@deftai/directive-content 0.106.0 → 0.107.0

package/Taskfile.yml

@@ -257,6 +257,10 @@ includes:
   triage-classify:
     taskfile: ./tasks/triage-classify.yml
     optional: true
+  # #3648: `task triage:evaluate` Stage A isolated validity + parent WIP census.
+  triage-evaluate:
+    taskfile: ./tasks/triage-evaluate.yml
+    optional: true
   # D2 (#1122): `task triage:summary` one-liner -- status surface invoked by
   # the session-start ritual (N9 / #1149). Inner task `summary` is exposed
   # as the user-facing alias `task triage:summary` in the alias block below.
@@ -444,6 +448,7 @@ tasks:
       - verify:pack-drift
       - verify-wip-cap-framework-self-check
       - verify:orphan-active
+      - verify:completed-write-guard
       - verify:agents-md-budget
       - verify-eval-health-relocation-framework-check
       - verify-eval-triggers-relocation-framework-check
@@ -475,6 +480,7 @@ tasks:
       - verify:cache-fresh
       - verify:wip-cap
       - verify:orphan-active
+      - verify:completed-write-guard
       - verify:test-boundary
       - verify:scope-provenance
       - verify:consumer-check-contract
@@ -991,6 +997,13 @@ tasks:
         vars:
           CLI_ARGS: "{{.CLI_ARGS}}"
 
+  triage:evaluate:
+    desc: "Evaluate issues off origin/master (validity + parent WIP + value). -- task triage:evaluate -- <N...> [--concurrency N] [--repo OWNER/NAME] [--json] (#3648)"
+    cmds:
+      - task: triage-evaluate:evaluate
+        vars:
+          CLI_ARGS: "{{.CLI_ARGS}}"
+
   triage:queue:
     desc: "Print the ranked triage queue (#1128 / D11). -- task triage:queue [-- --repo OWNER/NAME] [--limit N]"
     cmds:

package/UPGRADING.md

@@ -365,9 +365,9 @@ It is common after a manual folder rename or when agents stamp the current key n
 `migrate:xbrief` touches your `AGENTS.md` in two distinct regions:
 
 - **Managed section** (between the `<!-- deft:managed-section ... -->` / `<!-- /deft:managed-section -->` markers): regenerated wholesale by `agents:refresh`, so it always reflects the current framework layout. This region is rendered from the framework template — do not hand-edit it.
-- **Unmanaged header/tail** (everything outside those markers — your project-specific `Session orientation`, `Lifecycle` examples, `Local dev` notes): preserved verbatim across upgrades so your consumer notes survive. Because it is preserved, a rename migration would otherwise leave stale `vbrief/` path literals here. `migrate:xbrief` now applies a **bounded, idempotent** rewrite over the unmanaged region only, replacing the known crossover tokens (`vbrief/` → `xbrief/`, `*.vbrief.json` → `*.xbrief.json`, `vbrief:preflight` → `xbrief:preflight`) while leaving freeform prose untouched. It prints a summary of the replacements.
+- **Unmanaged header/tail** (everything outside those markers — your project-specific `Session orientation`, `Lifecycle` examples, `Local dev` notes): preserved verbatim across upgrades so your consumer notes survive. Because it is preserved, a rename migration would otherwise leave stale `vbrief/` path literals here. `migrate:xbrief` now applies a **bounded, idempotent** rewrite over the unmanaged region only after a first-time `vbrief/` → `xbrief/` conversion, replacing `.vbrief.json`, `vbrief:preflight`, and left-bounded `vbrief/` with a child segment (`vbrief/active/...`). Bare `vbrief/` directory mentions and `x-vbrief/` leftover prefixes are left in place. It prints a summary of the replacements.
 
-If you upgraded before this fix landed and your header still points at `vbrief/`, `deft doctor` now emits an `AGENTS.md header drift:` signpost. Re-run `deft migrate:xbrief` (idempotent) to patch the header, or hand-edit the offending path literals.
+If you upgraded before this fix landed and the unmanaged header still carries child-path `vbrief/` literals, `.vbrief.json`, or `vbrief:preflight`, `deft doctor` emits an `AGENTS.md header drift:` signpost. Hand-edit those path literals. `deft migrate:xbrief` does not patch AGENTS.md on an already-xbrief tree.
 
 **Option A (canonical, #2065):** new installs scaffold a **bounded** unmanaged header only — a project one-liner plus a **Session orientation** pointer at the canonical sources below. Do **not** add freeform `Status`, `Next:`, or `Known Issues` blocks; they are retired because the framework preserves the header verbatim while `deft doctor` only checks the managed section (#794, #1308). Session orientation comes from:
 

