@dzhechkov/keysarium 1.5.37 → 1.5.39

package/.dz-manifest.json

@@ -9,11 +9,11 @@
       },
       {
         "path": "CHANGELOG.md",
-        "sha256": "d7ebdc513689fb05fd652691b7446335fedbdc137b4420de3ab9c016f8d3aa15"
+        "sha256": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
       },
       {
         "path": "README.md",
-        "sha256": "06b7590edbe2b63cd5bfd4c50b25ced9b13f8e6ba7d511f060e9c6caf8ba27e5"
+        "sha256": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
       },
       {
         "path": "README.ru.md",
@@ -29,7 +29,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "3123e3492edd83e8fe521f4246d182b15803689ff83e658f683d96002ef303e3"
+        "sha256": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -401,7 +401,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+        "sha256": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
@@ -409,7 +409,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+        "sha256": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -501,7 +501,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+        "sha256": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -1005,5 +1005,5 @@
       }
     ]
   },
-  "signature": "pKq4VEm9ivZe6zNp7kRKyB1yqBN5g0W+L2uED0qz38Uowj0I/STFIkSXuytmLmxaHqJEAU9G3+EBtOdqz0hmAw=="
+  "signature": "XoglxxyxKFLcXDz2N8wZzIPbdDffl6Mo5OQwgXt1cIZT1dmM/xHe/s70VsMxlFUiYTgQwYyxjHctP33tG/P+DA=="
 }

package/README.md

@@ -416,3 +416,16 @@ structure chosen before understanding, and section-per-edit raises tool-call ove
 
 Steps whose deliverable is a returned verdict rather than a document (the complexity router) are
 deliberately excluded — "skeleton first" is nonsense there.
+
+## Status
+
+`1.5.38` — a fix to the bundled `feature-adr` gate script in `templates/`, no pipeline change.
+
+The bundled K2 plan-completeness gate now tells an **ABSENT** `00_complexity_assessment.md` from a
+deliberate skip: a missing file is a WARNING that names the missing artifact, while a present file
+carrying no acid table is an honest SKIP. Both used to report as a clean skip, so the acid check
+silently switched itself off whenever Step 0 wrote nothing — MEASURED 2026-08-21, 66 of 199 features
+carried that file and the last four in a row did not.
+
+`1.5.39` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
+`dz amendment-check` instead of a judgement the reviewer is asked to make. Text only; no pipeline change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.5.37",
+  "version": "1.5.39",
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
   "bin": {

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d7ebdc513689fb05fd652691b7446335fedbdc137b4420de3ab9c016f8d3aa15"
+          "content": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "06b7590edbe2b63cd5bfd4c50b25ced9b13f8e6ba7d511f060e9c6caf8ba27e5"
+          "content": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
         }
       ]
     },
@@ -75,7 +75,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3123e3492edd83e8fe521f4246d182b15803689ff83e658f683d96002ef303e3"
+          "content": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
         }
       ]
     },
@@ -1005,7 +1005,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+          "content": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
         }
       ]
     },
@@ -1025,7 +1025,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+          "content": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
         }
       ]
     },
@@ -1255,7 +1255,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+          "content": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -198,6 +198,13 @@ After the plan is written, run the gate. It is a script, not a judgement call:
 node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs features/<slug>
 ```
 
+The path above is relative to the workspace the skill is INSTALLED in. Working inside a target repo
+that has no feature-adr install of its own? Pass the absolute path to the script instead — the
+ultracode workflow does this for you (it tries `args.gateScript`, then the workspace copy, then the
+target-repo copy, and refuses with `tooling-missing` if none exists). The gate is language-neutral:
+C2 recognises JS/TS, pytest, Go, Rust, JVM and .NET test paths, extensible per project with
+`testPathRules` in `architecture/project-skills.json`.
+
 | Exit | Verdict | What you do |
 |------|---------|-------------|
 | `0` | PASS | proceed to Step 7 |

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -160,18 +160,32 @@ The Confirmation-to-test link is load-bearing. If absent, grade no better than C
 
 ### 3b. Amendment Gate (P2 — amendments inherit the Confirmation discipline)
 
-Read the `## Amendments` sections of `03.5_ideation_report.md` and `06_implementation_plan.md` (skip
-silently if absent). For EVERY `AM-N` row verify:
-1. the row contains a `→ test ` token naming a real test (the fixed shape);
-2. the named test **exists** in the suite;
-3. it is **non-vacuous** — include the amendment test files in the SAME
-   `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test. An
-   amendment test that stays green at pre-feature base proves nothing about its amendment;
-4. a **safeguard** amendment's test proves the safeguard FIRES on a real input (a structurally-dead
-   safeguard passes an existence test and never fires in production).
