@danmoisan/drm-copilot-mcp 1.1.12 → 1.1.14

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadiusWriteIntent.psm1

@@ -0,0 +1,446 @@
+<#
+.SYNOPSIS
+    Write-intent extraction for the blast-radius library (issue #722).
+
+.DESCRIPTION
+    Destination-runtime PowerShell mirror of
+    scripts/dev_tools/_blast_radius_write_intent.py. The rules narrow the text
+    harvest of derivation and validation so that only write-intent tokens become
+    radius entries, and they are active only when the truth table carries
+    write_intent_extraction set to true:
+
+      - W1 glob mention: a token containing * or ? is dropped.
+      - W2 command span: every token of an inline span that splits into more
+        than one word is dropped.
+      - W3 read task: the tokens of a task attribution window (a task line plus
+        the following non-task lines up to the next ATX heading) are dropped
+        when the title starts with a read verb, after an optional bold label,
+        and carries no write verb anywhere.
+      - W4 root anchoring: a concrete token whose first segment, after a
+        leading ./ is stripped, is not in path_roots and which is not a
+        configured root surface is dropped; an empty path_roots disables W4.
+      - W5 spec contracts only: the spec contributes contracts and no paths,
+        and contract harvesting applies W1 and W2.
+      - W6 placeholder stem: a concrete token whose final-component stem is in
+        the placeholder-stem set is dropped.
+
+    Each exported function names its Python counterpart:
+
+      - Test-WriteIntentExtractionEnabled  config_write_intent_extraction
+      - Get-ConfigPathRoot                 config_path_roots
+      - Get-WriteIntentPlanPath            extract_write_intent_plan_paths
+      - Get-WriteIntentSpecContract        extract_write_intent_contracts
+      - Select-WriteIntentPathEntry        select_write_intent_path_entries
+      - Get-PlanPathForConfig              select_plan_paths
+
+    Parity notes for maintainers:
+      - The three vocabularies below are pinned equal, member for member and in
+        order, to the Python constants READ_VERBS, WRITE_VERBS, and
+        PLACEHOLDER_STEMS by a Pester parity test that reads the Python source.
+      - With the flag absent or false, Get-PlanPathForConfig returns exactly
+        Get-PlanPaths, so every caller behaves as before (fail closed).
+      - The rules only drop tokens the current classifier accepts; they never
+        add one. Every function is pure: no filesystem, subprocess, network, or
+        clock access, and no input is mutated.
+      - This module imports the extraction, glob, and config leaves only, never
+        the validation module or the facade, so no import cycle can form.
+    CONVENTION: this module fails fast at module scope and imports its siblings with -ErrorAction Stop.
+#>
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusExtraction.psm1') -Force -ErrorAction Stop
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusGlob.psm1') -Force -ErrorAction Stop
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusConfig.psm1') -Force -ErrorAction Stop
+
+# Truth-table keys read by this module.
+$script:WriteIntentKey = 'write_intent_extraction'
+$script:PathRootKey = 'path_roots'
+
+# The three rule vocabularies, in the same order as the Python constants.
+$script:WriteIntentReadVerb = @('Read', 'Verify', 'Confirm', 'Inspect', 'Review', 'Baseline')
+$script:WriteIntentWriteVerb = @(
+    'Fix', 'Write', 'Update', 'Edit', 'Add', 'Create', 'Delete', 'Remove',
+    'Rename', 'Author', 'Append', 'Replace'
+)
+$script:WriteIntentPlaceholderStem = @(
+    'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o',
+    'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
+    'foo', 'bar', 'baz', 'example', 'sample', 'placeholder'
+)
+
+# Plan and spec structure patterns, mirroring the extraction module's regexes.
+$script:TaskPattern = [regex]::new('^- \[(?<state>[ xX])\] \[P(?<phase>\d+)-T(?<task>\d+)\] (?<title>.+)$')
+$script:HeadingPattern = [regex]::new('^(?<hashes>#{1,6}) (?<title>.+)$')
+$script:InlineCodeSpanPattern = [regex]::new('`([^`]+)`')
+$script:LineSuffixPattern = [regex]::new(':\d+$')
+$script:ContractLetterPattern = [regex]::new('[A-Za-z]')
+$script:ContractHeadingKeyword = @('API', 'Interface', 'Contract', 'Surface')
+
+# W3 title parsing: an optional leading bold label is skipped before the first
+# word is read; write verbs match as whole words anywhere, case-insensitively.
+$script:BoldLabelPattern = [regex]::new('^\*\*[^*]+\*\*\s*')
+$script:FirstWordPattern = [regex]::new('^[A-Za-z]+')
+$script:WriteVerbPattern = [regex]::new(
+    '\b(?:' + ($script:WriteIntentWriteVerb -join '|') + ')\b',
+    [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+$script:ReadVerbSet = [System.Collections.Generic.HashSet[string]]::new(
+    [string[]]@($script:WriteIntentReadVerb | ForEach-Object { $_.ToLowerInvariant() }),
+    [StringComparer]::Ordinal)
+$script:PlaceholderStemSet = [System.Collections.Generic.HashSet[string]]::new(
+    [string[]]$script:WriteIntentPlaceholderStem, [StringComparer]::Ordinal)
+
+
+function Test-WriteIntentExtractionEnabled {
+    <#
+    .SYNOPSIS
+        Read the write_intent_extraction flag strictly.
+
+    .DESCRIPTION
+        Port of config_write_intent_extraction. An absent or null key reads as
+        false, which keeps current extraction.
+
+    .PARAMETER Config
+        Parsed config/blast-radius.json.
+
+    .OUTPUTS
+        System.Boolean. The flag value. Throws, naming the key, when the value is
