@andresmassello/uscha 1.97.0 → 1.99.0

package/README.md

@@ -40,7 +40,7 @@ Requires **Python 3.8+** on the machine (the engine is Python stdlib — no pip
 runtime dependencies). The npm package is a thin router; the canonical installer is
 `uscha-kit/install-uscha.py`.
 
-**Kit v1.97.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
+**Kit v1.99.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
 [changelog](https://github.com/andresmassello/uscha/blob/main/uscha-kit/CHANGELOG.md)
 (the per-release changelogs live in the repo, not in the npm tarball)
 
@@ -169,7 +169,7 @@ automatic tool can perform: a human verdict.
                                               system (= 100% drift)
 
    round trip · bench-roundtrip — how much of the asset the reverse organs re-anchor
-   from the compiled code: 0.828 measured (12 archetypes) — names AND behaviour
+   from the compiled code: 0.815 measured (12 archetypes) — names AND behaviour
 ```
 
 **What each arrow is, in the engine (kit 1.96.0, 53 subcommands, all measured):**
@@ -178,25 +178,30 @@ automatic tool can perform: a human verdict.
 |---|---|---|
 | Asset → typed graph | `ir-extract`, `ir-render` | the whole package becomes one canonical IR (M2, ADR-015) — deterministic, `UNTYPED` is a measurement not an error |
 | Forward, the compiler | `compile-validate`, `compile-ingest` | any model produces code; the engine validates the output contract and never compiles (M3, ADR-016) |
-| Forward, is it the *same* system? | `bootstrap-oracle`, `bootstrap-variance`, `bench` | a withheld oracle judges blind compilations — **12 archetypes, 9 PASS · 3 PARTIAL**, three Claude-family models (Haiku · Sonnet · Opus — one vendor; cross-vendor not yet measured), JS included (M4/M5, ADR-017/018/028/029) |
+| Forward, is it the *same* system? | `bootstrap-oracle`, `bootstrap-variance`, `bench` | a withheld oracle judges blind compilations — **12 archetypes, 8 PASS · 4 PARTIAL**, four blind compilers across two vendors (Haiku · Sonnet · Opus · OpenAI Codex `gpt-5.5`), JS included (M4/M5, ADR-017/018/028/029/042) |
 | Reverse, facts | `discover`, `golden-diff` (+ the `/uscha-characterize` skill) | system map + mechanically captured golden; typed candidate observations with evidence class (M1, ADR-013) |
 | Reverse, the human gate | `curate`, `promote`, `curation-check`, `bench-curate` | one verdict per candidate, append-only ledger verified against git; unjudged → `pr-ready` blocked naming it (ADR-009/010, INV-CURATION-01) |
-| Fidelity, honestly | `fidelity`, `roundtrip`, `bench-roundtrip`, `bench-r2` | per-compiler fidelity vector, id-level round trip, recoverability **0.828**, and the **noise floor** under every variance claim (ADR-014/022/027/030) |
-
-**Read the numbers the way the repo does.** 9 of 12 archetypes regenerate to the same system
-under an oracle the compilers never saw — that is the closed loop working. 0.828 is the mean
-*recoverability* of the asset from compiled code counting only static and behavioural
-footing. It read **0.062** until 1.90.0, with the behaviour dimension `UNMEASURED`, because no
-oracle case carried an AC tag — a named absence, not a zero. The 12 bench oracles are now
-curated per case (`ORACLE-TAGS-CURATED.json`, human-authored; payloads and expectations
-untouched), so the dimension is measured and the number says the reverse organs anchor **names
-and behaviour**. Both numbers are published rather than smoothed, and what moved between them
-was the tagging, not the code under test. And `bench-r2` measured
+| Fidelity, honestly | `fidelity`, `roundtrip`, `bench-roundtrip`, `bench-r2` | per-compiler fidelity vector, id-level round trip, recoverability **0.815**, and the **noise floor** under every variance claim (ADR-014/022/027/030) |
+
+**Read the numbers the way the repo does.** 8 of 12 archetypes regenerate to the same system
+under an oracle the compilers never saw — that is the closed loop working. It was 9 of 12 until
+1.99.0, when a fourth compiler from a second vendor read one genuinely ambiguous sentence in
+`transformer` the other way and lost a case the three Claude-family models had agreed on
+(ADR-042). The number went down because the bench got harder, and the whole point of the arm was
+to let it. 0.815 is the mean *recoverability* of the asset from compiled code counting only
+static and behavioural footing. It read **0.062** until 1.90.0, with the behaviour dimension
+`UNMEASURED`, because no oracle case carried an AC tag — a named absence, not a zero. The 12
+bench oracles are now curated per case (`ORACLE-TAGS-CURATED.json`, human-authored; payloads and
+expectations untouched), so the dimension is measured and the number says the reverse organs
+anchor **names and behaviour**; it read 0.828 over three compilers and 0.815 over four, because
+an entry's recoverability is the mean over its compilations. Every number is published rather
+than smoothed, and what moved between them was the tagging and the arm, not the code under test.