-
-A missing, unnamed, or vacuous amendment test is a HIGH gap. This closes the distance between "we caught
-the design flaw" (challenge-panel/QCSD) and "we proved the fix works".
+**Do not judge this yourself — RUN the check.** Resolution of every `AM-N` row to a real test is a
+deterministic question, and a deterministic question must not live in prose (cost-of-detection ladder).
+It used to live here, and `features/qe-scoped-review` shipped with five named amendment test ids of
+which none existed, while its plan recorded `## Amendments: None`.
+
+```bash
+dz amendment-check --slug <feature-slug> --json      # or --feature-dir <abs path>
+```
+
+| Outcome | Exit | What it means for the gate |
+|---|---|---|
+| `pass` | 0 | every row resolves to a test found inside the file the row names |
+| `skip` | 0 | no `## Amendments` section — an absence, stated, never a silent pass |
+| `fail` | 1 | a HIGH gap: quote every reason verbatim into the QE report |
+| `not-established` | 3 | the grammar matched nothing, or the inputs were unreadable — **never a pass** |
+
+Empty stdout, a crash, or a missing `dz` is `not-established`, not a clean gate.
+
+**What the command does NOT prove:** that a resolved test discriminates. Vacuity stays yours, in the
+SAME `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test — an
+amendment test that stays green at pre-feature base proves nothing about its amendment. A **safeguard**
+amendment additionally needs its test to prove the safeguard FIRES on a real input: a structurally-dead
+safeguard passes an existence check and never fires in production.
+
+This closes the distance between "we caught the design flaw" (challenge-panel/QCSD) and "we proved the
+fix works".
 
 ### 3c. I/O-on-pure-path + fixture-swap hunt (P5)
 

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -85,6 +85,79 @@ const adrFiles = existsSync(adrDir) ? readdirSync(adrDir).filter(f => f.endsWith
 const planClaimsAdrWork = /\bADR-\d+/.test(plan);
 if (adrFiles.length === 0 && planClaimsAdrWork) notEstablished('no ADR files under 03_adr/, yet the plan cites ADR-<n> — completeness cannot be established');
 
+// ── C2 test-path predicate (P16/D1) — language-neutral, two stages ────────────────────────────
+// The shipped rule demanded a `.test.(ts|mjs|js)` SUFFIX, so C2 could never be satisfied outside
+// JS/TS: MEASURED 2026-08-20 over a 15-path corpus, 4/4 JS forms matched and 0/11 non-JS forms did
+// (`tests/test_x.py`, `x_test.go`, `tests/x.rs`, `XTest.java`, `XTests.cs`, …) — and zero matches is
+// the C2 FAIL branch, so the gate blocked every non-JS repo. The fix is a PREDICATE, not a wider
+// regex: "contains the word test" would admit `docs/testing.md` and `src/latest.rs`, and a gate that
+// passes prose is worse than one that fails Python.
+//
+// STAGE 1 (extractCandidatePaths) — pull candidate PATHS out of prose. The left edge is ANCHORED on
+// a boundary character so a longer token can never donate a substring (`xcontests/foo.test.ts` must
+// not yield `foo.test.ts`), and a candidate MUST carry at least one directory segment and an
+// extension — a bare `test_staleness.py` written inside a sentence is a name, not a path.
+// STAGE 2 (isTestPath) — ONE `$`-anchored rule per ecosystem. The anchoring IS the safety argument:
+// every acid item is refused by construction rather than by a blocklist.
+// DELIBERATELY NOT DONE: no `existsSync` decides whether a Confirmation path is valid — C2 runs
+// BEFORE Step 7 writes the test, so a file-existence probe there would fail every honest plan.
+const CANDIDATE_PATH_RE = /(?:^|[\s`'"(|])((?:[.\w@][\w@.-]*\/)+[\w@.-]+\.[A-Za-z0-9]+)/g;
+const extractCandidatePaths = (text) => {
+  const found = [];
+  CANDIDATE_PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = CANDIDATE_PATH_RE.exec(String(text))) !== null) found.push(m[1]);
+  return [...new Set(found)];
+};
+
+// One rule per ecosystem, each anchored at the END of the path. Adding an ecosystem is a data edit.
