@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/claude-customizations/.claude/hooks/validate-orchestrator-output-feature-folder.ps1

@@ -0,0 +1,146 @@
+<#
+.SYNOPSIS
+    Adopted feature-folder probe for the orchestrator SubagentStop hook validate-orchestrator-output.ps1 (issue #992).
+
+.DESCRIPTION
+    Dot-sourced by validate-orchestrator-output.ps1 through a guarded load whose catch records the
+    failure with Add-HookDependencyFailure, so a missing or broken copy of this file blocks the hook
+    instead of failing open. It defines Invoke-FeatureFolderGitExe, the single git seam, and
+    Get-OrchestratorOutputFeatureFolderDecision.
+
+    When an orchestrator-state checkpoint waives new_active_feature_folder through
+    issue_adoption.waived_tools, the validators accept a declared feature_folder_record but cannot
+    read the repository. This probe confirms that HEAD of the run worktree holds a tree at the
+    checkpoint feature-folder, so a staged-only, untracked, or absent folder blocks. It proves only
+    that a tree exists at that path at stop time; it does not prove which tool created the folder
+    or that its contents are correct.
+
+    The file imports nothing. Test-OrchestratorStateFeatureFolderPath comes from
+    OrchestratorStateFeatureFolderRecord.psm1, which the main hook imports through its own guarded
+    load. The file invokes no Python.
+#>
+
+$script:FeatureFolderProbeTool = 'new_active_feature_folder'
+
+function Invoke-FeatureFolderGitExe {
+    <#
+    .SYNOPSIS
+        Run git with the given arguments. The single executable seam of the feature-folder probe.
+    .DESCRIPTION
+        Never throws: a git that cannot start, or an invoker that throws, returns ExitCode -1 so the
+        caller blocks instead of failing open. The default invoker merges standard error into Output;
+        success requires the exact output tree, so error text is never read as success.
+    .PARAMETER GitArgs
+        The git arguments.
+    .PARAMETER GitInvoker
+        The scriptblock that runs git; a unit test passes a test-local stand-in that sets
+        $global:LASTEXITCODE, so this body runs without starting a process.
+    .OUTPUTS
+        System.Collections.Hashtable with keys ExitCode (int) and Output (string, trimmed).
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]] $GitArgs,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateNotNull()]
+        [scriptblock] $GitInvoker = { git @args 2>&1 }
+    )
+
+    try {
+        $lines = @(& $GitInvoker @GitArgs)
+        $code = $LASTEXITCODE
+    }
+    catch {
+        return @{ ExitCode = -1; Output = '' }
+    }
+    if ($null -eq $code) { $code = -1 }
+    return @{ ExitCode = [int]$code; Output = ((@($lines | ForEach-Object { [string]$_ }) -join "`n").Trim()) }
+}
+
+function Test-FeatureFolderProbeWaived {
+    <#
+    .SYNOPSIS
+        Report whether the checkpoint's issue_adoption.waived_tools lists new_active_feature_folder.
+    .PARAMETER Checkpoint
+        The parsed checkpoint object. May be $null.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Checkpoint
+    )
+
+    if ($Checkpoint -isnot [System.Management.Automation.PSCustomObject]) { return $false }
