@gajae-code/coding-agent 0.8.0 → 0.8.2

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -70,19 +70,22 @@ The consensus workflow:
    - If only one viable option remains, explicit invalidation rationale for alternatives
    - Deliberate mode only: pre-mortem (3 scenarios) + expanded test plan (unit/integration/e2e/observability)
 2. **User feedback** *(--interactive only)*: If `--interactive` is set, use the `ask` tool to present the draft plan **plus the Principles / Drivers / Options summary** before review (Proceed to review / Request changes / Skip review). Otherwise, automatically proceed to review.
-3. **Architect** reviews for architectural soundness and must provide the strongest steelman antithesis, at least one real tradeoff tension, and (when possible) synthesis — **await completion before step 4**. In deliberate mode, Architect should explicitly flag principle violations.
+3. **Review fan-out after Planner persistence**: after the Planner stage is persisted, launch fresh Architect and Critic review lanes against the same immutable Planner receipt/path/sha/stage_n when the Critic lane is **plan-only** and does not consume Architect output.
+   - **Architect lane**: Architect reviews for architectural soundness and must provide the strongest steelman antithesis, at least one real tradeoff tension, and (when possible) synthesis. In deliberate mode, Architect should explicitly flag principle violations.
    - The Architect agent/subagent must persist its review with `gjc ralplan --write --stage architect --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`CLEAR`/`WATCH`/`BLOCK`, `APPROVE`/`COMMENT`/`REQUEST CHANGES`) instead of pasting the full review body.
-4. **Critic** evaluates against quality criteria — run only after step 3 completes. Critic must enforce principle-option consistency, fair alternatives, risk mitigation clarity, testable acceptance criteria, and concrete verification steps. In deliberate mode, Critic must reject missing/weak pre-mortem or expanded test plan.
+   - **Plan-only Critic lane**: Critic evaluates the Planner artifact against quality criteria independently of Architect output. It must enforce principle-option consistency, fair alternatives, risk mitigation clarity, testable acceptance criteria, and concrete verification steps. In deliberate mode, Critic must reject missing/weak pre-mortem or expanded test plan.
    - The Critic agent/subagent must persist its evaluation with `gjc ralplan --write --stage critic --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`OKAY`/`ITERATE`/`REJECT`) instead of pasting the full evaluation body.
-5. **Re-review loop** (max 5 iterations): Any non-`OKAY` Critic verdict (`ITERATE` or `REJECT`) MUST run the same full closed loop:
+   - **Sequential fallback**: when Critic must evaluate Architect findings, verdict, antithesis, tradeoffs, synthesis, architectural status, or any other Architect-produced artifact, await the Architect result before issuing that Architect-dependent Critic pass.
+4. **Review join gate**: before consensus, revision, reconciliation, finalization, or approval, verify both Architect and Critic receipts/verdicts exist for the same Planner artifact/pass (`path`, `sha256`, `stage_n`). A non-`CLEAR` Architect verdict, non-`APPROVE` Architect decision, or any non-`OKAY` Critic verdict routes back to Planner revision; do not finalize from only one review lane.
+5. **Re-review loop** (max 5 iterations): Any non-`OKAY` Critic verdict (`ITERATE` or `REJECT`) or Architect result that is not `CLEAR`/`APPROVE` MUST run the same full closed loop:
    a. Collect Architect + Critic feedback
    b. Revise the plan by resuming the SAME persisted Planner subagent with consolidated Architect + Critic feedback (see **Persisted Planner** below); fall back to a fresh Planner spawn only per the fallback routing table
-   c. Return to Architect review
+   c. Return to the review fan-out or sequential fallback path above
       - Persist each Planner revision with `gjc ralplan --write --stage revision --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json` before re-review, then pass the receipt/path forward instead of duplicating the full revision markdown in the parent conversation.
-   d. Return to Critic evaluation
-   e. Repeat this loop until Critic returns `OKAY` or 5 iterations are reached
-   f. If 5 iterations are reached without `OKAY`, present the best version to the user
-6. **Post-ralplan interview** (intent reconciliation gate): After Critic returns `OKAY` and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
+   d. Re-join Architect and Critic verdicts for the same revised Planner artifact/pass
+   e. Repeat this loop until Critic returns `OKAY` **and** Architect is `CLEAR`/`APPROVE` for the same Planner artifact/pass, or 5 iterations are reached
+   f. If 5 iterations are reached without Critic `OKAY` plus Architect `CLEAR`/`APPROVE`, present the best version to the user
+6. **Post-ralplan interview** (intent reconciliation gate): After the review join gate has both Critic `OKAY` and Architect `CLEAR`/`APPROVE` for the same Planner artifact/pass, and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
    a. **Collect open items** from the run: every assumption the Planner/Architect/Critic resolved by assumption rather than by stated fact, every ambiguity flagged during review, and every decision the loop made without explicit user input. Source these from the persisted `planner`/`architect`/`critic`/`revision` stage artifacts, not from memory.
    b. **Cross-check prior context for conflicts**: glob `.gjc/_session-{sessionid}/specs/deep-interview-*.md` and other prior specs/plans/context relevant by topic. For each, list points where the consensus plan contradicts, weakens, or expands beyond a previously crystallized decision, constraint, or non-goal. Cite the conflicting artifact and line/section.
    c. **Reconcile with the user via the `ask` tool (always, regardless of `--interactive`)**: Never stop idle with plain-text prose after the consensus loop. Every reconciliation question MUST go through the `ask` tool with contextual options plus free-text.
@@ -90,7 +93,7 @@ The consensus workflow:
       - If the plan is crystal clear (no open assumptions or prior-context conflicts), skip straight to the step 8 final-options `ask` instead of inventing filler questions.
       - For every confirmed open item, embed the resolved outcome into the final plan under an **## Intent Reconciliation** section so the `pending approval` artifact records each decision; record any item the user explicitly defers as an open confirmation under that same section.
    d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
-7. On reconciliation completion, mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
+7. On reconciliation completion, re-check the review join gate (Critic `OKAY` plus Architect `CLEAR`/`APPROVE` for the same Planner artifact/pass), mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
 8. **Always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
    - **Refine further** — re-run the consensus loop / request changes, then return here
    - **Approve execution via ultragoal (Recommended)** — goal-tracked autonomous execution
@@ -108,13 +111,14 @@ The consensus workflow:
 
