@dzhechkov/harness-cli 0.8.9 → 0.8.15

package/dist/cli.js

@@ -10,33 +10,57 @@ import { request as httpsRequest } from 'node:https';
 import { KNOWN_CLI_FLAGS } from './known-flags.js';
 import { isBooleanFlag } from './boolean-flags.js';
 import { resolveInstallSpec } from './install-spec.js';
+import { dispatchedCommands, documentedCommands } from './command-inventory.js';
 import { execFile, execFileSync, execSync, spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { homedir, tmpdir } from 'node:os';
+import { homedir, hostname, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 import { isDeepStrictEqual } from 'node:util';
-import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
+import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, resolveSelection, formatSelectRefusal, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
 // dz workflow run (feature dz-workflow-run): the pure scheduler + the dispatch adapters.
-TRACE_RUNID_RE, WF_RUN_OWNER_HOST, preflight, runWorkflow, makeClaudePDispatcher, makeCodexExecDispatcher, NamedLockTimeoutError, NamedLockCompromisedError, POLICY_SOURCES, detectPolicyDrift, hasPolicyFence, TARGET_NAMES, buildParityMatrix, downgradeForStaleEvidence, findStaleTranscriptEvidence, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_TEMPLATES_RETIRED_MESSAGE, parsePlan, isParseErrors, validatePlan, normalizePlan, planDigest, toTraceProjection, renderPlan, mergeRender, lint, lintExitCode, LOOP_BLOBS, parseTrace, assembleTimeline, runInvariants, deriveAttestation, stampAttestation, corroborate, NOT_WITNESSED, renderTimelineHtml, importEcc, recordPattern, recordLessonForms, normalizeLessonForms, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, CHECKPOINT_STAGES, estimateEta, extractStageSamples, formatEta, parseCheckpointLines, segmentRun, computeUsage, deriveCostLedger, planLedgerBackfill, listCostLedgerRuns, resolveLedgerRunId, AMBIGUOUS, stampCheckpointLine, LEDGER_FILL_SOURCE, renderCostLedger, verifyCostLedgerReport, writeCostLedgerJsonl, COST_LEDGER_SCOPE, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, parseWeeklyResetAnchor, claimCheck, summarize, BUNDLED_SLOP_REGISTRY_URL, DEFAULT_SLOP_CONFIG, parseSlopRegistry, slopLint, validateSlopLintConfig, queryBookKnowledge, loadStorePatternsSync, patternRecordId, patternIdentityOf, mergeLessonMatchedForms, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, bookKbPath, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, EVENT_CHAIN_TAIL_BYTES, EMPTY_LOG_TAIL, readTailInfo, appendChainedLines, verifyEventChainText, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, parsePnpmLockImporters, scannableStubPath, 
+TRACE_RUNID_RE, WF_RUN_OWNER_HOST, preflight, runWorkflow, makeClaudePDispatcher, makeCodexExecDispatcher, NamedLockTimeoutError, NamedLockCompromisedError, POLICY_SOURCES, detectPolicyDrift, hasPolicyFence, TARGET_NAMES, buildParityMatrix, downgradeForStaleEvidence, findStaleTranscriptEvidence, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_TEMPLATES_RETIRED_MESSAGE, parsePlan, isParseErrors, validatePlan, normalizePlan, planDigest, toTraceProjection, renderPlan, mergeRender, lint, lintExitCode, LOOP_BLOBS, parseTrace, assembleTimeline, runInvariants, deriveAttestation, stampAttestation, corroborate, NOT_WITNESSED, renderTimelineHtml, importEcc, recordPattern, recordLessonForms, normalizeLessonForms, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, renderFeatureAdrPhaseLine, statuslineData, countLearningStoreRowsReadonly, readStoreMark, writeStoreMark, resetStoreMark, checkStoreHealth, storeGuardPath, storeSnapshotPath, writeFeatureAdrState, writeFeatureAdrStateDetailed, CHECKPOINT_STAGES, estimateEta, extractStageSamples, formatEta, parseCheckpointLines, segmentRun, computeUsage, deriveCostLedger, planLedgerBackfill, listCostLedgerRuns, resolveLedgerRunId, AMBIGUOUS, stampCheckpointLine, LEDGER_FILL_SOURCE, renderCostLedger, verifyCostLedgerReport, writeCostLedgerJsonl, COST_LEDGER_SCOPE, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, parseWeeklyResetAnchor, claimCheck, summarize, BUNDLED_SLOP_REGISTRY_URL, DEFAULT_SLOP_CONFIG, parseSlopRegistry, slopLint, validateSlopLintConfig, queryBookKnowledge, loadStorePatternsSync, patternRecordId, patternIdentityOf, mergeLessonMatchedForms, SWARM_BRIEF_CONTRACT, checkSwarmBrief, visibleText, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, bookKbPath, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, EVENT_CHAIN_TAIL_BYTES, EMPTY_LOG_TAIL, readTailInfo, appendChainedLines, verifyEventChainText, classifyChainDefects, CHAINED_JOURNALS, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, appendTransition, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, parsePnpmLockImporters, scannableStubPath, 
 // guard-promotion (feature guard-promotion, scout idea #1)
-assembleCandidates, renderPromotionReport, renderPromotionAdr, normalizePromotionState, nextPromotionState, recordPromotionRunEvidence, isLessonRuleContentAnchor, isOffsetIsoTimestamp, globMatch, promotionAdrRelPath, DEFAULT_WINDOW_DAYS, DEFAULT_PERIODS, MAX_CONTENT_FETCHES, BUILTIN_COVERAGE, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, classifyExecutionEvidence, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, harvestStageOutcomes, recommendModels, planFeed, unfedRuns, GRADE_SUCCESS_FLOOR, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, declaredPluginSurface, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, buildDeadwoodReport, compactCmdUsageIfNeeded, measureCmdUsageDepthDays, recordCommandInvocation, resolveCmdUsageRoot, renderDeadwoodReport, CMD_USAGE_LOG_RELATIVE, banditStats, narrowBanditReport, renderBanditHealth, 
+assembleCandidates, renderPromotionReport, renderPromotionAdr, normalizePromotionState, nextPromotionState, recordPromotionRunEvidence, isLessonRuleContentAnchor, isOffsetIsoTimestamp, globMatch, promotionAdrRelPath, DEFAULT_WINDOW_DAYS, DEFAULT_PERIODS, MAX_CONTENT_FETCHES, BUILTIN_COVERAGE, decideProvenance, isInsideTree, signManifest, verifyManifest, listPackFiles, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, resolveScanTailTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, runRetroTailScan, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, classifyExecutionEvidence, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, harvestStageOutcomes, recommendModels, planFeed, unfedRuns, GRADE_SUCCESS_FLOOR, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, declaredPluginSurface, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, buildDeadwoodReport, compactCmdUsageIfNeeded, measureCmdUsageDepthDays, recordCommandInvocation, resolveCmdUsageRoot, renderDeadwoodReport, CMD_USAGE_LOG_RELATIVE, banditStats, narrowBanditReport, renderBanditHealth, 
 // Cold-vs-warm EPOCH RUNNER (feature epoch-replay) — orchestrates + scores, never calls a model.
-replayableInstances, buildWorkOrder, buildJudgePrompts, unblindJudgments, verifyWorkOrder, isValidMargin, DIGEST_HONEST_SCOPE, scoreEpochReplay, generateMockOutcomes, renderEpochReplayResult, renderWorkOrderSummary, renderJudgePromptsSummary, WORK_ORDER_KIND, DEFAULT_MOCK_N, DEFAULT_MOCK_SEED, scoreRun, readQeGrade, recapWindow, decideHorizon, withinWindow, buildRecap, renderRecap, parseSourceManifest, tgPostHtmlIssues, tgVisibleLength, decideTgSend, TG_TEXT_LIMIT, countRecallEventsForRun, unknownFlagNotice, mirrorWriterExplanation, appendRecallUsage, closenessLine, anyAboveFloor, decideNameCheck, renderNameCheck, exportedNamesIn, dispatchedCommandsIn, decideSourceProvenance, renderSourceProvenance, REFUSED_HORIZONS, renderScorecard, renderCompoundingReport, readReinforcementState, readQuarantineState, registrationExitCode, renderRegistrationReport, 
+replayableInstances, buildWorkOrder, buildJudgePrompts, unblindJudgments, verifyWorkOrder, isValidMargin, DIGEST_HONEST_SCOPE, scoreEpochReplay, generateMockOutcomes, renderEpochReplayResult, renderWorkOrderSummary, renderJudgePromptsSummary, WORK_ORDER_KIND, DEFAULT_MOCK_N, DEFAULT_MOCK_SEED, scoreRun, readQeGrade, scoreReceiptToAggregateRow, readScoreAggregateRows, dedupeScoreAggregateRows, buildScoreAggregateReport, renderScoreAggregateReport, recapWindow, decideHorizon, withinWindow, buildRecap, renderRecap, parseSourceManifest, tgPostHtmlIssues, tgVisibleLength, decideTgSend, TG_TEXT_LIMIT, countRecallEventsForRun, unknownFlagNotice, mirrorWriterExplanation, appendRecallUsage, closenessLine, anyAboveFloor, decideNameCheck, renderNameCheck, exportedNamesIn, dispatchedCommandsIn, decideSourceProvenance, renderSourceProvenance, REFUSED_HORIZONS, renderScorecard, renderCompoundingReport, readReinforcementState, readQuarantineState, registrationExitCode, renderRegistrationReport, 
 // Smart Backlog (feature smart-backlog) — goal-directed idea pipeline over the Brain vector engine.
 readBacklogConfig, readIdeas, writeIdeas, ideaId, dedupIdea, readGoalMap, readGoalMapDetailed, parseEffort, ensureBacklogGitignored, isSafeId, alignIdea, mirrorIdeaVector, ensureBacklogEmbedForm, readBacklogEmbedFormVersion, recordAbsorption, DEDUP_EMBED_FORM_VERSION, snapshotIdeas, spinRoulette, rankRoulette, seededRng, eligibleIdeas, stageEnrichment, buildJiraDraft, resolveJiraAdapter, makeBacklogIO, harmonizeBacklog, transitionIdeas, editIdea, clearEmbedStale, BACKLOG_BACKENDS, applyDomainBoost, DZ_OWNED_TASK_TYPES, applyExportHoldout, DEFAULT_HELD_OUT_DOMAINS, canonicalDomainKey, readAgentdbRowsByTaskType, heldOutAfterOptIn, renderHoldoutNote, renderSharedStoreAdvice, decideVectorExport, countDisplacedByCut, renderDomainBoostNote, renderDomainCutNote, parseReqeDebt, 
 // qe-bridge (feature qe-bridge-claude, ADR-001): the pure half of the reverse QE bridge.
 KNOWN_CLAUDE, isSafeClaudeId, claudeProbeArgs, claudeReviewArgs, interpretClaudeProbe, modelFamily, buildBridgePrompt, parseBridgeOutput, buildBridgeFailureRecord, buildBridgeSignoffRecord, renderBridgeReport, isSafeSlug, hasUnsafePathChars, hasDotDotSegment, buildReqeBrief, settleReqeDebt, renderReqeList, REQE_SCOPE, 
 // Mutation gate (feature ha-mutation-gate) — break each named protection, run the suite, require red.
-parseMutationRegistry, applyMutationToText, countFailingTests, detectSuiteCompletionReceipt, detectSuiteReceiptMismatch, classifyBaseline, classifyRunFailure, classifyMutationOutcome, mutationGateExitCode, summarizeMutationResults, renderMutationReport, TRACE_BUNDLE_LEDGER_PATH, TRACE_BUNDLE_SCHEMA, TRACE_BUNDLE_RUN_META_FILE, buildBundle, serializeBundle, parseBundle, planImport, decideCheckpointWrite, amendmentSection, planSaysNoAmendments, parseAmendments, resolveAmendments, decideAmendmentOutcome, amendmentVerdictLine, amendmentsMissingFromPlan, AMENDMENT_VACUITY_NOTE, extractContractChecklist, parseContractVerdictReport, verifyContractVerdicts, decideSignableSet, signableSetLine, decideRecordWrite, decideReadBack, recordVerdictLine, buildCadenceReport, tgVisibleSha256, CADENCE_WINDOW_DAYS, readQeRounds, QE_ROUNDS_DEFAULT_CEILING, adviseRestart, describeStoreLocation, storeLocationLine, resolveTeachTarget, teachReasonPhrase, readTeachToConfig, TeachTargetError, mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel, 
+parseMutationRegistry, applyMutationToText, attributeBaselineRedness, countFailingTests, detectSuiteCompletionReceipt, detectSuiteReceiptMismatch, classifyBaseline, classifyRunFailure, classifyMutationOutcome, mutationGateExitCode, summarizeMutationResults, renderMutationReport, runWithOneInternalRetry, TRACE_BUNDLE_LEDGER_PATH, TRACE_BUNDLE_SCHEMA, TRACE_BUNDLE_RUN_META_FILE, buildBundle, serializeBundle, parseBundle, planImport, decideCheckpointWrite, amendmentSection, amendmentSectionCount, amendmentDeclarationAmbiguity, planSaysNoAmendments, parseAmendments, resolveAmendments, decideAmendmentOutcome, amendmentVerdictLine, amendmentsMissingFromPlan, AMENDMENT_VACUITY_NOTE, extractContractChecklist, parseContractVerdictReport, verifyContractVerdicts, decideSignableSet, signableSetLine, decideRecordWrite, decideReadBack, recordVerdictLine, buildCadenceReport, tgVisibleSha256, CADENCE_WINDOW_DAYS, readQeRounds, QE_ROUNDS_DEFAULT_CEILING, adviseRestart, describeStoreLocation, storeLocationLine, resolveTeachTarget, teachReasonPhrase, readTeachToConfig, TeachTargetError, mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel, 
 // operator-profile (ADR-001): per-user 0600 store + marked block in ~/.claude/CLAUDE.md
 renderProfileBlock, readProfile, writeProfile, syncProfileBlock, checkProfileDrift, parseRegister, registerOwnerWord, profileAgeDays, parseDomainList, domainListText, parseYesNo, REGISTERS, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
+/**
+ * Область, по которой гейт дрейфа собирает факты. ПОЛНАЯ, а не только корни установки.
+ *
+ * ПОЧЕМУ. Под областью `installs` сравниваются лишь корни установки (`.claude/skills`,
+ * `.agents/skills` и далее). Навык, чьи копии лежат в РАЗНЫХ корнях — канон в `packages/`, живая
+ * копия в `.claude/skills` — имеет там ОДНУ копию, а одну копию не с чем сравнивать: она
+ * отбрасывается как не дублированная. То есть главный класс расхождения был для гейта невидим.
+ *
+ * ИЗМЕРЕНО 2026-09-03: `brutal-honesty-review` разошёлся ровно так (канон в skills-qe, копия в
+ * бандле p-replicator, живая в .claude/skills), и гейт не мог увидеть это В ПРИНЦИПЕ. Я тогда
+ * написал в отчёте «гейт разблокирован» — он никогда не был на этом заблокирован.
+ *
+ * Узкая область давала 19 дублирующихся навыков, полная даёт 211. Безопасность расширения
+ * проверена ДО правки: с полной областью и списком исключений дрейфа сегодня НОЛЬ.
+ */
+const DRIFT_SWEEP_SCOPE = 'all';
+/**
+ * Базовая дата правила `backlog-covers-features`. Каталоги фич, заведённые ДО неё, правило не
+ * трогает: они появились раньше самого правила. ИЗМЕРЕНО 2026-09-03 — без базы правило даёт 236
+ * нарушений из 336 каталогов, и проверка, изобретающая полсотни нарушений в первый день, учит
+ * людей себя игнорировать. Дата = день, когда правило принято владельцем.
+ */
+const BACKLOG_COVERAGE_BASELINE = '2026-09-03';
 /** Literal command inventory, pinned against the main dispatch switch by a layer-1 test. */
 export const DZ_COMMANDS = [
     'init', 'verify', 'sync', 'update', 'list', 'create-skill', 'info', 'scout',
     'workflow', 'workflow-lint', 'workflow-trace', 'migrate', 'doctor', 'install',
-    'bundle', 'teach', 'consolidate', 'recall', 'vector', 'brain', 'statusline',
+    'bundle', 'teach', 'consolidate', 'recall', 'vector', 'brain', 'statusline', 'store-guard',
     'usage', 'claim-check', 'lint', 'sign', 'sbom', 'guard', 'verify-pack', 'setup',
     'pretrain', 'compose', 'diff', 'recommend', 'upgrade', 'auto-canonicalize',
     'publish', 'release', 'parity', 'registry', 'benchmark', 'mcp-scan',
@@ -45,9 +69,9 @@ export const DZ_COMMANDS = [
     'retro', 'feature-adr-setup', 'challenge', 'discrimination-check',
     'mutation-gate', 'delivery-check', 'skills-verify', 'compounding', 'deadwood',
     'epoch-replay', 'score', 'recap', 'cadence', 'qe-rounds', 'restart-advisor', 'tg-post',
-    'name-check', 'provenance-check', 'feature-adr-record', 'amendment-check', 'contract-check',
+    'name-check', 'brief-check', 'provenance-check', 'feature-adr-record', 'amendment-check', 'contract-check',
     'feature-adr-checkpoint', 'profile', 'reqe', 'qe-bridge', 'backlog', 'routing',
-    'bto-optimize', 'dashboard', 'roam', 'import-ecc',
+    'bto-optimize', 'dashboard', 'roam', 'import-ecc', 'chain',
 ];
 const USAGE = `dz - DZ cross-platform harness CLI
 
@@ -88,27 +112,29 @@ Usage:
   dz epoch-replay --judge <filled-work-order.json> [--out <file>]   (blind judge prompts from the filled plans)
   dz epoch-replay --score <judgments.json> --work-order <file> [--slice <name>] [--json]   (un-blind against the pre-registered assignment → SUPPORTED only when the two 95% Wilson CIs are DISJOINT, else FALSIFIED / INCONCLUSIVE)
   dz score --slug <feature> [--project <dir>] [--json]   (process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination, cross-model QE grade, live verification, README-first, learning loop, amendments — descriptive-only, a low score exits 0)
+  dz score --all [--project <dir>] [--json]              (sweep features/*/.fa-state/score-*.json into the append-only chained scorecards aggregate — descriptive-only, always exits 0)
   dz recap [--day|--week|--month] [--at <ISO date>] [--project <dir>] [--json]   (what was done over a window, from records only: deliveries with the grade an independent review STATED — a report naming two grades is reported ambiguous, never guessed — registry publishes, gate verdicts, knowledge reuse. --quarter/--half-year/--year are RECOGNISED and REFUSED with the real span in days: there is one complete quarter and the longest record is 174 days. Every section carries its own data-start date, and "the source was not read" never prints as zero. Contaminated measures — commit count, lines, tokens, learning-event volume, inventory counts, lesson count — are not computed, and the report says so. exit 0 reported / 2 refused)
   dz cadence [--window day|week|month|quarter|halfyear|year] [--json]   (the WHAT-SHIPPED aggregator: graded-shipment cadence by ISO week + npm-publish cadence (recap cache) + guard repeat decay on the FIXED rule set + recall reuse; a window deeper than 2× the record is REFUSED with the depth named (ADR: a cadence from one point is scale forgery); exit 0 report / 2 refused-window / 1 usage)
   dz qe-rounds (--slug <feature> | --feature-dir <abs>) [--ceiling <n>] [--project <dir>] [--json]   (how many Step-8 review rounds has this feature ALREADY had? Reads what dz qe-bridge already wrote — signoff-<runId>.json and failed-*.json under features/<slug>/.fa-state/qe-bridge — and writes nothing itself, so it can answer for runs already past. A round is a runId, not a file; an attempt with no verdict is counted SEPARATELY and never merged; an unreadable record is NAMED and the count is declared a LOWER BOUND. ONE directory, never a union across checkouts. exit 0 under the ceiling / 1 at-or-over — owner decides, the command does not judge whether the rounds were warranted / 2 NOT ESTABLISHED, which is never "zero rounds")
   dz restart-advisor --slug <s> [--threshold C|D] [--rounds N] [--json]   (read-only advisory decision over features/<slug>/.fa-state/checkpoints.jsonl and .dz/fa-training/<slug>/qe.jsonl. Defaults: threshold D, rounds 2 — both origins are printed. Equal sources corroborate; conflicts, torn/unreadable evidence, gaps, and unsafe paths are NOT ESTABLISHED. RECOMMENDATION ONLY: autoAction=false; never invokes feature-adr, deletes a stage, or writes advisor state. exit 0 established recommendation/no-recommendation / 2 NOT ESTABLISHED or invalid input / 1 unexpected runtime failure)
   dz tg-post --draft <file.html> [--manifest <sources.json>] [--channel <@name|id>] [--send --yes] [--night] [--preview] [--json]   (the sender for an APPROVED channel post, per the accepted genai-tweets-channel ADRs: HTML mode only — never MarkdownV2; link preview OFF by default (x.com previews in Telegram are broken); the 00:00-06:00 MSK quiet window refuses without an explicit --night. DEFAULT IS A DRY-RUN: it validates the draft (tag balance, allowed tags, bare &/<, the 4096 visible-character limit with the overshoot counted) and runs the provenance gate over --manifest IN-PROCESS — a draft with no manifest is refused as unchecked, and anything but ALLOWED refuses. A real send needs --send --yes, stating ADR-004's manual-publishing decision out loud each time. The token comes from TELEGRAM_BOT_TOKEN or telegram.tokenFile in .dz/config.json and is never printed. exit 0 sent or clean dry-run / 1 refused or Telegram error / 2 usage)
   dz name-check [--command <n>] [--module <basename>] [--export <a,b>] [--project <dir>] [--json]   (is this name free, BEFORE a line of code? Scans workspace SOURCE — never dist, because a stale build answers 'free' confidently. Checks a dz command name against the dispatcher AND the help block, a module basename against every package's src/, and exported identifiers against every declaration in the workspace. exit 0 all free / 1 at least one taken, naming where / 2 nothing asked or the scan did not run — an empty sweep is never a clean bill. Honest limit, printed on the passing path: it reads declarations, so a re-export under a different name stays the build's job)
+  dz brief-check <file> [--json]   (does a swarm brief declare OUTPUT_DIR, UNITS and ASSEMBLY_UNIT? parsed as DATA, refused by name; verifies the brief DECLARED the contract, not that the agent follows it. exit 0 ok / 1 refused / 2 unreadable)
   dz provenance-check --manifest <sources.json> [--project <dir>] [--json]   (nothing goes out citing a source that may not leave this machine. Checks PROVENANCE, not words: every claim names its source, and only a KNOWN kind that resolves safely is cleared. Repo paths go through 'git -C <root> check-ignore' over the RESOLVED path — a symlink into an ignored directory is REFUSED (git classifies the string and never dereferences, MEASURED), and the verdict does not change with your working directory. Store records must be named in the git-TRACKED provenance-public.json, so declaring one public is a reviewable commit rather than a field inside an ignored store. An undeclared kind is refused, never inferred from the path's shape. exit 0 allowed / 1 blocked / 3 NOT ESTABLISHED — an empty manifest, an unreadable one, or an oracle that did not run is never a pass. It proves what was CITED: it cannot see a paraphrase with no citation, nor confidential text pasted by hand into an allowed file)
   dz project-skills [--project <dir>] [--json] [--stages-json]   (polymorphic feature-adr: resolve architecture/project-skills.json — fixed roles product-vision/critic/brand/impl-bar plus an open extra[] — into per-stage guidance. READ-ONLY. --project names the root explicitly, so it works from any cwd; without it the manifest is read from the current repo. No manifest ⇒ a byte-identical generic run)
   dz discrimination-check --slug <slug> [--base <ref>] [--json]   (does the ADR's named test actually DISCRIMINATE? Re-runs it on a worktree at the pre-feature commit, where it MUST go red. A test that passes with the feature removed proves nothing; dz amendment-check proves the test exists, this proves it bites)
   dz guard [check|promote|init] [--json] [--force]   (HARD/SOFT repo rules — readme-first, lockfile-in-sync, claim tagging — run automatically as a pre-flight inside dz publish. HARD blocks, SOFT warns)