+    $adoptionProperty = $Checkpoint.PSObject.Properties['issue_adoption']
+    if ($null -eq $adoptionProperty -or $adoptionProperty.Value -isnot [System.Management.Automation.PSCustomObject]) { return $false }
+    $waivedProperty = $adoptionProperty.Value.PSObject.Properties['waived_tools']
+    if ($null -eq $waivedProperty -or $waivedProperty.Value -isnot [System.Array]) { return $false }
+    return (@($waivedProperty.Value | Where-Object { $_ -is [string] }) -ccontains $script:FeatureFolderProbeTool)
+}
+
+function Get-OrchestratorOutputFeatureFolderDecision {
+    <#
+    .SYNOPSIS
+        Confirm that HEAD of the run worktree holds a tree at the adopted feature-folder.
+    .DESCRIPTION
+        Returns @{ Ok = $true; Message = $null } when the checkpoint does not waive
+        new_active_feature_folder. Otherwise the checkpoint feature-folder is re-checked against the
+        shared path pattern before any git call (a failing path never reaches git), and
+        git -C <WorktreeRoot> cat-file -t HEAD:<feature-folder> must exit 0 and print exactly tree.
+        Every other outcome (non-zero exit, -1, empty output, other output) blocks with a repairable
+        ROUTING_CONTRACT_BLOCKED message naming the path.
+    .PARAMETER Checkpoint
+        The parsed checkpoint object. May be $null.
+    .PARAMETER WorktreeRoot
+        The root of the worktree whose run stopped.
+    .PARAMETER GitInvoker
+        Optional. Forwarded to Invoke-FeatureFolderGitExe; omitted, the seam's default runs git.
+    .OUTPUTS
+        System.Collections.Hashtable with keys Ok, Message, and (on a block) Repairable.
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowNull()]
+        [object] $Checkpoint,
+
+        [Parameter(Mandatory = $true)]
+        [string] $WorktreeRoot,
+
+        [Parameter(Mandatory = $false)]
+        [scriptblock] $GitInvoker
+    )
+
+    if (-not (Test-FeatureFolderProbeWaived -Checkpoint $Checkpoint)) {
+        return @{ Ok = $true; Message = $null }
+    }
+
+    $folderProperty = $Checkpoint.PSObject.Properties['feature-folder']
+    $folder = if ($null -ne $folderProperty) { $folderProperty.Value } else { $null }
+    $blocked = @{ Ok = $false; Repairable = $true; Message = ('ROUTING_CONTRACT_BLOCKED: Checkpoint feature-folder is not committed in HEAD: {0}.' -f [string]$folder) }
+    # Defense in depth: the validators already require the record path to match the pattern and to
+    # equal feature-folder, but a value that fails the pattern must never become a git argument.
+    if (-not (Test-OrchestratorStateFeatureFolderPath -Value $folder)) {
+        return $blocked
+    }
+
+    $gitArgs = [string[]]@('-C', $WorktreeRoot, 'cat-file', '-t', ('HEAD:' + [string]$folder))
+    $probe = if ($PSBoundParameters.ContainsKey('GitInvoker') -and $null -ne $GitInvoker) {
+        Invoke-FeatureFolderGitExe -GitArgs $gitArgs -GitInvoker $GitInvoker
+    }
+    else {
+        Invoke-FeatureFolderGitExe -GitArgs $gitArgs
+    }
+    if (($probe.ExitCode -eq 0) -and [string]::Equals([string]$probe.Output, 'tree', [System.StringComparison]::Ordinal)) {
+        return @{ Ok = $true; Message = $null }
+    }
+    return $blocked
+}

