@deftai/directive-content 0.110.0 → 0.112.0

package/contracts/design-critique.md

@@ -25,7 +25,7 @@ Boundaries are read off the machinery in this document, not asserted here.
 - Rounds accumulate inside one arc. The auto-stamp denominator is scoped to critic posts in this arc and keeps a Stop 4 retry's post, so a retry continues the arc it retries.
 - Same-round siblings share one ceiling and one panel-deposit. A panel is one round, not N arcs.
 - The arc stays open through the operator-gated loop until a verified synthesis is accepted, or until the halt line. Successor leans are moves inside that loop, so revising a lean before bind is not a boundary.
-- A **recut** opens the next arc, and only after bind: it re-applies `design-critique:mechanism-shaped`, drops `design-critique:triage-ready`, and its new lean is not cleared by the older completed-arc record. That is a post-bind target revision.
+- A **recut** opens the next arc, and only after bind: it re-applies `design-critique:mechanism-shaped`, drops `design-critique:triage-ready` and `design-critique:recut-needed`, and its new lean is not cleared by the older completed-arc record. That is a post-bind target revision.
 
 - ! Read `arc` in this document as that unit.
 - ⊗ Read a new ceiling, a new round, or a pre-bind lean revision as a new arc.
@@ -47,6 +47,23 @@ The Stop 1 write-back records `refutation-target:` naming the triage author's hi
 
 `verify:judgment-gates --enforce` stays opt-in unused in this rollout. Advisory observe first. No marker means the gate never fires. Voluntary critiques stay legal.
 
+### Run posture (#4072)
+
+The front door is a session-local run-posture field, not a second ingest switch and not a third occupancy concept. Occupancy mechanics stay on #4020. Cite that rule; do not clone it.
+
+Closed tokens on the operator utterance: `direct`, `directly`, `forge-only`, `github-only`, `github only`, `on github`, `no worktrees` for direct; `checkout` for the mutating checkout path. `parseOperatorRunPosture` (`packages/core/src/design-critique/run-posture.ts`) matches those tokens with word boundaries. `on github` is a location synonym at this Stop 1 front door: `file an issue on github` and `the comments live on github` resolve `direct`. Missing token, including `arc <N> yolo`, asks before Stop 1. Yolo does not pick a mode. `ingest` is not a front-door mode; that token asks. On grok-bot detect, a missing-token ask resolves to `arc-mode:direct` unless checkout tokens already won. `resolveArcRunPostureForHost` consumes `parseOperatorRunPosture`; do not clone the parser. ⊗ Substring or NLP classification. ⊗ Front-door mode `ingest`. ⊗ A yolo default-direct. ⊗ Default-direct without grok-bot detect. ⊗ An `arc N` proximity check on `on github`.
+
+Record `arc-mode: direct` or `arc-mode: checkout` on the Stop 1 write-back. `evaluateDirectDispatch` is a fixture over parent-claimed actions, not a live occupancy observer.
+
+- ! Record `arc-mode:` on the Stop 1 write-back before any mutation-capable session start.
+- ! Direct means `session:start --read-only`, or an explicit occupancy release if a mutation lease is already held.
+- ! Recognition of `direct` happens before mutation initialization. Refuse direct when mutation `session:start` has already occurred, unless the lease is released first.
+- ! Direct posting path that survives a foreign lease: `gh issue comment --body-file -` (stdin). Least-authority envelope: bounded GitHub reads and one comment post.
+- ! Direct N>1 process-only critics are not swarm Phase 2 and not a #4066 mutating worker. Family CLIs still spawn. ⊗ `git worktree add`. Pin reads to `git show <dispatch-sha>:` against the recorded SHA. ⊗ A moving branch ref.
+- ! Direct EXIT names ingest as a later operator verb after the completed-arc record. ⊗ Auto-ingest.
+- ⊗ Treat `arc-mode:` as ingest clearance or as a permanent ingest denial.
+- ⊗ Record a front-door mode named `ingest`.
+
 ## Stop 2 — Variant selection
 
 Record one line per arc: the **charter** (`refutation` | `open critique`), the **spend** (`N=1`, or `N≥3` when the permission is used), and why.
@@ -172,7 +189,7 @@ seat: codex launcher: codex
 
 - ! For spend N≥3, the panel-deposit or a sibling-seat record names three claimed families before the first sibling spawn. Parent claims the family at dispatch. ⊗ Classify family from a model slug.
 - ! A same-family sibling set is not a panel. ⊗ Lean it. Printed recovery is re-seat (or halt), not wait for Stop 5.
-- ! Grok Build launcher tree: Grok seat via `spawn_subagent` (or `grok`); Claude seat via `claude` CLI; Codex seat via `codex exec`. Worktree isolation before each spawn. Probe `claude` / `codex` on PATH before offering paste-ready. Paste-ready is the fallback when a named family's CLI is absent. Close stdin on CLI spawns (Windows `cmd /c "… <nul"`; Unix `… </dev/null`). Pointer: [`docs/grok-build-subscription-setup.md`](../docs/grok-build-subscription-setup.md).
+- ! Grok Build launcher tree: Grok seat via `spawn_subagent` (or `grok`); Claude seat via `claude` CLI; Codex seat via `codex exec`. Worktree isolation before each spawn unless `arc-mode: direct`. Probe `claude` / `codex` on PATH before offering paste-ready. Paste-ready is the fallback when a named family's CLI is absent. Close stdin on CLI spawns (Windows `cmd /c "… <nul"`; Unix `… </dev/null`). Pointer: [`docs/grok-build-subscription-setup.md`](../docs/grok-build-subscription-setup.md).
 - ! `evaluatePanelSeatComposition` (`packages/core/src/design-critique/panel-seat-families.ts`) refuses a same-family N≥3 set and refuses paste-ready-first when `claude` / `codex` resolve. It takes claimed families and PATH probe results. It does not observe live comments and does not count siblings.
 - ! After a dispatch-composition miss, offer a prevention issue. On yolo, file it. ⊗ Only re-seat.
 