   dz architecture [--check --slug <s> --desc <text>] [--project <dir>] [--revise]   (the live product map + vision: --check is the soft Step-0 сверка of a new feature against them, reporting {signal,confidence} rather than blocking)
   dz sbom [--pack <name>] [--out <file>]   (CycloneDX software bill of materials for the workspace, or for one pack with --pack)
-  dz amendment-check --slug <slug> | --feature-dir <dir> | --all [--json]   (the deterministic Step-8 amendment gate: every AM-N row must resolve to a test found INSIDE the file the row names; the PLAN is authoritative when it carries rows, and an ideation amendment the plan drops is a failure. exit 0 pass/skip, 1 fail, 3 NOT-ESTABLISHED — a section that parsed ZERO rows is never a pass. --all is a CENSUS and always exits 0. Does NOT prove non-vacuity — that is dz discrimination-check)
+  dz amendment-check --slug <slug> | --feature-dir <dir> | --all [--json]   (the deterministic Step-8 amendment gate: every AM-N / AM-CP-N row must resolve to a test found INSIDE the file the row names (the challenge-panel prefix is part of the id: AM-CP-1 is never AM-1); the PLAN is authoritative when it carries rows, and an ideation amendment the plan drops is a failure. exit 0 pass/skip, 1 fail, 3 NOT-ESTABLISHED — a section that parsed ZERO rows is never a pass, UNLESS the plan explicitly declares \"None\"/\"нет\", which is an answer and reports skip. --all is a CENSUS and always exits 0. Does NOT prove non-vacuity — that is dz discrimination-check)
   dz contract-check --slug <s> [--json]   (read-only retrospective feature contract gate: extracts canonical AC-N + ADR Confirmation items, requires one artifact-anchored met|unmet|not-testable verdict per CC-N, and rejects A/B with unmet. exit 0 pass / 1 readable contract or verdict violation / 2 invalid invocation or unreadable/not-established artifacts)
   dz feature-adr-record --kind ledger|training-pair --stage <s> [--slug <s>] [--row|--pair <json>] [--mark <n>] [--once] [--json]   (the witnessed writer for the run-cost ledger and training pairs: the payload arrives as an ARGUMENT, never as shell; a malformed or wrong-kind payload is REFUSED before any write; the timestamp is stamped before serialising; the append is verified by re-reading the tail. exit 0 written|duplicate|skipped, 2 refused, 3 not-verified — a record failure is never blocking)
   dz feature-adr-checkpoint (--slug <feature> | --feature-dir <abs>) --stage <s> --input-hash <h> --result <json> [--artifact a,b] [--json]   (record a pipeline stage ONLY after measuring its artifacts on disk; refuses a null result, an absent artifact, or a stage that declares none — the subagent runs a COMMAND instead of hand-writing durable state)
   dz profile [init|show|set|sync] [--json]   (WHO the assistant is talking to — per-user store at ~/.dz/profile.json (0600, NEVER in a project), delivered as a marked block in ~/.claude/CLAUDE.md so it loads in EVERY project, dz installed or not. init = five questions (language, register, deep/weak domains as comma lists — "networking (CCIE; NSX)" keeps the parenthetical as the note, Enter skips — teaches y/n with one re-ask, never a silent default); show ALWAYS prints the store path + age + drift verdict + the rendered block; set register|language|teaches <v> or set deep|weak add|rm <tag> [note] — register accepts the owner's own words (профи / профи лайт / просто), an unknown value is REFUSED naming the accepted set; sync re-writes the block (runs automatically after init/set; foreign content byte-for-byte, timestamped backup before every modifying write). The register changes FORM, never FACTS, and governs dialogue only — never ADRs/commits/QE reports; both rules are baked into the rendered block at every level. exit 0 done / 1 no profile or failed / 2 refused input)
   dz reqe [--slug <feature> [--done --report <f>]] [--json]   (the re-QE debt ledger: a usage-switched run whose Step-8 QE ran on the coder's OWN family records a debt; list debts, print the cross-family review brief, settle FAIL-CLOSED against a graded report — the settlement lands in 08_qe_report.md)
-  dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   (the REVERSE QE bridge: run an INDEPENDENT Claude reviewer over a feature's Step-8 artifacts from ANY host — a Codex session included, plain shell, no Claude agent plane needed — and land a PARSED signoff. The reviewer runs ISOLATED: an EMPTY temp cwd plus --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load, and the verdict is read from the --output-format json RESULT ENVELOPE — text a session customization printed onto the same stdout can never become a signoff. Probes the model before trusting it; sends SCOPED extracts with a loud 200k-char ceiling (never silent truncation); the grade must AGREE across three LAST-anchored channels (terminal marker line, fenced qe-bridge-signoff JSON, the report's own GRADE line) AND the marker must be the FINAL content — empty, gradeless, self-contradicting or miscounted output is one of 18 NAMED failures with an audit record under features/<slug>/.fa-state/qe-bridge/ (runId, resolved executable + binOverride, prompt sha256, channel offsets, requestedOut, reportWritten, retained raw stdout; 0600 files in a 0700 dir), never a clean review. A --coder-family that contradicts the recorded reqe debt is refused. Writes features/<slug>/08b_reqe_report.md, which dz reqe --done settles unchanged. DISCLOSURE: the extracts you scope are sent to the Claude runtime; the bridge cannot classify secrets. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM, not a flag. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage)
+  dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   (the REVERSE QE bridge: run an INDEPENDENT Claude reviewer over a feature's Step-8 artifacts from ANY host — a Codex session included, plain shell, no Claude agent plane needed — and land a PARSED signoff. The reviewer runs ISOLATED: an EMPTY temp cwd plus --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load, and the verdict is read from the --output-format json RESULT ENVELOPE — text a session customization printed onto the same stdout can never become a signoff. Probes the model before trusting it; sends SCOPED extracts with a loud 200k-char ceiling (never silent truncation); the grade must AGREE across three LAST-anchored channels (terminal marker line, fenced qe-bridge-signoff JSON, the report's own GRADE line) AND the marker must be the FINAL content — empty, gradeless, self-contradicting or miscounted output is one of 17 NAMED failures with an audit record under features/<slug>/.fa-state/qe-bridge/ (runId, resolved executable + binOverride, prompt sha256, channel offsets, requestedOut, reportWritten, retained raw stdout; 0600 files in a 0700 dir), never a clean review. A --coder-family that contradicts the recorded reqe debt is refused. Writes features/<slug>/08b_reqe_report.md, which dz reqe --done settles unchanged. DISCLOSURE: the extracts you scope are sent to the Claude runtime; the bridge cannot classify secrets. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM, not a flag. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage)
   dz mutation-gate [--package <dir>] [--registry <file>] [--test-cmd "<cmd>"] [--only <id[,id]>] [--timeout <ms>] [--rebaseline per-entry|final] [--keep-scratch] [--json]   (prove each NAMED protection has a test that DISCRIMINATES: copy the package to a scratch dir, verify the baseline suite is green, apply each registry mutation, run the suite, REQUIRE red, restore. The red must be BEHAVIOURAL: a mutation that no longer parses is MUTATION_UNPARSEABLE; a red run whose OWN output reports a test FILE failing to load (node --test file-level not-ok with exitCode, vitest Failed Suites) is MUTATION_LOAD_FATAL — the signal comes from the same run as the failing count, never from a separate isolated import; red output whose shape matches no known runner is INCONCLUSIVE (a runner-coverage gap, loud, never PROVEN); a count far above the entry's bound is OVER_FAILING; a restored tree that does not reproduce green makes the entry INCONCLUSIVE (flaky). Mutation writes are realpath-contained to the scratch copy: a symlink escape or a node_modules/ target is refused (exit 2), the real tree is never written. A mutation that does not apply, a green suite, or an inconclusive run is a FAILURE — never a skip. exit 0 all proven / 1 gate failed / 2 setup error)
-  dz backlog add "<idea>" [--effort 1-5] [--proposal <text>] [--dry-run] [--project <dir>] [--json]   (capture an idea: semantic dedup against existing ideas via the Brain vector engine (DUPLICATE>=0.92 merges, RELATED links, NEW creates) + GoalMap alignment; --dry-run classifies without writing)
+  dz backlog add "<idea>" [--effort 1-5] [--proposal <text>] [--dry-run] [--allow-cold-start] [--project <dir>] [--json]   (capture an idea: semantic dedup against existing ideas via the Brain vector engine (DUPLICATE>=0.92 merges, RELATED links, NEW creates) + GoalMap alignment; --dry-run classifies without writing)
   dz backlog list [--status <s>] [--goal <id>] [--project <dir>] [--json]   (list captured ideas, filterable by status/goal)
   dz backlog show <id> [--project <dir>] [--json]                          (full record for one idea)
   dz backlog goals [--validate] [--project <dir>] [--json]                 (list/validate the compass at .dz/backlog/goals.json)
@@ -122,7 +148,7 @@ Usage:
   dz backlog jira <id> [--project <dir>] [--json]                          (draft a Jira issue via the configurable adapter (backlog.jira.adapter: jira-mcp|copilot-mcp|none); none writes an auditable jira-outbox/<id>.json stub)
   dz backlog harmonize [--apply] [--threshold <0-1>] [--project <dir>] [--json]   (batch semantic dedup of the backlog ideas; --dry-run default, --apply snapshots first)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--no-verify] [--install-driver] [--force] [--enrich]   (--target codex ALSO installs + LIVE-verifies the codex hooks; an unverified hook exits non-zero WITHOUT aborting the rest of setup)
-  dz teach "<pattern>" [--class-form "<template with :slot>"] [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (class form is optional; rejection never blocks the specific write; --project pins the learned store to <dir>/.dz)
+  dz teach "<pattern>" [--class-form "<template with :slot>"] [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror] [--allow-cold-start]   (class form is optional; rejection never blocks the specific write; --project pins the learned store to <dir>/.dz)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
   dz consolidate [--sessions-dir <dir>] [--project <dir>] [--no-mirror] [--prune-noise [--apply]] [--prune-quarantine [--apply]]   (both prunes: DRY-RUN by default; --apply snapshots then deletes; prune-quarantine = expired unproven lessons ONLY, never coupled to noise)
   dz recall "<query>" [--limit <N>] [--domain <name>] [--semantic | --no-semantic] [--books [--book <slug>]] [--project <dir>] | dz recall --all [--json] | dz recall --usage [--json] | dz recall --forget <dzId>[,<dzId>] [--apply] | dz recall --promote <dzId>[,<dzId>] [--apply]   (--domain <name> BOOSTS lessons of that domain without dropping foreign ones — a shared store keeps its cross-domain transfers; forget/promote: dry-run default; forget snapshots before removing; promote lifts lesson-quarantine)
@@ -142,9 +168,11 @@ Usage:
   dz brain expand <kuId> [--source <slug>] [--json]                    (full-content lookup for a citation kuId; --json emits the full KU object)
   dz brain init  [--project <dir>] [--k <N>]                           (wire the grounding hook into .claude/settings.json — opt-in)
   dz statusline [--json] [--install] [--project <dir>]                 (live self-learning panel for Claude Code's status bar; reads the CC JSON payload from STDIN)
-  dz statusline --fa-record --slug <s> --step "<label>" [--kind <feature-adr|loop>] [--recalled <n>] [--stored <n>] [--mode <m>]   (feature-adr: record live per-run learning state → 📐 panel segment)
+  dz store-guard [--status|--reset] [--yes] [--project <dir>]          (show the monotonic external high-water mark; --reset is the only lowering path and requires confirmation or --yes)
+  dz statusline --fa-record --slug <s> --step "<label>" [--kind <feature-adr|loop>] [--tier <S|M|L|XL>] [--recalled <n>] [--stored <n>] [--mode <m>]   (feature-adr: record live per-run learning state + phase → 📐 SECOND-LINE phase panel; a plain "Step <n>" label that goes BACKWARDS against a slot younger than 90 min is absorbed as a stale duplicate — prefix the label with ⛔ or ⏸ to record a legitimate regression)
   dz usage [--json] [--project <dir>] | dz usage --calibrate --session <pct> --weekly <pct> [--model fable=<pct>] [--project <dir>]  (ESTIMATE Claude usage from fixed reset windows; optional per-model weekly binding; exit 0 ALWAYS; pct=null when limits unconfigured)
   dz usage --by-stage [--run <runId> | --slug <slug>] [--epsilon <0..1>] [--write <file.jsonl>] [--json]   (per-stage cost ledger for ONE feature-adr run + the reconciliation invariant: accounted + unaccounted = run total; verdict BALANCED | DEFECT | INSUFFICIENT_DATA; local transcript ESTIMATES — catches ATTRIBUTION errors, not pricing errors)
+  dz chain [--project <dir>] [--json]   (verify EVERY hash-chained journal in ONE command: coverage is DERIVED from the CHAINED_JOURNALS registry, never typed, so a journal cannot be given a chain and checked by nobody. An ABSENT journal is NAMED absent, never omitted — omission and cleanliness are indistinguishable in a report. Statuses: ok | healed (defects the current unbroken run has outlived — verdicts over present records are sound) | unchained (present, no chained record yet — legal) | absent | broken | unreadable. Exit 1 on broken/unreadable: a verifier that reports damage and exits 0 is one no automation can act on)
   dz claim-check [paths...] [--json] [--fail-on high|medium|none] [--project <dir>]  (enforce the Integrity Rule: flag untagged/overstated accuracy claims; default scan = root README.md + every discovered package's README.md + features/*/08_qe_report.md + docs/**/*.md (historical feature artifacts are NOT scanned — pass paths explicitly); exit 1 only at/above --fail-on, default high)
   dz lint [paths...] [--json] [--config <file>] [--registry <file>] [--project <dir>]  (advisory EN/RU prose-style lint; findings exit 0, incomplete input/policy exits 1, usage exits 2)
   dz pretrain [--project <dir>]
@@ -169,6 +197,10 @@ Usage:
   dz dashboard
   dz roam   [--apply] [--slug <slug>]
   dz import-ecc [--local-path <dir>] [--select id,id,...] [--limit N] [--output <dir>] [--force]
+  dz retro   [transcript-path] [--json] [--threshold N] [--no-teach] [--project <dir>] [--install-hook]   (per-session retrospective + co-learning: mines the session transcript for recurring PROCESS rakes, drills you, and teaches the same lesson to the store)
+  dz feature-adr-setup [--plan] [--from-spec <spec.json>] [--guards [--loc-cap <n>]] [--gates [--target <name>]] [--apply] [--json]   (scaffold the project-awareness files feature-adr reads — vision / map / testing / project-skills — plus the deterministic project guards and the portable delivery gates; --guards and --gates work STANDALONE or with --from-spec, and --apply writes for all three; without --apply everything is a preview)
+  dz mr-rakes [--json] [--candidate N] [--confirmed N] [--teach] [--gen-critic <path> [--apply]]   (experimental: mine the review corpus — features' QE reports + REVIEW files — for RECURRING mistakes and close them into self-learning)
+  dz bto-optimize --split | --plan | --select | --scope-check | --diff [--json]   (experimental: deterministic tune/holdout split, budget plan and holdout-no-regress winner selection behind the /bto-optimize skill)
   dz help
 
 Global: --version | -v [--json]   (prints this CLI's own semver on one line, exit 0; "unknown" + exit 1 when unresolvable)
@@ -266,6 +298,35 @@ function discoverSkillsDirs(cwd, explicitSkillsDir) {
 async function installSkills(opts) {
     const { target, projectRoot, cwd, explicitSkillsDir, select, force, enrich } = opts;
     const skillsDirs = discoverSkillsDirs(cwd, explicitSkillsDir);
+    // PREFLIGHT (backlog 9d15b9b6, PR-A) — resolve the REQUEST once, before anything is written.
+    //
+    // Two defects lived in asking each root independently instead of resolving the request: a skill
+    // present in two roots was installed TWICE and counted twice (the field report's `2 skill(s)` was
+    // one skill installed twice), and a skill present in NO root produced a warning and exit 0 —
+    // `0 skill(s)` reading as success. Both are gone once the decision happens here.
+    //
+    // Placement is load-bearing: an exit 1 that arrives after hooks and memory are written leaves a
+    // half-configured project, which is worse than either clean outcome. This runs before the loop
+    // below and before every target adapter.
+    //
+    // Dependency closure is deliberately NOT resolved here — that is PR-B. This preflight fixes the
+    // count and the exit contract, and gives that work a base it can trust.
+    if (select !== undefined) {
+        const roots = skillsDirs.map((dir) => ({ dir, ids: discoverSkillIds(dir) }));
+        const resolution = resolveSelection(select, roots);
+        for (const shadow of resolution.shadowed) {
+            opts.writeErr?.(`dz: skill '${shadow.id}' is offered by ${shadow.alsoIn.length + 1} roots; ` +
+                `installing from ${shadow.chosen} (earlier root wins). Also present in: ${shadow.alsoIn.join(', ')}`);
+        }
+        const refusal = formatSelectRefusal(resolution, roots);
+        if (refusal !== null) {
+            return {
+                selectRefusal: refusal,
+                results: [], dirsSearched: skillsDirs.length, written: 0, skipped: 0,
+                missing: [...resolution.missing], failures: [], applyFailures: [], integrations: [],
+            };
+        }
+    }
     // agents-md and gemini are FLATTENING single-file targets: each must aggregate
     // every selected skill from ALL discovered dirs into ONE root file (AGENTS.md /
     // GEMINI.md) in a single merge. A per-dir runInit loop (like the tree targets
@@ -398,6 +459,7 @@ async function cmdInit(options, flags, cwd, write, writeErr) {
         cwd,
         explicitSkillsDir,
         select,
+        writeErr,
         force: flags.has('force'),
         enrich: flags.has('enrich'),
         noHooks: flags.has('no-hooks'),
@@ -405,6 +467,12 @@ async function cmdInit(options, flags, cwd, write, writeErr) {
         noVerify: flags.has('no-verify'),
         ...(options.get('allow-integrations') !== undefined ? { allowIntegrations: options.get('allow-integrations') } : {}),
     });
+    // PR-A: an explicit --select that named a skill no root provides is a REFUSAL, not a warning.
+    // Printed and returned here, before any target adapter runs — nothing has been written yet.
+    if (r.selectRefusal !== undefined) {
+        writeErr(r.selectRefusal);
+        return 1;
+    }
     // Codex keeps its established user-registry writer, but its result is normalized into the same
     // two-outcome contract before JSON/human rendering. A write without a live ready observation is
     // a refusal with applied=true, never a second success channel.
@@ -711,7 +779,7 @@ async function cmdScout(options, flags, cwd, write) {
     write('Scanning 9 sources (GitHub + npm + HN + MCP Registry + Glama + OSSInsight + Smithery + Semantic Scholar + arXiv)...\n');
     try {
         const scanTopics = topicsArg ? topicsArg.split(',').map((t) => t.trim()) : undefined;
-        const { results: repos, totalBySource } = await scanAllSources({
+        const { results: repos, totalBySource, statusBySource } = await scanAllSources({
             token,
             topics: scanTopics,
             since,
@@ -723,10 +791,17 @@ async function cmdScout(options, flags, cwd, write) {
             .map(([src, count]) => `${src}: ${count}`)
             .join(', ');
         write(`Sources: ${sourceLines}`);
-        // Memory: diff with previous scan
+        // Memory: diff with previous scan.
+        //
+        // СОСТОЯНИЕ ИСТОЧНИКОВ ПЕРЕДАЁТСЯ ОБЯЗАТЕЛЬНО. Без него разность не выводит исчезновений
+        // вообще — и это правильно: источник, ответивший кодом ошибки, раньше делал ВСЕ свои записи
+        // «пропавшими» на экране, то есть отчёт печатал факт о нашей сети как факт о мире.
         if (showDiff || memory.size > 0) {
-            const diff = memory.diff(repos);
-            if (diff.newRepos.length > 0 || diff.goneRepos.length > 0 || diff.changedScore.length > 0) {
+            const health = {};
+            for (const [source, status] of Object.entries(statusBySource))
+                health[source] = status.health;
+            const diff = memory.diff(repos, health);
+            if (diff.newRepos.length > 0 || diff.goneRepos.length > 0 || diff.changedScore.length > 0 || diff.goneOmittedReason !== undefined) {
                 write(memory.diffMarkdown(diff));
             }
             else if (memory.size > 0) {
@@ -1553,6 +1628,47 @@ function cmdBundle(options, flags, cwd, write) {
     }
     return 0;
 }
+/**
+ * Команда npm для установки пакета В ЦЕЛЕВОЙ КАТАЛОГ, а не куда решит npm.
+ *
+ * ЗАЧЕМ `--prefix`. Без него npm при отсутствии `package.json` в текущем каталоге поднимается по
+ * дереву до первого найденного и мутирует ЕГО — а `dz` потом ищет пакет в
+ * `<цель>/node_modules` и не находит. Место установки и место проверки были двумя независимыми
+ * предположениями, и совпадали они только по удаче.
+ *
+ * ИЗМЕРЕНО 2026-09-03 (полевой случай владельца): установка в каталог без `package.json`
+ * записала в `/home`, где лежит ЧУЖОЙ проект; ручной откат вернул `package.json`, а запись
+ * `extraneous` в `/home/package-lock.json` пережила откат.
+ *
+ * ПОЧЕМУ НЕ ОТКАЗ (ADR-001, вариант A отвергнут). Отказ запретил бы законный сценарий: проект
+ * внутри монорепо, намеренно не имеющий своего `package.json` и опирающийся на родительский
+ * воркспейс. `--prefix` согласует установку с проверкой ПО ПОСТРОЕНИЮ и сценарий сохраняет.
+ *
+ * ЧИСТАЯ: ни файловой системы, ни запуска npm — проверяется без обоих. Путь экранируется, потому
+ * что каталоги с пробелом в имени встречаются в наших же тестах.
+ */
+export function buildInstallArgs(npmSpec, projectRoot) {
+    return ['install', npmSpec, '--prefix', projectRoot, '--save-dev', '--no-fund', '--no-audit'];
+}
+/**
+ * Та же команда СТРОКОЙ — только для показа человеку и для тестового шва.