+        present and is not a boolean.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Config
+    )
+
+    $mapping = Get-RequiredMapping -Value $Config -FieldName 'config'
+    if (-not $mapping.ContainsKey($script:WriteIntentKey) -or $null -eq $mapping[$script:WriteIntentKey]) {
+        return $false
+    }
+    $value = $mapping[$script:WriteIntentKey]
+    if ($value -isnot [bool]) {
+        throw "config[""$($script:WriteIntentKey)""] must be a boolean, got $($value.GetType().Name)."
+    }
+    return $value
+}
+
+function Get-ConfigPathRoot {
+    <#
+    .SYNOPSIS
+        Read the path_roots list strictly.
+
+    .DESCRIPTION
+        Port of config_path_roots. An absent or null key yields an empty list,
+        which disables rule W4.
+
+    .PARAMETER Config
+        Parsed config/blast-radius.json.
+
+    .OUTPUTS
+        System.Object[]. First path segments, deduplicated and ordinally sorted.
+        Throws, naming the key, when the value is not a list of non-blank
+        strings.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Config
+    )
+
+    $mapping = Get-RequiredMapping -Value $Config -FieldName 'config'
+    if (-not $mapping.ContainsKey($script:PathRootKey) -or $null -eq $mapping[$script:PathRootKey]) {
+        return @()
+    }
+    return @(Get-RequiredStringList -Value $mapping[$script:PathRootKey] -FieldName "config[""$($script:PathRootKey)""]")
+}
+
+# Report whether a task title makes its attribution window a read task (W3).
+function Test-ReadTaskTitle {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $Title)
+
+    $unlabeled = $script:BoldLabelPattern.Replace($Title.Trim(), '', 1)
+    $firstWord = $script:FirstWordPattern.Match($unlabeled)
+    if (-not $firstWord.Success -or -not $script:ReadVerbSet.Contains($firstWord.Value.ToLowerInvariant())) {
+        return $false
+    }
+    return -not $script:WriteVerbPattern.IsMatch($Title)
+}
+
+# Report whether an entry is a feature-folder glob, which is never dropped.
+function Test-FeatureFolderGlob {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory = $true)] [string] $Entry)
+
+    if (-not ($Entry.StartsWith('docs/features/', [System.StringComparison]::Ordinal) -and
+            $Entry.EndsWith('/**', [System.StringComparison]::Ordinal))) {
+        return $false
+    }
+    $body = $Entry.Substring(0, $Entry.Length - 3)
+    return ($body.IndexOf('*') -lt 0 -and $body.IndexOf('?') -lt 0)
+}
+
+# Apply the token-level rules W1, W4, and W6 to one token; true means it survives.
+function Test-WriteIntentToken {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)] [string] $Token,
+        [AllowEmptyCollection()] [string[]] $RootSurface = @(),
+        [AllowEmptyCollection()] [string[]] $PathRoot = @()
+    )
+
+    # W1: a wildcard marks a glob mention rather than a write claim.
+    if ($Token.IndexOf('*') -ge 0 -or $Token.IndexOf('?') -ge 0) {
+        return $false
+    }
+
+    # W4: enabled only by a non-empty root list; a configured root surface is a
+    # repository-root file with no first directory segment to test.
+    if ($PathRoot.Count -gt 0 -and $RootSurface -cnotcontains $Token) {
+        $stripped = if ($Token.StartsWith('./', [System.StringComparison]::Ordinal)) { $Token.Substring(2) } else { $Token }
+        if ($PathRoot -cnotcontains $stripped.Split('/', 2)[0]) {
+            return $false
+        }
+    }
+
+    # W6: the final component's stem, compared case-insensitively.
+    $finalComponent = $script:LineSuffixPattern.Replace($Token.Substring($Token.LastIndexOf('/') + 1), '')
+    $stem = if ($finalComponent.Contains('.')) { $finalComponent.Substring(0, $finalComponent.LastIndexOf('.')) } else { $finalComponent }
+    return -not $script:PlaceholderStemSet.Contains($stem.ToLowerInvariant())
+}
+
+# Yield the token of every inline span that holds exactly one word (W2).
+function Get-SingleWordToken {
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param([Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $Line)
+
+    $token = [System.Collections.Generic.List[string]]::new()
+    foreach ($match in $script:InlineCodeSpanPattern.Matches($Line)) {
+        $word = @($match.Groups[1].Value -split '\s+' | Where-Object { $_.Length -gt 0 })
+        if ($word.Count -eq 1) {
+            $token.Add($word[0])
+        }
+    }
+    return @($token.ToArray())
+}
+
+function Get-WriteIntentPlanPath {
+    <#
+    .SYNOPSIS
+        Extract plan paths under rules W1 through W4 and W6.
+
+    .DESCRIPTION
+        Port of extract_write_intent_plan_paths. A task line opens a window
+        whose read status comes from its title; an ATX heading closes any
+        window; every other line belongs to the open window. Tokens of a read
+        window are dropped (W3); every other line is harvested under W1, W2, W4,
+        and W6 after the current classifier accepts the token.
+
+    .PARAMETER PlanText
+        Full atomic-plan document text; may be empty.
+
+    .PARAMETER RootSurface
+        Configured separator-free root surfaces, forwarded to the classifier and
+        exempt from W4.
+
+    .PARAMETER PathRoot
+        Configured first segments for W4; empty disables W4.
+
+    .OUTPUTS
+        System.Object[]. Surviving tokens, deduplicated and ordinally sorted.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $PlanText,
+        [AllowEmptyCollection()] [string[]] $RootSurface = @(),
+        [AllowEmptyCollection()] [string[]] $PathRoot = @()
+    )
+
+    $accepted = [System.Collections.Generic.List[string]]::new()
+    $inReadWindow = $false
+    foreach ($line in @(ConvertTo-NormalizedLine -Text $PlanText)) {
