@dzhechkov/keysarium 1.7.6 → 1.7.8

package/.dz-manifest.json

@@ -3,9 +3,13 @@
     "version": 3,
     "pack": "keysarium",
     "files": [
+      {
+        "path": "LICENSE",
+        "sha256": "3b93f7070f6843f37e0cae255f7caff22b466a4017fd2020d7d3216237e5a701"
+      },
       {
         "path": "README.md",
-        "sha256": "3b4f6570d8cebd26429409ed23da99ddd082c378946cf722fe62d5b405e288c2"
+        "sha256": "384c02be209742869d2a88e87746abad359d4099acb0146a68b9b86dd13d47dd"
       },
       {
         "path": "README.ru.md",
@@ -17,7 +21,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "67d60a0ad58316ec7c0cd264683d6d17e5fe7f33c746f151b95c0def597037d6"
+        "sha256": "1dd2e14eb1a9f3108c5bf607490bf36127a655cfc8aa89136a2f164332757c6c"
       },
       {
         "path": "src/cli.js",
@@ -345,7 +349,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
+        "sha256": "28c265603481f976a52ea4c627e11194f3c0283801ea93d02cbb9f4248b43c68"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -381,15 +385,15 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "5c8d4c79d5329702b8c75b9afb36ae335aa63c99e74045c0afa98e12658ee975"
+        "sha256": "d7a2a4e56b24451da234b1ac4ef440ba9b0370617e1c0cde8ad5f3d575a53209"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
-        "sha256": "fb054591e86d55cee184eab96b5f0440053ada8fa9edf619e4a66ec5ac371587"
+        "sha256": "db79f8d026cc47edd1e5d2f30d0e1455c55c570dd022d549d440985a3e5940a5"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "7973676cc9a5a6d8429c0bcdbe163bb5dc16e2d2f28a72698e44ad72d234e199"
+        "sha256": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -479,9 +483,13 @@
         "path": "templates/.claude/skills/feature-adr/references/qe-checklist.md",
         "sha256": "238d8896996dc53559f58b24aa7eca966cc8845c3b9dda6d982c717c657b91e4"
       },
+      {
+        "path": "templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs",
+        "sha256": "19c3991bfb5e88205c9ff6d4d44037c136a190581bab199d3928196e4616fe15"
+      },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "08e69d2e63350fe2dc64483226fcd30901b77a8e930ca6280ef71181c67675b4"
+        "sha256": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
@@ -989,5 +997,5 @@
       }
     ]
   },
-  "signature": "Ld7xkqWgfHmJp0Xv+wKYPylP5opGZmCfibsIDam0NS90aZ6R9oLfJVeRljITB25umc7/zHZMW1MWLbMornUgDQ=="
+  "signature": "fTGSL3MpU5nWefu5K27ZehkXuMSbnESMohNdhhWggVsNtHkbsRP+fYgSdHRJEK7Qx86dOYvgywTLcveS5vjZCA=="
 }

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dzhechko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,9 +1,26 @@
 # @dzhechkov/keysarium
 
+Current package version: `1.7.8`. <!-- dz:version -->
+
+Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/keysarium
+
 **AI Case Research Toolkit for Claude Code**
 
 Full 7-phase pipeline for AI case studies, hackathons, and casariums. Provides skills, commands, rules, shards, agent templates, and brain portability for [Claude Code](https://docs.anthropic.com/en/docs/claude-code).
 
+Bundled feature-adr usage guidance records observed stage metadata/source IDs through existing
+writers and reads explicit Wf/FA project evidence. Unknown dimensions and full prices stay null;
+independent verification, family estimates and billing absence remain visible.
+
+The bundled feature-adr Step 8 now carries explicit existing round/run/task identity through its plain
+Claude bridge contract using the execution project. Preflight conflicts refuse before review; matching
+and legacy-window assurance remain distinct. Native Workflow QE does not add a duplicate bridge review.
+
+The bundled feature-adr Code module now ships the shared `scripts/build-coder-context.mjs` helper.
+It supplies bounded literal requirements, plan tasks and ADR Decision/Confirmation; plain coding
+reads or embeds its successful block, and Workflow fingerprints current inputs before code reuse.
+Required missing or incomplete context refuses coding. This helper is separate from advisory recall.
+
 ---
 
 
@@ -473,3 +490,22 @@ harness-core's `src/markdown-masker.ts`. It runs without a core build. Amendment
 and K2 share the parser while retaining their existing unclosed-block and indentation policies.
 The four-space indented-code gap remains open for amendment checks and K2; swarm briefs retain their
 existing masking of indented code. Versions are unchanged in this staged change.
+
+### Codex companion for feature-adr
+
+`dz statusline --watch --project "/path/to/worktree" --brain "/path/to/shared-brain"
+--slug "feature-slug" --run-id "stable-run-id"` adds an explicitly launched adjacent terminal
+companion, including Plain runs. Until installed, invoke the worktree-built
+`node packages/@dzhechkov/harness-cli/dist/bin.js statusline --watch ...`. This extends the existing
+command inventory. Canonical feature-adr guidance supplies the quoted producer/observer recipe: record
+a stable run ID and actual tier at the START of each step, then `done` on real completion; recall/teach
+remain scoped to the shared brain. Project run state and brain counts are separate. One slug retains
+one latest run; report freshness is not process liveness and stage position is not passed gates.
+
+The readonly companion requires a dedicated stdout TTY, uses serial 2-second refreshes (0.25–60
+allowed), sanitizes/clips text and handles resize. Below 40x8 it shows a size warning. Ctrl-C/SIGTERM
+exit 0; output failure 1; invalid/piped watch 2. Failed/absent counts and optional values are explicit;
+watch v1 ETA is unavailable and global source inventory omitted. No stdin/raw mode, models, logical
+store writes or automatic terminal/settings changes. Normal SQLite ephemeral WAL/SHM sidecars are
+permitted. One-shot Claude text/JSON/ETA remain unchanged. Codex native footer capability is not
+asserted; parity names manual `dz statusline --watch` access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "scripts": {},
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
@@ -38,7 +38,7 @@
     "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/keysarium"
   },
-  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/keysarium#readme",
+  "homepage": "https://aicoding.space",
   "bugs": {
     "url": "https://github.com/djd1m/dz-harness/issues"
   },

package/sbom.json

@@ -9,13 +9,23 @@
     }
   },
   "components": [
+    {
+      "type": "file",
+      "name": "LICENSE",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "3b93f7070f6843f37e0cae255f7caff22b466a4017fd2020d7d3216237e5a701"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "README.md",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3b4f6570d8cebd26429409ed23da99ddd082c378946cf722fe62d5b405e288c2"
+          "content": "384c02be209742869d2a88e87746abad359d4099acb0146a68b9b86dd13d47dd"
         }
       ]
     },
@@ -49,7 +59,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "67d60a0ad58316ec7c0cd264683d6d17e5fe7f33c746f151b95c0def597037d6"
+          "value": "1dd2e14eb1a9f3108c5bf607490bf36127a655cfc8aa89136a2f164332757c6c"
         }
       ]
     },
@@ -869,7 +879,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
+          "content": "28c265603481f976a52ea4c627e11194f3c0283801ea93d02cbb9f4248b43c68"
         }
       ]
     },
@@ -959,7 +969,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5c8d4c79d5329702b8c75b9afb36ae335aa63c99e74045c0afa98e12658ee975"
+          "content": "d7a2a4e56b24451da234b1ac4ef440ba9b0370617e1c0cde8ad5f3d575a53209"
         }
       ]
     },
@@ -969,7 +979,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fb054591e86d55cee184eab96b5f0440053ada8fa9edf619e4a66ec5ac371587"
+          "content": "db79f8d026cc47edd1e5d2f30d0e1455c55c570dd022d549d440985a3e5940a5"
         }
       ]
     },
@@ -979,7 +989,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7973676cc9a5a6d8429c0bcdbe163bb5dc16e2d2f28a72698e44ad72d234e199"
+          "content": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
         }
       ]
     },
@@ -1203,13 +1213,23 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "19c3991bfb5e88205c9ff6d4d44037c136a190581bab199d3928196e4616fe15"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "08e69d2e63350fe2dc64483226fcd30901b77a8e930ca6280ef71181c67675b4"
+          "content": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -562,13 +562,91 @@ only the statusline:
 
 **Record the panel at the START of every step, not only at Steps 0/8/9.** The panel shows the last step
 that reported; a pipeline that reports three times per run shows a stale step for most of its life. Emit
-`dz statusline --fa-record --slug <slug> --step "<Step N Name>" --recalled <n> --stored <n>` as the first
+`dz statusline --fa-record --project "<worktree>" --slug "<slug>" --run-id "<stable-run-id>" --tier M --step "<Step N Name>" --recalled <n> --stored <n>` as the first
 action of each step. The recall/teach counts only change at Steps 0/8/9; the *step label* changes at every
 one of them.
 
