Hand off with run 5 completed and the plan change designed

Ledger current through F42. Handoff records the two defects found in the
completion tail, the deployed revisions, and the two links the tail still
cannot reach because test-e2e has no gate and no delivery configuration.

PLAN-SPEC-DESIGN.md is the operator-approved design for the ACE-FCA plan gap,
committed as a note. No implementation yet, by instruction.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

BURNIN.md

@@ -1716,3 +1716,77 @@ Fixed in the phase brief: the terminal phase now states the marker, when to
 write it, and that it is exclusive with asking to go back.
 `TestTerminalPhaseNamesTheCompletionSignal` also asserts the negative, so a
 phase that can still ask is never told to finish instead.
+
+### F41: harness chrome counted as agent progress
+
+Run 5's review agent produced nothing after 02:12. The 02:46 renewal was
+granted anyway, and the lease moved to 03:16. Each renewal window bought
+another 30 minutes, so recovery by expiry had no bound.
+
+Reproduced the worker's stored `progress_sha` byte for byte from the live pane,
+so the branch taken at `cmd/orchestra-worker/main.go:1020` was
+`progress != l.ProgressSHA`. Not `IsBusy`: the 200-line capture held zero
+`esc to interrupt` markers, so `AgentStatus` returned `idle`. Not an empty
+baseline either: it held `3d93ca89`.
+
+`PaneProgress` dropped prompt lines only, so Claude Code's status footer stayed
+in the digest. The mutable fields there are the rolling usage percentage, the
+context counter, and the version notice. A 180-second sample showed no churn, so
+this leaked intermittently rather than constantly. One tick inside a window was
+enough.
+
+Fixed in `2417a39`. `PaneProgress` cuts from the editor's lower rule and then
+trims the spinner summary and version notice above it. `AgentStatus` still reads
+the raw capture, so the busy markers living in the footer are unaffected.
+
+Proven live in both directions on the first window after deployment: the
+03:13:48 renewal took version 28, the 03:16:13 window was refused, the lease
+expired at 03:18:43, and review relaunched at 03:20:14 with the F40 brief. The
+relaunched pane then showed a new footer field, `5h: 15%`, which the old digest
+would have counted as work.
+
+Lease TTL moved to 5 minutes in the same commit, from `domain.LeaseTTL`, with
+renewal at half of it. Reclaiming a stalled pane happens only at expiry.
+
+### F42: the result commit refused the completion marker
+
+The relaunched review agent wrote `.orchestra/done` at 03:20:48, 34 seconds
+after launch. The worker recognised it, confirmed the agent idle, and then
+failed the result commit once every five seconds:
+
+```text
+stage result: The following paths are ignored by one of your .gitignore files:
+.orchestra/done
+```
+
+`internal/herdr/adapter.go:132` writes `.orchestra/.gitignore` containing `*`,
+so the marker is ignored. The staging step passed `:!.orchestra/done`, and git
+refuses an add whose pathspec names an ignored path. Reproduced in a scratch
+repo on git 2.55.0, both the failing and the working form.
+
+Fixed in `dcd9af4`: the exclusion names the directory, `:!.orchestra`. That
+holds whether or not the inner `.gitignore` exists.
+
+The failure retried for 22 minutes with the task stuck in review and nothing
+observable outside the journal, because each identical error overwrote the
+single `last_error` slot. F18, again, and the second time in one night that it
+turned a five-second loop into archaeology.
+
+### Run 5 reached TaskCompleted
+
+On the first tick after the `dcd9af4` restart at 06:47:50:
+
+- task state `completed`, lease released, `.orchestra/done` removed
+- pane closed, no `orchestra-*` sessions left on the tmux socket
+- result branch pushed:
+  `refs/heads/orchestra/scratch/orchestra-06g4a4f0tfxkzhje48n05xn1hg-73a2e4fd`
+  at `fb15c61`
+
+Two links of the tail did not run, and neither is a defect. The deployed
+`test-e2e` project declares only `id`, `machine_affinity`, `repo` and
+`worktree_root`, so no quality gate exists to run. The deployed `config.jsonc`
+has no `sources` and no `delivery` keys, so no PR could be opened.
+
+Proven chain: review, done recognised, finalise, result branch pushed,
+`TaskCompleted`. Submission, human PR review and merge remain unproven, and they
+need registry configuration rather than code.