@adrata/adrata-mcp 1.0.30 → 1.0.40

package/README.md

@@ -268,6 +268,9 @@ All free tools plus:
 | `research_person` | Composite: deep person research |
 | `discover_prospects` | Composite: find new prospects |
 | `get_next_contacts` | Composite: next best contacts to reach |
+| `commit_lead_to_outbound` | Governed: commit a lead above the /targets line — Pipeline's Outbound stage |
+| `release_lead_from_outbound` | Governed: take a lead back out of Outbound |
+| `list_outbound_leads` | Who is committed to Outbound right now |
 | `get_competitive_intel` | Composite: competitive analysis |
 | `get_meeting_brief` | Composite: pre-meeting intelligence |
 | `get_deal_coaching` | Composite: deal coaching insights |

package/access/tiers.js

@@ -242,6 +242,7 @@ export const TOOL_TIERS = {
   record_work_item_qa_failure_and_release: TIERS.ENTERPRISE,
   requeue_work_item_qa_after_fix: TIERS.ENTERPRISE,
   get_work_item_history: TIERS.ENTERPRISE,
+  get_work_item_field_changes: TIERS.ENTERPRISE,
   get_work_item_comments: TIERS.ENTERPRISE,
   get_work_board_rollup: TIERS.ENTERPRISE,
   list_work_board_rollups: TIERS.ENTERPRISE,
@@ -250,6 +251,8 @@ export const TOOL_TIERS = {
   attach_work_item_qa_evidence: TIERS.ENTERPRISE,
   verify_work_item_qa_evidence_playback: TIERS.ENTERPRISE,
   move_work_item: TIERS.ENTERPRISE,
+  preview_work_item_acceptance_reaffirmation: TIERS.ENTERPRISE,
+  reaffirm_work_item_current_acceptance: TIERS.ENTERPRISE,
   transfer_work_item_between_boards: TIERS.ENTERPRISE,
   set_work_item_tag: TIERS.ENTERPRISE,
   block_work_item: TIERS.ENTERPRISE,
@@ -423,6 +426,18 @@ export const TOOL_TIERS = {
   // get_speedrun_list already mapped above
   discover_prospects: TIERS.PRO,
   get_next_contacts: TIERS.PRO,
+  // The Outbound trio, registered in `toolsets/prospecting.js` beside `get_next_contacts` and
+  // named in its header alongside it. They arrived on the desktop branch while this tier map
+  // grew on main, so neither side could see the gap: the registry had three tools this table
+  // did not, and `getToolTier` falls back to ENTERPRISE for anything unlisted -- which would
+  // have quietly put a PRO workspace's own Outbound moves behind the top tier rather than
+  // erroring. The exhaustiveness test is what refuses the fallback, and it is right to.
+  //
+  // PRO, matching the toolset they ship in: committing a lead to Outbound IS the pipeline move
+  // for a person, so it belongs with the prospecting reads that lead to it, not above them.
+  commit_lead_to_outbound: TIERS.PRO,
+  list_outbound_leads: TIERS.PRO,
+  release_lead_from_outbound: TIERS.PRO,
 
   // --- COMPOSITE TOOLSETS: intelligence (pro tier) ---
   get_competitive_intel: TIERS.PRO,

package/api-bridge.js

@@ -298,6 +298,12 @@ const PATH_WRITE_SCOPES = [
   ['/api/v1/contacts', 'write:people'],
   ['/api/v1/people', 'write:people'],
   ['/api/v1/leads', 'write:people'],
+  // Lead lists — including the marker-owned Outbound list that /targets and
+  // Pipeline share — are gated by the API on read:speedrun for reads AND
+  // writes (scope_guard/mod.rs: `path.starts_with("/lead-lists")`). Naming it
+  // here turns the preview's "unknown (no mapping for this path)" into the
+  // scope the server actually checks.
+  ['/api/v1/lead-lists', 'read:speedrun'],
   ['/api/v1/agent-tasks', 'write:tasks'],
   ['/api/v1/tasks', 'write:tasks'],
   ['/api/v1/actions', 'write:actions'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.30",
+  "version": "1.0.40",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js"
+    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js toolsets/prospecting.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/work-hub/field-changes.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js"
   },
   "keywords": [
     "mcp",

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.30",
+  "version": "1.0.40",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.30",
+      "version": "1.0.40",
       "transport": {
         "type": "stdio"
       },

package/skills/qa-the-card/SKILL.md

@@ -178,8 +178,14 @@ does not establish that the screen is visually correct.
   `ADRATA_MCP_CONFIG_DIR`. It opens the exact deployed product bundle through a
   one-use, read-only loopback session: upstream reads keep the QA OAuth identity,
   writes fail locally, and private media capabilities remain process-private.
-  Record the returned session fingerprint and the deployed app build in the
-  playback evidence, then close the bridge.
+  It defaults to the canonical deployment on both halves — the canonical API for
+  the card and `https://adrata.com` for the bundle — and serves that origin's own
+  response policy, so whether a recording plays is decided by the deployed
+  `media-src` rather than by no policy at all. Record the returned session
+  fingerprint, the deployed app build, AND the `Deployed security policy served
+  by this bridge` line in the playback evidence, then close the bridge. If that
+  line is the WARNING instead, the bridge sent no policy and the playback it
+  showed says nothing about the deployed one.
 
 ## Manage cards as outcomes, not bug counters
 

package/skills/ship-the-card/SKILL.md

@@ -36,22 +36,34 @@ implementation-and-submit path below.
    available here, and the reviewer's comment is usually the one thing that
    would have stopped you.
 
-**A card carrying a `flag` is not workable.** The flag means somebody has already
-found a problem with the card ITSELF — unclear scope, no repro, a blocked
-dependency, a question waiting on an answer — and its `reason` says which. It is
-a different claim from the tag, which is only about urgency: a flagged Critical
-card is still not something to start on. Read the comments for the surrounding
-argument and pick a different card, unless you are the person who can answer it.
-If you resolve it, clear the flag with `flag_work_item` (`flagged: false`) and
-say what resolved it. Anyone may clear one, which is exactly why every clear is
-recorded as a comment.
-
-If the card is not workable — no repro, no expected behaviour, ambiguous scope —
-**flag it** with `flag_work_item` and the one question that would unblock it,
-then stop. Do not invent the missing half. Flagging is what turns "I could not
-work this" into something the next person sees before they pick it up, rather
-than a sentence in your report that nobody reads. An unworkable card is a triage
-problem, not a coding problem.
+**Read the flag's reason and `blocksClaim` separately.** A flag preserves a
+finding; `blocksClaim` says whether an agent can take the work. An ordinary
+failed test, fixture repair or deploy prerequisite that an agent can resolve
+stays claimable with `blocksClaim: false`. Keep the finding visible while
+repairing it. Urgency still comes from the tag, not the flag.
+
+Use `blocksClaim: true` only for an explicit prerequisite agents cannot satisfy,
+such as owner authorization, vendor consent or a product decision. Read its
+comments and take another workable card until that prerequisite is satisfied.
+When the field is absent, inspect the deployed API and tool contract: older
+versions treat every flag as blocking. Do not clear an unresolved finding to
+work around an old claim gate; record the release dependency instead.
+
+When the finding is resolved, use `flag_work_item` (`flagged: false`) with the
+`expectedFlagGeneration` captured for that finding and a concrete resolution
+reason. A stale-generation refusal means a newer finding must be read and
+resolved; substituting its generation without doing that loses the newer
+failure. If the generation is absent, do not invent one or claim the older
+client supplied concurrent-update protection. Record the release/client
+prerequisite. For a deployed QA repair, use `requeue_work_item_qa_after_fix` with the
+actual failed/deployed builds and `repairedFlagGeneration`, after proving the
+fix's relevant blobs are deployed. Clearing a flag is not a QA pass.
+
+If a missing repro, expected behavior or scope decision prevents work, record
+what is missing and the next action on the card. Set a blocking flag only when
+the prerequisite needs someone outside the agent work loop. Do not invent the
+missing half, and do not turn an ordinary engineering failure into an owner
+decision.
 
 ## Claim it, in the same move, FIRST
 
@@ -77,8 +89,10 @@ Three reasons, and the third is the real one:
 Reuse the same `idempotencyKey` if the call fails and you retry. The server
 replays rather than appending a second transition.
 
