a lane's `verified` is only as trustworthy as the base its green ran against. A lane that downgraded an item to **`degraded`** under the spine's base-freshness clause (`docs/reference/fleet-family.md` § _Base freshness_ — green gathered against a base `main` has since moved past) surfaces here as **degraded**, not verified, carried forward with the conductor's existing degraded-verdict labeling rather than re-graded to verified.

**Verdict vocabulary, one per lane:** `verified`, `parked`, `rejected`, `unscheduled`, `quiet`. A `rejected` lane is **retried at most once** — transient failures are common enough to be worth one retry and rare enough that a second is a diagnosis, not a retry. A lane still rejected after its retry is reported with its reason and **the run continues**: one bad lane never sinks a run, and a run of four verified lanes and one rejected one is a useful result reported honestly.

### Phase 5: REPORT — One Consolidated Dashboard, Never a Merge

The report is the conductor's **entire product**. Every other phase exists to make it trustworthy. The value of running many fleets is destroyed if their outputs arrive as separate reports the human must collate by hand — that collation _is_ the coordination work this tier exists to absorb, and handing it back undone would leave the operator doing the job they invoked the conductor to avoid.

1. **One row per lane:**

   | Lane | Wave | Verdict | Emitted | Slots used | Parked forks |
   | ---- | ---- | ------- | ------- | ---------- | ------------ |

2. **The cross-fleet-deduped filing list** — one row per defect, citing **every** lane that raised it, so the human sees one item carrying several independent confirmations rather than several items describing one problem.

3. **The recommended merge order with its regeneration notes** — which lanes' emissions to land in which order, and what to regenerate between them. This is **advice attached to the report**, computed by the conductor and executed by nobody but the land member under its own gate, or the human.

4. **The run's budget accounting** — the slots allocated per lane and the `--concurrency` each lane was dispatched with, passes used, lanes scheduled against the fleet cap, and wall-clock consumed against the budget as measured from the run's start timestamp. Peak concurrency is reported as what it is: an allocation the dispatch seam imposed, not a measurement any artifact carries.

5. **Everything the budget shed, named with its reason** — unscheduled empty-queue fleets, fleets shed by the structural cap policy with the depth that ordered the shed, lanes shed because a serialization deferral would have reached the first non-admitting wave, waves never started because the wall-clock ran out, fleets the human trimmed, and members missing or erroring on their probe. A run that quietly did less than it appeared to is worse than one that did less and said so.

6. **An assumptions-made note for the run** — the derived DAG and why, the budget in force, the contention resolutions applied, and the defaults taken. **When the run scheduled a member into an exclusive wave, the note states that wave as exclusive and names that member as the only lane scheduled there** — today, wave 5 and `perf-fleet`. This is required of the report itself, not inferable from the lane rows: a row carries a wave index, and a wave index holding one lane is indistinguishable from waves 0, 1, 3 and 4, which hold one lane each and would each have taken a second. The statement is a claim about the **plan**, not a measurement of occupancy — no artifact records which lanes were in fan-out during a wave, exactly as none records a lane's peak concurrency — so it is reported in the same dispatch-time-enforced-assumption terms the conductor already uses for allocation. A run that scheduled nothing into an exclusive wave states nothing about one, because an emptied wave is skipped and is not a barrier.

Two terminal prohibitions close the phase. **The conductor never merges and never authorizes a land on the human's behalf** — landing is the land member's act under its own human gate, or the human's directly, and a conductor that merges has removed the one review the entire model is built around. And a run whose fleets all report empty queues is reported as **quiet**: a valid, informative outcome, never a failure to explain away and never a reason to go back and loosen something so the run has something to show.

