SDLC control plane routes on asserted facts, not read facts (consolidates 51 self-filed pipeline issues)

[valorengels]

Plan: https://github.com/tomcounsell/ai/blob/main/docs/plans/sdlc-control-plane-asserted-facts.md

Context for the stranger: this repo's SDLC pipeline takes a GitHub issue from idea to merged code through staged skills (ISSUE → PLAN → CRITIQUE → BUILD → TEST → REVIEW → DOCS → MERGE), dispatched to child agents and tracked in a Redis-backed ledger. This issue consolidates 51 separate issues the pipeline filed about its own control plane between 2026-06-11 and 2026-08-28. It replaces them.

The signal

The pipeline routes on facts it asserts, not facts it reads.

At every decision point — which lane am I, what stage am I in, did that gate pass, what did that stage do — the pipeline consults a value it minted earlier or a report a child handed it, when the ground truth (git, the branch, the ledger, the filesystem) is one command away. Every one of the 51 issues is an instance of that substitution, and it fails open in every direction: an unverified thing gets recorded as verified, and downstream stages route on it.

That is why the class regenerates. Each issue patches one asserted fact. The next lane asserts a different one.

The four shapes, each with a citable incident

1. Gates that are structurally incapable of firing.
On 2026-08-07, three independent gates in unrelated subsystems were each found reporting success while unable to detect the failure they existed to catch (#2658): a Verification-table sed row whose BRE address matched nothing on macOS yet printed its expected output and passed; an AST recurrence guard whose matcher matched zero call sites; a skill self-check that could not fail. Three same-day instances is a population property, not three bugs. Related: critique_cycle_count never increments, so the plan/critique loop has no cap (#2885); a registry probe counts an entry with a missing callable: key as resolved (#3038); the verification runner compares an expectation to an exit code rather than stdout, false-FAILing every prints N row (#2791).

No gate in this repo is required to demonstrate red before it is trusted green.

2. Stage reports that contradict the branch.
On 2026-08-10 (#2701), a BUILD child halted for lack of the Task tool, spawned a nested build agent carrying the same directive, and that nested agent wrote six commits to session/ask-me-telegram-polls (tip 80dcae8e9) outside its supervisor's loop. The supervisor's final report stated the branch had zero production commits (#3030, #2715). The pipeline then made routing decisions on that report. Nothing reconciles a stage report against the branch it claims to describe — git log on the named branch settles it in one command. Same shape: a forked /do-plan-critique silently degrades to a single reasoner while reporting a full roster, because a context: fork skill invoked from inside a subagent does not get the Agent tool (#3024, #2886, roster ran serially in 6/6 rounds).

3. Lane identity minted once, wrong, with no repair path.
sdlc-tool session-ensure mints sdlc-N at lane start, before /do-plan names the lane. On issue #2708 the recorded slug became sdlc-2708 while the real branch was session/job-expectations-obligation-primitive. resolve_lane_slug treats the recorded value as authoritative and never re-derives; adopt_lane_slug is conditional-on-empty. A recorded-but-wrong slug is permanently authoritative (#2816). This recurred one day after PR #2792 closed the same class via a different cause (#2718/#2735/#2793) — a patched instance, not a fixed root. Same shape: SDLC_ISSUE_NUMBER goes stale within a long-lived dev session and silently points downstream stages at the wrong issue (#2849); the issue lock is not repo-scoped, so two repos sharing an issue number collide (#2813); current_stage can never return PATCH because SDLC_STAGES omits it, so slugged PATCH sessions resolve to main with no worktree (#3017).

4. The pipeline's own definition is not single-source.
agent/pipeline_graph.py presents itself as canonical. A repo-wide sweep found 7 hardcoded code duplicates, ~30 prose restatements, 4 disagreeing stage-model tables, and only 2 clean importers. The duplicates have drifted and two carry live defects (#2491). validate_build.py carries two more private plan-document grammars (#2870).

Corroborating detail found during consolidation: 12 of these 51 issues link a docs/plans/*.md that does not exist on disk. #2870 links docs/plans/foo.md. The pipeline records plan references without checking the referent — the same asserted-fact failure, applied to its own paperwork.

Desired outcome

Not 51 patches. One property: a fact the pipeline routes on must be readable from ground truth at the moment it is used, or it must not be routed on.

Concretely, that means at minimum:

• A gate must demonstrate red before it counts as green. An undemonstrated gate is an unverified gate.
• A stage report is a claim until reconciled against the branch/ledger it describes.
• Lane identity is derived from the branch/worktree that exists, not from a value minted before one did.
• The pipeline graph has one definition and every consumer imports it.

Ownership of the closed issues

The 51 issues listed below are closed as consolidated into this one. Their bodies remain readable on GitHub; the incident detail above is drawn from them and nothing load-bearing was dropped. Plan documents already written for members of this set stay on disk and remain valid input.

