@dzhechkov/skills-feature-adr 1.5.0 → 1.5.1

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "59592f0b4612a14bdec61c96c20655644701cd77a0bf9d68315e1c98461900ff"
+        "sha256": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "8df52c2c7d7c70ef29670339ac01a6c0b0b6a36bb51a0be15dcc03357097cca8"
+        "sha256": "47f9402d4c3954d6d5a75ad906ec7b592010fdfd80f347d4a87dd14dd9e300ce"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "0fc1ae047774c2c67c6acf77a88eef8c9532c609bfc68b9e9cb37591cb61158f"
+        "sha256": "3fbe9ef86c9f6fa7c86bbe7760729094e80edb67577e397678b2d98dca1c2034"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -165,7 +165,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+        "sha256": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -321,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "3c8838c6a5107ea8a4b909cd9ccfa4d416324bb4ed9341f50b8e23f1b569d244"
+        "sha256": "0c74e8995d82bb986ef3233e91beebfa0e761aae4434f24554077bb05d2199e9"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -349,5 +349,5 @@
       }
     ]
   },
-  "signature": "8JbfbAiP55HvylGRoFfLwEtYCoo02jM9PwfOcTiYWQXfN/Utcg+Wc7uFo08yfqPUyONXsMCcEfqB7Y5eKWIvDg=="
+  "signature": "9WVoqK2D8eKSnmhhMqHPt31NedxwZCHiHyxJ5VLMxSVMecMqyXgrCJ2GQ3OOfIeiquB2D01bh7QjZW/EMVM9Aw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.5.1] - 2026-08-21
+
+### Changed — the Step-8 amendment gate is a COMMAND, and the durable writers are witnessed
+
+- `AMENDMENT_GATE` no longer asks the QE agent to judge whether every `AM-N` row names a real test.
+  It runs `dz amendment-check --slug <slug> --json` and reports the parsed verdict; the old judgement
+  wording is REMOVED from both workflow copies and all four `modules/08-qe.md` copies, not
+  accompanied. MEASURED 2026-08-21: `features/qe-scoped-review` shipped with five named amendment
+  test ids of which none existed, while its plan recorded `## Amendments: None`.
+- the run-cost ledger and the training-pair capture (including backfill) stop handing a subagent a
+  pre-baked shell string carrying their payload — the shape a security classifier blocked nine times
+  in one run. Both now call `dz feature-adr-record`. The `sed` that rewrote `"date":null` / `"ts":null`
+  inside an already-serialised document is gone: the command stamps before serialising.
+- a record failure still NEVER fails the run, but now survives it: `recordFailures` is returned from
+  every exit instead of scrolling past inside one log line.
+
+Requires `@dzhechkov/harness-core >= 0.6.1`.
+
 ## [1.5.0] - 2026-08-21
 
 ### Changed — feature `qe-scoped-review`

package/README.md

@@ -169,6 +169,25 @@ refused BY NAME: `path traversal ('..' segment)`, `degenerate path segment`, `em
 `illegal character '<c>'`, `empty stem after the leading dot`. The old substring traversal test also
 rejected the ordinary filename `foo..bar.ts`; it is a segment test now.
 
+### The Step-8 amendment gate runs a command instead of judging (v1.5.1)
+
+Every `AM-N` row must resolve to a test found INSIDE the file the row names, and the check is
+`dz amendment-check --slug <slug> --json` rather than a paragraph asking the reviewer to confirm it.
+MEASURED 2026-08-21: `features/qe-scoped-review` shipped with five named amendment test ids of which
+none existed, while its plan recorded `## Amendments: None`. The gate did not fail — a prompt cannot.
+
+The PLAN is authoritative when it carries rows (Step 6 owes "carry AM-N into the plan verbatim"), and
+the rule that keeps that honest is coverage: an amendment the plan drops — or rewords under the same
+id — is a failure. Renaming the TEST stays legitimate; tests are named later than ideation guesses.
+
+The durable writers were migrated in the same release: the run-cost ledger and the training-pair
+capture no longer hand a subagent a pre-baked shell string with their payload baked in — the shape a
+security classifier blocked nine times in one run. Both call `dz feature-adr-record`, which refuses
+before writing and verifies the append by re-reading the tail. A record failure still never fails the
+run; it now survives it in `recordFailures`.
+
+Requires `@dzhechkov/harness-core >= 0.6.1`.
+
 ### Step 0 writes the assessment down, and the acid check gets its input back (v1.5.0)
 
