@dzhechkov/skills-feature-adr 1.3.67 → 1.4.0

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+        "sha256": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "1d123dcb15ac44b9adfe8266cb72d2dc69d5086f54003540795296c36e06e1b2"
+        "sha256": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "31de034ec7534b585ee99a2dac0105bc4e43dca0c5b419076e66c43e797509d3"
+        "sha256": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -321,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "d9cda8df501188c894d083c5c44c240c9ebe9ba7e2d418302c448d73b089e051"
+        "sha256": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -349,5 +349,5 @@
       }
     ]
   },
-  "signature": "ZnkOOhYGfaIEp1W5L/Gphs0uniT0FieL/yn5KPl6cZ3zQeXkZcqDjfOta9b6zmPEgztZAclspZ0yf82VnjeHBQ=="
+  "signature": "gixeRY/3+gjSSS3a+DfVwn40SVlD9Gr2sCh3H8afGWd1+Dzo8R8CmD61qG0cLeDdHn2NgzRWwvICHe+0HFlYCA=="
 }

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.4.0] - 2026-08-20
+
+### Changed — the composite design checkpoint
+
+- The Step 1–5 design fan is checkpointed **per sibling** instead of as one composite entry, so one
+  dead agent no longer discards three finished siblings. Each sibling's resume key carries its own
+  steering inputs, including its prompt text: fixing one step's instructions invalidates that step
+  and nothing else.
+- An incomplete fan is **refused** at the Step-5/6 boundary (`phase: 'design-incomplete'`) instead of
+  being handed to the planner. Previously the completeness verdict was computed and only logged, and
+  Step 6 planned off a null design. The refusal captures training pairs and appends a cost-ledger row
+  on the way out, so a stopped run is neither silent nor invisible to cost analysis.
+- Three named reasons with distinct repairs — `substage-missing`, `artifact-missing`,
+  `probe-not-established`. Under `resume:'force'` the artifact-missing repair says `resume:'never'`,
+  because force skips artifact probes and a plain re-invoke would loop forever.
+- The artifact check no longer lists a directory: it runs `[ -f <exact path> ]` per required
+  artifact. A listing is a list of filenames, and a file whose NAME ends in a newline was measured
+  satisfying the requirement for the real file.
+- The probe transcript is validated strictly rather than scanned. It is relayed by an agent, not read
+  from a pipe, and an agent that narrates the expected output emits the token byte-identically —
+  which produced a false pass on a missing artifact before this release. Inconclusive is never a pass.
+
+### Requires
+
+- `@dzhechkov/harness-core >= 0.5.4`. The checkpoint schema is now `fa-ckpt-3`: every existing
+  `.fa-state/checkpoints.jsonl` reads as no checkpoint, so each in-flight feature re-runs
+  router+design+plan once.
+
+### Verification
+
+Eight cross-family review rounds (Codex `gpt-5.6-sol` at xhigh, each pinned to a sha256 of the
+reviewed files): D → D → D → B → C → C → D → **A**, the last with no new defects. Full ladder in
+`features/feature-adr-hardening/composite-design-checkpoint.md`.
+
+
 ### Follow-up (QE LOW gaps closed before publish)
 - **Upstream deletions**: `update` now removes files the template dropped (manifest-tracked orphans only; user-created untracked files are never touched) — previously `diff.missing` was computed but ignored. Shown in the summary + `--dry-run` (`- DEL`). Tests: Case G/H.
 - Removed a dead `unchanged` branch in the directory update path (unreachable — `diff.modified` guarantees bytes differ).

package/README.md

@@ -106,6 +106,36 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### The design fan resumes per sibling, and an incomplete design is REFUSED (v1.4.0)
+
+Step 1–5 run as one parallel fan — requirements, ADR, QCSD, architecture. Until v1.4.0 the whole fan
+was ONE checkpoint entry, so a single dead agent discarded three finished siblings and the next
+invocation paid for all four again. Each sibling is now checkpointed on its own
+(`design:requirements` / `design:adr` / `design:qcsd` / `design:architecture`), keyed on what steers
+**it** — its own prompt text included, so correcting one step's instructions re-runs that step and
+leaves the others alone.
