@cspeach/cli 1.1.27 → 1.1.28

package/dist/lane/app-chain.js

@@ -3,7 +3,7 @@
 //   stage 1  /abap-app @<spec>            → runs as abap-spec-gap
 //   stage 2  /abap-app --from @<specgap>  → lane card (app_lane_resolve, Task 5)
 //   stage 3  /abap-plan --from @<specgap> → plan with the lane block (Task 6)
-//   start    Yes → /abap-plan --resume @<saved plan> --guarded
+//   start    Yes → /abap-plan --resume @<saved plan> --guarded (and the object-list grant)
 //
 // Every command queued here is built by CLI code from a path the CLI itself
 // produced (the saved spec-gap / plan envelope). Model text never reaches a
@@ -17,7 +17,11 @@ import path from 'node:path';
 import { readProjectFile } from '../projects/status.js';
 import { looksLikeSpecGap } from '../projects/extract-spec-gap.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
-import { buildResumeCommand } from '../commands/plan-resume.js';
+import { adoptPlanTransportOnResume, buildResumeCommand, planBuildTransport } from '../commands/plan-resume.js';
+import { collectPlannedObjects, plannedObjectFacts, planGrantFactLines } from '../projects/plan-objects.js';
+import { phaseDisplayTitle } from '../projects/plan-run.js';
+import { isDeployPhase } from '../projects/plan-lane.js';
+import { installPlanGrant, planGrantAllowed } from '../approvals/plan-grant.js';
 import { canonicalLanePath } from './paths.js';
 import { cardLine, interactiveRunLine, shownToken } from './card.js';
 import { clearAppFlow, getAppFlow, setSpecGap } from './app-flow.js';
@@ -28,7 +32,7 @@ import { parseFromFlag } from '../skills/promotion-dispatch.js';
 export const STEP_1 = 'Step 1 of 3: finding the gaps in the spec.';
 export const STEP_2 = 'Step 2 of 3: choosing the build lane.';
 export const STEP_3 = 'Step 3 of 3: planning the build.';
-export const START_QUESTION = 'Start building now? It runs every phase and stops only for your answers, SAP approvals or a failed check.';
+export const START_QUESTION = 'Build this now?';
 /** Trailing characters a sentence puts after a token: `see @spec.md.` / `(@spec.md)`. */
 const TRAILING_PUNCT = /[.,;:!?)\]}>]+$/;
 /**
@@ -213,6 +217,54 @@ export function savedPlanLane(savedPath) {
         return undefined;
     }
 }
+/** The saved plan (envelope + parsed content), or undefined. */
+function readSavedPlan(savedPath) {
+    try {
+        const envelope = readProjectFile(savedPath);
+        if (envelope.artefactType !== 'plan')
+            return undefined;
+        const pc = parsePlanContent(envelope.content);
+        return pc.ok ? { envelope, content: pc.content } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const OBJECT_LIST_FAILED = 'The object list could not be approved. Each SAP write asks first.';
+/**
+ * The facts under "Build this now?": steps, the exact object list, transport,
+ * deploy, what stops. `grant: false` (the object-list approval cannot be
+ * given here: production, advisory-only, per-write approvals) says each write
+ * asks instead of promising no further card.
+ */
+export function buildStartCardFacts(content, opts = {}) {
+    const objects = collectPlannedObjects(content);
+    // The plan's recorded transport, else the session's current one: the grant
+    // is minted with it bound, so the card names it.
+    const transport = planBuildTransport(content.phases);
+    const facts = [`Steps: ${content.phases.map((p) => phaseDisplayTitle(p, content.phases)).join(' · ')}`];
+    if (objects.length > 0) {
+        facts.push(`It will create or change these ${objects.length} SAP object${objects.length === 1 ? '' : 's'}:`);
+        facts.push(...plannedObjectFacts(objects).map((r) => `  ${r}`));
+        facts.push(`Transport: ${transport ?? 'a new one for this build'}`);
+        if (opts.grant === false)
+            facts.push('CSPeach asks before each write.');
+        else
+            facts.push(...planGrantFactLines());
+    }
+    else {
+        facts.push('The plan does not list its SAP objects, so CSPeach asks before each write.');
+    }
+    if (content.phases.some((p) => isDeployPhase(p))) {