 Step 0 classifies the feature and now **writes `00_complexity_assessment.md` before it returns** — the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "59592f0b4612a14bdec61c96c20655644701cd77a0bf9d68315e1c98461900ff"
+          "content": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8df52c2c7d7c70ef29670339ac01a6c0b0b6a36bb51a0be15dcc03357097cca8"
+          "content": "47f9402d4c3954d6d5a75ad906ec7b592010fdfd80f347d4a87dd14dd9e300ce"
         }
       ]
     },
@@ -65,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0fc1ae047774c2c67c6acf77a88eef8c9532c609bfc68b9e9cb37591cb61158f"
+          "content": "3fbe9ef86c9f6fa7c86bbe7760729094e80edb67577e397678b2d98dca1c2034"
         }
       ]
     },
@@ -415,7 +415,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+          "content": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
         }
       ]
     },
@@ -805,7 +805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3c8838c6a5107ea8a4b909cd9ccfa4d416324bb4ed9341f50b8e23f1b569d244"
+          "content": "0c74e8995d82bb986ef3233e91beebfa0e761aae4434f24554077bb05d2199e9"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -160,18 +160,32 @@ The Confirmation-to-test link is load-bearing. If absent, grade no better than C
 
 ### 3b. Amendment Gate (P2 — amendments inherit the Confirmation discipline)
 
-Read the `## Amendments` sections of `03.5_ideation_report.md` and `06_implementation_plan.md` (skip
-silently if absent). For EVERY `AM-N` row verify:
-1. the row contains a `→ test ` token naming a real test (the fixed shape);
-2. the named test **exists** in the suite;
-3. it is **non-vacuous** — include the amendment test files in the SAME
-   `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test. An
-   amendment test that stays green at pre-feature base proves nothing about its amendment;
-4. a **safeguard** amendment's test proves the safeguard FIRES on a real input (a structurally-dead
-   safeguard passes an existence test and never fires in production).
-
-A missing, unnamed, or vacuous amendment test is a HIGH gap. This closes the distance between "we caught
-the design flaw" (challenge-panel/QCSD) and "we proved the fix works".
+**Do not judge this yourself — RUN the check.** Resolution of every `AM-N` row to a real test is a
+deterministic question, and a deterministic question must not live in prose (cost-of-detection ladder).
+It used to live here, and `features/qe-scoped-review` shipped with five named amendment test ids of
+which none existed, while its plan recorded `## Amendments: None`.
+
+```bash
+dz amendment-check --slug <feature-slug> --json      # or --feature-dir <abs path>
+```
+
+| Outcome | Exit | What it means for the gate |
+|---|---|---|
+| `pass` | 0 | every row resolves to a test found inside the file the row names |
+| `skip` | 0 | no `## Amendments` section — an absence, stated, never a silent pass |
+| `fail` | 1 | a HIGH gap: quote every reason verbatim into the QE report |
+| `not-established` | 3 | the grammar matched nothing, or the inputs were unreadable — **never a pass** |
+
+Empty stdout, a crash, or a missing `dz` is `not-established`, not a clean gate.
+
+**What the command does NOT prove:** that a resolved test discriminates. Vacuity stays yours, in the
+SAME `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test — an
+amendment test that stays green at pre-feature base proves nothing about its amendment. A **safeguard**
+amendment additionally needs its test to prove the safeguard FIRES on a real input: a structurally-dead
+safeguard passes an existence check and never fires in production.
+
+This closes the distance between "we caught the design flaw" (challenge-panel/QCSD) and "we proved the
+fix works".
 
