@cspeach/cli 1.1.25 → 1.1.27

package/dist/cost/credits.js

@@ -86,8 +86,11 @@ export async function fetchBalance(cfg, getBearer) {
  */
 export class CreditsTracker {
     baseline = null;
+    /** sessionTotal when the current user request began. */
+    requestStartTotal = 0;
     state = {
         chargedThisTurn: null,
+        chargedThisRequest: null,
         sessionTotal: 0,
         balance: null,
         unitLabel: DEFAULT_UNIT_LABEL,
@@ -99,34 +102,48 @@ export class CreditsTracker {
             this.state.unitLabel = balance.unit_label;
         const opening = balance ? balance.balance_credits : null;
         this.baseline = opening;
+        this.requestStartTotal = 0;
         this.state = {
             ...this.state,
             chargedThisTurn: null,
+            chargedThisRequest: null,
             sessionTotal: 0,
             balance: opening,
             pending: false,
         };
     }
-    /** Record a post-turn balance sample and return this turn's charge. */
+    /** Mark the start of a user request (one or more model rounds). */
+    beginRequest() {
+        this.requestStartTotal = this.state.sessionTotal;
+        this.state = { ...this.state, chargedThisRequest: null };
+    }
+    /** Record a post-round balance sample and return this round's charge. */
     afterTurn(balance) {
         if (balance)
             this.state.unitLabel = balance.unit_label;
         const current = balance ? balance.balance_credits : null;
         if (current === null) {
             // Unknown — keep the baseline so the next good sample covers both turns.
-            this.state = { ...this.state, chargedThisTurn: null, pending: true };
+            this.state = { ...this.state, chargedThisTurn: null, chargedThisRequest: null, pending: true };
             return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: this.state.balance };
         }
         if (this.baseline === null) {
             // First balance we have ever seen — establish the baseline only.
             this.baseline = current;
-            this.state = { ...this.state, chargedThisTurn: null, balance: current, pending: false };
+            this.state = { ...this.state, chargedThisTurn: null, chargedThisRequest: null, balance: current, pending: false };
             return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: current };
         }
         const charged = Math.max(0, this.baseline - current);
         this.baseline = current;
         const sessionTotal = this.state.sessionTotal + charged;
-        this.state = { ...this.state, chargedThisTurn: charged, sessionTotal, balance: current, pending: false };
+        this.state = {
+            ...this.state,
+            chargedThisTurn: charged,
+            chargedThisRequest: sessionTotal - this.requestStartTotal,
+            sessionTotal,
+            balance: current,
+            pending: false,
+        };
         return { chargedThisTurn: charged, sessionTotal, balance: current };
     }
     snapshot() {
@@ -154,10 +171,11 @@ export const CREDITS_PENDING = 'credits: updating…';
  * missing balance simply drops that segment.
  */
 export function formatCreditsLine(s) {
-    if (s.chargedThisTurn === null)
+    // 2026-10-02: "this turn" = the whole user request, not its last round.
+    if (s.chargedThisRequest === null)
         return CREDITS_PENDING;
     const parts = [
-        `▲ ${formatCredits(s.chargedThisTurn, s.unitLabel)} this turn`,
+        `▲ ${formatCredits(s.chargedThisRequest, s.unitLabel)} this turn`,
         `${Math.round(s.sessionTotal).toLocaleString('en-US')} this session`,
     ];
     if (s.balance !== null) {

package/dist/cost/router-spend.js

@@ -0,0 +1,24 @@
+/**
+ * BYOK skill-router spend (2026-10-02, review nit).
+ *
+ * In BYOK the skill router runs on the laptop, on the customer's own key, so
+ * each free-text prompt costs them one small router call. That is their bill,
+ * so the USD meter must count it. The router call's model differs from the
+ * session model, so it is priced here at its own rate and added to the
+ * session total (computeSessionCost) — not mixed into `session.usage`, which
+ * is priced at the session model. Process-scoped. Managed never records here
+ * (the proxy's router cost is ours, never shown).
+ */
+import { computeCost } from './pricing.js';
+let usd = 0;
+export function addRouterSpend(model, usage) {
+    usd += computeCost(model, usage);
+}
+/** USD spent on BYOK router calls in this process. */
+export function routerSpendUsd() {
+    return usd;
+}
+/** Test-only reset. */
+export function __resetRouterSpendForTests() {
+    usd = 0;
+}