+And `bench-r2` measured
 that same-model reruns differ structurally about as much as different models do (aggregate
 `NOISY`) — so one earlier variance narrative was **retracted**. Every claim above is a subcommand
 you can run; every unmeasured part is labeled. That honesty is the method applied to itself.
 
-→ The full thesis, with before/after diagrams and the REAL vs VISION table:
+→ The full thesis, with before/after diagrams and the REAL vs VISION vs REJECTED table:
 **[uscha.dev/diamond](https://uscha.dev/diamond)** · the mechanism, in three diagrams:
 **[uscha.dev/how](https://uscha.dev/how)**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andresmassello/uscha",
-  "version": "1.97.0",
+  "version": "1.99.0",
   "description": "Spec-driven development for LLM coding agents: 9 skills + a stdlib evidence engine. Facts block, guesses advise; the human approves.",
   "author": {
     "name": "Andres Massello",

package/uscha-kit/.claude/skills/uscha-devloop/qa_ledger.py

@@ -4140,6 +4140,47 @@ CANDIDATE_DELTA_FILE = "CANDIDATE-DELTA.json"    # under discovery/, machine-can
 CANDIDATE_DELTA_TWIN = "CANDIDATE-DELTA.md"      # rendered view, regenerated, never a source
 CANONICAL_FILE = "CANONICAL.json"                # under discovery/: the promoted package
 ISSUES_DEFERRED_FILE = "ISSUES-DEFERRED.md"
+# The shape of the work item `promote` writes for a `fix` verdict, and the shape it recognises
+# again on the next run. The dedupe used to be `o["id"] not in existing` -- a RAW SUBSTRING over
+# the whole file, so it suppressed the work item for any id merely MENTIONED in prose there and,
+# because the ids are a hash prefix, for any id that is a prefix of an already-written one
+# (1.69.0 fresh review, LOW, resolved 1.98.0). The question is not "does this text occur"; it is
+# "does this file already carry the WORK ITEM for this observation", and only the line shape
+# answers it. The word boundaries are what separate OBS-1 from OBS-10, and the `.*` between
+# the checkbox and the id is what lets a HUMAN reword the item -- prefix it with a date, a
+# severity, an owner -- without `promote` appending a second copy of it on the next run.
+_DEFERRED_ITEM_LINE = r"(?m)^[ \t]*[-*][ \t]*\[[ xX]\].*\b%s\b"
+
+
+def _deferred_carries(existing, oid):
+    """True when ISSUES-DEFERRED.md already holds the `- [ ] <oid>` work item for this OBS."""
+    return re.search(_DEFERRED_ITEM_LINE % re.escape(oid), existing) is not None
+
+
+def _config_beside_ledger(config, ledger_path):
+    """Where to LOOK for a config whose default is a bare relative name.
+
+    `--config` defaulted to the literal `uscha.config.json`, which `os.path.isfile` resolves
+    against the CWD. Run `fidelity --ledger /repo/QA-LEDGER.json` from anywhere but /repo and
+    the config beside the ledger was never opened -- so `defaults.fidelity.gate` was silently
+    not declared, and the INV-ADVISORY-01 refusal that reads it never fired. An UNNAMED absence
+    (1.69.0 fresh review, LOW, resolved 1.98.0): the command printed a full vector and exit 0,
+    exactly as it does when there genuinely is no config.
+
+    The cwd still WINS when it holds the file -- an explicit `--config` next to you is what you
+    meant, and no existing invocation changes behaviour. Only when it does not is the ledger's
+    own directory tried. Returns (path, found): callers report `path` so the answer to "which
+    file did you read" is in the output rather than in the reader's head.
+    """
+    if os.path.isfile(config):
+        return config, True
+    if not os.path.isabs(config):
+        beside = os.path.join(os.path.dirname(os.path.abspath(ledger_path)), config)
+        if os.path.isfile(beside):
+            return beside, True
+    return config, False
+
+
 OBS_TYPES = ("behavior", "invariant", "contract", "config", "dependency", "decision_trace")
 EVIDENCE_CLASSES = ("measured", "static", "narrated")
 # ADR-014 / INV-ADVISORY-01: dimensions an LLM judges can only advise. The QUARANTINE is an
@@ -4445,6 +4486,17 @@ def _match_canonical(statement, canon_ids):
     return None
 
 
+def _md_cell(text):
+    """One markdown TABLE cell. A `|` is escaped, and any CR/LF inside the value collapses to
+    a space -- a markdown row ENDS at a newline, so a statement or a provenance ref carrying
+    one used to split its observation across two rows and corrupt every column after it
+    (1.69.0 fresh review, LOW, resolved 1.98.0). The JSON and the OBS id always survived; only
+    this rendered view broke, and it is the artifact the human curates from. A space rather
+    than `<br>`: every other cell is plain text, and a lone HTML tag in one column would be
+    the only markup in the table."""
