@dzhechkov/keysarium 1.5.35 → 1.5.37

package/templates/.claude/skills/feature-adr/modules/01-requirements.md

@@ -77,6 +77,32 @@ Explicitly state:
 - **Dependencies:** What must exist before this feature works
 - **Dependents:** What will break if this feature changes
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/01_requirements.md` containing only the headings this step
+   requires (Stakeholders · Functional requirements · Non-functional requirements · Constraints ·
+   Scope boundaries · Open questions), one line of intent under each. (S-tier is inline and has no
+   file — this section does not apply to it.)
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 ### For S-tier (inline)

package/templates/.claude/skills/feature-adr/modules/02-research.md

@@ -73,6 +73,32 @@ Alternative considered: [Y], rejected because [reasons].
 
 After both complete, synthesize results sequentially.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/02_research.md` containing only the headings this step
+   requires (Codebase patterns · External patterns · Library evaluation · Anti-patterns ·
+   Recommended approach), one line of intent under each — before the research agents report back,
+   not after.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/02_research.md` with:

package/templates/.claude/skills/feature-adr/modules/03-adr.md

@@ -167,6 +167,32 @@ Each ADR must trace back to specific requirements:
 | Placeholder text | Template hints or TODOs remain | Remove or fill before checkpoint |
 | Supersession in-place | Existing ADR rewritten | Mint a new ADR and link it |
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** For each decision you have identified, write
+   `features/<slug>/03_adr/NNN-{decision-slug}.md` containing only the invariant-core headings
+   (Status · Context · Decision Drivers · Considered Options · Decision · Rationale · Consequences ·
+   Confirmation), one line of intent under each. A named-but-empty option beats an unwritten ADR.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/03_adr/` directory with:

package/templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md

@@ -154,6 +154,31 @@ AM-N (source): <change>. Confirmation: <property> → test `test_name` (fails if
   an existence test and never fires in production.
 - A cheap lint holds the shape: every `AM-N` line must contain a `→ test ` token naming a test that exists.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/03.5_ideation_report.md` containing only the eight
+   section headings of §5 (Executive summary … Amendments), one line of intent under each — while
+   the swarm is still running, not after every agent has returned.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/03.5_ideation_report.md` with full QCSD report.

package/templates/.claude/skills/feature-adr/modules/04-ddd.md

@@ -92,6 +92,31 @@ Check that proposed domain model is compatible with existing code:
 - Can aggregates be implemented with existing ORM/framework?
 - Do relationships align with existing data access patterns?
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/04_domain_model.md` containing only the headings this step
+   requires (Bounded context map · Ubiquitous language · Aggregates/Entities/VOs · Relationships ·
+   Codebase mapping), one line of intent under each.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/04_domain_model.md` with:

package/templates/.claude/skills/feature-adr/modules/05-architecture.md

@@ -118,6 +118,32 @@ GET /api/v1/{resource}/:id
   Errors: 401, 404
 ```
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/05_architecture.md` containing only the headings this step
+   requires at your tier (C4 Context · C4 Container · C4 Component · Sequence flows · Data & storage ·
+   API design), one line of intent under each. An empty `mermaid` fence with a caption is a
+   heading; fill it later.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 ### M-tier

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -4,8 +4,11 @@
 
 ## When
 
-Always runs. Adapts depth by tier:
-- **S:** Inline checklist (3-5 items, no file)
+Always runs, and ALWAYS writes `features/<slug>/06_implementation_plan.md` — every tier. Depth adapts:
+- **S:** minimal plan FILE (3-5 tasks + an `EXPECTED_CODE_TARGETS:` block). An inline-only checklist is
+  no longer permitted: the K2 gate below is mandatory at every tier and it reads the file, so a plan
+  that exists only in the conversation makes the gate answer NOT-ESTABLISHED and the run stops. The
+  file must clear the gate's own floor: >200 characters and a non-empty targets block.
 - **M/L/XL:** Full structured plan document
 
 ## Model
@@ -132,15 +135,45 @@ Before finalizing the plan, validate completeness:
 
 This gap-check loop ensures the implementation plan is complete before coding begins.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/06_implementation_plan.md` containing only the headings
+   this step requires (Goal state · Tasks · Dependency order · Parallel groups · Checkpoints · Risk
+   assessment · Amendments · `EXPECTED_CODE_TARGETS:`), one line of intent under each. The K2 gate
+   reads this file — a plan that lives only in the conversation cannot pass it.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
-### S-tier (inline)
-Inline checklist in conversation:
+### S-tier (minimal file — NOT inline-only)
+Write `features/<slug>/06_implementation_plan.md` with the checklist plus the machine-read block, and
+show the same checklist inline at the checkpoint:
 ```
 Implementation plan:
 - [ ] {task 1}
 - [ ] {task 2}
 - [ ] {task 3}
+
+EXPECTED_CODE_TARGETS:
+- {repo-relative path Step 7 will create or modify}
 ```
 
 ### M/L/XL
@@ -157,6 +190,41 @@ Create `features/<slug>/06_implementation_plan.md` with:
 
 Set `{IMPL_PLAN}` variable.
 
+## K2 plan-completeness gate (MANDATORY — Step 7 does not start until it exits 0)
+
+After the plan is written, run the gate. It is a script, not a judgement call:
+
+```bash
+node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs features/<slug>
+```
+
+| Exit | Verdict | What you do |
+|------|---------|-------------|
+| `0` | PASS | proceed to Step 7 |
+| `1` | FAIL | **return to Step 6** — fix the plan for every `FAIL C*` line, rerun the gate |
+| `3` | NOT-ESTABLISHED | **INCONCLUSIVE** — the gate could not read its inputs (no plan, plan under the size floor, ADR claims it cannot see). Fix the inputs and rerun. Never proceed. |
+
+Never proceed on a non-zero exit, and never treat empty output as a pass — the last line
+(`K2 plan-completeness: PASS|FAIL|NOT-ESTABLISHED`) is the verdict, and its absence is not one.
+What it checks: C1 every ADR has a plan task citing it · C2 every ADR Confirmation test path is named
+in the plan · C3 the `EXPECTED_CODE_TARGETS:` block parses line by line · C4 the feature's declared
+acid corpus is named · C5 (WARN) the `Inputs read:` line. An S-tier run with no `03_adr/` skips C1/C2
+with a note (it cannot be failed for ADRs it never had) — unless the plan itself cites `ADR-<n>`,
+which is NOT-ESTABLISHED. C1 is a grep: it catches "forgot entirely", not "mentioned but not tasked".
+
+Pass the run's tier so the check cannot be dodged: `--tier=S|M|L|XL`. An M/L/XL feature with no
+`03_adr/` FAILS C1/C2 (an M+ feature owes ADRs); only `--tier=S` — or no tier at all, and then the
+skip note says so — takes the skip. A declared-but-malformed acid table (lowercase `| a1 |`, a header
+with no parsable rows) FAILS as `C4-malformed`; it is not a skip.
+
+**If the gate fails in the ultracode workflow:** the run returns `phase: 'plan-gate-failed'` and the
+plan stage is CHECKPOINTED, so a bare re-invoke resumes the same failing plan. Repair it from outside:
+edit `features/<slug>/06_implementation_plan.md` to fix each `FAIL` line and re-invoke (the checkpoint
+is keyed on run INPUTS, not on the file, so your edit survives), or re-invoke with `args.resume:
+'never'` (or delete `features/<slug>/.fa-state/`) to force a fresh plan.
+
+The checkpoint banner's Gates line carries the verdict: `K2 plan-completeness ✓ | ✗ | inconclusive`.
+
 ## Checkpoint Format
 
 ```
@@ -167,6 +235,7 @@ Tier: {COMPLEXITY_TIER}
 
 {N} tasks in {M} parallel groups
 Estimated {K} files to create/modify
+🚦 Gates: K2 plan-completeness ✓ (exit 0)   ← ✗/inconclusive ⇒ do NOT start Step 7
 
