@dzhechkov/skills-feature-adr 1.5.13 → 1.5.14

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
+        "sha256": "26fa03f89862d03ebfc6447c866cb5d4dcbd5591ae4f8fb3a3ea08b6c586e19d"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "619a231352a602c736ce6eec1e5fa79a056dc2f5f80f6b35eed236f9670f7337"
+        "sha256": "8c96e82b41fb8479befb56797a367b3cc2119cc5b022b18fdd18f129ef8cd0f0"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "07537ebbd424c668a37a42b670c033a4d3134a9e7e13803f426aa31149a85b58"
+        "sha256": "0cdd048a5aacd52294f72b5903b5a94c049ad61680dbcac532d5cb3fbd45c736"
       },
       {
         "path": "src/cli.js",
@@ -37,7 +37,7 @@
       },
       {
         "path": "src/commands/init.js",
-        "sha256": "fbc3853435048c5b632119bf37cc702c4c305cae7de656548891295f6b9e8947"
+        "sha256": "07ff9d955422979ea67aa5aa454c13303f5ae644efb32e5cc6f359a509638347"
       },
       {
         "path": "src/commands/list.js",
@@ -157,7 +157,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "7ab9b7b1523289986a1f51b4cbbebf4410d96ad4a153f22fa8613e8a0f4f5fa7"
+        "sha256": "5355e2b36ab13b6acb65abe5b206685915ef2b08191b4a3130574620012b9135"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -249,7 +249,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "08e69d2e63350fe2dc64483226fcd30901b77a8e930ca6280ef71181c67675b4"
+        "sha256": "eb77822f121ade10bd6265b0f0145ec38507a07d2cb72ba5fa8336c962096bda"
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
@@ -317,7 +317,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "e96c5280ad21b604036cc912418c9627b0ff0ae8ca1436c58dcff951ba9a034b"
+        "sha256": "6d1bb93be6fae296281ac8f9fc2f266e5f09336cf6e183912fab5ff3bd0d3fd8"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -329,5 +329,5 @@
       }
     ]
   },
-  "signature": "CfTJgsBbekrZE+IbzaQFLofuRDZ3B2CJTqPk6gjeOiLXhChXiPGkqxaWKCT+hdQTy6ORB7fu6vfMx37rwJf6Cg=="
+  "signature": "+DKyJg37w6aHqhg/UhCpQ+y+w/e66HEEr9hgOv/TttSIMc6TokGEbvJpxEw2pdu19Q0SHlA/o6pSucM+h3KEDw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [Unreleased]
+
+### Fixed — `init --force` больше не стирает локальную правку молча
+
+- Из трёх путей записи `init --force` был ЕДИНСТВЕННЫМ, который перезаписывал локально
+  изменённый файл без резервной копии и без строки в отчёте — при том, что баннер успеха
+  рекомендует именно эту команду. `update` сохраняет правку по трёхсторонней сверке,
+  `update --force` кладёт `.bak` с первого дня; расходился только `init --force`.
+- Теперь `init --force` копирует изменённый файл в `<file>.bak` ПЕРЕД перезаписью и называет
+  его в отчёте. Копия делается только если байты ОТЛИЧАЮТСЯ от шаблона: `.bak`, совпадающий
+  с шаблоном, — чистый мусор. `--dry-run --force` называет будущую копию и ничего не пишет.
+- Поведение самого `--force` не смягчено: файл по-прежнему перезаписывается, это его смысл.
+  Менялось только то, что правка перестала исчезать бесследно.
+
 ## [1.5.1] - 2026-08-21
 
 ### Changed — the Step-8 amendment gate is a COMMAND, and the durable writers are witnessed

package/README.md

@@ -63,7 +63,9 @@ npx @dzhechkov/skills-feature-adr init               # Install core components
 npx @dzhechkov/skills-feature-adr init --with-learning                  # + reward learning
 npx @dzhechkov/skills-feature-adr init --knowledge-extractor            # + knowledge extractor
 npx @dzhechkov/skills-feature-adr init --with-learning --knowledge-extractor  # + both
-npx @dzhechkov/skills-feature-adr init --force       # Overwrite existing files
+npx @dzhechkov/skills-feature-adr init --force       # Overwrite existing files (a locally
+                                                     # changed file is copied to <file>.bak first,
+                                                     # and the copy is named in the report)
 npx @dzhechkov/skills-feature-adr init --dry-run     # Preview without making changes
 npx @dzhechkov/skills-feature-adr update             # Update to latest version
 npx @dzhechkov/skills-feature-adr remove             # Clean uninstall
@@ -106,6 +108,13 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### Checkpoint reads have one source (v1.5.14)
+
+`loadCheckpoints` in the bundled `feature-adr.js` now builds its read command with the checkpoints blob's own
+`checkpointReadCmd(FDIR)` instead of a hand-written duplicate, so the helper with the speaking name is the one the pipeline
+runs. Behaviour is unchanged: for directory names with spaces, quotes and missing directories the shell output is
+byte-identical (proved against the old command). A wiring test fails if the duplicate is re-inlined.
+
 ### Advisory micro-recall at two decision points (v1.5.9, staged)
 
 The workflow makes one bounded decision-local recall attempt immediately before the live Step 3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.5.13",
+  "version": "1.5.14",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
+          "content": "26fa03f89862d03ebfc6447c866cb5d4dcbd5591ae4f8fb3a3ea08b6c586e19d"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "619a231352a602c736ce6eec1e5fa79a056dc2f5f80f6b35eed236f9670f7337"
+          "content": "8c96e82b41fb8479befb56797a367b3cc2119cc5b022b18fdd18f129ef8cd0f0"
         }
       ]
     },
@@ -69,7 +69,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "07537ebbd424c668a37a42b670c033a4d3134a9e7e13803f426aa31149a85b58"
+          "value": "0cdd048a5aacd52294f72b5903b5a94c049ad61680dbcac532d5cb3fbd45c736"
         }
       ]
     },
@@ -99,7 +99,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fbc3853435048c5b632119bf37cc702c4c305cae7de656548891295f6b9e8947"
+          "content": "07ff9d955422979ea67aa5aa454c13303f5ae644efb32e5cc6f359a509638347"
         }
       ]
     },
@@ -399,7 +399,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ab9b7b1523289986a1f51b4cbbebf4410d96ad4a153f22fa8613e8a0f4f5fa7"
+          "content": "5355e2b36ab13b6acb65abe5b206685915ef2b08191b4a3130574620012b9135"
         }
       ]
     },
@@ -629,7 +629,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "08e69d2e63350fe2dc64483226fcd30901b77a8e930ca6280ef71181c67675b4"
+          "content": "eb77822f121ade10bd6265b0f0145ec38507a07d2cb72ba5fa8336c962096bda"
         }
       ]
     },
@@ -799,7 +799,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e96c5280ad21b604036cc912418c9627b0ff0ae8ca1436c58dcff951ba9a034b"
+          "content": "6d1bb93be6fae296281ac8f9fc2f266e5f09336cf6e183912fab5ff3bd0d3fd8"
         }
       ]
     },

package/src/commands/init.js

@@ -54,14 +54,15 @@ function showKeysariumIntegration(keysariumManifest) {
 
 // Copies a component file-by-file with per-file overwrite protection:
 //   - destination missing            -> write, record in `written`
-//   - destination exists + --force   -> overwrite, record in `written`
+//   - destination exists + --force   -> BACK UP to a .bak sibling if the bytes differ,
+//                                       then overwrite; record in `written` (+ `backedUp`)
 //   - destination exists, no --force -> do NOT write, record in `preserved`
 // In dry-run mode nothing is written, but the same written/preserved
 // classification is produced.
 // Returns { missing, fileCount } where `missing` means the template source
 // was absent on disk and `fileCount` is how many files the template provides.
 function installComponent(key, comp, templatesDir, targetDir, opts) {
-  const { force, dryRun, written, preserved, hashes } = opts;
+  const { force, dryRun, written, preserved, backedUp, hashes } = opts;
   const src = path.join(templatesDir, comp.src);
   const destRoot = path.join(targetDir, comp.src);
 
@@ -89,12 +90,20 @@ function installComponent(key, comp, templatesDir, targetDir, opts) {
   }
 
   for (const entry of entries) {
-    if (fileExists(entry.destFile) && !force) {
+    const existed = fileExists(entry.destFile);
+    if (existed && !force) {
       preserved.push(entry.rel);
       continue;
     }
+    // `update --force` has backed edits up to a `.bak` sibling since day one; `init --force` was
+    // the ONE path that overwrote silently — and the success banner recommends exactly that
+    // command, so a locally-edited workflow could vanish with no notice and no copy.
+    // Only DIFFERING bytes are backed up: a `.bak` identical to the template is pure litter.
+    const differs = existed && hashFile(entry.destFile) !== hashFile(entry.srcFile);
+    if (differs && backedUp) backedUp.push(entry.rel);
     if (!dryRun) {
       ensureDir(path.dirname(entry.destFile));
+      if (differs) fs.copyFileSync(entry.destFile, `${entry.destFile}.bak`);
       fs.copyFileSync(entry.srcFile, entry.destFile);
       // Record the SHA-256 of the TEMPLATE bytes we just installed (not the
       // dest) as this file's baseline. This makes baseline == mine immediately
@@ -110,6 +119,23 @@ function installComponent(key, comp, templatesDir, targetDir, opts) {
   return { missing: false, fileCount: entries.length };
 }
 