## Harness Integration

- **`harness skill run fleet-command`** — Execute the full five-phase conductor **run**. A run is a session, not a pipeline: pipelines are the convergence primitive a fleet composes, and naming this one would collapse the tier distinction the skill is built on.
- **The `-fleet` members** — The dispatched unit and the entire queue. Each lane runs the **real** member skill for its stage; the conductor reimplements none of them, re-derives none of their selection, and re-runs none of their verification.
- **Each member's `--concurrency` flag** — **The enforcement seam for the global slot budget.** Every member of the family exposes it, and the conductor imposes its allocation by dispatching each lane with `--concurrency <allocated>`. This is the only mechanism the global slot cap has; a member dispatched without it silently reverts to its own single-fleet default of 2, which reconstitutes the additive-cap failure the conductor exists to prevent.
- **`harness fleet budget-check`** — **The enforcement seam for the global spend budget** (the companion to the slot seam above). Consulted at each lane boundary in DISPATCH: reads observed spend from burn's per-fleet/per-lane attribution, compares it to the configured envelope via the shared `evaluateSpendEnvelope` primitive (`@harness-engineering/core`, `fleet/spend-budget`) the orchestrator engine's budget governor also uses, and returns `within | exhausted | unconfigured`. A slot cap bounds concurrency, not spend; this bounds spend and stops scheduling new lanes clean at a lane boundary when the envelope is exhausted. Unconfigured ⇒ no-op.
- **Each member's own gate-free report-only path** — How SELECT probes queue depth without reimplementing a member's selection **and without firing that member's human gate**. A member's dry-run path runs its CONFIRM and is therefore never used for probing; a member offering no gate-free path is recorded as queue-depth-unknown and scheduled on the human's call, never guessed at.
- **The subagent worktree-isolation primitive** — Lane isolation, one worktree per scheduled fleet, carrying the family's nested-path push caveat unchanged.
- **`gh`** — Artifact spot-checks and CI reads during VERIFY. The conductor reads evidence with it and **never merges** with it.
- **`manage_roadmap`** — Reads filing state during cross-fleet dedup, so one defect raised by several sweeps arrives as one row citing every lane that raised it.
- **`harness skill validate fleet-command`** — The authoring-time gate for this skill's own structure and schema.
- **`docs/reference/fleet-family.md`** — The shared `-fleet` spine this skill builds on (the five-phase skeleton, the per-fleet concurrency governor the global one supersedes, the artifact and all-OS-CI verification discipline, the worktree fan-out and its push caveat, the front-load / park-unforeseen interaction model, and the never-silent-merge invariant), and the page that describes the conductor tier above it.

## Success Criteria

- Given a set of installed members and their queues, the run produces **one consolidated report** covering every scheduled lane, each with a verdict, its emitted artifacts, and its budget consumption.
- **Every dispatched lane carries an explicit `--concurrency <allocated>`** at or below the per-fleet sub-cap of **2**, allocated from a global pool of 3 (hard max 4). That flag is the enforcement seam and no lane is dispatched without it; the sum of the per-fleet governors is never the operative limit, and a lane left to a member's own default of 2 is a gate violation rather than a harmless omission.
- **The run order is derived, not chosen ad hoc**, and it is derived from **two criteria, either one alone sufficient**: a **dependency edge** between members, or an **evidence-fidelity exclusivity requirement**. So the CI trust gate precedes every fleet whose verification depends on a trustworthy CI signal, ideation precedes intake in its own wave, the conveyor spine runs in dependency order, the land stage runs last, the independent quality sweeps run in parallel alongside — subject to the governor and to deconfliction — and a member whose evidence is silently corrupted by co-scheduled load holds a wave of its own **even though no dependency edge explains it**. **No wave contains a dependency edge**, which is what keeps at most one batched gate round per wave satisfiable; it is **necessary but not sufficient** as a derivation rule, and read as the whole rule it would collapse the exclusive wave back into the sweeps.
- **The exclusive wave admits only its named member, and the report says so.** The wave the evidence-fidelity criterion creates — today wave 5, `perf-fleet` — is scheduled with no other lane beside it and is **not a valid deferral target**; a serialization deferral that would reach it sheds its lane with a reason instead. When that member is scheduled, the run's assumptions-made note **states the wave as exclusive and names it as the only lane scheduled there**; when it is shed or unscheduled, the wave is **skipped rather than renumbered** and the terminal lander keeps its index. Exclusivity is a **dispatch-time-enforced property recorded as an assumption**, not a verified check — no artifact records which lanes were in fan-out during a wave.
- **Wave 0 is reported as a trust gate, never as a repair.** An untrustworthy CI signal is surfaced at CONFIRM as a fork with a recommended default; the CI lane's remediation PRs are reported as **unmerged**, so the restored signal is stated as paying off on the next run rather than this one, and any downstream verdict taken under a red signal is labelled degraded.
- **A fleet with an empty queue is reported as unscheduled, not run**; a fleet with no gate-free probe path is reported as **queue depth unknown** and scheduled only on the human's call; and a fleet the human excludes at CONFIRM drops out with its dependents re-derived.
- **A member's own gate is never fired during SELECT.** Probing uses gate-free paths only, so CONFIRM remains the only guaranteed human touchpoint before the first lane starts.
- **The fleet cap sheds structurally**: the CI trust gate and the terminal lander are never shed, the independent sweeps are shed first at lowest queue depth first, and a spine member drops only when the human trims it. The sweep category is defined **by input, not by wave**, so `perf-fleet` is shed by probed depth like any other sweep despite holding an exclusive wave. Every schedulable member falls into exactly one of the three categories, and every shed lane is named with the rule that shed it and — for a depth-ordered shed — the probed depth that ordered it.
- **Every member's own human CONFIRM gate is presented verbatim and answered only by the human.** The conductor never pre-answers, defaults, skips, or summarizes a member's gate into a yes/no. A fleet blocked on its gate parks its lane while the other lanes continue.
- **The human sees one run-plan authorization plus at most one batched gate round per wave** — never a member's gate arriving unscheduled and alone.
- **The contention map covers all four collision classes** and resolves each with its stated mechanism: generated artifacts get a merge-order plan with regeneration sequencing, allocated-sequence writers are serialized into different waves, same-region source-edit lanes are serialized rather than merge-ordered, and duplicate filings are deduped across fleets into one row citing every lane that raised it.
- **Deconfliction degrades to a no-op without breaking.** An empty contention map produces an empty merge-order plan — not an error, and not a stale playbook applied to a conflict that no longer exists. A serialization deferral that would reach the first non-admitting wave (today wave 5, the exclusive perf wave) sheds its lane with a reason rather than scheduling it into a wave that will not admit it.
- **The run is bounded**: one pass per fleet, a fleet cap, and a wall-clock budget compared against a run start timestamp **at each wave boundary before the next wave is scheduled**. Exhausting any of them stops scheduling and reports partial results with **everything shed named and reasoned**, while in-flight lanes finish or park cleanly and are never killed mid-write.
- **No lane verdict rests on a self-report.** Every `verified` lane is backed by an independently-confirmed terminal artifact, per-item verdicts whose references the conductor spot-checked itself, and a directly-checked nothing-merged record. Staying within allocation is reported as a **dispatch-time-enforced property recorded as an assumption**, not as a verified check, because no artifact records a lane's peak concurrency.
- **The merge-order plan contains only lanes that emit mergeable artifacts** — a lane that files nothing, emits no PR, or is the lander itself never appears in it.
- **The sweeps' output-coupling to intake is stated, not hidden.** Filings raised by the wave-2 sweeps are recorded in the assumptions-made note as intake for the **next** run, together with the reason the conductor does not serialize them behind intake.
- **All-OS CI is recorded as not-applicable at this tier**, explicitly and with its reason, never silently omitted — the conductor emits no code and opens no PR of its own, and the per-lane CI evidence stays inside each member's VERIFY where it is spot-checked.
- The conductor **never merges**, and never authorizes a land on the human's behalf; its merge-order plan is advice attached to the report.
- The conductor **never schedules a convergence pipeline directly** — pipelines are the primitive its fleets run.
- **A run whose fleets all report empty queues is reported as quiet** — a valid outcome, never a reason to widen a queue or lower a noise floor so that a lane produces something.
- It **degrades gracefully**: a missing member, a parked lane, or a single rejected lane is reported while the run continues, and a rejected lane is retried at most once.
- **Every report carries an assumptions-made note** — the derived DAG and why, the budget in force, the contention resolutions applied, and the defaults taken.

