@dzhechkov/skills-feature-adr 1.5.14 → 1.5.15

package/.dz-manifest.json

@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "8c96e82b41fb8479befb56797a367b3cc2119cc5b022b18fdd18f129ef8cd0f0"
+        "sha256": "66f3b2cf7fdcf9efbf64c7d5cc36b34ffc82b151a9bc07e6fda5fc47d4fba72e"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "0cdd048a5aacd52294f72b5903b5a94c049ad61680dbcac532d5cb3fbd45c736"
+        "sha256": "e74b1a22e0260a61a3ab37512366402c4e6231b85625028a86219ee3f5c21e12"
       },
       {
         "path": "src/cli.js",
@@ -113,7 +113,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
+        "sha256": "28c265603481f976a52ea4c627e11194f3c0283801ea93d02cbb9f4248b43c68"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -149,15 +149,15 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "5c8d4c79d5329702b8c75b9afb36ae335aa63c99e74045c0afa98e12658ee975"
+        "sha256": "d7a2a4e56b24451da234b1ac4ef440ba9b0370617e1c0cde8ad5f3d575a53209"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
-        "sha256": "fb054591e86d55cee184eab96b5f0440053ada8fa9edf619e4a66ec5ac371587"
+        "sha256": "db79f8d026cc47edd1e5d2f30d0e1455c55c570dd022d549d440985a3e5940a5"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "5355e2b36ab13b6acb65abe5b206685915ef2b08191b4a3130574620012b9135"
+        "sha256": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -247,9 +247,13 @@
         "path": "templates/.claude/skills/feature-adr/references/qe-checklist.md",
         "sha256": "238d8896996dc53559f58b24aa7eca966cc8845c3b9dda6d982c717c657b91e4"
       },
+      {
+        "path": "templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs",
+        "sha256": "19c3991bfb5e88205c9ff6d4d44037c136a190581bab199d3928196e4616fe15"
+      },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "eb77822f121ade10bd6265b0f0145ec38507a07d2cb72ba5fa8336c962096bda"
+        "sha256": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
@@ -317,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "6d1bb93be6fae296281ac8f9fc2f266e5f09336cf6e183912fab5ff3bd0d3fd8"
+        "sha256": "7928cc90575eaef4f4626849f4490631676bc4ce6eb80e8f94c99d9e215bbd77"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -329,5 +333,5 @@
       }
     ]
   },
-  "signature": "+DKyJg37w6aHqhg/UhCpQ+y+w/e66HEEr9hgOv/TttSIMc6TokGEbvJpxEw2pdu19Q0SHlA/o6pSucM+h3KEDw=="
+  "signature": "wSJpaUNRsFXAD5Ye7V5y8FPgcvrLDEq6peQpK/RadbFsD518KglZDn5GNzV4DJE6i+mkHbH9tIwr+HIYXKN4BA=="
 }

package/README.md

@@ -1,5 +1,9 @@
 # @dzhechkov/skills-feature-adr
 
+Current package version: `1.5.15`. <!-- dz:version -->
+
+Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/skills-feature-adr
+
 **Spec-Driven Development pipeline for AI coding agents (Claude Code, Codex, …)**
 
 An 11-step, complexity-routed pipeline that makes an AI coding agent build a feature the way a
@@ -37,6 +41,21 @@ npx @dzhechkov/skills-feature-adr init
 
 After installation, open Claude Code in your project directory and use `/feature-adr`.
 
+Plain usage guidance joins the existing stage writer to `usage --by-stage --project` with explicit FA/
+Wf source selection and observed receipt IDs. It preserves unknown splits/prices, caller estimates and
+separate conservation/inventory/source verification. No billing inference, new ledger or paid replay.
+
+Plain Step 8 bridge guidance now passes current `--round`, `--round-run` and `--task` from the existing
+round receipt with the execution `--project`. Explicit conflicts refuse before reviewer work; the
+bridge's invocation `runId` stays distinct from pipeline identity. Native Workflow QE remains its own
+review path. Historical window correlation is disclosed as lower assurance, without guessed identity.
+
+Step 7 uses the installed `scripts/build-coder-context.mjs` helper to include literal requirements,
+plan tasks and ADR Decision/Confirmation. Workflow reads current inputs before code checkpoint
+lookup; plain coding runs the same helper and reads or embeds its successful `promptBlock`.
+Missing required sections, invalid files and exceeded UTF-8 bounds refuse coding instead of trimming
+the context. Existing decision recall and code-wrapper routing remain in place.
+
 ---
 
 ## What You Get
@@ -1363,3 +1382,22 @@ harness-core's `src/markdown-masker.ts`. It runs without a core build. Amendment
 and K2 share the parser while retaining their existing unclosed-block and indentation policies.
 The four-space indented-code gap remains open for amendment checks and K2; swarm briefs retain their
 existing masking of indented code. Versions are unchanged in this staged change.
+
+### Codex companion for feature-adr
+
+`dz statusline --watch --project "/path/to/worktree" --brain "/path/to/shared-brain"
+--slug "feature-slug" --run-id "stable-run-id"` adds an explicitly launched adjacent terminal
+companion, including Plain runs. Until installed, invoke the worktree-built
+`node packages/@dzhechkov/harness-cli/dist/bin.js statusline --watch ...`. This extends the existing
+command inventory. Canonical feature-adr guidance supplies the quoted producer/observer recipe: record
+a stable run ID and actual tier at the START of each step, then `done` on real completion; recall/teach
+remain scoped to the shared brain. Project run state and brain counts are separate. One slug retains
+one latest run; report freshness is not process liveness and stage position is not passed gates.
+
+The readonly companion requires a dedicated stdout TTY, uses serial 2-second refreshes (0.25–60
+allowed), sanitizes/clips text and handles resize. Below 40x8 it shows a size warning. Ctrl-C/SIGTERM
+exit 0; output failure 1; invalid/piped watch 2. Failed/absent counts and optional values are explicit;
+watch v1 ETA is unavailable and global source inventory omitted. No stdin/raw mode, models, logical
+store writes or automatic terminal/settings changes. Normal SQLite ephemeral WAL/SHM sidecars are
+permitted. One-shot Claude text/JSON/ETA remain unchanged. Codex native footer capability is not
+asserted; parity names manual `dz statusline --watch` access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.5.14",
+  "version": "1.5.15",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"
@@ -49,7 +49,7 @@
     "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/skills-feature-adr"
   },
-  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/skills-feature-adr#readme",
+  "homepage": "https://aicoding.space",
   "bugs": {
     "url": "https://github.com/djd1m/dz-harness/issues"
   },

package/sbom.json

@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8c96e82b41fb8479befb56797a367b3cc2119cc5b022b18fdd18f129ef8cd0f0"
+          "content": "66f3b2cf7fdcf9efbf64c7d5cc36b34ffc82b151a9bc07e6fda5fc47d4fba72e"
         }
       ]
     },
@@ -69,7 +69,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "0cdd048a5aacd52294f72b5903b5a94c049ad61680dbcac532d5cb3fbd45c736"
+          "value": "e74b1a22e0260a61a3ab37512366402c4e6231b85625028a86219ee3f5c21e12"
         }
       ]
     },
@@ -289,7 +289,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
+          "content": "28c265603481f976a52ea4c627e11194f3c0283801ea93d02cbb9f4248b43c68"
         }
       ]
     },
@@ -379,7 +379,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5c8d4c79d5329702b8c75b9afb36ae335aa63c99e74045c0afa98e12658ee975"
+          "content": "d7a2a4e56b24451da234b1ac4ef440ba9b0370617e1c0cde8ad5f3d575a53209"
         }
       ]
     },
@@ -389,7 +389,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fb054591e86d55cee184eab96b5f0440053ada8fa9edf619e4a66ec5ac371587"
+          "content": "db79f8d026cc47edd1e5d2f30d0e1455c55c570dd022d549d440985a3e5940a5"
         }
       ]
     },
@@ -399,7 +399,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5355e2b36ab13b6acb65abe5b206685915ef2b08191b4a3130574620012b9135"
+          "content": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
         }
       ]
     },
@@ -623,13 +623,23 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "19c3991bfb5e88205c9ff6d4d44037c136a190581bab199d3928196e4616fe15"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb77822f121ade10bd6265b0f0145ec38507a07d2cb72ba5fa8336c962096bda"
+          "content": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
         }
       ]
     },
@@ -799,7 +809,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6d1bb93be6fae296281ac8f9fc2f266e5f09336cf6e183912fab5ff3bd0d3fd8"
+          "content": "7928cc90575eaef4f4626849f4490631676bc4ce6eb80e8f94c99d9e215bbd77"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -562,13 +562,91 @@ only the statusline:
 
 **Record the panel at the START of every step, not only at Steps 0/8/9.** The panel shows the last step
 that reported; a pipeline that reports three times per run shows a stale step for most of its life. Emit
-`dz statusline --fa-record --slug <slug> --step "<Step N Name>" --recalled <n> --stored <n>` as the first
+`dz statusline --fa-record --project "<worktree>" --slug "<slug>" --run-id "<stable-run-id>" --tier M --step "<Step N Name>" --recalled <n> --stored <n>` as the first
 action of each step. The recall/teach counts only change at Steps 0/8/9; the *step label* changes at every
 one of them.
 
 *Honesty note:* the panel is live only insofar as the pipeline records state — it reflects what the
 pipeline actually did with the loop (recalls that ran, stores that landed), not an aspirational count.
 