 ### 3c. I/O-on-pure-path + fixture-swap hunt (P5)
 

package/templates/.claude/workflows/feature-adr.js

@@ -459,6 +459,10 @@ const TP_MAX_IO = 48000
 const TP_DIR = REPO + '/.dz/fa-training/' + SLUG
 const TP_MARK_DIR = REPO + '/.dz/fa-training/.backfill-marks'
 const LEDGER_FILE = REPO + '/.dz/feature-adr/run-cost-ledger.jsonl'
+// ADR-003: a record failure NEVER fails the run — a cost row is observability, and observability must
+// not take a six-hour run down with it. But today's silence is not "secondary", it is invisible: one
+// log line among thousands. Failures accumulate here and are RETURNED, so they survive the run.
+const recordFailures = []
 const TP_README = REPO + '/.dz/fa-training/README.md'
 const TP_BACKFILL_OK = 'TP-BACKFILL-OK'
 const TP_BACKFILL_SKIP = 'TP-BACKFILL-SKIP'
@@ -554,40 +558,49 @@ async function capturePairs(stage, phaseName, records, resumeGuardStage) {
     const markStage = String(stage).replace(/\.\./g, '_').replace(/\//g, '_')
     // The workflow pair line carries the stable feature SLUG, so this content key stays stable across resumes.
     const mark = TP_MARK_DIR + '/' + markStage + '-' + fnv1a64(stage + '\0' + lines.join('\n'))
-    let cmd = 'mkdir -p ' + shq(TP_DIR) + ' && { [ -f ' + shq(TP_README) + ' ] || printf \'%s\\n\' ' + shq(TP_PRIVACY_NOTE) + ' > ' + shq(TP_README) + '; }'
-    // Release the mark only when the append fails so a failed backfill stays retryable; DUP is distinct from SKIP.
+    // WITNESSED WRITE (ADR-001), backfill mode. The mark is still an atomic mkdir — but it is the
+    // COMMAND that takes it, so the same invocation that claims the mark is the one that validates
+    // and writes. The old form claimed the mark in a shell pipeline the courier never inspected.
     if (mode === 'backfill') {
-      cmd += ' && mkdir -p ' + shq(TP_MARK_DIR) + ' && if mkdir ' + shq(mark) + ' 2>/dev/null; then if [ -f ' + shq(file) + ' ]; then echo ' + shq(TP_BACKFILL_SKIP) + '; else { '
+      let outcome = 'written'
       for (let i = 0; i < lines.length; i++) {
-        if (i > 0) cmd += ' && '
-        // Keep the workflow-owned shell-side timestamp fill inside the absence-guarded append.
-        cmd += 'printf \'%s\' ' + shq(lines[i]) + ' | sed "s/\\"ts\\":null/\\"ts\\":\\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"/" >> ' + shq(file) + ' && printf \'\\n\' >> ' + shq(file)
-      }
-      cmd += ' && echo ' + shq(TP_BACKFILL_OK) + '; } || { rmdir ' + shq(mark) + ' 2>/dev/null; false; }; fi; else echo ' + shq(TP_BACKFILL_DUP) + '; fi'
-      const out = await agent('Run EXACTLY this one shell command via your Bash tool and reply with only its stdout: ' + cmd, { label: 'trainpair:backfill:' + stage, phase: phaseName, effort: 'low' })
-      const readback = String(out == null ? '' : out)
-      if (/TP-BACKFILL-OK/.test(readback)) {
-        log('training-pair: ' + stage + ' missing pair backfilled from the checkpoint')
-      } else if (/TP-BACKFILL-DUP/.test(readback)) {
-        log('training-pair: ' + stage + ' another run already captured this pair (nothing written)')
-      } else if (/TP-BACKFILL-SKIP/.test(readback)) {
-        log('training-pair: ' + stage + ' pair already existed (nothing written)')
-      } else {
-        log('training-pair: ' + stage + ' backfill UNVERIFIED (no TP-BACKFILL readback) — the pair may be missing on disk (non-blocking; the run continues)')
-        captureFailures.push(captureFailureRecord(stage, mode, 'backfill-unverified', 'no TP-BACKFILL-OK or TP-BACKFILL-SKIP readback'))
+        const cmdOne = DZ + ' feature-adr-record --kind training-pair --slug ' + shq(SLUG) + ' --stage ' + shq(stage)
+          + ' --project ' + shq(REPO) + ' --mark ' + shq(markStage + '-' + fnv1a64(stage + '\0' + lines.join('\n')) + '-' + i)
+          + ' --once --pair ' + shq(lines[i]) + ' --json'
+        const out = await agent('Run this command via your Bash tool and reply with only its stdout: ' + cmdOne, { label: 'trainpair:backfill:' + stage, phase: phaseName, effort: 'low' })
+        const readback = String(out == null ? '' : out)
+        const m = /"verdict"\s*:\s*"(written|duplicate|skipped)"/.exec(readback)
+        if (m === null) {
+          outcome = 'unverified'
+          captureFailures.push(captureFailureRecord(stage, mode, 'backfill-unverified', readback === '' ? 'no output from the record command' : readback.slice(0, 200)))