## Gates

- **Never dispatch a lane outside the global governor.** The sum of the per-fleet governors is never the operative limit — that is an addition, not a cap.
- **Never dispatch a lane without an explicit `--concurrency <allocated>`.** That flag is the only seam the global cap has; a lane launched without it runs at the member's own single-fleet default and the pool becomes an aspiration.
- **Never raise the slot cap above the hard max to go faster.** Beyond the family's ceiling the compound load produces flaky failures indistinguishable from real ones, and a stormed run is slower once the re-runs are counted.
- **Never allocate one fleet more than 2 of the pool.** The sub-cap is the family's per-fleet default, not its ceiling; a single lane holding the whole global budget is a single-fleet run wearing a conductor's name, and at 2 there are always at least two lanes genuinely in flight.
- **Never claim a verified within-allocation check.** No artifact records peak concurrency. Report it as a dispatch-time-enforced property and an assumption; asserting a check with no evidence is the self-report failure one tier up.
- **Never present wave 0 as having healed the CI signal.** The CI lane hands back unmerged remediation PRs; a run cannot repair its own evidence base. Surface the trust fork at CONFIRM and label downstream verdicts taken under a red signal as degraded.
- **Never fire a member's own gate during SELECT.** Probe through gate-free paths only. A member with no gate-free path is recorded as queue-depth-unknown and carried to CONFIRM, never probed through its gated path.
- **Never place a dependency edge inside a wave.** A wave is the dependency barrier; an edge inside one makes "wave" mean two things and makes one batched gate round per wave unsatisfiable.
- **Never shed the CI trust gate or the terminal lander to fit the fleet cap.** The shed is structural: independent sweeps first at lowest queue depth first, and a spine member only when the human trims it.
- **Never defer a lane at or past the first non-admitting wave (today wave 5, the exclusive perf wave).** Shed it with its reason instead — an exclusive wave admits _only_ its named member and refuses deferrals, and a lane scheduled after the lander emits work the lander cannot see.
- **Never run a fleet before the fleets it depends on have finished.** A consumer scheduled early consumes stale output, and the result is worse than not running it — it looks complete.
- **Never schedule a fleet with an empty queue.** Report it as unscheduled; an empty lane costs machine time to produce nothing.
- **Never answer, default, skip, or summarize a member's CONFIRM.** Presenting it verbatim in a batched round is scheduling; answering it is the collapse this tier rejects.
- **Never merge, and never authorize a land on the human's behalf.** The merge-order plan is advice attached to the report, and it stays advice.
- **Never mark a lane verified on its self-report.** Terminal artifact, per-item verdicts with independently spot-checked references, and a directly-checked nothing-merged record — or it is not verified.
- **Never drop the all-OS CI check silently at this tier.** Record it as not-applicable **with its reason**; a skipped check and an inapplicable one must not look alike.
- **Never co-schedule a serialized pair.** Same-region editors are serialized as lanes, not merge-ordered — no ordering reconciles a semantic conflict.
- **Never kill an in-flight lane on budget exhaustion.** Stop scheduling and let in-flight lanes finish or park cleanly; a lane killed mid-write leaves artifacts nothing can interpret.
- **Never schedule a convergence pipeline directly.** Pipelines are the primitive a fleet runs, not a queue to fan out over.
- **Never manufacture work for a quiet run.** A quiet run is a valid result, and this is the one actor able to pressure every member into inventing work at once.
- **Never `--no-verify`.** A lane whose push gate fails pushes via the GitHub API or a non-nested throwaway worktree instead.

