@dzhechkov/skills-feature-adr 1.3.66 → 1.4.0

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+        "sha256": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "5cca2d4a5337177ee9a072d49d14f73386af75398f52d907d757d4c052afdf81"
+        "sha256": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "b76f1b1d1ce3d8b22be0c2354fe3bd22833513da8b418c7c93423ae75f4018ae"
+        "sha256": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -121,7 +121,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "02d2a081e4bc9e7f5d42e55a4e21a68484af8b45216ff74fe5fc4322cb689a96"
+        "sha256": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -133,31 +133,31 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/01-requirements.md",
-        "sha256": "7b599efd3122be7ce2247bba1c9204e1b3c09322ad56ed4cedcbd4dd471ed41e"
+        "sha256": "e6ea3a224b555d5b7410cf2ddf02a3fb8d009fa01109463353e2b993c318270c"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/02-research.md",
-        "sha256": "55099189082d872d08a9d40b11782d8d08256955cbea617aa457756eb9fa1a07"
+        "sha256": "e2506e42251c74485188473acc4586f841afbec3ae7c5eaa8a3d8f73f6e14cc5"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/03-adr.md",
-        "sha256": "742f1d362fd4d1b1b731fe81b7aa794886aa58126005ad67ef0a27775c80f082"
+        "sha256": "ea03eee136c89267888b8034baa1a1cb0057314a2e745df71654a9ebee5d46b6"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md",
-        "sha256": "220e06d0d67643f09df868df32d1ec3acdc205653a5ef977d171791d9ce77b74"
+        "sha256": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/04-ddd.md",
-        "sha256": "c6cf98ab0dd80183ad507aca12edf164ee79a5fb60eee84d674cf73fe3a68646"
+        "sha256": "e9504cf1183bc0105167dc06108860882941fcf1b5be79d1978d8212c410ffbb"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/05-architecture.md",
-        "sha256": "227ec469154348afc414ef4751cc34ea5bb87ecb063cf196eff254615a6b5e00"
+        "sha256": "2ef7cf316903f0cbb1fabe1f0e1770c22b2cb3a11a4118cac0529c25074b5e8a"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "443043f6f3a3c2ebdcc4d40f9d13d799581056fb37890a2bb1fa61662825229b"
+        "sha256": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
@@ -321,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "4904cf2040f024647c561fb5bd11aab5c7c0b70190dc4505b1bd69572cf25072"
+        "sha256": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -349,5 +349,5 @@
       }
     ]
   },
-  "signature": "nKR64NSSz41u0CCXl4HdsXqTmS5QUqIIYZdRn4xVoEj/wuzF7Vb7X21mte94etpLINVimxi1pTdUQYOO5GlyCw=="
+  "signature": "gixeRY/3+gjSSS3a+DfVwn40SVlD9Gr2sCh3H8afGWd1+Dzo8R8CmD61qG0cLeDdHn2NgzRWwvICHe+0HFlYCA=="
 }

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.4.0] - 2026-08-20
+
+### Changed — the composite design checkpoint
+
+- The Step 1–5 design fan is checkpointed **per sibling** instead of as one composite entry, so one
+  dead agent no longer discards three finished siblings. Each sibling's resume key carries its own
+  steering inputs, including its prompt text: fixing one step's instructions invalidates that step
+  and nothing else.
+- An incomplete fan is **refused** at the Step-5/6 boundary (`phase: 'design-incomplete'`) instead of
+  being handed to the planner. Previously the completeness verdict was computed and only logged, and
+  Step 6 planned off a null design. The refusal captures training pairs and appends a cost-ledger row
+  on the way out, so a stopped run is neither silent nor invisible to cost analysis.
+- Three named reasons with distinct repairs — `substage-missing`, `artifact-missing`,
+  `probe-not-established`. Under `resume:'force'` the artifact-missing repair says `resume:'never'`,
+  because force skips artifact probes and a plain re-invoke would loop forever.
+- The artifact check no longer lists a directory: it runs `[ -f <exact path> ]` per required
+  artifact. A listing is a list of filenames, and a file whose NAME ends in a newline was measured
+  satisfying the requirement for the real file.
+- The probe transcript is validated strictly rather than scanned. It is relayed by an agent, not read
+  from a pipe, and an agent that narrates the expected output emits the token byte-identically —
+  which produced a false pass on a missing artifact before this release. Inconclusive is never a pass.
+
+### Requires
+
+- `@dzhechkov/harness-core >= 0.5.4`. The checkpoint schema is now `fa-ckpt-3`: every existing
+  `.fa-state/checkpoints.jsonl` reads as no checkpoint, so each in-flight feature re-runs
+  router+design+plan once.
+
+### Verification
+
+Eight cross-family review rounds (Codex `gpt-5.6-sol` at xhigh, each pinned to a sha256 of the
+reviewed files): D → D → D → B → C → C → D → **A**, the last with no new defects. Full ladder in
+`features/feature-adr-hardening/composite-design-checkpoint.md`.
+
+
 ### Follow-up (QE LOW gaps closed before publish)
 - **Upstream deletions**: `update` now removes files the template dropped (manifest-tracked orphans only; user-created untracked files are never touched) — previously `diff.missing` was computed but ignored. Shown in the summary + `--dry-run` (`- DEL`). Tests: Case G/H.
 - Removed a dead `unchanged` branch in the directory update path (unreachable — `diff.modified` guarantees bytes differ).

package/README.md

@@ -106,6 +106,36 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### The design fan resumes per sibling, and an incomplete design is REFUSED (v1.4.0)
+
+Step 1–5 run as one parallel fan — requirements, ADR, QCSD, architecture. Until v1.4.0 the whole fan
+was ONE checkpoint entry, so a single dead agent discarded three finished siblings and the next
+invocation paid for all four again. Each sibling is now checkpointed on its own
+(`design:requirements` / `design:adr` / `design:qcsd` / `design:architecture`), keyed on what steers
+**it** — its own prompt text included, so correcting one step's instructions re-runs that step and
+leaves the others alone.
