@cspeach/cli 1.1.34 → 1.1.36

package/.gitattributes

@@ -0,0 +1 @@
+test/unit/recorded/golden/*.json -text

package/dist/agent/loop.js

@@ -44,6 +44,7 @@ import { consumeTodoSetThisTurn } from '../ui/todo-emitter.js';
 import { runSaveCommand, runPromoteCommand, detectArtifactSkill, offerAnswerBlockers } from '../projects/index.js';
 import { planLaneBlockForTurn } from '../projects/plan-lane.js';
 import { clearAppFlow, getAppFlow, setGapConfirmed, startAppFlow } from '../lane/app-flow.js';
+import { getLatestSkeletonDecision } from '../rap/skeleton-session.js';
 import { afterRebuildTurn } from '../journey/rebuild.js';
 import { afterJourneyTurn, gateJourneyForTurn, journeyAsk, journeyCardConfirm, journeyStoppedOnError, journeyTurnBlock, pauseJourneyForInterruptedTurn } from '../journey/chain.js';
 import { addJourneyLeftOut, addJourneySkips, getJourneyFlow } from '../journey/flow.js';
@@ -227,50 +228,140 @@ export async function inkAwareConfirm(q, opts) {
     return 'n';
 }
 /**
- * Choices picker for an answer-blocker that carries `options`. Renders the
- * native Ink AskCard (the same CC-style picker the ask_question tool
- * uses) with the candidate answers plus "Write my own" and "Skip" escapes.
+ * The picker for one spec-gap blocker (Task 3, 2026-10-12). It asks through
+ * the normal question path: a one-question v2 form, the same shape the
+ * ask_question tool sends, drawn by AskCard.
  *
- * - headless  → skip (never blocks on stdin)
- * - classic (non-Ink) → 'write' so the caller falls back to the free-text box
- * - Ink → choice/multi modal; Esc or empty selection → skip
+ * - "Blocker 2 of 4" on the card frame's top edge (Task 4); the question is the bare text
+ * - Ctrl+C on the card → { kind: 'stop' }: the remaining blockers are not asked
+ * - options show in sentence case (the stored answer keeps the words as
+ *   written), then a plain "Skip for now" option; the card's own inline
+ *   "Type something else…" row takes a typed answer, so no second text card
+ * - a blocker with no options is a free-text form question (Esc skips)
+ * - asked under the card-slot focus claim; one scrollback line per answer
+ *   ("Blocker 2 of 4 → <answer>"), so answered blockers stay on screen
+ * - headless → skip (never blocks); classic (non-Ink) → 'write' (free text)
  *
- * The two sentinels are filtered out of any real picked answer; for multi-select
- * the modal returns comma-joined values, so Write/Skip win over any co-selected
- * options.
+ * Option values are index ids (o0, o1…) so an option with a comma survives a
+ * multi-select answer (comma-joined values).
  */
-const CHOOSE_WRITE = '__cspeach_write__';
 const CHOOSE_SKIP = '__cspeach_skip__';
+const SKIP_LABEL = 'Skip for now';
+const SKIP_DESCRIPTION = 'Stays open. Answer it later at cspeach.dev/edit.';
+const SKIPPED_TRACE = 'skipped for now';
+const STOPPED_TRACE = 'stopped';
+/**
+ * A first word that is a name, not prose (Task 4, m1): it holds _ / digits /
+ * a slash (zcl_foo, s4hk903359, zfin/pkg), is all capitals (ZTEST_LAS, ERDAT)
+ * or has a capital after its first letter (eTag). Such a word is never recased.
+ */
+const Z_Y_ENGLISH = new Set(['yes', 'you', 'your', 'yours', 'yet', 'year', 'years', 'yearly', 'yield', 'zero', 'zone', 'zones', 'zoom']);
+function looksLikeIdentifier(word) {
+    if (/[_\d/]/.test(word))
+        return true;
+    // A Z/Y customer-namespace name (zfin, ytools) unless it is a common English word.
+    if (/^[zy][a-z0-9_]{2,}$/i.test(word) && !Z_Y_ENGLISH.has(word.toLowerCase()))
+        return true;
+    if (/[A-Z]/.test(word.slice(1)))
+        return true;
+    return word.length > 1 && /[A-Z]/.test(word) && word === word.toUpperCase();
+}
+/** First letter upper case when it is a lower-case letter; the rest as written. Identifiers stay as written. */
+function sentenceCase(label) {
+    const first = label.charAt(0);
+    if (first === first.toUpperCase())
+        return label;
+    if (looksLikeIdentifier(label.split(/\s/, 1)[0] ?? ''))
+        return label;
+    return first.toUpperCase() + label.slice(1);
+}
 export async function inkAwareChoose(a) {
     const { shouldUseInk, isHeadless } = await import('../renderer/tty.js');
     if (isHeadless())
         return { kind: 'skip' };
     if (!shouldUseInk())
         return { kind: 'write' }; // classic REPL → free-text fallback
-    const choices = [
-        ...a.options.map((o) => ({ value: o, label: o })),
-        { value: CHOOSE_WRITE, label: '✏️  Write my own…' },
-        { value: CHOOSE_SKIP, label: '↷  Skip (leave for the viewer)' },
+    const header = `Blocker ${a.index + 1} of ${a.total}`;
+    const freeText = a.options.length === 0;
+    const options = freeText ? [] : [
+        ...a.options.map((o, i) => ({ value: `o${i}`, label: sentenceCase(o) })),
+        { value: CHOOSE_SKIP, label: SKIP_LABEL, description: SKIP_DESCRIPTION },
     ];
     const { askQuestionEmitter } = await import('../ui/ask-question-emitter.js');
-    const res = await askQuestionEmitter.request({
-        id: 'answer-blocker',
