@deftai/directive-content 0.107.0 → 0.108.0

package/Taskfile.yml

@@ -738,7 +738,7 @@ tasks:
   #                    tests/cli/test_release_e2e.py
   # Refs #74, #233, #642, #635, #709, #710, #716, #718.
   release:
-    desc: "Automate the v0.X.Y release flow (#74) -- task release -- <version> [--dry-run] [--skip-tag] [--skip-release] [--no-draft]"
+    desc: "Automate the v0.X.Y release flow (#74) -- task release -- <version> [--dry-run] [--skip-tag] [--skip-release] [--no-draft] [--allow-vbrief-drift]"
     deps: [ts:build]
     dir: '{{.USER_WORKING_DIR}}'
     cmds:

package/UPGRADING.md

@@ -8,6 +8,23 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
 <!-- xbrief-backcompat-2111 -->
 
+## Dual policy block recovery (#3609)
+
+- **Applies when:** PROJECT-DEFINITION contains both legacy bare `plan.policy` and namespaced `plan["x-directive/policy"]`. The namespaced block wins reads, so the bare block is shadowed even when one or more values match.
+- **Safe to auto-run:** No. A generic writer cannot know how to combine unrelated keys or resolve collisions without data loss.
+- **Restart required:** No.
+- **Recovery:**
+  1. Run `deft policy:show --field=plan.policy.allowDirectCommitsToMaster` and inspect stderr; the inspector warns but remains read-only and may exit 0.
+  2. Inventory the keys in both blocks.
+  3. Move every bare-only key into `plan["x-directive/policy"]`.
+  4. Resolve every key present in both blocks explicitly.
+  5. Delete bare `plan.policy`.
+  6. Run the selected writer (`deft policy:enforce-branches --actor <actor>` or confirmed `deft policy:allow-direct-commits --confirm --actor <actor>`) and `deft verify:vbrief-conformance --project-root .`.
+
+Policy writers now fail with config exit 2 before changing PROJECT-DEFINITION or the policy audit log while both blocks coexist. Legacy-only projects remain supported: the next policy write migrates the complete legacy block to the namespaced key. For corpus-wide legacy-only cleanup, run `deft migrate:category-b`; it also fails closed on coexistence and is not a dual-block healer. Namespaced-only matching writes remain no-ops.
+
+---
+
 ## npm v12 install-time security defaults
 
 npm v12 flips three install defaults from "on" to opt-in. The same features shipped on **npm 11.16.0+** with warnings so you can migrate before enforcement.
@@ -649,11 +666,13 @@ This complements (does not replace) `deft verify:forward-coverage` (#1310 / #351
 
 ## Node runtime (#1828 / #1530)
 
-After Wave 8, live deft gates run through the TypeScript engine. **Node.js and pnpm are required consumer runtimes** alongside Python (`uv`) — not optional extras for framework contributors only.
+After Wave 8, live deft gates run through the TypeScript engine. **The consumer toolchain probe requires Node.js and the package manager selected by the project (`npm` or `pnpm`).** That probe does not check Python, `uv`, or go-task; session and workflow gates keep their separately documented prerequisites.
 
 - Install **Node 20+** (the framework pins `.nvmrc`; currently Node 24).
-- Enable pnpm via Corepack: `corepack enable && corepack prepare pnpm@latest --activate`
-- Verify from your project root: `task toolchain:check` (or `deft toolchain:check`). When Node or pnpm is missing, the check exits non-zero and prints an actionable remediation line instead of failing later with an opaque stack trace.
+- If `package.json#packageManager` selects npm, use the npm bundled with Node. If it selects pnpm, enable pnpm via Corepack: `corepack enable && corepack prepare pnpm@latest --activate`.
+- Consumer selection precedence is `DEFT_PACKAGE_MANAGER`, `package.json#packageManager`, `pnpm-lock.yaml`, `npm_config_user_agent`, then npm. An explicit unsupported manager fails with a supported-manager diagnostic; its raw value is never executed.
+- Verify from your project root: `deft toolchain:check --consumer --project-root .`. The check probes the selected manager, names the selection source, and prints manager-specific remediation instead of failing later with an opaque stack trace.
+- Framework maintainers still run `task toolchain:check`; that source-repository check remains pnpm-based.
 
 ---
 

package/commands.md

@@ -189,6 +189,20 @@ flowchart TD
 
 ---
 
+## Branch-policy commands (#3609)
+
+Directive exposes the logical field as `plan.policy.allowDirectCommitsToMaster`, but the writer stores it under `plan["x-directive/policy"]`. Use the public commands; do not hand-write bare `plan.policy`:
+
+- Inspect: `deft policy:show --field=plan.policy.allowDirectCommitsToMaster`
+- Enforce feature branches: `deft policy:enforce-branches --actor <actor>`
+- Allow confirmed trunk work: `deft policy:allow-direct-commits --confirm --actor <actor>`
+
+Every policy writer fails with config exit 2 when bare `plan.policy` and namespaced `plan["x-directive/policy"]` coexist, including when their branch values match. Recovery is lossless and manual: inventory both blocks, fold every bare-only key into the namespaced block, explicitly resolve each collision, delete bare `plan.policy`, then rerun the command. The failure writes neither PROJECT-DEFINITION nor `meta/policy-changes.log`.
+
+Legacy-only projects may migrate through the next policy write or through corpus-wide `deft migrate:category-b`. The migration command also fails closed on coexistence; it is not a dual-block healer.
+
+Setup uses these same commands for every interview track. Branch-based is persisted as explicit `false` unless the operator passes the trunk capability-cost confirmation; before reporting Phase 2 complete, setup reads the selected boolean back, confirms bare `plan.policy` is absent, and runs `deft verify:vbrief-conformance --project-root .`.
+
 ## Default-branch sync (`scm:sync-default`, #3391)
 
