@dzhechkov/harness-core 0.8.11 → 0.8.21

package/LICENSE

@@ -19,3 +19,16 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+Third-party licenses
+
+This package bundles the frontend-design skill template, which is licensed
+under the Apache License, Version 2.0 (not MIT). The full Apache-2.0 license
+text ships alongside the skill at:
+
+  templates/.claude/skills/frontend-design/LICENSE.txt
+
+All other contents of this package are covered by the MIT license above.
+The package's SPDX license expression is: MIT AND Apache-2.0

package/README.md

@@ -3,6 +3,45 @@
 Shared logic for the DZ harness — the engine behind `@dzhechkov/harness-cli`
 and any other consumer.
 
+## Per-turn admission debt (`session-retro.ts`)
+
+The engine behind `dz retro` and `dz retro --scan-tail`: it turns a session transcript into events,
+detects recurring PROCESS rakes, and folds an **admission debt** — an error narrated in chat with no
+`dz teach` behind it.
+
+Public surface used by the CLI: `streamSessionEvents`, `parseSessionJsonl`, `detectProcessRakes`,
+`buildRetro`, `renderRetro`, `renderDrill`, `retroLessonText`, `foldAdmissionDebt`, `runRetroTailScan`,
+`retroSentinelIsFresh`, `renderRetroDebtDirective`, `findLatestTranscript`, **`resolveScanTailTranscript`**
+(new), plus the types `SessionEvent`, `RetroPendingSentinel`, `TailScanOutcome` and **`ScanTailSource`**
+(new), and the constants `RETRO_DEBT_MARKER`, `RETRO_PENDING_FILE`, `RETRO_SCAN_STATE_FILE`,
+`RETRO_SCAN_LOCK_NAME`, `PROCESS_SIGNATURES`, `DEFAULT_DRILL_THRESHOLD`.
+
+`SessionEvent` carries an optional `toolUseId` — `tool_use.id` on a call, `tool_result.tool_use_id` on
+its result — which is the pairing key the debt fold needs to tell WHICH command a result belongs to.
+
+Load-bearing properties, each pinned by a test that goes RED when the property is mutated out
+(`test/session-retro.test.ts`, `test/retro-scan-tail-source.test.ts`, registry ids in
+`test/mutation-registry.json`):
+- **Block order survives parsing.** An admission text block is emitted BEFORE the `tool_use` of the same
+  message, so admitting and teaching in one turn reads as settled (`retro-p1-1-block-order`).
+- **Only an executed Bash teach can pay.** A `tool_result` echoing the phrase, an `echo`/`grep` decoy, or
+  a non-Bash tool call never settles anything (`retro-p1-2-bash-only-teach`).
+- **A newline is a command boundary.** The dominant field form (`DZ=…\n$DZ teach … --project $B`) pays;
+  every decoy still stays armed (`retro-adr5-newline-boundary`).
+- **The RECEIPT settles, not the command text.** A teach with a `tool_use_id` is registered by its call
+  and cleared only by that call's own result carrying a line `dz teach` prints on a real write — so
+  `exit 0\ndz teach "never runs"` pays nothing (`retro-r1-teach-receipt-required`).
+- **Every awaiting teach is retained.** Two parallel teach calls cannot cancel each other out; if both
+  results come back receipt-less the debt stays armed (`retro-r3-retain-awaiting-teaches`).
+- **An admission is a confession, not a bug-fix report.** The Russian branch is an allowlist of verb and
+  adverb forms, so «Я ошибку валидации исправил» — a NOUN in a completion report — arms nothing
+  (`retro-r3-admission-verb-only`).
+- **The scan never guesses its transcript.** `resolveScanTailTranscript` takes an explicit flag, then a
+  positional path, then the Stop hook's stdin `transcript_path`; with none it returns
+  `{path: null, reason}` rather than the newest file on disk.
+- **No lost update.** The whole read→fold→write tail-scan transaction runs under the `retro-scan` named
+  lock beside the store it guards; contention advances nothing (`retro-p1-3-unlocked-scan`).
+
 ## Lesson payoff (bandit re-rank)
 