+### Plain observed usage receipts
+
+Use the existing witnessed writer for usage you actually observed. At a real stage boundary,
+capture the execution project, stable run/task, verbatim stage, actual model/family/role, attempt,
+tier/mode and source window/IDs available to this host. Missing fields remain null with their reason;
+do not infer input/cache from total, price from a model family, or tokens from invocation budgets.
+
+```bash
+dz feature-adr-record --kind ledger --stage "$CURRENT_STAGE" --project "$EXECUTION_PROJECT" \
+  --row "$OBSERVED_STAGE_ROW_JSON" --rollout-id "$ACTUAL_SESSION_ID" --turn-id "$ACTUAL_TURN_ID" --json
+dz usage --by-stage --project "$EXECUTION_PROJECT" --source fa-ledger --run "$STABLE_RUN_ID" --json
+```
+
+`OBSERVED_STAGE_ROW_JSON` is real host metadata: `runId`, `taskId`, `stage`, `model`, `family`, `role`,
+`attempt`, `tier`, `mode`, `tokens`/dimensions when observed, and optional separate `estimate` with
+tokens/costUsd/method/source/capturedAt. Omit selectors not known; window/cwd/model-only correlation
+is labelled legacy-window and cannot claim exact source verification. Source roots can be named with
+`--codex-sessions`. Exact IDs are validated against existing receipts; no new IDs or recall/teach occur.
+The source receipt subset is captured once; later source append cannot enlarge the old row.
+Captured payload integrity and every pricing-bearing dimension must match the original scoped source.
+A reported monetary amount belongs to one observation, not each expanded token receipt. Preserve an
+actual observation ID/scope/basis in optional `reportedCostObservation: { id, scope, basis }` within
+`--row` when known; otherwise a captured source scope supplies a stable identity and unrelated money
+attribution stays unavailable. Reimports of the same observation count once; conflicting amounts are
+diagnosed. Missing money differs from zero. Exports must avoid every selected authoritative source,
+including custom run directories and symlink aliases. Invalid Claude counters retain nulls/diagnostics;
+a declared invalid total cannot derive a replacement, and accounting validity does not rewrite the
+actual generation outcome.
+
+For Wf, use `--source workflow-budget --run <id>` and optional `--run-dir <dir>` for its existing
+budget/trace/state. Auto source collisions require an explicit source; joined Wf summary projections
+never add another cost. Preserve reported total basis and cache/reasoning subsets. Wf budget.spent
+counts dispatch units; native Workflow's existing budget delta is output-only. Neither is raw total.
+
+Reports separate conservation, expected inventory and independent amount verification. Without
+a same-scope witness, verified totals are null even when reported values conserve. Unknown rates or
+split keep primary estimated USD null; static family estimates, provider-reported USD and caller
+pre-run estimates are separate, never current exact prices or billed amounts. Billing remains unobserved.
+
+### Codex companion terminal (Plain included)
+
+Open an adjacent terminal or a manual tmux split and launch the observer explicitly. Codex does not
+have a dz native command-provider footer. Keep the producer's project, slug and stable run ID equal to
+the observer's; use the actual complexity tier at the START of every active step. Brain is the shared
+learning store for recall/teach, while project is the worktree containing run slots and branch.
+
+```bash
+# Set these to your actual absolute paths. Use the worktree build until the change is installed.
+PANEL_CLI="/path/to/worktree/packages/@dzhechkov/harness-cli/dist/bin.js"
+PANEL_PROJECT="/path/to/worktree"
+PANEL_BRAIN="/path/to/canonical-brain"
+PANEL_SLUG="feature-slug"
+PANEL_RUN="feature-20261002-1"  # choose once per invocation, retain at every step
+node "$PANEL_CLI" statusline --watch --project "$PANEL_PROJECT" --brain "$PANEL_BRAIN" \
+  --slug "$PANEL_SLUG" --run-id "$PANEL_RUN" --interval 2
+# In the producer terminal, at the START of each real step (example: tier M):
+node "$PANEL_CLI" statusline --fa-record --project "$PANEL_PROJECT" --slug "$PANEL_SLUG" \
+  --run-id "$PANEL_RUN" --tier M --step "Step 7 Code" --recalled 3 --stored 0
+# Only after the run actually completes; this is not a claim that QE passed:
+node "$PANEL_CLI" statusline --fa-record --project "$PANEL_PROJECT" --slug "$PANEL_SLUG" \
+  --run-id "$PANEL_RUN" --tier M --step "done" --recalled 3 --stored 0
+```
+
+Use `dz recall ... --project "$PANEL_BRAIN"` and `dz teach ... --project "$PANEL_BRAIN"` for actual
+learning. Supply measured cumulative counters, not the example numbers. The observer counts its brain
+source directly; the slot's producer pool is not a shared-brain inventory. One slug holds one latest
+run, so a replacement makes an exact old selection missing. No selectors means visibly automatic
+selection. Freshness measures producer-report age, not process liveness: fresh <30 minutes, stale
+30–<90, expired >=90; completed remains completed. Stage position is not completed gates.
+
+Watch v1 displays ETA unavailable, unknown optional values and unavailable failed/absent learning
+sources, and omits ambiguous global source inventory. It uses escaped ASCII text, a dedicated stdout
+TTY, 0.25–60 second intervals (default 2), and a size warning below 40 columns/8 rows. Ctrl-C/SIGTERM
+exit 0; output failures exit 1; piped output and watch+JSON/install/record combinations exit 2.
+Observation never reads stdin, runs models or writes logical store state. SQLite-managed ephemeral
+WAL/SHM files are permitted; no application locks, repair or schema changes occur. One-shot Claude
+statusline/JSON and its ETA keep their existing behavior. Do not start a terminal automatically.
+
 ### What changes with `--full-qe`
 
 Full agentic-qe protocols for the same 9 core skills. No new agents, just deeper methodology.

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -235,6 +235,16 @@ C2 recognises JS/TS, pytest, Go, Rust, JVM and .NET test paths, extensible per p
 
 Never proceed on a non-zero exit, and never treat empty output as a pass — the last line
 (`K2 plan-completeness: PASS|FAIL|NOT-ESTABLISHED`) is the verdict, and its absence is not one.
+
+**Where an id counts (the default since 2026-09-27, owner decision).** C1 and C8 read the plan's
+TASK LINES only: a heading, a list item or a table row. An `ADR-<n>` or `FR-<n>` that appears only
+in a prose paragraph, a fenced code block (the SPARC-GOAP ```yaml goal state included), an HTML
+comment, the `## Amendments` section or the `EXPECTED_CODE_TARGETS:` block is a mention, not a task,
+and the gate FAILs it with `(cited only outside task lines)`. Write the id on the FIRST line of the
+task that implements it: a wrapped continuation line of a list item is not read either. Measured on the archive when the default changed: 56 of 102 plans that had
+passed would fail this reader, so a plan written before that date may be red on a re-check — move
+the citation onto a task line, or re-check that one plan with `--no-require-task-lines` and say so
+in the checkpoint banner.
 What it checks: C1 every ADR **decision** (a `# ADR-NNN` / `## ADR-NNN` heading INSIDE the file, not
 just the filename prefix — a file with several headings owes several plan citations) has a plan task
 citing it · C2 every ADR Confirmation test path is named in the plan · C3 the `EXPECTED_CODE_TARGETS:`

package/templates/.claude/skills/feature-adr/modules/07-code.md

@@ -26,6 +26,35 @@ opus (complex code generation)
 
 ### 1. Pre-Implementation Checklist
 
+### Current literal context (plain and delegated coding)
+
+Before coding or delegating, run the installed helper beside this module. Set `CONTEXT_HELPER` to
+the absolute `scripts/build-coder-context.mjs` path of the skill installation you are reading;
+set `FEATURE_DIR` to the absolute target `features/<slug>` directory and use the actual tier:
+
+```bash
+node "$CONTEXT_HELPER" "$FEATURE_DIR" --tier=M
+```
+
+The command emits exactly one JSON envelope and exits 0 only for `status: "complete"`. On any
+nonzero exit, unavailable/incomplete status, malformed JSON or required missing/empty section,
+stop before coding and repair the named input. Never paste a partial result as complete. A missing
+helper requires restoring this skill installation, not inventing a replacement block.
+
+For every delegated coder assignment, paste the successful envelope's literal `promptBlock` into
+the actual prompt, then append the existing advisory decision-recall block once. Keep the source
+paths below for deeper reading. For single-agent in-session coding, read this generated block
+directly before implementing. Requirements and plan are included in full; each ADR supplies its
+Decision and Confirmation with source labels. M/L/XL require at least one ADR; S can have none.
+
+The same canonical helper is used by the programmatic Workflow before code checkpoint lookup.
+It fingerprints full current inputs and binds the prompt separately, so changed documents cannot
+reuse old code. The plain mode boundary is an executable helper command plus these required
+read/embedding instructions; there is no separately automated plain dispatcher. Pure/fixture tests
+do not establish a live model relay's authenticity. Helper bounds are 64 documents, 256 KiB/file,
+1 MiB read and 96 KiB UTF-8 for the entire labelled block; exceeded bounds refuse without trimming.
+These are document limits, not a new limit on the existing coder wrapper's final prompt.
+
 Before writing any code:
 - [ ] Read existing similar implementations in codebase
 - [ ] Identify naming conventions (files, classes, functions, variables)