 Open dest-targeted sync PRs from typed `baseBranch` to `deliveryBranch`. Consumes the shared detector (#3388) and `syncMaxFiles` (#3390).
@@ -292,6 +306,7 @@ Current status: the validation, extractor, provider, registry, generated MAP, an
 - `task verify:cache-fresh` -- validate cache freshness where required.
 - `task verify:capacity`, `task verify:wip-cap`, and `task verify:judgment-gates` -- policy/capacity gates.
 - `task verify:orphan-active` -- fail closed when active/running xBRIEFs still point at closed issues or merged PRs (#2321). After merge, `task verify:orphan-active -- --issue N` scans briefs that reference that issue. Confirmed shipped prints `task scope:complete -- <path>`; unresolved lookup prints a retry remediation and still exits 1 (#3429). PR-only briefs stay on the unscoped scan or `task swarm:complete-cohort`.
+- `task verify:pr-closeout-attestable -- --pr N` -- fail closed when merging PR `N` would close an issue whose brief is still `running` in `xbrief/active/` with acceptance criteria carrying neither `x-directive/evidence` nor `x-directive/disposition` (#3781). The trigger is the PR's structured closing references, **not** the branch diff: CI runs before the merge and the issue closes on it, so a diff-keyed gate can never fail the PR that creates the orphan, and the brief need not be in the diff at all. Reuses `evaluateAcceptanceEvidenceGate`, the same rule `scope:complete` enforces. The refusal names each unattested criterion and the exact shape it needs, narrowed to the evidence kinds that criterion's axis allows. A PR that leaves an unattested brief **without** closing its issue is unaffected. Reads the working tree at `--project-root`, which at merge time is the PR head checkout. Matching is repository-qualified and case-insensitive on the owner/repo slug: closing references are scoped to the PR's repository, so a same-numbered issue tracked by a brief in another repository cannot block the merge, a mixed-case slug for this repository still matches, and a bare tracking number reads as this repository. Three-state exit (0 attestable or closes nothing / 1 unattested closeout / 2 config or lookup error) -- an unresolved closing-reference lookup, or an unresolvable OWNER/REPO, is 2, never a pass. `task pr:wait-mergeable-and-merge` runs it as the last gate before the merge call.
 - `task verify:lifecycle-visible` -- warn when a clone's ignore configuration hides `xbrief/` / `vbrief/` lifecycle roots (#3505). Uses `git check-ignore -v` on the stage dirs, a matching-extension sentinel under each, and bounded probes derived from ignore-rule globs in root, exclude, `core.excludesFile`, and nested lifecycle `.gitignore` files (so `2026-06-*.xbrief.json` / `2025-*.xbrief.json` cannot report clean), plus `git ls-files -v` for skip-worktree / assume-unchanged. Names the matching rule and source file. Warn-first from `session:start` (per-clone, not on `task check`). Selective `.triage-cache/*.jsonl` entries do not trip. Pass `--enforce` to fail closed.
 - `task verify:completed-write-guard` -- fail closed when a newly added `xbrief/completed/` (or `vbrief/completed/`) artifact was not written by `scope:complete` / `scope:fail` (#3679). Artifacts larger than 1 MiB fail closed before read. Historical corpus is advisory via doctor. Remediation names the leftover land PR after a scope-provenance strip (#3476). `scope:complete` can stamp a brief already in `completed/`. Does not change `verify:completed-tracked`.
 - `task verify:completed-tracked` -- fail closed when closed scoped issues lack a tracked `xbrief/completed/` or `xbrief/cancelled/` artifact on the delivery tip (#3264 / #3476); remediate with `task swarm:finalize-cohort` or a lifecycle PR. `task verify:completed-tracked -- --issue N` is the drive-to DONE form (delivery tip `origin/<deliveryBranch>`, not feature HEAD). Standalone verb (not part of `task check`); use `--tip HEAD` when validating an in-flight land branch. An unresolvable delivery tip fails closed (no silent HEAD fallback) -- fetch the delivery branch or pass an explicit `--tip`. Under `--skip-gh`, a named `--issue` with no cached state fails closed; the unscoped corpus scan keeps the offline allowance. Lifecycle-only lands (completed/cancelled xBRIEFs + optional CHANGELOG) use that verb plus finalize-cohort or the lifecycle PR. ⊗ Full `task check` / the TypeScript suite. ⊗ The drive-to story envelope (pre-pr + review-cycle + suite) for a file-copy land.
@@ -324,7 +339,7 @@ task pr:finish-loop -- <N>          # after a PR is open
 
 When the workflow needs an Approach 1 monitor, scope the Cursor leaf `stop-at: pr-open`. The orchestrator that owns the Task primitive must spawn the sibling review-monitor and claim the PR-anchored lease with `task review-monitor:register -- --pr <N> --monitor-agent-id <id> --platform-primitive cursor-task`; `task verify:review-monitor -- --pr <N>` remains the fail-closed proof of active GitHub ownership (sticky `<!-- deft:review-owner -->` comment — not local JSON). Release with `task review-monitor:release -- --pr <N>` when done. Owner Continuity / L4 handoff gate (#3090): `task verify:l4-owner -- --pr <N>` (or `deft verify:l4-owner --pr <N>`) exits 0 only when a sticky lease is fresh or `--review-cycle done` after Step 6; freeform `started`/`pending` is rejected. See `skills/deft-directive-review-cycle/SKILL.md` Owner Continuity Gate + Review Monitoring and `skills/deft-directive-swarm/SKILL.md` Phase 3.
 
-**Worker liveness (#2824):** For in-flight `drive-to: merge*` Cursor leaves, monitors run `task verify:subagent-alive -- --require-agent <agent-id> [--scratch-dir <worktree>/.deft-scratch/subagent-status]` each poll iteration. Exit `1` prints `REDISPATCH_OK` — authorize takeover when the host still reports running but heartbeats are missing/STALE. Raw heartbeat sweep: `task agent:monitor`. See `docs/subagent-heartbeat.md` § Cursor false-alive.
+**Worker liveness (#2824 / #3730):** For in-flight `drive-to: merge*` Cursor leaves, monitors run `task verify:subagent-alive -- --require-agent <agent-id> [--scratch-dir <worktree>/.deft-scratch/subagent-status]` each poll iteration. Exit `1` prints `REDISPATCH_OK` — authorize takeover when the host still reports running but heartbeats are missing/STALE. Takeover is `task swarm:pre-dispatch -- --action cancel` then begin; a killed worker stays `running` until that cancel. If gated ritual verify fails, run `session:start --rearm --session-id=<same>` first. Raw heartbeat sweep: `task agent:monitor`. See `docs/subagent-heartbeat.md` § Cursor false-alive.
 