package/commands.md

@@ -293,6 +293,7 @@ Current status: the validation, extractor, provider, registry, generated MAP, an
 - `task verify:capacity`, `task verify:wip-cap`, and `task verify:judgment-gates` -- policy/capacity gates.
 - `task verify:orphan-active` -- fail closed when active/running xBRIEFs still point at closed issues or merged PRs (#2321). After merge, `task verify:orphan-active -- --issue N` scans briefs that reference that issue. Confirmed shipped prints `task scope:complete -- <path>`; unresolved lookup prints a retry remediation and still exits 1 (#3429). PR-only briefs stay on the unscoped scan or `task swarm:complete-cohort`.
 - `task verify:lifecycle-visible` -- warn when a clone's ignore configuration hides `xbrief/` / `vbrief/` lifecycle roots (#3505). Uses `git check-ignore -v` on the stage dirs, a matching-extension sentinel under each, and bounded probes derived from ignore-rule globs in root, exclude, `core.excludesFile`, and nested lifecycle `.gitignore` files (so `2026-06-*.xbrief.json` / `2025-*.xbrief.json` cannot report clean), plus `git ls-files -v` for skip-worktree / assume-unchanged. Names the matching rule and source file. Warn-first from `session:start` (per-clone, not on `task check`). Selective `.triage-cache/*.jsonl` entries do not trip. Pass `--enforce` to fail closed.
+- `task verify:completed-write-guard` -- fail closed when a newly added `xbrief/completed/` (or `vbrief/completed/`) artifact was not written by `scope:complete` / `scope:fail` (#3679). Artifacts larger than 1 MiB fail closed before read. Historical corpus is advisory via doctor. Remediation names the leftover land PR after a scope-provenance strip (#3476). `scope:complete` can stamp a brief already in `completed/`. Does not change `verify:completed-tracked`.
 - `task verify:completed-tracked` -- fail closed when closed scoped issues lack a tracked `xbrief/completed/` or `xbrief/cancelled/` artifact on the delivery tip (#3264 / #3476); remediate with `task swarm:finalize-cohort` or a lifecycle PR. `task verify:completed-tracked -- --issue N` is the drive-to DONE form (delivery tip `origin/<deliveryBranch>`, not feature HEAD). Standalone verb (not part of `task check`); use `--tip HEAD` when validating an in-flight land branch. An unresolvable delivery tip fails closed (no silent HEAD fallback) -- fetch the delivery branch or pass an explicit `--tip`. Under `--skip-gh`, a named `--issue` with no cached state fails closed; the unscoped corpus scan keeps the offline allowance. Lifecycle-only lands (completed/cancelled xBRIEFs + optional CHANGELOG) use that verb plus finalize-cohort or the lifecycle PR. ⊗ Full `task check` / the TypeScript suite. ⊗ The drive-to story envelope (pre-pr + review-cycle + suite) for a file-copy land.
 - `task verify:ac` -- product-first acceptance gate (#3284). Runs `plan.acceptance.commands` (or #3267 literal ledger) **verbatim** before done; records AC-source rung (`stated`/`derived`/`project_floor`). Empty commands require `none_stated: true`. Empty resolution is not a green run when the project has no suite floor (`soft_empty` + stamp-acceptance remedy, #3334). Primary name used first in `task check` (fail-fast); `--soft-missing-xbrief` for check composition. Rapid ceremony = AC-only; pressure/degraded makes hygiene advisory. `--capture-only` lists resolved commands without executing. Extends #3267 / #973.
 - `task verify:literal-ac` -- #3267 mechanism alias for verbatim stated-command run (same flags/cwd); prefer `verify:ac` for product-first done-gate.
@@ -367,7 +368,7 @@ When the workflow needs an Approach 1 monitor, scope the Cursor leaf `stop-at: p
   - Shared checklist SoT: `packages/core/src/session/compact-ritual.ts` (all host deposits derive from it).
 - Codex project hooks are trust-gated by Codex. Directive can verify structural registration and command functionality, but reports trust separately as `manual-review-required` and interception as `not-directly-verified`; after an install or changed hook hash, open `/hooks` in Codex and review/approve the exact project hook commands. Runtime trust and real host interception cannot be inferred from the file or live shim probe alone.
 - Directive writes only `.codex/hooks.json`; it does not parse or modify `.codex/config.toml`. Codex can also load inline hooks from `config.toml`, so avoid defining duplicate Directive commands there or they may run more than once. See the [Codex hooks documentation](https://learn.chatgpt.com/docs/hooks).
-- The P0 hook slice does not classify shell-mediated *file* writes, richer unified-exec calls, or WebSearch by default. **Runtime authority (#1394 / #2711)** adds opt-in path allow/deny lists and graduated `scopes` (`edits`, `push`, `merge`) under `plan.policy.runtimeAuthority` — inspect with `deft policy:show --field=runtimeAuthority`. When `enabled: true`, PreToolUse denies classifiable direct-write targets outside `allowPaths` or matching `denyPaths` after ritual/scope/read-only gates; `scopes.edits` gates all direct writes. `scopes.push` / `scopes.merge` deny classifiable Shell/Bash (`git push`, `gh pr merge`) and classifiable MCP push/merge tool names; unclassifiable shell/MCP calls fail open (see `content/contracts/runtime-authority.md`). **Unified path write fence (#516 / #2443 / #2948 Wave 3):** PreToolUse also intersects project allow/deny with the active story’s `plan.metadata.swarm.file_scope` via `resolveWriteFence` (single evaluation SoT; optional `writeScope` alias normalizes at read-time only). Full contract: `content/contracts/path-write-fence.md`.
+- Recognized Shell dest-forms (`git checkout -- <paths>`, `git restore`, `rm`/`rmdir`) share the active-xBRIEF write gate with Edit/Write, including assist/scratch, proposed-lifecycle, and story `file_scope` exemptions (#3438). Other shell-mediated file writes (`python -c`, `cmd /c copy`, obfuscated bash), richer unified-exec calls, and WebSearch stay unclassifiable and fail open. **Runtime authority (#1394 / #2711)** adds opt-in path allow/deny lists and graduated `scopes` (`edits`, `push`, `merge`) under `plan.policy.runtimeAuthority` — inspect with `deft policy:show --field=runtimeAuthority`. When `enabled: true`, PreToolUse denies classifiable direct-write targets outside `allowPaths` or matching `denyPaths` after ritual/scope/read-only gates; `scopes.edits` gates all direct writes. `scopes.push` / `scopes.merge` deny classifiable Shell/Bash (`git push`, `gh pr merge`) and classifiable MCP push/merge tool names; unclassifiable non-dest shell/MCP calls fail open (see `content/contracts/runtime-authority.md`). **Unified path write fence (#516 / #2443 / #2948 Wave 3):** PreToolUse also intersects project allow/deny with the active story’s `plan.metadata.swarm.file_scope` via `resolveWriteFence` (single evaluation SoT; optional `writeScope` alias normalizes at read-time only). Full contract: `content/contracts/path-write-fence.md`.
 - **Human-origin authz + UAT mutation lease (#2944 / #2948 Wave 1)** — `deft authz:uat-start` / `authz:grant` / `authz:show`. When UAT is active, PreToolUse denies product/UI edits, push, PR create/advance, and merge without a named fix-cohort human-origin grant; tests, issue filing, and evidence/defect-capture writes stay allowed. Self-authored xBRIEF/lifecycle/dispatch tokens never satisfy implement gates. Contract: `content/contracts/human-origin-authz.md`.
 - **Closed-verb release gates + AFK templates (#1095 / #2948 Wave 4 / #3527)** — `deft authz:grant -- --template release-publish --target <ver>` (also `release-cut`, `release-rollback`) mints Wave 1 operator-cli grants only. `task release` fails closed at the Step 10–11 tag-push / npm-publish boundary unless a matching grant exists or `DEFT_ALLOW_RELEASE_PUBLISH=1`. `deft release-publish` / `task release:publish` still fails closed before draft→public (same verb; not deleted). `--skip-tag` and dry-run stay ungated. No second session-auth mint engine. Contract: `content/contracts/closed-verb-authz.md`.
 - **Structural scope:decompose apply grant (#3239 / #3291)** — after `scope:decompose --check` validates a draft, mint with `deft authz:grant -- --parent <parent.xbrief.json> --draft <draft.json> [--repo owner/name] [--single-use] --confirm` (typed phrase `mint` on a real TTY). Digests exact draft bytes and binds parent/target/worktree (and optional repo). Then `deft scope:decompose -- <parent> --draft <draft>`. `--check` stays ungated. Apply denies print the exact mint command.
@@ -395,7 +396,7 @@ After CLI/deposit upgrade, disk can show the new generation while a long-lived s
 - ! **USER.md path (#2544):** resolve via `deft session:start` output (`USER.md resolved …`); default platform paths: Windows `%APPDATA%\deft\USER.md`, Unix `~/.config/deft/USER.md`; override `$DEFT_USER_PATH`; workspace `<project>/.deft/USER.md`. ⊗ Invent or search `~/.config/deft` on Windows — AppData Roaming is canonical.
 - ! At mutation boundaries (code-writing, scope lifecycle moves, `start_agent`, commits, pushes, PR-from-local-changes, release work): run the mutable quick tier then gated verifier below before proceeding.
 - ? Explicit read-only alignment only: `deft session:start -- --read-only` (no ritual-state write).
-- ! **Worktree occupancy (#3433):** mutation `session:start` / `session:ready` claim a gitignored `.deft/occupancy.json` lease. A second mutation session on the same tree with a different `DEFT_SESSION_ID` fails closed (occupant id, intent, heartbeat age + remediation). Same-session re-arm heartbeats and keeps that id — it does not mint a new UUID. Steal with `occupancy:steal --confirm --occupant <id>` (or `session:start --steal --confirm --occupant <id>`). Expired heartbeat (20 min) is free. `--read-only` does not claim. Join (`occupancy:request`) is named in the remediation only. `swarm:launch` persists `occupancy_session_id` in a cohort-keyed record; close-out must use that cohort's entry (or `DEFT_SESSION_ID`), never a slot another launch can overwrite and never the live lease file.
+- ! **Worktree occupancy (#3433 / #3604):** mutation `session:start` / `session:ready` claim a gitignored `.deft/occupancy.json` lease. A second mutation session on the same tree with a different `DEFT_SESSION_ID` fails closed (occupant id, intent, heartbeat age + remediation). Same-session re-arm heartbeats and keeps that id — it does not mint a new UUID. Steal with `occupancy:steal --confirm --occupant <id>` (or `session:start --steal --confirm --occupant <id>`); steal stays confirm-gated for a **live** occupant and may print existing `claimed_at` / `heartbeat_at`. The occupant drops a live lease with `occupancy:release` or `session:end`; a non-owner cannot clear a live lease. Expired heartbeat (20 min) is free (claim-over-expired); leftover files after TTL are residue, not a blocked entry path, and the same release path may clear them. No `reap` verb. `--read-only` does not claim. Join (`occupancy:request`) is named in the remediation only. `swarm:launch` persists `occupancy_session_id` in a cohort-keyed record; close-out must use that cohort's entry (or `DEFT_SESSION_ID`), never a slot another launch can overwrite and never the live lease file. Swarm close-out stays `releaseSwarmOccupancy` on complete-cohort.
 - ~ Operators MAY still explicitly request full `deft session:start`, `deft triage:welcome`, sync, or doctor in read-only sessions.
 