@@ -237,8 +254,9 @@ Keep the arc in this contract until a verified synthesis is accepted.
 - ⊗ Print `accept` / `retry differences` / `walk` / `walk all` when no successor lean is posted for this round. An empty-lean verb menu is a contract miss.
 - ! The halt line remains postable while same-round siblings remain unposted. An unposted sibling with no dispatch-fail evidence is Dual stop envelope exhaustion.
 - ⊗ Auto-dispatch critics (#3578 / #1702).
-- ⊗ Hand the arc to `triage:accept` / `scope:promote` until the completed-arc record is present: `design-critique: synthesis accepted, because …` citing the accepted successor lean (and the verified-claims table when posted). Catalog chips (`design-critique:mechanism-shaped` / `design-critique:triage-ready`) are list-visible convenience, not clearance. A lone synthesis-accepted-shaped comment that does not cite an accepted lean does not unblock ingest.
+- ⊗ Hand the arc to `triage:accept` / `scope:promote` until the completed-arc record is present: `design-critique: synthesis accepted, because …` citing the accepted successor lean (and the verified-claims table when posted). Catalog chips (`design-critique:mechanism-shaped` / `design-critique:triage-ready` / `design-critique:recut-needed`) are list-visible convenience, not clearance. A lone synthesis-accepted-shaped comment that does not cite an accepted lean does not unblock ingest.
 - ⊗ Stamp `design-critique:triage-ready` at critic-post.
+- ⊗ Stamp `design-critique:recut-needed` at critic-post.
 - ⊗ Add a `design-critique:critic-posted` chip or any author/role chip.
 - ⊗ Critic writes issue labels.
 - ⊗ Add a #3607 thread interlock in this contract.
@@ -255,7 +273,9 @@ After this round's same-round siblings are posted, parent posts a successor `**L
 - ! Carry a per-heading take on the successor lean: `accept-into-contract` | `disagree` | `defer`. Defer is not accepted.
 - ! The successor lean is the disposition map. Do not post a third map type.
 - ! The first posted map is an ADR-006 arbitration surface. Record a substantiation token when takes introduce load-bearing premises. Non-self-arbitration applies when the same party authored the triage and the proposed takes.
-- ! Bind synthesis and `design-critique:triage-ready` to the latest successor lean, never a superseded write-back.
+- ! Bind synthesis and the auto-stamp catalog chip (`design-critique:triage-ready` or `design-critique:recut-needed`) to the latest successor lean, never a superseded write-back.
+- ! When the next-build contract is recut (not this body), stamp a Lean-family line-start `Recut:` on that successor lean. Nine spellings: zero to two asterisks counted independently on each side, the same wrapping as `Lean:`. Auto-stamp matches that token through `resolveAutoStampCatalogChip`. It does not parse lean English.
+- ⊗ Classify recut by NLP of the lean.
 - ! Full template (accepted set, residual, supersedes-id, ceiling if retrying) lives only on the successor lean and on a retry disagreement map.
 - ! Walk comments stay slim (model and role lines, Accept X, critic id, heading, decision, and when needed a token plus pointer).
 - ⊗ Edit the ceiling write-back in place.
@@ -361,11 +381,12 @@ Contract stops stay internal. Parent prints these phrases when they apply. They
 **walk** iterates recorded parent-disagree headings (successor-lean take is `disagree`). **walk all** is the census of every classified finding in existing order (blocking then sharpening then footnotes — or the critic's numbering). For one release, `walk findings one at a time` is an alias of **walk all**. Short forms of accept synthesis are valid: `accept synt`, `synt accepted`, `synt approved`, `accept synthesis`, `synthesis accepted`, `synthesis approved`. Same idea for other printed verbs when the short form is unambiguous (`retry` for `retry differences`). If the operator types a bare word that could be either **walk** or **walk all** and only one was offered, map it to the offered one. If ambiguous, parent re-prints the offered phrases and waits.
 