 *Honesty note:* the panel is live only insofar as the pipeline records state — it reflects what the
 pipeline actually did with the loop (recalls that ran, stores that landed), not an aspirational count.
 
+### Plain observed usage receipts
+
+Use the existing witnessed writer for usage you actually observed. At a real stage boundary,
+capture the execution project, stable run/task, verbatim stage, actual model/family/role, attempt,
+tier/mode and source window/IDs available to this host. Missing fields remain null with their reason;
+do not infer input/cache from total, price from a model family, or tokens from invocation budgets.
+
+```bash
+dz feature-adr-record --kind ledger --stage "$CURRENT_STAGE" --project "$EXECUTION_PROJECT" \
+  --row "$OBSERVED_STAGE_ROW_JSON" --rollout-id "$ACTUAL_SESSION_ID" --turn-id "$ACTUAL_TURN_ID" --json
+dz usage --by-stage --project "$EXECUTION_PROJECT" --source fa-ledger --run "$STABLE_RUN_ID" --json
+```
+
+`OBSERVED_STAGE_ROW_JSON` is real host metadata: `runId`, `taskId`, `stage`, `model`, `family`, `role`,
+`attempt`, `tier`, `mode`, `tokens`/dimensions when observed, and optional separate `estimate` with
+tokens/costUsd/method/source/capturedAt. Omit selectors not known; window/cwd/model-only correlation
+is labelled legacy-window and cannot claim exact source verification. Source roots can be named with
+`--codex-sessions`. Exact IDs are validated against existing receipts; no new IDs or recall/teach occur.
+The source receipt subset is captured once; later source append cannot enlarge the old row.
+Captured payload integrity and every pricing-bearing dimension must match the original scoped source.
+A reported monetary amount belongs to one observation, not each expanded token receipt. Preserve an
+actual observation ID/scope/basis in optional `reportedCostObservation: { id, scope, basis }` within
+`--row` when known; otherwise a captured source scope supplies a stable identity and unrelated money
+attribution stays unavailable. Reimports of the same observation count once; conflicting amounts are
+diagnosed. Missing money differs from zero. Exports must avoid every selected authoritative source,
+including custom run directories and symlink aliases. Invalid Claude counters retain nulls/diagnostics;
+a declared invalid total cannot derive a replacement, and accounting validity does not rewrite the
+actual generation outcome.
+
+For Wf, use `--source workflow-budget --run <id>` and optional `--run-dir <dir>` for its existing
+budget/trace/state. Auto source collisions require an explicit source; joined Wf summary projections
+never add another cost. Preserve reported total basis and cache/reasoning subsets. Wf budget.spent
+counts dispatch units; native Workflow's existing budget delta is output-only. Neither is raw total.
+
+Reports separate conservation, expected inventory and independent amount verification. Without
+a same-scope witness, verified totals are null even when reported values conserve. Unknown rates or
+split keep primary estimated USD null; static family estimates, provider-reported USD and caller
+pre-run estimates are separate, never current exact prices or billed amounts. Billing remains unobserved.
+
+### Codex companion terminal (Plain included)
+
+Open an adjacent terminal or a manual tmux split and launch the observer explicitly. Codex does not
+have a dz native command-provider footer. Keep the producer's project, slug and stable run ID equal to
+the observer's; use the actual complexity tier at the START of every active step. Brain is the shared
+learning store for recall/teach, while project is the worktree containing run slots and branch.
+
+```bash
+# Set these to your actual absolute paths. Use the worktree build until the change is installed.
+PANEL_CLI="/path/to/worktree/packages/@dzhechkov/harness-cli/dist/bin.js"
+PANEL_PROJECT="/path/to/worktree"
+PANEL_BRAIN="/path/to/canonical-brain"
+PANEL_SLUG="feature-slug"
+PANEL_RUN="feature-20261002-1"  # choose once per invocation, retain at every step
+node "$PANEL_CLI" statusline --watch --project "$PANEL_PROJECT" --brain "$PANEL_BRAIN" \
+  --slug "$PANEL_SLUG" --run-id "$PANEL_RUN" --interval 2
+# In the producer terminal, at the START of each real step (example: tier M):
+node "$PANEL_CLI" statusline --fa-record --project "$PANEL_PROJECT" --slug "$PANEL_SLUG" \
+  --run-id "$PANEL_RUN" --tier M --step "Step 7 Code" --recalled 3 --stored 0
+# Only after the run actually completes; this is not a claim that QE passed:
+node "$PANEL_CLI" statusline --fa-record --project "$PANEL_PROJECT" --slug "$PANEL_SLUG" \
+  --run-id "$PANEL_RUN" --tier M --step "done" --recalled 3 --stored 0
+```
+
+Use `dz recall ... --project "$PANEL_BRAIN"` and `dz teach ... --project "$PANEL_BRAIN"` for actual
+learning. Supply measured cumulative counters, not the example numbers. The observer counts its brain
+source directly; the slot's producer pool is not a shared-brain inventory. One slug holds one latest
+run, so a replacement makes an exact old selection missing. No selectors means visibly automatic
+selection. Freshness measures producer-report age, not process liveness: fresh <30 minutes, stale
+30–<90, expired >=90; completed remains completed. Stage position is not completed gates.
+
+Watch v1 displays ETA unavailable, unknown optional values and unavailable failed/absent learning
+sources, and omits ambiguous global source inventory. It uses escaped ASCII text, a dedicated stdout
+TTY, 0.25–60 second intervals (default 2), and a size warning below 40 columns/8 rows. Ctrl-C/SIGTERM
+exit 0; output failures exit 1; piped output and watch+JSON/install/record combinations exit 2.
+Observation never reads stdin, runs models or writes logical store state. SQLite-managed ephemeral
+WAL/SHM files are permitted; no application locks, repair or schema changes occur. One-shot Claude
+statusline/JSON and its ETA keep their existing behavior. Do not start a terminal automatically.
+
 ### What changes with `--full-qe`
 
 Full agentic-qe protocols for the same 9 core skills. No new agents, just deeper methodology.

