@gobing-ai/spur 0.3.75 → 0.3.77

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -110,12 +110,21 @@ For answer files, emit a matching parseable table:
 `Verdict: PARTIAL` first, append one complete row at a time, and replace the first verdict line only
 after every row is certified. `verify-answer-lint.ts` gates the file before `spur task verdict
 --from-answer` and rejects, with row-level diagnostics: missing/duplicate/unknown requirement IDs,
-AC ids that do not exactly match a task AC checklist label (or its leading token, e.g. `AC1`) or a
-linked feature scenario title, invalid status (`MET | PARTIAL | UNMET` for requirements;
+AC ids that do not resolve to one accepted identity — a task AC checklist label or its declared
+`AC-N`/checklist-token alias, or a linked feature scenario title, in the ac-style-guide forms
+(exact/bare title, `Scenario:` prefix, bracket tags, `AC-N`); paraphrases and ambiguous aliases
+fail — invalid status (`MET | PARTIAL | UNMET` for requirements;
 `N/A` additionally allowed for AC), invalid evidence type (`test | command | static-ref |
 manual-review | llm-judge | n/a`, or a `+` compound), and empty evidence. Interrupted runs keep the
 rows that pass the lint and complete only the missing IDs on retry.
 
+**Concrete anchors only (task 0804 R9).** An evidence anchor must be a concrete existing `file:line`
+(or `file:start-end`) path. A glob or directory summary (`src/services/*.ts`, `the retry
+classifiers in task-pipeline.yaml`) is not an anchor: expand it into the specific cited files/ranges
+the run actually verified. Since 0804 R9 the checker ignores complete parsed citation spans before
+scanning for subjects, so a citation's filename (including snake_case paths) can never become a
+false subject — a real absent symbol, nonexistent file, or invalid range still reports.
+
 ## Checks evidence
 
 Wave C verification can emit the following additive `checks[]` rows:

