diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index a004148..48ff166 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,12 +1,23 @@
 {
   "name": "voyage",
   "description": "Voyage — brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline. /trekbrief, /trekplan, and /trekreview each end by building a self-contained operator-annotation HTML (scripts/annotate.mjs, modelled on claude-code-100x): select text or click any element, pick intent (Fiks/Endre/Spørsmål), write comment, copy structured prompt, paste back, Claude revises the .md.",
-  "version": "5.9.0",
+  "version": "5.9.1",
   "author": {
     "name": "Kjell Tore Guttormsen"
   },
   "homepage": "https://git.fromaitochitta.com/open/ktg-plugin-marketplace/src/branch/main/plugins/voyage",
   "repository": "https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git",
   "license": "MIT",
-  "keywords": ["voyage", "trek", "planning", "implementation", "research", "context-engineering", "agents", "adversarial-review", "headless", "execution"]
+  "keywords": [
+    "voyage",
+    "trek",
+    "planning",
+    "implementation",
+    "research",
+    "context-engineering",
+    "agents",
+    "adversarial-review",
+    "headless",
+    "execution"
+  ]
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 973a917..21b08e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## v5.9.1 — 2026-07-03 — Fix /trekendsession load-time crash (eager-exec placeholders)
+
+Patch, no functional additions.
+
+### Fixed
+
+- `/trekendsession` was unusable in every invocation: two of its three `` !`...` `` eager-exec blocks (Phase 3 atomic-write, Phase 4 validator call) contained unresolved runtime placeholders (`<project-dir>` etc.). The harness executes eager-exec blocks at command LOAD time, so zsh parsed `<project-dir>` as input redirection and the command aborted before the model saw a single instruction. Both blocks are now plain runtime Bash fences with the `{curly}` placeholder convention (shell-inert), matching `trekplan.md`/`trekresearch.md`. The Phase 1 discovery block (self-contained) keeps its legitimate eager-exec prefix; `trekcontinue.md`'s discovery block was runtime-verified unaffected.
+- Latent secondary bug in the same blocks: cwd-relative plugin paths (`lib/validators/...`, `./lib/util/atomic-write.mjs`) would have failed with `ERR_MODULE_NOT_FOUND` even after substitution, since the Bash cwd is the user's repo. Both now use absolute `${CLAUDE_PLUGIN_ROOT}` paths per the existing command convention (Node ESM accepts absolute-path import specifiers — verified on Node 18+).
+
+### Added
+
+- Regression guard `tests/commands/trekendsession.test.mjs`: scans every `` !` ``-block in `commands/*.md` for unresolved `<angle>`/`{curly}` placeholders (this bug class is silent until first invocation), plus structure tests pinning Phase 3/4 as runtime Bash with `${CLAUDE_PLUGIN_ROOT}` paths and exactly one surviving eager block. Suite baseline 828 → 832 (830 pass / 0 fail / 2 skip).
+
 ## v5.9.0 — 2026-07-02 — Fable model tier + deep-research engine
 
 Additive, plus one behavior alignment: profile `phase_models` now reach sub-agent spawn sites (previously documented but never wired), and the seven command orchestrators no longer pin `model: opus` — frontmatter omits `model:`, so the orchestrator follows the session model.
diff --git a/README.md b/README.md
index 3bd57f1..1cb5546 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # trekplan — Brief, Research, Plan, Execute, Review, Continue
 
-![Version](https://img.shields.io/badge/version-5.9.0-blue)
+![Version](https://img.shields.io/badge/version-5.9.1-blue)
 ![License](https://img.shields.io/badge/license-MIT-green)
 ![Platform](https://img.shields.io/badge/platform-Claude%20Code-purple)
 
diff --git a/commands/trekendsession.md b/commands/trekendsession.md
index c8e0904..f395b35 100644
--- a/commands/trekendsession.md
+++ b/commands/trekendsession.md
@@ -90,16 +90,16 @@ want an interactive flow, use `/trekcontinue --help` to see the full pipeline.
 
 ## Phase 3 — Atomically write `.session-state.local.json` + sibling NEXT-SESSION-PROMPT.local.md
 
-Write `<project-dir>/.session-state.local.json` with the schema-v1 object:
+Write `{project_dir}/.session-state.local.json` with the schema-v1 object:
 
 ```json
 {
   "schema_version": 1,
-  "project": "<project-dir>",
-  "next_session_brief_path": "<arg 1>",
-  "next_session_label": "<arg 2>",
+  "project": "{project_dir}",
+  "next_session_brief_path": "{arg 1}",
+  "next_session_label": "{arg 2}",
   "status": "in_progress",
-  "updated_at": "<now, ISO-8601>"
+  "updated_at": "{now, ISO-8601}"
 }
 ```
 
@@ -114,14 +114,22 @@ Under `node --input-type=module -e "<script>" arg1 arg2 arg3`, Node sets
 