 ### Agent-host direct-write hooks (#2438, #2596)
 
@@ -396,7 +411,14 @@ After CLI/deposit upgrade, disk can show the new generation while a long-lived s
 - ! **USER.md path (#2544):** resolve via `deft session:start` output (`USER.md resolved …`); default platform paths: Windows `%APPDATA%\deft\USER.md`, Unix `~/.config/deft/USER.md`; override `$DEFT_USER_PATH`; workspace `<project>/.deft/USER.md`. ⊗ Invent or search `~/.config/deft` on Windows — AppData Roaming is canonical.
 - ! At mutation boundaries (code-writing, scope lifecycle moves, `start_agent`, commits, pushes, PR-from-local-changes, release work): run the mutable quick tier then gated verifier below before proceeding.
 - ? Explicit read-only alignment only: `deft session:start -- --read-only` (no ritual-state write).
-- ! **Worktree occupancy (#3433 / #3604):** mutation `session:start` / `session:ready` claim a gitignored `.deft/occupancy.json` lease. A second mutation session on the same tree with a different `DEFT_SESSION_ID` fails closed (occupant id, intent, heartbeat age + remediation). Same-session re-arm heartbeats and keeps that id — it does not mint a new UUID. Steal with `occupancy:steal --confirm --occupant <id>` (or `session:start --steal --confirm --occupant <id>`); steal stays confirm-gated for a **live** occupant and may print existing `claimed_at` / `heartbeat_at`. The occupant drops a live lease with `occupancy:release` or `session:end`; a non-owner cannot clear a live lease. Expired heartbeat (20 min) is free (claim-over-expired); leftover files after TTL are residue, not a blocked entry path, and the same release path may clear them. No `reap` verb. `--read-only` does not claim. Join (`occupancy:request`) is named in the remediation only. `swarm:launch` persists `occupancy_session_id` in a cohort-keyed record; close-out must use that cohort's entry (or `DEFT_SESSION_ID`), never a slot another launch can overwrite and never the live lease file. Swarm close-out stays `releaseSwarmOccupancy` on complete-cohort.
+- ! **Worktree occupancy contract (#3433 / #3604 / #3611):** mutation `session:start` / `session:ready` claim a gitignored `.deft/occupancy.json` lease. Occupancy is cooperative host-session routing between processes that follow the protocol, not authentication against another same-user process: hook JSON and local owner IDs are forgeable. Name it for what it is (#3755): a **cooperative bearer-id boundary, not a lineage** — the lease admits whoever presents an id the record itself names, nothing observes parentage, and a dispatched child is admitted only because a grant records it. A live lease allows only a matching presented owner or member and a ritual state whose exact verified owner agrees; missing, conflicting, or mismatched identity fails closed. `--read-only` does not claim.
+- ! **Host owner namespaces (#3611):** canonical owners are `host:<provider>:v1:<base64url(raw-id)>`. Codex uses payload `session_id` for the parent and its subagents. Claude Code uses `session_id`; `agent_id` does not replace the session-family owner. Cursor uses `conversation_id` and requires a simultaneously supplied `session_id` to agree; no Cursor subagent-granularity claim is made until verified. Grok has no assumed payload identity and retains explicit `--session-id` / `DEFT_SESSION_ID` ownership.
+- ! **Lifecycle identity transport (#3611):** for Codex, Claude, and Cursor, PreToolUse rewrites only exact, simple canonical `deft` / `directive` lifecycle commands and source-repo `task <verb> [-- ...]` forms to add the host's `--session-id`. Direct CLI spellings are `session:start`, `session:ready`, `session:end`, `occupancy:steal`, `occupancy:release`, `occupancy:heartbeat`, and `swarm-launch`; the Task spelling for the last verb is `swarm:launch`. For owner-requiring lifecycle commands, the shell execution directory must be absent or realpath-align exactly with the hook project root. Path-bearing executables (`./deft`, `/path/deft`), path/destination flags (`--project-root`, `--paths`, path-valued `--stories`, `--output`, `--worktree-map`, `--gate-clearances`), `--no-audit`, consumer-repo Task indirection, Task aliases (`task deft:<verb>`), and compound, redirected, quoted, aliased, wrapped, or otherwise ambiguous forms are not auto-rewritten. A supported-host hook rejects a recognized lifecycle form outside the narrow rewrite surface until it carries the explicit matching `--session-id`; an execution-root mismatch on an owner-requiring command always denies. With a matching ID on other excluded forms, the original command remains under normal host permission handling. Manual/integrated-terminal callers must likewise pass one matching `--session-id` (or `DEFT_SESSION_ID`) through the complete lifecycle.
+- ! **Transition, steal, and release (#3611):** an existing live UUID lease cannot silently become a host-namespaced owner. Prefer one aligned transition: `session:start --steal --confirm --occupant <reported-session-id> --session-id=<your-session-id>` (an exact host-mediated command receives the final option automatically). Bare `occupancy:steal --confirm --occupant <reported-session-id> --session-id=<your-session-id>` changes only the lease; direct writes remain denied unless ritual state already names the new owner. If they differ, align the same writer ID with `session:start --rearm --session-id=<same-session-id>` when re-arm is eligible, or cold `session:start --session-id=<same-session-id>` otherwise. The occupant drops a live lease with `occupancy:release` or `session:end`; a non-owner cannot clear it. Confirmed steal remains required for a live occupant and prints existing `claimed_at` / `heartbeat_at` / `last_write_at` when available.
+- ! **Lease refresh (#3599):** a gated write by the owner re-stamps `heartbeat_at`, so a session that keeps working keeps its lease, up to the absolute age cap below. The re-stamp is floored at a quarter of the TTL to avoid rewriting the lease per event, and it records `last_write_at` separately — `heartbeat_at` moves on any lease touch, `last_write_at` only on a gated product write, which is what tells a would-be stealer that the occupant is mid-work. When the owner's own lease is inside the staleness window (three quarters of the TTL) and the automatic re-stamp could not run, the write gate says so instead of letting the lease lapse silently; a write that did re-stamp stays quiet, because the warning would name a state that write just cleared. A re-stamp blocked by the lock leaves the lease untouched and the gate re-decides against the file on disk: contention alone keeps the rightful owner writing, while a takeover that completed during the wait denies. Long quiet stretches produce no gated write to ride on, so the owner refreshes explicitly with `deft occupancy:heartbeat` (Task: `task occupancy:heartbeat`). Refresh extends a lease the caller already holds — it never claims a free worktree, never takes a foreign lease, and never mints an owner; an unheld lease exits non-zero. Under a supported host the exact command receives the matching `--session-id` automatically; manual and Grok callers pass `--session-id <id>` or `DEFT_SESSION_ID`.
+- ! **Absolute lease age cap (#3599):** a lease is also dead 12 hours after `claimed_at`, whatever its heartbeat says, and no refresh path may extend that — `claimed_at` survives every re-stamp. Occupancy admits whoever presents the occupant's session id, so refresh alone would let any process holding that string keep a worktree forever and disable the crash-recovery reclaim the TTL exists for. The two dead states call for different responses and read differently: a stale heartbeat means refresh sooner; past the cap the tree is no longer held, so the capped holder's own gated writes are **refused** until it re-claims with `session:start --session-id=<your-session-id>` — allowing them would let the very bearer the cap bounds keep mutating a worktree a peer may claim at any moment. A lease that is both stale and capped reads as capped, because refreshing cannot revive it and the stale wording would send the holder somewhere that does not help. A different session is unaffected: taking over an aged-out tree is the reclaim the cap exists to enable. Twelve hours is sized by the stalled owner, not the busy one: refresh keys on writes, so an agent that finishes overnight and waits for its operator stops refreshing while staying legitimate, and 12 hours spans a 23:00 dispatch to a 09:00 handoff while still bounding reclaim inside a day. Reaching the cap costs one re-claim, never the work. A time cap cannot tell a stalled-but-live owner from a dead one — the only liveness signal on this path is a write; if that bites, the answer is a write-free liveness signal (explicit parked state, or refresh on non-write activity), not a larger number.
+- ! **Lease membership (#3755):** the occupant admits a dispatched child with `deft occupancy:grant --session-id=<owner> --child-session-id=<child> --role <worker-role> [--ttl-minutes N] [--worktree <path>] [--host <id>] [--address <name>] [--join-protocol none|heartbeat-file|parent-message]` (Task: `task occupancy:grant`), and withdraws it with the same command plus `--revoke`. The grant records owner id, child id, worktree, role and expiry, so a write resolves to a session rather than to whoever held the string. Admission splits: **writes** are admitted for the owner **or** a valid unexpired member; **release, steal, heartbeat and cohort close-out stay owner-only**, so a grant never escalates into the lease itself. An expired grant is refused on read, expiry is clamped to the lease's own absolute age cap, a lease carries at most 32 live grants, and a steal or a fresh claim starts with none — grants belong to the lease that issued them. A member's write re-stamps `heartbeat_at` and `last_write_at` on the same quarter-TTL floor as the owner's: a tree a granted child is actively writing is in use, and letting it lapse would hand the worktree to a peer mid-edit. `claimed_at` is untouched, so the absolute age cap and the grant's own expiry still bound it. The verb is outside the narrow rewrite surface above, so pass `--session-id` (or `DEFT_SESSION_ID`) explicitly. All of it is cooperative, like the rest of this lease: it names who may write, it does not authenticate them. Ritual state stays single-owner, so a member writes under the occupant's ceremony: the composite hook write gate measures the verified ritual owner against the occupant that issued the grant rather than against the writer, and a revoked or expired member is refused there as well.
+- ! **Lifetime and enforcement boundaries:** expired heartbeat (20 min) is free for claim-over-expired, and the release path may clear residue; no `reap` verb. No host-to-lease map or credential file is persisted; supported hooks re-derive their owner from each payload. Gated writes renew the heartbeat (#3599), so the 20-minute window runs from the owner's last write rather than from its claim, bounded by the absolute age cap above. Missing or drifted hooks remain #3742, and spawn tools remain outside occupancy enforcement. Join negotiation is owner-issued membership (`occupancy:grant`, #3755); the parked child-initiated `occupancy:request` queue stays unimplemented and is no longer named in remediation. `swarm:launch` carries the same explicit owner and persists `occupancy_session_id` in a cohort-keyed record; close-out uses that cohort entry as authority, requires any ambient owner to corroborate it, and never substitutes the current live lease owner. Swarm close-out stays `releaseSwarmOccupancy` on complete-cohort.
 - ~ Operators MAY still explicitly request full `deft session:start`, `deft triage:welcome`, sync, or doctor in read-only sessions.
 