 • "ок" — start coding
 • "разбей [TASK-N]" — split task further
@@ -196,3 +265,4 @@ re-flagging it. In the ultracode workflow this врезка runs automatically a
 - [ ] Parallel groups correctly identified
 - [ ] Each task touches identifiable files
 - [ ] Total file count matches complexity tier expectation
+- [ ] `check-plan-completeness.mjs features/<slug>` exited 0 (its output quoted at the checkpoint)

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -152,7 +152,7 @@ Fail the ADR gate for any miss:
 | Follow-up discipline | Consequences link follow-up ADRs or state none; after-action review is scheduled |
 | Confirmation stanza | Names verification method, monitoring, success metric, and owner |
 | Confirmation-to-test link | The named load-bearing property has a real automated test/fitness check by file/name |
-| No placeholders | No TODO, template hint text, raw prompt/generation scaffold, or empty tail sections |
+| No placeholders | No `TODO`, template hint text, raw prompt/generation scaffold, or empty tail sections |
 
 Reject explainer-masquerading-as-ADR: if the document describes a problem space or technology landscape but has no concrete `Decision`, record a BLOCKER.
 
@@ -182,6 +182,19 @@ paths — especially startup/lifespan/health: require a negative resource-down t
 path degrades per its declared contract: fail-open for advisory, explicit fail-fast for load-bearing).
 Missing → HIGH gap.
 
+### 3d. No-stubs gate (backlog 0b403a0106103901 — layer 1 of the cost-of-detection ladder)
+
+Over the files THIS RUN touched (the Step-7 change list; for a Codex coder, the landed-barrier file
+list), grep for unfinished-stub markers: `TODO` / `FIXME` / `HACK` / `XXX` / `PLACEHOLDER`
+(case-SENSITIVE, word-bounded — never add `-i`; `hackathon`/`todos` must not fire) plus the phrase
+`implement later` (case-insensitive). **Any match = the task shipped incomplete** → HIGH gap naming
+file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or
+`.dz/guard.json` `stubWaivers` lists the path WITH a reason. A REASONLESS waiver is itself a HIGH gap,
+never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan
+as the SOFT `no-stubs` rule over the working-tree diff. When you QUOTE a marker in `08_qe_report.md`,
+backtick it so the report itself scans clean (the claim-check forbidden-phrase convention). Record the
+verdict in the ADR Fitness section.
+
 ### 4. Multi-Agent Review Panel (L/XL)
 
 For L/XL features, spawn 3 parallel review agents using brutal-honesty modes:

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+// K2 — machine plan-completeness gate for /feature-adr, run BETWEEN Step 6 (plan) and Step 7 (code).
+// Generalized from features/wave1-instrument-repair/check-plan-completeness.mjs (that copy is the
+// historical artifact of its run and stays untouched); this one is parameterized by feature dir.
+//
+// USAGE:  node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs [<feature-dir>] [--tier=M] [--acid=A1,A2]
+//         <feature-dir> defaults to the current working directory.
+//         --tier=S|M|L|XL closes the ADR-less dodge (see S-TIER HONESTY); omitting it keeps the
+//         heuristic, and the skip note then names the dodge out loud.
+//
+// VERDICT CONTRACT (unchanged from the proven copy — never a silent pass):
+//   PASS            exit 0   last line: `K2 plan-completeness: PASS (...)`
+//   FAIL            exit 1   last line: `K2 plan-completeness: FAIL (...)`
+//   NOT-ESTABLISHED exit 3   last line: `K2 plan-completeness: NOT-ESTABLISHED — <reason>`
+// (the wave1 copy printed the exit-3 line as `K2: NOT-ESTABLISHED — …`; the prefix is unified here so
+//  ONE regex parses all three verdicts — the exit codes and their meanings are identical.)
+// Set difference over IDENTIFIERS, not text similarity.
+//
+// KNOWN LIMITATION (measured on the discrimination twin, 2026-08-19): C1 is a grep — a PROSE
+// mention of "ADR-002" satisfies it exactly like a task reference. The real N14 (backlog
+// 3dbd2851-adjacent) must parse task structure. Kept honest here: C1 catches "forgot entirely",
+// not "mentioned but not tasked".
+//
+// Checks:
+//  C1  every ADR file in 03_adr/ has >=1 task line in 06_implementation_plan.md citing it (ADR-00N)
+//  C2  every Confirmation-numbered check in each ADR is named in the plan (by its test-file path)
+//  C3  the plan carries an EXPECTED_CODE_TARGETS: block, non-empty, and EVERY line parses to a
+//      plausible repo-relative path (no spaces unless quoted, no traversal, no markdown residue)
+//      — SFDIPOT condition: line-level validation, reject-with-reason, not just block presence
+//  C4  the plan names the feature's OWN acid corpus (see "acid corpus" below)
+//  C5  the plan has an 'Inputs read:' line naming 03_adr, 05_architecture (wave-2 seam, cheap here)
+//
+// S-TIER HONESTY (no 03_adr/): an S-tier run legitimately has no ADR files, and forcing it to fail a
+// plan gate it can never satisfy would make the gate a nuisance to route around. So:
+//   - no ADR files BUT the plan cites `ADR-<digits>`  → NOT-ESTABLISHED (exit 3): the plan claims
+//     decisions the gate cannot see, so its completeness is unknown — that is never a pass.
+//   - no ADR files AND --tier is M/L/XL → FAIL: an M+ feature owes ADRs, and skipping C1/C2 for it
+//     would let a whole tier dodge the check by simply not writing 03_adr/ (G-F3).
+//   - no ADR files AND (--tier=S or no --tier) AND the plan claims no ADR work
+//       → C1 + C2 are SKIPPED-with-note (printed as SKIP lines; the run can still PASS on C3-C5).
+//     Without --tier the skip note NAMES the dodge, because the gate cannot tell an honest S-run
+//     from an M+ run that deleted its ADR directory.
+//
+// ECHO SAFETY (G-F1, reproduced by execution): this script echoes plan-controlled content (rejected
+// target lines, acid tokens, the feature path). A plan line carrying the literal verdict marker was
+// echoed verbatim and a first-match parser upstream read the PLANT instead of the real verdict. Every
+// echoed value now goes through `safe()`, which defangs the marker and the exit trailer and truncates,
+// so the only spellable verdict line in this stream is the one this script writes last.
+//
+// ACID CORPUS (C4): the wave1 copy hard-coded ITS run's tokens. Here the corpus is DISCOVERED from
+// the feature's own `00_complexity_assessment.md` acid-case table (rows shaped `| A<N> | … |`), or