+ *
+ * НЕ ДЛЯ ИСПОЛНЕНИЯ, и это не стилистическая оговорка. `JSON.stringify` НЕ является экранированием
+ * для оболочки: внутри двойных кавычек оболочка по-прежнему выполняет `$(...)` и обратные кавычки.
+ * ИЗМЕРЕНО 2026-09-03 — `execSync('echo ' + JSON.stringify('pkg$(touch ФАЙЛ)'))` создал файл.
+ * Прежняя редакция этого комментария утверждала «путь экранируется»; это было неверно, и находку
+ * предъявило кросс-семейное ревью (gpt-5.6-sol), а я подтвердил её пробой.
+ *
+ * Боевой путь исполняется через `execFileSync` массивом аргументов — оболочки в цепочке нет вовсе,
+ * поэтому подставлять некуда. Это структурное лечение, а не более хитрое экранирование.
+ */
+export function buildInstallCommand(npmSpec, projectRoot) {
+    // ЗНАЧЕНИЯ в кавычках, ФЛАГИ без — та же форма, что печаталась до этой фичи, чтобы читатель
+    // (и закреплённые тесты) видели знакомую строку. Кавычки здесь — ЧИТАЕМОСТЬ, а не безопасность:
+    // безопасность даёт отсутствие оболочки на боевом пути.
+    return `npm install ${JSON.stringify(npmSpec)} --prefix ${JSON.stringify(projectRoot)}`
+        + ' --save-dev --no-fund --no-audit';
+}
 async function cmdInstall(options, flags, cwd, write, writeErr, installRunner) {
     const pkg = options.get('_positional_0');
     if (!pkg) {
@@ -1611,17 +1727,38 @@ async function cmdInstall(options, flags, cwd, write, writeErr, installRunner) {
     if (targetResolution.via === 'alias')
         writeErr(formatTargetAliasNote('dz install', targetOpt, target));
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
+    // ПРЕДПОСЫЛКА НАЗЫВАЕТСЯ ДО ПОБОЧНОГО ЭФФЕКТА, А НЕ ПОСЛЕ (ADR-001, FR-2).
+    //
+    // Проверка стоит ЗДЕСЬ, до развилки installRunner/execSync, и это не стилистика. Поставить её
+    // внутрь ветки execSync значило бы оставить боевой путь непокрытым при зелёных тестах — ровно
+    // то состояние, из которого фича и родилась.
+    const hasOwnManifest = existsSync(join(projectRoot, 'package.json'));
+    if (!hasOwnManifest) {
+        write(`dz install: ${projectRoot} — не npm-проект (нет своего package.json).`);
+        write(`  Ставлю ЛОКАЛЬНО в него: npm получит --prefix, package.json и node_modules появятся здесь.`);
+        write(`  Без --prefix npm поднялся бы по дереву и записал в ЧУЖОЙ проект выше — измерено 2026-09-03.`);
+    }
     // Step 1: npm install the package (installRunner is the CliIo test seam — unset in production)
     write(`Installing ${specResolution.npmSpec}${specResolution.kind === 'name' ? '' : ` (${specResolution.kind} → node_modules/${specResolution.dirName})`}...`);
-    const installCmd = `npm install ${JSON.stringify(specResolution.npmSpec)} --save-dev --no-fund --no-audit`;
+    const installCmd = buildInstallCommand(specResolution.npmSpec, projectRoot);
     try {
         if (installRunner)
             installRunner(installCmd, projectRoot);
+        // БЕЗ ОБОЛОЧКИ. execFileSync с массивом аргументов не запускает shell, поэтому имя пакета или
+        // путь с `$(...)` подставить нечему. Строка выше — для показа и для тестового шва, не для
+        // исполнения (см. докстринг buildInstallCommand).
         else
-            execSync(installCmd, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf-8' });
+            execFileSync('npm', [...buildInstallArgs(specResolution.npmSpec, projectRoot)], { cwd: projectRoot, stdio: 'pipe', encoding: 'utf-8' });
     }
     catch (err) {
         write(`dz install: npm install failed — ${err instanceof Error ? err.message : String(err)}`);
+        // НЕАТОМАРНЫЙ ОТКАЗ НАЗЫВАЕТСЯ ВСЛУХ (ADR-001, FR-4). Названо кросс-семейной проверкой
+        // 2026-09-03: npm мог успеть изменить package.json, файл замков и node_modules и упасть уже
+        // после этого. Отката у нас нет — и молчать об этом хуже, чем не откатывать: пользователь
+        // считает каталог нетронутым. Полевой случай: ручной откат вернул package.json, а запись
+        // extraneous в файле замков пережила его.
+        write(`  npm мог успеть изменить файлы ДО падения — проверьте ${join(projectRoot, 'package.json')},`);
+        write(`  ${join(projectRoot, 'package-lock.json')} и ${join(projectRoot, 'node_modules')}: отката dz не делает.`);
         return 1;
     }
     // Step 2: Find SKILL.md files in the installed package — under the RESOLVED dir name, never the
@@ -1872,7 +2009,7 @@ function cmdStatuslineInstall(options, cwd, write) {
  * `--kind <feature-adr|loop>` identifies the producer, defaults to `feature-adr`, and rejects any
  * other value rather than silently weakening panel arbitration.
  */
-function cmdStatuslineFaRecord(options, cwd, write) {
+function cmdStatuslineFaRecord(options, cwd, write, writeErr) {
     const slug = (options.get('slug') ?? '').trim();
     const step = (options.get('step') ?? '').trim();
     // `--recalled auto` derives the count from the recall-usage log for `--run <id>`, replacing the
@@ -1932,18 +2069,40 @@ function cmdStatuslineFaRecord(options, cwd, write) {
         write('  Example: dz statusline --fa-record --slug add-user-auth --step "Step 0" --kind feature-adr --recalled 5 --stored 2');
         return 1;
     }
+    // fa-phase-statusline (acid A1): --tier drives done/total on the phase line — an invalid tier is
+    // REJECTED before anything is written (nothing slotted, nothing ledgered), never silently dropped.
+    const tierRaw = options.get('tier');
+    const tier = tierRaw?.trim();
+    if (tier !== undefined && tier !== 'S' && tier !== 'M' && tier !== 'L' && tier !== 'XL') {
+        write(`dz statusline --fa-record: --tier must be S, M, L or XL (got "${tierRaw}")`);
+        write('  Example: dz statusline --fa-record --slug add-user-auth --step "Step 7 Code" --tier M');
+        return 1;
+    }
     const mode = options.get('mode');
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
-    const state = writeFeatureAdrState(projectRoot, {
+    const outcome = writeFeatureAdrStateDetailed(projectRoot, {
         kind: kindRaw, slug, step, recalled, stored,
         ...(reinforced > 0 ? { reinforced } : {}),
         ...(mode !== undefined && mode.trim() !== '' ? { mode: mode.trim() } : {}),
+        ...(tier !== undefined ? { tier } : {}),
     });
+    const state = outcome.state;
     if (state === undefined) {
+        // [AM-5] A REFUSED slot write is LOUD. A held `fa-phase-slot` lock or an unwritable `.dz` used
+        // to return a bare `undefined`, and a caller reading silence as success is exactly the
+        // "absence of a receipt is not success" class. The reason goes to stderr — diagnosis, not
+        // data — and the EXIT CODE is unchanged for a refusal, because the panel must never break the
+        // pipeline that is only reporting to it.
+        if (outcome.refused !== undefined) {
+            writeErr(`fa-record: slot write refused (${slug}): ${outcome.refused}`);
+            return 0;
+        }
         write(`dz statusline --fa-record: could not write learning state under ${projectRoot}/.dz/feature-adr/`);
         return 1;
     }
-    write(`dz statusline: recorded /feature-adr learning state for "${slug}" (${step}) — 🎓 ${state.pool} pool · ↑${state.recalled} used · +${state.stored} new · ↻${state.reinforced ?? 0} reinforced`);
+    // state.step, not the flag: the monotonic guard may have kept a LATER step against a stale
+    // duplicate record (fa-phase-statusline P1) — print what actually stands in the slot.
+    write(`dz statusline: recorded /feature-adr learning state for "${slug}" (${state.step}) — 🎓 ${state.pool} pool · ↑${state.recalled} used · +${state.stored} new · ↻${state.reinforced ?? 0} reinforced`);
     return 0;
 }
 function statuslineEtaStage(step) {
@@ -2098,16 +2257,21 @@ function statuslineEta(projectRoot, state, nowMs) {
  * least a minimal `dz` even on total failure.
  *
  * Flags: `--install` wires it into settings.json; `--fa-record` records a live `/feature-adr`
- * learning state (WRITES — see {@link cmdStatuslineFaRecord}); `--json` prints the raw data object;
- * default prints the status line (with a 📐 pipeline segment prepended when a fresh run is in flight).
+ * learning state (WRITES — see {@link cmdStatuslineFaRecord}); `--json` prints the raw data object
+ * (plus `featureAdrLine`, the rendered phase line, when a fresh /feature-adr run is in flight);
+ * default prints the status line, with the 📐 phase panel as its OWN SECOND LINE (format B —
+ * fa-phase-statusline ADR-001 D1; Claude Code renders every stdout line of a statusline command).
+ * The ETA fragment main shipped for that panel rides the SECOND line with it (fa-phase-statusline ADR-001 D1) — the panel
+ * moved, the estimate was not dropped.
  */
-function cmdStatusline(options, flags, cwd, write, readStdin) {
+function cmdStatusline(options, flags, cwd, write, readStdin, writeErr) {
     if (flags.has('install'))
         return cmdStatuslineInstall(options, cwd, write);
     if (flags.has('fa-record'))
-        return cmdStatuslineFaRecord(options, cwd, write);
+        return cmdStatuslineFaRecord(options, cwd, write, writeErr);
     try {
         const projectRoot = statuslineProjectRoot(readStdin(), options, cwd);
+        warnLearningStoreRead(projectRoot, writeErr, 'dz statusline');
         const data = statuslineData(projectRoot);
         const fa = data.featureAdr;
         let eta;
@@ -2124,27 +2288,56 @@ function cmdStatusline(options, flags, cwd, write, readStdin) {
                 etaFragment = undefined;
             }
         }
+        // fa-phase-statusline (ADR-001 D1): the phase line renders from the slot ALONE — a pure
+        // function over data.featureAdr, computed once here for both the plain and --json surfaces.
+        const phaseLine = fa !== undefined ? renderFeatureAdrPhaseLine(fa) : undefined;
         if (flags.has('json')) {
-            write(JSON.stringify({ ...data, ...(eta !== undefined ? { eta } : {}) }));
+            write(JSON.stringify({
+                ...data,
+                ...(eta !== undefined ? { eta } : {}),
+                ...(phaseLine !== undefined ? { featureAdrLine: phaseLine } : {}),
+            }));
             return 0;
         }
-        let line = `🎓 dz: ${data.patterns} patterns${data.usedPatterns !== undefined ? ` · ${data.usedPatterns} used` : ''} · 🧠 ${data.brainSources} sources`;
+        const breakdown = data.patternBreakdown;
+        let line = breakdown === undefined
+            ? `🎓 dz: ${data.patterns} patterns`
+            : `🎓 dz: ${data.patterns} (${breakdown.active} актив${breakdown.quarantined > 0
+                ? ` · ${breakdown.quarantined} карантин${breakdown.attention ? ' ⚠' : ''}`
+                : ''})${breakdown.tierDelta !== undefined ? ` ⚠ тиры Δ${breakdown.tierDelta}` : ''}`;
+        if (data.storeHealth?.verdict === 'collapsed') {
+            line += ` ⛔ ОБВАЛ: было ${data.storeHealth.previousMax ?? '?'} · dz store-guard --reset`;
+        }
+        else if (data.storeHealth?.verdict === 'cold-start-over-existing') {
+            line += ` ⛔ СТОР ПУСТ: было ${data.storeHealth.previousMax ?? '?'} · восстановить из снимков ${data.storeHealth.snapshotPath ?? ''}`.trimEnd();
+        }
+        else if (data.storeHealth?.verdict === 'unreadable') {
+            line += ` ⛔ СТОР НЕЧИТАЕМ${data.storeHealth.unreadableFiles !== undefined && data.storeHealth.unreadableFiles.length > 0
+                ? `: ${data.storeHealth.unreadableFiles.join(', ')}` : ''}`;
+        }
+        else if (data.storeHealth?.verdict === 'source-changed') {
+            line += ' ⚠ смена источника хранения';
+        }
+        line += `${data.usedPatterns !== undefined ? ` · ${data.usedPatterns} used` : ''} · 🧠 ${data.brainSources} sources`;
         const branch = statuslineGitBranch(projectRoot);
         if (branch !== undefined)
             line += ` · ⎇ ${branch}`;
         if (data.consolidatedAgeH !== undefined)
             line += ` · ⟳ ${data.consolidatedAgeH}h`;
-        // Live /feature-adr run in flight → PREPEND the pipeline learning segment to the base dz line.
-        if (fa !== undefined) {
-            // The producer marker reached data and arbitration in a previous round but not this label, so the bar asserted a pipeline that was not running.
-            if (fa.kind === 'loop') {
-                line = `🔁 loop ${fa.step} · ${line}`;
-            }
-            else {
-                line = `📐 feature-adr ${fa.step} · ${etaFragment !== undefined ? `${etaFragment} · ` : ''}🎓 ${fa.pool} pool · ↑${fa.recalled} used · +${fa.stored} new · ↻${fa.reinforced ?? 0} reinforced · ${line}`;
-            }
+        // Live loop run in flight → PREPEND its segment to the base dz line (unchanged). A live
+        // /feature-adr run no longer glues into line 1: its 📐 segment IS the second line (format B) —
+        // Claude Code renders every stdout line of a statusline command (fa-phase-statusline ADR-001 D1).
+        if (fa !== undefined && fa.kind === 'loop') {
+            line = `🔁 loop ${fa.step} · ${line}`;
         }
         write(line);
+        // fa-phase-statusline ADR-001 D1: the phase panel moved to line 2 and TOOK main's ETA fragment with it. The move is
+        // the point of format B (ADR-001 D1); dropping the estimate would have been a silent
+        // regression of a feature `main` shipped while this branch was stranded, so it rides here
+        // instead. A phase line that renders (fresh, non-terminal, non-loop slot) is the only gate.
+        if (phaseLine !== undefined) {
+            write(`${phaseLine}${etaFragment !== undefined ? ` · ${etaFragment}` : ''}`);
+        }
         return 0;
     }
     catch {
@@ -2728,6 +2921,259 @@ function learningStoreLine(storeRoot, projectOption, target, verb) {
     const reason = teachReasonPhrase(target.reason);
     return storeLocationLine(describeStoreLocation(storeRoot, projectOption, target.store === 'global' ? 'global' : undefined), verb) + (reason ? '  [' + reason + ']' : '');
 }
+function inspectLearningStore(projectRoot) {
+    const mark = readStoreMark(projectRoot);
+    const rows = countLearningStoreRowsReadonly(projectRoot);
+    return { mark, rows, health: checkStoreHealth({ projectRoot, ...rows, mark }) };
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function storeGuardResetCommand(projectRoot) {
+    return `dz store-guard --reset --project ${shellQuote(projectRoot)}`;
+}
+function lexicalSourceLines(rows) {
+    return [
+        `  lexical selected: ${rows.lexicalSourcePath} (${rows.lexicalSource}, ${rows.lexicalRows} rows)`,
+        ...(rows.lexicalIgnoredSourcePath === undefined ? [] : [
+            `  lexical ignored: ${rows.lexicalIgnoredSourcePath} (${rows.lexicalIgnoredRows} rows)`,
+        ]),
+    ];
+}
+function storeGuardRecoveryLines(projectRoot, mark, health, rows) {
+    const snapshots = storeSnapshotPath(projectRoot);
+    const markPath = storeGuardPath(projectRoot);
+    let lexicalSnapshot;
+    let vectorSnapshot = false;
+    try {
+        const names = existsSync(snapshots) ? readdirSync(snapshots) : [];
+        const hasSqlite = names.some((name) => /^lexical\..+\.sqlite$/.test(name));
+        const hasJsonl = names.some((name) => /^lexical\..+\.jsonl$/.test(name));
+        const preferred = mark?.lexicalSource === 'sqlite' || mark?.lexicalSource === 'jsonl'
+            ? mark.lexicalSource
+            : rows?.lexicalSource;
+        if (preferred === 'jsonl' && hasJsonl)
+            lexicalSnapshot = 'jsonl';
+        else if (preferred === 'sqlite' && hasSqlite)
+            lexicalSnapshot = 'sqlite';
+        else if (hasSqlite)
+            lexicalSnapshot = 'sqlite';
+        else if (hasJsonl)
+            lexicalSnapshot = 'jsonl';
+        vectorSnapshot = names.some((name) => /^vector\..+\.sqlite$/.test(name));
+    }
+    catch {
+        lexicalSnapshot = undefined;
+        vectorSnapshot = false;
+    }
+    const lines = [
+        `dz store guard: REFUSED — ${health.reason}`,
+        `  mark: ${markPath}`,
+        ...(mark === undefined ? [] : [`  recorded rows: lexical=${mark.lexicalMax} (${mark.lexicalSource}), vector=${mark.vectorMax}`]),
+        ...(rows === undefined ? [] : lexicalSourceLines(rows)),
+    ];
+    if (lexicalSnapshot !== undefined && vectorSnapshot) {
+        const lexicalDestination = lexicalSnapshot === 'sqlite'
+            ? join(projectRoot, '.dz', 'memory', 'patterns.sqlite')
+            : join(projectRoot, '.dz', 'patterns.jsonl');
+        lines.push(`  snapshots: ${snapshots}/`, `  restore: mkdir -p ${shellQuote(dirname(lexicalDestination))} && cp ${shellQuote(join(snapshots, `lexical.<timestamp>.${lexicalSnapshot}`))} ${shellQuote(lexicalDestination)} && cp ${shellQuote(join(snapshots, 'vector.<timestamp>.sqlite'))} ${shellQuote(join(projectRoot, '.dz', 'agentdb.db'))}`);
+    }
+    else {
+        lines.push(`  snapshots: none found in ${snapshots}/`, `  create one manually: scripts/dz-store-snapshot.sh --project ${shellQuote(projectRoot)}`);
+    }
+    lines.push(`  accept current counts: ${storeGuardResetCommand(projectRoot)}`, '  continue intentionally: set DZ_ALLOW_COLD_START=1 or pass --allow-cold-start');
+    return lines;
+}
+function observedRows(rows) {
+    return typeof rows.lexicalRows === 'number' && typeof rows.vectorRows === 'number'
+        ? { lexicalRows: rows.lexicalRows, vectorRows: rows.vectorRows, lexicalSource: rows.lexicalSource }
+        : undefined;
+}
+/** Mark maintenance is diagnostic: the store operation already completed and must keep its exit code. */
+function refreshLearningStoreMark(projectRoot, writeErr, command, options = {}) {
+    try {
+        const rows = countLearningStoreRowsReadonly(projectRoot);
+        const counts = observedRows(rows);
+        if (counts === undefined) {
+            writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark was not updated — a store tier is unreadable`);
+            return;
+        }
+        writeStoreMark(projectRoot, {
+            ...counts,
+            observedAt: new Date().toISOString(),
+            command,
+        }, options.reader ? { timeoutMs: 0 } : {});
+    }
+    catch (error) {
+        if (options.reader && error instanceof NamedLockTimeoutError)
+            return;
+        writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark could not be updated — ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function storeGuardResetReminder(projectRoot, writeErr, command) {
+    try {
+        const rows = countLearningStoreRowsReadonly(projectRoot);
+        const mark = readStoreMark(projectRoot);
+        writeErr(`⚠ DZ STORE GUARD — ${command}: store now lexical=${rows.lexicalRows}, vector=${rows.vectorRows}; maximum remains lexical=${mark?.lexicalMax ?? 'none'}, vector=${mark?.vectorMax ?? 'none'}; reconcile explicitly: ${storeGuardResetCommand(projectRoot)}`);
+        for (const line of lexicalSourceLines(rows))
+            writeErr(line);
+    }
+    catch (error) {
+        writeErr(`⚠ DZ STORE GUARD — ${command}: store changed; inspect it and reconcile explicitly with ${storeGuardResetCommand(projectRoot)} (${error instanceof Error ? error.message : String(error)})`);
+    }
+}
+/** Fail closed for store writers, except for an explicit per-process/per-command override. */
+function allowLearningStoreWrite(projectRoot, flags, writeErr, command) {
+    let inspection;
+    try {
+        inspection = inspectLearningStore(projectRoot);
+    }
+    catch (error) {
+        const health = {
+            verdict: 'unreadable',
+            reason: `cannot read the external mark (${error instanceof Error ? error.message : String(error)})`,
+        };
+        for (const line of storeGuardRecoveryLines(projectRoot, undefined, health))
+            writeErr(line);
+        return false;
+    }
+    if (inspection.health.verdict === 'no-mark' || inspection.health.verdict === 'ok') {
+        // The successful write path records the resulting counts. Refreshing here as
+        // well would emit the same telemetry failure twice when the external mark is
+        // unavailable, and would receipt a source transition before the command's
+        // own row had landed.
+        return true;
+    }
+    if (inspection.health.verdict === 'source-changed') {
+        const counts = observedRows(inspection.rows);
+        if (counts === undefined)
+            return false;
+        writeErr(`⚠ DZ STORE GUARD WARNING — SOURCE CHANGED: ${inspection.health.reason}; ${storeGuardResetCommand(projectRoot)}`);
+        for (const line of lexicalSourceLines(inspection.rows))
+            writeErr(line);
+        try {
+            // Consume the single migration allowance BEFORE the store write. If the
+            // following command fails, the safe result is a consumed allowance that
+            // requires an explicit reset, never a silently reusable permission.
