@dzhechkov/harness-cli 0.8.2 → 0.8.6

package/src/cli.ts

@@ -4,7 +4,7 @@
  * @packageDocumentation
  */
 
-import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, type Dirent } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { request as httpsRequest } from 'node:https';
@@ -15,6 +15,7 @@ import { execFile, execFileSync, execSync, spawn, spawnSync, type ChildProcess }
 import { createHash, randomBytes } from 'node:crypto';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
+import { isDeepStrictEqual } from 'node:util';
 
 import {
   createSkill,
@@ -158,6 +159,11 @@ import {
   parseWeeklyResetAnchor,
   claimCheck,
   summarize,
+  BUNDLED_SLOP_REGISTRY_URL,
+  DEFAULT_SLOP_CONFIG,
+  parseSlopRegistry,
+  slopLint,
+  validateSlopLintConfig,
   queryBookKnowledge,
   loadStorePatternsSync,
   patternRecordId,
@@ -278,6 +284,7 @@ import {
   harvestStageOutcomes,
   recommendModels,
   planFeed,
+  unfedRuns,
   GRADE_SUCCESS_FLOOR,
   COST_LADDER,
   splitScenarios,
@@ -302,6 +309,13 @@ import {
   renderContentProbe,
   findNonRegistrableSkillDirs,
   assembleCompoundingReport,
+  buildDeadwoodReport,
+  compactCmdUsageIfNeeded,
+  measureCmdUsageDepthDays,
+  recordCommandInvocation,
+  resolveCmdUsageRoot,
+  renderDeadwoodReport,
+  CMD_USAGE_LOG_RELATIVE,
   banditStats,
   narrowBanditReport,
   renderBanditHealth,
@@ -457,6 +471,9 @@ import {
   amendmentVerdictLine,
   amendmentsMissingFromPlan,
   AMENDMENT_VACUITY_NOTE,
+  extractContractChecklist,
+  parseContractVerdictReport,
+  verifyContractVerdicts,
   decideSignableSet,
   signableSetLine,
   decideRecordWrite,
@@ -467,6 +484,7 @@ import {
   CADENCE_WINDOW_DAYS,
   readQeRounds,
   QE_ROUNDS_DEFAULT_CEILING,
+  adviseRestart,
   describeStoreLocation,
   storeLocationLine,
   resolveTeachTarget,
@@ -502,10 +520,30 @@ import type { IdeaRecord, IdeaStatus } from '@dzhechkov/harness-core';
 import type { Family, ModelRung, Candidate as BtoCandidate, DimScores } from '@dzhechkov/harness-core';
 import type { SetupSpec } from '@dzhechkov/harness-core';
 import type { LogTail } from '@dzhechkov/harness-core';
-import type { ProvenanceMode, PackVerdict, ClaudeUsageModel, PatternRecord, TargetName, BookKU, HarmonizeReport, UsageCalibrationPlan, ClaimFinding, RecallUsagePatternRow, GateExecution, GateStep } from '@dzhechkov/harness-core';
+import type { DeadwoodInventoryItem } from '@dzhechkov/harness-core';
+import type { ContractDiagnostic, ContractEvidenceReader } from '@dzhechkov/harness-core';
+import type { ProvenanceMode, PackVerdict, ClaudeUsageModel, PatternRecord, TargetName, BookKU, HarmonizeReport, UsageCalibrationPlan, ClaimFinding, RecallUsagePatternRow, GateExecution, GateStep, SlopFinding, SlopLintConfig, SlopRegistry } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 
+/** Literal command inventory, pinned against the main dispatch switch by a layer-1 test. */
+export const DZ_COMMANDS: readonly string[] = [
+  'init', 'verify', 'sync', 'update', 'list', 'create-skill', 'info', 'scout',
+  'workflow', 'workflow-lint', 'workflow-trace', 'migrate', 'doctor', 'install',
+  'bundle', 'teach', 'consolidate', 'recall', 'vector', 'brain', 'statusline',
+  'usage', 'claim-check', 'lint', 'sign', 'sbom', 'guard', 'verify-pack', 'setup',
+  'pretrain', 'compose', 'diff', 'recommend', 'upgrade', 'auto-canonicalize',
+  'publish', 'release', 'parity', 'registry', 'benchmark', 'mcp-scan',
+  'sync-upstream', 'drift-check', 'hooks-sync', 'agents-sync', 'sync-canonical',
+  'plugin', 'downloads', 'stats', 'architecture', 'project-skills', 'mr-rakes',
+  'retro', 'feature-adr-setup', 'challenge', 'discrimination-check',
+  'mutation-gate', 'delivery-check', 'skills-verify', 'compounding', 'deadwood',
+  'epoch-replay', 'score', 'recap', 'cadence', 'qe-rounds', 'restart-advisor', 'tg-post',
+  'name-check', 'provenance-check', 'feature-adr-record', 'amendment-check', 'contract-check',
+  'feature-adr-checkpoint', 'profile', 'reqe', 'qe-bridge', 'backlog', 'routing',
+  'bto-optimize', 'dashboard', 'roam', 'import-ecc',
+];
+
 const USAGE = `dz - DZ cross-platform harness CLI
 
 Usage:
@@ -539,6 +577,7 @@ Usage:
   dz challenge --plan <plan.md> [--author <model>]   (the deterministic cartridge behind the challenge-panel adversarial plan-gate (R6): assembles the wide brief — plan + architecture/vision.md + testing.md + map.json + degradations.md — and prints the C1-C8 adversary prompt naming the cross-family reviewer to dispatch. exit 0 brief printed / 1 plan missing or empty)
   dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--json]   (does .claude/skills/ actually REGISTER? --static = instant layout scan for CI; default reads the authoritative system/init listing from a real session. exit 0 pass / 1 fail / 2 inconclusive — never a false pass)
   dz compounding [--project <dir>] [--json]   (honest learning-loop payoff report: pool write-only ratio, guard repeat-violation trajectory, cold-vs-warm replay readiness, instrumentation health — a gate without enough data says INSUFFICIENT_DATA, never a fake verdict)
+  dz deadwood [--weeks <n>] [--json]   (advisory zero-usage candidates for human deprecation review; safety-excluded surfaces carry reasons; never deletes or deprecates anything; shallow history says INSUFFICIENT_DATA)
   dz epoch-replay --mock [--n <N>] [--effect <-1..1>] [--tie-rate <0..1>] [--seed <N>] [--slice <name>] [--json]   ($0 synthetic run — exercises the verdict math, NOT evidence)
   dz epoch-replay --emit [--project <dir>] [--limit <N>] [--seed <N>] [--out <file>]   (cold-vs-warm work order: instances + PRE-REGISTERED blind A/B assignment; the runner never calls a model)
   dz epoch-replay --judge <filled-work-order.json> [--out <file>]   (blind judge prompts from the filled plans)
@@ -547,6 +586,7 @@ Usage:
   dz recap [--day|--week|--month] [--at <ISO date>] [--project <dir>] [--json]   (what was done over a window, from records only: deliveries with the grade an independent review STATED — a report naming two grades is reported ambiguous, never guessed — registry publishes, gate verdicts, knowledge reuse. --quarter/--half-year/--year are RECOGNISED and REFUSED with the real span in days: there is one complete quarter and the longest record is 174 days. Every section carries its own data-start date, and "the source was not read" never prints as zero. Contaminated measures — commit count, lines, tokens, learning-event volume, inventory counts, lesson count — are not computed, and the report says so. exit 0 reported / 2 refused)
   dz cadence [--window day|week|month|quarter|halfyear|year] [--json]   (the WHAT-SHIPPED aggregator: graded-shipment cadence by ISO week + npm-publish cadence (recap cache) + guard repeat decay on the FIXED rule set + recall reuse; a window deeper than 2× the record is REFUSED with the depth named (ADR: a cadence from one point is scale forgery); exit 0 report / 2 refused-window / 1 usage)
   dz qe-rounds (--slug <feature> | --feature-dir <abs>) [--ceiling <n>] [--project <dir>] [--json]   (how many Step-8 review rounds has this feature ALREADY had? Reads what dz qe-bridge already wrote — signoff-<runId>.json and failed-*.json under features/<slug>/.fa-state/qe-bridge — and writes nothing itself, so it can answer for runs already past. A round is a runId, not a file; an attempt with no verdict is counted SEPARATELY and never merged; an unreadable record is NAMED and the count is declared a LOWER BOUND. ONE directory, never a union across checkouts. exit 0 under the ceiling / 1 at-or-over — owner decides, the command does not judge whether the rounds were warranted / 2 NOT ESTABLISHED, which is never "zero rounds")
+  dz restart-advisor --slug <s> [--threshold C|D] [--rounds N] [--json]   (read-only advisory decision over features/<slug>/.fa-state/checkpoints.jsonl and .dz/fa-training/<slug>/qe.jsonl. Defaults: threshold D, rounds 2 — both origins are printed. Equal sources corroborate; conflicts, torn/unreadable evidence, gaps, and unsafe paths are NOT ESTABLISHED. RECOMMENDATION ONLY: autoAction=false; never invokes feature-adr, deletes a stage, or writes advisor state. exit 0 established recommendation/no-recommendation / 2 NOT ESTABLISHED or invalid input / 1 unexpected runtime failure)