package/dist/cost/session-cost.js

@@ -17,8 +17,14 @@
  * ran. Same caveat as the footer's session line.
  */
 import { computeCost } from './pricing.js';
-/** USD cost of the session's lifetime usage, priced at `session.model`. */
-export function computeSessionCost(session) {
+import { routerSpendUsd } from './router-spend.js';
+/**
+ * USD cost of ONE session's lifetime usage, priced at `session.model` — no
+ * BYOK router spend. Use this for a single session's own spend (e.g. a
+ * reader child: read_agent adds it per call, so the process-wide router
+ * spend must not ride along — review S1, 2026-10-02).
+ */
+export function computeSessionModelCost(session) {
     return computeCost(session.model, {
         input: session.usage.input_tokens,
         output: session.usage.output_tokens,
@@ -26,3 +32,11 @@ export function computeSessionCost(session) {
         cacheCreate: session.usage.cache_creation_input_tokens ?? 0,
     });
 }
+/**
+ * The session total the meter shows: the model cost plus (2026-10-02) the
+ * BYOK router calls made on the laptop, priced at the router model
+ * (cost/router-spend.ts; always 0 outside BYOK), counted once.
+ */
+export function computeSessionCost(session) {
+    return computeSessionModelCost(session) + routerSpendUsd();
+}

package/dist/doctor/checks/skill.js

@@ -1,24 +1,73 @@
 import crypto from 'node:crypto';
 import { loadConfig } from '../../config/loader.js';
 import { getStore } from '../../auth/api-key.js';
-export async function checkSkill() {
-    const cfg = await loadConfig();
-    const store = await getStore();
-    const key = await store.get();
+import { ManifestClient, DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+const PROBE_SKILL = 'abap-radar';
+/**
+ * Fetch one skill the way a managed session does and prove its integrity.
+ *
+ * 2026-10-04 — the first version of this check (561807b9) expected a plain
+ * text body plus an `x-skill-sha256` header. The proxy serves JSON
+ * `{ name, body, sha256, … }` and sends no such header, so the check hashed
+ * the whole JSON text, compared it with '' and always reported a mismatch.
+ * Now: hash the delivered `body` bytes (exactly as served — CRLF included,
+ * the same bytes the seed signed) and compare with the server's `sha256` and
+ * with the signed manifest entry, the real trust anchor.
+ */
+export async function checkSkill(deps = {}) {
+    const doFetch = deps.fetch ?? ((u, i) => fetch(u, i));
+    const proxyUrl = deps.proxyUrl ?? (await loadConfig()).proxy_url;
+    const key = deps.getKey ? await deps.getKey() : await (await getStore()).get();
     if (!key)
         return { name: 'skill', ok: false, message: 'skipped (no API key)' };
+    let body;
+    let claimed;
     try {
-        const r = await fetch(`${cfg.proxy_url}/v1/skills/abap-radar`, { headers: { Authorization: `Bearer ${key}` } });