 `lesson-bandit.ts` / `lesson-payoff.ts` add a **payoff axis** to lesson recall: a Beta posterior per
@@ -54,6 +93,8 @@ explicit skills-only short circuit. `--no-verify` cannot authorize emission. A C
 | `sign` | `listPackFiles`, `listSignablePackFiles`, `verifyManifest`, `verifySbomAgainstManifest` | Shared node_modules/.git exclusions; verify sees MORE than sign (smuggled symlinks still fail). After authenticating the Ed25519 manifest, verification derives the canonical CycloneDX document from those signed entries and requires the no-follow `sbom.json` read to match it exactly. Current/v3 signing refuses malformed, duplicate-key, or precision-losing root `package.json` JSON and preserves object order throughout `exports`, `imports`, and `typesVersions`, so condition-order entry-point changes cannot hide behind packer-noise canonicalisation. Readers retain v1/v2 compatibility |
 | `guard` | `evaluateGuard`, `resolveRules`, `scanSecrets`, `DEFAULT_RULES`, `parsePnpmLockImporters` | Declarative HARD/SOFT constraint engine behind `dz guard` (publish/teach/consolidate pre-flight; fail-closed). The SOFT `lockfile-in-sync` rule compares each workspace package's `@dzhechkov/*` dep specs against the specifier `pnpm-lock.yaml` records for that importer — the `ERR_PNPM_OUTDATED_LOCKFILE` CI break, caught at publish. Its lockfile reader (`parsePnpmLockImporters`) is a pure RECOGNISE-OR-REFUSE parser (no YAML dependency): it reads only the `lockfileVersion: 9`+ importer layout and returns `undefined` for a legacy v5/v6 file, a truncated one, or any shape that leaves an importer with zero specifiers — because a half-parse reports every real dependency as "not recorded". The rule FAILS OPEN on that `undefined` (no violation) and is pinned SOFT-only via `SOFT_ONLY_RULES`, so no config can turn a parser that admits uncertainty into a publish blocker. The HARD `licence-hold` rule (+ `LICENCE_HOLD_PENDING_MARKER`) is the machine side of a declared licence precondition (`package.json.licenseHold`, ADR-001 hermes-claude-adaptation): silent while the pack stays `private:true` (the npm layer refuses it), it HARD-blocks publish the moment the pack becomes publishable with the hold unsatisfied — LICENSE absent/empty or still carrying the `<!-- PENDING:` grant placeholder, no `Grant-Confirmation: <url>` line, empty THIRD_PARTY_NOTICES, or a non-SPDX license field |
 | `slop-lint` | `slopLint`, `parseSlopRegistry`, `validateSlopLintConfig`, `DEFAULT_SLOP_CONFIG`, `BUNDLED_SLOP_REGISTRY_URL` | Pure deterministic EN/RU lexical-density and structural-style analysis behind advisory `dz lint`. It excludes protected Markdown, requires at least two distinct registered marker IDs in one paragraph, divides marker hits by `max(visibleWords, wordFloor)`, and reports bullet walls or registered three-adjective stacks independently. Under the default `4`/`2`/`25` policy, the distinct-ID floor owns paragraphs through 50 words and density is the dilution cap from 51 words onward. The core performs no file, network, clock, locale, or process I/O; policy/config failures are typed diagnostics rather than empty clean results. |
+| `stem` | `tokenize`, `stemToken`, `stems` | Zero-dependency EN/RU word-form normalisation (light suffix stripping applied to BOTH sides of a match) behind registry search and `recommend`, so «анализы» finds «анализ»; a RU topic dictionary maps Russian queries onto catalogue topics, and an unmapped topic is reported as a miss rather than silently widened. |
+| `course-staleness` | `classifyCourseStaleness`, `CourseStalenessState`, `CourseStalenessInput`, `CourseStalenessResult` | Pure tutorial/package parity classifier. It distinguishes `S0 SHIPPED`, `S3 TUTORIAL_STALE`, `S4 PACKAGE_BEHIND`, malformed/mismatched/unknown registry inputs, and—load-bearing—`E2 UNSTAMPED`; an absent source stamp can never collapse into shipped. The caller supplies registry facts, so classification performs no file, process, clock, or network I/O. |
 | `backlog` + `backlog-embed` | `dedupIdea`, `classifyDedup`, `dedupPairBand`, `dedupEmbedText`, `lexicalContainment`, `ensureBacklogEmbedForm`, `recordAbsorption`, `alignIdea`, `spinRoulette`, `readGoalMapDetailed`, `parseEffort`, `ensureBacklogGitignored`, `harmonizeBacklog`, `transitionIdeas`, `checkTransition`, `resolveIdPrefix`, `IDEA_TRANSITIONS` | The Smart Backlog engine behind `dz backlog`: status lifecycle via `transitionIdeas` (`ship`/`drop`/`reopen` against the `IDEA_TRANSITIONS` table — unique-short-prefix resolution, idempotent ship/drop no-ops, non-idempotent reopen, all-or-nothing fail-closed batches, line-preserving atomic JSONL rewrite that keeps every non-status byte of untouched records); content-addressed idea records in `.dz/backlog/ideas.jsonl`, semantic dedup over the REUSED agentdb vector namespace (`dz-backlog` — no second store), weighted-max GoalMap alignment, and a seeded weighted roulette. Dedup is TWO-SIGNAL since the register-inflation fix (MEASURED 2026-08-11 on the real 105-idea store: full-length embeds INVERTED the signal on long texts — genuine paraphrases 0.35–0.61 vs topically disjoint long-RU pairs up to 0.9195): `dedupEmbedText` embeds a bounded 400-char excerpt (`backlog-embed.ts`, one form shared by query/mirror/reindex so vectors can never split spaces; `ensureBacklogEmbedForm` re-mirrors v1 stores once, batched), and `dedupPairBand` requires a cosine-threshold DUPLICATE to also share subject vocabulary (`lexicalContainment` ≥ 0.3, else demoted to RELATED with the pair reported — the 0.941 register-only absorption) while promoting a same-idea re-capture at a different length (containment ≥ 0.95, cosine ≥ 0.75) to a subset duplicate; `recordAbsorption` keeps every absorbed text in `absorbed.jsonl` so a wrong verdict is reversible (mutation-defended: `backlog-dedup-demotion-corroboration`, hand-verified 6 red). Every band/weight decision is a PURE function. `classifyDedup` also reports the top-1 match id alongside the cosine (the calibration surface for the 0.92 duplicate band — observational, it never moves the verdict); `readGoalMapDetailed` returns the entries the defensive reader DROPPED with a reason AND the fields it REPAIRED with their raw values (a weight clamped before validation made the validator's out-of-range branch dead code), so `goals --validate` can never report a vacuous "valid (0 goals)" nor hide a `weight: 7`; `parseEffort` returns a printable note for every clamp; `ensureBacklogGitignored` gitignores the store on first write (raw ideas are private prompt-class content) — atomically, preserving the file's dominant EOL, recognising every plain spelling of an existing rule (`/.dz/`, `.dz/**`, …) via `backlogIgnoreStatus`, and obeying a `!` negation as an explicit user opt-out instead of overriding it |
 | `no-stubs` | `scanStubs`, `checkNoStubs`, `scannableStubPath`, `STUB_MARKERS`, `STUB_PHRASES`, `STUB_SCAN_EXTENSIONS` | Pure unfinished-stub scanner behind the SOFT `no-stubs` publish rule (backlog 0b403a0106103901, Karpathy-Michaels rule XI): bare markers (`TODO`/`FIXME`/`HACK`/`XXX`/`PLACEHOLDER`) case-SENSITIVE with hard word boundaries (`hackathon`/`todos`/a marker inside a hash never fire; MEASURED: relaxing case doubles this repo's hits and adds only prose) + the `implement later` phrase case-insensitive. SCOPE = the CHANGE-SET (the working-tree `git status --porcelain -uall` diff — `-uall` so a brand-new untracked DIRECTORY is scanned file-by-file instead of collapsing to one invisible `?? newdir/` line; `.gitignore` semantics unchanged), never the whole tree — MEASURED: a tree-wide scan is 32+25 hits of mostly ancient legitimate markers, i.e. noise that gets a gate switched off. Markdown gets PROSE scoping (fenced blocks + backticked spans are QUOTES, not stubs). Waiver-with-REASON only, per line (`no-stubs: <reason>`) or per path (`.dz/guard.json` `stubWaivers`, the feature-adr-setup --guards shape); a reasonless waiver is REFUSED as its own finding and exempts nothing. Self-exemption is STRUCTURAL: every marker in the module and its tests is assembled from string fragments, so the gate's own source scans clean — a tested property, not a path skip. Fail-open on missing evidence (no change fact / ungathered contents ⇒ nothing reported) but never fail-SILENT: skipped scannable files (deleted/oversize/unreadable/beyond the file cap) surface as ONE aggregate `notes` entry in the `GuardResult` + audit record — information that can never move the verdict. KNOWN LIMITS are documented at the top of `no-stubs.ts` instead of implied away (whole-line inline waiver token = layer-4 auditability defence; reason QUALITY not judged; boolean fence model, not CommonMark; git-quoted paths undecoded; TS-monorepo extension allowlist; worktree-not-index reads; exact-string config-waiver paths). Mutation-defended (`no-stubs-bare-marker-fires` observed 10 red, `no-stubs-skipped-note-emitted` observed 2 red) |
