docs: no user doc promises a launched session, a launch script or a fourth security layer

README claimed four security layers including scoped per-child tool
access (gone with the launched children), an auto-dispatched Phase 7.6
recovery session and a launch template; architecture.md still pointed at
launch.sh. They now describe what 6.0.0 does: session specs plus
orders.md, a recovery order for a session the user opens, three layers.
operations.md gets a status note instead of a rewrite (decision record).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -38,7 +38,7 @@ Changes to this plugin must preserve:
 | `templates/plan-template.md` | Structured plan output format |
 | `templates/research-brief-template.md` | Research brief format with triangulation and confidence |
 | `templates/spec-template.md` | Spec file format |
-| `templates/session-spec-template.md` | Session spec format for headless execution |
+| `templates/session-spec-template.md` | Session spec format for a session the user opens |
 
 The command files are the core. All logic lives in markdown.
 

README.md

@@ -66,7 +66,7 @@ A project typically has one task brief and zero-to-N research briefs.
 
 Every step in the plan ends with a YAML `manifest:` block declaring `expected_paths`, `commit_message_pattern`, `bash_syntax_check`, `forbidden_paths`, `must_contain`. The executor checks the manifest against the resulting commit — a step may not be marked passed if its manifest does not verify, regardless of the Verify command's exit code (Hard Rule 17).
 
-After all steps complete, `/trekexecute` runs **Phase 7.5 — Manifest audit (independent)**: re-verifies every expected path from git log + filesystem, ignoring the agent's own bookkeeping. Drift → status `partial`, **Phase 7.6** auto-dispatches a bounded recovery session with only the missing steps (`recovery_depth ≤ 2`). Step 0 pre-flight (`git push --dry-run`) runs inside every session sandbox before any real work — exit 77 sentinel catches sandbox push-denial before the agent wastes the whole budget.
+After all steps complete, `/trekexecute` runs **Phase 7.5 — Manifest audit (independent)**: re-verifies every expected path from git log + filesystem, ignoring the agent's own bookkeeping. Drift → status `partial`, **Phase 7.6** writes a bounded recovery order with only the missing steps (`recovery_depth ≤ 2`) for a session you open yourself, and the run stops as `partial`. Step 0 pre-flight (`git push --dry-run`) runs inside every session sandbox before any real work — exit 77 sentinel catches sandbox push-denial before the agent wastes the whole budget.
 
 No cloud dependency. No GitHub requirement. Works on **Mac, Linux, and Windows**.
 
@@ -137,9 +137,9 @@ Concrete capabilities, observable in the code — not aspirations.
 
 **Solo developer.** Plans survive across sessions; adversarial review (plan-critic + scope-guardian) catches your own tunnel vision before code is written; brief-phase forces clarity on what the task actually is. `examples/01-add-verbose-flag/` shows what good shape looks like.
 
-**Team (2–10).** Plan files are handover-ready — a colleague can pick up a project directory without re-asking "what did you mean here?". `--decompose` splits a plan into self-contained headless sessions with scoped `--allowedTools`. The plan-critic semantic rubric gives the team a shared definition of "this plan defers decisions to the executor".
+**Team (2–10).** Plan files are handover-ready — a colleague can pick up a project directory without re-asking "what did you mean here?". `--decompose` splits a plan into self-contained session specs plus `orders.md`, one starter line per session that each person runs in a session they open. The plan-critic semantic rubric gives the team a shared definition of "this plan defers decisions to the executor".
 
-**Virksomhet / regulated environment.** Defense-in-depth security across four layers (plugin hooks, prompt-level denylist, pre-execution plan scan, scoped tool access). `disableSkillShellExecution: true` recommendation for fork-ers handling untrusted briefs. No cloud dependency, no GitHub requirement. Validators are plain-Node CLIs — invocable from CI, custom hooks, or external tools, not just from voyage commands.
+**Virksomhet / regulated environment.** Defense-in-depth security across three layers (plugin hooks, prompt-level denylist, pre-execution plan scan). `disableSkillShellExecution: true` recommendation for fork-ers handling untrusted briefs. No cloud dependency, no GitHub requirement. Validators are plain-Node CLIs — invocable from CI, custom hooks, or external tools, not just from voyage commands.
 
 ## Non-goals
 
@@ -258,7 +258,7 @@ Output:
 | **Research-enriched** | `/trekplan --project <dir> --research <brief>` | Add extra research briefs beyond what is in `research/` |
 | **Foreground** | `/trekplan --project <dir> --fg` | No-op alias (foreground is default since v2.4.0) |
 | **Quick** | `/trekplan --project <dir> --quick` | No agent swarm, lightweight scan only |
-| **Decompose** | `/trekplan --decompose plan.md` | Split plan into headless session specs |
+| **Decompose** | `/trekplan --decompose plan.md` | Split plan into session specs + `orders.md` |
 | **Export** | `/trekplan --export headless plan.md` | Legacy alias for `--decompose` (the only remaining export format) |
 | **Profile** | `/trekplan --profile <name> --project <dir>` | (v4.1.0) Pin model profile; emitted as `profile:` in plan.md frontmatter. See [Profile system](#profile-system-v410). |
 
