@dzhechkov/harness-cli 0.8.24 → 0.8.26

package/dist/cli.js

@@ -3,8 +3,16 @@
  *
  * @packageDocumentation
  */
-import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
-import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { parseNpmPackInventory } from '@dzhechkov/harness-core';
+// Fix-round 1 (Codex HIGH-1c, feature recall-short-terms): the ONE place `dz recall` prints an
+// empty result must name WHY — via the shared helper, not by re-deriving the decision. Routed
+// through harness-core's re-export (lead correction) rather than a new direct dependency on
+// `@dzhechkov/memory`: a new package-graph edge is a publishing-surface change outside this
+// feature's scope, and harness-core already depends on memory.
+import { noSearchableTermsReason } from '@dzhechkov/harness-core';
+import { appendFileSync, chmodSync, closeSync, constants as fsConstants, cpSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, posix as nodePosixPath } from 'node:path';
+const posixNormalize = nodePosixPath.normalize;
 import { fileURLToPath } from 'node:url';
 import { request as httpsRequest } from 'node:https';
 import { KNOWN_CLI_FLAGS } from './known-flags.js';
@@ -13,15 +21,15 @@ import { resolveInstallSpec } from './install-spec.js';
 import { dispatchedCommands, documentedCommands } from './command-inventory.js';
 import { execFile, execFileSync, execSync, spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { homedir, hostname, tmpdir } from 'node:os';
+import { cpus, homedir, hostname, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 import { isDeepStrictEqual } from 'node:util';
 import { JOURNAL_KINDS, formatLine, parseLine, selectWindow, appendWitnessed } from '@dzhechkov/harness-core';
 import { appendRunEvent, readRunRegistry, liveParents, liveness, probePid, settleDeadRuns, planRegistryArchive, planWorktreeCleanup, renderCleanupPlan, worktreeRemovalsToApply } from '@dzhechkov/harness-core';
 import { openRound, closeRound, listRounds, parseCodexTokens, classifyRoundExecOutcome, buildRoundExecRow, } from '@dzhechkov/harness-core';
-import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, resolveSelection, formatSelectRefusal, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, memoryBackendSourceLabel, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
+import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, loadSkillFromDir, resolveSelection, formatSelectRefusal, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, memoryBackendSourceLabel, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
 // dz workflow run (feature dz-workflow-run): the pure scheduler + the dispatch adapters.
-TRACE_RUNID_RE, WF_RUN_OWNER_HOST, preflight, runWorkflow, makeClaudePDispatcher, makeCodexExecDispatcher, NamedLockTimeoutError, NamedLockCompromisedError, POLICY_SOURCES, detectPolicyDrift, hasPolicyFence, TARGET_NAMES, buildParityMatrix, computeParity, PARITY_FEATURES, downgradeForStaleEvidence, findStaleTranscriptEvidence, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, applyLegStatus, applyLegReasonMessage, resolveAgentdbPath, WORKFLOW_TEMPLATES_RETIRED_MESSAGE, parsePlan, isParseErrors, validatePlan, normalizePlan, planDigest, toTraceProjection, renderPlan, mergeRender, lint, lintExitCode, LOOP_BLOBS, parseTrace, assembleTimeline, runInvariants, deriveAttestation, stampAttestation, corroborate, NOT_WITNESSED, renderTimelineHtml, importEcc, recordPattern, recordLessonForms, normalizeLessonForms, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, renderFeatureAdrPhaseLine, statuslineData, countLearningStoreRowsReadonly, readStoreMark, writeStoreMark, resetStoreMark, checkStoreHealth, storeGuardPath, storeSnapshotPath, writeFeatureAdrState, writeFeatureAdrStateDetailed, CHECKPOINT_STAGES, estimateEta, extractStageSamples, formatEta, parseCheckpointLines, segmentRun, computeSpendReport, deriveCostLedger, planLedgerBackfill, listCostLedgerRuns, resolveLedgerRunId, AMBIGUOUS, stampCheckpointLine, LEDGER_FILL_SOURCE, renderCostLedger, verifyCostLedgerReport, writeCostLedgerJsonl, COST_LEDGER_SCOPE, spendReport, claimCheck, summarize, BUNDLED_SLOP_REGISTRY_URL, DEFAULT_SLOP_CONFIG, parseSlopRegistry, slopLint, validateSlopLintConfig, queryBookKnowledge, loadStorePatternsSync, patternRecordId, patternIdentityOf, mergeLessonMatchedForms, SWARM_BRIEF_CONTRACT, checkSwarmBrief, visibleText, loadStoreRecords, findExactLesson, recordToPattern, bundleSkills, brainHome, brainAgentdbPath, listPreReindexSnapshots, rotatePreReindexSnapshots, scanSnapshotDir, listBrain, bookKbPath, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, EVENT_CHAIN_TAIL_BYTES, EMPTY_LOG_TAIL, readTailInfo, appendChainedLines, verifyEventChainText, classifyChainDefects, CHAINED_JOURNALS, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, appendTransition, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, parsePnpmLockImporters, scannableStubPath, 
+TRACE_RUNID_RE, WF_RUN_OWNER_HOST, preflight, runWorkflow, makeClaudePDispatcher, makeCodexExecDispatcher, NamedLockTimeoutError, NamedLockCompromisedError, POLICY_SOURCES, detectPolicyDrift, hasPolicyFence, TARGET_NAMES, buildParityMatrix, computeParity, PARITY_FEATURES, downgradeForStaleEvidence, findStaleTranscriptEvidence, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, applyLegStatus, applyLegReasonMessage, probeApplyLeg, resolveAgentdbPath, WORKFLOW_TEMPLATES_RETIRED_MESSAGE, parsePlan, isParseErrors, validatePlan, normalizePlan, planDigest, toTraceProjection, renderPlan, mergeRender, lint, lintExitCode, LOOP_BLOBS, parseTrace, assembleTimeline, runInvariants, deriveAttestation, stampAttestation, corroborate, NOT_WITNESSED, renderTimelineHtml, importEcc, recordPattern, recordLessonForms, normalizeLessonForms, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, renderFeatureAdrPhaseLine, statuslineData, countLearningStoreRowsReadonly, readStoreMark, writeStoreMark, resetStoreMark, checkStoreHealth, storeGuardPath, storeSnapshotPath, writeFeatureAdrState, writeFeatureAdrStateDetailed, CHECKPOINT_STAGES, estimateEta, extractStageSamples, formatEta, parseCheckpointLines, segmentRun, computeSpendReport, deriveCostLedger, planLedgerBackfill, listCostLedgerRuns, resolveLedgerRunId, AMBIGUOUS, stampCheckpointLine, LEDGER_FILL_SOURCE, renderCostLedger, verifyCostLedgerReport, writeCostLedgerJsonl, COST_LEDGER_SCOPE, spendReport, claimCheck, summarize, BUNDLED_SLOP_REGISTRY_URL, DEFAULT_SLOP_CONFIG, parseSlopRegistry, slopLint, validateSlopLintConfig, queryBookKnowledge, loadStorePatternsSync, patternRecordId, patternIdentityOf, mergeLessonMatchedForms, SWARM_BRIEF_CONTRACT, checkSwarmBrief, visibleText, loadStoreRecords, findExactLesson, recordToPattern, bundleSkills, brainHome, brainAgentdbPath, listPreReindexSnapshots, rotatePreReindexSnapshots, scanSnapshotDir, listBrain, bookKbPath, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, EVENT_CHAIN_TAIL_BYTES, EMPTY_LOG_TAIL, readTailInfo, appendChainedLines, verifyEventChainText, classifyChainDefects, CHAINED_JOURNALS, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, appendTransition, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, parsePnpmLockImporters, scannableStubPath, 
 // guard-promotion (feature guard-promotion, scout idea #1)
 assembleCandidates, renderPromotionReport, renderPromotionAdr, normalizePromotionState, nextPromotionState, recordPromotionRunEvidence, isLessonRuleContentAnchor, isOffsetIsoTimestamp, globMatch, promotionAdrRelPath, DEFAULT_WINDOW_DAYS, DEFAULT_PERIODS, MAX_CONTENT_FETCHES, BUILTIN_COVERAGE, decideProvenance, isInsideTree, signManifest, verifyManifest, hashPackBytes, rewriteWorkspaceSpecs, detectSiblingDrift, planPackedInstallSmoke, judgePackedInstallSmoke, listPackFiles, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, resolveScanTailTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, runRetroTailScan, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, classifyExecutionEvidence, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, harvestStageOutcomes, recommendModels, planFeed, unfedRuns, GRADE_SUCCESS_FLOOR, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, declaredPluginSurface, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, buildDeadwoodReport, compactCmdUsageIfNeeded, measureCmdUsageDepthDays, recordCommandInvocation, resolveCmdUsageRoot, renderDeadwoodReport, CMD_USAGE_LOG_RELATIVE, banditStats, narrowBanditReport, renderBanditHealth, 
 // Cold-vs-warm EPOCH RUNNER (feature epoch-replay) — orchestrates + scores, never calls a model.
@@ -31,7 +39,7 @@ readBacklogConfig, readIdeas, writeIdeas, ideaId, dedupIdea, readGoalMap, readGo
 // qe-bridge (feature qe-bridge-claude, ADR-001): the pure half of the reverse QE bridge.
 KNOWN_CLAUDE, isSafeClaudeId, claudeProbeArgs, claudeReviewArgs, interpretClaudeProbe, modelFamily, buildBridgePrompt, parseBridgeOutput, buildBridgeFailureRecord, buildBridgeSignoffRecord, renderBridgeReport, isSafeSlug, hasUnsafePathChars, hasDotDotSegment, buildReqeBrief, settleReqeDebt, renderReqeList, REQE_SCOPE, 
 // Mutation gate (feature ha-mutation-gate) — break each named protection, run the suite, require red.