 | `feature-adr-setup` (P3) | `renderGuardsConfig`, `renderGuardsRunner` | Scaffolds deterministic guard tests into a TARGET project: `guards.config.json` + a zero-dependency `check.mjs` runner (loc-cap, secret-scan, frozen-file sha256 pins, waivers-with-reasons) — `dz feature-adr-setup --guards` |
@@ -69,7 +110,7 @@ explicit skills-only short circuit. `--no-verify` cannot authorize emission. A C
 | `feature-adr-training-pairs` (in `feature-adr-checkpoints`) | `buildTrainingPair`, `serializeTrainingPair`, `trainingPairPath`, `trainingPairAppendCmd`, `modelFamily`, `TRAINPAIR_SCHEMA_VERSION`, `TRAINPAIR_MAX_IO_CHARS`, `TRAINPAIR_PRIVACY_NOTE` | The PURE half of feature-adr TRAINING-PAIR capture (backlog 70e0f083): every checkpointed stage emits one SFT-ready JSONL record — STAGE INPUT (full prompt/context) → STAGE OUTPUT (artifact/result) → EVALUATION {QE grade, gradedBy, lessonsInjected} with provenance {model, FAMILY ∈ claude/codex, role} — to `.dz/fa-training/<slug>/<stage>.jsonl` (one file per stage), raw material for future local-model fine-tuning. FAMILY is load-bearing: the downstream dataset must honour the cross-model rule (QE pairs from a DIFFERENT family than the coder). Oversize guard: input+output over 48k chars is TRUNCATED with a named marker + full-text fnv1a64 — never silently dropped, never unbounded. A stage without a QE grade (router) records `grade:null` honestly. Deterministic: `ts` is passed in (the workflow fills it shell-side). Capture is default-ON in the workflow, opt-out `args.captureTrainingPairs:false`, non-blocking (a capture failure never fails the run). PRIVACY: pairs may contain target-repo code; the capture dir carries a README note; NOT gitignored by explicit owner decision. RU: тренировочные пары вход→выход→оценка с каждого прогона feature-adr — сырьё для будущей локальной модели |
 | `reqe` | `shouldEmitReqeDebt`, `buildReqeDebt`, `parseReqeDebt`, `buildReqeBrief`, `extractReportGrade`, `settleReqeDebt`, `renderReqeList`, `REQE_SCOPE` | The pure half of `dz reqe` — the re-QE debt ledger: when feature-adr's usage-adaptive override made Step-8 QE run on the coder's OWN family (the cross-model guard consciously suspended, FR-2.9), the run records a debt in `features/<slug>/.fa-state/reqe-due.json`. Emission is the NARROW case only (same-family + the ` (usage-switched)` label — never every switch, never the no-override Claude belt); settlement is FAIL-CLOSED: an existing, non-trivial report naming exactly ONE line-anchored grade (`GRADE A-F` boilerplate and `A through F` ranges refused, ambiguity refused), never the run's own 08_qe_report.md. Debts carry the emitting run's stamp so an old settlement never immunizes a fresh run. HONEST SCOPE printed everywhere: nothing re-runs QE automatically; the validator proves procedural soundness, not authorship. RU: снятый под лимитом гард «кодер не ревьюит сам себя» становится долгом на диске, а не памяткой |
 | `trace-bundle` | `buildBundle`, `serializeBundle`, `parseBundle`, `selectLedgerRows`, `resolveRunMeta`, `foldAttribution`, `planImport` | The PURE half of `dz workflow-trace export/import` — one run's telemetry as one movable file. No fs, no clock, no randomness: it DECIDES and the caller does the I/O, which is what makes the fail-closed import testable without ever pointing a test at a real project (`planImport` returns the refusals as a VALUE, not as a side effect). Run addressing is the existing one, reused rather than rebuilt. Carries EVENTS, not aggregates: the single derived value travels alongside the records it was folded from, marked derived and naming its rule, so deleting it loses nothing but convenience — last-writer-wins by timestamp is a stated CHOICE, not a truth. `resolveRunMeta` reads the harness's own workflow records and judges each RECORD, not the slug: one historical sibling must not poison a usable one (MEASURED: 1 slug of 32 was being thrown away whole). Its reason set is closed and exactly one value is ACTIONABLE — `layout-unrecognised` means the harness layout changed; `predates-model-routing` means history. That split exists because the actionable reason fired on 3 of 32 slugs of untouched data, and an alarm that sounds on normal operation is not an alarm. RECOGNISE-OR-REFUSE: a record whose fields are gone yields a reason and NO data, never a half-parse that would report a model-blind run as model-known |
-| `statusline` | `statuslineData`, `readFeatureAdrState`, `writeFeatureAdrState`, `featureAdrStateDir`, `featureAdrStatePath`, `FeatureAdrState` | The live self-learning panel behind `dz statusline`, plus the LIVE-RUN segment two producers share. Each producer owns a per-slug slot under `.dz/feature-adr/learning-state/` and stamps `kind: 'feature-adr' \| 'loop'` (absent ⇒ `feature-adr`, so legacy states keep their meaning); `readFeatureAdrState` arbitrates by `(kind rank, ts)` — a fresh `feature-adr` state OUTRANKS any `loop` state, because a generated loop writes zero recalled/stored counters far more often and plain freshest-wins would empty the panel of the very thing it exists to show. Candidates are stat'ed and ordered newest-first BEFORE the bounded slice, so truncation can only ever drop the least-recent slot — a cap over an unsorted listing could hide the live slot behind older ones (MEASURED: 81 slots, the live one invisible). The render path is strictly READ-ONLY (~300 ms budget); housekeeping — a 24 h prune — belongs to the write path alone. Hostile slugs are sanitized to one bounded filename component and cannot escape the directory. Nothing older than 30 minutes is surfaced |
+| `statusline` | `statuslineData`, `readFeatureAdrState`, `writeFeatureAdrState`, `writeFeatureAdrStateDetailed`, `renderFeatureAdrPhaseLine`, `featureAdrStateDir`, `featureAdrStatePath`, `FeatureAdrState`, `WriteFeatureAdrStateInput`, `WriteFeatureAdrStateResult` | The live self-learning panel behind `dz statusline`, plus the LIVE-RUN segment two producers share. Each producer owns a per-slug slot under `.dz/feature-adr/learning-state/` and stamps `kind: 'feature-adr' \| 'loop'` (absent ⇒ `feature-adr`, so legacy states keep their meaning); `readFeatureAdrState` arbitrates by `(kind rank, ts)` — a fresh `feature-adr` state OUTRANKS any `loop` state, because a generated loop writes zero recalled/stored counters far more often and plain freshest-wins would empty the panel of the very thing it exists to show. Candidates are stat'ed and ordered newest-first BEFORE the bounded slice, so truncation can only ever drop the least-recent slot — a cap over an unsorted listing could hide the live slot behind older ones (MEASURED: 81 slots, the live one invisible). The render path is strictly READ-ONLY (~300 ms budget); housekeeping — a 24 h prune — belongs to the write path alone. Hostile slugs are sanitized to one bounded filename component and cannot escape the directory. Nothing older than 30 minutes is surfaced |
 | `operations` | `runInit`, `runSync`, `runVerify`, `runDoctor` | The harness operations, returning structured reports. `InitReport` and `SyncReport` carry an additive, always-present `failures: readonly SkillLoadFailure[]` (empty when nothing failed): a single unloadable `SKILL.md` used to throw out of the whole loop, so `dz init`/`dz install`/`dz sync` reported NOTHING at all. They now skip, collect and name — skipping without a record would only trade a loud failure for a silent one. `runDoctor` is deliberately untouched: it was never a throw site, and a negative test asserts it gained no `failures` field |
 | `release` | `collectPackageFacts`, `selectAffectedPackages`, `planReleaseGates`, `classifyGateExecutions`, `buildFailureIssue`, `firstOutputLine` | Pure verified-release engine behind `dz release`: plans 4 HARD gates (tests / `pnpm audit --prod` / `node --check` / bin smoke-boot) as DATA and classifies injected results fail-closed — an unbuilt package (declared `build` script, no dist JS) is a `MISSING_DIST` failure, a template-only pack is a named `SKIP_NO_ARTIFACTS` skip, `selectAffectedPackages` fail-opens to the full set when the changed-file list is unavailable |
 | `parity` | `TARGET_CAPABILITIES`, `PARITY_FEATURES`, `computeParity`, `buildParityMatrix` | Declarative target-parity model behind `dz parity`: verified capability flags per target × feature FORMS with requirements; the feature×target matrix is always COMPUTED (never hand-written), and the model must classify exactly `TARGET_NAMES` — an unclassified new target refuses to compile |
@@ -232,6 +273,50 @@ inconclusive until re-probed). Both are load-bearing:
 `runtime: 'claude-code' | 'codex'` (absent ⇒ `claude-code`), and the compaction aggregate carries a
 `runtimes` set union so provenance survives the lossy path.
 