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -23,6 +23,30 @@ sonnet (analytical evaluation)
 
 ## Protocol
 
+### Bridge identity for plain Step 8
+
+When the plain host invokes the existing Claude review bridge, take round number, pipeline run and
+task from the current round receipt/state in the execution project. Pass the fields actually present:
+
+```bash
+dz qe-bridge --family claude --slug "$FEATURE_SLUG" --project "$EXECUTION_PROJECT" \
+  --round "$CURRENT_ROUND" --round-run "$CURRENT_ROUND_RUN" --task "$CURRENT_TASK" \
+  --coder-family codex
+```
+
+Do not mint missing identifiers or point `--project` at a separate learning brain. Explicit identity
+must agree with one readable open round before any probe or review child; conflicts refuse with exit 2.
+The bridge freezes that snapshot for the signoff. Signoff `roundRun` is the pipeline run; its existing
+`runId` identifies the separate bridge invocation and audit filenames. No-flags standalone reviews
+retain best-effort lookup and visibly unbound provenance when authority is absent or unavailable.
+
+Round close validates every present identity field before selection. Full, partial and genuinely
+identity-free window assurance appear as `round-run-task`, `partial-identity` and `legacy-window`.
+Malformed or foreign claims cannot become a manual-close fallback. This contract governs the
+existing plain bridge and control-review caller; native Workflow QE already runs its own review and
+must not invoke a second bridge to manufacture this receipt. Local fake-child tests do not establish
+a live Claude model roundtrip or secure every native Codex QE receipt.
+
 ### 1. Smoke Tests (All tiers)
 
 ```

package/templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// One parser for workflow and plain Step 7. Importing this module performs no IO.
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCHEMA = 'fa-coder-context-1';
+const MAX_DOCUMENTS = 64;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 1024 * 1024;
+const MAX_PROMPT_BYTES = 96 * 1024;
+const sha = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+const kindOf = (path) => path === '01_requirements.md' ? 'requirements'
+  : path === '06_implementation_plan.md' ? 'plan'
+    : /^03_adr\/[0-9]{3}-[^/\\\x00-\x1f]+\.md$/.test(path) ? 'adr' : null;
+const diagnostic = (source, reason, section) => ({ source, reason, severity: 'error', ...(section ? { section } : {}) });
+
+// One lexical pass recognizes comments only outside Markdown code/escapes, retaining offsets.
+function markdown(text) {
+  const headings = [];
+  const visible = [];
+  let fence = null;
+  let comment = false;
+  let inlineEnd = -1;
+  let offset = 0;
+  for (const line of text.match(/[^\n]*\n|[^\n]+$/g) ?? []) {
+    const clean = line.replace(/\r?\n$/, '').replace(/^\uFEFF/, '');
+    const delimiter = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(clean);
+    if (fence) {
+      if (delimiter && delimiter[1][0] === fence.char && delimiter[1].length >= fence.length && delimiter[2].trim() === '') fence = null;
+      else visible.push(line);
+    } else if (!comment && inlineEnd <= offset && delimiter && !(delimiter[1][0] === '`' && delimiter[2].includes('`'))) {
+      fence = { char: delimiter[1][0], length: delimiter[1].length };
+    } else {
+      const wasComment = comment;
+      let masked = '';
+      for (let i = 0; i < line.length;) {
+        if (comment) {
+          if (line.startsWith('-->', i)) { masked += '   '; i += 3; comment = false; }
+          else { masked += /[\r\n]/.test(line[i]) ? line[i] : ' '; i++; }
+          continue;
+        }
+        if (offset + i < inlineEnd) { masked += line[i++]; continue; }
+        // An escaped '<' cannot start a comment; paired backslashes still allow the next opener.
+        if (line[i] === '\\' && i + 1 < line.length && /[!"#$%&'()*+,\-./:;<=>?@[\]\\^_`{|}~]/.test(line[i + 1])) {
+          masked += line.slice(i, i + 2); i += 2; continue;
+        }
+        if (line[i] === '`') {
+          const run = /^`+/.exec(line.slice(i))[0];
+          const rest = text.slice(offset + i + run.length);
+          // Code spans can wrap within a paragraph, but cannot hide a subsequent block heading/fence.
+          const boundary = /\n[ \t]*(?:\r?\n|#{1,6}[ \t]|`{3,}|~{3,})/.exec(rest);
+          const paragraph = boundary ? rest.slice(0, boundary.index) : rest;
+          const close = [...paragraph.matchAll(/`+/g)].find((match) => match[0].length === run.length);
+          if (close) inlineEnd = offset + i + run.length + close.index + run.length;
+          masked += run; i += run.length; continue;
+        }
+        if (line.startsWith('<!--', i)) { comment = true; masked += '    '; i += 4; continue; }
+        masked += line[i++];
+      }
+      const heading = !wasComment && /^ {0,3}(#{1,6})[ \t]+(.+?)\s*$/.exec(masked.replace(/\r?\n$/, '').replace(/^\uFEFF/, ''));
+      if (heading) headings.push({ depth: heading[1].length, title: heading[2].replace(/[ \t]+#+[ \t]*$/, '').trim(), start: offset, body: offset + line.length });
+      else visible.push(masked);
+    }
+    offset += line.length;
+  }
+  return { headings, unclosed: fence !== null, unclosedComment: comment, substantive: visible.join('').trim() !== '' };
+}
+
+/** Pure: consumes already-read documents only, and hashes the same snapshot used for the block. */
+export function buildCoderContext({ tier, documents }) {
+  const diagnostics = [];
+  const sources = [];
+  const blocks = [];
+  let bounded = true;
+  if (!['S', 'M', 'L', 'XL'].includes(tier)) diagnostics.push(diagnostic('tier', 'invalid-tier'));
+  if (!Array.isArray(documents)) documents = [];
+  if (documents.length > MAX_DOCUMENTS) { diagnostics.push(diagnostic('documents', 'document-limit')); bounded = false; }
+  const sorted = [...documents].sort((a, b) => String(a?.path).localeCompare(String(b?.path), 'en'));
+  const seen = new Set();
+  let total = 0;
+  for (const doc of sorted.slice(0, MAX_DOCUMENTS)) {
+    const path = doc?.path;
+    const kind = typeof path === 'string' && path.length <= 512 ? kindOf(path) : null;
+    if (!kind || typeof doc.text !== 'string') { diagnostics.push(diagnostic(String(path ?? 'documents'), 'invalid-source')); bounded = false; continue; }
+    if (seen.has(path)) { diagnostics.push(diagnostic(path, 'duplicate-source')); bounded = false; continue; }
+    seen.add(path);
+    const bytes = Buffer.byteLength(doc.text, 'utf8'); total += bytes;
+    const status = bytes > MAX_FILE_BYTES ? 'oversized' : 'read';
+    sources.push({ path, kind, bytes, digest: status === 'read' ? sha(doc.text) : null, status });
+    if (status !== 'read') { diagnostics.push(diagnostic(path, 'file-limit')); bounded = false; continue; }
+    const parsed = markdown(doc.text);
+    if (parsed.unclosed) diagnostics.push(diagnostic(path, 'unclosed-fence'));
+    if (parsed.unclosedComment) diagnostics.push(diagnostic(path, 'unclosed-comment'));
+    if (kind !== 'adr') {
+      if (!parsed.substantive) diagnostics.push(diagnostic(path, 'empty-section', 'body'));
+      blocks.push('\n\n### Source: ' + path + ' — body\n' + doc.text);
+      continue;
+    }
+    for (const section of ['Decision', 'Confirmation']) {
+      const matches = parsed.headings.filter((h) => h.depth >= 2 && h.title.toLowerCase() === section.toLowerCase());
+      if (matches.length !== 1) { diagnostics.push(diagnostic(path, matches.length ? 'duplicate-section' : 'missing-section', section)); continue; }
+      const heading = matches[0];
+      const next = parsed.headings.find((h) => h.start > heading.start && h.depth <= heading.depth);
+      const body = doc.text.slice(heading.body, next ? next.start : doc.text.length);
+      if (!markdown(body).substantive) diagnostics.push(diagnostic(path, 'empty-section', section));
+      blocks.push('\n\n### Source: ' + path + ' — ' + section + '\n' + body);
+    }
+  }
+  if (total > MAX_TOTAL_BYTES) { diagnostics.push(diagnostic('documents', 'aggregate-limit')); bounded = false; }
+  for (const path of ['01_requirements.md', '06_implementation_plan.md']) {
+    if (!seen.has(path)) {
+      sources.push({ path, kind: kindOf(path), bytes: 0, digest: null, status: 'missing' });
+      diagnostics.push(diagnostic(path, 'missing-source'));
+    }
+  }
+  if (tier !== 'S' && !sources.some((s) => s.kind === 'adr')) diagnostics.push(diagnostic('03_adr', 'missing-source'));
+  let promptBlock = '\n\n## Current coder context (literal source snapshot)' + blocks.join('');
+  if (tier === 'S' && !sources.some((s) => s.kind === 'adr')) promptBlock += '\n\nADR sources: none selected (tier S).';
+  if (Buffer.byteLength(promptBlock, 'utf8') > MAX_PROMPT_BYTES) {
+    diagnostics.push(diagnostic('promptBlock', 'prompt-limit')); promptBlock = '';
+  }
+  return { schema: SCHEMA, status: diagnostics.length ? 'incomplete' : 'complete', promptBlock,
