merge: main (wave 4 order A) into order B before B goes into main

Conflicts on the union lines only: CHANGELOG Unreleased (both orders'
entries kept), CLAUDE.md (/trekexecute row from A, /trekreview row from
B), tests/fixtures/jsonl-schemas.md (trekplan line_ref from B,
trekexecute line_ref from A). Suite on the merged tree 2682 (2680/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -328,7 +328,7 @@ Every implementation step includes:
 - **Checkpoint:** — git commit after success
 - **Manifest:** — the objective completion predicate (Hard Rule 17)
 
-One step per plan is the "run the thing" step (`End-to-end:`): the product run the way a user runs it. Without it a result is "not verified end to end", never green.
+One step per plan is the "run the thing" step (`End-to-end:`): the product run the way a user runs it. Without it a result is "not verified end to end", never green. The app is seen and driven with Claude Code's built-in `run` skill; the verdict is still the `End-to-end:` command, because `run` gives no exit code.
 
 **Checks that run, and can fail.** Every `Verify:`, `Regression:`, `End-to-end:` and `## Verification` command, like every brief success criterion, is written by the `voyage:writing-criteria` skill: one command the criteria runner accepts (a known test runner, plain words, no pipe or `&&`), a script under `tests/` (`bash tests/<name>.sh`) for anything more, and a command that can go red. `/trekplan` asks for it where the plan is written and where it starts its reviewers; `brief-reviewer` and `plan-critic` have it preloaded and report a criterion the runner refuses, or one that exits 0 whatever the code does (`git status`, `git log`, a test file that already passes).
 
@@ -346,7 +346,7 @@ Borrowed, with credit: per-step interfaces, Global Constraints and Review Focus
 
 Reads a plan from `/trekplan` and implements it with strict discipline. No guessing, no improvising — follows the plan exactly.
 
-Per step: record the start point → **one fresh helper** (`step-implementer`) writes the step's test first, proves it red, locks it, then applies Changes exactly as written → the executor proves it by command: **red at the start point, green at the result** (`red-proof.mjs`), Verify (exit code is truth), manifest audit, and the **floor guard** on the diff (`test-integrity.mjs`: removed asserts, skipped or deleted tests, muted checks, stubs, loosened thresholds) → **one controller** reads the diff — never the helper's summary — and gives two verdicts, *spec* and *quality* → a script writes the step's **done line** only when the test command exits 0 (`done-line.mjs`) → Checkpoint commit. After all steps: independent Phase 7.5 manifest audit from git log + filesystem (ignoring agent bookkeeping); drift triggers Phase 7.6 bounded recovery. A plan with no passing run-the-thing criterion ends **not verified end to end**, never green.
+Per step: record the start point → **one fresh helper** (`step-implementer`) writes the step's test first, proves it red, locks it, then applies Changes exactly as written → the executor proves it by command: **red at the start point, green at the result** (`red-proof.mjs`), Verify (exit code is truth), manifest audit, and the **floor guard** on the diff (`test-integrity.mjs`: removed asserts, skipped or deleted tests, muted checks, stubs, loosened thresholds) → **one controller** reads the diff — never the helper's summary — and gives two verdicts, *spec* and *quality* → a script writes the step's **done line** only when the test command exits 0 (`done-line.mjs`) → Checkpoint commit. After all steps: independent Phase 7.5 manifest audit from git log + filesystem (ignoring agent bookkeeping); drift triggers Phase 7.6 bounded recovery. A plan with no passing run-the-thing criterion ends **not verified end to end**, never green. Claude Code's built-in `run` skill can show the app working, but it gives no exit code, so the run-the-thing verdict stays with the plan's `End-to-end:` command.
 
 A run starts only on a plan you approved **as it is now**: the approval log holds the plan's sha256, so a plan edited after its approval is refused before step 1. At step end the repo's own tools check the step's diff (the step check) and the step's `Regression:` suite must stay green. After the last step come the architecture rules and the sweep for files the plan does not name, and then **the review starts by itself**: `/simplify` → `/trekreview` → the verdict gate. A BLOCK keeps the merge into main closed.
 
@@ -674,7 +674,9 @@ The workshop behind them runs in `npm test`: the form check `lib/skills/skill-li
 "Use when ...", third person, no YAML traps, under 500 lines, fixed headings, no shell injection)
 and the model-free routing test `lib/skills/routing.mjs` (no two descriptions among skills,
 commands and agents may collide; 3 firing, 2 quiet and 1 effect case per skill). The eval cases sit
-in `evals/skill-*` for the operator's own eval run. How to write one, starting with a baseline the
+in `evals/skill-*` for the operator's own eval run. Every case in `evals/`, the fixed test set's
+too, names the event it came from (`from=`); the routing test fails a case without it and reports
+how many cases it checked for `from=` and how many it routed. A quiet case's owner may be Claude Code's own `run` skill, which is outside the corpus: then only "the skill does not rank first" is checked. How to write one, starting with a baseline the
 helper fails without the skill: [docs/skills-authoring.md](docs/skills-authoring.md).
 
 Borrowed, with credit: the form check and routing test from addyosmani/agent-skills (MIT); the red