+        const r = await doFetch(`${proxyUrl}/v1/skills/${PROBE_SKILL}`, { headers: { Authorization: `Bearer ${key}` } });
         if (!r.ok)
             return { name: 'skill', ok: false, message: `HTTP ${r.status}` };
-        const body = await r.text();
-        const sha256 = r.headers.get('x-skill-sha256') ?? '';
-        const computed = crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
-        if (sha256 !== computed)
-            return { name: 'skill', ok: false, message: `SHA256 mismatch (header=${sha256}, body=${computed})`, hint: 'Possible tampering or proxy bug — contact support' };
-        return { name: 'skill', ok: true, message: `abap-radar fetched (${body.length} bytes, SHA ${sha256.slice(0, 8)}...)` };
+        const j = await r.json();
+        if (typeof j.body !== 'string')
+            return { name: 'skill', ok: false, message: `${PROBE_SKILL}: response has no skill body` };
+        body = j.body;
+        claimed = typeof j.sha256 === 'string' ? j.sha256 : '';
     }
     catch (err) {
         return { name: 'skill', ok: false, message: err.message };
     }
+    const computed = crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
+    if (claimed !== computed) {
+        return {
+            name: 'skill', ok: false,
+            message: `${PROBE_SKILL}: SHA256 mismatch (served sha256=${claimed || 'none'}, body=${computed})`,
+            hint: 'Possible tampering or proxy bug — contact support',
+        };
+    }
+    const getManifest = deps.manifest ?? (() => new ManifestClient(DEFAULT_MANIFEST_URL).fetchAndVerifyManifest());
+    let manifestNote;
+    try {
+        const m = await getManifest();
+        const entry = m.skills.find((s) => s.name === PROBE_SKILL);
+        if (!entry) {
+            manifestNote = `not in the signed manifest`;
+        }
+        else if (entry.sha256 !== computed) {
+            return {
+                name: 'skill', ok: false,
+                message: `${PROBE_SKILL} differs from the signed manifest (manifest=${entry.sha256.slice(0, 12)}…, body=${computed.slice(0, 12)}…)`,
+                hint: 'The skills were updated without republishing the signed manifest — contact support',
+            };
+        }
+        else {
+            manifestNote = 'matches the signed manifest';
+        }
+    }
+    catch (err) {
+        const msg = err.message;
+        if (/signature invalid/i.test(msg)) {
+            return { name: 'skill', ok: false, message: msg.slice(0, 200), hint: 'Upgrade cspeach, or contact support if you are on the latest version' };
+        }
+        manifestNote = `signed manifest not checked: ${msg.slice(0, 120)}`;
+    }
+    return { name: 'skill', ok: true, message: `${PROBE_SKILL} fetched (${body.length} chars, SHA ${computed.slice(0, 8)}…, ${manifestNote})` };
 }