-**If the claim is refused**, the card already belongs to somebody: pick a
-different one. `force: true` exists — it takes the card over and demands a reason
+**If the claim is refused**, read its actual reason. Another worker, missing
+scope, readiness requirements or an older deployed gate can each refuse a claim.
+Resolve an agent-repairable prerequisite or pick another workable card; do not
+treat every refusal as proof of ownership. `force: true` exists — it takes the card over and demands a reason
 saying why — but it is for a card whose owner is genuinely gone, not for working
 around a refusal. Taking someone's card because it was convenient is the one move
 on this board that costs trust permanently. If you use it, say so in your report,
@@ -114,27 +128,22 @@ Two things to carry back to the card:
   session), so the next person at aligning can ask you what you meant; what it
   must not arrive with is a list of outcomes nobody can check.
 
-## Tick what you ran
-
-Before you move the card on, tick the criteria you actually executed, with
-`satisfy_work_item_acceptance_criterion` and the evidence in `note` — a build
-number, a run link, the caveat that makes it honest. An untouched checkbox says
-nothing about whether the check passed; it says nobody has been near it, which
-is the same thing an abandoned card says.
-
-Ticking from a build column records `claimed`, not `verified`. At a QA gate, an
-authenticated human may verify even when they own the card or authored the
-criterion: the human is the accountable exception when one person operates the
-workspace. An agent verifies only when its credential differs from the
-criterion author, and QA2 requires a different agent credential from the one
-whose clean receipt opened QA1. One AI cannot certify both gates. Tick anyway
-when the result is `claimed` — it is a real state that says the work is believed
-done and tells QA what to rerun. Never tick a box you did not execute merely to
-improve the count.
-
-If a tick turns out to be wrong, `unsatisfy_work_item_acceptance_criterion`
-takes it off. It clears the note with it, so if the evidence is worth keeping,
-put it on the card with `comment_on_work_item` first.
+## Record builder readiness
+
+Before QA1 entry, record the exact deployed build, implementation and test
+blobs, executed checks, failures and replay instructions in the builder
+handoff. Leave acceptance criteria **unmet and unverified** for independent QA,
+as required by `AGENTS.md` and the recorded staging QA standard. Readiness means
+deployed, testable and free of known card-specific failure; a missing fixture,
+failing relevant check or unexplained runtime failure keeps the card in its
+build column.
+
+The builder releases its build claim at handoff and does not consume a QA-pass
+lease or credential. A fresh independent reviewer follows `qa-the-card`; a
+fixer never certifies its own repair. If an earlier unsupported tick needs to
+be cleared, preserve its evidence in a comment before using
+`unsatisfy_work_item_acceptance_criterion` through the governed current-stage
+claim procedure.
 
 ## Submit it
 

package/tools/work-board-tools.js

@@ -1,3 +1,4 @@
+import { registerWorkItemFieldChanges } from './work-hub/field-changes.js';
 import { auditWorkHubBoards, deliveryContradictions } from './work-hub/audit.js';
 import { describeCriteriaQuality, inspectCriteria } from './work-hub/criteria-quality.js';
 import { createHash } from 'node:crypto';
@@ -184,6 +185,88 @@ export function describeMissingAcceptanceCriteria(criteria) {
   return 'This card would have no executable acceptance criteria. It can be captured, but it is not ready for build or QA until at least one where/when/then criterion is added.';
 }
 
+/**
+ * Why a card with no product will not reach a QA lane, or `undefined` if it has
+ * one.
+ *
+ * `product` reads like an optional label and is not one. Every QA drain claims
+ * for ONE exact product, and the dispatcher selects on `i.product = $4` — SQL
+ * equality against NULL is not true, so an unclassified card is not ranked last
+ * or shown late, it is absent from every product queue at once while each of
+ * them reports itself empty. Measured 2026-09-08 on the Adrata board: 3 of 7
+ * cards in Staging QA2 carried no product, a product-scoped census returned 0
+ * workable, and those three were the only workable cards there.
+ *
+ * Advisory rather than a refusal, on the same argument `describeMissingBody`
+ * makes: a refused capture is how work stops reaching the board at all. The
+ * preview is where the author is already deciding, and this is the cheapest
+ * moment the omission is ever visible.
+ */
+/**
+ * The population, the exclusions, and which exclusions are themselves suspect.
+ *
+ * Returned whether or not a card was claimed. Shaped as counts plus the cards
+ * behind them, because a total is the last thing to trust and a reader who
+ * doubts the summary needs the rows.
+ */
+export function describeEmptyQueue(census) {
+  const finished = census?.skippedFinished ?? [];
+  const unrouted = census?.unroutedProduct ?? [];
+  return {
+    considered: census?.considered ?? 0,
+    truncated: census?.truncated === true,
+    skippedFinishedCount: finished.length,
+    skippedFinished: finished,
+    unroutedProductCount: unrouted.length,
+    unroutedProduct: unrouted,
+  };
+}
+
+/**
+ * What a lane should DO about an empty answer.
+ *
+ * Ordered by what changes the lane's next action, most actionable first. The
+ * unrouted clause comes before the flat "nothing remains" sentence on purpose:
+ * a gate holding unclassified cards is NOT empty, and saying it is would be the
+ * same false all-clear in new words.
+ */
+export function emptyQueueNote(product, qaGate, skippedBlocked, census) {
+  const parts = [];
+  const finished = census?.skippedFinished?.length ?? 0;
+  const unrouted = census?.unroutedProduct?.length ?? 0;
+  const considered = census?.considered ?? 0;
+
+  if (skippedBlocked?.length) {
+    parts.push(
+      `${skippedBlocked.length} card(s) in this gate are blocked by another card. Do not re-claim — read the blockers in skippedBlocked.`
+    );
+  }
+  if (finished) {
+    parts.push(
+      `${finished} card(s) were skipped because every acceptance criterion is already verified in this dwell. They are DONE, not pending — do not re-run a pass on them; they are listed in census.skippedFinished for whoever advances them.`
+    );
+  }
+  if (unrouted) {
+    parts.push(
+      `${unrouted} card(s) stand in ${qaGate} with NO product set. They are invisible to every product-scoped lane at once, including this one — this gate is unrouted, not empty. Set a product on them (they are listed in census.unroutedProduct) rather than concluding there is no work here.`
+    );
+  }
+  if (census?.truncated) {
+    parts.push(
+      'The candidate window was full, so the ranking saw only its first page; this census describes that page, not the whole gate.'
+    );
+  }
+  if (!parts.length) {
+    return `No eligible unclaimed ${product} ${qaGate} pass remains on any visible board: ${considered} candidate(s) were considered and none was excluded. Pick another lane.`;
+  }
+  return `No workable ${product} ${qaGate} pass was handed out. ${considered} candidate(s) considered. ${parts.join(' ')}`;
+}
+
+export function describeMissingProduct(product) {
+  if (String(product ?? '').trim()) return undefined;
+  return 'This card would arrive with no `product`. QA lanes drain ONE exact product at a time and select on an exact match, so a card without one is invisible to every lane at once rather than merely deprioritised — and each of those queues reports itself empty. Set `product` unless you intend this card to be worked by hand.';
+}
+
 /**
  * Make the created card's own criteria counter agree with the criteria returned
  * beside it.
@@ -267,6 +350,7 @@ export function registerWorkBoardTools(
     uploadQaEvidenceFile = uploadLocalQaEvidenceFile,
   }
 ) {
+  registerWorkItemFieldChanges(server, { z, api, ok });
   const GOVERNED_NOTE =
     ' Governed write: previews by default. A live write requires dryRun:false plus approved:true, a reason, and an idempotencyKey (reuse the SAME key on retry — a duplicate move would read as the card having bounced between columns).';
   // Capability material belongs to this MCP process, not to the model transcript.
@@ -625,18 +709,26 @@ Start here for "what should I work on". With includeUnassigned it also returns t
       const outcome = data?.data ?? {};
       const selected = outcome.claimed;
       const skippedBlocked = outcome.skippedBlocked ?? [];
+      const census = outcome.census ?? {};
       if (!selected) {
-        // The empty-handed case is two different situations and a lane acts on
-        // them differently: an empty gate means pick another lane, while a
-        // fully-blocked one means go and look at the blockers.
+        // The empty-handed case is FOUR different situations and a lane acts on
+        // them differently: an empty gate means pick another lane; a
+        // fully-blocked one means go and look at the blockers; a gate whose
+        // work is all verified means the drain is finished; and cards with no
+        // product mean the queue is not empty at all, it is unrouted.
+        //
+        // So this answer shows its working rather than asserting a conclusion.
+        // A signal that can tell a worker to STOP has to be contradictable —
+        // this factory has already believed "there is genuinely nothing to pick
+        // up" once, from a count that could not be wrong out loud, while 211 of
+        // 212 claims sat on cards that had left the column.
         return ok({
           claimed: false,
           qaGate: args.qaGate,
           product: args.product,
           skippedBlocked,
-          note: skippedBlocked.length
-            ? `No workable ${args.product} ${args.qaGate} pass remains: ${skippedBlocked.length} card(s) in this gate are blocked by another card. Do not re-claim — look at the blockers listed in skippedBlocked.`
-            : `No eligible unclaimed ${args.product} ${args.qaGate} pass remains on any visible board.`,
+          census: describeEmptyQueue(census),
+          note: emptyQueueNote(args.product, args.qaGate, skippedBlocked, census),
         });
       }
       const visible = rememberWorkerLease(
@@ -648,6 +740,11 @@ Start here for "what should I work on". With includeUnassigned it also returns t
       return ok({
         claimed: true,
         skippedBlocked,
+        // Reported on the winning path as well. Three finished cards and two
+        // unrouted ones in this gate are a board finding whoever is reading,
+        // and a lane that only sees them on the empty pass learns about them
+        // last -- by which point it has no reason to look.
+        census: describeEmptyQueue(census),
         workItemId: selected.workItemId,
         boardId: selected.boardId,
         boardName: selected.boardName,
@@ -746,10 +843,11 @@ Start here for "what should I work on". With includeUnassigned it also returns t
 