+// Print the block of locally-changed files that were (or would be) backed up before --force
+// overwrote them. Silence here is what the field report caught: the operator had no way to learn
+// that their edit was gone, let alone where the copy is.
+function printBackedUpBlock(backedUp, dryRun) {
+  if (backedUp.length === 0) return;
+  const MAX_SHOWN = 10;   // `printPreservedBlock` держит свою копию — она объявлена в его теле
+  console.log('');
+  const verb = dryRun ? 'would be backed up' : 'backed up';
+  warn(`${backedUp.length} locally-changed file(s) ${verb} to a .bak sibling before being overwritten:`);
+  for (const rel of backedUp.slice(0, MAX_SHOWN)) {
+    console.log(dim(`  ${rel} -> ${rel}.bak`));
+  }
+  if (backedUp.length > MAX_SHOWN) {
+    console.log(dim(`  …and ${backedUp.length - MAX_SHOWN} more`));
+  }
+}
+
 // Print the block of pre-existing files that were (or would be) preserved
 function printPreservedBlock(preserved, dryRun) {
   console.log('');
@@ -233,6 +259,7 @@ async function run(options) {
   const installedFiles = [];   // files written (or would-write in dry-run)
   const installedHashes = {};  // rel -> sha256 of the TEMPLATE bytes installed (baseline)
   const preservedFiles = [];   // pre-existing files NOT overwritten (no --force)
+  const backedUpFiles = [];    // locally-changed files copied to .bak before --force overwrote them
   const completedKeys = [];    // component keys processed so far (for partial manifest)
   const installedOptionalKeys = [];
   let stepNum = 0;
@@ -246,7 +273,7 @@ async function run(options) {
 
       installComponent(key, comp, templatesDir, targetDir, {
         force, dryRun, written: installedFiles, preserved: preservedFiles,
-        hashes: installedHashes,
+        backedUp: backedUpFiles, hashes: installedHashes,
       });
       completedKeys.push(key);
     }
@@ -262,7 +289,7 @@ async function run(options) {
 
       const res = installComponent(key, comp, templatesDir, targetDir, {
         force, dryRun, written: installedFiles, preserved: preservedFiles,
-        hashes: installedHashes,
+        backedUp: backedUpFiles, hashes: installedHashes,
       });
       if (!res.missing && res.fileCount > 0) {
         installedOptionalKeys.push(key);
@@ -296,6 +323,10 @@ async function run(options) {
   if (dryRun) {
     console.log('');
     info(`Dry run: ${installedFiles.length} file(s) would be written, ${preservedFiles.length} pre-existing file(s) would be preserved.`);
+    // Отчёт о копиях стоит СНАРУЖИ стража сохранённых: при --force сохранять нечего, список
+    // пуст, и внутри стража блок был бы недостижим ровно в том случае, ради которого написан.
+    // Пустой список функция отсекает сама.
+    printBackedUpBlock(backedUpFiles, true);
     if (preservedFiles.length > 0) {
       printPreservedBlock(preservedFiles, true);
     }
@@ -318,10 +349,11 @@ async function run(options) {
     process.exit(0);
   }
 
+  printBackedUpBlock(backedUpFiles, false);   // снаружи: при --force preservedFiles пуст
   if (preservedFiles.length > 0) {
     printPreservedBlock(preservedFiles, false);
-    console.log('');
   }
+  if (preservedFiles.length > 0 || backedUpFiles.length > 0) console.log('');
 
   // ── f) Write manifest ──────────────────────────────────────────────────
   const pkgPath = path.resolve(__dirname, '../../package.json');

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -205,7 +205,9 @@ list), grep for unfinished-stub markers: `TODO` / `FIXME` / `HACK` / `XXX` / `PL
 file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or
 `.dz/guard.json` `stubWaivers` lists the path WITH a reason. A REASONLESS waiver is itself a HIGH gap,
 never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan
-as the SOFT `no-stubs` rule over the working-tree diff. When you QUOTE a marker in `08_qe_report.md`,
+as the SOFT `no-stubs` rule over the working-tree diff.
+After the Step-7 code has landed, run `dz guard check --op code --json` and treat a HARD `block` verdict
+as a HIGH finding naming the drifted file. When you QUOTE a marker in `08_qe_report.md`,
 backtick it so the report itself scans clean (the claim-check forbidden-phrase convention). Record the
 verdict in the ADR Fitness section.
 
@@ -311,6 +313,9 @@ Compile all findings into a structured report:
 ✅ READY FOR MERGE | ❌ NEEDS FIXES | ⚠️ CONDITIONAL APPROVAL
 ```
 
+Settle a cross-family re-QE debt with `dz reqe --slug <s> --done --report <08b>`.
+For `dz reqe --done`, exit 3 means the review settled but named BLOCKER/HIGH findings — stop and surface them to the owner.
+
 ### 7.1 Findings ledger (machine-readable)
 
 Prose is for people; `dz score`/`dz recap` need a machine-readable surface too (qe-findings-record,
@@ -373,9 +378,13 @@ resume guard at all before this).
 Otherwise — QE ran fresh in this pass — after `08_qe_report.md` is written and the grade is final, run:
 