 ### Assist / research posture (#1802)
@@ -451,7 +452,7 @@ Agents use this signal to prefer portable syntax and quote zsh-sensitive data su
 - Shallow probe (default hot path): PATH ladder `ghx` > `gh`, injected-token env presence, short `gh auth status`.
 - Deep probe when `--with-network` / `DEFT_SESSION_START_NETWORK=1`: full `github-auth-modes` validation (API + optional repo).
 - Session-start never hard-blocks on SCM absence (framework-local gates still run). When not ready it lists skipped SCM-dependent gates (`triage:queue`, `issue:ingest`, `pr:*`, `reconcile:issues`, `cache:fetch-all`, `scm:*`, ...).
-- Explicit probe: `deft scm:status` (alias `scm:readiness`) -- exit `0` ready / `1` not ready / `2` config; flags `--json`, `--deep` / `--shallow`.
+- Explicit probe: `deft scm:status` (alias `scm:readiness`) -- exit `0` ready / `1` not ready / `2` config; flags `--json`, `--deep` / `--shallow`, `--repo OWNER/REPO`, `--expected-login`. Deep validation derives the target repo and compares an expected user login when one is supplied (#3665). GitHub App installation identity is deferred to #3693.
 - Credential bridging: host-gh (`gh auth login` in the execution env) or injected-token (`GH_TOKEN` / `GITHUB_TOKEN` / `GH_ENTERPRISE_TOKEN`). Never put token values in prompts or transcripts.
 - Contract: `content/contracts/scm-readiness.md`; operator docs: `content/scm/github.md` § Mismatched/headless SCM readiness.
 
@@ -549,6 +550,7 @@ Directive does not guess your mix. Either you name the next units in order (**or
 ### Triage Tasks
 
 - `task triage:bootstrap -- [--repo OWNER/NAME] [--limit N] [--state {open|closed|all}] [--batch-size N] [--delay-ms N]` -- seed the local triage cache and audit layer.
+- `task triage:evaluate -- <N...> [--concurrency N] [--repo OWNER/NAME] [--json]` -- Stage A isolated issue-eval (#3648). Detached `origin/master` worktrees own validity; the parent owns WIP census (`xbrief/active`, `xbrief/pending`, `plan-sequence`); GitHub REST owns open PRs/issues. Verdicts land under `.deft-scratch/issue-eval/<sha12>/<invocation-id>/`. No GitHub writes. Fan-out default 4. Value may set `critique-recommend:`; it must not emit `design-critique: warranted | not warranted, because …`. Decisions stay existing `triage:*` verbs.
 - `deft triage:queue --limit=10 [--author LOGIN|@me]` -- show ranked candidate work from cache-backed state. Optional `--author` / `--author-mine` filters to cache `author.login` (exact match; `@me` resolves via authenticated `gh`; comma allow-list; missing author disclosed as unknown) (#3129 / #1318 Layer 1). When the cache is empty, auto-populates from GitHub first (#2575) — do not conclude "nothing to do" from xBRIEF folders or live `gh issue list` alone (#2576).
 - **Ordered-plan precedence (#2402):** when `.deft/plan-sequence.json` is active, bare "what's next?" / "next PR" / "proceed" bind to the current sequence entry via `deft plan-sequence:current` — they do **not** authorize `triage:queue` or adjacent backlog picks. Use `deft verify:plan-sequence --target-kind <kind> --target <id>` before opening a PR/branch/story/sub-agent. Sequence exhaustion fails closed until the operator names a new target or explicitly asks for queue/backlog selection ("what's the queue?", "build a cohort"). Set a sequence with `deft plan-sequence:set --file <json>`; advance with `deft plan-sequence:advance`; clear with `deft plan-sequence:clear`. Do not reuse triage queue `continuationNumbers` / `continuationOrder` for this state.
 - `task triage:accept -- --issue <N> --repo OWNER/NAME [--auto-promote] [--force]` -- accept a candidate and ingest it as a proposed scope xBRIEF. Opt-in `--auto-promote` also promotes proposed→pending in the same action (#1136); `--force` is the WIP-cap override for that promote leg.
@@ -563,6 +565,7 @@ Directive does not guess your mix. Either you name the next units in order (**or
 - `task triage:summary`, `task triage:scope`, `task triage:scope-drift`, `task triage:subscribe`, `task triage:unsubscribe`, `task triage:classify`, `task triage:welcome`, and `task triage:smoketest` -- supporting workflow and onboarding commands.
 - `task triage:classify -- --mirror [--apply] [--re-enrich] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json]` -- **Bootstrap mass-triage / Tier-1 SCM label mirror (#1423 Wave 1–2 / #3125, #3129, #3197).** Runs the existing classify engine over the github-issue cache and mirrors outcomes as labels (`triaged` idempotency marker + optional `plan.policy.triageLabelMirror.actionLabels`). **Default state filter is open-only** (opt-in `--include-closed` for closed archive stamps). Optional `--author` / `--author-mine` scopes plan/apply to matching `author.login` (AND with open-only; digest surfaces the filter) (#3129). Dry-run by default: operator digest with totals (scanned/planned/already_triaged/no_match/closed_skipped/author_skipped/errors), breakdown by **state / rule / action**, and samples (not a full dump as primary UX); `--json` includes the same aggregates. `--apply` writes via the SCM label client / repo-mutation boundary in **batches** (`--batch-size`, default 10) with **rate-limit delay** (`--delay-ms`, default 1000), reports partial failures, and is idempotent on re-run (already-`triaged` skip). **Re-run vs re-enrich (#3124 / #3197):** default re-run keeps the one-shot stamp (`skipped_already_triaged`). After `actionLabels` / auto-classify rule / hold-marker changes, opt in with **`--re-enrich`** (still dry-run by default; pair with `--apply` to write) to re-classify already-stamped issues and plan **additive** label deltas only (v1 never removes obsolete chips; never full reconcile). Digest distinguishes `kind=first-time` vs `kind=re-enrich` planned/applied rows (`planned_kind` / `re_enrich_planned`). Missing labels fail closed per issue with a create-label hint. **Never** calls `triage:accept` and **never** writes `proposed/` xBRIEFs. Wave 3 (agent Tier-2 comments) remains out of scope.
 - **Triage write-back pairing (#1423 / ADR-005).** When the author stamps that a lean is mechanism-shaped, write **both**: body-text field `mechanism-shaped: true` (the artifact) **and** mirrored label `design-critique:mechanism-shaped` (what `plan.policy.judgmentGates` matches and lists show). Do not compute the classification. No stamp -> the design-critique gate never fires. Clearance is a separate line on the thread: `design-critique: warranted | not warranted, because ...` -- engine evaluates presence, shape, and authority, never the because-clause content. Advisory/observe; `verify:judgment-gates --enforce` stays opt-in unused; `scope:promote` does not gain `--enforce` in this story.
+- **Design-critique catalog chip (#3642).** Parent attach of `triage-ready` / recut `mechanism-shaped` MUST use `task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped [--repo OWNER/NAME]` (or `deft scm issue design-critique-chip`). Closed catalog remaining-set replace, one write. ⊗ `gh api POST .../labels`. ⊗ additive `scm:issue:edit --add-label`.
 - **Operator discovery for SCM label mirror (#3124).** Cold `session:start` (via `triage:welcome` default mode) surfaces a **throttled** tip until the first successful `--mirror` dry-run or operator ack — **not** on every re-arm. Tip teaches existence **and** get-the-most: dry-run `deft triage:classify -- --mirror` (open-only; `--include-closed` opt-in); `--apply` batches writes and **never** auto-accepts into `proposed/`; defaults only stamp **`triaged` on matches** (control stamp, not disposition); **board usability is greatly decreased without `actionLabels`** — recommend full five-chip map (`defer→triage:deferred`, `archive→triage:archived`, `accept→triage:lifecycle-linked`, `escalate→triage:needs-human` + always `triaged`); more matches → `plan.policy.triageAutoClassify` in PROJECT-DEFINITION; inspect via `deft policy:show --field=plan.policy.triageLabelMirror`; labels must exist on GitHub; applying `triaged` before action chips skips re-enrichment on re-run (use `--re-enrich`); point at consumer kit **#2611** (`content/docs/consumer-issue-label-kit.md`) — do not invent vocabulary. Dismiss without dry-run: `deft triage:classify -- --ack-discovery` (production entry for tip ack). Dry-run digests SHOULD footer-hint when `actionLabels` is empty or open `no_match` dominates. **Anti-swallow:** when the tip fires, agents MUST restate existence + get-the-most in the **user-visible** message (not absorb ceremony alone).
 