+    return re.sub(r"[\r\n]+", " ", "%s" % text).replace("|", "\\|")
+
+
 def _render_delta_md(delta, verdicts):
     lines = ["<!-- %s -->" % _DELTA_BANNER, "",
              "# CANDIDATE-DELTA (rendered view)", ""]
@@ -4460,9 +4512,10 @@ def _render_delta_md(delta, verdicts):
     for o in delta["observations"]:
         v = verdicts.get(o["id"], "(uncurated)")
         files = ", ".join(o["provenance"].get("files") or []) or "-"
-        stmt = o["statement"].replace("|", "\\|")
         lines.append("| %s | %s | %s | %s | %s | %s |"
-                     % (o["id"], o["type"], o["evidence_class"], v, stmt, files))
+                     % tuple(_md_cell(c) for c in (o["id"], o["type"],
+                                                   o["evidence_class"], v,
+                                                   o["statement"], files)))
     lines.append("")
     return "\n".join(lines)
 
@@ -4771,15 +4824,18 @@ def cmd_promote(args):
         if os.path.isfile(dpath):
             with open(dpath, encoding="utf-8-sig", errors="replace") as fh:
                 existing = fh.read()
-        add = [o for o in fixes if o["id"] not in existing]
+        add = [o for o in fixes if not _deferred_carries(existing, o["id"])]
         if add:
             with open(dpath, "a", encoding="utf-8", newline="\n") as fh:
                 if existing and not existing.endswith("\n"):
                     fh.write("\n")
                 for o in add:
+                    # a markdown checklist item ends at a newline just as a table row
+                    # does: a multi-line statement would split the work item in two and
+                    # leave the half _deferred_carries recognises without its text.
                     fh.write("- [ ] %s (curated `fix`): %s -- observed behavior the human "
                              "ruled a defect; NEVER canonical (ADR-013)\n"
-                             % (o["id"], o["statement"]))
+                             % (o["id"], _md_cell(o["statement"])))
             new_fix = [o["id"] for o in add]
     ledger["candidate_delta"] = {"repo": args.repo, "total": len(obs),
                                  "curated": len(obs),
@@ -4817,16 +4873,20 @@ def cmd_fidelity(args):
     node = _repo_node(ledger, args.repo)
     repo_path = _scope_path(ledger, args.repo)
     cfg = {}
-    if os.path.isfile(args.config):
+    # WHERE the config was looked for is part of the answer: a gate declared in a file the
+    # command never opened is a gate that does not exist, and the old cwd-only resolution said
+    # nothing about it (1.69.0 fresh review, resolved 1.98.0).
+    cfg_path, cfg_found = _config_beside_ledger(args.config, args.ledger)
+    if cfg_found:
         try:
-            with open(args.config, encoding="utf-8-sig") as fh:
+            with open(cfg_path, encoding="utf-8-sig") as fh:
                 cfg = json.load(fh)
         except (OSError, ValueError) as exc:
             # a config that cannot be parsed cannot declare gates -- swallowing the error
             # would DISABLE the INV-ADVISORY-01 refusal on a syntax slip (fresh-review
             # HIGH, reproduced). Malformation is exit 2, never a silent degrade.
             print("[qa_ledger] fidelity: %s unreadable: %s -- refusing to guess what it "
-                  "declares." % (args.config, exc), file=sys.stderr)
+                  "declares." % (cfg_path, exc), file=sys.stderr)
             sys.exit(2)
     declared = ((cfg.get("defaults") or {}).get("fidelity") or {}).get("gate") or []
     for dim in (ledger.get("config", {}).get("defaults", {}).get("fidelity")
@@ -4979,6 +5039,7 @@ def cmd_fidelity(args):
     dims["semantic"] = _fid_dim(None, "not wired: an LLM-judged comparison enters as "
                                       "advisory only and can NEVER gate (INV-ADVISORY-01)")
     out = {"repo": args.repo,
+           "config": cfg_path if cfg_found else None,
            **({"path": bound} if bound else {}),
            "dimensions": {k: dict(dims[k], **{"class": FIDELITY_DIMENSIONS[k]})
                           for k in ("traceability", "behavior", "contracts",
@@ -4990,6 +5051,11 @@ def cmd_fidelity(args):
     else:
         print("FIDELITY %s%s (vector -- no blend; each number stands on its own evidence):"
               % (args.repo, " [bounded to %s]" % bound if bound else ""))
+        if cfg_found:
+            print("  config           %s" % cfg_path)
+        else:
+            print("  config           none (looked for %r in the cwd and beside the ledger) "
+                  "-- no fidelity gate declared from a file" % args.config)
         for k, d in out["dimensions"].items():
             val = "UNMEASURED" if d["value"] is None else "%.2f" % d["value"]
             print("  %-17s %-10s [%s] %s" % (k, val, d["class"], d["provenance"]))
@@ -5211,8 +5277,8 @@ def _render_ir_md(graph):
              "|----|------|-----------|--------|"]
     for nd in graph.get("nodes") or []:
         src = "%s:%s" % (nd["source"]["file"], nd["source"]["line"])
-        stmt = (nd.get("statement") or "").replace("|", "\\|")
-        lines.append("| %s | %s | %s | %s |" % (nd["id"], nd["type"], stmt, src))
+        lines.append("| %s | %s | %s | %s |"
+                     % (nd["id"], nd["type"], _md_cell(nd.get("statement") or ""), src))
     lines += ["", "## Edges", "", "| from | type | to |", "|------|------|----|"]
     for e in graph.get("edges") or []:
         lines.append("| %s | %s | %s |" % (e["from"], e["type"], e["to"]))
@@ -5221,8 +5287,11 @@ def _render_ir_md(graph):
                   "| text | source | reason |", "|------|--------|--------|"]
         for u in graph["untyped"]:
             src = "%s:%s" % (u["source"]["file"], u["source"]["line"])
-            txt = (u.get("text") or "").replace("|", "\\|")[:80]
-            lines.append("| %s | %s | %s |" % (txt, src, u.get("reason", "")))
+            # truncate AFTER the cell is flattened: slicing raw text can cut mid-newline
+            # and leave the break inside the 80 characters that reach the row.