+## Destructive-command guard (`classifyDestructive` / `decideDestructiveHook`)
+
+A pre-execution veto on the ONE class of loss the harness has actually suffered: a literal shell
+deletion aimed at its own stores. `classifyDestructive(command)` is pure and returns one of three
+verdicts — `refuse` (a deletion verb with a literal operand inside `.dz/`, `.agentic-qe/`, or a
+database file such as `*.db` / `*.sqlite`), `allow`, or `undecidable` (the operand is built by the
+shell: `$var`, `$(…)`, globs, a `bash -c` string that itself expands something). Every refusal names
+the path AND the rule id from `DESTRUCTIVE_RULES`; `undecidable` is printed, never silently mapped
+to either side.
+
+The scope is narrow by DECIDABILITY, not by taste — MEASURED by
+`bash scratchpad/corpus2.sh r17` on a 20 938-command corpus of real session commands: 35 refusals
+(0.167 %), 45 undecidable, the rest allowed; both verdict lists are byte-identical to R16. Four
+limits are printed with every verdict
+so nobody reads more into it than it does: (1) it sees the command text, never the filesystem;
+(2) an operand assembled at runtime is `undecidable`; (3) only the four deletion verbs `rm`, `rmdir`, `unlink`, `shred` are heads — `git rm`, `find -delete`
+and a `>` truncation are deliberately outside the scope;
+(4) quotes are decoded ONLY under a deletion verb or a table-declared shell command carrier:
+shell `-c`, npm/npx `-c`/`--call`, or pnpm's global `-c`/`--shell-mode` before `exec`. Under any
+other head the quoted text is text ABOUT a command, and heredoc / comment bodies are never read.
+
+Wrapper command location is declared once in `COMMAND_WRAPPER_STRATEGIES`: first positional argv,
+option value, shell `-c` string, or named external script, together with `execution: argv|shell`.
+R17 removed the two parallel wrapper registries that let npm/npx/pnpm shell carriers fall between
+branches. The same round restores function bodies after brace-expanding call words and respects
+`POSIXLY_CORRECT` when deciding whether a late `--help` is a mode or an operand.
+
+`decideDestructiveHook(payload, host)` in `destructive-guard-hook.ts` is the host adapter. Both
+hosts call the SAME function: Claude Code through `.claude/hooks/destructive-guard.cjs`
+(`PreToolUse` on `Bash`, exit 2 + `DZ-DESTRUCTIVE-REFUSE:` on stderr), and Codex through the
+emitted veto helper (`hooks-sync --target codex`, helper version 6). The helper loads the decider
+with `import()` — on Node < 20.19 a CommonJS `require()` of this ESM package throws
+`ERR_REQUIRE_ESM`, and the previous body turned that into a silent exit 0 (MEASURED: exit 0, empty
+stderr). A decider that fails to load now prints ONE `DZ-DESTRUCTIVE-WARN: guard not loaded —
+<reason>` line and records `destructive-not-loaded` in `helper-errors.jsonl`; it still fails open,
+but never quietly.
+
+The registry currently contains 121 `guard-*` entries. R17's exhaustive anchor census identifies
+the anchors displaced by the source refactor; new/repointed entries are staged separately under
+`scratchpad/` until the owner lands the registry mutation. `dz mutation-gate` proves each accepted
+protection by making at least one named test red; each
+protection, when deleted from the source, turns at least one named test red. Design record:
+`features/destructive-command-guard/03_adr/001-narrow-by-decidability.md`.
+
 ## Run a plan without the Claude host
 