 ### Cache Tasks

package/contracts/design-critique.md

@@ -1,6 +1,6 @@
 # Design-critique contract
 
-Sole normative source of truth for the design-critique motion: charter, variant table, envelope and ceiling, and synthesis format. The copyable dispatch envelope is [`templates/design-critique-brief.md`](../templates/design-critique-brief.md). Phase 1 (the judgment gate) lives in [`docs/decisions/ADR-005-design-critique-judgment-gate.md`](../../docs/decisions/ADR-005-design-critique-judgment-gate.md).
+Sole normative source of truth for the design-critique motion: charter, critic method, variant table, envelope and ceiling, synthesis format, and the operator-gated loop until synthesis is accepted. The copyable dispatch envelope is [`templates/design-critique-brief.md`](../templates/design-critique-brief.md). Phase 1 (the judgment gate) lives in [`docs/decisions/ADR-005-design-critique-judgment-gate.md`](../../docs/decisions/ADR-005-design-critique-judgment-gate.md). Parent-side substantiation principle: [`docs/decisions/ADR-006-parent-side-substantiation.md`](../../docs/decisions/ADR-006-parent-side-substantiation.md).
 
 Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
@@ -11,7 +11,7 @@ This contract scaffolds the motion. Only the ADR-005 judgment gate and the conte
 - ! Use `scaffolds` for protocol steps in this document.
 - ⊗ Use the verb "enforces" here for anything other than the ADR-005 judgment gate and the content-contract tests.
 - ⊗ Pin this contract or `skills/deft-directive-design-critique` into `templates/agents-entry.md` or the AGENTS.md always-pin list. Discovery is on-demand via the Skills Index.
-- ⊗ Auto-dispatch critics from this contract. Dispatch is deferred until a second consumer demands it (#1702). Until then the operator dispatches from the brief template.
+- ⊗ Auto-dispatch critics from this contract (#3578 / #1702). Operator (or parent after an operator verb) dispatches the next envelope from the brief template.
 
 ## Stop 1 — Gate
 
@@ -21,43 +21,139 @@ ADR-005 is vehicle-invariant. The gate never computes "is this triage mechanism-
 2. `plan.policy.judgmentGates` matches that label. Pure syntax.
 3. The clearance line on the thread is `design-critique: warranted | not warranted, because …`. `verify:judgment-gates` checks presence, shape, and authority. It never scores the because-clause.
 
+The write-back first two lines name the model and role (Stop 3).
+
+The Stop 1 write-back records `refutation-target:` naming the triage author's highest-leverage asserted premise.
+
+- ! Record `refutation-target:` on the Stop 1 write-back.
+- ⊗ Treat `refutation-target:` as an `audit:` marker. The field creates no unresolved-marker state and never blocks bind.
+
 `verify:judgment-gates --enforce` stays opt-in unused in this rollout. Advisory observe first. No marker means the gate never fires. Voluntary critiques stay legal.
 
 ## Stop 2 — Variant selection
 
-Record one line per arc: which variant, why, N.
+Record one line per arc: the **charter** (`refutation` | `open critique`), the **spend** (`N=1`, or `N≥3` when the permission is used), and why.
+
+- ! Record the charter and the spend as two fields. The charter is what the critic is given. The spend is how many critics that charter may use.
+- ⊗ Record `panel` as the variant or charter. The panel row is spend permission, not a third charter.
 
 ### Variant table
 
-| Condition | Variant | N | Exemplar |
+| Condition | Charter | N | Exemplar |
 |---|---|---|---|
 | Issue body names a defensible presumption with a refutation target | refutation | N=1 | #3462 |
 | Otherwise (default) | open critique | N=1 | #3547 |
-| No defensible presumption, and a genuinely open solution space or high blast radius | panel | N≥3 | #3383 |
 
-Default motion after a mechanism-shaped stamp: N=1 fresh open critique. If residual remains, one reiterating pass with a fresh critic that reads a disagreement map, then verified synthesis. Resume is optional sharpening ("does my prior finding still hold"), not the default reiterating agent.
+| Condition | Spend | N | Exemplar |
+|---|---|---|---|
+| A genuinely open solution space or high blast radius | panel permission (not a charter) | N≥3 permitted | #3383 |
+
+Supersedes #3434 disposition comment 5364365428 item 4, which accepted "no defensible presumption + genuinely open solution space / high blast radius → N≥3 panel" on 2026-08-20. The conjunct treated a drafted proposal and high blast radius as mutually exclusive, so a well-specified high-blast-radius issue could not earn a panel. This table drops that conjunct and grants N≥3 as permitted, not selected.
+
+### Evaluation rule
+
+Charter selection and spend permission are evaluated independently.
+
+- The first two rows select the **charter**: refutation when the issue names a defensible presumption with a refutation target; otherwise open critique. Those rows are unchanged in behaviour.
+- The panel row grants **permission** for N≥3 when the solution space is genuinely open or blast radius is high. It does not select the charter and does not override charter.
+- An issue that matches both a refutation charter and the panel condition is refutation with N≥3 permitted.
+- A drafted-MUSTs issue with no refutation target and whole-motion blast radius is open critique with N≥3 permitted.
+
+**Why permission rather than selection.** Serial reiteration is anchored by a parent-authored disagreement map correlated with round 1 by construction — the same correlation Decorrelation refuses to count as confirmation. Parallel critics carry independent priors, which is worth buying when being wrong is expensive and hard to reverse. That argues for making N≥3 available. One arc in which a panel added unique value does not establish that every high-blast-radius issue must spend it.
+
+⊗ Add a Stop 2 variant-table trigger for "the author is the party the proposed rule would constrain." Raising N changes spend; who may substantiate and clear an interested party's claims is a role-and-clearance problem owned by Decorrelation and Non-self-arbitration. Neither requires N≥3. If constrained-party risk needs stronger treatment, it belongs in Stop 5 disclosure and non-self-clearance (#3651).
+
+Default motion after a mechanism-shaped stamp: N=1 fresh open critique. If residual remains, one reiterating pass with a fresh critic that reads a disagreement map, then verified synthesis. Resume is optional sharpening ("does my prior finding still hold"), not the default reiterating agent. A permitted N≥3 does not change that default; the parent records the spend when it uses the permission.
 