+            txt = _md_cell(u.get("text") or "")[:80]
+            lines.append("| %s | %s | %s |"
+                         % (txt, src, _md_cell(u.get("reason", ""))))
     lines.append("")
     return "\n".join(lines)
 
@@ -11189,18 +11258,33 @@ def _lc_valid_date(s):
         return False
 _LC_KEY = re.compile(r"^lifecycle\s*:\s*(.*)$")
 _LC_GOLIVE_FM = re.compile(r"^go[-_ ]?live\s*:\s*(.+?)\s*$", re.I)
-_LC_GOLIVE_LINE = re.compile(r"^\s*\*\*\s*go[-_ ]?live\s*:?\s*\*\*\s*:?\s*"
+# the body form. A list marker or a blockquote prefix in front of the bold label is still the
+# same declaration -- a SPEC that writes it as a bullet used to read as "no go-live declared"
+# (1.98.1, field report). The prefix is markdown-CORRECT, not merely permissive: at most three
+# leading spaces and never a tab, because four spaces or a tab opens an INDENTED CODE BLOCK --
+# an example, not a declaration -- and a list marker must be FOLLOWED by whitespace, so the
+# glued `-**Go-live:**` is not a list item. Fenced blocks are skipped by the caller for the
+# same reason. The trailing \b keeps the date a WHOLE token: it must be followed by a
+# non-digit or the end of the line, so a longer number can never be truncated into a date,
+# while ordinary prose after it ("(delivery 1). ...") is allowed.
+_LC_GOLIVE_LINE = re.compile(r"^ {0,3}(?:> ?)*(?:(?:[-*+]|\d+[.)])\s+)?"
+                             r"\*\*\s*go[-_ ]?live\s*:?\s*\*\*\s*:?\s*"
                              r"(\d{4}-\d{2}-\d{2})\b", re.I)
 _LC_FIELDS = ("component", "version", "eol", "source", "checked")
 
 
 def _lc_frontmatter(lines):
     """The lines INSIDE a leading `---` frontmatter block, or None when there is none.
+    Leading blank lines and a BOM are skipped before the fence is looked for: a file whose
+    text reached us with anything glued in front still opens its block at the top (1.98.1).
     An unterminated fence is not data: a half-written block reads as absent."""
-    if not lines or lines[0].strip() != "---":
+    i = 0
+    while i < len(lines) and not lines[i].lstrip("\ufeff").strip():
+        i += 1
+    if i >= len(lines) or lines[i].lstrip("\ufeff").strip() != "---":
         return None
     body = []
-    for ln in lines[1:]:
+    for ln in lines[i + 1:]:
         if ln.strip() == "---":
             return body
         body.append(ln)
@@ -11252,7 +11336,8 @@ def _lc_parse(lines):
 
 def _lc_go_live(text):
     """The declared go-live of a SPEC: frontmatter `go_live: YYYY-MM-DD`, or a
-    `**Go-live:** YYYY-MM-DD` line anywhere in the body. None = not declared."""
+    `**Go-live:** YYYY-MM-DD` line anywhere in the body OUTSIDE a fenced block.