+            writeStoreMark(projectRoot, { ...counts, observedAt: new Date().toISOString(), command }, {
+                expectedPreviousLexicalSource: inspection.mark?.lexicalSource ?? 'unknown',
+            });
+            return true;
+        }
+        catch (error) {
+            writeErr(`dz store guard: REFUSED — source-change allowance could not be recorded: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    }
+    const allowed = process.env.DZ_ALLOW_COLD_START === '1' || flags.has('allow-cold-start');
+    if (allowed) {
+        const label = inspection.health.verdict.replaceAll('-', ' ').toUpperCase();
+        writeErr(`⚠ DZ STORE GUARD WARNING — ${label}: ${inspection.health.reason}; explicit cold-start override accepted`);
+        return true;
+    }
+    for (const line of storeGuardRecoveryLines(projectRoot, inspection.mark, inspection.health, inspection.rows))
+        writeErr(line);
+    return false;
+}
+/** Readers warn on damage and bootstrap/refresh a healthy non-empty store mark. */
+function warnLearningStoreRead(projectRoot, writeErr, command) {
+    try {
+        const { health, rows, mark } = inspectLearningStore(projectRoot);
+        if (health.verdict === 'collapsed' || health.verdict === 'cold-start-over-existing' || health.verdict === 'unreadable'
+            || health.verdict === 'source-changed') {
+            writeErr(`⚠ DZ STORE GUARD WARNING — ${health.verdict.replaceAll('-', ' ').toUpperCase()}: ${health.reason}`);
+            for (const line of lexicalSourceLines(rows))
+                writeErr(line);
+            return;
+        }
+        const counts = observedRows(rows);
+        if (counts !== undefined && counts.lexicalRows + counts.vectorRows > 0
+            && (mark === undefined || mark.lexicalLast !== counts.lexicalRows || mark.vectorLast !== counts.vectorRows
+                || mark.lexicalSource !== counts.lexicalSource
+                || mark.lexicalMax < counts.lexicalRows || mark.vectorMax < counts.vectorRows)) {
+            refreshLearningStoreMark(projectRoot, writeErr, command, { reader: true });
+        }
+    }
+    catch (error) {
+        writeErr(`⚠ DZ STORE GUARD WARNING — external mark unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function cmdStoreGuard(options, flags, cwd, write, writeErr, stdinText, interactive) {
+    const projectRoot = resolve(cwd, options.get('project') ?? '.');
+    const path = storeGuardPath(projectRoot);
+    const reset = flags.has('reset');
+    const status = flags.has('status') || options.has('status');
+    if (reset && status) {
+        writeErr('dz store-guard: --status and --reset are mutually exclusive');
+        return 2;
+    }
+    if (reset) {
+        const rows = countLearningStoreRowsReadonly(projectRoot);
+        const counts = observedRows(rows);
+        if (counts === undefined) {
+            writeErr(`dz store-guard: REFUSED — cannot reset from an unreadable store; mark: ${path}`);
+            return 1;
+        }
+        try {
+            const previous = readStoreMark(projectRoot);
+            const beforeLexical = previous?.lexicalMax ?? counts.lexicalRows;
+            const beforeVector = previous?.vectorMax ?? counts.vectorRows;
+            writeErr('⚠ dz store-guard --reset: manual operator decision required; this lowers the recorded high-water evidence');
+            writeErr(`  old maximum: lexical=${beforeLexical}, vector=${beforeVector}`);
+            writeErr(`  new observed: lexical=${counts.lexicalRows} (${counts.lexicalSource}), vector=${counts.vectorRows}`);
+            for (const line of lexicalSourceLines(rows))
+                writeErr(line);
+            let answer = stdinText?.trim().split(/\r?\n/, 1)[0]?.trim().toLowerCase() ?? '';
+            if (!flags.has('yes') && answer === '' && interactive && process.stdin.isTTY) {
+                const { createInterface } = await import('node:readline/promises');
+                const rl = createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    answer = (await rl.question('  type yes to continue: ')).trim().toLowerCase();
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            if (!flags.has('yes') && !['y', 'yes', 'да'].includes(answer)) {
+                writeErr(`dz store-guard: REFUSED — reset was not confirmed; re-run with --yes or answer yes`);
+                return 1;
+            }
+            const current = countLearningStoreRowsReadonly(projectRoot);
+            const currentCounts = observedRows(current);
+            if (currentCounts === undefined || !isDeepStrictEqual(currentCounts, counts)) {
+                writeErr('dz store-guard: REFUSED — store counts changed after confirmation; inspect and confirm again');
+                return 1;
+            }
+            const mark = resetStoreMark(projectRoot, {
+                ...counts,
+                observedAt: new Date().toISOString(),
+                command: 'dz store-guard --reset',
+            });
+            write(`dz store-guard: RESET — accepted lexical=${mark.lexicalMax}, vector=${mark.vectorMax}`);
+            write(`  mark: ${path}`);
+            write(`  receipt: ${mark.resetAt?.at} — ${mark.resetAt?.reason}`);
+            return 0;
+        }
+        catch (error) {
+            writeErr(`dz store-guard: reset failed — ${error instanceof Error ? error.message : String(error)}; mark: ${path}`);
+            return 1;
+        }
+    }
+    try {
+        const inspection = inspectLearningStore(projectRoot);
+        write(`dz store-guard: ${inspection.health.verdict.toUpperCase()} — ${inspection.health.reason}`);
+        write(`  mark: ${path}`);
+        write(`  current rows: lexical=${inspection.rows.lexicalRows}, vector=${inspection.rows.vectorRows}`);
+        for (const line of lexicalSourceLines(inspection.rows))
+            write(line);
+        write(`  recorded: ${inspection.mark === undefined ? 'none' : JSON.stringify(inspection.mark)}`);
+        return 0;
+    }
+    catch (error) {
+        writeErr(`dz store-guard: mark unreadable — ${error instanceof Error ? error.message : String(error)}; mark: ${path}`);
+        return 1;
+    }
+}
 async function runTeachGuardReinforcement(projectRoot, dzId, reward) {
     const backend = resolveLearningBackend(projectRoot);
     backend.addSample({ dzId, kind: 'reinforce', reward, ts: new Date().toISOString() });
@@ -2755,6 +3201,13 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
     // repo's own store holds 361 records written under that behaviour, and every other user's store
     // is the same. Only an explicit choice moves it.
     const { storeRoot, target: teachTarget } = resolved;
+    const teachWillWrite = flags.has('harmonize')
+        ? false
+        : options.has('from-json')
+            || (options.get('reinforce') ?? '').trim() !== ''
+            || (options.get('_positional_0') ?? '').trim() !== '';
+    if (teachWillWrite && !allowLearningStoreWrite(storeRoot, flags, writeErr, 'dz teach'))
+        return 1;
     // The verb is per OUTCOME, not per command: a harmonize dry-run and a failed --reinforce READ
     // the store and change nothing, so saying "written" there is a false claim about what happened
     // (cross-family QE round 2, 2026-08-27).
@@ -2793,10 +3246,11 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
         // worse defect than the invisibility it was closing (measured live, cross-family QE round 2).
         if (!flags.has('json'))
             write(storeLine(flags.has('apply') ? 'written' : 'read'));
-        return runHarmonize(storeRoot, options, flags, write, {
+        const code = await runHarmonize(storeRoot, options, flags, write, writeErr, {
             store: join(storeRoot, '.dz'),
             storeChosenBy: teachTarget.reason,
         });
+        return code;
     }
     // Bulk import: `dz teach --from-json <file>` ingests a `dz recall --all --json`
     // export (an array of learned patterns) — the portable way to SHARE a learned
@@ -2894,6 +3348,8 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
             const report = await harmonizeVectorStore(storeRoot, {});
             write(`  ℹ ${imported} imported — ${report.clusters.length} near-duplicate cluster(s): review with dz vector harmonize (dry-run); merge with dz vector harmonize --apply after backup`);
         }
+        if (imported > 0)
+            refreshLearningStoreMark(storeRoot, writeErr, 'dz teach --from-json');
         return 0;
     }
     const reinforce = options.get('reinforce');
@@ -2914,6 +3370,7 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
             if (clearedQ.cleared > 0)
                 write(`  ↳ promoted out of quarantine (mirror updated)`);
             write(storeLine('written'));
+            refreshLearningStoreMark(storeRoot, writeErr, 'dz teach --reinforce');
             return 0;
         }
         // HIGH-fix: a no-match must NOT auto-teach the raw argument — callers pass dzIds or truncated
@@ -2961,6 +3418,7 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
                     const clearedQ = clearAgentdbQuarantine(storeRoot, [verdict.dzId]);
                     if (clearedQ.cleared > 0)
                         write('  ↳ promoted out of quarantine (mirror updated)');
+                    refreshLearningStoreMark(storeRoot, writeErr, 'dz teach --guard');
                     return 0;
                 }
                 write(`dz teach --guard: reinforce of ${verdict.dzId} did not flush (backend off or write failure) — teaching the lesson normally instead`);
@@ -3077,9 +3535,13 @@ async function cmdTeach(options, flags, cwd, write, writeErr = (line) => { conso
     }
     // The lexical write above is durable — the vector mirror is strictly best-effort (I-3).
     await emitMirrorQ(storeRoot, recordsToMirror, 'dz-teach', quarantineOn);
+    if (stored.records.length > 0) {
+        write(`  ID: ${stored.records.map((record) => patternRecordId(record)).join(', ')}`);
+        refreshLearningStoreMark(storeRoot, writeErr, 'dz teach');
+    }
     return commandFailed ? 1 : 0;
 }
-async function cmdConsolidate(options, flags, cwd, write) {
+async function cmdConsolidate(options, flags, cwd, write, writeErr) {
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
     const sessionsDirOpt = options.get('sessions-dir');
     const pruneNoise = flags.has('prune-noise');
@@ -3103,6 +3565,8 @@ async function cmdConsolidate(options, flags, cwd, write) {
         write(`dz consolidate --prune-quarantine: removed ${res.removed} expired quarantined lesson(s)`);
         if (res.snapshot !== undefined)
             write(`  snapshot: ${res.snapshot}`);
+        refreshLearningStoreMark(projectRoot, writeErr, 'dz consolidate --prune-quarantine --apply');
+        storeGuardResetReminder(projectRoot, writeErr, 'dz consolidate --prune-quarantine --apply');
         return 0;
     }
     // --prune-noise: RETRO-PRUNE legacy noise (tool telemetry + system-wrapper "responses") from
@@ -3212,6 +3676,10 @@ async function cmdConsolidate(options, flags, cwd, write) {
         }
     }
     catch { /* best-effort — the ranking is advisory, never fails the consolidate */ }
+    refreshLearningStoreMark(projectRoot, writeErr, 'dz consolidate');
+    if (pruneNoise && applyPrune) {
+        storeGuardResetReminder(projectRoot, writeErr, 'dz consolidate --prune-noise --apply');
+    }
     return 0;
 }
 function recallUsagePatternRefs(projectRoot) {
@@ -3322,7 +3790,7 @@ function cmdRecallUsage(options, flags, projectRoot, write) {
  * DRY-RUN BY DEFAULT, and it snapshots before deleting: `.dz/` is git-ignored and unversioned, so a
  * mistaken id is unrecoverable. Use `dz recall --all --json` to find ids.
  */
-async function cmdRecallForget(options, flags, projectRoot, write) {
+async function cmdRecallForget(options, flags, projectRoot, write, writeErr) {
     const raw = options.get('forget') ?? '';
     const ids = new Set(raw.split(',').map((s) => s.trim()).filter((s) => s !== ''));
     if (ids.size === 0) {
@@ -3348,7 +3816,7 @@ async function cmdRecallForget(options, flags, projectRoot, write) {
         write(`dz recall --forget: DRY RUN — ${found.length} record(s) would be removed. Re-run with --apply.`);
         return 0;
     }
-    const dest = join(projectRoot, '.dz', `patterns-pre-forget-${Date.now()}.json`);
+    const dest = join(storeSnapshotPath(projectRoot), `forget-${Date.now()}.json`);
     const snap = snapshotStore(projectRoot, dest);
     if (snap.error !== undefined) {
         write(`dz recall --forget: snapshot failed (${snap.error}) — nothing removed; the store is not versioned`);
@@ -3360,6 +3828,8 @@ async function cmdRecallForget(options, flags, projectRoot, write) {
     if (result.error !== undefined)
         write(`  ⚠ ${result.error}`);
     write('  the vector mirror still holds them — run `dz vector reindex` to resync');
+    refreshLearningStoreMark(projectRoot, writeErr, 'dz recall --forget --apply');
+    storeGuardResetReminder(projectRoot, writeErr, 'dz recall --forget --apply');
     return 0;
 }
 /**
@@ -3439,12 +3909,17 @@ async function cmdRecallPromote(options, flags, projectRoot, write) {
 }
 async function cmdRecall(options, flags, cwd, write, writeErr, classMatcher) {
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
+    warnLearningStoreRead(projectRoot, writeErr, 'dz recall');
+    const globalRootForGuard = globalStoreRoot();
+    if (!sameStore(projectRoot, globalRootForGuard) && existsSync(join(globalRootForGuard, '.dz', 'memory'))) {
+        warnLearningStoreRead(globalRootForGuard, writeErr, 'dz recall');
+    }
     const asJson = flags.has('json');
     const all = flags.has('all');
     if (flags.has('usage'))
         return cmdRecallUsage(options, flags, projectRoot, write);
     if (options.has('forget'))
-        return cmdRecallForget(options, flags, projectRoot, write);
+        return cmdRecallForget(options, flags, projectRoot, write, writeErr);
     if (options.has('promote'))
         return cmdRecallPromote(options, flags, projectRoot, write);
     // --all: dump the entire learned store (backend-agnostic, via loadStorePatternsSync).
@@ -4009,7 +4484,7 @@ function renderHarmonize(report, write) {
  * and `dz teach --harmonize` — ONE implementation, no bespoke second path (QR-6). Guards (AC-6):
  * `--apply` + `--dry-run` together is rejected; `--threshold` must be in `(0, 1]`; no flag ⇒ dry-run.
  */
-async function runHarmonize(projectRoot, options, flags, write, 
+async function runHarmonize(projectRoot, options, flags, write, writeErr, 
 /**
  * Where this harmonize is pointed and what chose it. Under `--json` the human store line is
  * suppressed to keep stdout ONE document, so the destination has to travel INSIDE that document
@@ -4032,6 +4507,10 @@ storeAnnotation) {
         }
     }
     const report = await harmonizeVectorStore(projectRoot, { apply, ...(threshold !== undefined ? { threshold } : {}) });
+    if (apply && report.error === undefined) {
+        refreshLearningStoreMark(projectRoot, writeErr, 'dz vector harmonize --apply');
+        storeGuardResetReminder(projectRoot, writeErr, 'dz vector harmonize --apply');
+    }
     if (flags.has('json')) {
         write(JSON.stringify(storeAnnotation !== undefined ? { ...report, ...storeAnnotation } : report));
         return report.error !== undefined ? 1 : 0;
@@ -4039,7 +4518,7 @@ storeAnnotation) {
     renderHarmonize(report, write);
     return report.error !== undefined ? 1 : 0;
 }
-async function cmdVector(options, flags, cwd, write) {
+async function cmdVector(options, flags, cwd, write, writeErr) {
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
     const sub = options.get('_positional_0');
     if (sub === 'status') {
@@ -4093,6 +4572,10 @@ async function cmdVector(options, flags, cwd, write) {
     if (sub === 'reindex') {
         const report = await reindexVectorStore(projectRoot);
         if (flags.has('json')) {
+            if (report.error === undefined) {
+                refreshLearningStoreMark(projectRoot, writeErr, 'dz vector reindex');
+                storeGuardResetReminder(projectRoot, writeErr, 'dz vector reindex');
+            }
             write(JSON.stringify(report));
             return report.error !== undefined ? 1 : 0;
         }
@@ -4112,6 +4595,8 @@ async function cmdVector(options, flags, cwd, write) {
             if (report.staleTaskTypes.includes('book-knowledge'))
                 write('    run \`dz brain reindex\` to rebuild the brain\'s book vectors');
         }
+        refreshLearningStoreMark(projectRoot, writeErr, 'dz vector reindex');
+        storeGuardResetReminder(projectRoot, writeErr, 'dz vector reindex');
         return 0;
     }
     if (sub === 'export') {
@@ -4163,7 +4648,7 @@ async function cmdVector(options, flags, cwd, write) {
     // harmonize (alias: dz teach --harmonize) — SEMANTIC dedup of the learned store, NON-DESTRUCTIVE:
     // dry-run by default (previews clusters, writes nothing); --apply drops after a restorable backup.
     if (sub === 'harmonize') {
-        return runHarmonize(projectRoot, options, flags, write);
+        return runHarmonize(projectRoot, options, flags, write, writeErr);
     }
     // import <file.rvf> — the missing HALF of the RVF cycle: UPSERT-BY-dzId, never overwrites.
     if (sub === 'import') {
@@ -4174,6 +4659,8 @@ async function cmdVector(options, flags, cwd, write) {
         }
         const report = await importRvfCheckpoint(projectRoot, resolve(cwd, src), {});
         if (flags.has('json')) {
+            if (report.error === undefined)
+                refreshLearningStoreMark(projectRoot, writeErr, 'dz vector import');
             write(JSON.stringify(report));
             return report.error !== undefined ? 1 : 0;
         }
@@ -4186,6 +4673,7 @@ async function cmdVector(options, flags, cwd, write) {
         if (report.skippedOrphans > 0) {
             write('  ↳ orphan vectors have no local pattern — import the text first: dz teach --from-json <recall-export.json>, then re-run dz vector import');
         }
+        refreshLearningStoreMark(projectRoot, writeErr, 'dz vector import');
         return 0;
     }
     write('dz vector — semantic (vector) tier of the learned-pattern store');
@@ -4860,6 +5348,28 @@ async function cmdSetup(options, flags, cwd, write, writeErr) {
         writeErr(formatTargetAliasNote('dz setup', targetOpt, target));
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
     const presetName = options.get('preset');
+    // PREFLIGHT BEFORE THE FIRST WRITE (backlog 9d15b9b6, PR-A). Step 3 configures the learning
+    // environment and step 4 installs skills, so refusing at step 4 would leave a project that has
+    // memory and hooks but not the skills the operator asked for — a half-configured state worse than
+    // either clean outcome. The request is therefore resolved HERE, before the banner's first step.
+    //
+    // Only an EXPLICIT --select is refused. A preset names skills the package itself ships, so a gap
+    // there is our packaging defect, not the operator's typo, and it is reported by the existing
+    // missing-list rather than by refusing the whole run.
+    const setupSelectRaw = options.get('select');
+    if (setupSelectRaw !== undefined) {
+        const requested = setupSelectRaw.split(',').map((x) => x.trim()).filter((x) => x.length > 0);
+        const roots = discoverSkillsDirs(cwd, options.get('skills-dir')).map((dir) => ({ dir, ids: discoverSkillIds(dir) }));
+        const resolution = resolveSelection(requested, roots);
+        for (const shadow of resolution.shadowed) {
+            writeErr(`dz: skill '${shadow.id}' is offered by ${shadow.alsoIn.length + 1} roots; installing from ${shadow.chosen} (earlier root wins). Also present in: ${shadow.alsoIn.join(', ')}`);
+        }
+        const refusal = formatSelectRefusal(resolution, roots);
+        if (refusal !== null) {
+            writeErr(refusal);
+            return 1;
+        }
+    }
     write(`\n╔══════════════════════════════════════════════════════╗`);
     write(`║           DZ SETUP — Full Environment                ║`);
     write(`╠══════════════════════════════════════════════════════╣`);
@@ -5001,7 +5511,7 @@ function cmdPretrain(options, cwd, write) {
     write(`╚══════════════════════════════════════════════════════════════╝`);
     return 0;
 }
-function cmdRecommend(options, cwd, write) {
+function cmdRecommend(options, flags, cwd, write) {
     const task = options.get('_positional_0');
     if (!task) {
         write('dz recommend: task description required');
@@ -5010,15 +5520,40 @@ function cmdRecommend(options, cwd, write) {
     }
     const registry = buildRegistry(cwd);
     const report = recommend(task, registry, cwd);
+    if (flags.has('json')) {
+        write(JSON.stringify(report, null, 2));
+        return 0;
+    }
     write(`\n╔══════════════════════════════════════════════════════════════╗`);
     write(`║                 DZ RECOMMEND — Task Advisor                 ║`);
     write(`╠══════════════════════════════════════════════════════════════╣`);
     write(`║  Task: ${report.task.slice(0, 52).padEnd(52)}║`);
-    const topicSuffix = report.pretrainFallback ? ' (via pretrain)' : '';
-    write(`║  Topics: ${(report.topics.join(', ') + topicSuffix).slice(0, 50).padEnd(50)}║`);
+    if (report.topicSource === 'task') {
+        write(`║  Topics: ${report.topics.join(', ').slice(0, 50).padEnd(50)}║`);
+    }
+    else if (report.topicSource === 'project-stack') {
+        write(`║  Topics: ${'not matched in the question'.padEnd(50)}║`);
+    }
+    else {
+        write(`║  Topics: ${'not recognized — no recommendations'.padEnd(50)}║`);
+    }
     write(`╠══════════════════════════════════════════════════════════════╣`);
+    if (report.topicSource === 'project-stack') {
+        write(`⚠ Тема запроса не распознана — подбор ниже сделан по СТЕКУ ПРОЕКТА, не по вашему вопросу.`);
+        write(`  (topic not recognized — recommendations reflect the project stack, not the question)`);
+        write(`PROJECT-STACK SUGGESTIONS`);
+    }
+    else if (report.topicSource === 'none') {
+        write(`Тема запроса не распознана; рекомендаций нет.`);
+        write(`Переформулируйте задачу или используйте dz registry search <слово> / /skill-advisor.`);
+        write(`╚══════════════════════════════════════════════════════════════╝`);
+        return 0;
+    }
+    const stackDerived = report.topicSource === 'project-stack';
     if (report.presets.length > 0) {
-        write(`║  RECOMMENDED PRESETS                                        ║`);
+        write(stackDerived
+            ? `║  PROJECT-STACK PRESETS                                      ║`
+            : `║  RECOMMENDED PRESETS                                        ║`);
         for (const p of report.presets) {
             const matched = p.matchedSkills.length > 0 ? ` (${p.matchedSkills.slice(0, 3).join(', ')})` : '';
             write(`║    ${p.name.padEnd(15)} ${String(p.skills).padStart(2)} skills  coverage: ${String(p.coverage).padStart(2)} topics${matched.padEnd(15)}║`);
@@ -5026,7 +5561,9 @@ function cmdRecommend(options, cwd, write) {
         write(`║${''.padEnd(62)}║`);
     }
     if (report.skills.length > 0) {
-        write(`║  RECOMMENDED SKILLS (top ${Math.min(report.skills.length, 8)})${' '.repeat(35)}║`);
+        write(stackDerived
+            ? `║  PROJECT-STACK SKILLS (top ${Math.min(report.skills.length, 8)})${' '.repeat(35)}║`
+            : `║  RECOMMENDED SKILLS (top ${Math.min(report.skills.length, 8)})${' '.repeat(35)}║`);
         for (const s of report.skills.slice(0, 8)) {
             const desc = s.description.length > 35 ? s.description.slice(0, 32) + '...' : s.description;
             write(`║    ${s.id.padEnd(24)} ${desc.padEnd(36)}║`);
@@ -5034,7 +5571,9 @@ function cmdRecommend(options, cwd, write) {
         write(`║${''.padEnd(62)}║`);
     }
     if (report.toolkits.length > 0) {
-        write(`║  FULL PIPELINE (npx toolkits)                               ║`);
+        write(stackDerived
+            ? `║  PROJECT-STACK PIPELINE (npx toolkits)                      ║`
+            : `║  FULL PIPELINE (npx toolkits)                               ║`);
         for (const tk of report.toolkits) {
             const desc = tk.description.length > 44 ? tk.description.slice(0, 41) + '...' : tk.description;
             write(`║    ${tk.name.padEnd(16)} ${desc.padEnd(44)}║`);
@@ -5044,13 +5583,17 @@ function cmdRecommend(options, cwd, write) {
         write(`║${''.padEnd(62)}║`);
     }
     write(`╠══════════════════════════════════════════════════════════════╣`);
-    write(`║  STEP-BY-STEP PLAN                                         ║`);
+    write(stackDerived
+        ? `║  PROJECT-STACK PLAN                                         ║`
+        : `║  STEP-BY-STEP PLAN                                         ║`);
     for (const step of report.plan) {
         const line = step.length > 60 ? step.slice(0, 57) + '...' : step;
         write(`║    ${line.padEnd(58)}║`);
     }
     write(`╠══════════════════════════════════════════════════════════════╣`);
-    write(`║  QUICK INSTALL                                              ║`);
+    write(stackDerived
+        ? `║  PROJECT-STACK QUICK INSTALL                                ║`
+        : `║  QUICK INSTALL                                              ║`);
     const cmd = report.installCommand.length > 58 ? report.installCommand.slice(0, 55) + '...' : report.installCommand;
     write(`║    ${cmd.padEnd(58)}║`);
     write(`╚══════════════════════════════════════════════════════════════╝`);
@@ -5586,6 +6129,18 @@ function cmdPublish(options, flags, cwd, write) {
             return 1;
         }
     }
+    const filterStr = options.get('filter');
+    // SAFETY: trim + drop empty segments (mirrors --select at the top of cmdInit).