## Escalation

- **A member is missing, or errors on its queue probe:** degrade the DAG to the members present, record the absence in the run plan and the report, and continue. If **no** member is available, stop and report — there is nothing to conduct.
- **A member exposes no gate-free probe path:** record its queue depth as unknown, carry it to CONFIRM as a fork with a recommended default, and schedule it only if the human says so. Do not probe it through its gated path to get a number.
- **The CI trust probe comes back red or flaky:** do not treat wave 0 as a repair that fixes it. Surface the fork at CONFIRM with its three options, take the human's answer, and label every downstream verdict in the report according to that answer.
- **A member blocks on its own gate:** park that lane, continue the others, and report the parked gate **verbatim** so the human answers the member's question rather than the conductor's paraphrase of it.
- **A lane was dispatched without its explicit `--concurrency`:** stop the lane and report it as a gate violation. The enforcement seam was skipped, so the run's budget was never actually in force for it, and no after-the-fact reading can establish what it did.
- **A serialization deferral would push a lane at or past the first non-admitting wave (today wave 5, the exclusive perf wave):** shed the lane with its reason. Do not park it in the exclusive wave, do not schedule it after the lander, and do not drop the serialization to keep it.
- **A lane's report carries no per-item verdicts:** reject it. The family standard did not run, and a summary that reads as though it did is precisely what the check exists to catch.
- **A spot-checked reference does not resolve:** reject and retry once; if it still does not resolve, report the lane as unverifiable rather than passing it.
- **The wall-clock or the fleet cap is exhausted:** stop scheduling new lanes, name everything shed with its reason, and report partial results. Do not raise the budget mid-run to finish the list.
- **The contention map comes back empty:** proceed. The merge-order plan is a no-op, which is a success — the conflict class was eliminated upstream, and nothing about the run needs to change.
- **A lane merged something outside an authorized land:** stop the run, report it as a gate violation, and schedule nothing further. This is the one failure that invalidates the authorization the run started under, so it is a stop rather than a rejected lane.