    The skill tool then dispatches the execution skill same-turn and runs `gjc state ralplan handoff --to <team|ultragoal> --json` in-process to atomically demote ralplan, promote the callee, and sync `.gjc/_session-{sessionid}/state/skill-active-state.json`. You do not need to run the handoff verb yourself.
 
-> **Important:** Steps 3 and 4 MUST run sequentially. Do NOT issue both agent Task calls in the same parallel batch. Always await the Architect result before issuing the Critic Task.
+> **Important:** Architect and Critic MAY run in the same parallel batch only for the plan-only Critic lane after Planner persistence. Any Architect-dependent Critic pass MUST remain sequential: await Architect before issuing Critic, then apply the same review join gate before consensus.
+
 
 Follow the Plan skill's full documentation for consensus mode details.
 
 ### Persisted Planner (consensus loop)
 
-The Planner is a **same-session persisted subagent**: launched detached once, awaited before the Architect, then **resumed** with consolidated Architect + Critic feedback on every re-review pass instead of being re-spawned. The Architect and Critic stay **fresh, independent spawns each pass** so their verdicts remain reproducible from their pass artifacts alone. Do NOT modify the subagent control surface; this orchestration uses the existing `subagent` resume/steer controls only.
+The Planner is a **same-session persisted subagent**: launched detached once, awaited before review fan-out, then **resumed** with consolidated Architect + Critic feedback on every re-review pass instead of being re-spawned. The Architect and Critic stay **fresh, independent spawns each pass** so their verdicts remain reproducible from their pass artifacts alone; the Critic may run in parallel only when it is plan-only and tied to the same Planner receipt/path/sha/stage_n as Architect. Do NOT modify the subagent control surface; this orchestration uses the existing `subagent` resume/steer controls only.
 