   server.tool(
     'record_work_item_qa_failure_and_release',
-    `Durably record why the current QA pass cannot proceed, then safely release the process-private lease without moving the card. A failed criterion is flagged first, un-ticked, and left on the same QA card waiting for a fix and deployed build; it is NOT immediately reclaimable against the unchanged build. A dependency blocker is flagged in place. Both paths release the lease only after the durable safety state exists, so claim-next skips the card until an explicit requeue. This is one governed recovery recipe, not a new bug card and not a QA bounce.${GOVERNED_NOTE}`,
+    `Durably record why the current QA pass cannot proceed, then safely release the process-private lease without moving the card. A failed criterion is flagged first, un-ticked, and left on the same QA card for the next worker to diagnose, repair, deploy and independently retest. Ordinary failure and dependency handoffs remain claimable. Set blocksClaim:true only for an explicit prerequisite no agent can satisfy, such as owner consent or a vendor credential. Both paths release the lease only after the failure is durably recorded; a claimable handoff is not a QA pass. This is one governed recovery recipe, not a new bug card and not a QA bounce.${GOVERNED_NOTE}`,
     {
       itemId: z.string().describe('Card currently claimed by this MCP worker.'),
       disposition: z.enum(['failed_criterion', 'blocked_dependency']),
+      blocksClaim: z.boolean().optional().default(false).describe('Stop pickup only for an explicit prerequisite no agent can satisfy. Ordinary failed work remains claimable for repair and retest.'),
       criterionId: z.string().optional().describe('Required for failed_criterion; the exact acceptance criterion contradicted.'),
       details: z.string().describe('Concrete observed failure or blocker and the recovery needed. Stored on the card.'),
       dryRun: z.boolean().optional().default(true),
@@ -767,7 +865,7 @@ Start here for "what should I work on". With includeUnassigned it also returns t
       const preview = validateApiBridgeRequest({
         method: 'POST',
         path: `/api/v1/work-items/${encodeURIComponent(args.itemId)}/comments`,
-        body: { disposition: args.disposition, criterionId: args.criterionId, details: args.details },
+        body: { disposition: args.disposition, criterionId: args.criterionId, details: args.details, blocksClaim: args.blocksClaim === true },
         dryRun: args.dryRun, approved: args.approved, reason: args.reason,
         idempotencyKey: args.idempotencyKey, grantedScope: getGrantedScope(),
       });
@@ -779,10 +877,11 @@ Start here for "what should I work on". With includeUnassigned it also returns t
             disposition: args.disposition,
             criterionId: args.criterionId ?? null,
             details: args.details,
+            blocksClaim: args.blocksClaim === true,
           },
-          note: args.disposition === 'failed_criterion'
-            ? 'The card will stay in its QA column, be flagged and un-ticked, then release the pass while waiting for a fixed deployed build.'
-            : 'The card will be flagged in place and the pass handed off.',
+          note: args.blocksClaim === true
+            ? 'The card will be flagged in place and withheld from pickup until the explicit prerequisite is resolved.'
+            : 'The card will stay in place, retain its failure reason, and remain claimable for repair and retest after this pass is released.',
         });
       }
       const leaseHeaders = workerLeaseHeaders(args.itemId);
@@ -795,11 +894,11 @@ Start here for "what should I work on". With includeUnassigned it also returns t
       const flagReason = args.disposition === 'failed_criterion'
         ? `QA criterion failure (${args.criterionId}): ${args.details.trim()} Waiting for a fixed deployed build before requeue.`
         : args.details.trim();
-      // Flag first. If this composite is interrupted after any following step,
-      // claim-next still cannot put another worker into a hot loop on the same
-      // broken build. Every child is endpoint-idempotent, so a retry continues.
-      await api('POST', `/api/v1/work-items/${encodeURIComponent(args.itemId)}/flag`, {
-        body: { flagged: true, reason: flagReason, idempotencyKey: recordKey },
+      // Preserve the contradiction before un-ticking or releasing. Ordinary
+      // failures remain claimable so another worker can repair them; only an
+      // explicitly requested hold blocks pickup. Child writes are idempotent.
+      const recordedFlag = await api('POST', `/api/v1/work-items/${encodeURIComponent(args.itemId)}/flag`, {
+        body: { flagged: true, reason: flagReason, blocksClaim: args.blocksClaim === true, idempotencyKey: recordKey },
         headers: mutationHeadersForItem({ ...args, idempotencyKey: recordKey }, args.itemId),
       });
       if (args.disposition === 'failed_criterion') {
@@ -817,8 +916,10 @@ Start here for "what should I work on". With includeUnassigned it also returns t
         recorded: true,
         disposition: args.disposition,
         requeued: false,
-        blocked: true,
+        blocked: args.blocksClaim === true,
+        claimable: args.blocksClaim !== true,
         waitingForFix: args.disposition === 'failed_criterion',
+        flagGeneration: recordedFlag?.data?.recordedFlagGeneration ?? null,
         releaseKind,
         ...release,
       });
@@ -827,9 +928,10 @@ Start here for "what should I work on". With includeUnassigned it also returns t
 
   server.tool(
     'requeue_work_item_qa_after_fix',
-    `Clear a failed QA card’s waiting-for-fix flag only after a different exact build has been deployed and its relationship to the failed build has been checked. This does not claim the card; it makes the same card eligible for a fresh QA pass. The clear reason durably records both SHAs and the fix/deployment reference. The worker must verify ancestry in source control before calling this tool; this endpoint rejects the unchanged SHA but does not pretend to be a Git ancestry oracle.${GOVERNED_NOTE}`,
+    `Clear a failed QA card’s waiting-for-fix flag only after a different exact build has been deployed and its relationship to the failed build has been checked. This does not claim or certify the card; it clears the resolved hold or failure handoff before a fresh independent QA pass. The clear reason durably records both SHAs and the fix/deployment reference. The worker must verify ancestry in source control before calling this tool; this endpoint rejects the unchanged SHA but does not pretend to be a Git ancestry oracle.${GOVERNED_NOTE}`,
     {
       itemId: z.string().describe('Flagged QA card left in place by record_work_item_qa_failure_and_release.'),
+      repairedFlagGeneration: z.string().min(1).describe('The flag.generation captured for the failure actually repaired. Never substitute a newer flag generation without resolving that failure.'),
       failedBuildSha: z.string().length(40).describe('Exact lowercase 40-character SHA of the build that failed.'),
       deployedBuildSha: z.string().length(40).describe('Exact lowercase 40-character SHA of the newer deployed descendant build.'),
       details: z.string().describe('How ancestry and deployment were verified, including the fix PR or deployment reference.'),
@@ -849,6 +951,9 @@ Start here for "what should I work on". With includeUnassigned it also returns t
       if (!args.details?.trim()) {
         return ok({ error: true, message: 'details must name the ancestry check and deployment/fix reference.' });
       }
+      if (!args.repairedFlagGeneration?.trim()) {
+        return ok({ error: true, message: 'repairedFlagGeneration is required. Read and resolve the current failure before retrying; never substitute a newer generation for an older repair.' });
+      }
       const path = `/api/v1/work-items/${encodeURIComponent(args.itemId)}/flag`;
       const clearReason = `QA requeue: deployed ${args.deployedBuildSha} after failed ${args.failedBuildSha}. ${args.details.trim()}`;
       const preview = validateApiBridgeRequest({
@@ -856,13 +961,13 @@ Start here for "what should I work on". With includeUnassigned it also returns t
         reason: args.reason, idempotencyKey: args.idempotencyKey, grantedScope: getGrantedScope(),
       });
       if (preview.dryRun) {
-        return ok({ ...preview, wouldRequeue: { itemId: args.itemId, failedBuildSha: args.failedBuildSha, deployedBuildSha: args.deployedBuildSha } });
+        return ok({ ...preview, wouldRequeue: { itemId: args.itemId, failedBuildSha: args.failedBuildSha, deployedBuildSha: args.deployedBuildSha, repairedFlagGeneration: args.repairedFlagGeneration } });
       }
       const data = await api('POST', path, {
-        body: { flagged: false, reason: clearReason, idempotencyKey: args.idempotencyKey },
+        body: { flagged: false, reason: clearReason, expectedFlagGeneration: args.repairedFlagGeneration, idempotencyKey: args.idempotencyKey },
         headers: buildMutationHeaders(args),
       });
-      return ok({ requeued: true, item: data?.data, failedBuildSha: args.failedBuildSha, deployedBuildSha: args.deployedBuildSha });
+      return ok({ requeued: true, item: data?.data, failedBuildSha: args.failedBuildSha, deployedBuildSha: args.deployedBuildSha, repairedFlagGeneration: args.repairedFlagGeneration });
     }
   );
 