+    None = not declared."""
     lines = [ln.rstrip("\r") for ln in (text or "").split("\n")]
     fm = _lc_frontmatter(lines)
     if fm:
@@ -11264,7 +11349,14 @@ def _lc_go_live(text):
                 v = m.group(1).strip().strip("\x27\x22")
                 if _lc_valid_date(v):
                     return v
+    in_fence = False
     for ln in lines:
+        st = ln.strip()
+        if st.startswith("```") or st.startswith("~~~"):
+            in_fence = not in_fence
+            continue
+        if in_fence:      # a SPEC that QUOTES the form is showing it, not declaring a date --
+            continue      # and the quoted line comes FIRST (the fence idiom of _spec_check_text)
         m = _LC_GOLIVE_LINE.match(ln)
         if m and _lc_valid_date(m.group(1)):
             return m.group(1)
@@ -11376,7 +11468,12 @@ def _lifecycle_for(root, adr_dir=None, spec_text=None, fallback=True):
         if os.path.isfile(sp):
             try:
                 with open(sp, "r", encoding="utf-8", errors="replace") as fh:
-                    spec_text = (spec_text or "") + "\n" + fh.read()
+                    body = fh.read()
+                # join only when there is something to join TO. Gluing a newline in front of
+                # the file pushed its `---` off line 0, so the frontmatter went invisible and
+                # `readiness` read "no go-live declared" on a SPEC that `spec-check` measured
+                # (1.98.1, field report).
+                spec_text = (spec_text + "\n" + body) if spec_text else body
             except OSError:
                 pass
     return _lifecycle_report(adr_dir or os.path.join(root, "docs", "adr"), spec_text)
@@ -12500,7 +12597,9 @@ def build_parser():
     pfv.add_argument("--ledger", default="QA-LEDGER.json")
     pfv.add_argument("--repo", required=True)
     pfv.add_argument("--config", default="uscha.config.json",
-                     help="checked for defaults.fidelity.gate -- advisory there is a refusal")
+                     help="checked for defaults.fidelity.gate -- advisory there is a "
+                          "refusal. A relative name is resolved against the cwd first, "
+                          "then beside --ledger; the path actually read is reported")
     pfv.add_argument("--ir", action="store_true",
                      help="answer curation_closure as a path query over the IR graph "
                           "(ADR-015); reproduces v0 from the derived index")

package/uscha-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "uscha",
-  "version": "1.97.0",
+  "version": "1.99.0",
   "displayName": "Uscha",
   "description": "Spec-driven development for LLM coding agents: 9 skills (discovery, adr-refine, reverse-discovery, characterize, devloop, sysdoc, rubric, mirador, status) + a stdlib measurement engine (qa_ledger.py, 53 subcommands + universal installer + npm/npx router). Facts block, guesses advise; the human approves.",
   "author": {

package/uscha-kit/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "uscha",
-  "version": "1.97.0",
+  "version": "1.99.0",
   "description": "Uscha spec-driven development methodology for coding agents. Includes npm/npx router.",
   "author": {
     "name": "Andres Massello",

package/uscha-kit/README.md

@@ -1,6 +1,6 @@
 # uscha-kit
 
-**Kit version:** v1.97.0 <!-- uscha:version --> · **[uscha.dev](https://uscha.dev)**
+**Kit version:** v1.99.0 <!-- uscha:version --> · **[uscha.dev](https://uscha.dev)**
 
 Spec-driven orchestrator + multi-repo QA for Claude Code, with a deterministic ledger.
 **Nine skills** (`uscha-discovery`, `uscha-adr-refine`, `uscha-devloop`, `uscha-sysdoc`, `uscha-reverse-discovery`,

package/uscha-kit/VERSION

@@ -1 +1 @@
-uscha-kit 1.97.0
+uscha-kit 1.99.0

package/uscha-kit/skills/uscha-devloop/qa_ledger.py

@@ -4140,6 +4140,47 @@ CANDIDATE_DELTA_FILE = "CANDIDATE-DELTA.json"    # under discovery/, machine-can
 CANDIDATE_DELTA_TWIN = "CANDIDATE-DELTA.md"      # rendered view, regenerated, never a source
 CANONICAL_FILE = "CANONICAL.json"                # under discovery/: the promoted package
 ISSUES_DEFERRED_FILE = "ISSUES-DEFERRED.md"
+# The shape of the work item `promote` writes for a `fix` verdict, and the shape it recognises
+# again on the next run. The dedupe used to be `o["id"] not in existing` -- a RAW SUBSTRING over
+# the whole file, so it suppressed the work item for any id merely MENTIONED in prose there and,
+# because the ids are a hash prefix, for any id that is a prefix of an already-written one
+# (1.69.0 fresh review, LOW, resolved 1.98.0). The question is not "does this text occur"; it is
+# "does this file already carry the WORK ITEM for this observation", and only the line shape
+# answers it. The word boundaries are what separate OBS-1 from OBS-10, and the `.*` between
+# the checkbox and the id is what lets a HUMAN reword the item -- prefix it with a date, a
+# severity, an owner -- without `promote` appending a second copy of it on the next run.
+_DEFERRED_ITEM_LINE = r"(?m)^[ \t]*[-*][ \t]*\[[ xX]\].*\b%s\b"
+
+
+def _deferred_carries(existing, oid):
+    """True when ISSUES-DEFERRED.md already holds the `- [ ] <oid>` work item for this OBS."""
+    return re.search(_DEFERRED_ITEM_LINE % re.escape(oid), existing) is not None
+
+
+def _config_beside_ledger(config, ledger_path):
+    """Where to LOOK for a config whose default is a bare relative name.