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -39,7 +39,8 @@ sinks; this skill owns the protocol.
 testee (a /sp:... command, Skill(...), or shell CLI invocation)
   → PLAN     classify + derive steps + open dual artifacts (live + docs/dogfood) with status:running
   → EXECUTE  run each step as a user; on failure, bounded diagnose→fix→re-run (or observe-only)
-  → MONITOR  dual-write ledger row to disk on every step resolve — never reconstruct from memory
+  → MONITOR  live-ledger row to disk every step resolve; mirror frozen inside a proof window —
+             never reconstruct from memory
   → REPORT   finalize-or-abort (non-skippable): status complete|aborted, Cost block, both paths, footer
 ```
 
@@ -75,8 +76,11 @@ The command forwards these via `$ARGUMENTS`:
 > independent mutation sources is present:
 >
 > - **Pipeline-driving testees** — tokens
->   [`--next`, `dev-runall`, `dev-wrapall`, `dev-run`, `dev-wrap`, `dev-idea`,
->   `runall`, `wrapall`, `run`, `wrap`, `idea`] matched as a **distinct hyphen-word**
+>   <!-- pipeline-tokens:start -->
+>   [`--next`, `dev-runall`, `dev-wrapall`, `dev-refineall`, `dev-verifyall`, `dev-run`, `dev-wrap`, `dev-idea`,
+>   `refineall`, `verifyall`, `runall`, `wrapall`, `run`, `wrap`, `idea`]
+>   <!-- pipeline-tokens:end -->
+>   matched as a **distinct hyphen-word**
 >   (machine-checked by
 >   [`detectPipelineDriving`](../../scripts/dogfood-testing/detect-pipeline-driving.ts);
 >   see [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract))
@@ -102,9 +106,8 @@ The command forwards these via `$ARGUMENTS`:
    ```
 
    - Exit **2** → print the stdout refuse line and **stop** (do not plan). The CLI refuses on either
-     of two independent mutation sources (task 0293); print whichever refuse message it emits:
-     - pipeline-driving: `⚠ pipeline-driving testee detected; pass --max-retry 0 (observe-only) or --max-retry N (fix mode, tree mutation acknowledged)`.
-     - mutating `--fix`: `⚠ mutating --fix mode detected (--fix all | --fix blockers-first); pass --max-retry 0 (observe-only for the driver; the testee still mutates the tree) or --max-retry N (fix mode, driver + testee both mutate)`.
+     of two independent mutation sources (task 0293); its two refuse lines are the ones quoted
+     verbatim in the repo-mutation warning above.
    - Exit **0** → proceed. Do not auto-substitute `--max-retry 0`.
    - The matcher contract is unit-checked by `tests/dogfood-testing/pipeline-detect.test.ts`.
      See [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract) and
@@ -183,17 +186,18 @@ report — the report is assembled from the files, not from memory.
 On **every** step resolve:
 
 1. Append/update the ledger row on the **live** file first.
-2. Mirror the same row to the **report** path under `docs/dogfood/`.
+2. Mirror the same row to the **report** path under `docs/dogfood/` — unconditional **outside** a
+   pipeline proof window; **inside** one the mirror stays **frozen** (live rows only) until the
+   window closes, then sync/validate with live-based recovery (task 0804 R2 —
+   [monitor-ledger.md](references/monitor-ledger.md) live-ledger rule 3).
 3. Do **not** batch rows until Phase 4.
 
-The final report MUST include a `### 3. Monitor Ledger` section containing those rows, and the
-ledger's data-row count MUST equal the `**Steps:** N derived, N executed` declared in §2 of the report (N/A steps
-documented explicitly as rows) — the cardinality rule in
-[monitor-ledger.md](references/monitor-ledger.md). Full
-methodology, column contract, token/cache estimation, multi-source Cost honesty, the cache-health
-finding rule, and the **cache-conservation discipline** live in
-**[monitor-ledger.md](references/monitor-ledger.md)**. Apply the conservation discipline while
-monitoring — low cache% is usually the driver re-fetching data it already holds.
+The final report MUST include a `### 3. Monitor Ledger` section containing those rows (cardinality:
+row count == the declared executed steps). Cardinality, full methodology, column contract,
+token/cache estimation, multi-source Cost honesty, the cache-health finding rule, and the
+**cache-conservation discipline** live in
+**[monitor-ledger.md](references/monitor-ledger.md)** — apply conservation while monitoring; low
+cache% is usually the driver re-fetching data it already holds.
 
 ## Phase 4 — Report (finalize-or-abort — non-skippable)
 
@@ -211,8 +215,9 @@ contract violation**.
    declared in §2 (N/A steps documented explicitly as rows). A mismatch refuses `complete`.
 4. Write the **Cost** block under §2 (ledger `~estimate` + Method + confidence; `Meter: n/a` or
    optional ccusage/agent usage when real). For any `chained:<step>` ledger row whose meter is not
-   observable, Fresh/Cached MUST be `~unknown` (or Cached `~0` with Basis `unobservable`) **and**
-   emit finding `P3 — chained-step cost not observable` — never invent chained totals.
+   observable, Fresh/Cached MUST be `~unknown` — excluded from the cache% aggregate (or surfaced as
+   a separate unknown bucket), never counted as `Cached ~0` — **and** emit finding
+   `P3 — chained-step cost not observable`; never invent chained totals.
 5. **R2 drift check at finalize.** If a workspace fingerprint was recorded in Phase 1, re-take
    the snapshot and diff against baseline minus the run's own touched files. If drift is detected,
    append a `drift:external` warning row to the ledger and emit a mandatory P2 report finding
@@ -289,13 +294,15 @@ Do **not** use this skill for:
    mutating pipeline — pass `--max-retry 0` first and inspect the findings before letting it apply
    fixes.
 2. **The ledger is live on disk, not reconstructed.** Honest fixed-vs-unresolved accounting depends
-   on dual-writing each step *as it happens* to both artifacts. Reconstructing at the end produces
-   fiction. Working-memory-only ledgers are a contract violation.
+   on writing each step *as it happens* to the live file (mirror per Phase 3 — frozen inside a proof
+   window). Reconstructing at the end produces fiction. Working-memory-only ledgers are a contract
+   violation.
 3. **A hiding fix is a finding.** If "fixing" a step would mask the bug, log it as a finding and
    leave the step unresolved.
 4. **Token numbers are estimates, but cache math is not free-form.** A skill cannot read its own
    exact token meter, so label numbers `~estimate` and put Method + confidence in the Cost block;
-   however, cache% must be recomputable from Monitor Ledger row sums. Never invent or reuse a fixed
+   however, cache% must be recomputable from Monitor Ledger row sums of observable rows (`~unknown`
+   rows are excluded from the aggregate, never counted as `~0` cached). Never invent or reuse a fixed
    percentage. Optional meters (`ccusage`, agent usage) are session/day scope — never fake per-step.
 5. **Testee-scoped `--agent`.** Don't confuse the driver agent (always current) with the testee
    agent (the forwarded value).
