iter disc.1: boss-only commits + main-as-quarantine (no branches in implement)

Two project-wide rules are now explicit across every skill:

1. Only the Boss commits. No skill agent (implementer,
   brainstormer, planner, debugger, fieldtester, docwriter,
   architect, bencher) runs `git commit`. Agents write their
   artefacts to the working tree as unstaged changes; the Boss
   inspects, decides commit shape, and commits.
2. main HEAD is sacrosanct. No actor runs `git reset` or
   `git revert` on main. Bad work stays in the working tree
   where it is still discardable via `git checkout -- <paths>`.

Implement loses the `iter/<iter_id>` branch mechanic entirely;
Phase 0 of the orchestrator-agent now does a clean-tree check
and refuses to start on a dirty tree. Per-task agent commits
are removed everywhere; reviewers operate against
`git diff HEAD` instead of `pre_task_sha..head_sha`.

Motivation: 2026-05-11 iter 23.4 stranded prep2/prep3 commits on
an iter-branch that never integrated to main, then a corrected
spec falsely claimed those commits had shipped. Branch-per-iter
+ manual-Boss-merge + iter-stacking made the strand structurally
possible. See docs/journals/2026-05-11-iter-disc.1.md for the
full per-task notes and motivation.

skills/implement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: implement
-description: Use when an implementation plan exists in docs/plans/ and is ready to execute, OR when a debug RED-test is handed off for a bugfix. Dispatches the ailang-implement-orchestrator agent, which runs the entire per-task loop (implementer phase → spec-compliance check → quality check, as sequential role-switches in its own context) on an isolated branch `iter/<iter_id>`, writes a per-iter journal + stats file, and returns a compressed end-report. The Boss reads the end-report, optionally rewrites the journal Summary section, appends one line to docs/journals/INDEX.md, and fast-forwards main to the iter branch.
+description: Use when an implementation plan exists in docs/plans/ and is ready to execute, OR when a debug RED-test is handed off for a bugfix. Dispatches the ailang-implement-orchestrator agent, which runs the entire per-task loop (implementer phase → spec-compliance check → quality check, as sequential role-switches in its own context) directly in the working tree without creating commits, writes a per-iter journal + stats file (also uncommitted), and returns a compressed end-report. The Boss reads the end-report, inspects the working tree, decides commit shape, and performs all commits.
 ---
 
 # implement — plan execution via a dedicated orchestrator-agent
@@ -14,9 +14,10 @@ ONE subagent (`ailang-implement-orchestrator`), which runs the entire
 per-task loop in its own context: implementer phase → spec-compliance
 check → quality check, per task, as sequential role-switches inside
 the orchestrator-agent itself (Claude Code does not permit nested
-subagent dispatch — see Cross-references). All commits land on a
-dedicated branch `iter/<iter_id>`. The Boss sees one ≤500-token
-end-report and a per-iter journal file on the branch.
+subagent dispatch — see Cross-references). All work lives in the
+working tree: code edits, the per-iter journal file, and the stats
+file. The orchestrator does NOT commit. The Boss sees one ≤500-token
+end-report and an unstaged working tree, then decides commit shape.
 
 This skill body is intentionally short. The procedural details of
 the per-task loop live in
@@ -41,7 +42,8 @@ is shed.
 ## The Iron Law
 
 ```
-ONE BRANCH PER ITER — `iter/<iter_id>`, created from local main.
+THE IMPLEMENTER NEVER COMMITS. CODE EDITS, THE PER-ITER JOURNAL, AND THE STATS FILE ALL LIVE IN THE WORKING TREE AS UNSTAGED CHANGES UNTIL THE BOSS COMMITS THEM.
+MAIN HEAD IS SACROSANCT — NO RESET, NO REVERT, BY ANY ACTOR. MAIN MOVES FORWARD ONLY VIA BOSS COMMITS.
 PER-TASK PHASES RUN SEQUENTIALLY IN THE ORCHESTRATOR-AGENT'S OWN CONTEXT — implementer phase, then spec-compliance check, then quality check. Each phase is a deliberate role-switch, NOT a fresh subagent (nested-subagent dispatch is forbidden by Claude Code).
 TWO-STAGE CHECK PER TASK: SPEC COMPLIANCE FIRST, CODE QUALITY SECOND.
 NEVER START THE QUALITY CHECK BEFORE THE SPEC-COMPLIANCE CHECK IS GREEN.
@@ -104,6 +106,10 @@ Agent("ailang-implement-orchestrator", {
 })
 ```
 
+Before dispatch: ensure the working tree is clean
+(`git status --porcelain` empty). The orchestrator's Phase 0 will
+refuse to start on a dirty tree.
+
 ### Step 2 — Read the end-report
 
 The orchestrator returns a ≤500-token plain-text report (see the
@@ -112,49 +118,60 @@ structure). Read it. The end-report is the only thing that costs the
 Boss-context tokens; per-task chatter has stayed inside the
 orchestrator-agent.
 