 `runWorkflow` (`workflow-run.ts`) is the PURE scheduler behind `dz workflow run`: it INTERPRETS a
@@ -385,14 +470,185 @@ decision domain: justification is neither scored nor offered as a trimming targe
 
 ## Status
 
-`0.8.10` — staged, not published. Adds the four bounded `volume-shadow/v1` observations and their
+`0.8.12` — **staged, not published.** The `/feature-adr` phase panel + per-phase ledger telemetry,
+with the four cross-family review findings of the feature's first landing closed with proof: a
+monotone step guard on the write path, the `fa-phase-slot` named lock around the whole slot
+transition (plus a refusal REASON the CLI can print), and `kind`-carrying ledger rows made invisible
+to every cost reader (`planLedgerBackfill`, `selectLedgerRows`, `assembleTimeline`). See the phase
+telemetry paragraph above. Seven named guards in this package are `DEFENDED` under `dz mutation-gate`.
+
+Unreleased — adds the pure `course-staleness` classifier. Missing provenance is explicitly
+`E2 UNSTAMPED` and is tested not to equal `S0 SHIPPED`; version ordering uses the existing semver
+comparator while all registry and filesystem I/O remains outside the classifier.
+
+`0.8.15` — **staged, not published.** `amendment-trace.ts` now keeps the `CP-` prefix in the
+amendment id: `AM-CP-N` and `AM-N` are DISTINCT ids, so a challenge-panel row appended by the
+feature-adr workflow can no longer collide with the ideation's `AM-N`. Until this release the prefix
+was matched by a non-capturing group and thrown away at id construction, and the subject guard —
+which exists because comparing ids alone let a plan swap one change for another under the same id —
+fired on plans whose subject WAS carried verbatim. MEASURED TWICE on 2026-09-05, on two independent
+worktrees: the authors of `run-registry-liveness` and `core-boundary-guard` each re-numbered or
+refused the `AM-CP-N` form to get past the instrument. K2 (`check-plan-completeness.mjs`) has always
+kept the whole token and REQUIRES those rows inside `## Amendments`, so the pipeline's own gate was
+forcing rows into the position this module misread — two tools, one text, two contracts. The
+`amendmentSubject` furniture stripper learned the prefix too, so a CP row's subject is its text
+rather than its own id. **JSON surface (`dz amendment-check --json`):** no field is renamed, but a
+consumer that keyed on `AM-\d+` will now see the id VALUE `AM-CP-<n>` where a colliding `AM-<n>`
+used to appear. Backlog `a7d0aece023774a0`; the prefix-drop mutant is registered as
+`amendment-trace-cp-prefix-is-identity` and reported PROVEN with 7 failing tests under
+`dz mutation-gate --only amendment-trace-cp-prefix-is-identity --test-cmd "npx vitest run
+test/amendment-trace.test.ts test/amendment-grammar-agreement.test.ts test/score.test.ts"`. The
+registry-wide `testCommand` reports the SAME failing count and answers INCONCLUSIVE on a loaded
+machine for this entry AND for an untouched control entry, both for the same reason —
+`test/eta.test.ts` times out at 5 s in the re-baseline — so that verdict is a property of the
+runner, not of this protection.
+
+**QE fix round (same `0.8.15`, cross-family review 2026-09-06).** The release note above claimed to
+end the two-reader disagreement; the review found a THIRD reader with a THIRD contract, and it is
+closed here. (1) `score.ts` scanned plans and QE reports with its own `/AM-\d+/g`, which does not
+match `AM-CP-1` at all (MEASURED — `'AM-CP-1'.match(/AM-\d+/g)` → `null`), so a plan whose
+amendments were all challenge-panel rows scored an EMPTY planned set and the whole
+`amendment-confirmation` discipline was skipped with no `absent` and no `partial` — a check that
+silently checked nothing. Coverage one line below was `qeText.includes(id)`, so a planned `AM-1` read
+as covered by a report that only ever mentions `AM-10` (MEASURED — `'AM-10'.includes('AM-1')` →
+`true`). Both are closed by ONE exported reader, `amendmentIdsIn` / `mentionsAmendmentId`, living
+beside the row grammar in `amendment-trace.ts` and pinned against K2's token by
+`test/amendment-grammar-agreement.test.ts`; narrowing it back is the registered mutant
+`amendment-token-cp-prefix-shared-reader` (PROVEN, 4 failing). (2) `decideAmendmentOutcome` now tells
+an explicit "None" from a silent grammar failure: a `## Amendments` section that declares
+`None`/`нет`/`n/a` and parses zero rows is a **skip** (exit 0, stated reason), where it used to
+return NOT-ESTABLISHED (exit 3) on a plan that was complete — MEASURED on this feature's own plan
+(backlog `ce2da797e17a7a7f`). The skip is GUARDED: it never fires while an ideation amendment the
+plan dropped is outstanding, so an absence can still never silence a real gap. Blast radius over the
+363-feature census: exactly 2 features move `not-established` → `skip`
+(`amendment-trace-cp-prefix`, `doctor-insight-flow-check`), both plans declaring None in prose. (3)
+**Cross-family round 2** found the explicit-None contract half-honoured: the pipeline's own Step-8
+module documents the INLINE form `## Amendments: None`
+(`.claude/skills/feature-adr/modules/08-qe.md:166`), and there `amendmentSection` ate `: None` as
+part of the heading and returned an EMPTY body, so the skip branch never ran and the gate still
+answered NOT-ESTABLISHED (exit 3) — MEASURED on the built module: section `""`, `saysNone false`,
+exit 3. The declaration is now read from BOTH homes, the section body and the heading suffix, and it
+must BE a declaration: a separator (`:` or a dash), then a WHOLE remainder from the closed set
+`None`/`N/A`/`нет`, optionally with a full stop. Before that exact comparison, an optional
+whitespace-separated CommonMark closing hash sequence is removed as heading furniture. That rule
+was chosen from the corpus, not invented — the 363 features carry
+`## Amendments (carried verbatim into the plan)` (8×), `## Amendments — conditions before
+plan/code`, `## Amendments applied before Step 6`, `## Amendments and confirmation obligations`, and
+none of them may read as "none". Registered mutant `amendment-explicit-none-on-the-heading`
+(refreshed against the current return path; PROVEN, 5 failing). Census: **zero** features use the inline form today, so the tally is unchanged
+at `fail 48 · pass 82 · skip 200 · not-established 33` over 363 — this half of the fix honours a
+DOCUMENTED contract rather than moving a live verdict. (7) **Cross-family round 6** replaced the mask
+with a BLOCK READER, and the reason is the shape of the previous five rounds rather than any single
+defect: `<!--` and `-->` written inside INLINE CODE SPANS in ordinary prose were read as a comment
+spanning a real section, so `amendmentSection` returned null and the gate answered skip/exit 0
+(MEASURED). Each mask had been born to close the previous one's hole — the signature of reading at
+the wrong level. `maskNonRendered` is now one length-preserving block scan implementing CommonMark
+§4.5 (fenced code), §4.6 type 2 (`<!-- … -->`, whose START CONDITION is line-start after at most
+three spaces — which is what makes a code-spanned delimiter a non-event by construction) and §4.2
+(headings matched only in what survives); §6.1 code spans are deliberately not parsed, because no
+inline construct may open a block. NOT implemented, so the gap is auditable: indented code blocks,
+HTML block types 1 and 3–7, block quotes and list containers, tabs as indentation, link reference
+definitions. One deliberate deviation: an UNCLOSED block is reverted rather than run to end of
+document, because hiding a real section would turn the gate into exit 0. Also in this round: a
+document that opens more than one RENDERED `## Amendments` section at the same depth or shallower is
+NOT-ESTABLISHED with a named reason, never a skip — a stale `## Amendments: None` above the real
+section used to answer for it. The depth rule is corpus-derived: counting a `###` subsection as a
+rival moved `p16-non-js-portability` from an honest `fail` to `not-established`, which is a
+regression dressed as caution. Registered mutants `amendment-comment-start-is-a-block-condition` and
+`amendment-duplicate-sections-are-not-established` (PROVEN, 1 failing each); fourteen `amendment-*`