 **Persistence boundary:** this is same-parent, active-session continuity only. Resumability depends on the manager's retained subagent resume metadata and a persistent parent session (an in-memory parent yields `resumable:false`), not just the `.gjc` run-state record. A terminal subagent whose live job record was evicted can still be resumed when its retained resume descriptor points at a saved subagent session file. After a process restart, missing resume metadata, or any unavailable/failed resume, use the fresh Planner fallback.
 

package/src/defaults/gjc/skills/team/SKILL.md

@@ -112,7 +112,7 @@ Before launching `gjc team`, require a grounded context snapshot:
    - unknowns/open questions
    - likely codebase touchpoints
 4. If ambiguity remains high, gather brownfield facts with focused repo inspection or a canonical read-only role agent first, then run `$deep-interview --quick <task>` before team launch.
-5. If current correctness depends on official docs, version-aware framework guidance, best practices, or external dependency behavior, auto-delegate `researcher` as an evidence lane before or alongside worker launch instead of relying on repo-local recall alone.
+5. If current correctness depends on official docs, version-aware framework guidance, best practices, or external dependency behavior, gather evidence before or alongside worker launch using supported surfaces only: focused repo inspection for local facts, `planner` for broad context mapping/sequencing, `architect` for architecture or external-doc-risk assessment, and direct web/search tools when configured.
 
 Do not start the worker pane until this gate is satisfied; if forced to proceed quickly, state explicit scope/risk limitations in the launch report.
 

package/src/extensibility/extensions/runner.ts

@@ -205,6 +205,7 @@ export class ExtensionRunner {
 		private readonly cwd: string,
 		private readonly sessionManager: SessionManager,
 		private readonly modelRegistry: ModelRegistry,
+		private readonly sessionMetadata?: ExtensionContext["sessionMetadata"],
 	) {
 		this.#uiContext = noOpUIContext;
 	}
@@ -458,6 +459,7 @@ export class ExtensionRunner {
 			hasUI: this.hasUI(),
 			cwd: this.cwd,
 			sessionManager: this.sessionManager,
+			sessionMetadata: this.sessionMetadata,
 			modelRegistry: this.modelRegistry,
 			get model() {
 				return getModel();

package/src/extensibility/extensions/types.ts

@@ -285,6 +285,13 @@ export interface CompactOptions {
 	onError?: (error: Error) => void;
 }
 
+export interface ExtensionSessionMetadata {
+	kind: "main" | "sub";
+	taskDepth: number;
+	parentTaskPrefix?: string;
+	currentAgentType?: string;
+}
+
 /**
  * Context passed to extension event handlers.
  */
@@ -306,6 +313,8 @@ export interface ExtensionContext {
 	cwd: string;
 	/** Session manager (read-only) */
 	sessionManager: ReadonlySessionManager;
+	/** Session classification supplied by the SDK for extension policy decisions. */
+	sessionMetadata?: ExtensionSessionMetadata;
 	/** Model registry for API key resolution */
 	modelRegistry: ModelRegistry;
 	/** Current model (may be undefined) */

package/src/extensibility/skills.ts

@@ -326,12 +326,28 @@ interface SkillTokenMatch {
 	skill: Skill;
 }
 
+function buildInlineSkillInvocationArgs(text: string, matches: readonly SkillTokenMatch[]): string {
+	const pieces: string[] = [];
+	let cursor = 0;
+	for (const match of matches) {
+		pieces.push(text.slice(cursor, match.index));
+		cursor = match.end;
+	}
+	pieces.push(text.slice(cursor));
+	return pieces
+		.join("")
+		.replace(/[ \t]{2,}/g, " ")
+		.replace(/[ \t]+\n/g, "\n")
+		.replace(/\n[ \t]+/g, "\n")
+		.trim();
+}
+
 export function parseSkillInvocations(
 	text: string,
 	skillsByCommandName: ReadonlyMap<string, Skill>,
 ): ParsedSkillInvocation[] {
 	const trimmedText = text.trim();
-	if (!trimmedText.startsWith("/")) return [];
+	if (!trimmedText) return [];
 	const canonicalSkillCommandPattern = /(^|\s)\/(skill:[^\s]+)/g;
 	const matches: SkillTokenMatch[] = [];
 	for (const match of trimmedText.matchAll(canonicalSkillCommandPattern)) {
@@ -348,7 +364,19 @@ export function parseSkillInvocations(
 			skill,
 		});
 	}
-	if (matches.length === 0 || matches[0]?.index !== 0) return [];
+	if (matches.length === 0) return [];
+	if (matches[0]?.index !== 0) {
+		// Preserve leading slash-command semantics: `/skill:unknown /skill:alpha`
+		// should remain plain text rather than silently skipping the unknown
+		// leading command and invoking the later known one.
+		if (trimmedText.startsWith("/")) return [];
+		const args = buildInlineSkillInvocationArgs(trimmedText, matches);
+		return matches.map(match => ({
+			commandName: match.commandName,
+			args,
+			skill: match.skill,
+		}));
+	}
 	return matches.map((match, index) => {
 		const next = matches[index + 1];
 		return {