@@ -335,8 +342,8 @@ node "$(superskill script path sp dogfood-testing/detect-pipeline-driving.mjs)"
 
 | Token shape | Examples | Matches | Rejects |
 |-------------|----------|---------|---------|
-| Flag / complete | `--next`, `dev-run`, `dev-runall`, `dev-wrap`, `dev-wrapall`, `dev-idea` | `/sp:dev-run 0125`, bare `--next` | `--next-gen`, `dev-runner` |
-| Bare noun | `run`, `runall`, `wrap`, `wrapall`, `idea` | `task run 0042` | `runaway`, `wrapper`, `idealist` |
+| Flag / complete | <!-- pipeline-tokens:start -->`--next`, `dev-run`, `dev-runall`, `dev-wrap`, `dev-wrapall`, `dev-idea`, `dev-refineall`, `dev-verifyall`<!-- pipeline-tokens:end --> | `/sp:dev-run 0125`, bare `--next` | `--next-gen`, `dev-runner` |
+| Bare noun | <!-- pipeline-tokens:start -->`run`, `runall`, `wrap`, `wrapall`, `idea`, `refineall`, `verifyall`<!-- pipeline-tokens:end --> | `task run 0042` | `runaway`, `wrapper`, `idealist` |
 
 `-` is a **word character** for boundaries: a token must be a distinct hyphen-word. Contract tests:
 `plugins/sp/tests/dogfood-testing/pipeline-detect.test.ts`. Helpers:
@@ -428,11 +435,10 @@ baseline is drift.
 ### Worktree advisory (mutating dogfoods)
 
 For fix-mode dogfoods of **pipeline-driving** or **mutating-`--fix`** testees (the two refuse-gate
-cases above), the §Mutating `--fix` mode contract recommends running the dogfood in an **isolated
-`git worktree`** so concurrent external writers cannot collide with the run. This is **advisory,
-not a hard gate** — the refuse-gate semantics from task 0293 are unchanged. A worktree removes the
-drift case entirely (no concurrent writer can reach the isolated checkout), which is why it is the
-preferred setup for mutating dogfoods where the operator cares about clean attribution.
+cases above), run in an **isolated `git worktree`** — **advisory, not a hard gate**. Phase 1 must
+print this advisory whenever the driver or testee may mutate and the tree is dirty, **or** the
+testee drives a pipeline (incl. observe-only over a mutating testee). Rationale, trigger matrix
+and wording: `references/monitor-ledger.md`.
 
 ## Step-splitting recipe (implement-heavy pipeline dogfoods)
 
@@ -483,8 +489,9 @@ Rules:
 2. When the chained step ran in a subagent or session whose usage data the driver cannot read, label
    the chained row `~unknown` and emit a **P3** finding: "chained-step cost not observable — candidate
    for surfacing subagent usage in the driver context." Do not invent a number.
-3. The chained row still counts toward the aggregate cache% — but mark it pessimistically
-   (`Cached = ~0`) when the basis is missing, per the anti-fiction rule in
+3. An observable chained row counts toward the aggregate cache%. A `~unknown` chained row is
+   **excluded** from the aggregate (or surfaced as a separate unknown bucket) — never folded in as
+   `Cached = ~0` — per the anti-fiction rule in
    [monitor-ledger.md](references/monitor-ledger.md).
 
 ## `--next` chain stop-at-testing
@@ -515,18 +522,17 @@ Do NOT:
   driver permission to read the chained leg's named artifacts (`.spur/run/<wbs>-verdict.json`,
   task-file section diffs, review tables) after the leg completes and attribute normally. The flag
   licenses **reading** chained-leg evidence that already exists — it does NOT license the driver to
-  execute the chained leg itself. The legacy "operator may direct" prose direction is still honored
-  for back-compat; `--chain-follow` is the explicit, machine-recognizable form. Omitting the flag
-  keeps stop-at-testing as the **default**. The flag is a driver attribute only — it does not change
-  `detect-pipeline-driving` gate semantics (it is not a testee mutation source). See
-  [§Arguments](#arguments).
+  execute the chained leg itself. The legacy "operator may direct" prose direction stays honored for
+  back-compat; omitting the flag keeps stop-at-testing as the **default**. The flag is a driver
+  attribute only — it does not change `detect-pipeline-driving` gate semantics (it is not a testee
+  mutation source). See [§Arguments](#arguments).
 
 ## Additional Resources
 
-- [references/report-template.md](references/report-template.md) — the report section contract +
-  mandatory summary footer + task-sink L3 rule.
-- [references/monitor-ledger.md](references/monitor-ledger.md) — the live-ledger column contract,
-  token/cache estimation heuristic, and the cache-health finding rule.
+- [references/report-template.md](references/report-template.md) — report section contract,
+  mandatory footer, task-sink L3 rule.
+- [references/monitor-ledger.md](references/monitor-ledger.md) — live-ledger column contract,
+  token/cache estimation, cache-health finding rule.
 
 ## Platform Notes
 
@@ -562,8 +568,10 @@ shape just because `report-template.md` wasn't auto-loaded.
 - Report: `docs/dogfood/YYYY-MM-DD-<testee-slug>-dogfood.md`
 
 Both start with YAML frontmatter including `status: running | aborted | complete`, `run_id`,
-`protocol: sp:dogfood-testing@1.2`, and paths. Dual-write a ledger row to both files on every step
-resolve. On stop, set `status` to `complete` or `aborted` (finalize-or-abort — non-skippable).
+`protocol: sp:dogfood-testing@1.2`, and paths. Write each ledger row to the live file on every step
+resolve; mirror it to the report only outside a proof window — frozen inside one, synced at
+finalize (Phase 3). On stop, set `status` to `complete` or
+`aborted` (finalize-or-abort — non-skippable).
 
 **The six mandatory section headings** (in order, each report MUST contain all six):
 

package/plugins/sp/skills/dogfood-testing/references/monitor-ledger.md

@@ -28,9 +28,14 @@ artifacts):
 1. **Open both artifacts in Phase 1**, before the first step runs (frontmatter `status: running` +
    empty ledger table in each).
 2. **Write a row the instant a step resolves** (pass, fixed, unresolved, or N/A) — not after the run.
-3. **Dual-write every step:** append/update the row on the **live** file first, then mirror to the
-   **report** path. Do not batch rows until Phase 4. If the report write fails, continue with live
-   as SSOT, emit a P2 finding, and retry promote on finalize.
+3. **Dual-write every step — EXCEPT inside a proof window (task 0804 R2).** Append/update the row
+   on the **live** file first; the live file is SSOT. While a pipeline proof window is open (from
+   the first proof capture until the final proof-sensitive action, including done/provenance
+   checks), the tracked report mirror stays **frozen**: append each observation to the live ledger
+   only, and sync/validate the mirror after the window closes (or after abort). Tracked reports are
+   proof-input fingerprint inputs — writing them mid-window churns the fingerprint and voids the
+   proof. If the report write fails at finalize, recover by recreating the mirror from the valid
+   live content and re-validate; missing live evidence cannot manufacture complete.
 4. **The report reads the on-disk ledger, not your memory.** Every number in the report traces to a