-        question: `Blocker ${a.index + 1}/${a.total}: ${a.question}`,
-        context: a.multiSelect ? 'Space to toggle one or more · Enter to submit' : undefined,
-        kind: a.multiSelect ? 'multi' : 'choice',
-        choices,
-    });
-    if (res.cancelled || res.answer == null)
+    const { withFocusClaim } = await import('../ui/card-slot.js');
+    const { emitTrace, formatAnswerTrace } = await import('../renderer/trace.js');
+    const { uiWidth } = await import('../renderer/ui-width.js');
+    let stopped = false;
+    const res = await withFocusClaim(() => askQuestionEmitter.requestForm({
+        formId: 'answer-blocker',
+        // Task 4 (m4): the counter sits on the frame's top edge.
+        frameHeader: header,
+        // Task 4 (m2): Ctrl+C stops the remaining blocker cards.
+        onInterrupt: () => { stopped = true; },
+        questions: [{
+                id: 'answer-blocker',
+                question: a.question,
+                ...(freeText ? { context: 'Esc skips it for now' } : {}),
+                header,
+                multiSelect: !freeText && a.multiSelect,
+                freeText,
+                options,
+            }],
+    }));
+    const skip = () => {
+        emitTrace(formatAnswerTrace(header, SKIPPED_TRACE, uiWidth()));
         return { kind: 'skip' };
-    const values = res.answer.split(',');
-    if (values.includes(CHOOSE_WRITE))
-        return { kind: 'write' };
-    if (values.includes(CHOOSE_SKIP))
-        return { kind: 'skip' };
-    const real = values.filter((v) => v !== CHOOSE_WRITE && v !== CHOOSE_SKIP);
-    if (real.length === 0)
-        return { kind: 'skip' };
-    return { kind: 'picked', answer: real.join(', ') };
+    };
+    if (stopped) {
+        emitTrace(formatAnswerTrace(header, STOPPED_TRACE, uiWidth()));
+        return { kind: 'stop' };
+    }
+    const ans = res.cancelled ? undefined : res.answers[0];
+    if (!ans || ans.answer == null)
+        return skip();
+    let answer;
+    let shown;
+    if (freeText) {
+        answer = ans.answer.trim();
+        shown = answer;
+    }
+    else if (ans.custom) {
+        // Task 4 (m3): a multi-select typed answer arrives as the ticked labels
+        // (in option order), then the typed words. The labels go back to the
+        // options as written; a ticked "Skip for now" gives way to the answer.
+        let rest = ans.answer.trim();
+        const parts = [];
+        const shownParts = [];
+        if (a.multiSelect) {
+            for (const o of options) {
+                if (!rest.startsWith(`${o.label}, `))
+                    continue;
+                rest = rest.slice(o.label.length + 2);
+                const i = /^o(\d+)$/.exec(o.value);
+                if (i) {
+                    parts.push(a.options[Number(i[1])]);
+                    shownParts.push(o.label);
+                }
+            }
+        }
+        answer = [...parts, rest].join(', ');
+        shown = [...shownParts, rest].join(', ');
+    }
+    else {
+        const values = ans.answer.split(',');
+        if (values.includes(CHOOSE_SKIP))
+            return skip();
+        const picked = values
+            .map((v) => /^o(\d+)$/.exec(v))
+            .map((m) => (m ? a.options[Number(m[1])] : undefined))
+            .filter((o) => o !== undefined);
+        answer = picked.join(', ');
+        shown = picked.map(sentenceCase).join(', ');
+    }
+    if (answer.length === 0)
+        return skip();
+    emitTrace(formatAnswerTrace(header, shown, uiWidth()));
+    return { kind: 'picked', answer };
 }
 export async function maybeOfferSave(p) {
     if (p.assistantText.trim().length === 0)
@@ -337,6 +428,7 @@ export async function maybeOfferSave(p) {
             // the skill it saves (the /abap-plan turn that got the lane block); a plan
             // found in another skill's output (detectArtifactSkill) never gets it.
             ...(p.lane && p.skill === saveSkill ? { lane: p.lane } : {}),
+            ...(p.latestSkeleton && p.skill === saveSkill ? { latestSkeleton: p.latestSkeleton } : {}),
             onNotSaved: (reason) => { notSaved = reason; },
             ...(p.onProjectId ? { onProjectId: p.onProjectId } : {}),
             // Never headless: a headless journey queues nothing.
@@ -1751,6 +1843,10 @@ ${imageExpansion.error}`));
                             const flowLane = getAppFlow(session)?.lane;
                             return flowLane ? { lane: { ...flowLane, cwd: params.ctx.cwd } } : {};
                         })(),
+                        ...(() => {
+                            const sk = getLatestSkeletonDecision(session);
+                            return sk ? { latestSkeleton: { path: sk.path, sha256: sk.sha256 } } : {};
+                        })(),
                         // Sessions/folders (Task 6) — the first save tags the session with
                         // its folder's project id, only when the session belongs to this
                         // folder (ruling 18). Saved to disk right after the hook.