+    // Parse before the guard pre-flight so its packed-secret scan uses the SAME scoped package set
+    // that publishPackages receives below; an empty resulting list remains an explicit error.
+    let filter;
+    if (filterStr !== undefined) {
+        filter = filterStr.split(',').map((s) => s.trim()).filter((s) => s.length > 0);
+        if (filter.length === 0) {
+            write('dz publish: --filter requires a non-empty comma-separated list of package-name substrings');
+            return 1;
+        }
+    }
     // dz guard pre-flight (ADR-002 option A): publish is the most dangerous, least-reversible self-mutation, so
     // it ALWAYS runs the declarative guard first. A HARD violation refuses the publish; `--no-guard "<reason>"`
     // is the logged escape hatch (the override lands in .dz/guard-audit.jsonl — visible, never silent).
@@ -5600,7 +6155,7 @@ function cmdPublish(options, flags, cwd, write) {
             write('dz publish: --no-guard requires a reason (it is logged): --no-guard "hotfix, guard re-run after"');
             return 1;
         }
-        const guardResult = runGuardEvaluation(guardRoot, 'publish', undefined, noGuard);
+        const guardResult = runGuardEvaluation(guardRoot, 'publish', undefined, noGuard, filter);
         if (guardResult.verdict === 'block' && noGuard === undefined) {
             write('dz publish: ✗ BLOCKED by dz guard (HARD invariant violated):');
             for (const v of guardResult.violations.filter((x) => x.severity === 'hard'))
@@ -5645,21 +6200,6 @@ function cmdPublish(options, flags, cwd, write) {
     }
     const claimCheckOpt = claimCheckRaw ?? 'warn';
     const bumpOnly = flags.has('bump-only');
-    const filterStr = options.get('filter');
-    // SAFETY: trim + drop empty segments (mirrors --select at the top of cmdInit).
-    // Without this, `--filter ""` (e.g. an unset shell var) or a stray comma yields
-    // [''] / ['', 'core'], and publishPackages matches with name.includes(''), which
-    // is true for EVERY package — silently turning a scoped publish into a
-    // whole-monorepo publish. An empty resulting list is an explicit error, never
-    // "match all".
-    let filter;
-    if (filterStr !== undefined) {
-        filter = filterStr.split(',').map((s) => s.trim()).filter((s) => s.length > 0);
-        if (filter.length === 0) {
-            write('dz publish: --filter requires a non-empty comma-separated list of package-name substrings');
-            return 1;
-        }
-    }
     // SAFETY: dry-run is the DEFAULT. A real publish requires an EXPLICIT opt-in
     // via --yes, --confirm, or --no-dry-run. Without one, we never bump or publish.
     const wantsLive = flags.has('yes') || flags.has('confirm') || flags.has('no-dry-run');
@@ -5852,6 +6392,14 @@ function cmdPublish(options, flags, cwd, write) {
         if (pkg.claimCheck && pkg.claimCheck.findings > 0 && pkg.status !== 'error') {
             write(`      ⚠ claim-check: ${pkg.claimCheck.findings} finding(s) (${pkg.claimCheck.high} high) in README.md`);
         }
+        // A dry run stops before build/sign/pack, so it says NOTHING about the gates below that line.
+        // Printing what it did not check is what keeps a clean preview from reading as a clean publish
+        // (measured 2026-09-02: a clean dry run preceded a RED real gate).
+        if (pkg.notVerified && pkg.notVerified.length > 0) {
+            write(`      ⓘ холостой прогон НЕ проверял (${pkg.notVerified.length}):`);
+            for (const item of pkg.notVerified)
+                write(`         · ${item}`);
+        }
     }
     return report.errors > 0 ? 1 : 0;
 }
@@ -6811,6 +7359,81 @@ function looksBinaryText(text) {
  * per-file findings (each enriched with its `file`), and applies the exit-code contract.
  * `--json` ALWAYS emits valid JSON `{ok, findings, scanned}`, even on the failure path.
  */
+/**
+ * `dz chain` — verify EVERY hash-chained journal in one command (W0-chain, backlog bc4ee35c).
+ *
+ * The machinery to verify a chain has worked for weeks. What was missing is the ABILITY TO ASK:
+ * verification lived inside two consumers, each carrying its own hardcoded list of which files are
+ * chained, so a journal could be given a chain and still be checked by nobody. Coverage here is
+ * DERIVED from CHAINED_JOURNALS, never typed — adding a journal to the registry adds it to this
+ * report by construction.
+ *
+ * An ABSENT journal is reported as `absent`, not omitted. Omission and cleanliness are
+ * indistinguishable in a report, and that indistinguishability is how the original blind spot
+ * survived; the same reason `broken` exits NON-ZERO rather than merely printing — a verifier that
+ * reports damage and exits 0 is one no automation can act on, and this verb exists to run unattended.
+ *
+ * A journal that exists but carries NO chained records is `unchained`, which is legal (a log may
+ * predate the chain) and therefore does not fail the command. Calling it a defect would train the
+ * reader to ignore the output — the failure mode already measured once on the doctor's own line.
+ */
+function cmdChain(options, flags, cwd, write) {
+    const root = options.get('project') ?? cwd;
+    const journals = CHAINED_JOURNALS.map((journal) => {
+        const path = join(root, journal.rel);
+        if (!existsSync(path)) {
+            return { rel: journal.rel, decides: journal.decides, status: 'absent', chained: 0, defects: 0, detail: 'file not present' };
+        }
+        let text = '';
+        try {
+            text = readFileSync(path, 'utf-8');
+        }
+        catch {
+            // Unreadable is NOT clean. It is the one outcome that must never be quietly folded into
+            // "nothing to report": we did not look, so we know nothing.
+            return { rel: journal.rel, decides: journal.decides, status: 'unreadable', chained: 0, defects: 0, detail: 'file could not be read' };
+        }
+        const v = verifyEventChainText(text);
+        if (v.chained === 0) {
+            return { rel: journal.rel, decides: journal.decides, status: 'unchained', chained: 0, defects: 0, detail: 'present, but no record carries a chain (legal — the log predates chaining)' };
+        }
+        const total = text.split('\n').filter((l) => l.trim() !== '').length;
+        const age = classifyChainDefects(v, total);
+        if (v.ok) {
+            return { rel: journal.rel, decides: journal.decides, status: 'ok', chained: v.chained, defects: 0, detail: `${v.chained} chained record(s), ${v.resets} recorded restart(s)` };
+        }
+        // A break the current unbroken run has already outlived does not make TODAY's records unsound.
+        // Reporting both alike is what made the doctor's equivalent line permanently red for four weeks.
+        const historical = age.inRun.length === 0 && age.runRecords > 0;
+        return {
+            rel: journal.rel,
+            decides: journal.decides,
+            status: historical ? 'healed' : 'broken',
+            chained: v.chained,
+            defects: v.defects.length,
+            detail: historical
+                ? `${v.defects.length} defect(s), all BEFORE the current run — the last ${age.runRecords} record(s) are unbroken, so verdicts over those are sound`
+                : `${v.defects.length} defect(s) with NO sound records after them: verdicts computed from this log are unsafe`,
+        };
+    });
+    const failed = journals.filter((j) => j.status === 'broken' || j.status === 'unreadable');
+    const ok = failed.length === 0;
+    if (flags.has('json')) {
+        write(JSON.stringify({ ok, root, journals }, null, 2));
+        return ok ? 0 : 1;
+    }
+    write(`dz chain — ${journals.length} registered journal(s) under ${root}`);
+    write('');
+    const MARK = { ok: '\u2713', healed: '\u2713', unchained: '\u00b7', absent: '\u00b7', broken: '\u2717', unreadable: '\u2717' };
+    for (const j of journals) {
+        write(`  ${MARK[j.status] ?? '?'} ${j.rel} — ${j.status}`);
+        write(`      ${j.detail}`);
+        write(`      decides: ${j.decides}`);
+    }
+    write('');
+    write(ok ? '  all registered journals are sound for present verdicts' : `  ${failed.length} journal(s) UNSAFE — see above`);
+    return ok ? 0 : 1;
+}
 function cmdClaimCheck(options, _optionLists, flags, cwd, write) {
     // Reject (never silently coerce) an invalid --fail-on.
     const failOnRaw = options.get('fail-on') ?? 'high';
@@ -7499,7 +8122,19 @@ function cmdAgentsSync(options, flags, cwd, write, writeErr) {
             writeErr(`dz agents-sync: DRIFT — ${drifted.length} stale/missing section(s); ${effect}`);
             for (const finding of drifted)
                 writeErr(`  ${finding.id}: ${finding.file} (${finding.status})`);
-            if (drifted.some((finding) => finding.id === 'dz:policies')) {
+            const unregistered = drifted.filter((finding) => finding.status === 'unregistered-section');
+            if (unregistered.length > 0) {
+                // ПОДСКАЗКА, ВЕДУЩАЯ НЕ ТУДА, ХУЖЕ ОТСУТСТВУЮЩЕЙ. Повторный `dz agents-sync` эту находку
+                // НЕ лечит: реестр POLICY_SOURCES ведётся руками, и секция, не вписанная в него, не
+                // попадёт в проекцию сколько ни синхронизируй. Раньше здесь печаталась общая подсказка —
+                // читатель прогнал бы её и снова увидел ту же ошибку.
+                writeErr('→ heal with: объяви секцию в POLICY_SOURCES (packages/@dzhechkov/harness-core/src/agents-policy.ts):');
+                for (const finding of unregistered) {
+                    writeErr(`     { id: '${finding.id}', file: '${finding.file}', heading: '…', why: '…', operativeClause: '…' }`);
+                }
+                writeErr('   затем: dz agents-sync');
+            }
+            else if (drifted.some((finding) => finding.id === 'dz:policies')) {
                 writeErr('→ heal with: repair duplicate/unmatched dz:policies markers, then run dz agents-sync');
             }
             else {
@@ -7584,7 +8219,9 @@ const DEFAULT_STORE_CAP = 5000;
  * the rule reports nothing for them — a pre-flight must never become a filesystem sweep.
  */
 const MAX_STUB_SCAN_FILES = 400;
-/** Read the optional `.dz/guard.json` — `{ rules?: [...], storeCap?: number, stubWaivers?: [...] }`. Missing/broken ⇒ defaults. */
+/** Maximum packed-file size read by the publish secret scan. */
+const SECRET_SCAN_MAX_BYTES = 512 * 1024;
+/** Read the optional `.dz/guard.json` — `{ rules?, storeCap?, stubWaivers?, secretWaivers? }`. Missing/broken ⇒ defaults. */
 function loadGuardConfig(root) {
     const p = join(root, '.dz', 'guard.json');
     if (!existsSync(p))
@@ -7621,6 +8258,54 @@ function gatherReadmeCounts(root) {
     // (target repo without sitedoc — missing-evidence contract). But a file that EXISTS and no longer
     // matches its anchored pattern emits a MISMATCH pair (a: -1) — silent non-extraction is the exact
     // disease this contour cures (AM-1 applies to the guard path too, not only the CI test).
+    // ЗНАЧКИ ПРОТИВ ДЕРЕВА, а не только README против README (бэклог 9cb30764).
+    //
+    // Прежде правило сверяло только числа МЕЖДУ документами: два согласованных документа могли
+    // хором утверждать одно и то же неверное число, и правило молчало. Значок «пакетов: 52» стоял
+    // при 55 публикуемых на диске — ИЗМЕРЕНО 2026-09-03. Меню обещает 32 блюда, официант
+    // перечисляет 30, кухня готовит 38, и никто в ресторане не знает правду.
+    //
+    // Сверяются только числа, ВЫЧИСЛИМЫЕ ИЗ ДЕРЕВА. Значок «опубликовано в npm» сюда НЕ входит и
+    // это сказано вслух: его источник — реестр, а не рабочая копия, и пара, которая делает вид, что
+    // проверила его, была бы хуже отсутствующей.
+    const badge = (s, name) => {
+        const m = s.match(new RegExp(`img\\.shields\\.io/badge/${name}-(\\d+)`));
+        return m && m[1] ? Number(m[1]) : null;
+    };
+    const publishablePackages = (() => {
+        const dir = join(root, 'packages', '@dzhechkov');
+        if (!existsSync(dir))
+            return null;
+        let n = 0;
+        for (const name of readdirSync(dir)) {
+            const pj = join(dir, name, 'package.json');
+            if (!existsSync(pj))
+                continue;
+            try {
+                const j = JSON.parse(readFileSync(pj, 'utf8'));
+                if (j.private !== true)
+                    n += 1;
+            }
+            catch { /* нечитаемый манифест — не считается ни в одну сторону */ }
+        }
+        return n;
+    })();
+    const pkgBadge = badge(rootMd, 'packages');
+    if (pkgBadge !== null && publishablePackages !== null) {
+        pairs.push({ label: 'packages (root badge vs publishable package.json on disk)', a: pkgBadge, b: publishablePackages });
+    }
+    const presetBadge = badge(rootMd, 'presets');
+    if (presetBadge !== null) {
+        pairs.push({ label: 'presets (root badge vs PRESET_NAMES in the build)', a: presetBadge, b: PRESET_NAMES.length });
+    }
+    const targetBadge = badge(rootMd, 'targets');
+    if (targetBadge !== null) {
+        pairs.push({ label: 'targets (root badge vs TARGET_NAMES in the build)', a: targetBadge, b: TARGET_NAMES.length });
+    }
+    const cmdBadge = badge(rootMd, 'CLI%20commands');
+    if (cmdBadge !== null && cliAll !== null) {
+        pairs.push({ label: 'commands (root badge vs cli All Commands)', a: cmdBadge, b: cliAll });
+    }
     const sitePair = (rel, re, label) => {
         if (cliAll === null || !existsSync(join(root, rel)))
             return;
@@ -8056,8 +8741,9 @@ function gatherVolumeShadowFacts(root, packages) {
     };
 }
 /** Gather the facts one op needs. All I/O is best-effort — a missing signal skips its rule, never crashes. */
-function gatherGuardFacts(op, root, text, storeCap) {
+function gatherGuardFacts(op, root, text, storeCap, publishFilter) {
     const facts = { op };
+    const publishPackageRoots = [];
     if (op === 'publish') {
         // Advisory I/O: unreadable telemetry or fed state is absence of evidence, never a fabricated
         // stale finding and never a publish blocker.
@@ -8204,6 +8890,11 @@ function gatherGuardFacts(op, root, text, storeCap) {
         for (const m of manifests)
             if (m.name && typeof m.version === 'string')
                 versionByName.set(m.name, m.version);
+        publishPackageRoots.push(...located
+            .filter(({ dir, m }) => m.private !== true && (publishFilter === undefined
+            || publishFilter.length === 0
+            || publishFilter.some((filter) => (m.name ?? '').includes(filter) || dir.includes(filter))))
+            .map(({ dir }) => dir));
         const pnpmWorkspace = existsSync(join(root, 'pnpm-workspace.yaml'));
         const packages = [];
         for (const m of manifests) {
@@ -8218,6 +8909,95 @@ function gatherGuardFacts(op, root, text, storeCap) {
             packages.push({ name: m.name ?? '(unnamed)', deps });
         }
         facts['packages'] = packages;
+        // sibling-dep-protocol: сырые спеки, БЕЗ подстановки версии. Подставленная версия выглядела бы
+        // как обычный диапазон, и правило потеряло бы ровно то, что проверяет.
+        const siblingDeps = [];
+        for (const m of manifests) {
+            if (m.private === true)
+                continue;
+            const fields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+            for (const field of fields) {
+                const table = m[field];
+                if (typeof table !== 'object' || table === null)
+                    continue;
+                for (const [dep, spec] of Object.entries(table)) {
+                    if (!dep.startsWith('@dzhechkov/') || typeof spec !== 'string')
+                        continue;
+                    siblingDeps.push({ name: m.name ?? '(unnamed)', field, dep, spec });
+                }
+            }
+        }
+        facts['siblingDeps'] = siblingDeps;
+        // plugin-manifest-audit: каждый `.claude-plugin/plugin.json` в дереве. Обход ограничен по
+        // глубине и не заходит в node_modules/dist — чужие манифесты не наши, и краснеть на них
+        // значило бы отчитываться о том, чего мы не публикуем.
+        const pluginManifests = [];
+        const walkPlugins = (dir, depth) => {
+            if (depth > 4)
+                return;
+            let entries;
+            try {
+                entries = readdirSync(dir, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const e of entries) {
+                // `out/` — СГЕНЕРИРОВАННОЕ публичное зеркало: те же манифесты, скопированные. Дефект в нём
+                // есть дефект генератора, и он уже сообщается по источнику; вторая копия только удвоила бы
+                // одну и ту же находку.
+                if (!e.isDirectory() || e.name === 'node_modules' || e.name === 'dist' || e.name === 'out')
+                    continue;
+                const full = join(dir, e.name);
+                if (e.name === '.claude-plugin') {
+                    const manifest = join(full, 'plugin.json');
+                    if (!existsSync(manifest))
+                        continue;
+                    try {
+                        const j = JSON.parse(readFileSync(manifest, 'utf8'));
+                        const pick = (k) => (typeof j[k] === 'string' ? j[k] : undefined);
+                        // Состав навыков — ОБЕ стороны инвентаризации, и ТОЛЬКО для коробки ОДНОГО ПАКЕТА.
+                        //
+                        // Корневая витрина сюда НЕ входит, и это не упрощение: её состав собирается из всего
+                        // монорепозитория через реестр, «что лежит на складе» для неё — не обход одного дерева,
+                        // а весь реестр, и ровно это уже проверяет `marketplace-parity` регенерацией. Первая
+                        // редакция этой проверки обошла корень с ограничением глубины и выдала 27 ЛОЖНЫХ
+                        // «объявлено, но не найдено» — навыки лежали глубже границы обхода (ИЗМЕРЕНО 2026-09-04,
+                        // поймано до коммита прогоном стража на этом же дереве).
+                        //
+                        // Сравниваются ПУТИ, как их объявил манифест, а не имена: два навыка с одинаковым
+                        // именем в разных подкаталогах — законная вещь, и сведение к имени их бы склеило.
+                        const boxRoot = dirname(full);
+                        const isRepoRoot = resolve(boxRoot) === resolve(root);
+                        const declaredSkills = Array.isArray(j['skills']) && !isRepoRoot
+                            ? j['skills'].filter((x) => typeof x === 'string')
+                                .map((rel) => rel.replace(/^\.\//, '').replace(/\/+$/, '')).filter(Boolean)
+                            : undefined;
+                        const skillsOnDisk = declaredSkills === undefined ? undefined : findSkillDirs(boxRoot);
+                        pluginManifests.push({
+                            path: relative(root, manifest),
+                            ...(pick('name') !== undefined ? { name: pick('name') } : {}),
+                            ...(pick('version') !== undefined ? { version: pick('version') } : {}),
+                            ...(pick('description') !== undefined ? { description: pick('description') } : {}),
+                            ...(declaredSkills !== undefined ? { declaredSkills } : {}),
+                            ...(skillsOnDisk !== undefined ? { skillsOnDisk } : {}),
+                        });
+                    }
+                    catch (error) {
+                        pluginManifests.push({
+                            path: relative(root, manifest),
+                            parseError: (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').slice(0, 200),
+                        });
+                    }
+                    continue;
+                }
+                if (e.name.startsWith('.'))
+                    continue;
+                walkPlugins(full, depth + 1);
+            }
+        };
+        walkPlugins(root, 0);
+        facts['pluginManifests'] = pluginManifests;
         facts['volume'] = gatherVolumeShadowFacts(root, located.map(({ dir, m }) => ({
             dir,
             name: m.name ?? dir,
@@ -8252,9 +9032,57 @@ function gatherGuardFacts(op, root, text, storeCap) {
         }
         catch { /* unreadable tree — the rule reports nothing rather than inventing a violation */ }
         try {
-            facts['drift'] = sweepSkillDrift(root, { scope: 'installs', allowlist: readDriftAllowlist(root) }).drifted.map((d) => d.name);
+            facts['drift'] = sweepSkillDrift(root, { scope: DRIFT_SWEEP_SCOPE, allowlist: readDriftAllowlist(root) }).drifted.map((d) => d.name);
         }
         catch { /* skip */ }
+        // backlog-covers-features: каталоги фич, дата их ПОЯВЛЕНИЯ В ИСТОРИИ (не mtime — его двигает
+        // любой посторонний процесс), оговорки из README фичи и тексты записей бэклога. Базовая дата
+        // делает правило зелёным на приходе: 336 существующих каталогов заведены до правила.
+        // Нечитаемое дерево ⇒ факт НЕ выставляется ⇒ правило молчит, а не выдумывает вердикт.
+        try {
+            const featDir = join(root, 'features');
+            if (existsSync(featDir)) {
+                const slugs = readdirSync(featDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+                const features = slugs.map((slug) => {
+                    let createdIso = '';
+                    try {
+                        createdIso = execSync(`git log --diff-filter=A --format=%aI -1 -- ${JSON.stringify('features/' + slug)}`, { cwd: root, encoding: 'utf-8' }).trim().split('\n').filter(Boolean).pop() ?? '';
+                    }
+                    catch { /* нет в истории — функция засчитает как новый, это верный дефолт */ }
+                    let waiver;
+                    for (const f of ['README.md', '07_code_changes/change_manifest.md']) {
+                        try {
+                            const m = readFileSync(join(featDir, slug, f), 'utf-8')
+                                .match(/^\s*Backlog:\s*не заведено\s*[—-]\s*(.+)$/m);
+                            if (m && m[1] && m[1].trim() !== '') {
+                                waiver = m[1].trim();
+                                break;
+                            }
+                        }
+                        catch { /* нет файла — не оговорка */ }
+                    }
+                    return { slug, createdIso, waiver };
+                });
+                const backlogTexts = [];
+                try {
+                    for (const line of readFileSync(join(root, '.dz', 'backlog', 'ideas.jsonl'), 'utf-8').split('\n')) {
+                        if (line.trim() === '')
+                            continue;
+                        try {
+                            const o = JSON.parse(line);
+                            if (typeof o.text === 'string')
+                                backlogTexts.push(o.text);
+                        }
+                        catch { /* рваная строка */ }
+                    }
+                }
+                catch { /* стора нет */ }
+                if (backlogTexts.length > 0) {
+                    facts['featureBacklog'] = { baseline: BACKLOG_COVERAGE_BASELINE, features, backlogTexts };
+                }
+            }
+        }
+        catch { /* нечитаемо — правило молчит */ }
         facts['counts'] = gatherReadmeCounts(root);
         // readme-first: from the WORKING-TREE diff (publishes happen pre-commit here), per package: does the
         // change set contain its package.json (the version-bump signal) without its README.md?