   dz tg-post --draft <file.html> [--manifest <sources.json>] [--channel <@name|id>] [--send --yes] [--night] [--preview] [--json]   (the sender for an APPROVED channel post, per the accepted genai-tweets-channel ADRs: HTML mode only — never MarkdownV2; link preview OFF by default (x.com previews in Telegram are broken); the 00:00-06:00 MSK quiet window refuses without an explicit --night. DEFAULT IS A DRY-RUN: it validates the draft (tag balance, allowed tags, bare &/<, the 4096 visible-character limit with the overshoot counted) and runs the provenance gate over --manifest IN-PROCESS — a draft with no manifest is refused as unchecked, and anything but ALLOWED refuses. A real send needs --send --yes, stating ADR-004's manual-publishing decision out loud each time. The token comes from TELEGRAM_BOT_TOKEN or telegram.tokenFile in .dz/config.json and is never printed. exit 0 sent or clean dry-run / 1 refused or Telegram error / 2 usage)
   dz name-check [--command <n>] [--module <basename>] [--export <a,b>] [--project <dir>] [--json]   (is this name free, BEFORE a line of code? Scans workspace SOURCE — never dist, because a stale build answers 'free' confidently. Checks a dz command name against the dispatcher AND the help block, a module basename against every package's src/, and exported identifiers against every declaration in the workspace. exit 0 all free / 1 at least one taken, naming where / 2 nothing asked or the scan did not run — an empty sweep is never a clean bill. Honest limit, printed on the passing path: it reads declarations, so a re-export under a different name stays the build's job)
   dz provenance-check --manifest <sources.json> [--project <dir>] [--json]   (nothing goes out citing a source that may not leave this machine. Checks PROVENANCE, not words: every claim names its source, and only a KNOWN kind that resolves safely is cleared. Repo paths go through 'git -C <root> check-ignore' over the RESOLVED path — a symlink into an ignored directory is REFUSED (git classifies the string and never dereferences, MEASURED), and the verdict does not change with your working directory. Store records must be named in the git-TRACKED provenance-public.json, so declaring one public is a reviewable commit rather than a field inside an ignored store. An undeclared kind is refused, never inferred from the path's shape. exit 0 allowed / 1 blocked / 3 NOT ESTABLISHED — an empty manifest, an unreadable one, or an oracle that did not run is never a pass. It proves what was CITED: it cannot see a paraphrase with no citation, nor confidential text pasted by hand into an allowed file)
@@ -556,6 +596,7 @@ Usage:
   dz architecture [--check --slug <s> --desc <text>] [--project <dir>] [--revise]   (the live product map + vision: --check is the soft Step-0 сверка of a new feature against them, reporting {signal,confidence} rather than blocking)
   dz sbom [--pack <name>] [--out <file>]   (CycloneDX software bill of materials for the workspace, or for one pack with --pack)
   dz amendment-check --slug <slug> | --feature-dir <dir> | --all [--json]   (the deterministic Step-8 amendment gate: every AM-N row must resolve to a test found INSIDE the file the row names; the PLAN is authoritative when it carries rows, and an ideation amendment the plan drops is a failure. exit 0 pass/skip, 1 fail, 3 NOT-ESTABLISHED — a section that parsed ZERO rows is never a pass. --all is a CENSUS and always exits 0. Does NOT prove non-vacuity — that is dz discrimination-check)
+  dz contract-check --slug <s> [--json]   (read-only retrospective feature contract gate: extracts canonical AC-N + ADR Confirmation items, requires one artifact-anchored met|unmet|not-testable verdict per CC-N, and rejects A/B with unmet. exit 0 pass / 1 readable contract or verdict violation / 2 invalid invocation or unreadable/not-established artifacts)
   dz feature-adr-record --kind ledger|training-pair --stage <s> [--slug <s>] [--row|--pair <json>] [--mark <n>] [--once] [--json]   (the witnessed writer for the run-cost ledger and training pairs: the payload arrives as an ARGUMENT, never as shell; a malformed or wrong-kind payload is REFUSED before any write; the timestamp is stamped before serialising; the append is verified by re-reading the tail. exit 0 written|duplicate|skipped, 2 refused, 3 not-verified — a record failure is never blocking)
   dz feature-adr-checkpoint (--slug <feature> | --feature-dir <abs>) --stage <s> --input-hash <h> --result <json> [--artifact a,b] [--json]   (record a pipeline stage ONLY after measuring its artifacts on disk; refuses a null result, an absent artifact, or a stage that declares none — the subagent runs a COMMAND instead of hand-writing durable state)
   dz profile [init|show|set|sync] [--json]   (WHO the assistant is talking to — per-user store at ~/.dz/profile.json (0600, NEVER in a project), delivered as a marked block in ~/.claude/CLAUDE.md so it loads in EVERY project, dz installed or not. init = five questions (language, register, deep/weak domains as comma lists — "networking (CCIE; NSX)" keeps the parenthetical as the note, Enter skips — teaches y/n with one re-ask, never a silent default); show ALWAYS prints the store path + age + drift verdict + the rendered block; set register|language|teaches <v> or set deep|weak add|rm <tag> [note] — register accepts the owner's own words (профи / профи лайт / просто), an unknown value is REFUSED naming the accepted set; sync re-writes the block (runs automatically after init/set; foreign content byte-for-byte, timestamped backup before every modifying write). The register changes FORM, never FACTS, and governs dialogue only — never ADRs/commits/QE reports; both rules are baked into the rendered block at every level. exit 0 done / 1 no profile or failed / 2 refused input)
@@ -570,7 +611,7 @@ Usage:
   dz backlog ship <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (mark work DONE: new|enriched|in-progress → shipped, removing it from the roulette pool — run it after finishing a task; short id prefixes ok, ambiguous = loud error)
   dz backlog drop <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (retire an idea: new|enriched|in-progress → dropped)
   dz backlog edit <id> --text "<new>" | --append "<more>" [--dry-run] [--project <dir>] [--json]   (rewrite ONE idea's text, preserving every other field; re-embeds the dedup vector, and on a failed re-embed MARKS the record embedStale so dedup refuses to trust it — previous text preserved in .dz/backlog/edits.jsonl)
-  dz routing recommend [--tier <t>] [--apply] [--json]   (per-stage args.models suggestion from REAL telemetry — harness records + imported run-meta sidecars — printed WITH its basis: n runs, window, the grade-floor rule, skip reasons; qe is FORCED cross-family of code; --apply feeds .dz/routing-outcomes.json idempotently by runId)
+  dz routing recommend [--tier <t>] [--apply] [--json]   (per-stage args.models suggestion from REAL telemetry — harness records + imported run-meta sidecars — printed WITH its basis + current/STALE/UNFED store receipt; qe is FORCED cross-family of code; --apply feeds .dz/routing-outcomes.json idempotently by runId)
   dz backlog reopen <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (back to the pool: shipped|dropped|in-progress → new)
   dz backlog enrich <id> [--project <dir>] [--json]                        (stage the idea2prd input scaffold in features/<slug>/ and hand off to the idea2prd-manual skill — the CLI never fabricates a PRD)
   dz backlog jira <id> [--project <dir>] [--json]                          (draft a Jira issue via the configurable adapter (backlog.jira.adapter: jira-mcp|copilot-mcp|none); none writes an auditable jira-outbox/<id>.json stub)
@@ -600,6 +641,7 @@ Usage:
   dz usage [--json] [--project <dir>] | dz usage --calibrate --session <pct> --weekly <pct> [--model fable=<pct>] [--project <dir>]  (ESTIMATE Claude usage from fixed reset windows; optional per-model weekly binding; exit 0 ALWAYS; pct=null when limits unconfigured)