+const BUILTIN_TEST_PATH_RULES = [
+  { ecosystem: 'js', re: /\.(?:test|spec)\.(?:ts|tsx|mts|cts|mjs|cjs|js|jsx)$/ },
+  { ecosystem: 'pytest', re: /(?:^|\/)test_[^/]+\.py$/ },
+  { ecosystem: 'pytest', re: /[^/]+_test\.py$/ },
+  { ecosystem: 'go', re: /[^/]+_test\.go$/ },
+  { ecosystem: 'rust', re: /(?:^|\/)tests\/[^/]+\.rs$/ },
+  { ecosystem: 'rust', re: /(?:^|\/)tests\.rs$/ },
+  { ecosystem: 'jvm', re: /[^/]+(?:Test|Tests|IT|Spec)\.(?:java|kt|kts|scala|groovy)$/ },
+  { ecosystem: 'dotnet', re: /[^/]+(?:Test|Tests)\.(?:cs|fs|vb)$/ },
+];
+const KNOWN_ECOSYSTEMS = 'JS/TS *.test|spec.[tj]s, pytest test_*.py + *_test.py, Go *_test.go, Rust tests/*.rs + tests.rs, JVM *Test|Tests|IT|Spec.java|kt|kts|scala|groovy, .NET *Test|Tests.cs|fs|vb';
+// The override channel lives in the manifest the pipeline ALREADY probes at Step 0 — a second
+// dotfile would be a second thing to keep in sync. Resolved against the TARGET REPO cwd (the gate
+// command cd's into the repo first); never shelled out to `dz project-skills`, because a gate that
+// needs a working `dz` to decide whether a path is a test inherits every one of dz's own failures.
+const MANIFEST_REL = 'architecture/project-skills.json';
+function loadTestPathRules() {
+  const rules = BUILTIN_TEST_PATH_RULES.slice();
+  const manifestPath = join(process.cwd(), MANIFEST_REL);
+  if (!existsSync(manifestPath)) return rules;
+  let text = null;
+  try { text = readFileSync(manifestPath, 'utf-8'); } catch { notEstablished(`testPathRules unreadable: ${MANIFEST_REL} could not be read`); }
+  let manifest = null;
+  try { manifest = JSON.parse(text); } catch { notEstablished(`testPathRules unreadable: ${MANIFEST_REL} is not valid JSON`); }
+  const extra = (manifest !== null && typeof manifest === 'object' && !Array.isArray(manifest)) ? manifest.testPathRules : undefined;
+  // ABSENT is not an error — the built-ins stand. Only a PRESENT-but-broken override is fatal: a
+  // silent fall-back to built-ins would tell a project its rules are live when they are not.
+  if (extra === undefined || extra === null) return rules;
+  if (!Array.isArray(extra)) notEstablished('testPathRules unreadable: testPathRules is present but is not an array');
+  for (const entry of extra) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) notEstablished('testPathRules unreadable: an entry is not a {ecosystem, pattern} object');
+    const eco = typeof entry.ecosystem === 'string' ? entry.ecosystem.trim() : '';
+    if (eco === '') notEstablished('testPathRules unreadable: an entry has no non-empty "ecosystem"');
+    if (typeof entry.pattern !== 'string' || entry.pattern === '') notEstablished(`testPathRules unreadable: entry "${eco}" has no non-empty "pattern"`);
+    if (entry.pattern.length > 200) notEstablished(`testPathRules unreadable: entry "${eco}" pattern exceeds 200 characters`);
+    // The ONE catastrophic-backtracking shape a length cap does not bound. Refused by SHAPE, because
+    // this sandboxless script cannot enforce a match timeout.
+    if (/\([^)]*[+*][^)]*\)[+*]/.test(entry.pattern)) notEstablished(`testPathRules unreadable: entry "${eco}" pattern nests a quantifier over a quantified group (catastrophic backtracking)`);
+    let re = null;
+    // WRAP, never append a bare `$`: `foo|bar` + `$` anchors only the LAST branch, so `src/foolish.py`
+    // would match `foo` unanchored and an arbitrary source file would count as a Confirmation test.