 ## Stop 3 — Critic envelope
 
-### Charter
+### Parent-facing dispatch rules
 
 Process-only. The critic audits the lean, the protocol fit, and the recording obligations. It does not implement product work.
 
-- ! Give the critic a process-only charter.
+- ! Give the critic process-only dispatch rules.
 - ⊗ Load parent hypotheses into the envelope.
 - ⊗ Name a refutation target unless the recorded variant is refutation.
 - ⊗ Edit critic text after dispatch. The parent records; it does not rewrite.
 
+### Critic method
+
+How a critic critiques. Method-reconciliation stays at Stop 5; critics issue verdicts and therefore read it.
+
+Strengths are not one level. Token presence is not behavioral evidence. Classification has a mechanized consumer; re-verification and inventory change the search. An empty road-not-taken or a perfunctory steelman satisfies a pin while changing nothing.
+
+- ! Re-verify the triage's anchors by running checks. Line cites are claims, not evidence.
+- ! Inventory existing mechanisms before proposing new ones.
+- ! Classify every finding with the exact three tokens: `blocks-the-design`, `sharpens-framing`, or `footnote`.
+- ! Every classified finding names evidence, a concrete failure mode, and the disposition consequence — or it is a footnote.
+
+The three tokens are the blocking, sharpening, and footnote classes `walk all` already consumes in that order. `blocks-the-design` means the lean cannot bind as written. `sharpens-framing` means the lean can bind, but the finding changes how it is stated or scoped. That distinction is the disposition consequence the anatomy MUST already requires, not a separate evidence rubric. Two critics may still disagree; that disagreement is residual, not a contract defect. This contract does not add a decision table of evidence. A `footnote` cannot carry disposition weight: it is in the census, it is not residual, and it is not in the auto-stamp denominator. Anatomy is required of blocking and sharpening findings; a finding that cannot name evidence, a failure mode, and a disposition consequence is a footnote, not a silent skip of classification. A footnote-only post is not a stub.
+- ! Apply the injection / swarm lens when the target changes authority, untrusted input, prompts or envelopes, identity, concurrency, worktrees, or shared state. An `N/A` paragraph on a local constant change is theater.
+- ⊗ Close a finding with "a reviewer would catch it". That is a failed finding. If a safety case ends at reviewer attention, name a deterministic control or leave the finding unresolved.
+- ~ When the critic actually chose among plausible mechanisms, state a road-not-taken.
+- ~ When the critic actually chose among plausible mechanisms, steelman the strongest rejected position and name what would flip the verdict.
+
+The injection / swarm lens is a triggered MUST: it fires only on those target changes. The reviewer-catch rule is a prohibition, not a required recital. Road-not-taken and steelman are SHOULD, and fire only on a real fork.
+
 ### Envelope and ceiling
 
 The envelope is [`templates/design-critique-brief.md`](../templates/design-critique-brief.md). Fill fields. Do not copy rule bodies from this contract into the envelope.
 
 - ! State an id ceiling (GitHub comment id, inclusive) at dispatch.
-- ! Honor that ceiling. Comments after the id ceiling are out of envelope.
-- ! Round-1 ceiling is the triage write-back (or the thread head at dispatch).
+- ! Honor that ceiling. Comments after the id ceiling are out of envelope, except the critic's own Stop 4 retry post (including after the disagreement-map input ceiling), which stays in the auto-stamp denominator.
+- ! Critics dispatched in the same round share one issue-comment input ceiling, fixed before any sibling dispatch. A sibling's post is out of envelope for every other sibling in that round.
+- ! That MUST claims only that siblings cannot read each other through the issue thread. It does not claim decorrelation.
+- ! Round-1 ceiling is the triage write-back when one exists. The "thread head at dispatch" fallback applies only to a single-critic round with no triage write-back. When two or more critics share the round, take one round-start snapshot before the first sibling dispatch and use that snapshot (or the triage write-back) as the shared ceiling.
+- ! Before dispatching two or more critics in the same round, parent posts a panel-deposit comment (`role: parent`) that names `round:`, `siblings:`, and `input-ceiling:` (the shared GitHub comment id). That comment is the durable record. A missing or malformed deposit is a contract defect.
 - ! Round-2 ceiling is the disagreement-map comment.
 - ! Resolve SHAs from the tree. Do not invent them.
 
+Canonical panel-deposit:
+
+```text
+model: grok-4.6
+role: parent
+
+panel-deposit
+round: 1
+siblings: 3
+input-ceiling: 5390001612
+```
+
+### Comment lead (model then role)
+
+Comment-lead field. The first two lines of the triage write-back and of every critic, parent, and #3640 auto-posted comment name the LLM and the posting role. Keep the first line as `model: <slug>`. The second line is `role: triage|critic|parent`.
+
+Canonical lead:
+
+```text
+model: grok-4.6
+role: critic
+```
+
+Closed role set (do not invent chips or extra roles in v1): `role: triage|critic|parent`.
+
+| role | Who posts |
+| --- | --- |
+| `triage` | Stop 1 write-back |
+| `critic` | Stop 3 / Stop 4 critic comments |
+| `parent` | successor lean, walk decisions, verified-claims table, synthesis-accepted line, halt line, panel-deposit, disposition map if not folded into the successor lean |
+
+- ! First line of the triage write-back comment is `model: <slug>`.
+- ! Second line of the triage write-back comment is `role: triage`.
+- ! First line of every critic comment is `model: <slug>` for the model that produced that comment.
+- ! Second line of every critic comment is `role: critic`.
+- ! Same first-two-lines on a Stop 4 retry critic (`role: critic`).
+- ! Same first-two-lines on #3640 auto-posted table / synthesis-accepted comments (`role: parent`).
+- ! Parent comments (successor lean, walk decisions, halt line, verified-claims table, synthesis-accepted, panel-deposit) use `role: parent`.
+- ! Synthesis comments use the same first-two-lines (`model: <slug>` then `role: parent`).
+- ⊗ Put the model in an issue label.
+- ⊗ Put role in an issue label (`design-critique:critic`, author/role chips).
+- ⊗ Put a GitHub login, author name, or role name in that lead line in place of the model.
+- ⊗ Replace the model line with a role or GitHub login.
+- ⊗ Infer the model from `verify:routing` or spawn metadata and omit it from the comment.
+- ⊗ Infer role from `verify:routing` or spawn metadata and omit it from the comment.
+
 ## Stop 4 — Residual reiteration
 