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -235,6 +235,16 @@ C2 recognises JS/TS, pytest, Go, Rust, JVM and .NET test paths, extensible per p
 
 Never proceed on a non-zero exit, and never treat empty output as a pass — the last line
 (`K2 plan-completeness: PASS|FAIL|NOT-ESTABLISHED`) is the verdict, and its absence is not one.
+
+**Where an id counts (the default since 2026-09-27, owner decision).** C1 and C8 read the plan's
+TASK LINES only: a heading, a list item or a table row. An `ADR-<n>` or `FR-<n>` that appears only
+in a prose paragraph, a fenced code block (the SPARC-GOAP ```yaml goal state included), an HTML
+comment, the `## Amendments` section or the `EXPECTED_CODE_TARGETS:` block is a mention, not a task,
+and the gate FAILs it with `(cited only outside task lines)`. Write the id on the FIRST line of the
+task that implements it: a wrapped continuation line of a list item is not read either. Measured on the archive when the default changed: 56 of 102 plans that had
+passed would fail this reader, so a plan written before that date may be red on a re-check — move
+the citation onto a task line, or re-check that one plan with `--no-require-task-lines` and say so
+in the checkpoint banner.
 What it checks: C1 every ADR **decision** (a `# ADR-NNN` / `## ADR-NNN` heading INSIDE the file, not
 just the filename prefix — a file with several headings owes several plan citations) has a plan task
 citing it · C2 every ADR Confirmation test path is named in the plan · C3 the `EXPECTED_CODE_TARGETS:`

package/templates/.claude/skills/feature-adr/modules/07-code.md

@@ -26,6 +26,35 @@ opus (complex code generation)
 
 ### 1. Pre-Implementation Checklist
 
+### Current literal context (plain and delegated coding)
+
+Before coding or delegating, run the installed helper beside this module. Set `CONTEXT_HELPER` to
+the absolute `scripts/build-coder-context.mjs` path of the skill installation you are reading;
+set `FEATURE_DIR` to the absolute target `features/<slug>` directory and use the actual tier:
+
+```bash
+node "$CONTEXT_HELPER" "$FEATURE_DIR" --tier=M
+```
+
+The command emits exactly one JSON envelope and exits 0 only for `status: "complete"`. On any
+nonzero exit, unavailable/incomplete status, malformed JSON or required missing/empty section,
+stop before coding and repair the named input. Never paste a partial result as complete. A missing
+helper requires restoring this skill installation, not inventing a replacement block.
+
+For every delegated coder assignment, paste the successful envelope's literal `promptBlock` into
+the actual prompt, then append the existing advisory decision-recall block once. Keep the source
+paths below for deeper reading. For single-agent in-session coding, read this generated block
+directly before implementing. Requirements and plan are included in full; each ADR supplies its
+Decision and Confirmation with source labels. M/L/XL require at least one ADR; S can have none.
+
+The same canonical helper is used by the programmatic Workflow before code checkpoint lookup.
+It fingerprints full current inputs and binds the prompt separately, so changed documents cannot
+reuse old code. The plain mode boundary is an executable helper command plus these required
+read/embedding instructions; there is no separately automated plain dispatcher. Pure/fixture tests
+do not establish a live model relay's authenticity. Helper bounds are 64 documents, 256 KiB/file,
+1 MiB read and 96 KiB UTF-8 for the entire labelled block; exceeded bounds refuse without trimming.
+These are document limits, not a new limit on the existing coder wrapper's final prompt.
+
 Before writing any code:
 - [ ] Read existing similar implementations in codebase
 - [ ] Identify naming conventions (files, classes, functions, variables)

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -23,6 +23,30 @@ sonnet (analytical evaluation)
 
 ## Protocol
 
+### Bridge identity for plain Step 8
+
+When the plain host invokes the existing Claude review bridge, take round number, pipeline run and
+task from the current round receipt/state in the execution project. Pass the fields actually present:
+
+```bash
+dz qe-bridge --family claude --slug "$FEATURE_SLUG" --project "$EXECUTION_PROJECT" \
+  --round "$CURRENT_ROUND" --round-run "$CURRENT_ROUND_RUN" --task "$CURRENT_TASK" \
+  --coder-family codex
+```
+
+Do not mint missing identifiers or point `--project` at a separate learning brain. Explicit identity
+must agree with one readable open round before any probe or review child; conflicts refuse with exit 2.
+The bridge freezes that snapshot for the signoff. Signoff `roundRun` is the pipeline run; its existing
+`runId` identifies the separate bridge invocation and audit filenames. No-flags standalone reviews
+retain best-effort lookup and visibly unbound provenance when authority is absent or unavailable.
+
+Round close validates every present identity field before selection. Full, partial and genuinely
+identity-free window assurance appear as `round-run-task`, `partial-identity` and `legacy-window`.
+Malformed or foreign claims cannot become a manual-close fallback. This contract governs the
+existing plain bridge and control-review caller; native Workflow QE already runs its own review and
+must not invoke a second bridge to manufacture this receipt. Local fake-child tests do not establish
+a live Claude model roundtrip or secure every native Codex QE receipt.
+
 ### 1. Smoke Tests (All tiers)
 
 ```
@@ -205,7 +229,9 @@ list), grep for unfinished-stub markers: `TODO` / `FIXME` / `HACK` / `XXX` / `PL
 file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or
 `.dz/guard.json` `stubWaivers` lists the path WITH a reason. A REASONLESS waiver is itself a HIGH gap,
 never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan
-as the SOFT `no-stubs` rule over the working-tree diff. When you QUOTE a marker in `08_qe_report.md`,
+as the SOFT `no-stubs` rule over the working-tree diff.
+After the Step-7 code has landed, run `dz guard check --op code --json` and treat a HARD `block` verdict
+as a HIGH finding naming the drifted file. When you QUOTE a marker in `08_qe_report.md`,
 backtick it so the report itself scans clean (the claim-check forbidden-phrase convention). Record the
 verdict in the ADR Fitness section.
 
@@ -311,6 +337,9 @@ Compile all findings into a structured report:
 ✅ READY FOR MERGE | ❌ NEEDS FIXES | ⚠️ CONDITIONAL APPROVAL
 ```
 
+Settle a cross-family re-QE debt with `dz reqe --slug <s> --done --report <08b>`.
+For `dz reqe --done`, exit 3 means the review settled but named BLOCKER/HIGH findings — stop and surface them to the owner.
+
 ### 7.1 Findings ledger (machine-readable)
 
 Prose is for people; `dz score`/`dz recap` need a machine-readable surface too (qe-findings-record,
@@ -356,6 +385,45 @@ An empty (header-only) table is read as `hollow: true` — worse than no table a
 claims a ledger exists and says nothing. If there are no findings, omit the section entirely rather
 than writing an empty table.
 
+### 7.2 Ledger row for this QE step (mandatory)
+
+Plain mode (this SKILL, not the ultracode `Workflow`) has no in-process `appendRunCostRow` — without
+this step the QE instrument's own pass leaves ZERO trace in the run-cost ledger (aqe-ledger-row,
+owner audit 17.09, decision #3).
+
+**Resume guard — check this FIRST, before writing anything.** If QE was RESTORED from a checkpoint
+for THIS run (`features/<slug>/.fa-state/checkpoints.jsonl` already contains a line for stage `qe`
+that matches this run) — the row for this review was already written by the run that actually did
+it. Do **NOT** run the command below in that case; instead write exactly this line into
+`08_qe_report.md`: `qe ledger row skipped — stage resumed`. Writing the row anyway would double-pay
+the same review in the ledger (aqe-ledger-row fix-round-1/#3, Codex r1 HIGH #3 — plain mode had no
+resume guard at all before this).
+
+Otherwise — QE ran fresh in this pass — after `08_qe_report.md` is written and the grade is final, run:
+
+```bash
+dz feature-adr-record --kind ledger --stage qe --slug <slug> --row '<json>' --json
+```
+
+fix-round-1 (Codex r1 HIGH finding 4, ADR-001 D5): no `--auto` here. `--auto` is the trusted marker
+of an AUTOMATED pipeline run and requires an experiment envelope that the manual path does not have;
+this plain-mode row is written without it.
+
+`<json>` carries the same fields the ultracode pipeline writes for this row: `reviewer` (the model
+that reviewed, or `null` if unknown — never guessed), `reviewerFamily` (`claude`|`codex`|`null` when
+the reviewer identity is not one of the two known families — never guessed as `claude`), `qeRole`
+(`qe-code-reviewer` for a Claude reviewer; `codex-review`/`codex-exec` for a codex reviewer by scope
+mode; `null` otherwise), `grade`, `gradeSource` (if known), `findings` (gap count), `findingsBySeverity`
+(normalized `sev` -> count, unknown severities counted as `other`, never dropped), `findingsSource`
+(`gaps` or `no-gaps-array`), `claimCheck` (if run), `crossFamily` (bool: reviewer family != coder
+family — `null` when either family is unknown, since a same/cross-family verdict cannot be asserted
+without both), `qeScope` (if the reviewer ran scoped, e.g. codex `mode`/`ref`/`files`). Insert the
+writer's verdict (`{verdict:"written"|...}`) verbatim into `08_qe_report.md` so the record is
+auditable from the artifact itself. NAMED LIMIT (layer 4 of the cost-of-detection ladder, said
+honestly): this step is a skill instruction, not a code gate — nothing forces the agent to run it or
+to check the resume guard first; only its PRESENCE in this module is deterministically pinned (grep
+for the command above and for the resume-guard sentence).
+
 ### 8. QE Pattern Store (Direct Mode only)
 