+        $taskMatch = $script:TaskPattern.Match($line)
+        if ($taskMatch.Success) {
+            $inReadWindow = Test-ReadTaskTitle -Title $taskMatch.Groups['title'].Value
+        } elseif ($script:HeadingPattern.IsMatch($line)) {
+            $inReadWindow = $false
+        }
+        if ($inReadWindow) {
+            continue
+        }
+
+        foreach ($token in @(Get-SingleWordToken -Line $line)) {
+            if ($null -ne (Get-PathTokenKind -Token $token -RootSurface $RootSurface) -and
+                (Test-WriteIntentToken -Token $token -RootSurface $RootSurface -PathRoot $PathRoot)) {
+                $accepted.Add($token)
+            }
+        }
+    }
+    return @(Get-OrdinalSortedEntry -Entry $accepted.ToArray())
+}
+
+function Get-WriteIntentSpecContract {
+    <#
+    .SYNOPSIS
+        Extract spec contract identifiers with W1 and W2 applied (W5).
+
+    .DESCRIPTION
+        Port of extract_write_intent_contracts. Identifiers are harvested only
+        inside a section whose heading, or an ancestor heading, names an API,
+        interface, contract, or surface; a multi-word span and a wildcard token
+        contribute nothing.
+
+    .PARAMETER SpecText
+        Full feature spec.md document text; may be empty.
+
+    .OUTPUTS
+        System.Object[]. Identifiers carrying an ASCII letter and no separator,
+        deduplicated and ordinally sorted.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $SpecText
+    )
+
+    $identifier = [System.Collections.Generic.List[string]]::new()
+    $qualifyingDepth = 0
+    foreach ($line in @(ConvertTo-NormalizedLine -Text $SpecText)) {
+        $headingMatch = $script:HeadingPattern.Match($line)
+
+        # A deeper heading stays inside the qualifying section; a heading at or
+        # above that level ends it and is judged on its own title.
+        if ($headingMatch.Success) {
+            $level = $headingMatch.Groups['hashes'].Value.Length
+            if ($qualifyingDepth -ne 0 -and $level -gt $qualifyingDepth) {
+                continue
+            }
+            $title = $headingMatch.Groups['title'].Value
+            $qualifyingDepth = 0
+            foreach ($keyword in $script:ContractHeadingKeyword) {
+                if ($title.IndexOf($keyword, [System.StringComparison]::Ordinal) -ge 0) {
+                    $qualifyingDepth = $level
+                    break
+                }
+            }
+            continue
+        }
+        if ($qualifyingDepth -eq 0) {
+            continue
+        }
+
+        foreach ($token in @(Get-SingleWordToken -Line $line)) {
+            if ($token.IndexOf('/') -lt 0 -and $token.IndexOf('*') -lt 0 -and
+                $token.IndexOf('?') -lt 0 -and $script:ContractLetterPattern.IsMatch($token)) {
+                $identifier.Add($token)
+            }
+        }
+    }
+    return @(Get-OrdinalSortedEntry -Entry $identifier.ToArray())
+}
+
+function Select-WriteIntentPathEntry {
+    <#
+    .SYNOPSIS
+        Apply the token-level rules W1, W4, and W6 to recorded radius entries.
+
+    .DESCRIPTION
+        Port of select_write_intent_path_entries. Normalization calls this
+        before the mandate-read filter when the flag is true. The feature-folder
+        glob is always kept.
+
+    .PARAMETER Entry
+        Recorded entries already accepted by the current classifier.
+
+    .PARAMETER RootSurface
+        Configured separator-free root surfaces.
+
+    .PARAMETER PathRoot
+        Configured first segments for W4.
+
+    .OUTPUTS
+        System.Object[]. Surviving entries, deduplicated and ordinally sorted.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [string[]] $Entry,
+        [AllowEmptyCollection()] [string[]] $RootSurface = @(),
+        [AllowEmptyCollection()] [string[]] $PathRoot = @()
+    )
+
+    $kept = [System.Collections.Generic.List[string]]::new()
+    foreach ($item in $Entry) {
+        if ((Test-FeatureFolderGlob -Entry $item) -or
+            (Test-WriteIntentToken -Token $item -RootSurface $RootSurface -PathRoot $PathRoot)) {
+            $kept.Add($item)
+        }
+    }
+    return @(Get-OrdinalSortedEntry -Entry $kept.ToArray())
+}
+
+function Get-PlanPathForConfig {
+    <#
+    .SYNOPSIS
+        Select the plan-side extractor from the truth table's flag.
+
+    .DESCRIPTION
+        Port of select_plan_paths, the single selector shared by derivation and
+        by validation rules V1 and V2, which keeps a derived radius passing V1
+        and V2 against its own plan in both modes.
+
+    .PARAMETER PlanText
+        Full atomic-plan document text; may be empty.
+
+    .PARAMETER Config
+        Parsed config/blast-radius.json.
+
+    .PARAMETER RootSurface
+        Configured separator-free root surfaces.
+
+    .OUTPUTS
+        System.Object[]. The write-intent plan paths when the flag is true, and
+        exactly Get-PlanPaths otherwise.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string] $PlanText,
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Config,
+        [AllowEmptyCollection()] [string[]] $RootSurface = @()
+    )
+
+    if (Test-WriteIntentExtractionEnabled -Config $Config) {
+        return @(Get-WriteIntentPlanPath -PlanText $PlanText -RootSurface $RootSurface `
+                -PathRoot ([string[]]@(Get-ConfigPathRoot -Config $Config)))
+    }
+    return @(Get-PlanPaths -PlanText $PlanText -RootSurface $RootSurface)
+}
+
+Export-ModuleMember -Function `
+    Test-WriteIntentExtractionEnabled, `
+    Get-ConfigPathRoot, `
+    Get-WriteIntentPlanPath, `
+    Get-WriteIntentSpecContract, `
+    Select-WriteIntentPathEntry, `
+    Get-PlanPathForConfig