package/resources/claude-customizations/.claude/hooks/validate-orchestrator-output-rejection.ps1

@@ -0,0 +1,172 @@
+<#
+.SYNOPSIS
+    Parallel mutation rejection helpers for validate-orchestrator-output.ps1 (issue #1012).
+
+.DESCRIPTION
+    Dot-sourced by validate-orchestrator-output.ps1. A parallel skill that rejects a mutation before
+    any run checkpoint exists stops without writing state and ends its final output with the line
+    PARALLEL_MUTATION_REJECTED: <code>. These helpers parse that signal, scan the live worktrees for
+    parallel checkpoint text that would contradict the claim that no state was written, decide
+    whether the unresolved parallel stop may be allowed, and compose the hint appended to the block
+    message when it may not.
+
+    The signal grammar, the closed code set, and the hook behavior are defined once in the section
+    `## Mutation Rejection Signal (issue #1012)` of .claude/rules/parallel-orchestration.md.
+
+    Imports no module, invokes no Python, and starts no process. Relies on
+    Find-WorktreeRunIdentitySignal, Get-WorktreeItemLiveRoot, Get-WorktreeRunCheckpointText, and
+    Get-WorktreeRunCheckpointPath, which the hook imports before it dot-sources this file. Reads no
+    file except through Get-WorktreeRunCheckpointText.
+#>
+
+# The closed rejection code set, in rule order. It mirrors the table of
+# `## Mutation Rejection Signal (issue #1012)` in .claude/rules/parallel-orchestration.md, which owns
+# the set; a Pester parity row pins this array to that table.
+$script:ParallelMutationRejectionCodes = @('kickoff_artifact_missing', 'run_not_started', 'items_in_flight', 'unknown_item')
+$script:ParallelMutationRejectionPrefix = 'PARALLEL_MUTATION_REJECTED:'
+$script:ParallelMutationRejectionPattern = '^PARALLEL_MUTATION_REJECTED: (?<code>[a-z_]+)$'
+$script:ParallelMutationRejectionHeading = '## Mutation Rejection Signal (issue #1012)'
+$script:ParallelMutationRejectionArtifactType = 'parallel-orchestrator-state'
+
+function Get-ParallelMutationRejectionCode {
+    <#
+    .SYNOPSIS
+        Return the code of a valid final-line rejection signal, or $null.
+    .DESCRIPTION
+        Pure. Only the last non-blank line of the output is considered, after trailing whitespace
+        (including a carriage return) is trimmed. The line must match
+        ^PARALLEL_MUTATION_REJECTED: (?<code>[a-z_]+)$ case-sensitively, and the code must be an
+        ordinal member of the closed code set. Any other form, including formatting or trailing
+        text, returns $null.
+    .PARAMETER AgentOutput
+        The agent's final output text.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)] [AllowNull()] [AllowEmptyString()] [string] $AgentOutput
+    )
+
+    $trimmed = ([string]$AgentOutput).TrimEnd()
+    if ($trimmed.Length -eq 0) { return $null }
+    $lastLine = $trimmed.Substring($trimmed.LastIndexOf("`n") + 1)
+    $match = [regex]::Match($lastLine, $script:ParallelMutationRejectionPattern)
+    if (-not $match.Success) { return $null }
+    $code = $match.Groups['code'].Value
+    foreach ($member in $script:ParallelMutationRejectionCodes) {
+        if ([string]::Equals($member, $code, [System.StringComparison]::Ordinal)) { return $member }
+    }
+    return $null
+}
+
+function Test-ParallelRunStateAbsent {
+    <#
+    .SYNOPSIS
+        Return $true when no live worktree holds parallel checkpoint text that contradicts a no-state stop.
+    .DESCRIPTION
+        For every live root, the text at the canonical parallel checkpoint path must be null or blank,
+        or parse as a JSON object with route_id 'parallel' and a non-blank string parallel_slug that
+        differs (ordinally) from the parallel_slug: value the output names, when it names one. Any
+        other non-blank text (unparseable, a non-object root, off-route, or without a slug) and a
+        checkpoint recording the named slug return $false.
+    .PARAMETER AgentOutput
+        The agent's final output text, scanned for a parallel_slug: literal.
+    .PARAMETER SessionRoot
+        The calling process's path, used only to find the repository.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)] [AllowNull()] [AllowEmptyString()] [string] $AgentOutput,
+        [Parameter(Mandatory = $true)] [string] $SessionRoot
+    )
+
+    $namedSlug = (Find-WorktreeRunIdentitySignal -Text ([string]$AgentOutput)).ParallelSlug
+    # The seam returns its array as one object, so it is assigned before it is iterated.
+    $liveRoots = Get-WorktreeItemLiveRoot -SessionRoot $SessionRoot
+    foreach ($root in $liveRoots) {