 - ! Print the phrases when they apply. An empty-lean verb menu is a miss.
+- ! Host widgets print only the verbs that apply and MUST end the numbered list with Discuss then Back (#1470 / #1563). `operatorVerbApplySet` is the fixture.
 - ! Do not print **walk** until at least one proposed take on the posted lean is `disagree`.
 - ! Do not print **retry differences** until residual headings are named on that map.
 - ! Do not skip the first-lean offer because the draft is all-accept.
 - ! Non-empty disagree set: print **walk** / **walk all** / **retry differences** / **accept**. Walk is an option, not the only path. Do not auto-start the walk.
-- ! When the successor lean's per-heading map is total over a **non-empty** in-envelope classified-finding set, every heading is `accept-into-contract` (no `disagree`, no `defer`), AND zero unresolved audit markers, AND the operator has confirmed or amended that map, AND no unposted same-round siblings remain: parent auto-posts the verified-claims table as its own comment, then auto-posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**, **post the verified-claims table**, **walk**, or **walk all**.
+- ! When the successor lean's per-heading map is total over a **non-empty** in-envelope classified-finding set, every heading is `accept-into-contract` (no `disagree`, no `defer`), AND zero unresolved audit markers, AND the operator has confirmed or amended that map, AND no unposted same-round siblings remain: parent auto-posts the verified-claims table as its own comment, then auto-posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip recut-needed` when `resolveAutoStampCatalogChip` matches a Lean-family `Recut:` line-start on the latest successor lean, else `--chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**, **post the verified-claims table**, **walk**, or **walk all**.
 - ⊗ Auto-stamp a parent-drafted all-accept map that the operator has not confirmed or amended.
 - ⊗ Auto-stamp while same-round siblings remain unposted.
 - ⊗ Auto-stamp when any audit marker is unresolved.
@@ -456,18 +477,18 @@ Two bind paths authorize:
 design-critique: synthesis accepted, because …
 ```
 
-1. #3640 auto-stamp: when the successor lean map is total over the auto-stamp denominator (critic posts in this arc, including Stop 4 retry output, plus still-open residual headings) and that set is non-empty and every heading is `accept-into-contract` AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings remain, parent posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip to `design-critique:triage-ready` via `task scm:issue:design-critique-chip -- --issue N --chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**. Do not auto-stamp on a partial map, an unconfirmed parent draft, or when any audit marker is unresolved, or while same-round siblings remain unposted.
-2. Explicit operator **accept synthesis** (or a listed short form), subject to the two non-empty refusals below. Parent may post that line and cite the verb. Then apply `design-critique:triage-ready` as the exclusive catalog chip via remaining-set write. If that write misses, continue; do not halt.
+1. #3640 auto-stamp: when the successor lean map is total over the auto-stamp denominator (critic posts in this arc, including Stop 4 retry output, plus still-open residual headings) and that set is non-empty and every heading is `accept-into-contract` AND zero unresolved audit markers AND the operator has confirmed or amended that map AND no unposted same-round siblings remain, parent posts `design-critique: synthesis accepted, because agents agreed (empty disagreement set)` and remaining-set-replaces the chip via `task scm:issue:design-critique-chip -- --issue N --chip recut-needed` when `resolveAutoStampCatalogChip` matches a Lean-family `Recut:` line-start on the latest successor lean, else `--chip triage-ready`. If that write misses, continue; do not halt. Do not print **accept synthesis**. Do not auto-stamp on a partial map, an unconfirmed parent draft, or when any audit marker is unresolved, or while same-round siblings remain unposted.
+2. Explicit operator **accept synthesis** (or a listed short form), subject to the two non-empty refusals below. Parent may post that line and cite the verb. Then apply the exclusive catalog chip `resolveAutoStampCatalogChip` selects (`design-critique:recut-needed` or `design-critique:triage-ready`) via remaining-set write. If that write misses, continue; do not halt.
 
-Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight, gate match) and `design-critique:triage-ready` (bound). No halt chip.
+Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight, gate match), `design-critique:triage-ready` (bound implement), and `design-critique:recut-needed` (bound recut / not this body). No halt chip. `CHIP_ALIASES` in `packages/core/src/scm/design-critique-chip.ts` is the same three names. Unknown `--chip` fails closed.
 
 - ⊗ Bind path 2 when the critic posts zero classified headings (stub / blank). The same refusal path 1 carries at Operator verbs. Stop and inform. Do not stamp.
 - ⊗ Bind path 2 on a footnote-only census. A footnote-only post is a valid census and is not a stub, but denominator set (a) is empty, so it carries no bind at either path.
-- ! Exclusive replace is one merged remaining-set write: GET current labels, drop the other catalog names (`design-critique:mechanism-shaped` and `design-critique:triage-ready`), PUT/PATCH that list with the new chip. Other facets stay. Parent write path: `task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped [--repo OWNER/NAME]` (`deft scm issue design-critique-chip` dual-invoke). The verb GET-drops via `applyDesignCritiqueCatalogChip` / `designCritiqueChipApplyDelta` and one `ScmLabelClient.apply`. Inventory: `LabelClient.apply` / `mergeIssueLabels`.
+- ! Exclusive replace is one merged remaining-set write: GET current labels, drop the other catalog names (`design-critique:mechanism-shaped`, `design-critique:triage-ready`, and `design-critique:recut-needed`), PUT/PATCH that list with the new chip. Other facets stay. Parent write path: `task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped|recut-needed [--repo OWNER/NAME]` (`deft scm issue design-critique-chip` dual-invoke). The verb GET-drops via `applyDesignCritiqueCatalogChip` / `designCritiqueChipApplyDelta` and one `ScmLabelClient.apply`. Inventory: `LabelClient.apply` / `mergeIssueLabels`.
 - ⊗ `gh api POST .../labels` or additive `scm:issue:edit --add-label` for this facet.
 - ⊗ Intercept mixed `scm issue edit` adds/removes for this facet.
 - ⊗ General-purpose labels CLI.
-- ! After the completed-arc record is present, `triage:accept` / `scope:promote` / `issue:ingest` / build may proceed unless `evaluateCompletedArcRecord` returns `cancelled` or `unrecut-body` (#4057). Any identity may run those verbs. Same-session parent continuation is not required. GitHub Triage on the implementer is not required. They read the accepted verified synthesis (latest successor lean plus the verified-claims table).