-### Step 3 — Boss merge step (on DONE or PARTIAL)
+### Step 3 — Boss inspect + commit step (on DONE or PARTIAL)
 
-> **Switch to main FIRST.** The orchestrator-agent ends its run with
-> the worktree on `iter/<iter_id>` (Phase 0 created the branch and
-> all per-task commits land on it). Any Boss commit issued before
-> `git switch main` lands on the iter branch by mistake — including
-> the INDEX-append below. This is a recurring papercut. Do the
-> switch before any Boss-side edit.
+The orchestrator returns with code edits, the per-iter journal
+file, and the stats file all sitting in the working tree as
+unstaged changes. Nothing is committed yet.
 
-1. Open the per-iter journal file on the branch (read-only, branch-
-   independent): `git show iter/<iter_id>:docs/journals/<YYYY-MM-DD>-iter-<iter_id>.md`.
-2. Decide whether the agent's Summary section is acceptable or needs
-   a Boss-level rewrite. The rest of the journal file is factual and
-   preserved verbatim. Defer the actual edit to step 5 — it lands on
-   main, not on the iter branch.
-3. Fast-forward main to the iter branch:
-   `git switch main && git merge --ff-only iter/<iter_id>`. Since the
-   iter branch was created from local `main` (Phase 0 of the
-   orchestrator-agent) and no commits have landed on main since, the
-   fast-forward is always linear.
-4. Append one line to `docs/journals/INDEX.md` and commit:
+1. Inspect: `git status` and `git diff` — confirm the changes match
+   what the end-report claims. Read the per-iter journal file at
+   `docs/journals/<YYYY-MM-DD>-iter-<iter_id>.md` directly from the
+   working tree.
+2. Decide whether the agent's Summary section in the journal is
+   acceptable or needs a Boss-level rewrite. Edit it in place if
+   needed.
+3. Decide commit shape — by default one cohesive commit for the
+   whole iter; split into a few logical commits only if the diff
+   genuinely covers multiple unrelated changes. Per-task commit
+   splitting is NOT a goal; the iter is the unit of consistency
+   the Boss is committing to.
+4. Stage + commit the code edits, the journal, and the stats file.
+5. Append one line to `docs/journals/INDEX.md` and include it in
+   the same commit (or a follow-up commit):
    `- YYYY-MM-DD — iter <iter_id>: <one-line title> → <YYYY-MM-DD>-iter-<iter_id>.md`
-5. If the Summary needed rewriting (step 2), edit the journal file
-   on main now and commit.
-6. Optionally delete the branch: `git branch -D iter/<iter_id>`.
-7. If trigger is done-state and the user is away, write a
-   `docs/WhatsNew.md` entry + `notify.sh` per CLAUDE.md's
+6. If trigger is done-state and the user is away, write a
+   `docs/WhatsNew.md` entry + run `notify.sh` per CLAUDE.md's
    "Done-state notifications" subsection.
 
 ### Step 4 — Boss handling (on BLOCKED)
 
-1. Read the per-iter journal on the branch — `Blocked detail:` names
-   the failure mode.
+The orchestrator returns with whatever work-in-progress it managed
+plus the per-iter journal recording `Status: BLOCKED`. Nothing is
+committed. The Boss decides what to do with the dirty working tree:
+
+1. Read the per-iter journal at the working-tree path — `Blocked detail:`
+   names the failure mode. Read `git diff` to see what was attempted.
 2. Decide:
-   - **Repair:** adjust plan or extend context; re-dispatch the
+   - **Repair:** keep the working-tree changes in place (or stash
+     them with `git stash` if a clarifying read of clean main is
+     needed first). Adjust plan or extend context; re-dispatch the
      orchestrator with the same `iter_id` and a `task_range` covering
-     the remaining tasks. The orchestrator picks up the existing
-     branch.
-   - **Discard:** `git branch -D iter/<iter_id>`. INDEX.md is NOT
-     touched (the orchestrator did not append).
-   - **Escalate:** ask the user via `notify.sh`. The branch sits
+     the remaining tasks. Phase 0's clean-tree check will refuse
+     if the tree is dirty — Boss either stashes or commits a
+     known-good subset before re-dispatch.
+   - **Discard:** `git checkout -- .` to drop unstaged file
+     changes; `git clean -fd` for any new files (with care).
+     INDEX.md is not touched (no commit happened). main HEAD does
+     NOT move.
+   - **Escalate:** ask the user via `notify.sh`. Working tree sits
      until the conversation resumes.
 