@@ -8449,16 +9277,61 @@ function gatherGuardFacts(op, root, text, storeCap) {
         catch { /* not a git repo — every template rule stays silent (fail-open) */ }
         // no-stubs config waivers: `.dz/guard.json` `stubWaivers: [{path, reason}]` — path-keyed, reason
         // MANDATORY (the feature-adr-setup --guards shape; the pure checker refuses a reasonless entry).
-        const stubWaivers = loadGuardConfig(root).stubWaivers;
+        const guardConfig = loadGuardConfig(root);
+        const stubWaivers = guardConfig.stubWaivers;
         if (Array.isArray(stubWaivers))
             facts['stubWaivers'] = stubWaivers;
+        const secretWaivers = guardConfig.secretWaivers;
+        if (Array.isArray(secretWaivers))
+            facts['secretWaivers'] = secretWaivers;
     }
     if (op === 'consolidate') {
         try {
-            facts['drift'] = sweepSkillDrift(root, { scope: 'installs', allowlist: readDriftAllowlist(root) }).drifted.map((d) => d.name);
+            facts['drift'] = sweepSkillDrift(root, { scope: DRIFT_SWEEP_SCOPE, allowlist: readDriftAllowlist(root) }).drifted.map((d) => d.name);
         }
         catch { /* skip */ }
     }
+    if (op === 'publish') {
+        const secretTargets = [];
+        let skipped = 0;
+        for (const dir of publishPackageRoots) {
+            const packageRoot = join(root, dir);
+            let packed;
+            try {
+                packed = listPackFiles(packageRoot);
+            }
+            catch {
+                skipped++;
+                continue;
+            }
+            for (const rel of packed) {
+                const absolute = join(packageRoot, rel);
+                try {
+                    const stat = lstatSync(absolute);
+                    if (!stat.isFile() || stat.size > SECRET_SCAN_MAX_BYTES) {
+                        skipped++;
+                        continue;
+                    }
+                    const content = readFileSync(absolute);
+                    if (content.subarray(0, 8 * 1024).includes(0)) {
+                        skipped++;
+                        continue;
+                    }
+                    secretTargets.push({
+                        label: relative(root, absolute).split(sep).join('/'),
+                        text: content.toString('utf8'),
+                    });
+                }
+                catch {
+                    skipped++;
+                }
+            }
+        }
+        if (secretTargets.length > 0)
+            facts['secretTargets'] = secretTargets;
+        if (skipped > 0)
+            facts['secretScan'] = { skipped };
+    }
     if (op === 'teach' || op === 'consolidate') {
         if (op === 'teach' && text)
             facts['secretTargets'] = [{ label: 'lesson', text }];
@@ -8478,13 +9351,13 @@ function gatherGuardFacts(op, root, text, storeCap) {
  * shared by `dz guard check` and the `dz publish` pre-flight (ADR-002 option A) so they can never disagree.
  * `overrideReason` (when the caller forces through a block) is logged, never silent.
  */
-function runGuardEvaluation(root, op, text, overrideReason) {
+function runGuardEvaluation(root, op, text, overrideReason, publishFilter) {
     const cfg = loadGuardConfig(root);
     // Number.isFinite, not just > 0: a config `storeCap: 1e400` parses to Infinity, passes `> 0`, and would
     // silently DISABLE the cap (count <= Infinity always). Non-finite ⇒ fall back to the default.
     const storeCap = typeof cfg.storeCap === 'number' && Number.isFinite(cfg.storeCap) && cfg.storeCap > 0 ? cfg.storeCap : DEFAULT_STORE_CAP;
     const rules = resolveRules(Array.isArray(cfg.rules) ? cfg.rules : undefined);
-    const facts = gatherGuardFacts(op, root, text, storeCap);
+    const facts = gatherGuardFacts(op, root, text, storeCap, publishFilter);
     const result = evaluateGuard(facts, rules);
     // audit (append-only). ts is real time here (a CLI, not the sandboxed workflow).
     try {
@@ -9320,17 +10193,57 @@ async function cmdMrRakes(options, flags, cwd, write) {
  *   --threshold N       drill threshold (default 2 — anti-noise: a first-seen rake accrues, never drills)
  *   --no-teach          drill only; do NOT write the store (skip the agent side)
  *   --project <dir>     pin the teach ledger
- *   --install-hook      print the opt-in SessionEnd hook to add (non-destructive)
+ *   --install-hook      print the opt-in hook set to add (non-destructive): Stop scan-tail +
+ *                       PreCompact/SessionEnd full retro (feature narrated-error-must-be-taught)
+ *   --scan-tail         per-turn Stop-hook mode: incremental admission-debt scan, O(new bytes) —
+ *                       writes/clears .dz/retro-pending.json; no ledger, no teach, no git subprocess
+ *   --transcript <p>    the transcript --scan-tail must read. Without it the Stop hook's own stdin
+ *                       payload (`transcript_path`) is used; with neither, the scan REFUSES
+ *                       (NOT-ESTABLISHED) rather than guessing the newest file on disk
  */
-async function cmdRetro(options, flags, cwd, write) {
+async function cmdRetro(options, flags, cwd, write, readStdin = () => '') {
+    if (flags.has('scan-tail')) {
+        // Per-turn primary detector (ADR-001 D2). Cost budget IS the design: no `git rev-parse`
+        // subprocess (hooks run with cwd = project root; CLAUDE_PROJECT_DIR pins it), no store open,
+        // O(new bytes) via the persisted offset. Always exit 0 — a Stop hook must never fail a turn.
+        const root = process.env['CLAUDE_PROJECT_DIR'] ?? cwd;
+        // WHICH transcript. Round 3, P1-3: this used to fall back to `findLatestTranscript(root)`, so with
+        // several sessions and their subagents alive at once it scanned whichever file had the newest
+        // mtime — routinely another session's, advancing that session's offset and never seeing this
+        // turn's admission. The Stop hook hands the exact path on stdin; with no path from any source the
+        // answer is a stated refusal, never a guess. Still exit 0: a Stop hook must never fail a turn.
+        const picked = resolveScanTailTranscript({
+            flag: options.get('transcript'),
+            positional: options.get('_positional_0'),
+            stdin: readStdin(),
+        });
+        if (picked.path === null) {
+            const reason = picked.reason ?? 'no transcript path';
+            if (flags.has('json'))
+                write(JSON.stringify({ status: 'not-established', source: 'none', reason, scannedBytes: 0, offset: 0 }));
+            else
+                write(`retro scan-tail: NOT-ESTABLISHED — ${reason}. Wire the hook as \`dz retro --scan-tail\` (Claude Code pipes the payload on stdin) or pass \`--transcript <path>\`.`);
+            return 0;
+        }
+        const outcome = runRetroTailScan(join(root, '.dz'), picked.path);
+        if (flags.has('json'))
+            write(JSON.stringify({ ...outcome, source: picked.source }));
+        else if (outcome.status === 'pending')
+            write(`retro scan-tail: unpaid admission — .dz/retro-pending.json armed («${(outcome.snippet ?? '').slice(0, 60)}…»)`);
+        return 0;
+    }
     let repoRoot = cwd;
     try {
         repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd;
     }
     catch { /* not git */ }
     if (flags.has('install-hook')) {
-        write('Add this opt-in SessionEnd hook to .claude/settings.json (runs a retro when a session ends):');
-        write(JSON.stringify({ hooks: { SessionEnd: [{ hooks: [{ type: 'command', command: 'dz retro' }] }] } }, null, 2));
+        write('Add these opt-in hooks to .claude/settings.json (per-turn debt scan + retro at compaction AND session end — PreCompact covers the crash/disconnect sessions SessionEnd never sees):');
+        write(JSON.stringify({ hooks: {
+                Stop: [{ hooks: [{ type: 'command', command: 'dz retro --scan-tail', timeout: 10000, continueOnError: true }] }],
+                PreCompact: [{ hooks: [{ type: 'command', command: 'dz retro', timeout: 60000, continueOnError: true }] }],
+                SessionEnd: [{ hooks: [{ type: 'command', command: 'dz retro', timeout: 60000, continueOnError: true }] }],
+            } }, null, 2));
         return 0;
     }
     const transcript = options.get('_positional_0') ?? findLatestTranscript(repoRoot);
@@ -9593,6 +10506,50 @@ function cmdChallenge(options, flags, cwd, write) {
  * decide (dz's rule — a false gate kills trust). Exit code is 0 on a clean run regardless of verdict; 2 only on
  * a usage/setup error, so a caller distinguishes "gate ran" from "gate could not run".
  */
+/**
+ * Есть ли в этом каталоге НЕЗАКОММИЧЕННЫЕ правки. Это и отличает «фича ещё в рабочем дереве»
+ * (тогда `HEAD` — законная предфичевая база) от «фича уже закоммичена» (тогда `HEAD` её содержит).
+ *
+ * Не удалось спросить git — возвращается null, и вызывающий обязан считать положение НЕ
+ * УСТАНОВЛЕННЫМ, а не выбрать удобный ответ.
+ */
+/**
+ * Каталоги с `SKILL.md` внутри коробки ОДНОГО пакета — то, что РЕАЛЬНО лежит на складе.
+ * Возвращаются ПУТИ относительно коробки, как их объявляет манифест, а не имена.
+ */
+function findSkillDirs(boxRoot) {
+    const found = new Set();
+    const walk = (dir, depth) => {
+        if (depth > 4)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (!e.isDirectory() || e.name === 'node_modules' || e.name === 'dist' || e.name.startsWith('.'))
+                continue;
+            const full = join(dir, e.name);
+            if (existsSync(join(full, 'SKILL.md')))
+                found.add(relative(boxRoot, full));
+            walk(full, depth + 1);
+        }
+    };
+    walk(boxRoot, 0);
+    return [...found];
+}
+function hasUncommittedChangesIn(repoRoot, dir) {
+    try {
+        const out = execSync(`git status --porcelain -- ${JSON.stringify(dir)}`, { cwd: repoRoot, encoding: 'utf-8' });
+        return out.split('\n').some((line) => line.trim() !== '');
+    }
+    catch {
+        return null;
+    }
+}
 function cmdDiscriminationCheck(options, flags, cwd, write) {
     let repoRoot = cwd;
     try {
@@ -9606,13 +10563,124 @@ function cmdDiscriminationCheck(options, flags, cwd, write) {
     }
     const nameFilter = options.get('name');
     const propertyTests = testArg.split(',').map((s) => s.trim()).filter(Boolean).map((file) => nameFilter !== undefined && nameFilter.trim() !== '' ? { file, name: nameFilter.trim() } : { file });
-    const baseRef = options.get('base') ?? 'HEAD';
+    /**
+     * УМОЛЧАНИЕ БАЗЫ РАЗЛИЧАЕТ ДВА РАЗНЫХ ПОЛОЖЕНИЯ, потому что они и правда разные.
+     *
+     * В штатном ходе конвейера правка Шага 7 ЕЩЁ НЕ ЗАКОММИЧЕНА, и тогда `HEAD` — настоящая
+     * предфичевая база; так конвейер и зовёт гейт (`--base HEAD`, причина записана в его тексте).
+     *
+     * Но если фича УЖЕ ЗАКОММИЧЕНА, `HEAD` её содержит, и гейт сравнивает фичу С САМОЙ СОБОЙ.
+     * ИЗМЕРЕНО 2026-09-04: такой прогон дал уверенное `NON_DISCRIMINATING` с советом «усилить тест»
+     * на тестах, которые дискриминируют; тот же прогон с верной базой дал `DISCRIMINATES_VIA_ERROR`.
+     * Находка выглядела как утверждение О ТЕСТАХ, и автор пошёл бы чинить исправное.
+     *
+     * Различить эти положения можно ДЕТЕРМИНИРОВАННО: есть ли незакоммиченные правки в пакете, чьи
+     * тесты названы. Есть — `HEAD` законен и используется как раньше. Нет — база не установлена, и
+     * гейт ОТКАЗЫВАЕТСЯ (exit 3), вместо того чтобы измерять относительно самого себя.
+     */
+    const explicitBase = options.get('base');
     const runnerOpt = options.get('runner');
     // R11: a hung runner is a loud non-answer, never a pass. Same default + parse shape as mutation-gate.
     const timeoutOpt = Number(options.get('timeout') ?? '300000');
     const timeoutMs = Number.isFinite(timeoutOpt) && timeoutOpt > 0 ? timeoutOpt : 300000;
-    const plan = planDiscriminationCheck(runnerOpt !== undefined ? { baseRef, propertyTests, runner: runnerOpt } : { baseRef, propertyTests });
+    // Runner honesty (feature instrument-honesty, ADR-001): the runner is selected from the TARGET
+    // package's own scripts.test, never from a global default. The package dir is the nearest
+    // ancestor of the FIRST named test that carries a package.json — walked here, at the seam,
+    // because the pure half deliberately takes the script text as data and never touches the fs.
+    let packageTestScript = null;
+    let packageDevDependencies = [];
+    let packageDir = repoRoot;
+    {
+        const firstTest = propertyTests[0]?.file;
+        // QE-1 (instrument-honesty, HIGH): this walk runs on the RAW --test argument, BEFORE the
+        // engine's sanitation — a `../` traversal made it read an arbitrary package.json OUTSIDE the
+        // repo and echo its scripts.test verbatim into the JSON output (MEASURED with a planted
+        // marker file). Containment first: a start point outside the repo root never gets walked,
+        // the script stays null, and the engine's own path sanitation then refuses the test path.
+        const walkStart = firstTest !== undefined ? resolve(cwd, dirname(firstTest)) : undefined;
+        if (firstTest !== undefined && walkStart !== undefined
+            && (walkStart === resolve(repoRoot) || walkStart.startsWith(resolve(repoRoot) + sep))) {
+            let probe = walkStart;
+            // walk up to the repo root looking for package.json (bounded by the fs root either way)
+            for (;;) {
+                if (existsSync(join(probe, 'package.json'))) {
+                    packageDir = probe;
+                    break;
+                }
+                const parent = dirname(probe);
+                if (parent === probe || probe === repoRoot)
+                    break;
+                probe = parent;
+            }
+            try {
+                const pkg = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf-8'));
+                packageTestScript = typeof pkg.scripts?.test === 'string' ? pkg.scripts.test : null;
+                packageDevDependencies = Object.keys(pkg.devDependencies ?? {});
+            }
+            catch { /* unreadable package.json → selection falls through to the honest REFUSE */ }
+        }
+    }
+    // The pure half's path sanitation expects a REPO-RELATIVE package dir ('.'-rooted), not an
+    // absolute one — an absolute path is refused as unsafe-package-dir by design.
+    const packageDirRel = relative(repoRoot, packageDir) || '.';
+    // Умолчание базы решается ЗДЕСЬ, потому что только здесь известен пакет, чьи тесты названы.
+    let baseRef;
+    if (explicitBase !== undefined && explicitBase.trim() !== '') {
+        baseRef = explicitBase.trim();
+    }
+    else {
+        const dirty = hasUncommittedChangesIn(repoRoot, packageDirRel);
+        if (dirty !== true) {
+            write('dz discrimination-check: NOT-ESTABLISHED — предфичевая база не установлена.');
+            write(dirty === null
+                ? `  Не удалось спросить git о состоянии ${packageDirRel}; выбирать удобный ответ вместо этого нельзя.`
+                : `  В ${packageDirRel} нет незакоммиченных правок, значит фича УЖЕ в HEAD, и сравнение шло бы с самой собой.`);
+            write('  Гейт сравнивает поведение ДО и ПОСЛЕ фичи; без базы сравнивать не с чем, а HEAD здесь');
+            write('  дал бы уверенное NON_DISCRIMINATING на исправных тестах (ИЗМЕРЕНО 2026-09-04).');
+            write('  Передайте --base <коммит перед фичей>, например `<sha коммита фичи>^`.');
+            return 3;
+        }
+        // Штатный ход конвейера: правка Шага 7 ещё в рабочем дереве, HEAD — настоящая предфичевая база.
+        baseRef = 'HEAD';
+        write(`dz discrimination-check: база не задана; в ${packageDirRel} есть незакоммиченные правки, беру HEAD как предфичевую базу.`);
+    }
+    // Провенанс базы едет в квитанцию вместе с самой базой: «явно указано» — утверждение о действии
+    // человека, и писать его для HEAD, выбранного инструментом, значит подделывать происхождение
+    // доказательства, на которое сошлются позже.
+    const baseRefSupplied = explicitBase !== undefined && explicitBase.trim() !== '';
+    const planInput = runnerOpt !== undefined
+        ? { baseRef, baseRefSupplied, propertyTests, runner: runnerOpt, packageTestScript, packageDevDependencies, packageDir: packageDirRel }
+        : { baseRef, baseRefSupplied, propertyTests, packageTestScript, packageDevDependencies, packageDir: packageDirRel };
+    const plan = planDiscriminationCheck(planInput);
     if (!plan.runnable) {
+        // QE-2 (instrument-honesty, MEDIUM): a runner REFUSE used to be reported through the generic
+        // "no property test to check"/map-a-test framing — the operator-facing surface re-created the
+        // exact "instrument gap misread as test gap" class ADR-001 names as the reason three duplicate
+        // backlog entries existed. The plan's own named reason is the verdict; the generic classify
+        // stays only for the genuinely-empty-target case.
+        const runnerRefusal = typeof plan.reason === 'string' && plan.reason.startsWith('unsupported-runner');
+        if (runnerRefusal) {
+            const refusal = {
+                aggregate: 'CANNOT_ISOLATE',
+                measurementValid: false,
+                primaryAction: plan.primaryAction ?? 'fix-runner-invocation',
+                finding: {
+                    severity: 'high',
+                    verdict: 'CANNOT_ISOLATE',
+                    files: plan.targets.map((t) => t.file),
+                    detail: `runner refused: ${plan.reason} — the INSTRUMENT could not run, nothing was measured; `
+                        + `declare scripts.test in the target package (or pass --runner) and re-run. `
+                        + `This is NOT a statement about the tests.`,
+                },
+            };
+            if (flags.has('json')) {
+                write(JSON.stringify({ plan, results: [], perTest: [], ...refusal }, null, 2));
+                return 0;
+            }
+            write(`discrimination-check: REFUSED (${plan.reason})`);
+            write(`  → ${refusal.finding.detail}`);
+            return 0;
+        }
         // No safe target to run → this is the existing "property untested" finding (empty propertyTests classify).
         const result = classifyDiscrimination({ propertyTests: [], results: [] });
         if (flags.has('json')) {
@@ -9717,10 +10785,24 @@ function cmdDiscriminationCheck(options, flags, cwd, write) {
                 }
                 // t.file + t.name already passed the engine's strict sanitation (no quotes/metacharacters/leading-dash);
                 // still quote + `--` so a path can never be read as a runner option or split a word.
+                // Runner honesty (ADR-001): the run executes FROM the target package dir with a
+                // package-relative path — a root-cwd `npx vitest run packages/...` loads the ROOT config
+                // (none) and reds unclassifiably, which is exactly the CANNOT_ISOLATE artifact this
+                // feature removes. The plan's own commands encode the same cd; this body mirrors it.
+                const pkgRel = plan.packageDir === '.' ? '' : plan.packageDir;
+                const fileInPkg = pkgRel !== '' && t.file.startsWith(pkgRel + '/') ? t.file.slice(pkgRel.length + 1) : t.file;
+                const execDirBase = pkgRel === '' ? worktree : join(worktree, pkgRel);
+                const execDirTip = pkgRel === '' ? repoRoot : join(repoRoot, pkgRel);
                 const nameArg = t.name ? ` -t '${t.name}'` : '';
-                const cmd = `${runner}${nameArg} -- '${t.file}'`;
-                const base = runCapturedTest(cmd, worktree, timeoutMs);
-                const evidence = classifyExecutionEvidence(base.output, base.exitCode, t.file);
+                // NO `--` before the path: MEASURED 2026-09-02 — `npx vitest run -- 'file'` IGNORES the
+                // filter and runs the whole suite (5269 tests), which is the exact whole-repo artifact
+                // this feature removes (QE ha-intake-archive F5). The path is engine-sanitized (no
+                // leading dash, no metacharacters), so it can never be read as an option.
+                const cmd = `${runner}${nameArg} '${fileInPkg}'`;
+                const base = runCapturedTest(cmd, execDirBase, timeoutMs);
+                // The classifier's targetSeen is a substring probe: the run now prints PACKAGE-relative
+                // paths, so it must be probed with the same form, or every hit reads as target-unseen.
+                const evidence = classifyExecutionEvidence(base.output, base.exitCode, fileInPkg);
                 const outcome = discriminationOutcomeOf(base.exitCode, evidence);
                 const row = t.name !== undefined
                     ? { file: t.file, name: t.name, outcome, evidence }
@@ -9731,8 +10813,8 @@ function cmdDiscriminationCheck(options, flags, cwd, write) {
                 // base rows per the matrix; running it is cheap and only ever on an already-broken path.
                 // Do NOT "simplify" this to evidenced-error-only — that silently breaks Confirmation 17.
                 if (base.exitCode !== null && base.exitCode !== 0 && evidence.failureKind !== 'assertions') {
-                    const tip = runCapturedTest(cmd, repoRoot, timeoutMs);
-                    const tipEvidence = classifyExecutionEvidence(tip.output, tip.exitCode, t.file);
+                    const tip = runCapturedTest(cmd, execDirTip, timeoutMs);
+                    const tipEvidence = classifyExecutionEvidence(tip.output, tip.exitCode, fileInPkg);
                     row['tipOutcome'] = discriminationOutcomeOf(tip.exitCode, tipEvidence);
                     row['tipEvidence'] = tipEvidence;
                     // R15, named honestly: the base run is isolated in a worktree, but the tip runs in the LIVE
@@ -9841,51 +10923,6 @@ function readTipTreeConditions(repoRoot) {
 function nameFor(t, outcome) {
     return t.name !== undefined ? { file: t.file, name: t.name, outcome } : { file: t.file, outcome };
 }
-/**
- * `dz mutation-gate` — the mutation gate (feature ha-mutation-gate, SPEC at
- * features/ha-mutation-gate/SPEC.md). A green test proves the code works; it does NOT prove the
- * test would notice the protection being DELETED. For each entry in a declarative registry this
- * gate applies the entry's exact {find, replace} mutation to a SCRATCH COPY of the package, runs
- * the package's test command there, and REQUIRES a non-zero exit (red). All logic is in
- * harness-core's pure engine (mutation-gate.ts); this is the I/O executor.