+    try { re = new RegExp('(?:' + entry.pattern + ')$'); } catch { notEstablished(`testPathRules unreadable: entry "${eco}" pattern is not a valid regular expression`); }
+    rules.push({ ecosystem: eco, re: re });
+  }
+  return rules;
+}
+
 if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
   failures.push(`C1: tier ${TIER} has NO ADR files under 03_adr/ — an M/L/XL feature owes at least one ADR; the plan cannot be complete against decisions that were never written`);
   failures.push(`C2: tier ${TIER} has no 03_adr/ — no Confirmation test can be checked`);
@@ -101,18 +174,78 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
   }
 
   // C2 — every Confirmation-listed test file path appears in the plan
-  const testPathRe = /(?:packages\/[\w@/.-]+\/test\/[\w./-]+\.test\.(?:ts|mjs|js)|tests?\/[\w./-]+\.test\.(?:ts|mjs|js))/g;
+  const testPathRules = loadTestPathRules();
+  const isTestPath = (p) => testPathRules.some((r) => r.re.test(p));
   for (const f of adrFiles) {
     const adr = readFileSync(join(adrDir, f), 'utf-8');
     const confIdx = adr.search(/^##+\s*Confirmation/mi);
     if (confIdx < 0) { failures.push(`C2: ${safe(f)} has no Confirmation section`); continue; }
     const conf = adr.slice(confIdx);
-    const paths = [...new Set((conf.match(testPathRe) ?? []))];
-    if (paths.length === 0) { failures.push(`C2: ${safe(f)} Confirmation names no test file paths`); continue; }
+    const paths = extractCandidatePaths(conf).filter(isTestPath);
+    // UNKNOWN ECOSYSTEM STAYS A FAILURE, never a WARN: a gate that downgrades itself on the one
+    // repo it cannot read is a gate that is off exactly where it is needed. The remedy is named
+    // in the message instead.
+    if (paths.length === 0) { failures.push(`C2: ${safe(f)} Confirmation names no test file paths (recognised: ${KNOWN_ECOSYSTEMS}; extend the vocabulary with a "testPathRules" array in ${MANIFEST_REL})`); continue; }
     for (const p of paths) if (!plan.includes(p)) failures.push(`C2: ${safe(f)} Confirmation test ${safe(p)} NOT named in the plan`);
   }
 }
 
+// ── C3 target-path admissibility (P16/D3) — named rules, not one character class ───────────────
+// A LEADING DOT is legitimate: `.claude/`, `.github/workflows/ci.yml`, `.gitignore`, `.env.example`
+// are ordinary targets in every ecosystem, and until the 2026-08-20 bootstrap fix the `^[\w@]…`
+// class rejected every one of them — so feature-adr could not name its OWN files and no feature
+// could touch CI config. Found by a run that stopped at this very gate while trying to fix the gate.
+//
+// This is the HARDENING of that minimal fix, and it answers the three holes it left:
+//  (a) the traversal rule was a SUBSTRING test, so an ordinary filename `foo..bar.ts` collected the
+//      label `path traversal` (MEASURED). It is replaced by SEGMENT rules: a segment exactly `..` is
+//      traversal; a segment of nothing but dots is a DEGENERATE NAME — a different defect that must
+//      not borrow the traversal label. Coverage is not weakened: `..`, `../`, `../etc/passwd` and
+//      `.a/../b` all carry a `..` SEGMENT and are still refused.
+//  (b) a directory-shaped target (`.claude/`) was ACCEPTED and gives Step-6/7 plan-vs-diff matching
+//      nothing concrete to verify against — rejected now, by its own name.
+//  (c) every refusal names WHAT is wrong. The old catch-all `not a plain repo-relative path` fired
+//      for an illegal character, a bad first character and a stray dot alike.
+// A named reason that LIES is worse than a generic one: the leading-stem message is emitted ONLY for
+// a path that actually starts with a dot, never for `-foo.ts` or `+x.ts`.
+const MARKDOWN_RESIDUE_RE = /[*#\[\]()]/;
+const LEGAL_TARGET_CHAR_RE = /[A-Za-z0-9_@./-]/;
+function classifyTargetPath(path) {
+  const reasons = [];
+  if (/\s/.test(path)) reasons.push('contains whitespace');
+  if (MARKDOWN_RESIDUE_RE.test(path)) reasons.push('markdown residue');
+  if (path.startsWith('/')) reasons.push('absolute path — targets are repo-relative');
+  if (path.startsWith('~')) reasons.push('home-relative path — targets are repo-relative');
+  const anchoredHere = path === '.' || path.startsWith('./');
+  if (anchoredHere) reasons.push('not repo-relative (anchored at the current directory)');
+  const segs = path.split('/');
+  let dotDot = false, degenerate = false, emptySeg = false, trailingDotSeg = false;
+  for (let i = 0; i < segs.length; i++) {
+    const s = segs[i];
+    if (s === '..') { dotDot = true; continue; }
+    if (/^\.+$/.test(s)) { if (s.length >= 3 || (i > 0 && !anchoredHere)) degenerate = true; continue; }
+    if (s === '') { if (i > 0 && i < segs.length - 1) emptySeg = true; continue; }
+    if (s.endsWith('.')) trailingDotSeg = true;
+  }
+  if (dotDot) reasons.push("path traversal ('..' segment)");
+  if (degenerate) reasons.push('degenerate path segment');
+  if (emptySeg) reasons.push('empty path segment');
+  if (path.endsWith('/')) reasons.push('trailing slash — names a directory, not a file');
+  if (trailingDotSeg) reasons.push("path segment ends with '.'");
+  // Residual character check — LAST, and it names the first offender instead of shrugging. Characters
+  // already explained by the whitespace/markdown rules are skipped so one defect gets one reason.