+
+The other half is what the pipeline is allowed to CONSUME. An incomplete fan no longer flows into
+Step 6: the run stops at the Step-5/6 boundary and returns `phase: 'design-incomplete'` rather than
+producing a plan with no ADR behind it. Three distinct reasons, each with its own repair:
+
+| Reason | What happened | Repair printed |
+|---|---|---|
+| `substage-missing` | a sibling agent died (often a Claude limit) | re-invoke — the finished siblings resume free; or route that stage to Codex |
+| `artifact-missing` | every sibling reported success, but a required file is not on disk | under `resume:'force'` it says use `resume:'never'` — force skips artifact probes, so re-invoking would loop |
+| `probe-not-established` | the check could not be trusted at all | inconclusive is never a pass — refuse, then re-run |
+
+The artifact check never lists a directory. It asks `[ -f <exact path> ]` per required artifact,
+because a listing is a list of filenames and the data can impersonate the frame: measured, a file
+whose NAME ends in a newline satisfied the requirement for the real file. And since the check is
+relayed by an agent rather than read from a pipe, the whole transcript is validated — an agent that
+merely *narrates* the expected output emits the token byte-identically, and that produced a false
+pass before this release.
+
+Requires `@dzhechkov/harness-core >= 0.5.4`. **One-time cost:** the checkpoint schema moved to
+`fa-ckpt-3`, so every existing `.fa-state/checkpoints.jsonl` reads as no checkpoint and each
+in-flight feature re-runs router+design+plan once.
+
 ### Durable checkpoints + resume (v1.3.64)
 
 Every expensive stage (router / design / plan / code / qe / fleet) checkpoints its result into

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.67",
+  "version": "1.4.0",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+          "content": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1d123dcb15ac44b9adfe8266cb72d2dc69d5086f54003540795296c36e06e1b2"
+          "content": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
         }
       ]
     },
@@ -65,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "31de034ec7534b585ee99a2dac0105bc4e43dca0c5b419076e66c43e797509d3"
+          "content": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
         }
       ]
     },
@@ -805,7 +805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d9cda8df501188c894d083c5c44c240c9ebe9ba7e2d418302c448d73b089e051"
+          "content": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
         }
       ]
     },

package/templates/.claude/workflows/feature-adr.js

@@ -142,7 +142,7 @@ const CKPT_FILE = FDIR + '/.fa-state/checkpoints.jsonl'
 // M10 Stage-A, feature loop-designer). This region is now a GENERATED BLOB (regen-diff-gated by
 // loop-blobs-regen.test.ts): edit the canonical TS FIRST, run node scripts/gen-loop-blobs.mjs,
 // then re-splice. The value-pinned wiring tests in feature-adr-checkpoints.test.ts stay the net.
