docs(skills): fix four reference-doc traps in the loop and dispatch surfaces (#170-#173)

plugins/codexclaw/skills/loop/SKILL.md

@@ -88,13 +88,14 @@ Keep explicit-only skills and leaf-safe delivery restrictions intact.
   task with its own goal and PABCD state, and with `environment: worktree` its own
   checkout — `environment: local` shares the project checkout instead. Work that
   needs its own branch, checkout, or merge/CI lane is thread work: N parallel lanes
-  means N worktree threads. Spawning N subagents for N branches puts N writers
-  on one HEAD. Concurrent subagents need non-overlapping write scopes and must
-  never run branch-level git operations at the same time. A request for parallel
-  branch or worktree lanes **is** the user request that creating those threads
-  needs — the lanes are the mechanism the work requires, so do not downgrade them
-  onto the shared tree to avoid creating tasks. If the shape is unclear, ask once
-  naming what you would create, then continue.
+  means N worktree threads, and the workers inside each lane are that lane's
+  subagents, not threads of their own. Spawning N subagents for N branches puts
+  N writers on one HEAD. Concurrent subagents need non-overlapping write scopes
+  and must never run branch-level git operations at the same time. A request for
+  parallel branch or worktree lanes **is** the user request that creating those
+  threads needs — the lanes are the mechanism the work requires, so do not
+  downgrade them onto the shared tree to avoid creating tasks. If the shape is
+  unclear, ask once naming what you would create, then continue.
   Details and the measured evidence: [Dispatch surfaces](../pabcd/references/dispatch-surfaces.md).
 - ORCH-MANDATE-01 (STRICT): a claimed active loop needs real persisted FSM evidence,
   not narrated phase names. Read actual session state before entry or re-entry.

plugins/codexclaw/skills/loop/references/durable-goalplan.md

@@ -57,26 +57,37 @@ This is the on-disk shape under `.codexclaw/goalplans/<slug>/goalplan.json`
   Task ids and task dependency references are phase-local: `task.dependsOn` names existing task ids in
   the same work phase, never a task in another phase. A done task carries a non-empty `outcome`; a pending
   task has no outcome.
-- `criteria[]` — each `{ id, scenario, expectedEvidence, capturedEvidence, status: open|met }`.
-  A criterion only reaches `met` when `capturedEvidence` is non-empty (fresh proof, not memory).
+- `criteria[]` — each `{ id, scenario, surface, expectedEvidence, capturedEvidence, status: open|met }`.
+  `scenario` is the `--criterion` text and `surface` comes from `--surface` (default
+  `logic`); `id` is auto-assigned and `status` is derived. `expectedEvidence` has no
+  CLI flag on `add-criterion` — it stays `""` unless set via a steering batch op or a
+  hand edit — so do not plan on passing it. `capturedEvidence` is written by
+  `meet-criterion --evidence`. A criterion only reaches `met` when `capturedEvidence`
+  is non-empty (fresh proof, not memory).
 - `host` — `GoalplanHostLink { armed, armedAt, source: freeze|none }`. `armed` is provenance,
   intended to read true only after a freeze-boundary arm (the MAIN session created a host goal).
   No shipped CLI flips it automatically and codexclaw never writes the goal DB itself; treat it
   as the slot that records that boundary, not an auto-managed flag.
 
 ### CLI surface
 
-- `cxc loop init --objective "<text>" [--session <id>]` — creates the local
-  artifact and binds it to the session when a session id is supplied; it never
-  writes the host goal DB.
+- `cxc loop init --objective "<text>" [--session <id>] [--criterion <text>]...` —
+  creates the local artifact and binds it to the session when a session id is
+  supplied; it never writes the host goal DB. Repeat `--criterion` once per
+  criterion to register them at init.
 - `cxc loop show --slug "<text>"` — renders the current plan summary.
 - `cxc loop validate --slug "<text>"` — runs the E8 quality gate; it FAILS
   unless the plan is complete and every `met` criterion carries `capturedEvidence`.
 - `cxc loop ready (--slug <slug> | --objective <text> | --session <id>) [--json]`
 - `cxc loop add-work-phase --session <id> --id <id> --title <text> [--depends-on <id>]...`
 - `cxc loop add-task --session <id> --work-phase <id> --id <id> --title <text> [--depends-on <task-id>]...`
+- `cxc loop add-criterion --session <id> --criterion <text> [--surface logic|web|tui]` —
+  registers a criterion whose scenario is the `--criterion` text. There is no `--id`:
+  ids are assigned as `c-1`, `c-2`, ... (max existing `c-N` + 1, in registration
+  order). A duplicate scenario text is rejected.
 - `cxc loop complete-task --session <id> --work-phase <id> --id <id> --outcome <text>`
-- `cxc loop meet-criterion --session <id> --id <id> --evidence <text>`
+- `cxc loop meet-criterion --session <id> --id <id> --evidence <text>` — `--id` takes
+  a generated `c-N` id; read it from `cxc loop show` or the goalplan file.
 - `cxc goalplan *` — deprecated alias for the same behavior during migration.
 