 ```bash
-dz feature-adr-record --kind ledger --stage qe --slug <slug> --row '<json>' --auto --json
+dz feature-adr-record --kind ledger --stage qe --slug <slug> --row '<json>' --json
 ```
 
+fix-round-1 (Codex r1 HIGH finding 4, ADR-001 D5): no `--auto` here. `--auto` is the trusted marker
+of an AUTOMATED pipeline run and requires an experiment envelope that the manual path does not have;
+this plain-mode row is written without it.
+
 `<json>` carries the same fields the ultracode pipeline writes for this row: `reviewer` (the model
 that reviewed, or `null` if unknown — never guessed), `reviewerFamily` (`claude`|`codex`|`null` when
 the reviewer identity is not one of the two known families — never guessed as `claude`), `qeRole`

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -31,12 +31,18 @@
 // side) for C1 and C8 together, so a prose mention stops satisfying either check, is a separate
 // backlog item — filed by the lead, not chased here.
 //
+// KNOWN LIMITATION (C9): only byte-identical copies are visible before the edit. Already drifted
+// or intentionally different pinned copies remain the identity tests' job; the frozen
+// features/wave1-instrument-repair/check-plan-completeness.mjs is a real example C9 cannot see.
+//
 // Checks:
 //  C1  every ADR file in 03_adr/ has >=1 task line in 06_implementation_plan.md citing it (ADR-00N)
 //  C2  every Confirmation-numbered check in each ADR is named in the plan (by its test-file path)
 //  C3  the plan carries an EXPECTED_CODE_TARGETS: block, non-empty, and EVERY line parses to a
 //      plausible repo-relative path (no spaces unless quoted, no traversal, no markdown residue)
 //      — SFDIPOT condition: line-level validation, reject-with-reason, not just block presence
+//  C9  every tracked byte-identical twin of a target is also listed or explicitly waived with a
+//      reason; size-first narrowing, fixed exclusions, one FAIL per missing (target, twin) pair
 //  C4  the plan names the feature's OWN acid corpus (see "acid corpus" below)
 //  C5  the plan has an 'Inputs read:' line naming 03_adr, 05_architecture (wave-2 seam, cheap here)
 //  C8  every requirement id DECLARED in 01_requirements.md (FR-N, NFR-N, AC-N, C-N, with an optional
@@ -79,7 +85,9 @@
 // supplied explicitly with `--acid=T1,T2,…`. If neither establishes a corpus, C4 is SKIPPED-with-note
 // (a feature that declared no acid cases cannot be failed for not naming them).
 import { maskMarkdown } from './markdown-masker.mjs';
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { isAbsolute, join, resolve } from 'node:path';
 
 const argv = process.argv.slice(2);
@@ -335,6 +343,7 @@ function classifyTargetPath(path) {
 
 // C3 — EXPECTED_CODE_TARGETS block, line-level validation
 const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
+const listedTargets = new Set();
 if (!blockM) failures.push('C3: no EXPECTED_CODE_TARGETS: block in the plan');
 else {
   const lines = blockM[1].split('\n').map(s => s.trim()).filter(Boolean);
@@ -343,6 +352,81 @@ else {
     const path = ln.replace(/^[-*]\s*/, '').replace(/`/g, '').trim();
     const reasons = classifyTargetPath(path);
     if (reasons.length) failures.push(`C3: target line rejected: "${safe(ln)}" — ${reasons.join(', ')}`);
+    else listedTargets.add(path);
+  }
+}
+
+// C9 — every byte-identical copy is listed or carries a reasoned waiver (ADR-001).
+const TWIN_EXCLUDED_PREFIXES = ['out/', '.claude/worktrees/', 'node_modules/'];
+{
+  const excluded = (path) => TWIN_EXCLUDED_PREFIXES.some((prefix) => path.startsWith(prefix) || path.includes('/' + prefix));
+  const waivers = [];
+  for (const line of maskMarkdown(plan, { unclosed: 'mask' }).split('\n')) {
+    if (!/^\s*(?:[-*]\s*)?TWIN_NOT_A_TARGET:/.test(line)) continue;
+    const match = line.match(/^\s*(?:[-*]\s*)?TWIN_NOT_A_TARGET:\s*`?([^\s`]+)`?\s*(?:—|--)\s*(\S.*)$/);
+    if (!match) {
+      failures.push(`C9: waiver "${safe(line.trim())}" carries no reason — a waiver without a reason is an allowlist entry`);
+    } else waivers.push({ path: match[1], used: false });
+  }
+
+  let tracked = null;
+  try {
+    tracked = execFileSync('git', ['ls-files', '-z'], {
+      cwd: process.cwd(), encoding: 'utf-8', maxBuffer: 16 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).split('\0').filter(Boolean);
+  } catch (error) {
+    warnings.push(`C9: twin scan had no input — git ls-files failed in ${safe(process.cwd())}: ${safe(error.message)}`);
+  }
+  if (tracked !== null) {
+    // Stat the universe first; only size matches ever reach readFileSync / md5.
+    const sizes = new Map();
+    for (const path of new Set([...tracked, ...listedTargets])) {
+      if (excluded(path)) continue;
+      try {
+        const stat = statSync(path);
+        if (stat.isFile()) sizes.set(path, stat.size);
+      } catch (error) {
+        // Missing targets are new files; tracked files can also have been deleted locally.
+        if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') warnings.push(`C9: cannot stat ${safe(path)}: ${safe(error.message)}`);
+      }
+    }
+    const targetSizes = new Set([...listedTargets].map((path) => sizes.get(path)).filter((size) => size > 0));
+    const hashes = new Map();
+    const twinsByHash = new Map();
+    for (const [path, size] of sizes) {
+      if (!targetSizes.has(size)) continue;
+      try { hashes.set(path, createHash('md5').update(readFileSync(path)).digest('hex')); }
+      catch (error) { warnings.push(`C9: cannot hash ${safe(path)}: ${safe(error.message)}`); }
+    }
+    for (const path of tracked) {
+      const hash = hashes.get(path);
+      if (hash === undefined) continue;
+      if (!twinsByHash.has(hash)) twinsByHash.set(hash, []);
+      twinsByHash.get(hash).push(path);
+    }
+    let unlisted = 0;
+    for (const target of listedTargets) {
+      for (const twin of twinsByHash.get(hashes.get(target)) ?? []) {
+        if (twin === target) continue;
+        let waived = false;
+        for (const waiver of waivers) {
+          if (waiver.path.endsWith('/') ? twin.startsWith(waiver.path) : twin === waiver.path) {
+            waiver.used = true;
+            waived = true;
+          }
+        }
+        if (listedTargets.has(twin) || waived) continue;
+        unlisted++;
+        // Keep pairs separate: safe() truncates each echoed value at 300 characters.
+        failures.push(`C9: target ${safe(target)} has a byte-identical twin the plan does not list: ${safe(twin)} — list it or waive it (TWIN_NOT_A_TARGET: ${safe(twin)} — <why>)`);
+      }
+    }
+    for (const waiver of waivers) if (!waiver.used) warnings.push(`C9: unused waiver ${safe(waiver.path)}`);
+    if (unlisted === 0) {
+      const onDisk = [...listedTargets].filter((path) => sizes.has(path)).length;
+      out(`NOTE  C9: twin scan over ${listedTargets.size} target(s), ${onDisk} on disk, 0 unlisted twins (byte-identical only; drifted copies need identity tests)`);
+    }
   }
 }
 
@@ -417,7 +501,21 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
       // bullet-less row was invisible here while being a row there (so it evaded this check), and
       // this side lacked the range guard, so «AM-1..AM-4 are covered elsewhere» was falsely
       // reported as a definition. One shape, one meaning.
-      const isDef = /^\s*(?:[-*|]\s*)?\*{0,2}AM-(?:CP-)?\d+\*{0,2}\b(?!\s*\.)/.test(pl);
+      // ЯЧЕЙКА ТАБЛИЦЫ ВНЕ СЕКЦИИ — НЕ ОПРЕДЕЛЕНИЕ. Внутри `## Amendments` строка таблицы
+      // законно объявляет поправку, поэтому там `|` остаётся допустимым началом строки. Снаружи
+      // же таблица — это СВОДКА, ссылающаяся на поправки, определённые в другом месте, и читать
+      // её как определение значит отказывать плану за оглавление.
+      // ИЗМЕРЕНО 2026-09-05: четыре ложных FAIL за один день на четырёх разных фичах
+      // (narrated-error-must-be-taught, fa-phase-statusline, core-boundary-guard,
+      // run-registry-liveness); каждый стоил ручной правки ведущего и перезапуска конвейера,
+      // то есть 5–10 минут и один цикл роутера. Один планировщик дошёл до того, что вписал в
+      // план оговорку «no line of this paragraph may begin with AM-» — прибор начал
+      // диктовать людям форму прозы, а это уже не проверка, а суеверие.
+      // ОДИН механизм, а не два: `|` УБРАН из класса начал строки. Первая редакция этой правки
+      // добавляла ещё и отдельную проверку `isTableRow`, и мутация, снимавшая только её,
+      // оставалась ЭКВИВАЛЕНТНОЙ — 77 тестов из 77 зелёные при «снятой» починке. Дублирующая
+      // защита не усиливает гейт, она прячет от мутационной пробы, что именно держит свойство.
+      const isDef = /^\s*(?:[-*]\s*)?\*{0,2}AM-(?:CP-)?\d+\*{0,2}\b(?!\s*\.)/.test(pl);
       const inSection = sectionStart >= 0 && cursor2 >= sectionStart && cursor2 < sectionEnd;
       if (isDef && !inSection) {
         const tok = (/AM-(?:CP-)?\d+/.exec(pl) || ['AM-?'])[0];
@@ -479,7 +577,10 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
         }
         if (superseded) break;
       }
-      if (!hasTest && !superseded) failures.push(`C6: ${defs[k].id} carries neither \`\u2192 test <name>\` nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
+      // Сообщение называет ТУ ЖЕ форму, которую требует MARK выше. Прежняя редакция обещала