package/resources/claude-customizations/.claude/rules/parallel-orchestration.md

@@ -209,6 +209,8 @@ All nine enums of the parallel surface are owned by the schema-and-validator fea
 
 The wave-4 features — F6 (mutation protocol), F7 (enforcement hooks), and F8 (drift detection) — CONSUME these member sets and NEVER extend them. A wave-4 feature that needs a new member must amend this rule file and the validators at spec review, not add the member at implementation time. This constraint exists because the wave-4 features are prepared concurrently and would otherwise add fields to the same files at the same time.
 
+Integration-cost scheduling (issue #722) adds no `conflict_edges[].reason` member; the four members above are unchanged. The scheduling data travels in tolerated-not-validated fields: an edge may carry the extra fields `hard`, `cost`, and `benefit`, and the planner and orchestrator checkpoints may carry a `tolerated_overlaps` list. No validator reads these fields, and the Python validators and the TypeScript validator port accept them with zero errors.
+
 ## F7 Seam
 
 The retrospective cohort-ordering invariant `PARALLEL_COHORT_BARRIER_VIOLATION` (design section 9, Layer 2) is F7's explicitly assigned addition to the orchestrator validator. It is NOT implemented here. The entry point of `scripts/dev_tools/validate_parallel_orchestrator_state.py` contains a clearly delimited, appendable helper-invocation block, marked with explicit begin and end comments that name F7 and the invariant token, so that F7's edit is one appended helper call with no reflow of existing code. The TypeScript core `extensions/drm-copilot/src/lib/validate/parallel-orchestrator-state-core.ts` carries the matching comment-delimited seam. Existing helper calls sit outside the block.
@@ -241,6 +243,11 @@ plan-side extraction so V1 and V2 stay self-consistent against a radius derived
 The key is optional and fail-closed: a truth table that omits it excludes nothing and reproduces
 pre-change behaviour exactly.
 
+The Copilot instructions file `.github/copilot-instructions.md` is a mandate read as well (issue
+#722): the policy reading order begins with it, so a plan that cites copilot-instructions.md is
+reporting that it read the tone and communication policy. Both committed copies of
+`config/blast-radius.json` list it in `mandate_reads`.
+
 Three constraints bound the mandate-read exclusion:
 
 1. **The planner remains obliged to enumerate a genuine write explicitly.** An exclusion describes
@@ -391,6 +398,144 @@ weakens the relation below the path level: two items editing the same file still
 A candidate module belongs in the map when it names a subsystem an item could plausibly not touch.
 A candidate that matches the majority of work items belongs nowhere.
 