 When `{AGENTIC_QE_MODE}` = `direct` | `direct-extended`, after the gap loop is closed and the verdict is set:

package/templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// One parser for workflow and plain Step 7. Importing this module performs no IO.
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCHEMA = 'fa-coder-context-1';
+const MAX_DOCUMENTS = 64;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 1024 * 1024;
+const MAX_PROMPT_BYTES = 96 * 1024;
+const sha = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+const kindOf = (path) => path === '01_requirements.md' ? 'requirements'
+  : path === '06_implementation_plan.md' ? 'plan'
+    : /^03_adr\/[0-9]{3}-[^/\\\x00-\x1f]+\.md$/.test(path) ? 'adr' : null;
+const diagnostic = (source, reason, section) => ({ source, reason, severity: 'error', ...(section ? { section } : {}) });
+
+// One lexical pass recognizes comments only outside Markdown code/escapes, retaining offsets.
+function markdown(text) {
+  const headings = [];
+  const visible = [];
+  let fence = null;
+  let comment = false;
+  let inlineEnd = -1;
+  let offset = 0;
+  for (const line of text.match(/[^\n]*\n|[^\n]+$/g) ?? []) {
+    const clean = line.replace(/\r?\n$/, '').replace(/^\uFEFF/, '');
+    const delimiter = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(clean);
+    if (fence) {
+      if (delimiter && delimiter[1][0] === fence.char && delimiter[1].length >= fence.length && delimiter[2].trim() === '') fence = null;
+      else visible.push(line);
+    } else if (!comment && inlineEnd <= offset && delimiter && !(delimiter[1][0] === '`' && delimiter[2].includes('`'))) {
+      fence = { char: delimiter[1][0], length: delimiter[1].length };
+    } else {
+      const wasComment = comment;
+      let masked = '';
+      for (let i = 0; i < line.length;) {
+        if (comment) {
+          if (line.startsWith('-->', i)) { masked += '   '; i += 3; comment = false; }
+          else { masked += /[\r\n]/.test(line[i]) ? line[i] : ' '; i++; }
+          continue;
+        }
+        if (offset + i < inlineEnd) { masked += line[i++]; continue; }
+        // An escaped '<' cannot start a comment; paired backslashes still allow the next opener.
+        if (line[i] === '\\' && i + 1 < line.length && /[!"#$%&'()*+,\-./:;<=>?@[\]\\^_`{|}~]/.test(line[i + 1])) {
+          masked += line.slice(i, i + 2); i += 2; continue;
+        }
+        if (line[i] === '`') {
+          const run = /^`+/.exec(line.slice(i))[0];
+          const rest = text.slice(offset + i + run.length);
+          // Code spans can wrap within a paragraph, but cannot hide a subsequent block heading/fence.
+          const boundary = /\n[ \t]*(?:\r?\n|#{1,6}[ \t]|`{3,}|~{3,})/.exec(rest);
+          const paragraph = boundary ? rest.slice(0, boundary.index) : rest;
+          const close = [...paragraph.matchAll(/`+/g)].find((match) => match[0].length === run.length);
+          if (close) inlineEnd = offset + i + run.length + close.index + run.length;
+          masked += run; i += run.length; continue;
+        }
+        if (line.startsWith('<!--', i)) { comment = true; masked += '    '; i += 4; continue; }
+        masked += line[i++];
+      }
+      const heading = !wasComment && /^ {0,3}(#{1,6})[ \t]+(.+?)\s*$/.exec(masked.replace(/\r?\n$/, '').replace(/^\uFEFF/, ''));
+      if (heading) headings.push({ depth: heading[1].length, title: heading[2].replace(/[ \t]+#+[ \t]*$/, '').trim(), start: offset, body: offset + line.length });
+      else visible.push(masked);
+    }
+    offset += line.length;
+  }
+  return { headings, unclosed: fence !== null, unclosedComment: comment, substantive: visible.join('').trim() !== '' };
+}
+
+/** Pure: consumes already-read documents only, and hashes the same snapshot used for the block. */
+export function buildCoderContext({ tier, documents }) {
+  const diagnostics = [];
+  const sources = [];
+  const blocks = [];
+  let bounded = true;
+  if (!['S', 'M', 'L', 'XL'].includes(tier)) diagnostics.push(diagnostic('tier', 'invalid-tier'));
+  if (!Array.isArray(documents)) documents = [];
+  if (documents.length > MAX_DOCUMENTS) { diagnostics.push(diagnostic('documents', 'document-limit')); bounded = false; }
+  const sorted = [...documents].sort((a, b) => String(a?.path).localeCompare(String(b?.path), 'en'));
+  const seen = new Set();
+  let total = 0;
+  for (const doc of sorted.slice(0, MAX_DOCUMENTS)) {
+    const path = doc?.path;
+    const kind = typeof path === 'string' && path.length <= 512 ? kindOf(path) : null;
+    if (!kind || typeof doc.text !== 'string') { diagnostics.push(diagnostic(String(path ?? 'documents'), 'invalid-source')); bounded = false; continue; }
+    if (seen.has(path)) { diagnostics.push(diagnostic(path, 'duplicate-source')); bounded = false; continue; }
+    seen.add(path);
+    const bytes = Buffer.byteLength(doc.text, 'utf8'); total += bytes;
+    const status = bytes > MAX_FILE_BYTES ? 'oversized' : 'read';
+    sources.push({ path, kind, bytes, digest: status === 'read' ? sha(doc.text) : null, status });
+    if (status !== 'read') { diagnostics.push(diagnostic(path, 'file-limit')); bounded = false; continue; }
+    const parsed = markdown(doc.text);
+    if (parsed.unclosed) diagnostics.push(diagnostic(path, 'unclosed-fence'));
+    if (parsed.unclosedComment) diagnostics.push(diagnostic(path, 'unclosed-comment'));
+    if (kind !== 'adr') {
+      if (!parsed.substantive) diagnostics.push(diagnostic(path, 'empty-section', 'body'));
+      blocks.push('\n\n### Source: ' + path + ' — body\n' + doc.text);
+      continue;
+    }
+    for (const section of ['Decision', 'Confirmation']) {
+      const matches = parsed.headings.filter((h) => h.depth >= 2 && h.title.toLowerCase() === section.toLowerCase());
+      if (matches.length !== 1) { diagnostics.push(diagnostic(path, matches.length ? 'duplicate-section' : 'missing-section', section)); continue; }
+      const heading = matches[0];
+      const next = parsed.headings.find((h) => h.start > heading.start && h.depth <= heading.depth);
+      const body = doc.text.slice(heading.body, next ? next.start : doc.text.length);
+      if (!markdown(body).substantive) diagnostics.push(diagnostic(path, 'empty-section', section));
+      blocks.push('\n\n### Source: ' + path + ' — ' + section + '\n' + body);
+    }
+  }
+  if (total > MAX_TOTAL_BYTES) { diagnostics.push(diagnostic('documents', 'aggregate-limit')); bounded = false; }
+  for (const path of ['01_requirements.md', '06_implementation_plan.md']) {
+    if (!seen.has(path)) {
+      sources.push({ path, kind: kindOf(path), bytes: 0, digest: null, status: 'missing' });
+      diagnostics.push(diagnostic(path, 'missing-source'));
+    }
+  }
+  if (tier !== 'S' && !sources.some((s) => s.kind === 'adr')) diagnostics.push(diagnostic('03_adr', 'missing-source'));
+  let promptBlock = '\n\n## Current coder context (literal source snapshot)' + blocks.join('');
+  if (tier === 'S' && !sources.some((s) => s.kind === 'adr')) promptBlock += '\n\nADR sources: none selected (tier S).';
+  if (Buffer.byteLength(promptBlock, 'utf8') > MAX_PROMPT_BYTES) {
+    diagnostics.push(diagnostic('promptBlock', 'prompt-limit')); promptBlock = '';
+  }
+  return { schema: SCHEMA, status: diagnostics.length ? 'incomplete' : 'complete', promptBlock,
+    digest: bounded ? sha(JSON.stringify([SCHEMA, tier, sorted.map((d) => [d.path, d.text])])) : null,
+    sources: sources.sort((a, b) => a.path.localeCompare(b.path, 'en')), diagnostics };
+}
+
+function hostContext(feature, tier) {
+  const failures = [];
+  const documents = [];
+  const failedSources = [];
+  let root;
+  const fail = (path, reason, status = 'unreadable', bytes = 0) => {
+    failures.push(diagnostic(path, reason));
+    failedSources.push({ path, kind: kindOf(path) ?? 'adr', bytes, digest: null, status });
+  };
+  try {
+    if (lstatSync(feature).isSymbolicLink() || !lstatSync(feature).isDirectory()) throw new Error('invalid-root');
+    root = realpathSync(feature);
+  } catch { return { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic(feature, 'invalid-root')] }; }
+  let paths = ['01_requirements.md', '06_implementation_plan.md'];
+  const adrDir = join(root, '03_adr');
+  try {
+    const stat = lstatSync(adrDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) fail('03_adr', 'invalid-file', 'invalid');
+    else paths.push(...readdirSync(adrDir).filter((name) => /^[0-9]{3}-.+\.md$/.test(name)).sort().map((name) => '03_adr/' + name));
+  } catch (error) { if (error.code !== 'ENOENT') fail('03_adr', 'read-failure'); }
+  if (paths.length > MAX_DOCUMENTS) return { schema: SCHEMA, status: 'incomplete', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('documents', 'document-limit')] };
+  let total = 0;
+  for (const path of paths) {
+    let fd;
+    try {
+      const file = join(root, path);
+      const stat = lstatSync(file);
+      if (stat.isSymbolicLink() || !stat.isFile()) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const actual = realpathSync(file);
+      const rel = relative(root, actual);
+      if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) { fail(path, 'outside-root', 'invalid'); continue; }
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      const opened = fstatSync(fd);
+      // Compare the opened descriptor with the contained file checked before open.
+      if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev || realpathSync(file) !== actual) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const chunks = []; let bytes = 0;
+      while (true) {
+        const chunk = Buffer.alloc(Math.min(16384, MAX_FILE_BYTES + 1 - bytes));
+        const count = readSync(fd, chunk, 0, chunk.length, null);
+        if (count === 0) break;
+        bytes += count; total += count; chunks.push(chunk.subarray(0, count));
+        if (bytes > MAX_FILE_BYTES || total > MAX_TOTAL_BYTES) break;
+      }
+      if (bytes > MAX_FILE_BYTES) { fail(path, 'file-limit', 'oversized', bytes); continue; }
+      if (total > MAX_TOTAL_BYTES) { fail(path, 'aggregate-limit', 'oversized', bytes); break; }
+      try { documents.push({ path, text: new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)) }); }
+      catch { fail(path, 'invalid-utf8', 'invalid', bytes); }
+    } catch (error) { fail(path, error.code === 'ENOENT' ? 'missing-source' : 'read-failure', error.code === 'ENOENT' ? 'missing' : 'unreadable'); }
+    finally { if (fd !== undefined) closeSync(fd); }
+  }
+  const result = buildCoderContext({ tier, documents });
+  if (failures.length) {
+    const failed = new Set(failedSources.map((s) => s.path));
+    result.sources = result.sources.filter((s) => !failed.has(s.path)).concat(failedSources).sort((a, b) => a.path.localeCompare(b.path, 'en'));
+    result.diagnostics = result.diagnostics.filter((d) => !(failed.has(d.source) && d.reason === 'missing-source')).concat(failures);
+    result.status = failures.every((d) => ['file-limit', 'aggregate-limit'].includes(d.reason)) ? 'incomplete' : 'unavailable';
+    result.digest = null;
+  }
+  return result;
+}
+
+function main(argv) {
+  const feature = argv[0];
+  const tier = argv.find((arg) => arg.startsWith('--tier='))?.slice(7);
+  let result;
+  if (!feature || !['S', 'M', 'L', 'XL'].includes(tier) || argv.some((arg, i) => i > 0 && arg !== '--tier=' + tier)) {
+    result = { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('arguments', 'invalid-arguments')] };
+  } else result = hostContext(resolve(feature), tier);
+  console.log(JSON.stringify(result));
+  return result.status === 'complete' ? 0 : 1;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) process.exitCode = main(process.argv.slice(2));