+        facts.push(`Deploy: the app goes to ${opts.sapAlias ?? 'your SAP system'}. CSPeach asks again before deploying.`);
+    }
+    // The closing fact follows what was granted: with no object-list approval
+    // every SAP write asks, so it never promises "only a write not on the list".
+    facts.push(opts.grant !== false && objects.length > 0
+        ? 'It runs every step and stops only for your answers, a write not on the list, a failed check, or the deploy.'
+        : 'It runs every step and stops for your answers, each SAP write, a failed check, or the deploy.');
+    return { facts, objects, ...(transport ? { transport } : {}) };
+}
 /**
  * After a spec-gap save inside an app flow that is at its spec-gap step:
  * record the saved path and queue stage 2. Runs once per flow (R11): a later
@@ -277,16 +329,20 @@ export function afterSpecGapNotSaved(h, reason, assistantText) {
     h.emit(SPEC_GAP_NOT_SAVED_LINE(flow.specToken));
 }
 /**
- * After a plan save: when the saved plan carries `from.lane`, offer to start
- * the guarded run. Inside an active app flow the flow's lane must be the
- * plan's lane. A plan without `from.lane` → nothing.
+ * After a plan save: one "Build this now?" card that shows the exact SAP object
+ * list (spec §3.2). Yes approves the plan AND that list (Forge Rule 8: plan,
+ * then yes, then execute) and starts the continuous run. Inside an /abap-app
+ * flow only the flow's own lane plan gets the card; outside a flow every saved
+ * plan does (2026-10-04 — /abap-plan and revision plans too). Headless, or
+ * with no card listener (the card comes back cancelled), no grant is minted.
  */
 export async function afterPlanSave(h, savedPath) {
-    const lane = savedPlanLane(savedPath);
-    if (!lane)
+    const saved = readSavedPlan(savedPath);
+    if (!saved)
         return;
+    const lane = saved.content.from.lane;
     const flow = getAppFlow(h.session);
-    if (flow && (flow.expect !== 'plan' || !flow.lane
+    if (flow && (flow.expect !== 'plan' || !flow.lane || !lane
         || canonicalLanePath(flow.lane.path) !== canonicalLanePath(lane.path) || flow.lane.sha256 !== lane.sha256)) {
         return;
     }
@@ -303,6 +359,11 @@ export async function afterPlanSave(h, savedPath) {
         end();
         return;
     }
+    const sapAlias = h.sapAlias && h.sapAlias !== 'none' ? h.sapAlias : undefined;
+    const grantable = await planGrantAllowed(sapAlias);
+    const { facts, objects, transport } = buildStartCardFacts(saved.content, {
+        ...(sapAlias ? { sapAlias } : {}), grant: grantable,
+    });
     const confirm = h.confirm ?? (async (req) => {
         const { askConfirm } = await import('../ui/confirm-request.js');
         return askConfirm(req);
@@ -311,11 +372,29 @@ export async function afterPlanSave(h, savedPath) {
         id: 'app-start-build',
         tag: 'QUESTION',
         title: START_QUESTION,
+        facts,
         choices: [{ value: 'yes', label: 'Yes' }, { value: 'no', label: 'No' }],
         initial: 0,
         aliases: { y: 'yes', n: 'no' },
     });
     if (res.value === 'yes' && !res.cancelled) {
+        // The plan's recorded transport becomes the session transport when the
+        // session has none, so the first step's writes land on (and are covered
+        // by) it without the model naming it — the same rule a resume uses.
+        adoptPlanTransportOnResume(saved.content.phases);
+        const sessionId = h.session.id;
+        if (grantable && objects.length > 0 && typeof sessionId === 'string' && sessionId) {
+            const a = { planId: saved.envelope.id, sessionId, objects, ...(transport ? { transport } : {}) };
+            try {
+                if (h.grant)
+                    await h.grant(a);
+                else if (!(await installPlanGrant({ ...a, ...(sapAlias ? { sapAlias } : {}) })))
+                    h.emit(OBJECT_LIST_FAILED);
+            }
+            catch {
+                h.emit(OBJECT_LIST_FAILED);
+            }
+        }
         h.queueNext(cmd);
     }
     else {