+### Integration-cost scheduling (issue #722)
+
+Detection and scheduling are separate steps. The detection relation (`conflicts` in Python,
+`Test-BlastRadiusConflict` in PowerShell) is unchanged and still answers one question: do two radii
+contend? Scheduling decides whether a detected contention must serialize the two items. The entry
+points are `schedule_conflict_edges` in `scripts/dev_tools/_blast_radius_scheduling.py` and
+Get-BlastRadiusConflictEdge in `.claude/lib/blast-radius/BlastRadiusScheduling.psm1`; both return
+the edges and the tolerated overlaps of a set of items. Planners call the entry point instead of
+applying the detection relation to every pair by hand.
+
+This is an operator-directed configured policy change (issue #722, 2026-09-27), not ad hoc
+narrowing. The only sanctioned mechanisms for relaxing contention are the configured
+`conflict_tolerance` key and configured write-intent extraction. Planners still never hand-narrow a
+radius: editing a declared radius to suppress an edge remains prohibited.
+
+**Configuration.** `config/blast-radius.json` carries an optional `conflict_tolerance` object with
+tolerance_percent (integer, at least 0), `weights` (same_file, possible_overlap, append_only, and
+module, each an integer of at least 1), `band_durations` (C1 through C4, each an integer of at least
+1), `default_band` (one of C1 through C4), and append_only_paths (a list of exact entries and `**`
+globs). The reader fails fast with an error naming the key for any other shape; booleans are
+rejected wherever an integer is required. An absent key means strict scheduling, identical to
+tolerance_percent 0.
+
+**Edge rule.** For each unordered pair of items:
+
+1. Run the unchanged detection relation. No conflict means no edge and no tolerated overlap.
+2. **Hard classes.** A reason list containing `shared_surface_overlap` or `contract_dependency`
+   makes the pair an edge at every tolerance.
+3. **Cost** (integer, computed only for a detected conflict). Re-enumerate the overlapping entry
+   pairs with the same mergeable-path exclusion and the same entry-overlap primitive the relation
+   uses, then sum the append_only weight for a concrete overlapping path that matches an
+   append_only_paths entry, the same_file weight for two equal concrete entries, the
+   possible_overlap weight for a glob or directory-prefix overlap, and the module weight times the
+   number of shared modules. The append_only_paths check runs before the same_file check (append-only
+   precedence), so an append-only file stays low cost even when both items name it. Mergeable paths
+   contribute 0 because they are excluded before enumeration.
+4. **Benefit** (integer, pairwise). The smaller of the two items' band durations; a missing band uses
+   `default_band`. Running the pair concurrently saves at most one cohort step of the shorter item.
+5. **Rule.** The pair is an edge if and only if it conflicts and either it is hard or
+   `cost * 100 > benefit * tolerance_percent`.
+6. **Recorded reason.** The first member of the relation's reason list in canonical kind order.
+
+**Strict-identity proof.** Every weight and every band duration is validated as an integer of at
+least 1. A detected conflict that is not hard therefore has a cost of at least 1, so at
+tolerance_percent 0 the inequality `cost * 100 > 0` always holds and the edge set equals the
+detected-conflict set exactly; cohort coloring of that set is identical to strict scheduling. At
+every tolerance an edge requires a conflict, so every edge implies a conflict and the edge set is
+always a subset of the detected-conflict set. Raising tolerance_percent never adds an edge, and the
+decision for (a, b) equals the decision for (b, a).
+
+**Soft-overlap handling.** A detected, non-hard pair within tolerance is a tolerated overlap, not an
+edge. The planner records it in a tolerated_overlaps list on the planner checkpoint (and the
+orchestrator carries it), each entry holding `a`, `b`, `reasons`, `cost`, and `benefit`. Tolerated
+pairs run in the same or adjacent cohorts without a barrier. The later-merging item of a tolerated
+pair merges `origin/main` under the existing per-item merge-conflict handling and re-passes CI before
+it merges.
+
+**Drift behaviour.** When an item's observed radius replaces its declared radius, drift detection
+evaluates each in-flight peer pair through the same edge rule, using the items' complexity bands from
+the checkpoint (`default_band` when absent), through the helper module
+`scripts/dev_tools/_parallel_drift_scheduling.py`. A pair is newly conflicting only when the rule
+yields an edge and the pair is not already a recorded edge. A tolerated pair whose observed overlap
+stays within tolerance halts neither item; one whose observed overlap exceeds tolerance, or becomes
+hard, is reported. An unevaluable peer radius still counts as an edge (fail closed). At