-REGISTRY_SELFCHECK_TESTS, buildMutationTestCommand, parseMutationRegistry, applyMutationToText, attributeBaselineRedness, countFailingTests, detectSuiteCompletionReceipt, detectSuiteReceiptMismatch, classifyBaseline, classifyRunFailure, classifyMutationOutcome, mutationGateExitCode, summarizeMutationResults, renderMutationReport, runWithOneInternalRetry, TRACE_BUNDLE_LEDGER_PATH, TRACE_BUNDLE_SCHEMA, TRACE_BUNDLE_RUN_META_FILE, buildBundle, serializeBundle, parseBundle, planImport, decideCheckpointWrite, amendmentSection, amendmentSectionCount, amendmentDeclarationAmbiguity, planSaysNoAmendments, parseAmendments, resolveAmendments, decideAmendmentOutcome, amendmentVerdictLine, amendmentsMissingFromPlan, AMENDMENT_VACUITY_NOTE, extractContractChecklist, readFeatureTier, parseContractVerdictReport, verifyContractVerdicts, decideSignableSet, signableSetLine, decideRecordWrite, decideReadBack, recordVerdictLine, buildCadenceReport, tgVisibleSha256, CADENCE_WINDOW_DAYS, readQeRounds, QE_ROUNDS_DEFAULT_CEILING, adviseRestart, describeStoreLocation, storeLocationLine, resolveTeachTarget, teachReasonPhrase, readTeachToConfig, TeachTargetError, mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel, 
+REGISTRY_SELFCHECK_TESTS, buildMutationTestCommand, parseMutationRegistry, registryEntriesAddedSince, applyMutationToText, attributeBaselineRedness, countFailingTests, detectSuiteCompletionReceipt, detectSuiteReceiptMismatch, classifyBaseline, classifyRunFailure, classifyMutationOutcome, mutationGateExitCode, summarizeMutationResults, renderMutationReport, runWithOneInternalRetry, TRACE_BUNDLE_LEDGER_PATH, TRACE_BUNDLE_SCHEMA, TRACE_BUNDLE_RUN_META_FILE, buildBundle, serializeBundle, parseBundle, planImport, decideCheckpointWrite, amendmentSection, amendmentSectionCount, amendmentDeclarationAmbiguity, planSaysNoAmendments, parseAmendments, resolveAmendments, decideAmendmentOutcome, amendmentVerdictLine, amendmentsMissingFromPlan, AMENDMENT_VACUITY_NOTE, extractContractChecklist, readFeatureTier, parseContractVerdictReport, verifyContractVerdicts, decideSignableSet, signableSetLine, decideRecordWrite, decideReadBack, recordVerdictLine, buildCadenceReport, tgVisibleSha256, CADENCE_WINDOW_DAYS, readQeRounds, QE_ROUNDS_DEFAULT_CEILING, adviseRestart, describeStoreLocation, storeLocationLine, resolveTeachTarget, teachReasonPhrase, readTeachToConfig, TeachTargetError, mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel, 
 // operator-profile (ADR-001): per-user 0600 store + marked block in ~/.claude/CLAUDE.md
 renderProfileBlock, readProfile, writeProfile, syncProfileBlock, checkProfileDrift, parseRegister, registerOwnerWord, profileAgeDays, parseDomainList, domainListText, parseYesNo, REGISTERS, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
@@ -141,7 +149,7 @@ Usage:
   dz profile [init|show|set|sync] [--json]   (WHO the assistant is talking to — per-user store at ~/.dz/profile.json (0600, NEVER in a project), delivered as a marked block in ~/.claude/CLAUDE.md so it loads in EVERY project, dz installed or not. init = five questions (language, register, deep/weak domains as comma lists — "networking (CCIE; NSX)" keeps the parenthetical as the note, Enter skips — teaches y/n with one re-ask, never a silent default); show ALWAYS prints the store path + age + drift verdict + the rendered block; set register|language|teaches <v> or set deep|weak add|rm <tag> [note] — register accepts the owner's own words (профи / профи лайт / просто), an unknown value is REFUSED naming the accepted set; sync re-writes the block (runs automatically after init/set; foreign content byte-for-byte, timestamped backup before every modifying write). The register changes FORM, never FACTS, and governs dialogue only — never ADRs/commits/QE reports; both rules are baked into the rendered block at every level. exit 0 done / 1 no profile or failed / 2 refused input)
   dz reqe [--slug <feature> [--done --report <f>]] [--json]   (the re-QE debt ledger: a usage-switched run whose Step-8 QE ran on the coder's OWN family records a debt; list debts, print the cross-family review brief, settle FAIL-CLOSED against a graded report — the settlement lands in 08_qe_report.md)
   dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   (the REVERSE QE bridge: run an INDEPENDENT Claude reviewer over a feature's Step-8 artifacts from ANY host — a Codex session included, plain shell, no Claude agent plane needed — and land a PARSED signoff. The reviewer runs ISOLATED: an EMPTY temp cwd plus --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load, and the verdict is read from the --output-format json RESULT ENVELOPE — text a session customization printed onto the same stdout can never become a signoff. Probes the model before trusting it; sends SCOPED extracts with a loud 200k-char ceiling (never silent truncation); the grade must AGREE across three LAST-anchored channels (terminal marker line, fenced qe-bridge-signoff JSON, the report's own GRADE line) AND the marker must be the FINAL content — empty, gradeless, self-contradicting or miscounted output is one of 17 NAMED failures with an audit record under features/<slug>/.fa-state/qe-bridge/ (runId, resolved executable + binOverride, prompt sha256, channel offsets, requestedOut, reportWritten, retained raw stdout; 0600 files in a 0700 dir), never a clean review. A --coder-family that contradicts the recorded reqe debt is refused. Writes features/<slug>/08b_reqe_report.md, which dz reqe --done settles unchanged. DISCLOSURE: the extracts you scope are sent to the Claude runtime; the bridge cannot classify secrets. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM, not a flag. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage)
-  dz mutation-gate [--package <dir>] [--registry <file>] [--test-cmd "<cmd>"] [--only <id[,id]>] [--timeout <ms>] [--rebaseline per-entry|final] [--keep-scratch] [--json]   (prove each NAMED protection has a test that DISCRIMINATES: copy the package to a scratch dir, verify the baseline suite is green, apply each registry mutation, run the suite, REQUIRE red, restore. The red must be BEHAVIOURAL: a mutation that no longer parses is MUTATION_UNPARSEABLE; a red run whose OWN output reports a test FILE failing to load (node --test file-level not-ok with exitCode, vitest Failed Suites) is MUTATION_LOAD_FATAL — the signal comes from the same run as the failing count, never from a separate isolated import; red output whose shape matches no known runner is INCONCLUSIVE (a runner-coverage gap, loud, never PROVEN); a count far above the entry's bound is OVER_FAILING; a restored tree that does not reproduce green makes the entry INCONCLUSIVE (flaky). Mutation writes are realpath-contained to the scratch copy: a symlink escape or a node_modules/ target is refused (exit 2), the real tree is never written. A mutation that does not apply, a green suite, or an inconclusive run is a FAILURE — never a skip. exit 0 all proven / 1 gate failed / 2 setup error)
+  dz mutation-gate [--package <dir>] [--registry <file>] [--test-cmd "<cmd>"] [--only <id[,id]>] [--touched <path[,path]>] [--added-since <git-ref>] [--timeout <ms>] [--max-workers <n>] [--rebaseline per-entry|final] [--keep-scratch] [--json]   (prove each NAMED protection has a test that DISCRIMINATES: '--max-workers' resolves flag > the registry's own 'maxWorkers' field > 'min(4, max(1, floor(cpus/2)))' (an invalid flag value — 0, negative, fractional, non-numeric — is a usage error, exit 2, never a silent default; fix-round 1), injects '--maxWorkers=<n>' right after 'vitest run' inside its own compound-command segment (unless that segment already names the flag; fix-round 1 — scoped detection, not a whole-command substring check) and sets 'VITEST_MAX_WORKERS=<n>' in the env regardless — an uncapped full-suite baseline/mutant run at vitest's default worker count (= cpu cores) has measured load 62-358 and <2GB free on an 8-core/16GB box under embedding-daemon tests, killing full overnight gate runs (0bb74d66); printed as 'mutation-gate: workers: <n> (<flag|registry|default>)', or 'mutation-gate: workers: n/a — test command is not vitest' when the command is not recognised as vitest. '--touched' selects entries whose 'file' matches one of the given paths, accepted in ANY of package-relative, './'-prefixed, absolute-inside-the-package, repo-relative, or backslash-separated form — all normalized to package-relative POSIX before matching (fix-round 1, AM-1); a path that resolves OUTSIDE the package is counted, never silently dropped, as '<K> outside package' in the 'selected N of M' line; '--added-since <ref>' selects entries whose id is not present in the registry as it read at that ref ('git show <ref>:<registry path>'): a registry genuinely ABSENT at that ref means every current entry counts as added (said explicitly); an unresolvable ref, any OTHER git failure, or an invalid/malformed base registry at that ref is a usage error (exit 2), never folded into "absent" (AM-3) — a feature scopes the gate to its own touched files and any entries it just added instead of the whole registry (MEASURED: an unscoped run over 358 entries on this repo's core package ran 30-40 minutes and hit the timeout wall, INCONCLUSIVE every time). The two selectors UNION and the result INTERSECTS with '--only' when both are given; an empty selection prints 'selected 0 of M entries (…)' and exits 0 — never a silent skip; '--json' always carries a 'selection' object ({selected, total, touched, addedSince, base, outsidePackage}) on every scoped run (AM-4). copy the package to a scratch dir, verify the baseline suite is green, apply each registry mutation, run the suite, REQUIRE red, restore. The red must be BEHAVIOURAL: a mutation that no longer parses is MUTATION_UNPARSEABLE; a red run whose OWN output reports a test FILE failing to load (node --test file-level not-ok with exitCode, vitest Failed Suites) is MUTATION_LOAD_FATAL — the signal comes from the same run as the failing count, never from a separate isolated import; red output whose shape matches no known runner is INCONCLUSIVE (a runner-coverage gap, loud, never PROVEN); a count far above the entry's bound is OVER_FAILING; a restored tree that does not reproduce green makes the entry INCONCLUSIVE (flaky). Mutation writes are realpath-contained to the scratch copy: a symlink escape or a node_modules/ target is refused (exit 2), the real tree is never written. A mutation that does not apply, a green suite, or an inconclusive run is a FAILURE — never a skip. exit 0 all proven / 1 gate failed / 2 setup error)
   dz backlog add "<idea>" [--effort 1-5] [--proposal <text>] [--dry-run] [--allow-cold-start] [--project <dir>] [--json]   (capture an idea: semantic dedup against existing ideas via the Brain vector engine (DUPLICATE>=0.92 merges, RELATED links, NEW creates) + GoalMap alignment; --dry-run classifies without writing)
   dz backlog list [--status <s>] [--goal <id>] [--project <dir>] [--json]   (list captured ideas, filterable by status/goal)
   dz backlog show <id> [--project <dir>] [--json]                          (full record for one idea)
@@ -1807,6 +1815,43 @@ async function cmdInstall(options, flags, cwd, write, writeErr, installRunner) {
     if (root.layout === 'npx-template' && root.hasCompanionAssets) {
         write(`  note: ${pkg} also ships commands/hooks/agents — \`npx -y ${pkg} init\` installs the full kit.`);
     }
+    // Junk-skip summary (feature skills-walk-symlinks-and-junk, FR-2/AC-3). `report.skills[].skipped`
+    // above is a WRITE outcome (an existing file not overwritten without --force) — a different
+    // question from "did this skill directory contain build/cache junk that never became an asset at
+    // all". Re-walk each discovered skill (a cheap second READ — `loadSkillFromDir` already did this
+    // once inside `runInit`'s `adapter.compile`, this adds no write) to surface that count without
+    // reshaping `InitReport`. Silent at N=0 (AC-3): most packages ship no junk and must print nothing.
+    // fix-round 1 MEDIUM-4: this counts ENTRIES, not files. A skipped junk DIRECTORY (e.g.
+    // `__pycache__`) is exactly one entry here even though it may hold many files underneath —
+    // `walkFiles` never descends into a skipped junk directory to count those (see skills.ts),
+    // so a per-file count would be a number this code cannot honestly produce. The wording and
+    // the trailing `/` on directory paths say so, instead of implying "file" for something that
+    // may be a whole tree.
+    let junkSkippedCount = 0;
+    const junkSkippedPaths = [];
+    for (const id of discoverSkillIds(root.dir)) {
+        let skill;
+        try {
+            skill = loadSkillFromDir(root.dir, id);
+        }
+        catch {
+            continue; // unparseable skills are reported separately via report.failures below
+        }
+        for (const entry of skill.skipped ?? []) {
+            if (!entry.reason.startsWith('junk'))
+                continue; // broken-symlink/cycle/escape skips are a different concern (FR-1/AM-8)
+            junkSkippedCount += 1;
+            const shownPath = relative(pkgDir, entry.path).split('\\').join('/');
+            const isDir = entry.reason.startsWith('junk directory');
+            junkSkippedPaths.push(isDir ? `${shownPath}/` : shownPath);
+        }
+    }
+    if (junkSkippedCount > 0) {
+        const shown = junkSkippedPaths.slice(0, 5).join(', ');
+        const more = junkSkippedPaths.length > 5 ? `, … (+${junkSkippedPaths.length - 5} more)` : '';
+        const noun = junkSkippedCount === 1 ? 'entry' : 'entries';
+        write(`skills: skipped ${junkSkippedCount} junk ${noun} (${shown}${more})`);
+    }
     // Skip-and-collect at install time (D1 / the report's D2 amendment): the offending
     // SKILL.md came out of the DOWNLOADED TARBALL, so the path is rendered relative to
     // the package root (a `node_modules/**` absolute path is not actionable) and the
@@ -4243,7 +4288,19 @@ async function cmdRecall(options, flags, cwd, write, writeErr, classMatcher) {
     }
     if (hits.length === 0) {
         write(`dz recall "${shownQuery}"`);
-        write(`  No matching patterns (teach some with \`dz teach\`, or consolidate sessions).`);
+        // Fix-round 1 (Codex HIGH-1c): a query that tokenizes to literally nothing (pure
+        // punctuation/whitespace) is a DIFFERENT empty result than a query with real terms that
+        // simply matched no record — FR-3 requires the reason to be named, not folded into the same
+        // generic "no matching patterns" line. `noSearchableTermsReason` is the single source of
+        // truth for the decision (memory/src/tokenize.ts); this print site calls it rather than
+        // re-deriving "no searchable terms" from the query text itself.
+        const noTermsReason = noSearchableTermsReason(query);
+        if (noTermsReason !== undefined) {
+            write(`  no searchable terms in "${shownQuery}" (only punctuation/whitespace) — reason: ${noTermsReason}`);
+        }
+        else {
+            write(`  No matching patterns (teach some with \`dz teach\`, or consolidate sessions).`);
+        }
         // The domain note must print here too (Codex QE #10): a --domain run with zero hits
         // silently said nothing about the domain, so the reader could not tell whether the
         // boost had been applied and found nothing, or had not run at all.