+          recordFailures.push({ kind: 'training-pair', stage: stage, reason: 'backfill: ' + (readback === '' ? 'no output from the record command' : readback.slice(0, 300)) })
+          break
+        }
+        if (m[1] !== 'written' && outcome === 'written') outcome = m[1]
       }
+      if (outcome === 'written') log('training-pair: ' + stage + ' missing pair backfilled from the checkpoint')
+      else if (outcome === 'duplicate') log('training-pair: ' + stage + ' another run already captured this pair (nothing written)')
+      else if (outcome === 'skipped') log('training-pair: ' + stage + ' pair already existed (nothing written)')
+      else log('training-pair: ' + stage + ' backfill NOT WRITTEN (non-blocking; the run continues)')
       return
     }
+    // WITNESSED WRITE (ADR-001): one command invocation per pair, data passed as an ARGUMENT. The
+    // `sed` that used to rewrite `"ts":null` inside an already-serialised document is gone — the
+    // command stamps the timestamp BEFORE serialising, so no text surgery touches a JSON value.
+    let allWritten = true
     for (const line of lines) {
-      // sed fills the top-level "ts":null with the real UTC time; the top-level ts precedes input in
-      // key order, so the FIRST match on the line is always the record's own ts, never payload text.
-      cmd += ' && printf \'%s\' ' + shq(line) + ' | sed "s/\\"ts\\":null/\\"ts\\":\\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"/" >> ' + shq(file) + ' && printf \'\\n\' >> ' + shq(file)
+      const cmdOne = DZ + ' feature-adr-record --kind training-pair --slug ' + shq(SLUG) + ' --stage ' + shq(stage)
+        + ' --project ' + shq(REPO) + ' --pair ' + shq(line) + ' --json'
+      const out = await agent('Run this command via your Bash tool and reply with only its stdout: ' + cmdOne, { label: 'trainpair:' + stage, phase: phaseName, effort: 'low' })
+      const readback = String(out == null ? '' : out)
+      if (!/"verdict"\s*:\s*"(written|duplicate|skipped)"/.test(readback)) {
+        allWritten = false
+        captureFailures.push(captureFailureRecord(stage, mode, 'unverified', readback === '' ? 'no output from the record command' : readback.slice(0, 200)))
+        recordFailures.push({ kind: 'training-pair', stage: stage, reason: readback === '' ? 'no output from the record command' : readback.slice(0, 300) })
+      }
     }
-    cmd += ' && echo TP-OK'
-    const out = await agent('Run EXACTLY this one shell command via your Bash tool and reply with only its stdout: ' + cmd, { label: 'trainpair:' + stage, phase: phaseName, effort: 'low' })
-    if (!/TP-OK/.test(String(out == null ? '' : out))) {
-      log('training-pair: ' + stage + ' capture UNVERIFIED (no TP-OK readback) — the pair may be missing on disk (non-blocking; the run continues)')
-      captureFailures.push(captureFailureRecord(stage, mode, 'unverified', 'no TP-OK readback'))
+    if (!allWritten) {
+      log('training-pair: ' + stage + ' capture NOT WRITTEN for at least one pair (non-blocking; the run continues)')
     }
   } catch (e) {
     const message = e && e.message ? e.message : String(e)
@@ -615,17 +628,18 @@ async function appendRunCostRow(stage, phaseName) {
       auto: true,
       mode: (typeof MODE === 'string' && MODE !== '') ? MODE : null,
     })
-    const dir = LEDGER_FILE.replace(/\/[^/]*$/, '')
-    // Safe sed target: JSON-escaped scalar values cannot contain the raw `"date":null` token,
-    // and the top-level `"date":null` field appears exactly once.
-    const cmd = 'mkdir -p ' + shq(dir)
-      + " && printf '%s' " + shq(line)
-      + ' | sed "s/\\"date\\":null/\\"date\\":\\"$(date -u +%Y-%m-%d)\\"/" >> ' + shq(LEDGER_FILE)
-      + " && printf '\\n' >> " + shq(LEDGER_FILE)
-      + ' && echo LEDGER-OK'
-    const out = await agent('Run EXACTLY this one shell command via your Bash tool and reply with only its stdout: ' + cmd, { label: 'ledger:append', phase: phaseName, effort: 'low' })
-    if (!/LEDGER-OK/.test(String(out == null ? '' : out))) {
-      log('run-cost ledger: ' + stage + ' row UNVERIFIED (no LEDGER-OK readback) — the row may be missing on disk (SECONDARY; the run continues)')
+    // WITNESSED WRITE (ADR-001): the subagent RUNS a command with data arguments; it is no longer