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -3,7 +3,7 @@
 // Generalized from features/wave1-instrument-repair/check-plan-completeness.mjs (that copy is the
 // historical artifact of its run and stays untouched); this one is parameterized by feature dir.
 //
-// USAGE:  node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs [<feature-dir>] [--tier=M] [--acid=A1,A2] [--require-requirements]
+// USAGE:  node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs [<feature-dir>] [--tier=M] [--acid=A1,A2] [--require-requirements] [--no-require-task-lines]
 //         <feature-dir> defaults to the current working directory.
 //         --tier=S|M|L|XL closes the ADR-less dodge (see S-TIER HONESTY); omitting it keeps the
 //         heuristic, and the skip note then names the dodge out loud.
@@ -11,6 +11,12 @@
 //         pipeline passes this flag, so the check is introduced two-shot (ADR-001 plan-inherits-
 //         requirements): WARN first so the corpus can be measured without repainting every green
 //         fixture red, FAIL once the planner prompt names the contract (feature-adr.js Step 6).
+//         C1 and C8 read the plan's TASK LINES by DEFAULT (C10 below; owner decision 2026-09-27,
+//         backlog 95565da0): an id cited only in prose, fenced code, an HTML comment, `## Amendments`
+//         or EXPECTED_CODE_TARGETS is not a task. --no-require-task-lines is the explicit way back
+//         to the raw-plan reader, where C10 only WARNs — for re-checking a plan written before the
+//         default changed. --require-task-lines is still accepted and means the default; passing
+//         BOTH is a contradiction and is refused (NOT-ESTABLISHED), never resolved silently.
 //
 // VERDICT CONTRACT (unchanged from the proven copy — never a silent pass):
 //   PASS            exit 0   last line: `K2 plan-completeness: PASS (...)`
@@ -20,16 +26,26 @@
 //  ONE regex parses all three verdicts — the exit codes and their meanings are identical.)
 // Set difference over IDENTIFIERS, not text similarity.
 //
-// KNOWN LIMITATION (measured on the discrimination twin, 2026-08-19): C1 is a grep — a PROSE
-// mention of "ADR-002" satisfies it exactly like a task reference. The real N14 (backlog
-// 3dbd2851-adjacent) must parse task structure. Kept honest here: C1 catches "forgot entirely",
-// not "mentioned but not tasked".
+// C1 AND C8 SHARE ONE PLAN-SIDE READER (k2-reads-masked-plan, backlog c03903eb, 2026-09-27).
+// Until then both were a grep over the RAW plan: an id in prose, a fenced code block, an HTML
+// comment, the `## Amendments` section or the EXPECTED_CODE_TARGETS block counted as a task
+// (named here as a limit since 2026-08-19 for C1 and 2026-09-16 for C8). `planTaskText()` now
+// answers "which plan text is a task" ONCE, for both checks — so one phrase can never pass one
+// check and fail the other. Introduced WARN-first (C10), because the corpus said so; the FAIL
+// half became the DEFAULT on 2026-09-27 by owner decision, with this measurement on the table:
+// MEASURED 2026-09-27 over all 472 features/*/06_implementation_plan.md, pipeline mode
+// (--require-requirements, tier read from 00): of 101 green plans, the task-line reader turns 55
+// red (an earlier snapshot of the same day; the count the owner decided on, taken later over 473
+// plans, was 56 of 102), and even mask-only (prose kept) turns 11 red — the SPARC-GOAP ```yaml goal-state block and
+// «ADR-001 governs every task» prose are the corpus's own idioms, not forgeries. So a plan that
+// was green before 2026-09-27 may be red on a re-check: that is the decision, not a regression —
+// cite the id on a task line, or re-check that plan with --no-require-task-lines and say so.
+// NAMED LIMIT: `planClaimsAdrWork` (S-tier honesty) and C2 still read the raw plan — a CLAIM of
+// ADR work in prose is still a claim, and C2 names test paths, not ids.
 //
-// KNOWN LIMITATION (fix round 1, 2026-09-16, same class as C1 above): C8 is also a grep — a PROSE
-// mention of "FR-3" satisfies it exactly like a task reference. Kept honest here too: C8 catches
-// "forgot entirely", not "mentioned but not tasked". Masking the PLAN side (not just the 01/ADR
-// side) for C1 and C8 together, so a prose mention stops satisfying either check, is a separate
-// backlog item — filed by the lead, not chased here.
+// KNOWN LIMITATION (C9): only byte-identical copies are visible before the edit. Already drifted
+// or intentionally different pinned copies remain the identity tests' job; the frozen
+// features/wave1-instrument-repair/check-plan-completeness.mjs is a real example C9 cannot see.
 //
 // Checks:
 //  C1  every ADR file in 03_adr/ has >=1 task line in 06_implementation_plan.md citing it (ADR-00N)
@@ -37,6 +53,8 @@
 //  C3  the plan carries an EXPECTED_CODE_TARGETS: block, non-empty, and EVERY line parses to a
 //      plausible repo-relative path (no spaces unless quoted, no traversal, no markdown residue)
 //      — SFDIPOT condition: line-level validation, reject-with-reason, not just block presence
+//  C9  every tracked byte-identical twin of a target is also listed or explicitly waived with a
+//      reason; size-first narrowing, fixed exclusions, one FAIL per missing (target, twin) pair
 //  C4  the plan names the feature's OWN acid corpus (see "acid corpus" below)
 //  C5  the plan has an 'Inputs read:' line naming 03_adr, 05_architecture (wave-2 seam, cheap here)
 //  C8  every requirement id DECLARED in 01_requirements.md (FR-N, NFR-N, AC-N, C-N, with an optional
@@ -79,7 +97,9 @@
 // supplied explicitly with `--acid=T1,T2,…`. If neither establishes a corpus, C4 is SKIPPED-with-note
 // (a feature that declared no acid cases cannot be failed for not naming them).
 import { maskMarkdown } from './markdown-masker.mjs';
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { isAbsolute, join, resolve } from 'node:path';
 