@@ -6236,7 +6293,85 @@ function mirrorFailureMessage(error) {
 function packedInstallScratchRoot() {
     return existsSync('/var/tmp') ? '/var/tmp' : tmpdir();
 }
-function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDriftFetcher, packedInstallRunner, publishExecRunner) {
+/**
+ * FR-1 (feature release-smoke-staged-pack): stage every target's `package.json` exactly like a
+ * live publish packs it — `workspace:*` sibling specs rewritten to the exact sibling version
+ * (`rewriteWorkspaceSpecs`), `scripts.prepublishOnly` dropped — run `fn`, then ALWAYS restore the
+ * original bytes in a `finally`, whatever `fn` does or throws. A restore failure is reported
+ * through `write` (with the path), never swallowed — the "absence of a receipt is not success"
+ * rule this file follows everywhere else.
+ *
+ * `cmdPublish`'s dry-run preview and `cmdRelease`'s packed-install-smoke `pack` steps both go
+ * through this ONE helper, so the two doors that ask "what would the registry receive?" pack the
+ * exact same bytes (MEASURED 2026-09-13 16:05: `dz release` packed the live `workspace:*`
+ * package.json and its smoke install died with EUNSUPPORTEDPROTOCOL — `dz publish`'s preview
+ * already staged around this and release never got that).
+ */
+function withStagedPackageJson(targets, workspaceVersions, write, fn, label = 'dz') {
+    // Lead edits after Codex review (2026-09-13, findings 1/5/6): every write — the staged text and
+    // the restore — goes through a sibling temp file + rename, so a reader never sees a truncated
+    // package.json; a restore that FAILS is an error the caller must see (thrown after fn, or attached
+    // to fn's own error), never a warning that lets a run "succeed" on a damaged tree; and the
+    // diagnostic keeps the calling command's name (`label`).
+    const atomicWrite = (path, text) => {
+        // Codex round 2: an EXCLUSIVE, randomized sibling temp — never a shared pid-named file
+        const tmp = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.staged.tmp`;
+        writeFileSync(tmp, text, { flag: 'wx' });
+        renameSync(tmp, path);
+    };
+    const stagedOriginals = [];
+    let fnError;
+    let fnThrew = false;
+    try {
+        for (const p of targets) {
+            const pkgJsonPath = join(p.dir, 'package.json');
+            const original = readFileSync(pkgJsonPath, 'utf-8');
+            const rewritten = JSON.parse(rewriteWorkspaceSpecs(original, workspaceVersions));
+            const scripts = rewritten['scripts'];
+            if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts))
+                delete scripts['prepublishOnly'];
+            stagedOriginals.push({ path: pkgJsonPath, text: original });
+            atomicWrite(pkgJsonPath, JSON.stringify(rewritten, null, 2) + '\n');
+        }
+        return fn();
+    }
+    catch (err) {
+        fnThrew = true;
+        fnError = err;
+        throw err;
+    }
+    finally {
+        const restoreFailures = [];
+        for (const o of stagedOriginals) {
+            try {
+                atomicWrite(o.path, o.text);
+            }
+            catch (err) {
+                const msg = `${label}: ✗ could not restore ${o.path} after staged packing: ${formatPublishError(err)} — the tree is left STAGED, restore it by hand`;
+                try {
+                    write(msg);
+                }
+                catch { /* a throwing writer must not mask the restore failure */ }
+                restoreFailures.push(msg);
+            }
+        }
+        if (restoreFailures.length > 0) {
+            // Codex round 2: one aggregate error carrying BOTH fn's own failure (if any) and the restore
+            // failures — never a bare message assignment that could itself throw out of finally.
+            const fnPart = fnThrew ? `\n(during: ${fnError instanceof Error ? fnError.message : String(fnError)})` : '';
+            // eslint-disable-next-line no-unsafe-finally -- a damaged tree must not read as success
+            throw new Error(`${restoreFailures.join('\n')}${fnPart}`);
+        }
+    }
+}
+function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDriftFetcher, packedInstallRunner, publishExecRunner, gateAuditFsLayer, 
+/**
+ * AM-5 (feature publish-gate-audit-durable): test seam for the sibling-drift gate's `npm pack
+ * --dry-run --json` call — production leaves it unset (real `execFileSync`). Takes the package
+ * dir, returns raw stdout, or THROWS to simulate a real `npm` failure — a test can then prove the
+ * failure reaches `parseNpmPackInventory`'s caller as `unavailable`, never a real subprocess.
+ */
+npmPackRunner) {
     const json = flags.has('json');
     // Under --json stdout carries exactly one JSON document, so every human line — guard notes, refusals,
     // progress — goes to stderr instead of being dropped: a refusal that prints nothing is the silent
@@ -6379,19 +6514,57 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
                 return null;
             }
         });
-    // AM-6: an override (--allow-sibling-drift) is only real once its audit row is DURABLE. A write
-    // failure must refuse the publish rather than print "(logged)" about a log entry that never
-    // landed — the same "absence of a receipt is not success" lesson the registry-probe gate already
-    // enforces for a publish's own confirmation.
-    const auditedOverride = (detail, humanMessage, pkgNameForBlock) => {
-        const wrote = appendPublishGateAudit(cwd, 'sibling-drift', 'warn', detail, '--allow-sibling-drift');
-        if (wrote) {
-            write(`dz publish: ⚠ ${humanMessage} — allowed via --allow-sibling-drift (logged)`);
-            return false;
+    // AM-4: `npm pack --dry-run --json` is a real subprocess — cache it for the lifetime of this
+    // ENTIRE run (keyed by resolved dir), NOT per package being checked (round-1 review, finding 5):
+    // the cache used to be re-created inside the per-package loop body, so two different dependents
+    // of the SAME sibling packed it twice. `npmPackRunner` (AM-5) is a test seam — production leaves
+    // it unset and runs the real subprocess; a test injects a stub that throws to prove a real `npm`
+    // failure reaches the caller as `unavailable`, without spawning anything.
+    // Lead fix after the fix-round's live dry-run (2026-09-14 01:02, MEASURED on the hub): the
+    // workspace side is now PACKED BY THE LIVE TRANSPORT — `pnpm pack` into a per-run temp dir,
+    // unpacked, and handed to core as a `packedDir` that core hashes with the SAME full walk it uses
+    // for the published tarball. `npm pack --dry-run --json` (kept behind the `npmPackRunner` test
+    // seam) never lists the LICENSE pnpm synthesises from the workspace root into a package whose own
+    // tree has none, so two siblings unchanged since publication (harness-presets, scout) read as
+    // "LICENSE only in the published copy" — a false drift the fix-round's inventory could not see.
+    // Honest limit: the seam path (tests) still parses npm's JSON; only production takes the pnpm path.
+    const npmPackInventoryCache = new Map();
+    let packTmpDir;
+    const npmPackInventory = (dir) => {
+        const key = resolve(dir);
+        const hit = npmPackInventoryCache.get(key);
+        if (hit !== undefined)
+            return hit;
+        let out;
+        try {
+            if (npmPackRunner !== undefined) {
+                out = parseNpmPackInventory(npmPackRunner(dir));
+            }
+            else {
+                packTmpDir ??= mkdtempSync(join(tmpdir(), 'dz-drift-pack-'));
+                out = { packedDir: extractIntoTempDir(dir, mkdtempSync(join(packTmpDir, 'p-'))).dir };
+            }
         }
-        write(`dz publish: BLOCKED ${pkgNameForBlock} — ${humanMessage}, and the override could not be recorded (audit write failed); refusing rather than proceeding unlogged`);
-        return true;
+        catch (err) {
+            const how = npmPackRunner !== undefined ? 'npm pack --dry-run --json' : 'pnpm pack';
+            out = { unavailable: `${how} failed: ${err.message.split('\n')[0]}` };
+        }
+        npmPackInventoryCache.set(key, out);
+        return out;
     };
+    const localInventorySource = npmPackRunner !== undefined ? 'npm-pack' : 'pnpm-pack';
+    // AM-3 (Codex round-1 review, finding 4, high): sibling-drift audit records are EXACTLY one per
+    // package per rule per RUN. The old code appended one JSONL record per SIBLING a package depends
+    // on (a package with two drifted deps wrote two rows under the same rule), and the `unavailable`
+    // branch without `--allow-sibling-drift` wrote NO record at all. Every sibling outcome for a
+    // package is now aggregated first (`pkParts`/`pkVerdict`/`pkOverrideUsed`) and written ONCE —
+    // `block` if any sibling blocks, else `warn` if the only issues were resolved via
+    // `--allow-sibling-drift`, else `pass` — with a detail naming every sibling and its status.
+    // `siblingDriftAudited` guarantees the single write even though `--include-drifted`'s fixed-point
+    // loop can revisit the SAME package across rounds: a package's own `dependencies` never change
+    // between rounds, so a later round can only ever re-derive a SUBSET of what the first pass
+    // already covered (its siblings that drifted got folded into the batch and are now skipped).
+    const siblingDriftAudited = new Set();
     let driftBlocked = 0;
     const extraBatch = new Set();
     // AM-2: --include-drifted must reach a FIXED POINT over transitive drifted siblings — a sibling
@@ -6399,92 +6572,156 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
     // (finding 2) showed the single pass never re-checked an EXPANDED batch's own new edges. Capped at
     // `allPackages.length + 1` rounds (the plan's own "цикл с потолком = число пакетов").
     const maxRounds = allPackages.length + 1;
-    for (let round = 0; round < maxRounds; round++) {
-        let addedThisRound = false;
-        for (const pk of targets) {
-            let manifestObj;
-            try {
-                manifestObj = JSON.parse(readFileSync(join(pk.dir, 'package.json'), 'utf-8'));
-            }
-            catch (err) {
-                // AM-3: an unreadable/invalid package.json for a BATCH package is an input this HARD gate
-                // cannot build — it must BLOCK, never silently degrade to "no dependencies" (which used to
-                // read as a clean n/a).
-                const reason = `package.json unreadable/invalid (${err.message.split('\n')[0]})`;
-                if (allowSiblingDrift) {
-                    if (auditedOverride(`${pk.name}: ${reason}`, `sibling drift check unavailable for ${pk.name} (${reason})`, pk.name))
-                        driftBlocked++;
+    // Codex round-3 (2026-09-14): the per-run pack scratch is released in a `finally`, so an
+    // exception thrown while hashing or auditing cannot leak a `dz-drift-pack-*` dir under tmpdir.
+    try {
+        for (let round = 0; round < maxRounds; round++) {
+            let addedThisRound = false;
+            for (const pk of targets) {
+                let manifestObj;
+                try {
+                    manifestObj = JSON.parse(readFileSync(join(pk.dir, 'package.json'), 'utf-8'));
                 }
-                else {
-                    write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${reason}); add --allow-sibling-drift to override (logged) or fix the manifest`);
-                    driftBlocked++;
+                catch (err) {
+                    // AM-3: an unreadable/invalid package.json for a BATCH package is an input this HARD gate
+                    // cannot build — it must BLOCK, never silently degrade to "no dependencies" (which used to
+                    // read as a clean n/a). AND (finding 4) the non-override branch below used to print a
+                    // BLOCKED line with NO audit record behind it — an `unavailable` outcome is logged exactly
+                    // like every other outcome, override or not.
+                    const reason = `package.json unreadable/invalid (${err.message.split('\n')[0]})`;
+                    if (!siblingDriftAudited.has(pk.name)) {
+                        siblingDriftAudited.add(pk.name);
+                        if (allowSiblingDrift) {
+                            const wrote = appendPublishGateAudit(cwd, 'sibling-drift', 'warn', `${pk.name}: ${reason} — allowed via --allow-sibling-drift`, [{ name: pk.name, version: pk.version }], '--allow-sibling-drift', gateAuditFsLayer);
+                            if (wrote.logged) {
+                                write(`dz publish: ⚠ sibling drift check unavailable for ${pk.name} (${reason}) — allowed via --allow-sibling-drift (logged)`);
+                            }
+                            else {
+                                write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable for ${pk.name} (${reason}), and the override could not be recorded (audit write failed: ${wrote.reason ?? 'unknown reason'}); refusing rather than proceeding unlogged`);
+                                driftBlocked++;
+                            }
+                        }
+                        else {
+                            const wrote = appendPublishGateAudit(cwd, 'sibling-drift', 'block', `${pk.name}: ${reason}`, [{ name: pk.name, version: pk.version }], undefined, gateAuditFsLayer);
+                            write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${reason}); add --allow-sibling-drift to override (logged) or fix the manifest${auditSuffix(wrote)}`);
+                            driftBlocked++;
+                        }
+                    }
+                    continue;
                 }
-                continue;
-            }
-            const deps = manifestObj?.dependencies ?? {};
-            const peerDeps = manifestObj?.peerDependencies ?? {};
-            const optionalDeps = manifestObj?.optionalDependencies ?? {};
-            // AM-6: a package with no workspace: dependency at all is n/a for THIS gate — recorded as a
-            // pass note, not silence (FR-6 compatibility: output stays unchanged for such a batch).