   dz usage --by-stage [--run <runId> | --slug <slug>] [--epsilon <0..1>] [--write <file.jsonl>] [--json]   (per-stage cost ledger for ONE feature-adr run + the reconciliation invariant: accounted + unaccounted = run total; verdict BALANCED | DEFECT | INSUFFICIENT_DATA; local transcript ESTIMATES — catches ATTRIBUTION errors, not pricing errors)
   dz claim-check [paths...] [--json] [--fail-on high|medium|none] [--project <dir>]  (enforce the Integrity Rule: flag untagged/overstated accuracy claims; default scan = root README.md + every discovered package's README.md + features/*/08_qe_report.md + docs/**/*.md (historical feature artifacts are NOT scanned — pass paths explicitly); exit 1 only at/above --fail-on, default high)
+  dz lint [paths...] [--json] [--config <file>] [--registry <file>] [--project <dir>]  (advisory EN/RU prose-style lint; findings exit 0, incomplete input/policy exits 1, usage exits 2)
   dz pretrain [--project <dir>]
   dz recommend "<task description>"
   dz compose <preset1+preset2+...> [--target <name>]
@@ -2741,6 +2783,114 @@ function cmdQeRounds(options: Map<string, string>, flags: Set<string>, cwd: stri
   return 0;
 }
 
+type RestartAdvisorDiskRead =
+  | { readonly text: string | null; readonly diagnostic: null }
+  | { readonly text: null; readonly diagnostic: string };
+
+/** Read one fixed advisor evidence path without following a symlink or escaping the project root. */
+function readRestartAdvisorEvidence(root: string, relativePath: string): RestartAdvisorDiskRead {
+  const contained = containedUnderRoot(root, relativePath);
+  if (!contained.ok) {
+    return { text: null, diagnostic: `${relativePath}: ${contained.why}` };
+  }
+  let stat;
+  try {
+    stat = lstatSync(contained.path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { text: null, diagnostic: null };
+    return { text: null, diagnostic: `${relativePath}: evidence cannot be inspected (${(error as Error).message})` };
+  }
+  if (stat.isSymbolicLink()) {
+    return { text: null, diagnostic: `${relativePath}: symlink evidence is refused` };
+  }
+  if (!stat.isFile()) {
+    return { text: null, diagnostic: `${relativePath}: evidence exists but is not a regular file` };
+  }
+  try {
+    return { text: readFileSync(contained.path, 'utf-8'), diagnostic: null };
+  } catch (error) {
+    return { text: null, diagnostic: `${relativePath}: evidence cannot be read (${(error as Error).message})` };
+  }
+}
+
+/** Manual restart recommendation only. I/O ends here; the core remains deterministic and pure. */
+function cmdRestartAdvisor(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const json = flags.has('json');
+  const rawSlug = options.get('slug') ?? '';
+  const slug = rawSlug.trim();
+  const thresholdRaw = options.get('threshold');
+  const roundsRaw = options.get('rounds');
+  const thresholdOrigin = thresholdRaw === undefined ? 'default' as const : 'flag' as const;
+  const roundsOrigin = roundsRaw === undefined ? 'default' as const : 'flag' as const;
+
+  const emit = (advice: ReturnType<typeof adviseRestart>): number => {
+    if (json) {
+      write(JSON.stringify(advice));
+    } else {
+      write(`dz restart-advisor: ${advice.recommendation} — advisory only; autoAction=false`);
+      write(`  policy: threshold ${String(advice.policy.threshold)} (${advice.policy.thresholdOrigin}), rounds ${String(advice.policy.rounds)} (${advice.policy.roundsOrigin})`);
+      write(`  source: ${advice.sourcePath ?? 'none'}${advice.corroborated ? ' (corroborated by both stores)' : ''}`);
+      for (const diagnostic of advice.diagnostics) write(`  diagnostic: ${JSON.stringify(diagnostic)}`);
+      if (advice.diagnosticsSummary.truncated) {
+        write(`  diagnostics: ${advice.diagnosticsSummary.returned}/${advice.diagnosticsSummary.total} shown`);
+      }
+      write(advice.decisionLogLine);
+    }
+    return advice.recommendation === 'RESTART_CODE_STAGE'
+      || advice.recommendation === 'NO_RESTART_RECOMMENDATION'
+      ? 0
+      : 2;
+  };
+
+  const inputErrors: string[] = [];
+  for (const flag of flags) {
+    if (flag !== 'json' && flag !== 'help') inputErrors.push(`--${flag} requires a value or is not supported`);
+  }
+  for (const key of options.keys()) {
+    if (key !== 'slug' && key !== 'threshold' && key !== 'rounds') {
+      inputErrors.push(key.startsWith('_positional_')
+        ? `unexpected argument ${JSON.stringify(options.get(key))}`
+        : `unsupported option --${key}`);
+    }
+  }
+  if (!isSafeSlug(slug)) {
+    inputErrors.push(`--slug ${JSON.stringify(rawSlug)} must be one kebab-case path segment (max 40 characters)`);
+  }
+  const threshold = thresholdRaw ?? 'D';
+  if (threshold !== 'C' && threshold !== 'D') {
+    inputErrors.push(`--threshold ${JSON.stringify(thresholdRaw)} must be exactly C or D`);
+  }
+  const roundsValue = roundsRaw === undefined ? 2 : Number(roundsRaw);
+  if (!Number.isFinite(roundsValue) || !Number.isInteger(roundsValue) || roundsValue < 1) {
+    inputErrors.push(`--rounds ${JSON.stringify(roundsRaw)} must be a positive integer`);
+  }
+  if (inputErrors.length > 0) {
+    return emit(adviseRestart({ slug, inputErrors }, {
+      thresholdOrigin,
+      roundsOrigin,
+    }));
+  }
+
+  const root = resolve(cwd);
+  const checkpointPath = `features/${slug}/.fa-state/checkpoints.jsonl`;
+  const trainingPath = `.dz/fa-training/${slug}/qe.jsonl`;
+  const checkpoints = readRestartAdvisorEvidence(root, checkpointPath);
+  const trainingPairs = readRestartAdvisorEvidence(root, trainingPath);
+  const readDiagnostics = [checkpoints.diagnostic, trainingPairs.diagnostic]
+    .filter((entry): entry is string => entry !== null);
+  return emit(adviseRestart({
+    slug,
+    checkpointsJsonl: checkpoints.text,
+    trainingPairsJsonl: trainingPairs.text,
+    readDiagnostics,
+  }, {
+    threshold: threshold as 'C' | 'D',
+    rounds: roundsValue,
+    thresholdOrigin,
+    roundsOrigin,
+  }));
+}
+
 function cmdCadence(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   const root = resolve(cwd, options.get('project') ?? '.');
   const windowRaw = (options.get('window') ?? 'week').trim() as CadenceWindow;
@@ -6478,6 +6628,256 @@ function cmdBenchmark(options: Map<string, string>, flags: Set<string>, cwd: str
   return score.passRate >= 80 ? 0 : 1;
 }
 
+interface SlopScanRow {
+  readonly path: string;
+  readonly status: 'scanned' | 'skipped';
+  readonly paragraphs?: number;
+  readonly findings?: number;
+  readonly reason?: string;
+}
+
+interface SlopCliError {
+  readonly path?: string;
+  readonly message: string;
+}
+
+interface SlopCliFinding extends SlopFinding {
+  readonly file: string;
+}
+
+interface SlopCliReport {
+  readonly schema: 'dz-slop-lint/1';
+  readonly advisory: true;
+  readonly ok: boolean;
+  readonly status: 'clean' | 'findings' | 'incomplete';
+  readonly findings: readonly SlopCliFinding[];
+  readonly scanned: readonly SlopScanRow[];
+  readonly skipped: readonly SlopScanRow[];
+  readonly errors: readonly SlopCliError[];
+}
+
+const SLOP_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const SLOP_COURSE_TEXT_KEYS = new Set([
+  'back', 'courseDescription', 'courseTitle', 'description', 'explanation', 'front', 'instruction',
+  'keyConcept', 'keyConcepts', 'note', 'options', 'question', 'reflection', 'shortTitle', 'strengths',
+  'theory', 'title', 'weaknesses', 'wrapup',
+]);
+
+function slopDisplayPath(root: string, absolute: string): string {
+  const rel = relative(root, absolute);
+  return rel !== '' && !rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel) ? rel : absolute;
+}
+
+function slopWalk(dir: string, depth = 0): string[] {
+  if (depth > 16) return [];
+  const out: string[] = [];
+  let entries: Dirent<string>[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const entry of entries) {
+    if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist' || entry.name === 'build') continue;