-// ── BEGIN BLOB checkpoints@1.1.0 sha256:aa730483f52a9f6263751138d4514fe9a6a3f4f191897c86d1e035f3da890574 src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
+// ── BEGIN BLOB checkpoints@1.1.0 sha256:d4dc6c956be3dd279b225bc5061ec4255babc44ffb5ca58646c9b6ea04a0c8c2 src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
 const CHECKPOINT_STAGES = ['router', 'design', 'plan', 'code', 'qe', 'fleet'];
 const STAGE_ARTIFACTS = {
     router: null,
@@ -153,7 +153,7 @@ const STAGE_ARTIFACTS = {
     fleet: '09_fleet_qe_assessment.md',
 };
 const CHECKPOINT_MAX_RESULT_CHARS = 12000;
-const CKPT_SCHEMA_VERSION = 'fa-ckpt-2';
+const CKPT_SCHEMA_VERSION = 'fa-ckpt-3';
 function fnv1a(str) {
     let h = 0x811c9dc5;
     for (let i = 0; i < str.length; i++) {
@@ -171,6 +171,33 @@ function checkpointInputHash(stage, parts) {
 function resumeMode(raw) {
     return raw === 'never' ? 'never' : raw === 'force' ? 'force' : 'auto';
 }
+const DESIGN_SUBSTAGES = ['requirements', 'adr', 'qcsd', 'architecture'];
+function designStageKey(sub) {
+    return 'design:' + sub;
+}
+function decideDesignFanResume(opts) {
+    const missingSubstages = [];
+    opts.required.forEach((sub, i) => {
+        const r = opts.results[i];
+        if (r === null || r === undefined)
+            missingSubstages.push(sub);
+    });
+    const missingArtifacts = [];
+    let probeMissing = false;
+    if (opts.artifacts.length > 0) {
+        if (opts.postRunListing === null)
+            probeMissing = true;
+        else
+            for (const rel of opts.artifacts)
+                if (!opts.postRunListing.has(rel))
+                    missingArtifacts.push(rel);
+    }
+    const reason = missingSubstages.length > 0 ? 'substage-missing'
+        : probeMissing ? 'probe-not-established'
+            : missingArtifacts.length > 0 ? 'artifact-missing'
+                : 'ok';
+    return { complete: reason === 'ok', missingSubstages, missingArtifacts, reason };
+}
 function decideCheckpointResume(opts) {
     if (opts.mode === 'never')
         return { resume: false, reason: 'mode-never' };
@@ -250,10 +277,41 @@ function checkpointAppendCmd(fdirAbs, line) {
     const file = shellQuote(fdirAbs + '/.fa-state/checkpoints.jsonl');
     return 'mkdir -p ' + dir + " && printf '%s\\n' " + shellQuote(line) + ' >> ' + file;
 }
+function parseArtifactProbe(opts) {
+    if (opts.stdout === null || opts.stdout === undefined)
+        return null;
+    const known = new Map();
+    for (const rel of opts.required)
+        known.set('HAVE:' + rel, rel);
+    const found = new Set();
+    let sentinels = 0;
+    for (const raw of String(opts.stdout).split('\n')) {
+        const line = raw.trim();
+        if (line === '')
+            continue;
+        if (line === opts.sentinel) {
+            sentinels++;
+            continue;
+        }
+        if (sentinels > 0)
+            return null;
+        const rel = known.get(line);
+        if (rel === undefined)
+            return null;
+        found.add(rel);
+    }
+    if (sentinels !== 1)
+        return null;
+    return found;
+}
 // ── END BLOB checkpoints@1.1.0 ──
 // glue (workflow-owned, hand-reviewed): legacy mirror names → the blob exports. The hash
 // composition is UNCHANGED (same CKPT_SCHEMA_VERSION salt + JSON-tuple), so recorded
 // checkpoints from pre-wrap runs still resume.
+// Run-specific, not a fixed literal: a fixed one is a string an ARTIFACT FILE could be named, and a
+// listing is exactly a list of filenames. Derived from the slug + dir so it stays stable across a
+// resume (the workflow sandbox has no randomness, and a random one would break nothing here anyway).
+const FAN_LS_SENTINEL = '<<<DZ-FAN-LS-END:' + fnv1a64(SLUG + '\0' + FDIR) + '>>>'
 const CKPT_LS_SENTINEL = CHECKPOINT_LS_SENTINEL
 const CKPT_MAX = CHECKPOINT_MAX_RESULT_CHARS
 const STAGE_ARTIFACTS_CKPT = STAGE_ARTIFACTS
@@ -1465,19 +1523,19 @@ modelsUsed.ddd = modelLabel(archOpts)
 // which aligns with design[i] in the parallel result — one pair per design sub-stage.