 const argv = process.argv.slice(2);
@@ -88,6 +108,8 @@ const tierArg = argv.find((a) => a.startsWith('--tier='));
 const TIER = tierArg ? tierArg.slice('--tier='.length).trim().toUpperCase() : null;
 const TIER_REQUIRES_ADR = TIER === 'M' || TIER === 'L' || TIER === 'XL';
 const REQUIRE_REQUIREMENTS = argv.includes('--require-requirements');
+const NO_REQUIRE_TASK_LINES = argv.includes('--no-require-task-lines');
+const REQUIRE_TASK_LINES = !NO_REQUIRE_TASK_LINES;
 const dirArg = argv.find((a) => !a.startsWith('--'));
 const FDIR = resolve(dirArg && dirArg !== '' ? (isAbsolute(dirArg) ? dirArg : join(process.cwd(), dirArg)) : process.cwd());
 const planPath = join(FDIR, '06_implementation_plan.md');
@@ -105,6 +127,7 @@ const safe = (v) => String(v)
   .slice(0, 300);
 const out = (s) => console.log(s);
 const notEstablished = (why) => { out(`K2 plan-completeness: NOT-ESTABLISHED — ${safe(why)}`); process.exit(3); };
+if (NO_REQUIRE_TASK_LINES && argv.includes('--require-task-lines')) notEstablished('both --require-task-lines and --no-require-task-lines were passed — pick one reader');
 let failures = [], warnings = [], skips = [];
 
 // Lead delta after Codex rounds 2+3 (2026-09-16, plan-inherits-requirements): on the DECLARATION side
@@ -128,6 +151,54 @@ if (!existsSync(FDIR)) notEstablished(`feature dir absent: ${FDIR}`);
 if (!existsSync(planPath)) notEstablished('06_implementation_plan.md absent');
 const plan = readFileSync(planPath, 'utf-8');
 if (plan.trim().length < 200) notEstablished('plan suspiciously small (<200 chars)');
+// The EXPECTED_CODE_TARGETS block as C3 reads it (C3 below reuses THIS match — one reader).
+const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
+
+// `## Amendments` as C6 reads it: up to three leading spaces, two to four hashes, trailing text
+// allowed; the section ends at the next level-1..4 heading. Returned as LINE indices over masked
+// lines — [headingLine, endLine). One definition for C6 and planTaskText, or the two drift.
+function findAmendmentsSection(maskedLines) {
+  let head = -1, end = -1;
+  for (let i = 0; i < maskedLines.length; i++) {
+    const pl = maskedLines[i];
+    if (head < 0 && /^ {0,3}#{2,4}\s+Amendments\b/.test(pl)) head = i;
+    else if (head >= 0 && end < 0 && /^ {0,3}#{1,4}\s/.test(pl)) end = i;
+  }
+  if (head >= 0 && end < 0) end = maskedLines.length;
+  return { head, end };
+}
+
+// C10 — the TASK LINES of the plan, the text C1/C8 cite against (the default reader).
+// Masked first (fences and HTML comments blanked, unclosed fence hidden — the K2 reader policy),
+// then: drop the `## Amendments` section and the EXPECTED_CODE_TARGETS block, and keep only
+// headings, list items and table rows. Table rows are kept deliberately, beyond the backlog's
+// «headings/list items»: task tables (`| T1 | … |`) are a corpus form — MEASURED 2026-09-27,
+// dropping them turns 12 more green plans red in pipeline mode (67 vs 55) and 26 more in WARN mode.
+// NAMED LIMIT: a list item or table row that is itself prose («- Note: ADR-001 governs …») still
+// counts — the reader tells structure from prose, not a task from a remark.
+function planTaskText(planText) {
+  const lines = maskMarkdown(planText, { unclosed: 'mask' }).split('\n');
+  const am = findAmendmentsSection(lines);
+  let tFrom = -1, tTo = -1;
+  if (blockM) {
+    tFrom = planText.slice(0, blockM.index).split('\n').length - 1;
+    tTo = planText.slice(0, blockM.index + blockM[0].length - 1).split('\n').length - 1;
+  }
+  const keep = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (am.head >= 0 && i >= am.head && i < am.end) continue;
+    if (tFrom >= 0 && i >= tFrom && i <= tTo) continue;
+    const l = lines[i];
+    if (/^ {0,3}#{1,6}\s/.test(l) || /^\s*(?:[-*+]|\d+[.)])\s+/.test(l) || /^\s*\|/.test(l)) keep.push(l);
+  }
+  return keep.join('\n');
+}
+const planTasks = planTaskText(plan);
+// What C1/C8 cite against, and the ids that pass the raw read but have no task line (C10).
+const citeText = REQUIRE_TASK_LINES ? planTasks : plan;
+const outsideTasksOnly = { C1: [], C8: [] };
+const citedOutsideOnly = (re) => re.test(plan) && !re.test(planTasks);
+
 const adrFiles = existsSync(adrDir) ? readdirSync(adrDir).filter(f => f.endsWith('.md')).sort() : [];
 const planClaimsAdrWork = /\bADR-\d+/.test(plan);
 if (adrFiles.length === 0 && planClaimsAdrWork) notEstablished('no ADR files under 03_adr/, yet the plan cites ADR-<n> — completeness cannot be established');
@@ -235,7 +306,8 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
       for (const n of headingNums) {
         const id = `ADR-${n}`;
         const re = new RegExp(`ADR-0*${Number(n)}\\b`);
-        if (!re.test(plan)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it`);
+        if (!re.test(citeText)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it${citedOutsideOnly(re) ? ' (cited only outside task lines)' : ''}`);
+        else if (citedOutsideOnly(re)) outsideTasksOnly.C1.push(id);
       }
       continue;
     }
@@ -243,7 +315,8 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
     warnings.push(`C1: ${safe(f)} has no ADR-NNN heading — falling back to the filename prefix`);
     const id = `ADR-${m[1]}`;
     const re = new RegExp(`ADR-0*${Number(m[1])}\\b`);
-    if (!re.test(plan)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it`);
+    if (!re.test(citeText)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it${citedOutsideOnly(re) ? ' (cited only outside task lines)' : ''}`);
+    else if (citedOutsideOnly(re)) outsideTasksOnly.C1.push(id);
   }
 