## Rationalizations to Reject

| Rationalization                                                                            | Reality                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Every fleet honors its own cap, so running six of them at once is fine"                   | The aggregate is the storm. Six well-behaved members at their own caps is six times the load nobody authorized, and a cap that every participant honors locally and nobody enforces globally is not a cap.                                                                                                                                                                                                                                    |
| "The sweeps are independent, so I will run them all at once to save wall-clock"            | Independence of **queues** is not independence of **load** or of **shared surfaces**. The governor still applies because they share a machine, and the contention map still applies because they share a tree.                                                                                                                                                                                                                                |
| "The spine order is probably fine — intake had nothing new anyway"                         | "Probably fine" is a derivation, not an observation. Run order is derived from the dependency shape and the evidence-fidelity requirements, and a consumer scheduled early consumes stale output while looking exactly like one that did not.                                                                                                                                                                                                 |
| "That member's gate is obviously a yes; I will approve it and keep the run moving"         | Answering a member's gate converts a human taste-check into a machine judgment at the tier with the largest blast radius in the family. Obviousness is what the human is there to confirm, not what replaces it.                                                                                                                                                                                                                              |
| "Presenting several gates in a round is bad ergonomics, so I will summarize them into one" | Batching is scheduling; summarizing is answering. The gate text is presented verbatim, in the member's own words, because a summary is already a judgment about what mattered in it.                                                                                                                                                                                                                                                          |
| "The lane reported four verified items and CI green, so the lane is verified"              | A self-report is never verification. Check that the terminal artifact exists and spot-check the verdict references yourself — a lane that ran the standard can produce references that resolve.                                                                                                                                                                                                                                               |
| "Re-verifying every item the members produced is the more rigorous choice"                 | It duplicates work already done to the family standard and roughly doubles the run's cost for no new evidence. Rigor here is verifying the lane from artifacts, not repeating the members' work.                                                                                                                                                                                                                                              |
| "Everything is green and the merge order is right there — I will just land it"             | The merge decision is a human act held by the land member's gate. A conductor that merges has removed the one review the entire model is built around, and it holds the merge order precisely because it cannot use it.                                                                                                                                                                                                                       |
| "This run produced nothing, so widen a queue or lower a floor so it was not wasted"        | A quiet run is a valid result — it says the backlog is clear. This is the one actor positioned to make every member manufacture work at once, which is exactly why it is forbidden to make any of them.                                                                                                                                                                                                                                       |
| "The token budget is the real constraint, so the governor should meter tokens"             | Per-subagent token spend _is_ observable after the fact — each dispatched agent writes its own transcript, and the burn scanner attributes spend to it. What is not available is a pre-flight reservation: attribution is retrospective and machine-local, so it cannot refuse a dispatch before it happens. The budget governs slots, passes, fleets, and wall-clock because those are the levers that bind _before_ the spend, and says so. |
| "One lane was rejected, so the run failed and should be re-run from the top"               | A rejected lane is reported and the run continues. Re-running the whole run to clear one lane spends the global budget again on work that already succeeded.                                                                                                                                                                                                                                                                                  |
| "This maintenance pipeline is basically a fleet, so the conductor may as well schedule it" | A pipeline converges one target; a fleet fans out across many. Conducting pipelines directly collapses the tier distinction the family is built on, and the conductor's queue is orchestrators.                                                                                                                                                                                                                                               |

## Red Flags

| Flag                                                                            | Corrective Action                                                                                                                                                                 |
| ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "The lanes are queueing on slots — I will raise the cap above the hard max"     | STOP. The cap is the machine-storm limit, not a throughput dial. Let the lanes queue; a stormed run is slower once the re-runs are counted.                                       |
| "This member's gate has an obvious answer and the wave is waiting on it"        | STOP. Present it verbatim and park the lane if it is unanswered. The other lanes continue — one unanswered gate stalls one lane, never the run.                                   |
| "The lane's report says verified and reads thoroughly, so I will take it"       | STOP. Check the terminal artifact and spot-check the verdict references yourself. A thorough-reading summary with no per-item verdicts is exactly the failure this check catches. |
| "Every lane is green and the merge order is computed — I will land the batch"   | STOP. The merge-order plan is advice attached to the report. Landing belongs to the land member under its own human gate, or to the human directly.                               |
| "The pre-push gate is failing in this lane's worktree — I will `--no-verify`"   | STOP. Never bypass. Push via the GitHub API or a non-nested throwaway worktree; that gate is part of the verification every lane verdict rests on.                                |
| "Two sweeps want the same module and serializing costs a wave — merge-order it" | STOP. That is a semantic conflict, not a textual one. No merge order reconciles two rewrites of the same region; serialize the lanes.                                             |