+
+    `--config` defaulted to the literal `uscha.config.json`, which `os.path.isfile` resolves
+    against the CWD. Run `fidelity --ledger /repo/QA-LEDGER.json` from anywhere but /repo and
+    the config beside the ledger was never opened -- so `defaults.fidelity.gate` was silently
+    not declared, and the INV-ADVISORY-01 refusal that reads it never fired. An UNNAMED absence
+    (1.69.0 fresh review, LOW, resolved 1.98.0): the command printed a full vector and exit 0,
+    exactly as it does when there genuinely is no config.
+
+    The cwd still WINS when it holds the file -- an explicit `--config` next to you is what you
+    meant, and no existing invocation changes behaviour. Only when it does not is the ledger's
+    own directory tried. Returns (path, found): callers report `path` so the answer to "which
+    file did you read" is in the output rather than in the reader's head.
+    """
+    if os.path.isfile(config):
+        return config, True
+    if not os.path.isabs(config):
+        beside = os.path.join(os.path.dirname(os.path.abspath(ledger_path)), config)
+        if os.path.isfile(beside):
+            return beside, True
+    return config, False
+
+
 OBS_TYPES = ("behavior", "invariant", "contract", "config", "dependency", "decision_trace")
 EVIDENCE_CLASSES = ("measured", "static", "narrated")
 # ADR-014 / INV-ADVISORY-01: dimensions an LLM judges can only advise. The QUARANTINE is an
@@ -4445,6 +4486,17 @@ def _match_canonical(statement, canon_ids):
     return None
 
 
+def _md_cell(text):
+    """One markdown TABLE cell. A `|` is escaped, and any CR/LF inside the value collapses to
+    a space -- a markdown row ENDS at a newline, so a statement or a provenance ref carrying
+    one used to split its observation across two rows and corrupt every column after it
+    (1.69.0 fresh review, LOW, resolved 1.98.0). The JSON and the OBS id always survived; only
+    this rendered view broke, and it is the artifact the human curates from. A space rather
+    than `<br>`: every other cell is plain text, and a lone HTML tag in one column would be
+    the only markup in the table."""
+    return re.sub(r"[\r\n]+", " ", "%s" % text).replace("|", "\\|")
+
+
 def _render_delta_md(delta, verdicts):
     lines = ["<!-- %s -->" % _DELTA_BANNER, "",
              "# CANDIDATE-DELTA (rendered view)", ""]
@@ -4460,9 +4512,10 @@ def _render_delta_md(delta, verdicts):
     for o in delta["observations"]:
         v = verdicts.get(o["id"], "(uncurated)")
         files = ", ".join(o["provenance"].get("files") or []) or "-"
-        stmt = o["statement"].replace("|", "\\|")
         lines.append("| %s | %s | %s | %s | %s | %s |"
-                     % (o["id"], o["type"], o["evidence_class"], v, stmt, files))
+                     % tuple(_md_cell(c) for c in (o["id"], o["type"],
+                                                   o["evidence_class"], v,
+                                                   o["statement"], files)))
     lines.append("")
     return "\n".join(lines)
 
@@ -4771,15 +4824,18 @@ def cmd_promote(args):
         if os.path.isfile(dpath):
             with open(dpath, encoding="utf-8-sig", errors="replace") as fh:
                 existing = fh.read()
-        add = [o for o in fixes if o["id"] not in existing]
+        add = [o for o in fixes if not _deferred_carries(existing, o["id"])]
         if add:
             with open(dpath, "a", encoding="utf-8", newline="\n") as fh:
                 if existing and not existing.endswith("\n"):
                     fh.write("\n")
                 for o in add:
+                    # a markdown checklist item ends at a newline just as a table row
+                    # does: a multi-line statement would split the work item in two and
+                    # leave the half _deferred_carries recognises without its text.
                     fh.write("- [ ] %s (curated `fix`): %s -- observed behavior the human "
                              "ruled a defect; NEVER canonical (ADR-013)\n"
-                             % (o["id"], o["statement"]))
+                             % (o["id"], _md_cell(o["statement"])))
             new_fix = [o["id"] for o in add]
     ledger["candidate_delta"] = {"repo": args.repo, "total": len(obs),
                                  "curated": len(obs),
@@ -4817,16 +4873,20 @@ def cmd_fidelity(args):
     node = _repo_node(ledger, args.repo)
     repo_path = _scope_path(ledger, args.repo)
     cfg = {}
-    if os.path.isfile(args.config):
+    # WHERE the config was looked for is part of the answer: a gate declared in a file the
+    # command never opened is a gate that does not exist, and the old cwd-only resolution said
+    # nothing about it (1.69.0 fresh review, resolved 1.98.0).