+
+The other half is what the pipeline is allowed to CONSUME. An incomplete fan no longer flows into
+Step 6: the run stops at the Step-5/6 boundary and returns `phase: 'design-incomplete'` rather than
+producing a plan with no ADR behind it. Three distinct reasons, each with its own repair:
+
+| Reason | What happened | Repair printed |
+|---|---|---|
+| `substage-missing` | a sibling agent died (often a Claude limit) | re-invoke — the finished siblings resume free; or route that stage to Codex |
+| `artifact-missing` | every sibling reported success, but a required file is not on disk | under `resume:'force'` it says use `resume:'never'` — force skips artifact probes, so re-invoking would loop |
+| `probe-not-established` | the check could not be trusted at all | inconclusive is never a pass — refuse, then re-run |
+
+The artifact check never lists a directory. It asks `[ -f <exact path> ]` per required artifact,
+because a listing is a list of filenames and the data can impersonate the frame: measured, a file
+whose NAME ends in a newline satisfied the requirement for the real file. And since the check is
+relayed by an agent rather than read from a pipe, the whole transcript is validated — an agent that
+merely *narrates* the expected output emits the token byte-identically, and that produced a false
+pass before this release.
+
+Requires `@dzhechkov/harness-core >= 0.5.4`. **One-time cost:** the checkpoint schema moved to
+`fa-ckpt-3`, so every existing `.fa-state/checkpoints.jsonl` reads as no checkpoint and each
+in-flight feature re-runs router+design+plan once.
+
 ### Durable checkpoints + resume (v1.3.64)
 
 Every expensive stage (router / design / plan / code / qe / fleet) checkpoints its result into
@@ -878,3 +908,38 @@ them inside the package's own monorepo is almost never what you want anyway.
 - **npm:** [https://www.npmjs.com/package/@dzhechkov/skills-feature-adr](https://www.npmjs.com/package/@dzhechkov/skills-feature-adr)
 - **Keysarium:** [https://www.npmjs.com/package/@dzhechkov/keysarium](https://www.npmjs.com/package/@dzhechkov/keysarium)
 - **BTO:** [https://www.npmjs.com/package/@dzhechkov/skills-bto](https://www.npmjs.com/package/@dzhechkov/skills-bto)
+
+## Write discipline — why the writing steps now build a skeleton first
+
+MEASURED in the field on 2026-08-19 and 2026-08-20, two independent runs of the canonical pipeline
+against a ~130-file repository: the steps that must produce a document — Step 5 (Architecture) and
+Step 6 (Plan) — **never reached a write**. 18 attempts, zero file writes in every one. They died in
+the READING phase: a shell result returns, the agent thinks about its next move, stays silent past
+the runtime's 180-second inactivity watchdog, and is killed. One run cost ~4M tokens and 1h54m.
+
+The failure is **deterministic, not unlucky**: thinking time grows with accumulated history, so on a
+large enough repository unbounded exploration guarantees the kill. And the cause was in the
+instructions, not the runtime — every writing step said, in effect, *"read the code, write the
+document"*, with no reading budget and no order of operations. An agent obeying literally reads
+until it dies.
+
+The owner's control experiment is the whole evidence base, and it is n=1: same slice, same inputs,
+same model, ONE added paragraph about write discipline → a 10-section skeleton on disk 8 minutes in,
+first attempt, after six consecutive deaths.
+
+So every document-producing step now carries:
+
+1. the FIRST file write happens within the first ~12 tool calls — a skeleton of section headings
+   with one line of intent under each;
+2. then fill it **one section per edit**, no edit longer than ~120 lines;
+3. never go more than 2 minutes without a tool call;
+4. when unsure whether to read more or to write — **write**.
+
+**What this does not do**, stated plainly: it does not stop the deaths. The watchdog is unchanged.
+It changes what survives one — previously nothing, now a skeleton on disk that the next attempt can
+continue. The `~12` and `~120` are chosen parameters, not measured optima. Two possible regressions
+were named by an independent reviewer and are **not measured**: an early skeleton may anchor a
+structure chosen before understanding, and section-per-edit raises tool-call overhead.
+
+Steps whose deliverable is a returned verdict rather than a document (the complexity router) are
+deliberately excluded — "skeleton first" is nonsense there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.66",
+  "version": "1.4.0",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+          "content": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5cca2d4a5337177ee9a072d49d14f73386af75398f52d907d757d4c052afdf81"
+          "content": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
         }
       ]
     },
@@ -65,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b76f1b1d1ce3d8b22be0c2354fe3bd22833513da8b418c7c93423ae75f4018ae"
+          "content": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
         }
       ]
     },
@@ -305,7 +305,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "02d2a081e4bc9e7f5d42e55a4e21a68484af8b45216ff74fe5fc4322cb689a96"
+          "content": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
         }
       ]
     },
@@ -335,7 +335,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7b599efd3122be7ce2247bba1c9204e1b3c09322ad56ed4cedcbd4dd471ed41e"
+          "content": "e6ea3a224b555d5b7410cf2ddf02a3fb8d009fa01109463353e2b993c318270c"
         }
       ]
     },
@@ -345,7 +345,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "55099189082d872d08a9d40b11782d8d08256955cbea617aa457756eb9fa1a07"
+          "content": "e2506e42251c74485188473acc4586f841afbec3ae7c5eaa8a3d8f73f6e14cc5"
         }
       ]
     },
@@ -355,7 +355,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "742f1d362fd4d1b1b731fe81b7aa794886aa58126005ad67ef0a27775c80f082"
+          "content": "ea03eee136c89267888b8034baa1a1cb0057314a2e745df71654a9ebee5d46b6"
         }
       ]
     },
@@ -365,7 +365,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "220e06d0d67643f09df868df32d1ec3acdc205653a5ef977d171791d9ce77b74"
+          "content": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
         }
       ]
     },
@@ -375,7 +375,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c6cf98ab0dd80183ad507aca12edf164ee79a5fb60eee84d674cf73fe3a68646"
+          "content": "e9504cf1183bc0105167dc06108860882941fcf1b5be79d1978d8212c410ffbb"
         }
       ]
     },
@@ -385,7 +385,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "227ec469154348afc414ef4751cc34ea5bb87ecb063cf196eff254615a6b5e00"
+          "content": "2ef7cf316903f0cbb1fabe1f0e1770c22b2cb3a11a4118cac0529c25074b5e8a"
         }
       ]
     },
@@ -395,7 +395,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "443043f6f3a3c2ebdcc4d40f9d13d799581056fb37890a2bb1fa61662825229b"
+          "content": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
         }
       ]
     },
@@ -805,7 +805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4904cf2040f024647c561fb5bd11aab5c7c0b70190dc4505b1bd69572cf25072"
+          "content": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -226,6 +226,14 @@ Execute protocol
 → Checkpoint N
 ```
 
+**Write discipline — applies to EVERY step that produces a document.** Open the step's artifact within
+your first ~12 tool calls as a SKELETON (its section headings, one line of intent each), then fill it one
+section per edit, no edit longer than ~120 lines. Never go more than 2 minutes without a tool call, and
+when you are unsure whether to read more or to write, WRITE. Reason: an executor silent for 180 seconds is
+killed by the runtime, and thinking time grows with accumulated history — so unbounded exploration before
+the first write is a deterministic death on a large repo, not bad luck. Each module restates this under
+its own `## Write discipline (the 180-second rule)` heading.