+tolerance_percent 0 the drift output equals strict drift output.
+
+### Write-intent extraction (issue #722)
+
+The extractor harvests every inline-code token of a plan and spec, so a path an item only reads,
+mentions as a glob, or quotes inside a command becomes a radius path and can create a false edge.
+Write-intent extraction keeps only tokens that state a write. It is the second sanctioned mechanism,
+beside `conflict_tolerance`, for relaxing contention; like it, it is an operator-directed configured
+policy change, and planners still never hand-narrow a radius.
+
+**Configuration.** `config/blast-radius.json` carries two optional keys. `write_intent_extraction`
+is a boolean; when it is true, rules W1 through W6 below apply. `path_roots` is a list of non-empty
+first path segments that enables rule W4. Both readers fail fast with an error naming the key for any
+other shape. An absent or false `write_intent_extraction` reproduces pre-change extraction exactly
+(fail closed), and an empty or absent `path_roots` disables W4. The self-hosted copy sets
+`path_roots` to this repository's tracked top-level directories. The implementations are
+`scripts/dev_tools/_blast_radius_write_intent.py` and
+`.claude/lib/blast-radius/BlastRadiusWriteIntent.psm1`.
+
+**Rules.** Each rule is a pure, statically decidable function of the text and the truth table.
+
+- **W1 glob mention.** Drop any harvested token containing a wildcard character. The feature-folder
+  glob is added after filtering and is never dropped.
+- **W2 command span.** Drop every token of an inline span whose whitespace split yields more than
+  one word.
+- **W3 read task.** Drop the tokens of a task attribution window (a task line plus the following
+  non-task lines up to the next ATX heading, as defined in `.claude/rules/plan-acceptance-gates.md`)
+  whose title's first word, after an optional bold label, is in the read-verb set (Read, Verify,
+  Confirm, Inspect, Review, Baseline) and whose title contains no member of the write-verb set (Fix,
+  Write, Update, Edit, Add, Create, Delete, Remove, Rename, Author, Append, Replace). A write verb
+  anywhere in the title overrides the read verb.
+- **W4 root anchoring.** Drop a concrete token whose first segment, after stripping a leading `./`,
+  is not in `path_roots` and is not a configured root surface.
+- **W5 spec paths.** The spec contributes contracts only, not paths. Contract harvesting from the
+  spec applies W1 and W2.
+- **W6 placeholder stem.** Drop a concrete token whose final-component stem is in the placeholder
+  set (the single ASCII letters, and foo, bar, baz, example, sample, placeholder), compared
+  case-insensitively.
+
+The read-verb, write-verb, and placeholder-stem sets are code constants pinned equal across Python
+and PowerShell by a parity test. Shared surfaces are still resolved from the surviving concrete
+paths, so a shared surface cited only in a read task, a command span, or the spec produces no hard
+edge, while a shared surface an item writes in a write task survives and stays hard.
+
+**One extractor for derivation and validation.** W1, W4, and W6 are token-level and also apply when
+`normalize_declared_radius` and Get-NormalizedDeclaredRadius re-filter a recorded radius; an entry
+that starts with `docs/features/`, ends with `/**`, and carries no other wildcard (the feature-folder
+glob) is always kept. W2, W3, and W5 need line context and apply only to derivation and to the
+plan-side extraction of validation. `derive_blast_radius` and `validate_blast_radius` (and their
+PowerShell ports) select the same extractor from the same flag, so a derived radius still passes V1
+and V2 against its own plan in both modes.
+
+#### Known false negatives
+
+Write-intent extraction can drop a genuine write in these cases:
+
+1. a genuine write stated only as a glob (W1);
+2. a genuine write stated only inside a command span (W2);
+3. a write named only in spec prose (W5);
+4. a read-verb task that also writes without a write verb in its title (W3);
+5. a new top-level directory not yet in `path_roots` (W4);
+6. a genuine file whose stem is in the placeholder set (W6).
+
+Three mitigations bound these cases:
+
+1. **The planner remains obliged to enumerate a genuine write explicitly.** When an item's plan will
+   write a path that one of the rules drops, the planner appends that exact path to the declared
+   radius after normalization, as for the mandate-read exclusion.
+2. **Execution-time escaped-path detection.** `detect_escaped_paths` compares the declared radius
+   against the paths a diff actually touched, so a dropped write is caught against observed evidence
+   rather than against prose.
+3. **The fail-closed absent key.** A truth table without `write_intent_extraction`, or with it set
+   to false, reproduces pre-change extraction exactly, so an operator can disable the rules at once.
+
 ### The published truth table is not a copy of this one (issue #500)
 