 ### Assist / research posture (#1802)

package/contracts/design-critique.md

@@ -13,6 +13,23 @@ This contract scaffolds the motion. Only the ADR-005 judgment gate and the conte
 - ⊗ Pin this contract or `skills/deft-directive-design-critique` into `templates/agents-entry.md` or the AGENTS.md always-pin list. Discovery is on-demand via the Skills Index.
 - ⊗ Auto-dispatch critics from this contract (#3578 / #1702). Operator (or parent after an operator verb) dispatches the next envelope from the brief template.
 
+### The arc
+
+**An arc is one recorded motion over one target revision**, from the Stop 1 write-back (or a voluntary dispatch) through accepted synthesis or the halt line. It holds one or more rounds, and therefore one or more ceilings. An arc is per-target, not per-issue: one issue carries several arcs over time, and one arc can span several issues.
+
+The target is what the arc critiques. Under a refutation charter it is the recorded `refutation-target:`. Open critique names no refutation target, so the target there is the scope the write-back records. `### Target shape` describes the shapes that scope has taken.
+
+Boundaries are read off the machinery in this document, not asserted here.
+
+- A round takes a new ceiling. The converse does not hold: Amendment supersession under `### Audited residuals (panel bookkeeping)` records an amendment adopted as the ceiling **inside** round 2. Neither event opens an arc.
+- Rounds accumulate inside one arc. The auto-stamp denominator is scoped to critic posts in this arc and keeps a Stop 4 retry's post, so a retry continues the arc it retries.
+- Same-round siblings share one ceiling and one panel-deposit. A panel is one round, not N arcs.
+- The arc stays open through the operator-gated loop until a verified synthesis is accepted, or until the halt line. Successor leans are moves inside that loop, so revising a lean before bind is not a boundary.
+- A **recut** opens the next arc, and only after bind: it re-applies `design-critique:mechanism-shaped`, drops `design-critique:triage-ready`, and its new lean is not cleared by the older completed-arc record. That is a post-bind target revision.
+
+- ! Read `arc` in this document as that unit.
+- ⊗ Read a new ceiling, a new round, or a pre-bind lean revision as a new arc.
+
 ## Stop 1 — Gate
 
 ADR-005 is vehicle-invariant. The gate never computes "is this triage mechanism-shaped."
@@ -65,6 +82,26 @@ Charter selection and spend permission are evaluated independently.
 
 Default motion after a mechanism-shaped stamp: N=1 fresh open critique. If residual remains, one reiterating pass with a fresh critic that reads a disagreement map, then verified synthesis. Resume is optional sharpening ("does my prior finding still hold"), not the default reiterating agent. A permitted N≥3 does not change that default; the parent records the spend when it uses the permission.
 
+### Target shape
+
+Charter is what the critic is given. **Target shape is what is being critiqued.** The two are independent axes, and target shape selects neither the charter nor the spend, so it is not a row in either table above.
+
+The default shape is one issue's premise, which every row above assumes. Two other shapes have been run.
+
+| Target shape | The target | Exemplars |
+|---|---|---|
+| set-level | N issues as a remedy portfolio — whether they compose | #3781 / #3783 / #3790 (synthesis 5433848104, open critique); #3797 / #3798 / #3799 (synthesis 5434313019, refutation) |
+| against-implementation | the design together with the diff that already implements it | #3610 with PR #3784 (synthesis 5434122672); #3796 with PR #3793 |
+
+Those pairs are the whole record. Each shape has been run twice, which is not a settled pattern, and neither row grants a charter or a spend. The set-level pair is also the evidence for the axis being orthogonal: the same shape ran once under open critique and once under refutation.
+
+**Set-level.** The arc anchors on one issue and takes its ceiling on that thread. The target is the portfolio claim, not any one issue's premise, and disposition is per-issue. The #3781 set arc closed one of the three as dominated and surfaced a fourth issue worth more than any of them.
+
+**Against-implementation.** The implementation already exists, so critics judge the diff alongside the design. Tell them the PR's check status is unsettled, so a green review does not anchor them, and have author responses to earlier findings re-derived rather than accepted. The verdict has two parts — does the target survive, and should the PR merge — and they can differ. On #3610 the target survived 3/3 while the arc struck one acceptance criterion as an already-holding invariant and found two blocking defects a 5/5 review had missed.
+
+- ? Record the target shape on the Stop 2 line when it is not a single issue. Two exemplars do not make it a required field.
+- ⊗ Add a target shape as a charter row or a spend row. It is a third axis, and a row conflates two of them.
+
 ## Stop 3 — Critic envelope
 
 ### Parent-facing dispatch rules
@@ -111,7 +148,7 @@ The envelope is [`templates/design-critique-brief.md`](../templates/design-criti
 Canonical panel-deposit:
 
 ```text
-model: grok-4.6
+model: <your-model-slug>
 role: parent
 
 panel-deposit
@@ -120,14 +157,18 @@ siblings: 3
 input-ceiling: 5390001612
 ```
 
+**Panel completeness is behavioural.** The deposit MUST above, and every sibling-completeness clause in this document, bind the parent. No code observes them. `evaluateCompletedArcRecord` reads a deposit only as evidence that an arc is in flight; it never counts critic posts and never compares a count against `siblings:`. `evaluateParentAudit` carries no round, sibling, or deposit field. Both halves hold: the obligation on the parent is real, and nothing machine-checks it. A parent that binds on a partial panel breaks this contract and no gate will stop it (#3850).
+
 ### Comment lead (model then role)
 
 Comment-lead field. The first two lines of the triage write-back and of every critic, parent, and #3640 auto-posted comment name the LLM and the posting role. Keep the first line as `model: <slug>`. The second line is `role: triage|critic|parent`.
 
+The `model:` line is a self-attestation. Nothing in this repository verifies which model produced a comment; do not treat it as provenance.
+
 Canonical lead:
 
 ```text
-model: grok-4.6
+model: <your-model-slug>
 role: critic
 ```
 
@@ -141,7 +182,7 @@ Closed role set (do not invent chips or extra roles in v1): `role: triage|critic
 
 - ! First line of the triage write-back comment is `model: <slug>`.
 - ! Second line of the triage write-back comment is `role: triage`.
-- ! First line of every critic comment is `model: <slug>` for the model that produced that comment.
+- ! First line of every critic comment is `model: <slug>` naming the model slug the critic self-attests.
 - ! Second line of every critic comment is `role: critic`.
 - ! Same first-two-lines on a Stop 4 retry critic (`role: critic`).
 - ! Same first-two-lines on #3640 auto-posted table / synthesis-accepted comments (`role: parent`).
@@ -151,8 +192,8 @@ Closed role set (do not invent chips or extra roles in v1): `role: triage|critic
 - ⊗ Put role in an issue label (`design-critique:critic`, author/role chips).
 - ⊗ Put a GitHub login, author name, or role name in that lead line in place of the model.
 - ⊗ Replace the model line with a role or GitHub login.
-- ⊗ Infer the model from `verify:routing` or spawn metadata and omit it from the comment.
-- ⊗ Infer role from `verify:routing` or spawn metadata and omit it from the comment.
+- ⊗ Omit the model line. Post `model: <slug>` on the comment; do not substitute a slug inferred from `verify:routing` or spawn metadata.
+- ⊗ Omit the role line. Post `role: triage|critic|parent` on the comment; do not substitute a role inferred from `verify:routing` or spawn metadata.
 