+    // handed a shell pipeline with the row baked in. The command refuses a malformed row, stamps the
+    // date BEFORE serialising (no sed over a serialised document) and verifies the append by
+    // re-reading the tail. A courier could do none of those three.
+    const cmd = DZ + ' feature-adr-record --kind ledger --stage ' + shq(stage) + ' --project ' + shq(REPO)
+      + ' --row ' + shq(line) + ' --json'
+    const out = await agent('Run this command via your Bash tool and reply with only its stdout: ' + cmd, { label: 'ledger:append', phase: phaseName, effort: 'low' })
+    const readback = String(out == null ? '' : out)
+    if (!/"verdict"\s*:\s*"written"/.test(readback)) {
+      // ADR-003: SECONDARY — never fails the run — but the failure now SURVIVES it.
+      recordFailures.push({ kind: 'ledger', stage: stage, reason: readback === '' ? 'no output from the record command' : readback.slice(0, 300) })
+      log('run-cost ledger: ' + stage + ' row NOT WRITTEN (SECONDARY; the run continues) — ' + readback.slice(0, 200))
     }
   } catch (e) {
     log('run-cost ledger: ' + stage + ' append failed (SECONDARY; non-blocking): ' + (e && e.message ? e.message : String(e)))
@@ -1895,7 +1909,7 @@ const DISCRIMINATION_GATE = '\u00a742 TEST-DISCRIMINATION GATE (run right after
 // shape (a linter can assert the `→ test ` token); Step-8 verifies existence + non-vacuity via the SAME
 // dz discrimination-check that guards the ADR property (cost-of-detection ladder: judgment → step gate).
 const AMENDMENT_RULE = 'AMENDMENT CONFIRMATION DISCIPLINE (every amendment is a mini-ADR): whenever a correction/amendment is folded in (a QCSD CONDITIONAL condition, a challenge-panel confirmed finding, or a user checkpoint steer), record it in a `## Amendments` section as a fixed-shape row: `AM-N (source): <change>. Confirmation: <property> → test `test_name` (fails if reverted).` — naming the test that would FAIL if the amendment were reverted/broken. For a SAFEGUARD amendment (a warning/guard/fallback), the named test must prove the safeguard actually TRIGGERS on a real input — not merely that its code path exists (a structurally-dead safeguard passes an existence test and never fires in production).'
-const AMENDMENT_GATE = 'AMENDMENT GATE (P2): read the `## Amendments` sections of ' + FDIR + '/03.5_ideation_report.md and ' + FDIR + '/06_implementation_plan.md (skip silently if absent). EVERY `AM-N` row must contain a `→ test ` token naming a real test. Verify: (a) the named test EXISTS in the suite; (b) it is NON-VACUOUS — include the amendment test files in the SAME `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test (an amendment test that stays green at pre-feature base proves nothing); (c) a safeguard amendment\'s test proves the safeguard FIRES on a real input. A missing, unnamed, or vacuous amendment test is a HIGH gap. ' +
+const AMENDMENT_GATE = 'AMENDMENT GATE (P2): do NOT judge this yourself — RUN the check and report what it says. Via Bash run EXACTLY `' + DZ + ' amendment-check --slug ' + SLUG + ' --json` (add `--feature-dir ' + FDIR + '` if the slug does not resolve from your CWD). Parse the JSON and report `amendments: {outcome, counts, reasons}` in your return object. outcome `pass` or `skip` clears the gate; `fail` is a HIGH gap and every reason must be quoted verbatim into the QE report; `not-established` means the check could not be run or the grammar matched nothing — that is NEVER a pass, report it as inconclusive with the tool error. Empty stdout, a crash, or a missing `dz` is `not-established`, not a clean gate. This check proves each amendment RESOLVES to a real test; it does NOT prove the test discriminates — vacuity stays with the discrimination gate above. ' +
   'IO-ON-PURE-PATH + FIXTURE-SWAP HUNT (P5): in the test diff, hunt for replacements of broken/unbound fixtures with healthy ones — the old fixture was probably a NEGATIVE CONTROL proving a path was I/O-free; each such swap requires a compensating negative resource-down test. If the code diff adds I/O (DB/network/file) to a previously-pure path — especially startup/lifespan/health — require a negative resource-down test (broken/unbound resource → the path degrades per its declared contract: fail-open for advisory, explicit fail-fast for load-bearing). Missing → HIGH gap.'
 