+
 ### 4. Final Verification
 After Step 8 (or Step 9 for L/XL) completes, verify:
 - All mandatory artifacts exist per tier
@@ -616,6 +624,7 @@ npx @dzhechkov/skills-feature-adr init --with-learning --knowledge-extractor
 | Ignore NO-GO verdict | Proceed despite Step 3.5 NO-GO | BLOCK — rework required |
 | Skip gap loop | No gap detection in Step 8 | Missing requirements coverage check |
 | Skip fleet QE for L/XL | No Step 9 for large features | BLOCK — fleet assessment mandatory |
+| Unbounded reading before the first write | The step's artifact still does not exist after ~12 tool calls | BLOCK — write the skeleton now; a silent executor is killed at 180 s |
 
 ## Checkpoint Format
 

package/templates/.claude/skills/feature-adr/modules/01-requirements.md

@@ -77,6 +77,32 @@ Explicitly state:
 - **Dependencies:** What must exist before this feature works
 - **Dependents:** What will break if this feature changes
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/01_requirements.md` containing only the headings this step
+   requires (Stakeholders · Functional requirements · Non-functional requirements · Constraints ·
+   Scope boundaries · Open questions), one line of intent under each. (S-tier is inline and has no
+   file — this section does not apply to it.)
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 ### For S-tier (inline)

package/templates/.claude/skills/feature-adr/modules/02-research.md

@@ -73,6 +73,32 @@ Alternative considered: [Y], rejected because [reasons].
 
 After both complete, synthesize results sequentially.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/02_research.md` containing only the headings this step
+   requires (Codebase patterns · External patterns · Library evaluation · Anti-patterns ·
+   Recommended approach), one line of intent under each — before the research agents report back,
+   not after.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/02_research.md` with:

package/templates/.claude/skills/feature-adr/modules/03-adr.md

@@ -167,6 +167,32 @@ Each ADR must trace back to specific requirements:
 | Placeholder text | Template hints or TODOs remain | Remove or fill before checkpoint |
 | Supersession in-place | Existing ADR rewritten | Mint a new ADR and link it |
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** For each decision you have identified, write
+   `features/<slug>/03_adr/NNN-{decision-slug}.md` containing only the invariant-core headings
+   (Status · Context · Decision Drivers · Considered Options · Decision · Rationale · Consequences ·
+   Confirmation), one line of intent under each. A named-but-empty option beats an unwritten ADR.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/03_adr/` directory with:

package/templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md

@@ -154,6 +154,31 @@ AM-N (source): <change>. Confirmation: <property> → test `test_name` (fails if
   an existence test and never fires in production.
 - A cheap lint holds the shape: every `AM-N` line must contain a `→ test ` token naming a test that exists.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/03.5_ideation_report.md` containing only the eight
+   section headings of §5 (Executive summary … Amendments), one line of intent under each — while
+   the swarm is still running, not after every agent has returned.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/03.5_ideation_report.md` with full QCSD report.

package/templates/.claude/skills/feature-adr/modules/04-ddd.md

@@ -92,6 +92,31 @@ Check that proposed domain model is compatible with existing code:
 - Can aggregates be implemented with existing ORM/framework?
 - Do relationships align with existing data access patterns?
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/04_domain_model.md` containing only the headings this step
+   requires (Bounded context map · Ubiquitous language · Aggregates/Entities/VOs · Relationships ·
+   Codebase mapping), one line of intent under each.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 Create `features/<slug>/04_domain_model.md` with:

package/templates/.claude/skills/feature-adr/modules/05-architecture.md

@@ -118,6 +118,32 @@ GET /api/v1/{resource}/:id
   Errors: 401, 404
 ```
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/05_architecture.md` containing only the headings this step
+   requires at your tier (C4 Context · C4 Container · C4 Component · Sequence flows · Data & storage ·
+   API design), one line of intent under each. An empty `mermaid` fence with a caption is a
+   heading; fill it later.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 ### M-tier

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -135,6 +135,32 @@ Before finalizing the plan, validate completeness:
 
 This gap-check loop ensures the implementation plan is complete before coding begins.
 
+## Write discipline (the 180-second rule)
+
+An executor that returns from a tool call and then thinks in silence past **180 seconds** is killed by the
+runtime. Thinking time grows with the history already accumulated, so on a large repo "read everything,
+then write the document" is not a risk — it is a deterministic death, and nothing survives it, because
+nothing was ever on disk.
+
+MEASURED on this harness: the writing steps died **18 times out of 18** in the reading phase without ever
+writing a file. The control — same slice, same model, one added instruction to write a skeleton early —
+landed the skeleton 8 minutes in, on the first attempt, after six consecutive deaths.
+
+So, in this step:
+
+1. **Skeleton first — inside your first ~12 tool calls.** Write `features/<slug>/06_implementation_plan.md` containing only the headings
+   this step requires (Goal state · Tasks · Dependency order · Parallel groups · Checkpoints · Risk
+   assessment · Amendments · `EXPECTED_CODE_TARGETS:`), one line of intent under each. The K2 gate
+   reads this file — a plan that lives only in the conversation cannot pass it.
+2. **Then fill it one section per edit.** No single edit longer than ~120 lines. Every edit leaves the
+   file readable; none of them is allowed to wait for the section after it.
+3. **Never go more than 2 minutes without a tool call.** A thought that is getting long is the signal to
+   stop and write what you have — an edit is a checkpoint, not an interruption.
+4. **When you are unsure whether to read more or to write, WRITE.** A thin section refined later survives;
+   a perfect section you never reached does not.