+      // простое `→ test <name>`, а проверка требовала имя и файл в обратных кавычках — человек,
+      // написавший ровно то, что просило сообщение, получал отказ снова и не понимал, почему.
+      if (!hasTest && !superseded) failures.push(`C6: ${defs[k].id} carries neither \`\u2192 test \`<имя>\` in \`<файл>\`\` (обратные кавычки обязательны, как и слово in) nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
     }
   }
 }

package/templates/.claude/workflows/feature-adr.js

@@ -16,6 +16,49 @@ export const meta = {
   ],
 }
 
+// Self-contained mirror of harness-core/src/reqe.ts shouldEmitReqeDebt. TASK-3 executes both
+// predicates against the shared cause table; keep branch order and decision text identical.
+function reqeEmitDecision(input) {
+  const familyOf = function (spec) { return /codex|gpt|openai/i.test(String(spec ?? '')) ? 'openai' : 'claude' }
+  const coderFam = familyOf(input.coderUsed)
+  const qeFam = familyOf(input.qeReviewerUsed)
+  if (coderFam !== qeFam) {
+    return { emit: false, cause: null, degraded: false, reason: 'cross-family QE ran' }
+  }
+  if (input.routingRequested === false) {
+    return { emit: false, cause: null, degraded: false,
+      reason: 'same-family by configuration (cross-family never requested)' }
+  }
+  if (/\(usage-switched\)/.test(String(input.qeModelLabel ?? ''))) {
+    return {
+      emit: true, cause: 'usage-switched', degraded: false,
+      reason:
+        'usage-switched self-review: Step-8 QE ran on the coder’s own family (' + coderFam +
+        ') under the limit override — the cross-model guard was suspended (FR-2.9)',
+    }
+  }
+  if (input.bridge?.rungState === 'probe-failed') {
+    return { emit: true, cause: 'probe-failed', degraded: false,
+      reason: 'codex probe found no usable id; review ran on the coder’s own family (' + coderFam + ')' }
+  }
+  if (input.bridge?.rungState === 'dispatched' || input.bridge?.rungState === 'refused-before-dispatch' ||
+      input.qeReviewerUsed === 'codex-fallback') {
+    return { emit: true, cause: 'same-family-fallback', degraded: false,
+      reason: 'same-family fallback: ' + (input.bridge?.decline ?? input.bridge?.rungReason ?? 'cross-family reviewer unavailable') +
+        '; review ran on the coder’s own family (' + coderFam + ')' }
+  }
+  if (input.bridge == null) {
+    return { emit: false, cause: null, degraded: true,
+      reason: "cause undeterminable (pre-change checkpoint) — re-run with resume:'never' to classify" }
+  }
+  if (input.routingRequested === true && input.bridge.rungState === 'pending') {
+    return { emit: true, cause: 'same-family-pinned', degraded: false,
+      reason: 'same-family by explicit qe pin (args.models.qe) while cross-family routing was requested' }
+  }
+  return { emit: false, cause: null, degraded: true,
+    reason: 'cause undeterminable (unknown rung state or routing request)' }
+}
+
 // Finalize on every normal return and on a caught runtime error; a killed host cannot finalize.
 let finishRunRegistry = null
 let registryOutcome = 'errored'
@@ -26,7 +69,6 @@ const A = typeof args === 'string' ? JSON.parse(args) : (args || {})
 const SLUG = A.slug || 'feature'
 const DESC = A.description || ''
 const CODE_HINT = A.code || '(discover from the description)'
-const MODE = A.mode || 'full-qe-extended'
 const STOP_AFTER = A.stopAfter || null
 // fa-phase-statusline (ADR-001 D2): tier holder for the ckpt-side phase-start fa-records. The real
 // tier variable initializes only AFTER the router stage (TDZ — reading it from the router's own
@@ -207,6 +249,40 @@ function parseRoundCommandJson(raw) {
   return null
 }
 
+// ablation-c-start (ADR-001 D6, fix-round-1 BLOCKER #2): the run's arm is NEVER accepted from a
+// caller-supplied option — that let a run execute reference mode (or claim "direct" while actually
+// running "reference") with zero journal entry, bypassing the lottery entirely. If args.experiment
+// is given, the arm is RESOLVED here from the SAME assignments journal `dz experiment assign`
+// already wrote to BEFORE this run was ever dispatched, via `dz experiment resolve` — never
+// invented, never trusted from an option the caller could set to anything.
+const EXPERIMENT = typeof A.experiment === 'string' ? A.experiment.trim() : ''
+const EXPERIMENT_TASK_ID = typeof A.taskId === 'string' ? A.taskId.trim() : ''
+// direct -> the pipeline's own default full pipeline; reference -> the reduced-QE arm. A caller
+// that also passes args.mode must AGREE with what the resolved arm implies, or the run refuses
+// (assignment-conflict) rather than silently letting the mode win over the arm.
+const ABLATION_ARM_EXPECTED_MODE = { direct: 'full-qe-extended', reference: 'reference' }
+let ABLATION_ARM = null
+let ABLATION_PROPENSITY = null
+if (EXPERIMENT !== '') {
+  if (EXPERIMENT_TASK_ID === '') {
+    throw new Error('feature-adr: args.experiment=' + JSON.stringify(EXPERIMENT) + ' but args.taskId is missing — the arm can only be RESOLVED from an existing assignment, never invented (ADR-001 D6, assignment-missing).')
+  }
+  const resolveCmd = 'cd ' + shq(REPO) + ' && ' + DZ + ' experiment resolve --experiment ' + shq(EXPERIMENT) + ' --task ' + shq(EXPERIMENT_TASK_ID) + ' --project ' + shq(REPO) + ' --json'
+  const resolveOut = await dispatchAgent(newRung(), 'Run EXACTLY this one shell command via your Bash tool and return its stdout VERBATIM, no commentary: ' + resolveCmd, { label: 'resolve-experiment-arm', phase: 'Route', model: 'haiku', effort: 'low' })
+  const resolved = parseRoundCommandJson(resolveOut)
+  if (!resolved || resolved.status !== 'resolved' || (resolved.arm !== 'direct' && resolved.arm !== 'reference')) {
+    const reason = (resolved && typeof resolved.status === 'string') ? resolved.status : 'assignment-missing'
+    throw new Error('feature-adr: could not resolve an assignment for task ' + JSON.stringify(EXPERIMENT_TASK_ID) + ' in experiment ' + JSON.stringify(EXPERIMENT) + ' (' + reason + ') — run `dz experiment assign` for this task BEFORE dispatching it (ADR-001 D6, assignment-missing).')
+  }
+  ABLATION_ARM = resolved.arm
+  ABLATION_PROPENSITY = (typeof resolved.propensity === 'number') ? resolved.propensity : null
+  const expectedMode = ABLATION_ARM_EXPECTED_MODE[ABLATION_ARM]
+  if (typeof A.mode === 'string' && A.mode !== '' && A.mode !== expectedMode) {
+    throw new Error('feature-adr: the resolved arm ' + JSON.stringify(ABLATION_ARM) + ' for task ' + JSON.stringify(EXPERIMENT_TASK_ID) + ' implies mode ' + JSON.stringify(expectedMode) + ', but args.mode=' + JSON.stringify(A.mode) + ' disagrees — refusing rather than letting one silently override the other (ADR-001 D6, assignment-conflict).')
+  }
+}
+const MODE = ABLATION_ARM !== null ? ABLATION_ARM_EXPECTED_MODE[ABLATION_ARM] : (A.mode || 'full-qe-extended')
+
 // ── Durable checkpoints + resume (backlog 49e4a95b) — inline mirror of ──
 // ── harness-core/src/feature-adr-checkpoints.ts (the workflow is self-contained, no imports) ──
 // After each expensive stage a cheap effort-low agent appends {stage, inputHash, result} to
@@ -226,7 +302,7 @@ const CKPT_FILE = FDIR + '/.fa-state/checkpoints.jsonl'
 // M10 Stage-A, feature loop-designer). This region is now a GENERATED BLOB (regen-diff-gated by
 // loop-blobs-regen.test.ts): edit the canonical TS FIRST, run node scripts/gen-loop-blobs.mjs,
 // then re-splice. The value-pinned wiring tests in feature-adr-checkpoints.test.ts stay the net.
-// ── BEGIN BLOB checkpoints@1.2.0 sha256:a44560c6036fd143b7a3f125fec00fa8b91c3c06ac5b9e1ecfb83d27a5211e9b src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
+// ── BEGIN BLOB checkpoints@1.2.0 sha256:b602357649042d6b8aa68b5ca5593f7f5c483fdb36a287742e7b27bda8a2a6c7 src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
 const CHECKPOINT_STAGES = ['router', 'design', 'plan', 'code', 'qe', 'fleet'];
 const STAGE_ARTIFACTS = {
     router: '00_complexity_assessment.md',
@@ -300,12 +376,12 @@ function decideCheckpointResume(opts) {
     }
     return { resume: true, reason: 'resumed' };
 }
-function serializeCheckpoint(stage, inputHash, result) {
+function serializeCheckpoint(stage, inputHash, result, ts) {
     if (result === null || result === undefined)
         return null;
     let line;
     try {
-        line = JSON.stringify({ stage, inputHash, result });
+        line = JSON.stringify({ stage, inputHash, result, ...(ts === undefined ? {} : { ts }) });
     }
     catch {
         return null;
@@ -315,6 +391,7 @@ function serializeCheckpoint(stage, inputHash, result) {
     return line;
 }
 const CHECKPOINT_LS_SENTINEL = '---FA-CKPT-LS---';
+const CHECKPOINT_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
 function parseCheckpointRead(text) {
     const out = { entries: {}, listing: new Set(), malformedLines: 0 };
     const raw = String(text ?? '');
@@ -329,7 +406,8 @@ function parseCheckpointRead(text) {
         try {
             const e = JSON.parse(t);
             if (e && typeof e === 'object' && typeof e.stage === 'string' && typeof e.inputHash === 'string' && 'result' in e && e.result !== null && e.result !== undefined) {
-                out.entries[e.stage] = e;
+                const { ts, ...entry } = e;