@@ -374,7 +374,7 @@ prompt-injection vector that the plugin's own hooks cannot fully mitigate
 - **No questions asked** — all recovery decisions come from the plan
 - **Progress file** — crash recovery via `{project_dir}/progress.json` (or `.trekexecute-progress-{slug}.json` for legacy plans)
 - **Scope fence enforcement** — never touches files outside the session's scope
-- **JSON summary** — machine-parseable `trekexecute_summary` block for log parsing
+- **JSON summary** — machine-parseable `trekexecute_summary` block at the end of every run
 
 ### Session titles for voyage commands (CC v2.1.94+)
 
@@ -822,7 +822,7 @@ trekplan/
 ├── agents/        23 specialized agents (all `model: opus`-pinned; per-phase model set by `--profile`)
 │                  └ 20 spawnable (1 dormant: synthesis-agent, Δ≈0) + 3 orchestrator reference docs (not spawned)
 ├── commands/      6 slash commands (trekbrief, trekresearch, trekplan, trekexecute, trekreview, trekcontinue) + trekendsession helper
-├── templates/     Frontmatter templates for brief, research, plan, session, launch
+├── templates/     Frontmatter templates for brief, research, plan, session
 ├── hooks/         8 hooks (pre-bash, pre-write, pre-agent-cap, session-title, post-bash-stats, pre-compact-flush, post-compact-flush, otel-export)
 ├── lib/           Zero-dep parsers and validators (CLI shims under lib/validators/)
 ├── tests/         comprehensive node:test suite — `npm test` is the fork-readiness gate

SECURITY.md

@@ -34,7 +34,7 @@ The plugin's security posture covers:
 | `pre-bash-executor.mjs` | `PreToolUse` for Bash | BLOCKs known-dangerous shell patterns; WARNs on suspicious ones; fails open on parse errors |
 | `pre-write-executor.mjs` | `PreToolUse` for Write | BLOCKs writes to `.git/hooks/`, `~/.ssh/`, `.env`, and other sensitive paths |
 | `pre-compact-flush.mjs` | `PreCompact` | Flushes `progress.json` from git history before compaction (P0 drift fix); read-only beyond `progress.json` |
-| `session-title.mjs` *(planned, F9)* | `UserPromptSubmit` | Sets session title `voyage:<command>:<slug>` for headless multiplexing |
+| `session-title.mjs` *(planned, F9)* | `UserPromptSubmit` | Sets session title `voyage:<command>:<slug>` for telling parallel sessions apart |
 
 All hooks are zero-dependency Node.js (`.mjs`) scripts and are designed
 to **fail open** — a hook crash never blocks the user's work. Hooks log
@@ -43,9 +43,10 @@ scope.
 
 ### Prompt-level denylist (`commands/trekexecute.md`)
 
-The execute command embeds a denylist that takes effect even in headless
-sessions where hooks may not fire. This is layer 4 of the defense-in-depth
-model and protects against plan-injected destructive commands.
+The execute command embeds a denylist that takes effect even in a session
+where a hook does not fire. This is layer 2 of the three-layer
+defense-in-depth model (README, Security hardening) and protects against
+plan-injected destructive commands.
 
 ### Validators (`lib/validators/*.mjs`)
 

docs/architecture.md

@@ -29,7 +29,7 @@ Doc-consistency test at `tests/lib/doc-consistency.test.mjs` pins agent-table co
 
 `hooks/scripts/pre-compact-flush.mjs` (PreCompact event, CC v2.1.105+) fixes the documented P0 in `docs/trekexecute-v2-observations-from-config-audit-v4.md`: keeps `progress.json` in sync with git history before context compaction so `--resume` works after long conversations. Atomic write, monotonic only, never blocks compaction.
 
-`hooks/scripts/session-title.mjs` (UserPromptSubmit, CC v2.1.94+) sets `sessionTitle` to `voyage:<command>:<slug>` for voyage-command invocations. Helps multi-session headless runs identify themselves in process lists.
+`hooks/scripts/session-title.mjs` (UserPromptSubmit, CC v2.1.94+) sets `sessionTitle` to `voyage:<command>:<slug>` for voyage-command invocations. Helps parallel sessions identify themselves in process lists.
 
 `hooks/scripts/post-bash-stats.mjs` (PostToolUse, CC v2.1.97+) appends `duration_ms` for each Bash call into `${CLAUDE_PLUGIN_DATA}/trekexecute-stats.jsonl`. Useful for finding long-running verify or checkpoint commands.
 