package/dist/one-shot.js

@@ -59,6 +59,7 @@ import './tools/cap/sap-link-tool.js';
 import './tools/cap/link-smoke.js';
 import './tools/lane/app-lane-resolve.js';
 import './tools/extend-model/tool.js';
+import './tools/text-elements/tools.js';
 import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';

package/dist/projects/extract-plan.js

@@ -1,6 +1,8 @@
 import { parsePlanContent, PLAN_PHASE_STATUSES } from './plan-schema.js';
 import { computeNextPhase, isPhaseSatisfied } from './plan-run.js';
 import { canonicalLanePath } from '../lane/paths.js';
+/** The error message when a turn wrote no plan manifest block (callers match on it). */
+export const NO_PLAN_MANIFEST_MESSAGE = 'No plan manifest block found in the output';
 // E2 dual-read: accept BOTH the legacy `csforge:` prefix (old artifacts on
 // customer disks carry it forever) and the current `cspeach:` prefix. Legacy
 // acceptance is permanent.
@@ -75,6 +77,13 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
         // phase's `ui` always survives the spread below.
         delete overlay.ui;
         normalizeWorkFields(overlay);
+        // 2026-10-04 (continuous run) — `work` replaces wholesale, but the planned
+        // object list was authored at plan creation: keep it when the overlay omits it.
+        const ow = overlay.work;
+        const priorWork = prior.phases.find((p) => p.id === id)?.work;
+        if (ow && typeof ow === 'object' && ow.plannedObjects === undefined && priorWork?.plannedObjects !== undefined) {
+            ow.plannedObjects = priorWork.plannedObjects;
+        }
     }
     // 1:1 map over the PRIOR phase list — changed entries overlay their phase,
     // everything else passes through verbatim from the envelope.
@@ -149,6 +158,29 @@ function imposeLane(contentInput, priorContent, opts) {
         ci.from = rest;
     }
 }
+/**
+ * `from.specGap` precedence: the CLI's promotion state (plan creation) > the
+ * prior envelope's ref (resume / revision — the source never changes mid-plan)
+ * > whatever valid ref the model wrote (kept as before; junk refs are already
+ * stripped by the sha guard). Never mutates the prior content.
+ */
+function imposeSpecGap(contentInput, priorContent, opts) {
+    if (typeof contentInput !== 'object' || contentInput === null || Array.isArray(contentInput))
+        return;
+    const ref = opts.specGap
+        ? { path: opts.specGap.path, sha256: opts.specGap.sha256 }
+        : priorContent?.from.specGap
+            ? { ...priorContent.from.specGap }
+            : undefined;
+    if (!ref)
+        return;
+    const ci = contentInput;
+    const from = ci.from;
+    if (from === undefined)
+        ci.from = { specGap: ref };
+    else if (typeof from === 'object' && from !== null && !Array.isArray(from))
+        ci.from = { ...from, specGap: ref };
+}
 export function extractPlan(markdown, priorContent, opts = {}) {
     // Last block wins — defensive against a turn emitting more than one block.
     const re = new RegExp(MANIFEST_RE.source, MANIFEST_RE.flags);
@@ -157,7 +189,7 @@ export function extractPlan(markdown, priorContent, opts = {}) {
     while ((m = re.exec(markdown)) !== null)
         last = m;
     if (!last) {
-        throw new Error('No <!-- csforge:plan-manifest --> block found in skill output');
+        throw new Error(NO_PLAN_MANIFEST_MESSAGE);
     }
     let parsed;
     try {
@@ -247,6 +279,7 @@ export function extractPlan(markdown, priorContent, opts = {}) {
         throw new Error('plan-manifest must carry either "content" (full shape) or "changed" (compact resume shape)');
     }
     imposeLane(contentInput, priorContent, opts);
+    imposeSpecGap(contentInput, priorContent, opts);
     const pc = parsePlanContent(contentInput);
     if (!pc.ok) {
         throw new Error(`plan-manifest content failed validation:\n  ${pc.errors.join('\n  ')}`);