+                out.entries[e.stage] = typeof ts === 'string' && CHECKPOINT_TIMESTAMP.test(ts) ? { ...entry, ts } : entry;
             }
             else {
                 if (e && typeof e === 'object' && typeof e.stage === 'string')
@@ -360,7 +438,11 @@ function checkpointReadCmd(fdirAbs) {
 function checkpointAppendCmd(fdirAbs, line) {
     const dir = shellQuote(fdirAbs + '/.fa-state');
     const file = shellQuote(fdirAbs + '/.fa-state/checkpoints.jsonl');
-    return 'mkdir -p ' + dir + " && printf '%s\\n' " + shellQuote(line) + ' >> ' + file;
+    const plain = 'mkdir -p ' + dir + " && printf '%s\\n' " + shellQuote(line) + ' >> ' + file;
+    if (typeof line !== 'string' || !line.startsWith('{'))
+        return plain;
+    return 'ts=$(date -u +%Y-%m-%dT%H:%M:%SZ); mkdir -p ' + dir
+        + ' && { printf \'{"ts":"%s",\' "$ts"; printf \'%s\\n\' ' + shellQuote(line.slice(1)) + '; } >> ' + file;
 }
 function parseArtifactProbe(opts) {
     if (opts.stdout === null || opts.stdout === undefined)
@@ -406,7 +488,7 @@ let CKPT_LISTING = new Set()
 const resumedStages = []
 async function loadCheckpoints(phaseName) {
   if (!CHECKPOINTS_ON) return
-  const readCmd = 'cat ' + shq(CKPT_FILE) + ' 2>/dev/null || true; echo ' + shq(CKPT_LS_SENTINEL) + '; cd ' + shq(FDIR) + ' 2>/dev/null && find . -maxdepth 2 -type f 2>/dev/null | sed "s|^\\./||" || true'
+  const readCmd = checkpointReadCmd(FDIR)
   const readOut = await dispatchAgent(newRung(), 'Run EXACTLY this via Bash and return its stdout VERBATIM (it may be empty) with NO code fences and NO commentary: ' + readCmd, { label: 'ckpt:read', phase: phaseName, effort: 'low' })
   const raw = String(readOut == null ? '' : readOut)
   // LINE-ANCHORED sentinel: a sentinel string INSIDE a recorded result shares its line with JSON
@@ -893,6 +975,70 @@ function qeFindingsSummary(gaps) {
   }
   return { findings: gaps.length, findingsBySeverity: bySeverity, findingsSource: 'gaps' }
 }
+// instrument-round-b T1/A1 (ADR-001 D1): a self-report can ONLY come from the QE agent's OWN return
+// object, keyed to a NAMED source — never derived from MODE (mode is an intent the run was
+// configured with, not an event that happened). A missing or non-boolean aqeInvoked is honestly
+// 'not-reported', never guessed true/false from context. Pure, never throws.
+// fix-round-1 (Codex r1 MEDIUM finding 6): `aqeEvidence` used to accept ANY nonempty string,
+// including pure whitespace. Now TRIMMED; blank-after-trim keeps `aqeInvoked` (the agent DID answer
+// the invoked/not-invoked question) but the evidence itself is honestly `null` with
+// `aqeEvidenceStatus:'blank'`. A non-blank string is checked against a SOFT form (does it look like
+// an MCP tool name or an `aqe ` command?) — a fabricated tool name is still indistinguishable from a
+// truthful one (a named, honest limit, not a fixable gap: see the module README), so this can only
+// catch the OBVIOUSLY wrong shape, never a convincing lie. The value is kept either way; only the
+// status is marked 'unrecognized', never discarded.
+function aqeSelfReport(qe) {
+  if (!qe || typeof qe !== 'object' || typeof qe.aqeInvoked !== 'boolean') {
+    return { aqeInvoked: null, aqeInvokedSource: 'not-reported', aqeEvidence: null }
+  }
+  const trimmed = typeof qe.aqeEvidence === 'string' ? qe.aqeEvidence.trim() : ''
+  if (trimmed === '') {
+    return { aqeInvoked: qe.aqeInvoked, aqeInvokedSource: 'qe-self-report', aqeEvidence: null, aqeEvidenceStatus: 'blank' }
+  }
+  // Lead delta after Codex r2 (#6 partial): a substring test called 'garbagemcp__agentic-qe__garbage'
+  // recognized evidence. The shape is now ANCHORED: the whole trimmed string is either an MCP tool
+  // name (mcp__agentic-qe__<tool>) or an aqe command line starting with 'aqe '.
+  const looksReal = /^mcp__agentic-qe__[a-z][a-z0-9_]*$/.test(trimmed) || /^aqe [\w-]/.test(trimmed)
+  return {
+    aqeInvoked: qe.aqeInvoked,
+    aqeInvokedSource: 'qe-self-report',
+    aqeEvidence: trimmed,
+    aqeEvidenceStatus: looksReal ? 'recognized' : 'unrecognized',
+  }
+}
+// instrument-round-b T2/A2/A7 (ADR-001 D2): `arm`/`propensity` are COPIES of
+// envelope.chosen.mode/envelope.policy.propensity, promoted to top-level ledger-row fields so a
+// consumer never has to parse the nested envelope object — copied at write time so the two can never
+// disagree by construction. No envelope (the router never completed) -> both null, armSource names
+// why. Pure, never throws.
+// fix-round-1 (Codex r1 HIGH finding 5): an envelope object present but carrying neither a valid
+// `chosen.mode` NOR a valid `policy.propensity` (e.g. `{}`) used to be labeled `armSource:'envelope'`
+// despite yielding two nulls — a validated-looking label on an unvalidated object. Now honestly
+// `'invalid-envelope'` unless AT LEAST one of the two fields actually resolved to a real value.
+function envelopeArmFields(envelope) {
+  if (!envelope || typeof envelope !== 'object') return { arm: null, propensity: null, armSource: 'no-envelope' }
+  const chosen = envelope.chosen
+  const policy = envelope.policy
+  const arm = (chosen && typeof chosen.mode === 'string' && chosen.mode !== '') ? chosen.mode : null
+  const propensity = (policy && typeof policy.propensity === 'number') ? policy.propensity : null
+  const armSource = (arm !== null || propensity !== null) ? 'envelope' : 'invalid-envelope'
+  return { arm: arm, propensity: propensity, armSource: armSource }
+}
+// fix-round-1 (Codex r1 HIGH finding 5): keys a per-stage `extra` is FORBIDDEN from carrying —
+// each one is either derived from the SAME canonical ENVELOPE the row already stamps (arm,
+// propensity, armSource) or IS that canonical value (envelope) — stripped before the spread so an
+// `extra` that named one of these could never make the row's TOP-LEVEL fields disagree with its
+// NESTED envelope. Defense in depth: appendRunCostRow also restates `envelope: ENVELOPE` and
+// re-derives arm/propensity/armSource AFTER the (now-sanitized) spread.
+function sanitizeLedgerExtra(extra) {
+  const RESERVED_LEDGER_EXTRA_KEYS = ['arm', 'propensity', 'armSource', 'envelope']
+  if (!extra || typeof extra !== 'object') return {}
+  const out = {}
+  for (const k in extra) {
+    if (Object.prototype.hasOwnProperty.call(extra, k) && RESERVED_LEDGER_EXTRA_KEYS.indexOf(k) === -1) out[k] = extra[k]
+  }
+  return out
+}
 function tpText(v) { if (typeof v === 'string') return v; if (v === null || v === undefined) return ''; try { const s = JSON.stringify(v); return typeof s === 'string' ? s : String(v) } catch (e) { return String(v) } }
 function tpBudget(raw) {
   try {
@@ -1139,7 +1285,18 @@ async function appendRunCostRow(stage, phaseName, outcome, extra) {
       // the payload carries no runId), so passing it here is a strict reliability improvement.
       runId: (typeof RUN_ID === 'string' && RUN_ID !== '') ? RUN_ID : null,
       // aqe-ledger-row T1/NFR-1: additive-only — spreads nothing when `extra` is absent.
-      ...(extra && typeof extra === 'object' ? extra : {}),
+      // fix-round-1 (Codex r1 HIGH finding 5): reserved keys are STRIPPED from `extra` first
+      // (sanitizeLedgerExtra), which is what makes the single `envelope: ENVELOPE` above canonical —
+      // nothing the spread carries can shadow it. Lead delta after Codex r2: the belt-and-braces
+      // RESTATEMENT that used to sit here was removed — a second `envelope` key in the same literal
+      // is invisible at runtime but visible to the key-order guard (feature-adr-training-pairs),
+      // which reads the literal's keys, so the defense in depth read as a contract break.
+      ...sanitizeLedgerExtra(extra),
+      // instrument-round-b T2/FR-2/A2/A7 (ADR-001 D2): arm/propensity/armSource land AFTER the
+      // per-stage `extra` spread — the last fields on every row, exactly like NFR-1 requires. Derived
+      // from the SAME `ENVELOPE` just restated above, so the row's nested envelope and its top-level
+      // arm/propensity/armSource can never disagree (Codex r1 finding 5).
+      ...envelopeArmFields(ENVELOPE),
     })
     // WITNESSED WRITE (ADR-001): the subagent RUNS a command with data arguments; it is no longer
     // handed a shell pipeline with the row baked in. The command refuses a malformed row, stamps the
@@ -1147,8 +1304,18 @@ async function appendRunCostRow(stage, phaseName, outcome, extra) {
     // re-reading the tail. A courier could do none of those three.
     // fix-round-1/F2: --auto is the TRUSTED CLI-level marker (harness-core run-records.ts) — the
     // written row's auto:true no longer depends solely on the JSON payload remembering the field.
+    // instrument-round-b FR-4/A5 (ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3): a NAMED,
+    // SCOPED allowance — `--allow-incomplete tokens,minutes --incomplete-reason
+    // sandbox-metrics-unavailable` — replaces the removed blanket `--no-strict`. This row's `tokens`/
+    // `minutes` are LEGITIMATELY incomplete by construction, every single call: the sandbox has no
+    // clock and budget.spent() exposes only a partial OUTPUT-token delta (tokensOut, a DIFFERENT
+    // field than the `tokens`/`minutes` completeness checks), never the real total — that total is