 const designPairMeta = []
 const reqPromptText = 'Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.' + PS_GUIDANCE('design') + WRITE_DISCIPLINE
-designThunks.push(() => designStage(reqPromptText, reqOpts, FDIR + '/01_requirements.md', 'requirements'))
+designThunks.push(() => subCheckpoint('requirements', reqPromptText, reqOpts, ['01_requirements.md'].concat(isLplus ? ['02_research.md'] : []), () => designStage(reqPromptText, reqOpts, FDIR + '/01_requirements.md', 'requirements')))
 // the requirements prompt is where the Step-0 recalled lessons are INJECTED — recorded per pair
 designPairMeta.push({ role: 'design:requirements', prompt: reqPromptText, model: modelLabel(reqOpts), lessons: (LEARNED && LEARNED !== 'none recalled') ? [String(LEARNED)] : [] })
 if (isMplus) {
   const adrPromptText = 'Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. ' + ADR_TEMPLATE_GUIDE + ' Write ' + FDIR + '/03_adr/001-' + SLUG + '.md as a MADR-structured ADR that PASSES the Step-8 ADR fitness checklist (do NOT emit the legacy shape). Emit ALL of these sections, in order: a decision-shaped # Title (present-tense imperative verb — the auto-filename tracks the feature slug, so the IMPERATIVE signal lives in the title); ## Status (proposed/accepted/rejected/deprecated/superseded + a reversibility/revisit clause); ## Context (neutral, problem-first, BEFORE the Decision); ## Decision Drivers (ranked/weighted D1, D2, …); ## Considered Options (frame the CHOSEN approach as one option ALONGSIDE the rejected ones, each with symmetric Pros:/Cons:); ## Decision (concrete/testable — exact names, versions, paths, commands); ## Rationale (map each point to a driver Dn + why the losers lost); ## Consequences (Positive + Negative/Accepted Downsides + Follow-up ADRs + After-action Review with owner + date); a REQUIRED ## Confirmation stanza with Method:, Monitoring:, Success metric:, Owner:, Load-bearing property:, and Required automated check: `<test file>` NAMING the load-bearing property that MUST have a Step-8 test (the recurring lesson: the key safety property is often the untested one); and a ## Links traceability block (requirements, driving use case, related ADRs). Add a one-line provenance note (model-generated, edited for clarity) and, for a long ADR, a top-of-file table of contents. Do NOT use an "Alternatives considered" or "Testability/shift-left" heading in place of Considered Options / Confirmation. When creating ADDITIONAL ADRs, name them 03_adr/NNN-{decision-slug}.md with a lowercase-kebab, present-tense imperative, dateless, ticketless slug. Return wrote[] + summary.' + WRITE_DISCIPLINE
-  designThunks.push(() => designStage(adrPromptText, adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md', 'adr'))
+  designThunks.push(() => subCheckpoint('adr', adrPromptText, adrOpts, ['03_adr/001-' + SLUG + '.md'], () => designStage(adrPromptText, adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md', 'adr')))
   designPairMeta.push({ role: 'design:adr', prompt: adrPromptText, model: modelLabel(adrOpts), lessons: [] })
   const qcsdPromptText = 'Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. On a CONDITIONAL verdict, write each condition as an amendment row in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + WRITE_DISCIPLINE
-  designThunks.push(() => designStage(qcsdPromptText, qcsdOpts, FDIR + '/03.5_ideation_report.md', 'qcsd'))
+  designThunks.push(() => subCheckpoint('qcsd', qcsdPromptText, qcsdOpts, ['03.5_ideation_report.md'], () => designStage(qcsdPromptText, qcsdOpts, FDIR + '/03.5_ideation_report.md', 'qcsd')))
   designPairMeta.push({ role: 'design:qcsd', prompt: qcsdPromptText, model: modelLabel(qcsdOpts), lessons: [] })
   const archExtra = isLplus ? ' Also ' + FDIR + '/04_domain_model.md (DDD).' : ''
   const archPromptText = (isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.' + WRITE_DISCIPLINE
-  designThunks.push(() => designStage(archPromptText, archOpts, FDIR + '/05_architecture.md', 'architecture'))
+  designThunks.push(() => subCheckpoint('architecture', archPromptText, archOpts, ['05_architecture.md'].concat(isLplus ? ['04_domain_model.md'] : []), () => designStage(archPromptText, archOpts, FDIR + '/05_architecture.md', 'architecture')))