• Durable per-project SDLC state artifact that survives restarts #1629 Durable per-project SDLC state artifact that survives restarts
• Router-level DOCS-skip for doc-free trivial PRs #1799 Router-level DOCS-skip for doc-free trivial PRs
• do-sdlc: consumer repos without docs/sdlc/*.md context files force manual verdict/marker backfill #2419 do-sdlc: consumer repos without docs/sdlc/*.md context files force manual verdict/marker backfill
• SDLC skills: treat a reported metric as a claim until reproduced #2465 SDLC skills: treat a reported metric as a claim until reproduced
• Pipeline graph is not a single source of truth: 7 hardcoded duplicates, 4 disagreeing stage-model tables, circular doc authority #2491 Pipeline graph is not a single source of truth: 7 hardcoded duplicates, 4 disagreeing stage-model tables, circular doc authority
• Reliability risk: SDLC issue-lock — a single renewal stamp makes a dead run read live for up to 1200s, short-circuiting the pid check #2648 Reliability risk: SDLC issue-lock — a single renewal stamp makes a dead run read live for up to 1200s, short-circuiting the pid check
• Plan-doc writes in the shared main checkout have no single-writer protocol #2650 Plan-doc writes in the shared main checkout have no single-writer protocol
• Reliability risk: SDLC gate G7 — revision_applied means 'a revision ran', not 'blockers are resolved' #2654 Reliability risk: SDLC gate G7 — revision_applied means 'a revision ran', not 'blockers are resolved'
• Reliability risk: /do-sdlc — supervisor fork gets one turn and does not chain stages, so every transition needs an external nudge #2657 Reliability risk: /do-sdlc — supervisor fork gets one turn and does not chain stages, so every transition needs an external nudge
• Gates that cannot fire: require demonstrated-red for verification rows, guards, and skill self-checks #2658 Gates that cannot fire: require demonstrated-red for verification rows, guards, and skill self-checks
• Schedule the sdlc-local ledger orphan reaper (nothing invokes --kill-orphans) #2677 Schedule the sdlc-local ledger orphan reaper (nothing invokes --kill-orphans)
• Dead lease helpers in tools/_sdlc_utils.py: renew_issue_lock_for_session and check_run_ownership have no production callers #2690 Dead lease helpers in tools/_sdlc_utils.py: renew_issue_lock_for_session and check_run_ownership have no production callers
• Make SDLC pipeline ownership observable instead of lock-enforced (self-owned lock hard-blocks resumed runs) #2704 Make SDLC pipeline ownership observable instead of lock-enforced (self-owned lock hard-blocks resumed runs)
• Escalate two-pole gate proofs from critique-time advisory to build-time and hook enforcement #2709 Escalate two-pole gate proofs from critique-time advisory to build-time and hook enforcement
• /do-build mandates the Task tool but nothing checks the dispatched session has it — four silent no-op builds, then an unsupervised nested agent wrote six commits #2715 /do-build mandates the Task tool but nothing checks the dispatched session has it — four silent no-op builds, then an unsupervised nested agent wrote six commits
• SDLC gates: distinguish exit 127 (entry point missing) from a real non-zero gate verdict #2749 SDLC gates: distinguish exit 127 (entry point missing) from a real non-zero gate verdict
• Lease-helper AST sweep misses nested module-level imports (try/if-wrapped, relative) #2762 Lease-helper AST sweep misses nested module-level imports (try/if-wrapped, relative)
• Reliability risk: SDLC session ensure — six lease heartbeats spawned on March-closed issues under an off-pin interpreter, with no spawn-side terminal-issue guard #2781 Reliability risk: SDLC session ensure — six lease heartbeats spawned on March-closed issues under an off-pin interpreter, with no spawn-side terminal-issue guard
• Drop the --blockers / --tech-debt aliases from sdlc-tool verdict finalize once every machine has run /update #2789 Drop the --blockers / --tech-debt aliases from sdlc-tool verdict finalize once every machine has run /update
• verification_parser runner false-FAILs every 'prints N' row: compares expectation to exit code, not stdout #2791 verification_parser runner false-FAILs every 'prints N' row: compares expectation to exit code, not stdout
• The _run_identities anchor has a silent bootstrap hole: pre-#2803 lanes and first-lapse lanes still re-mint #2811 The _run_identities anchor has a silent bootstrap hole: pre-Anchor run-identity history on the ledger so a re-ensure rebinds instead of re-minting #2803 lanes and first-lapse lanes still re-mint
• Ledger stage history for #2675 went empty mid-lane after the AgentSession was recreated #2812 Ledger stage history for do-sdlc Step 3d.6 continuity re-ensure mints a new run_id after lease lapse, recreating the ledger anchor and wiping stage markers #2675 went empty mid-lane after the AgentSession was recreated
• SDLC issue lock and session lookup are not repo-scoped, so two repos sharing an issue number collide #2813 SDLC issue lock and session lookup are not repo-scoped, so two repos sharing an issue number collide
• session-ensure mints sdlc-N before /do-plan names the lane, so the recorded slug is permanently wrong #2816 session-ensure mints sdlc-N before /do-plan names the lane, so the recorded slug is permanently wrong
• Six unit tests phantom-fail with RUN_ID_REQUIRED/LEASE_ABSENT from a scratch worktree: resolve_project_key(cwd) misses every projects.json path and silently disables the run-id self-heal #2820 Six unit tests phantom-fail with RUN_ID_REQUIRED/LEASE_ABSENT from a scratch worktree: resolve_project_key(cwd) misses every projects.json path and silently disables the run-id self-heal