+entries are 12/12 proven with 0 drops among 12/12 anchored. STILL OPEN and named: K2
+(`check-plan-completeness.mjs`) keeps the old any-run-of-three fence closer, so on a `````md` fence
+containing a ```` ``` ```` line K2 now FAILS a plan this checker reads correctly — one reader for both
+consumers is a feature, not a fix round (six copies, three published packages, standalone
+execution). (4) **Cross-family round 3** found the skip
+FORGEABLE and one of its spellings unreachable, both in the same reader. A plan may SHOW the form it
+is allowed to write, and a fenced `## Amendments: None` above the real section won the raw heading
+search: the fence's own body parsed as zero rows and the gate exited 0 WITHOUT LOOKING at the real
+section, which carried an unresolvable `AM-1` — the new false pass NFR-3 forbids. Headings, section
+boundaries and rows are now found in a length-preserving FENCE MASK and sliced from the original, so
+an example illustrates the form and never answers for the document; an UNCLOSED fence is reverted
+rather than trusted, because losing an example is cheap and hiding a real section would manufacture
+the very skip the mask exists to prevent. In the same reader, JavaScript's `\b` was wrong in BOTH
+directions at once: Cyrillic is not `\w`, so `нет` was REJECTED against the contract these READMEs
+print, while a hyphen IS a word boundary, so a body opening `none-blocking follow-ups` was ACCEPTED
+and exited 0. The current reader is stronger: the whole heading remainder or first paragraph must
+match the closed set, so both longer-word and qualified-sentence forms are refused.
+Registered mutants `amendment-explicit-none-not-forgeable-by-a-fence` (PROVEN, 2 failing) and
+the stable registry id `amendment-none-declaration-unicode-guard` (retargeted from the deleted
+constant to the current exact reader; PROVEN, 6 failing). Census after: 363 features,
+`fail 48 · pass 82 · skip 200 · not-established 33` — and this time not one feature moved even in
+its per-verdict COUNTS, so the masking cost the corpus nothing. (5) **Cross-family round 4** found two defects
+in that fence mask itself, both again exit-0 answers over unresolved work. The mask was used for
+FINDING and not for READING: row starts were located in the mask while each row's text was sliced
+from the original, so a testless `AM-1` followed by a fenced example carrying a complete
+`→ test … in …` pointer borrowed that pointer, resolved, and the gate answered **pass** (MEASURED —
+`{"ids":["AM-1"],"testIds":[["a_long_enough_test_id"]],"verdicts":["AM-1:resolved"],"outcome":"pass","exit":0}`).
+Every semantic read of a row — pointer, file, retraction, subject — now goes through a masked slice
+of the SAME length carried on the row itself (`AmendmentRow.scan`, a new required field). And the
+mask closed a fence on any run of three or more, while CommonMark §4.5 closes only on a run of the
+SAME character at least as long as the opener: a standalone ` ``` ` line inside a ` ```` ` fence
+re-opened the document mid-fence and a fenced `## Amendments: None` was selected again (MEASURED —
+`{"saysNone":true,"outcome":"skip","exit":0}` with the real section's amendment never parsed). Both
+reproducers now answer `fail`, exit 1. Registered mutants
+`amendment-row-pointers-read-the-masked-slice`, `amendment-retraction-reads-the-masked-slice` and
+`amendment-fence-closer-must-match-the-opener` (PROVEN, 1 failing each); the eight `amendment-*`
+entries are 8/8 proven with 0 coverage drops among 8/8 anchored. Census unchanged again: 363
+features, `fail 48 · pass 82 · skip 200 · not-established 33`, zero features moved even in their
+per-verdict counts. HONEST LIMIT: the subject read shares the fix but has no discriminating test —
+a fenced example can only APPEND to a row, and subject comparison is containment-tolerant in both
+directions, so no fixture flips a verdict; the read is corrected, not proven. (6) **Cross-family round 5** raised the first two
+P1s of this feature. An HTML-commented template — `<!-- … ## Amendments: None … -->` kept above the
+real section, as plans legitimately do — was still read as the document's own declaration, so the
+gate answered skip/exit 0 with the real section's unresolved `AM-1` never parsed (MEASURED —
+`{"ids":[],"saysNone":true,"outcome":"skip","exit":0}`). The mask now blanks fences AND HTML
+comments, both length-preserving, fences first; an unclosed comment is left visible for the same
+reason an unclosed fence is reverted — masking may lose a comment, never hide a section. Fourth
+instance of one class, after the fenced heading, the fenced row and the fenced pointer. Second P1:
+round 4 made `AmendmentRow.scan` REQUIRED, which breaks any downstream constructor of a row the
+previous release accepted — a legacy row reaching `amendmentsMissingFromPlan` threw
+`TypeError: Cannot read properties of undefined (reading 'split')`. The field is **optional** again
+and every semantic read goes through a fallback to `raw`, so a hand-built or deserialised row is
+read slightly more generously instead of crashing. Registered mutants
+`amendment-html-comment-is-not-a-declaration` (PROVEN, 1) and `amendment-row-scan-falls-back-to-raw`
+(PROVEN, 3); the ten `amendment-*` entries are 10/10 proven, 0 drops among 10/10 anchored. Census
+unchanged again — 363 features, zero moved, counts included — and zero of the 397 plan/ideation
+documents on disk hold a commented `## Amendments` heading today, so this too closes a forgery route
+rather than moving a live verdict.
+
+**Cross-family rounds 7–8 (same staged `0.8.15`).** The exported declaration predicate now accepts
+only a whole first paragraph or heading remainder from the closed set `None`/`N/A`/`нет`, optionally
+with a full stop; qualified text such as `None of the required rows has been written yet.` is not an
+absence declaration. The companion exported ambiguity predicate scans rendered text below the
+section heading: when a declaration exists, zero rows parse, and AM-like content remains, the
+decision is NOT-ESTABLISHED rather than skip. Round 8 also removes an optional whitespace-separated
+CommonMark closing hash sequence before the exact heading comparison, so
+`## Amendments: None ##` is accepted while `## Amendments: None##` remains text. The focused mutation
+reproducer for the two refreshed declaration entries plus the closing-hash and ambiguity entries
+reported 4/4 PROVEN (5, 6, 1 and 1 failing tests respectively) with no NOT_APPLIED or UNDEFENDED:
+`dz mutation-gate --package . --only amendment-explicit-none-on-the-heading,amendment-none-declaration-unicode-guard,amendment-explicit-none-closing-hashes,amendment-explicit-none-ambiguity-fails-closed --test-cmd "npx vitest run test/amendment-trace.test.ts"`.
+
+`0.8.11` — **published 2026-09-02.** Russian catalogue: `stem.ts` word-form normalisation on both sides of
+registry search plus a RU topic dictionary with an observable miss in `recommend` (feature
+`ru-catalog-discovery`, ADR 001/002, cross-family QE grade B). Honesty instruments: the
+`dz discrimination-check` / `dz mutation-gate` seams are fixed — the CLI now passes the package test
+script, a root-relative `packageDir` is accepted, and the vitest filter is no longer dropped by a stray
+`--` (MEASURED: that ran all 5269 repo tests instead of one file). Also in this version: `dz chain`
+(verify every chained journal in one command), `dz score --all` (a chained scorecard aggregate that
+says `INSUFFICIENT_DATA` instead of a fake zero), mutation verdicts counted rather than read from
+prose, `runnerId` stamped on the run ledger, a closed `RunOutcome` set in the telemetry vocabulary
+wired into all five pipeline returns and the cost ledger, the catalogue counting invocable skills
+(202 → 249) instead of prefix-named packs, `--select` refusing closed and installing a skill exactly
+once, and one Codex invocation path that cannot return silence with a layer-1 guard against the stub
+wrapper.
+
+`0.8.10` — published 2026-08-31. Adds the four bounded `volume-shadow/v1` observations and their
 immutable SOFT belt; incomplete evidence remains visible as unknown without changing the verdict.
 