    ledger row on disk. If it is not in the ledger file, it does not go in the report.
 5. **Cardinality (@1.2).** The ledger's data-row count MUST equal the `**Steps:** N derived, N executed` declared
@@ -44,6 +49,19 @@ artifacts):
    a `FIXED` / `PASS` outcome — it is purely documentary. Cache columns carry `—` (not estimated).
    See [SKILL.md §Workspace-drift guard](../SKILL.md#workspace-drift-guard-r2--task-0296).
 
+### Worktree advisory — planning-time surfacing (task 0804 R5)
+
+The worktree advisory (SKILL.md §Worktree advisory) is surfaced at planning time, not only when
+drift is detected. Phase 1 prints it whenever the **driver or the testee may mutate** and the tree
+is dirty (`git status --porcelain` non-empty) **or** the testee itself drives a pipeline —
+including observe-only driver mode over a mutating testee. The advisory is **not a hard gate** (the
+refuse-gate semantics from task 0293 are unchanged); the isolated checkout is simply the preferred
+setup for mutating dogfoods because no concurrent writer can reach it, so attribution stays clean
+— which is why the §Mutating `--fix` mode contract recommends it for those two refuse-gate cases.
+Dirtiness alone is not proof of a concurrent writer and must not be reported as one; known
+concurrent writes still follow the project's one-writer rule. A clean, read-only run adds no
+warning.
+
 ### Fast-run exemption (task 0294 R6a)
 
 The per-step live-write mandate (rules 1–4) exists to bound information loss when a mid-run crash
@@ -81,7 +99,7 @@ in the report's §6 Findings (no exemption applies).
 | `Finding` | One-line finding surfaced at this step, or `—`. A finding does **not** change `Outcome`. |
 | `Fresh Tokens` | Estimated fresh context for the step. Prefix with `~`. |
 | `Cached Tokens` | Estimated reused context for the step. Prefix with `~`. |
-| `Cache %` | `Cached Tokens / (Fresh Tokens + Cached Tokens)`, rounded to the nearest whole percent. |
+| `Cache %` | `Cached Tokens / (Fresh Tokens + Cached Tokens)`, rounded to the nearest whole percent. An `~unknown` row carries `—`, never `0%` — unknown basis is not an observed zero. |
 | `Basis` | Observable basis for the estimate: command output, prior file read reused, generated text, etc. |
 | `Wall-clock` | Elapsed time for the step. |
 
@@ -98,8 +116,10 @@ A skill **cannot read its own exact token meter** — derive an estimate and lab
    reused by reference in this step. Use the same `ceil(characters / 4)` basis and round to the
    nearest 100. Do not count fresh command output, newly read files, or regenerated scaffolding as
    cached.
-3. Compute each row: `Cache % = round(Cached Tokens / (Fresh Tokens + Cached Tokens) * 100)`.
-4. Compute the report aggregate from row sums:
+3. Compute each row: `Cache % = round(Cached Tokens / (Fresh Tokens + Cached Tokens) * 100)`. A row
+   whose basis is unknown carries `—`, never `0%`.
+4. Compute the report aggregate from **observable rows only** — `~unknown` rows are excluded from
+   both sums (or surfaced as a separate unknown bucket), never folded in as `Cached ~0`:
    `aggregate cache% = round(sum(Cached Tokens) / sum(Fresh Tokens + Cached Tokens) * 100)`.
 
 The **trend across runs** is the signal, not the absolute value: rising cache% = the testee is
@@ -132,8 +152,10 @@ step stays on the driver's own row.
 - Observable chained usage (subagent output in driver context, or the operator explicitly provided
   the artifact) → estimate Fresh/Cached from that output normally.
 - Unobservable chained usage (subagent ran in a different session, usage data never surfaced) →
-  label Fresh `~unknown`, Cached `~0`, Basis `chained-leg usage not observable from driver`. **MUST**
-  emit a P3 finding: `P3 — chained-step cost not observable` (task 0278 R3). Do not invent totals.
+  label Fresh `~unknown`, Cached `~unknown`, Basis `chained-leg usage not observable from driver`,
+  and **exclude the row from the aggregate cache%** (or surface it as a separate unknown bucket) —
+  unknown cache use is not an observed zero. **MUST** emit a P3 finding: `P3 — chained-step cost
+  not observable` (task 0278 R3). Do not invent totals.
 
 Never fold a chained row into the driver's row; the whole point of dogfooding a pipeline-driving
 testee is to see the testee's own cost separately from the driver's monitoring cost. See
@@ -142,8 +164,10 @@ testee is to see the testee's own cost separately from the driver's monitoring c
 ## Anti-fiction rule
 
 Never reuse a convenient cache percentage such as `45%` because it "feels right." A cache percentage
-is valid only when it can be recomputed from the ledger row sums. If the basis is missing, mark the
-row pessimistically (`Cached Tokens = ~0`) and explain the missing basis.
+is valid only when it can be recomputed from the ledger row sums of observable rows. If the basis is
+missing, mark the row `~unknown`, exclude it from the aggregate (or surface it as a separate unknown
+bucket), and explain the missing basis — never fold it in as `Cached Tokens = ~0`: unknown cache use
+is not an observed zero-percent hit rate, and a low-cache diagnosis needs observed data.
 
 ## Cache-health finding rule
 

package/plugins/sp/skills/dogfood-testing/references/report-template.md

@@ -27,7 +27,7 @@ Every dogfood run **always** writes **two** files — with or without `--save`:
 | Artifact | Path | Role |
 | ---------- | ------ | ------ |
 | **Live** | `.spur/run/dogfood/<run_id>.md` | Mid-run SSOT; opened in Phase 1; ledger rows appended on every step resolve |
-| **Report** | `docs/dogfood/YYYY-MM-DD-<testee-slug>-dogfood.md` | Operator artifact; same content promoted on open + every step + finalize |
+| **Report** | `docs/dogfood/YYYY-MM-DD-<testee-slug>-dogfood.md` | Operator artifact; same content promoted on open + every step + finalize — **except inside a pipeline proof window (task 0804 R2): the mirror stays frozen (live ledger only) until the window closes, then sync/validate, recovering from live if the write failed** — [monitor-ledger.md](monitor-ledger.md) → live-ledger rule 3 |
 
 `--save` is **back-compat no-op** for delivery: it still documents/prints the report path but is
 **not required** to create the file. A run that ends with no file under `docs/dogfood/` (and no live
@@ -158,14 +158,17 @@ it is the audit trail for step outcomes, fix attempts, findings, and cache math.
 |------|----------|---------|-------------|---------|--------------|---------------|---------|-------|------------|
 | resolve | 1 | PASS | — | — | ~800 | ~300 | 27% | 1 command + reused task summary | ~3s |
 
-**Cache calculation:** aggregate cache% = round((sum(Cached Tokens) / sum(Fresh Tokens + Cached Tokens)) * 100).
+**Cache calculation:** aggregate cache% = round((sum(Cached Tokens) / sum(Fresh Tokens + Cached Tokens)) * 100),
+computed over **observable rows only** — `~unknown` rows are excluded from both sums (or surfaced as
+a separate unknown bucket), never counted as `~0` cached.
 ```
 