 // Step 0: Router + MANDATORY self-learning recall
@@ -2172,7 +2186,7 @@ if (!fanVerdict.complete) {
   // invisible to cost analysis, which is how a stage that keeps dying stays cheap-looking.
   // (coderUsed/qe are the outer bindings, both still null here, so the row reports null honestly.)
   await appendRunCostRow('design-gate', 'Design')
-  return { tier: tier, phase: 'design-incomplete', slug: SLUG, artifactsDir: FDIR, missingSubstages: fanVerdict.missingSubstages, missingArtifacts: fanVerdict.missingArtifacts, reason: fanVerdict.reason, modelsUsed: modelsUsed, gates: { design: fanVerdict.reason === 'probe-not-established' ? 'not-established' : 'incomplete', plan: 'not-run', planCompleteness: 'not-run', challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'REFUSED at the Step-5/6 boundary: ' + what + ', so the design is incomplete and Step 6 was NOT dispatched. Planning off a partial design produces a plan with no ADR behind it. ' + repair + ' If a sibling died on a Claude limit, add usage-adaptive routing or route that stage to Codex first (args.models). To rebuild the whole design from scratch instead, re-invoke with args.resume=\'never\'.' }
+  return { tier: tier, phase: 'design-incomplete', slug: SLUG, artifactsDir: FDIR, missingSubstages: fanVerdict.missingSubstages, missingArtifacts: fanVerdict.missingArtifacts, reason: fanVerdict.reason, modelsUsed: modelsUsed, gates: { design: fanVerdict.reason === 'probe-not-established' ? 'not-established' : 'incomplete', plan: 'not-run', planCompleteness: 'not-run', challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, recordFailures: recordFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'REFUSED at the Step-5/6 boundary: ' + what + ', so the design is incomplete and Step 6 was NOT dispatched. Planning off a partial design produces a plan with no ADR behind it. ' + repair + ' If a sibling died on a Claude limit, add usage-adaptive routing or route that stage to Codex first (args.models). To rebuild the whole design from scratch instead, re-invoke with args.resume=\'never\'.' }
 }
 