• Concerns-scoped re-critique pass with a mechanical escalation trigger #2828 Concerns-scoped re-critique pass with a mechanical escalation trigger
• Critique run dirs lose their _roster.json/.plan_hash mid-run, silently defeating the war-room roster barrier #2832 Critique run dirs lose their _roster.json/.plan_hash mid-run, silently defeating the war-room roster barrier
• SDLC_ISSUE_NUMBER goes stale within a long-lived dev session, silently pointing downstream stages at the wrong issue #2849 SDLC_ISSUE_NUMBER goes stale within a long-lived dev session, silently pointing downstream stages at the wrong issue
• CHANGES REQUESTED review verdicts record no head_sha, leaving the PATCH<->REVIEW lap with no staleness anchor #2850 CHANGES REQUESTED review verdicts record no head_sha, leaving the PATCH<->REVIEW lap with no staleness anchor
• Deterministic candidate ordering in _gh_pr_search_issue_ref: 'first body-validating candidate' rests on unguaranteed gh ranking #2868 Deterministic candidate ordering in _gh_pr_search_issue_ref: 'first body-validating candidate' rests on unguaranteed gh ranking
• Lane slug adoption is not universal: a minted sdlc-N slug names a branch that does not exist #2869 Lane slug adoption is not universal: a minted sdlc-N slug names a branch that does not exist
• validate_build.py carries two more private plan-document grammars: parse_file_assertions and parse_success_criteria_commands #2870 validate_build.py carries two more private plan-document grammars: parse_file_assertions and parse_success_criteria_commands
• critique_cycle_count never increments: the plan/critique loop has no automatic cap #2885 critique_cycle_count never increments: the plan/critique loop has no automatic cap
• do-plan-critique roster lenses ran serially in 6/6 rounds: a context:fork skill invoked from inside a subagent does not get the Agent tool #2886 do-plan-critique roster lenses ran serially in 6/6 rounds: a context:fork skill invoked from inside a subagent does not get the Agent tool
• Unreproduced: G6 fast-pathed a head-stale APPROVED verdict; shared staleness seam has a fail-open branch #2895 Unreproduced: G6 fast-pathed a head-stale APPROVED verdict; shared staleness seam has a fail-open branch
• Verification runner: 120s bound, BRE alternation lost to cell escaping, and an expectation vocabulary narrower than the plans it grades #2901 Verification runner: 120s bound, BRE alternation lost to cell escaping, and an expectation vocabulary narrower than the plans it grades
• Reliability risk: SDLC stall detector — lane flagged stalled on the age of a commit its own pipeline pass produced #2926 Reliability risk: SDLC stall detector — lane flagged stalled on the age of a commit its own pipeline pass produced
• skills-audit files one issue per rule: a single skill regression fans out into N issues #2937 skills-audit files one issue per rule: a single skill regression fans out into N issues
• SDLC debt-tithe: make each pipeline run net-reduce codebase bloat #2959 SDLC debt-tithe: make each pipeline run net-reduce codebase bloat
• Three unbuilt plans carry line-anchored references into the #2879 split monoliths #3013 Three unbuilt plans carry line-anchored references into the Split the largest test files into per-class modules #2879 split monoliths
• current_stage can never return PATCH: SDLC_STAGES omits it, so slugged PATCH sessions resolve to main with no worktree #3017 current_stage can never return PATCH: SDLC_STAGES omits it, so slugged PATCH sessions resolve to main with no worktree
• Plan verification rows can write production state: a bare command that defaults to a real path #3020 Plan verification rows can write production state: a bare command that defaults to a real path
• Verification-table parser executes non-check tables and reads the wrong column as the command #3022 Verification-table parser executes non-check tables and reads the wrong column as the command
• Forked /do-plan-critique silently degrades to a single reasoner — roster independence is never met #3024 Forked /do-plan-critique silently degrades to a single reasoner — roster independence is never met
• sdlc-tool dispatch reset wipes routing evidence, not just the G4 counter — sends revised plans back to /do-plan #3025 sdlc-tool dispatch reset wipes routing evidence, not just the G4 counter — sends revised plans back to /do-plan
• Supervisor stage reports can contradict the branch: a nested build agent wrote six commits the supervisor reported as zero #3030 Supervisor stage reports can contradict the branch: a nested build agent wrote six commits the supervisor reported as zero
• Reliability risk: SDLC router — open-PR lane routed back to /do-plan-critique (docs checkbox tick stales verdict; G3 misses router-selected rows) #3036 Reliability risk: SDLC router — open-PR lane routed back to /do-plan-critique (docs checkbox tick stales verdict; G3 misses router-selected rows)
• Eviction tests pin the function, not its call site in _ledger_less_merged_pr #3037 Eviction tests pin the function, not its call site in _ledger_less_merged_pr
• Registry probe counts an entry with a missing callable: key as resolved #3038 Registry probe counts an entry with a missing callable: key as resolved
• plan_checkbox_writer returns MATCH_NOT_FOUND for any criterion whose text wraps across lines #3039 plan_checkbox_writer returns MATCH_NOT_FOUND for any criterion whose text wraps across lines
• Legacy-artifact guard: exemption entries rot silently when a retainer is deleted #3052 Legacy-artifact guard: exemption entries rot silently when a retainer is deleted