@@ -1272,6 +1377,41 @@ Start here for "what should I work on". With includeUnassigned it also returns t
     }
   );
 
+  server.tool(
+    'preview_work_item_acceptance_reaffirmation',
+    'Read the exact current criterion definitions and preserved independent QA evidence for a legacy human-accepted Ready to Ship card. Returns a content digest for a separate explicit owner decision. Original acceptance scope remains unknown; this never repairs missing QA.',
+    { itemId: z.string() },
+    async (args) => {
+      const data = await api('GET', `/api/v1/work-items/${encodeURIComponent(args.itemId)}/acceptance-reaffirmation`);
+      return ok(data?.data);
+    }
+  );
+
+  server.tool(
+    'reaffirm_work_item_current_acceptance',
+    `Record a separate owner approval of the exact CURRENT scope and existing QA evidence from preview_work_item_acceptance_reaffirmation. Only the authenticated delegated OAuth owner can do this. The original legacy acceptance receipt stays unchanged and its original scope stays unknown. This neither verifies criteria nor fills missing QA receipts. Use only on the owner's explicit instruction after reviewing the preview and limitation.${GOVERNED_NOTE}`,
+    {
+      itemId: z.string(), historyId: z.string(), originalReceiptId: z.string(),
+      contentSha256: z.string().regex(/^[0-9a-f]{64}$/),
+      acknowledgeOriginalScopeUnknown: z.literal(true),
+      receivingBuildSha: z.string().regex(/^[0-9a-f]{40}$/),
+      expiresAt: z.number().int(),
+      dryRun: z.boolean().optional(), approved: z.boolean().optional(),
+      reason: z.string().optional(), idempotencyKey: z.string().optional(),
+    },
+    async (args) => {
+      const path = `/api/v1/work-items/${encodeURIComponent(args.itemId)}/acceptance-reaffirmation`;
+      const preview = validateApiBridgeRequest({ method: 'POST', path, dryRun: args.dryRun,
+        approved: args.approved, reason: args.reason, idempotencyKey: args.idempotencyKey,
+        grantedScope: getGrantedScope() });
+      const { dryRun: _dryRun, ...body } = args;
+      if (preview?.dryRun) return ok({ ...preview, wouldReaffirm: body,
+        limitation: 'Original legacy acceptance scope remains unknown. This is a separate current acceptance.' });
+      const data = await api('POST', path, { body, headers: buildMutationHeaders(args) });
+      return ok({ reaffirmed: true, receipt: data?.data });
+    }
+  );
+
   server.tool(
     'move_work_item',
     `Move a card to another column on the same board — and, outside QA, use claim:true to pick it up in the same action. The server does this in ONE transaction: it closes the card's open dwell, appends the transition to the history, records you as the handler of the pass the card is now on, and updates the card. Dropping a card into the column it is already in is a REORDER and deliberately does not restamp the stage timer.
@@ -1304,6 +1444,20 @@ QA PASSES ARE THE EXCEPTION. An executable QA worker must hold the process-priva
         ),
       dryRun: z.boolean().optional().describe('Defaults to true. Set false for a live move.'),
       approved: z.boolean().optional().describe('Required true for a live move.'),
+      presenceAttestation: z.string().optional().describe('Single-use human-minted presence token. This remains separate from owner delegation.'),
+      ownerApproval: z.object({
+        approved: z.literal(true),
+        itemId: z.string(),
+        toColumnId: z.string(),
+        idempotencyKey: z.string(),
+        acceptanceReceiptId: z.string(),
+        reaffirmationReceiptId: z.string().optional().describe('Separate current acceptance receipt for legacy original scope; never a backfilled original receipt.'),
+        reviewedBuildSha: z.string().regex(/^[0-9a-f]{40}$/),
+        receivingBuildSha: z.string().regex(/^[0-9a-f]{40}$/),
+        expiresAt: z.number().int(),
+      }).strict().optional().describe(
+        'Explicit owner-delegated Production request. Use only after the owner approves this exact card, destination, accepted QA2 closing receipt and reviewed delivery build. Expires within five minutes. Server requires the authenticated owner’s delegated OAuth credential and preserves species agent. This is delegated authority, not cryptographic proof of human presence. receivingBuildSha is the live API build; reviewedBuildSha is the separately reviewed component build and must match receipt.commitSha.'
+      ),
       reason: z
         .string()
         .optional()
@@ -1426,6 +1580,8 @@ QA PASSES ARE THE EXCEPTION. An executable QA worker must hold the process-priva
             claim: args.claim === true,
             force: args.force === true,
             receipt: args.receipt !== undefined,
+            ownerApproval: args.ownerApproval,
+            presenceAttestation: args.presenceAttestation !== undefined,
           },
           wip: projectColumnWip({
             limit: target.wipLimit,
@@ -1493,6 +1649,8 @@ QA PASSES ARE THE EXCEPTION. An executable QA worker must hold the process-priva
           acknowledgeUnmetCriteria:
             args.acknowledgeUnmetCriteria === true ? true : undefined,
           receipt: args.receipt,
+          ownerApproval: args.ownerApproval,
+          presenceAttestation: args.presenceAttestation,
         },
         headers: mutationHeadersForItem(args, args.itemId),
       });
@@ -1979,6 +2137,9 @@ YOU DO NOT NEED TO SAY WHO IS CREATING IT. The card records its creator from you
           // capture is how work stops reaching the board at all.
           note: describeMissingBody(args.body),
           readinessNote: describeMissingAcceptanceCriteria(args.acceptanceCriteria),
+          // A missing product is not a missing label: it is the difference
+          // between a card a QA lane can be handed and one no lane can see.
+          routingNote: describeMissingProduct(args.product),
           // Advisory, and only ever present when it has something to say. The
           // preview is where an author is already deciding whether to approve,
           // and a criterion that cannot fail is cheapest to fix before the card
@@ -2602,34 +2763,33 @@ TO @-MENTION SOMEBODY, write the token \`<@userId>\` in the body — the id come
 
   server.tool(
     'flag_work_item',
-    `Flag a card as having a problem WITH THE CARD — unclear scope, no repro, a blocked dependency, a question waiting on an answer — or clear a flag once it is resolved. A flagged card is drawn differently on the board so nobody picks it up by mistake.
+    `Flag unresolved work for the next repair and retest, or clear a flag once its reason is resolved. Ordinary failures remain visible and claimable.
 
-A FLAG IS NOT A TAG. The tag says how urgent the WORK is; a flag says the CARD is not fit to be worked. If a card is merely important, use set_work_item_tag. If you cannot start because something is missing, flag it.
+A FLAG IS NOT A TAG. The tag says how urgent the work is; a flag records an unresolved problem. If a card is merely important, use set_work_item_tag.
 
-THE REASON IS REQUIRED IN BOTH DIRECTIONS, and it is not the audit reason — it is the text a human reads on the card. Raising says what is wrong; clearing says what resolved it. Anyone may clear a flag, which only works because both directions are recorded as a comment on the card.
+THE REASON IS REQUIRED IN BOTH DIRECTIONS, and it is not the audit reason — it is the text read on the card. Raising says what failed, what you tried, and what remains to check; clearing says what resolved it. Agents may clear a resolved flag without a human handoff. Both directions append a comment, preserving the original failure and its resolution.
 