+        if ([string]::IsNullOrWhiteSpace($root)) { continue }
+        $text = Get-WorktreeRunCheckpointText -Path (Get-WorktreeRunCheckpointPath -Kind 'parallel' -WorktreeRoot $root)
+        if ([string]::IsNullOrWhiteSpace($text)) { continue }
+        try { $parsed = ConvertFrom-Json -InputObject $text -NoEnumerate -ErrorAction Stop } catch { return $false }
+        if ($parsed -isnot [System.Management.Automation.PSCustomObject]) { return $false }
+        $names = @($parsed.PSObject.Properties.Name)
+        if (-not ($names -ccontains 'route_id') -or ([string]$parsed.route_id -cne 'parallel')) { return $false }
+        if (-not ($names -ccontains 'parallel_slug')) { return $false }
+        $slug = $parsed.parallel_slug
+        if ($slug -isnot [string] -or [string]::IsNullOrWhiteSpace($slug)) { return $false }
+        if (-not [string]::IsNullOrWhiteSpace($namedSlug) -and ($slug -ceq $namedSlug)) { return $false }
+    }
+    return $true
+}
+
+function Get-OrchestratorOutputRejectionDecision {
+    <#
+    .SYNOPSIS
+        Return the allow decision for an unresolved parallel stop that carries a valid rejection signal, or $null.
+    .DESCRIPTION
+        Returns @{ Ok = $true; Message = $null } only when every gate holds: the artifact type is
+        parallel-orchestrator-state, the resolution status is NoTarget, the final line is a valid
+        rejection signal, and the state-absence scan passes. Otherwise returns $null, and the caller
+        applies its existing block.
+    .PARAMETER ArtifactType
+        The artifact type the hook validates.
+    .PARAMETER Resolution
+        The unresolved result of Resolve-OrchestratorOutputCheckpointPath.
+    .PARAMETER AgentOutput
+        The agent's final output text.
+    .PARAMETER SessionRoot
+        The calling process's path, used only to find the repository.
+    #>
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $ArtifactType,
+        [Parameter(Mandatory = $true)] [AllowNull()] [object] $Resolution,
+        [Parameter(Mandatory = $true)] [AllowNull()] [AllowEmptyString()] [string] $AgentOutput,
+        [Parameter(Mandatory = $true)] [string] $SessionRoot
+    )
+
+    if ($ArtifactType -cne $script:ParallelMutationRejectionArtifactType) { return $null }
+    if ($null -eq $Resolution -or [string]$Resolution.Status -cne 'NoTarget') { return $null }
+    if ($null -eq (Get-ParallelMutationRejectionCode -AgentOutput $AgentOutput)) { return $null }
+    if (-not (Test-ParallelRunStateAbsent -AgentOutput $AgentOutput -SessionRoot $SessionRoot)) { return $null }
+    return @{ Ok = $true; Message = $null }
+}
+
+function Get-ParallelMutationRejectionHint {
+    <#
+    .SYNOPSIS
+        Return the text appended to an unresolved block message.
+    .DESCRIPTION
+        Pure. Returns an empty string unless the artifact type is parallel-orchestrator-state and the
+        status is NoTarget. Otherwise returns one newline-prefixed hint line naming the signal form
+        and the rule heading and, when the last non-blank line begins with the signal prefix but
+        carries no valid code, a second line listing the allowed codes.
+    .PARAMETER ArtifactType
+        The artifact type the hook validates.
+    .PARAMETER Status
+        The resolution status of the block.
+    .PARAMETER AgentOutput
+        The agent's final output text.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $ArtifactType,
+        [Parameter(Mandatory = $true)] [AllowNull()] [AllowEmptyString()] [string] $Status,
+        [Parameter(Mandatory = $true)] [AllowNull()] [AllowEmptyString()] [string] $AgentOutput
+    )
+
+    if ($ArtifactType -cne $script:ParallelMutationRejectionArtifactType -or $Status -cne 'NoTarget') { return '' }
+    $hint = ("`norchestrator hook: a parallel skill that stopped without writing state ends its final output with the line 'PARALLEL_MUTATION_REJECTED: <code>' as the last line, with no formatting; see '{0}' in .claude/rules/parallel-orchestration.md." -f
+        $script:ParallelMutationRejectionHeading)
+    $trimmed = ([string]$AgentOutput).TrimEnd()
+    $lastLine = $trimmed.Substring($trimmed.LastIndexOf("`n") + 1)
+    if ($lastLine.StartsWith($script:ParallelMutationRejectionPrefix, [System.StringComparison]::Ordinal) -and
+        $null -eq (Get-ParallelMutationRejectionCode -AgentOutput $AgentOutput)) {
+        $hint += ("`norchestrator hook: the final line carries the {0} prefix with an invalid code; allowed codes: {1}." -f
+            $script:ParallelMutationRejectionPrefix, ($script:ParallelMutationRejectionCodes -join ', '))
+    }
+    return $hint
+}