## Examples

### Example: A conveyor-and-maintenance run under a red CI signal

```
$ harness skill run fleet-command --slots 3 --max-fleets 8

Phase 1: SELECT
  Installed members: 10 of 13 (cleanup-fleet, perf-fleet and docs-fleet not
                    installed — recorded, DAG degraded)
  Queue probes (gate-free --report-only paths ONLY):
    cicd-fleet      2 red workflows        issue-fleet     31 open items
    test-fleet      14 coverage gaps       security-fleet  8 gated findings
    craft-fleet     22 findings            bug-fleet       6 risk areas
    adr-fleet       3 pending decisions    pr-fleet        5 open PRs
    roadmap-fleet   0  -> UNSCHEDULED (quiet queue)
    ideate-fleet    QUEUE DEPTH UNKNOWN — no gate-free path; its --dry-run runs
                    SELECT *and CONFIRM*, and firing a member's gate during SELECT
                    is forbidden -> carried to CONFIRM as a fork
  Derived waves (indices come from the fixed dependency shape plus the
                 fixed evidence-fidelity exclusivity requirements):
    0  cicd-fleet (CI trust gate)          1  ideate-fleet
    2  issue-fleet (intake) | test-fleet, bug-fleet, security-fleet,
       craft-fleet (independent sweeps)
    3  adr-fleet     4  (empty — roadmap-fleet unscheduled)
    5  (empty — perf-fleet not installed)     6  pr-fleet
  Fleet cap 8 -> 9 schedulable -> 1 shed, structurally:
    trust gate and lander never shed; spine untouched; sweeps shed first at
    lowest depth first -> bug-fleet (6 risk areas) SHED
  Contention map:
    generated artifacts   security-fleet + craft-fleet (both file items that
                          regenerate the roadmap aggregate)
                          -> merge-order plan + regeneration sequencing
    allocated sequences   adr-fleet (decision-record numbers) — sole writer,
                          already wave-separated
    same-region edits     security-fleet + craft-fleet both target the parser
                          module -> SERIALIZED (craft-fleet deferred wave 2 -> 3;
                          wave 3 is before the first non-admitting wave (5), so
                          it is a deferral, not a shed)
    duplicate filings     security-fleet + craft-fleet -> dedup at report
  Forks detected: 2

Phase 2: CONFIRM  [checkpoint:human-verify]
  Run plan presented in one surface: the wave DAG, the selection with its probed
  depths, the unscheduled/unknown/shed/missing members, the budget (slots 3 of a
  hard max 4, per-fleet sub-cap 2, one pass per fleet, fleet cap 8, wall-clock 8h),
  the contention map with its serialization and merge order, and 2 forks.
  Fork 1 — CI TRUST: the CI lane's queue probe found 2 red workflows, so every
    downstream verdict would rest on an untrustworthy signal. Options, in order of
    recommendation: (a) run cicd-fleet alone this session and conduct the rest
    next run, once its remediation PRs have landed [RECOMMENDED]; (b) proceed
    with the full run and label every downstream verdict degraded; (c) trim the
    fleets whose verdicts lean hardest on CI. Human chooses (b).
  Fork 2 — UNKNOWN QUEUE: schedule ideate-fleet without a probed depth?
    Recommended default: schedule it. Human: schedule.
  Human trims adr-fleet (3 decisions deferred to a dedicated decide session).
    -> DAG re-derived: wave 3's decide slot empties; no dependents remain
       (roadmap-fleet was already unscheduled); the allocated-sequence row of the
       contention map goes EMPTY (its only writer is gone); wave indices unchanged,
       pr-fleet stays terminal at wave 6.
  Authorization recorded. 7 lanes scheduled.

Phase 3: DISPATCH (global pool = 3 leaf slots, per-fleet sub-cap 2)
  wave 0  cicd-fleet     lane started; batched gate round (wave 0) presents its own
                         CONFIRM verbatim; answered. Dispatched --concurrency 2 -> 2 slots
                         -> 2 remediation PRs opened, BOTH UNMERGED. The CI signal
                            is NOT restored this run; these land on the next one.
  wave 1  ideate-fleet   lane started (SELECT holds no slot)
                         Batched gate round (wave 1): ideate-fleet's own CONFIRM
                         presented verbatim; UNANSWERED -> LANE PARKED before
                         fan-out -> 0 slots. Run continues.
  wave 2  issue-fleet, test-fleet, security-fleet lanes started (no slots held)
          Batched gate round (wave 2): all three members' own CONFIRM gates
          presented together, verbatim and unmodified. Human answers all three.
          issue-fleet    admitted --concurrency 2 -> 2 slots
          test-fleet     admitted --concurrency 1 -> 1 slot (pool full at 3)
          security-fleet HELD; admitted --concurrency 2 when issue-fleet entered
                         its cheap verify phase and released its 2 slots
          test-fleet     -> PARKED on an unforeseen fork: a coverage gap whose
                            fix needs a design call. Others continue.
  wave 3  craft-fleet    deferred here by the same-region serialization
                         Batched gate round (wave 3): craft-fleet's gate presented
                         verbatim; answered. Dispatched --concurrency 2 -> 2 slots
  wave 4  (empty — roadmap-fleet unscheduled; an empty wave is skipped, not a barrier)
  wave 5  (empty — perf-fleet not installed; an empty wave is skipped, not a barrier)