   designPairMeta.push({ role: 'design:architecture', prompt: archPromptText, model: modelLabel(archOpts), lessons: [] })
 }
 // design checkpoint: ONE composite entry for the whole parallel design fan (requirements/ADR/QCSD/
@@ -1490,10 +1548,145 @@ const designHash = ckptHash('design', [tier, DESC, CODE_HINT, fnv1a64(String(LEA
 const designArtifacts = ['01_requirements.md']
 if (isMplus) designArtifacts.push('03_adr/001-' + SLUG + '.md', '03.5_ideation_report.md', '05_architecture.md')
 if (isLplus) designArtifacts.push('02_research.md', '04_domain_model.md')
-const design = await withCheckpoint('design', 'Design', designHash, async () => parallel(designThunks), { artifacts: designArtifacts })
+/**
+ * PER-SIBLING checkpoint (SP-2, no-amplification). Before 2026-08-20 the whole fan shared ONE
+ * all-or-nothing entry, so a single dead agent discarded three finished siblings — and because every
+ * downstream hash is content-addressed on the design RESULT, re-running them produced different
+ * summaries and a completed plan then read `stale-input` too. One death re-spent the entire run,
+ * every time, which is why the field report saw 18 attempts rather than 6.
+ *
+ * `withCheckpoint` needs no change for this: it already does its own lookup, hash, artifact probe
+ * and append per call. Nesting is the whole fix.
+ */
+function subCheckpoint(sub, prompt, opts, artifacts, thunk) {
+  const key = 'design:' + sub
+  // SP-3 (independence). The hash carries THIS sibling's own steering inputs — including its PROMPT
+  // TEXT (owner decision 2026-08-20). Two consequences, both intended:
+  //   • a fix to one step's instructions invalidates exactly that step and nothing else, so a feature
+  //     still IN FLIGHT picks the corrected prompt up on its next invocation. A feature that already
+  //     finished is never re-invoked, so its written artifacts are untouched — which is the line the
+  //     owner drew: correct what has not run, leave alone what has.
+  //   • changing the ADR model no longer invalidates requirements. The old fan hash lumped every
+  //     model spec together, so one dial moved four stages.
+  // The hash carries what actually steers THIS sibling, and nothing else. Review round 1 measured
+  // both directions of wrongness in the first version:
+  //   OVER-invalidating — FIXED, by DELETION. CODEX_MODEL was folded in unconditionally, so changing
+  //     args.codexModel invalidated a sibling explicitly pinned to `sonnet`. Round 1 narrowed it to
+  //     Codex siblings; round 2 showed that was still wrong — a sibling pinned to
+  //     'codex:gpt-5.6-sol:high' resolves its own id, yet still moved when the global dial moved. It
+  //     is gone entirely, because `modelLabel(opts)` — already in this hash — renders
+  //     'codex:<resolvedId>:<reasoning>', and specToOpts resolves a bare 'codex' spec THROUGH
+  //     CODEX_MODEL. So the effective model is captured in every case, pinned or inherited, and a
+  //     second copy of it could only ever add false invalidation.
+  //   UNDER-invalidating — NAMED, NOT FIXED, because it cannot be fixed here. Editing the CONTENT of
+  //     a project-skills guidance file without changing which files exist leaves this hash unchanged,
+  //     so a stale sibling resumes. The reason is structural: the Step-0 probe deliberately returns
+  //     only {hasManifest, report} and DROPS the guidance text ("drop the big design/code/qe
+  //     strings"), so the workflow never holds the content to hash. My first fix claimed the prompt
+  //     covered it via PS_GUIDANCE — MEASURED FALSE: of the four sibling prompts only `requirements`
+  //     embeds PS_GUIDANCE; adr, qcsd and architecture do not. POLY.report therefore stays in the
+  //     hash as the best available proxy — it names the source files, so adding or removing one does
+  //     invalidate. Closing this properly means carrying a content digest out of the probe, which is
+  //     a change to the probe, not to this line.