+    // visible only in the Workflow COMPLETION NOTIFICATION, which the running script cannot see (see
+    // the HONESTY comment above the row literal). Naming exactly these two fields means if a THIRD
+    // one (e.g. `envelope`) ever went missing too, the write would refuse rather than silently
+    // widen what "legitimately incomplete" covers.
     const cmd = DZ + ' feature-adr-record --kind ledger --stage ' + shq(stage) + ' --project ' + shq(REPO)
-      + ' --row ' + shq(line) + ' --auto --json'
+      + ' --row ' + shq(line) + ' --auto --allow-incomplete tokens,minutes --incomplete-reason sandbox-metrics-unavailable --json'
     const out = await dispatchAgent(newRung(), 'Run this command via your Bash tool and reply with only its stdout: ' + cmd, { label: 'ledger:append', phase: phaseName, effort: 'low' })
     const readback = String(out == null ? '' : out)
     if (!/"verdict"\s*:\s*"written"/.test(readback)) {
@@ -1638,7 +1805,14 @@ function buildExperimentEnvelopeInline(input) {
     // this mirror used to alias them directly, so a caller mutating its own arms.stages object
     // after calling this function would silently mutate the built envelope too.
     arms: { mode: input.arms.mode.slice(), stages: mergeOpts({}, input.arms.stages) },
-    chosen: { mode: input.chosen.mode, stages: mergeOpts({}, input.chosen.stages), overrides: mergeOpts({}, input.chosen.overrides === undefined ? {} : input.chosen.overrides) },
+    chosen: {
+      mode: input.chosen.mode,
+      stages: mergeOpts({}, input.chosen.stages),
+      overrides: mergeOpts({}, input.chosen.overrides === undefined ? {} : input.chosen.overrides),
+      // ablation-c-start (ADR-001, T3): mirror of the core builder — carried through only
+      // when the caller actually set it, so an unset qeMode never appears in the JSON.
+      ...(input.chosen.qeMode !== undefined ? { qeMode: input.chosen.qeMode } : {}),
+    },
     policy: { name: input.policy.name, version: input.policy.version, propensity: input.policy.propensity },
     evaluator: { family: input.evaluator.family, model: input.evaluator.model, source: input.evaluator.source },
   }
@@ -1748,6 +1922,12 @@ function validateExperimentEnvelopeInline(value) {
       return { ok: false, reason: 'chosen.stages.' + stage + ': "' + spec + '" is not a member of arms.stages.' + stage + ' (' + offered.join('|') + ') and not declared in chosen.overrides' }
     }
   }
+  // ablation-c-start (ADR-001, T3): qeMode is OPTIONAL — absent on every run this feature
+  // does not touch — but when present must be a non-empty string, same shape rule every
+  // other envelope field gets (mirror of the core validator).
+  if (chosen.qeMode !== undefined && !isNonEmptyStringEnv(chosen.qeMode)) {
+    return { ok: false, reason: 'chosen.qeMode: expected a non-empty string when present' }
+  }
   if (!isPlainObjectEnv(v.policy)) return { ok: false, reason: 'policy: expected an object' }
   const policy = v.policy
   if (!isNonEmptyStringEnv(policy.name)) return { ok: false, reason: 'policy.name: expected a non-empty string' }
@@ -3735,7 +3915,7 @@ const ARTIFACT = { type: 'object', additionalProperties: false, required: ['wrot
 // (hasManifest + the who-injected report). The BIG per-stage guidance content is fetched by each stage
 // agent directly from `dz project-skills` (never threaded through a model → fidelity preserved).
 const PROJECT_SKILLS = { type: 'object', additionalProperties: false, required: ['hasManifest', 'report'], properties: { hasManifest: { type: 'boolean' }, report: { type: 'string' } } }
-const QE = { type: 'object', additionalProperties: false, required: ['grade', 'gaps', 'codeTestsAdequate', 'docTestsPresent'], properties: { grade: { type: 'string' }, codeTestsAdequate: { type: 'boolean' }, docTestsPresent: { type: 'boolean' }, gaps: { type: 'array', items: { type: 'object', additionalProperties: false, required: ['sev', 'what'], properties: { sev: { type: 'string' }, what: { type: 'string' } } } }, claimCheck: { type: 'object', additionalProperties: false, properties: { findings: { type: 'number' }, high: { type: 'number' }, medium: { type: 'number' } } }, roundLessons: { type: 'array', items: { type: 'string' } }, roundNoNewKnowledge: { type: 'string' } } }
+const QE = { type: 'object', additionalProperties: false, required: ['grade', 'gaps', 'codeTestsAdequate', 'docTestsPresent'], properties: { grade: { type: 'string' }, codeTestsAdequate: { type: 'boolean' }, docTestsPresent: { type: 'boolean' }, gaps: { type: 'array', items: { type: 'object', additionalProperties: false, required: ['sev', 'what'], properties: { sev: { type: 'string' }, what: { type: 'string' } } } }, claimCheck: { type: 'object', additionalProperties: false, properties: { findings: { type: 'number' }, high: { type: 'number' }, medium: { type: 'number' } } }, roundLessons: { type: 'array', items: { type: 'string' } }, roundNoNewKnowledge: { type: 'string' }, aqeInvoked: { type: 'boolean' }, aqeEvidence: { type: 'string' } } }
 const CONFIRMATION_FILE_GATE = { type: 'object', additionalProperties: false, required: ['verdict', 'missing', 'checked', 'reason'], properties: { verdict: { type: 'string', enum: ['pass', 'fail', 'skipped', 'refused'] }, missing: { type: 'array', items: { type: 'string' } }, checked: { type: 'array', items: { type: 'string' } }, reason: { type: 'string' } } }
 
 function normalizeConfirmationFileGate(raw) {
@@ -3783,7 +3963,7 @@ const MUTATION_GATE = 'MUTATION GATE (feature ha-mutation-gate — run alongside
 // same scan runs mechanically at publish time as the SOFT `no-stubs` guard rule.
 const STUB_RX = '(^|[^A-Za-z0-9_])(' + ['TO' + 'DO', 'FIX' + 'ME', 'HA' + 'CK', 'XX' + 'X', 'PLACE' + 'HOLDER'].join('|') + ')([^A-Za-z0-9_]|$)'
 const STUB_PHRASE = 'imple' + 'ment later'
-const NO_STUBS_GATE = 'NO-STUBS GATE (backlog 0b403a0106103901 — layer 1 of the cost-of-detection ladder): over the files THIS RUN touched (the Step-7 change list; for a Codex coder, the landed-barrier file list), via Bash run EXACTLY `grep -nE \'' + STUB_RX + '\' <touched files>` (case-SENSITIVE — never add -i) plus `grep -niE \'' + STUB_PHRASE.replace(' ', '[[:space:]]+') + '\' <touched files>`. ANY match = the task shipped incomplete → HIGH gap naming file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or `.dz/guard.json` stubWaivers lists the path WITH a reason — a REASONLESS waiver is itself a HIGH gap, never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan as the SOFT `no-stubs` rule over the working-tree diff. When you QUOTE a marker in 08_qe_report.md, backtick it so the report itself scans clean (the same convention as the claim-check forbidden-phrase escape). Record the verdict in the 08_qe_report.md ADR Fitness section.'
+const NO_STUBS_GATE = 'NO-STUBS GATE (backlog 0b403a0106103901 — layer 1 of the cost-of-detection ladder): over the files THIS RUN touched (the Step-7 change list; for a Codex coder, the landed-barrier file list), via Bash run EXACTLY `grep -nE \'' + STUB_RX + '\' <touched files>` (case-SENSITIVE — never add -i) plus `grep -niE \'' + STUB_PHRASE.replace(' ', '[[:space:]]+') + '\' <touched files>`. ANY match = the task shipped incomplete → HIGH gap naming file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or `.dz/guard.json` stubWaivers lists the path WITH a reason — a REASONLESS waiver is itself a HIGH gap, never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan as the SOFT `no-stubs` rule over the working-tree diff. After the Step-7 code has landed, run `dz guard check --op code --json` and treat a HARD `block` verdict as a HIGH finding naming the drifted file. When you QUOTE a marker in 08_qe_report.md, backtick it so the report itself scans clean (the same convention as the claim-check forbidden-phrase escape). Record the verdict in the 08_qe_report.md ADR Fitness section.'
 const DISCRIMINATION_GATE = '\u00a742 TEST-DISCRIMINATION GATE (run right after asserting the property has a test): the ADR Confirmation names `Required automated check: <test file>` for the load-bearing property. Prove that test DISCRIMINATES \u2014 via Bash run EXACTLY `' + DZ + ' discrimination-check --test <that test file> --base HEAD --json` (the PINNED workspace bin, never bare `dz` — the global install measurably lags the workspace) (the Step-7 feature diff is UNCOMMITTED, so HEAD is the pre-feature base). Parse the JSON: read `perTest[]` (each row carries verdict + reason), `findings[]` (ALL entries, not only the first), `measurementValid`, and `primaryAction` \u2014 the singular `finding` is a DEPRECATED alias; do not consume it. The SEVEN verdicts and the required QE action for each: `DISCRIMINATES` (assertion-red at base, execution-evidenced) = PASS. `DISCRIMINATES_VIA_ERROR` (evidenced load-error at base + evidenced pass at tip) = PASS \u2014 note the inference. `NON_DISCRIMINATING` (evidenced pass at base \u2014 a proven false green) \u2192 HIGH gap "property test does not discriminate: <file>"; advisory, not an automatic blocker. `TEST_FILE_ABSENT` (the named test is not a regular file) \u2192 HIGH gap; action create-missing-test; NEVER a pass. `LOAD_ERROR_AT_BOTH_REVS` (the instrument could not execute the test at either rev \u2014 zero signal) \u2192 HIGH gap; action fix-runner-invocation. `FAILS_AT_TIP` (the feature\'s own test is red WITH the feature present) \u2192 HIGH gap; action fix-red-feature-test \u2014 grade the feature code accordingly. `CANNOT_ISOLATE` (no established observation; the row\'s `reason` is one of no-execution-evidence | unrecognised-runner-output | no-tests-executed | inconsistent-evidence | tip-control-missing | tip-evidence-missing | timeout) \u2192 HIGH gap NAMING the reason; action per `primaryAction` (map-a-test or fix-runner-invocation). `measurementValid` false or \'partial\' means the instrument did not (fully) measure \u2014 report it verbatim; never convert a degraded reading into a pass. Record every verdict + reason in the 08_qe_report.md ADR Fitness section. If `discrimination-check` is unavailable at the pinned path, errors, or overruns its window \u2192 record a HIGH gap `discrimination gate INCONCLUSIVE: <unavailable|error|timeout>` (backlog 52d0ed08: an instrument that could not run is never a pass and never applicable-by-silence). Still never abort the run.'
