feat(execute): one fresh helper per step, a controller on the diff, proof by command

/trekexecute no longer builds steps itself. Each plan step is built by one
fresh helper (new agent step-implementer: opus, effort high, no Agent tool)
and judged by one controller (a general helper on opus) that reads the
diff from a recorded start_sha and gives two verdicts, spec and quality.
Fix rounds go up, maximum 5: three fixes by a fresh helper, then back to
the plan, then to the operator. No cheaper-model ladder.

Proof is a command, never the model's word:
- lib/verification/red-proof.mjs: the step's test must fail at the start
  point and pass at the result (exit 0/1/2; 2 is never green). Reproduces
  the 02243c6 red-first measurement (6 of 55) through the shim fixture.
- lib/verification/test-integrity.mjs: the floor guard on the diff
  (removed asserts, skipped/deleted tests, muted checks, stubs, loosened
  thresholds). Over the last 150 commits: 149 clean, 1 real finding.
- lib/verification/done-line.mjs: DONE step N only when the test command
  exits 0.

Test first is required from plan_version 1.8. The test lock (K8) is used
through its CLI and reported as not-locked while it is missing. A run
stops only on a closed list of four classes; every other call goes into a
decision log with its cost if wrong. Without a passing run-the-thing
criterion the result is not verified end to end, never green.

Handover 5 gains optional per-step start_sha, report_path, red_proof,
test_lock, fix_rounds (0-5) and run-level decisions and end_to_end; old
progress files still validate and resume.

No isolation on the helper: measured, a worktree-isolated subagent
branches from the default branch (02f320f), not the executor's HEAD
(2c89a6b), so it would miss the earlier steps.

Borrowings credited in commands/trekexecute.md ## Credits (Superpowers,
ai-native-sdlc, Kiro, GitHub Spec Kit, agent-skills, Cherny).

Tests: 1411 -> 1457 (1455 pass, 0 fail, 2 skipped).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/HANDOVER-CONTRACTS.md

@@ -270,7 +270,7 @@ The strongest validation in the entire pipeline. Phase 5.5 (planning-orchestrato
 
 ## Handover 5 — `progress.json` (resume contract)
 
-**Producer:** `/trekexecute` per-step (after Verify + Manifest audit + Checkpoint).
+**Producer:** `/trekexecute` per-step (start point recorded before the step; then proof of red + Verify + Manifest audit + floor guard + control + done line + Checkpoint).
 
 **Consumer:** `/trekexecute --resume` (re-entry) + `pre-compact-flush` hook (drift detection before context compaction).
 
@@ -296,6 +296,8 @@ The strongest validation in the entire pipeline. Phase 5.5 (planning-orchestrato
 | `session_start_sha` | string | optional | git sha at execute start |
 | `session_end_sha` | string | optional | git sha at execute end |
 | `steps` | object | yes | Map of step number → step record |
+| `end_to_end` | string | optional | `verified \| not-verified` — a passing run-the-thing criterion in the plan's `## Verification`; `not-verified` turns `completed` into `partial` (wave 1, P9 (6)) |
+| `decisions` | array | optional | `[{step, decision, cost_if_wrong}]` — every call the executor made that the plan did not dictate; both strings non-empty (wave 1, P4) |
 
 **Per-step record:**
 
@@ -308,6 +310,15 @@ The strongest validation in the entire pipeline. Phase 5.5 (planning-orchestrato
 | `commit` | string \| null | git sha after Checkpoint |
 | `manifest_audit` | string | `pass \| fail \| pass-with-note \| n/a` |
 | `note` | string | optional human-readable annotation |
+| `start_sha` | string \| null | optional (wave 1) — git sha the step started from; every check of the step reads `git diff {start_sha}` |
+| `report_path` | string \| null | optional (wave 1) — the step's report file: the helper's ran / saw / did-NOT-check rounds and the script-written `DONE step N` line |
+| `red_proof` | string \| null | optional (wave 1) — `proven \| rejected \| not-run`, the exit of `lib/verification/red-proof.mjs` |
+| `test_lock` | string \| null | optional (wave 1) — `locked \| released \| not-locked` (K8, `lib/util/test-lock.mjs`) |
+| `fix_rounds` | number | optional (wave 1) — 0..5: 0 = passed its first control, 1–3 = fix rounds, 4 = sent up to the plan, 5 = sent up to the operator. 6 is invalid |
+
+The wave-1 fields are **additive-optional on read**: a `progress.json` written
+before them validates and resumes unchanged (no `schema_version` bump). `null`
+means "not set yet". When present, `progress-validator.mjs` shape-checks them.
 
 **Validation strategy:** `progress-validator.mjs` runs at:
 1. `/trekexecute --validate` (alongside plan-validator)
@@ -325,6 +336,9 @@ The strongest validation in the entire pipeline. Phase 5.5 (planning-orchestrato
 - `PROGRESS_STEP_RANGE` → `current_step` outside `[0, total_steps]`; resume halts
 - `PROGRESS_ALREADY_DONE` → `status === completed`; nothing to resume
 - `PROGRESS_STEP_COUNT_MISMATCH` → warning; not a blocker
+- `PROGRESS_FIX_ROUNDS_INVALID` → `fix_rounds` not an integer 0..5; resume halts
+- `PROGRESS_START_SHA_INVALID` / `PROGRESS_REPORT_PATH_INVALID` / `PROGRESS_RED_PROOF_INVALID` / `PROGRESS_TEST_LOCK_INVALID` → a wave-1 step field of the wrong shape; resume halts
+- `PROGRESS_DECISION_INVALID` → `decisions` is not an array of `{decision, cost_if_wrong}`; resume halts
 
 ---