+// supplied explicitly with `--acid=T1,T2,…`. If neither establishes a corpus, C4 is SKIPPED-with-note
+// (a feature that declared no acid cases cannot be failed for not naming them).
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+
+const argv = process.argv.slice(2);
+const acidArg = argv.find((a) => a.startsWith('--acid='));
+const tierArg = argv.find((a) => a.startsWith('--tier='));
+const TIER = tierArg ? tierArg.slice('--tier='.length).trim().toUpperCase() : null;
+const TIER_REQUIRES_ADR = TIER === 'M' || TIER === 'L' || TIER === 'XL';
+const dirArg = argv.find((a) => !a.startsWith('--'));
+const FDIR = resolve(dirArg && dirArg !== '' ? (isAbsolute(dirArg) ? dirArg : join(process.cwd(), dirArg)) : process.cwd());
+const planPath = join(FDIR, '06_implementation_plan.md');
+const adrDir = join(FDIR, '03_adr');
+const complexityPath = join(FDIR, '00_complexity_assessment.md');
+
+// Defang any value this script echoes back: a plan (or a path, or an ADR) must never be able to spell
+// the verdict marker or the exit trailer into this stream. Truncated so one hostile line cannot bury
+// the verdict either. The offender stays READABLE — defanged, not dropped.
+const safe = (v) => String(v)
+  .replace(/K2 plan-completeness:/g, 'K2 plan-completeness[echoed]:')
+  .replace(/K2_EXIT=/g, 'K2_EXIT[echoed]=')
+  .replace(/[\r\n]+/g, ' ')
+  .slice(0, 300);
+const out = (s) => console.log(s);
+const notEstablished = (why) => { out(`K2 plan-completeness: NOT-ESTABLISHED — ${safe(why)}`); process.exit(3); };
+let failures = [], warnings = [], skips = [];
+
+if (!existsSync(FDIR)) notEstablished(`feature dir absent: ${FDIR}`);
+if (!existsSync(planPath)) notEstablished('06_implementation_plan.md absent');
+const plan = readFileSync(planPath, 'utf-8');
+if (plan.trim().length < 200) notEstablished('plan suspiciously small (<200 chars)');
+const adrFiles = existsSync(adrDir) ? readdirSync(adrDir).filter(f => f.endsWith('.md')).sort() : [];
+const planClaimsAdrWork = /\bADR-\d+/.test(plan);
+if (adrFiles.length === 0 && planClaimsAdrWork) notEstablished('no ADR files under 03_adr/, yet the plan cites ADR-<n> — completeness cannot be established');
+
+if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
+  failures.push(`C1: tier ${TIER} has NO ADR files under 03_adr/ — an M/L/XL feature owes at least one ADR; the plan cannot be complete against decisions that were never written`);
+  failures.push(`C2: tier ${TIER} has no 03_adr/ — no Confirmation test can be checked`);
+} else if (adrFiles.length === 0) {
+  skips.push(`C1: no 03_adr/ and the plan claims no ADR work — ADR-coverage check SKIPPED${TIER === 'S' ? ' (--tier=S, the legitimate S-tier shape)' : ' (NO --tier supplied: an M/L/XL run that simply never wrote 03_adr/ would dodge C1/C2 here — pass --tier to close it)'}`);
+  skips.push('C2: no 03_adr/ — Confirmation-test coverage check SKIPPED');
+} else {
+  // C1 — ADR ids referenced by plan tasks
+  for (const f of adrFiles) {
+    const m = f.match(/^(\d{3})-/); if (!m) { warnings.push(`C1: unparseable ADR filename ${safe(f)}`); continue; }
+    const id = `ADR-${m[1]}`;
+    const re = new RegExp(`ADR-0*${Number(m[1])}\\b`);
+    if (!re.test(plan)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it`);
+  }
+
+  // C2 — every Confirmation-listed test file path appears in the plan
+  const testPathRe = /(?:packages\/[\w@/.-]+\/test\/[\w./-]+\.test\.(?:ts|mjs|js)|tests?\/[\w./-]+\.test\.(?:ts|mjs|js))/g;
+  for (const f of adrFiles) {
+    const adr = readFileSync(join(adrDir, f), 'utf-8');
+    const confIdx = adr.search(/^##+\s*Confirmation/mi);
+    if (confIdx < 0) { failures.push(`C2: ${safe(f)} has no Confirmation section`); continue; }
+    const conf = adr.slice(confIdx);
+    const paths = [...new Set((conf.match(testPathRe) ?? []))];
+    if (paths.length === 0) { failures.push(`C2: ${safe(f)} Confirmation names no test file paths`); continue; }