package/src/gjc-runtime/deep-interview-ambiguity.ts

@@ -0,0 +1,206 @@
+import {
+	type DeepInterviewEstablishedFact,
+	type DeepInterviewRoundRecord,
+	type DeepInterviewStateEnvelope,
+	normalizeDeepInterviewEnvelope,
+} from "./deep-interview-state";
+
+/**
+ * Deterministic ambiguity floor for deep-interview.
+ *
+ * The interview's ambiguity score is reported by an LLM scorer, which anchors on
+ * prior scores and under-reports rises when the user pivots or contradicts earlier
+ * answers. Following the Ouroboros `max(llm_score, deterministic_floor(ledger))`
+ * principle, this pure leaf module computes a code-level lower bound from evidence
+ * already persisted in deep-interview state, so the reported score can never fall
+ * below what code can objectively measure:
+ *
+ * - `0.10` per established fact marked disputed with no `superseded_by` resolution
+ *   (contradiction pressure — a pivot keeps ambiguity elevated until resolved);
+ * - `0.05` per active topology component whose goal/constraints/criteria clarity
+ *   is still unscored (gap pressure — a sibling component cannot hide);
+ * - `0.05 × (auto-answered rounds / scored rounds)` (assumption dilution).
+ *
+ * Like `deep-interview-state`, this module MUST stay pure and dependency-free
+ * (no filesystem, no state-writer, no CLI runtime) so every writer can apply it.
+ */
+
+// =============================================================================
+// Weights (mirrors the Ouroboros deterministic_floor coefficients)
+// =============================================================================
+
+const DISPUTED_FACT_WEIGHT = 0.1;
+const UNSCORED_COMPONENT_WEIGHT = 0.05;
+const AUTO_ANSWER_DILUTION_WEIGHT = 0.05;
+
+const CORE_CLARITY_DIMENSIONS = ["goal", "constraints", "criteria"] as const;
+
+export interface AmbiguityFloorBreakdown {
+	floor: number;
+	disputed_fact_count: number;
+	unscored_active_component_count: number;
+	auto_answer_ratio: number;
+}
+
+export interface AmbiguityClampResult {
+	effective: number;
+	clamped: boolean;
+}
+
+// =============================================================================
+// Pure helpers
+// =============================================================================
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function asArray(value: unknown): unknown[] {
+	return Array.isArray(value) ? value : [];
+}
+
+function round2(value: number): number {
+	return Math.round(value * 100) / 100;
+}
+
+/** A disputed fact contributes pressure until it is resolved via `superseded_by` or re-confirmation. */
+function isUnresolvedDisputedFact(value: unknown): boolean {
+	if (!isPlainObject(value)) return false;
+	const fact = value as Partial<DeepInterviewEstablishedFact>;
+	if (fact.disputed !== true) return false;
+	return typeof fact.superseded_by !== "string" || fact.superseded_by.trim() === "";
+}
+
+/**
+ * An active component is unscored while any core clarity dimension lacks a finite
+ * numeric score. Deferred components are excluded (they are outside ambiguity math),
+ * and the gate only arms once the topology was explicitly confirmed in Round 0.
+ */
+function countUnscoredActiveComponents(topology: unknown): number {
+	if (!isPlainObject(topology) || topology.status !== "confirmed") return 0;
+	let unscored = 0;
+	for (const component of asArray(topology.components)) {
+		if (!isPlainObject(component) || component.status === "deferred") continue;
+		const clarity = isPlainObject(component.clarity_scores) ? component.clarity_scores : {};
+		const incomplete = CORE_CLARITY_DIMENSIONS.some(dimension => {
+			const score = clarity[dimension];
+			return typeof score !== "number" || !Number.isFinite(score);
+		});
+		if (incomplete) unscored += 1;
+	}
+	return unscored;
+}
+
+function autoAnswerRatio(inner: Record<string, unknown>): number {
+	const autoAnswered = asArray(inner.auto_answered_rounds).length;
+	if (autoAnswered === 0) return 0;
+	const scored = asArray(inner.rounds).filter(round => isPlainObject(round) && round.lifecycle === "scored").length;
+	return Math.min(1, autoAnswered / Math.max(scored, 1));
+}
+
+// =============================================================================
+// Floor computation + clamping
+// =============================================================================
+
+/** Compute the deterministic floor from the inner deep-interview `state` object. */