package/dist/projects/handover-md.js

@@ -40,7 +40,7 @@ function auditWords(audit) {
         case 'waived': return `· waived${audit.waiveCategory ? ` (${audit.waiveCategory})` : ''}`;
         case 'failed': return '✗ audit failed';
         case 'not_audited_hand_edited': return '· hand-edited';
-        case 'pending':
+        case 'pending': return '! not independently checked yet';
         case 'infra_failed':
         default:
             return '! audit not run';

package/dist/projects/plan-objects.js

@@ -0,0 +1,75 @@
+import { canonicalApprovalObject } from '../approvals/canonical.js';
+export const OBJECT_TYPE_LABELS = {
+    TABL: 'table', DDLS: 'CDS view', DDLX: 'metadata extension', DCLS: 'access control',
+    BDEF: 'behavior definition', CLAS: 'class', INTF: 'interface', SRVD: 'service definition',
+    SRVB: 'service binding', PROG: 'program', FUGR: 'function group', DOMA: 'domain',
+    DTEL: 'data element', MSAG: 'message class', NROB: 'number range object',
+};
+/** Never on the list: deploy (own card), transport and package (a different one must ask). */
+const NEVER_ON_LIST = new Set(['WAPA', 'CTS', 'DEVC']);
+const TYPE_RE = /^[A-Z]{4}$/;
+const NAME_RE = /^(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,40}$/;
+const PKG_RE = /^(\$[A-Z0-9_]{1,29}|(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,30})$/;
+export const MAX_PLANNED_OBJECTS = 200;
+/** ADT type code from a raw type: `'ddls/df'` → `'DDLS'`. */
+export function normalizeObjectType(raw) {
+    return String(raw ?? '').trim().toUpperCase().split('/')[0].trim();
+}
+/** Canonical upper-case object name (same folding as approvals). */
+export function normalizeObjectName(raw) {
+    return canonicalApprovalObject(raw);
+}
+/** One validated row, or null for anything malformed or never-on-the-list. */
+export function toPlannedObject(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (typeof r.type !== 'string' || typeof r.name !== 'string')
+        return null;
+    const type = normalizeObjectType(r.type);
+    const name = normalizeObjectName(r.name);
+    // Only repository object types the list knows are kept: a data run (DATA) or
+    // any other non-repository type is never on the list, so never signed.
+    if (!TYPE_RE.test(type) || NEVER_ON_LIST.has(type) || !Object.hasOwn(OBJECT_TYPE_LABELS, type) || !NAME_RE.test(name))
+        return null;
+    const pkg = typeof r.package === 'string' ? r.package.trim().toUpperCase() : '';
+    return { type, name, ...(pkg && PKG_RE.test(pkg) ? { package: pkg } : {}) };
+}
+/** Every phase's planned objects — validated, deduped by type+name, capped. */
+export function collectPlannedObjects(content) {
+    const seen = new Set();
+    const out = [];
+    for (const p of content.phases) {
+        const list = p.work?.plannedObjects;
+        if (!Array.isArray(list))
+            continue;
+        for (const raw of list) {
+            const o = toPlannedObject(raw);
+            if (!o)
+                continue;
+            const key = `${o.type}:${o.name}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push(o);
+            if (out.length >= MAX_PLANNED_OBJECTS)
+                return out;
+        }
+    }
+    return out;
+}
+/** Card rows: `ZI_X · CDS view · package ZPKG`, with a "more" line past max. */
+export function plannedObjectFacts(objs, max = 12) {
+    const rows = objs.slice(0, max).map((o) => `${o.name} · ${OBJECT_TYPE_LABELS[o.type] ?? o.type}${o.package ? ` · package ${o.package}` : ''}`);
+    if (objs.length > max)
+        rows.push(`… and ${objs.length - max} more`);
+    return rows;
+}
+/**
+ * The two card lines that say what the object-list approval covers. One
+ * source for every card that installs the plan grant ("Build this now?",
+ * the startup Continue).
+ */
+export function planGrantFactLines() {
+    return ['Writes to these objects need no further card.', 'Anything else stops and asks.'];
+}