 ## Stop 4 — Residual reiteration
 
@@ -172,11 +213,11 @@ Keep the arc in this contract until a verified synthesis is accepted.
 - ! Operator (or parent after an operator verb) dispatches the next envelope.
 - ! After each critic EXIT, parent posts a successor lean with proposed per-heading takes **before** printing `accept` / `retry differences` / `walk` / `walk all`. That posted lean is the first operator surface. Chat is not the record.
 - ! Operator confirm or amend binds the proposed takes on that posted lean. Binding takes is not synthesis bind and does not stamp `design-critique:triage-ready`.
-- ⊗ Bind synthesis or stamp `design-critique:triage-ready` while a panel-deposit for this round names `siblings:` N and fewer than N critic posts for that round exist. The first lean after one critic EXIT is the take-offer, not the bind.
+- ⊗ Bind synthesis or stamp `design-critique:triage-ready` while same-round siblings remain unposted. The first lean after one critic EXIT is the take-offer, not the bind.
 - ! Later successor leans follow accept-X or walk-end, or land before synthesis. This supersedes #3627's "successor lean only after accept-X" for the first lean after critic EXIT. Later leans may still follow accept-X / walk-end.
 - ⊗ Print `accept` / `retry differences` / `walk` / `walk all` when no successor lean is posted for this critic EXIT. An empty-lean verb menu is a contract miss.
 - ⊗ Auto-dispatch critics (#3578 / #1702).
-- ⊗ Hand the arc to `triage:accept` / `scope:promote` until `design-critique:triage-ready`.
+- ⊗ Hand the arc to `triage:accept` / `scope:promote` until the completed-arc record is present: `design-critique: synthesis accepted, because …` citing the accepted successor lean (and the verified-claims table when posted). Catalog chips (`design-critique:mechanism-shaped` / `design-critique:triage-ready`) are list-visible convenience, not clearance. A lone synthesis-accepted-shaped comment that does not cite an accepted lean does not unblock ingest.
 - ⊗ Stamp `design-critique:triage-ready` at critic-post.
 - ⊗ Add a `design-critique:critic-posted` chip or any author/role chip.
 - ⊗ Critic writes issue labels.
@@ -187,7 +228,7 @@ Keep the arc in this contract until a verified synthesis is accepted.
 After each critic EXIT, parent posts a successor `**Lean:**` comment with proposed per-heading takes. That posted lean is the first operator surface. Later successor leans follow accept-X or walk-end, or land before synthesis.
 
 - ! After critic EXIT, post the successor lean before printing `accept` / `retry differences` / `walk` / `walk all`.
-- ! Operator confirm or amend is what makes those takes bindable. An all-accept draft still goes through this offer. Confirming or amending an all-accept first lean binds those takes. It does not auto-stamp synthesis or `design-critique:triage-ready` while same-round siblings named on the panel-deposit remain unposted.
+- ! Operator confirm or amend is what makes those takes bindable. An all-accept draft still goes through this offer. Confirming or amending an all-accept first lean binds those takes. It does not auto-stamp synthesis or `design-critique:triage-ready` while same-round siblings remain unposted.
 - ! Cite accepted critic ids/headings, the still-open residual, and the write-back or prior lean it supersedes.
 - ! Carry a per-heading take on the successor lean: `accept-into-contract` | `disagree` | `defer`. Defer is not accepted.
 - ! The successor lean is the disposition map. Do not post a third map type.
@@ -219,7 +260,7 @@ audit:<id> sha=<git-sha> pointer=<path:start-end|comment:<id>> reading=measured|
 - ⊗ Mixed-basis laundering: one independently reproduced premise does not clear an unaudited load-bearing one.
 - ! An unresolved marker is residual and blocks verified-synthesis bind.
 - ⊗ Discharge a marker by promising a later pass.
-- ! Auto-bind requires an all-accept disposition map AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain. This conjunct applies at Operator verbs auto-stamp and at Bind after accepted synthesis path 1.
+- ! Auto-bind requires an all-accept disposition map AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings remain. This conjunct applies at Operator verbs auto-stamp and at Bind after accepted synthesis path 1.
 - ! The brief envelope names unresolved marker ids as `audit-targets` (ids only, or `none`). It does not carry parent rationale.
 - ! `evaluateParentAudit` fails closed on a missing token, a silently cleared marker, a parent self-clear, or an envelope that omits a named audit target.
 
@@ -241,9 +282,9 @@ Contract stops stay internal. Parent prints these phrases when they apply. They
 - ! Do not print **retry differences** until residual headings are named on that map.
 - ! Do not skip the first-lean offer because the draft is all-accept.
 - ! Non-empty disagree set: print **walk** / **walk all** / **retry differences** / **accept**. Walk is an option, not the only path. Do not auto-start the walk.
-- ! When the successor lean's per-heading map is total over a **non-empty** in-envelope classified-finding set, every heading is `accept-into-contract` (no `disagree`, no `defer`), AND zero unresolved audit markers, AND the operator has confirmed or amended that map, AND no unposted same-round siblings named on the panel-deposit remain: parent auto-posts the verified-claims table as its own comment, then auto-posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. Do not print **accept synthesis**, **post the verified-claims table**, **walk**, or **walk all**.
+- ! When the successor lean's per-heading map is total over a **non-empty** in-envelope classified-finding set, every heading is `accept-into-contract` (no `disagree`, no `defer`), AND zero unresolved audit markers, AND the operator has confirmed or amended that map, AND no unposted same-round siblings remain: parent auto-posts the verified-claims table as its own comment, then auto-posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**, **post the verified-claims table**, **walk**, or **walk all**.
 - ⊗ Auto-stamp a parent-drafted all-accept map that the operator has not confirmed or amended.
-- ⊗ Auto-stamp while a panel-deposit for this round still has unposted siblings.
+- ⊗ Auto-stamp while same-round siblings remain unposted.
 - ⊗ Auto-stamp when any audit marker is unresolved.
 - ! The auto-stamp denominator is the union of (a) classified headings from critic comments posted in this arc and (b) still-open residual headings on the latest successor lean. Classified headings in (a) are blocking and sharpening; footnotes stay in the walk-all census and are not in (a). Each critic's own post is in-envelope for the pass that dispatched it, including a Stop 4 retry that posts after the disagreement-map input ceiling. The input id ceiling bounds what the critic may read; it does not exclude that critic's own post from the denominator. Headings already `accept-into-contract` remain in the accepted set. Still-open residual headings persist in the denominator until they receive an explicit take on a successor lean. A retry may add headings. A retry that omits, renames, splits, or merges a still-open heading does not drop the prior heading unless the successor lean cites that prior heading and records the take. Uncited still-open headings remain `disagree` (walkable) and the map is not total. A successor-lean map is total only when every heading in that union has a take. Do not auto-stamp on a partial map.
 - ! Parse classified headings only.
@@ -255,7 +296,7 @@ Contract stops stay internal. Parent prints these phrases when they apply. They
 - ⊗ Mix walk and retry on the same finding in one turn.
 - ⊗ Auto-post the verified-claims table on a non-empty disagree set.
 
-Walk order for **walk all**: classified findings in order (blocking first, then sharpening, then footnotes — or the critic's numbering). For **walk**: only headings whose successor-lean take is `disagree`. For each: restated critic claim, parent take if it differs, then wait. Each decision is a thread comment (`Accept X` / skip / amend), citing critic comment id and finding heading. Chat is not the record. When the walk ends, parent offers to post a successor lean. The walk is not synthesis. When that successor lean is later total and all `accept-into-contract` over a non-empty classified-finding set AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain, the auto-table + auto-stamp path runs with no extra verb.
+Walk order for **walk all**: classified findings in order (blocking first, then sharpening, then footnotes — or the critic's numbering). For **walk**: only headings whose successor-lean take is `disagree`. For each: restated critic claim, parent take if it differs, then wait. Each decision is a thread comment (`Accept X` / skip / amend), citing critic comment id and finding heading. Chat is not the record. When the walk ends, parent offers to post a successor lean. The walk is not synthesis. When that successor lean is later total and all `accept-into-contract` over a non-empty classified-finding set AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings remain, the auto-table + auto-stamp path runs with no extra verb.
 