+export function computeAmbiguityFloor(inner: unknown): AmbiguityFloorBreakdown {
+	const state = isPlainObject(inner) ? inner : {};
+	const disputedFactCount = asArray(state.established_facts).filter(isUnresolvedDisputedFact).length;
+	const unscoredActiveComponentCount = countUnscoredActiveComponents(state.topology);
+	const ratio = autoAnswerRatio(state);
+	const floor =
+		DISPUTED_FACT_WEIGHT * disputedFactCount +
+		UNSCORED_COMPONENT_WEIGHT * unscoredActiveComponentCount +
+		AUTO_ANSWER_DILUTION_WEIGHT * ratio;
+	return {
+		floor: round2(Math.min(1, Math.max(0, floor))),
+		disputed_fact_count: disputedFactCount,
+		unscored_active_component_count: unscoredActiveComponentCount,
+		auto_answer_ratio: round2(ratio),
+	};
+}
+
+/** Clamp an LLM-reported ambiguity to the deterministic floor: `max(reported, floor)`. */
+export function clampReportedAmbiguity(reported: number, floor: number): AmbiguityClampResult {
+	const bounded = Math.min(1, Math.max(0, reported));
+	if (floor > bounded) return { effective: Math.min(1, floor), clamped: true };
+	return { effective: bounded, clamped: false };
+}
+
+/**
+ * Mark every established fact recorded in `retractedRound` as disputed. This is the
+ * mechanical contradiction signal for answer retraction: when the user replaces an
+ * already-scored answer (A -> B pivot), the facts that answer established can no
+ * longer be trusted, so they raise the floor until re-confirmed or superseded.
+ * Returns new arrays/objects; never mutates the input.
+ */
+export function disputeFactsFromRetractedRound(
+	facts: readonly unknown[],
+	retractedRound: number,
+): { facts: Record<string, unknown>[]; disputedIds: string[] } {
+	const disputedIds: string[] = [];
+	const next = facts.filter(isPlainObject).map(fact => {
+		const record = fact as Record<string, unknown>;
+		if (record.round !== retractedRound || record.disputed === true) return { ...record };
+		if (typeof record.superseded_by === "string" && record.superseded_by.trim() !== "") return { ...record };
+		if (typeof record.id === "string") disputedIds.push(record.id);
+		return { ...record, disputed: true };
+	});
+	return { facts: next, disputedIds };
+}
+
+export interface AppliedAmbiguityFloor {
+	envelope: DeepInterviewStateEnvelope;
+	breakdown: AmbiguityFloorBreakdown;
+	clamped: boolean;
+}
+
+/**
+ * Enforce the floor invariant on a full deep-interview envelope: recompute the floor
+ * from persisted evidence, clamp `state.current_ambiguity`, and clamp the latest
+ * scored round (preserving the original value as `reported_ambiguity` for audit).
+ * Historical rounds are never rewritten. Idempotent and non-mutating; every writer
+ * (state CLI write/reconcile, recorder) applies this immediately before persisting.
+ */
+export function applyAmbiguityFloorToEnvelope(value: unknown): AppliedAmbiguityFloor {
+	const envelope = normalizeDeepInterviewEnvelope(value);
+	const inner = { ...(envelope.state as Record<string, unknown>) };
+	const breakdown = computeAmbiguityFloor(inner);
+	let clamped = false;
+
+	const rounds = asArray(inner.rounds).filter(isPlainObject) as unknown as DeepInterviewRoundRecord[];
+	let latestScoredIndex = -1;
+	for (let index = 0; index < rounds.length; index += 1) {
+		const candidate = rounds[index];
+		if (candidate.lifecycle !== "scored" || !Number.isFinite(candidate.round)) continue;
+		if (latestScoredIndex < 0 || candidate.round >= rounds[latestScoredIndex].round) latestScoredIndex = index;
+	}
+	if (latestScoredIndex >= 0) {
+		const latest = rounds[latestScoredIndex];
+		if (typeof latest.ambiguity === "number") {
+			const clampedRound = clampReportedAmbiguity(latest.ambiguity, breakdown.floor);
+			if (clampedRound.clamped) {
+				const nextRounds = [...rounds];
+				nextRounds[latestScoredIndex] = {
+					...latest,
+					reported_ambiguity: latest.reported_ambiguity ?? latest.ambiguity,
+					ambiguity: clampedRound.effective,
+					ambiguity_floor: breakdown.floor,
+				};
+				inner.rounds = nextRounds;
+				clamped = true;
+			}
+		}
+	}
+
+	if (typeof inner.current_ambiguity === "number") {
+		const clampedCurrent = clampReportedAmbiguity(inner.current_ambiguity, breakdown.floor);
+		if (clampedCurrent.clamped) {
+			inner.current_ambiguity = clampedCurrent.effective;
+			clamped = true;
+		}
+	}
+
+	inner.ambiguity_floor = breakdown;
+	return { envelope: { ...envelope, state: inner }, breakdown, clamped };
+}