-This is what the ship-the-card skill means by "an unworkable card is a triage problem, not a coding problem": flag it, say the one question that would unblock it, and stop.
+A FLAG HANDS THE CARD ON; IT DOES NOT HIDE IT. A failed test or an unsuccessful first repair is not an external hold. Leave it claimable so the next agent can investigate, repair, and independently retest. Clearing a flag does not certify acceptance criteria or replace either QA gate.
 
-A FLAG HANDS THE CARD ON; IT DOES NOT HIDE IT. Raising one leaves the card claimable, so another agent picks it up, reads your reason, and tries — and reflags with what it learned if it fails too. That loop is the point: write the reason for the next agent, not for a log. Say what you tried and what you ruled out, because they will otherwise re-derive it.
-
-PASS blocksClaim:true ONLY FOR A BLOCKER NO AGENT CAN SATISFY — an owner credential, a vendor consent, a product decision. That takes the card out of every reviewer's queue until somebody clears it by hand, so it is the wrong answer for "the test failed" or "I could not work out why". If another agent could plausibly get further, leave it claimable.${GOVERNED_NOTE}`,
+PASS blocksClaim:true ONLY FOR AN EXPLICIT PREREQUISITE AGENTS CANNOT SATISFY — owner authorization, vendor consent, or a product decision. The hold remains until that prerequisite is satisfied and the flag is cleared with a resolution reason. Do not turn an ordinary test failure into an owner decision.${GOVERNED_NOTE}`,
     {
       itemId: z.string().describe('Card id.'),
       flagged: z
         .boolean()
         .describe(
-          'true raises the flag; false clears it. Raising an already-flagged card replaces the reason.'
+          'true raises the flag; false clears it. Raising an already-flagged card replaces the reason, and that is an EDIT rather than a second flag: the card carries a lifetime count of how many times it has been flagged (drawn on the board as a stack of one, two, three, or three-plus pennants), and only an unflagged card becoming flagged increments it. So narrowing a live flag costs nothing, and a card showing four pennants really has been through the loop four times.'
         ),
       reason: z
         .string()
         .describe(
           'REQUIRED. Raising: what is wrong with the card. Clearing: what resolved it. Shown on the card and appended to its comment thread — write it for the person who will read it, not for a log.'
         ),
+      expectedFlagGeneration: z.string().optional().describe('Required when clearing: flag.generation captured for the failure actually resolved. A stale generation is refused; inspect and resolve the newer flag before another clear.'),
       blocksClaim: z
         .boolean()
         .optional()
         .describe(
-          'Whether this flag stops anyone picking the card up. OMITTED MEANS FALSE — the card stays claimable and another agent can try, which is what a flag is for. Pass true only for a blocker no agent can satisfy (an owner credential, a vendor consent, a decision); that hides the card until somebody clears the flag by hand. Ignored when clearing — clearing always restores the blocking default.'
+          'Whether this flag prevents claims. OMITTED MEANS FALSE: ordinary failed work remains claimable for repair and independent retest. Pass true only for an explicit prerequisite agents cannot satisfy, such as owner authorization or vendor consent. Clear after that prerequisite is satisfied, recording the resolution. Ignored when clearing.'
         ),
       dryRun: z.boolean().optional().describe('Defaults to true. Set false to change the flag.'),
       approved: z.boolean().optional().describe('Required true for a live change.'),
@@ -2645,10 +2805,13 @@ PASS blocksClaim:true ONLY FOR A BLOCKER NO AGENT CAN SATISFY — an owner crede
         return ok({
           error: true,
           message:
-            'reason is required to flag or to clear. A flag with nothing written on it stops work without saying how to restart it, and a flag anyone can silently clear is a flag nobody trusts.',
+            'reason is required to flag or to clear. Record the unresolved problem when raising and what resolved it when clearing; both become card history.',
         });
       }
 
+      if (!args.flagged && !args.expectedFlagGeneration?.trim()) {
+        return ok({ error: true, message: 'Clearing requires expectedFlagGeneration from the failure actually resolved. Read and resolve the current flag before retrying.' });
+      }
       const path = `/api/v1/work-items/${encodeURIComponent(args.itemId)}/flag`;
       const preview = validateApiBridgeRequest({
         method: 'POST',
@@ -2668,6 +2831,7 @@ PASS blocksClaim:true ONLY FOR A BLOCKER NO AGENT CAN SATISFY — an owner crede
           wouldFlag: {
             itemId: args.itemId,
             flagged: args.flagged,
+            expectedFlagGeneration: args.expectedFlagGeneration,
             reason: args.reason,
             // Shown in the rehearsal because it decides whether the card
             // disappears from every queue, which is the consequence a reader
@@ -2680,12 +2844,12 @@ PASS blocksClaim:true ONLY FOR A BLOCKER NO AGENT CAN SATISFY — an owner crede
       const data = await api('POST', path, {
         body: {
           flagged: args.flagged,
+          expectedFlagGeneration: args.expectedFlagGeneration,
           reason: args.reason,
           idempotencyKey: args.idempotencyKey,
-          // Sent only when the caller named it, so an older API that does not
-          // know the field is not handed one, and the server's own default
-          // (blocking) remains the single source of that decision.
-          ...(args.blocksClaim === undefined ? {} : { blocksClaim: args.blocksClaim }),
+          // Match the preview explicitly: ordinary failures remain claimable.
+          // Clearing ignores this field on the server.
+          blocksClaim: args.flagged ? (args.blocksClaim ?? false) : true,
         },
         headers: buildMutationHeaders({ ...args, reason: args.reason }),
       });
@@ -2876,6 +3040,8 @@ THE REASON IS REQUIRED HERE TOO — what changed. Anyone can bring a card back,
 
 /** Tool names registered here, for the tier map and the toolset manifest. */
 export const WORK_BOARD_TOOL_NAMES = [
+  'preview_work_item_acceptance_reaffirmation',
+  'reaffirm_work_item_current_acceptance',
   'list_my_work_items',
   'list_work_boards',
   'get_work_board',
@@ -2889,6 +3055,7 @@ export const WORK_BOARD_TOOL_NAMES = [
   'record_work_item_qa_failure_and_release',
   'requeue_work_item_qa_after_fix',
   'get_work_item_history',
+  'get_work_item_field_changes',
   'get_work_item_delivery_evidence',
   'audit_work_hub',
   'list_work_item_acceptance_criteria',

package/tools/work-hub/criteria-quality.js

@@ -52,6 +52,50 @@
  * word. The cost of that false positive is an author learning to ignore the
  * notes, which is worse than the check not existing. When in doubt these rules
  * stay silent.
+ *
+ * # The 2026-09-08 correction: it was firing on the good ones
+ *
+ * Measured across a complete census — 648 criteria on 220 cards — the
+ * placeholder rule found **zero of the 12 genuinely unexecutable criteria** and
+ * produced **seven false positives**. That is worse than no check at all,
+ * because it is believed: it steers a grader toward well-written criteria and
+ * away from the ones that cannot fail. What it fired on, verbatim:
+ *
+ *   - `WIP = throughput × cycle time` and the WIP-limit card itself, on a board
+ *     whose own feature is WIP limits.
+ *   - `The <video> element autoplays muted …`, because `<[^>]{0,40}>` cannot
+ *     tell a referent from an unfilled slot.
+ *   - `The draft email body contains no placeholder tokens` — a criterion that
+ *     is correct *because* it says that word.
+ *   - the classifier's own fixture card, which must name TODO and N/A as data.
+ *
+ * Three repairs follow, and each is a NARROWING that had to be tested in both
+ * directions — a genuine `TODO` must still fire, or the fix is just a silence:
+ *
+ *   1. **`wip` is gone.** It is a live domain term here and nothing in this
+ *      corpus separates "WIP limit" from "WIP" as an unfinished marker. #3871
+ *      tried a `(?![\s-]+limits?)` lookahead; it still fired on a sentence
+ *      carrying BOTH senses. Removing a token that cannot discriminate is a
+ *      strengthening — every remaining token means one thing.
+ *   2. **Angle brackets classify the inner text** (`isUnfilledSlot`) instead of
+ *      matching any `<…>`. `<video>` and `<Button>` are referents; `<name>` and
+ *      `<fill this in>` are slots.
+ *   3. **A negated or quoted mention does not fire.** "contains no placeholder",
+ *      "must not say TODO", "names TODO as data" — the criterion is naming the
+ *      thing it forbids or the literal it expects. Same shape as the flag
+ *      disclaimer window in `scripts/fleet/stale-flag-detector.mjs`.
+ *
+ * And the other half, which is the more valuable one: the check missed EVERY
+ * real defect, so `ADJECTIVAL_THEN` and `CATEGORICAL_WHERE` were added for the
+ * two commonest shapes in that census — a `then` that is pure adjectives
+ * ("warm, sharp, candid", "near black", "usable overflow") and a `where` that
+ * names a category rather than a place ("Representative seller conversations",
+ * "code/api — wherever it is implemented"). Both stay advisory.
+ *
+ * Two shapes from that census are deliberately NOT attempted here, because a
+ * regex would guess: several fault states folded into one criterion (one had
+ * seven), and a `then` naming no value at all in a long sentence. Both need to
+ * read the sentence, not match it.
  */
 