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...slopWalk(full, depth + 1));
+    else if (entry.isFile() && (['.md', '.mdx'].includes(extname(entry.name).toLowerCase()) || entry.name === 'course.json')) out.push(full);
+  }
+  return out;
+}
+
+function defaultSlopScanSet(root: string): string[] {
+  const paths: string[] = [];
+  const readme = join(root, 'README.md');
+  if (existsSync(readme)) paths.push(readme);
+  try {
+    for (const pkg of discoverPackages(root)) {
+      const packageReadme = join(pkg.dir, 'README.md');
+      if (existsSync(packageReadme)) paths.push(packageReadme);
+    }
+  } catch { /* a foreign project need not be a dz workspace */ }
+  paths.push(...slopWalk(join(root, 'packages', '@dzhechkov', 'sitedoc', 'src', 'content'))
+    .filter((path) => ['.md', '.mdx'].includes(extname(path).toLowerCase())));
+  try {
+    const featureDir = join(root, 'features');
+    for (const entry of readdirSync(featureDir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+      const course = join(featureDir, entry.name, 'course.json');
+      if (existsSync(course)) paths.push(course);
+    }
+  } catch { /* no features directory */ }
+  return [...new Set(paths.map((path) => resolve(path)))].sort((a, b) => {
+    const left = slopDisplayPath(root, a);
+    const right = slopDisplayPath(root, b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+}
+
+function decodeSlopUtf8(path: string): string {
+  const stat = lstatSync(path);
+  if (!stat.isFile()) throw new Error('not a regular file');
+  if (stat.size > SLOP_MAX_FILE_BYTES) throw new Error(`file exceeds ${SLOP_MAX_FILE_BYTES} byte limit`);
+  const bytes = readFileSync(path);
+  return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+}
+
+function projectCourseJson(text: string): string | null {
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return null;
+  const root = value as Record<string, unknown>;
+  if (typeof root.language !== 'string' || typeof root.courseTitle !== 'string' ||
+    !Array.isArray(root.topics) || !Array.isArray(root.sections)) return null;
+  const output: string[] = [];
+  const visit = (current: unknown, key = ''): void => {
+    if (typeof current === 'string') {
+      if (SLOP_COURSE_TEXT_KEYS.has(key) && current.trim() !== '') output.push(current);
+      return;
+    }
+    if (Array.isArray(current)) {
+      for (const item of current) visit(item, key);
+      return;
+    }
+    if (current === null || typeof current !== 'object') return;
+    for (const [childKey, child] of Object.entries(current as Record<string, unknown>)) visit(child, childKey);
+  };
+  visit(root);
+  return output.join('\n\n');
+}
+
+function slopLoadJson<T>(path: string, validate: (value: unknown) => { readonly ok: true; readonly value: T } | { readonly ok: false; readonly errors: readonly { readonly field: string; readonly value: unknown; readonly reason: string }[] }): T {
+  const decoded = decodeSlopUtf8(path);
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(decoded);
+  } catch (error) {
+    throw new Error(`invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const result = validate(parsed);
+  if (!result.ok) throw new Error(result.errors.map((error) => `${error.field}=${JSON.stringify(error.value)}: ${error.reason}`).join('; '));
+  return result.value;
+}
+
+/**
+ * Read-only adapter over the pure slopLint core. Style findings are advisory by construction:
+ * only usage errors return 2 and incomplete policy/input evidence returns 1.
+ */
+function cmdLint(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+): number {
+  const json = flags.has('json');
+  const root = resolve(cwd, options.get('project') ?? '.');
+  const usageError = (message: string): number => {
+    if (json) write(JSON.stringify({ schema: 'dz-slop-lint/1', advisory: true, ok: false, status: 'incomplete', findings: [], scanned: [], skipped: [], errors: [{ message }] }));
+    else write(`dz lint: ${message}`);
+    return 2;
+  };
+  if (flags.has('config')) return usageError('--config requires a file');
+  if (flags.has('registry')) return usageError('--registry requires a file');
+
+  let config: SlopLintConfig = DEFAULT_SLOP_CONFIG;
+  let registry: SlopRegistry;
+  const setupErrors: SlopCliError[] = [];
+  try {
+    if (options.has('config')) config = slopLoadJson(resolve(root, options.get('config')!), validateSlopLintConfig);
+  } catch (error) {
+    const path = options.get('config');
+    setupErrors.push({ ...(path === undefined ? {} : { path }), message: `config: ${error instanceof Error ? error.message : String(error)}` });
+  }
+  try {
+    const registryPath = options.has('registry') ? resolve(root, options.get('registry')!) : fileURLToPath(BUNDLED_SLOP_REGISTRY_URL);
+    registry = slopLoadJson(registryPath, parseSlopRegistry);
+  } catch (error) {
+    const path = options.get('registry');
+    setupErrors.push({ ...(path === undefined ? {} : { path }), message: `registry: ${error instanceof Error ? error.message : String(error)}` });
+    registry = { schema: 'dz-slop-registry/1', metadata: {} as SlopRegistry['metadata'], markers: [], adjectives: [] };
+  }
+
+  const requested: string[] = [];
+  for (let index = 0; ; index += 1) {
+    const value = options.get(`_positional_${index}`);
+    if (value === undefined) break;
+    requested.push(resolve(root, value));
+  }
+  const explicit = requested.length > 0;
+  const candidates = explicit ? requested.flatMap((path) => {
+    try {
+      const stat = lstatSync(path);
+      if (stat.isSymbolicLink()) return [path];
+      return stat.isDirectory() ? slopWalk(path) : [path];
+    } catch {
+      return [path];
+    }
+  }) : defaultSlopScanSet(root);
+  const scanSet = [...new Set(candidates.map((path) => resolve(path)))].sort((a, b) => {
+    const left = slopDisplayPath(root, a);
+    const right = slopDisplayPath(root, b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+
+  const findings: SlopCliFinding[] = [];
+  const scanned: SlopScanRow[] = [];
+  const errors = [...setupErrors];
+  if (setupErrors.length === 0) {
+    for (const path of scanSet) {
+      const display = slopDisplayPath(root, path);
+      let source: string;
+      try {
+        source = decodeSlopUtf8(path);
+      } catch (error) {
+        const message = error instanceof TypeError ? `invalid UTF-8: ${error.message}` : error instanceof Error ? error.message : String(error);
+        scanned.push({ path: display, status: 'skipped', reason: message });
+        errors.push({ path: display, message });
+        continue;
+      }
+      if (basename(path) === 'course.json') {
+        const projected = projectCourseJson(source);
+        if (projected === null) {
+          const message = 'unsupported course.json shape';
+          scanned.push({ path: display, status: 'skipped', reason: message });
+          if (explicit) errors.push({ path: display, message });
+          continue;
+        }
+        source = projected;
+      } else if (!['.md', '.mdx'].includes(extname(path).toLowerCase())) {
+        const message = 'unsupported input type; expected Markdown, MDX, or recognized course.json';
+        scanned.push({ path: display, status: 'skipped', reason: message });
+        errors.push({ path: display, message });
+        continue;
+      }
+      const result = slopLint(source, { config, registry });
+      if (result.paragraphCount === 0) errors.push({ path: display, message: 'no analyzable prose' });
+      for (const diagnostic of result.diagnostics) errors.push({ path: display, message: `${diagnostic.code} at line ${diagnostic.line}: ${diagnostic.message}` });
+      for (const finding of result.findings) findings.push({ ...finding, file: display });
+      scanned.push({ path: display, status: 'scanned', paragraphs: result.paragraphCount, findings: result.findings.length });
+    }
+  }
+  // A valid empty directory/default scope is a clean advisory no-op. Explicit missing paths stay
+  // in scanSet and fail above, while a supported file containing no prose remains incomplete.