package/src/gjc-runtime/deep-interview-recorder.ts

@@ -1,6 +1,11 @@
 import { syncSkillActiveState } from "../skill-state/active-state";
 import { deriveDeepInterviewHud } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
+import {
+	clampReportedAmbiguity,
+	computeAmbiguityFloor,
+	disputeFactsFromRetractedRound,
+} from "./deep-interview-ambiguity";
 import {
 	answerHash,
 	type DeepInterviewEstablishedFact,
@@ -14,6 +19,7 @@ import {
 import { writeSessionActivityMarker } from "./session-resolution";
 import { readExistingStateForMutation, writeGuardedWorkflowEnvelopeAtomic } from "./state-writer";
 
+export * from "./deep-interview-ambiguity";
 export * from "./deep-interview-state";
 
 /**
@@ -395,30 +401,55 @@ export async function syncDeepInterviewRecorderHud(
 	await syncRecorderHud(cwd, normalizeDeepInterviewEnvelope(read.value), sessionId);
 }
 
-/** Record an `answered` shell for one round (append-or-merge by durable key). */
+/**
+ * Record an `answered` shell for one round (append-or-merge by durable key).
+ *
+ * Retraction dynamics: replacing an already-`scored` answer is a mechanical
+ * contradiction signal (the user pivoted). The facts that round established are
+ * marked disputed, which raises the deterministic ambiguity floor immediately —
+ * without waiting for the LLM scorer to self-report a trigger.
+ */
 export async function appendOrMergeDeepInterviewRound(
 	cwd: string,
 	statePath: string,
 	input: DeepInterviewAnswerInput,
 	options: { sessionId?: string } = {},
-): Promise<{ action: AppendOrMergeAction; record: DeepInterviewRoundRecord }> {
+): Promise<{ action: AppendOrMergeAction; record: DeepInterviewRoundRecord; disputedFactIds?: string[] }> {
 	const envelope = await readEnvelope(statePath);
 	const interviewId = input.interviewId ?? interviewIdOf(envelope);
 	const shell = buildAnswerShell({ ...input, interviewId });
 	const rounds = readRounds(envelope);
+	const priorRecord = rounds.find(r => r.round_key === shell.round_key);
 	const result = appendOrMergeRound(rounds, shell);
 	if (result.action === "noop") {
 		await repairRecorderHudFromPersisted(cwd, statePath, options.sessionId);
 		return { action: result.action, record: result.record };
 	}
-	(envelope.state as Record<string, unknown>).rounds = result.rounds;
+	const inner = envelope.state as Record<string, unknown>;
+	inner.rounds = result.rounds;
+	let disputedFactIds: string[] | undefined;
+	if (result.action === "replaced" && priorRecord?.lifecycle === "scored") {
+		const facts = Array.isArray(inner.established_facts) ? inner.established_facts : [];
+		const disputed = disputeFactsFromRetractedRound(facts, shell.round);
+		if (disputed.disputedIds.length > 0) {
+			inner.established_facts = disputed.facts;
+			disputedFactIds = disputed.disputedIds;
+			// Surface the rise right away: the retraction changed the evidence, so the
+			// gating score must reflect the new floor before the next scoring pass.
+			const breakdown = computeAmbiguityFloor(inner);
+			inner.ambiguity_floor = breakdown;
+			if (typeof inner.current_ambiguity === "number") {
+				inner.current_ambiguity = clampReportedAmbiguity(inner.current_ambiguity, breakdown.floor).effective;
+			}
+		}
+	}
 	await persistEnvelope(cwd, statePath, envelope, options.sessionId, "gjc deep-interview record-answer");
 	try {
 		await syncRecorderHud(cwd, envelope, options.sessionId);
 	} catch {
 		// HUD sync is best-effort cache maintenance and must not change record semantics.
 	}
-	return { action: result.action, record: result.record };
+	return { action: result.action, record: result.record, disputedFactIds };
 }
 