+    digest: bounded ? sha(JSON.stringify([SCHEMA, tier, sorted.map((d) => [d.path, d.text])])) : null,
+    sources: sources.sort((a, b) => a.path.localeCompare(b.path, 'en')), diagnostics };
+}
+
+function hostContext(feature, tier) {
+  const failures = [];
+  const documents = [];
+  const failedSources = [];
+  let root;
+  const fail = (path, reason, status = 'unreadable', bytes = 0) => {
+    failures.push(diagnostic(path, reason));
+    failedSources.push({ path, kind: kindOf(path) ?? 'adr', bytes, digest: null, status });
+  };
+  try {
+    if (lstatSync(feature).isSymbolicLink() || !lstatSync(feature).isDirectory()) throw new Error('invalid-root');
+    root = realpathSync(feature);
+  } catch { return { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic(feature, 'invalid-root')] }; }
+  let paths = ['01_requirements.md', '06_implementation_plan.md'];
+  const adrDir = join(root, '03_adr');
+  try {
+    const stat = lstatSync(adrDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) fail('03_adr', 'invalid-file', 'invalid');
+    else paths.push(...readdirSync(adrDir).filter((name) => /^[0-9]{3}-.+\.md$/.test(name)).sort().map((name) => '03_adr/' + name));
+  } catch (error) { if (error.code !== 'ENOENT') fail('03_adr', 'read-failure'); }
+  if (paths.length > MAX_DOCUMENTS) return { schema: SCHEMA, status: 'incomplete', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('documents', 'document-limit')] };
+  let total = 0;
+  for (const path of paths) {
+    let fd;
+    try {
+      const file = join(root, path);
+      const stat = lstatSync(file);
+      if (stat.isSymbolicLink() || !stat.isFile()) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const actual = realpathSync(file);
+      const rel = relative(root, actual);
+      if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) { fail(path, 'outside-root', 'invalid'); continue; }
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      const opened = fstatSync(fd);
+      // Compare the opened descriptor with the contained file checked before open.
+      if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev || realpathSync(file) !== actual) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const chunks = []; let bytes = 0;
+      while (true) {
+        const chunk = Buffer.alloc(Math.min(16384, MAX_FILE_BYTES + 1 - bytes));
+        const count = readSync(fd, chunk, 0, chunk.length, null);
+        if (count === 0) break;
+        bytes += count; total += count; chunks.push(chunk.subarray(0, count));
+        if (bytes > MAX_FILE_BYTES || total > MAX_TOTAL_BYTES) break;
+      }
+      if (bytes > MAX_FILE_BYTES) { fail(path, 'file-limit', 'oversized', bytes); continue; }
+      if (total > MAX_TOTAL_BYTES) { fail(path, 'aggregate-limit', 'oversized', bytes); break; }
+      try { documents.push({ path, text: new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)) }); }
+      catch { fail(path, 'invalid-utf8', 'invalid', bytes); }
+    } catch (error) { fail(path, error.code === 'ENOENT' ? 'missing-source' : 'read-failure', error.code === 'ENOENT' ? 'missing' : 'unreadable'); }
+    finally { if (fd !== undefined) closeSync(fd); }
+  }
+  const result = buildCoderContext({ tier, documents });
+  if (failures.length) {
+    const failed = new Set(failedSources.map((s) => s.path));
+    result.sources = result.sources.filter((s) => !failed.has(s.path)).concat(failedSources).sort((a, b) => a.path.localeCompare(b.path, 'en'));
+    result.diagnostics = result.diagnostics.filter((d) => !(failed.has(d.source) && d.reason === 'missing-source')).concat(failures);
+    result.status = failures.every((d) => ['file-limit', 'aggregate-limit'].includes(d.reason)) ? 'incomplete' : 'unavailable';
+    result.digest = null;
+  }
+  return result;
+}
+
+function main(argv) {
+  const feature = argv[0];
+  const tier = argv.find((arg) => arg.startsWith('--tier='))?.slice(7);
+  let result;
+  if (!feature || !['S', 'M', 'L', 'XL'].includes(tier) || argv.some((arg, i) => i > 0 && arg !== '--tier=' + tier)) {
+    result = { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('arguments', 'invalid-arguments')] };
+  } else result = hostContext(resolve(feature), tier);
+  console.log(JSON.stringify(result));
+  return result.status === 'complete' ? 0 : 1;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) process.exitCode = main(process.argv.slice(2));

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -3,7 +3,7 @@
 // Generalized from features/wave1-instrument-repair/check-plan-completeness.mjs (that copy is the
 // historical artifact of its run and stays untouched); this one is parameterized by feature dir.
 //
-// USAGE:  node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs [<feature-dir>] [--tier=M] [--acid=A1,A2] [--require-requirements]
+// USAGE:  node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs [<feature-dir>] [--tier=M] [--acid=A1,A2] [--require-requirements] [--no-require-task-lines]
 //         <feature-dir> defaults to the current working directory.
 //         --tier=S|M|L|XL closes the ADR-less dodge (see S-TIER HONESTY); omitting it keeps the
 //         heuristic, and the skip note then names the dodge out loud.
@@ -11,6 +11,12 @@
 //         pipeline passes this flag, so the check is introduced two-shot (ADR-001 plan-inherits-
 //         requirements): WARN first so the corpus can be measured without repainting every green
 //         fixture red, FAIL once the planner prompt names the contract (feature-adr.js Step 6).
+//         C1 and C8 read the plan's TASK LINES by DEFAULT (C10 below; owner decision 2026-09-27,
+//         backlog 95565da0): an id cited only in prose, fenced code, an HTML comment, `## Amendments`
+//         or EXPECTED_CODE_TARGETS is not a task. --no-require-task-lines is the explicit way back
+//         to the raw-plan reader, where C10 only WARNs — for re-checking a plan written before the
+//         default changed. --require-task-lines is still accepted and means the default; passing
+//         BOTH is a contradiction and is refused (NOT-ESTABLISHED), never resolved silently.
 //
 // VERDICT CONTRACT (unchanged from the proven copy — never a silent pass):
 //   PASS            exit 0   last line: `K2 plan-completeness: PASS (...)`
@@ -20,16 +26,22 @@
 //  ONE regex parses all three verdicts — the exit codes and their meanings are identical.)
 // Set difference over IDENTIFIERS, not text similarity.
 //
-// KNOWN LIMITATION (measured on the discrimination twin, 2026-08-19): C1 is a grep — a PROSE
-// mention of "ADR-002" satisfies it exactly like a task reference. The real N14 (backlog
-// 3dbd2851-adjacent) must parse task structure. Kept honest here: C1 catches "forgot entirely",
-// not "mentioned but not tasked".
-//
-// KNOWN LIMITATION (fix round 1, 2026-09-16, same class as C1 above): C8 is also a grep — a PROSE
-// mention of "FR-3" satisfies it exactly like a task reference. Kept honest here too: C8 catches
-// "forgot entirely", not "mentioned but not tasked". Masking the PLAN side (not just the 01/ADR
-// side) for C1 and C8 together, so a prose mention stops satisfying either check, is a separate
-// backlog item — filed by the lead, not chased here.
+// C1 AND C8 SHARE ONE PLAN-SIDE READER (k2-reads-masked-plan, backlog c03903eb, 2026-09-27).
+// Until then both were a grep over the RAW plan: an id in prose, a fenced code block, an HTML
+// comment, the `## Amendments` section or the EXPECTED_CODE_TARGETS block counted as a task
+// (named here as a limit since 2026-08-19 for C1 and 2026-09-16 for C8). `planTaskText()` now
+// answers "which plan text is a task" ONCE, for both checks — so one phrase can never pass one
+// check and fail the other. Introduced WARN-first (C10), because the corpus said so; the FAIL
+// half became the DEFAULT on 2026-09-27 by owner decision, with this measurement on the table:
+// MEASURED 2026-09-27 over all 472 features/*/06_implementation_plan.md, pipeline mode
+// (--require-requirements, tier read from 00): of 101 green plans, the task-line reader turns 55
+// red (an earlier snapshot of the same day; the count the owner decided on, taken later over 473
+// plans, was 56 of 102), and even mask-only (prose kept) turns 11 red — the SPARC-GOAP ```yaml goal-state block and
+// «ADR-001 governs every task» prose are the corpus's own idioms, not forgeries. So a plan that
+// was green before 2026-09-27 may be red on a re-check: that is the decision, not a regression —
+// cite the id on a task line, or re-check that plan with --no-require-task-lines and say so.
+// NAMED LIMIT: `planClaimsAdrWork` (S-tier honesty) and C2 still read the raw plan — a CLAIM of
+// ADR work in prose is still a claim, and C2 names test paths, not ids.
 //
 // KNOWN LIMITATION (C9): only byte-identical copies are visible before the edit. Already drifted