Recon Summary

Performed 2026-09-03 against main @ 00a3d93ca, scoping the residual after the
2026-09-02/03 seven-lane batch (supervisor report, comment 5521519215). Every claim below
was re-read in the source at the cited file:line; four were executed against main to
observe behavior rather than infer it.

Confirmed:

• Three defects from this consolidation are already fixed on main and are out of residual
  scope: critique cycle cap (bfa4a6f7d), crashed-PLAN NO_RULE (d9cf29dd6), crashed-PATCH
  row 8g (3c689f211). All three verified present in git log with their tests.
• Wrong recorded lane slug is unrepairable, and the G8 probe converts it into a forced
  /do-patch. resolve_lane_slug (tools/lane_identity.py:488-548) returns the recorded
  slug unconditionally at rung 1 (:535-538) and allow_heal defaults to False;
  adopt_lane_slug (:436-480) is conditional-on-empty via _record_slug_if_empty. No path
  re-derives from the real branch; the module docstring concedes this at :37-39. In
  tools/sdlc_next_skill.py, _check_branch_pushed (:181-198) cannot distinguish a
  wrong-but-present slug from a genuinely missing branch, so :355-361 emits
  stage_artifacts_verified: False and guard_g8_artifact_verification
  (agent/sdlc_router.py:550-600, listed at GUARDS:1071 ahead of G7/G5/G6) dispatches
  /do-patch on an OPEN approved PR.
• G3 never sees the row the table would return. guard_g3_pr_lock
  (agent/sdlc_router.py:469-488) reads only context["proposed_skill"] and
  meta["last_dispatched_skill"]; guards run to completion at :2246-2248 before the table
  at :2250-2255, and there is no post-table re-validation. agent/session_runner/runner.py:1408
  calls decide_next_dispatch(stage_states, meta) with no context at all, so proposed is
  always "" on that path.
• G3's redirect ladder has no /do-docs branch. :501-509 has exactly three arms
  (/do-merge, /do-patch, else /do-pr-review). REVIEW completed + APPROVED + DOCS pending
  falls to the else arm. Arm 1 also keys on the REVIEW marker, not on a recorded APPROVED
  verdict, making it weaker than rows 9/10 (:1956, :1970).
• Row 2b preempts DOCS unconditionally on a shipped lane. _rule_critique_verdict_stale
  (:1568-1592) → _critique_verdict_is_stale (:1431) reduces to a timestamp compare
  (:1531-1563) and reads neither pr_number, nor REVIEW/DOCS, nor any review verdict
  (grep-confirmed over :1431-1592). Row 2b sits at :2050-2055; row 9 (/do-docs) is at
  :2181-2186, fifteen rows later. Every guard steps aside in that state.
• Four distinct verification runner/parser defects, all reproduced by execution on main:
  (a) run_checks(timeout=120) (agent/verification_parser.py:387-392) renders a timeout as
  [FAIL] with no TIMEOUT status (:423-432, :499), while scripts/validate_build.py:238
  hardcodes timeout=30 and emits SKIP (:260-263) — the two runners disagree on the same
  event; (b) evaluate_expectation (:304-384) supports exactly six forms and returns False
  at :384 for everything else, so prints `0`, >= 1, == 0, and empty output all
  silently false-FAIL and are indistinguishable from real failures; (c) command = cells[1].strip("") (:286-288) strips backticks only, so trailing prose after an em-dash is executed as part of the shell command; (d) BRE/ERE escape guidance exists in agent/verification_parser.py:60-68anddocs/features/machine-readable-dod.md:118-139butgrep -rn "grep -E|BRE|ERE|alternation" .claude/skills-global/` returns zero verification
  hits, so it is absent from the surface that generates rows.
• Plan prose cannot gate merge. The merge decision reads exactly four inputs
  (_rule_ready_to_merge, agent/sdlc_router.py:1962-1978) plus G6's six
  (:910-957); tools/merge_predicate.py has zero occurrences of plan or docs/plans.
  A plan document can declare exactly three machine-read keys today — tracking:
  (tools/lane_identity.py:165-168), revision_applied: and revision_applied_at:
  (tools/sdlc_stage_query.py:438-500) — each via a hand-rolled single-key regex. There is no
  generic frontmatter parser. status:, type:, appetite:, owner:, slug:, covers: are
  read by no code.
• next-skill persisting nothing is intentional and documented
  (tools/sdlc_next_skill.py:63-69, :88-89, :739-748;
  .claude/skills-global/do-sdlc/SKILL.md:299-303). The residual exposure is that compliance is
  prose-enforced: nothing degrades if the caller skips sdlc-tool dispatch record, and the
  consequence surfaces much later as a G4 oscillation block attributed to the wrong cause.
• session-ensure destroys live leases, both halves confirmed (comment 5521461151).
  tools/sdlc_session_ensure.py:613-620 discards the handle it just saved (:589-595) and
  re-queries by session_id, which is a plain Field() and not the primary key
  (models/agent_session.py:156-157); Popoto resolves that filter by SMEMBERS
  (popoto/models/query.py:1326,1345), so fresh_rows[0] is unordered and session_id is
  explicitly non-unique (models/agent_session.py:132). Separately, candidate (:538-540)
  carries no provenance flag distinguishing mint from adopt — reuse_run_id cannot serve as one
  because it is overwritten at :526 — so the compare-and-delete in release_issue_lock
  (models/session_lifecycle.py:1484-1520) matches by construction on an adopted id and deletes
  a lease this call never created.