 /**
@@ -459,12 +490,34 @@ export async function enrichDeepInterviewRoundScoring(
 	const envelope = await readEnvelope(statePath);
 	const interviewId = input.interviewId ?? interviewIdOf(envelope);
 	const rounds = readRounds(envelope);
-	const { rounds: nextRounds, record } = enrichRoundWithScoring(rounds, { ...input, interviewId });
+	const { rounds: enrichedRounds, record: reportedRecord } = enrichRoundWithScoring(rounds, {
+		...input,
+		interviewId,
+	});
+	// Deterministic floor (Ouroboros principle): the LLM-reported ambiguity is only a
+	// lower-bound input. Evidence persisted in state — unresolved disputed facts,
+	// unscored active components, auto-answer dilution — sets a code-computed floor
+	// the reported score can never fall under, so a pivot mechanically raises the
+	// gating score even when the scorer omits triggers.
+	const inner = envelope.state as Record<string, unknown>;
+	const breakdown = computeAmbiguityFloor({ ...inner, rounds: enrichedRounds });
+	const clampResult = clampReportedAmbiguity(input.ambiguity, breakdown.floor);
+	let record = reportedRecord;
+	let nextRounds = enrichedRounds;
+	if (clampResult.clamped) {
+		record = {
+			...reportedRecord,
+			ambiguity: clampResult.effective,
+			reported_ambiguity: input.ambiguity,
+			ambiguity_floor: breakdown.floor,
+		};
+		nextRounds = enrichedRounds.map(item => (item.round_key === record.round_key ? record : item));
+	}
 	// Fail closed: a scored transition that violates the bidirectional invariant
 	// (an active trigger that improves the affected dimension or fails to raise
 	// overall ambiguity, or a disputed/unresolved trigger lacking a rationale) must
 	// never be persisted — storing it lets the interview falsely converge. Validate
-	// against the most recent prior scored round before writing any durable state.
+	// the effective (floor-clamped) record against the most recent prior scored round.
 	const prior = latestPriorScoredRound(rounds, record.round_key, record.round);
 	const validation = validateDeepInterviewScoredTransition(prior, record);
 	if (!validation.ok) {
@@ -472,8 +525,9 @@ export async function enrichDeepInterviewRoundScoring(
 			`deep-interview scored transition for round ${record.round} is invalid and was refused: ${validation.violations.join("; ")}`,
 		);
 	}
-	(envelope.state as Record<string, unknown>).rounds = nextRounds;
-	(envelope.state as Record<string, unknown>).current_ambiguity = input.ambiguity;
+	inner.rounds = nextRounds;
+	inner.current_ambiguity = clampResult.effective;
+	inner.ambiguity_floor = breakdown;
 	await persistEnvelope(cwd, statePath, envelope, options.sessionId, "gjc deep-interview score-round");
 	await syncRecorderHud(cwd, envelope, options.sessionId);
 	return { record };