 ## Dual stop
 
@@ -315,18 +356,26 @@ Two bind paths authorize:
 design-critique: synthesis accepted, because …
 ```
 
-1. #3640 auto-stamp: when the successor lean map is total over the auto-stamp denominator (critic posts in this arc, including Stop 4 retry output, plus still-open residual headings) and that set is non-empty and every heading is `accept-into-contract` AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings named on the panel-deposit remain, parent posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip to `design-critique:triage-ready` via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. Do not print **accept synthesis**. Do not auto-stamp on a partial map, an unconfirmed parent draft, or when any audit marker is unresolved, or while same-round siblings remain unposted.
-2. Explicit operator **accept synthesis** (or a listed short form). Parent may post that line and cite the verb. Then apply `design-critique:triage-ready` as the exclusive catalog chip via remaining-set write.
+1. #3640 auto-stamp: when the successor lean map is total over the auto-stamp denominator (critic posts in this arc, including Stop 4 retry output, plus still-open residual headings) and that set is non-empty and every heading is `accept-into-contract` AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings remain, parent posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip to `design-critique:triage-ready` via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**. Do not auto-stamp on a partial map, an unconfirmed parent draft, or when any audit marker is unresolved, or while same-round siblings remain unposted.
+2. Explicit operator **accept synthesis** (or a listed short form), subject to the two non-empty refusals below. Parent may post that line and cite the verb. Then apply `design-critique:triage-ready` as the exclusive catalog chip via remaining-set write. If that write misses, continue; do not halt.
 
 Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight, gate match) and `design-critique:triage-ready` (bound). No halt chip.
 
+- ⊗ Bind path 2 when the critic posts zero classified headings (stub / blank). The same refusal path 1 carries at Operator verbs. Stop and inform. Do not stamp.
+- ⊗ Bind path 2 on a footnote-only census. A footnote-only post is a valid census and is not a stub, but denominator set (a) is empty, so it carries no bind at either path.
 - ! Exclusive replace is one merged remaining-set write: GET current labels, drop the other catalog names (`design-critique:mechanism-shaped` and `design-critique:triage-ready`), PUT/PATCH that list with the new chip. Other facets stay. Parent write path: `task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped [--repo OWNER/NAME]` (`deft scm issue design-critique-chip` dual-invoke). The verb GET-drops via `applyDesignCritiqueCatalogChip` / `designCritiqueChipApplyDelta` and one `ScmLabelClient.apply`. Inventory: `LabelClient.apply` / `mergeIssueLabels`.
 - ⊗ `gh api POST .../labels` or additive `scm:issue:edit --add-label` for this facet.
 - ⊗ Intercept mixed `scm issue edit` adds/removes for this facet.
 - ⊗ General-purpose labels CLI.
-- ! After `design-critique:triage-ready`, `triage:accept` / `scope:promote` read the accepted verified synthesis (latest successor lean plus the verified-claims table).
+- ! After the completed-arc record is present, `triage:accept` / `scope:promote` / `issue:ingest` / build may proceed. Any identity may run those verbs. Same-session parent continuation is not required. GitHub Triage on the implementer is not required. They read the accepted verified synthesis (latest successor lean plus the verified-claims table).
+- ! Ingest clearance cites the latest successor lean. An older completed-arc record does not clear a later recut lean. A panel-deposit is in-flight even when the catalog chip missed and no critic has posted.
+- ! The lexical form of that citation, and the requirement that the occurrence be affirmative, are published in `## Citation grammar`. Ingest reads that grammar, not prose intent.
 - ! Keep `plan.policy.judgmentGates` matching only `design-critique:mechanism-shaped`. After `triage-ready` replaces it, the issue leaves the gate match.
 - ! Chip is list-visible state, not consent. Do not drop `mechanism-shaped` without the synthesis-accepted line (or the #3640 empty-disagreement path).
+- ⊗ Treat `design-critique:triage-ready` as ingest clearance.
+- ! Chip apply miss is non-blocking convenience. Do not invent a 403 HTTP parser. Any apply miss is the same miss. Do not use the halt line. Do not block ingest. Optional later remaining-set by a write-capable identity is hygiene.
+- ! Leftover `design-critique:mechanism-shaped` after a chip apply miss does not block ingest. `judgmentGates` match is advisory/observe.
+- ⊗ Use the halt line for a chip apply miss.
 - ! Write-back `mechanism-shaped: true` is history after replace. Current-state authority is the last catalog chip.
 - ! Recut (new lean) applies `design-critique:mechanism-shaped` with the same remaining-set write and drops `triage-ready`.
 - ~ A live `design-critique:*` count!=1 check is SHOULD, not a new `judgmentGates` match.
@@ -336,6 +385,58 @@ Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight,
 - ⊗ PUT a naive full wipe of every label.
 - ⊗ Classify-mirror this facet.
 
+## Citation grammar
+
+Closed set (#3831). The completed-arc record clears ingest only when a citation matches an accepted form **and** the occurrence is affirmative. `evaluateCompletedArcRecord` reads both through one parser, `scanCitations` (`packages/core/src/design-critique/citation-grammar.ts`). Nothing else parses citations.
+
+Citation keywords are `successor lean`, `lean`, `verified-claims table`, and `comment`. The id follows the keyword immediately: a colon and horizontal whitespace are the only things allowed between them.
+
+Accepted forms, and nothing else:
+
+1. bare decimal — `successor lean 12345678`
+2. colon, following space optional — `successor lean: 12345678`, `successor lean:12345678`
+3. balanced single-backtick decimal — `` successor lean `12345678` ``
+4. emphasised keyword, `*` or `**`, with either id form — `**successor lean:** 12345678`
+5. canonical comment permalink fragment — `#issuecomment-12345678`
+6. canonical comment permalink path — `/issues/comments/12345678`
+
+- ! Publish a form in this list before the parser accepts it. An unpublished spelling is not a citation.
+- ⊗ Widen the accept set with `.*`, arbitrary decoration, or an open decorator class.
+- ⊗ Accept a bold, italic, underscore, hash-prefixed, parenthesised, quoted, HTML-tagged, or display-text-link id. Those sit outside the closed set, and the refusal names the accepted forms.
+- ⊗ Count every 8-or-more digit run in the body as a citation. Keyword adjacency and the two permalink targets are the whole anchor.
+
+### Position predicate
+
+Accepting an id is not accepting a citation. A match is classified by where it landed, and an occurrence that is not affirmative does not clear:
+
+- inside a fenced code block, including a fence indented up to three spaces — prose that shows the form
+- keyword inside an inline code span, including a span that opened on an earlier line — `` the parser wants `successor lean 12345678` shaped text ``
+- in a blockquote, including an unmarked lazy-continuation line — `> they wrote: successor lean 12345678`
+- struck through — `~~successor lean 12345678~~`
+- explicitly negated within three words of the keyword — `do not use successor lean 12345678`
+
+Those five are the whole refused set. An indented code block and an HTML comment are deliberately outside it: a four-space indent is also ordinary list-continuation content, so refusing it would block valid records more often than it would catch example text. Widening the refused set is a contract change, not an implementation detail.
+
+- ! Classify the position of a match. Prior art is `classifyHit` (`packages/core/src/pr-closing-keywords/detect.ts`), which records where a hit landed.
+- ! Read the enclosing block, not one physical line. A code span, a strikethrough run, and a blockquote all carry across a newline, and they end at the blank line.