+    for (const p of paths) if (!plan.includes(p)) failures.push(`C2: ${safe(f)} Confirmation test ${safe(p)} NOT named in the plan`);
+  }
+}
+
+// C3 — EXPECTED_CODE_TARGETS block, line-level validation
+const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
+if (!blockM) failures.push('C3: no EXPECTED_CODE_TARGETS: block in the plan');
+else {
+  const lines = blockM[1].split('\n').map(s => s.trim()).filter(Boolean);
+  if (lines.length === 0) failures.push('C3: EXPECTED_CODE_TARGETS block is empty');
+  for (const ln of lines) {
+    const path = ln.replace(/^[-*]\s*/, '').replace(/`/g, '').trim();
+    const reasons = [];
+    if (/\s/.test(path)) reasons.push('contains whitespace');
+    if (/\.\./.test(path)) reasons.push('path traversal');
+    if (/[*#\[\]()]/.test(path)) reasons.push('markdown residue');
+    if (!/^[\w@][\w@/.-]*$/.test(path)) reasons.push('not a plain repo-relative path');
+    if (reasons.length) failures.push(`C3: target line rejected: "${safe(ln)}" — ${reasons.join(', ')}`);
+  }
+}
+
+// C4 — the feature's OWN acid corpus is named in the plan (discovered, or --acid=…)
+// G-F5: a corpus that was DECLARED but declared BADLY (lowercase `| a1 |`, a row with trailing junk,
+// or an acid-case table header with no parsable rows) is a FAILURE, not a skip. Silently skipping it
+// let a malformed declaration buy the same green as an honest "no acid cases here". The strict row
+// shape is `| A<digits> |`; anything that LOOKS like an acid row under the loose shape but is not
+// strict is reported by name. (Honest scope: rows that look nothing like an acid row — a defect table
+// `| D1 |`, say — are not acid candidates and are left alone.)
+let acidTokens = [];
+let acidSource = null;
+if (acidArg) {
+  acidTokens = acidArg.slice('--acid='.length).split(',').map(s => s.trim()).filter(Boolean);
+  acidSource = '--acid';
+  if (acidTokens.length === 0) failures.push('C4-malformed: --acid was passed but declares no tokens');
+} else if (existsSync(complexityPath)) {
+  const complexity = readFileSync(complexityPath, 'utf-8');
+  acidTokens = [...new Set((complexity.match(/^\|\s*(A\d+)\s*\|/gm) ?? []).map(r => r.replace(/[|\s]/g, '')))];
+  if (acidTokens.length) acidSource = '00_complexity_assessment.md acid-case table';
+  const loose = [...new Set((complexity.match(/^\|\s*([Aa]\d+[A-Za-z]?)\s*\|/gm) ?? []).map(r => r.replace(/[|\s]/g, '')))];
+  for (const cand of loose) if (!acidTokens.includes(cand)) failures.push(`C4-malformed: acid row "${safe(cand)}" does not match the required \`| A<n> |\` shape (case-sensitive, digits only) — it is declared but uncheckable`);
+  const declaresTable = /\|\s*Acid case\s*\|/i.test(complexity);
+  if (declaresTable && acidTokens.length === 0) failures.push('C4-malformed: 00_complexity_assessment.md declares an acid-case table but NO `| A<n> |` row parsed from it');
+}
+if (acidTokens.length === 0) skips.push('C4: no acid corpus declared (no --acid, no `| A<n> |` table in 00_complexity_assessment.md) — acid-naming check SKIPPED');
+else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(plan)) failures.push(`C4: acid token "${safe(t)}" (from ${acidSource}) not named in the plan`);
+
+// C5 — Inputs read line
+if (!/Inputs read:/i.test(plan)) warnings.push('C5: no "Inputs read:" line (wave-2 seam, WARN only)');
+else for (const need of ['03_adr','05_architecture']) if (!plan.includes(need)) warnings.push(`C5: Inputs read line missing ${need}`);
+
+for (const s of skips) out('SKIP  ' + s);
+for (const w of warnings) out('WARN  ' + w);
+for (const f of failures) out('FAIL  ' + f);
+out(`K2 plan-completeness: ${failures.length === 0 ? 'PASS' : 'FAIL'} (${failures.length} failure(s), ${warnings.length} warning(s), ${skips.length} skip(s)) over ${adrFiles.length} ADRs, tier ${TIER === null ? '(unspecified)' : safe(TIER)}, in ${safe(FDIR)}`);
+process.exit(failures.length === 0 ? 0 : 1);