-            const anyWorkspaceDep = [...Object.values(deps), ...Object.values(peerDeps), ...Object.values(optionalDeps)]
-                .some((spec) => String(spec).startsWith('workspace:'));
-            if (!anyWorkspaceDep) {
-                appendPublishGateAudit(cwd, 'sibling-drift', 'pass', `${pk.name}: n/a — no workspace: dependency declared`);
-                continue;
-            }
-            const drifts = detectSiblingDrift({
-                dependencies: deps,
-                peerDependencies: peerDeps,
-                optionalDependencies: optionalDeps,
-                workspaceVersions,
-                workspaceDirs,
-                batch: batchNames,
-                fetchPublished,
-            });
-            for (const r of drifts) {
-                if (r.status === 'same') {
-                    appendPublishGateAudit(cwd, 'sibling-drift', 'pass', `${r.name}@${r.version} = workspace (dependent: ${pk.name})`);
-                    write(`dz publish: ✓ sibling drift: none (${r.name}@${r.version} = workspace)`);
+                const deps = manifestObj?.dependencies ?? {};
+                const peerDeps = manifestObj?.peerDependencies ?? {};
+                const optionalDeps = manifestObj?.optionalDependencies ?? {};
+                // AM-6: a package with no EXTERNAL sibling to check at all is n/a for THIS gate — recorded as
+                // a pass note ("no external siblings"), not silence (FR-6 compatibility: this branch prints
+                // nothing to stdout, matching the pre-existing behavior). "External" covers BOTH "no
+                // workspace: dependency declared" and "every workspace: dependency is inside THIS batch"
+                // (publishing fresh, nothing stale to drift from) — both used to leave this package with no
+                // audit record at all when every dep resolved to the second case.
+                const anyWorkspaceDep = [...Object.values(deps), ...Object.values(peerDeps), ...Object.values(optionalDeps)]
+                    .some((spec) => String(spec).startsWith('workspace:'));
+                const pkParts = [];
+                let pkVerdict = 'pass';
+                let pkOverrideUsed = false;
+                if (anyWorkspaceDep) {
+                    const drifts = detectSiblingDrift({
+                        localInventory: npmPackInventory,
+                        localInventorySource,
+                        dependencies: deps,
+                        peerDependencies: peerDeps,
+                        optionalDependencies: optionalDeps,
+                        workspaceVersions,
+                        workspaceDirs,
+                        batch: batchNames,
+                        fetchPublished,
+                    });
+                    for (const r of drifts) {
+                        if (r.status === 'same') {
+                            pkParts.push(`${r.name}@${r.version}: same`);
+                            write(`dz publish: ✓ sibling drift: none (${r.name}@${r.version} = workspace)`);
+                        }
+                        else if (r.status === 'unavailable') {
+                            if (allowSiblingDrift) {
+                                pkParts.push(`${r.name}@${r.version}: unavailable (${r.reason}) — allowed via --allow-sibling-drift`);
+                                if (pkVerdict !== 'block')
+                                    pkVerdict = 'warn';
+                                pkOverrideUsed = true;
+                            }
+                            else {
+                                pkParts.push(`${r.name}@${r.version}: unavailable (${r.reason})`);
+                                pkVerdict = 'block';
+                                write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${r.reason}); add --allow-sibling-drift to override (logged) or check network/registry access`);
+                                driftBlocked++;
+                            }
+                        }
+                        else if (includeDrifted) {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s)) — auto-included via --include-drifted`);
+                            if (!batchNames.has(r.name) && !extraBatch.has(r.name)) {
+                                extraBatch.add(r.name);
+                                addedThisRound = true;
+                                write(`dz publish: → sibling drift: ${r.name}@${r.version} differs from the workspace (${r.changedFiles.length} file(s)) — adding to the batch via --include-drifted${r.missingExports.length > 0 ? ` (missing exports: ${r.missingExports.join(', ')})` : ''}`);
+                            }
+                        }
+                        else if (allowSiblingDrift) {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s)) — allowed via --allow-sibling-drift`);
+                            if (pkVerdict !== 'block')
+                                pkVerdict = 'warn';
+                            pkOverrideUsed = true;
+                        }
+                        else {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s))`);
+                            pkVerdict = 'block';
+                            const suggestFilter = filterStr !== undefined ? `${filterStr},${r.name}` : `${pk.name},${r.name}`;
+                            write(`dz publish: BLOCKED ${pk.name} — sibling drift: @dzhechkov/${r.name.replace(/^@dzhechkov\//, '')}@${r.version} on the registry differs from the workspace (${r.changedFiles.length} file(s)); add ${r.name} to the batch (--filter ${suggestFilter}) or publish it first`);
+                            driftBlocked++;
+                        }
+                    }
                 }
-                else if (r.status === 'unavailable') {
-                    if (allowSiblingDrift) {
-                        if (auditedOverride(`${r.name}@${r.version}: ${r.reason}`, `sibling drift check unavailable for ${r.name}@${r.version} (${r.reason})`, pk.name))
+                // AM-3/AM-6: the single, aggregated audit write for this package — "no external siblings"
+                // when nothing was ever checked, otherwise every sibling's status joined into one detail.
+                if (!siblingDriftAudited.has(pk.name)) {
+                    siblingDriftAudited.add(pk.name);
+                    const detail = pkParts.length > 0 ? pkParts.join('; ') : 'no external siblings';
+                    // AM-6: an override reason is attached only when the FINAL verdict is 'warn' — if some
+                    // OTHER sibling still stands as a live block, the override never actually excused the run.
+                    const overrideReason = pkOverrideUsed && pkVerdict !== 'block' ? '--allow-sibling-drift' : undefined;
+                    const wrote = appendPublishGateAudit(cwd, 'sibling-drift', pkVerdict, detail, [{ name: pk.name, version: pk.version }], overrideReason, gateAuditFsLayer);
+                    if (pkOverrideUsed) {
+                        // AM-6: the override is only real once ITS audit row is durable — a write failure must
+                        // refuse the publish rather than print "(logged)" about a record that never landed.
+                        if (wrote.logged) {
+                            write(`dz publish: ⚠ sibling drift override recorded for ${pk.name} — allowed via --allow-sibling-drift (logged)`);
+                        }
+                        else {
+                            write(`dz publish: BLOCKED ${pk.name} — the --allow-sibling-drift override could not be recorded (audit write failed: ${wrote.reason ?? 'unknown reason'}); refusing rather than proceeding unlogged`);
                             driftBlocked++;
+                        }
                     }
-                    else {
-                        write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${r.reason}); add --allow-sibling-drift to override (logged) or check network/registry access`);
-                        driftBlocked++;
+                    else if (pkParts.length > 0) {
+                        write(`dz publish: ℹ sibling drift audit for ${pk.name}${auditSuffix(wrote)}`);
                     }
-                }
-                else if (includeDrifted) {
-                    if (!batchNames.has(r.name) && !extraBatch.has(r.name)) {
-                        extraBatch.add(r.name);
-                        addedThisRound = true;
-                        write(`dz publish: → sibling drift: ${r.name}@${r.version} differs from the workspace (${r.changedFiles.length} file(s)) — adding to the batch via --include-drifted${r.missingExports.length > 0 ? ` (missing exports: ${r.missingExports.join(', ')})` : ''}`);
+                    else if (!wrote.logged) {
+                        // Codex round-2 (2026-09-14), AM-6 residual: the "no external siblings" pass note stays
+                        // silent on stdout ONLY while its record actually landed — a failed audit write is said.
+                        write(`dz publish: ℹ sibling drift audit for ${pk.name} (no external siblings)${auditSuffix(wrote)}`);
                     }
                 }
-                else if (allowSiblingDrift) {
-                    if (auditedOverride(`${r.name}@${r.version}: ${r.changedFiles.length} file(s) differ from the workspace`, `sibling drift: ${r.name}@${r.version} differs from the workspace (${r.changedFiles.length} file(s))`, pk.name))
-                        driftBlocked++;
-                }
-                else {
-                    appendPublishGateAudit(cwd, 'sibling-drift', 'block', `${pk.name} depends on ${r.name}@${r.version}; ${r.changedFiles.length} file(s) differ from the workspace`);
-                    const suggestFilter = filterStr !== undefined ? `${filterStr},${r.name}` : `${pk.name},${r.name}`;
-                    write(`dz publish: BLOCKED ${pk.name} — sibling drift: @dzhechkov/${r.name.replace(/^@dzhechkov\//, '')}@${r.version} on the registry differs from the workspace (${r.changedFiles.length} file(s)); add ${r.name} to the batch (--filter ${suggestFilter}) or publish it first`);
-                    driftBlocked++;
-                }
             }
+            if (driftBlocked > 0)
+                break; // nothing to expand into a run that already refuses
+            if (!includeDrifted || !addedThisRound)
+                break; // no auto-expand requested, or fixed point reached
+            // FR-4: --include-drifted folds the drifted sibling(s) into the batch — they bump patch like
+            // any other package in `publishPackages`' own (unchanged) bump logic. Re-loop: the newly
+            // folded-in sibling(s) may themselves depend on a drifted sibling outside the (now bigger) batch.
+            filter = filter === undefined ? [...batchNames, ...extraBatch] : [...filter, ...extraBatch];
+            targets = allPackages.filter(matchesFilter);
+            batchNames = new Set(targets.map((p) => p.name));
         }
-        if (driftBlocked > 0)
-            break; // nothing to expand into a run that already refuses
-        if (!includeDrifted || !addedThisRound)
-            break; // no auto-expand requested, or fixed point reached
-        // FR-4: --include-drifted folds the drifted sibling(s) into the batch — they bump patch like
-        // any other package in `publishPackages`' own (unchanged) bump logic. Re-loop: the newly
-        // folded-in sibling(s) may themselves depend on a drifted sibling outside the (now bigger) batch.
-        filter = filter === undefined ? [...batchNames, ...extraBatch] : [...filter, ...extraBatch];
-        targets = allPackages.filter(matchesFilter);
-        batchNames = new Set(targets.map((p) => p.name));
+    }
+    finally {
+        if (packTmpDir !== undefined)
+            rmSync(packTmpDir, { recursive: true, force: true });
     }
     const siblingDriftFailed = driftBlocked > 0;
     if (siblingDriftFailed && !dryRun) {
@@ -6523,8 +6760,8 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
     let packedInstallSmokePreviewFailed = false;
     if (dryRun) {
         if (bins.length === 0) {
-            appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin');
-            write('dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)');
+            const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin', targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+            write(`dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)${auditSuffix(wrote)}`);
         }
         else {
             const scratchRoot = packedInstallScratchRoot();
@@ -6557,33 +6794,19 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
             // Lead edit after the live dry-run (13.09 12:05): the preview packed the WORKING directory with
             // `workspace:^` specs still inside, so `npm install <tgz>` died with EUNSUPPORTEDPROTOCOL — the
             // preview must stage package.json exactly as the live packedTransport does (sibling pins via
-            // rewriteWorkspaceSpecs, prepublishOnly dropped) and restore the originals afterwards.