package/dist/doctor/run.js

@@ -4,7 +4,6 @@ import { checkProxy } from './checks/proxy.js';
 import { checkAuth } from './checks/auth.js';
 import { checkKeychain } from './checks/keychain.js';
 import { checkSap } from './checks/sap.js';
-import { checkZcspeach } from './checks/zcspeach.js';
 import { checkCert } from './checks/cert.js';
 import { checkSkill } from './checks/skill.js';
 import { checkKeychainFallback } from './checks/keychain-fallback.js';
@@ -111,7 +110,6 @@ export async function collectChecks() {
     checks.push(await checkSystemRoles(cfg));
     checks.push(await checkKeychain());
     checks.push(await checkSap());
-    checks.push(await checkZcspeach());
     checks.push(await checkCert());
     checks.push(await checkSkill());
     checks.push(await checkKeychainFallback());

package/dist/lane/app-chain.js

@@ -15,6 +15,7 @@
 import { promises as fs, statSync } from 'node:fs';
 import path from 'node:path';
 import { readProjectFile } from '../projects/status.js';
+import { looksLikeSpecGap } from '../projects/extract-spec-gap.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
 import { buildResumeCommand } from '../commands/plan-resume.js';
 import { canonicalLanePath } from './paths.js';
@@ -248,6 +249,33 @@ export async function afterSpecGapSave(h, savedPath) {
     h.queueNext(cmd);
     h.emit(STEP_2);
 }
+/** The result was written but could not be read as a spec-gap: the flow waits at step 1. */
+export const SPEC_GAP_NOT_SAVED_LINE = (specToken) => `The /abap-app run is paused at step 1: the spec-gap result could not be saved. Ask CSPeach to "re-issue the spec gap in the standard structure", or run /abap-app ${shownToken(specToken, 'spec file')} again.`;
+/** The user said No to the save: the run ends here. */
+export const SPEC_GAP_DECLINED_LINE = (specToken) => `The /abap-app run stopped at step 1 because the spec-gap result was not saved. To start again, run /abap-app ${shownToken(specToken, 'spec file')}.`;
+/**
+ * 2026-10-04 — a spec-gap turn inside an app flow at its spec-gap step that
+ * produced no file must never end the chain in silence (live 1.1.26: the
+ * result was written, the save failed on its heading, nothing more was said).
+ * - unreadable + the text IS a spec-gap result → one line; the flow stays at
+ *   step 1, so a re-issued result saves and moves the chain on.
+ * - unreadable + no result (a question back to the user) → nothing: the
+ *   conversation is still in step 1.
+ * - declined → one line; the flow ends.
+ */
+export function afterSpecGapNotSaved(h, reason, assistantText) {
+    const flow = getAppFlow(h.session);
+    if (!flow || flow.expect !== 'spec-gap' || flow.specGapPath !== undefined)
+        return;
+    if (reason === 'declined') {
+        clearAppFlow(h.session);
+        h.emit(SPEC_GAP_DECLINED_LINE(flow.specToken));
+        return;
+    }
+    if (!looksLikeSpecGap(assistantText))
+        return;
+    h.emit(SPEC_GAP_NOT_SAVED_LINE(flow.specToken));
+}
 /**
  * After a plan save: when the saved plan carries `from.lane`, offer to start
  * the guarded run. Inside an active app flow the flow's lane must be the

package/dist/models/server-config.js

@@ -276,9 +276,27 @@ export function servedToolLoading() {
 export function managedProxyServesNewShapes() {
     return snapshot?.tool_loading !== undefined;
 }
-/** BYOK only: fetch `/v1/model-config` and keep its `tool_loading`. */
+// 2026-10-02 (BYOK local routing) — BYOK now classifies prompts on the laptop
+// (direct to the model, the customer's key) instead of POSTing them to our
+// /v1/classify. It uses the router model CSPeach serves, `roles.router`, kept
+// from the SAME public /v1/model-config fetch as `tool_loading` above (no
+// extra request; the fetch carries no prompt data). Only the router role is
+// kept — the session roles still never steer a BYOK session.
+/** The proxy's built-in router model (cspeach-proxy/src/models/config.ts). */
+export const DEFAULT_BYOK_ROUTER_MODEL = 'claude-haiku-4-5';
+let byokRouter;
+/** Test-only setter for the BYOK router model. */
+export function __setByokRouterModelForTests(v) {
+    byokRouter = v;
+}
+/** The router model for BYOK classification: the served `roles.router`, else the default. Pure sync read. */
+export function byokRouterModel() {
+    return byokRouter ?? DEFAULT_BYOK_ROUTER_MODEL;
+}
+/** BYOK only: fetch `/v1/model-config` and keep its `tool_loading` (and, since 2026-10-02, `roles.router`). */
 export async function fetchToolLoadingMode(cfg, getBearer, opts) {
     byokToolLoading = undefined;
+    byokRouter = undefined;
     if (cfg.llm?.mode !== 'byok')
         return undefined;
     const controller = new AbortController();
@@ -298,10 +316,12 @@ export async function fetchToolLoadingMode(cfg, getBearer, opts) {
             return undefined;
         const body = (await r.json());
         byokToolLoading = coerceToolLoading(body && typeof body === 'object' ? body.tool_loading : undefined);
+        byokRouter = coerceRoles(body && typeof body === 'object' ? body.roles : undefined).router;
         return byokToolLoading;
     }
     catch {
         byokToolLoading = undefined;
+        byokRouter = undefined;
         return undefined;
     }
     finally {