-`0.8.9` — staged, not published. Adds the pure decision-point micro-recall contract, strict
+`0.8.9` — never published as-is; shipped inside 0.8.10 (2026-08-31). Adds the pure decision-point micro-recall contract, strict
 fail-open transport/receipt reducers, post-hoc numerator/denominator metrics, and mutation-defended
 advisory prompt isolation. This is experiment instrumentation, not evidence of local effectiveness.
 
-`0.8.8` — staged, not published. Adds evidence-gated `INTEGRATIONS.json` orchestration, one
+`0.8.8` — never published as-is; shipped inside 0.8.10 (2026-08-31). Adds evidence-gated `INTEGRATIONS.json` orchestration, one
 receipt-qualified Claude project-MCP emitter, explicit refusal outcomes, and the ownership journal.
 
 `0.8.7` — **pure same-tier feature-adr ETA calibration.** `eta.ts` parses timestamped checkpoint
@@ -419,6 +675,30 @@ closed. `CheckpointEntry` gains an optional `ts` and `stampCheckpointLine` appli
 deliberately OUTSIDE the blob-mirrored serializer, because the sandboxed workflow has no `Date` and a
 clock has no business in a function the clockless copy also runs. An absent stamp reads as UNKNOWN,
 never zero; a malformed one is dropped, because a wrong instant is worse than an absent one.
+**Phase telemetry, and why `planLedgerBackfill` now skips rows (v0.8.12).** `writeFeatureAdrState`
+stores a `tier` and a `phaseStartTs` on the slot, and on a step-label CHANGE appends ONE
+`{"kind":"phase",…,"wallSec","ts"}` row to the EXISTING `.dz/feature-adr/run-cost-ledger.jsonl`
+(never creating one). `renderFeatureAdrPhaseLine` turns the slot alone into the panel's second line.
+Three properties are load-bearing and each has a `dz mutation-gate` entry:
+- **Monotone.** A plain `Step <n>` label going BACKWARDS against a slot younger than 90 minutes is
+  absorbed — counters land, the step and phase clock stand, no phase row. `⛔`/`⏸` labels and a
+  stale slot are the two escape hatches for a legitimate regression.
+- **Serialized.** The whole read → compare → append → write transaction runs inside
+  `withNamedLockSync(root, 'fa-phase-slot', …)`; pattern counting and directory housekeeping stay
+  outside it. A lock timeout REFUSES the write. `writeFeatureAdrStateDetailed` returns
+  `{state}` or `{refused:'<reason>'}` so a caller can be LOUD about it (`writeFeatureAdrState` is the
+  back-compatible façade returning `state | undefined`). `WriteFeatureAdrStateInput._unsafeSkipLock`
+  and `._unsafeHoldMs` are **TEST-ONLY seams** for that lock's own RED half — no shipped caller sets
+  them, and `statusline-phase-lock.test.ts` asserts neither is spellable from the CLI.
+- **Never a cost claim.** `kind`-carrying rows are telemetry. `isNonRunRow` is exported from
+  `ledger-backfill` and used by all three cost readers, so one definition covers them:
+  `planLedgerBackfill` skips such rows in claimant counting AND in filling (reporting
+  `skipped:'non-run-row'`), `selectLedgerRows` no longer pulls them into a run's evidence bundle
+  through its slug fallback, and `assembleTimeline` no longer labels them `cost` in a run timeline.
+  The last two were MEASURED leaking on 2026-09-06 — running each consumer with and without a phase
+  row changed its output — not assumed clean. `cadence` is untouched: it needs a string `date`,
+  which a phase row never carries.
+
 `planLedgerBackfill` + `resolveLedgerRunId` let the run-cost ledger fill itself from the host's own
 workflow record: a run id is resolved at WRITE time (the only moment it is unambiguous), a slug is
 the fallback only when it names exactly ONE run, and a run claimed by more than one row fills
@@ -497,8 +777,9 @@ manifest was stale against its own shipped files. No behaviour changes.
 lexical hit under `--semantic`, `HybridRecall` gains `semanticCandidates` / `semanticRanked`, and
 `VectorTierStatus` gains `mirrorWriterEnabled`, `unmirrored`, `mirroredOther` and `orphaned`.
 **`mirrored` CHANGES MEANING** to the pattern scope only — a consumer comparing it against a
-full-store count must be updated. `0.6.1` — two new pure modules behind two new commands. `amendment-trace.ts` resolves every `AM-N`
-amendment row to a test found INSIDE the file the row names — matched against the file's parsed TEST
+full-store count must be updated. `0.6.1` — two new pure modules behind two new commands. `amendment-trace.ts` resolves every `AM-N` and
+`AM-CP-N` amendment row (two DISTINCT ids since `0.8.15`: a challenge-panel `AM-CP-1` never collides
+with the ideation's `AM-1`) to a test found INSIDE the file the row names — matched against the file's parsed TEST
 TITLES, because whole-file matching was forgeable by two comment lines whose letters spell the id, and
 because an existing FILE never stands in for an existing TEST. `run-records.ts` decides whether a
 run-cost row or a training pair may be written: it refuses bad JSON, a wrong-kind payload, an EMPTY
@@ -556,3 +837,136 @@ normaliser rather than keeping a copy of the rule). Four `TARGET_ALIASES` rows w
 UNREACHABLE — `claude_code`, `claudecode`, `agentsmd`, `agents.md` all normalise onto a canonical name
 and were resolved by precedence step 2 before the table was ever consulted; every one of those inputs
 still resolves, so the deletion is observably a no-op.
+
+## Публичный снимок бэклога — `buildPublicSnapshot` / `assertPublicSafe`
+
+Две функции, отдающие наружу агрегаты очереди задач так, чтобы тексты задач не покидали машину.
+
+```ts
+import { buildPublicSnapshot, assertPublicSafe } from '@dzhechkov/harness-core';
+
+const built = buildPublicSnapshot(records, '2026-09-03');   // чистая: записи + дата, без файлов и часов
+if (!built.ok) throw new Error(`${built.code}: ${built.reason}`);
+
+const verdict = assertPublicSafe(JSON.stringify(built.snapshot));  // независимая застава на выходе
+if (!verdict.ok) throw new Error(`${verdict.code}: ${verdict.reason}`);
+```
+
+**Порождение, а не фильтрация.** Публичный объект не проверяется после сборки — он собирается
+перечислением разрешённых агрегатов, и приватное поле ни разу не читается на пути к выходу.
+Проверяющий поверх готового файла ловит то, о чём подумали, и пропускает поле, которое добавят
+завтра.
+
+**Застава несёт СВОЮ копию перечня** и не импортирует схему у порождения: иначе одна ошибка
+проходила бы обе проверки. Она проверяет БАЙТЫ, а не разобранный объект — измерено, что
+`{"receipt":{"text":"…"},"receipt":{…}}` проходит разбор чистым, а наружу уезжают оба ключа.
+
+**Чего в схеме нет намеренно:** максимума, минимума и процентилей. Крайнее значение по определению
+принадлежит ровно одной записи, то есть указывает на неё. Вместо них медиана и гистограмма, и порог
+малых групп применяется к каждой корзине.
+
+Пять каналов утечки закрыты по итогу трёх проходов кросс-семейного ревью: вложенное поле
+разрешённого ключа, пустой объект как чистый снимок, дубликат ключа в байтах, свободная строка в
+массиве правил, приватный текст в имени ключа словаря. Каждый воспроизведён прогоном до починки.
+
+## Журнал переходов статуса — `appendTransition` / `readTransitions`
+
+Запись бэклога хранит ровно один переход, последний. Журнал `.dz/backlog/status-log.jsonl` копит
+все: строка на переход, дозапись без чтения файла целиком.
+
+```ts
+import { appendTransition, readTransitions } from '@dzhechkov/harness-core';
+appendTransition(root, { id, from: 'new', to: 'shipped', ts, by: 'backlog ship' });
+```
+
+Никогда не бросает: журнал — наблюдение, а не гейт, и его поломка не должна ронять команду, которая
+меняла статус. Битая строка при чтении пропускается — файл дозаписывается конкурентно.
+
+## Контракт вывода роя — `checkSwarmBrief` / `SWARM_BRIEF_CONTRACT`
+
+Разбирает бриф роя агентов и отвечает, объявлен ли в нём контракт вывода: куда писать
+(`OUTPUT_DIR`), какие единицы работы (`UNITS`) и какая из них сборочная (`ASSEMBLY_UNIT`).
+Заведён после инцидента, где рой получил бриф «пришли один отчёт в конце», умер посреди работы,
+и восстанавливать оказалось нечего.
+
+Вся ценность модуля в одном свойстве: **вердикт нельзя подделать текстом, который он же и судит.**
+Отсюда форма проверок — не «есть ли такие слова», а «объявлено ли это ОДНОЗНАЧНО»:
+
+- объявление внутри забора кода или HTML-комментария не считается объявлением; закрывающий забор
+  обязан быть не короче открывающего, а комментарий, пытающийся вложиться, даёт отказ, а не тихое
+  открытие после внутреннего `-->`;
+- украшенный ключ (жирный, цитата, обратные кавычки) **считается** в счётчик повторов: спрятать
+  одно объявление за оформлением и получить тихий выбор другого нельзя — будет отказ по
+  неоднозначности;
+- перечень единиц никогда не усекается молча. Пустая строка или любая строка-не-пункт, за которой в
+  том же блоке ещё есть пункты, — отказ, **называющий эту строку**; так же считается заслонённая
+  строка. Причина: `units` — тот самый машинный перечень, с которым потом сверяют каталог, и тихая
+  потеря его хвоста делает сверку ложно-успешной;
+- строка-не-пункт ПОСЛЕ последнего пункта — нормальное окончание списка, а не нарушение: проверка,
+  изобретающая нарушения, хуже отсутствующей;
+- `OUTPUT_DIR` проверяется как ПУТЬ: абсолютный, переход вверх, обратная косая, управляющие байты и
+  сегменты, не являющиеся именами, отвергаются;
+- имя `plan` зарезервировано — его файл есть файл плана, который рой пишет первым;
+- длина имени единицы ограничена, число единиц ограничено, проверка дубликатов линейная;
+- любое значение из брифа, доходящее до терминала, обезврежено: байт `ESC` не перерисует строку
+  отказа в «OK».
+
+Все перечисленные защиты имеют записи в реестре мутаций и доказаны прогоном
+(`dz mutation-gate … → 7/7 proven, verdict PASS`).
+
+Честный предел, который печатается вместе с зелёным ответом: проверка удостоверяет, что бриф
+ОБЪЯВИЛ контракт, а не что рой ему последует.
+
+## Двухфазная строка стадии — intent до модели, outcome после
+
+Резолвер моделей теперь возвращает не только `StageOpts`, но и **причину**: `resolveStageDecision(stage, env)
+→ {opts, spec, reason}`, где `reason` — закрытое перечисление из **двадцати** (20) значений:
+восемь веток резолвера, две деградации спецификации и десять причин уровня диспатча, которых чистый
+резолвер знать не может. Канонический порядок совпадает с экспортом `STAGE_DECISION_REASONS`:
+
+<!-- stage-decision-reasons:start -->
+- `usage-override`
+- `explicit-models`
+- `routing-not-requested`
+- `coder-knob-codex`
+- `planner-knob-codex`
+- `qe-cross-family`
+- `budget-table-cell`
+- `default-models`
+- `codex-id-substituted`
+- `spec-unrecognised`
+- `coder-fallback`
+- `codex-unsupported-at-dispatch`
+- `fallback-after-no-deliverable`
+- `precision-second-pass`
+- `auto-cost`
+- `qe-same-family-degraded`
+- `challenge-panel`
+- `codex-probe-failed`
+- `codex-refused-before-dispatch`
+- `fallback-rung`
+<!-- stage-decision-reasons:end -->
+
+Причины первых двух групп вычисляются резолвером; причины последней группы описывают выбор текущей
+ступени, включая откаты, второй precision-проход, challenge panel и learned-cost. `fallback-rung`
+намеренно не пересказывает исход предыдущей ступени: тот уже принадлежит её собственной строке outcome.
+Отдельно стоит `codex-refused-before-dispatch`: id ответил на пробу, но ступень так и не построила
+диспатч (непригодный ref области ревью, небезопасный id, отклонённый exec-план). Ни один агент не
+запускался, поэтому следующая ступень — НЕ `fallback-after-no-deliverable`: та причина утверждает, что
+ступень отработала и ничего не отдала. Исход ступени трёхзначен (`dispatched` / `probe-failed` /
+`refused-before-dispatch`) и остаётся на holder этой конкретной попытки; булев флаг сваливал всякий
+не-пробный отказ в ветку «оно запускалось».
+Исход принадлежит КОНКРЕТНОМУ вызову, а не модулю: дизайн-стадии идут конкурентно
+(`await parallel(designThunks)`), и общая переменная, прочитанная после `await`, содержала бы то,
+что записал последний сосед — измерено: стадия, чей собственный диспатч Codex ОТРАБОТАЛ, объявляла
+свой откат как `codex-probe-failed`, позаимствовав факт у соседки. Отдельный случай — рантайм не
+знает типа агента `codex:codex-rescue`: это тоже отказ ДО запуска, и он докладывается уже имевшейся
+причиной `codex-unsupported-at-dispatch`, а не «ступень отработала и ничего не отдала».
+`resolveStageDecision` не эмитит ни одну из десяти — это закреплено тестом. `resolveStageModel`
+остался тонкой обёрткой с байт-идентичным результатом. Чистые `renderStageIntentLine` и
+`renderStageOutcomeLine` проецируются генератором в оба зеркальных скрипта. Единственный шов
+`dispatchAgent` печатает `▸ code · opus · budget table cell · intent` непосредственно перед
+`agent(...)`, а после окончательного исхода той же попытки — `◆ code · opus · outcome: dispatched`
+либо точный отказ/провал пробы. Только outcome добавляется в `dispatchOutcomes`, авторитетный отчёт
+«кто-что-делал»; intent остаётся живым предупреждением. Свёрнутые стадии (`research`, `ddd`) отдельных
+строк не получают — у них нет отдельного диспатча.