 The push-down publishes a second truth table into a destination workspace at
@@ -430,8 +575,11 @@ non-vacuous input.
 subset, not a copy of the self-hosted sets.** They were authored narrow when the bundled copy was
 created and were never a copy that fell behind, so the correct gate is portable-set equality against
 a declared constant plus a subset relation against the self-hosted list — never byte-equality with
-the self-hosted file. Only `version`, `over_breadth_fraction`, `mandate_reads`, and `mergeable_paths`
-are byte-equal across the two copies.
+the self-hosted file. Only `version`, `over_breadth_fraction`, `mandate_reads`, `mergeable_paths`,
+`conflict_tolerance`, and `write_intent_extraction` are byte-equal across the two copies.
+`path_roots` is a Class 2 key: its self-hosted value is this repository's tracked top-level
+directory list, and its bundled value is an empty list, because the bundle cannot know a
+destination's top-level directories and an empty list disables root anchoring there.
 
 The reason the two key groups take different relations is an asymmetry between surfaces and modules.
 An over-matching MODULE glob costs concurrency on every pair of items it touches, because a module

package/resources/claude-customizations/.claude/rules/plan-acceptance-gates.md

@@ -85,7 +85,7 @@ The window size is fixed at four adjacent non-blank lines. Blank lines are remov
 
 ### The shared measurement behind G7, G8, G8b, and G9
 
-The four severities below were fixed by one corpus measurement recorded in `docs/features/active/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`. The pre-declared decision rule was written and committed **before** the driver existed and before any count was taken, so the ordering is verifiable from git history rather than only asserted in prose. Its form matches the G5 precedent: the shipped severity is Blocking if and only if the total finding count for that rule is greater than zero **and** the recorded false-positive count for that rule is zero; otherwise Warning.
+The four severities below were fixed by one corpus measurement recorded in `docs/features/completed/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`. The pre-declared decision rule was written and committed **before** the driver existed and before any count was taken, so the ordering is verifiable from git history rather than only asserted in prose. Its form matches the G5 precedent: the shipped severity is Blocking if and only if the total finding count for that rule is greater than zero **and** the recorded false-positive count for that rule is zero; otherwise Warning.
 