 This phase ALSO writes a sibling `NEXT-SESSION-PROMPT.local.md` in the
 project directory with YAML frontmatter (`produced_by: trekendsession`,
-`produced_at: <ISO-8601>`, `project: <project-dir>`). Both files are written
-in a single ESM block so the writes succeed or fail together:
+`produced_at: {ISO-8601}`, `project: {project_dir}`). Both files are written
+in a single ESM block so the writes succeed or fail together.
+
+Run the block below via the Bash tool at runtime, substituting the resolved
+values for the `{curly}` placeholders (Phase 1 gives `{project_dir}`, Phase 2
+gives `{next_brief_path}` and `{next_label}`). This is NOT an eager-exec
+block — the values do not exist at command-load time. The import path must
+stay absolute via `${CLAUDE_PLUGIN_ROOT}` — your Bash cwd is the user's
+repo, not the plugin root, so a cwd-relative import throws
+`ERR_MODULE_NOT_FOUND`:
 
 ```bash
-!`node --input-type=module -e "
+node --input-type=module -e "
 import path from 'node:path';
 import { writeFileSync } from 'node:fs';
-import { atomicWriteJson } from './lib/util/atomic-write.mjs';
+import { atomicWriteJson } from '${CLAUDE_PLUGIN_ROOT}/lib/util/atomic-write.mjs';
 const [, dir, brief, label] = process.argv;
 const now = new Date().toISOString();
 const stateObj = { schema_version: 1, project: dir, next_session_brief_path: brief, next_session_label: label, status: 'in_progress', updated_at: now };
@@ -132,26 +140,28 @@ const promptBody = '---\\nproduced_by: trekendsession\\nproduced_at: ' + now + '
 writeFileSync(promptFile, promptBody);
 console.log(stateFile);
 console.log(promptFile);
-" '<project-dir>' '<next-brief-path>' '<next-label>'`
+" '{project_dir}' '{next_brief_path}' '{next_label}'
 ```
 
 ## Phase 4 — Validate + narrate
 
-Validate the freshly-written state file:
+Validate the freshly-written state file via the Bash tool at runtime,
+substituting the resolved `{project_dir}` (NOT eager-exec — the file does
+not exist at command-load time):
 
 ```bash
-!`node lib/validators/session-state-validator.mjs --json <project-dir>/.session-state.local.json`
+node ${CLAUDE_PLUGIN_ROOT}/lib/validators/session-state-validator.mjs --json {project_dir}/.session-state.local.json
 ```
 