+- ! After the completed-arc record is present, `triage:accept` / `scope:promote` / `issue:ingest` / build may proceed unless `evaluateCompletedArcRecord` returns `cancelled` or `unrecut-body` (#4057). Any identity may run those verbs. Same-session parent continuation is not required. ⊗ Treat `arc-mode:` as ingest clearance or as a permanent ingest denial. Ingest stays `issue:ingest` after the completed-arc record. Direct EXIT names it as a later operator verb. GitHub Triage on the implementer is not required. They read the accepted verified synthesis (latest successor lean plus the verified-claims table).
 - ! Per-thread body ingest stays the mapper after a set-level bind. Stories the bind wants are recut bodies or newly filed issues. Derived AC stays on that body.
 - ! Un-recut portfolio members fail closed on `cancelled`. Parent posts `design-critique: cancelled, because ...` on that number. Parent `role: parent` dominate prose is not that record. Critic, quoted, or fenced cancel-shaped prose is not that record. Leftover `mechanism-shaped` without cancel stays `missing-record` and is not this control.
 - ! A later successor lean after cancel starts a recut arc. Completing a superseded thread without recut would mint the harvest.
@@ -476,16 +497,18 @@ Closed catalog (last chip wins): `design-critique:mechanism-shaped` (in-flight,
 - ⊗ Put a set-level graph (dominate / split / corpus parsed from comment English) inside ingest.
 - ! Ingest clearance cites the latest successor lean. An older completed-arc record does not clear a later recut lean. A panel-deposit is in-flight even when the catalog chip missed and no critic has posted.
 - ! The lexical form of that citation, and the requirement that the occurrence be affirmative, are published in `## Citation grammar`. Ingest reads that grammar, not prose intent.
-- ! Keep `plan.policy.judgmentGates` matching only `design-critique:mechanism-shaped`. After `triage-ready` replaces it, the issue leaves the gate match.
+- ! Keep `plan.policy.judgmentGates` matching only `design-critique:mechanism-shaped`. After `triage-ready` or `recut-needed` replaces it, the issue leaves the gate match.
 - ! Chip is list-visible state, not consent. Do not drop `mechanism-shaped` without the synthesis-accepted line (or the #3640 empty-disagreement path).
 - ⊗ Treat `design-critique:triage-ready` as ingest clearance.
+- ⊗ Treat `design-critique:recut-needed` as ingest clearance or as a halt chip.
 - ! Chip apply miss is non-blocking convenience. Do not invent a 403 HTTP parser. Any apply miss is the same miss. Do not use the halt line. Do not block ingest. Optional later remaining-set by a write-capable identity is hygiene.
 - ! Leftover `design-critique:mechanism-shaped` after a chip apply miss does not block ingest. `judgmentGates` match is advisory/observe.
 - ⊗ Use the halt line for a chip apply miss.
 - ! Write-back `mechanism-shaped: true` is history after replace. Current-state authority is the last catalog chip.
-- ! Recut (new lean) applies `design-critique:mechanism-shaped` with the same remaining-set write and drops `triage-ready`.
+- ! Recut (new lean) applies `design-critique:mechanism-shaped` with the same remaining-set write and drops `triage-ready` and `recut-needed`.
 - ~ A live `design-critique:*` count!=1 check is SHOULD, not a new `judgmentGates` match.
 - ⊗ Add `design-critique:triage-ready` to `judgmentGates` labels.any-of.
+- ⊗ Add `design-critique:recut-needed` to `judgmentGates` labels.any-of.
 - ⊗ Infer consent from looks-good.
 - ⊗ DELETE-then-POST the chip (unchipped window if POST fails).
 - ⊗ PUT a naive full wipe of every label.
@@ -576,4 +599,4 @@ This motion ingests untrusted issue threads by design.
 
 ## Test surface
 
-`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the comment-lead field as model then role from the closed set (not an issue label), the operator-gated loop (successor lean, operator verbs including walk / walk all, dual stop, halt line, exclusive remaining-set replace of the two catalog chips, #3640 auto-stamp on a non-empty all-accept map and no-stamp on stubs, first-lean recording obligation after this round's siblings are posted), the parent-side substantiation token and independence rules, the Stop 1 exclusion (pre-critic premises outside the trigger) and `refutation-target:` field tokens rather than full body sentences, the composed auto-bind conjunct (all-accept map AND zero unresolved audit markers) at Operator verbs and Bind path 1, the variant-table evaluation rule (charter selection and spend permission evaluated independently), the critic-method heading and distinctive obligation tokens (exact class tokens, citations-are-claims, existing mechanisms, injection / swarm trigger nouns, failed-reviewer phrase, finding anatomy) rather than full body sentences, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content). `evaluateParentAudit` locks the omission failure modes. This suite locks the SoT MUST and the thin skill pointer for the first-lean recording obligation, including the auto-stamp operator-confirm conjunct and the no-bind-while-unposted-same-round-siblings rule. `evaluateCompletedArcRecord` locks ingest on the completed-arc record rather than a catalog chip. It does not fail-close live parent turns. `packages/core/src/design-critique/citation-grammar.test.ts` locks the `## Citation grammar` closed set, the refused positions, and the diagnostics surface; `packages/core/src/design-critique/completed-arc-record.test.ts` locks one parser for both questions, set membership against the latest lean, and the observation-echoing block details (#3831). Runtime parent-turn detection only if `evaluateParentAudit` is extended; that extension is not required to ship the recording obligation. Panel completeness is locked as contract text only. No predicate observes it on a live arc (#3850). `evaluatePanelSeatComposition` locks claimed-family composition and PATH paste-ready-first; it is a fixture over claimed families, not a live sibling-count gate. `### The arc` and its derived boundaries, the `### Target shape` axis with its twice-run caveat, and the two bind-path-2 non-empty refusals are locked as contract text (#3797). `## Plain-language summary` is locked the same way: the contract test pins the heading token, the MUST-not-SHOULD reasoning, the ADR-006 exemption and its limit, the non-normative marking, and the per-artifact reserved line-start matrix, and `packages/core/src/design-critique/reserved-line-starts.test.ts` exercises each of the three families on each artifact kind against the exported shape predicates and `evaluateCompletedArcRecord`. No predicate observes a summary on a live arc (#3929). `### Verified-claims table heading`, the closed reason vocabulary, and the re-measured line-start matrix are locked as contract text, and `completed-arc-record.test.ts` exercises the typed refusal partition: the two states, details that differ by more than the id, the untyped null table id, and the seven recorded live arc table ids (#3942).