 Use this stop only when round 1 leaves residual disagreement that still changes disposition.
@@ -65,14 +161,143 @@ Use this stop only when round 1 leaves residual disagreement that still changes
 - ! Dispatch a fresh critic against a disagreement map. Do not default to resume.
 - ? Resume the same critic when the question is "does my prior finding still hold?"
 - ! Keep the id ceiling at the disagreement-map comment for that pass.
-- ⊗ Run a third critic pass as the default. Record why if a panel variant already set N≥3.
+- ! First-two-lines (model then `role: critic`) on the retry critic comment (Stop 3).
+- ⊗ Run a third critic pass as the default. An N=3 panel is not a recorded why for a Stop 4 retry. See Dual stop.
+
+## Operator-gated loop
+
+Keep the arc in this contract until a verified synthesis is accepted.
+
+- ! Each critic dispatch EXITs after posting.
+- ! Operator (or parent after an operator verb) dispatches the next envelope.
+- ! After each critic EXIT, parent posts a successor lean with proposed per-heading takes **before** printing `accept` / `retry differences` / `walk` / `walk all`. That posted lean is the first operator surface. Chat is not the record.
+- ! Operator confirm or amend binds the proposed takes on that posted lean. Binding takes is not synthesis bind and does not stamp `design-critique:triage-ready`.
+- ⊗ Bind synthesis or stamp `design-critique:triage-ready` while a panel-deposit for this round names `siblings:` N and fewer than N critic posts for that round exist. The first lean after one critic EXIT is the take-offer, not the bind.
+- ! Later successor leans follow accept-X or walk-end, or land before synthesis. This supersedes #3627's "successor lean only after accept-X" for the first lean after critic EXIT. Later leans may still follow accept-X / walk-end.
+- ⊗ Print `accept` / `retry differences` / `walk` / `walk all` when no successor lean is posted for this critic EXIT. An empty-lean verb menu is a contract miss.
+- ⊗ Auto-dispatch critics (#3578 / #1702).
+- ⊗ Hand the arc to `triage:accept` / `scope:promote` until `design-critique:triage-ready`.
+- ⊗ Stamp `design-critique:triage-ready` at critic-post.
+- ⊗ Add a `design-critique:critic-posted` chip or any author/role chip.
+- ⊗ Critic writes issue labels.
+- ⊗ Add a #3607 thread interlock in this contract.
+
+## Successor lean
+
+After each critic EXIT, parent posts a successor `**Lean:**` comment with proposed per-heading takes. That posted lean is the first operator surface. Later successor leans follow accept-X or walk-end, or land before synthesis.
+
+- ! After critic EXIT, post the successor lean before printing `accept` / `retry differences` / `walk` / `walk all`.
+- ! Operator confirm or amend is what makes those takes bindable. An all-accept draft still goes through this offer. Confirming or amending an all-accept first lean binds those takes. It does not auto-stamp synthesis or `design-critique:triage-ready` while same-round siblings named on the panel-deposit remain unposted.
+- ! Cite accepted critic ids/headings, the still-open residual, and the write-back or prior lean it supersedes.
+- ! Carry a per-heading take on the successor lean: `accept-into-contract` | `disagree` | `defer`. Defer is not accepted.
+- ! The successor lean is the disposition map. Do not post a third map type.
+- ! The first posted map is an ADR-006 arbitration surface. Record a substantiation token when takes introduce load-bearing premises. Non-self-arbitration applies when the same party authored the triage and the proposed takes.
+- ! Bind synthesis and `design-critique:triage-ready` to the latest successor lean, never a superseded write-back.
+- ! Full template (accepted set, residual, supersedes-id, ceiling if retrying) lives only on the successor lean and on a retry disagreement map.
+- ! Walk comments stay slim (model and role lines, Accept X, critic id, heading, decision, and when needed a token plus pointer).
+- ⊗ Edit the ceiling write-back in place.
+- ⊗ Fold the successor lean into the critic comment.
+- ⊗ Paraphrase critic findings as new claims.
+
+## Parent-side substantiation
+
+A `role: parent` artifact that introduces a load-bearing premise while adjudicating a critic finding records a substantiation token at that point. The token records the premise. It does not decide whether the reading is true.
+
+A load-bearing premise introduced before any critic exists is outside this obligation. At Stop 1 nobody has spoken and the entire critic pass is the audit. ADR-006 addresses post-critic arbitration where the critic gets no reply. #3651's round-1 critic named a pre-critic premise and instructed: state expressly that the initial triage remains outside this amendment, or widen scope deliberately. The successor lean widened the trigger. This paragraph is the other half.
+
+Token grammar:
+
+```text
+audit:<id> sha=<git-sha> pointer=<path:start-end|comment:<id>> reading=measured|asserted
+```
+
+- ! Record dispatch SHA, source pointer, and measured-versus-asserted at the point of use.
+- ⊗ Push substantiation prose into walk comments. A token plus pointer satisfies this at the walk surface. The substantiation lives in the parent artifact or its linked successor lean.
+- ! A premise under this section that changes classification, residual, or next-build contract stays unaudited until a later `role: critic` artifact targets its marker.
+- ! The predicate is independence, not provenance. Primary-source citation by the parent does not clear the marker.
+- ⊗ A `role: parent` artifact clears its own marker.
+- ⊗ Mixed-basis laundering: one independently reproduced premise does not clear an unaudited load-bearing one.
+- ! An unresolved marker is residual and blocks verified-synthesis bind.
+- ⊗ Discharge a marker by promising a later pass.
+- ! Auto-bind requires an all-accept disposition map AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain. This conjunct applies at Operator verbs auto-stamp and at Bind after accepted synthesis path 1.
+- ! The brief envelope names unresolved marker ids as `audit-targets` (ids only, or `none`). It does not carry parent rationale.
+- ! `evaluateParentAudit` fails closed on a missing token, a silently cleared marker, a parent self-clear, or an envelope that omits a named audit target.
+
+## Operator verbs
+
+Contract stops stay internal. Parent prints these phrases when they apply. They apply only after a successor lean is posted for this critic EXIT. Printing the verb menu with no posted successor lean is a contract miss. The operator does not have to remember them.
+
+- **accept** (cite findings)
+- **retry differences**
+- **walk**
+- **walk all**
+- **post the verified-claims table**
+- **accept synthesis**
+