  wave 6  pr-fleet       batched gate round (wave 6); answered.
                         Dispatched --concurrency 1 -> 1 slot
                         -> 3 PRs reviewed
  Wall-clock compared against the run start timestamp at each wave boundary
  before scheduling the next wave: 5h20m of 8h at the wave-6 boundary.

Phase 4: VERIFY (from artifacts — no lane's self-report accepted)
  cicd-fleet     2 remediation PRs exist and are OPEN/unmerged; per-run verdicts
                 present with refs; 2 refs spot-checked and resolved -> verified
  issue-fleet    reports "31 items triaged" with NO per-item verdicts
                 -> REJECTED (family standard did not run); retried once, same
                 -> reported as rejected; run continues
  security-fleet 3 fix PRs + 4 filed evidence packets present; per-finding verdicts
                 with refs; 3 refs spot-checked -> verified
  craft-fleet    4 elevation PRs + 6 filed roadmap items present; per-target
                 verdicts with refs; 3 refs spot-checked -> verified
  pr-fleet       review verdicts present with PR refs; 2 spot-checked; nothing
                 merged outside the human-authorized land inside pr-fleet's own
                 gate -> verified
  ideate-fleet   parked (gate unanswered)   test-fleet parked (unforeseen fork)
  Nothing merged: CHECKED directly against every branch and PR the lanes touched.
  Within allocation: NOT a check — no artifact records peak concurrency. Recorded
                 as a dispatch-time-enforced property (every lane launched with an
                 explicit --concurrency of 2 or 1) and carried as an assumption.
  All-OS CI: NOT APPLICABLE at this tier — the conductor emits no code and opens
                 no PR of its own. Recorded, not dropped. Per-lane CI evidence
                 stays inside each member's VERIFY and was spot-checked there —
                 and is labelled DEGRADED for this run, per fork 1.

Phase 5: REPORT
  | Lane           | Wave | Verdict     | Emitted                          | Slots | Parked forks |
  | -------------- | ---- | ----------- | -------------------------------- | ----- | ------------ |
  | cicd-fleet     | 0    | verified    | 2 unmerged remediation PRs       | 2     | —            |
  | ideate-fleet   | 1    | parked      | —                                | 0     | gate         |
  | issue-fleet    | 2    | rejected    | (unverifiable)                   | 2     | —            |
  | test-fleet     | 2    | parked      | —                                | 1     | 1 fork       |
  | security-fleet | 2    | verified    | 3 fix PRs + 4 evidence packets   | 2     | —            |
  | craft-fleet    | 3    | verified    | 4 elevation PRs + 6 filed items  | 2     | —            |
  | pr-fleet       | 6    | verified    | 3 reviewed PRs                   | 1     | —            |
  | roadmap-fleet  | —    | unscheduled | —                                | 0     | —            |
  7 lanes scheduled: 4 verified, 1 rejected, 2 parked. 1 unscheduled.
  Deduped filings: 9 rows from 10 raw filings — one defect raised independently
    by security-fleet and craft-fleet collapsed into one row citing both.
  Merge order (advice, not executed): cicd-fleet -> security-fleet -> craft-fleet,
    regenerating the roadmap aggregate between the last two. Only lanes that emit
    mergeable PRs appear: ideate-fleet files nothing, issue-fleet was rejected and
    emits no PR, test-fleet parked, and pr-fleet is the lander rather than an emitter.
  Budget: 3/3 slots at peak allocation, per-lane max 2/3, 1 pass per fleet,
    7 lanes against a cap of 8, 5h20m of 8h.
  Shed with reasons:
    bug-fleet      over the fleet cap — lowest-depth independent sweep (6 areas);
                   the trust gate and the lander are never shed
    roadmap-fleet  empty queue (0 shards) -> unscheduled, not run
    adr-fleet      trimmed by the human at CONFIRM
    cleanup-fleet  not installed — DAG degraded to the members present
    perf-fleet     not installed — DAG degraded to the members present; wave 5
                   is empty and skipped, not renumbered
    docs-fleet     not installed — DAG degraded to the members present
  Assumptions made:
    - DAG derived from the fixed dependency shape plus the evidence-fidelity
      exclusivity requirements; after the adr-fleet trim wave 3
      holds only the deferred craft-fleet lane, and waves 4 and 5 are left empty and skipped
      rather than renumbered.
    - craft-fleet deferred wave 2 -> 3 by the same-region serialization with
      security-fleet; the deferral stays clear of the first non-admitting wave (5).
    - CI trust fork answered "proceed": every downstream verdict this run rests on
      a DEGRADED CI signal, and cicd-fleet's 2 remediation PRs are unmerged, so the
      restored signal pays off on the NEXT run, not this one.
    - ideate-fleet scheduled on an unknown queue depth, per the fork default.
    - security-fleet's and craft-fleet's 10 filings are intake for the NEXT run:
      issue-fleet triaged this run's standing backlog and could not see them. The
      sweeps were not serialized behind intake because doing so would spend their
      whole parallelism to freshen a queue the next run picks up anyway.
    - Every lane dispatched with an explicit --concurrency at or below the sub-cap
      of 2; peak concurrency is an allocation, not a measurement.
  Nothing merged. No land authorized.
```