+`packages/core/src/content-contracts/standards/design_critique_contract.test.ts` locks required pointer strings, the scaffolds framing, the comment-lead field as model then role from the closed set (not an issue label), the operator-gated loop (successor lean, operator verbs including walk / walk all, dual stop, halt line, exclusive remaining-set replace of the three catalog chips, #3640 auto-stamp on a non-empty all-accept map and no-stamp on stubs, first-lean recording obligation after this round's siblings are posted), the parent-side substantiation token and independence rules, the Stop 1 exclusion (pre-critic premises outside the trigger) and `refutation-target:` field tokens rather than full body sentences, the composed auto-bind conjunct (all-accept map AND zero unresolved audit markers) at Operator verbs and Bind path 1, the variant-table evaluation rule (charter selection and spend permission evaluated independently), the critic-method heading and distinctive obligation tokens (exact class tokens, citations-are-claims, existing mechanisms, injection / swarm trigger nouns, failed-reviewer phrase, finding anatomy) rather than full body sentences, the brief-template forbidden-inputs list, and the thin router skill (existence, line cap, pointer resolution, no-normative-content). `evaluateParentAudit` locks the omission failure modes. This suite locks the SoT MUST and the thin skill pointer for the first-lean recording obligation, including the auto-stamp operator-confirm conjunct and the no-bind-while-unposted-same-round-siblings rule. `evaluateCompletedArcRecord` locks ingest on the completed-arc record rather than a catalog chip. It does not fail-close live parent turns. `packages/core/src/design-critique/citation-grammar.test.ts` locks the `## Citation grammar` closed set, the refused positions, and the diagnostics surface; `packages/core/src/design-critique/completed-arc-record.test.ts` locks one parser for both questions, set membership against the latest lean, and the observation-echoing block details (#3831). Runtime parent-turn detection only if `evaluateParentAudit` is extended; that extension is not required to ship the recording obligation. Panel completeness is locked as contract text only. No predicate observes it on a live arc (#3850). `evaluatePanelSeatComposition` locks claimed-family composition and PATH paste-ready-first; it is a fixture over claimed families, not a live sibling-count gate. `### The arc` and its derived boundaries, the `### Target shape` axis with its twice-run caveat, and the two bind-path-2 non-empty refusals are locked as contract text (#3797). `## Plain-language summary` is locked the same way: the contract test pins the heading token, the MUST-not-SHOULD reasoning, the ADR-006 exemption and its limit, the non-normative marking, and the per-artifact reserved line-start matrix, and `packages/core/src/design-critique/reserved-line-starts.test.ts` exercises each of the three families on each artifact kind against the exported shape predicates and `evaluateCompletedArcRecord`. No predicate observes a summary on a live arc (#3929). `### Verified-claims table heading`, the closed reason vocabulary, and the re-measured line-start matrix are locked as contract text, and `completed-arc-record.test.ts` exercises the typed refusal partition: the two states, details that differ by more than the id, the untyped null table id, and the seven recorded live arc table ids (#3942). `### Run posture` and `parseOperatorRunPosture` / `evaluateDirectDispatch` lock the closed-token front door, the missing-token ask including yolo, the `session:start --read-only` start verb, stdin posting, SHA-pinned reads, and the no-worktree direct panel; `run-posture.test.ts` exercises those fixtures. `evaluateCompletedArcRecord` ignores `arc-mode:` (#4072).

package/conventions/machine-generated-banner.md

@@ -10,7 +10,7 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 ## Why
 
 Before this contract, deft had four machine-managed file writers
-(`task migrate:vbrief` deprecation redirects, `task spec:render`,
+(frozen `task migrate:vbrief` deprecation redirects (v0.59.0; historical), `task spec:render`,
 `task prd:render`, `task roadmap:render`) and each used a different
 (or no) banner convention. Downstream heuristics that distinguish
 "is this file user-customized" from "is this machine-managed" were
@@ -34,7 +34,7 @@ of the file:
 - `{purpose}` — one of the enumerated per-writer purposes below; fixed
   string values so downstream detectors can match on a stable token.
 - `{source}` — the source-of-truth path the writer consumed
-  (typically `vbrief/specification.vbrief.json`), or `n/a` when the
+  (typically `xbrief/specification.xbrief.json`), or `n/a` when the
   writer has no single source-of-truth file (e.g. the migrator
   deprecation redirect, which is driven by the migration flow).
 - `{command}` — the canonical `task *` invocation that regenerates
@@ -49,10 +49,10 @@ of the file:
 The `Purpose:` value is a small fixed enum so detectors can match on a
 stable token. Writers MUST use exactly one of these values:
 
-- `rendered specification` -- `scripts/spec_render.py` -> `SPECIFICATION.md`
-- `rendered PRD` -- `scripts/prd_render.py` -> `PRD.md`
-- `rendered roadmap` -- `scripts/roadmap_render.py` -> `ROADMAP.md`
-- `deprecation redirect` -- `scripts/migrate_vbrief.py::_deprecation_redirect()`
+- `rendered specification` -- `task spec:render` -> `SPECIFICATION.md`
+- `rendered PRD` -- `task prd:render` -> `PRD.md`
+- `rendered roadmap` -- `task roadmap:render` -> `ROADMAP.md`
+- `deprecation redirect` -- frozen `task migrate:vbrief` (v0.59.0; historical)
   -> replaced `SPECIFICATION.md` / `PROJECT.md`
 
 ? Future render tasks added under `tasks/` MUST extend this list before
@@ -61,7 +61,7 @@ contract violation.
 
 ## Detection heuristic (for user-customization guards)
 
-! `scripts/migrate_vbrief.py::_is_user_customized()` consults the
+! Frozen `task migrate:vbrief` (v0.59.0) `_is_user_customized()` consults the
 `_SPEC_AUTO_MARKERS` and `_PROJECT_AUTO_MARKERS` tuples. Both MUST
 include `"AUTO-GENERATED by"` and the FULL HTML-comment prefix
 `"<!-- Purpose:"` so any file carrying this banner is recognised as
@@ -83,13 +83,13 @@ incorrectly re-flagged as pre-cutover on rc.3.
 ```
 <!-- AUTO-GENERATED by task spec:render -- DO NOT EDIT MANUALLY -->
 <!-- Purpose: rendered specification -->
-<!-- Source of truth: vbrief/specification.vbrief.json -->
+<!-- Source of truth: xbrief/specification.xbrief.json -->
 <!-- Regenerate with: task spec:render -->
 # My Project
 ...
 ```
 
-## Example (migrator deprecation redirect)
+## Example (frozen migrator deprecation redirect, v0.59.0; historical)
 