+  const h = ckptHash(key, [tier, DESC, CODE_HINT, fnv1a64(String(prompt)), modelLabel(opts), POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, sub === 'requirements' ? fnv1a64(String(LEARNED)) : null])
+  return withCheckpoint(key, 'Design', h, thunk, { artifacts: artifacts })
+}
+
+const designSubsRequired = ['requirements'].concat(isMplus ? ['adr', 'qcsd', 'architecture'] : [])
+const designFan = await parallel(designThunks)
+// SP-1 (completeness) — what may be CONSUMED is a different question from what may be WRITTEN. The
+// old code answered the second by crippling the first. Codex QE #2 (a one-file probe accepting a
+// design with no ADR) is preserved here, on the read side where it belongs.
+// LIVE results, never the start-of-run snapshot. Cross-family review round 1 (grade D) caught the
+// snapshot version: a stale non-null entry from a PREVIOUS run survives in it even when this run's
+// retry returned null, so an incomplete design would be declared complete — reopening the very hole
+// the old all-or-nothing gate existed to close. A sibling that returns non-null wrote its artifact;
+// a sibling that died returns null. Nothing needs re-probing to know that.
+// The artifact half needs a listing taken AFTER the fan, and nothing else will do. Round 2 caught the
+// version fed CKPT_LISTING (taken once at run start, so on a fresh slug it cannot contain what the fan
+// is about to write — every fresh M+ run read as incomplete). Round 3 caught the version with no probe
+// at all: an L-tier requirements sibling that writes 01_requirements.md, skips 02_research.md and
+// returns non-null was accepted, and Step 6 planned with no research behind it. A non-null result is
+// the agent's own word about its own work. One effort-low `find` is what turns it into evidence.
+// The probe must PROVE it ran, and it must not be forgeable by the very thing it inspects.
+// Three rounds of review taught the shape:
+//   • round 4 — `|| true` around a suppressed listing made an unreadable FDIR indistinguishable from
+//     an empty one, so the refusal named the wrong cause and printed the wrong repair;
+//   • round 5 — `find | sed; echo SENT` emitted the sentinel even when find itself failed, because sed
+//     masks the pipeline status;
+//   • round 6 — and the deeper problem: a LISTING is a list of filenames, so the data can impersonate
+//     the frame. A file named "01_requirements.md\n" prints as a line reading `01_requirements.md`
+//     plus a blank one, and satisfied a requirement for the real file. No amount of sentinel hardening
+//     fixes that, because the forgery is inside the payload.
+// So the probe no longer prints filenames AT ALL. It asks `[ -f <exact rel> ]` once per required
+// artifact and echoes a fixed token we already know the text of. A filename can no longer produce a
+// line, so it can no longer forge one — and `-f` on an exact path cannot be satisfied by a name that
+// merely renders like it. MEASURED red/green below in a real shell against a newline-bearing filename.
+let fanChecks = ''
+for (const rel of designArtifacts) fanChecks += '[ -f ' + shq(rel) + ' ] && echo ' + shq('HAVE:' + rel) + '; '
+const fanLsCmd = 'cd ' + shq(FDIR) + ' 2>/dev/null && { ' + fanChecks + 'echo ' + shq(FAN_LS_SENTINEL) + '; } || true'
+const fanLsOut = await agent('Run EXACTLY this via Bash and return its stdout VERBATIM (it may be empty) with NO code fences and NO commentary: ' + fanLsCmd, { label: 'design:artifact-probe', phase: 'Design', effort: 'low' })
+// The transcript is validated STRICTLY, not scanned. Round 7 measured the difference: an agent that
+// narrates ("Expected output when present: HAVE:01_requirements.md … Actual stdout: …") emits a line
+// byte-identical to the real token, and a parser that merely LOOKED for the token passed a design whose
+// artifact did not exist. parseArtifactProbe accepts only a subset of the known tokens followed by
+// exactly one sentinel and nothing else; anything unexpected returns null — inconclusive, never a pass.