 Ledger rules:
 
 - Every executed step gets exactly one row, recorded when the step resolves (**on disk**, both files).
-- `Fresh Tokens` and `Cached Tokens` must be numbers with `~` prefixes; `Cache %` must be computed
-  from those two cells, not guessed.
+- `Fresh Tokens` and `Cached Tokens` must be `~`-prefixed numbers, or `~unknown` when the basis is
+  unobservable (that row is then excluded from the aggregate, never counted as `~0` cached);
+  `Cache %` must be computed from those two cells, not guessed.
 - `Basis` is mandatory. It names the observable inputs used for the estimate: command output,
   previously-read file reused from context, generated report text, or similar.
 - The aggregate cache line in `#### Cost` under §2 must equal the ledger formula above. If it
@@ -173,8 +176,9 @@ Ledger rules:
 - **Cardinality (@1.2):** the number of ledger data rows MUST equal the `**Steps:** N derived, N executed`
   declared in §2. Steps marked N/A are documented explicitly as their own rows (`Outcome: N/A`);
   an unaccounted step or an extra row refuses `status: complete` at finalize.
-- If the driver cannot make a defensible estimate for a row, write `~0` cached and explain the
-  missing basis in `Basis`; do not invent a stable percentage.
+- If the driver cannot make a defensible estimate for a row, write `~unknown`, exclude it from the
+  aggregate cache% (or surface it as a separate unknown bucket), and explain the missing basis in
+  `Basis`; do not fold it in as `~0` cached or invent a stable percentage.
 