 ```
 <!-- AUTO-GENERATED by task migrate:vbrief -- DO NOT EDIT MANUALLY -->

package/conventions/rule-ownership.json

@@ -252,11 +252,11 @@
     },
     {
       "id": "main-vbrief-persistence",
-      "text": "All vBRIEF files MUST be stored in `./vbrief/` or its lifecycle subfolders",
+      "text": "All xBRIEF files MUST be stored in `./xbrief/` or its lifecycle subfolders",
       "owner_file": "main.md",
-      "owner_section": "## vBRIEF Persistence",
+      "owner_section": "## xBRIEF Persistence",
       "authority": "MUST",
-      "last_verified": "2026-04-28"
+      "last_verified": "2026-09-02"
     },
     {
       "id": "agents-deft-alignment-confirmation",

package/docs/SUPPORT.md

@@ -0,0 +1,43 @@
+# Support and troubleshooting
+
+This page is a **symptom index**. It is not a second recovery ladder.
+
+- If `directive` (or the `deft` alias) will not start, use the [README cold-start](https://github.com/deftai/directive/blob/master/README.md). That committed block is the only payload-independent command ladder.
+- If the CLI runs, start with `directive doctor --full`. Follow its one `Next command:`. Do not pick a competing command from this page.
+
+Doctor caches a clean run for 24 hours and a dirty run for 4 hours. `--full` bypasses that throttle.
+
+Specialist pages below are pointers. Recovery command bytes stay in doctor and the README cold-start.
+
+## Symptom index
+
+| Symptom | Safe diagnostic | Specialist link |
+| --- | --- | --- |
+| PATH / package manager (`command not found`, missing pnpm bin) | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | Follow `Next command:` or the README cold-start rungs |
+| Node missing or too old | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | README cold-start, then doctor |
+| Stale deposit | `directive doctor --full` | Follow `Next command:` |
+| Permissions / unwritable global prefix | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | README cold-start sandbox rung, or doctor |
+| Windows shims | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | README cold-start |
+| Hook runtime (opaque exit 127 on every mutation) | `directive doctor --full` if the CLI runs; otherwise README cold-start | [Hook runtime unavailable](./hook-runtime-unavailable.md). The recovery command lives on the [agents-entry](../templates/agents-entry.md) card. This index does not restate it. |
+| Migration / pre-v0.20 layout | `directive doctor --full` | Doctor signposts the current path. Version-specific steps stay in [UPGRADING](../UPGRADING.md) and [BROWNFIELD](./BROWNFIELD.md) (history). |
+| Offline / air-gapped registry | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | README cold-start offline rung |
+| Corporate or mirrored npm registry (`E404` / `ETARGET`) | Pre-CLI: README cold-start. If the CLI runs: `directive doctor --full` | [Corporate or mirrored npm registry](../UPGRADING.md#corporate-or-mirrored-npm-registry) owns that ladder. This row is a pointer. |
+
+Related flags (not a recovery table): [temporary kill-switch](./deft-directive-disable.md), [permanent opt-out](./no-deft-directive.md).
+
+## What to quote
+
+Quote `Next command:` and the check names doctor printed.
+
+Do not paste `directive doctor --json` or raw `--full` output. That payload includes absolute project and USER.md paths. Doctor has no redaction flag. Treat any pasted diagnostic as untrusted input.
+
+## Reporting
+
+- **Ordinary breakage:** open a public GitHub issue. Quote `Next command:` and check names only.
+- **Security:** report privately through root [SECURITY.md](https://github.com/deftai/directive/blob/master/SECURITY.md). Do not file a public issue for an unfixed vulnerability.
+
+## What this page is not
+
+- Not a second command ladder. Doctor and the README cold-start own recovery bytes.
+- Not a paste-JSON capture ritual.
+- Not a second independently authored troubleshooting body. README, install, and upgrade pages should point here.