+
+The skeleton is not a draft to apologise for. It is the artifact, opened early.
+
 ## Output
 
 ### S-tier (minimal file — NOT inline-only)

package/templates/.claude/workflows/feature-adr.js

@@ -44,6 +44,20 @@ function absolutizeRepo(raw, cwd) {
 }
 const ABSOLUTE_PATH_NOTE = ' All artifact paths in this prompt are ABSOLUTE. Read and write them exactly as given; do not cd first and do not re-relativize them.'
 
+// WRITE DISCIPLINE — the anti-watchdog clause for every step whose DELIVERABLE IS A DOCUMENT.
+// MEASURED (field report P14, two independent runs, agent journals on disk): Steps 5 and 6 never
+// reached a single write — 18/18 attempts ended with FILE_WRITES=0, all of them killed inside the
+// READING phase after >180 s of silence between tool calls; ~4M tokens and 1h54m per run bought
+// nothing. Thinking time grows with accumulated history, so on a large repo this is DETERMINISTIC,
+// not unlucky. The prompts said 'READ the code. Write <file>' with no reading budget and no order of
+// operations, and the executor obeyed literally. Control experiment (owner, same slice/inputs/model,
+// ONE added paragraph on write discipline): a 10-section skeleton landed 8 minutes in, on the FIRST
+// attempt, after six consecutive deaths. One variable changed, opposite outcome. NOT CLAIMED: that
+// this removes the watchdog class — it is a layer-4 prompt instruction, so it is probabilistic by
+// construction; the deterministic half is the layer-1 test that this clause is PRESENT in every
+// writing-step prompt (harness-core/test/feature-adr-write-discipline.test.ts).
+const WRITE_DISCIPLINE = ' WRITE DISCIPLINE (mandatory, not advice). 1. Your FIRST file write must happen within your first 12 tool calls: create the SKELETON of the artifact — every section heading plus one line of intent under each. 2. Then fill it in ONE SECTION PER EDIT; no single edit longer than ~120 lines. 3. Never go more than 2 minutes without a tool call. 4. If you are unsure whether to read more or to write, WRITE. Reason: an executor that shows no activity for 180 seconds is KILLED by the runtime, so unbounded exploration before the first write makes the step die having written nothing at all.'
+
 const UNSAFE_PATH_CHARS = /[\u0000-\u001f\u007f]/
 const DOT_DOT_SEGMENT = /(^|\/)\.\.(\/|$)/
 function hasUnsafePathChars(p) { return UNSAFE_PATH_CHARS.test(String(p)) }
@@ -128,7 +142,7 @@ const CKPT_FILE = FDIR + '/.fa-state/checkpoints.jsonl'
 // M10 Stage-A, feature loop-designer). This region is now a GENERATED BLOB (regen-diff-gated by
 // loop-blobs-regen.test.ts): edit the canonical TS FIRST, run node scripts/gen-loop-blobs.mjs,
 // then re-splice. The value-pinned wiring tests in feature-adr-checkpoints.test.ts stay the net.
-// ── BEGIN BLOB checkpoints@1.1.0 sha256:aa730483f52a9f6263751138d4514fe9a6a3f4f191897c86d1e035f3da890574 src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
+// ── BEGIN BLOB checkpoints@1.1.0 sha256:d4dc6c956be3dd279b225bc5061ec4255babc44ffb5ca58646c9b6ea04a0c8c2 src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
 const CHECKPOINT_STAGES = ['router', 'design', 'plan', 'code', 'qe', 'fleet'];
 const STAGE_ARTIFACTS = {
     router: null,
@@ -139,7 +153,7 @@ const STAGE_ARTIFACTS = {
     fleet: '09_fleet_qe_assessment.md',
 };
 const CHECKPOINT_MAX_RESULT_CHARS = 12000;
-const CKPT_SCHEMA_VERSION = 'fa-ckpt-2';
+const CKPT_SCHEMA_VERSION = 'fa-ckpt-3';
 function fnv1a(str) {
     let h = 0x811c9dc5;
     for (let i = 0; i < str.length; i++) {
@@ -157,6 +171,33 @@ function checkpointInputHash(stage, parts) {
 function resumeMode(raw) {
     return raw === 'never' ? 'never' : raw === 'force' ? 'force' : 'auto';
 }
+const DESIGN_SUBSTAGES = ['requirements', 'adr', 'qcsd', 'architecture'];
+function designStageKey(sub) {
+    return 'design:' + sub;
+}
+function decideDesignFanResume(opts) {
+    const missingSubstages = [];
+    opts.required.forEach((sub, i) => {
+        const r = opts.results[i];
+        if (r === null || r === undefined)
+            missingSubstages.push(sub);
+    });
+    const missingArtifacts = [];
+    let probeMissing = false;
+    if (opts.artifacts.length > 0) {
+        if (opts.postRunListing === null)
+            probeMissing = true;
+        else
+            for (const rel of opts.artifacts)
+                if (!opts.postRunListing.has(rel))
+                    missingArtifacts.push(rel);
+    }
+    const reason = missingSubstages.length > 0 ? 'substage-missing'
+        : probeMissing ? 'probe-not-established'
+            : missingArtifacts.length > 0 ? 'artifact-missing'
+                : 'ok';
+    return { complete: reason === 'ok', missingSubstages, missingArtifacts, reason };
+}
 function decideCheckpointResume(opts) {
     if (opts.mode === 'never')
         return { resume: false, reason: 'mode-never' };
@@ -236,10 +277,41 @@ function checkpointAppendCmd(fdirAbs, line) {
     const file = shellQuote(fdirAbs + '/.fa-state/checkpoints.jsonl');
     return 'mkdir -p ' + dir + " && printf '%s\\n' " + shellQuote(line) + ' >> ' + file;
 }
+function parseArtifactProbe(opts) {
+    if (opts.stdout === null || opts.stdout === undefined)
+        return null;
+    const known = new Map();
+    for (const rel of opts.required)
+        known.set('HAVE:' + rel, rel);
+    const found = new Set();
+    let sentinels = 0;
+    for (const raw of String(opts.stdout).split('\n')) {
+        const line = raw.trim();
+        if (line === '')
+            continue;
+        if (line === opts.sentinel) {
+            sentinels++;
+            continue;
+        }
+        if (sentinels > 0)
+            return null;
+        const rel = known.get(line);
+        if (rel === undefined)
+            return null;
+        found.add(rel);
+    }
+    if (sentinels !== 1)
+        return null;
+    return found;
+}
 // ── END BLOB checkpoints@1.1.0 ──
 // glue (workflow-owned, hand-reviewed): legacy mirror names → the blob exports. The hash
 // composition is UNCHANGED (same CKPT_SCHEMA_VERSION salt + JSON-tuple), so recorded
 // checkpoints from pre-wrap runs still resume.