package/resources/claude-customizations/.claude/hooks/validate-orchestrator-output.ps1

@@ -25,7 +25,9 @@
     ambiguous, or mismatched target blocks with ORCHESTRATOR_CHECKPOINT_UNRESOLVED:
     before any checkpoint is read. For epic-orchestrator-state, the Layer 2 wave-barrier
     ordering check (OrchestratorStateEpicWaveBarrier.psm1, issue #840) runs after the
-    routing dispatch passes.
+    routing dispatch passes. For orchestrator-state, the adopted feature-folder probe
+    (validate-orchestrator-output-feature-folder.ps1, issue #992) runs after the routing
+    dispatch passes, and only when the checkpoint waives new_active_feature_folder.
 
 .NOTES
     Reads the SubagentStop envelope from stdin through Read-SubagentStopEnvelope
@@ -55,12 +57,17 @@ Set-StrictMode -Version Latest
 
 try { . (Join-Path $PSScriptRoot 'validate-orchestrator-output-resolution.ps1') } catch { Add-HookDependencyFailure -Name 'validate-orchestrator-output-resolution.ps1' -ErrorRecord $_ }
 try { . (Join-Path $PSScriptRoot 'validate-orchestrator-output-routing.ps1') } catch { Add-HookDependencyFailure -Name 'validate-orchestrator-output-routing.ps1' -ErrorRecord $_ }
+try { . (Join-Path $PSScriptRoot 'validate-orchestrator-output-rejection.ps1') } catch { Add-HookDependencyFailure -Name 'validate-orchestrator-output-rejection.ps1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeItemResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeItemResolution.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunResolution.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateEpicWaveBarrier.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'OrchestratorStateEpicWaveBarrier.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateCompletion.psm1') -Force -Global -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'OrchestratorStateCompletion.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateUnconditional.psm1') -Force -Global -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'OrchestratorStateUnconditional.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorState.psm1') -Force -Global -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'OrchestratorState.psm1' -ErrorRecord $_ }
+# Imported after the completion modules without -Force, so the instance they already loaded through
+# the adoption module stays the one in use (issue #992).
+try { Import-Module (Join-Path $PSScriptRoot '../lib/orchestrator-state/OrchestratorStateFeatureFolderRecord.psm1') -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'OrchestratorStateFeatureFolderRecord.psm1' -ErrorRecord $_ }
+try { . (Join-Path $PSScriptRoot 'validate-orchestrator-output-feature-folder.ps1') } catch { Add-HookDependencyFailure -Name 'validate-orchestrator-output-feature-folder.ps1' -ErrorRecord $_ }
 try { . (Join-Path $PSScriptRoot 'subagentstop-envelope.ps1') } catch { Add-HookDependencyFailure -Name 'subagentstop-envelope.ps1' -ErrorRecord $_ }
 $ErrorActionPreference = 'Stop'
 $script:SubagentStopReportAndHaltLine = 'This condition is not repairable by the subagent. Report it to the operator and halt.'
@@ -194,7 +201,10 @@ function Invoke-OrchestratorOutputValidation {
         [string] $SessionRoot = (Get-Location).Path,
 
         [Parameter(Mandatory = $false)]
-        [scriptblock] $RoutingInvoker
+        [scriptblock] $RoutingInvoker,
+
+        [Parameter(Mandatory = $false)]
+        [scriptblock] $FeatureFolderGitInvoker
     )
     $dependencyDecision = Get-HookDependencyFailureDecision -HookEvent SubagentStop -ReasonPrefix 'ORCHESTRATOR_CHECKPOINT_UNRESOLVED:'
     if ($null -ne $dependencyDecision) { return $dependencyDecision }
@@ -205,6 +215,7 @@ function Invoke-OrchestratorOutputValidation {
         $agentOutput = $envelope.AssistantText
         $blockArguments = @{ AgentOutput = ([string]$agentOutput); CheckpointPath = $CheckpointPath; ArtifactType = $ArtifactType; SessionRoot = $SessionRoot }
         if ($PSBoundParameters.ContainsKey('RoutingInvoker')) { $blockArguments['RoutingInvoker'] = $RoutingInvoker }
+        if ($PSBoundParameters.ContainsKey('FeatureFolderGitInvoker')) { $blockArguments['FeatureFolderGitInvoker'] = $FeatureFolderGitInvoker }
         $decision = Get-OrchestratorOutputBlockDecision @blockArguments
     }
     if ($decision.Ok) { return @{ Ok = $true; Message = $null } }
@@ -225,6 +236,10 @@ function Get-OrchestratorOutputBlockDecision {
         the condition (message content, its checkpoint, or its runbook) and $false when it cannot
         (a registration argument, an internal evaluation failure, or a state it may not clear).
         The caller applies the re-entry policy to that flag.
+        An unresolved parallel-orchestrator-state checkpoint (status NoTarget) is allowed when the
+        output ends with a valid PARALLEL_MUTATION_REJECTED: <code> line and no live worktree holds
+        contradicting parallel checkpoint text (Get-OrchestratorOutputRejectionDecision, issue #1012);
+        otherwise the unresolved block carries the hint from Get-ParallelMutationRejectionHint.
     #>
     [CmdletBinding()]
     [OutputType([hashtable])]
@@ -235,7 +250,10 @@ function Get-OrchestratorOutputBlockDecision {
         [string] $SessionRoot = (Get-Location).Path,
 