- *
- *   --package <dir>     the package to gate (default: cwd; must contain package.json)
- *   --registry <file>   registry path (default: <pkg>/test/mutation-registry.json, then
- *                       <pkg>/mutation-registry.json)
- *   --test-cmd '<cmd>'  suite command run in the scratch copy (default: registry.testCommand,
- *                       then `npm test`)
- *   --only <id[,id]>    run a subset of entries (unknown id = usage error, never a silent skip)
- *   --timeout <ms>      per-suite-run timeout (default 300000). A timed-out run is INCONCLUSIVE —
- *                       a FAILURE, never a pass.
- *   --rebaseline <m>    route-b guard mode: 'per-entry' (default — every red entry re-runs the
- *                       suite on the restored tree; not green ⇒ that entry is INCONCLUSIVE) or
- *                       'final' (one re-run at the end; not green ⇒ every red-based verdict is
- *                       downgraded). The gate's PROVEN now means the redness was ATTRIBUTABLE.
- *   --keep-scratch      keep the scratch copy for inspection (default: removed in a finally)
- *   --json              machine contract {packageDir, registryPath, testCommand, rebaselineMode,
- *                       baseline, results, summary, warnings, exitCode}
- *
- * The four rules (SPEC §"Four rules") and where each is enforced:
- *   1. does-not-apply = FAILURE  → core classifyMutationOutcome (occurrences !== 1 ⇒ NOT_APPLIED);
- *   2. green suite    = FAILURE  → core (exit 0 ⇒ UNDEFENDED, names the property);
- *   3. never mutate the working tree → HERE: every write targets the scratch copy under tmpdir();
- *      the repo tree is opened read-only, and a crashed run leaves at worst a stale tmp dir;
- *   4. the gate's own discrimination proof → harness-cli/test/fixtures/mutation-gate-undefended
- *      (the gate MUST fail on it; asserted by test/mutation-gate-cli.test.ts).
- *
- * Exit codes: 0 every entry PROVEN · 1 the gate ran and failed (undefended / not-applied /
- * below-min / unparseable / load-fatal / over-failing / inconclusive entry) · 2 usage or setup
- * error (missing registry, red BASELINE — a red unmutated copy proves nothing and must not be
- * read as a mutation result — or an entry whose file RESOLVES outside the scratch copy: a
- * symlink escape is refused before anything is written, SPEC rule 3).
- */
-/**
- * Route-a guard for `dz mutation-gate`: parse-check a MUTATED file as its own language BEFORE the
- * suite runs. A registry mutation must delete the protection while keeping the file loadable — a
- * file that no longer parses kills the whole suite (or its import chain), and that STRUCTURAL
- * redness says nothing about the named protection. Returns `{error}` when a parser ran and the
- * text does not parse; `{skipped}` (reported loudly, never silently) when no parser is available.
- */
 function parseCheckMutatedFile(absFile, text) {
     const ext = extname(absFile).toLowerCase();
     try {
@@ -9916,18 +10953,36 @@ function parseCheckMutatedFile(absFile, text) {
             }
         }
         if (ext === '.js' || ext === '.cjs' || ext === '.mjs' || ext === '') {
-            try {
-                // `node --check` on the file IN PLACE, so the nearest package.json decides the module goal.
-                execFileSync(process.execPath, ['--check', absFile], { stdio: 'pipe' });
-                return {};
-            }
-            catch (e) {
-                const err = e;
-                const stderrLines = String(err.stderr ?? '').split('\n').map((l) => l.trim()).filter((l) => l !== '');
-                // prefer the actual `SyntaxError: …` line over node's trailing version footer.
-                const msg = [...stderrLines].reverse().find((l) => l.includes('Error')) ?? stderrLines.at(-1) ?? 'node --check failed';
-                return { error: msg.slice(0, 200) };
+            const checked = runWithOneInternalRetry(() => {
+                try {
+                    // `node --check` on the file IN PLACE, so the nearest package.json decides the module goal.
+                    execFileSync(process.execPath, ['--check', absFile], { stdio: 'pipe' });
+                    return {};
+                }
+                catch (e) {
+                    const err = e;
+                    // A launched parser that exits non-zero with a SyntaxError is a parse verdict. A child
+                    // launch/internal error (EPERM, ENOENT, Node's thrown internal) is runner infrastructure
+                    // and must take the bounded retry → INCONCLUSIVE route instead of masquerading as bad JS.
+                    if (typeof err.code === 'string' || typeof err.status !== 'number')
+                        throw e;
+                    const stderrLines = String(err.stderr ?? '').split('\n').map((line) => line.trim()).filter((line) => line !== '');
+                    const msg = [...stderrLines].reverse().find((line) => line.includes('Error'))
+                        ?? stderrLines.at(-1)
+                        ?? err.message
+                        ?? 'node --check failed';
+                    return { error: msg.slice(0, 200) };
+                }
+            });
+            if (checked.value === null) {
+                return {
+                    internalFailureReason: checked.failureReason ?? 'runner-internal-error: persistent after 2/2 attempts',
+                    internalAttempts: checked.attempts,
+                };
             }
+            return checked.internalRetries === 1
+                ? { ...checked.value, internalAttempts: checked.attempts }
+                : checked.value;
         }
         return { skipped: `no parser for '${ext}' files — parse-check unavailable` };
     }
@@ -9935,7 +10990,7 @@ function parseCheckMutatedFile(absFile, text) {
         return { skipped: `parse-check errored: ${String(e.message).slice(0, 120)}` };
     }
 }
-function cmdMutationGate(options, flags, cwd, write) {
+function cmdMutationGate(options, flags, cwd, write, injectedRunner) {
     const json = flags.has('json');
     const fail = (what) => {
         write(json ? JSON.stringify({ error: what, exitCode: 2 }) : `dz mutation-gate: ${what}`);
@@ -10003,6 +11058,7 @@ function cmdMutationGate(options, flags, cwd, write) {
     const results = [];
     const observations = [];
     const warnings = [];
+    const internalRetries = [];
     let baseline;
     try {
         if (gitTop !== null && gitTop !== pkgDir && resolve(pkgDir).startsWith(resolve(gitTop) + sep)) {
@@ -10046,7 +11102,10 @@ function cmdMutationGate(options, flags, cwd, write) {
         // write below is asserted to RESOLVE inside this root before it happens.
         const realScratchRoot = realpathSync(copyDir);
         const requireCompletionReceipt = parsed.registry.requireCompletionReceipt === true;
-        const runSuite = () => {
+        const invokeSuite = () => {
+            if (injectedRunner !== undefined) {
+                return injectedRunner(testCmd, { cwd: copyDir, timeoutMs: timeout });
+            }
             const run = spawnSync(testCmd, {
                 cwd: copyDir,
                 shell: true,
@@ -10058,6 +11117,12 @@ function cmdMutationGate(options, flags, cwd, write) {
             const errorCode = run.error && 'code' in run.error && typeof run.error.code === 'string'
                 ? run.error.code
                 : undefined;
+            // Node may populate both `error` and a numeric `status` for an internal spawn failure. The
+            // error wins except for the two already-named resource observations: a status alongside
+            // EPERM/Unreachable-code is not a suite verdict and takes the one-retry internal-error path.
+            if (run.error !== undefined && errorCode !== 'ETIMEDOUT' && errorCode !== 'ENOBUFS') {
+                throw run.error;
+            }
             const signal = typeof run.signal === 'string' ? run.signal : undefined;
             let failureReason;
             if (typeof run.status !== 'number') {
@@ -10074,25 +11139,59 @@ function cmdMutationGate(options, flags, cwd, write) {
             }
             return {
                 exitCode: typeof run.status === 'number' ? run.status : null,
-                // Receipt markers may be on stderr. Preserve both streams even on exit 0; stdout-only
-                // collection would silently lose a green-run marker.
                 output: `${String(run.stdout ?? '')}\n${String(run.stderr ?? '')}`,
                 ...(failureReason !== undefined ? { failureReason } : {}),
             };
         };
+        const runSuite = (phase, entryId) => {
+            const retried = runWithOneInternalRetry(invokeSuite);
+            const loggedAttempts = retried.attempts.map((attempt) => {
+                if (attempt.outcome !== 'completed' || retried.value === null)
+                    return attempt;
+                const outcome = retried.value.exitCode === null
+                    ? `no exit code (${retried.value.failureReason ?? 'unnamed failure'})`
+                    : `exit ${retried.value.exitCode}`;
+                return { ...attempt, detail: `attempt ${attempt.attempt}: completed — ${outcome}` };
+            });
+            if (retried.internalRetries === 1) {
+                const record = entryId === undefined
+                    ? { phase, attempts: loggedAttempts }
+                    : { phase, entryId, attempts: loggedAttempts };
+                internalRetries.push(record);
+                if (!json)
+                    write(`mutation-gate: internal retry — ${loggedAttempts.map((attempt) => attempt.detail).join('; ')}`);
+            }
+            const internalAttemptLog = retried.internalRetries === 1
+                ? loggedAttempts.map((attempt) => attempt.detail).join('; ')
+                : undefined;
+            if (retried.value !== null) {
+                return {
+                    ...retried.value,
+                    ...(internalAttemptLog !== undefined ? { internalAttemptLog } : {}),
+                };
+            }
+            return {
+                exitCode: null,
+                output: '',
+                failureReason: retried.failureReason ?? 'runner-internal-error: persistent after 2/2 attempts',
+                ...(internalAttemptLog !== undefined ? { internalAttemptLog } : {}),
+            };
+        };
         // Baseline BEFORE any mutation: a red copy proves nothing, and reading it as a mutation
         // result would be this gate shipping the defect class it exists to catch.
         if (!json)
             write(`mutation-gate: baseline suite in scratch copy of ${pkgDir} …`);
-        const base = runSuite();
-        baseline = classifyBaseline(base.exitCode, base.failureReason);
+        const base = runSuite('baseline');
+        baseline = classifyBaseline(base.exitCode, base.failureReason, base.exitCode !== null && base.exitCode !== 0
+            ? attributeBaselineRedness(base.output, entries.map((entry) => entry.file))
+            : undefined);
         if (!baseline.ok) {
             if (json) {
-                write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, baseline, results: [], exitCode: 2 }, null, 2));
-                return 2;
+                write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, baseline, results: [], internalRetries, exitCode: 1 }, null, 2));
+                return 1;
             }
             write(renderMutationReport([], baseline, pkgDir));
-            return 2;
+            return 1;
         }
         for (const entry of entries) {
             const filePath = join(copyDir, entry.file);
@@ -10135,6 +11234,8 @@ function cmdMutationGate(options, flags, cwd, write) {
                 write(`mutation-gate: ${entry.id} — mutating ${entry.file}, running suite …`);
             let run = null;
             let parseError;
+            let parseInternalFailureReason;
+            let parseInternalAttemptLog;
             try {
                 writeFileSync(filePath, applied.text);
                 // Route-a guard: the mutated file must still PARSE — a load failure reddens the whole
@@ -10145,11 +11246,18 @@ function cmdMutationGate(options, flags, cwd, write) {
                     if (!json)
                         write(`mutation-gate: WARNING ${entry.id}: parse-check skipped — ${check.skipped}`);
                 }
+                if (check.internalAttempts !== undefined) {
+                    internalRetries.push({ phase: 'parse-check', entryId: entry.id, attempts: check.internalAttempts });
+                    parseInternalAttemptLog = check.internalAttempts.map((attempt) => attempt.detail).join('; ');
+                    if (!json)
+                        write(`mutation-gate: internal retry — ${parseInternalAttemptLog}`);
+                }
+                parseInternalFailureReason = check.internalFailureReason;
                 if (check.error !== undefined) {
                     parseError = check.error; // no suite run: the verdict is MUTATION_UNPARSEABLE regardless
                 }
-                else {
-                    run = runSuite();
+                else if (parseInternalFailureReason === undefined) {
+                    run = runSuite('mutation', entry.id);
                 }
             }
             finally {
@@ -10185,14 +11293,24 @@ function cmdMutationGate(options, flags, cwd, write) {
             // those verdicts outrank the rebaseline check, so the extra suite run would buy nothing.
             let rebaselineExitCode;
             let rebaselineFailureReason;
+            let rebaselineAttribution;
+            let rebaselineInternalAttemptLog;
             if (rebaselineMode === 'per-entry' && run !== null && run.exitCode !== null && run.exitCode !== 0
                 && fileLoadFailure === undefined && outputUnrecognised === undefined && receiptMismatch === undefined) {
                 if (!json)
                     write(`mutation-gate: ${entry.id} — re-baselining the restored tree …`);
-                const rebaselineRun = runSuite();
+                const rebaselineRun = runSuite('rebaseline', entry.id);
                 rebaselineExitCode = rebaselineRun.exitCode;
                 rebaselineFailureReason = rebaselineRun.failureReason;
+                rebaselineInternalAttemptLog = rebaselineRun.internalAttemptLog;
+                if (rebaselineRun.exitCode !== null && rebaselineRun.exitCode !== 0) {
+                    rebaselineAttribution = attributeBaselineRedness(rebaselineRun.output, entries.map((candidate) => candidate.file));
+                }
             }
+            const entryRunFailureReason = run?.failureReason ?? parseInternalFailureReason;
+            const entryInternalAttemptLog = [parseInternalAttemptLog, run?.internalAttemptLog, rebaselineInternalAttemptLog]
+                .filter((log) => log !== undefined)
+                .join('; ');
             const obs = {
                 entry,
                 occurrences: 1,
@@ -10202,9 +11320,11 @@ function cmdMutationGate(options, flags, cwd, write) {
                 ...(fileLoadFailure !== undefined ? { fileLoadFailure } : {}),
                 ...(outputUnrecognised !== undefined ? { outputUnrecognised } : {}),
                 ...(receiptMismatch !== undefined ? { receiptMismatch } : {}),
-                ...(run?.failureReason !== undefined ? { runFailureReason: run.failureReason } : {}),
+                ...(entryRunFailureReason !== undefined ? { runFailureReason: entryRunFailureReason } : {}),
+                ...(entryInternalAttemptLog !== '' ? { internalAttemptLog: entryInternalAttemptLog } : {}),
                 ...(rebaselineExitCode !== undefined ? { rebaselineExitCode } : {}),
                 ...(rebaselineFailureReason !== undefined ? { rebaselineFailureReason } : {}),
+                ...(rebaselineAttribution !== undefined ? { rebaselineAttribution } : {}),
             };
             observations.push(obs);
             results.push(classifyMutationOutcome(obs));
@@ -10217,7 +11337,7 @@ function cmdMutationGate(options, flags, cwd, write) {
         if (rebaselineMode === 'final') {
             if (!json)
                 write('mutation-gate: final re-baseline of the restored tree …');
-            const finalRun = runSuite();
+            const finalRun = runSuite('final-rebaseline');
             const finalExit = finalRun.exitCode;
             if (finalExit !== 0) {
                 const what = finalExit === null ? `no exit code: ${finalRun.failureReason ?? 'unknown timeout / spawn failure'}` : `exit ${finalExit}`;
@@ -10228,6 +11348,12 @@ function cmdMutationGate(options, flags, cwd, write) {
                     ...obs,
                     rebaselineExitCode: finalExit,
                     ...(finalRun.failureReason !== undefined ? { rebaselineFailureReason: finalRun.failureReason } : {}),
+                    ...(finalRun.internalAttemptLog !== undefined
+                        ? { internalAttemptLog: [obs.internalAttemptLog, finalRun.internalAttemptLog].filter((log) => log !== undefined).join('; ') }
+                        : {}),
+                    ...(finalExit !== null && finalExit !== 0
+                        ? { rebaselineAttribution: attributeBaselineRedness(finalRun.output, entries.map((entry) => entry.file)) }
+                        : {}),
                 }));
                 results.length = 0;
                 results.push(...reclassified);
@@ -10247,7 +11373,7 @@ function cmdMutationGate(options, flags, cwd, write) {
     }
     const exitCode = mutationGateExitCode(results, baseline.ok);
     if (json) {
-        write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, rebaselineMode, baseline, results, summary: summarizeMutationResults(results), warnings, exitCode }, null, 2));
+        write(JSON.stringify({ packageDir: pkgDir, registryPath, testCommand: testCmd, rebaselineMode, baseline, results, summary: summarizeMutationResults(results), warnings, internalRetries, exitCode }, null, 2));
         return exitCode;
     }
     write(renderMutationReport(results, baseline, pkgDir));
@@ -11507,12 +12633,30 @@ function nameCheckScan(repoRoot) {
                 // Command names come from the dispatcher AND from the help block: a name that dispatches but
                 // is undocumented is still taken, and so is the reverse.
                 if (f.name === 'cli.ts') {
-                    for (const c of dispatchedCommandsIn(text))
-                        commands.add(c);
-                    const help = /^\s{2}dz ([a-z][a-z0-9-]*)/gm;
-                    for (let m = help.exec(text); m !== null; m = help.exec(text))
-                        if (m[1] !== undefined)
-                            commands.add(m[1]);
+                    // ONE enumeration, every consumer derives (ADR-001, feature command-count-triad). This
+                    // scan's question is "is the name TAKEN?", so taken = dispatched ∪ documented, which is
+                    // legitimately LARGER than the canonical command count — but it must be the SAME parse
+                    // the layer-1 parity test uses, not a second private regex that agrees by coincidence.
+                    // The any-indent `dispatchedCommandsIn` fallback stays for a cli.ts WITHOUT a main
+                    // `switch (command)` (none in this workspace today): a partial sweep would answer "free"
+                    // about a taken name, and that is the one answer this command may never give.
+                    let mainSwitchParsed = false;
+                    try {
+                        for (const c of dispatchedCommands(text))
+                            commands.add(c);
+                        for (const c of documentedCommands(text))
+                            commands.add(c);
+                        mainSwitchParsed = true;
+                    }
+                    catch { /* no main switch here — fall back to the broad regexes below */ }
+                    if (!mainSwitchParsed) {
+                        for (const c of dispatchedCommandsIn(text))
+                            commands.add(c);
+                        const help = /^\s{2}dz ([a-z][a-z0-9-]*)/gm;
+                        for (let m = help.exec(text); m !== null; m = help.exec(text))
+                            if (m[1] !== undefined)
+                                commands.add(m[1]);
+                    }
                 }
             }
         }
@@ -11527,6 +12671,75 @@ function nameCheckScan(repoRoot) {
         return { commands: new Set(), modules: new Map(), exports: new Map(), scanFailed: true };
     return { commands, modules, exports: exportsFound, scanned: { packages, files, exports: exportsFound.size, commands: commands.size } };
 }
+/**
+ * `dz brief-check <файл>` — проверить бриф роя на контракт вывода (ADR-001 swarm-brief-output-contract).
+ *
+ * Разбирает объявления брифа как ДАННЫЕ и отказывает поимённо: «бриф неверен» не говорит автору,
+ * что чинить, поэтому каждое нарушение называет ключ и причину.
+ *
+ * ЧЕСТНЫЙ ПРЕДЕЛ печатается ВМЕСТЕ С ЗЕЛЁНЫМ ответом: проверено, что бриф ОБЪЯВИЛ каталог и
+ * единицы, а не что агент им последует. Зелёная проверка, читаемая как гарантия поведения, хуже
+ * её отсутствия.
+ */
+function cmdBriefCheck(options, flags, cwd, write) {
+    const json = flags.has('json');
+    /**
+     * ВЕТКА «ПРОВЕРИТЬ НЕ УДАЛОСЬ» ТОЖЕ ОБЯЗАНА ОТВЕТИТЬ JSON-ом (находка 11).
+     *
+     * `--json` печатал человеческую строку на несуществующем файле, и потребитель, читающий вывод как
+     * JSON, получал ошибку разбора вместо структурного «не проверено». Признак `checked` — тот же
+     * трихотомический вердикт, что и коды выхода, только для машины: не «бриф плох», а «мы про него
+     * ничего не установили».
+     */
+    const unchecked = (reason, detail) => {
+        if (json)
+            write(JSON.stringify({ ok: false, checked: false, reason, detail }));
+        else
+            write(detail);
+        return 2;
+    };
+    // Только позиционный аргумент: `--file` был необъявленным псевдонимом, и страж дрейфа флагов
+    // справедливо на него указал — лишняя поверхность, которой нет в справке.
+    const file = options.get('_positional_0');
+    if (file === undefined || file.trim() === '') {
+        const code = unchecked('no-file', 'dz brief-check: name the brief file — dz brief-check <file> [--json]');
+        if (!json)
+            write('  A brief must declare: ' + SWARM_BRIEF_CONTRACT.map((c) => c.key).join(', '));
+        return code;
+    }
+    let text;
+    try {
+        text = readFileSync(resolve(cwd, file), 'utf-8');
+    }
+    catch {
+        // Нечитаемый файл — НЕ «бриф плох»: мы про него ничего не установили. Отдельный код выхода,
+        // чтобы отказ прибора не смешивался с отказом брифа.
+        return unchecked('unreadable', `dz brief-check: cannot read ${visibleText(file)}`);
+    }
+    const result = checkSwarmBrief(text);
+    if (json) {
+        // `checked: true` — вторая половина того же различителя: потребитель отличает «проверено и
+        // отвергнуто» от «проверить не удалось» полем, а не отсутствием поля.
+        write(JSON.stringify({ ...result, checked: true }));
+        return result.ok ? 0 : 1;
+    }
+    if (result.ok) {
+        // ЗНАЧЕНИЯ ИЗ БРИФА ОБЕЗВРЕЖИВАЮТСЯ И В ЗЕЛЁНОЙ СТРОКЕ (находка 10). Отказ их уже обезвредил,
+        // но подделывается ровно эта строка: управляющая последовательность в имени каталога стирает
+        // предыдущий вывод и печатает поверх него подделку.
+        write(`dz brief-check: OK — dir ${visibleText(result.outputDir ?? '')}, ${result.units.length} unit(s), assembly "${visibleText(result.assemblyUnit ?? '')}"`);
+        write('  LIMIT: this verifies the brief DECLARED the contract, not that the agent will follow it —');
+        write('  only comparing the directory against the unit list on an orchestrator tick can show that.');
+        write('  A filled-in template and an unedited one both pass: the parse cannot tell them apart.');
+        return 0;
+    }
+    write(`dz brief-check: REFUSED — ${result.violations.length} violation(s)`);
+    // Ядро уже обезвредило значения в причинах; повтор на слое печати — не суеверие, а граница:
+    // печатающий слой не обязан знать, кто именно из его источников уже почистил текст.
+    for (const v of result.violations)
+        write(`  ${v.rule}: ${visibleText(v.detail)}`);
+    return 1;
+}
 function cmdNameCheck(options, flags, cwd, write) {
     const repoRoot = resolve(options.get('project') ?? cwd);
     const json = flags.has('json');
@@ -12091,6 +13304,18 @@ function cmdFeatureAdrRecord(options, flags, cwd, write) {
         targetExists: existsSync(target),
         targetHasPair: flags.has('once') && existsSync(target),
         timestamp: new Date().toISOString(),
+        // WHO ran it: `--runner <id>` when the caller knows, otherwise this host. The workflow cannot
+        // supply it — it has no host inside its sandbox — so the identity is resolved here, at the one
+        // seam that runs outside. hostname() can throw on an exotic setup; an unresolvable runner stays
+        // ABSENT rather than becoming the string 'unknown', which would later join as if it were one.