Revised:

• Open finding 4 ("NO_RULE with CRITIQUE APPROVED+completed and BUILD in_progress, no PR")
  is falsified as stated. _rule_branch_exists_no_pr (row 5, agent/sdlc_router.py:1320-1325)
  returns True for exactly that state and dispatches /do-build; rows 4a/4b/4c step aside
  because they require BUILD in (None, pending, ready), so row 5 is reached in order. The
  build_status == STATUS_IN_PROGRESS clause has been present since c1e991972, so there is no
  crashed-BUILD gap analogous to PLAN or PATCH. The observed NO_RULE therefore came from a state
  other than the one reported. The actionable residual is observability, not routing: a
  NO_RULE blocked payload does not carry the stage_states/meta it decided on, so the field
  report could not be checked against ground truth — itself an instance of this issue's property.
• The G3 escape (finding 6) is narrower than reported. G3 does still trip without a
  --proposed-skill when last_dispatched_skill is itself a plan-family skill. The real hole is
  PR open + last dispatch was a PR-stage skill (/do-pr-review, /do-patch, /do-docs) + no
  proposed_skill. Pre-existing write-up:
  docs/archive/plans-completed/sdlc-router-rereview-crash-and-row3-pr-guard.md:38-39.
• verification_parser runner false-FAILs every 'prints N' row: compares expectation to exit code, not stdout #2791 and Verification-table parser executes non-check tables and reads the wrong column as the command #3022 were closed into this consolidation with no fix commit. verification_parser runner false-FAILs every 'prints N' row: compares expectation to exit code, not stdout #2791's named
  mechanism is genuinely gone (scripts/validate_build.py:243-245 now delegates to
  evaluate_expectation, converged in 05a444b1b/Converge verification-table parsing and expectation evaluation #2871) but its symptom survives. Verification-table parser executes non-check tables and reads the wrong column as the command #3022 is
  entirely unfixed: _is_check_table_header (:178-183) is still name-based and position-blind,
  and the issue's exact table shape still gets its "Observed stdout" column executed as a shell
  command with no SkippedTable diagnostic. Per-block table scoping (_iter_pipe_blocks:156)
  was fixed for parse_verification_table merges any second table in ## Verification into the executable checks, unconditionally failing the gate #2836 and is correct; classification and column selection are not.

Pre-requisites:

• None external. All work is inside this repo, needs no new secret, service, or dependency, and
  touches no Popoto schema.
• Test coverage gaps to close alongside the fixes: no test exists for an em-dash/trailing-prose
  command cell, for run_checks timeout handling, or for the Verification-table parser executes non-check tables and reads the wrong column as the command #3022 header shape.
  tests/fixtures/verification/runner_agreement.md asserts per-check parity between the two
  runners but contains no timeout row, which is why the FAIL-vs-SKIP divergence survives it.
  tests/unit/test_verification_parser.py:210 currently asserts the unknown-expectation
  fall-through as intended behavior and must be revised, not merely extended.

Dropped:

• Re-planning the three already-hotfixed defects (bfa4a6f7d, d9cf29dd6, 3c689f211).
• A "crashed BUILD" routing row, per the Revised bucket above: row 5 already owns that state.
• Re-litigating next-skill's non-persistence as a defect. It is a deliberate, documented
  contract; only the silent-non-compliance exposure is residual.

[valorengels]

Instance: PLAN stuck at in_progress with no plan doc → Blocked('no matching dispatch rule')

Hit on lane #2771 (2026-09-02). Same asserted-vs-read-facts shape this issue consolidates.

State: PLAN: in_progress, plan_exists: false, no session/sdlc-2771 branch, no plan doc, no PR, one recorded /do-plan dispatch. A prior /do-plan dispatch marked PLAN in_progress and died before writing anything.

Router verdict: {"blocked": true, "decision": "blocked", "reason": "no matching dispatch rule", "guard_id": "NO_RULE"}

Gap: agent/sdlc_router.py::_rule_no_plan (row 1) treats "no plan exists" as PLAN in (None, "pending"), plus a bootstrap case for PLAN == "ready" and not plan_exists. It does not cover PLAN == "in_progress" and not plan_exists. Rows 2c (_rule_critique_in_progress_no_verdict, #1668) and 8c (_rule_review_in_progress_no_verdict) exist for exactly this dead-end at the CRITIQUE and REVIEW stages; PLAN has no analogue.

No sanctioned manual recovery. sdlc-tool stage-marker --status accepts only {in_progress, completed, skipped} — there is no way to walk a stale in_progress back to pending, and skipped is semantically wrong (the pipeline did dispatch the stage). So the lane is unrecoverable without a code change.

Suggested fix: extend row 1's predicate to plan_status == "in_progress" and meta["issue_number"] and not meta["plan_exists"], mirroring the existing "ready" bootstrap branch. It is naturally loop-bounded by G4 oscillation, same as 2c/8c.

Lane #2771 is stopped pending this; its run lease has been released.

[valorengels]

Same class of problem, filed separately: #3075

Filed #3075 — the nightly-triage equivalent of what this issue consolidates for the SDLC pipeline: an automated agent generating tracker noise at scale. The 2026-08-24 incident produced a 39-issue flood from two root causes, and the dedup contract still re-files nodes whose issues were closed as duplicates.

Cross-referencing because a fix that generalizes across both is better than two bespoke ones. #3075's planner is instructed to read this issue first and reuse its consolidation mechanism if it generalizes.

[valorengels]

Live corroboration of #2885 from 2026-09-02

Observed during a seven-lane parallel SDLC batch, on issue #2701's lane. Recording it here rather than filing a new issue, since #2885 (critique_cycle_count never increments) is in this issue's closed set.