-            const stagedOriginals = [];
+            // rewriteWorkspaceSpecs, prepublishOnly dropped) and restore the originals afterwards. Shared
+            // with `dz release` via `withStagedPackageJson` (feature release-smoke-staged-pack).
             try {
-                for (const p of targets) {
-                    const pkgJsonPath = join(p.dir, 'package.json');
-                    const original = readFileSync(pkgJsonPath, 'utf-8');
-                    const rewritten = JSON.parse(rewriteWorkspaceSpecs(original, workspaceVersions));
-                    const scripts = rewritten['scripts'];
-                    if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts))
-                        delete scripts['prepublishOnly'];
-                    stagedOriginals.push({ path: pkgJsonPath, text: original });
-                    writeFileSync(pkgJsonPath, JSON.stringify(rewritten, null, 2) + '\n');
-                }
-                for (const step of smokePlan.steps) {
-                    const r = runSmoke(step.cmd, { cwd: step.cwd, timeoutMs: step.timeoutMs });
-                    smokeExecutions.push({ stepId: step.id, exitCode: r.exitCode, stdout: r.stdout, stderr: r.stderr, ...(r.timedOut !== undefined ? { timedOut: r.timedOut } : {}) });
-                }
-            }
-            finally {
-                for (const o of stagedOriginals) {
-                    try {
-                        writeFileSync(o.path, o.text);
-                    }
-                    catch (err) {
-                        write(`dz publish: ⚠ could not restore ${o.path} after the preview smoke: ${formatPublishError(err)}`);
+                withStagedPackageJson(targets, workspaceVersions, write, () => {
+                    for (const step of smokePlan.steps) {
+                        const r = runSmoke(step.cmd, { cwd: step.cwd, timeoutMs: step.timeoutMs });
+                        smokeExecutions.push({ stepId: step.id, exitCode: r.exitCode, stdout: r.stdout, stderr: r.stderr, ...(r.timedOut !== undefined ? { timedOut: r.timedOut } : {}) });
                     }
-                }
+                }, 'dz publish');
+            }
+            catch (err) {
+                // a restore failure is a preview failure (Codex finding 1): never a green preview on a staged tree
+                smokeExecutions.push({ stepId: 'staged-restore', exitCode: 1, stdout: '', stderr: formatPublishError(err) });
             }
             const smokeVerdict = judgePackedInstallSmoke(smokePlan, smokeExecutions);
             try {
@@ -6595,13 +6818,13 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
             }
             catch { /* best-effort cleanup */ }
             if (smokeVerdict.ok) {
-                appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'preview: pack/install/--version all clean');
-                write('dz publish: ✓ packed install smoke (preview)');
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'preview: pack/install/--version all clean', targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+                write(`dz publish: ✓ packed install smoke (preview)${auditSuffix(wrote)}`);
             }
             else {
                 const detail = smokeVerdict.failureDetail ?? smokeVerdict.bins.find((b) => !b.ok)?.detail ?? '(no detail)';
-                appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail);
-                write(`dz publish: BLOCKED — packed install smoke failed (preview): ${detail}`);
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail, targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+                write(`dz publish: BLOCKED — packed install smoke failed (preview): ${detail}${auditSuffix(wrote)}`);
                 for (const b of smokeVerdict.bins.filter((b) => !b.ok))
                     write(`  ✗ ${b.pkg} (${b.binName}): ${b.detail ?? '(no detail)'}`);
                 packedInstallSmokePreviewFailed = true;
@@ -6658,23 +6881,37 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
                 // `pnpm publish` and skipped re-signing (ADR-001, features/publish-gate-verifies-the-tarball).
                 let cleanupGate = null;
                 try {
-                    const signed = JSON.parse(readFileSync(manifestPath, 'utf8'));
-                    let extracted;
-                    try {
-                        extracted = extractPublishTarball(pk.dir);
-                        cleanupGate = extracted.cleanup;
-                    }
-                    catch (err) {
-                        // Cross-family review (codex `gpt-5.6-sol`, 2026-08-22): falling back to the working
-                        // TREE here fails the gate OPEN. The gate's whole claim is "what ships matches the
-                        // signature"; with no artifact, nothing was compared, and reporting a pass would be a
-                        // claim about an object that was never built. Say why, and block.
-                        write(`dz publish: could not pack ${pk.name} (${err.message.split('\n')[0]}) — the artifact was never built, so its signature was not checked`);
+                    const parsedManifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+                    // FR-4 (feature publish-gate-audit-durable): a manifest that PARSES but is not a plain
+                    // object — `null`, an array, a bare string — is UNAVAILABLE, never "no signature". Those
+                    // are different failures with different fixes: "no signature" means run `dz sign`; a
+                    // malformed manifest means the file itself is corrupt/wrong-shaped and re-signing alone
+                    // would silently paper over that. Mirrors `readManifest`'s shape guard in
+                    // publish-sibling-drift.ts (null/array/non-object ⇒ cannot be used, say so).
+                    if (parsedManifest === null || typeof parsedManifest !== 'object' || Array.isArray(parsedManifest)) {
+                        const gotShape = parsedManifest === null ? 'null' : Array.isArray(parsedManifest) ? 'an array' : typeof parsedManifest;
+                        write(`dz publish: ${pk.name}'s ${MANIFEST_NAME} is not a JSON object (got ${gotShape}) — its signature is unavailable, not merely absent`);
                         artifactUnavailable = true;
                     }
-                    verifyOk =
-                        extracted !== undefined &&
-                            verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8')).ok;
+                    else {
+                        const signed = parsedManifest;
+                        let extracted;
+                        try {
+                            extracted = extractPublishTarball(pk.dir);
+                            cleanupGate = extracted.cleanup;
+                        }
+                        catch (err) {
+                            // Cross-family review (codex `gpt-5.6-sol`, 2026-08-22): falling back to the working
+                            // TREE here fails the gate OPEN. The gate's whole claim is "what ships matches the
+                            // signature"; with no artifact, nothing was compared, and reporting a pass would be a
+                            // claim about an object that was never built. Say why, and block.
+                            write(`dz publish: could not pack ${pk.name} (${err.message.split('\n')[0]}) — the artifact was never built, so its signature was not checked`);
+                            artifactUnavailable = true;
+                        }
+                        verifyOk =
+                            extracted !== undefined &&
+                                verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8')).ok;
+                    }
                 }
                 catch {
                     verifyOk = false;
@@ -6722,9 +6959,10 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
             smoke: (artifacts) => {
                 for (const a of artifacts)
                     write(`dz publish: tarball ${a.name}@${a.newVersion} sha256:${a.sha256}`);
+                const auditPackages = artifacts.map((a) => ({ name: a.name, version: a.newVersion, tarballSha256: a.sha256 }));
                 if (bins.length === 0) {
-                    appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin');
-                    write('dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)');
+                    const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin', auditPackages, undefined, gateAuditFsLayer);
+                    write(`dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)${auditSuffix(wrote)}`);
                     return { ok: true };
                 }
                 const scratchRoot = packedInstallScratchRoot();
@@ -6766,13 +7004,13 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
                 }
                 catch { /* best-effort cleanup */ }
                 if (verdict.ok) {
-                    appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'pack/install/--version all clean (live, packedTransport)');
-                    write('dz publish: ✓ packed install smoke');
+                    const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'pack/install/--version all clean (live, packedTransport)', auditPackages, undefined, gateAuditFsLayer);
+                    write(`dz publish: ✓ packed install smoke${auditSuffix(wrote)}`);
                     return { ok: true };
                 }
                 const detail = verdict.failureDetail ?? verdict.bins.find((b) => !b.ok)?.detail ?? '(no detail)';
-                appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail);
-                write(`dz publish: BLOCKED — packed install smoke failed: ${detail}`);
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail, auditPackages, undefined, gateAuditFsLayer);
+                write(`dz publish: BLOCKED — packed install smoke failed: ${detail}${auditSuffix(wrote)}`);
                 for (const b of verdict.bins.filter((b) => !b.ok))
                     write(`  ✗ ${b.pkg} (${b.binName}): ${b.detail ?? '(no detail)'}`);
                 return { ok: false, reason: detail };
@@ -7007,7 +7245,7 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDrift
 /*  dz parity — the honest feature×target map (target-parity-matrix,   */
 /*  ADR-001): computed from the declarative model, never hand-written  */
 /* ------------------------------------------------------------------ */
-function cmdParity(options, flags, write, writeErr, cwd) {
+async function cmdParity(options, flags, write, writeErr, cwd) {
     const json = flags.has('json');
     if (flags.has('help')) {
         write('dz parity [--target <name>] [--json] — the computed feature×target map (never hand-written)');
@@ -7035,32 +7273,56 @@ function cmdParity(options, flags, write, writeErr, cwd) {
             return 1;
         }
     }
-    // ADR-001 Decision 3 (feature setup-installs-apply-leg): `learning-apply` on `claude-code` is
-    // MEASURED, not declared — `hooks-prompt` is present for that ONE target only when
-    // `applyLegStatus(root).installed`. `computeParity` itself is untouched (FR-5); only the
-    // capability SET fed into it for this one cell differs from the static `TARGET_CAPABILITIES`.
-    // `applyLegStatus` never throws (fix round 1, Q3 finding: an unreadable helper used to be able to
-    // crash this command rather than degrade to a named remedy).
+    // ADR-001 Decision 3 (feature setup-installs-apply-leg), extended by `apply-leg-never-silent`
+    // Decision 3 (FR-4): `learning-apply` on `claude-code` is MEASURED, not declared — `hooks-prompt`
+    // is present for that ONE target only when the leg is OBSERVED to inject, not merely installed.
+    // Issue #2 was exactly this cell reading `full` while the leg injected nothing in every session
+    // but one: `applyLegStatus(root).installed` alone (file presence + structural wiring) is
+    // necessary but not sufficient — `probeApplyLeg` is the live end-to-end proof. `computeParity`
+    // itself is untouched (FR-5 of the earlier feature); only the capability SET fed into it for this
+    // one cell differs from the static `TARGET_CAPABILITIES`, exactly as before this feature.
+    // `applyLegStatus` never throws (fix round 1, Q3 finding); `probeApplyLeg` is only invoked when
+    // `installed` is true — a leg with missing/stale/unreadable helpers has nothing live to probe,
+    // and the pre-existing remedy for that state is unchanged.
     const applyLegStatusVal = applyLegStatus(cwd);
     const applyLegInstalled = applyLegStatusVal.installed;
+    // Codex round-2: `probeApplyLeg` may REJECT (temp dir, dynamic import, a throwing remover) — doctor
+    // catches that; parity must too, or a probe crash would crash `dz parity` instead of reading as
+    // "installed but silent: probe-error".
+    let applyLegProbe;
+    if (applyLegInstalled) {
+        try {
+            applyLegProbe = await probeApplyLeg(cwd);
+        }
+        catch (err) {
+            applyLegProbe = { ok: false, reason: `probe-error: ${err instanceof Error ? err.message : String(err)}`, elapsedMs: 0 };
+        }
+    }
+    const applyLegWorking = applyLegProbe?.ok === true;
     const matrix = buildParityMatrix().map((row) => {
-        if (row.feature.id !== 'learning-apply' || applyLegInstalled)
+        if (row.feature.id !== 'learning-apply' || applyLegWorking)
             return row;
         const claudeCodeCaps = TARGET_CAPABILITIES['claude-code'].filter((c) => c !== 'hooks-prompt');
         return { feature: row.feature, cells: { ...row.cells, 'claude-code': computeParity(row.feature, claudeCodeCaps) } };
     });
-    // The "not installed" remedy — named ONLY for the one cell whose grant is a live measurement,
-    // never a blanket note for every `manual` cell (most targets are manual by DESIGN, not absence).
-    // `stale-version`/`unreadable` route through `applyLegReasonMessage` — the SAME text-producing
-    // function `dz doctor` uses for those two reasons (fix round 1, HIGH finding 2 / Q3 finding 7), so
-    // the two instruments cannot disagree about WHY a stale or broken install is not "full".