+// Run-specific, not a fixed literal: a fixed one is a string an ARTIFACT FILE could be named, and a
+// listing is exactly a list of filenames. Derived from the slug + dir so it stays stable across a
+// resume (the workflow sandbox has no randomness, and a random one would break nothing here anyway).
+const FAN_LS_SENTINEL = '<<<DZ-FAN-LS-END:' + fnv1a64(SLUG + '\0' + FDIR) + '>>>'
 const CKPT_LS_SENTINEL = CHECKPOINT_LS_SENTINEL
 const CKPT_MAX = CHECKPOINT_MAX_RESULT_CHARS
 const STAGE_ARTIFACTS_CKPT = STAGE_ARTIFACTS
@@ -1450,20 +1522,20 @@ modelsUsed.ddd = modelLabel(archOpts)
 // record the exact input each design agent received. designPairMeta[i] aligns with designThunks[i],
 // which aligns with design[i] in the parallel result — one pair per design sub-stage.
 const designPairMeta = []
-const reqPromptText = 'Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.' + PS_GUIDANCE('design')
-designThunks.push(() => designStage(reqPromptText, reqOpts, FDIR + '/01_requirements.md', 'requirements'))
+const reqPromptText = 'Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.' + PS_GUIDANCE('design') + WRITE_DISCIPLINE
+designThunks.push(() => subCheckpoint('requirements', reqPromptText, reqOpts, ['01_requirements.md'].concat(isLplus ? ['02_research.md'] : []), () => designStage(reqPromptText, reqOpts, FDIR + '/01_requirements.md', 'requirements')))
 // the requirements prompt is where the Step-0 recalled lessons are INJECTED — recorded per pair
 designPairMeta.push({ role: 'design:requirements', prompt: reqPromptText, model: modelLabel(reqOpts), lessons: (LEARNED && LEARNED !== 'none recalled') ? [String(LEARNED)] : [] })
 if (isMplus) {
-  const adrPromptText = 'Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. ' + ADR_TEMPLATE_GUIDE + ' Write ' + FDIR + '/03_adr/001-' + SLUG + '.md as a MADR-structured ADR that PASSES the Step-8 ADR fitness checklist (do NOT emit the legacy shape). Emit ALL of these sections, in order: a decision-shaped # Title (present-tense imperative verb — the auto-filename tracks the feature slug, so the IMPERATIVE signal lives in the title); ## Status (proposed/accepted/rejected/deprecated/superseded + a reversibility/revisit clause); ## Context (neutral, problem-first, BEFORE the Decision); ## Decision Drivers (ranked/weighted D1, D2, …); ## Considered Options (frame the CHOSEN approach as one option ALONGSIDE the rejected ones, each with symmetric Pros:/Cons:); ## Decision (concrete/testable — exact names, versions, paths, commands); ## Rationale (map each point to a driver Dn + why the losers lost); ## Consequences (Positive + Negative/Accepted Downsides + Follow-up ADRs + After-action Review with owner + date); a REQUIRED ## Confirmation stanza with Method:, Monitoring:, Success metric:, Owner:, Load-bearing property:, and Required automated check: `<test file>` NAMING the load-bearing property that MUST have a Step-8 test (the recurring lesson: the key safety property is often the untested one); and a ## Links traceability block (requirements, driving use case, related ADRs). Add a one-line provenance note (model-generated, edited for clarity) and, for a long ADR, a top-of-file table of contents. Do NOT use an "Alternatives considered" or "Testability/shift-left" heading in place of Considered Options / Confirmation. When creating ADDITIONAL ADRs, name them 03_adr/NNN-{decision-slug}.md with a lowercase-kebab, present-tense imperative, dateless, ticketless slug. Return wrote[] + summary.'
-  designThunks.push(() => designStage(adrPromptText, adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md', 'adr'))
+  const adrPromptText = 'Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. ' + ADR_TEMPLATE_GUIDE + ' Write ' + FDIR + '/03_adr/001-' + SLUG + '.md as a MADR-structured ADR that PASSES the Step-8 ADR fitness checklist (do NOT emit the legacy shape). Emit ALL of these sections, in order: a decision-shaped # Title (present-tense imperative verb — the auto-filename tracks the feature slug, so the IMPERATIVE signal lives in the title); ## Status (proposed/accepted/rejected/deprecated/superseded + a reversibility/revisit clause); ## Context (neutral, problem-first, BEFORE the Decision); ## Decision Drivers (ranked/weighted D1, D2, …); ## Considered Options (frame the CHOSEN approach as one option ALONGSIDE the rejected ones, each with symmetric Pros:/Cons:); ## Decision (concrete/testable — exact names, versions, paths, commands); ## Rationale (map each point to a driver Dn + why the losers lost); ## Consequences (Positive + Negative/Accepted Downsides + Follow-up ADRs + After-action Review with owner + date); a REQUIRED ## Confirmation stanza with Method:, Monitoring:, Success metric:, Owner:, Load-bearing property:, and Required automated check: `<test file>` NAMING the load-bearing property that MUST have a Step-8 test (the recurring lesson: the key safety property is often the untested one); and a ## Links traceability block (requirements, driving use case, related ADRs). Add a one-line provenance note (model-generated, edited for clarity) and, for a long ADR, a top-of-file table of contents. Do NOT use an "Alternatives considered" or "Testability/shift-left" heading in place of Considered Options / Confirmation. When creating ADDITIONAL ADRs, name them 03_adr/NNN-{decision-slug}.md with a lowercase-kebab, present-tense imperative, dateless, ticketless slug. Return wrote[] + summary.' + WRITE_DISCIPLINE
+  designThunks.push(() => subCheckpoint('adr', adrPromptText, adrOpts, ['03_adr/001-' + SLUG + '.md'], () => designStage(adrPromptText, adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md', 'adr')))
   designPairMeta.push({ role: 'design:adr', prompt: adrPromptText, model: modelLabel(adrOpts), lessons: [] })
-  const qcsdPromptText = 'Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. On a CONDITIONAL verdict, write each condition as an amendment row in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.'