The guard did not fire, and the only thing that stopped the loop was a subagent's judgment.

/do-plan-critique ran nine cycles on docs/plans/ask-me-telegram-polls.md (five revise rounds) while _meta.critique_cycle_count remained at 0. MAX_CRITIQUE_CYCLES = 2 therefore never tripped. Cycle 9 reopened a finding that cycle 8 had already settled — oscillation rather than convergence — and the lane halted only because the skill judged it was oscillating. Nothing structural would have stopped it.

This is a clean instance of shape 1 in this issue's taxonomy ("gates that are structurally incapable of firing"), with two details worth adding to the record:

1. The cap's failure is unbounded, not off-by-one. A counter stuck at 0 does not permit MAX + 1 cycles; it permits infinitely many. The nine cycles are a lower bound set by when a human-supervised agent happened to intervene.

2. The cost is not just wasted cycles. Nine rounds of critique on one plan produced 5 revision commits and 4 critique-findings commits on main, all in a shared checkout where other lanes were concurrently committing their own plan revisions. The loop's cost scales into cross-lane contention, not only into tokens.

Cross-referencing #2650 ("plan-doc writes in the shared main checkout have no single-writer protocol"), also in this closed set, which was independently reproduced in the same batch: one lane's unscoped git add swept 225 lines of another lane's in-progress plan file into three of its own commits (edf037b5b, 6b734b008, 80a5042fa), plus 20 lines of a third lane's plan. Nothing was lost, but the work is misattributed under the wrong issue trailers. Two members of this consolidated set reproducing within one batch is the "class regenerates" property this issue describes.

Separately filed as its own issue because it is a missing state transition rather than a routing-discipline problem: #3078, a crashed stage subagent wedges the lane because no marker status means "started, did not finish" and the router returns blocked / NO_RULE. Fold it in here if you consider it in scope.

[valorengels]

Instance: G3 redirects to /do-patch on a verdict that predates the commit resolving it

Hit on lane #2771 / PR #3083 (2026-09-02 → 09-03). Recording here rather than filing separately, per this issue's consolidation. Two distinct router behaviors, same asserted-vs-read-facts shape, and together they wedged a lane that had nothing left to do.

1. G3's redirect target is computed from a verdict nobody re-read

Sequence on the lane:

• 12:13Z — REVIEW records CHANGES REQUESTED (0 blockers, 1 tech-debt) at head 0df503a17.
• 20:50Z — PATCH lands f3804ec9b, which resolves all three findings.
• 21:51Z onward — every router call resolves to /do-patch and finds nothing to patch.

The router reads latest_review_verdict == "CHANGES REQUESTED" and routes on it. It never compares that verdict's recording time (or its head SHA) against the branch tip. latest_review_head_sha was null for the entire wedge, so the staleness comparison that would have caught this had no left-hand side to compare — the field exists, the gate reads it, and a null silently means "not stale" instead of "unknown, fail closed."

The loop is self-sustaining: /do-patch is a no-op because the work is done, a no-op PATCH records no new verdict, so the stale verdict survives to route the next call to /do-patch again. Observed same_stage_dispatch_count climbing to 2 across three consecutive no-op PATCH dispatches (9d79db2f, eed9d31f, and a third under bac0b766), heading for a G4 oscillation hard-stop on a lane whose actual state was APPROVED-ready. Ground truth was one git log away: the verdict's recorded_at is four hours older than the commit that resolved it.

Suggested property, in this issue's terms: a verdict is routable only while the head it was recorded against is still the head. A null head_sha on a recorded verdict should fail closed (treat as stale, route to re-review), never fail open.

2. Bare next-skill routes an open-PR lane backward to /do-plan-critique

Independent of the above, and worth separating because it bites the documented minimal invocation.

sdlc-tool next-skill with no --proposed-skill returned /do-plan-critique (row 2b, "critique verdict is stale") for a lane with an open, CI-green PR at BUILD-complete. The G3 PR-lock guard — which exists precisely to stop plan-stage dispatch on a shipped PR — only fired once --proposed-skill /do-plan-critique was supplied on a second call.

So the guard is not evaluated on the primary path. A caller following the minimal documented invocation gets routed backward into a plan stage on a lane with a live PR, and only a caller who already guessed the answer and offered it for validation sees the guard fire. That inverts the intended relationship: the guard should constrain the proposal, not require one.

Disposition

Lane #2771 was unwedged manually: /do-pr-review dispatched directly at the resolved head f3804ec9b (via tools/pr_head_resolver.py::resolve_pr_head_sha), verdict re-recorded as APPROVED, sdlc-tool verdict finalize confirming trailer_matches_head: true and marker_completed: true. No router fix made — deliberately left for this issue's owner.

[valorengels]

Corroboration: the G3 stale-verdict loop reproduced on a second, unrelated lane

Follow-up to my comment above. The same wedge hit lane nightly-autonomous-fix-before-alert (issue #2334, PR #3082) on the same night, with no shared code between the two lanes. That upgrades it from a one-lane fluke to a router property.