 // or intentionally different pinned copies remain the identity tests' job; the frozen
@@ -96,6 +108,8 @@ const tierArg = argv.find((a) => a.startsWith('--tier='));
 const TIER = tierArg ? tierArg.slice('--tier='.length).trim().toUpperCase() : null;
 const TIER_REQUIRES_ADR = TIER === 'M' || TIER === 'L' || TIER === 'XL';
 const REQUIRE_REQUIREMENTS = argv.includes('--require-requirements');
+const NO_REQUIRE_TASK_LINES = argv.includes('--no-require-task-lines');
+const REQUIRE_TASK_LINES = !NO_REQUIRE_TASK_LINES;
 const dirArg = argv.find((a) => !a.startsWith('--'));
 const FDIR = resolve(dirArg && dirArg !== '' ? (isAbsolute(dirArg) ? dirArg : join(process.cwd(), dirArg)) : process.cwd());
 const planPath = join(FDIR, '06_implementation_plan.md');
@@ -113,6 +127,7 @@ const safe = (v) => String(v)
   .slice(0, 300);
 const out = (s) => console.log(s);
 const notEstablished = (why) => { out(`K2 plan-completeness: NOT-ESTABLISHED — ${safe(why)}`); process.exit(3); };
+if (NO_REQUIRE_TASK_LINES && argv.includes('--require-task-lines')) notEstablished('both --require-task-lines and --no-require-task-lines were passed — pick one reader');
 let failures = [], warnings = [], skips = [];
 
 // Lead delta after Codex rounds 2+3 (2026-09-16, plan-inherits-requirements): on the DECLARATION side
@@ -136,6 +151,54 @@ if (!existsSync(FDIR)) notEstablished(`feature dir absent: ${FDIR}`);
 if (!existsSync(planPath)) notEstablished('06_implementation_plan.md absent');
 const plan = readFileSync(planPath, 'utf-8');
 if (plan.trim().length < 200) notEstablished('plan suspiciously small (<200 chars)');
+// The EXPECTED_CODE_TARGETS block as C3 reads it (C3 below reuses THIS match — one reader).
+const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
+
+// `## Amendments` as C6 reads it: up to three leading spaces, two to four hashes, trailing text
+// allowed; the section ends at the next level-1..4 heading. Returned as LINE indices over masked
+// lines — [headingLine, endLine). One definition for C6 and planTaskText, or the two drift.
+function findAmendmentsSection(maskedLines) {
+  let head = -1, end = -1;
+  for (let i = 0; i < maskedLines.length; i++) {
+    const pl = maskedLines[i];
+    if (head < 0 && /^ {0,3}#{2,4}\s+Amendments\b/.test(pl)) head = i;
+    else if (head >= 0 && end < 0 && /^ {0,3}#{1,4}\s/.test(pl)) end = i;
+  }
+  if (head >= 0 && end < 0) end = maskedLines.length;
+  return { head, end };
+}
+
+// C10 — the TASK LINES of the plan, the text C1/C8 cite against (the default reader).
+// Masked first (fences and HTML comments blanked, unclosed fence hidden — the K2 reader policy),
+// then: drop the `## Amendments` section and the EXPECTED_CODE_TARGETS block, and keep only
+// headings, list items and table rows. Table rows are kept deliberately, beyond the backlog's
+// «headings/list items»: task tables (`| T1 | … |`) are a corpus form — MEASURED 2026-09-27,
+// dropping them turns 12 more green plans red in pipeline mode (67 vs 55) and 26 more in WARN mode.
+// NAMED LIMIT: a list item or table row that is itself prose («- Note: ADR-001 governs …») still
+// counts — the reader tells structure from prose, not a task from a remark.
+function planTaskText(planText) {
+  const lines = maskMarkdown(planText, { unclosed: 'mask' }).split('\n');
+  const am = findAmendmentsSection(lines);
+  let tFrom = -1, tTo = -1;
+  if (blockM) {
+    tFrom = planText.slice(0, blockM.index).split('\n').length - 1;
+    tTo = planText.slice(0, blockM.index + blockM[0].length - 1).split('\n').length - 1;
+  }
+  const keep = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (am.head >= 0 && i >= am.head && i < am.end) continue;
+    if (tFrom >= 0 && i >= tFrom && i <= tTo) continue;
+    const l = lines[i];
+    if (/^ {0,3}#{1,6}\s/.test(l) || /^\s*(?:[-*+]|\d+[.)])\s+/.test(l) || /^\s*\|/.test(l)) keep.push(l);
+  }
+  return keep.join('\n');
+}
+const planTasks = planTaskText(plan);
+// What C1/C8 cite against, and the ids that pass the raw read but have no task line (C10).
+const citeText = REQUIRE_TASK_LINES ? planTasks : plan;
+const outsideTasksOnly = { C1: [], C8: [] };
+const citedOutsideOnly = (re) => re.test(plan) && !re.test(planTasks);
+
 const adrFiles = existsSync(adrDir) ? readdirSync(adrDir).filter(f => f.endsWith('.md')).sort() : [];
 const planClaimsAdrWork = /\bADR-\d+/.test(plan);
 if (adrFiles.length === 0 && planClaimsAdrWork) notEstablished('no ADR files under 03_adr/, yet the plan cites ADR-<n> — completeness cannot be established');
@@ -243,7 +306,8 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
       for (const n of headingNums) {
         const id = `ADR-${n}`;
         const re = new RegExp(`ADR-0*${Number(n)}\\b`);
-        if (!re.test(plan)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it`);
+        if (!re.test(citeText)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it${citedOutsideOnly(re) ? ' (cited only outside task lines)' : ''}`);
+        else if (citedOutsideOnly(re)) outsideTasksOnly.C1.push(id);
       }
       continue;
     }
@@ -251,7 +315,8 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
     warnings.push(`C1: ${safe(f)} has no ADR-NNN heading — falling back to the filename prefix`);
     const id = `ADR-${m[1]}`;
     const re = new RegExp(`ADR-0*${Number(m[1])}\\b`);
-    if (!re.test(plan)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it`);
+    if (!re.test(citeText)) failures.push(`C1: ${id} (${safe(f)}) has NO task in the plan referencing it${citedOutsideOnly(re) ? ' (cited only outside task lines)' : ''}`);
+    else if (citedOutsideOnly(re)) outsideTasksOnly.C1.push(id);
   }
 
   // C2 — every Confirmation-listed test file path appears in the plan
@@ -342,7 +407,6 @@ function classifyTargetPath(path) {
 }
 
 // C3 — EXPECTED_CODE_TARGETS block, line-level validation
-const blockM = plan.match(/EXPECTED_CODE_TARGETS:\s*\n((?:\s*[-*]\s*.+\n?)+)/);
 const listedTargets = new Set();
 if (!blockM) failures.push('C3: no EXPECTED_CODE_TARGETS: block in the plan');
 else {
@@ -477,16 +541,14 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
   // phantom amendment or hand a real testless one someone else's marker. Third fence-blindness
   // found in a checker today, so it is closed here by construction rather than by care.
   const planLines = maskMarkdown(plan, { unclosed: 'mask' }).split('\n');
-  let sectionStart = -1, sectionEnd = -1, cursor = 0;
-  for (const pl of planLines) {
-    // The SAME heading shape amendment-trace.ts accepts: up to three leading spaces, two to four
-    // hashes, and trailing text allowed. C6 required exactly `##` with nothing after, so the two
-    // tools disagreed about where the section even IS — the divergence this feature exists to end.
-    if (sectionStart < 0 && /^ {0,3}#{2,4}\s+Amendments\b/.test(pl)) sectionStart = cursor + pl.length + 1;
-    else if (sectionStart >= 0 && sectionEnd < 0 && /^ {0,3}#{1,4}\s/.test(pl)) sectionEnd = cursor;
-    cursor += pl.length + 1;
-  }
-  if (sectionStart >= 0 && sectionEnd < 0) sectionEnd = plan.length;
+  // The SAME heading shape amendment-trace.ts accepts: up to three leading spaces, two to four
+  // hashes, and trailing text allowed. C6 required exactly `##` with nothing after, so the two
+  // tools disagreed about where the section even IS — the divergence this feature exists to end.
+  // The section boundary itself is `findAmendmentsSection` — shared with C10, one answer.
+  const amRange = findAmendmentsSection(planLines);
+  const lineOffset = (idx) => planLines.slice(0, idx).reduce((acc, l) => acc + l.length + 1, 0);
+  const sectionStart = amRange.head < 0 ? -1 : lineOffset(amRange.head + 1);
+  const sectionEnd = amRange.head < 0 ? -1 : (amRange.end < planLines.length ? lineOffset(amRange.end) : plan.length);
   // Sliced from the MASKED text so the offsets computed above line up with what is scanned.
   const maskedPlan = planLines.join('\n');
   const amSection = sectionStart >= 0 ? maskedPlan.slice(sectionStart, sectionEnd) : '';
@@ -623,7 +685,9 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
     if (reqIds.length === 0) {
       warnings.push('C8: 01_requirements.md declares NO requirement ids in the contract shapes (FR-N / NFR-N / AC-N / C-N at line start) — nothing to cover');
     } else {
-      const missing = reqIds.filter((id) => !new RegExp('\\b' + escapeReqId(id) + '\\b').test(plan));
+      const reqRe = (id) => new RegExp('\\b' + escapeReqId(id) + '\\b');
+      const missing = reqIds.filter((id) => !reqRe(id).test(citeText));
+      for (const id of reqIds) if (!missing.includes(id) && citedOutsideOnly(reqRe(id))) outsideTasksOnly.C8.push(id);
       if (missing.length === 0) {
         // Silence is not a verdict (K7): a check that ran and found nothing wrong must still print,