package/dist/agent/parallel-write-guard.js

@@ -21,7 +21,7 @@
  *
  * Scope of "write-class" matches the spec for this bug fix and is narrower
  * than tools/write-mode.ts WRITE_TOOLS: only the four tools that perform
- * net-new source mutation are gated here.
+ * net-new source mutation (and the RAP generator, which creates objects) are gated here.
  */
 /** Tools that mutate ABAP source. Narrower than WRITE_TOOLS — excludes
  *  activate / publish / transport_release / message_maintain. The bug
@@ -31,6 +31,8 @@ export const WRITE_CLASS_TOOLS = new Set([
     'sap_update_method',
     'sap_delete_object',
     'sap_create_object',
+    // Final review I2 — SAP's RAP generator creates up to 9 objects in one call.
+    'sap_generate_objects',
 ]);
 export function isWriteClassTool(name) {
     return WRITE_CLASS_TOOLS.has(name);

package/dist/commands/plan-audit-evidence.js

@@ -44,8 +44,13 @@ import { checkpointsRoot } from '../agent/skill-checkpoint.js';
  * contract branch depends on it — so it must NEVER be evicted by the row cap:
  * PROTECTED, not the fillable existence tier. Matched EXACTLY (^…$ anchored) so
  * a near-miss tool name can never masquerade as consent.
+ *
+ * RAP generator (2026-10-14): sap_generate_objects is a write (SAP's generator
+ * creates the whole stack) and rap_finish_check is the F1–F5 proof of a RAP
+ * phase — both PROTECTED in any phase. rap_finish_check is matched EXACTLY.
+ * The R26 rule for the fiori_* smokes (cap.* phases only) is unchanged.
  */
-const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_object|activate|syntax_check|atc_run|inactive_objects|transport_create|transport_release|service_binding_publish|snapshot)|^request_approval$/;
+const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_object|activate|syntax_check|atc_run|inactive_objects|transport_create|transport_release|service_binding_publish|snapshot|generate_objects)|^request_approval$|^rap_finish_check$/;
 /**
  * D-F (2026-07-05): EXISTENCE / VERIFY-READ evidence. A verify-only phase
  * re-run (object already built in a prior attempt; this attempt proves it

