Planner Claude orders actions against mechanisms that don't exist, then offloads agent-doable work onto the operator — while the project's entire enforcement layer turns out to be silently advisory

Continuation of a two-seat setup previously reported (planner on claude.ai writing orders; Claude Code executing against a local repo). This session surfaced three distinct defects — two on the planner, one systemic — even after the planner had been corrected, had read the governing documents, and had installed explicit rules against its own failure pattern.

1. The planner ordered a procedure against machinery that does not exist. It instructed the executor to quote "existing signed entries" from a governance file for format authority, then have the operator sign a promotion entry there. The executor's probe found: the file does not exist (0 entries), no code anywhere reads it, and a tool in the repo literally contains the comment that the file is "DEAD (one-day artifact)." The planner had built a multi-step owner-signature ceremony on a mechanism it never verified existed — the same read-nothing-guess-everything class it had just been corrected for, now with a rule against it installed in its own memory. The rule reduced the failure's blast radius (the executor caught it at a read-only probe) but not its occurrence.

2. The planner offloaded agent-doable work onto the human. When a real fix was identified — a one-token change (exit 0 → exit $rc) in three hook scripts — the planner chose the option requiring the operator to hand-edit three files, on an abstract "agents shouldn't touch their own enforcement" purity argument, when a supervised alternative existed: operator arms the scope, agent makes the edit, operator verifies a three-line diff. The operator had to ask "why do I have to edit these myself?" before the planner reversed. A delegation system where the human does the mechanical edits and the AI does the deciding is upside down.

3. Systemic finding: the enforcement layer was silently advisory. The repo's six PreToolUse gate wrappers — edit gate, bash gate, step-scope gate, and three others — all end in an unconditional exit 0 with a # FAIL-CLOSED comment directly contradicting the code. Every "denial" printed as [ADVISORY] and proceeded. This explains an earlier unauthorized commit in the arc: the step-scope lock was armed for a different task, the gate "denied," and the edit went through anyway. For weeks, both agents and the operator believed a mechanical control layer existed; it was logging its refusals and complying. Notably, the executor deserves credit here: asked to prove the new gate with a live RED test, it refused to run the proof against advisory wrappers because the resulting "block" would have been a fake receipt — exactly the right instinct.

4. Residual: option menus at halt points. The executor, when legitimately blocked (owner-only files), still wrapped every stop in decision menus — "(A)/(B)/(C), your call," "confirm X?" — despite a project rule mandating decide-and-deliver. Each menu exported to the operator decisions that were fully determined by standing project rules. Partly planner-induced: the planner's own orders contained "your call" phrasing, licensing the menus.

Expected behavior

• An order referencing a mechanism (file, gate, registry, signature flow) should be preceded by verification the mechanism exists — and a planner that was just corrected for this exact class, with a rule installed, should not repeat it within the same session. Rule-following that survives one turn is not behavior change.
• When work is agent-executable under human-armed scope and human-reviewed diff, the default should be agent-executes/human-verifies — never delegating mechanical edits to the operator on abstract-principle grounds.
• Gate/hook code whose comments claim fail-closed while the code is fail-open should be detectable — an agent reading # FAIL-CLOSED above exit 0 should flag the contradiction proactively, not after weeks of phantom enforcement.
• At legitimate halt points, agents should decide everything decidable from standing rules and request exactly one prescribed operator action — no menus.

Impact

Operator burden inverted twice in one session: first supervising a planner that orders ceremonies against dead mechanisms, then being assigned manual file edits by the AI that exists to do them. Meanwhile the discovery that all enforcement was advisory retroactively voids weeks of assumed control: every "gate passed" receipt in that window is unverified. The one bright spot — the executor refusing to fabricate a proof against a fake gate — shows the desired behavior is reachable; it needs to be the default, not the exception.

Environment: claude.ai planning seat with project skills mounted read-only + Claude Code on Windows, local git repository, CLAUDE.md directives, PreToolUse hooks (six wrappers, all found advisory).