+**walk** iterates recorded parent-disagree headings (successor-lean take is `disagree`). **walk all** is the census of every classified finding in existing order (blocking then sharpening then footnotes — or the critic's numbering). For one release, `walk findings one at a time` is an alias of **walk all**. Short forms of accept synthesis are valid: `accept synt`, `synt accepted`, `synt approved`, `accept synthesis`, `synthesis accepted`, `synthesis approved`. Same idea for other printed verbs when the short form is unambiguous (`retry` for `retry differences`). If the operator types a bare word that could be either **walk** or **walk all** and only one was offered, map it to the offered one. If ambiguous, parent re-prints the offered phrases and waits.
+
+- ! Print the phrases when they apply. An empty-lean verb menu is a miss.
+- ! Do not print **walk** until at least one proposed take on the posted lean is `disagree`.
+- ! Do not print **retry differences** until residual headings are named on that map.
+- ! Do not skip the first-lean offer because the draft is all-accept.
+- ! Non-empty disagree set: print **walk** / **walk all** / **retry differences** / **accept**. Walk is an option, not the only path. Do not auto-start the walk.
+- ! When the successor lean's per-heading map is total over a **non-empty** in-envelope classified-finding set, every heading is `accept-into-contract` (no `disagree`, no `defer`), AND zero unresolved audit markers, AND the operator has confirmed or amended that map, AND no unposted same-round siblings named on the panel-deposit remain: parent auto-posts the verified-claims table as its own comment, then auto-posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. Do not print **accept synthesis**, **post the verified-claims table**, **walk**, or **walk all**.
+- ⊗ Auto-stamp a parent-drafted all-accept map that the operator has not confirmed or amended.
+- ⊗ Auto-stamp while a panel-deposit for this round still has unposted siblings.
+- ⊗ Auto-stamp when any audit marker is unresolved.
+- ! The auto-stamp denominator is the union of (a) classified headings from critic comments posted in this arc and (b) still-open residual headings on the latest successor lean. Classified headings in (a) are blocking and sharpening; footnotes stay in the walk-all census and are not in (a). Each critic's own post is in-envelope for the pass that dispatched it, including a Stop 4 retry that posts after the disagreement-map input ceiling. The input id ceiling bounds what the critic may read; it does not exclude that critic's own post from the denominator. Headings already `accept-into-contract` remain in the accepted set. Still-open residual headings persist in the denominator until they receive an explicit take on a successor lean. A retry may add headings. A retry that omits, renames, splits, or merges a still-open heading does not drop the prior heading unless the successor lean cites that prior heading and records the take. Uncited still-open headings remain `disagree` (walkable) and the map is not total. A successor-lean map is total only when every heading in that union has a take. Do not auto-stamp on a partial map.
+- ! Parse classified headings only.
+- ⊗ Stamp when the critic posts zero classified headings (stub / blank). Stop and inform. Do not stamp.
+- ⊗ Treat a footnote-only post as a stub. Stub is zero headings with any of the three class tokens. Footnote-only is a valid census; (a) is empty, so do not auto-stamp.
+- ⊗ Stamp on dispatch-fail. Stop and inform. Do not stamp.
+- ⊗ Use Phase 3 or Stop 5 as operator commands.
+- ⊗ Infer accept-synthesis from looks-good, ok, proceed, or bare **accept**. Looks-good still does not bind.
+- ⊗ Mix walk and retry on the same finding in one turn.
+- ⊗ Auto-post the verified-claims table on a non-empty disagree set.
+
+Walk order for **walk all**: classified findings in order (blocking first, then sharpening, then footnotes — or the critic's numbering). For **walk**: only headings whose successor-lean take is `disagree`. For each: restated critic claim, parent take if it differs, then wait. Each decision is a thread comment (`Accept X` / skip / amend), citing critic comment id and finding heading. Chat is not the record. When the walk ends, parent offers to post a successor lean. The walk is not synthesis. When that successor lean is later total and all `accept-into-contract` over a non-empty classified-finding set AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain, the auto-table + auto-stamp path runs with no extra verb.
+
+## Dual stop
+
+Numbered dual stop (#2442):
+
+- Default critic posts without extra record: 2 (round 1 plus one Stop 4 retry).
+- A third critic only with a recorded why (panel already N≥3, or operator raises the cap for this arc). Otherwise halt.
+- An N=3 panel is permitted three round-1 posts and no default retry. A fourth post requires the operator to raise the cap for this arc and record it.
+- Panels larger than three (N>3) are unaddressed. The variant table permits N≥3; this section names only a third critic.
+- Fingerprint: the set of still-open finding headings/ids on the disagreement map. Two retries in a row with that set unchanged and no new successor lean = same-fingerprint halt.
+- Dispatch failure (no comment posted, spawn died) is a separate halt. It does not spend a retry slot. Stop and inform. Do not stamp.
+
+### Audited residuals (panel bookkeeping)
+
+These are not rules. They record open protocol questions with the working default one arc used. A parent that leans on any of them MUST carry an audit marker (`## Parent-side substantiation`).
+
+- **Round-3+ ceiling.** The round-1 and round-2 ceiling rules cover those rounds. Stop 4 pins a retry to the disagreement-map comment. Round 3 and later have no stated ceiling. *Working default:* the most recent parent artifact that supersedes the map.
+- **Amendment supersession.** The round-2 ceiling is the disagreement-map comment. An amendment that supersedes a stale map has been used as the ceiling instead. *Working default:* that amendment becomes the ceiling.
+- **Pass-4 accounting.** Where the optional pass-4 synthesis audit counts against the budget is unaddressed. At N=3 it would be a fifth post. *Working default:* both panel arcs declined it.
+- **Parallel fingerprint.** The halt fingerprint is the still-open headings on the disagreement map. Parallel critics merge into one map. The same-fingerprint halt assumes sequential retries against a stable finding set and is untested with a panel. *Working default:* the merged map.
+
+## Halt line
+
+At dual-stop halt (cap, same-fingerprint, or dispatch-fail), parent posts:
+
+```text
+design-critique: halted, because …
+```
+
+Presence, shape, and authority only. Do not score the because-clause.
+
+- ⊗ Add a `design-critique:halted` issue label.
+- ! Resume after halt is a new operator verb, not a silent retry.
 