package/dist/commands/plan-gate.js

@@ -64,9 +64,14 @@ let planPhaseActive = false;
  * plan object-list grant covers requests only for THIS plan; a step started
  * without an id (null) is never covered. Cleared with the flag. */
 let activePlanId = null;
-export function setPlanPhaseActive(active, planId) {
+/* RAP generator final review M1 — the running plan's file, so a tool resolves
+ * the plan's pinned files (skeleton decision) from the plan's own root first,
+ * like the lane reader does. Cleared with the flag. */
+let activePlanPath = null;
+export function setPlanPhaseActive(active, planId, planPath) {
     planPhaseActive = active;
     activePlanId = active && typeof planId === 'string' && planId ? planId : null;
+    activePlanPath = active && typeof planPath === 'string' && planPath ? planPath : null;
 }
 export function isPlanPhaseActive() {
     return planPhaseActive;
@@ -75,6 +80,10 @@ export function isPlanPhaseActive() {
 export function getActivePlanId() {
     return planPhaseActive ? activePlanId : null;
 }
+/** The running plan's file path, or null (no step, or started without one). */
+export function getActivePlanPath() {
+    return planPhaseActive ? activePlanPath : null;
+}
 /* Task 7 — per-phase subagent dispatch counter. agent_run increments it on
  * every dispatch made while a plan phase is active; the REPL reads it
  * (read+reset) in the runTurn finally that clears the plan-phase flag and

package/dist/commands/plan-resume.js

@@ -59,6 +59,7 @@ import { FLOORPLAN_TO_TEMPLATE } from '../tools/fiori/floorplan-map.js';
 import { getCurrentTransport, setCurrentTransport } from '../repl/current-transport.js';
 import { askYesNo, isYes } from '../projects/yes-no.js';
 import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
+import { skeletonWriteBackConflict } from '../projects/plan-skeleton.js';
 import { checkLaneConsistency, checkRequiredDeploy, isDeployPhase, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
 import { askDeployCard } from './deploy-card.js';
 import { isCredentialHandoverApproved } from '../repl/credential-handover-gate.js';
@@ -925,6 +926,14 @@ export async function finishPlanResume(args) {
             logNotSaved(args, laneConflict ? 'a step no longer fits the app type the plan was made for. Re-run /abap-plan to rebuild the plan.' : 'it dropped the deploy step this app needs', (laneConflict ?? deployConflict));
             return null;
         }
+        // RAP generator plan, Task 8 — the skeleton decision is fixed for the run:
+        // a write-back may not change, drop or add a phase's work.skeleton. A plan
+        // without one that stays without one is untouched (older plans, spec §8).
+        const skeletonConflict = priorParsed.ok ? skeletonWriteBackConflict(priorParsed.content, extract.content) : null;
+        if (skeletonConflict) {
+            logNotSaved(args, 'it changed the skeleton decision, which cannot change during the run. Re-run /abap-plan to change it.', skeletonConflict);
+            return null;
+        }
     }
     const nowIso = new Date().toISOString();
     const statuses = extract.statuses;

package/dist/lib/graceful-exit.js

@@ -31,6 +31,20 @@ function call(fn, self) {
         return Promise.reject(e);
     }
 }
+/**
+ * 2026-10-13 — async work that must run on the way out, before the sockets
+ * close (ending the stateful SAP session, so its locks leave SM12). Capped as
+ * a whole; a task that throws or hangs never blocks the exit.
+ */
+const exitTasks = new Set();
+/** Register an async exit task. Returns an unregister. */
+export function registerExitTask(task) {
+    exitTasks.add(task);
+    return () => { exitTasks.delete(task); };
+}
+export function __resetExitTasksForTests() {
+    exitTasks.clear();
+}
 export async function gracefulExit(code, opts = {}) {
     const exit = opts.exit ?? ((c) => process.exit(c));
     const graceMs = opts.graceMs ?? 250;
@@ -38,6 +52,9 @@ export async function gracefulExit(code, opts = {}) {
     const guard = () => { };
     process.on('unhandledRejection', guard);
     try {
+        if (exitTasks.size > 0) {
+            await capped(Promise.allSettled([...exitTasks].map((t) => call(t, {}))), opts.exitTaskMs ?? 3_500);
+        }
         const dispatcher = globalThis[UNDICI_DISPATCHER];
         if (dispatcher) {
             let done = false;