+    // The remedy — named ONLY for the one cell whose grant is a live measurement, never a blanket
+    // note for every `manual` cell (most targets are manual by DESIGN, not absence). Three distinct
+    // states, never conflated: NOT installed (stale-version/unreadable route through
+    // `applyLegReasonMessage`, the SAME text-producing function `dz doctor` uses for those two
+    // reasons, so the two instruments cannot disagree about WHY); installed but the live probe did
+    // NOT observe injection (FR-4's new "installed but silent" case, reason from `probeApplyLeg`
+    // itself — the SAME reason `dz doctor`'s live-probe row prints, so doctor and parity cannot
+    // disagree about a dead leg either); and the working case, where this function returns ''.
     const applyLegRemedy = (featureId, t) => {
-        if (featureId !== 'learning-apply' || t !== 'claude-code' || applyLegInstalled)
+        if (featureId !== 'learning-apply' || t !== 'claude-code' || applyLegWorking)
             return '';
-        if (applyLegStatusVal.reason === 'stale-version' || applyLegStatusVal.reason === 'unreadable') {
-            return ` — ${applyLegReasonMessage(applyLegStatusVal)}`;
+        if (!applyLegInstalled) {
+            if (applyLegStatusVal.reason === 'stale-version' || applyLegStatusVal.reason === 'unreadable') {
+                return ` — ${applyLegReasonMessage(applyLegStatusVal)}`;
+            }
+            return ' — not installed — run dz setup --target claude-code --memory agentdb';
         }
-        return ' — not installed — run dz setup --target claude-code --memory agentdb';
+        return ` — installed but silent: ${applyLegProbe?.reason ?? 'unknown'}`;
     };
     // EVIDENCE staleness, folded into the report (fix round 2, R2-3). Derived from the records
     // themselves — no `codex --version`, no subprocess, so `dz parity` stays a deterministic function
@@ -7352,7 +7614,20 @@ function cmdRelease(options, flags, cwd, write, runner) {
     let smokeTmp;
     const execSteps = plan.steps.filter((s) => s.kind !== 'synthetic-fail');
     say(`\ndz release — executing ${execSteps.length} gate step(s) across ${plan.packages.length} package(s)…`);
-    for (const step of execSteps) {
+    // FR-1/FR-2 (feature release-smoke-staged-pack): the packed-install smoke's `pack` steps must
+    // pack the SAME staged bytes `dz publish`'s preview does — sibling `workspace:*` deps rewritten
+    // to the exact sibling version, `prepublishOnly` dropped — or `npm install` on the resulting
+    // tarballs dies with EUNSUPPORTEDPROTOCOL (MEASURED 2026-09-13 16:05). `workspaceVersions` is
+    // built like publish's (from the FULL workspace, not just this release's filtered batch — an
+    // out-of-batch sibling still needs its real version). Only the `pack` sub-steps are staged; the
+    // `install`/`bin-exists`/`bin-version` steps already run against the packed tarballs and need no
+    // staging.
+    const allPackages = discoverPackages(cwd);
+    const workspaceVersions = new Map(allPackages.map((p) => [p.name, p.version]));
+    const packStepIds = new Set((plan.packedInstallPlan?.steps ?? [])
+        .filter((s) => s.kind === 'pack')
+        .map((s) => `smoke:packed-install:${s.id}`));
+    const runGateStep = (step) => {
         let stepCwd = step.cwd;
         if (step.tempCwd === true) {
             // AM-4: boot bins in a throwaway cwd so an installer-style bin cannot mutate the workspace.
@@ -7370,6 +7645,37 @@ function cmdRelease(options, flags, cwd, write, runner) {
             durationMs: Date.now() - started,
             timedOut: r.timedOut,
         });
+    };
+    // Plan/execution order is load-bearing (see the plan/execution skew guard test) — steps run in
+    // exactly the order `plan.steps` lists them, one loop, no reordering. Only the `pack` steps are
+    // wrapped in the staged window, individually, so where they fall in that order never changes.
+    let announcedStagedPack = false;
+    for (const step of execSteps) {
+        if (packStepIds.has(step.id)) {
+            if (!announcedStagedPack) {
+                say('dz release: smoke: packed tarballs staged like the live publish (workspace:* → exact sibling versions)');
+                announcedStagedPack = true;
+            }
+            // Codex finding 2: stage ONLY the package this pack step packs — sibling pins come from
+            // workspaceVersions, and `npm pack` reads the packed package's manifest alone.
+            const packed = factsList.filter((f) => f.name === step.pkg);
+            try {
+                withStagedPackageJson(packed, workspaceVersions, write, () => runGateStep(step), 'dz release');
+            }
+            catch (err) {
+                // a staging/restore failure is a FAILED step with the reason, never a silent skip — and ONE
+                // record per step: a run already recorded by runGateStep is replaced, not duplicated (Codex r2)
+                const failed = { stepId: step.id, exitCode: 1, stdout: '', stderr: formatPublishError(err), durationMs: 0, timedOut: false };
+                const at = executions.findIndex((e) => e.stepId === step.id);
+                if (at >= 0)
+                    executions[at] = failed;
+                else
+                    executions.push(failed);
+            }
+        }
+        else {
+            runGateStep(step);
+        }
     }
     if (smokeTmp !== undefined) {
         try {
@@ -7384,8 +7690,24 @@ function cmdRelease(options, flags, cwd, write, runner) {
     for (const g of verdict.gates) {
         const icon = g.status === 'pass' ? '✓' : g.status === 'fail' ? '✗' : '○';
         say(`  ${icon} ${g.gate.padEnd(7)} ${g.status.toUpperCase().padEnd(4)}  ${g.passed} passed, ${g.failures.length} failed, ${g.skips.length} skipped`);
-        for (const f of g.failures)
+        for (const f of g.failures) {
             say(`      [${f.class}] ${f.pkg !== undefined ? `${f.pkg}: ` : ''}${f.reason}`);
+            // FR-2 / AM-4 / AM-6 (feature release-gate-output-tail): print each non-empty stream's
+            // tail under the failure line, labelled `stdout:`/`stderr:` at the failure's own 6-space
+            // indent, with its content lines at an 8-space CONTINUATION indent so a reader can tell a
+            // tail line from a new failure/skip bullet at a glance; --json carries the same `tails`
+            // object as-is (present, possibly with empty strings, on every executed failure).
+            if (f.tails !== undefined) {
+                for (const stream of ['stdout', 'stderr']) {
+                    const t = f.tails[stream];
+                    if (t.length === 0)
+                        continue;
+                    say(`      ${stream}:`);
+                    for (const tailLine of t.split('\n'))
+                        say(`        ${tailLine}`);
+                }
+            }
+        }
         for (const sk of g.skips)
             say(`      [${sk.class}] ${sk.pkg}: ${sk.reason}`);
     }
@@ -10211,31 +10533,154 @@ function runGuardEvaluation(root, op, text, overrideReason, publishFilter) {
     return result;
 }
 /**
- * Feature `publish-sibling-drift-gate` (FR-5/AM-6): both the sibling-drift and packed-install-smoke
+ * AM-2: loop `writeSync` until every byte of `data` has been accepted, checking the RETURNED
+ * length on every call (Codex round-1 review, finding 1: the old code called `writeSync` once and
+ * ignored the return value — a short write followed by `fsyncSync` durably persists a TRUNCATED,
+ * unparseable JSON line into an append-only log every future read walks). A call that reports zero
+ * or negative progress can never complete the buffer and would spin forever — that is treated as a
+ * failure, not a retry target.
+ */
+function writeAllSync(fsLayer, fd, data) {
+    let remaining = data;
+    while (remaining.length > 0) {
+        const n = fsLayer.writeSync(fd, remaining);
+        if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0) {
+            throw new Error(`writeSync made no progress (returned ${n}) with ${remaining.length} byte(s) still pending`);
+        }
+        // Codex round-2 (2026-09-14) finding 3: a layer claiming MORE bytes than it was given is lying
+        // about the record, and must not reach "logged: true" through a subarray that just goes empty.
+        if (n > remaining.length) {
+            throw new Error(`writeSync claimed ${n} byte(s) written but only ${remaining.length} were supplied`);
+        }
+        remaining = remaining.subarray(n);
+    }
+}
+const REAL_PUBLISH_GATE_AUDIT_FS = { existsSync, mkdirSync, openSync, writeSync, fsyncSync, closeSync };
+/**
+ * Feature `publish-sibling-drift-gate` (FR-5/AM-6), durability + per-package identity added by
+ * feature `publish-gate-audit-durable` (FR-1/FR-2): both the sibling-drift and packed-install-smoke
  * gates write to the SAME append-only, hash-chained `.dz/guard-audit.jsonl` the declarative
  * `dz guard` rules use — visibility for `dz guard promote`/`dz compounding` never depends on
  * which mechanism produced the finding. `pass` records go through as an informational `note`
  * (never a violation, so they can never flip the row's own verdict) so a clean check is ALSO on
  * the record, not just a block or an override (AM-6: "аудит без записи = не аудит").
  *
- * Returns whether the write actually landed. Most callers are best-effort (a write failure never
- * blocks a verdict already decided) — the one exception is an `--allow-sibling-drift` OVERRIDE,
- * whose caller MUST check this return value: an override is not real without a durable row behind
- * it (AM-6's load-bearing property — see `auditedOverride` in `cmdPublish`).
+ * FR-1: one JSONL record PER PACKAGE in `packages`, each naming the package, its version, and the
+ * tarball's sha256 (or the explicit `sha256:n/a` before a tarball exists — a dry-run preview). FR-2:
+ * the write is `openSync('a') → writeSync → fsyncSync(fd) → closeSync`, plus an `fsyncSync` of the
+ * `.dz` directory itself the one time this call CREATES it (a file's own fsync durably persists its
+ * bytes; the directory entry that makes the file findable after a crash needs its own fsync — the
+ * same lesson `integration-apply.ts`'s `fsyncDirectory` already encodes).
+ *
+ * Returns `{ logged, reason? }` — never a bare boolean, so a caller can print WHY a write failed,
+ * not just that it did. Most callers are best-effort (a write failure never blocks a verdict already
+ * decided) — the one exception is an `--allow-sibling-drift` OVERRIDE, whose caller MUST check
+ * `logged`: an override is not real without a durable row behind it (AM-6's load-bearing property —
+ * see `auditedOverride` in `cmdPublish`).
  */
-function appendPublishGateAudit(root, rule, verdict, detail, overrideReason) {
+function appendPublishGateAudit(root, rule, verdict, detail, packages, overrideReason, fsLayer = REAL_PUBLISH_GATE_AUDIT_FS) {
+    if (packages.length === 0)
+        return { logged: true }; // nothing to record about — not a failure
+    const dzDir = join(root, '.dz');
+    const auditPath = join(dzDir, 'guard-audit.jsonl');
+    const dzDirExisted = fsLayer.existsSync(dzDir);
+    // AM-2: tracked BEFORE the write — this is what decides whether the append call below is about
+    // to CREATE the file (needing a `.dz` directory-entry fsync afterwards) or extend an existing one
+    // (whose directory entry is already durable from a previous append).
+    const auditFileExisted = fsLayer.existsSync(auditPath);
     try {
-        const rec = auditRecord(verdict === 'pass'
-            ? { op: 'publish', verdict, violations: [], checked: [rule], notEstablished: [], notes: [`${rule}: ${detail}`] }
-            : { op: 'publish', verdict, violations: [{ rule, severity: 'hard', detail }], checked: [rule], notEstablished: [] }, new Date().toISOString(), overrideReason !== undefined ? { reason: overrideReason } : undefined);
-        mkdirSync(join(root, '.dz'), { recursive: true });
-        const auditPath = join(root, '.dz', 'guard-audit.jsonl');
-        writeFileSync(auditPath, appendChainedLines([rec], readLogTail(auditPath)), { flag: 'a' });
-        return true;
+        fsLayer.mkdirSync(dzDir, { recursive: true });
     }
-    catch {
-        return false; // audit write failed — the caller decides whether that itself is refusable (AM-6)
+    catch (err) {
+        return { logged: false, reason: `could not create ${dzDir}: ${err.message.split('\n')[0]}` };
+    }
+    const records = packages.map((pkg) => {
+        const sha = pkg.tarballSha256 !== undefined && pkg.tarballSha256 !== '' ? pkg.tarballSha256 : 'n/a';
+        const label = `${rule}: ${pkg.name}@${pkg.version} sha256:${sha} — ${detail}`;
+        return auditRecord(verdict === 'pass'
+            ? { op: 'publish', verdict, violations: [], checked: [rule], notEstablished: [], notes: [label] }
+            : { op: 'publish', verdict, violations: [{ rule, severity: 'hard', detail: label }], checked: [rule], notEstablished: [] }, new Date().toISOString(), overrideReason !== undefined ? { reason: overrideReason } : undefined);
+    });
+    let bytes;
+    try {
+        bytes = appendChainedLines(records, readLogTail(auditPath));
+    }
+    catch (err) {
+        return { logged: false, reason: `could not build the chained record: ${err.message.split('\n')[0]}` };
     }
+    if (bytes === '')
+        return { logged: true };
+    const buf = Buffer.from(bytes, 'utf-8');
+    let fd;
+    try {
+        fd = fsLayer.openSync(auditPath, fsConstants.O_APPEND | fsConstants.O_CREAT | fsConstants.O_WRONLY);
+        writeAllSync(fsLayer, fd, buf); // AM-2: loops on a short write, throws on no progress
+        fsLayer.fsyncSync(fd);
+        fsLayer.closeSync(fd);
+        fd = undefined;
+    }
+    catch (err) {
+        return { logged: false, reason: err.message.split('\n')[0] ?? String(err) };
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fsLayer.closeSync(fd);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    // AM-2 (Codex round-1 review, finding 1, high): a directory-entry fsync is REQUIRED, not
+    // best-effort, whenever THIS call is the reason the entry needed persisting — swallowing its
+    // failure used to let `logged: true` go out about a record whose directory entry can vanish on a
+    // crash before the next fsck. Two DIFFERENT entries can need persisting, tracked independently:
+    if (!auditFileExisted) {
+        // The audit FILE was just created by the open() above — `.dz` (its containing directory) needs
+        // its own fsync so the new directory entry survives a crash; the file's own fsync (above) only
+        // guarantees the file's DATA, not that anything can find it afterwards.