package/dist/projects/plan-run.js

@@ -74,27 +74,52 @@ export function statusesFromItems(items, phases) {
  * session died mid-phase) qualify the same as 'todo' — the phase is
  * re-entered from the top, gates and grounding included.
  */
-export function computeNextPhase(phases, statuses) {
+function nextPhaseWith(phases, statuses, satisfied) {
     // Audit verdicts live on the phase objects, not the status map — look each
     // dependency up so a validated-but-audit-failed phase gates its dependants.
     const byId = new Map(phases.map((p) => [p.id, p]));
     for (const p of phases) {
         const s = statuses[p.id] ?? 'todo';
-        if (isPhaseSatisfied(s, p.audit) || s === 'blocked')
+        if (satisfied(s, p.audit) || s === 'blocked')
             continue;
         if (s !== 'todo' && !IN_PROGRESS.includes(s))
             continue;
-        if (p.entryCriteria.every((dep) => isPhaseSatisfied(statuses[dep], byId.get(dep)?.audit)))
+        if (p.entryCriteria.every((dep) => satisfied(statuses[dep], byId.get(dep)?.audit)))
             return p;
     }
     return null;
 }
+export function computeNextPhase(phases, statuses) {
+    return nextPhaseWith(phases, statuses, isPhaseSatisfied);
+}
+/**
+ * 2026-10-04 (continuous run) — audits run once at the END of a run, so inside
+ * a run a 'pending' audit is deferred, not unresolved. On-disk semantics
+ * (isAuditResolved / isPhaseSatisfied / computeNextPhase) are unchanged.
+ */
+export function isAuditResolvedForRun(audit) {
+    return isAuditResolved(audit) || audit?.state === 'pending';
+}
+export function isPhaseSatisfiedForRun(s, audit) {
+    return (s === 'validated' || s === 'validated-with-waiver') && isAuditResolvedForRun(audit);
+}
+export function computeNextPhaseForRun(phases, statuses) {
+    return nextPhaseWith(phases, statuses, isPhaseSatisfiedForRun);
+}
+/**
+ * 2026-10-04 (continuous run) — every phase whose audit is still 'pending'
+ * (deferred to the end of the run), in plan order, whichever session wrote it.
+ * The single scan shared by the resume path and the end-of-run batch audit.
+ */
+export function pendingAuditPhaseIds(content) {
+    return content.phases.filter((p) => p.audit?.state === 'pending').map((p) => p.id);
+}
 /**
  * Plan-progress board printed before and after every resume turn (and by
  * `--status` for plan envelopes). Flows through chunkEmitter in Ink mode and
  * console.log in classic mode alike.
  *
- *   HR Dayforce Extract (v3) · 2 of 7 done
+ *   HR Dayforce Extract (v3) · 2 of 7 phases done
  *
  *     ✓ Types — ZDOM_DAYF_STATUS ✓ audited
  *     ◼ Tables — Reason checktable + text table active
@@ -123,14 +148,43 @@ const DELEGATE_LABELS = {
     'abap-eml': 'Behaviour logic',
     'abap-segw': 'OData (SEGW)',
 };
-function phaseTitle(p) {
-    // C2 (2026-06-11, D29): an explicit seed-time title wins — the seed prose
-    // instructs short human names ("Design", "Tables", "Service"). The label
-    // maps remain the fallback for envelopes seeded before titles existed.
+/** A component id that is not a human word: `c1`, `k1`, `C12`, `project`, `ui`. */
+const MACHINE_COMPONENT = /^([a-z]\d+|project|ui)$/i;
+/**
+ * 2026-10-04 (continuous run) - the ONE title every CSPeach line uses for a
+ * phase. Seed-time `title` wins, then the delegate / layer labels; the id is
+ * the last resort (tidied). With `phases`, a plan made of more than one NAMED
+ * component ("backend", "frontend") prefixes the component: "Backend: CDS views".
+ */
+export function phaseDisplayTitle(p, phases) {
     const explicit = p.title?.trim();
-    if (explicit)
-        return explicit;
-    return DELEGATE_LABELS[p.delegateTo] ?? LAYER_LABELS[p.layer] ?? tidyId(p.id);
+    const base = explicit || (DELEGATE_LABELS[p.delegateTo] ?? LAYER_LABELS[p.layer] ?? tidyId(p.id));
+    if (!phases)
+        return base;
+    const named = new Set(phases.map((q) => q.component).filter((c) => c && !MACHINE_COMPONENT.test(c)));
+    if (named.size < 2 || !p.component || MACHINE_COMPONENT.test(p.component))
+        return base;
+    return `${p.component.charAt(0).toUpperCase()}${p.component.slice(1)}: ${base}`;
+}
+function phaseTitle(p) {
+    return phaseDisplayTitle(p);
+}
+/**
+ * 2026-10-04 - the one-line progress strip shown at each phase start:
+ * "Design ✓ · CDS views ◼ · Service · Fiori app · Deploy". Titles only.
+ */
+export function renderPlanProgressLine(a) {
+    const g = getGlyphs();
+    return a.content.phases.map((p) => {
+        const t = sanitizeControlChars(phaseDisplayTitle(p, a.content.phases));