Identical fingerprint on both lanes:

	#2771 / PR #3083	#2334 / PR #3082
REVIEW verdict recorded	12:13Z CHANGES REQUESTED	12:14Z CHANGES REQUESTED
latest_review_head_sha	null	null
Commits landing the fix, after the verdict	1 (f3804ec9b, 20:50Z)	5 (through 6ae865401)
Unconfirmed same-stage dispatches	3 × /do-patch	3 × /do-patch
same_stage_dispatch_count at intervention	2	2
Router decision on every call	/do-patch, no-op	/do-patch, no-op

Both lanes converged on same_stage_dispatch_count == 2 and were one dispatch from a G4 oscillation hard-stop, while their actual state was APPROVED-ready. On #2334 the re-review at the current head returned 0 blockers and 0 carried tech-debt — both prior blockers and all three tech-debt items had been fixed hours earlier by commit daa1dc737. The router had been routing /do-patch at a lane with nothing to patch, on the strength of a verdict recorded five commits back.

Two details this second instance adds:

The null head_sha is doing the damage, not the verdict text. On both lanes the staleness comparison had no left-hand side, so "unknown" silently evaluated as "not stale." A recorded verdict with a null head_sha should fail closed and route to re-review. Once sdlc-tool verdict finalize populated the field (trailer_matches_head: true on both lanes), the loop broke immediately and both lanes advanced to DOCS on the next read.

The unconfirmed dispatch is the amplifier. Each interrupted run recorded a /do-patch dispatch and died before confirming it. An unconfirmed dispatch leaves no verdict behind, so the stale verdict survives to route the next call to the same stage — the loop is self-sustaining precisely because the thing that would break it (a completed stage recording a fresh verdict) is what keeps failing to complete. Three interruptions on #2334 produced three unconfirmed /do-patch records and zero progress, while real uncommitted work sat in the lane worktree unnoticed.

Both lanes were unwedged the same way: resolve the head via tools/pr_head_resolver.py::resolve_pr_head_sha, dispatch /do-pr-review directly at that head, verdict finalize to populate the trailer. No router code changed on either lane — still left for this issue's owner.

[valorengels]

New instance observed 2026-09-03, lane sdlc-2771 (PR #3083). Two coupled defects that together destroy a live run lease. Both are "routes on asserted facts, not read facts" in the sense this issue names: the code asserts session_id identifies one row, and asserts a failing ensure owns the candidate it is releasing.

1. session_id is not unique, so the post-save readback is a coin flip

AgentSession's compound primary key includes agent_session_id, so two ensure calls for the same session_id create two distinct rows:

row: session_id='sdlc-local-2771' agent_session_id='645808c270d746629fbe3de4ea8bdfcb' created=2026-09-02 05:46:17  active_run_id='03769d4bcf4a43c191277c2691b61bc5'
row: session_id='sdlc-local-2771' agent_session_id='35030743e2aa42ca893781d0d7e8938f' created=2026-09-03 03:50:25  active_run_id=None

tools/sdlc_session_ensure.py:617-619 does:

fresh_rows = list(AgentSession.query.filter(session_id=session_id))
fresh = fresh_rows[0] if fresh_rows else None
readback_run_id = getattr(fresh, "active_run_id", None)

The index is a Redis SET, so fresh_rows[0] is unordered. Two consecutive queries in the same session returned the two rows in opposite order. The bind at :597 writes one object; the readback at :617 reads a randomly chosen one; when they differ, :635 fails with post-save readback mismatch.

Observed rate, six consecutive invocations:

$ for i in 1 2 3 4 5 6; do sdlc-tool session-ensure --issue-number 2771; done
{"error": "RUN_BIND_FAILED", "reason": "post-save readback mismatch", "session_id": "sdlc-local-2771"}
{"error": "RUN_BIND_FAILED", "reason": "post-save readback mismatch", "session_id": "sdlc-local-2771"}
{"session_id": "sdlc-local-2771", "created": false, "run_id": "6d3ea1d0e8de45be96f5e3e96b33d755"}
{"session_id": "sdlc-local-2771", "created": false, "run_id": "6d3ea1d0e8de45be96f5e3e96b33d755"}
{"error": "RUN_BIND_FAILED", "reason": "post-save readback mismatch", "session_id": "sdlc-local-2771"}
{"error": "RUN_BIND_FAILED", "reason": "post-save readback mismatch", "session_id": "sdlc-local-2771"}

Roughly 50/50, matching a two-row coin flip. This is a hard wedge for any lane whose session row got duplicated — every state-mutating call (stage-marker, verdict, meta-set) needs a run_id and half of the attempts to get one fail.

2. A losing ensure releases the previous winner's lease

Note attempts 3 and 4 return the same run_id — a second ensure under a held lock adopts the existing lock's run_id as its candidate rather than minting a new one. Attempts 5 and 6 then adopted 6d3ea1d0... too, lost the coin flip, and ran the mismatch cleanup at sdlc_session_ensure.py:636:

release_issue_lock(issue_number, candidate)

models/session_lifecycle.py:1484 is a correct compare-and-delete — but the candidate it is comparing is the live holder's id, so the compare matches and the lock is deleted. The compare-and-delete's stated protection ("a delayed cleanup can therefore never delete a successor's freshly acquired lock", :1489) does not hold when the candidate was adopted rather than minted.

Confirmed by the next call:

$ sdlc-tool stage-marker --stage DOCS --status in_progress --issue-number 2771 --run-id 6d3ea1d0e8de45be96f5e3e96b33d755
[ERROR] LEASE_ABSENT: no live issue lease for issue #2771 owned by run_id='6d3ea1d0e8de45be96f5e3e96b33d755'; run `sdlc-tool session-ensure` first. Marker write refused.