 // P2 (amendment-confirmation-discipline, fa-improvements 2026-07-18): amendments are where the SHARPEST design
 // corrections land (challenge-panel/QCSD) and were the least-tested — prose deltas with no proving test. Every
@@ -4078,8 +4258,17 @@ ENVELOPE = buildExperimentEnvelopeInline({
   treeSha: ENVELOPE_TREE_SHA,
   treeShaReason: ENVELOPE_TREE_SHA_REASON,
   arms: { mode: ['same-family', 'cross-family'], stages: envelopeArmsStages },
-  chosen: { mode: ENVELOPE_CHOSEN_MODE, stages: envelopeChosenStages, overrides: envelopeChosenOverrides },
-  policy: { name: 'routing-tables', version: POLICY_VERSION, propensity: null },
+  // ablation-c-start (ADR-001, T3; fix-round-1 BLOCKER #2): a non-null ABLATION_ARM puts the arm
+  // in chosen.qeMode (a field SEPARATE from chosen.mode's same-family/cross-family axis — mode
+  // keeps its old meaning untouched) and renames the policy so a reader of the ledger's embedded
+  // envelope can tell an ablation-c run from a routing-tables run at a glance. ABLATION_ARM and
+  // ABLATION_PROPENSITY are RESOLVED above from the assignments journal via `dz experiment
+  // resolve` — never taken from a caller-supplied option — so this line cannot be used to bypass
+  // the lottery. ?? 0.5 covers only a missing/invalid propensity on the resolved record alongside
+  // a present arm, never a missing arm. Without an arm, both lines stay byte-identical to before
+  // this feature (NFR-2).
+  chosen: { mode: ENVELOPE_CHOSEN_MODE, stages: envelopeChosenStages, overrides: envelopeChosenOverrides, ...(ABLATION_ARM ? { qeMode: ABLATION_ARM } : {}) },
+  policy: ABLATION_ARM ? { name: 'ablation-c', version: POLICY_VERSION, propensity: (typeof ABLATION_PROPENSITY === 'number') ? ABLATION_PROPENSITY : 0.5 } : { name: 'routing-tables', version: POLICY_VERSION, propensity: null },
   evaluator: { family: ENVELOPE_QE_FAMILY, model: ENVELOPE_QE_SPEC, source: 'planned' },
 })
 // fix-round-1/F1: the router's training pair, captured here — AFTER ENVELOPE is real — so it gets
@@ -4766,7 +4955,17 @@ if (stopHere) {
       const rows = cpFindings.map((f, i) => '- AM-CP-' + (i + 1) + ' [' + f.severity + '] ' + String(f.title || '').replace(/[\r\n`]/g, ' ').slice(0, 160) + ' \u2192 test `названный кодером при реализации — заменить на имя реального теста` (panel ' + String(f.c || '') + ')').join('\n')
       const marker = '<!-- challenge-panel amendments appended ' + fnv1a64(rows) + ' -->'
       const planPath = FDIR + '/06_implementation_plan.md'
-      const appendCmd = 'cd ' + shq(REPO) + ' && grep -qF ' + shq(marker) + ' ' + shq(planPath) + ' && echo CP-DUP || { grep -q "^## Amendments" ' + shq(planPath) + ' || printf "\n## Amendments\n" >> ' + shq(planPath) + '; printf "%s\n%s\n" ' + shq(marker) + ' ' + shq(rows) + ' >> ' + shq(planPath) + '; echo CP-APPENDED; }'
+      // The rows must land INSIDE `## Amendments`, not at EOF. MEASURED 2026-09-20 (backlog d48505cc,
+      // which stood as an unverified inference until then): with `## Amendments` at line 13 and a later
+      // `## Risks` at 17, the old `>> plan` put AM-CP-1 at line 21 and K2 C6 answered "AM-CP-1 is
+      // DEFINED outside the `## Amendments` section". A plan whose Amendments section happens to be
+      // last worked by luck, not by construction. The awk pass inserts before the NEXT `## ` heading
+      // after the section, and falls back to EOF when the section IS last; the `a` flag is set AFTER
+      // the heading test so the `## Amendments` line itself never triggers the insert. Idempotence is
+      // unchanged: the marker grep still short-circuits to CP-DUP.
+      const insertAwk = 'awk -v m=' + shq(marker) + ' -v r=' + shq(rows)
+        + ' \'BEGIN{a=0;d=0} { if(a&&!d&&/^## /){print m; print r; d=1; a=0} if($0 ~ /^## Amendments/)a=1; print } END{if(a&&!d){print m; print r}}\' '
+      const appendCmd = 'cd ' + shq(REPO) + ' && grep -qF ' + shq(marker) + ' ' + shq(planPath) + ' && echo CP-DUP || { grep -q "^## Amendments" ' + shq(planPath) + ' || printf "\n## Amendments\n" >> ' + shq(planPath) + '; ' + insertAwk + shq(planPath) + ' > ' + shq(planPath) + '.cp-tmp && mv ' + shq(planPath) + '.cp-tmp ' + shq(planPath) + '; echo CP-APPENDED; }'
       const cpOut = await dispatchAgent(newRung(), 'Run EXACTLY this via Bash and reply with ONLY its stdout: ' + appendCmd, { label: 'challenge:append-amendments', phase: 'Plan', effort: 'low' })
       log('challenge panel \u2192 plan amendments: ' + (/CP-APPENDED/.test(String(cpOut || '')) ? cpFindings.length + ' AM-CP row(s) appended' : /CP-DUP/.test(String(cpOut || '')) ? 'already appended (idempotent)' : 'NOT appended (probe answered: ' + String(cpOut || '').slice(0, 80) + ')'))
     }
@@ -5115,7 +5314,7 @@ const confirmationGateLine = confirmationFileGate.verdict === 'skipped'
 log(confirmationGateLine)
 const confirmationGateNote = ' MANDATORY CONFIRMATION FILE GATE RESULT: `' + confirmationGateLine + '`. Write that as a separate line in 08_qe_report.md. The independent QE review MUST still run. If the gate verdict is fail or refused, the final Step-8 grade cannot be A or B; the workflow also enforces that after the reviewer returns. This gate proves only existence/readability; all other ADR checklist items remain advisory.'
 await usageProbe('QE')
-const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test that DISCRIMINATES - the recurring lesson: a test that would still pass with the protection deleted is documentation, not a gate). Run this ADR gate before final grading: ' + ADR_FITNESS_CHECKLIST + ' ' + DISCRIMINATION_GATE + ' ' + MUTATION_GATE + ' ' + NO_STUBS_GATE + ' ' + AMENDMENT_GATE + ' Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md with the primary findings under the exact heading `## Primary QE pass` and an ADR Fitness Checklist section showing PASS/FAIL per ADR and evidence for the Confirmation-linked test. MANDATORY SELF-LEARNING STORE (close the loop, never skip): compare every candidate lesson against the Step-0 recalled LEARNED patterns above. Teach ONLY lessons NOT covered by Step-0 recall. On overlap, run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate; if --reinforce is unavailable, skip the duplicate teach and report `reinforced existing pattern <id>` in the QE report. Store every genuinely new lesson in the CANONICAL BRAIN store at `' + BRAIN + '` so it is NOT lost to a target repo you may have cd`d into. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal) — the `cd ' + BRAIN + ' &&` prefix + `--project ' + BRAIN + '` pin guarantee the lesson lands in the brain regardless of your CWD. Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. In the return object set roundLessons to the teach:<id> receipts successfully written in this Step 8; when there were none, return roundLessons:[] and a non-empty roundNoNewKnowledge reason derived from this review/reinforcement decision. AUTHORING-TIME CLAIM-CHECK (Deliverable of claim-check-authoring-time): after writing ' + FDIR + '/08_qe_report.md, run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash, parse the {ok, findings, scanned} JSON, and report claimCheck: {findings: N, high: N, medium: N} (counts by severity) in your return object. TAG EVERY QUANTITATIVE CLAIM you write in the report using the convention the checker recognizes as honest — write "1131 tests pass (MEASURED — `npx vitest run`)", never a bare "1131 tests pass" — and where you QUOTE a forbidden phrase as an example (e.g. the retracted "100% passing" framing), backtick the literal so it reads as code, not an assertion, so your own compliant report scans clean. Return {grade, gaps, codeTestsAdequate, docTestsPresent, claimCheck, roundLessons, roundNoNewKnowledge}.' + ABSOLUTE_PATH_NOTE + FINDINGS_LEDGER_NOTE + landedNote + wqNote + confirmationGateNote + PS_GUIDANCE('qe')