         [Parameter(Mandatory = $false)]
-        [scriptblock] $RoutingInvoker
+        [scriptblock] $RoutingInvoker,
+
+        [Parameter(Mandatory = $false)]
+        [scriptblock] $FeatureFolderGitInvoker
     )
 
     if ([string]::IsNullOrWhiteSpace($agentOutput)) {
@@ -251,9 +269,12 @@ function Get-OrchestratorOutputBlockDecision {
         return @{ Ok = $false; Repairable = $false; Message = ('ORCHESTRATOR_CHECKPOINT_UNRESOLVED: {0}: NoTarget (RESOLVER_FAILED): {1}' -f $ArtifactType, $_.Exception.Message) }
     }
     if (-not $resolution.Resolved) {
+        # Issue #1012: a parallel stop that wrote no state and ends with a valid rejection signal is allowed.
+        $rejectionDecision = Get-OrchestratorOutputRejectionDecision -ArtifactType $ArtifactType -Resolution $resolution -AgentOutput ([string]$agentOutput) -SessionRoot $SessionRoot
+        if ($null -ne $rejectionDecision) { return $rejectionDecision }
         $resolutionRepairable = ($resolution.Status -in @('NoTarget', 'Ambiguous')) -and ($ArtifactType -in @('epic-orchestrator-state', 'parallel-orchestrator-state'))
         return @{ Ok = $false; Repairable = $resolutionRepairable; Message = ('ORCHESTRATOR_CHECKPOINT_UNRESOLVED: {0}: {1} ({2}): {3}' -f
-                $ArtifactType, $resolution.Status, $resolution.ReasonCode, $resolution.Detail) }
+                $ArtifactType, $resolution.Status, $resolution.ReasonCode, $resolution.Detail) + (Get-ParallelMutationRejectionHint -ArtifactType $ArtifactType -Status ([string]$resolution.Status) -AgentOutput ([string]$agentOutput)) }
     }
 
     $file = Get-CheckpointFileContent -Path $resolution.CheckpointPath
@@ -322,6 +343,15 @@ function Get-OrchestratorOutputBlockDecision {
         return @{ Ok = $false; Repairable = $true; Message = "ROUTING_CONTRACT_BLOCKED: $($routingResult.ErrorText)" }
     }
 
+    # Issue #992: a waived new_active_feature_folder must name a folder committed in HEAD of the run
+    # worktree. The validators only see the declared record, so the hook probes git once.
+    if ($ArtifactType -eq 'orchestrator-state') {
+        $folderArgs = @{ Checkpoint = $checkpoint; WorktreeRoot = [string]$resolution.WorktreeRoot }
+        if ($PSBoundParameters.ContainsKey('FeatureFolderGitInvoker') -and $null -ne $FeatureFolderGitInvoker) { $folderArgs['GitInvoker'] = $FeatureFolderGitInvoker }
+        $folderDecision = Get-OrchestratorOutputFeatureFolderDecision @folderArgs
+        if (-not $folderDecision.Ok) { return @{ Ok = $false; Repairable = $folderDecision.Repairable; Message = $folderDecision.Message } }
+    }
+
     # Layer 2 (issue #840): the epic checkpoint only, after the routing dispatch passes,
     # on the checkpoint text already read.
     if ($ArtifactType -eq 'epic-orchestrator-state') {

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadius.psm1

@@ -73,6 +73,7 @@ Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusValidation.p
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusConflict.psm1') -Force -ErrorAction Stop
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusScheduling.psm1') -Force -ErrorAction Stop
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusWriteIntent.psm1') -Force -ErrorAction Stop
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusCombination.psm1') -Force -ErrorAction Stop
 