@@ -47,7 +47,7 @@ Doc-consistency test at `tests/lib/doc-consistency.test.mjs` pins agent-table co
 
 **Plan:** Foreground workflow (v2.4.0): Parse mode (validate brief input) → Codebase sizing → Brief review (`brief-reviewer`) → Parallel exploration (6-8 agents, spawned from main context) → Deep-dives → Synthesis (with architecture-note cross-reference if present) → Planning → Adversarial review (`plan-critic` + `scope-guardian`) → Present/refine → Handoff. With `--project`, writes to `{dir}/plan.md` and auto-detects `{dir}/architecture/overview.md` (produced by an opt-in upstream architect plugin if installed; not bundled).
 
-**Decompose:** Parse plan → Analyze step dependencies → Group into sessions → Identify parallel waves → Generate session specs + dependency graph + launch script.
+**Decompose:** Parse plan → Analyze step dependencies → Group into sessions → Identify parallel waves → Generate session specs + dependency graph + `orders.md` (one starter line per session).
 
 **Execute:** Parse plan → Security scan (Phase 2.4) → Detect Execution Strategy → Single-session (step loop) or multi-session (one wave at a time: a worktree plus a session order and starter per session; the user opens every session, and a re-run merges the wave — Voyage never starts a session) → Phase 7.5 manifest audit → Phase 7.6 bounded recovery (if partial) → Phase 8 atomically writes `progress.json` + `.session-state.local.json` (Handover 7) → Report. With `--project`, reads `{dir}/plan.md`. Phase 2.55 (pre-flight stop) and Phase 4 (entry-condition stop) also write `.session-state.local.json` so `/trekcontinue` can surface the stop and prompt for next steps.
 
@@ -119,7 +119,7 @@ Legacy paths (still work without `--project`):
 - Research briefs: `.claude/research/trekresearch-{date}-{slug}.md`
 - Plans: `.claude/plans/trekplan-{date}-{slug}.md`
 - Sessions: `.claude/trekplan-sessions/{slug}/session-*.md`
-- Launch scripts: `.claude/trekplan-sessions/{slug}/launch.sh`
+- Session orders: `.claude/trekplan-sessions/{slug}/orders.md` (`--decompose`) and `orders/` (`/trekexecute` Phase 2.6: one order per session + `wave.json`)
 - Progress: `{plan-dir}/.trekexecute-progress-{slug}.json`
 
 Stats:

docs/command-modes.md

@@ -58,7 +58,7 @@ protocol, thresholds, and the exact commands in
 | `--quick` | Plan directly (no agent swarm) |
 | `--min-brief-version <ver>` | (S18) Warn — never block — if the brief declares a version below `<ver>` (e.g. `2.2`), i.e. sidesteps framing enforcement |
 | `--export headless <plan>` | Legacy alias for `--decompose` — the only remaining export format (the `pr` / `issue` / `markdown` variants were removed; Claude reformats a plan ad-hoc on request) |
-| `--decompose <plan>` | Split plan into self-contained headless sessions |
+| `--decompose <plan>` | Split plan into self-contained session specs + `orders.md` (one starter line per session) |
 | `--gates {true\|false}` | (v3.4.0) Boolean autonomy-gate flag; present → gating on. Policy (`gates_mode`) detailed under `## Autonomy mode` in `docs/operations.md`. |
 | `--profile <name>` | (v4.1.0) Model profile for the plan phase (and others, since plan emits `profile:` to plan.md frontmatter). |
 

docs/operations.md

@@ -24,6 +24,8 @@ Three architectural options were considered for the speedup work:
 - **Path B — sequential `--no-ff` parallel waves with manifest-driven failure recovery**: CHOSEN. Ships in v3.4.0. Phase 2.6 of `/trekexecute` runs the wave executor with hardenings for plugin-in-monorepo + gitignored-state topology.
 - **Path C — hybrid (cache-warm sentinel + identical-tool parallel)**: **CLOSED 2026-05-05.** Q3 experiment measured median `cache_creation_input_tokens` = 163,903 across 3 fork-children at 186K parent context (CC v2.1.128, Sonnet 4.6). Master-plan thresholds: ≤ 1,500 POSITIVE / ≥ 3,500 NEGATIVE. Result is solidly NEGATIVE — `CLAUDE_CODE_FORK_SUBAGENT` does not preserve cache prefix across identical-tool children at our context size. Path C migration is deferred indefinitely; reassessment is appropriate when CC v2.2.xxx ships fork-cache-relevant features. Harness: `scripts/q3-cache-prefix-experiment.mjs`. Companion analyser: `lib/stats/cache-analyzer.mjs`.
 
+> **Status (6.0.0):** `/trekexecute` no longer starts wave children. Phase 2.6 prepares one wave at a time and hands each session over as an order the user runs in a session they open (CHANGELOG, 6.0.0). The Q3 harness was removed in 6.0.0 because it started the binary; its result above stands, and the script remains in git history before that tag.
+
 A revived Path C (post-v2.2.xxx) would require: (1) re-architecting tool-list to be identical across all wave children, (2) cache-telemetry analysis confirming the new fork-cache behaviour holds, (3) prompt-level deny re-enablement to compensate for tool scoping rollback.
 
 ## Profile system (`--profile`, v4.1.0)