+    cfg_path, cfg_found = _config_beside_ledger(args.config, args.ledger)
+    if cfg_found:
         try:
-            with open(args.config, encoding="utf-8-sig") as fh:
+            with open(cfg_path, encoding="utf-8-sig") as fh:
                 cfg = json.load(fh)
         except (OSError, ValueError) as exc:
             # a config that cannot be parsed cannot declare gates -- swallowing the error
             # would DISABLE the INV-ADVISORY-01 refusal on a syntax slip (fresh-review
             # HIGH, reproduced). Malformation is exit 2, never a silent degrade.
             print("[qa_ledger] fidelity: %s unreadable: %s -- refusing to guess what it "
-                  "declares." % (args.config, exc), file=sys.stderr)
+                  "declares." % (cfg_path, exc), file=sys.stderr)
             sys.exit(2)
     declared = ((cfg.get("defaults") or {}).get("fidelity") or {}).get("gate") or []
     for dim in (ledger.get("config", {}).get("defaults", {}).get("fidelity")
@@ -4979,6 +5039,7 @@ def cmd_fidelity(args):
     dims["semantic"] = _fid_dim(None, "not wired: an LLM-judged comparison enters as "
                                       "advisory only and can NEVER gate (INV-ADVISORY-01)")
     out = {"repo": args.repo,
+           "config": cfg_path if cfg_found else None,
            **({"path": bound} if bound else {}),
            "dimensions": {k: dict(dims[k], **{"class": FIDELITY_DIMENSIONS[k]})
                           for k in ("traceability", "behavior", "contracts",
@@ -4990,6 +5051,11 @@ def cmd_fidelity(args):
     else:
         print("FIDELITY %s%s (vector -- no blend; each number stands on its own evidence):"
               % (args.repo, " [bounded to %s]" % bound if bound else ""))
+        if cfg_found:
+            print("  config           %s" % cfg_path)
+        else:
+            print("  config           none (looked for %r in the cwd and beside the ledger) "
+                  "-- no fidelity gate declared from a file" % args.config)
         for k, d in out["dimensions"].items():
             val = "UNMEASURED" if d["value"] is None else "%.2f" % d["value"]
             print("  %-17s %-10s [%s] %s" % (k, val, d["class"], d["provenance"]))
@@ -5211,8 +5277,8 @@ def _render_ir_md(graph):
              "|----|------|-----------|--------|"]
     for nd in graph.get("nodes") or []:
         src = "%s:%s" % (nd["source"]["file"], nd["source"]["line"])
-        stmt = (nd.get("statement") or "").replace("|", "\\|")
-        lines.append("| %s | %s | %s | %s |" % (nd["id"], nd["type"], stmt, src))
+        lines.append("| %s | %s | %s | %s |"
+                     % (nd["id"], nd["type"], _md_cell(nd.get("statement") or ""), src))
     lines += ["", "## Edges", "", "| from | type | to |", "|------|------|----|"]
     for e in graph.get("edges") or []:
         lines.append("| %s | %s | %s |" % (e["from"], e["type"], e["to"]))
@@ -5221,8 +5287,11 @@ def _render_ir_md(graph):
                   "| text | source | reason |", "|------|--------|--------|"]
         for u in graph["untyped"]:
             src = "%s:%s" % (u["source"]["file"], u["source"]["line"])
-            txt = (u.get("text") or "").replace("|", "\\|")[:80]
-            lines.append("| %s | %s | %s |" % (txt, src, u.get("reason", "")))
+            # truncate AFTER the cell is flattened: slicing raw text can cut mid-newline
+            # and leave the break inside the 80 characters that reach the row.
+            txt = _md_cell(u.get("text") or "")[:80]
+            lines.append("| %s | %s | %s |"
+                         % (txt, src, _md_cell(u.get("reason", ""))))
     lines.append("")
     return "\n".join(lines)
 
@@ -11189,18 +11258,33 @@ def _lc_valid_date(s):
         return False
 _LC_KEY = re.compile(r"^lifecycle\s*:\s*(.*)$")
 _LC_GOLIVE_FM = re.compile(r"^go[-_ ]?live\s*:\s*(.+?)\s*$", re.I)
-_LC_GOLIVE_LINE = re.compile(r"^\s*\*\*\s*go[-_ ]?live\s*:?\s*\*\*\s*:?\s*"
+# the body form. A list marker or a blockquote prefix in front of the bold label is still the
+# same declaration -- a SPEC that writes it as a bullet used to read as "no go-live declared"
+# (1.98.1, field report). The prefix is markdown-CORRECT, not merely permissive: at most three
+# leading spaces and never a tab, because four spaces or a tab opens an INDENTED CODE BLOCK --
+# an example, not a declaration -- and a list marker must be FOLLOWED by whitespace, so the
+# glued `-**Go-live:**` is not a list item. Fenced blocks are skipped by the caller for the
+# same reason. The trailing \b keeps the date a WHOLE token: it must be followed by a
+# non-digit or the end of the line, so a longer number can never be truncated into a date,
+# while ordinary prose after it ("(delivery 1). ...") is allowed.