         // or a reader cannot tell "C8 ran clean" from "C8 never ran". Deliberately NOT a PASS/FAIL/
@@ -631,7 +695,7 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
         // mid-stream is exactly the G-F1 forgery class this script's `safe()` already defends against.
         out(`NOTE  C8: all ${reqIds.length} requirement ids referenced`);
       } else if (REQUIRE_REQUIREMENTS) {
-        for (const id of missing) failures.push(`C8: ${id} (01_requirements.md) is not referenced by the plan`);
+        for (const id of missing) failures.push(`C8: ${id} (01_requirements.md) is not referenced by the plan${citedOutsideOnly(reqRe(id)) ? ' (cited only outside task lines)' : ''}`);
       } else {
         const shown = missing.slice(0, 12);
         const more = missing.length > 12 ? `, …and ${missing.length - 12} more` : '';
@@ -641,6 +705,23 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
   }
 }
 
+// C10 — ids that C1/C8 counted as covered, but whose ONLY citations sit outside task lines
+// (prose, fenced code, an HTML comment, `## Amendments`, the EXPECTED_CODE_TARGETS block). Reached
+// ONLY under --no-require-task-lines: by default C1/C8 already read task lines, so this list is
+// empty by construction. One line per check, ids capped like C8's WARN.
+for (const check of ['C1', 'C8']) {
+  const ids = [...new Set(outsideTasksOnly[check])];
+  if (ids.length === 0) continue;
+  const shown = ids.slice(0, 12);
+  const more = ids.length > 12 ? `, …and ${ids.length - 12} more` : '';
+  // Say what dropping the opt-out would do in THIS invocation (Codex astra r1 MINOR): C1 always
+  // FAILs by default; C8 FAILs only when --require-requirements is also passed — otherwise a WARN.
+  const consequence = check === 'C8' && !REQUIRE_REQUIREMENTS
+    ? 'without --no-require-task-lines this stays a C8 WARN (C8 is enforced only with --require-requirements; add that flag and the default reader fails it)'
+    : `these ids count as covered only because of --no-require-task-lines; the default makes this a ${check} FAIL`;
+  warnings.push(`C10: ${ids.length} ${check} id(s) are cited only outside task lines (prose, fenced code, HTML comment, ## Amendments, EXPECTED_CODE_TARGETS): ${shown.join(', ')}${more} — a mention is not a task; ${consequence}`);
+}
+
 // C5 — Inputs read line
 if (!/Inputs read:/i.test(plan)) warnings.push('C5: no "Inputs read:" line (wave-2 seam, WARN only)');
 else for (const need of ['03_adr','05_architecture']) if (!plan.includes(need)) warnings.push(`C5: Inputs read line missing ${need}`);

package/templates/.claude/workflows/feature-adr.js

@@ -3521,8 +3521,80 @@ function codeLandingLivenessProbeCmd(repo, plan, baselineAbsPath, jobId, waitSec
 // A Bash one-liner that waits for a Codex OUT-OF-BAND artifact write to LAND: polls up to ~40s until
 // the file exists, is non-empty, AND its size is stable across two reads (write finished). Assumes a
 // fresh feature slug (no stale same-path artifact) — true for a normal /feature-adr run.
+// The printed count is stripped to digits (tr -cd 0-9): BSD/macOS wc -c left-pads it, and
+// parseLandedProbe accepts only landed=<digits> (Codex astra r1 MAJOR, landed-barrier-anchored-line).
 function landedProbeCmd(f) {
-  return 'f="' + f + '"; last=-1; for i in 1 2 3 4 5 6 7 8; do if [ -s "$f" ]; then s=$(wc -c < "$f"); if [ "$s" = "$last" ]; then break; fi; last=$s; fi; sleep 5; done; [ -s "$f" ] && echo "landed=$(wc -c < "$f")" || echo "absent"'
+  return 'f="' + f + '"; last=-1; for i in 1 2 3 4 5 6 7 8; do if [ -s "$f" ]; then s=$(wc -c < "$f"); if [ "$s" = "$last" ]; then break; fi; last=$s; fi; sleep 5; done; [ -s "$f" ] && echo "landed=$(wc -c < "$f" | tr -cd 0-9)" || echo "absent"'
+}
+
+// Mirror of parseLandedProbe in harness-core/src/feature-adr-routing.ts (body-pinned by the drift
+// guard in test/feature-adr-model-routing.test.ts; backlog 1f0353f7bdb53588). The probe above writes
+// its verdict as its LAST line, so only the last non-empty line decides and it must be exactly
+// landed=<positive digits>; a landed= anywhere else in the transport agent's reply is not a landing.
+// Trailing blank lines and code-fence lines are tolerated; any other trailing text is not.
+function parseLandedProbe(raw) {
+  const lines = String(raw === null || raw === undefined ? '' : raw).split('\n').map(function (l) { return l.trim() }).filter(function (l) { return l !== '' && !/^\x60\x60\x60+[\w-]*$/.test(l) })
+  if (lines.length === 0) return { landed: false, bytes: null, reason: 'empty-agent-reply' }
+  const m = /^landed=(\d+)$/.exec(String(lines[lines.length - 1]))
+  if (m === null) return { landed: false, bytes: null, reason: 'no-landed-line' }
+  const bytes = Number(m[1])
+  if (!(bytes > 0)) return { landed: false, bytes: bytes, reason: 'zero-bytes' }
+  return { landed: true, bytes: bytes, reason: 'landed' }
+}
+// Inline coder context host contract. Pure wire validation only; filesystem IO stays in the host.
+const CODER_CONTEXT_SCHEMA = 'fa-coder-context-1'
+function coderContextCommand(repo, featureDir, tier, opts) {
+  const q = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'"
+  const absolute = (value) => {
+    if (typeof value !== 'string' || value.charAt(0) !== '/' || /(^|\/)\.\.(\/|$)/.test(value) || /[\x00-\x1f]/.test(value)) throw new Error('coder context paths must be absolute without traversal or control characters')
+    return value
+  }
+  if (['S', 'M', 'L', 'XL'].indexOf(tier) === -1) throw new Error('invalid coder context tier')
+  const script = '.claude/skills/feature-adr/scripts/build-coder-context.mjs'
+  const explicit = opts && opts.script != null ? absolute(opts.script) : null
+  const workspace = opts && opts.workspace != null ? absolute(opts.workspace) : null
+  absolute(repo)
+  const selected = featureDir.charAt(0) === '/' ? absolute(featureDir) : absolute(repo + '/' + featureDir)
+  const unavailable = JSON.stringify({ schema: CODER_CONTEXT_SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [{ source: script, reason: 'helper-missing', severity: 'error' }] })
+  return [
+    'CC_WORKSPACE=' + (workspace === null ? '$(pwd -P)' : q(workspace)) + "; CC_SCRIPT=''",
+    'CC_ONE=' + (explicit === null ? "''" : q(explicit)) + '; CC_TWO="$CC_WORKSPACE/' + script + '"; CC_THREE=' + q(repo + '/' + script),
+    'for c in "$CC_ONE" "$CC_TWO" "$CC_THREE"; do [ -n "$c" ] && [ -f "$c" ] && { CC_SCRIPT="$c"; break; }; done',
+    'if [ -n "$CC_SCRIPT" ]; then node "$CC_SCRIPT" ' + q(selected) + ' --tier=' + q(tier) + '; else printf \'%s\\n\' ' + q(unavailable) + '; printf \'coder context helper missing; tried: %s | %s | %s\\n\' "$CC_ONE" "$CC_TWO" "$CC_THREE" >&2; exit 1; fi',
+  ].join('\n')
+}
+function coderContextUtf8Bytes(value) {
+  let bytes = 0
+  for (const ch of value) { const cp = ch.codePointAt(0); bytes += cp <= 127 ? 1 : cp <= 2047 ? 2 : cp <= 65535 ? 3 : 4 }
+  return bytes
+}
+function parseCoderContextEnvelope(raw, tier) {
+  const failed = (source, reason) => ({ schema: CODER_CONTEXT_SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [{ source: source, reason: reason, severity: 'error' }] })
+  if (typeof raw !== 'string' || coderContextUtf8Bytes(raw) > 2 * 1024 * 1024) return failed('relay', 'invalid-envelope')
+  let value
+  try { value = JSON.parse(raw) } catch (_) { return failed('relay', 'invalid-json') }
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.schema !== CODER_CONTEXT_SCHEMA || ['complete', 'incomplete', 'unavailable'].indexOf(value.status) === -1 || typeof value.promptBlock !== 'string' || !Array.isArray(value.sources) || !Array.isArray(value.diagnostics)) return failed('relay', 'invalid-envelope')
+  const hash = (v) => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v)
+  if (!(value.digest === null || hash(value.digest)) || coderContextUtf8Bytes(value.promptBlock) > 96 * 1024 || value.sources.length > 64 || value.diagnostics.length > 256) return failed('relay', 'invalid-envelope')
+  const seen = new Set()
+  let total = 0
+  for (const source of value.sources) {
+    if (!source || typeof source !== 'object' || typeof source.path !== 'string' || source.path.length > 512 || seen.has(source.path) || /[\x00-\x1f]/.test(source.path)) return failed('relay', 'invalid-source')
+    const kind = source.path === '01_requirements.md' ? 'requirements' : source.path === '06_implementation_plan.md' ? 'plan' : /^03_adr\/[0-9]{3}-[^/\\\x00-\x1f]+\.md$/.test(source.path) || source.path === '03_adr' ? 'adr' : null
+    if (kind === null || source.kind !== kind || !Number.isInteger(source.bytes) || source.bytes < 0 || ['read', 'missing', 'unreadable', 'invalid', 'oversized'].indexOf(source.status) === -1 || !(source.digest === null || hash(source.digest))) return failed(source.path, 'invalid-source')
+    if (source.status === 'read' && (!hash(source.digest) || source.bytes > 256 * 1024 || source.path === '03_adr')) return failed(source.path, 'invalid-source')