package/dist/one-shot.js

@@ -63,6 +63,9 @@ import './tools/cap/metadata-import.js';
 import './tools/cap/sap-link-tool.js';
 import './tools/cap/link-smoke.js';
 import './tools/lane/app-lane-resolve.js';
+import './tools/rap/skeleton-resolve.js';
+import './tools/rap/generate-objects.js';
+import './tools/rap/finish-check.js';
 import './tools/extend-model/tool.js';
 import './tools/text-elements/tools.js';
 import './tools/capability/tool.js';

package/dist/projects/answer-blockers.js

@@ -59,6 +59,9 @@ export function applyBlockerAnswers(env, answers, answerer, nowIso) {
         lastEditedBy: answerer,
     };
 }
+function plural(n, word) {
+    return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
 function affirmative(reply) {
     const v = reply.trim().toLowerCase();
     return v === 'y' || v === 'yes';
@@ -83,7 +86,9 @@ export async function offerAnswerBlockers(args) {
     if (blockers.length === 0)
         return null;
     const reply = await askYesNo({
-        question: `Answer the ${blockers.length} unanswered blocker(s) now?`,
+        question: blockers.length === 1
+            ? 'Answer the open blocker now?'
+            : `Answer the ${blockers.length} open blockers now?`,
         confirm: args.confirm,
         prompt: args.prompt,
     });
@@ -92,16 +97,15 @@ export async function offerAnswerBlockers(args) {
     const answers = new Map();
     for (let i = 0; i < blockers.length; i++) {
         const b = blockers[i];
-        // 2026-09-17 — the "Blocker i/n: …" line is printed only on the free-text
-        // path below. When a picker handles the question it shows the same text
-        // itself, and printing it here too showed every blocker twice.
-        // Choices first, where the question has them and a picker is available.
+        // The "Blocker i of n: …" line is printed only on the free-text fallback
+        // below. The picker shows the question itself and leaves its own trace.
+        // The picker first, for every blocker (options or free text).
         // 'write' falls through to the text box; 'skip' leaves the blocker open.
         let askText = true;
-        if (b.options && b.options.length > 0 && args.choose) {
+        if (args.choose) {
             const c = await args.choose({
                 question: b.text,
-                options: b.options,
+                options: b.options ?? [],
                 multiSelect: !!b.multiSelect,
                 index: i,
                 total: blockers.length,
@@ -114,19 +118,26 @@ export async function offerAnswerBlockers(args) {
             else if (c.kind === 'skip') {
                 askText = false;
             }
+            else if (c.kind === 'stop') {
+                // Ctrl+C (Task 4, m2): ask none of the rest. Answers already given
+                // are kept and saved below; the others stay open.
+                break;
+            }
             // c.kind === 'write' → askText stays true
         }
         if (askText) {
             args.log('');
-            args.log(`Blocker ${i + 1}/${blockers.length}: ${b.text}`);
-            const a = (await args.prompt('  Your answer (Enter to skip): ')).trim();
+            args.log(`Blocker ${i + 1} of ${blockers.length}: ${b.text}`);
+            const a = (await args.prompt('Your answer (Enter to skip): ')).trim();
             if (a.length > 0)
                 answers.set(b.id, a);
         }
     }
     if (answers.size === 0) {
         args.log('');
-        args.log('No answers entered — all blockers left open for the viewer.');
+        args.log(blockers.length === 1
+            ? 'No answer entered. The blocker stays open. Answer it later at cspeach.dev/edit.'
+            : `No answers entered. The ${blockers.length} blockers stay open. Answer them later at cspeach.dev/edit.`);
         return null;
     }
     const nowIso = (args.now ?? (() => new Date().toISOString()))();
@@ -139,7 +150,9 @@ export async function offerAnswerBlockers(args) {
     writeFileSync(args.path, JSON.stringify(revised, null, 2), 'utf8');
     const stillOpen = blockers.length - answers.size;
     args.log('');
-    args.log(`Recorded ${answers.size} answer(s) in the file`
-        + (stillOpen > 0 ? ` — ${stillOpen} blocker(s) still open for the viewer.` : '.'));
+    args.log(`Recorded ${plural(answers.size, 'answer')} in the file.`
+        + (stillOpen === 0 ? ''
+            : stillOpen === 1 ? ' 1 blocker is still open. Answer it later at cspeach.dev/edit.'
+                : ` ${stillOpen} blockers are still open. Answer them later at cspeach.dev/edit.`));
     return answers.size;
 }