 ### 4. What We Did
 

package/plugins/sp/skills/spur-cli/references/tasks/section-editing.md

@@ -9,8 +9,8 @@ see_also:
 
 Task bodies are edited section-by-section through `spur task update --section <name> --from-file
 <path>`. The write is **file-wins and crash-safe** (atomic write): the named section's body is
-replaced wholesale from the file you point at. There is no inline-body flag — always stage the new
-body in a file first.
+replaced wholesale from the file you point at — with one exception, `Q&A`, which appends (see
+below). There is no inline-body flag — always stage the new body in a file first.
 
 For **pipeline output**, section authorship is one-writer-per-section (F92 0593 R1):
 `Testing` comes from `spur task record` (deterministic, from a verify verdict artifact — the
@@ -23,6 +23,8 @@ for `Plan`, `Acceptance Criteria`, hand-authored `Solution`, and any narrative s
 
 1. **Assemble the full section body** in a temp file. The body is everything *under* the `###`
    heading — do not include the heading line itself; the CLI owns the heading.
+   Sub-headings inside the body MUST be `####` or deeper: a `###` in a body parses as a new
+   top-level section and trips `L2.disallowed-section` (task 0787 grew 8 phantom sections this way).
 
    ```bash
    cat > /tmp/review.md <<'EOF'
@@ -42,7 +44,11 @@ for `Plan`, `Acceptance Criteria`, hand-authored `Solution`, and any narrative s
 
 3. The whole `### Review` body is now that file's contents. To amend rather than overwrite, read
    the current body (`spur task show 0040`), edit the temp file to the full desired state, and
-   replace again — there is no append mode.
+   replace again — there is no append mode for ordinary sections.
+
+**`Q&A` is the exception.** `--section "Q&A"` APPENDS a timestamped `#### Q&A entry — <ISO>`
+block rather than replacing the section. Start the body with `<!-- qa:replace -->` to replace it
+wholesale.
 
 `--section` **requires** `--from-file` (exit `2` otherwise). Section names match the DD-08 headings
 exactly: `Background`, `Requirements`, `Acceptance Criteria`, `Q&A`, `Design`, `Plan`, `Solution`, `Root Cause`, `Testing`, `Review`, `References`, `History`, `Notes` (universal sections are `History`, `References`, `Notes`; `Root Cause` is carried by the `issue` template variant).

package/plugins/sp/skills/spur-cli/references/tasks/verbs.md

@@ -61,8 +61,10 @@ frontmatter scalar.
   to avoid orphaned nested lifecycle runs). **It is not a guard bypass** — the `wip→testing` and
   `testing→done` `check` gates above still run; the CLI evaluates them inline when the FSM guard
   does not. `--force-done` waives the verify **verdict** only, never the section matrix.
-- **Section** (`--section` **requires** `--from-file`): replaces the entire named section body from
-  the file. No inline-body flag. Section names: `Background`, `Requirements`, `Acceptance Criteria`, `Q&A`, `Design`, `Plan`, `Solution`, `Testing`, `Review`, `References`, `History`, `Notes`.
+- **Section** (`--section` **requires** `--from-file`): writes the named section body from the file.
+  Most sections replace wholesale. Exception: `--section "Q&A"` APPENDS a timestamped
+  `#### Q&A entry — <ISO>` block; start the body with `<!-- qa:replace -->` to replace the section
+  wholesale. No inline-body flag. Section names: `Background`, `Requirements`, `Acceptance Criteria`, `Q&A`, `Design`, `Plan`, `Solution`, `Testing`, `Review`, `References`, `History`, `Notes`.
 - **Frontmatter** (`--feature <id>`, `--priority <p>`): sets the scalar frontmatter field on an
   existing task — the only post-create path, allow-listed to `feature_id` / `parent_wbs` / `priority`.
 
@@ -85,7 +87,7 @@ Flags: `--folder <path>`, `--json`. Exit codes: `0` success, `1` error, `2` usag
 
 ## `sections <wbs> <op> [name]`
 
-CLI-safe, matrix-enforced task section mutation. Section names are validated against canonical sections (`Background`, `Requirements`, `Acceptance Criteria`, `Q&A`, `Design`, `Plan`, `Solution`, `Root Cause`, `Testing`, `Review`, `References`, `History`, `Notes`). Universal sections (`History`, `References`, `Notes`) are always allowed; `Root Cause` is carried by the `issue` template variant.
+CLI-safe, matrix-enforced task section mutation. Section names are validated against canonical sections (`Background`, `Requirements`, `Acceptance Criteria`, `Q&A`, `Design`, `Plan`, `Solution`, `Root Cause`, `Testing`, `Review`, `References`, `History`, `Notes`). Universal sections (`History`, `References`, `Notes`) are always allowed; `Root Cause` is carried by the `issue` template variant. `Q&A` on `update --section` appends rather than replacing (see the Section bullet above); `<!-- qa:replace -->` forces a wholesale replace.
 
 | Op | Usage | Description |
 | --- | --- | --- |

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -209,7 +209,7 @@ spur workflow run ./workflows/approval.yaml --steer                # interactive
   are exclusive (exit `2`); `--silent` cannot combine with either (exit `2`).
 - **`--detail <level>`** sets human verbosity: `minimal` (state changes only), `invocation` (default;
   per-step headers), `full` (transitions + correlation). `--verbose` is shorthand for `--detail full`.
-- **`--trace-file`** appends a redacted, schema-versioned JSONL trace under `.spur/runs/workflow/`
+- **`--trace-file`** appends a redacted, schema-versioned JSONL trace under `.spur/workflow/`
   for post-run analysis - independent of human/JSON output.
 - **`--no-log`** opts out of writing the consolidated all-in-one run log (`.spur/run/<RUNID>.log`).
   By default the log is written **and retained** after the run ends; this flag skips it entirely
@@ -280,7 +280,7 @@ not advertise `--json-envelope` because its JSON projection is a kept-raw docume
 | `--silent` | Suppress all routine output; errors still set a non-zero exit status. |
 | `--verbose` | Include transitions and correlation diagnostics in human progress (implies `--detail full`). |
 | `--detail <level>` | Human detail level: `minimal`, `invocation` (default), or `full`. |
-| `--trace-file` | Append a redacted schema-versioned JSONL trace under `.spur/runs/workflow/`. |
+| `--trace-file` | Append a redacted schema-versioned JSONL trace under `.spur/workflow/`. |
 | `--no-log` | Opt out of writing the consolidated `.spur/run/<RUNID>.log` (retained by default; propagates to `--async` workers). |
 | `--steer` | Accept in-process steering commands on stdin at declared action boundaries (sync only; incompatible with `--json`/`--async`). |
 