package/dist/one-shot.js

@@ -13,11 +13,12 @@ import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
+import { prefetchRouterPrompt } from './router/router-prompt.js';
 import { createProviderForMode } from './agent/providers/factory.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
 import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
-import { routingFailureFromResult, routingFailureOneShotLine } from './router/routing-failure.js';
+import { routingFailureFromResult, routingFailureOneShotLine, routingFallbackFromError } from './router/routing-failure.js';
 import { startThinkingHeartbeat, ROUTING_HEARTBEAT_THRESHOLDS } from './renderer/thinking-heartbeat.js';
 import { setRenderingOverride, setHeadlessOverride, setOneShotOverride } from './renderer/tty.js';
 import { resolveRenderingMode } from './renderer/rendering-mode.js';
@@ -96,6 +97,9 @@ export async function runOneShot(prompt, opts) {
         loadCustomerModelConfig(cfg, async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }),
         // Task 16 (F13) — BYOK reads only the served tool_loading (signed in only).
         fetchToolLoadingMode(cfg, async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }),
+        // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
+        // router prompt (public manifest, no prompt data) under the same cap.
+        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
     // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
     // REPL, often piped (CI / battery). Any stdin prompt would hang forever
@@ -224,7 +228,13 @@ export async function runOneShot(prompt, opts) {
                 console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
                 return 1;
             }
-            throw err;
+            // Live fix 2026-10-02 — a classify failure (proxy HTTP 500, an
+            // unreadable body) escaped as "cspeach: unhandled error". Continue on
+            // the bundled local rules instead; the offline line below says so.
+            const fallback = routingFallbackFromError(err, body);
+            if (!fallback)
+                throw err;
+            c = fallback;
         }
         finally {
             routingBeat.stop();

package/dist/projects/extract-design.js

@@ -1,8 +1,9 @@
+import { matchTitleHeading } from './title-heading.js';
 // 2026-09-17 — tolerant on heading level and dash: the skill prescribes
 // "## ABAP Design — …" but a live standalone run wrote "# ABAP Design — …"
 // and the whole design was silently lost (no file, so /abap-rap --from had
 // nothing to start from). H1..H3 and em/en/plain dash all count.
-const TITLE_RE = /^#{1,3} ABAP Design [—–-] (.+)$/m;
+const TITLE_SPEC = { phrase: String.raw `abap[ \t]+design`, skillPrefix: 'abap-design' }; // 2026-10-04 — tolerant title, see title-heading.ts
 const OBJECTS_HEADING_RE = /^### Objects to Create\s*$/m;
 const DEPENDENCY_HEADING_RE = /^### Dependency Sequence\s*$/m;
 const NEXT_HEADING_RE = /^###\s/m;
@@ -93,11 +94,11 @@ function parseDependencySequence(section, nameToId) {
     return out;
 }
 export function extractDesign(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not a design output (no "## ABAP Design — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
+    const title = titleMatch.title || 'ABAP Design';
     const objectsSection = sliceSection(markdown, OBJECTS_HEADING_RE);
     if (!objectsSection) {
         throw new Error('No "### Objects to Create" section found');

package/dist/projects/extract-estimate.js

@@ -1,6 +1,7 @@
+import { matchTitleHeading } from './title-heading.js';
 // 2026-09-17 — tolerant on heading level (H1..H3) and dash, same reason as
 // extract-design.ts.
-const TITLE_RE = /^#{1,3} Effort Estimate [—–-] (.+)$/m;
+const TITLE_SPEC = { phrase: String.raw `effort[ \t]+estimate`, skillPrefix: 'abap-estimate' }; // 2026-10-04 — tolerant title, see title-heading.ts
 const COMPONENTS_HEADING_RE = /^### Component Breakdown\s*$/m;
 const NEXT_HEADING_RE = /^###\s/m;
 function sliceSection(markdown, headingRe) {
@@ -60,11 +61,11 @@ function parseComponentsTable(section) {
     return rows;
 }
 export function extractEstimate(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not an estimate output (no "## Effort Estimate — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
+    const title = titleMatch.title || 'Effort Estimate';
     const section = sliceSection(markdown, COMPONENTS_HEADING_RE);
     if (!section) {
         throw new Error('No "### Component Breakdown" section found');

