fix(session-flow): carry the user's original goal across the handoff chain

docs/CATALOG.md

@@ -89,7 +89,7 @@ plugin manifests and kept in sync by CI — never hand-edit it; the category voc
 
 ## Workflow
 
-- [`session-flow`](../plugins/session-flow) — Session-lifecycle toolkit of thirteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now — same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled — inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear — when the resume prompt was written but never copied — via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away — sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger — capture and route only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation — synthesize where we stand, what we are doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality — referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files — before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality — the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), and setup (check-centric verification of the observer's runtime prerequisites and configuration).
+- [`session-flow`](../plugins/session-flow) — Session-lifecycle toolkit of thirteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now — same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled — inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear — when the resume prompt was written but never copied — via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away — sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger — capture and route only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation — synthesize where we stand, what we are doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality — referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files, and the goal a handoff records, compared across the chain so a re-derived goal reports as drift — before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality — the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), and setup (check-centric verification of the observer's runtime prerequisites and configuration).
 - [`visualization`](../plugins/visualization) — On-demand visualization router: infers what in the current conversation should be shown visually, then decides the best FORM (a mermaid diagram, a markdown table, a hand-authored SVG/CSS chart, ASCII/Unicode art, or a rich rendered page) and the best MEDIUM (inline terminal, a local HTML file, or a published Artifact) via a decision matrix over content shape, complexity, and a configurable medium preference. Renders good defaults and asks only when the target is genuinely ambiguous and no form was named. A form-and-medium decision layer in front of the craft capabilities — it routes chart craft and artifact-design fundamentals to those capabilities when installed and never restates them.
 
 ## Project Management

plugins/session-flow/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "session-flow",
-  "version": "0.17.22",
-  "description": "Session-lifecycle toolkit of thirteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now — same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled — inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear — when the resume prompt was written but never copied — via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away — sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger — capture and route only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation — synthesize where we stand, what we are doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality — referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files — before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality — the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), and setup (check-centric verification of the observer's runtime prerequisites and configuration).",
+  "version": "0.17.23",
+  "description": "Session-lifecycle toolkit of thirteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now — same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled — inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear — when the resume prompt was written but never copied — via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away — sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger — capture and route only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation — synthesize where we stand, what we are doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality — referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files, and the goal a handoff records, compared across the chain so a re-derived goal reports as drift — before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality — the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), and setup (check-centric verification of the observer's runtime prerequisites and configuration).",
   "author": {
     "name": "Melodic Software",
     "email": "info@melodicsoftware.com"

plugins/session-flow/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog — session-flow plugin
 