+        let dfd;
+        try {
+            dfd = fsLayer.openSync(dzDir, fsConstants.O_RDONLY);
+            fsLayer.fsyncSync(dfd);
+        }
+        catch (err) {
+            return { logged: false, reason: `could not fsync ${dzDir} after creating ${auditPath}: ${err.message.split('\n')[0]}` };
+        }
+        finally {
+            if (dfd !== undefined) {
+                try {
+                    fsLayer.closeSync(dfd);
+                }
+                catch { /* best-effort, does not affect the verdict already returned */ }
+            }
+        }
+    }
+    if (!dzDirExisted) {
+        // `.dz` ITSELF was just created by `mkdirSync` above — its PARENT (`root`) needs its own fsync
+        // so `.dz`'s OWN directory entry survives a crash (the fsync of `.dz` just above only durably
+        // persists entries INSIDE `.dz`, not the fact that `.dz` exists at all).
+        let pfd;
+        try {
+            pfd = fsLayer.openSync(root, fsConstants.O_RDONLY);
+            fsLayer.fsyncSync(pfd);
+        }
+        catch (err) {
+            return { logged: false, reason: `could not fsync ${root} after creating ${dzDir}: ${err.message.split('\n')[0]}` };
+        }
+        finally {
+            if (pfd !== undefined) {
+                try {
+                    fsLayer.closeSync(pfd);
+                }
+                catch { /* best-effort, does not affect the verdict already returned */ }
+            }
+        }
+    }
+    return { logged: true };
+}
+/** FR-2: the printed suffix a caller appends to its own verdict line — never silent about logging. */
+function auditSuffix(wrote) {
+    return wrote.logged ? ' (logged)' : ` (audit NOT logged: ${wrote.reason ?? 'unknown reason'})`;
 }
 function renderGuardObservation(observation) {
     const tag = observation.status === 'unknown' ? 'note' : 'observe';
@@ -11955,6 +12400,43 @@ function splitMutationGateOutputWrite(result) {
         return {};
     return 'path' in result ? { outputPath: result.path } : { outputError: result.error };
 }
+/** Fix-round 1 (AM-1, feature qe-step-gate-scoped-to-feature): a `--touched` path arrives in one of
+ * several shapes — package-relative POSIX (the common case, already correct as-is), with a leading
+ * `./`, as an ABSOLUTE path inside the package, or REPO-relative (e.g.
+ * `packages/@dzhechkov/harness-cli/src/x.ts`) — and on a POSIX host a caller may hand a backslash
+ * path too (a Windows-authored change list). MEASURED (Codex round-1 review): the pre-fix
+ * normalization only converted the native path separator, so any of the other shapes matched ZERO
+ * registry entries and the gate silently reported `selected 0` / exit 0 — the run looked clean while
+ * defending nothing. This resolves EVERY shape to the package-relative POSIX candidate(s) a registry
+ * entry's `file` is written in, and — when a path genuinely resolves outside `pkgDir` (an absolute
+ * path elsewhere, or a `../` that still escapes the package after a repo-relative reinterpretation)
+ * — reports it as `outside`, never a silent non-match indistinguishable from "the path doesn't
+ * exist".
+ */
+function normalizeTouchedPath(raw, pkgDir, repoTop) {
+    // Codex round-2: normalize lexically FIRST so `lib/../../x` is seen as the traversal it is, and treat a
+    // Windows-drive path (`C:/…`) on a POSIX host as outside the package (counted, said) rather than as a
+    // package-relative name that silently matches nothing. Symlinked package dirs stay a named limit: the
+    // containment check is lexical, not realpath-based.
+    const p = posixNormalize(raw.replace(/\\/g, '/')).replace(/^(?:\.\/)+/, '');
+    if (p === '' || p === '.')
+        return { candidates: [], outside: false };
+    if (/^[A-Za-z]:\//.test(p) && !isAbsolute(p))
+        return { candidates: [], outside: true };
+    if (isAbsolute(p)) {
+        const rel = relative(pkgDir, resolve(p)).split(sep).join('/');
+        return rel === '' || rel.startsWith('..') ? { candidates: [], outside: true } : { candidates: [rel], outside: false };
+    }
+    const candidates = new Set();
+    if (p !== '..' && !p.startsWith('../'))
+        candidates.add(p); // already package-relative, as given
+    if (repoTop !== null) {
+        const rel = relative(pkgDir, resolve(repoTop, p)).split(sep).join('/');
+        if (rel !== '' && !rel.startsWith('..'))
+            candidates.add(rel);
+    }
+    return candidates.size > 0 ? { candidates: [...candidates], outside: false } : { candidates: [], outside: true };
+}
 function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
     const json = flags.has('json');
     const fail = (what) => {
@@ -11978,7 +12460,9 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
     }
     let entries = parsed.registry.entries;
     let entryResults = parsed.entryResults;
+    const totalRegistryEntries = entries.length;
     const only = options.get('only');
+    let onlyIds = null;
     if (only !== undefined) {
         const ids = only.split(',').map((s) => s.trim()).filter(Boolean);
         const known = new Set([
@@ -11988,15 +12472,139 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
         const unknown = ids.filter((id) => !known.has(id));
         if (unknown.length > 0)
             return fail(`--only names unknown entry id(s): ${unknown.join(', ')}`);
+        onlyIds = new Set(ids);
         entries = entries.filter((e) => ids.includes(e.id));
         entryResults = entryResults.filter((result) => ids.includes(result.id));
     }
+    // Feature qe-step-gate-scoped-to-feature (FR-1/FR-2/FR-3): scope the gate to the files a FEATURE
+    // actually touched and/or entries added since a base ref, instead of the whole registry — MEASURED
+    // 2026-09-12, 358 entries on this repo's core package ran 30-40 minutes and hit the timeout wall,
+    // INCONCLUSIVE every time, though a feature owns only its own touched files. `--touched` and
+    // `--added-since` UNION (a file changed by the feature OR an entry it newly added is in scope);
+    // that union then INTERSECTS with `--only` when both are given, same algebra as an ordinary filter
+    // chain. Both selectors are computed against the FULL (pre-`--only`) registry so their reported
+    // counts describe what THEY matched, independent of any `--only` narrowing applied on top.
+    const touchedRaw = options.get('touched');
+    const addedSinceRaw = options.get('added-since');
+    let selectionMeta = null;
+    if (touchedRaw !== undefined || addedSinceRaw !== undefined) {
+        let repoTop = null;
+        try {
+            repoTop = execSync('git rev-parse --show-toplevel', { cwd: pkgDir, stdio: 'pipe', encoding: 'utf-8' }).trim() || null;
+        }
+        catch { /* not in a git repo */ }
+        const touchedIds = new Set();
+        let outsidePackageCount = 0;
+        if (touchedRaw !== undefined) {
+            const touchedPaths = touchedRaw.split(',').map((s) => s.trim()).filter(Boolean);
+            const normalizedCandidates = new Set();
+            for (const raw of touchedPaths) {
+                const { candidates, outside } = normalizeTouchedPath(raw, pkgDir, repoTop);
+                if (outside)
+                    outsidePackageCount++;
+                for (const c of candidates)
+                    normalizedCandidates.add(c);
+            }
+            for (const entry of parsed.registry.entries) {
+                if (normalizedCandidates.has(entry.file))
+                    touchedIds.add(entry.id);
+            }
+        }
+        const addedSinceIds = new Set();
+        let baseAbsentMessage = null;
+        if (addedSinceRaw !== undefined) {
+            if (repoTop === null)
+                return fail(`--added-since requires ${pkgDir} to be inside a git repository`);
+            try {
+                execFileSync('git', ['rev-parse', '--verify', '--quiet', `${addedSinceRaw}^{commit}`], { cwd: repoTop, stdio: 'pipe' });
+            }
+            catch {
+                return fail(`--added-since names an unknown git ref: ${addedSinceRaw}`);
+            }
+            const registryRelPath = relative(repoTop, registryPath).split(sep).join('/');
+            let baseRegistry = null;
+            // Fix-round 1 (AM-3): only a genuinely ABSENT registry at that ref means "all entries are
+            // new". Any OTHER `git show` failure (a bad path that isn't a missing-registry case, git
+            // itself missing, a timeout) is a usage error, and a registry that parses to invalid JSON /
+            // an invalid registry shape at that ref is a distinct usage error too — collapsing all three
+            // into "absent" used to hide real failures behind a silently-too-generous selection.
+            try {
+                // stdio: registry-absent-at-ref is an EXPECTED outcome (git's own "fatal: path … does not
+                // exist" on stderr would otherwise leak to the terminal by node's default inherit-stderr
+                // behaviour) — pipe it into the caught error instead of printing it at the user.
+                const baseText = execFileSync('git', ['show', `${addedSinceRaw}:${registryRelPath}`], { cwd: repoTop, encoding: 'utf-8', env: { ...process.env, LC_ALL: 'C', LANG: 'C' }, maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+                const baseParsed = parseMutationRegistry(baseText);
+                if (baseParsed.registry === null) {
+                    return fail(`base registry at ${addedSinceRaw} is not a valid registry: ${baseParsed.errors.join('; ')}`);
+                }
+                baseRegistry = baseParsed.registry;
+            }
+            catch (e) {
+                const stderr = typeof e?.stderr === 'string'
+                    ? e.stderr
+                    : String(e?.message ?? e);
+                if (/does not exist in|exists on disk, but not in|Path .* does not exist/i.test(stderr)) {
+                    baseRegistry = null; // registry absent at that ref → every current entry counts as added
+                    baseAbsentMessage = `base registry absent at ${addedSinceRaw} — all ${totalRegistryEntries} entries count as added`;
+                }
+                else {
+                    return fail(`git show ${addedSinceRaw}:${registryRelPath} failed: ${stderr.trim()}`);
+                }
+            }
+            if (baseAbsentMessage !== null && !json)
+                write(`mutation-gate: ${baseAbsentMessage}`);
+            for (const id of registryEntriesAddedSince(baseRegistry, parsed.registry))
+                addedSinceIds.add(id);
+        }
+        let unionIds = new Set([...touchedIds, ...addedSinceIds]);
+        if (onlyIds !== null) {
+            const only2 = onlyIds;
+            unionIds = new Set([...unionIds].filter((id) => only2.has(id)));
+        }
+        const selectorParts = [];
+        if (touchedRaw !== undefined)
+            selectorParts.push(`touched: ${touchedIds.size}${outsidePackageCount > 0 ? ` (${outsidePackageCount} outside package)` : ''}`);
+        if (addedSinceRaw !== undefined)
+            selectorParts.push(`added-since ${addedSinceRaw}: ${addedSinceIds.size}`);
+        if (!json)
+            write(`mutation-gate: selected ${unionIds.size} of ${totalRegistryEntries} entries (${selectorParts.join('; ')})`);
+        entries = entries.filter((e) => unionIds.has(e.id));
+        entryResults = entryResults.filter((result) => unionIds.has(result.id));
+        // AM-4: every scoped run — empty or not — carries a machine-readable `selection` object in the
+        // JSON contract, not just the empty-selection early return.
