Wave Drain

Drain chooses work; Ship delivers it. Do not create a second lifecycle, reviewer policy, evidence store, worktree manager, or landing path here.

1. Select ready work

List open issues and exclude blocked, needs-human, needs-clarification, and epic. Before selection, require explicit AC-N acceptance criteria, non-goals, and affected files/contracts. Run scripts/issue-readiness.mjs when present. Missing evidence or an unavailable issue source is unknown, so exclude the issue from this wave and record why.

Phase 0.5 — Harvest the finding spool

Before selection, inspect incidental findings left by earlier work with arbiter finding list, then use arbiter finding promote to revalidate, deduplicate, and file ready findings through the normal issue workflow. A missing or empty spool is a clean no-op.

Worker DONE reports use the FindingEntry shape from src/commands/task-note.ts; do not invent a second finding schema. graphNode and auditorHint are optional; every other field is required:

{
  "ts": "2026-06-16T00:00:00.000Z",
  "note": "duplicated retry helper",
  "kind": "dup",
  "severity": "low",
  "foundDuring": "#1404",
  "file": "src/example.ts",
  "line": 120,
  "sha": "deadbeefcafef00d",
  "graphNode": "src/example.ts#retry",
  "fingerprint": "<sha1 of kind+normalizedPath+symbol+normalizedNote>",
  "auditorHint": "code-quality"
}

2. Compose a capability train

Select at most the configured ship.train.maxChain or --wave-size, whichever is smaller. Every joined issue must satisfy the Ship affinity proof:

• same user-visible outcome;
• related owner paths or dependencies;
• compatible ordering;
• shared proof, acceptance boundary, and rollback boundary;
• no hard conflict.

Uncertain affinity seals the train. Conflicting work lands separately. Each joined issue keeps namespaced acceptance criteria, RED evidence, a commit reference, and a closing reference. An issue declaring conflicts-with:#N shares a serial lane with #N; it never enters a parallel lane.

XS/S profile (#2891): when the train's widest tier is XS or S, the proof drops owner-path overlap and dependency-relatedness in favor of disjointFiles — computed from each issue's plan manifest, never declared on --affinity. ship.train.maxChain is capped at 3 for this profile regardless of config; a Standard-tier member in the mix keeps the legacy 7-signal proof and the default cap.

Record one cumulative plan with the complete file manifest, dependency proof, acceptance criteria, non-goals, rollback, and issue-to-proof mapping. Mechanical admission checks validate the plan and finish before implementation.

3. Invoke the shared Ship contract

Start the train through the same runtime entrypoint as a single issue:

arbiter ship #A #B --tier <XS|S|Standard> --affinity '<json>'

Follow the emitted next action and advance only through:

arbiter ship --advance

Ship owns persisted treatment, TDD transitions, review policy, exact-subject evidence, recovery, PR, CI, merge, post-merge proof, issue closure, and cleanup. Never recompute its tier or reviewer panel from this skill.

Ejecting a member (#2891 AC-3): re-declare --chain without a previously-joined id to drop it — arbiter ship #A --chain #B after seeding #A,#B,#C drops #C. Ship accepts the re-declare, reports the dropped id on result.trainDecision.ejected, and re-freezes the train (clears the pinned review sha, keeps the round count) so the next review round reads the narrowed diff, not the one the ejected member widened. The ejected id's own RED receipt and commits are untouched: it keeps its evidence and opens as its own task on its own train. Manually move its Closes #N out of this train's PR body into its own before landing either train. A swap (dropping one id while adding a different new one in the same call) is refused — eject alone, or grow with --chain-add alone, never both in one call.

4. Optional parallel implementation

Under the ADR-103 carve-out, parallel writers are allowed only when every lane has a dedicated worktree, a distinct branch, and plan-manifest-disjoint file-sets. Dependency files, main-tree changes, tags, and overlapping paths remain serial. This is the owner-ratified 2026-07-10 convergence model: governed repositories produce ONE wave PR. One author owns each worktree. Each lane runs TDD and targeted checks; the integrated frozen candidate receives the single final qualification owned by Ship.

--max-parallel defaults to 1. The effective cap is min(--max-parallel, nproc - 2, wave size) so workers retain machine headroom.

Expensive same-repository gates run through arbiter check run -- <cmd> and its flock(1) mutex. The lock releases when the gate-exec supervisor is SIGKILL/OOM-killed; killing the Arbiter Node PID alone leaves that supervisor holding. Without flock(1), fail closed to --max-parallel 1. Worktrees use symlink-children plus VITE_CACHE_DIR="$PWD/.cache/vite" so their caches do not race.

Gate-wait is one deterministic foreground wait. Turn-stall is different: bound it with the watchdog sweep over real PR, issue, worktree, and DONE-report state; never poll the mutex.

Route every wave worktree through the native host and the canonical arbiter worktree prepare/check/relink helpers; do not hand-roll worktree commands.

M16 handoff-contract: subagents never own waits — a worker returns its commit, tests, residual risks, and structured evidence. The orchestrator owns integration and external waits.

Integrate lanes serially in dependency order, breaking ties by overlap computed from the REAL branch diffs with git diff --name-only main...<branch>, not the plan estimate. A conflict, missing commit, failed targeted test, or scope breach is a failure, not permission to skip proof. Close each worktree with the native host, then run arbiter worktree check to verify cleanup.

5. Qualify and land

On the frozen integrated SHA, Ship runs one independent final review with the persisted treatment's pertinent verticals. That same panel supplies an acceptance decision for every AC. Applicable MED/HIGH/CRITICAL findings block; reconcile one fix batch and invalidate stale review, acceptance, and gate evidence when source changes.

After review and all-PASS acceptance fit, push the exact candidate so CI runs the full gate. Record the CI verdict before opening or readying the PR. Completion requires the PR merged, green post-merge CI, live proof when applicable, every carried issue closed, and worktree cleanup.

Commit and push the cumulative candidate and all review/evidence artifacts for CI verification:

node scripts/ci-receipt.mjs

One PR per wave. For trunk-solo + pr-ff, use the exact-SHA watcher:

node scripts/pr-merge-watch.mjs \
  "$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
  "$(gh pr view --json number -q .number)"

Iron Law

• Iff-closure contract: an issue closes only when real-binary E2E evidence and updated-doc evidence both pass. Missing either half leaves the issue open and names the missing proof.
• RED-first branch construction: the recorded RED is bound to its test commit and must reproduce before the fix; fix-before-test ordering is not admissible evidence.
• Snapshot conflicts: regenerate, never hand-resolve. Regenerate on the integrated tree and audit the resulting file and hash changes.
• No lane integrates without TDD and targeted tests green. No full L1-per-checkpoint or pre-code review ceremony is reintroduced; Ship qualifies the frozen candidate once.

Hard stops

Stop or exclude only the affected work when an invariant fails, required evidence is missing, a material product decision is unresolved, affinity seals, or an implementation approach makes no progress. Continue independent work. Preserve product failures, test failures, environment errors, tool unavailability, timeouts, killed processes, and no-data outcomes as distinct results.

Do not add parallel qualification pipelines, forced context clearing, or mandatory handoff steps. Do not claim completion while any PR is open or CI is red.

Appendix — Cross-repo manual protocol

For a repository without Arbiter governance, use one worktree and branch per issue, then N PRs with a merge-train integration check. Serialize the repository gate directly:

flock /tmp/<repo>-gate.lock -c '<gate-cmd>'

The kernel releases the lock when the direct flock process is SIGKILL/OOM-killed. Recompute state after a Crash mid-train, honor Branch protection per PR, and recompute ordering after Exclusion instability changes the train.