+const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test that DISCRIMINATES - the recurring lesson: a test that would still pass with the protection deleted is documentation, not a gate). Run this ADR gate before final grading: ' + ADR_FITNESS_CHECKLIST + ' ' + DISCRIMINATION_GATE + ' ' + MUTATION_GATE + ' ' + NO_STUBS_GATE + ' ' + AMENDMENT_GATE + ' Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md with the primary findings under the exact heading `## Primary QE pass` and an ADR Fitness Checklist section showing PASS/FAIL per ADR and evidence for the Confirmation-linked test. MANDATORY SELF-LEARNING STORE (close the loop, never skip): compare every candidate lesson against the Step-0 recalled LEARNED patterns above. Teach ONLY lessons NOT covered by Step-0 recall. On overlap, run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate; if --reinforce is unavailable, skip the duplicate teach and report `reinforced existing pattern <id>` in the QE report. Store every genuinely new lesson in the CANONICAL BRAIN store at `' + BRAIN + '` so it is NOT lost to a target repo you may have cd`d into. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal) — the `cd ' + BRAIN + ' &&` prefix + `--project ' + BRAIN + '` pin guarantee the lesson lands in the brain regardless of your CWD. Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. In the return object set roundLessons to the teach:<id> receipts successfully written in this Step 8; when there were none, return roundLessons:[] and a non-empty roundNoNewKnowledge reason derived from this review/reinforcement decision. AUTHORING-TIME CLAIM-CHECK (Deliverable of claim-check-authoring-time): after writing ' + FDIR + '/08_qe_report.md, run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash, parse the {ok, findings, scanned} JSON, and report claimCheck: {findings: N, high: N, medium: N} (counts by severity) in your return object. TAG EVERY QUANTITATIVE CLAIM you write in the report using the convention the checker recognizes as honest — write "1131 tests pass (MEASURED — `npx vitest run`)", never a bare "1131 tests pass" — and where you QUOTE a forbidden phrase as an example (e.g. the retracted "100% passing" framing), backtick the literal so it reads as code, not an assertion, so your own compliant report scans clean. AQE SELF-REPORT (instrument-round-b T1/A1, ADR-001 D1): state honestly in your return object whether you actually invoked LIVE agentic-qe in THIS QE pass — aqeInvoked: true or false — and name aqeEvidence: the exact MCP tool you called (e.g. mcp__agentic-qe__quality_assess) or the exact command you ran (e.g. aqe quality assess). This is a SELF-REPORT of what YOU did, never an inference from the run MODE (' + MODE + ') — the mode names an intent this run was configured with, not proof that live agentic-qe was actually called this pass. If you did not call live agentic-qe this pass, say aqeInvoked:false and name what you used instead in aqeEvidence. Return {grade, gaps, codeTestsAdequate, docTestsPresent, claimCheck, roundLessons, roundNoNewKnowledge, aqeInvoked, aqeEvidence}.' + ABSOLUTE_PATH_NOTE + FINDINGS_LEDGER_NOTE + landedNote + wqNote + confirmationGateNote + PS_GUIDANCE('qe')
 // CROSS-MODEL QE (load-bearing): resolveStageModel('qe') derives the OTHER family than the resolved
 // coder when args.models.qe is unset (coder-codex ⇒ opus; coder-Claude ⇒ codex, or opus if codex absent).
 // An explicit args.models.qe wins. A Claude qe spec is merged onto the qe-code-reviewer base (role
@@ -5499,12 +5698,17 @@ if (qe !== null && qe2Spec !== null) {
   }
 }
 if (qe === null) return null
-return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe, qe2: qe2, qe2ModelUsed: modelsUsed.qe2 || null }
-}, { validate: function (r) { return !!(r && typeof r === 'object' && r.qe && typeof r.qe === 'object' && typeof r.qeReviewerUsed === 'string') } })
+return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe, qe2: qe2, qe2ModelUsed: modelsUsed.qe2 || null,
+  bridge: { happened: crossFamilyQeReport ? crossFamilyQeReport.happened : null, rungState: qeCodexRung ? qeCodexRung.state : null, rungReason: qeCodexRung ? qeCodexRung.reason : null, decline: lastCodexDecline } }
+// Missing bridge is valid for pre-change checkpoints; the debt decision logs the degradation.
+}, { validate: function (r) { return !!(r && typeof r === 'object' && r.qe && typeof r.qe === 'object' && typeof r.qeReviewerUsed === 'string' && (r.bridge == null || (typeof r.bridge === 'object' && !Array.isArray(r.bridge)))) } })
 qe = qeStage ? qeStage.qe : null
 let qeReviewerUsed = qeStage ? qeStage.qeReviewerUsed : 'claude'
 if (qeStage && qeStage.modelUsed) modelsUsed.qe = qeStage.modelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
 if (qeStage && qeStage.qe2ModelUsed) modelsUsed.qe2 = qeStage.qe2ModelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
+if (qeStage && qeStage.bridge == null && resumedStages.indexOf('qe') !== -1) {
+  log('re-QE debt: resumed pre-change checkpoint without bridge — only usage-switched can be classified from the model label')
+}
 
 // aqe-ledger-row T3/FR-1/FR-3/A1/A3/A4: the QE step's OWN autorow — who reviewed, how many
 // findings, cross-family or not — so the instrument's own footprint in the ledger stops being
@@ -5536,6 +5740,10 @@ if (resumedStages.indexOf('qe') === -1) {
     claimCheck: qeClaimCheck,
     crossFamily: qeCrossFamily,
     qeScope: qeScopeRow,
+    // instrument-round-b T1/FR-1/A1 (ADR-001 D1): last fields on the qe row's own extra — the
+    // agent's self-report of whether it actually invoked live agentic-qe this pass, never derived
+    // from MODE.
+    ...aqeSelfReport(qe),
   })
 } else {
   log('run-cost ledger: qe row skipped — stage resumed')
@@ -5576,19 +5784,17 @@ await capturePairs('code', 'QE', [{ input: codePrompt, output: codeStage, evalua
 await capturePairs('qe', 'QE', [{ input: qePrompt, output: qeStage ? qeStage.qe : null, evaluation: { grade: qe ? qe.grade : null, gradedBy: qeReviewerUsed, lessonsInjected: [] }, provenance: { model: String(modelsUsed.qe || ''), family: tpFamily(qeReviewerUsed), role: 'reviewer' } }])
 
 // ── re-QE debt emission (backlog 6b40e667) — mirror of harness-core/src/reqe.ts ──
-// The cross-model guard was consciously SUSPENDED when the usage override made coder and QE the
-// same family (FR-2.9). Record that as a machine DEBT (features/<slug>/.fa-state/reqe-due.json) so
-// `dz reqe` / `dz usage` surface it after limits reset — a doc instruction on the weakest detection
-// layer becomes a fact on disk. Emitted ONLY for the actual same-family-under-override case: a
-// switch that kept cross-family QE, or the codex-unavailable Claude belt (no override), creates no
-// debt. A RESUMED qe never re-emits (the original run emitted; a settlement must not be clobbered).
+// Record same-family reviews after usage switches, failed probes, fallbacks or explicit QE pins
+// as machine debt. Checkpoint-carried bridge facts preserve the cause on resume; routing OFF is
+// excluded explicitly. Missing old checkpoint facts degrade visibly. The guards below preserve
+// existing debt and this run's settlement when a resumed QE retries the write.
 let reqeDue = false
 {
   const reqeFamOf = function (s) { return /codex|gpt|openai/i.test(String(s || '')) ? 'openai' : 'claude' }
-  const qeLabel = String(modelsUsed.qe || '')
-  if (/\(usage-switched\)/.test(qeLabel) && reqeFamOf(coderUsed) === reqeFamOf(qeReviewerUsed)) {
+  const reqeDecision = reqeEmitDecision({ coderUsed: coderUsed, qeReviewerUsed: qeReviewerUsed, qeModelLabel: modelsUsed.qe, routingRequested: routingRequested, bridge: qeStage ? qeStage.bridge : undefined })
+  if (reqeDecision.emit) {
     reqeDue = true
-    const reqeDebt = { schema: 'reqe-due-1', slug: SLUG, coderFamily: reqeFamOf(coderUsed), qeFamily: reqeFamOf(qeReviewerUsed), qeGrade: (qe && qe.grade) ? String(qe.grade) : null, reason: 'usage-switched self-review: Step-8 QE ran on the coder’s own family under the limit override (FR-2.9)', emittedAt: null, runStamp: qeHash }
+    const reqeDebt = { schema: 'reqe-due-1', slug: SLUG, coderFamily: reqeFamOf(coderUsed), qeFamily: reqeFamOf(qeReviewerUsed), qeGrade: (qe && qe.grade) ? String(qe.grade) : null, cause: reqeDecision.cause, bridge: qeStage ? qeStage.bridge : undefined, reason: reqeDecision.reason, emittedAt: null, runStamp: qeHash }
     // IDEMPOTENT + VERIFIED (reqe QE #2 + r2 #2/#3): a RESUMED qe re-runs this block (the original
     // run may have died between the qe checkpoint and this write), but: an existing due file is
     // never clobbered; a settlement blocks re-emission ONLY when it carries THIS run's runStamp (an
@@ -5602,8 +5808,10 @@ let reqeDue = false
     const emitText = String(emitOut || '')
     if (/REQE-SETTLED-THIS-RUN/.test(emitText)) log('re-QE debt: THIS run’s debt was already settled — not re-opened')
     else if (/REQE-EXISTS/.test(emitText)) log('re-QE debt: already recorded for ' + SLUG + ' — not overwritten')
-    else if (emitText.indexOf('reqe-due-1') !== -1) log('re-QE DEBT recorded: Step-8 ran same-family under the usage override — after limits reset run `dz reqe --slug ' + SLUG + '` for the independent cross-family pass')
+    else if (emitText.indexOf('reqe-due-1') !== -1) log('re-QE DEBT recorded: Step-8 ran same-family; cause=' + reqeDecision.cause + ' — run `dz reqe --slug ' + SLUG + '` for the independent cross-family pass')
     else log('re-QE debt write UNVERIFIED (agent returned no readback) — the debt may be missing on disk; reqeDue=true is still reported, record it manually via features/' + SLUG + '/.fa-state/reqe-due.json')
+  } else {
+    log('re-QE debt: ' + (reqeDecision.degraded ? '' : 'none — ') + reqeDecision.reason)
   }
 }