@@ -335,7 +335,7 @@ redirecting `agent.run` stages (ADR-047).
 - **Run-log reclamation** (0429): removes retained `.spur/run/<RUNID>.log` files whose mtime is older
   than `workflow.logRetentionDays` in `.spur/config.yaml` (default 30 days; integer days, not minutes).
   Age is the only gate; best-effort deletes never abort the rest. Never touches
-  `.spur/runs/workflow/<RUNID>.jsonl` or `*-partial.md`.
+  `.spur/workflow/<RUNID>.jsonl` or `*-partial.md`.
 - **`--logs`** scopes to log reclamation only (skips stale-run finalization). `--dry-run` applies to
   both scopes (lists what would be removed, writes nothing). `--json` returns
   `{ olderThanMinutes, dryRun, cleaned, logs: { retentionDays, dryRun, reclaimed, failures } }` (with

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -237,11 +237,11 @@ must not be changed without updating the backing skill.
 - **Inputs:**
   - `--feature <id>` **or** `--tasks <selector>` (required — at least one). `--feature` is sugar for `--tasks feature:<id>` (shared selector grammar: explicit WBS list, `feature:<id>`, `ready`, status pseudo-list — [execution-batch.md](execution-batch.md) Step 1). If both are present, `--tasks` wins (one-line note in the report).
   - Shared refine flags (passed through to each per-task refine): `--focus <mode>`, `--description <text>`, `--depth <standard|ready>`, `--agent <inline|auto|name>`, `--auto`.
-  - Batch-only flags: `--keep-going` (continue independents after a failure; default halt), `--status <s>` (filter resolved membership; default **`backlog,todo`** — planning-side fill candidates), `--json` (machine-readable batch report).
+  - Batch-only flags: `--keep-going` (continue independents after a failure; default halt), `--status <s>` (filter resolved membership; default **`backlog` + `todo`** — planning-side fill candidates. The filter is applied in-agent against the frozen set; `spur task list --status` takes exactly one canonical status per call (see `execution-batch.md` Step 1).), `--json` (machine-readable batch report).
 - **Backing:** `sp:spur-dev` skill, `refineall` operation (orchestrates; per-task body is the single-task `refine` operation — never a second refine implementation).
 - **Behavior:**
   1. Resolve + **freeze** the set at kickoff (never re-query membership mid-batch).
-  2. Apply `--status` filter (default `backlog,todo`). Tasks already `done`/`cancelled`/`testing` are excluded unless the operator widens `--status`. Report each exclusion with reason.
+  2. Apply `--status` filter (default `backlog` + `todo`; applied in-agent against the frozen set; `spur task list --status` takes exactly one canonical status per call — see `execution-batch.md` Step 1). Tasks already `done`/`cancelled`/`testing` are excluded unless the operator widens `--status`. Report each exclusion with reason.
   3. Topo-sort by `dependencies[]` (Kahn, WBS-ascending tie-break). Cycle → abort entire batch before any refine. Out-of-set deps: `done` → allow; else → block subtree (same as runall).
   4. For each WBS in order: invoke single-task refine with shared flags **including `--depth`**. Under `--auto` + **`--depth standard`** (default), the per-task **L3 pre-synthesis SKIP gate** still applies. Under **`--depth ready`**, each task runs the implement-ready checklist (no L3-only SKIP).
   5. Failure policy: **stop-the-batch** (default) or `--keep-going` (skip in-batch dependents of a failed refine; continue independents).