package/dist/projects/extract-spec-gap.js

@@ -1,6 +1,9 @@
-// 2026-09-17 — tolerant on heading level (H1..H3) and dash, same reason as
-// extract-design.ts: a title written one level off must not lose the file.
-const TITLE_RE = /^#{1,3} Spec Gap Analysis [—–-] (.+)$/m;
+import { matchTitleHeading } from './title-heading.js';
+// 2026-09-17 — tolerant on heading level and dash. 2026-10-04 — and on the
+// separator (colon / none), casing, bold and an "abap-spec-gap —" prefix: a
+// live /abap-app run wrote "Spec Gap Analysis: …" and the chain stopped at
+// step 1 because nothing was saved. See title-heading.ts.
+const TITLE_SPEC = { phrase: String.raw `spec(?:ification)?[ \t-]*gap[ \t]+analysis`, skillPrefix: 'abap-spec-gap' };
 const DOMAIN_RE = /^\*\*Inferred Domain:\*\*\s*(.+?)(?:\s*\[INFERRED.*?\])?$/m;
 const INPUT_TYPE_RE = /^\*\*Input Type:\*\*\s*(.+)$/m;
 const SOURCE_DOC_RE = /^\*\*Source Document:\*\*\s*(.+)$/m;
@@ -54,14 +57,16 @@ const SKIP_SECTIONS = [
     'Recommended Next Steps', // is a paragraph
 ];
 export function extractSpecGap(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not a spec-gap output (no "## Spec Gap Analysis — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
     const inputType = (INPUT_TYPE_RE.exec(markdown)?.[1] ?? 'Unknown').trim();
     const inferredDomain = (DOMAIN_RE.exec(markdown)?.[1] ?? 'Unknown').trim();
     const sourceDocument = SOURCE_DOC_RE.exec(markdown)?.[1].trim() || undefined;
+    // A bare "## Spec Gap Analysis" heading still names the artefact: fall back
+    // to the source document, then to a plain label.
+    const title = titleMatch.title || sourceDocument || 'Spec Gap Analysis';
     const sectionStarts = [];
     let m;
     const reCopy = new RegExp(SECTION_HEADING_RE.source, SECTION_HEADING_RE.flags);
@@ -103,6 +108,24 @@ export function extractSpecGap(markdown) {
         items,
     };
 }
+/**
+ * True when the text has the body of a spec-gap result (a known gap section
+ * heading, or a numbered [BLOCKER]/[IMPORTANT]/[NICE TO KNOW] line). Tells a
+ * result that failed to save apart from a conversational turn (a question back
+ * to the user), which is not an artefact at all.
+ */
+export function looksLikeSpecGap(markdown) {
+    if (/^\s*\d+\.\s*(?:\*\*)?\[(?:BLOCKER|IMPORTANT|NICE TO KNOW)\]/m.test(markdown))
+        return true;
+    const re = new RegExp(SECTION_HEADING_RE.source, SECTION_HEADING_RE.flags);
+    let m;
+    while ((m = re.exec(markdown)) !== null) {
+        const name = m[1].toLowerCase();
+        if (KNOWN_GAP_SECTIONS.some((k) => name.includes(k.toLowerCase())))
+            return true;
+    }
+    return false;
+}
 function parseGapsFromSection(sectionBody, nextId) {
     const out = [];
     const gapRe = new RegExp(GAP_LINE_RE.source); // per-line, no /m — exec on each line