+    seen.add(source.path); total += source.bytes
+  }
+  const reasons = ['invalid-tier', 'invalid-source', 'duplicate-source', 'document-limit', 'file-limit', 'aggregate-limit', 'unclosed-fence', 'unclosed-comment', 'empty-section', 'duplicate-section', 'missing-section', 'missing-source', 'prompt-limit', 'invalid-root', 'invalid-file', 'outside-root', 'read-failure', 'invalid-utf8', 'invalid-arguments', 'helper-missing']
+  for (const d of value.diagnostics) {
+    if (!d || typeof d !== 'object' || typeof d.source !== 'string' || d.source.length > 4096 || reasons.indexOf(d.reason) === -1 || ['error', 'warning'].indexOf(d.severity) === -1 || (d.section !== undefined && typeof d.section !== 'string')) return failed('relay', 'invalid-diagnostic')
+  }
+  if (value.status === 'complete') {
+    if (!hash(value.digest) || !value.promptBlock.trim() || total > 1024 * 1024 || value.diagnostics.some((d) => d.severity === 'error') || value.sources.some((s) => s.status !== 'read' || s.bytes === 0)) return failed('relay', 'contradictory-complete')
+    for (const path of ['01_requirements.md', '06_implementation_plan.md']) if (!seen.has(path)) return failed(path, 'missing-source')
+    if (tier !== 'S' && !value.sources.some((s) => s.kind === 'adr')) return failed('03_adr', 'missing-source')
+  }
+  return value
 }
 
 // ── K2 plan-completeness gate (feature fa-plan-gate-wiring) ────────────────────────────────────
@@ -3885,7 +3957,7 @@ async function designStage(promptText, opts, artifactPath, baseLabel) {
   const designRungHolder = newRung()
   const res = await safeCodexAgent(promptText + codexEffortHint(codexOpts) + ' IMPORTANT: run the Codex task in FOREGROUND (synchronous — do NOT pass --background) so this call blocks until the file is fully written to disk.', codexOpts, designRungHolder)
   const probe = await dispatchAgent(newRung(), 'Confirm a Codex OUT-OF-BAND artifact write has LANDED before the next stage reads it. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + landedProbeCmd(artifactPath), { label: 'design:confirm-landed', phase: 'Design', effort: 'low' })
-  if (res && probe && /landed=/.test(String(probe))) return { wrote: [artifactPath], summary: String(res).slice(0, 300) }
+  if (res && probe && parseLandedProbe(probe).landed) return { wrote: [artifactPath], summary: String(res).slice(0, 300) }
   log('design artifact did not land on codex (' + artifactPath + ') — falling back to Claude')
   const fallbackOpts = {}
   // R18: ONE mapping for the whole class. The boolean below still writes the provenance TEXT (a
@@ -4605,7 +4677,7 @@ if (registryOutcome !== 'unverified') registryOutcome = designIncompleteOutcome
 phase('Plan')
 await recordRegistryEvent('heartbeat', 'Plan')
 await usageProbe('Plan')
-const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for "' + DESC + '" (' + SLUG + ', tier ' + tier + '). READ THESE INPUTS FIRST, by name: ' + FDIR + '/01_requirements.md, every ' + FDIR + '/03_adr/NNN-*.md, ' + FDIR + '/05_architecture.md, and ' + FDIR + '/03.5_ideation_report.md / ' + FDIR + '/04_domain_model.md when present. Then decompose into milestones + concrete tasks with success metrics. Write ' + FDIR + '/06_implementation_plan.md. END the plan with a trailing `EXPECTED_CODE_TARGETS:` block listing, one per line as `- <repo-relative path>`, EVERY production/test/config/doc file Step 7 is expected to create or modify. This block is machine-read by the Step-7.5 landing barrier: only paths it ESTABLISHES can ever count as landed, so an absent or unpollable block makes the barrier verdict INCONCLUSIVE. List only real targets outside features/, .dz/, .agentic-qe/ and roam/. The K2 plan-completeness gate blocks Step 7 until the plan satisfies these too, so write them in as you author, not afterwards: (C1) every ADR under 03_adr/ is cited as `ADR-<n>` by the task that implements it; (C2) every test path named in an ADR Confirmation stanza appears verbatim in the plan, bound to the task that writes it; (C4) every acid token `A<n>` from 00_complexity_assessment.md is named verbatim, bound to its owning task and to the test that proves the refusal. (C8) every requirement id declared in 01_requirements.md (FR-N, NFR-N, AC-N, C-N) is cited by the task that covers it. If any corrections from Step 3.5 (a CONDITIONAL verdict) or other sources are folded into this plan, carry them in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + ABSOLUTE_PATH_NOTE + WRITE_DISCIPLINE
+const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for "' + DESC + '" (' + SLUG + ', tier ' + tier + '). READ THESE INPUTS FIRST, by name: ' + FDIR + '/01_requirements.md, every ' + FDIR + '/03_adr/NNN-*.md, ' + FDIR + '/05_architecture.md, and ' + FDIR + '/03.5_ideation_report.md / ' + FDIR + '/04_domain_model.md when present. Then decompose into milestones + concrete tasks with success metrics. Write ' + FDIR + '/06_implementation_plan.md. END the plan with a trailing `EXPECTED_CODE_TARGETS:` block listing, one per line as `- <repo-relative path>`, EVERY production/test/config/doc file Step 7 is expected to create or modify. This block is machine-read by the Step-7.5 landing barrier: only paths it ESTABLISHES can ever count as landed, so an absent or unpollable block makes the barrier verdict INCONCLUSIVE. List only real targets outside features/, .dz/, .agentic-qe/ and roam/. The K2 plan-completeness gate blocks Step 7 until the plan satisfies these too, so write them in as you author, not afterwards: (C1) every ADR under 03_adr/ is cited as `ADR-<n>` by the task that implements it; (C2) every test path named in an ADR Confirmation stanza appears verbatim in the plan, bound to the task that writes it; (C4) every acid token `A<n>` from 00_complexity_assessment.md is named verbatim, bound to its owning task and to the test that proves the refusal. (C8) every requirement id declared in 01_requirements.md (FR-N, NFR-N, AC-N, C-N) is cited by the task that covers it. For C1/C8 an id counts ONLY on the first line of a heading, list item or table row (not prose, not fenced code). If any corrections from Step 3.5 (a CONDITIONAL verdict) or other sources are folded into this plan, carry them in a `## Amendments` section. ' + AMENDMENT_RULE + ' Return wrote[] + summary.' + ABSOLUTE_PATH_NOTE + WRITE_DISCIPLINE
 const planContext = buildDecisionContext({ slug: SLUG, decisionKind: 'plan-route-selection', description: DESC, tier: tier, codeHint: CODE_HINT, upstreamDigest: fnv1a64(JSON.stringify(design === undefined ? null : design)) })
 let planRecallCapture = { promptBlock: '', selected: [] }
 // Resolve the plan model. args.models.plan wins; else the planner:'codex' knob (via routingRequested +
@@ -4638,7 +4710,7 @@ if (planIsCodex) {
   // Codex-landed barrier for the plan artifact: a stub return is NOT proof the file was written
   // (codex writes out-of-band). Require the artifact to LAND; otherwise fall through to the Claude planner.
   const planLanded = codexPlan ? await dispatchAgent(newRung(), 'Confirm the Codex plan write has LANDED. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + landedProbeCmd(FDIR + '/06_implementation_plan.md'), { label: 'plan:confirm-landed', phase: 'Plan', effort: 'low' }) : null
-  if (codexPlan && planLanded && /landed=/.test(String(planLanded))) {
+  if (codexPlan && planLanded && parseLandedProbe(planLanded).landed) {
     plan = { wrote: [FDIR + '/06_implementation_plan.md'], summary: String(codexPlan).slice(0, 500), planner: 'codex' }
     log('Plan: Codex (top model) — artifact landed')
   } else {
@@ -4837,7 +4909,7 @@ if (plan && planGate.verdict === 'fail' && planGate.reason === 'script-verdict')
       // Codex writes out-of-band, so a stub return is not proof of landing — reuse the SAME
       // landed-barrier probe the first Codex plan dispatch used (landedProbeCmd), not a copy of it.
       const repairLanded = codexRepair ? await dispatchAgent(newRung(), 'Confirm the Codex plan-repair write has LANDED. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + landedProbeCmd(FDIR + '/06_implementation_plan.md'), { label: 'plan:repair-confirm-landed', phase: 'Plan', effort: 'low' }) : null
-      if (codexRepair && repairLanded && /landed=/.test(String(repairLanded))) repaired = { wrote: [FDIR + '/06_implementation_plan.md'], summary: String(codexRepair).slice(0, 500) }
+      if (codexRepair && repairLanded && parseLandedProbe(repairLanded).landed) repaired = { wrote: [FDIR + '/06_implementation_plan.md'], summary: String(codexRepair).slice(0, 500) }
     } else {
       const repairClaudeModel = planIsCodex ? {} : planModel
       const repairClaudeOpts = mergeOpts({ label: stageLabel(planIsCodex ? 'plan:repair-claude-fb' : 'plan:repair', repairClaudeModel), phase: 'Plan', schema: ARTIFACT, _stage: 'plan-repair', _reason: 'plan-repair' }, repairClaudeModel)