-  designThunks.push(() => designStage(qcsdPromptText, qcsdOpts, FDIR + '/03.5_ideation_report.md', 'qcsd'))
+  const qcsdPromptText = 'Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. On a CONDITIONAL verdict, write each condition as an amendment row in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + WRITE_DISCIPLINE
+  designThunks.push(() => subCheckpoint('qcsd', qcsdPromptText, qcsdOpts, ['03.5_ideation_report.md'], () => designStage(qcsdPromptText, qcsdOpts, FDIR + '/03.5_ideation_report.md', 'qcsd')))
   designPairMeta.push({ role: 'design:qcsd', prompt: qcsdPromptText, model: modelLabel(qcsdOpts), lessons: [] })
   const archExtra = isLplus ? ' Also ' + FDIR + '/04_domain_model.md (DDD).' : ''
-  const archPromptText = (isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.'
-  designThunks.push(() => designStage(archPromptText, archOpts, FDIR + '/05_architecture.md', 'architecture'))
+  const archPromptText = (isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.' + WRITE_DISCIPLINE
+  designThunks.push(() => subCheckpoint('architecture', archPromptText, archOpts, ['05_architecture.md'].concat(isLplus ? ['04_domain_model.md'] : []), () => designStage(archPromptText, archOpts, FDIR + '/05_architecture.md', 'architecture')))
   designPairMeta.push({ role: 'design:architecture', prompt: archPromptText, model: modelLabel(archOpts), lessons: [] })
 }
 // design checkpoint: ONE composite entry for the whole parallel design fan (requirements/ADR/QCSD/
@@ -1476,10 +1548,145 @@ const designHash = ckptHash('design', [tier, DESC, CODE_HINT, fnv1a64(String(LEA
 const designArtifacts = ['01_requirements.md']
 if (isMplus) designArtifacts.push('03_adr/001-' + SLUG + '.md', '03.5_ideation_report.md', '05_architecture.md')
 if (isLplus) designArtifacts.push('02_research.md', '04_domain_model.md')
-const design = await withCheckpoint('design', 'Design', designHash, async () => parallel(designThunks), { artifacts: designArtifacts })
+/**
+ * PER-SIBLING checkpoint (SP-2, no-amplification). Before 2026-08-20 the whole fan shared ONE
+ * all-or-nothing entry, so a single dead agent discarded three finished siblings — and because every
+ * downstream hash is content-addressed on the design RESULT, re-running them produced different
+ * summaries and a completed plan then read `stale-input` too. One death re-spent the entire run,
+ * every time, which is why the field report saw 18 attempts rather than 6.
+ *
+ * `withCheckpoint` needs no change for this: it already does its own lookup, hash, artifact probe
+ * and append per call. Nesting is the whole fix.
+ */
+function subCheckpoint(sub, prompt, opts, artifacts, thunk) {
+  const key = 'design:' + sub
+  // SP-3 (independence). The hash carries THIS sibling's own steering inputs — including its PROMPT
+  // TEXT (owner decision 2026-08-20). Two consequences, both intended:
+  //   • a fix to one step's instructions invalidates exactly that step and nothing else, so a feature
+  //     still IN FLIGHT picks the corrected prompt up on its next invocation. A feature that already
+  //     finished is never re-invoked, so its written artifacts are untouched — which is the line the
+  //     owner drew: correct what has not run, leave alone what has.
+  //   • changing the ADR model no longer invalidates requirements. The old fan hash lumped every
+  //     model spec together, so one dial moved four stages.
+  // The hash carries what actually steers THIS sibling, and nothing else. Review round 1 measured
+  // both directions of wrongness in the first version:
+  //   OVER-invalidating — FIXED, by DELETION. CODEX_MODEL was folded in unconditionally, so changing
+  //     args.codexModel invalidated a sibling explicitly pinned to `sonnet`. Round 1 narrowed it to
+  //     Codex siblings; round 2 showed that was still wrong — a sibling pinned to
+  //     'codex:gpt-5.6-sol:high' resolves its own id, yet still moved when the global dial moved. It
+  //     is gone entirely, because `modelLabel(opts)` — already in this hash — renders
+  //     'codex:<resolvedId>:<reasoning>', and specToOpts resolves a bare 'codex' spec THROUGH
+  //     CODEX_MODEL. So the effective model is captured in every case, pinned or inherited, and a
+  //     second copy of it could only ever add false invalidation.
+  //   UNDER-invalidating — NAMED, NOT FIXED, because it cannot be fixed here. Editing the CONTENT of
+  //     a project-skills guidance file without changing which files exist leaves this hash unchanged,
+  //     so a stale sibling resumes. The reason is structural: the Step-0 probe deliberately returns
+  //     only {hasManifest, report} and DROPS the guidance text ("drop the big design/code/qe
+  //     strings"), so the workflow never holds the content to hash. My first fix claimed the prompt
+  //     covered it via PS_GUIDANCE — MEASURED FALSE: of the four sibling prompts only `requirements`
+  //     embeds PS_GUIDANCE; adr, qcsd and architecture do not. POLY.report therefore stays in the
+  //     hash as the best available proxy — it names the source files, so adding or removing one does
+  //     invalidate. Closing this properly means carrying a content digest out of the probe, which is
+  //     a change to the probe, not to this line.
+  const h = ckptHash(key, [tier, DESC, CODE_HINT, fnv1a64(String(prompt)), modelLabel(opts), POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, sub === 'requirements' ? fnv1a64(String(LEARNED)) : null])
+  return withCheckpoint(key, 'Design', h, thunk, { artifacts: artifacts })
+}
+
+const designSubsRequired = ['requirements'].concat(isMplus ? ['adr', 'qcsd', 'architecture'] : [])
+const designFan = await parallel(designThunks)
+// SP-1 (completeness) — what may be CONSUMED is a different question from what may be WRITTEN. The
+// old code answered the second by crippling the first. Codex QE #2 (a one-file probe accepting a
+// design with no ADR) is preserved here, on the read side where it belongs.