The lease was acquired successfully and then destroyed by two subsequent read-only-intent probes.

Practical consequence

A caller cannot safely retry session-ensure. The idiom that looks obviously correct — retry until you get a run_id — is the exact idiom that revokes the run_id you already hold. The working shape is: retry until first success, then break, then use the id immediately and never call ensure again.

Suggested directions (not scoped here)

• Readback should re-read the row it wrote (by agent_session_id/pk), not re-query by session_id and index [0].
• The mismatch cleanup should only release a candidate this call minted; an adopted candidate must never be released by the adopter.
• Separately, duplicate rows per session_id are worth preventing or reconciling at the source — this lane's row was duplicated by a predecessor that died and re-ensured.

Lane sdlc-2771 worked around this by acquiring once and reusing; no data was repaired.

[valorengels]

Batch evidence: 2026-09-02/03 seven-lane upvote run (supervisor report)

Running all seven upvote lanes in parallel exercised the control plane hard. Everything below is first-hand or independently verified. Three defects were hotfixed on main during the run; the rest are open evidence for this consolidation.

Fixed during the run (commits on main)

1. Critique cycle cap was inert (was critique_cycle_count never increments: the plan/critique loop has no automatic cap #2885, closed into here): critique_cycle_count's only writer was fail_stage (never called by the skill flow), G2 stood down on CRITIQUE=completed (which the loop sets every round), and G1 preceded G2. Lanes ran 9–11 revision rounds with zero code. Fixed bfa4a6f7d: durable _revision_round_count (mirrors A "READY TO BUILD (with concerns)" critique verdict does not mandate a re-critique, so the revision that closes the concerns is never itself reviewed #2787), G2 trips on still-revising verdicts, G2 before G1.
2. Crashed PLAN stage wedged at NO_RULE (A crashed stage subagent wedges the lane: no status means 'started, did not finish', and the router has no rule for it #3078): fixed d9cf29dd6 — in_progress+no doc → re-plan; in_progress+doc → critique.
3. Crashed PATCH dispatch wedged at NO_RULE (observed on docs-auditor Telegram sender hardcodes "Eng: Valor" instead of using resolve_eng_group #2754): the dispatch record itself made the review verdict "stale", after which no row owned the state. Fixed 3c689f211 (row 8g).

Open findings

4. next-skill NO_RULE with CRITIQUE recorded APPROVED+completed and BUILD in_progress (Render /ask-me questions as native Telegram polls so a blocked agent can be unblocked with one tap #2701 lane, 2026-09-02): {"blocked": true, "reason": "no matching dispatch rule", "guard_id": "NO_RULE"} — BUILD in_progress with no PR appears to have no owning row.
5. Wrong recorded lane slug breaks G8: Nightly regression: attempt autonomous fix before paging a human (alert = last resort, not first responder) #2334's ledger held the sdlc-2334 mint fallback while the real branch was session/nightly-autonomous-fix-before-alert; G8 probed the nonexistent branch and force-dispatched /do-patch on an approved CLEAN PR. Repaired via ORM with head-SHA evidence. The docs/features/sdlc-lane-identity.md adoption rung 2 gap (session-ensure before branch exists) is the cause.
6. Row 2b escapes the PR lock when no --proposed-skill is supplied — G3 only evaluates volunteered skills, not the row the table itself would return, so an open approved PR gets /do-plan-critique. And G3's redirect ladder has no /do-docs branch: REVIEW complete + DOCS pending falls through to a redundant /do-pr-review that G4 would eventually cap without ever reaching DOCS. Nightly regression: attempt autonomous fix before paging a human (alert = last resort, not first responder) #2334's lane had to dispatch /do-docs against the router's answer (named deviation, confirmed correct by G6 afterward).
7. A stale CRITIQUE verdict permanently preempts DOCS on a shipped lane (row 2b is marker-agnostic by design, Reliability risk: sdlc router — NEEDS REVISION + revision applied has no route back to re-critique (dead-end loop on /do-plan) #1639). Consolidate the two owners of "which db popoto is on" in tests/conftest.py #2771's lane resolved it properly by re-running critique to re-stamp the artifact hash; that works but costs a full roster round to clear a bookkeeping staleness.
8. Verification-table runner/parser gaps (three independent reports): 120s subprocess cap turns slow-but-passing rows into FAIL; ≥ N / == N / empty output expectation forms unparsed; trailing prose after an em-dash breaks command cells; grep -c 'A|B' without -E in generated rows. Every "failure" was hand-verified as passing.
9. Plan-level hard gates are invisible to the merge predicate (Render /ask-me questions as native Telegram polls, and stop nudging a session past its own question #3080 incident, 2026-09-03): an owner ruling in plan prose ("FAIL and UNRESOLVED hold the PR at REVIEW") was merged past because the predicate checks only a recorded APPROVED verdict. This is the consolidation property stated in this issue's own terms: the fact routed on (mergeability) was not the fact that governed (the gate). Suggest: plans can declare machine-readable merge gates the predicate reads.

Supervisor-side counterpart of item 4 from memory: sdlc-tool next-skill never persists; ledger advancement requires a separate dispatch record call — worth folding into whatever routing redesign lands here.