 If `valid: true`, print the success block matching `/trekcontinue` Phase 3
 narration (SC-8 cross-project consistency — same template both sides):
 
 ```
-Session state written: <project-dir>/.session-state.local.json
+Session state written: {project_dir}/.session-state.local.json
 
-Project: <project-dir>
-Next session: <next-label>
-Brief: <next-brief-path>
+Project: {project_dir}
+Next session: {next_label}
+Brief: {next_brief_path}
 
 In a fresh Claude session, run /trekcontinue to resume.
 ```
diff --git a/package-lock.json b/package-lock.json
index 15784cd..d256a93 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "voyage",
-  "version": "5.9.0",
+  "version": "5.9.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "voyage",
-      "version": "5.9.0",
+      "version": "5.9.1",
       "license": "MIT",
       "engines": {
         "node": ">=18"
diff --git a/package.json b/package.json
index 9a93156..92964ae 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "voyage",
-  "version": "5.9.0",
+  "version": "5.9.1",
   "description": "Voyage — brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline. /trekbrief, /trekplan, and /trekreview each end by building a self-contained operator-annotation HTML (scripts/annotate.mjs, modelled on claude-code-100x): select text or click any heading/paragraph/list-item, pick intent (Fiks/Endre/Spørsmål), write comment, copy structured prompt, paste back, Claude revises the .md.",
   "type": "module",
   "engines": {
diff --git a/tests/commands/trekendsession.test.mjs b/tests/commands/trekendsession.test.mjs
new file mode 100644
index 0000000..d7c06db
--- /dev/null
+++ b/tests/commands/trekendsession.test.mjs
@@ -0,0 +1,127 @@
+// tests/commands/trekendsession.test.mjs
+// Regression tests for /trekendsession (commands/trekendsession.md).
+//
+// Bug (2026-07-03): two of the three !`...` eager-exec blocks contained
+// unresolved placeholders (<project-dir> etc.). The harness executes
+// eager-exec blocks at command LOAD time, so zsh parsed <project-dir> as
+// input redirection and the command aborted before the model saw a single
+// instruction. Eager-exec is only valid for self-contained commands.
+//
+// Pattern D (markdown structure) — assertions against command prose.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(HERE, '..', '..');
+const COMMANDS_DIR = join(ROOT, 'commands');
+const COMMAND_FILE = join(COMMANDS_DIR, 'trekendsession.md');
+
+function readCommand() {
+  return readFileSync(COMMAND_FILE, 'utf8');
+}
+
+function extractPhase(commandText, phaseHeader) {
+  const startIdx = commandText.indexOf(phaseHeader);
+  if (startIdx === -1) return '';
+  const rest = commandText.slice(startIdx);
+  const nextPhase = rest.search(/\n## (?:Phase |Hard )/);
+  if (nextPhase === -1) return rest;
+  return rest.slice(0, nextPhase);
+}
+
+// Extract all eager-exec blocks (!`...`) from a command/skill file,
+// including multi-line blocks. Returns [{ content, line }].
+function extractEagerBlocks(text) {
+  const blocks = [];
+  const re = /!`([^`]+)`/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const line = text.slice(0, m.index).split('\n').length;
+    blocks.push({ content: m[1], line });
+  }
+  return blocks;
+}
+
+// ---------------------------------------------------------------
+// Marketplace-wide regression guard: eager-exec blocks must be
+// self-contained. An unresolved placeholder (<angle> or {curly}) in an
+// eager block is executed verbatim by the shell at load time — <x> is
+// parsed as input redirection and aborts the whole command load.
+// ---------------------------------------------------------------
+
+test('eager-exec guard — no !`-block in commands/ contains an unresolved placeholder', () => {
+  const offenders = [];
+  for (const file of readdirSync(COMMANDS_DIR).filter((f) => f.endsWith('.md'))) {
+    const text = readFileSync(join(COMMANDS_DIR, file), 'utf8');
+    for (const { content, line } of extractEagerBlocks(text)) {
+      // Placeholder conventions: <angle-word> or {curly_word}. Curly must
+      // contain a separator (- or _) so JS destructuring like {join} in a
+      // legitimate self-contained script does not false-positive; angle
+      // placeholders are unambiguous (shell would parse them as redirects).
+      if (/<[a-z][a-z0-9_-]*>/.test(content) || /\{[a-z][a-z0-9]*([_-][a-z0-9]+)+\}/.test(content)) {
+        offenders.push(`${file}:${line}`);
+      }
+    }
+  }
+  assert.deepEqual(
+    offenders,
+    [],
+    `eager-exec !\`-blocks run at command LOAD time and must be self-contained; ` +
+      `placeholder found in: ${offenders.join(', ')}`,
+  );
+});
+
+// ---------------------------------------------------------------
+// trekendsession-specific: exactly one eager block (Phase 1 project
+// discovery — self-contained, legitimate); Phases 3 and 4 are runtime
+// Bash-tool commands with model-substituted values, never eager.
+// ---------------------------------------------------------------
+
+test('trekendsession — exactly one eager-exec block remains (Phase 1 discovery)', () => {
+  const cmd = readCommand();
+  const blocks = extractEagerBlocks(cmd);
+  assert.equal(
+    blocks.length,
+    1,
+    `expected exactly 1 eager-exec block (Phase 1 discovery), got ${blocks.length} at line(s) ${blocks.map((b) => b.line).join(', ')}`,
+  );
+  assert.match(
+    blocks[0].content,
+    /readdirSync\(root\)/,
+    'the surviving eager block must be the self-contained Phase 1 discovery script',
+  );
+});
+
+test('trekendsession Phase 3 — atomic-write block is runtime Bash (no eager prefix) with plugin-root import', () => {
+  const phase3 = extractPhase(readCommand(), '## Phase 3 ');
+  assert.doesNotMatch(phase3, /!`/, 'Phase 3 must not use eager-exec — values exist only at runtime');
+  assert.match(
+    phase3,
+    /\$\{CLAUDE_PLUGIN_ROOT\}\/lib\/util\/atomic-write\.mjs/,
+    'Phase 3 import must use the absolute ${CLAUDE_PLUGIN_ROOT} path — cwd is the user repo, not the plugin root',
+  );
+  assert.doesNotMatch(
+    phase3,
+    /['"]\.\/lib\/util\/atomic-write\.mjs['"]/,
+    'Phase 3 must not import atomic-write.mjs via a cwd-relative path',
+  );
+});
+
+test('trekendsession Phase 4 — validator call is runtime Bash (no eager prefix) with plugin-root path', () => {
+  const phase4 = extractPhase(readCommand(), '## Phase 4 ');
+  assert.doesNotMatch(phase4, /!`/, 'Phase 4 must not use eager-exec — the state-file path exists only at runtime');
+  assert.match(
+    phase4,
+    /\$\{CLAUDE_PLUGIN_ROOT\}\/lib\/validators\/session-state-validator\.mjs/,
+    'Phase 4 validator path must use the absolute ${CLAUDE_PLUGIN_ROOT} convention',
+  );
+  assert.doesNotMatch(
+    phase4,
+    /<[a-z][a-z0-9_-]*>/,
+    'Phase 4 must not use <angle> placeholders in commands — zsh parses <x> as input redirection',
+  );
+});