 /** Lowercase, collapse whitespace, drop trailing punctuation. */
@@ -109,11 +153,179 @@ const UNLOCATED_WHERE = [
   /^(?:it|this|there|here|everywhere|anywhere|all surfaces|any surface|none|various)$/,
 ];
 
-/** Text nobody has written yet, left in a field that is required to be written. */
-// WIP limit(s) names the board feature, not unfinished prose. Exempt only that
-// noun phrase; bare WIP and separate placeholders in the same field still fire.
-const PLACEHOLDER =
-  /(?:^|[^a-z0-9])(?:tbd|tba|todo|fixme|wip(?![\s-]+limits?\b)|xxx|placeholder|n\/a)(?:[^a-z0-9]|$)|\?{3,}|<[^>]{0,40}>/i;
+/**
+ * A `where` that names a CATEGORY of place rather than a place.
+ *
+ * Distinct from `UNLOCATED_WHERE`, which catches the whole-product noun. This
+ * catches the field that reads like a sampling frame — "Representative seller
+ * conversations" — or that defers the location to the reader — "code/api —
+ * wherever it is implemented". Both are answers to "what kind of place"; the
+ * field asks "which one", and the next reviewer cannot stand in a category.
+ *
+ * `all` / `each` / `every` are deliberately absent from the quantifier list: "all
+ * three boards in the workspace" is an exhaustive scope, which is a real answer.
+ */
+const CATEGORICAL_WHERE = [
+  /^(?:a |an |the )?(?:representative|typical|assorted|various|relevant|appropriate|applicable|indicative|sample|example|some|several|a few|any)\b/,
+  /\b(?:wherever|as applicable|if applicable|as appropriate|as needed|where (?:it|they|that) (?:is|are) (?:implemented|used|defined|rendered|handled))\b/,
+];
+
+/**
+ * A `then` made only of adjectives — the commonest real defect in the census
+ * and one the rules above could not see, because it is not a fixed phrase.
+ *
+ * Three conditions, all required, and the conjunction is what keeps it quiet:
+ * the clause is at most three words, it carries no falsifiable anchor (see
+ * `hasFalsifiableAnchor`), and at least one of its words is a subjective quality
+ * word. "The badge is green" is four words and stays silent; "near black" is two
+ * and does not.
+ */
+const VAGUE_QUALITY = new Set([
+  // quality adjectives a reviewer cannot disagree with
+  'warm', 'sharp', 'candid', 'crisp', 'clean', 'clear', 'smooth', 'snappy',
+  'polished', 'tidy', 'neat', 'readable', 'legible', 'usable', 'sensible',
+  'reasonable', 'appropriate', 'nice', 'pleasant', 'elegant', 'modern',
+  'professional', 'intuitive', 'seamless', 'robust', 'solid', 'consistent',
+  'coherent', 'obvious', 'natural', 'comfortable', 'balanced', 'subtle',
+  'punchy', 'tight', 'generous', 'minimal', 'simple', 'friendly',
+  'approachable', 'compelling', 'engaging', 'delightful', 'beautiful',
+  'responsive', 'performant', 'stable', 'reliable', 'good', 'great', 'fine',
+  'better', 'improved', 'acceptable', 'adequate', 'sufficient', 'correct',
+  'proper', 'right', 'accurate',
+  // hedges — a value that is "near" something is not a value
+  'near', 'roughly', 'approximately', 'about', 'around', 'slightly', 'somewhat',
+  'fairly', 'quite', 'very', 'pretty', 'mostly', 'generally', 'largely',
+  // bare colour and size, with no value beside them
+  'black', 'white', 'grey', 'gray', 'dark', 'light', 'big', 'small', 'large',
+  'tall', 'short', 'wide', 'narrow', 'thin', 'thick', 'fast', 'slow', 'quick',
+]);
+
+/**
+ * Something in the clause a reviewer could look for and fail to find: a number,
+ * a quoted or code-fenced literal, a path or identifier, or a capitalised label
+ * anywhere but the sentence's first word.
+ *
+ * Read on the RAW text, not the normalised one, because normalising lowercases
+ * — and case is half of what makes a label a label.
+ */
+function hasFalsifiableAnchor(raw) {
+  const text = String(raw ?? '').trim();
+  if (!text) return false;
+  if (/[0-9]/.test(text)) return true;
+  if (/["'`“”‘’]/.test(text)) return true;
+  if (/[/_=<>{}()[\]#%]/.test(text)) return true;
+  const words = text.split(/\s+/);
+  return words.slice(1).some((word) => /^[A-Z]/.test(word) || /[a-z][A-Z]/.test(word));
+}
+
+/**
+ * Placeholder markers. `wip` is deliberately absent — see the header. `tbc` is
+ * new and unambiguous, and it is what made `<copy tbc>` detectable once the
+ * blanket angle-bracket rule went.
+ */
+const PLACEHOLDER_MARKER = /(?:^|[^a-z0-9])(tbd|tba|tbc|todo|fixme|xxx|placeholder|n\/a)(?:[^a-z0-9]|$)/gi;
+
+/** Three or more question marks is nobody's referent. */
+const UNANSWERED = /\?{3,}/;
+
+/**
+ * A marker the author is NAMING rather than leaving behind.
+ *
+ * Two families, one window. Negation — "contains no placeholder", "must not say
+ * TODO" — and quotation verbs — "names TODO as data", "the literal TODO". The
+ * 24-character window is the same bounded-lookback shape as `disclaimerNearRef`
+ * in `scripts/fleet/stale-flag-detector.mjs`: near enough to be about this
+ * marker, short enough that a negation two sentences back cannot excuse it.
+ *
+ * `reads` / `shows` / `displays` are deliberately NOT here. "The banner reads
+ * TBD" is genuinely ambiguous between an expected literal and an unfinished
+ * clause, and this file's standing rule is that ambiguity stays loud in the
+ * direction of the marker.
+ *
+ * The window stops at `. , ; :` as well as at 24 characters. That clause
+ * boundary is what keeps "the summary names every owner, TBD which column"
+ * firing: the naming verb is inside 24 characters but it is about a different
+ * object, and the comma says so.
+ */
+const EXCUSED_BEFORE =
+  /\b(?:no|not|never|without|absent|excluding|neither|nor|free of|rather than|other than|names?|named|naming|quotes?|quoted|literal(?:ly)?|marker|markers|token|tokens|string|strings|word|words|spelled|spelling|placeholder)\b[^.,;:]{0,24}$/i;
+
+/** A marker wrapped in quotes or backticks is a literal under discussion. */
+function isQuotedAt(text, start, end) {
+  const before = text.slice(Math.max(0, start - 1), start);
+  const after = text.slice(end, end + 1);
+  return /["'`“‘]/.test(before) && /["'`”’]/.test(after);
+}
+
+/**
+ * HTML element names, so `<video>` reads as the referent it is. Not exhaustive
+ * and does not need to be: everything it misses falls through to the
+ * capitalised-component and multi-word tests below.
+ */
+const HTML_ELEMENTS = new Set(
+  ('a abbr address area article aside audio b base bdi bdo blockquote body br button canvas caption ' +
+    'cite code col colgroup data datalist dd del details dfn dialog div dl dt em embed fieldset ' +
+    'figcaption figure footer form h1 h2 h3 h4 h5 h6 head header hgroup hr html i iframe img input ' +
+    'ins kbd label legend li link main map mark menu meta meter nav noscript object ol optgroup ' +
+    'option output p param picture pre progress q rp rt ruby s samp script section select slot small ' +
+    'source span strong style sub summary sup table tbody td template textarea tfoot th thead time ' +
+    'title tr track u ul var video wbr svg path circle rect g defs use'
+  ).split(' ')
+);
+
+/**
+ * Does `<…>` hold an unfilled slot, or a referent the author meant to name?
+ *
+ * The blanket `<[^>]{0,40}>` this replaces could not tell them apart, so it
+ * flagged `<video>`. Order matters: attributes and closing tags settle it first,
+ * then a multi-word inside is prose and therefore a slot, then a capitalised
+ * single token is a JSX component, then a known element name.
+ *
+ * What is left — a lowercase single token that is not an HTML element — is read
+ * as a slot: `<name>`, `<slug>`, `<workspace>`. The cost of that choice is a
+ * custom element like `<my-widget>` written bare in a criterion, which is rarer
+ * in this corpus than the slot it catches.
+ */
+function isUnfilledSlot(inner) {
+  const text = inner.trim();
+  if (!text || text.length > 40) return false;
+  if (text !== inner) return false; // "a < b and c > d" — padded, so it is a comparison
+  if (text.includes('=')) return false; // <input type="text">
+  if (/^[/!?]/.test(text)) return false; // </div>, <!-- -->, <?xml
+  const words = text.split(/\s+/);
+  if (words.length > 1) return words.length <= 5 && words.every((word) => /^[\w'’-]+$/.test(word));
+  const token = text.replace(/\/$/, ''); // <br/>
+  if (/^[A-Z]/.test(token)) return false; // <Button> — a JSX component
+  return !HTML_ELEMENTS.has(token.toLowerCase());
+}
+
+/**
+ * Every placeholder marker in one field that is not excused, plus any unfilled
+ * angle-bracket slot. Returns the matched text, or `null` when the field is
+ * clean — the caller only needs to know whether to speak.
+ */
+export function findPlaceholder(raw) {
+  const text = String(raw ?? '');
+  if (!text.trim()) return null;
+
+  PLACEHOLDER_MARKER.lastIndex = 0;
+  for (const hit of text.matchAll(PLACEHOLDER_MARKER)) {
+    const marker = hit[1];
+    const start = hit.index + hit[0].indexOf(marker);
+    const end = start + marker.length;
+    if (isQuotedAt(text, start, end)) continue;
+    if (EXCUSED_BEFORE.test(text.slice(0, start))) continue;
+    return marker;
+  }
+
+  if (UNANSWERED.test(text)) return text.match(UNANSWERED)[0];
+
+  for (const hit of text.matchAll(/<([^<>]*)>/g)) {
+    if (isUnfilledSlot(hit[1])) return hit[0];
+  }
+
+  return null;
+}
 