+        if (isPhaseSatisfied(a.statuses[p.id]))
+            return `${t} ${paint('ok', g.done)}`;
+        if (p.id === a.currentId)
+            return `${t} ${paint('sap', g.current)}`;
+        if (a.statuses[p.id] === 'blocked')
+            return `${t} ${paint('bad', g.failed)}`;
+        return paint('dim', t);
+    }).join(paint('dim', ' · '));
 }
 function tidyId(id) {
     const tail = id.split('.').pop() ?? id;
@@ -173,7 +227,9 @@ function auditTag(audit) {
         }
         case 'failed': return ` ${paint('bad', `${g.failed} audit failed`)}`;
         case 'not_audited_hand_edited': return ` ${paint('dim', `${g.info} hand-edited`)}`;
-        case 'pending':
+        // 2026-10-04 (continuous run) — 'pending' = the end-of-run check has not
+        // judged this step yet (deferred, or it could not run); the next resume runs it.
+        case 'pending': return ` ${paint('warn', `${g.attention} not independently checked yet`)}`;
         case 'infra_failed':
         default:
             // Deliberate forward-compat: an unknown future state reads "audit not run".
@@ -212,7 +268,7 @@ export function renderPlanTracker(a) {
     // plan-tracker-pin).
     const validated = a.content.phases.filter((p) => isPhaseSatisfied(a.statuses[p.id], p.audit)).length;
     if (a.includeHeader !== false) {
-        const tail = ` (v${a.version}) · ${countLabel(validated, total)} done`;
+        const tail = ` (v${a.version}) · ${countLabel(validated, total)} phases done`;
         const head = truncateToWidth(sanitizeControlChars(a.title), Math.max(1, width - stringWidth(tail)));
         lines.push(chalk.bold(head) + paint('dim', tail));
         lines.push('');
@@ -330,8 +386,8 @@ g = getGlyphs()) {
         const notes = p.audit.findings ?? [];
         // Findings are model-written text: sanitise before they reach a terminal.
         lines.push(notes.length > 0
-            ? `${g.attention} ${p.id} passed with ${notes.length} note${notes.length === 1 ? '' : 's'}: ${sanitizeControlChars(notes.join('; '))}.`
-            : `${g.attention} ${p.id} passed with notes.`);
+            ? `${g.attention} ${sanitizeControlChars(phaseDisplayTitle(p, phases))} passed with ${notes.length} note${notes.length === 1 ? '' : 's'}: ${sanitizeControlChars(notes.join('; '))}.`
+            : `${g.attention} ${sanitizeControlChars(phaseDisplayTitle(p, phases))} passed with notes.`);
     }
     // §10 Q2 (audit-confidence redesign): a waived phase surfaces its light
     // category + reason in the FINAL summary — an "all validated" plan never
@@ -344,7 +400,7 @@ g = getGlyphs()) {
         // Same "· waived" tag as the board (auditTag); the reason is user-typed text.
         const cat = p.audit.waiveCategory ? ` (${sanitizeControlChars(p.audit.waiveCategory)})` : '';
         const reason = p.audit.waivedReason ? `: ${sanitizeControlChars(p.audit.waivedReason)}` : '';
-        lines.push(`${g.info} ${p.id} waived${cat}${reason}.`);
+        lines.push(`${g.info} ${sanitizeControlChars(phaseDisplayTitle(p, phases))} waived${cat}${reason}.`);
     }
     // audit-infra-continue (2026-07-09): a phase whose audit could NOT RUN
     // surfaces in the FINAL summary as a DISTINCT "unverified" line — an "all
@@ -355,7 +411,7 @@ g = getGlyphs()) {
     for (const p of phases) {
         if (p.audit?.state !== 'infra_failed')
             continue;
-        lines.push(`${g.attention} ${p.id} was NOT audit-verified (audit infrastructure failed — its own exit gate, activation + ATC, passed).`);
+        lines.push(`${g.attention} ${sanitizeControlChars(phaseDisplayTitle(p, phases))} was not independently checked (the check could not run — its own exit gate, activation + ATC, passed).`);
     }
     const hasUi = phases.some((p) => p.layer === 'ui' || p.layer === 'cap.ui' || p.delegateTo === 'abap-fiori-build');
     const hasService = phases.some((p) => p.layer === 'service');
@@ -378,7 +434,7 @@ g = getGlyphs()) {
         const optOut = phases.map((p) => p.ui?.deployOptOut?.trim()).find((w) => !!w);
         lines.push(optOut
             ? `${g.info} Deploy skipped by the developer: ${sanitizeControlChars(optOut)}`
-            : `${g.attention} The app was not deployed to SAP — it runs only in local preview. Deploy it with /abap-fiori-build (Step 10, fiori_deploy) or record why not.`);
+            : `${g.attention} The app was not deployed to SAP — it runs only in local preview. Deploy it with /abap-fiori-build or record why not.`);
     }
     lines.push('Consider /abap-preflight on the produced transport(s) before release.');
     return lines;

