fix(#1143): address adversarial review — full semver precedence, docs/reality alignment

- compareSemver: implement full SemVer 2.0.0 §11 pre-release identifier
  comparison (two pre-releases of the same triple now order correctly; was 0).
- capability description + fragment: scope the plan-checker/verifier claim
  (this capability delivers the parallel-execution backend; those gates remain
  inline until separately wired). Correct the 'each wave is one barrier' prose
  (a wave splits into multiple sequential parallel() barriers on files_modified
  overlap). Frame detect-backend CLI as a simulation harness; the pure function
  with the live host descriptor is the real detection seam.
- partitionStages docstring: 'near-minimal via greedy first-fit' (not 'fewest');
  document empty-files_modified behavior.

capabilities/claude-orchestration/capability.json

@@ -3,7 +3,7 @@
   "role": "feature",
   "version": "1.7.0-rc.3",
   "title": "Claude orchestration (Workflow backend)",
-  "description": "Default-off, BETA, claude-only capability that adopts Claude Code's Workflow tool (the engine behind /effort ultracode) as an optional parallel-execution backend for the GSD loop. When the runtime exposes the Workflow tool and claude_orchestration.execution_backend resolves to 'workflow', execute-phase emits a generated Workflow script (waves -> parallel() barriers, plans -> agent({ agentType: 'gsd-executor', isolation: 'worktree' }), files_modified overlap -> separate sequential stages, resumeFromRunId wired to the phase run id, shared token budget) that composes the SAME gsd-executor agent and worktree isolation the inline path uses, restoring the parallelism + plan-checker + verifier that the #853 backgrounded-agent nesting limitation forces inline on Claude Code. Also folds the ultraplan plan-offload under one runtime gate (plan:* surface). On any runtime lacking the Workflow tool, or when the capability is disabled, behaviour is byte-identical to today (inline/manual dispatch). Detection + emission live in gsd-core/bin/lib/claude-orchestration.cjs (pure, fail-closed). Mirrors the existing gsd-ultraplan-phase BETA-isolation posture.",
+  "description": "Default-off, BETA, claude-only capability that adopts Claude Code's Workflow tool (the engine behind /effort ultracode) as an optional parallel-execution backend for the GSD loop. When the runtime exposes the Workflow tool and claude_orchestration.execution_backend resolves to 'workflow', execute-phase emits a generated Workflow script (waves -> parallel() barriers, plans -> agent({ agentType: 'gsd-executor', isolation: 'worktree' }), files_modified overlap -> separate sequential stages, resumeFromRunId wired to the phase run id, shared token budget) that composes the SAME gsd-executor agent and worktree isolation the inline path uses, restoring the wave parallelism the #853 backgrounded-agent nesting limitation forces inline on Claude Code. (The plan-checker and verifier remain inline until separately wired — this capability delivers the parallel-execution backend, not those gates.) Also folds the ultraplan plan-offload under one runtime gate (plan:* surface). On any runtime lacking the Workflow tool, or when the capability is disabled, behaviour is byte-identical to today (inline/manual dispatch). Detection + emission live in gsd-core/bin/lib/claude-orchestration.cjs (pure, fail-closed). Mirrors the existing gsd-ultraplan-phase BETA-isolation posture.",
   "tier": "full",
   "requires": [],
   "engines": {

capabilities/claude-orchestration/fragments/execute-wave-post.md

@@ -29,8 +29,10 @@ cannot nest further subagents — #853 — and so degrades to sequential inline
 execution), execute-phase **emits a generated Workflow script** and lets the main
 loop orchestrate it:
 
-- **waves → `parallel()` barriers** — each wave is one barrier; the next wave
-  waits for the previous to complete.
+- **waves → one or more sequential `parallel()` barriers** — each wave is a
+  barrier group; when plans within a wave share `files_modified`, they are split
+  into separate sequential stages within that wave's barrier (the next wave
+  still waits for the previous wave to complete).
 - **plans → `agent(brief, { agentType: 'gsd-executor', isolation: 'worktree' })`**
   — the SAME executor agent and worktree isolation the inline path uses, so the
   produced `SUMMARY.md` and commits are identical.
@@ -48,8 +50,11 @@ The emitter is a pure function exposed through the capability command surface:
 [--phase-dir <dir>] [--budget <n>]` (or `require('gsd-core/bin/lib/claude-orchestration.cjs').emitWorkflowScript`
 directly). It maps the phase's wave/plan manifest to the Workflow script string
 and never invokes the Workflow tool itself; the orchestrator runs the emitted
-script. Use `gsd-tools claude-orchestration detect-backend` to resolve whether
-the Workflow backend should activate for the current runtime.
+script. Detection is resolved by the orchestrator calling the pure
+`detectWorkflowBackend` with the LIVE host descriptor (the CLI
+`gsd-tools claude-orchestration detect-backend` is a simulation harness that
+assumes a capable host unless `--no-nested-dispatch` is passed — it does not probe
+the real runtime; the orchestrator supplies the real descriptor).
 
 ## Fallback contract