 const PART_LABELS = {
   whereText: 'where',
@@ -144,6 +356,29 @@ export function inspectCriterion(criterion, { ordinal = null, id = null } = {})
     });
   }
 
+  // A `then` of at most three adjectives, with nothing in it to look for.
+  // Ordered after UNFALSIFIABLE_THEN and guarded on it, because "it works" is
+  // both, and one clause earning two findings reads as the check stuttering.
+  if (thenText && !findings.some((finding) => finding.code === 'unfalsifiable_then')) {
+    const words = thenText.split(' ').map((word) => word.replace(/[^a-z-]/g, ''));
+    const content = words.filter(Boolean);
+    if (
+      content.length > 0 &&
+      content.length <= 3 &&
+      !hasFalsifiableAnchor(criterion.thenText) &&
+      content.some((word) => VAGUE_QUALITY.has(word))
+    ) {
+      findings.push({
+        ...at,
+        code: 'adjectival_then',
+        field: 'thenText',
+        text: String(criterion.thenText).trim(),
+        detail:
+          'The observable result is a quality, not an observation — there is no value, count, state, or exact message in it for a reviewer to look for. Say what is on the screen or in the response.',
+      });
+    }
+  }
+
   const whereText = normalise(criterion?.whereText);
   if (whereText && UNLOCATED_WHERE.some((pattern) => pattern.test(whereText))) {
     findings.push({
@@ -154,17 +389,29 @@ export function inspectCriterion(criterion, { ordinal = null, id = null } = {})
       detail:
         'This names the whole product rather than a place to stand. Give the surface, environment, account, or role the next reviewer should check it on.',
     });
+  } else if (whereText && CATEGORICAL_WHERE.some((pattern) => pattern.test(whereText))) {
+    findings.push({
+      ...at,
+      code: 'categorical_where',
+      field: 'whereText',
+      text: String(criterion.whereText).trim(),
+      detail:
+        'This names a kind of place rather than one place. The next reviewer cannot stand in a category — name the specific surface, record, account, or route to open.',
+    });
   }
 
   for (const [field, label] of Object.entries(PART_LABELS)) {
     const raw = criterion?.[field];
-    if (typeof raw === 'string' && raw.trim() && PLACEHOLDER.test(raw)) {
+    if (typeof raw !== 'string') continue;
+    const marker = findPlaceholder(raw);
+    if (marker) {
       findings.push({
         ...at,
         code: 'placeholder_text',
         field,
         text: raw.trim(),
-        detail: `The ${label} clause still carries a placeholder. A criterion nobody has finished writing cannot be executed by somebody who did not write the code.`,
+        marker,
+        detail: `The ${label} clause still carries a placeholder (${marker}). A criterion nobody has finished writing cannot be executed by somebody who did not write the code.`,
       });
     }
   }

package/tools/work-hub/field-changes.js

@@ -0,0 +1,25 @@
+/** One authenticated read; unavailable history must never become an empty record. */
+export function registerWorkItemFieldChanges(server, { z, api, ok }) {
+  server.tool(
+    'get_work_item_field_changes',
+    'Read recorded edits to one card, newest first: field, previous and new values, actor, timestamp, reason and its source. Assignee names are current workspace directory labels; stored ids remain the historical values. Truncation is explicit. An empty result means no field changes were recorded, not that the card was never edited; older edits may predate recording. Reasons are the writer’s account, not independent QA evidence. Credential identifiers and worker capabilities are never returned.',
+    { itemId: z.string().describe('Card id.') },
+    async ({ itemId }) => {
+      const response = await api(
+        'GET',
+        `/api/v1/work-items/${encodeURIComponent(itemId)}/field-changes`
+      );
+      if (!Array.isArray(response?.data)) {
+        throw new Error(
+          'Field-change history was unavailable or malformed; no empty-history claim can be made.'
+        );
+      }
+      return ok({
+        count: response.data.length,
+        changes: response.data,
+        howToRead:
+          'Newest first. No rows means no recorded field changes; older edits may predate recording. A missing reason or identity was not recorded. Directory names are current labels for the stored assignee ids.',
+      });
+    }
+  );
+}

package/toolsets/prospecting.js

@@ -1,9 +1,10 @@
 /**
- * Prospecting Toolset (6 tools, Pro tier)
+ * Prospecting Toolset (9 tools, Pro tier)
  *
  * qualify_company, research_company, research_person,
  * get_priority_pursuits, get_speedrun_list (legacy alias), discover_prospects,
- * get_next_contacts
+ * get_next_contacts, commit_lead_to_outbound, release_lead_from_outbound,
+ * list_outbound_leads
  */
 
 import { z } from 'zod';
@@ -17,7 +18,19 @@ import {
   previewMarkdown, enrichCostLine,
   COMPANY_ENRICH_COST_SENTENCE, PERSON_ENRICH_COST_SENTENCE,
 } from '../governance/governed-args.js';
-import { governedWrite } from '../api-bridge.js';
+import { governedWrite, buildMutationHeaders } from '../api-bridge.js';
+
+/**
+ * The lead list that IS Pipeline's Outbound stage.
+ *
+ * `/targets` and Pipeline agree on who is committed by reading one list: the workspace's lead
+ * list whose `description` carries this marker. The display name is deliberately ordinary and
+ * deliberately NOT the identity — a user is free to make a list called "Outbound" for their own
+ * reasons, and it must never become product state. Mirrors `LEAD_COMMITMENT_MARKER` in
+ * `code/desktop/src/renderer/src/api/lead-commitment.ts`; `prospecting.test.js` pins the two to
+ * the same string because two packages cannot share the constant.
+ */
+export const LEAD_COMMITMENT_MARKER = 'starfield:sell:lead-commitment:v1';
 