   // C2 — every Confirmation-listed test file path appears in the plan
@@ -334,7 +407,7 @@ function classifyTargetPath(path) {
 }
 
 // C3 — EXPECTED_CODE_TARGETS block, line-level validation
-const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
+const listedTargets = new Set();
 if (!blockM) failures.push('C3: no EXPECTED_CODE_TARGETS: block in the plan');
 else {
   const lines = blockM[1].split('\n').map(s => s.trim()).filter(Boolean);
@@ -343,6 +416,81 @@ else {
     const path = ln.replace(/^[-*]\s*/, '').replace(/`/g, '').trim();
     const reasons = classifyTargetPath(path);
     if (reasons.length) failures.push(`C3: target line rejected: "${safe(ln)}" — ${reasons.join(', ')}`);
+    else listedTargets.add(path);
+  }
+}
+
+// C9 — every byte-identical copy is listed or carries a reasoned waiver (ADR-001).
+const TWIN_EXCLUDED_PREFIXES = ['out/', '.claude/worktrees/', 'node_modules/'];
+{
+  const excluded = (path) => TWIN_EXCLUDED_PREFIXES.some((prefix) => path.startsWith(prefix) || path.includes('/' + prefix));
+  const waivers = [];
+  for (const line of maskMarkdown(plan, { unclosed: 'mask' }).split('\n')) {
+    if (!/^\s*(?:[-*]\s*)?TWIN_NOT_A_TARGET:/.test(line)) continue;
+    const match = line.match(/^\s*(?:[-*]\s*)?TWIN_NOT_A_TARGET:\s*`?([^\s`]+)`?\s*(?:—|--)\s*(\S.*)$/);
+    if (!match) {
+      failures.push(`C9: waiver "${safe(line.trim())}" carries no reason — a waiver without a reason is an allowlist entry`);
+    } else waivers.push({ path: match[1], used: false });
+  }
+
+  let tracked = null;
+  try {
+    tracked = execFileSync('git', ['ls-files', '-z'], {
+      cwd: process.cwd(), encoding: 'utf-8', maxBuffer: 16 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).split('\0').filter(Boolean);
+  } catch (error) {
+    warnings.push(`C9: twin scan had no input — git ls-files failed in ${safe(process.cwd())}: ${safe(error.message)}`);
+  }
+  if (tracked !== null) {
+    // Stat the universe first; only size matches ever reach readFileSync / md5.
+    const sizes = new Map();
+    for (const path of new Set([...tracked, ...listedTargets])) {
+      if (excluded(path)) continue;
+      try {
+        const stat = statSync(path);
+        if (stat.isFile()) sizes.set(path, stat.size);
+      } catch (error) {
+        // Missing targets are new files; tracked files can also have been deleted locally.
+        if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') warnings.push(`C9: cannot stat ${safe(path)}: ${safe(error.message)}`);
+      }
+    }
+    const targetSizes = new Set([...listedTargets].map((path) => sizes.get(path)).filter((size) => size > 0));
+    const hashes = new Map();
+    const twinsByHash = new Map();
+    for (const [path, size] of sizes) {
+      if (!targetSizes.has(size)) continue;
+      try { hashes.set(path, createHash('md5').update(readFileSync(path)).digest('hex')); }
+      catch (error) { warnings.push(`C9: cannot hash ${safe(path)}: ${safe(error.message)}`); }
+    }
+    for (const path of tracked) {
+      const hash = hashes.get(path);
+      if (hash === undefined) continue;
+      if (!twinsByHash.has(hash)) twinsByHash.set(hash, []);
+      twinsByHash.get(hash).push(path);
+    }
+    let unlisted = 0;
+    for (const target of listedTargets) {
+      for (const twin of twinsByHash.get(hashes.get(target)) ?? []) {
+        if (twin === target) continue;
+        let waived = false;
+        for (const waiver of waivers) {
+          if (waiver.path.endsWith('/') ? twin.startsWith(waiver.path) : twin === waiver.path) {
+            waiver.used = true;
+            waived = true;
+          }
+        }
+        if (listedTargets.has(twin) || waived) continue;
+        unlisted++;
+        // Keep pairs separate: safe() truncates each echoed value at 300 characters.
+        failures.push(`C9: target ${safe(target)} has a byte-identical twin the plan does not list: ${safe(twin)} — list it or waive it (TWIN_NOT_A_TARGET: ${safe(twin)} — <why>)`);
+      }
+    }
+    for (const waiver of waivers) if (!waiver.used) warnings.push(`C9: unused waiver ${safe(waiver.path)}`);
+    if (unlisted === 0) {
+      const onDisk = [...listedTargets].filter((path) => sizes.has(path)).length;
+      out(`NOTE  C9: twin scan over ${listedTargets.size} target(s), ${onDisk} on disk, 0 unlisted twins (byte-identical only; drifted copies need identity tests)`);
+    }
   }
 }
 