+  const scanned = path.startsWith('~') ? path.slice(1) : path;
+  const illegal = [...scanned].find((c) => !LEGAL_TARGET_CHAR_RE.test(c) && !/\s/.test(c) && !MARKDOWN_RESIDUE_RE.test(c));
+  if (illegal !== undefined) reasons.push(`illegal character '${illegal}'`);
+  // The leading stem: a dot must be followed by a REAL name (`.-` has an empty stem), and any other
+  // path must start with a word character, '@' or '.'. Suppressed where a structural rule above
+  // already explains the first character, so the operator is never handed a reason that is false.
+  else if (!/^\.?[\w@]/.test(path) && !path.startsWith('/') && !path.startsWith('~') && !anchoredHere && !dotDot && !degenerate) {
+    reasons.push(path.startsWith('.') ? 'empty stem after the leading dot' : "path does not start with a letter, digit, '_', '@' or '.'");
+  }
+  return reasons;
+}
+
 // C3 — EXPECTED_CODE_TARGETS block, line-level validation
 const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
 if (!blockM) failures.push('C3: no EXPECTED_CODE_TARGETS: block in the plan');
@@ -121,11 +254,7 @@ else {
   if (lines.length === 0) failures.push('C3: EXPECTED_CODE_TARGETS block is empty');
   for (const ln of lines) {
     const path = ln.replace(/^[-*]\s*/, '').replace(/`/g, '').trim();
-    const reasons = [];
-    if (/\s/.test(path)) reasons.push('contains whitespace');
-    if (/\.\./.test(path)) reasons.push('path traversal');
-    if (/[*#\[\]()]/.test(path)) reasons.push('markdown residue');
-    if (!/^[\w@][\w@/.-]*$/.test(path)) reasons.push('not a plain repo-relative path');
+    const reasons = classifyTargetPath(path);
     if (reasons.length) failures.push(`C3: target line rejected: "${safe(ln)}" — ${reasons.join(', ')}`);
   }
 }
@@ -152,7 +281,15 @@ if (acidArg) {
   const declaresTable = /\|\s*Acid case\s*\|/i.test(complexity);
   if (declaresTable && acidTokens.length === 0) failures.push('C4-malformed: 00_complexity_assessment.md declares an acid-case table but NO `| A<n> |` row parsed from it');
 }
-if (acidTokens.length === 0) skips.push('C4: no acid corpus declared (no --acid, no `| A<n> |` table in 00_complexity_assessment.md) — acid-naming check SKIPPED');
+// ABSENT INPUT is not a deliberate skip. Until 2026-08-21 both read the same: `SKIP C4`. The owner
+  // asked why the tier is recorded nowhere, and the answer was that Step 0 never writes
+  // 00_complexity_assessment.md at all (MEASURED: 66 of 199 features have it; the last four in a row
+  // did not) — so the acid check quietly switched itself off for every one of them, including the
+  // features that INTRODUCED it. A check that could not read its input must not look like a check that
+  // read its input and found nothing to do.
+  if (acidTokens.length === 0 && !acidArg && !existsSync(complexityPath)) {
+    warnings.push('C4: 00_complexity_assessment.md is ABSENT — the acid-naming check had no input to read (a missing Step-0 artifact, not a clean skip)');
+  } else if (acidTokens.length === 0) skips.push('C4: no acid corpus declared (no --acid, no `| A<n> |` table in 00_complexity_assessment.md) — acid-naming check SKIPPED');
 else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(plan)) failures.push(`C4: acid token "${safe(t)}" (from ${acidSource}) not named in the plan`);
 
 // C5 — Inputs read line