+        selectionMeta = {
+            selected: unionIds.size,
+            total: totalRegistryEntries,
+            touched: touchedRaw !== undefined ? [...touchedIds].sort() : null,
+            addedSince: addedSinceRaw !== undefined ? [...addedSinceIds].sort() : null,
+            base: addedSinceRaw ?? null,
+            baseAbsent: baseAbsentMessage !== null,
+            outsidePackage: outsidePackageCount,
+        };
+        if (unionIds.size === 0) {
+            const msg = `0 entries match ${selectorParts.join(', ')} — nothing to run`;
+            if (json) {
+                write(JSON.stringify({
+                    packageDir: pkgDir,
+                    registryPath,
+                    selection: selectionMeta,
+                    results: [],
+                    summary: summarizeMutationResults([]),
+                    exitCode: 0,
+                }, null, 2));
+            }
+            else {
+                write(`mutation-gate: ${msg}`);
+            }
+            return 0;
+        }
+    }
     if (entries.length === 0) {
         const scope = only === undefined ? 'registry' : 'selected registry entries';
         const error = `${scope} has no runnable entries after validation — nothing can be run; the registry is unusable`;
         const summary = summarizeMutationResults(entryResults);
         if (json) {
-            write(JSON.stringify({ error, registryPath, results: entryResults, summary, exitCode: 2 }, null, 2));
+            write(JSON.stringify({ error, registryPath, ...(selectionMeta !== null ? { selection: selectionMeta } : {}), results: entryResults, summary, exitCode: 2 }, null, 2));
         }
         else {
             write(`dz mutation-gate: ${error}`);
@@ -12009,13 +12617,98 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
     const testCmdRaw = options.get('test-cmd') ?? parsed.registry.testCommand ?? 'npm test';
     if (/[\0\n\r]/.test(testCmdRaw))
         return fail('--test-cmd may not contain NUL or newline characters');
-    const testCmd = testCmdRaw;
+    let testCmd = testCmdRaw;
     const excludedSelfChecks = REGISTRY_SELFCHECK_TESTS.filter((testFile) => entries.some((entry) => buildMutationTestCommand(testCmd, entry).excluded.includes(testFile)));
     if (!json) {
         write(`mutation-gate: self-check excluded from mutant runs: ${excludedSelfChecks.join(', ') || '(none)'}`);
     }
-    const timeoutOpt = Number(options.get('timeout') ?? '300000');
-    const timeout = Number.isFinite(timeoutOpt) && timeoutOpt > 0 ? timeoutOpt : 300000;
+    // mutation-gate-timeout-verdict FR-3/FR-4: precedence is the `--timeout` flag > the registry's
+    // own `timeoutMs` field > the 300000ms default. A package whose real baseline run is longer than
+    // the default (this repo's core package, MEASURED ≈5-8 min) declares its floor in the registry so
+    // a bare `dz mutation-gate` — no flag — still succeeds (AC-5).
+    const timeoutFlagRaw = options.get('timeout');
+    let timeout;
+    let timeoutSource;
+    if (timeoutFlagRaw !== undefined) {
+        const timeoutOpt = Number(timeoutFlagRaw);
+        if (Number.isFinite(timeoutOpt) && timeoutOpt > 0) {
+            timeout = timeoutOpt;
+            timeoutSource = 'flag';
+        }
+        else {
+            timeout = 300000;
+            timeoutSource = 'default';
+        }
+    }
+    else if (parsed.registry.timeoutMs !== undefined) {
+        timeout = parsed.registry.timeoutMs;
+        timeoutSource = 'registry';
+    }
+    else {
+        timeout = 300000;
+        timeoutSource = 'default';
+    }
+    if (!json)
+        write(`mutation-gate: timeout: ${timeout} ms (${timeoutSource})`);
+    // mutation-gate-baseline-honesty FR-2/FR-3: precedence is the `--max-workers` flag > the
+    // registry's own `maxWorkers` field > `min(4, max(1, floor(cpus/2)))`. Baseline and mutant runs
+    // spawn the package's FULL testCommand at vitest's DEFAULT worker count (= cpu cores) unless
+    // capped — MEASURED: under embedding-daemon tests (0.7-3.5 GB/process) this repo's core package
+    // hit load 62-358 and 0.4-1.8 GB free on an 8-core/16GB box, killing three full overnight runs
+    // (0bb74d66); the same suite at `--maxWorkers=2` passed 6909/6909.
+    const maxWorkersFlagRaw = options.get('max-workers');
+    const defaultMaxWorkers = Math.min(4, Math.max(1, Math.floor(cpus().length / 2)));
+    let maxWorkers;
+    let maxWorkersSource;
+    if (maxWorkersFlagRaw !== undefined) {
+        // fix-round 1, AM-1: an invalid `--max-workers` value (0, negative, fractional, `NaN`,
+        // non-numeric) is a USAGE ERROR (exit 2) — mirroring the `--only` unknown-id fail() style —
+        // never a silent fallback to the default. A silent fallback would make a typo'd flag run
+        // uncapped-by-mistake while LOOKING capped (the source line still says "(default)").
+        const maxWorkersOpt = Number(maxWorkersFlagRaw);
+        if (!Number.isInteger(maxWorkersOpt) || maxWorkersOpt < 1) {
+            return fail(`--max-workers must be a positive integer, got '${maxWorkersFlagRaw}'`);
+        }
+        maxWorkers = maxWorkersOpt;
+        maxWorkersSource = 'flag';
+    }
+    else if (parsed.registry.maxWorkers !== undefined) {
+        maxWorkers = parsed.registry.maxWorkers;
+        maxWorkersSource = 'registry';
+    }
+    else {
+        maxWorkers = defaultMaxWorkers;
+        maxWorkersSource = 'default';
+    }
+    // FR-3: inject the ceiling into the command ONLY when it is (detectably) a vitest run and does
+    // not already name the flag itself — an arbitrary testCommand cannot be assumed to accept
+    // `--maxWorkers`. VITEST_MAX_WORKERS is set in the env unconditionally (below, at spawn time)
+    // regardless of this detection, so a vitest command reached indirectly (e.g. through a package
+    // script) is still capped.
+    // fix-round 1, AM-3: detection AND injection are scoped to the VITEST SEGMENT — from the first
+    // `vitest run` token to the next `&&`/`||`/`;`/`|` (or end of string) — and the flag lands right
+    // after `vitest run`, never appended to the tail of a whole (possibly compound) command. A
+    // raw-substring append over the FULL command turned `vitest run … && cleanup` into
+    // `vitest run … && cleanup --maxWorkers=2` (silently handed to `cleanup`, not vitest), and the
+    // existing-flag check could be suppressed by an unrelated `--maxWorkers` substring living outside
+    // the vitest segment entirely (e.g. inside `cleanup`'s own args, or before `vitest run` in the
+    // same command).
+    const vitestRunIdx = testCmd.indexOf('vitest run');
+    const isVitestCommand = vitestRunIdx !== -1;
+    if (isVitestCommand) {
+        const tailFromRun = testCmd.slice(vitestRunIdx);
+        const terminator = /&&|\|\||;|\|/.exec(tailFromRun);
+        const vitestSegment = terminator !== null ? tailFromRun.slice(0, terminator.index) : tailFromRun;
+        if (!vitestSegment.includes('--maxWorkers')) {
+            const insertAt = vitestRunIdx + 'vitest run'.length;
+            testCmd = `${testCmd.slice(0, insertAt)} --maxWorkers=${maxWorkers}${testCmd.slice(insertAt)}`;
+        }
+    }
+    if (!json) {
+        write(isVitestCommand
+            ? `mutation-gate: workers: ${maxWorkers} (${maxWorkersSource})`
+            : 'mutation-gate: workers: n/a — test command is not vitest');
+    }
     // Route-b guard mode: `per-entry` (default, strongest — each red entry re-baselines the restored
     // tree, so a flaky neighbour flips THAT entry to INCONCLUSIVE) or `final` (cheap — one re-run at
     // the end; if it is not green, every red-based verdict of the run is downgraded, because any of
@@ -12092,22 +12785,29 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
         const realScratchRoot = realpathSync(copyDir);
         const requireCompletionReceipt = parsed.registry.requireCompletionReceipt === true;
         const invokeSuite = (suiteCommand, phase, entryId) => {
+            // FR-3: VITEST_MAX_WORKERS is set in any case — regardless of whether the command was
+            // recognised as vitest and got the `--maxWorkers=<n>` flag injected — so a vitest command
+            // reached indirectly (a wrapper script) is still capped.
+            const extraEnv = { VITEST_MAX_WORKERS: String(maxWorkers) };
             if (injectedRunner !== undefined) {
                 return injectedRunner(suiteCommand, {
                     cwd: copyDir,
                     timeoutMs: timeout,
                     phase,
+                    env: extraEnv,
                     ...(entryId !== undefined ? { entryId } : {}),
                 });
             }
+            const startedAt = performance.now();
             const run = spawnSync(suiteCommand, {
                 cwd: copyDir,
                 shell: true,
                 encoding: 'utf-8',
                 timeout,
                 maxBuffer: 64 * 1024 * 1024,
-                env: { ...process.env, FORCE_COLOR: '0' },
+                env: { ...process.env, FORCE_COLOR: '0', ...extraEnv },
             });
+            const elapsedMs = Math.round(performance.now() - startedAt);
             const errorCode = run.error && 'code' in run.error && typeof run.error.code === 'string'
                 ? run.error.code
                 : undefined;
@@ -12118,11 +12818,28 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
                 throw run.error;
             }
             const signal = typeof run.signal === 'string' ? run.signal : undefined;
+            // mutation-gate-timeout-verdict FR-1/FR-2: a genuine ETIMEDOUT must NEVER be read as a real
+            // suite verdict, even when the killed child intercepted the kill signal and exited with its
+            // OWN status (e.g. a SIGTERM handler calling `process.exit(1)`) — MEASURED: node still sets
+            // `run.error.code === 'ETIMEDOUT'` in that case, but a numeric `run.status` used to win the
+            // `typeof run.status !== 'number'` check below, so the timeout was silently reported as
+            // "baseline suite RED (exit 1)", indistinguishable from a real red suite. ETIMEDOUT now short
+            // -circuits to `exitCode: null` unconditionally, before that check runs.
+            if (errorCode === 'ETIMEDOUT') {
+                // Codex round-1 (2026-09-14): report BOTH facts when both exist — a trapped SIGTERM that
+                // exits 1 shows `child exit 1; signal SIGTERM`, a plain kill shows `no exit code; signal …`.
+                const exitPart = typeof run.status === 'number' ? `child exit ${run.status}` : 'child produced no exit code';
+                const childExit = signal === undefined ? exitPart : `${exitPart}; signal ${signal}`;
+                const suggestedMs = Math.max(timeout + 1, Math.ceil(elapsedMs * 2));
+                return {
+                    exitCode: null,
+                    output: `${String(run.stdout ?? '')}\n${String(run.stderr ?? '')}`,
+                    failureReason: `timeout after ${timeout}ms (elapsed ${elapsedMs}ms); ${childExit}; try --timeout ${suggestedMs} or the registry's timeoutMs field`,
+                };
+            }
             let failureReason;
             if (typeof run.status !== 'number') {
-                if (errorCode === 'ETIMEDOUT')
-                    failureReason = `timeout after ${timeout}ms${signal === undefined ? '' : `; signal=${signal}`}`;
-                else if (errorCode === 'ENOBUFS')
+                if (errorCode === 'ENOBUFS')
                     failureReason = 'maxBuffer exceeded (ENOBUFS; 67108864-byte output ceiling)';
                 else if (signal !== undefined)
                     failureReason = `child killed by signal ${signal}`;
@@ -12384,7 +13101,7 @@ function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
     }
     const exitCode = mutationGateExitCode(results, baseline.ok);
     if (json) {
-        write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, rebaselineMode, baseline, results, summary: summarizeMutationResults(results), warnings, internalRetries, exitCode }, null, 2));
+        write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, rebaselineMode, baseline, results, summary: summarizeMutationResults(results), warnings, internalRetries, ...(selectionMeta !== null ? { selection: selectionMeta } : {}), exitCode }, null, 2));
         return exitCode;
     }
     write(renderMutationReport(results, baseline, pkgDir));
@@ -19757,11 +20474,11 @@ export async function runCli(argv, io = {}) {
             case 'auto-canonicalize':
                 return await cmdAutoCanonicalize(options, cwd, write);
             case 'publish':
-                return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner, io.publishSiblingDriftFetcher, io.publishPackedInstallRunner, io.publishExecRunner);
+                return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner, io.publishSiblingDriftFetcher, io.publishPackedInstallRunner, io.publishExecRunner, io.publishGateAuditFsLayer, io.publishNpmPackRunner);
             case 'release':
                 return cmdRelease(options, flags, cwd, write, io.releaseRunner);
             case 'parity':
-                return cmdParity(options, flags, write, writeErr, cwd);
+                return await cmdParity(options, flags, write, writeErr, cwd);
             case 'registry':
                 return cmdRegistry(options, cwd, write);
             case 'benchmark':