@@ -5021,7 +5093,22 @@ await usageProbe('Code')
 // nothing; every hand-dispatched round that carried this preamble landed code. The routing is
 // decided before this prompt exists, so saying so is the whole fix.
 const codePromptBase = 'GATE-ANSWERED — the routing questions are already settled and must NOT be asked again: the mode and the coder family were chosen before this dispatch, you ARE the coder, and an independent cross-family QE runs after you. This dispatch is non-interactive: asking a question and exiting returns exit 0 with nothing written, which is indistinguishable from a crash to everything downstream. FIRST, via Bash run EXACTLY `mkdir -p ' + FDIR + '/.fa-state && git -C ' + REPO + ' rev-parse HEAD > "' + FDIR + '/.fa-state/base-ref.tmp" && mv "' + FDIR + '/.fa-state/base-ref.tmp" "' + FDIR + '/.fa-state/base-ref"` — an atomic record of HEAD before your changes; Step 8 scopes `--added-since` on it (AM-2). Begin implementing immediately.\n\nStep 7 (Code) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ THESE INPUTS FIRST, by name (0691e163: the coder used to get one directory pointer; measured over three real runs, the plan was opened by all coders but the ADR unevenly and requirements/domain model not at all): ' + FDIR + '/06_implementation_plan.md (the tasks + EXPECTED_CODE_TARGETS + Amendments), every ' + FDIR + '/03_adr/NNN-*.md (each names a load-bearing property and its Required automated check), ' + FDIR + '/05_architecture.md, ' + FDIR + '/01_requirements.md, and ' + FDIR + '/04_domain_model.md when present (L/XL). Then implement the feature. Write the ACTUAL production code + its tests (mirror the closest existing implementation named in research/architecture). If the plan carries a `## Amendments` section, implement every AM-N row AND its named Confirmation test (for a safeguard amendment: a test proving it FIRES on a real input). IO-ON-PURE-PATH RULE: if your diff adds I/O (DB/network/file) to a previously-pure path — especially a startup/lifespan/health path — also write a NEGATIVE resource-down test (broken/unbound resource handle → the path degrades per its declared contract: fail-open for an advisory feature, explicit fail-fast for a load-bearing one) alongside the happy-path test; never fix a failing test by swapping a broken fixture for a healthy one without keeping BOTH cases. Follow repo conventions; build must pass. Write a change manifest ' + FDIR + '/07_code_changes/change_manifest.md listing every file touched. Return wrote[] (incl. real source files) + summary.' + ABSOLUTE_PATH_NOTE + PS_GUIDANCE('code')
-let codePrompt = codePromptBase
+// Read current documents on EVERY invocation, before lookup, using one captured host snapshot.
+let coderContextSnapshot
+try {
+  const contextCommand = coderContextCommand(REPO, FDIR, tier, { script: A.coderContextScript, workspace: WS === null ? undefined : WS })
+  const contextRaw = await dispatchAgent(newRung(), 'Run EXACTLY this shell snippet via Bash as ONE command. Return stdout VERBATIM as the single JSON envelope, with no narration or fences. Preserve command exit status; never synthesize a complete result:\n' + contextCommand, { label: 'code:context', phase: 'Code', effort: 'low' })
+  coderContextSnapshot = parseCoderContextEnvelope(contextRaw, tier)
+} catch (_) {
+  coderContextSnapshot = { schema: CODER_CONTEXT_SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [{ source: 'host-command', reason: 'read-failure', severity: 'error' }] }
+}
+if (coderContextSnapshot.status !== 'complete') {
+  log('Step 7 refused: required coder context ' + coderContextSnapshot.status + ': ' + JSON.stringify(coderContextSnapshot.diagnostics))
+  return { tier: tier, phase: 'code-context-failed', outcome: 'unverified', slug: SLUG, artifactsDir: FDIR, coderContext: coderContextSnapshot, gates: { code: 'not-run', qe: 'not-run' }, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', note: 'Required current coder context was not established; no code checkpoint lookup, decision recall or coder dispatch occurred.' }
+}
+const coderContextFingerprint = fnv1a64(coderContextSnapshot.promptBlock)
+const coderContextMetadata = { schema: coderContextSnapshot.schema, digest: coderContextSnapshot.digest, promptFingerprint: coderContextFingerprint }
+let codePrompt = codePromptBase + coderContextSnapshot.promptBlock
 // Resolve the coder model. args.models.code wins (a direct 'codex' spec = codex-first); else the legacy
 // CODER knob drives it (with its codex-fallback null-guard). resolveStageModel('code') folds both via the
 // code:null sentinel → resolveCoderSpec(). A Claude resolution merges {model} onto the Claude branch;
@@ -5042,7 +5129,7 @@ const codeClaudeOpts = mergeOpts({ label: stageLabel('code', codeClaudeModel), p
 // the checkpoint (it only feeds the expected-targets parse, already consumed by the original run).
 // R6: the landing token is salted into the code stage's PARTS (not CKPT_SCHEMA_VERSION, which
 // stays 'fa-ckpt-2' deliberately) so ONLY this stage's pre-protocol checkpoints hash stale.
-const codeHash = ckptHash('code', [tier, DESC, fnv1a64(JSON.stringify(plan === undefined ? null : plan)), CODER, MODELS.code === undefined ? null : MODELS.code, CODEX_MODEL, PRIMARY, BUDGET_MODE, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, LANDING_HASH_TOKEN])
+const codeHash = ckptHash('code', [tier, DESC, fnv1a64(JSON.stringify(plan === undefined ? null : plan)), CODER, MODELS.code === undefined ? null : MODELS.code, CODEX_MODEL, PRIMARY, BUDGET_MODE, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, LANDING_HASH_TOKEN, coderContextSnapshot.digest, coderContextFingerprint])
 const codeComposite = await withCheckpoint('code', 'Code', codeHash, async () => {
 let code = null
 let coderUsed = 'claude'
@@ -5052,7 +5139,7 @@ let codexJobId = null
 let baselineCapture = null
 const codeContext = buildDecisionContext({ slug: SLUG, decisionKind: 'code-implementation', description: DESC, tier: tier, codeHint: CODE_HINT, upstreamDigest: fnv1a64(JSON.stringify(plan === undefined ? null : plan)) })
 const codeRecall = await prepareDecisionRecall(codeContext, 'Code', 'decision-recall:step7')
-codePrompt = codePromptBase + codeRecall.promptBlock
+codePrompt = codePromptBase + coderContextSnapshot.promptBlock + codeRecall.promptBlock
 if (!codeIsCodexFirst) {
   // R14-1: claimed at DISPATCH. The later `return null` exits only this withCheckpoint CALLBACK — the
   // run continues and can return `completed-unverified`, so a success-only write left the report with
@@ -5200,12 +5287,12 @@ if (needsCodeLandedBarrier(coderUsed)) {
 }
 const codeStageResult = { code: code, coderUsed: coderUsed, codexCodeText: String(codexCodeText).slice(0, 4000), codexJobId: codexJobId, modelUsed: modelsUsed.code, landedNote: landedNote, landingStatus: landingStatus, landingProtocol: LANDING_PROTOCOL_VERSION, scrapeDiagnostic: scrapeDiagnostic, expectedTargets: expectedTargets }
 if (landingReason !== null) codeStageResult.landingReason = landingReason
-return { stageResult: codeStageResult, decisionRecall: codeRecall }
-}, { validate: function (value) { return !!value && typeof value === 'object' && value.stageResult !== null && value.stageResult !== undefined && codeStageResultShapeValid(value.stageResult) && value.decisionRecall && typeof value.decisionRecall.promptBlock === 'string' }, persist: function (r) { return codeCheckpointPersistAllowed(r.stageResult.landingStatus, needsCodeLandedBarrier(r.stageResult.coderUsed)) } })
+return { stageResult: codeStageResult, decisionRecall: codeRecall, coderContext: coderContextMetadata }
+}, { validate: function (value) { return !!value && typeof value === 'object' && value.stageResult !== null && value.stageResult !== undefined && codeStageResultShapeValid(value.stageResult) && value.decisionRecall && typeof value.decisionRecall.promptBlock === 'string' && value.coderContext && value.coderContext.schema === coderContextMetadata.schema && value.coderContext.digest === coderContextMetadata.digest && value.coderContext.promptFingerprint === coderContextMetadata.promptFingerprint }, persist: function (r) { return codeCheckpointPersistAllowed(r.stageResult.landingStatus, needsCodeLandedBarrier(r.stageResult.coderUsed)) } })
 let codeStage = null
 if (codeComposite && typeof codeComposite === 'object') {
   codeStage = codeComposite.stageResult
-  codePrompt = codePromptBase + (codeComposite.decisionRecall && typeof codeComposite.decisionRecall.promptBlock === 'string' ? codeComposite.decisionRecall.promptBlock : '')
+  codePrompt = codePromptBase + coderContextSnapshot.promptBlock + (codeComposite.decisionRecall && typeof codeComposite.decisionRecall.promptBlock === 'string' ? codeComposite.decisionRecall.promptBlock : '')
 }
 let code = codeStage ? codeStage.code : null
 coderUsed = codeStage ? codeStage.coderUsed : 'claude'