+        runnerId: (options.get('runner') ?? '').trim() !== ''
+            ? (options.get('runner') ?? '').trim()
+            : (() => { try {
+                return hostname();
+            }
+            catch {
+                return null;
+            } })(),
     });
     if (decision.line === null)
         return emit(decision);
@@ -12445,12 +13670,21 @@ function cmdAmendmentCheck(options, flags, cwd, write) {
         // Paths in an amendment row are repo-relative, so they resolve against the repo root — not
         // against the feature directory, and not against wherever the caller happened to stand.
         const resolutions = resolveAmendments(rows, { readFile: (rel) => readOr(resolve(cwd, rel)) });
+        // A document that opens `## Amendments` twice cannot have its first heading answer for the
+        // rest (Codex round 6, P2). Counted per document and taken at its worst — one contradictory
+        // input is enough to make the run inconclusive.
+        const sectionCount = Math.max(ideation === null ? 0 : amendmentSectionCount(ideation), plan === null ? 0 : amendmentSectionCount(plan));
         const decision = decideAmendmentOutcome({
             sectionPresent,
             rows,
             resolutions,
             planSaysNone: plan !== null && planSaysNoAmendments(plan),
             missingFromPlan,
+            sectionCount,
+            // Fail-closed: measured on the document the rows would have come from (the plan when it has
+            // a section, otherwise the ideation report).
+            ambiguity: (plan !== null ? amendmentDeclarationAmbiguity(plan) : null)
+                ?? (ideation !== null ? amendmentDeclarationAmbiguity(ideation) : null),
         });
         return { slug, decision, resolutions };
     };
@@ -13443,6 +14677,143 @@ async function cmdQeBridge(options, flags, cwd, write) {
         cleanupIsolated();
     }
 }
+function scoreReceiptFiles(root) {
+    const featuresDir = join(root, 'features');
+    let features;
+    try {
+        features = readdirSync(featuresDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const receipts = [];
+    for (const feature of features) {
+        if (!feature.isDirectory())
+            continue;
+        const stateDir = join(featuresDir, feature.name, '.fa-state');
+        let entries;
+        try {
+            if (lstatSync(stateDir).isSymbolicLink())
+                continue;
+            entries = readdirSync(stateDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const match = /^score-(.+)\.json$/.exec(entry.name);
+            if (match === null || match[1] === undefined || match[1] === '')
+                continue;
+            const path = join(stateDir, entry.name);
+            receipts.push({ path, displayPath: relative(root, path), qeHash: match[1] });
+        }
+    }
+    return receipts.sort((a, b) => a.displayPath < b.displayPath ? -1 : a.displayPath > b.displayPath ? 1 : 0);
+}
+function scoreAggregateChainLine(text) {
+    if (text === '') {
+        return { line: 'chain: NOT_PRESENT — no aggregate evidence file was created', verification: null, defectAges: null };
+    }
+    const verification = verifyEventChainText(text);
+    const defectAges = classifyChainDefects(verification, verification.lines);
+    const kinds = new Map();
+    for (const defect of verification.defects)
+        kinds.set(defect.kind, (kinds.get(defect.kind) ?? 0) + 1);
+    const kindText = [...kinds.entries()].map(([kind, count]) => `${kind}: ${count}`).join(' · ');
+    const line = `chain: ${verification.ok ? 'OK' : 'FAILED'} · ${verification.chained} chained · ` +
+        `${verification.resets} recorded restart(s) · before-run defects ${defectAges.beforeRun.length} · ` +
+        `in-run defects ${defectAges.inRun.length} · current run ${defectAges.runRecords} record(s)` +
+        (kindText === '' ? '' : ` · ${kindText}`) +
+        ` — ${verification.scope}`;
+    return { line, verification, defectAges };
+}
+function cmdScoreAll(options, flags, cwd, write) {
+    const json = flags.has('json');
+    if (options.has('slug')) {
+        write(json
+            ? JSON.stringify({ error: '--all and --slug are mutually exclusive', exitCode: 1 })
+            : 'dz score: --all and --slug are mutually exclusive');
+        return 1;
+    }
+    const root = resolve(cwd, options.get('project') ?? '.');
+    const receiptFiles = scoreReceiptFiles(root);
+    if (receiptFiles.length === 0) {
+        const report = buildScoreAggregateReport([], [], 0);
+        const chain = scoreAggregateChainLine('');
+        if (json)
+            write(JSON.stringify({ ...report, chain: null, aggregatePath: '.dz/feature-adr/scorecards.jsonl', exitCode: 0 }, null, 2));
+        else {
+            write(renderScoreAggregateReport(report));
+            write(chain.line);
+        }
+        return 0;
+    }
+    const ts = new Date().toISOString();
+    const rows = [];
+    const unreadableReceipts = [];
+    for (const receipt of receiptFiles) {
+        try {
+            rows.push(scoreReceiptToAggregateRow({
+                content: readFileSync(receipt.path, 'utf8'),
+                qeHash: receipt.qeHash,
+                ts,
+            }));
+        }
+        catch {
+            unreadableReceipts.push(receipt.displayPath);
+        }
+    }
+    const storeDir = join(root, '.dz', 'feature-adr');
+    const aggregatePath = join(storeDir, 'scorecards.jsonl');
+    let finalText = '';
+    let finalRows = rows;
+    let appended = 0;
+    let storeError = null;
+    try {
+        const result = withNamedLockSync(storeDir, 'scorecards', () => {
+            let existingText = '';
+            try {
+                existingText = readFileSync(aggregatePath, 'utf8');
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            const fresh = dedupeScoreAggregateRows(rows, readScoreAggregateRows(existingText));
+            const appendText = appendChainedLines(fresh, readTailInfo(existingText));
+            if (appendText !== '')
+                appendFileSync(aggregatePath, appendText, { encoding: 'utf8', mode: 0o600 });
+            const settledText = existingText + appendText;
+            return { text: settledText, rows: readScoreAggregateRows(settledText), appended: fresh.length };
+        });
+        finalText = result.text;
+        finalRows = result.rows;
+        appended = result.appended;
+    }
+    catch (error) {
+        storeError = error instanceof Error ? error.message : String(error);
+    }
+    const report = buildScoreAggregateReport(finalRows, unreadableReceipts, appended);
+    const chain = scoreAggregateChainLine(finalText);
+    if (json) {
+        write(JSON.stringify({
+            ...report,
+            aggregatePath: '.dz/feature-adr/scorecards.jsonl',
+            chain: chain.verification === null ? null : { verification: chain.verification, defectAges: chain.defectAges },
+            storeError,
+            exitCode: 0,
+        }, null, 2));
+    }
+    else {
+        write(renderScoreAggregateReport(report));
+        write(chain.line);
+        if (storeError !== null)
+            write(`store error (nothing was claimed appended): ${storeError}`);
+    }
+    return 0;
+}
 function cmdScore(options, flags, cwd, write) {
     const json = flags.has('json');
     if (flags.has('help')) {
@@ -13451,13 +14822,14 @@ function cmdScore(options, flags, cwd, write) {
             write(JSON.stringify({ help: usage, exitCode: 0 })); // --json stays ONE document even for help
         else {
             write(usage);
+            write('dz score --all [--project <dir>] [--json] — sweep immutable score receipts into the append-only chained aggregate');
             write('  disciplines: ADR confirmation · discrimination · cross-model QE · live verification · README-first · learning loop · amendments');
             write('  descriptive-only, never a gate: a low score exits 0');
         }
         return 0;
     }
     for (const flag of flags) {
-        if (!new Set(['json', 'help']).has(flag)) {
+        if (!new Set(['json', 'help', 'all']).has(flag)) {
             write(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : `dz score: unknown option --${flag}\n  allowed: --slug <feature>, --project <dir>, --json`);
             return 1;
         }
@@ -13469,6 +14841,8 @@ function cmdScore(options, flags, cwd, write) {
             return 1;
         }
     }
+    if (flags.has('all'))
+        return cmdScoreAll(options, flags, cwd, write);
     const slug = options.get('slug') ?? '';
     // The delivery-check traversal lesson, upgraded to a WHITELIST: `.` slipped the blacklist and
     // silently aggregated the entire features/ tree as one "run" (Codex QE #2).
@@ -14562,7 +15936,7 @@ function cmdDeliveryCheck(options, flags, cwd, write) {
 /*  backlog — the Smart Backlog idea pipeline (feature smart-backlog)   */
 /* ------------------------------------------------------------------ */
 /** Thin dispatcher — ALL logic lives in harness-core/src/backlog.ts (05 architecture: handlers stay dumb). */
-async function cmdBacklog(options, flags, cwd, write) {
+async function cmdBacklog(options, flags, cwd, write, writeErr) {
     const projectRoot = resolve(cwd, options.get('project') ?? '.');
     const json = flags.has('json');
     const sub = options.get('_positional_0');
@@ -14580,6 +15954,8 @@ async function cmdBacklog(options, flags, cwd, write) {
         if (eff.adjusted && !json && eff.note !== undefined)
             write(`dz backlog: ${eff.note}`);
         const dryRun = flags.has('dry-run');
+        if (!dryRun && !allowLearningStoreWrite(projectRoot, flags, writeErr, 'dz backlog add'))
+            return 1;
         // Embed-form migration (register-inflation fix): v1 vectors are FULL-TEXT embeds, v2 queries are
         // bounded excerpts — comparing across the forms is a query-vs-row space split. Re-mirror once
         // (idempotent upsert), before the dedup search. Dry-run writes nothing, so it only WARNS.
@@ -14610,6 +15986,7 @@ async function cmdBacklog(options, flags, cwd, write) {
             const ideas = readIdeas(projectRoot);
             const match = ideas.find((i) => i.id === verdict.matchedId);
             let absorbErr;
+            let didWrite = false;
             if (!dryRun && match !== undefined) {
                 const snap = snapshotIdeas(projectRoot, join(projectRoot, '.dz', 'backlog', `ideas.pre-merge-${Date.now()}.jsonl`));
                 if (snap.error !== undefined)
@@ -14626,7 +16003,10 @@ async function cmdBacklog(options, flags, cwd, write) {
                 }).error;
                 match.uses += 1;
                 writeIdeas(projectRoot, ideas);
+                didWrite = true;
             }
+            if (didWrite)
+                refreshLearningStoreMark(projectRoot, writeErr, 'dz backlog add');
             if (json)
                 write(JSON.stringify({ action: 'duplicate', matchedId: verdict.matchedId, cosine: verdict.cosine, ...(verdict.containment !== undefined ? { containment: verdict.containment } : {}), ...(verdict.subsetMatch === true ? { subsetMatch: true } : {}), ...(topMatch !== undefined ? { topMatch } : {}), ...(eff.note !== undefined ? { effortNote: eff.note } : {}), ...(dryRun ? {} : { absorbedLogged: absorbErr === undefined, ...(absorbErr !== undefined ? { absorbedLogError: absorbErr } : {}) }), exitCode: 0 }, null, 2));
             else {
@@ -14688,6 +16068,7 @@ async function cmdBacklog(options, flags, cwd, write) {
         ideas.push(rec);
         writeIdeas(projectRoot, ideas);
         const mirror = await mirrorIdeaVector(projectRoot, rec); // best-effort — never blocks capture
+        refreshLearningStoreMark(projectRoot, writeErr, 'dz backlog add');
         if (json)
             write(JSON.stringify({ action: verdict.action, idea: rec, related: verdict.relatedIds, ...(verdict.demoted !== undefined ? { demoted: verdict.demoted } : {}), ...(topMatch !== undefined ? { topMatch } : {}), ...(eff.note !== undefined ? { effortNote: eff.note } : {}), gitignore: ignore, exitCode: 0 }, null, 2));
         else {
@@ -14887,8 +16268,18 @@ async function cmdBacklog(options, flags, cwd, write) {
         if (commitId !== undefined) {
             // Validated above (safe id + known id) BEFORE any early return.
             const idx = ideas.findIndex((i) => i.id === commitId);
+            // ОТМЕТКА ВРЕМЕНИ И ЖУРНАЛ ставятся ЗДЕСЬ, а не «где-нибудь потом».
+            // Измерено 2026-09-02: `grep -c statusTs cli.ts` давал НОЛЬ — оба пути смены статуса в этом
+            // файле меняли поле и не отмечали, когда. Отсюда 22 терминальные записи без отметки и
+            // невычислимое «сколько идея пробыла в работе».
+            const spinFrom = ideas[idx].status;
+            const spinTs = new Date().toISOString();
             ideas[idx].status = 'in-progress';
+            ideas[idx].statusTs = spinTs;
             writeIdeas(projectRoot, ideas);
+            if (!appendTransition(projectRoot, { id: commitId, from: spinFrom, to: 'in-progress', ts: spinTs, by: 'backlog roulette --commit' })) {
+                write('dz backlog: переход НЕ записан в журнал — наблюдение потеряно (сам статус изменён)');
+            }
             pick = ideas[idx];
             committed = true;
         }
@@ -14963,6 +16354,7 @@ async function cmdBacklog(options, flags, cwd, write) {
             }
             else
                 embed = 'stale';
+            refreshLearningStoreMark(projectRoot, writeErr, 'dz backlog edit');
         }
         if (json) {
             write(JSON.stringify({ verb: 'edit', ...report, embed, exitCode: report.ok ? (embed === 'stale' ? 1 : 0) : 1 }, null, 2));
@@ -14997,9 +16389,15 @@ async function cmdBacklog(options, flags, cwd, write) {
         const goalMap = readGoalMap(projectRoot);
         const related = ideas.filter((i) => rec.relatedIds.includes(i.id));
         const staging = stageEnrichment(projectRoot, rec, related, goalMap);
+        const enrichFrom = rec.status;
+        const enrichTs = new Date().toISOString();
         rec.status = 'enriched';
+        rec.statusTs = enrichTs;
         rec.enrichedPath = `features/${staging.slug}`;
         writeIdeas(projectRoot, ideas);
+        if (!appendTransition(projectRoot, { id: rec.id, from: enrichFrom, to: 'enriched', ts: enrichTs, by: 'backlog enrich' })) {
+            write('dz backlog: переход НЕ записан в журнал — наблюдение потеряно (сам статус изменён)');
+        }
         if (json)
             write(JSON.stringify({ slug: staging.slug, scaffoldPath: staging.scaffoldPath, handoff: 'idea2prd-manual', exitCode: 0 }, null, 2));
         else {
@@ -15044,6 +16442,10 @@ async function cmdBacklog(options, flags, cwd, write) {
         else if (form.action === 'deferred' && !json)
             write(`dz backlog: ⚠ embed-form migration deferred (${form.error ?? 'unknown error'})`);
         const report = await harmonizeBacklog(projectRoot, { apply, ...(thr !== undefined ? { threshold: Number(thr) } : {}) });
+        if (apply) {
+            refreshLearningStoreMark(projectRoot, writeErr, 'dz backlog harmonize --apply');
+            storeGuardResetReminder(projectRoot, writeErr, 'dz backlog harmonize --apply');
+        }
         if (json) {
             write(JSON.stringify({ ...report, exitCode: 0 }, null, 2));
             return 0;
@@ -15342,17 +16744,19 @@ function cmdStats(cwd, write) {
     }
     const dirs = readdirSync(baseDir, { withFileTypes: true }).filter((e) => e.isDirectory());
     const packages = dirs.length;
-    let totalSkills = 0;
-    let skillPacks = 0;
-    for (const dir of dirs) {
-        if (dir.name.startsWith('skills-')) {
-            skillPacks++;
-            const skillDir = join(baseDir, dir.name);
-            const skillDirs = readdirSync(skillDir, { withFileTypes: true })
-                .filter((e) => e.isDirectory() && existsSync(join(skillDir, e.name, 'SKILL.md')));
-            totalSkills += skillDirs.length;
-        }
-    }
+    // Backlog e160aeee. This used to walk the tree ITSELF, and was wrong in two independent ways:
+    // it counted only packages whose NAME starts with `skills-` (health-advisor, p-replicator,
+    // keysarium and trip-planner were therefore invisible), and it knew only ONE of the three skill
+    // layouts. Result: 203 here against 250 from `dz registry` on the same tree — two counters of one
+    // quantity, each unable to refute the other because neither knew the other existed.
+    //
+    // The fix is structural, not arithmetic: there is now ONE enumerator, and both commands ask it.
+    // Pinned by test/stats-registry-parity.test.ts, whose red half is this exact divergence.
+    // The registry already PUBLISHES these totals; recomputing them from `entries` here would be a
+    // third implementation of the same count, which is the very defect being fixed.
+    const registry = buildRegistry(cwd);
+    const totalSkills = registry.totalSkills;
+    const skillPacks = registry.totalPacks;
     const targets = TARGET_NAMES.length;
     const presets = PRESET_NAMES.length;
     write(`dz stats — DZ Harness Hub`);
@@ -15837,7 +17241,28 @@ export async function runCli(argv, io = {}) {
         // let a guard treat "I could not tell you" as "I answered you".
         return version === 'unknown' ? 1 : 0;
     }
-    if (command === '' || command === 'help' || flags.has('help')) {
+    // `-h` is the most-typed help flag and is NOT a command: before the unknown-command contract
+    // landed it fell through to the switch and still printed usage; afterwards it would have died
+    // with exit 2 and an empty stdout (measured regression, cross-model QE M1). It belongs beside
+    // `-v` above — an argv-level flag, resolved before command dispatch.
+    if (argv[0] === '-h') {
+        write(USAGE);
+        return 0;
+    }
+    // A bare `--typo` leaves the command empty, so the usage branch reported SUCCESS on a misspelled
+    // FLAG exactly as it used to on a misspelled VERB (cross-model QE M2): `dz --frobnicate` exited 0
+    // with 30 KB of usage. The refusal is deliberately narrowed to the no-command case, because the
+    // warn-don't-refuse decision above is measured and still stands: with a command present, an
+    // unrecognised name may simply be missing from KNOWN_CLI_FLAGS and refusing would break working
+    // invocations. With NO command there is nothing the flag could belong to, so it is a usage error.
+    if (command === '') {
+        const strayNames = unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS).map((n) => n.name);
+        if (strayNames.length > 0) {
+            writeErr(`dz: unknown option --${strayNames[0]} — run 'dz help' for usage`);
+            return 2;
+        }
+    }
+    if (command === '' || command === 'help' || (flags.has('help') && DZ_COMMANDS.includes(command))) {
         write(USAGE);
         return 0;
     }
@@ -15885,17 +17310,21 @@ export async function runCli(argv, io = {}) {
             case 'teach':
                 return await cmdTeach(options, flags, cwd, write, writeErr, io.interactive ?? process.stdout.isTTY === true, io.teachGuardRunner ?? teachGuard, io.teachReinforceRunner ?? runTeachGuardReinforcement);
             case 'consolidate':
-                return await cmdConsolidate(options, flags, cwd, write);
+                return await cmdConsolidate(options, flags, cwd, write, writeErr);
             case 'recall':
                 return await cmdRecall(options, flags, cwd, write, writeErr, io.classMatcher);
             case 'vector':
-                return await cmdVector(options, flags, cwd, write);
+                return await cmdVector(options, flags, cwd, write, writeErr);
             case 'brain':
                 return await cmdBrain(options, flags, cwd, write, readStdin);
             case 'statusline':
-                return cmdStatusline(options, flags, cwd, write, readStdin);
+                return cmdStatusline(options, flags, cwd, write, readStdin, writeErr);
+            case 'store-guard':
+                return await cmdStoreGuard(options, flags, cwd, write, writeErr, io.stdin, io.interactive ?? process.stdin.isTTY === true);
             case 'usage':
                 return cmdUsage(options, optionLists, flags, cwd, write);
+            case 'chain':
+                return cmdChain(options, flags, cwd, write);
             case 'claim-check':
                 return cmdClaimCheck(options, optionLists, flags, cwd, write);
             case 'lint':
@@ -15917,7 +17346,7 @@ export async function runCli(argv, io = {}) {
             case 'diff':
                 return cmdDiff(options, cwd, write);
             case 'recommend':
-                return cmdRecommend(options, cwd, write);
+                return cmdRecommend(options, flags, cwd, write);
             case 'upgrade':
                 return cmdUpgrade(options, flags, cwd, write, writeErr);
             case 'auto-canonicalize':
@@ -15959,15 +17388,29 @@ export async function runCli(argv, io = {}) {
             case 'mr-rakes':
                 return await cmdMrRakes(options, flags, cwd, write);
             case 'retro':
-                return await cmdRetro(options, flags, cwd, write);
+                return await cmdRetro(options, flags, cwd, write, readStdin);
             case 'feature-adr-setup':
                 return cmdFeatureAdrSetup(options, flags, cwd, write, writeErr);
             case 'challenge':
                 return cmdChallenge(options, flags, cwd, write);
             case 'discrimination-check':
                 return cmdDiscriminationCheck(options, flags, cwd, write);
-            case 'mutation-gate':
-                return cmdMutationGate(options, flags, cwd, write);
+            case 'mutation-gate': {
+                try {
+                    return cmdMutationGate(options, flags, cwd, write, io.mutationGateRunner);
+                }
+                catch (error) {
+                    const raw = error instanceof Error ? error.message : String(error);
+                    const head = Array.from(raw.split(/\r?\n/, 1)[0]?.trim() || 'unknown internal error').slice(0, 160).join('');
+                    if (flags.has('json')) {
+                        write(JSON.stringify({ verdict: 'INCONCLUSIVE', reason: 'runner-internal-error', error: head, exitCode: 1 }));
+                    }
+                    else {
+                        write(`mutation-gate: INTERNAL ERROR (${head}) — verdict INCONCLUSIVE, exit 1`);
+                    }
+                    return 1;
+                }
+            }
             case 'delivery-check':
                 return cmdDeliveryCheck(options, flags, cwd, write);
             case 'skills-verify':
@@ -15992,6 +17435,8 @@ export async function runCli(argv, io = {}) {
                 return cmdTgPost(options, flags, cwd, write);
             case 'name-check':
                 return cmdNameCheck(options, flags, cwd, write);
+            case 'brief-check':
+                return cmdBriefCheck(options, flags, cwd, write);
             case 'provenance-check':
                 return cmdProvenanceCheck(options, flags, cwd, write);
             case 'feature-adr-record':
@@ -16009,7 +17454,7 @@ export async function runCli(argv, io = {}) {
             case 'qe-bridge':
                 return await cmdQeBridge(options, flags, cwd, write);
             case 'backlog':
-                return await cmdBacklog(options, flags, cwd, write);
+                return await cmdBacklog(options, flags, cwd, write, writeErr);
             case 'routing':
                 return cmdRouting(options, flags, cwd, write);
             case 'bto-optimize':
@@ -16021,9 +17466,8 @@ export async function runCli(argv, io = {}) {
             case 'import-ecc':
                 return await cmdImportEcc(options, flags, cwd, write);
             default:
-                write(`dz: unknown command ${JSON.stringify(command)}`);
-                write(USAGE);
-                return 1;
+                writeErr(`dz: unknown command ${JSON.stringify(command)} — run 'dz help' for the command list`);
+                return 2;
         }
     }
     catch (error) {