+
+  const skipped = scanned.filter((row) => row.status === 'skipped');
+  const status: SlopCliReport['status'] = errors.length > 0 ? 'incomplete' : findings.length > 0 ? 'findings' : 'clean';
+  const report: SlopCliReport = {
+    schema: 'dz-slop-lint/1', advisory: true, ok: errors.length === 0, status, findings, scanned, skipped, errors,
+  };
+  if (json) write(JSON.stringify(report));
+  else {
+    write(`dz lint: ${findings.length} finding(s), ${scanned.filter((row) => row.status === 'scanned').length} file(s) scanned — ${status}`);
+    for (const finding of findings) write(`  [${finding.ruleId}] ${finding.file}:${finding.lineStart}:${finding.columnStart} — ${finding.excerpt}`);
+    for (const error of errors) write(`  incomplete${error.path ? ` ${error.path}` : ''}: ${error.message}`);
+  }
+  return errors.length > 0 ? 1 : 0;
+}
+
 /**
  * Exit-code contract for `dz claim-check` (named in the ADR, locked by tests):
  * exit 0 when no finding at/above `failOn` exists; exit 1 only when one does.
@@ -7435,6 +7835,90 @@ function gatherReadmeCounts(root: string): { label: string; a: number; b: number
 function gatherGuardFacts(op: string, root: string, text: string | undefined, storeCap: number): Record<string, unknown> {
   const facts: Record<string, unknown> = { op };
   if (op === 'publish') {
+    // Advisory I/O: unreadable telemetry or fed state is absence of evidence, never a fabricated
+    // stale finding and never a publish blocker.
+    try {
+      const routing = readRoutingTelemetry(root);
+      facts['routingFreshness'] = { unfedRunIds: unfedRuns(routing.harvest.samples, routing.alreadyFed) };
+    } catch { /* fail-open: routing-store-stale is SOFT and needs gathered evidence */ }
+    // marketplace-parity: regenerate the two published showcase manifests from the LIVE registry,
+    // but redirect every write to a unique temp root. Version is operator-owned, so pinning the
+    // published value into generatePlugin makes the comparison composition-only by construction.
+    try {
+      const showcaseDir = join(root, '.claude-plugin');
+      if (!existsSync(showcaseDir)) {
+        facts['marketplaceParity'] = { applicable: false };
+      } else {
+        const pluginPath = join(showcaseDir, 'plugin.json');
+        const marketplacePath = join(showcaseDir, 'marketplace.json');
+        const hasPlugin = existsSync(pluginPath);
+        const hasMarketplace = existsSync(marketplacePath);
+        const manifestFailures: { file: 'plugin.json' | 'marketplace.json'; error: string }[] = [];
+        const readManifest = (path: string, file: 'plugin.json' | 'marketplace.json'): unknown => {
+          try {
+            return JSON.parse(readFileSync(path, 'utf8')) as unknown;
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            manifestFailures.push({ file, error: message.replace(/\s+/g, ' ').slice(0, 240) });
+            return undefined;
+          }
+        };
+        const versionOf = (manifest: unknown): string | undefined => {
+          if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return undefined;
+          const version = (manifest as Record<string, unknown>)['version'];
+          return typeof version === 'string' && version !== '' ? version : undefined;
+        };
+        const publishedPlugin = hasPlugin ? readManifest(pluginPath, 'plugin.json') : undefined;
+        const publishedMarketplace = hasMarketplace ? readManifest(marketplacePath, 'marketplace.json') : undefined;
+        const marketplaceRecord = publishedMarketplace && typeof publishedMarketplace === 'object' && !Array.isArray(publishedMarketplace)
+          ? publishedMarketplace as Record<string, unknown>
+          : undefined;
+        const marketplacePlugins = marketplaceRecord !== undefined && Array.isArray(marketplaceRecord['plugins'])
+          ? marketplaceRecord['plugins']
+          : [];
+        const publishedVersion = versionOf(publishedPlugin)
+          ?? versionOf(publishedMarketplace)
+          ?? versionOf(marketplacePlugins[0]);
+        if (manifestFailures.length > 0) {
+          facts['marketplaceParity'] = {
+            applicable: true,
+            manifestFailures,
+            ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+          };
+        } else if (hasPlugin !== hasMarketplace) {
+          facts['marketplaceParity'] = {
+            applicable: true,
+            onlyOnePresent: true,
+            ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+          };
+        } else if (!hasPlugin) {
+          facts['marketplaceParity'] = { applicable: false };
+        } else {
+          let scratch: string | undefined;
+          try {
+            const registry = buildRegistry(root);
+            scratch = mkdtempSync(join(tmpdir(), 'dz-guard-marketplace-'));
+            const generated = generatePlugin(scratch, registry, { version: publishedVersion });
+            const freshPlugin = JSON.parse(readFileSync(generated.pluginJsonPath, 'utf8')) as unknown;
+            const freshMarketplace = JSON.parse(readFileSync(generated.marketplaceJsonPath, 'utf8')) as unknown;
+            facts['marketplaceParity'] = {
+              applicable: true,
+              diverged: !isDeepStrictEqual(publishedPlugin, freshPlugin)
+                || !isDeepStrictEqual(publishedMarketplace, freshMarketplace),
+              ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+            };
+          } catch {
+            facts['marketplaceParity'] = {
+              applicable: true,
+              regenerateFailed: true,
+              ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+            };
+          } finally {
+            if (scratch !== undefined) rmSync(scratch, { recursive: true, force: true });
+          }
+        }
+      }
+    } catch { /* fail-open only on unexpected showcase-discovery failure; manifest read/parse errors are structured violations above */ }
     // agents-md-policy-sync: fixed registry, no tree walk. The pure detector
     // recomputes every expected hash from current source text; this gatherer
     // only supplies bytes. Any unexpected gather failure omits the fact, and
@@ -11107,6 +11591,265 @@ function cmdFeatureAdrRecord(options: Map<string, string>, flags: Set<string>, c
   return emit(decideReadBack(lineToWrite, lastLine), { target });
 }
 
+type ContractDiskRead =
+  | { readonly ok: true; readonly text: string; readonly realPath: string }
+  | { readonly ok: false; readonly diagnostic: ContractDiagnostic };
+
+type ContractDirectoryRead =
+  | { readonly ok: true; readonly realPath: string }
+  | { readonly ok: false; readonly diagnostic: ContractDiagnostic };
+
+function contractRepoRoot(cwd: string): string {
+  let root = cwd;
+  try {
+    root = execSync('git rev-parse --show-toplevel', {
+      cwd,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim() || cwd;
+  } catch { /* temporary repository fixtures intentionally use cwd as their root */ }
+  return resolve(root);
+}
+