 # Feature-folder handling. Every radius contains its own feature folder, and a
 # caller may pass either a bare folder name or an already-qualified path.
@@ -246,7 +247,8 @@ function Get-NormalizedDeclaredRadius {
 
     .OUTPUTS
         System.Collections.Hashtable. A new radius carrying the surviving paths,
-        contracts re-filtered by the ASCII-letter rule, and modules and shared
+        contracts re-filtered by the ASCII-letter rule and the generic sheet-tab
+        rule of Test-GenericContractToken (issue #1006), and modules and shared
         surfaces re-resolved from the surviving paths. Throws when the radius
         source is observed: an observed radius records a diff listing rather than
         a plan-text harvest, so the plan-text acceptance rules do not apply to it
@@ -297,9 +299,12 @@ function Get-NormalizedDeclaredRadius {
             -MandateRead ([string[]]@(Get-ConfigMandateRead -Config $Config)))
     $concrete = [string[]]@(Get-ConcreteEntry -Entry $paths)
 
+    # Keep a recorded contract only when it carries an ASCII letter and is not a
+    # default spreadsheet sheet-tab name (issue #1006).
     $contract = [System.Collections.Generic.List[string]]::new()
     foreach ($identifier in @($normalized['contracts'])) {
-        if ($script:ContractLetterPattern.IsMatch([string]$identifier)) {
+        if ($script:ContractLetterPattern.IsMatch([string]$identifier) -and
+            -not (Test-GenericContractToken -Token ([string]$identifier))) {
             $contract.Add([string]$identifier)
         }
     }
@@ -472,4 +477,5 @@ Export-ModuleMember -Function `
     Get-WriteIntentPlanPath, `
     Get-WriteIntentSpecContract, `
     Select-WriteIntentPathEntry, `
-    Get-PlanPathForConfig
+    Get-PlanPathForConfig, `
+    Get-BlastRadiusCombination