package/dist/agents-policy.d.ts

@@ -28,7 +28,21 @@ export interface ExtractPolicyBlocksResult {
     /** Registry ids whose source is absent/null or whose begin/end anchor is malformed. */
     readonly missing: readonly string[];
 }
-export type PolicyDriftStatus = 'ok' | 'stale' | 'missing-stamp' | 'missing-anchor' | 'orphan-stamp';
+export type PolicyDriftStatus = 'ok' | 'stale' | 'missing-stamp' | 'missing-anchor' | 'orphan-stamp'
+/**
+ * Секция `<!-- dz:policy id=X -->` найдена в ФАЙЛЕ-ИСТОЧНИКЕ, но не объявлена в `POLICY_SOURCES`.
+ *
+ * ЗАЧЕМ ОТДЕЛЬНЫЙ СТАТУС. `orphan-stamp` смотрит в другую сторону — штамп в проекции без
+ * источника. Обратный случай не покрывался ничем, и это давало ЛОЖНОЕ ЗЕЛЁНОЕ: реестр
+ * `POLICY_SOURCES` ведётся руками, поэтому секция, дописанная в CLAUDE.md и не вписанная в него,
+ * молча не попадала в AGENTS.md, а `dz agents-sync --check` отвечал «in sync».
+ *
+ * ИЗМЕРЕНО 2026-09-03 на живом случае: добавил в канон секцию `backlog-coverage`, прогнал
+ * `agents-sync` — «in sync — 9 policy section(s), 9250 bytes», ровно те же число секций и байт,
+ * что до правки, ни на единицу не изменившиеся. Правило, ради которого всё делалось, до агентов
+ * не доехало, а прибор доложил успех.
+ */
+ | 'unregistered-section';
 export interface PolicyDriftFinding {
     readonly id: string;
     readonly file: string;

package/dist/agents-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents-policy.d.ts","sourceRoot":"","sources":["../src/agents-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,oFAAoF;AACpF,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAgExC,CAAC;AAEX,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,OAAO,GAAG,eAAe,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAErG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED,mMAAmM;AACnM,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAMD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACzC,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,yBAAyB,CA0B3B;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,SAAS,MAAM,EAAE,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAatE;AA8DD,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,iBAAiB,CAwDnB"}
+{"version":3,"file":"agents-policy.d.ts","sourceRoot":"","sources":["../src/agents-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,oFAAoF;AACpF,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAyExC,CAAC;AAEX,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,iBAAiB,GACzB,IAAI,GACJ,OAAO,GACP,eAAe,GACf,gBAAgB,GAChB,cAAc;AAChB;;;;;;;;;;;;GAYG;GACD,sBAAsB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED,mMAAmM;AACnM,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAMD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACzC,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,yBAAyB,CA0B3B;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,SAAS,MAAM,EAAE,CAMnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAatE;AA8DD,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,GAAE,SAAS,YAAY,EAAmB,GAChD,iBAAiB,CAwEnB"}

package/dist/agents-policy.js

@@ -28,7 +28,16 @@ export const POLICY_SOURCES = [
         file: 'CLAUDE.md',
         heading: 'Test execution: never watch',
         why: 'A watch-mode test run hangs an unattended coding session.',
-        operativeClause: 'npm test -- --run',
+        // Была `npm test -- --run` — эта команда в корне НЕ СУЩЕСТВУЕТ (Missing script: test), и
+        // 2026-09-03 канон исправлен. Несущей стала команда, которая есть.
+        operativeClause: 'npm run test:all',
+    },
+    {
+        id: 'backlog-coverage',
+        file: 'CLAUDE.md',
+        heading: 'Backlog coverage',
+        why: 'Работа, не закрытая в этом же ходу, иначе не оставляет следа нигде, кроме переписки, которая прокручивается.',
+        operativeClause: 'ALWAYS say out loud which records you filed',
     },
     {
         id: 'data-protection',
@@ -242,6 +251,23 @@ export function detectPolicyDrift(sourceFiles, agentsMdText, sources = POLICY_SO
     for (const stamp of [...stamps.filter((entry) => !sourceIds.has(entry.id)), ...duplicateStamps]) {
         findings.push({ id: stamp.id, file: stamp.file, status: 'orphan-stamp', expectedSha: null, actualSha: stamp.sha });
     }
+    // Секции канона, о которых реестр не знает. Ищем во ВСЕХ переданных файлах-источниках, а не
+    // только в тех, что уже объявлены: файл может целиком отсутствовать в реестре.
+    {
+        const declared = new Set(sources.map((source) => source.id));
+        const seen = new Set();
+        for (const [file, text] of sourceFiles) {
+            if (typeof text !== 'string')
+                continue;
+            for (const m of text.matchAll(/<!-- dz:policy id=([a-z0-9-]+) -->/g)) {
+                const id = m[1];
+                if (declared.has(id) || seen.has(id))
+                    continue;
+                seen.add(id);
+                findings.push({ id, file, status: 'unregistered-section', expectedSha: null, actualSha: null });
+            }
+        }
+    }
     if (typeof agentsMdText === 'string') {
         const beginCount = markerCount(agentsMdText, POLICY_BLOCK_BEGIN);
         const endCount = markerCount(agentsMdText, POLICY_BLOCK_END);