+_LC_GOLIVE_LINE = re.compile(r"^ {0,3}(?:> ?)*(?:(?:[-*+]|\d+[.)])\s+)?"
+                             r"\*\*\s*go[-_ ]?live\s*:?\s*\*\*\s*:?\s*"
                              r"(\d{4}-\d{2}-\d{2})\b", re.I)
 _LC_FIELDS = ("component", "version", "eol", "source", "checked")
 
 
 def _lc_frontmatter(lines):
     """The lines INSIDE a leading `---` frontmatter block, or None when there is none.
+    Leading blank lines and a BOM are skipped before the fence is looked for: a file whose
+    text reached us with anything glued in front still opens its block at the top (1.98.1).
     An unterminated fence is not data: a half-written block reads as absent."""
-    if not lines or lines[0].strip() != "---":
+    i = 0
+    while i < len(lines) and not lines[i].lstrip("\ufeff").strip():
+        i += 1
+    if i >= len(lines) or lines[i].lstrip("\ufeff").strip() != "---":
         return None
     body = []
-    for ln in lines[1:]:
+    for ln in lines[i + 1:]:
         if ln.strip() == "---":
             return body
         body.append(ln)
@@ -11252,7 +11336,8 @@ def _lc_parse(lines):
 
 def _lc_go_live(text):
     """The declared go-live of a SPEC: frontmatter `go_live: YYYY-MM-DD`, or a
-    `**Go-live:** YYYY-MM-DD` line anywhere in the body. None = not declared."""
+    `**Go-live:** YYYY-MM-DD` line anywhere in the body OUTSIDE a fenced block.
+    None = not declared."""
     lines = [ln.rstrip("\r") for ln in (text or "").split("\n")]
     fm = _lc_frontmatter(lines)
     if fm:
@@ -11264,7 +11349,14 @@ def _lc_go_live(text):
                 v = m.group(1).strip().strip("\x27\x22")
                 if _lc_valid_date(v):
                     return v
+    in_fence = False
     for ln in lines:
+        st = ln.strip()
+        if st.startswith("```") or st.startswith("~~~"):
+            in_fence = not in_fence
+            continue
+        if in_fence:      # a SPEC that QUOTES the form is showing it, not declaring a date --
+            continue      # and the quoted line comes FIRST (the fence idiom of _spec_check_text)
         m = _LC_GOLIVE_LINE.match(ln)
         if m and _lc_valid_date(m.group(1)):
             return m.group(1)
@@ -11376,7 +11468,12 @@ def _lifecycle_for(root, adr_dir=None, spec_text=None, fallback=True):
         if os.path.isfile(sp):
             try:
                 with open(sp, "r", encoding="utf-8", errors="replace") as fh:
-                    spec_text = (spec_text or "") + "\n" + fh.read()
+                    body = fh.read()
+                # join only when there is something to join TO. Gluing a newline in front of
+                # the file pushed its `---` off line 0, so the frontmatter went invisible and
+                # `readiness` read "no go-live declared" on a SPEC that `spec-check` measured
+                # (1.98.1, field report).
+                spec_text = (spec_text + "\n" + body) if spec_text else body
             except OSError:
                 pass
     return _lifecycle_report(adr_dir or os.path.join(root, "docs", "adr"), spec_text)
@@ -12500,7 +12597,9 @@ def build_parser():
     pfv.add_argument("--ledger", default="QA-LEDGER.json")
     pfv.add_argument("--repo", required=True)
     pfv.add_argument("--config", default="uscha.config.json",
-                     help="checked for defaults.fidelity.gate -- advisory there is a refusal")
+                     help="checked for defaults.fidelity.gate -- advisory there is a "
+                          "refusal. A relative name is resolved against the cwd first, "
+                          "then beside --ledger; the path actually read is reported")
     pfv.add_argument("--ir", action="store_true",
                      help="answer curation_closure as a path query over the IR graph "
                           "(ADR-015); reproduces v0 from the derived index")

package/uscha-kit/templates/CONSTITUTION.md

@@ -121,7 +121,7 @@ enforcing the record is the engine's job. It is never resolved by "working aroun
 - [ ] **Runs without the human typing anything** — a script/agent autocompletes it; no routine forms
 - [ ] **Speaks only when it matters** — a failure, or a high-risk profile; if it always speaks, it is silenced by default
 - [ ] **Collapses into `readiness`** — one number + one line, not another screen (`--verbose` opens the detail)
-- [ ] **A trivial change skips it** — gated by risk profile <!-- principle: profiles A–E NOT yet mechanized in the engine -->
+- [ ] **A trivial change skips it** — gated by risk profile <!-- principle: profiles A–E are NOT mechanized in the engine, by design -- the paragraph above says why: this is design discipline and review judgment, not a check -->
 
 ## How it is enforced
 

package/uscha-kit/uscha.config.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.97.0",
+  "version": "1.99.0",
   "project": null,
   "defaults": {
     "coverage_threshold": 60,