+- ! A quote block also ends at a fence delimiter, and a `>` line inside an open fence is example text rather than a marker. A quoted line in a fenced example does not refuse the citation that follows the closing fence.
+- ! The negation form is explicit: `cannot`, `never`, `no longer`, an auxiliary plus `not`, or an auxiliary contraction ending in `n't`, closing within three plain words of the citation keyword and inside the same sentence.
+- ! A negated verb of denial affirms the citation instead of refusing it, because the negation binds the verb and the citation sits in the complement clause. The verb set is closed: `deny`, `doubt`, `dispute`, `contest`, `question`. `we cannot deny that successor lean 12345678 binds` cites.
+- ! That carve-out suspends a negation that already fired; it never refuses on its own, and it does not accept the citation outright. The complement clause carries the claim, so a negation anywhere in the rest of that sentence keeps the refusal: `we do not doubt that successor lean 12345678 does not bind` says the lean does not bind.
+- ⊗ Read a trailing `that` as the complement-clause signal on its own. `that` is also a determiner, so `do not use that successor lean 12345678` and the cleft `the record is not that successor lean 12345678` stay refused, and a second negation before the keyword still binds.
+- ⊗ Refuse on a negation word anywhere in the sentence prefix. `without a doubt, successor lean 12345678 is accepted` and `not only successor lean 12345678 but also the table` are affirmative citations, and refusing them blocks a valid record.
+- ⊗ Strip the span instead. The established markdown scanners delete a code span with its contents, which destroys the digits.
+
+### Which code-span convention governs
+
+The intake cross-ref scanners (`packages/core/src/intake/markdown-scanners.ts`) delete code spans, so for them a backticked id is an example and never a reference. The citation scan takes the opposite polarity for the **id token only**: a balanced single-backtick id is an accepted citation, because arc comments are hand-written prose and the mandated lean heading is itself `**Lean:**`. A keyword inside a code span, and anything inside a fence, stays an example in both layers. The two conventions differ deliberately, and this paragraph is the record of which governs where.
+
+### One parser, set membership, observed diagnostics
+
+- ! Citation extraction and the verified-claims-table claim read the same parse. Two regexes answering one question let a decorated table id waive the table requirement and return `complete` with a null table id.
+- ! Clearance is set membership: the record clears when the cited set contains the latest successor lean id. Position in the body does not select the lean, so citing the prior lean that `## Successor lean` requires cannot block.
+- ! A block detail reports what was scanned, what was found, and the accepted forms. ⊗ Guess at a cause. A guessed detail sends the operator back to re-post the same body and reproduce the refusal.
+
 ## Failure and budget stop
 
 - ! Failure/budget stop (#2442): Dual stop and Halt line. If a critic run fails or the arc exhausts its envelope, halt with the halt line. Do not thrash.
@@ -351,4 +452,4 @@ This motion ingests untrusted issue threads by design.
 
 ## Test surface
 
-`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the comment-lead field as model then role from the closed set (not an issue label), the operator-gated loop (successor lean, operator verbs including walk / walk all, dual stop, halt line, exclusive remaining-set replace of the two catalog chips, #3640 auto-stamp on a non-empty all-accept map and no-stamp on stubs, first-lean recording obligation after critic EXIT), the parent-side substantiation token and independence rules, the Stop 1 exclusion (pre-critic premises outside the trigger) and `refutation-target:` field tokens rather than full body sentences, the composed auto-bind conjunct (all-accept map AND zero unresolved audit markers) at Operator verbs and Bind path 1, the variant-table evaluation rule (charter selection and spend permission evaluated independently), the critic-method heading and distinctive obligation tokens (exact class tokens, citations-are-claims, existing mechanisms, injection / swarm trigger nouns, failed-reviewer phrase, finding anatomy) rather than full body sentences, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content). `evaluateParentAudit` locks the omission failure modes. This suite locks the SoT MUST and the thin skill pointer for the first-lean recording obligation, including the auto-stamp operator-confirm conjunct and the no-bind-while-unposted-same-round-siblings rule. It does not fail-close live parent turns. Runtime parent-turn detection only if `evaluateParentAudit` is extended; that extension is not required to ship the recording obligation.
+`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the comment-lead field as model then role from the closed set (not an issue label), the operator-gated loop (successor lean, operator verbs including walk / walk all, dual stop, halt line, exclusive remaining-set replace of the two catalog chips, #3640 auto-stamp on a non-empty all-accept map and no-stamp on stubs, first-lean recording obligation after critic EXIT), the parent-side substantiation token and independence rules, the Stop 1 exclusion (pre-critic premises outside the trigger) and `refutation-target:` field tokens rather than full body sentences, the composed auto-bind conjunct (all-accept map AND zero unresolved audit markers) at Operator verbs and Bind path 1, the variant-table evaluation rule (charter selection and spend permission evaluated independently), the critic-method heading and distinctive obligation tokens (exact class tokens, citations-are-claims, existing mechanisms, injection / swarm trigger nouns, failed-reviewer phrase, finding anatomy) rather than full body sentences, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content). `evaluateParentAudit` locks the omission failure modes. This suite locks the SoT MUST and the thin skill pointer for the first-lean recording obligation, including the auto-stamp operator-confirm conjunct and the no-bind-while-unposted-same-round-siblings rule. `evaluateCompletedArcRecord` locks ingest on the completed-arc record rather than a catalog chip. It does not fail-close live parent turns. `packages/core/src/design-critique/citation-grammar.test.ts` locks the `## Citation grammar` closed set, the refused positions, and the diagnostics surface; `packages/core/src/design-critique/completed-arc-record.test.ts` locks one parser for both questions, set membership against the latest lean, and the observation-echoing block details (#3831). Runtime parent-turn detection only if `evaluateParentAudit` is extended; that extension is not required to ship the recording obligation. Panel completeness is locked as contract text only. No predicate observes it on a live arc (#3850). `### The arc` and its derived boundaries, the `### Target shape` axis with its twice-run caveat, and the two bind-path-2 non-empty refusals are locked as contract text (#3797).

package/docs/delivery-attempt.md

@@ -102,7 +102,8 @@ task swarm:pre-dispatch -- --scope-id <story|issue|xbrief-id> --target-id <workt
 Default unit key: `scopeId` + `targetId` + `workflowId=drive-to:merge-ready`.
 Actions: `begin` (default), `complete` (`--status succeeded|failed|cancelled|blocked`), `cancel` (takeover step 1).
 Monitors MUST run begin before any peer implement spawn; spawn only on exit 0.
-Takeover: cancel prior attempt, then begin again — never concurrent dual active.
+Takeover after REDISPATCH_OK: cancel prior attempt, then begin again — never concurrent dual active.
+A killed worker stays `queued`/`running` until cancel; REDISPATCH_OK does not lift `DENY_DUPLICATE_ACTIVE` (#3730).
 Implementation: `packages/core/src/swarm/pre-dispatch.ts` + `task swarm:pre-dispatch`.
 
 ## Skill routing

package/docs/freshness-contract.md

@@ -35,10 +35,15 @@ When a mutation `session:start` (cold or re-arm) loads payload surfaces into
 runtime context, it binds the live generation:
 