+function contractReadConfined(repoRoot: string, absolute: string, artifact: string): ContractDiskRead {
+  let rootReal: string;
+  let targetReal: string;
+  try {
+    rootReal = realpathSync(repoRoot);
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'repository-unreadable', message: 'repository root cannot be resolved', artifact: '.' },
+    };
+  }
+  try {
+    targetReal = realpathSync(absolute);
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'artifact-unreadable', message: `required artifact cannot be resolved or read: ${artifact}`, artifact },
+    };
+  }
+  const rel = relative(rootReal, targetReal);
+  if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || isAbsolute(rel)) {
+    return {
+      ok: false,
+      diagnostic: { code: 'artifact-outside-repository', message: `artifact resolves outside the repository: ${artifact}`, artifact },
+    };
+  }
+  try {
+    if (!statSync(targetReal).isFile()) throw new Error('not a regular file');
+    return { ok: true, text: readFileSync(targetReal, 'utf-8'), realPath: targetReal };
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'artifact-unreadable', message: `required artifact cannot be read as a file: ${artifact}`, artifact },
+    };
+  }
+}
+
+function contractDirectoryConfined(repoRoot: string, absolute: string, artifact: string): ContractDirectoryRead {
+  let rootReal: string;
+  let targetReal: string;
+  try {
+    rootReal = realpathSync(repoRoot);
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'repository-unreadable', message: 'repository root cannot be resolved', artifact: '.' },
+    };
+  }
+  try {
+    targetReal = realpathSync(absolute);
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'adr-directory-unreadable', message: `required ADR directory cannot be resolved: ${artifact}`, artifact },
+    };
+  }
+  const rel = relative(rootReal, targetReal);
+  if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || isAbsolute(rel)) {
+    return {
+      ok: false,
+      diagnostic: { code: 'artifact-outside-repository', message: `artifact resolves outside the repository: ${artifact}`, artifact },
+    };
+  }
+  try {
+    if (!statSync(targetReal).isDirectory()) throw new Error('not a directory');
+    return { ok: true, realPath: targetReal };
+  } catch {
+    return {
+      ok: false,
+      diagnostic: { code: 'adr-directory-unreadable', message: `required ADR directory is not readable: ${artifact}`, artifact },
+    };
+  }
+}
+
+function contractDiagnosticLine(entry: ContractDiagnostic): string {
+  const where = [entry.artifact, entry.contractId ?? entry.sourceId].filter((part): part is string => part !== undefined).join(' · ');
+  return `  [${entry.code}]${where === '' ? '' : ` ${where} —`} ${entry.message}`;
+}
+
+function cmdContractCheck(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+  writeErr: WriteErr,
+): number {
+  const json = flags.has('json');
+  const emitEarly = (outcome: 'fail' | 'not-established', exitCode: 1 | 2, diagnostics: readonly ContractDiagnostic[]): number => {
+    if (json) {
+      write(JSON.stringify({ outcome, exitCode, diagnostics }));
+    } else {
+      for (const entry of diagnostics) writeErr(contractDiagnosticLine(entry));
+      write(`contract-check: ${outcome === 'fail' ? 'FAIL' : 'NOT-ESTABLISHED'} — ${diagnostics[0]?.message ?? 'no trustworthy verdict'}`);
+    }
+    return exitCode;
+  };
+
+  for (const flag of flags) {
+    if (flag !== 'json' && flag !== 'help') {
+      return emitEarly('not-established', 2, [{ code: 'usage-invalid', message: `unknown option --${flag}`, observed: `--${flag}` }]);
+    }
+  }
+  for (const key of options.keys()) {
+    if (key !== 'slug') {
+      return emitEarly('not-established', 2, [{
+        code: 'usage-invalid',
+        message: key.startsWith('_positional_') ? `unexpected argument ${JSON.stringify(options.get(key))}` : `unknown option --${key}`,
+        observed: key.startsWith('_positional_') ? options.get(key) ?? '' : `--${key}`,
+      }]);
+    }
+  }
+  const slug = (options.get('slug') ?? '').trim();
+  if (!isSafeSlug(slug)) {
+    return emitEarly('not-established', 2, [{
+      code: 'slug-invalid',
+      message: 'a kebab-case --slug <feature> is required (one path segment, max 40 characters)',
+      observed: slug,
+    }]);
+  }
+
+  const repoRoot = contractRepoRoot(cwd);
+  const featureDir = join(repoRoot, 'features', slug);
+  const requirementsRel = `features/${slug}/01_requirements.md`;
+  const reportRel = `features/${slug}/08_qe_report.md`;
+  const requirementsRead = contractReadConfined(repoRoot, join(featureDir, '01_requirements.md'), requirementsRel);
+  if (!requirementsRead.ok) return emitEarly('not-established', 2, [requirementsRead.diagnostic]);
+
+  const adrDirRel = `features/${slug}/03_adr`;
+  const adrDirectory = contractDirectoryConfined(repoRoot, join(featureDir, '03_adr'), adrDirRel);
+  if (!adrDirectory.ok) return emitEarly('not-established', 2, [adrDirectory.diagnostic]);
+  const adrDir = adrDirectory.realPath;
+  let adrNames: string[];
+  try {
+    adrNames = readdirSync(adrDir, { withFileTypes: true })
+      .filter((entry) => entry.name.endsWith('.md') && (entry.isFile() || entry.isSymbolicLink()))
+      .map((entry) => entry.name)
+      .sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  } catch {
+    return emitEarly('not-established', 2, [{
+      code: 'adr-directory-unreadable',
+      message: `required ADR directory cannot be read: ${adrDirRel}`,
+      artifact: adrDirRel,
+    }]);
+  }
+  if (adrNames.length === 0) {
+    return emitEarly('not-established', 2, [{
+      code: 'adr-artifacts-missing',
+      message: `no direct ADR Markdown artifacts exist under ${adrDirRel}`,
+      artifact: adrDirRel,
+      observed: 0,
+    }]);
+  }
+  const adrs: Array<{ path: string; text: string }> = [];
+  const adrReadErrors: ContractDiagnostic[] = [];
+  for (const name of adrNames) {
+    const rel = `features/${slug}/03_adr/${name}`;
+    const read = contractReadConfined(repoRoot, join(adrDir, name), rel);
+    if (read.ok) adrs.push({ path: rel, text: read.text });
+    else adrReadErrors.push(read.diagnostic);
+  }
+  if (adrReadErrors.length > 0) return emitEarly('not-established', 2, adrReadErrors);
+
+  const extracted = extractContractChecklist({
+    requirements: { path: requirementsRel, text: requirementsRead.text },
+    adrs,
+  });
+  if (!extracted.ok) return emitEarly('fail', 1, extracted.diagnostics);
+
+  const reportRead = contractReadConfined(repoRoot, join(featureDir, '08_qe_report.md'), reportRel);
+  if (!reportRead.ok) return emitEarly('not-established', 2, [reportRead.diagnostic]);
+
+  const parsed = parseContractVerdictReport(reportRead.text);
+  if (!parsed.ok) {
+    const diagnostics = parsed.diagnostics.map((entry) => ({
+      ...entry,
+      artifact: entry.artifact ?? reportRel,
+    }));
+    return emitEarly(parsed.established ? 'fail' : 'not-established', parsed.established ? 1 : 2, diagnostics);
+  }
+