package/dist/projects/plan-schema.js

@@ -68,6 +68,11 @@ const planPhaseWorkSchema = z.object({
         version: z.enum(['2.0', '4.0']).optional(),
     }).optional().catch(undefined),
     deployedUrl: z.string().min(1).optional().catch(undefined),
+    // 2026-10-04 (continuous run) — `plannedObjects` (the phase's planned SAP
+    // objects) is deliberately NOT declared here: .passthrough() carries it
+    // through parse and save exactly as written, so one malformed row (or a
+    // non-list) can never drop the valid rows or fail the envelope.
+    // collectPlannedObjects (plan-objects.ts) validates each row where used.
 }).passthrough();
 export const PLAN_UI_FLAVORS = ['fiori-elements', 'freestyle'];
 export const PLAN_UI_FLOORPLANS = ['listReport', 'worklist', 'ovp', 'alp'];
@@ -119,6 +124,7 @@ const planPhaseAuditSchema = z.object({
     // D-B review item 1 (2026-07-05): attempt-window cutoff for re-audits (see
     // PlanPhaseAudit in types.ts). Must be in the schema or z.object strips it.
     attemptStartedAt: z.string().optional(),
+    attemptEndedAt: z.string().optional(),
     consecutiveFailures: z.number().int().nonnegative().optional(),
 });
 /** Fail-safe write-ness: a phase that doesn't declare is treated as writing. */