 // Step 6: Plan — optionally routed to Codex's top model (opt-in via args.planner='codex').
@@ -2320,7 +2334,7 @@ if (planGate.verdict !== 'pass') {
   // NAMED REFUSAL — the run stops here and the coder is never dispatched. This precedes the L/XL
   // checkpoint deliberately: an incomplete plan is not something to steer, it is something to fix.
   await appendRunCostRow('plan-gate', 'Plan')
-  return { tier: tier, phase: 'plan-gate-failed', slug: SLUG, artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: modelsUsed, planGate: planGate, gates: { plan: (plan ? 'produced' : 'missing'), planCompleteness: planGate.verdict, challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: refusalNoteFor(planGate, SLUG) }
+  return { tier: tier, phase: 'plan-gate-failed', slug: SLUG, artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: modelsUsed, planGate: planGate, gates: { plan: (plan ? 'produced' : 'missing'), planCompleteness: planGate.verdict, challengePanel: 'not-run', code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, recordFailures: recordFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: refusalNoteFor(planGate, SLUG) }
 }
 
 // Hybrid checkpoint for L/XL
@@ -2341,7 +2355,7 @@ if (stopHere) {
   // presence), never from prose, so a skipped gate shows as 'not-run' instead of being silently forgotten.
   const planGates = { plan: (plan ? 'produced' : 'missing'), planCompleteness: planGate.verdict, challengePanel: (challengeVerdict ? 'ran' : 'not-run'), code: 'not-run', qe: 'not-run' }
   await appendRunCostRow('plan', 'Plan')
-  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: plannedModels, challengeVerdict: challengeVerdict, gates: planGates, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'L/XL checkpoint - review the ADR + plan (+ the planned code/qe/fleet models) + the challenge panel verdict (advisory) + the gates line, then re-invoke with args.stopAfter="none" to implement + QE (durable checkpoints make the re-invoke resume router+design+plan instead of re-running them). Present the gates map as a `🚦 Gates:` line in the checkpoint banner, rendering the planCompleteness entry as `K2 plan-completeness ✓` (pass) / `✗` (fail) / `inconclusive`.' }
+  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: plannedModels, challengeVerdict: challengeVerdict, gates: planGates, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, recordFailures: recordFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'L/XL checkpoint - review the ADR + plan (+ the planned code/qe/fleet models) + the challenge panel verdict (advisory) + the gates line, then re-invoke with args.stopAfter="none" to implement + QE (durable checkpoints make the re-invoke resume router+design+plan instead of re-running them). Present the gates map as a `🚦 Gates:` line in the checkpoint banner, rendering the planCompleteness entry as `K2 plan-completeness ✓` (pass) / `✗` (fail) / `inconclusive`.' }
 }
 
 // Step 7: Code (optional Codex fallback on Claude-limit exhaustion)
@@ -2974,7 +2988,7 @@ return {
   resumedStages: resumedStages,
   checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off',
   trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off',
-  captureFailures: captureFailures,
+  captureFailures: captureFailures, recordFailures: recordFailures,
   reqeDue: reqeDue,
   brain: BRAIN,
   polymorphism: POLY.hasManifest ? POLY.report : null,