+// LIVE results, never the start-of-run snapshot. Cross-family review round 1 (grade D) caught the
+// snapshot version: a stale non-null entry from a PREVIOUS run survives in it even when this run's
+// retry returned null, so an incomplete design would be declared complete — reopening the very hole
+// the old all-or-nothing gate existed to close. A sibling that returns non-null wrote its artifact;
+// a sibling that died returns null. Nothing needs re-probing to know that.
+// The artifact half needs a listing taken AFTER the fan, and nothing else will do. Round 2 caught the
+// version fed CKPT_LISTING (taken once at run start, so on a fresh slug it cannot contain what the fan
+// is about to write — every fresh M+ run read as incomplete). Round 3 caught the version with no probe
+// at all: an L-tier requirements sibling that writes 01_requirements.md, skips 02_research.md and
+// returns non-null was accepted, and Step 6 planned with no research behind it. A non-null result is
+// the agent's own word about its own work. One effort-low `find` is what turns it into evidence.
+// The probe must PROVE it ran, and it must not be forgeable by the very thing it inspects.
+// Three rounds of review taught the shape:
+//   • round 4 — `|| true` around a suppressed listing made an unreadable FDIR indistinguishable from
+//     an empty one, so the refusal named the wrong cause and printed the wrong repair;
+//   • round 5 — `find | sed; echo SENT` emitted the sentinel even when find itself failed, because sed
+//     masks the pipeline status;
+//   • round 6 — and the deeper problem: a LISTING is a list of filenames, so the data can impersonate
+//     the frame. A file named "01_requirements.md\n" prints as a line reading `01_requirements.md`
+//     plus a blank one, and satisfied a requirement for the real file. No amount of sentinel hardening
+//     fixes that, because the forgery is inside the payload.
+// So the probe no longer prints filenames AT ALL. It asks `[ -f <exact rel> ]` once per required
+// artifact and echoes a fixed token we already know the text of. A filename can no longer produce a
+// line, so it can no longer forge one — and `-f` on an exact path cannot be satisfied by a name that
+// merely renders like it. MEASURED red/green below in a real shell against a newline-bearing filename.
+let fanChecks = ''
+for (const rel of designArtifacts) fanChecks += '[ -f ' + shq(rel) + ' ] && echo ' + shq('HAVE:' + rel) + '; '
+const fanLsCmd = 'cd ' + shq(FDIR) + ' 2>/dev/null && { ' + fanChecks + 'echo ' + shq(FAN_LS_SENTINEL) + '; } || true'
+const fanLsOut = await agent('Run EXACTLY this via Bash and return its stdout VERBATIM (it may be empty) with NO code fences and NO commentary: ' + fanLsCmd, { label: 'design:artifact-probe', phase: 'Design', effort: 'low' })
+// The transcript is validated STRICTLY, not scanned. Round 7 measured the difference: an agent that
+// narrates ("Expected output when present: HAVE:01_requirements.md … Actual stdout: …") emits a line
+// byte-identical to the real token, and a parser that merely LOOKED for the token passed a design whose
+// artifact did not exist. parseArtifactProbe accepts only a subset of the known tokens followed by
+// exactly one sentinel and nothing else; anything unexpected returns null — inconclusive, never a pass.
+// It cannot stop an agent that deliberately emits the exact expected transcript; that residual is the
+// same trust the checkpoint reader and the Step-7.5 landing barrier already place in a relaying agent.
+const fanListing = parseArtifactProbe({ stdout: fanLsOut, sentinel: FAN_LS_SENTINEL, required: designArtifacts })
+if (fanListing === null) log('design artifact probe NOT ESTABLISHED — the transcript was not the command\'s own output (no completion sentinel, a second one, or an unexpected line). This is inconclusive, not clean.')
+const fanVerdict = decideDesignFanResume({ results: designFan, required: designSubsRequired, artifacts: designArtifacts, postRunListing: fanListing })
+const design = designFan
 // training pairs: one per design sub-stage (designPairMeta[i] ↔ design[i]); a null sub-result emits
 // no pair (a dead agent produced no output). Design has no per-stage QE grade — grade:null honestly.
-if (design) await capturePairs('design', 'Design', designPairMeta.map(function (m, i) { return { input: m.prompt, output: design[i], evaluation: { grade: null, gradedBy: null, lessonsInjected: m.lessons }, provenance: { model: m.model, family: tpFamily(m.model), role: m.role } } }))
+// Pair capture has to answer TWO questions per-sibling that the whole-stage guard inside capturePairs
+// cannot: which siblings produced output THIS run, and whether the stage as a whole is a resume.
+//   • The guard tests resumedStages for the exact name 'design'; per-sibling checkpointing records
+//     'design:requirements' instead, so every repair run read as wholly-live and re-appended the
+//     resumed siblings' pairs (round 3).
+//   • Filtering the resumed siblings out unconditionally then killed the BACKFILL path — the recovery
+//     that exists for a run whose pairs were never written (round 4). Backfill is file-absence-guarded,
+//     so it only ever recovers a wholly-missing file, and that is exactly the all-resumed case.
+// So: all four resumed ⇒ the stage IS a resume, hand capturePairs every record under a guard stage it
+// will read as resumed, and let the absence guard decide. Otherwise ⇒ emit only what ran this run.
+const designPairRecords = designPairMeta.map(function (m, i) { return { input: m.prompt, output: design ? design[i] : null, evaluation: { grade: null, gradedBy: null, lessonsInjected: m.lessons }, provenance: { model: m.model, family: tpFamily(m.model), role: m.role } } })
+const designAllResumed = designSubsRequired.length > 0 && designSubsRequired.every(function (sub) { return resumedStages.indexOf('design:' + sub) !== -1 })
+// NAMED, not fixed: a MIXED repair run whose earlier pair file was lost entirely does not recover the
+// resumed siblings' pairs — backfill would skip anyway once the file exists, and re-appending them in
+// capture mode is the duplication round 3 caught. Recovering that case needs per-record dedup inside
+// capturePairs, which is a change to the capture layer, not to this call.
+if (design && designAllResumed) await capturePairs('design', 'Design', designPairRecords, 'design:' + designSubsRequired[0])
+else if (design) await capturePairs('design', 'Design', designPairRecords.map(function (r, i) { return (resumedStages.indexOf('design:' + designSubsRequired[i]) !== -1) ? null : r }))
+
+// SP-1 ENFORCED. Round 2 was right that the previous line only LOGGED: the comment above promised a
+// read-side gate and the body handed a fan containing nulls straight to Step 6, which then planned
+// off a missing ADR — the exact outcome Codex QE #2 named. Refusing here is cheap precisely because
+// this feature made the fan resumable: every sibling that DID finish is checkpointed, so the repair
+// re-invoke re-spends only the missing ones. (Pairs are captured first: what ran deserves its record.)