package/dist/projects/extract-plan.js

@@ -84,6 +84,12 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
         if (ow && typeof ow === 'object' && ow.plannedObjects === undefined && priorWork?.plannedObjects !== undefined) {
             ow.plannedObjects = priorWork.plannedObjects;
         }
+        // RAP generator plan, Task 8 — the skeleton decision is plan-create-only too:
+        // a step's write-back that omits it keeps it (plan-resume refuses a change).
+        const priorSkeleton = priorWork?.skeleton;
+        if (ow && typeof ow === 'object' && ow.skeleton === undefined && priorSkeleton !== undefined) {
+            ow.skeleton = priorSkeleton;
+        }
     }
     // 1:1 map over the PRIOR phase list — changed entries overlay their phase,
     // everything else passes through verbatim from the envelope.

package/dist/projects/plan-objects.js

@@ -9,7 +9,7 @@ export const OBJECT_TYPE_LABELS = {
 const NEVER_ON_LIST = new Set(['WAPA', 'CTS', 'DEVC']);
 const TYPE_RE = /^[A-Z]{4}$/;
 const NAME_RE = /^(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,40}$/;
-const PKG_RE = /^(\$[A-Z0-9_]{1,29}|(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,30})$/;
+export const PKG_RE = /^(\$[A-Z0-9_]{1,29}|(\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,30})$/;
 export const MAX_PLANNED_OBJECTS = 200;
 /** ADT type code from a raw type: `'ddls/df'` → `'DDLS'`. */
 export function normalizeObjectType(raw) {