+Under no circumstance does the Boss `git reset` or `git revert` on
+main: there is nothing on main to undo (the orchestrator did not
+commit), and the policy forbids history rewinding on main even if
+there were.
+
 ## Handoff Contract
 
 `implement` consumes:
@@ -164,34 +181,34 @@ orchestrator-agent.
 | from `planner` | path to `docs/plans/<iteration>.md` (+ optional `task_range`) |
 | from `debug` | RED-test path + cause summary + minimal-fix constraint |
 
-`implement` produces: a feature branch `iter/<iter_id>` carrying
-per-task commits, a per-iter journal file (`docs/journals/<file>.md`),
-and a stats file (`bench/orchestrator-stats/<file>.json`). The Boss
-merges and updates `docs/journals/INDEX.md`. No further hand-off —
-`audit` runs independently at milestone close.
+`implement` produces: an unstaged working tree containing the code
+edits, the per-iter journal file (`docs/journals/<file>.md`), and
+the stats file (`bench/orchestrator-stats/<file>.json`). The Boss
+inspects, commits, and updates `docs/journals/INDEX.md`. No further
+hand-off — `audit` runs independently at milestone close.
 
 ## Common Rationalisations
 
 | Excuse | Reality |
 |--------|---------|
-| "Single task, dispatch overhead exceeds the work" | The orchestrator-agent IS the discipline. A single dispatch is cheap; the per-task phase loop, the branch isolation, and the journal file are the value. |
-| "I'll merge on main directly, no need for the iter branch" | The branch is what makes parallel `/implement` activity safe and makes "discard on BLOCKED" trivial. Skipping it puts you back in the pre-2026-05-11 coordination problems. |
-| "BLOCKED end-report, let me dig into the branch and continue myself" | Read the `Blocked detail:` first. The orchestrator stopped at the re-loop limit for a reason. Continuing by hand undoes the discipline. |
-| "End-report says PARTIAL with 4/5 DONE — close to enough" | The 5th task may carry an invariant the earlier 4 silently depend on. Either re-dispatch for the missing task or treat the iter as incomplete. |
+| "Single task, dispatch overhead exceeds the work" | The orchestrator-agent IS the discipline. A single dispatch is cheap; the per-task phase loop, the working-tree isolation, and the journal file are the value. |
+| "Let me have the orchestrator commit the per-task work, it's cleaner" | The orchestrator never commits. Boss-only commit is a project-wide rule (see CLAUDE.md): only the Boss decides when a state is consistent enough to enter main history. |
+| "Per-task commits would help bisection later" | The orchestrator's per-task phases are review gates, not bisection points. Iter-level commits are the bisection unit — and they only exist if the whole iter passes the Boss's review. |
+| "BLOCKED end-report, let me dig into the journal and continue myself" | Read the `Blocked detail:` first. The orchestrator stopped at the re-loop limit for a reason. Continuing by hand undoes the discipline. |
+| "End-report says PARTIAL with 4/5 tasks DONE — close enough, commit them" | The 5th task may carry an invariant the earlier 4 silently depend on. Either re-dispatch for the missing task or `git checkout -- .` and re-plan. |
 | "Skip the INDEX line, the journal file is enough" | INDEX.md is the only thing that makes per-iter journals navigable. Without it, future agents have to ls the directory and parse filenames. |
-| "I'll let the orchestrator-agent update INDEX.md" | No. INDEX.md is Boss-only. The orchestrator-agent does not know what `<one-line title>` the Boss will pick. |
+| "I'll have the orchestrator-agent update INDEX.md to save a Boss step" | No. INDEX.md is Boss-only. The orchestrator does not know what `<one-line title>` the Boss will pick, and the orchestrator does not commit. |
 | "The per-task phases run inline anyway, just have the Boss dispatch the reviewer-agents instead and skip the orchestrator-agent" | That gives back fresh-per-phase context but loses the Boss-context offload — the per-task chatter goes back through the Boss. The orchestrator-agent exists precisely for the offload. If you want fresh-per-phase context AND offload, you want a capability Claude Code does not provide. |
+| "BLOCKED iter with a bad commit on main — let me `git revert` it" | There is no bad commit on main: the orchestrator did not commit. Bad work stays in the working tree where it is still discardable. main HEAD is sacrosanct. |
 
 ## Red Flags — STOP
 
 - Boss dispatching `ailang-implementer` directly (bypassing the
   orchestrator-agent).
-- Boss editing a per-iter journal file on `main` instead of on its
-  iter branch.
-- Two `/implement` runs sharing one `iter_id`.
+- Boss running `git reset` or `git revert` on main.
+- Orchestrator-agent running `git commit` (anywhere, ever).
+- Two `/implement` runs overlapping on the same working tree.
 - INDEX.md modified by anything other than the Boss.
-- Branch `iter/<iter_id>` pushed to remote before the merge step
-  decided what to do with it.
 - End-report longer than ~500 tokens.
 
 ## Cross-references
@@ -224,5 +241,5 @@ merges and updates `docs/journals/INDEX.md`. No further hand-off —
     consumes
   - `skills/debug/SKILL.md` — produces the RED-test handoff for
     mini-mode
-- **Output target:** Boss reads the end-report and the per-iter
-  journal; `audit` runs at milestone close.
+- **Output target:** Boss reads the end-report, inspects the
+  working tree, and commits; `audit` runs at milestone close.