@@ -393,16 +541,14 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
   // phantom amendment or hand a real testless one someone else's marker. Third fence-blindness
   // found in a checker today, so it is closed here by construction rather than by care.
   const planLines = maskMarkdown(plan, { unclosed: 'mask' }).split('\n');
-  let sectionStart = -1, sectionEnd = -1, cursor = 0;
-  for (const pl of planLines) {
-    // The SAME heading shape amendment-trace.ts accepts: up to three leading spaces, two to four
-    // hashes, and trailing text allowed. C6 required exactly `##` with nothing after, so the two
-    // tools disagreed about where the section even IS — the divergence this feature exists to end.
-    if (sectionStart < 0 && /^ {0,3}#{2,4}\s+Amendments\b/.test(pl)) sectionStart = cursor + pl.length + 1;
-    else if (sectionStart >= 0 && sectionEnd < 0 && /^ {0,3}#{1,4}\s/.test(pl)) sectionEnd = cursor;
-    cursor += pl.length + 1;
-  }
-  if (sectionStart >= 0 && sectionEnd < 0) sectionEnd = plan.length;
+  // The SAME heading shape amendment-trace.ts accepts: up to three leading spaces, two to four
+  // hashes, and trailing text allowed. C6 required exactly `##` with nothing after, so the two
+  // tools disagreed about where the section even IS — the divergence this feature exists to end.
+  // The section boundary itself is `findAmendmentsSection` — shared with C10, one answer.
+  const amRange = findAmendmentsSection(planLines);
+  const lineOffset = (idx) => planLines.slice(0, idx).reduce((acc, l) => acc + l.length + 1, 0);
+  const sectionStart = amRange.head < 0 ? -1 : lineOffset(amRange.head + 1);
+  const sectionEnd = amRange.head < 0 ? -1 : (amRange.end < planLines.length ? lineOffset(amRange.end) : plan.length);
   // Sliced from the MASKED text so the offsets computed above line up with what is scanned.
   const maskedPlan = planLines.join('\n');
   const amSection = sectionStart >= 0 ? maskedPlan.slice(sectionStart, sectionEnd) : '';
@@ -417,7 +563,21 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
       // bullet-less row was invisible here while being a row there (so it evaded this check), and
       // this side lacked the range guard, so «AM-1..AM-4 are covered elsewhere» was falsely
       // reported as a definition. One shape, one meaning.
-      const isDef = /^\s*(?:[-*|]\s*)?\*{0,2}AM-(?:CP-)?\d+\*{0,2}\b(?!\s*\.)/.test(pl);
+      // ЯЧЕЙКА ТАБЛИЦЫ ВНЕ СЕКЦИИ — НЕ ОПРЕДЕЛЕНИЕ. Внутри `## Amendments` строка таблицы
+      // законно объявляет поправку, поэтому там `|` остаётся допустимым началом строки. Снаружи
+      // же таблица — это СВОДКА, ссылающаяся на поправки, определённые в другом месте, и читать
+      // её как определение значит отказывать плану за оглавление.
+      // ИЗМЕРЕНО 2026-09-05: четыре ложных FAIL за один день на четырёх разных фичах
+      // (narrated-error-must-be-taught, fa-phase-statusline, core-boundary-guard,
+      // run-registry-liveness); каждый стоил ручной правки ведущего и перезапуска конвейера,
+      // то есть 5–10 минут и один цикл роутера. Один планировщик дошёл до того, что вписал в
+      // план оговорку «no line of this paragraph may begin with AM-» — прибор начал
+      // диктовать людям форму прозы, а это уже не проверка, а суеверие.
+      // ОДИН механизм, а не два: `|` УБРАН из класса начал строки. Первая редакция этой правки
+      // добавляла ещё и отдельную проверку `isTableRow`, и мутация, снимавшая только её,
+      // оставалась ЭКВИВАЛЕНТНОЙ — 77 тестов из 77 зелёные при «снятой» починке. Дублирующая
+      // защита не усиливает гейт, она прячет от мутационной пробы, что именно держит свойство.
+      const isDef = /^\s*(?:[-*]\s*)?\*{0,2}AM-(?:CP-)?\d+\*{0,2}\b(?!\s*\.)/.test(pl);
       const inSection = sectionStart >= 0 && cursor2 >= sectionStart && cursor2 < sectionEnd;
       if (isDef && !inSection) {
         const tok = (/AM-(?:CP-)?\d+/.exec(pl) || ['AM-?'])[0];
@@ -479,7 +639,10 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
         }
         if (superseded) break;
       }
-      if (!hasTest && !superseded) failures.push(`C6: ${defs[k].id} carries neither \`\u2192 test <name>\` nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
+      // Сообщение называет ТУ ЖЕ форму, которую требует MARK выше. Прежняя редакция обещала
+      // простое `→ test <name>`, а проверка требовала имя и файл в обратных кавычках — человек,
+      // написавший ровно то, что просило сообщение, получал отказ снова и не понимал, почему.
+      if (!hasTest && !superseded) failures.push(`C6: ${defs[k].id} carries neither \`\u2192 test \`<имя>\` in \`<файл>\`\` (обратные кавычки обязательны, как и слово in) nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
     }
   }
 }
@@ -522,7 +685,9 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
     if (reqIds.length === 0) {
       warnings.push('C8: 01_requirements.md declares NO requirement ids in the contract shapes (FR-N / NFR-N / AC-N / C-N at line start) — nothing to cover');
     } else {
-      const missing = reqIds.filter((id) => !new RegExp('\\b' + escapeReqId(id) + '\\b').test(plan));
+      const reqRe = (id) => new RegExp('\\b' + escapeReqId(id) + '\\b');
+      const missing = reqIds.filter((id) => !reqRe(id).test(citeText));
+      for (const id of reqIds) if (!missing.includes(id) && citedOutsideOnly(reqRe(id))) outsideTasksOnly.C8.push(id);
       if (missing.length === 0) {
         // Silence is not a verdict (K7): a check that ran and found nothing wrong must still print,
         // or a reader cannot tell "C8 ran clean" from "C8 never ran". Deliberately NOT a PASS/FAIL/
@@ -530,7 +695,7 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
         // mid-stream is exactly the G-F1 forgery class this script's `safe()` already defends against.
         out(`NOTE  C8: all ${reqIds.length} requirement ids referenced`);
       } else if (REQUIRE_REQUIREMENTS) {
-        for (const id of missing) failures.push(`C8: ${id} (01_requirements.md) is not referenced by the plan`);
+        for (const id of missing) failures.push(`C8: ${id} (01_requirements.md) is not referenced by the plan${citedOutsideOnly(reqRe(id)) ? ' (cited only outside task lines)' : ''}`);
       } else {
         const shown = missing.slice(0, 12);
         const more = missing.length > 12 ? `, …and ${missing.length - 12} more` : '';
@@ -540,6 +705,23 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
   }
 }
 
+// C10 — ids that C1/C8 counted as covered, but whose ONLY citations sit outside task lines
+// (prose, fenced code, an HTML comment, `## Amendments`, the EXPECTED_CODE_TARGETS block). Reached
+// ONLY under --no-require-task-lines: by default C1/C8 already read task lines, so this list is
+// empty by construction. One line per check, ids capped like C8's WARN.
+for (const check of ['C1', 'C8']) {
+  const ids = [...new Set(outsideTasksOnly[check])];
+  if (ids.length === 0) continue;
+  const shown = ids.slice(0, 12);
+  const more = ids.length > 12 ? `, …and ${ids.length - 12} more` : '';
+  // Say what dropping the opt-out would do in THIS invocation (Codex astra r1 MINOR): C1 always
+  // FAILs by default; C8 FAILs only when --require-requirements is also passed — otherwise a WARN.
+  const consequence = check === 'C8' && !REQUIRE_REQUIREMENTS
+    ? 'without --no-require-task-lines this stays a C8 WARN (C8 is enforced only with --require-requirements; add that flag and the default reader fails it)'
+    : `these ids count as covered only because of --no-require-task-lines; the default makes this a ${check} FAIL`;
+  warnings.push(`C10: ${ids.length} ${check} id(s) are cited only outside task lines (prose, fenced code, HTML comment, ## Amendments, EXPECTED_CODE_TARGETS): ${shown.join(', ')}${more} — a mention is not a task; ${consequence}`);
+}
+
 // C5 — Inputs read line
 if (!/Inputs read:/i.test(plan)) warnings.push('C5: no "Inputs read:" line (wave-2 seam, WARN only)');
 else for (const need of ['03_adr','05_architecture']) if (!plan.includes(need)) warnings.push(`C5: Inputs read line missing ${need}`);