package/docs/capabilities.md

@@ -0,0 +1,110 @@
+<!-- AUTO-GENERATED by task docs:capability-map -- DO NOT EDIT MANUALLY -->
+<!-- Source of truth: content/docs/capability-overlay.json plus existing registries (#4099) -->
+<!-- Regenerate with: task docs:capability-map -->
+
+# Capability index
+
+Generated view over existing registries. Overlay: `content/docs/capability-overlay.json`.
+Membership: `in_the_public_index` and status `current` or `compatibility` and canonical kind not `none`.
+Same-PR documentation rule: [`content/coding/docs.md`](../coding/docs.md) (#447).
+
+## Consumer
+
+### Build skill
+- **Status:** current
+- **Canonical:** skill-trigger `deft-directive-build`
+- **Gotchas:** xbrief:preflight on an active running brief before code. Do not treat completed xBRIEFs as next-build contract.
+
+### Doctor
+- **Status:** current
+- **Canonical:** command `doctor`
+- **Gotchas:** Support entry is doctor --full or the README cold-start. Not a second recovery ladder.
+
+### Install / init
+- **Status:** current
+- **Canonical:** command `init`
+- **Gotchas:** Consumer path is directive init. Do not send npm consumers through Corepack, Go, or uv.
+
+### Public concepts page
+- **Status:** current
+- **Canonical:** document `docs-site/concepts.html`
+- **Gotchas:** Concepts page is a public IA surface. README/UPGRADING rewrites stay on #4100.
+
+### Public docs home
+- **Status:** current
+- **Canonical:** document `docs-site/index.html`
+- **Gotchas:** Public IA lives under docs-site/. Do not mix it with maintainer docs/.
+
+### Public gates page
+- **Status:** current
+- **Canonical:** document `docs-site/gates.html`
+- **Gotchas:** task check is the merge chokepoint named here; do not invent a parallel public gate.
+
+### Public install page
+- **Status:** current
+- **Canonical:** document `docs-site/install.html`
+- **Gotchas:** Install copy stays on the consumer Node floor, not the maintainer toolchain pin.
+
+### Public license page
+- **Status:** current
+- **Canonical:** document `docs-site/license.html`
+- **Gotchas:** License page is a docs-site surface, not a substitute for root LICENSE.
+
+### Public upgrade page
+- **Status:** current
+- **Canonical:** document `docs-site/upgrade.html`
+- **Gotchas:** Frozen pre-v0.20 migration stays on the v0.59.0 hop. Current npm uses migrate:xbrief.
+
+### Session start
+- **Status:** current
+- **Canonical:** command `session:start`
+- **Gotchas:** Run before mutation. USER.md Personal wins. Read-only until implementation intent.
+
+### Setup skill
+- **Status:** current
+- **Canonical:** skill-trigger `deft-directive-setup`
+- **Gotchas:** Writes USER.md and PROJECT-DEFINITION. Confirm captured values before write.
+
+### task check
+- **Status:** current
+- **Canonical:** command `check`
+- **Gotchas:** Merge chokepoint. Iteration may use cheaper affected gates; do not skip this before PR.
+
+## Maintainer
+
+### Encoding gate (alias)
+- **Status:** compatibility
+- **Canonical:** command `verify:encoding`
+- **Gotchas:** Alias owner is dispatch.ts VERB_ALIASES. Canonical engine verb is verify-encoding.
+
+### Policy inspector
+- **Status:** current
+- **Canonical:** command `policy:show`
+- **Gotchas:** Read namespaced plan["x-directive/policy"]. Bare plan.policy is a shadowing stop.
+
+### Pre-PR skill
+- **Status:** current
+- **Canonical:** skill-trigger `deft-directive-pre-pr`
+- **Gotchas:** Run before opening a PR. Always-pin process skill; not this capability index.
+
+### Review-cycle skill
+- **Status:** current
+- **Canonical:** skill-trigger `deft-directive-review-cycle`
+- **Gotchas:** Greptile residuals go through this skill. Host babysit/bugbot are advisory-only.
+
+### Rule map
+- **Status:** current
+- **Canonical:** command `docs:rule-map`
+- **Gotchas:** Generated maintainer view. Do not mint a second RULE-MAP. Refresh with task docs:rule-map.
+
+### Swarm skill
+- **Status:** current
+- **Canonical:** skill-trigger `deft-directive-swarm`
+- **Gotchas:** Drive-to merge-ready is the default story unit. Parent must not implement as the leaf.
+
+## Frozen
+
+### Frozen vBRIEF migrator
+- **Status:** compatibility
+- **Canonical:** command `migrate:vbrief`
+- **Gotchas:** Current npm does not ship this verb. Pin v0.59.0 for hop 1, then migrate:xbrief.

