docs: bind "Voyage never starts Claude Code" in CLAUDE.md, add changelog

The operator decision of 2026-09-27 stands where every session reads it:
a short binding rule in CLAUDE.md that names the replacement (order plus
starter, subagents inside one session) and the gate that enforces it.
CHANGELOG gets an Unreleased entry; the version is left for the release
round to set.

npm test 1250 (1245 pass, 0 fail, 5 skipped). The gate is unchanged:
the new changelog text adds no hit line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## Unreleased — Voyage never starts Claude Code
+
+Operator decision 2026-09-27: Voyage works the PM way. Nothing it ships
+starts a Claude Code session; work that needs another session becomes an
+order plus a starter line the user runs in a session they open themselves.
+
+### Changed (breaking)
+
+- `/trekexecute` multi-session path (Phase 2.6) no longer launches headless
+  child sessions. It prepares one wave at a time: a worktree per session, one
+  session order per session (`.claude/trekplan-sessions/{slug}/orders/`,
+  written by the new `lib/util/session-orders.mjs`) with a
+  `/trekexecute --session N <plan>` starter, and stops. Running the same
+  command again reads each session's progress file, merges the wave
+  sequentially and prepares the next one. Phase 7.6 recovery is handed over
+  the same way. New Hard rule 21: never start Claude Code.
+- `/trekplan --decompose`: the session-decomposer writes `orders.md` instead
+  of a `launch.sh`, and the "launch" reply is gone.
+- `/trekresearch --engine deep-research`: the pre-gate no longer runs the
+  Claude Code binary to read its version; the post-hoc check decides, as it
+  already did.
+
+### Removed
+
+- The `ANTHROPIC_API_KEY` billing check, the hooks-fire version precheck, the
+  headless safety preamble and the per-child tool, turn and budget flags —
+  they existed only for launched children.
+- `templates/headless-launch-template.md` and
+  `scripts/q3-cache-prefix-experiment.mjs` (a finished experiment that
+  spawned the binary; its results stay in `docs/`).
+- README: the billing-safety and headless MCP-tuning sections.
+
+### Added
+
+- `tests/lib/no-claude-code-launch.test.mjs`: fails when any tracked file
+  outside a reasoned, exact-count exemption list carries a way to start
+  Claude Code; proven on a known-positive fixture for every pattern.
+- `tests/lib/session-orders.test.mjs`: runs the order writer on a fixture
+  plan and proves the orders land and nothing is started.
+
 ## v5.11.1 — 2026-09-23 — dead references to a retired repository removed
 
 ### Changed

CLAUDE.md

@@ -10,6 +10,15 @@ Voyage — a contract-driven Claude Code pipeline: brief, research, plan, execut
 
 > **Cross-cutting invariant: brief framing must match operator intent.** The brief is the pipeline's source of truth; operator intent lives in memory files — the pipeline must not polish a wrong premise. Enforced as the `brief_version 2.2` gate (v5.5), all BLOCKER for briefs declaring ≥ 2.2: (1) explicit `framing: preserve|refine|replace|new-direction` frontmatter, `AskUserQuestion`-validated in `/trekbrief` Phase 2.5; (2) memory-alignment as `brief-reviewer` dimension 6; (3) mandatory `## TL;DR`. Existing 2.0/2.1 briefs stay valid; `trekreview` briefs are exempt. Full implementation + contract evolution → `docs/HANDOVER-CONTRACTS.md` §Handover 1 (PUBLIC CONTRACT).
 
+> **Binding rule (operator decision, 2026-09-27): Voyage never starts Claude Code.**
+> Nothing Voyage ships may start a Claude Code session or model run: no `claude`
+> CLI line, no Agent SDK, no spawned binary, no launch script. Work that needs
+> another session becomes an order plus a starter line the user gives a session
+> they open themselves (`/trekexecute` Phase 2.6, `lib/util/session-orders.mjs`);
+> parallel work inside one session uses subagents. Enforced by
+> `tests/lib/no-claude-code-launch.test.mjs` (historical mentions only in its
+> exemption list, each with a reason and an exact count).
+
 ## Commands
 
 | Command | Description | Orchestrator model |