 The false-positive definition the rule consumes is likewise pre-declared: a finding is a false positive when the acceptance condition it reports is in fact falsifiable — when the plan states an observation sufficient to distinguish a passing run from a failing one, by a mechanism the rule's predicate does not recognise. A finding is a true positive when the acceptance condition it reports genuinely cannot fail, or can only be satisfied vacuously.
 
@@ -108,7 +108,7 @@ G7's finding count of 466 satisfies the first conjunct, so the rule was not deci
 
 Both classes are addressable by a later feature — Class 1 by adding a check-flag exclusion to the `prettier-write` entry, Class 2 by admitting a tree-observation span as an alternative to a marker — but neither was changed here, because narrowing a predicate after reading its measurement would invalidate the measurement that decided its severity. A later feature that narrows either class must re-take the measurement the same way.
 
-Counts, and every one of the 22 false positives named by plan path, task identifier, and offending span: `docs/features/active/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
+Counts, and every one of the 22 false positives named by plan path, task identifier, and offending span: `docs/features/completed/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
 
 ### G8 — ships as a Warning because the measurement recorded 7 false positives
 
@@ -118,7 +118,7 @@ G8's finding count of 82 satisfies the first conjunct. It fails the second: 7 fi
 
 **Class 2, one finding — the unmerged-path filter.** `--diff-filter=U` selects conflicted paths during a merge or rebase. In that state the worktree-against-index comparison is the correct one and does not become vacuous on commit, because the conflict is precisely what is not yet committed.
 
-Counts, and every one of the 7 false positives named by plan path, task identifier, and offending span: `docs/features/active/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
+Counts, and every one of the 7 false positives named by plan path, task identifier, and offending span: `docs/features/completed/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
 
 ### G8b — ships as a Warning unconditionally, by the pre-declared rule
 
@@ -126,7 +126,7 @@ G8b is exempt from the two-conjunct rule and **cannot reach the Blocking channel
 
 The reason is that G8b carries the highest false-positive surface of the set, and a false-positive count taken over one corpus does not bound the false-positive surface of a predicate. Promoting a rule on the strength of a clean run over one corpus would convert an accident of that corpus into a gate. The 19 findings were nonetheless examined individually and all 19 were retained as true positives, across three sub-classes: a placeholder ref operand, which resolves to a real ref at run time and still cannot make the diff see an untracked path; an artifact-field label inside the span, which is cosmetic and leaves the underlying acceptance condition as the finding describes it; and a pathspec written without the `--` separator, where the predicate reads the pathspec as a ref operand. That last sub-class is a true positive for G8b and is simultaneously recorded in the measurement as a **G8 false negative**: the same span should also have been reported by G8, and was not.
 
-Counts, the zero false-positive record, and the three sub-classes with their plan paths and offending spans: `docs/features/active/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
+Counts, the zero false-positive record, and the three sub-classes with their plan paths and offending spans: `docs/features/completed/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
 
 ### G9 — ships as a Warning because the measurement recorded 4 false positives
 
@@ -134,7 +134,7 @@ G9's finding count of 8 satisfies the first conjunct. It fails the second: 4 of
 
 The remaining 4 findings are true positives, and each is the exact defect the rule was written for: the acceptance condition demands a numeric coverage percentage, the command supplies no terminal reporter, the project `addopts` supplies only an LCOV reporter, and the number the acceptance demands is therefore never printed.
 
-Counts, and every one of the 4 false positives named by plan path, task identifier, offending span, and the reason its acceptance condition is falsifiable: `docs/features/active/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
+Counts, and every one of the 4 false positives named by plan path, task identifier, offending span, and the reason its acceptance condition is falsifiable: `docs/features/completed/2026-08-23-plan-acceptance-gates-miss-unobservable-and-ambient-state-gates-519/evidence/qa-gates/corpus-measurement.2026-08-24T00-00.md`.
 
 ## The Write-Mode Register