+  const evidenceCache = new Map<string, ReturnType<ContractEvidenceReader['read']>>();
+  const reader: ContractEvidenceReader = {
+    reportArtifact: reportRel,
+    read(artifact) {
+      const cached = evidenceCache.get(artifact);
+      if (cached !== undefined) return cached;
+      const disk = contractReadConfined(repoRoot, join(repoRoot, artifact), artifact);
+      let result: ReturnType<ContractEvidenceReader['read']>;
+      if (!disk.ok) {
+        result = { ok: false, code: `evidence-${disk.diagnostic.code}`, detail: disk.diagnostic.message };
+      } else if (disk.realPath === reportRead.realPath) {
+        result = { ok: false, code: 'evidence-self-citation', detail: `${artifact} resolves to the QE verdict payload itself` };
+      } else {
+        result = { ok: true, text: disk.text };
+      }
+      evidenceCache.set(artifact, result);
+      return result;
+    },
+  };
+  const rawVerification = verifyContractVerdicts(extracted.checklist, parsed.report, reader);
+  const withReportArtifact = (entry: ContractDiagnostic): ContractDiagnostic => ({
+    ...entry,
+    artifact: entry.artifact ?? reportRel,
+  });
+  const verification = {
+    ...rawVerification,
+    diagnostics: rawVerification.diagnostics.map(withReportArtifact),
+    items: rawVerification.items.map((item) => ({
+      ...item,
+      diagnostics: item.diagnostics.map(withReportArtifact),
+    })),
+  };
+  if (json) {
+    write(JSON.stringify({
+      contract: extracted.checklist,
+      report: parsed.report,
+      items: verification.items,
+      diagnostics: verification.diagnostics,
+      counts: verification.counts,
+      overallGrade: verification.overallGrade,
+      outcome: verification.outcome,
+      exitCode: verification.exitCode,
+    }));
+    return verification.exitCode;
+  }
+  for (const item of verification.items) {
+    const reason = item.reason === undefined ? '' : ` — ${item.reason}`;
+    write(`  ${item.id}: ${item.verdict ?? 'missing'} · evidence ${item.evidence}${reason}`);
+  }
+  write(`  counts: contract=${verification.counts.contractItems} verdict=${verification.counts.verdictItems} met=${verification.counts.met} unmet=${verification.counts.unmet} not-testable=${verification.counts.notTestable} invalid-evidence=${verification.counts.invalidEvidence}`);
+  write(`  overall grade: ${verification.overallGrade}`);
+  for (const entry of verification.diagnostics) writeErr(contractDiagnosticLine(entry));
+  const summary = verification.outcome === 'pass'
+    ? `${verification.counts.met} contract item(s) met`
+    : `${verification.diagnostics.length} contract or evidence violation(s)`;
+  write(`contract-check: ${verification.outcome === 'pass' ? 'PASS' : 'FAIL'} — ${summary}`);
+  return verification.exitCode;
+}
+
 function cmdAmendmentCheck(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   const json = flags.has('json');
   const readOr = (abs: string): string | null => {
@@ -12307,6 +13050,90 @@ function readRecallUsageEvents(
   return usage;
 }
 
+function readOptionalText(path: string): string {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function deadwoodAllowlistText(): string {
+  const require = createRequire(import.meta.url);
+  const corePackage = require.resolve('@dzhechkov/harness-core/package.json');
+  return readFileSync(join(dirname(corePackage), 'src', 'deadwood-allowlist.json'), 'utf8');
+}
+
+function cmdUsageDepthDays(root: string, now: Date): number | null {
+  const text = readOptionalText(join(root, CMD_USAGE_LOG_RELATIVE));
+  if (text === '') return null;
+  return measureCmdUsageDepthDays(text, now);
+}
+
+/** Canonical deadwood candidates keyed to every alternate top-level dispatch token. */
+const DEADWOOD_COMMAND_ALIASES: Readonly<Record<string, readonly string[]>> = {
+  sync: ['update'],
+};
+
+function deadwoodInventory(root: string): DeadwoodInventoryItem[] {
+  const aliasTokens = new Set(Object.values(DEADWOOD_COMMAND_ALIASES).flat());
+  const inventory: DeadwoodInventoryItem[] = DZ_COMMANDS
+    .filter((surface) => !aliasTokens.has(surface))
+    .map((surface) => ({
+      surface,
+      kind: 'command',
+      ...(DEADWOOD_COMMAND_ALIASES[surface] === undefined
+        ? {}
+        : { aliases: DEADWOOD_COMMAND_ALIASES[surface] }),
+    }));
+  for (const rule of DEFAULT_RULES) inventory.push({ surface: rule.id, kind: 'rule' });
+  const skillDir = resolve(root, '.claude/skills');
+  const { skills } = listSkillsDetailed(skillDir);
+  for (const skill of skills) inventory.push({ surface: skill.id, kind: 'skill' });
+  return inventory;
+}
+
+/** `dz deadwood` is a read-only advisory report; findings never affect the exit code. */
+function cmdDeadwood(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+  writeErr: WriteErr,
+): number {
+  if (flags.has('weeks')) {
+    writeErr('dz deadwood: --weeks requires an integer value');
+    return 1;
+  }
+  const rawWeeks = options.get('weeks') ?? '8';
+  const weeks = Number(rawWeeks);
+  if (!Number.isInteger(weeks) || weeks <= 0 || weeks > 520) {
+    writeErr(`dz deadwood: --weeks must be an integer from 1 to 520 (received ${JSON.stringify(rawWeeks)})`);
+    return 1;
+  }
+  const root = resolve(cwd);
+  try {
+    // Observe integrity before maintenance: compaction may discard malformed lines, but this run
+    // still has to report that they existed rather than laundering the count to zero.
+    const cmdUsageText = readOptionalText(join(resolveCmdUsageRoot(root), CMD_USAGE_LOG_RELATIVE));
+    const report = buildDeadwoodReport({
+      cmdUsageText,
+      guardAuditText: readOptionalText(join(root, '.dz', 'guard-audit.jsonl')),
+      inventory: deadwoodInventory(root),
+      allowlistText: deadwoodAllowlistText(),
+      weeks,
+      now: new Date(),
+    });
+    compactCmdUsageIfNeeded(root);
+    if (flags.has('json')) write(JSON.stringify({ ...report, exitCode: 0 }, null, 2));
+    else write(renderDeadwoodReport(report, 'text'));
+    return 0;
+  } catch (error) {
+    writeErr(`dz deadwood: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+
 /**
  * `dz compounding` — does the learning loop actually PAY? (feature compounding, scout C2.)
  * Gathers the facts (store rows, apply-leg usage log, guard audit) and hands them to the PURE
@@ -12383,7 +13210,15 @@ function cmdCompounding(options: Map<string, string>, flags: Set<string>, cwd: s
     }
   }
 
-  const report = assembleCompoundingReport({ lessons, usage, guard, nowTs: new Date().toISOString(), evidenceLogs });
+  const now = new Date();
+  const report = assembleCompoundingReport({
+    lessons,
+    usage,
+    guard,
+    nowTs: now.toISOString(),
+    evidenceLogs,
+    cmdUsageDepthDays: cmdUsageDepthDays(root, now),
+  });
   // lesson-bandit-rerank §11: the payoff axis joins THIS report rather than growing a private
   // dashboard — the `rewardEvents : exposureEvents` row asks exactly the question this command
   // already asks of the reinforcement loop (is the apply leg alive, or is it a write-only log?).