+// It cannot stop an agent that deliberately emits the exact expected transcript; that residual is the
+// same trust the checkpoint reader and the Step-7.5 landing barrier already place in a relaying agent.
+const fanListing = parseArtifactProbe({ stdout: fanLsOut, sentinel: FAN_LS_SENTINEL, required: designArtifacts })
+if (fanListing === null) log('design artifact probe NOT ESTABLISHED — the transcript was not the command\'s own output (no completion sentinel, a second one, or an unexpected line). This is inconclusive, not clean.')
+const fanVerdict = decideDesignFanResume({ results: designFan, required: designSubsRequired, artifacts: designArtifacts, postRunListing: fanListing })
+const design = designFan
 // training pairs: one per design sub-stage (designPairMeta[i] ↔ design[i]); a null sub-result emits
 // no pair (a dead agent produced no output). Design has no per-stage QE grade — grade:null honestly.
-if (design) await capturePairs('design', 'Design', designPairMeta.map(function (m, i) { return { input: m.prompt, output: design[i], evaluation: { grade: null, gradedBy: null, lessonsInjected: m.lessons }, provenance: { model: m.model, family: tpFamily(m.model), role: m.role } } }))
+// Pair capture has to answer TWO questions per-sibling that the whole-stage guard inside capturePairs
+// cannot: which siblings produced output THIS run, and whether the stage as a whole is a resume.
+//   • The guard tests resumedStages for the exact name 'design'; per-sibling checkpointing records
+//     'design:requirements' instead, so every repair run read as wholly-live and re-appended the
+//     resumed siblings' pairs (round 3).
+//   • Filtering the resumed siblings out unconditionally then killed the BACKFILL path — the recovery
+//     that exists for a run whose pairs were never written (round 4). Backfill is file-absence-guarded,
+//     so it only ever recovers a wholly-missing file, and that is exactly the all-resumed case.
+// So: all four resumed ⇒ the stage IS a resume, hand capturePairs every record under a guard stage it
+// will read as resumed, and let the absence guard decide. Otherwise ⇒ emit only what ran this run.
+const designPairRecords = designPairMeta.map(function (m, i) { return { input: m.prompt, output: design ? design[i] : null, evaluation: { grade: null, gradedBy: null, lessonsInjected: m.lessons }, provenance: { model: m.model, family: tpFamily(m.model), role: m.role } } })
+const designAllResumed = designSubsRequired.length > 0 && designSubsRequired.every(function (sub) { return resumedStages.indexOf('design:' + sub) !== -1 })
+// NAMED, not fixed: a MIXED repair run whose earlier pair file was lost entirely does not recover the
+// resumed siblings' pairs — backfill would skip anyway once the file exists, and re-appending them in
+// capture mode is the duplication round 3 caught. Recovering that case needs per-record dedup inside
+// capturePairs, which is a change to the capture layer, not to this call.
+if (design && designAllResumed) await capturePairs('design', 'Design', designPairRecords, 'design:' + designSubsRequired[0])
+else if (design) await capturePairs('design', 'Design', designPairRecords.map(function (r, i) { return (resumedStages.indexOf('design:' + designSubsRequired[i]) !== -1) ? null : r }))
+
+// SP-1 ENFORCED. Round 2 was right that the previous line only LOGGED: the comment above promised a
+// read-side gate and the body handed a fan containing nulls straight to Step 6, which then planned
+// off a missing ADR — the exact outcome Codex QE #2 named. Refusing here is cheap precisely because
+// this feature made the fan resumable: every sibling that DID finish is checkpointed, so the repair
+// re-invoke re-spends only the missing ones. (Pairs are captured first: what ran deserves its record.)