 /**
  * Run the enrichment leg of a research tool through the governed-write
@@ -417,4 +430,182 @@ export function register(server, api, AUTH) {
       }
     }
   );
+
+  // -----------------------------------------------------------------------
+  // Outbound commitment — the /targets line, over MCP
+  //
+  // The leads surface has two halves: Outbound above the line, Targets below it. Crossing the
+  // line is ONE governed write — add or remove the person on the marker-owned lead list — and
+  // Pipeline's Outbound column reads that same list. These three tools are that gesture for an
+  // agent. They add no API surface: `POST/DELETE /lead-lists/{id}/members` existed and was in the
+  // bridge allowlist; what was missing was the knowledge of WHICH list, and a caller who reached
+  // for `add_to_lead_list` with the wrong id landed the person in a list the product never reads.
+  //
+  // The API's scope_guard maps `/lead-lists` writes onto `read:speedrun`
+  // (code/api/crates/middleware/src/scope_guard/mod.rs), which every issued grant carries, so the
+  // approval, reason and idempotency key are the whole gate here — and they are the same gate
+  // every other governed write in this server uses.
+  // -----------------------------------------------------------------------
+
+  /** The marker-owned Outbound list, or `null` — never a user's list that shares a display name. */
+  async function findOutboundList() {
+    const body = await api('GET', '/api/v1/lead-lists', { params: { limit: 500, page: 1 } });
+    const rows = Array.isArray(body?.data) ? body.data : [];
+    return rows.find((row) => row?.description === LEAD_COMMITMENT_MARKER) ?? null;
+  }
+
+  /** The Outbound members, named the way the members endpoint names them. */
+  async function outboundMembers(listId) {
+    const body = await api('GET', `/api/v1/lead-lists/${listId}/members`, {});
+    return Array.isArray(body?.data) ? body.data : [];
+  }
+
+  /** The refusal for a live write that lacks approval — checked BEFORE any step runs, because
+   *  the commit can carry a list-creation step and a refusal must leave nothing behind. */
+  function refuseIfUnapproved(args, method, path) {
+    if (!isLiveWrite(args)) return null;
+    const missing = missingLiveWriteFields(args);
+    if (missing.length === 0) return null;
+    // `isError` is the MCP-level flag a host reads; `mdError` alone only styles the text. A
+    // refused write that reads as a success envelope is how a caller retries with the same
+    // missing field — the communications pack sets it for the same reason.
+    return {
+      ...mdError(
+        `Live write refused — missing ${missing.join(', ')}`,
+        `Nothing was sent to ${method} ${path}. Re-call with dryRun:false plus ${missing.join(', ')}.`,
+      ),
+      isError: true,
+    };
+  }
+
+  server.tool(
+    'commit_lead_to_outbound',
+    'Commit a lead to Outbound. On /targets the Outbound half above the line IS Pipeline\'s Outbound stage, so this is the pipeline move for a person: it adds them to the workspace\'s marker-owned Outbound lead list, creating that list on the very first commitment. Use list_outbound_leads to read who is there and release_lead_from_outbound to take someone back out.' +
+      governedWriteNote('read:speedrun'),
+    {
+      personId: z.string().min(1).describe('The person (lead) to commit to Outbound'),
+      ...governedWriteArgs(z),
+    },
+    async (args) => {
+      try {
+        const list = await findOutboundList();
+        // A canonical placeholder segment, because the bridge refuses a non-pathname; the note
+        // beside it says what a live write does about the missing list.
+        const path = `/api/v1/lead-lists/${list ? list.id : 'new-outbound-list'}/members`;
+        const refused = refuseIfUnapproved(args, 'POST', path);
+        if (refused) return refused;
+
+        let listId = list?.id ?? null;
+        if (!listId && isLiveWrite(args)) {
+          // Same approval, same reason, same idempotency key as the member write that follows:
+          // the two requests are one decision, and neither route replays by key.
+          const created = await api('POST', '/api/v1/lead-lists', {
+            body: { name: 'Up Next', description: LEAD_COMMITMENT_MARKER },
+            headers: buildMutationHeaders(args),
+          });
+          listId = created?.data?.id;
+          if (!listId) throw new Error('creating the Outbound list returned no id');
+        }
+
+        const outcome = await governedWrite(api, args, {
+          method: 'POST',
+          path: listId ? `/api/v1/lead-lists/${listId}/members` : path,
+          body: { members: [{ personId: args.personId }] },
+          preview: {
+            entity: 'person',
+            entityId: args.personId,
+            operation: 'commit to Outbound (Pipeline Outbound stage)',
+            ...(list
+              ? {}
+              : {
+                  note:
+                    `The Outbound list does not exist yet in this workspace. A live write first creates it ` +
+                    `(POST /api/v1/lead-lists with description \`${LEAD_COMMITMENT_MARKER}\`), then adds the person.`,
+                }),
+          },
+        });
+        if (outcome.dryRun) return md(previewMarkdown('Commit to Outbound', outcome.preview));
+        return md(
+          `## Committed to Outbound\n\n` +
+            `- **Person:** ${args.personId}\n` +
+            `- **Outbound list:** ${listId}${list ? '' : ' (created on this write)'}\n` +
+            `- **Added:** ${outcome.result?.data?.added ?? 'reported by server'}\n\n` +
+            `The person now sits above the line on /targets and in Pipeline\'s Outbound stage.\n`,
+        );
+      } catch (err) {
+        return mdError('Commit to Outbound failed', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'release_lead_from_outbound',
+    'Take a lead back out of Outbound — below the line on /targets, out of Pipeline\'s Outbound stage. Removes the person from the marker-owned Outbound lead list; the person record itself is untouched.' +
+      governedWriteNote('read:speedrun'),
+    {
+      personId: z.string().min(1).describe('The person (lead) to release from Outbound'),
+      ...governedWriteArgs(z),
+    },
+    async (args) => {
+      try {
+        const list = await findOutboundList();
+        if (!list) {
+          return md(
+            `## Nothing to release\n\nThis workspace has no Outbound list yet — nobody has been committed, so ` +
+              `${args.personId} is already below the line. Nothing was written.\n`,
+          );
+        }
+        const path = `/api/v1/lead-lists/${list.id}/members/${encodeURIComponent(args.personId)}`;
+        const refused = refuseIfUnapproved(args, 'DELETE', path);
+        if (refused) return refused;
+        const outcome = await governedWrite(api, args, {
+          method: 'DELETE',
+          path,
+          preview: { entity: 'person', entityId: args.personId, operation: 'release from Outbound' },
+        });
+        if (outcome.dryRun) return md(previewMarkdown('Release from Outbound', outcome.preview));
+        return md(
+          `## Released from Outbound\n\n- **Person:** ${args.personId}\n- **Outbound list:** ${list.id}\n\n` +
+            `The person is below the line on /targets again and no longer in Pipeline\'s Outbound stage.\n`,
+        );
+      } catch (err) {
+        return mdError('Release from Outbound failed', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'list_outbound_leads',
+    'Who is committed to Outbound right now — the people above the line on /targets, which is Pipeline\'s Outbound stage. Read-only.',
+    {},
+    async () => {
+      try {
+        const list = await findOutboundList();
+        if (!list) {
+          return md(
+            `## Outbound\n\nThis workspace has no Outbound list yet: nobody has ever been committed to Outbound, ` +
+              `so there is nothing above the line. (Not a failed read — the list is created on the first commitment.)\n`,
+          );
+        }
+        const members = await outboundMembers(list.id);
+        if (members.length === 0) {
+          return md(`## Outbound — 0 committed\n\nThe Outbound list (${list.id}) exists and is empty: nobody is above the line.\n`);
+        }
+        const rows = members.map((m, i) => [
+          String(i + 1),
+          m.personName || m.personId || '\u2014',
+          m.personTitle || '\u2014',
+          m.personEmail || '\u2014',
+          m.personId || '\u2014',
+        ]);
+        return md(
+          `## Outbound — ${members.length} committed\n\n` +
+            table(['#', 'Person', 'Title', 'Email', 'Person ID'], rows) +
+            `\nOutbound list ${list.id}. Each row is above the line on /targets and in Pipeline\'s Outbound stage.\n`,
+        );
+      } catch (err) {
+        return mdError('Could not read Outbound', err.message);
+      }
+    },
+  );
 }

package/toolsets/revenue/always-loaded.js

@@ -12,9 +12,9 @@ import { getDemoAvailability } from '../../tools/scheduling.js';
 export const TOOLSET_REGISTRY = {
   prospecting: {
     name: 'prospecting',
-    description: 'Qualify companies, research prospects, get daily priorities, discover leads',
+    description: 'Qualify companies, research prospects, get daily priorities, discover leads, commit leads to Outbound',
     tier: 'pro',
-    toolCount: 6,
+    toolCount: 9,
   },
   intelligence: {
     name: 'intelligence',