+## [0.17.23]
+
+### Fixed
+
+- **A handoff chain preserved state perfectly and intent not at all: nothing made the user's own
+  goal a mandatory, immutable field, so each save-point serialized the process machinery as the
+  mission.** The goal appeared in exactly one place — a line inside the six-line `Resumption brief`,
+  a section whose own contract is to restate facts owned below. So every hop re-derived the goal
+  from a conversation that had already lost it, each paraphrase individually plausible, and what
+  survived was the phase, the bundle, and the checklist in front of the writer. `Completion
+  criteria` compounded it: the section demanded observability and said nothing about framing, so
+  criteria stated as process steps passed — and a process criterion is satisfiable while the goal is
+  no closer, reporting done when the process finished rather than when the work landed. Each resumed
+  session then optimized the wrong objective faithfully, with nothing on any resume path testing the
+  work against what it was for.
+
+  `reference/structure.md` now opens with body section 1, **`Original goal`** — the user's statement
+  quoted verbatim with its date, never paraphrased; `Amended:` defaulting to `None.` and changeable
+  only on an explicit dated statement from whoever set the goal, prior goal retained above it; and a
+  drift-check line, `Next action serves it by:`, that ties the first remaining action back to the
+  goal and, when it cannot be written, says so as drift rather than staying silent. Immutability is
+  enforced as a step, not an adjective: whenever `previous_handoff` is emitted, the write procedure
+  opens that file from disk THIS turn and reproduces its quote and amendments unchanged — the same
+  did-the-read check the live `TaskList` call already carries. The `Resumption brief` stops
+  restating the goal and points at §1. `Completion criteria` now requires both halves — the
+  goal-state a criterion establishes AND the command or diff that settles it — with process
+  milestones demoted to a subordinate `Process milestones` sub-heading, since goal-framed
+  criteria are the harder ones to settle mechanically, which is exactly why writers drifted to
+  process framing. Sections renumbered 1-14; the doc's internal cross-references moved with them.
+  `skills/handoff`'s post-write checklist gains the matching assertions on both paths — the quote
+  copied off disk rather than rebuilt, the drift-check answered, criteria goal-framed, and the
+  verbatim goal line present on prompt-only — because a rule the writer is never checked against is
+  the rule it drifts from; `context/gotchas.md` carries the failure pattern, and the skill's eval
+  set covers both paths.
+
+- **Nothing re-anchored a resumed session to its goal, so the drift ran unnoticed across many
+  sessions.** The check now sits on all three surfaces a resume can cross.
+  `reference/save-point.md` gains an `Original goal — mandatory on BOTH paths` rule (prompt-only
+  writes no body sections, so it carries the verbatim goal inline between the rails — below an
+  active `/goal` re-arm when one holds the first line, above its remaining-work bullets, and with
+  every dated amendment travelling under the original quote rather than collapsing to a single
+  line — it points at no file, and a prompt-only save-point listing just the
+  follow-ups is the precise shape that loses the goal), and the rails directive becomes `Read @…,
+  confirm its Original goal still governs the remaining next steps, then continue them.` — the
+  directive because it is the one artifact every resume passes through, including the dominant bare
+  paste that invokes no skill at all, the agent `continue-in-background` launches, and a
+  `find-handoff` recovery. Not a detection-contract change: signal 1 is matched on the
+  `…handoffs/<TS>-handoff-…` shape, which the clause leaves untouched. It does carry one structural
+  consequence, recorded where `structure.md` describes how that doc is cited elsewhere: the
+  directive now names `Original goal` by name (never by number), so renaming that one section
+  ripples out to it, where before no rename ripple existed. `skills/keep-going` owns the
+  skill-mediated path — goal alignment is now its own step, sitting after the read-only
+  inventory/inspection and BEFORE any recovery action, because resuming or restarting work that
+  serves a drifted goal re-arms the drift before anything has tested it: read the handoff's
+  `Original goal`, say in one sentence how the next action
+  serves it, and treat an unstatable connection as drift rather than a wording problem. A handoff
+  carrying no `Original goal` is itself a flagged defect — the goal is never inferred from the
+  process the file describes, since that process is the thing that drifted; the user is asked for it
+  in their own words first. `skills/reanchor` covers the third path — the deliberate "is this still
+  current" pass over an old plan, where neither of the other two ever runs — as a fifth premise
+  check beside its PR, base-drift, surface-rename, and stale-memory ones. That framing is the point:
+  a recorded goal is a documented claim about what the work is FOR, and it goes stale exactly the
+  way a PR's state does, so it sits inside reanchor's existing boundary rather than stretching it
+  toward intent. Because reanchor reads a chain, it can do what no single-document check can — open
+  the prior handoff and compare the quotes across links, reporting a re-derived goal as drift
+  between them. It reports and hands to `keep-going`; it never re-derives the next action or amends
+  a goal. None of the three is sufficient alone: reanchor is opt-in and fires only once staleness is
+  already suspected, which is precisely when a drifted chain looks healthiest. Both skills carry
+  eval cases for the new check, including the absent-goal case each must refuse to infer past.
+
 ## [0.17.22]
 
 ### Fixed

plugins/session-flow/README.md

@@ -91,7 +91,7 @@ running again); while a limit still holds it hands back via `handoff` rather tha
 scheduler. Intent is inferred from the conversation; arguments are optional.
 
 ```shell
-/session-flow:keep-going              # inventory → inspect → recover → reconcile → report
+/session-flow:keep-going              # inventory → inspect → goal-align → recover → reconcile → report
 ```
 
 ### find-handoff