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -48,11 +48,28 @@ command, skill, script, or second workflow.
    chooses the subprocess workflow path.
 2. Allocate a collision-resistant inline run id (`uuidgen`, with a timestamp/pid fallback), create
    `.spur/run/`, and use `.spur/run/<run-id>.log` as the run log.
-3. Resolve the host session id from `.spur/context/.session.json`, accepting the normalized hook key
+3. **Authoritative run identity (task 0804 R1, fail-closed).** Persist the run row through the
+   internal delegate before any stage executes — this is what makes bound `run.artifact` record
+   accept the inline run (0785 R3):
+
+   ```bash
+   SETUP_SCRIPT="plugins/sp/scripts/inline-run-setup.ts";
+   [ -f "$SETUP_SCRIPT" ] || SETUP_SCRIPT="$(superskill script path sp inline-run-setup.ts 2>/dev/null)";
+   [ -n "$SETUP_SCRIPT" ] && [ -f "$SETUP_SCRIPT" ] && \
+     bun "$SETUP_SCRIPT" --run-id "$RUN_ID" --file <selected-pipeline-yaml> \
+     || { echo "inline run setup failed closed — checker not found; run 'superskill install sp'" >&2; exit 1; }
+   ```
+
+   The delegate resolves the app service from the SPUR_BIN chain, creates-or-attaches the row,
+   and writes `.spur/run/<run-id>-inline-setup.json`. Seed `__runId` and `__definitionDigest`
+   from that file so proof capture and bound registration verify against the persisted identity.
+   A non-zero exit (missing row identity, changed definition, bundle-only install) stops the run —
+   never continue unbound and never fabricate a PASS.
+4. Resolve the host session id from `.spur/context/.session.json`, accepting the normalized hook key
    `session` and the Codex key `session_id` (in that order). If neither is available, allocate
    `host-session-<run-id>` and record that fallback in the log; provenance must never be blank or
    guessed from an executor subprocess.
-4. Render the two-layer plan into the host todo list (task 0596):
+5. Render the two-layer plan into the host todo list (task 0596):
    - **Layer 1** = `spur workflow show <pipeline-yaml> --format todo --json` → its `steps[]`: the
      declared state inventory in declaration order with `initial` / `terminal` / `failure` /
      `pause` / `loopBack` / `conditional` markers. Mark the active state. Never re-derive this
@@ -69,7 +86,7 @@ command, skill, script, or second workflow.
      ended 0/11 with precheck and implement still open).
    - **Source of truth** = the CLI projection for layer 1; the YAML parsed in step 1 for layer 2.
      Never hand-copy or hand-derive the state list into the driver, a command, a skill, or a script.
-5. For task execution only, record lifecycle provenance before entering the FSM:
+6. For task execution only, record lifecycle provenance before entering the FSM:
 
    ```bash
    spur task run-link <wbs> --source inline-full --run-id <run-id> --json
@@ -101,6 +118,16 @@ Action semantics come from the YAML and the workflow action contract:
   `answerFile`; assert `expectFile`; enforce `requireDiff` against a pre-action git snapshot,
   including the task-scope guard; honor declared error policy. `timeoutMs` is recorded as not
   applicable because the host session has no independent kill boundary.
+- `run.artifact` — the engine's ledger registration has **no inline execution surface** (0808 R4).
+  The inline equivalent is a documented **registration-equivalent convention**: before the record
+  state mutates the task, the host validates the same refusal conditions inline — the declared
+  artifact exists at the resolved path and is canonical-valid for the run's wbs (for
+  `verify-verdict`: verdict `PASS`), `proofBinding: current` is honored against a freshly captured
+  proof digest, and the run-scoped review-completion marker exists — then appends one provenance
+  line to `.spur/run/<run-id>.log` naming the equivalence (artifact kind, path, verdict, digest) and
+  proceeds to `spur task record`. A failed validation stops at the state and follows the failure
+  contract; the step is never silently skipped. Artifact-provenance consumers read that run-log
+  line on the inline path — there is no ledger row.
 
 **Native-subagent dispatch (R2 eligibility, evaluated before each action):**
 
@@ -204,10 +231,11 @@ tasks (0617, 0619) because the sections were hand-written **before** the verdict
    and `L3.required-section-placeholder` before the transition, not after.
 3. **Solution change-map anchor rule (L4.anchor-subject-mismatch).** A Solution change-map table must
    list **one `file:line` per row**. A ·-joined paragraph makes every anchor's "subject" the other
-   anchors and trips the L4 subject check. Paths containing `_` (e.g. `docs/help/cmd_*.md`,
-   `spur-cli-matrix.md`) can **never** match their cited line — the snake_case filename token is
-   extracted as the subject and cannot appear in the line content — so drop those rows from the table
-   (prose still covers them).
+   anchors and trips the L4 subject check. Since 0804 R9, subject extraction ignores complete parsed
+   citation spans, so a path's underscores no longer manufacture a subject: an underscore path row
+   (`docs/help/cmd_example.md:12`) is checked exactly like any other row — cite an **existing file**
+   with a **valid line or line range** whose content names the requirement's subject. A real absent
+   symbol, nonexistent file or invalid range still reports; never replace a citable row with prose.
 
 ## Failure contract
 

package/schemas/spur-config.schema.json

@@ -165,6 +165,10 @@
                                 "type": "string",
                                 "enum": ["cheap", "standard", "capable-1", "capable-2", "capable-3"],
                                 "description": "Capability tier for stage-registry adaptive model routing (ADR-033, 0343). Live values: cheap | standard | capable-1 | capable-2 | capable-3 (1=low output quality, 3=high within the capable band). A stage starts on the cheapest eligible executor meeting its model_policy min_tier. Bare legacy `capable` is accepted at runtime (zod preprocess \u2192 capable-1) during the deprecation window but is not part of this editor enum."
+                            },
+                            "disabled": {
+                                "type": "boolean",
+                                "description": "Routing kill-switch (111): a disabled profile never serves a role, team, stage, or explicit selection, and doctor inventories it without probing. Omitted = enabled; only true/false accepted (no string/number/null coercion)."
                             }
                         }
                     }