package/dist/projects/plan-lane.js

@@ -108,6 +108,53 @@ export function checkLaneConsistency(content, rec) {
     }
     return null;
 }
+/* ── deploy is a required step of a UI lane (owner, 2026-10-02) ─────────── */
+/**
+ * A rap lane with a UI, and the `none` lane (a UI on an already published
+ * service), build an app that runs on SAP — its plan must deploy it. cap is
+ * out (the BTP deploy is not built); abap-report has no UI.
+ */
+export function laneRequiresDeploy(rec) {
+    const { backend, ui } = rec.final;
+    return (backend === 'rap' && ui !== 'none') || backend === 'none';
+}
+/** The deploy phase of a UI: ui layer, /abap-fiori-build, id `ui.deploy` (or `<app>.deploy`). */
+export function isDeployPhase(p) {
+    return p.layer === 'ui' && p.delegateTo === 'abap-fiori-build' && /(^|\.)deploy$/.test(p.id);
+}
+/** The developer's recorded reason for not deploying (phases[ui.build].ui.deployOptOut), if any. */
+export function deployOptOutOf(phases) {
+    for (const p of phases) {
+        const why = p.ui?.deployOptOut?.trim();
+        if (why)
+            return why;
+    }
+    return undefined;
+}
+/**
+ * Refuse a UI-lane plan with no deploy phase (and no recorded opt-out), or
+ * whose deploy phase does not wait for a UI build phase. Returns a plain
+ * refusal or null. Checked at save; a phase write-back may not remove it.
+ */
+export function checkRequiredDeploy(content, rec) {
+    if (!laneRequiresDeploy(rec))
+        return null;
+    const deploys = content.phases.filter(isDeployPhase);
+    if (deploys.length === 0) {
+        if (deployOptOutOf(content.phases))
+            return null;
+        return ('This lane builds an app that runs on SAP, so the plan needs a ui.deploy phase (deploy the app to the ABAP ' +
+            'repository, delegateTo abap-fiori-build, layer ui) after ui.build. If the developer does not want it deployed, ' +
+            'record their words in phases[ui.build].ui.deployOptOut. Re-run /abap-plan.');
+    }
+    const builds = new Set(content.phases.filter((p) => p.layer === 'ui' && !isDeployPhase(p)).map((p) => p.id));
+    for (const d of deploys) {
+        if (!d.entryCriteria.some((id) => builds.has(id))) {
+            return `Phase ${cardLine(d.id)} must run after ui.build — list the UI build phase in its entryCriteria. Re-run /abap-plan.`;
+        }
+    }
+    return null;
+}
 /**
  * Resume / continuation gate: read the plan's lane with its recorded sha,
  * re-validate it and check the stored phases against it. Lane-less plans pass

package/dist/projects/plan-run.js

@@ -372,6 +372,14 @@ g = getGlyphs()) {
     if (deployed?.work?.deployedUrl) {
         lines.push(`App deployed: ${deployed.work.deployedUrl}`);
     }
+    else if (phases.some((p) => p.layer === 'ui' && p.delegateTo === 'abap-fiori-build' && p.ui !== undefined)) {
+        // 2026-10-02 — deploy is a chained step of a UI plan: finishing without a
+        // deployed app is said out loud, never left to silence.
+        const optOut = phases.map((p) => p.ui?.deployOptOut?.trim()).find((w) => !!w);
+        lines.push(optOut
+            ? `${g.info} Deploy skipped by the developer: ${sanitizeControlChars(optOut)}`
+            : `${g.attention} The app was not deployed to SAP — it runs only in local preview. Deploy it with /abap-fiori-build (Step 10, fiori_deploy) or record why not.`);
+    }
     lines.push('Consider /abap-preflight on the produced transport(s) before release.');
     return lines;
 }

package/dist/projects/plan-schema.js

@@ -78,6 +78,8 @@ const planPhaseUiSchema = z.object({
     floorplan: z.enum(PLAN_UI_FLOORPLANS).optional(),
     appId: z.string().min(1).optional(),
     appTitle: z.string().min(1).optional(),
+    // The developer's own words for not deploying (checkRequiredDeploy, plan-lane.ts).
+    deployOptOut: z.string().min(1).optional(),
 });
 /** Keep in sync with PlanAuditState in types.ts. 'warn' is the non-blocking
  * tier (confidence-tiered redesign, 2026-07-08) — persisted literally so a