@@ -13523,6 +14358,34 @@ async function cmdBacklog(options: Map<string, string>, flags: Set<string>, cwd:
   return sub === undefined ? 0 : 1;
 }
 
+/** Read the recommender's existing telemetry planes plus its idempotency receipt. One adapter is
+ * shared by `recommend` and the publish advisory so their freshness definitions cannot drift. */
+function readRoutingTelemetry(repoRoot: string): { harvest: ReturnType<typeof harvestStageOutcomes>; alreadyFed: string[] } {
+  const records: unknown[] = readHarnessRecords(repoRoot);
+  for (const base of [join(repoRoot, 'features'), join(repoRoot, '.dz', 'loop-trace')]) {
+    if (!existsSync(base)) continue;
+    let names: string[] = [];
+    try { names = readdirSync(base); } catch { continue; }
+    for (const name of names) {
+      const sidecar = join(base, name, 'run-meta.json');
+      if (!existsSync(sidecar)) continue;
+      try {
+        const meta = JSON.parse(readFileSync(sidecar, 'utf-8')) as { runMeta?: { resolved?: boolean; records?: unknown[] } };
+        if (meta.runMeta?.resolved === true && Array.isArray(meta.runMeta.records)) records.push(...meta.runMeta.records);
+      } catch { /* an unreadable sidecar contributes no asserted record */ }
+    }
+  }
+  let alreadyFed: string[] = [];
+  const fedPath = join(repoRoot, '.dz', 'routing-fed.json');
+  if (existsSync(fedPath)) {
+    const parsed = JSON.parse(readFileSync(join(repoRoot, '.dz', 'routing-fed.json'), 'utf-8')) as unknown;
+    if (!Array.isArray(parsed)) throw new Error('.dz/routing-fed.json must be a JSON array of runIds');
+    if (parsed.some((v) => typeof v !== 'string')) throw new Error('.dz/routing-fed.json contains a non-string runId');
+    alreadyFed = parsed as string[];
+  }
+  return { harvest: harvestStageOutcomes(records), alreadyFed };
+}
+
 /**
  * `dz routing` — inspect the learned cost-optimal routing outcome store (feature learned-cost-routing). Shows
  * what `args.models[stage]='auto-cost'` currently believes per (stage, complexity-tier, model): gated
@@ -13537,28 +14400,20 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
   // ── recommend — harvest real telemetry, print per-stage picks WITH THE BASIS, optionally feed the
   // store (a9c3dd5c fn 3, ADR-001). Sources: live harness records + imported run-meta.json sidecars.
   if (options.get('_positional_0') === 'recommend') {
-    const records: unknown[] = readHarnessRecords(repoRoot);
-    // imported runs (trace-bundle ADR-001 D4): run-meta sidecars carry runMeta.records of the SAME shape
-    for (const base of [join(repoRoot, 'features'), join(repoRoot, '.dz', 'loop-trace')]) {
-      if (!existsSync(base)) continue;
-      let names: string[] = [];
-      try { names = readdirSync(base); } catch { continue; }
-      for (const name of names) {
-        const sidecar = join(base, name, 'run-meta.json');
-        if (!existsSync(sidecar)) continue;
-        try {
-          const meta = JSON.parse(readFileSync(sidecar, 'utf-8')) as { runMeta?: { resolved?: boolean; records?: unknown[] } };
-          if (meta.runMeta?.resolved === true && Array.isArray(meta.runMeta.records)) records.push(...meta.runMeta.records);
-        } catch { /* an unreadable sidecar contributes nothing — counted below as noResult */ }
-      }
+    let routing: ReturnType<typeof readRoutingTelemetry>;
+    try { routing = readRoutingTelemetry(repoRoot); }
+    catch (e) {
+      write(`dz routing recommend: cannot read routing freshness state — ${(e as Error).message}`);
+      return 1;
     }
-    const harvest = harvestStageOutcomes(records);
-    const rec = recommendModels(harvest, { ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}) });
+    const harvest = routing.harvest;
+    let rec = recommendModels(harvest, {
+      ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}),
+      alreadyFed: routing.alreadyFed,
+    });
     if (flags.has('apply')) {
       const fedPath = join(repoRoot, '.dz', 'routing-fed.json');
-      let alreadyFed: string[] = [];
-      try { alreadyFed = JSON.parse(readFileSync(fedPath, 'utf-8')) as string[]; } catch { /* first apply */ }
-      const plan = planFeed(harvest.samples, alreadyFed);
+      const plan = planFeed(harvest.samples, routing.alreadyFed);
       for (const sample of plan.toFeed) finalizeOutcome(repoRoot, sample.stage, sample.tier, sample.model, sample.success);
       try {
         mkdirSync(join(repoRoot, '.dz'), { recursive: true });
@@ -13567,6 +14422,10 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
         write(`dz routing recommend: fed ${plan.toFeed.length} sample(s) but could NOT persist the fed-set — a re-apply WILL double-count: ${(e as Error).message}`);
         return 1;
       }
+      rec = recommendModels(harvest, {
+        ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}),
+        alreadyFed: plan.fedAfter,
+      });
       write(`dz routing recommend --apply: fed ${plan.toFeed.length} sample(s) into .dz/routing-outcomes.json${plan.skippedRuns.length > 0 ? `; skipped ${plan.skippedRuns.length} already-fed run(s) (idempotent by runId)` : ''}`);
     }
     if (flags.has('json')) {
@@ -13578,6 +14437,9 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
       write(`  ${s.stage.padEnd(14)} ${s.spec.padEnd(20)} ${s.insufficientData ? '[insufficient data — cold-start pick]' : '[quality bar met]'} ${s.pick.evidence}`);
     }
     write(`  basis: ${rec.basis.rule}`);
+    if (rec.basis.freshness === 'current') write('  store: current (0 unharvested runs)');
+    else if (rec.basis.freshness === 'stale') write(`  store: STALE — ${rec.basis.unfed.count} run(s) harvested but never fed; auto-cost is routing from an older snapshot — run \`dz routing recommend --apply\``);
+    else write('  store: UNFED — auto-cost has no learned rows; picks below are cold-start');
     write(`  basis: skipped records — no result ${rec.basis.skipped.noResult}, no modelsUsed ${rec.basis.skipped.noModels} (predates model routing — history, not an error), no grade ${rec.basis.skipped.noGrade}, unknown model ${rec.basis.skipped.unknownModel}`);
     write(`  basis: ${rec.basis.crossFamilyNote}`);
     return 0;
@@ -14175,8 +15037,10 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   // reads appear nowhere in help, and static extraction over the dispatch table lost `--week` from
   // `dz recap` — a refusal built on either list would reject working commands, which is a worse
   // failure than the one being fixed. Goes to STDERR so a `--json` consumer's stdout stays clean.
-  for (const notice of unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS)) {
-    writeErr(notice.line);
+  if (command !== 'contract-check') {
+    for (const notice of unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS)) {
+      writeErr(notice.line);
+    }
   }
 
   // ── `dz --version` / `dz -v` / `dz version` — PRE-DISPATCH, before the help branch ──
@@ -14204,6 +15068,14 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
     return 0;
   }
 
+  // Only registered command identifiers are telemetry. An unknown first argv token may be a path,
+  // typo, or secret-like value; persisting it would violate the command-name-only privacy boundary.
+  // `contract-check` has an explicit byte-for-byte read-only contract: even the advisory command
+  // usage ledger would mutate the repository being audited and invalidate its own safety proof.
+  if (command !== 'contract-check') {
+    recordCommandInvocation(cwd, DZ_COMMANDS.includes(command) ? command : '', new Date());
+  }
+
   try {
     switch (command) {
       case 'init':
@@ -14253,6 +15125,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdUsage(options, optionLists, flags, cwd, write);
       case 'claim-check':
         return cmdClaimCheck(options, optionLists, flags, cwd, write);
+      case 'lint':
+        return cmdLint(options, flags, cwd, write);
       case 'sign':
         return cmdSign(options, flags, cwd, write);
       case 'sbom':
@@ -14325,6 +15199,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdSkillsVerify(options, flags, cwd, write);
       case 'compounding':
         return cmdCompounding(options, flags, cwd, write);
+      case 'deadwood':
+        return cmdDeadwood(options, flags, cwd, write, writeErr);
       case 'epoch-replay':
         return cmdEpochReplay(options, flags, cwd, write);
       case 'score':
@@ -14335,6 +15211,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdCadence(options, flags, cwd, write);
       case 'qe-rounds':
         return cmdQeRounds(options, flags, cwd, write);
+      case 'restart-advisor':
+        return cmdRestartAdvisor(options, flags, cwd, write);
       case 'tg-post':
         return cmdTgPost(options, flags, cwd, write);
       case 'name-check':
@@ -14345,6 +15223,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdFeatureAdrRecord(options, flags, cwd, write);
       case 'amendment-check':
         return cmdAmendmentCheck(options, flags, cwd, write);
+      case 'contract-check':
+        return cmdContractCheck(options, flags, cwd, write, writeErr);
       case 'feature-adr-checkpoint':
         return cmdFeatureAdrCheckpoint(options, flags, cwd, write);
       case 'profile':