 ```text
-.deft/session-binds/<safe-session-id>.json   # multi-agent isolation (preferred)
+.deft/session-binds/<sha256-slice>.json      # multi-agent isolation (preferred)
 .deft/session-bind.json                      # default / last-bind convenience
 ```
 
+The per-session record is named by a 24-hex SHA-256 slice of the session id, so
+a directory listing carries no fragment of the id (#3768). Records written
+before that rename also carried a 32-character id prefix; they are read-accepted
+until the next bind supersedes them.
+
 Multi-agent hosts **must** pin session identity so one session cannot certify
 another as current:
 

package/docs/getting-started.md

@@ -16,21 +16,18 @@ Before the mechanics below, it helps to see the whole loop. Directive is two con
 
 ## Prerequisites
 
-- **Node 20+** and **pnpm** for live gates and the npm distribution channel (see `.nvmrc` in the framework payload).
+- **Node 20+** and the package manager declared by the project (`npm` or `pnpm`) for live consumer gates and the npm distribution channel (see `.nvmrc` in the framework payload). npm is bundled with Node; a pnpm-pinned project enables pnpm through Corepack.
+- **Git** and **GitHub CLI (`gh`)** are also checked by the consumer toolchain gate.
 - **Go 1.22+** only if you use the bootstrap Go installer or build from source.
-- **Python 3.11+**, **uv**, **task**, **git**, and **gh** for full framework workflows — run `directive toolchain:check` (or `deft toolchain:check`) after install.
+- **Python 3.11+**, **uv**, and **task** for the framework-maintainer and session workflows that name them. The consumer toolchain probe itself does not check those tools. Run `directive toolchain:check --consumer --project-root .` after install.
 
 ---
 
 ## Installation
 
-### npm (coming soon — not yet published)
+### npm (canonical)
 
-> ⚠️ **The `@deftai/directive` npm package is not yet published** to the registry (provisioning tracked by [#1909](https://github.com/deftai/directive/issues/1909)). **Until it goes live, install via the [Go installer](#go-installer-bootstrap) below.** The commands shown here are what the install will become once the package is published.
-
-<!-- TODO(#1909): flip to npm-canonical and remove this "coming soon" notice when @deftai/directive is published -->
-
-Once published, when Node is already available you will install Directive globally:
+With Node already available, install Directive globally from npm:
 
 ```bash
 npm i -g @deftai/directive
@@ -38,16 +35,18 @@ directive --version    # primary command
 deft --version         # alias — same binary
 ```
 
-One-shot without a global install (also once published):
+One-shot without a global install:
 
 ```bash
 npx @deftai/directive doctor
 npx @deftai/directive session:start
 ```
 
-This npm path is the emerging primary distribution channel under `@deftai/directive` ([#11](https://github.com/deftai/directive/issues/11)); the Go installer below remains the install/bootstrap option today and during the staged retire window.
+This npm path has been the canonical distribution channel since v0.55.1. A pnpm-managed repository can install the same package with `pnpm add -g @deftai/directive` or project-locally with `pnpm add -D @deftai/directive`.
+
+### Go installer (legacy bridge)
 
-### Go installer (bootstrap)
+The Go installer is a frozen legacy bridge for older installs and source-oriented recovery. New consumer installs should use npm above; see [UPGRADING.md](../UPGRADING.md#one-time-migration-from-the-go-installer-legacy--npm) when migrating an existing Go-installer layout.
 
 Download a platform installer from the [Directive release page](https://github.com/deftai/directive/releases) and run it from the project you want to adopt:
 

package/docs/hook-runtime-unavailable.md

@@ -0,0 +1,54 @@
+# Hook runtime unavailable: `deft-hook` is not on PATH
+
+On a host that cannot execute `deft-hook`, the Cursor `preToolUse` registration is `failClosed: true`, so **every mutation is denied** — and because the binary never runs, no Directive code is left to say why. The visible symptom is an opaque non-zero exit, typically **127** (command not found).
+
+Tracker: [#3785](https://github.com/deftai/directive/issues/3785). Related: [#3736](https://github.com/deftai/directive/issues/3736) (timeout), [#3571](https://github.com/deftai/directive/issues/3571) (unused-host recovery), [#2752](https://github.com/deftai/directive/issues/2752) (per-host toggles).
+
+## Who hits this
+
+The registration travels via git; the runtime does not. `.cursor/hooks.json` is trackable by design and the `.deft/core/` deposit is born-ignored, so any environment that gets the repo without a Node install of the CLI inherits the fence without the implementation:
+
+- cloud agent VMs whose image has no Node and no global install
+- CI runners and containers that never run `npm i -g @deftai/directive`
+- a fresh clone on a new workstation
+
+## Recovery is out of band
+
+There is no in-session escape. Run this from a shell where Node and the CLI **are** available — your workstation, or the repo before you push it:
+
+```bash
+deft policy:disable-host-hooks --host cursor --confirm
+```
+
+That sets `plan.policy.hostHooks.cursor = false` in `xbrief/PROJECT-DEFINITION.xbrief.json`, and the next `deft update` strips the Cursor registration. Commit and push; the locked-out environment clears on its next pull or fresh clone.
+
+⚠ Capability cost: disabling `hostHooks` for a host removes `deft-hook` pre-execution guardrails for anyone who later opens this repo in that host. The change is tracked and recorded to `meta/policy-changes.log`. Inspect with `deft policy:show --field=hostHooks`; reverse by setting the host back to `true` and running `deft update`.
+
+## Preferred fix: make the runtime travel with the registration
+
+If Cursor is a host you rely on, restore the runtime rather than removing the fence. Either:
+
+- commit a `package.json` dependency on `@deftai/directive` — a published version or another spec a clone can fetch, since a location spec (`file:`, `link:`, `../directive`, an absolute path) resolves only on the machine that wrote it — and run `npm install` in the image or clone, which puts `deft-hook` in `node_modules/.bin`; or
+- add `npm i -g @deftai/directive` to the image build.
+
+`deft init` and `deft update` warn when a hook registration travels with the repository — already committed, or merely untracked and not ignored, so the next `git add` carries it — while neither anchor is present. The warning names the affected file and this document.
+
+## ⊗ Do not hand-edit `failClosed` in the deposited hook file
+
+Setting `failClosed: false` in `.cursor/hooks.json` clears the block exactly once. That file is a managed deposit: the next `deft update` rewrites the entries with `failClosed: true` and **silently re-arms the lockout**, usually long after anyone remembers editing it. Use the policy verb above, which is durable and tracked.
+
+## Why the flags do not help
+
+| Escape hatch | Why it does not reach this failure |
+|---|---|
+| `.deft-directive-disable` | Evaluated *inside* `deft-hook`. When the binary is missing, nothing reads the flag. |
+| `.no-deft-directive` | Consulted at `session.start` only; it never reaches `preToolUse`. |
+| Host-side "skip hook" | A host concept. Directive has no such bypass. |
+
+## Absent, crashed, and timed out are one class
+
+The hook exit contract already decouples the exit code from the verdict: exit `0` means a decision was **rendered** — allow *or* deny — so every non-zero exit is by construction a *non-decision*. Absence, a crash, and a host timeout kill are the same state, and all three stay fail-closed.
+
+They stay fail-closed because fail-open-on-absence is a bypass primitive, not a lenience: removing the binary is an ordinary shell call, so treating absence as allow would convert a self-inflicted denial into a bypass of the write fence, the intent ceiling, the session ritual, and the occupancy lease ([#3156](https://github.com/deftai/directive/issues/3156)). What these cases need is legibility and an out-of-band escape — this page — not a relaxed fence.
+
+For a timeout specifically, retry the gated ritual first when machine load is the likely cause; the Cursor `tool.before` budget is sized for a gated ritual plus live readiness, so a repeated timeout is a real signal rather than noise.