package/docs/capability-overlay.json

@@ -0,0 +1,197 @@
+{
+  "version": 1,
+  "issue": 4099,
+  "gotcha_max_chars": 280,
+  "entries": [
+    {
+      "id": "session-start",
+      "title": "Session start",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "session:start" },
+      "gotchas": "Run before mutation. USER.md Personal wins. Read-only until implementation intent."
+    },
+    {
+      "id": "check",
+      "title": "task check",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "check" },
+      "gotchas": "Merge chokepoint. Iteration may use cheaper affected gates; do not skip this before PR."
+    },
+    {
+      "id": "doctor",
+      "title": "Doctor",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "doctor" },
+      "gotchas": "Support entry is doctor --full or the README cold-start. Not a second recovery ladder."
+    },
+    {
+      "id": "init",
+      "title": "Install / init",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "init" },
+      "gotchas": "Consumer path is directive init. Do not send npm consumers through Corepack, Go, or uv."
+    },
+    {
+      "id": "setup-skill",
+      "title": "Setup skill",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-setup" },
+      "gotchas": "Writes USER.md and PROJECT-DEFINITION. Confirm captured values before write."
+    },
+    {
+      "id": "build-skill",
+      "title": "Build skill",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-build" },
+      "gotchas": "xbrief:preflight on an active running brief before code. Do not treat completed xBRIEFs as next-build contract."
+    },
+    {
+      "id": "docs-home",
+      "title": "Public docs home",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/index.html" },
+      "gotchas": "Public IA lives under docs-site/. Do not mix it with maintainer docs/."
+    },
+    {
+      "id": "docs-install",
+      "title": "Public install page",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/install.html" },
+      "gotchas": "Install copy stays on the consumer Node floor, not the maintainer toolchain pin."
+    },
+    {
+      "id": "docs-gates",
+      "title": "Public gates page",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/gates.html" },
+      "gotchas": "task check is the merge chokepoint named here; do not invent a parallel public gate."
+    },
+    {
+      "id": "docs-concepts",
+      "title": "Public concepts page",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/concepts.html" },
+      "gotchas": "Concepts page is a public IA surface. README/UPGRADING rewrites stay on #4100."
+    },
+    {
+      "id": "docs-upgrade",
+      "title": "Public upgrade page",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/upgrade.html" },
+      "gotchas": "Frozen pre-v0.20 migration stays on the v0.59.0 hop. Current npm uses migrate:xbrief."
+    },
+    {
+      "id": "docs-license",
+      "title": "Public license page",
+      "audience": "consumer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "document", "id": "docs-site/license.html" },
+      "gotchas": "License page is a docs-site surface, not a substitute for root LICENSE."
+    },
+    {
+      "id": "rule-map",
+      "title": "Rule map",
+      "audience": "maintainer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "docs:rule-map" },
+      "gotchas": "Generated maintainer view. Do not mint a second RULE-MAP. Refresh with task docs:rule-map."
+    },
+    {
+      "id": "policy-show",
+      "title": "Policy inspector",
+      "audience": "maintainer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "policy:show" },
+      "gotchas": "Read namespaced plan[\"x-directive/policy\"]. Bare plan.policy is a shadowing stop."
+    },
+    {
+      "id": "pre-pr-skill",
+      "title": "Pre-PR skill",
+      "audience": "maintainer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-pre-pr" },
+      "gotchas": "Run before opening a PR. Always-pin process skill; not this capability index."
+    },
+    {
+      "id": "review-cycle-skill",
+      "title": "Review-cycle skill",
+      "audience": "maintainer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-review-cycle" },
+      "gotchas": "Greptile residuals go through this skill. Host babysit/bugbot are advisory-only."
+    },
+    {
+      "id": "swarm-skill",
+      "title": "Swarm skill",
+      "audience": "maintainer",
+      "status": "current",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-swarm" },
+      "gotchas": "Drive-to merge-ready is the default story unit. Parent must not implement as the leaf."
+    },
+    {
+      "id": "verify-encoding",
+      "title": "Encoding gate (alias)",
+      "audience": "maintainer",
+      "status": "compatibility",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "verify:encoding" },
+      "gotchas": "Alias owner is dispatch.ts VERB_ALIASES. Canonical engine verb is verify-encoding."
+    },
+    {
+      "id": "migrate-vbrief-frozen",
+      "title": "Frozen vBRIEF migrator",
+      "audience": "frozen",
+      "status": "compatibility",
+      "in_the_public_index": true,
+      "canonical_entry": { "kind": "command", "id": "migrate:vbrief" },
+      "gotchas": "Current npm does not ship this verb. Pin v0.59.0 for hop 1, then migrate:xbrief."
+    },
+    {
+      "id": "triage-skill-withdrawn",
+      "title": "Triage classify (withdrawn)",
+      "audience": "maintainer",
+      "status": "withdrawn",
+      "in_the_public_index": false,
+      "canonical_entry": { "kind": "skill-trigger", "id": "deft-directive-triage" },
+      "gotchas": "Classify playbook is off. Work selection is plan-sequence:current then triage:queue."
+    },
+    {
+      "id": "product-signal-consent",
+      "title": "Product-signal consent",
+      "audience": "consumer",
+      "status": "experimental",
+      "status_owner": "packages/core/src/product-signal",
+      "in_the_public_index": false,
+      "canonical_entry": { "kind": "command", "id": "product-signal:consent" },
+      "gotchas": "Off until the operator grants consent. Absence of consent is not a product verdict."
+    }
+  ]
+}