package/dist/projects/plan-skeleton.js

@@ -0,0 +1,93 @@
+// cspeach-cli/src/projects/plan-skeleton.ts
+//
+// RAP generator plan, Task 8 — a RAP lane plan must carry the CLI's skeleton
+// decision unchanged (spec §3.3). Checked at plan create; an older plan without
+// a skeleton phase still resumes exactly as before (no regression, spec §8).
+//
+// - checkSkeletonDecision: at save. The phase whose `work.skeleton` holds the
+//   Plan block from rap_skeleton_resolve must name the builder the decision
+//   file (sha-pinned) records, and on the generator path list exactly the
+//   objects SAP's generator will create.
+// - skeletonWriteBackConflict: at resume. A write-back may not change, drop or
+//   add a `work.skeleton` — the decision is fixed for the run.
+import { cardLine } from '../lane/card.js';
+import { readSkeletonDecision } from '../rap/skeleton-store.js';
+import { toPlannedObject } from './plan-objects.js';
+// Final review M3 — the developer reads these on screen ([save] lines, no
+// detail split there): plain words only, no tool, field, layer or phase ids.
+export const SKELETON_PHASE_MISSING = 'This RAP plan is missing its skeleton step. Run /abap-plan again.';
+export const SKELETON_DECISION_STALE = 'This plan uses an older skeleton choice, not the newest one. Run /abap-plan again.';
+export const SKELETON_CHANGED_ON_RESUME = 'The skeleton choice cannot change during a run. Run /abap-plan again.';
+const SKELETON_TWO_PHASES = 'This plan has more than one skeleton step. Run /abap-plan again.';
+const SKELETON_BUILDER_DIFFERS = 'This plan builds the skeleton differently from the choice on the skeleton card. Run /abap-plan again.';
+const key = (o) => `${o.type} ${o.name} ${o.package ?? ''}`.trim();
+const skeletonOf = (p) => p.work?.skeleton;
+/** True when any phase carries a `work.skeleton`. */
+export function hasSkeletonPhase(content) {
+    return content.phases.some((p) => !!skeletonOf(p));
+}
+export async function checkSkeletonDecision(content, rec, laneRoot, opts) {
+    if (rec.final.backend !== 'rap')
+        return null;
+    const phases = content.phases.filter((p) => !!skeletonOf(p));
+    if (phases.length === 0) {
+        // Fix round 1 — keyed on CLI-owned state only (`creating`, from the prior
+        // envelope), never on the model-written project.mode.
+        return opts.creating ? SKELETON_PHASE_MISSING : null;
+    }
+    if (phases.length > 1) {
+        return SKELETON_TWO_PHASES;
+    }
+    const phase = phases[0];
+    const work = phase.work;
+    const d = work.skeleton.decision;
+    // Fix round 1 — the plan must cite the decision rap_skeleton_resolve wrote
+    // last in this session (not an older sha-valid file, e.g. from before an
+    // owner override). No session decision (a later session): any sha-valid file.
+    if (opts.latest) {
+        const cited = String(d?.path ?? '').replace(/\\/g, '/');
+        if (cited !== opts.latest.path || String(d?.sha256 ?? '') !== opts.latest.sha256)
+            return SKELETON_DECISION_STALE;
+    }
+    const read = await readSkeletonDecision(laneRoot, String(d?.path ?? ''), String(d?.sha256 ?? ''));
+    if (!read.ok)
+        return read.message;
+    const decided = read.rec.decision.by;
+    if (work.skeleton.by !== decided) {
+        return SKELETON_BUILDER_DIFFERS;
+    }
+    if (decided === 'sap-generator') {
+        const norm = (list) => (Array.isArray(list) ? list : [])
+            .map(toPlannedObject).filter((o) => !!o).map(key);
+        const planned = new Set(norm(work.plannedObjects));
+        const wanted = new Set(norm(read.rec.objects));
+        const missing = [...wanted].find((k) => !planned.has(k));
+        const extra = [...planned].find((k) => !wanted.has(k));
+        if (missing || extra) {
+            const shown = (k) => cardLine(k.split(' ').slice(0, 2).join(' '));
+            return "This plan's skeleton step does not list exactly the objects SAP's generator will create. "
+                + `${missing ? `Missing: ${shown(missing)}. ` : ''}${extra ? `Not created by the generator: ${shown(extra)}. ` : ''}Run /abap-plan again.`;
+        }
+    }
+    return null;
+}
+/** JSON with object keys sorted, so a re-ordered but equal skeleton compares equal. */
+function stable(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stable).join(',')}]`;
+    if (v && typeof v === 'object') {
+        const o = v;
+        return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stable(o[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(v) ?? 'null';
+}
+const skeletonMap = (c) => stable(c.phases.filter((p) => !!skeletonOf(p)).map((p) => [p.id, skeletonOf(p)]));
+/**
+ * Resume write-back guard: every phase's `work.skeleton` must be exactly as it
+ * was (none changed, dropped or added). A plan with no skeleton that stays
+ * without one is untouched (older plans resume unchanged). Returns the plain
+ * refusal, or null.
+ */
+export function skeletonWriteBackConflict(prior, next) {
+    return skeletonMap(prior) === skeletonMap(next) ? null : SKELETON_CHANGED_ON_RESUME;
+}

package/dist/projects/save-command.js

@@ -22,6 +22,8 @@ import { resolveProjectFolderSync, ensureProjectId } from './project-folder.js';
 import { askYesNo, isYes } from './yes-no.js';
 import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
 import { specGapRefForSave } from './plan-sources.js';
+import { checkSkeletonDecision, hasSkeletonPhase } from './plan-skeleton.js';
+import { laneRootFor } from '../lane/roots.js';
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
         artefactType: 'spec-gap',
@@ -369,6 +371,21 @@ export async function runSaveCommand(args) {
             args.log('[save] The plan was not saved.');
             return null;
         }
+        // RAP generator plan, Task 8 — a RAP plan holds to the CLI's skeleton
+        // decision. The file was written under laneRootFor(cwd) by
+        // rap_skeleton_resolve, so it is read from the same root here. A new plan
+        // (or a revision of one that already carried a skeleton) must have it; a
+        // revision of an older plan without one saves as before (spec §8).
+        const skel = await checkSkeletonDecision(planExtract.content, lr.rec, await laneRootFor(args.lane?.cwd ?? args.cwd), {
+            creating: !prior || (priorContent !== undefined && hasSkeletonPhase(priorContent)),
+            ...(args.latestSkeleton ? { latest: args.latestSkeleton } : {}),
+        });
+        if (skel) {
+            args.log('');
+            args.log(`[save] ${skel}`);
+            args.log('[save] The plan was not saved.');
+            return null;
+        }
     }
     // C1 review fix — name the revision target BEFORE the confirm so the user
     // knows what a 'y' will do. Log line only, deliberately NOT a second