+if (!fanVerdict.complete) {
+  const missing = fanVerdict.missingSubstages.join(', ')
+  const missingArt = fanVerdict.missingArtifacts.join(', ')
+  const what = fanVerdict.reason === 'substage-missing' ? 'sub-stage(s) [' + missing + '] returned nothing (a dead or limit-exhausted agent)'
+    : fanVerdict.reason === 'probe-not-established' ? 'the post-run artifact probe could not be read, so completeness is NOT ESTABLISHED (never a pass)'
+    : 'the design artifact(s) [' + missingArt + '] are absent although every sub-stage reported success — an agent said it wrote a file it did not write'
+  // Honest about the repair: "resume for free" is only true when resume is actually available. With
+  // checkpoints off or resume:'never' the whole fan re-runs, and saying otherwise would misprice the retry.
+  // resume:'force' deliberately trusts the input hash and SKIPS the artifact probe, so a sibling that
+  // reported success without writing its file resumes forever and this gate refuses forever. Telling
+  // that operator to "just re-invoke" would be a loop, not a repair (round 5).
+  const repair = (CHECKPOINTS_ON && RESUME_MODE === 'force' && fanVerdict.reason === 'artifact-missing')
+    ? "HOW TO REPAIR: this run used resume:'force', which skips the artifact probe when resuming — so the sibling that reported success without writing [" + missingArt + "] would resume again and hit this same refusal. Re-invoke with args.resume='never' (or delete features/" + SLUG + "/.fa-state/) to make it actually re-run."
+    : (CHECKPOINTS_ON && RESUME_MODE !== 'never')
+    ? 'HOW TO REPAIR: re-invoke with the SAME slug — the sub-stages that finished are individually checkpointed and resume for free, so only the failing one re-runs.'
+    : 'HOW TO REPAIR: re-invoke with the SAME slug. NOTE: this run had ' + (CHECKPOINTS_ON ? "resume:'never', so its finished siblings ARE recorded — drop that argument and the retry re-runs only the failing one" : 'checkpoints disabled, so this run recorded NOTHING — dropping args.checkpoints:false does not make THIS retry cheap (the whole fan re-runs and is re-spent once more); it only makes the run AFTER it cheap') + '.'
+  log('design fan INCOMPLETE (' + fanVerdict.reason + ') — ' + what + '. REFUSING to plan off a partial design.')
+  // A run that stops here still SPENT its router + design phases, so it belongs in the cost ledger —
+  // the same reason the K2 plan-gate refusal logs one. An unlogged refusal makes design stops
+  // invisible to cost analysis, which is how a stage that keeps dying stays cheap-looking.
+  // (coderUsed/qe are the outer bindings, both still null here, so the row reports null honestly.)
+  await appendRunCostRow('design-gate', 'Design')
+  return { tier: tier, phase: 'design-incomplete', slug: SLUG, artifactsDir: FDIR, missingSubstages: fanVerdict.missingSubstages, missingArtifacts: fanVerdict.missingArtifacts, reason: fanVerdict.reason, modelsUsed: modelsUsed, gates: { design: fanVerdict.reason === 'probe-not-established' ? 'not-established' : 'incomplete', plan: 'not-run', planCompleteness: 'not-run', challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'REFUSED at the Step-5/6 boundary: ' + what + ', so the design is incomplete and Step 6 was NOT dispatched. Planning off a partial design produces a plan with no ADR behind it. ' + repair + ' If a sibling died on a Claude limit, add usage-adaptive routing or route that stage to Codex first (args.models). To rebuild the whole design from scratch instead, re-invoke with args.resume=\'never\'.' }
+}
 
 // Step 6: Plan — optionally routed to Codex's top model (opt-in via args.planner='codex').
 // The user opts in at pre-flight ('use the top Codex model for planning?'); we route the Plan step to
@@ -1487,7 +1694,7 @@ if (design) await capturePairs('design', 'Design', designPairMeta.map(function (
 // unavailable/errors — the pipeline never blocks on Codex.
 phase('Plan')
 await usageProbe('Plan')
-const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for "' + DESC + '" (' + SLUG + ', tier ' + tier + '). Given the requirements + ADR + architecture in ' + FDIR + ', decompose into milestones + concrete tasks with success metrics. Write ' + FDIR + '/06_implementation_plan.md. END the plan with a trailing `EXPECTED_CODE_TARGETS:` block listing, one per line as `- <repo-relative path>`, EVERY production/test/config/doc file Step 7 is expected to create or modify. This block is machine-read by the Step-7.5 landing barrier: only paths it ESTABLISHES can ever count as landed, so an absent or unpollable block makes the barrier verdict INCONCLUSIVE. List only real targets outside features/, .dz/, .agentic-qe/ and roam/. If any corrections from Step 3.5 (a CONDITIONAL verdict) or other sources are folded into this plan, carry them in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + ABSOLUTE_PATH_NOTE
+const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for "' + DESC + '" (' + SLUG + ', tier ' + tier + '). Given the requirements + ADR + architecture in ' + FDIR + ', decompose into milestones + concrete tasks with success metrics. Write ' + FDIR + '/06_implementation_plan.md. END the plan with a trailing `EXPECTED_CODE_TARGETS:` block listing, one per line as `- <repo-relative path>`, EVERY production/test/config/doc file Step 7 is expected to create or modify. This block is machine-read by the Step-7.5 landing barrier: only paths it ESTABLISHES can ever count as landed, so an absent or unpollable block makes the barrier verdict INCONCLUSIVE. List only real targets outside features/, .dz/, .agentic-qe/ and roam/. If any corrections from Step 3.5 (a CONDITIONAL verdict) or other sources are folded into this plan, carry them in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + ABSOLUTE_PATH_NOTE + WRITE_DISCIPLINE
 // Resolve the plan model. args.models.plan wins; else the planner:'codex' knob (via routingRequested +
 // DEFAULT_MODELS/coder-fold) or the DEFAULT_MODELS.plan ('sonnet') under routing; else {} (BC).
 const planModel = resolveStageModel('plan')