### Example: The contention map comes back empty

A run schedules four quality sweeps in one wave. The project has already removed derived counters from its generated prose and moved regeneration to a post-merge job on the main branch, so the generated-artifact class has nothing in it; the sweeps target disjoint modules, so the same-region class is empty too; and neither of the remaining classes has a writer this run.

The map is therefore empty, the merge-order plan is a **no-op**, and no lane is serialized. This is reported as a **success, not a defect** — the coordination the conductor would have performed was made unnecessary upstream, and the run simply schedules all four sweeps in parallel under the same global governor. Nothing about the run changes shape and nothing errors. That is the intended behavior: a deconfliction mechanism built against one project's specific conflicts would have needed rewriting the moment those conflicts were fixed, which would quietly reward leaving them in place.

## Test Scenarios

### Scenario 1: Gate — the per-fleet caps are summed instead of pooled

Two lanes are ready in the same wave, and each is about to be dispatched with no `--concurrency` at all, on the grounds that "each fleet's own cap already allows 2." Expected: the **global governor** Gate refuses the bare dispatch — a lane launched without an explicit `--concurrency` reverts to the member's single-fleet default and the pool becomes an aspiration. Both lanes are dispatched with `--concurrency <allocated>`, at most 2 each and at most the pool (default 3, hard max 4) across both combined; the second lane's fan-out is held until a slot frees and the cap is never raised to clear the queue. The first lane's cheap phases release its slots, at which point the second is admitted. This scenario guards against "every fleet honors its own cap, so running several at once is fine" — the failure is not any member misbehaving, it is the addition, and the seam that prevents it is a flag that has to actually be passed.

### Scenario 2: Gate — a member's CONFIRM is summarized into the run-plan authorization

At CONFIRM, the run plan is presented and the conductor additionally offers to carry the members' upcoming gates as a single "approve all fleets" line, on the grounds that the human is already here. Expected: refused by the **never answer, default, skip, or summarize a member's CONFIRM** Gate. The run-plan authorization covers **the schedule and the budget only**; each member's gate is presented verbatim in its wave's batched round, in the member's own words, and answered only by the human. A member whose gate goes unanswered **parks its lane while the other lanes continue**. This guards against "presenting several gates is bad ergonomics, so I will summarize them" — batching is scheduling, summarizing is already a judgment about what mattered.

### Scenario 3: Gate — a lane is marked verified from its own report

A lane's report reads "ran, 4 items verified, 3 PRs open, CI green" and carries no per-item verdict references. Expected: the **never mark a lane verified on its self-report** Gate rejects it — a lane that ran the family standard carries a per-item verdict for every dispatched item, each with the reference it was drawn from, and the conductor spot-checks a sample of those references itself. The lane is **retried once**; still lacking verdicts, it is reported as rejected with its reason and **the run continues** rather than being re-run from the top. This guards against "the lane reported verified and CI green, so it is verified," and note that the report reading thoroughly is what makes it dangerous rather than what excuses it.

### Scenario 4: Gate — landing the batch because the merge order is already computed

Every scheduled lane has come back `verified`, the contention map produced a merge order with its regeneration steps, and nothing in it is ambiguous. The conductor is one command away from landing the whole batch itself. Expected: refused by the **never merge, and never authorize a land on the human's behalf** Gate. The merge-order plan is **advice attached to the report**; landing is the land member's act under its own human gate, or the human's directly. A conductor that merges has removed the one review the entire model is built around — and it holds the merge order precisely because it is the actor forbidden to use it. Handing the plan back unlanded is the success condition, not a shortfall.

### Scenario 5: Gate — a consumer is scheduled beside its producer to save a wave

Intake and the decide stage are both ready, the intake queue looks quiet, and co-scheduling them in one wave would collapse two waves into one. Expected: refused by the **never run a fleet before the fleets it depends on have finished** Gate, reinforced by **never place a dependency edge inside a wave**. Run order is **derived from the fixed dependency shape and the fixed evidence-fidelity requirements, not from how the queue looks today**: the decide lane would consume intake's stale routed output while producing a result indistinguishable from a correct one, and a wave holding a real edge inside it also makes "at most one batched gate round per wave" unsatisfiable. The waves stay separate even when the saving looks free. This guards against "the spine order is probably fine — intake had nothing new anyway": "probably fine" is a derivation, not an observation.

### Scenario 6: Park-unforeseen — a contention resolution that turns out not to hold

Mid-run, a lane discovers that the serialization SELECT computed for it was built on a surface the other lane has since restructured, so the resolution no longer describes the collision. Expected: that **lane parks and reports the fork verbatim**, carrying the conductor's own framing of what changed; the other lanes continue uninterrupted; and the parked fork appears in the report for the human. The conductor does **not** re-derive the contention map mid-flight and quietly re-serialize around it — a serialization decided after two lanes are already running is not a serialization, and silently re-planning the run past its authorization is exactly what the run-plan gate was approving against. Guessing a fresh resolution to keep the wave moving is the failure this scenario guards against.