package/dist/projects/save-command.js

@@ -18,7 +18,7 @@ import { renderEmailTemplate } from './email-template.js';
 import { writePlanHandover } from './handover-md.js';
 import { ensureWorkspace, resolveWorkspacePath } from './workspace.js';
 import { askYesNo, isYes } from './yes-no.js';
-import { checkLaneConsistency, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
+import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
         artefactType: 'spec-gap',
@@ -328,6 +328,7 @@ export async function runSaveCommand(args) {
             args.log(`[save] ${e instanceof Error ? e.message : String(e)}`);
             args.log(`[save] Ask CSPeach to "re-issue the ${spec.artefactType} in the standard structure" and it will be saved then.`);
         }
+        args.onNotSaved?.('unreadable');
         return null;
     }
     // App lane routing (Task 6) — a plan that carries a lane is checked against
@@ -343,7 +344,8 @@ export async function runSaveCommand(args) {
             args.log('[save] The plan was not saved.');
             return null;
         }
-        const conflict = checkLaneConsistency(planExtract.content, lr.rec);
+        // 2026-10-02 — a UI lane must deploy (or record the developer's opt-out).
+        const conflict = checkLaneConsistency(planExtract.content, lr.rec) ?? checkRequiredDeploy(planExtract.content, lr.rec);
         if (conflict) {
             args.log('');
             args.log(`[save] ${conflict}`);
@@ -365,8 +367,10 @@ export async function runSaveCommand(args) {
     // prompt, give maybeOfferSave's headless prompt a question-aware answer
     // first.
     const answer = await askYesNo({ question: 'Save as project file?', confirm: args.confirm, prompt: args.prompt });
-    if (!isYes(answer))
+    if (!isYes(answer)) {
+        args.onNotSaved?.('declined');
         return null;
+    }
     let env;
     if (planExtract && prior) {
         // C1 (D30) — the 49dd duplicate: the generic save used to mint a fresh

package/dist/projects/title-heading.js

@@ -0,0 +1,36 @@
+// 2026-10-04 — one tolerant title-heading matcher for the prose artefacts
+// (spec-gap, design, estimate). A live /abap-app run lost its spec-gap file
+// because the model wrote "Spec Gap Analysis: …" and the saver only accepted
+// "## Spec Gap Analysis — …". Models drift on the separator (dash, en/em dash,
+// colon, none), the heading level (#..######, or none), the casing and an
+// optional "<skill-name> —" prefix. All of those count; an unrelated heading
+// does not.
+// Horizontal whitespace only: a match never runs onto the next line.
+const SEP = String.raw `[ \t]*[—–:-][ \t]*`;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function strip(title) {
+    return title
+        .replace(/\s*\*\*\s*$/, '') // closing bold
+        .replace(/\s+#+\s*$/, '') // closing ATX hashes
+        .trim();
+}
+/**
+ * Find the artefact's title heading. Heading lines (`#`..`######`) are tried
+ * first and may use any separator or none; a plain line (no `#`, optionally
+ * bold) must use a dash or colon, so ordinary prose never counts. The first
+ * heading line wins over any plain line.
+ */
+export function matchTitleHeading(markdown, spec) {
+    const prefix = String.raw `(?:${escapeRe(spec.skillPrefix)}${SEP})?`;
+    const phrase = `(?:${spec.phrase})`;
+    // `## [**][abap-x — ]Phrase[ — | : | ' ']Title[**]`  or  `## abap-x — Title`
+    const heading = new RegExp(String.raw `^[ \t]{0,3}#{1,6}[ \t]+(?:\*\*)?(?:${prefix}${phrase}(?:(?:${SEP}|[ \t]+)(.*?))?|${escapeRe(spec.skillPrefix)}${SEP}(.+?))[ \t]*$`, 'im');
+    const h = heading.exec(markdown);
+    if (h)
+        return { title: strip(h[1] ?? h[2] ?? '') };
+    const plain = new RegExp(String.raw `^[ \t]{0,3}(?:\*\*)?(?:${prefix}${phrase}${SEP}(.+?)|${escapeRe(spec.skillPrefix)}${SEP}(.+?))[ \t]*$`, 'im');
+    const p = plain.exec(markdown);
+    if (p)
+        return { title: strip(p[1] ?? p[2] ?? '') };
+    return null;
+}