+if (!fanVerdict.complete) {
+  const missing = fanVerdict.missingSubstages.join(', ')
+  const missingArt = fanVerdict.missingArtifacts.join(', ')
+  const what = fanVerdict.reason === 'substage-missing' ? 'sub-stage(s) [' + missing + '] returned nothing (a dead or limit-exhausted agent)'
+    : fanVerdict.reason === 'probe-not-established' ? 'the post-run artifact probe could not be read, so completeness is NOT ESTABLISHED (never a pass)'
+    : 'the design artifact(s) [' + missingArt + '] are absent although every sub-stage reported success — an agent said it wrote a file it did not write'
+  // Honest about the repair: "resume for free" is only true when resume is actually available. With
+  // checkpoints off or resume:'never' the whole fan re-runs, and saying otherwise would misprice the retry.
+  // resume:'force' deliberately trusts the input hash and SKIPS the artifact probe, so a sibling that
+  // reported success without writing its file resumes forever and this gate refuses forever. Telling
+  // that operator to "just re-invoke" would be a loop, not a repair (round 5).
+  const repair = (CHECKPOINTS_ON && RESUME_MODE === 'force' && fanVerdict.reason === 'artifact-missing')
+    ? "HOW TO REPAIR: this run used resume:'force', which skips the artifact probe when resuming — so the sibling that reported success without writing [" + missingArt + "] would resume again and hit this same refusal. Re-invoke with args.resume='never' (or delete features/" + SLUG + "/.fa-state/) to make it actually re-run."
+    : (CHECKPOINTS_ON && RESUME_MODE !== 'never')
+    ? 'HOW TO REPAIR: re-invoke with the SAME slug — the sub-stages that finished are individually checkpointed and resume for free, so only the failing one re-runs.'
+    : 'HOW TO REPAIR: re-invoke with the SAME slug. NOTE: this run had ' + (CHECKPOINTS_ON ? "resume:'never', so its finished siblings ARE recorded — drop that argument and the retry re-runs only the failing one" : 'checkpoints disabled, so this run recorded NOTHING — dropping args.checkpoints:false does not make THIS retry cheap (the whole fan re-runs and is re-spent once more); it only makes the run AFTER it cheap') + '.'
+  log('design fan INCOMPLETE (' + fanVerdict.reason + ') — ' + what + '. REFUSING to plan off a partial design.')
+  // A run that stops here still SPENT its router + design phases, so it belongs in the cost ledger —
+  // the same reason the K2 plan-gate refusal logs one. An unlogged refusal makes design stops
+  // invisible to cost analysis, which is how a stage that keeps dying stays cheap-looking.
+  // (coderUsed/qe are the outer bindings, both still null here, so the row reports null honestly.)
+  await appendRunCostRow('design-gate', 'Design')
+  return { tier: tier, phase: 'design-incomplete', slug: SLUG, artifactsDir: FDIR, missingSubstages: fanVerdict.missingSubstages, missingArtifacts: fanVerdict.missingArtifacts, reason: fanVerdict.reason, modelsUsed: modelsUsed, gates: { design: fanVerdict.reason === 'probe-not-established' ? 'not-established' : 'incomplete', plan: 'not-run', planCompleteness: 'not-run', challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'REFUSED at the Step-5/6 boundary: ' + what + ', so the design is incomplete and Step 6 was NOT dispatched. Planning off a partial design produces a plan with no ADR behind it. ' + repair + ' If a sibling died on a Claude limit, add usage-adaptive routing or route that stage to Codex first (args.models). To rebuild the whole design from scratch instead, re-invoke with args.resume=\'never\'.' }
+}
 
 // Step 6: Plan — optionally routed to Codex's top model (opt-in via args.planner='codex').
 // The user opts in at pre-flight ('use the top Codex model for planning?'); we route the Plan step to