 Repeat `--depends-on` once per prerequisite; comma-separated values are one id. Existing dependencies are

plugins/codexclaw/skills/pabcd/references/delegation.md

@@ -140,6 +140,16 @@ The schema marks no argument required, but the runtime still rejects a spawn
 carrying neither `message` nor `items`. `nickname` is a display label: never
 address an agent by it. A completed agent holds a concurrency slot until closed.
 
+**DELEGATE-MODEL-LIST-01 (STRICT).** The model-override list in the host tool
+description is a hint, not an allowlist, and is known to be incomplete. When the
+user names a worker model, pass it through as given. Only a real spawn rejection
+is evidence of unavailability; absence from the description is not. If a
+requested model genuinely fails to spawn, say so to the user — do not substitute
+a different model and silently re-plan the ratio. Measured on 2026-09-14:
+`spawn_agent({ model: "devin/swe-2" })` returned `{ agent_id, nickname }` and
+the child ran to a final message on the parent's branch, while the advertised
+list still omitted it; re-confirmed the same day in a second session.
+
 ### V2 — the task-shaped family
 
 | Concern | V2 |

plugins/codexclaw/skills/pabcd/references/dispatch-surfaces.md

@@ -22,6 +22,10 @@ Isolation comes from the environment, not from being a task. A `local` thread is
 an independent owner sharing one checkout; a `worktree` thread is an independent
 owner with its own. Lane work needs the second.
 
+A **lane** is thread work; a **worker inside a lane** is subagent work. N lanes
+means N worktree threads, and the workers inside each lane are that lane's
+subagents — they cannot collide across lanes because the worktrees differ.
+
 Say which one you are creating, in those words, before you create it.
 
 ## What actually differs
@@ -76,6 +80,8 @@ Route by what the work needs to own, not by how parallel it is:
   one per lane, created with `environment: worktree`. A `local` thread does not
   give the lane a checkout of its own.
 - Needs its own goal or its own PABCD cycle -> **thread**.
+- Is a bounded slice inside a lane that already owns its checkout -> **subagent**
+  of that lane's thread.
 - Is a bounded slice of the tree you are already editing, returning evidence or a
   patch rather than owning a branch -> **subagent**.
 - Is read-only research -> **subagent**, by default. It cannot collide because it

structure/20_pabcd_dispatch_doctrine.md

@@ -28,6 +28,7 @@ move; the machinery does not.
 | Boss agent | the main Codex session (you) |
 | Employee (`cli-jaw dispatch --agent`) | a Codex `spawn_agent` subagent (`explorer`/`worker`) — a leaf in the parent's own working directory, no goal, no FSM |
 | A parallel lane that owns its own branch/checkout | a separate Codex task (`create_thread`) with its own worktree, goal and FSM — not a subagent |
+| A worker inside one of those lanes | a `spawn_agent` subagent of that lane's thread, running in that lane's worktree — workers are not lanes |
 | Employee registry (server) | role TOMLs in `plugins/codexclaw/agents/` (prompt sources only) |
 | `cli-jaw orchestrate I/P/A/B/C/D` (HTTP) | `cxc orchestrate I/P/A/B/C/D` (agent-gated CLI over `.codexclaw/`) |
 | `--attest` gate (`orchestrator/attestation.ts`) | `cxc orchestrate <phase> --attest` (same JSON gate) |