 ## Stop 5 — Verified synthesis
 
 ### Synthesis format
 
-Post a verified-claims table. Each quantitative row names its method.
+On the #3640 all-accept path, parent auto-posts the verified-claims table as its own comment (`role: parent`). On a non-empty disagree set, parent does not auto-post the table. Each quantitative row names its method.
 
+- ! Synthesis comments start with the same first-two-lines (`model: <slug>` then `role: parent`).
+- ! #3640 auto-posted verified-claims table and synthesis-accepted comments use `role: parent`.
 - ! Put a method column in every verified-claims table.
 - ! Decorrelation: a row whose only evidence is prior critics' agreement MUST NOT be marked verified. Require primary-source re-derivation or a cross-family re-check.
 - ! Method-reconciliation: when verifying, upholding, or issuing any verdict that a measurement or count claim is false, first reproduce the original claimant's method. A different number under a different method is a discrepancy to explain, not a refutation.
@@ -82,9 +307,38 @@ Post a verified-claims table. Each quantitative row names its method.
 
 Distinguish measured evidence from endorsed evidence. Same-family agreement is correlated, not confirmatory.
 
+## Bind after accepted synthesis
+
+Two bind paths authorize:
+
+```text
+design-critique: synthesis accepted, because …
+```
+
+1. #3640 auto-stamp: when the successor lean map is total over the auto-stamp denominator (critic posts in this arc, including Stop 4 retry output, plus still-open residual headings) and that set is non-empty and every heading is `accept-into-contract` AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain, parent posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip to `design-critique:triage-ready` via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. Do not print **accept synthesis**. Do not auto-stamp on a partial map, an unconfirmed parent draft, or when any audit marker is unresolved, or while same-round siblings remain unposted.
+2. Explicit operator **accept synthesis** (or a listed short form). Parent may post that line and cite the verb. Then apply `design-critique:triage-ready` as the exclusive catalog chip via remaining-set write.
+
+Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight, gate match) and `design-critique:triage-ready` (bound). No halt chip.
+
+- ! Exclusive replace is one merged remaining-set write: GET current labels, drop the other catalog names (`design-critique:mechanism-shaped` and `design-critique:triage-ready`), PUT/PATCH that list with the new chip. Other facets stay. Parent write path: `task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped [--repo OWNER/NAME]` (`deft scm issue design-critique-chip` dual-invoke). The verb GET-drops via `applyDesignCritiqueCatalogChip` / `designCritiqueChipApplyDelta` and one `ScmLabelClient.apply`. Inventory: `LabelClient.apply` / `mergeIssueLabels`.
+- ⊗ `gh api POST .../labels` or additive `scm:issue:edit --add-label` for this facet.
+- ⊗ Intercept mixed `scm issue edit` adds/removes for this facet.
+- ⊗ General-purpose labels CLI.
+- ! After `design-critique:triage-ready`, `triage:accept` / `scope:promote` read the accepted verified synthesis (latest successor lean plus the verified-claims table).
+- ! Keep `plan.policy.judgmentGates` matching only `design-critique:mechanism-shaped`. After `triage-ready` replaces it, the issue leaves the gate match.
+- ! Chip is list-visible state, not consent. Do not drop `mechanism-shaped` without the synthesis-accepted line (or the #3640 empty-disagreement path).
+- ! Write-back `mechanism-shaped: true` is history after replace. Current-state authority is the last catalog chip.
+- ! Recut (new lean) applies `design-critique:mechanism-shaped` with the same remaining-set write and drops `triage-ready`.
+- ~ A live `design-critique:*` count!=1 check is SHOULD, not a new `judgmentGates` match.
+- ⊗ Add `design-critique:triage-ready` to `judgmentGates` labels.any-of.
+- ⊗ Infer consent from looks-good.
+- ⊗ DELETE-then-POST the chip (unchipped window if POST fails).
+- ⊗ PUT a naive full wipe of every label.
+- ⊗ Classify-mirror this facet.
+
 ## Failure and budget stop
 
-- ! Failure/budget stop (#2442): if a critic run fails or the arc exhausts its envelope, halt with an operator-visible report. Do not thrash.
+- ! Failure/budget stop (#2442): Dual stop and Halt line. If a critic run fails or the arc exhausts its envelope, halt with the halt line. Do not thrash.
 
 ## Security context (#480)
 
@@ -97,4 +351,4 @@ This motion ingests untrusted issue threads by design.
 
 ## Test surface
 
-`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content).
+`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the comment-lead field as model then role from the closed set (not an issue label), the operator-gated loop (successor lean, operator verbs including walk / walk all, dual stop, halt line, exclusive remaining-set replace of the two catalog chips, #3640 auto-stamp on a non-empty all-accept map and no-stamp on stubs, first-lean recording obligation after critic EXIT), the parent-side substantiation token and independence rules, the Stop 1 exclusion (pre-critic premises outside the trigger) and `refutation-target:` field tokens rather than full body sentences, the composed auto-bind conjunct (all-accept map AND zero unresolved audit markers) at Operator verbs and Bind path 1, the variant-table evaluation rule (charter selection and spend permission evaluated independently), the critic-method heading and distinctive obligation tokens (exact class tokens, citations-are-claims, existing mechanisms, injection / swarm trigger nouns, failed-reviewer phrase, finding anatomy) rather than full body sentences, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content). `evaluateParentAudit` locks the omission failure modes. This suite locks the SoT MUST and the thin skill pointer for the first-lean recording obligation, including the auto-stamp operator-confirm conjunct and the no-bind-while-unposted-same-round-siblings rule. It does not fail-close live parent turns. Runtime parent-turn detection only if `evaluateParentAudit` is extended; that extension is not required to ship the recording obligation.

package/contracts/issue-eval.md

@@ -0,0 +1,77 @@
+# Issue-eval contract (#3648)
+
+Sole normative source of truth for Stage A issue evaluation: isolated validity, parent WIP census, named gitignored sink, and value advice that must not stamp the reserved design-critique clearance line. The thin skill [`skills/deft-directive-issue-eval/SKILL.md`](../skills/deft-directive-issue-eval/SKILL.md) is a pointer only. The verb is `task triage:evaluate`.
+
+Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
+
+**See also**: [`design-critique.md`](./design-critique.md) (reserved clearance grammar) | [`docs/decisions/ADR-005-design-critique-judgment-gate.md`](../../docs/decisions/ADR-005-design-critique-judgment-gate.md) (gate; not amended here)
+
+Stage B (accept-path default-flip stamp) is not this contract. ⊗ Amend ADR-005 vehicle invariance from this surface.
+
+## Split read sources
+
+! A detached worktree at `origin/master` owns validity and ADR / contract reads.
+
+! The parent on the live working set owns the WIP census: `xbrief/active/`, `xbrief/pending/`, and `plan-sequence`.
+
+! GitHub REST owns open PRs, open issues, and duplicate linkage. Prefer `ghx` for repeated GETs. ⊗ `gh issue view --json` / `gh pr view --json` (GraphQL).
+
+! The evaluator never receives WIP conflict inputs. Parent joins after the evaluator returns.
+
+## Verdict sink
+
+! The parent writes under `.deft-scratch/issue-eval/<sha12>/<invocation-id>/`.
+
+! `<sha12>` is `origin/master` at evaluation start (invalidation key). `<invocation-id>` is a fresh UUID per `triage:evaluate` invocation.
+
+! **No assist posture marker on the CLI parent.** The parent writes after join. The evaluator writes nothing durable.
+
+! Parent tears down evaluator worktrees on success and on failure. Parent MAY GC `<sha12>` directories that are not the current `origin/master`.
+
+⊗ Widen `VALID_DECISIONS` or append a candidates-log row. The audit log is closed and has no SHA field.
+
+⊗ Write under `xbrief/.eval/` (eval-health namespace).
+
+⊗ Use `xbrief/.triage-cache/candidates.jsonl` as the verdict store.
+
+## Evaluator worktrees
+
+! Path: `.deft-scratch/worktrees/issue-eval-<issue>-<invocation-id>` (same layout class as `defaultWorktree`).
+
+! Parent owns `git worktree add --detach` at `origin/master` and `git worktree remove`. The evaluator never creates or removes worktrees.
+
+! Evaluators run `deft session:start --read-only` (never claims occupancy).
+
+⊗ Reuse `swarm:launch` until #3649 lands (create-before-claim occupancy defect).
+
+⊗ Checkout or commit to `origin/master` on the shared working tree.
+
+⊗ Let evaluators read or write the shared working tree.
+
+## Value advice grammar
+
+! Value MAY recommend a critique via a distinct field `critique-recommend:`.
+
+⊗ Emit `design-critique: warranted | not warranted, because …` — that line is the reserved posted clearance shape. The author stamps clearance independently.
+
+## No GitHub writes; existing decisions
+
+! Evaluation writes nothing to GitHub (no comments, labels, or issue edits).
+
+! Operator decisions stay the existing `triage:*` verbs (`accept` / `reject` / `defer` / `needs-ac` / `mark-duplicate`). No new decision verb. No direct `xbrief/proposed/` write.
+
+## Fan-out
+
+! Default **4** parallel evaluators. Override `--concurrency N`. 4 is a bind, not a measured existing cap.
+
+! REST-first reads.
+
+## Acceptance-criterion amendment
+
+The body AC "shared checkout and master untouched" is recut:
+
+! Evaluators never read or write the shared working tree.
+
+! The parent MAY write the named gitignored sink and create the named sibling worktrees.
+
+! `origin/master` is not checked out and not committed to.