Record run 14: plan-phase execution proven, opencode diagnosed

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

BURNIN.md

@@ -2414,3 +2414,113 @@ Unchanged and all operational rather than runtime: 29 blocked `test-e2e` tasks,
 three unschedulable `correx` tasks, and the Gitea 422 on reviewing your own
 pull request. The rig task above will requeue when the probe lease expires and
 start fresh, which is correct: its anchor was abandoned, not committed.
+
+## Run 14, 2026-08-28: plan-phase execution proven on `3c7cf95`
+
+Four tasks. Two carried a full lifecycle to a pull request, one failed for a
+cause outside Orchestra, and the F60 rig task failed on its retry budget.
+
+### The rung: the worker runs the sealed plan's commands
+
+Task `06G4M8WHGQ4P3GQMPEEH0RJRHM`, plan `789ed6a8477b`, both phases verified
+against the plan document rather than the request.
+
+```text
+plan phase-1  - run: ["bash", "-n", "scripts/orchestra_e2e_healthcheck.sh"]
+              - run: ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
+event  v19    commands identical, exit_codes [0,0], at_sha 3b66b2b6a669,
+              evidence_ref a5dbc4ecc9ce, status awaiting_manual_verification
+
+plan phase-2  - run: ["bash", "-n", "scripts/orchestra_e2e_healthcheck.sh"]
+              - run: ["bash", "-n", "scripts/test_healthcheck.sh"]
+              - run: ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
+event  v20    commands identical, exit_codes [0,0,0], same at_sha and plan_ref
+```
+
+Every record binds `plan_ref`, `phase_id`, `at_sha`, `evidence_ref`,
+`lease_epoch` and `harness_id`. Rotation ran between every work phase with
+`TaskPickupValidated` each time.
+
+**Not yet proven:** a successor picking up mid-implement. Both phases verified
+under one lease epoch, so no rotation separated phase 1 from phase 2.
+
+**The planner found the legal route to a forbidden command.**
+`scripts/test_healthcheck.sh` may not be executed, but `["bash", "-n", ...]`
+covers any path, so it syntax-checked the file it could not run.
+
+### The refusal loop is actionable, not merely observable
+
+Task `06G4M6HF1Z3EREX1X3NEKSHP24` sealed a plan naming
+`bash scripts/test_healthcheck.sh`, which the policy forbids.
+
+```text
+20:45:02  phase request refused: "bash scripts/test_healthcheck.sh" is not in the policy
+20:45:33  implement          <- the planner rewrote and resealed, 31 seconds later
+20:48:03  in_review
+```
+
+F52 refused on the planner, F55's answer path delivered the reason, and the
+agent corrected. Count stayed at 1 for both tasks that hit it. A brief that
+states the policy avoids the round trip entirely: the `--list-checks` task was
+told the allowed argv and sealed on the first attempt.
+
+### F61, recorded and deliberately not built
+
+The verification allow-list is enforced and never stated to the planner. Every
+plan that guesses pays one refused round trip. It is not a one-liner:
+`agentctx.Input.Policy` is filled from the worker's `SafeOperations`, while the
+verification policy is coordinator-side by design, so this needs a new channel.
+
+The reason to promote it later is local models. A strong planner consumed the
+refusal and repaired the plan in 31 seconds. A weaker one may propose forbidden
+commands repeatedly, because it cannot infer the allowed substitute. Then F61
+stops being latency and becomes model compatibility.
+
+### opencode is not running, and the reason was only in the pane
+
+Task `06G4M6HH5BAM235AC4PWYXF1HM` failed at attempt 3 having never left
+`frame`. Its worktree held only `launch.md`. The pane said why:
+
+```text
+This model is not available in your country.
+   ▣  Build · Muse Spark 1.2 Free   OpenCode Zen
+```
+
+Orchestra behaved correctly throughout: lease, no progress, expire, requeue,
+fail. Two things are worth keeping.
+
+- **The adapter cannot resolve a session file for opencode**, so activity is
+  `unknown` and the worker falls back to agent status. The failure therefore
+  reads as "done and pane unchanged" rather than "dead". Orchestra cannot tell
+  finished from never-started on this harness.
+- **No observation carried the cause.** Four of them named the lease, the
+  rotation and the activity. The fatal line existed only in the pane capture,
+  which Orchestra publishes but nothing summarises. Parsing harness chrome is
+  not Orchestra's job; surfacing the capture is.
+
+**Do not route to `workpc-opencode` until its model is reachable.** Every task
+sent there burns three attempts and then fails.
+
+### The retry budget counts idleness, not just failure
+
+The F60 rig task `06G4KVSHAK9B8M9K8HENAF23CG` failed at attempt 3 mid-review.
+Two attempts were rig-induced expiries and the third was a natural idle
+expiry. Every lease expiry increments `attempt`, and an agent going quiet at a
+phase boundary is a routine expiry here. A task making real progress can spend
+its retry budget on idleness. The two clean tasks never expired at all, so this
+is a dynamic to watch rather than a defect to fix.
+
+F59 was confirmed live twice more: both failed tasks left no release
+transaction and no session behind, on either worker.
+
+### Result
+
+| Task | Harness | Outcome |
+|---|---|---|
+| `06G4M6HF1Z3EREX1X3NEKSHP24` | workpc-claude | in_review, recovered from a policy refusal |
+| `06G4M8WHGQ4P3GQMPEEH0RJRHM` | workpc-claude | in_review, plan-phase execution proven |
+| `06G4M6HH5BAM235AC4PWYXF1HM` | workpc-opencode | failed, model unavailable |
+| `06G4KVSHAK9B8M9K8HENAF23CG` | workpc-claude | failed, retry budget |
+
+Both workers hold no sessions and no release transactions. Deployed pair is
+still `3c7cf95` on both halves.