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadiusAggregate.psm1

@@ -0,0 +1,154 @@
+<#
+.SYNOPSIS
+    Aggregate integration-cost cap over tolerated overlaps (issue #1013, D-2).
+
+.DESCRIPTION
+    Destination-runtime PowerShell mirror of
+    scripts/dev_tools/_blast_radius_aggregate.py. The pairwise edge rule judges
+    each pair alone, so one item can accumulate many tolerated overlaps whose
+    summed cost exceeds what running it serially would cost. Get-AggregateCappedPair
+    caps each item's summed tolerated cost and returns the pairs to promote to
+    scheduling edges; Get-BlastRadiusConflictEdge applies the result.
+
+    Cap rule: total(i) is the summed cost of the remaining tolerated overlaps
+    that include item i. Item i is over its cap when
+    total(i) * 100 > band_duration(i) * tolerance_percent, evaluated in
+    integers; a missing band reads as default_band. While an item is over its
+    cap, the smallest-key such item promotes its overlap with the minimum key
+    (benefit ascending, cost descending, a ascending, b ascending).
+
+    Parity notes for maintainers:
+      - The Python module is the reference implementation; the committed
+        aggregate fixtures bind the two runtimes together.
+      - Every function is pure: no filesystem, subprocess, network, or clock
+        access, and no input is mutated. Integers only.
+    CONVENTION: this module fails fast at module scope and imports its siblings with -ErrorAction Stop.
+#>
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# tolerance_percent is a percentage of the band duration.
+$script:Percent = 100
+
+# Resolve an item's band duration, reading a missing band as default_band.
+function Get-AggregateBandDuration {
+    [CmdletBinding()]
+    [OutputType([long])]
+    param(
+        [AllowNull()]
+        [object] $Band,
+        [Parameter(Mandatory = $true)]
+        [hashtable] $Tolerance
+    )
+
+    $resolved = if ($null -eq $Band) { $Tolerance['default_band'] } else { $Band }
+    $duration = $Tolerance['band_durations']
+    if ($resolved -isnot [string] -or -not $duration.ContainsKey($resolved)) {
+        throw "band '$resolved' must be one of $(@($duration.Keys | Sort-Object) -join ', ')."
+    }
+    return [long]$duration[$resolved]
+}
+
+# Return the smallest item key whose tolerated total exceeds its cap, or $null.
+function Get-FirstOverCapItem {
+    [CmdletBinding()]
+    [OutputType([long])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]] $Remaining,
+        [Parameter(Mandatory = $true)]
+        [hashtable] $BandByKey,
+        [Parameter(Mandatory = $true)]
+        [hashtable] $Tolerance
+    )
+
+    # Each overlap's cost counts toward both of its items.
+    $total = @{}
+    foreach ($overlap in $Remaining) {
+        foreach ($key in @($overlap['a'], $overlap['b'])) {
+            $current = if ($total.ContainsKey($key)) { $total[$key] } else { [long]0 }
+            $total[$key] = $current + $overlap['cost']
+        }
+    }
+    $percent = [long]$Tolerance['tolerance_percent']
+    foreach ($key in @($total.Keys | Sort-Object)) {
+        $band = if ($BandByKey.ContainsKey($key)) { $BandByKey[$key] } else { $null }
+        $cap = (Get-AggregateBandDuration -Band $band -Tolerance $Tolerance) * $percent
+        if ($total[$key] * $script:Percent -gt $cap) {
+            return $key
+        }
+    }
+    return $null
+}
+
+function Get-AggregateCappedPair {
+    <#
+    .SYNOPSIS
+        Return the tolerated pairs to promote so every item is within its cap.
+
+    .DESCRIPTION
+        Port of select_capped_pairs. Repeatedly takes the smallest-key item that
+        is over its cap, promotes its cheapest-to-serialize overlap, and
+        recomputes the totals, until no item is over its cap.
+
+    .PARAMETER ToleratedOverlap
+        The pairwise tolerated overlaps, in any order: records carrying a, b,
+        cost, and benefit.
+
+    .PARAMETER Band
+        Item key to complexity band; a key that is absent or maps to null reads
+        as default_band.
+
+    .PARAMETER Tolerance
+        A value returned by Get-ConfigConflictTolerance.
+
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary. The promoted pairs in
+        promotion order, each an ordered record with keys a and b, written to
+        the pipeline; nothing when no item is over its cap. Wrap the call in
+        @() to read the result as an array. Throws when a band is not a
+        configured band.
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]] $ToleratedOverlap,
+        [Parameter(Mandatory = $true)]
+        [hashtable] $Band,
+        [Parameter(Mandatory = $true)]
+        [hashtable] $Tolerance
+    )
+
+    # Copy every overlap and band key into Int64 records, so integer keys of any
+    # width compare equal and no input is mutated.
+    $bandByKey = @{}
+    foreach ($key in $Band.Keys) { $bandByKey[[long]$key] = $Band[$key] }
+    $copied = foreach ($overlap in $ToleratedOverlap) {
+        [ordered]@{ a = [long]$overlap['a']; b = [long]$overlap['b']; cost = [long]$overlap['cost']; benefit = [long]$overlap['benefit'] }
+    }
+    $remaining = [System.Collections.Generic.List[object]]::new()
+    foreach ($overlap in @($copied | Sort-Object -Property { $_['a'] }, { $_['b'] })) {
+        if ($null -ne $overlap) { $remaining.Add($overlap) }
+    }
+
+    $promoted = [System.Collections.Generic.List[object]]::new()
+    while ($true) {
+        $item = Get-FirstOverCapItem -Remaining @($remaining.ToArray()) -BandByKey $bandByKey -Tolerance $Tolerance
+        if ($null -eq $item) {
+            # Callers wrap the enumerated records with @() so an empty result is
+            # an empty array.
+            return $promoted.ToArray()
+        }
+        # Cheapest to serialize: least benefit, then most cost, then pair keys.
+        $cheapest = @($remaining | Where-Object { $_['a'] -eq $item -or $_['b'] -eq $item } |
+                Sort-Object -Property { $_['benefit'] }, { - $_['cost'] }, { $_['a'] }, { $_['b'] })[0]
+        [void]$remaining.Remove($cheapest)
+        $promoted.Add([ordered]@{ a = $cheapest['a']; b = $cheapest['b'] })
+    }
+}
+
+Export-ModuleMember -Function Get-AggregateCappedPair