fix(execute): every /trekexecute telemetry write lands through a writer

Phase 9 said 'append to ${CLAUDE_PLUGIN_DATA}/trekexecute-stats.jsonl; if it is not set, skip silently' - the Bash tool env never carries it. It now runs stats-append.mjs trekexecute with the record on stdin, the /trekbrief Phase 7 shape, and reports a written:false. The gates_mode_flag_override record was prose with no writer; it now has an event-emit block (fixed literal payload: --gates is a boolean flag) and a documented shape {ts, event, known_event, payload:{flag, signal_effort}}. Phase 8's three event blocks spliced ${PLAN_PATH} (set in an earlier Bash call that does not survive) and ${WAVE_COUNT} (never assigned) into a double-quoted payload, so a literal run printed payload-not-json, and the decline reason was operator free text in a shell argument. Payloads are now single-quoted with {plan-path} / {wave-count} placeholders and the literal label hold-for-review; each call runs on its own and a written:false is printed and passed. docs/architecture.md and the jsonl-schemas rows (writer, measured line_refs) follow.

Red: 7 of 7 new tests fail on the pre-fix text (Phase 9 writer + no 'skip silently', Phase 9 record lands, no bare ${CLAUDE_PLUGIN_DATA}/...jsonl target, no shell expansion in --payload, the three Phase 8 blocks land known events when run as written in a fresh shell, the written:false sentence, the override writer and shape).
Verify 198/198 (stats-landing, main-merge-gate, gates-flag-coverage, profile-stats-fields, plugin-root-resolution, doc-consistency, no-claude-code-launch). Suite 1383 (1381/0/2).

Voyage order 20261005T104513Z-1250514346, plan step 3/5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commands/trekexecute.md

@@ -1640,9 +1640,21 @@ boundary:
 ```bash
 node ${CLAUDE_PLUGIN_ROOT}/lib/stats/event-emit.mjs \
   --event main-merge-gate \
-  --payload "{\"plan\":\"${PLAN_PATH}\",\"wave_count\":${WAVE_COUNT}}"
+  --payload '{"plan":"{plan-path}","wave_count":{wave-count}}'
 ```
 
+Fill in the placeholders yourself; the payload is single-quoted, so the shell
+expands nothing in it (shell state from an earlier Bash call does not survive,
+and an expanded variable is how this event used to print `payload-not-json`).
+`{plan-path}` is the repo-relative plan path — a Voyage plan path
+(`.claude/projects/<date>-<slug>/plan.md` or
+`.claude/plans/trekplan-<date>-<slug>.md`) holds no quote character.
+`{wave-count}` is the number of merged waves, `1` on the single-session path.
+
+Run each event call as its own command, never chained with `&&`. The writer
+prints `{"written": true, ...}`. On `"written": false` (exit 1), print its
+`reason` in one line and continue — an event failure never blocks the gate.
+
 Pause for operator confirmation via `AskUserQuestion`:
 
 **Question:** "All waves merged. Ready to proceed with the main-merge step
@@ -1662,7 +1674,7 @@ On confirm:
 ```bash
 node ${CLAUDE_PLUGIN_ROOT}/lib/stats/event-emit.mjs \
   --event main-merge-approved \
-  --payload "{\"plan\":\"${PLAN_PATH}\"}"
+  --payload '{"plan":"{plan-path}"}'
 ```
 
 On the multi-session wave path (Phase 2.6), and only when `next-wave` said
@@ -1678,9 +1690,13 @@ On decline:
 ```bash
 node ${CLAUDE_PLUGIN_ROOT}/lib/stats/event-emit.mjs \
   --event main-merge-declined \
-  --payload "{\"plan\":\"${PLAN_PATH}\",\"reason\":\"${reason}\"}"
+  --payload '{"plan":"{plan-path}","reason":"hold-for-review"}'
 ```
 
+The reason is the literal label of the one decline option, never the
+operator's free text (free text in a shell argument breaks the JSON and can be
+expanded by the shell).
+
 On decline, nothing is cleared: the merged-waves record is kept.
 
 **Recovery surface:** on the single-session path, if declined,
@@ -1865,9 +1881,13 @@ wave instead.
 
 ## Phase 9 — Stats tracking
 
-Append one record to `${CLAUDE_PLUGIN_DATA}/trekexecute-stats.jsonl`:
+Append one record to `trekexecute-stats.jsonl` in the plugin data directory.
+Run it exactly like this. The record goes on stdin, and the writer resolves
+the directory: `CLAUDE_PLUGIN_DATA`, which the Bash tool env does not carry,
+else the directory `scripts/yardstick.mjs` reads.
 
-```json
+```bash
+node ${CLAUDE_PLUGIN_ROOT}/lib/stats/stats-append.mjs trekexecute <<'JSON'
 {
   "ts": "{ISO-8601}",
   "plan": "{filename only}",
@@ -1880,10 +1900,14 @@ Append one record to `${CLAUDE_PLUGIN_DATA}/trekexecute-stats.jsonl`:
   "steps_skipped": 0,
   "failed_at_step": null
 }
+JSON
 ```
 
-If `${CLAUDE_PLUGIN_DATA}` is not set or not writable, skip silently.
-Never let stats failures block the workflow.
+`steps_passed` counts the steps whose status is `completed`.
+
+The writer prints `{"written": true, ...}`. On `"written": false` (exit 1),
+print its `reason` in one line and continue. A stats failure never blocks the
+workflow, but it is reported, not skipped silently.
 
 ## Profile (v4.1)
 
@@ -1968,9 +1992,16 @@ manifest-audit runs in its strictest form (fails on ANY mismatch, not
 just deltas above threshold). Operator explicit `--gates` flag still
 wins over the brief signal — if the operator passes `--gates open` on
 the command line while `phase_signal_result.effort == 'high'`, the
-flag takes precedence and the override is logged to
-`${CLAUDE_PLUGIN_DATA}/trekexecute-stats.jsonl` as
-`{event: 'gates_mode_flag_override', flag: 'open', signal_effort: 'high'}`.
+flag takes precedence and the override is logged:
+
+```bash
+node ${CLAUDE_PLUGIN_ROOT}/lib/stats/event-emit.mjs \
+  --event gates_mode_flag_override --payload '{"flag":"--gates","signal_effort":"high"}'
+```
+
+The record lands in `trekexecute-stats.jsonl` in the plugin data directory as
+`{ts, event, known_event, payload:{flag, signal_effort}}`. The two payload keys
+stay in the jsonl; the OTel export allowlist drops them by omission.
 
 Standard effort (or absent): use `gates_mode = 'adaptive'` (the
 default). Low effort: `gates_mode = 'open'` plus sequential-only