feat(execute)!: hand waves over as session orders, never start Claude Code (green)

Operator decision 27.09.2026: Voyage works the PM way, so nothing in it
starts Claude Code. Work that needs another session becomes an order plus
a starter line the user gives a session they open themselves; Voyage
never starts the session.

/trekexecute's multi-session path (Phase 2.6) now prepares one wave at a
time: worktree per session, then lib/util/session-orders.mjs writes one
order per session (worktree, steps, done-condition, starter) plus
orders/wave.json, and the run stops. Running the same command again reads
each session's progress file (status mode), merges sequentially with
push-before-cleanup as before, and prepares the next wave. Phase 2.5 skips
the destructive pre-flight while a wave is in flight. Phase 7.6 recovery is
handed over the same way. Hard rule 21: never start Claude Code.

Removed with it, because they existed only for launched children: the
ANTHROPIC_API_KEY billing check (and its dry-run line and Hard rule 1
exception), the hooks-fire version precheck, the safety preamble, the
scoped-tool/turn/budget flags, templates/headless-launch-template.md, the
decomposer's launch.sh (now orders.md), /trekplan's "launch", the README
billing and MCP tuning sections, and scripts/q3-cache-prefix-experiment.mjs
(an experiment that spawned the binary; its results stay in docs/).
/trekresearch's deep-research pre-gate no longer runs the binary for its
version; the post-hoc check was already the authoritative guard.

Chose orders + starters over in-session subagents because the order's done
criterion asks for exactly that, and because /trekexecute disallows the
Agent tool on purpose (Hard rule 10); reopening that is a separate change.

Gate: 54 -> 0 hit lines outside EXEMPT. npm test 1250 (1245 pass, 0 fail,
5 skipped: 3 are the retired-reference scan without its local list).
verify.sh 7/0. The fixture run (tests/lib/session-orders.test.mjs) writes
two orders and wave.json for wave 1 and leaves a trap binary untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

agents/plan-critic.md

@@ -143,7 +143,7 @@ questions, which defeats the purpose.
   (not "handle the error" but "revert file X, do not proceed to step N+1")
 - Is there a circuit breaker? (steps that should halt execution on failure
   must say so explicitly — never assume the executor will "figure it out")
-- Could a headless `claude -p` session execute each step without asking questions?
+- Could a fresh session running `/trekexecute` execute each step without asking questions?
 
 Steps missing On failure or Checkpoint clauses are **major** findings
 (not blockers — the plan is still valid for interactive use, but it

agents/session-decomposer.md

@@ -3,7 +3,7 @@ name: session-decomposer
 description: |
   Use this agent to decompose an trekplan into self-contained headless sessions.
   Reads a plan file, analyzes step dependencies, groups steps into sessions,
-  identifies parallelism, and generates session specs + dependency graph + launch script.
+  identifies parallelism, and generates session specs + dependency graph + session orders.
 model: opus
 color: green
 tools: ["Read", "Glob", "Grep", "Write"]
@@ -166,8 +166,8 @@ The Step 0 block to prepend verbatim:
   ```
   → expected: non-77 exit code
 - **On failure:** `escalate` — exit code 77 means this sandbox cannot push.
-  Abort immediately; do not attempt any work. Main orchestrator will
-  re-spawn with correct permissions.
+  Abort immediately; do not attempt any work. Fix the sandbox's push
+  permission, then rerun this session.
 - **Checkpoint:** none (no file changes)
 - **Manifest:**
   ```yaml
@@ -218,28 +218,22 @@ graph LR
 | 3 | S4 | sequential | Wave 2 |
 ```
 
-### Step 7 — Generate the launch script
+### Step 7 — Write the session orders
 
-Write a bash launch script to `{output_dir}/launch.sh`.
+Voyage never starts a session, and neither does anything you write: no launch
+script, no `claude` command line. Write `{output_dir}/orders.md` — the hand-over
+the user works from. For each wave, in order, list every session with:
 
-The script must:
-1. Group sessions into waves matching the dependency graph
-2. Launch parallel sessions in each wave using `claude -p "$(cat session-file.md)"`
-3. Wait for all sessions in a wave before starting the next wave
-4. Log each session to a separate file in `{output_dir}/logs/`
-5. Run exit-condition verification after each wave
-6. Stop if any wave's verification fails
-7. Run the master plan's overall verification at the end
+1. Its spec file (`{output_dir}/session-{N}-{slug}.md`)
+2. Its starter line, which the user gives a Claude Code session they open
+   themselves: `/trekexecute {output_dir}/session-{N}-{slug}.md`
+3. What it depends on, and its exit condition
 
-**Important script conventions:**
-- Use `#!/usr/bin/env bash` shebang
-- Use `set -euo pipefail`
-- Each `claude -p` invocation must use `--allowedTools "Read,Write,Edit,Bash,Glob,Grep"`
-  and `--permission-mode bypassPermissions`. Prepend `unset ANTHROPIC_API_KEY`
-  before each invocation to prevent accidental API billing
-- Background processes use `&` and are collected with `wait`
-- PID tracking for wait targets
-- Exit codes propagated correctly
+State the two rules at the top of the file: a wave starts only after every
+session of the previous wave met its exit condition; and sessions of the same
+wave run in parallel only in separate git worktrees (never two in one working
+directory) — run sequentially, one after another in the main checkout, is
+always safe. End with the master plan's overall verification commands.
 
 ### Step 8 — Write the summary
 
@@ -271,7 +265,7 @@ Output a structured summary:
 
 - Session specs: `{output_dir}/session-*.md`
 - Dependency graph: `{output_dir}/dependency-graph.md`
-- Launch script: `{output_dir}/launch.sh`
+- Session orders: `{output_dir}/orders.md`
 
 ### Final verification