@gobing-ai/spur 0.3.80 → 0.3.81

package/config/rules/typescript/no-leaky-module-mocks.yaml

@@ -33,22 +33,15 @@ include:
   - "packages/**/tests/**/*.test.ts"
   - "packages/**/tests/**/*.test.tsx"
 exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
-  # Shared full-surface mock helpers are the CORRECT pattern — they ensure every
-  # test file registers the same compatible surface, neutralizing "last mock wins."
-  - "apps/web/tests/test-helpers/rpc-client-mock.ts"
-  # These files use beforeEach restoreMock() atop the shared baseline — the mock.module
-  # call is in a runtime function, not at module scope, and always registers the full surface.
+  # These three files mock.module() first-party modules and keep the mock inside a
+  # runtime function guarded by beforeEach restoreMock() atop the shared full-surface
+  # baseline (apps/web/tests/test-helpers/rpc-client-mock.ts, itself unflagged: it
+  # only documents the surface in comments). Remaining mock.module() hits in the
+  # test suite were verified stale or third-party-only and have been de-listed.
   - "apps/web/tests/modules/task-kanban/board.test.tsx"
-  - "apps/web/tests/modules/task-kanban/components.test.tsx"
   - "apps/web/tests/modules/task-kanban/new-task-panel.test.tsx"
-  - "apps/web/tests/modules/features/components.test.tsx"
   - "apps/web/tests/modules/task-kanban/task-detail.test.tsx"
-  - "apps/web/tests/modules/task-kanban/index.test.tsx"
-  # index.test.tsx no longer mocks useTasks/useTaskParams/TaskDetail; useTasks.test.ts
-  # uses custom listFn (isolated store), not mock.module for first-party modules.
-  - "apps/web/tests/modules/task-kanban/useTasks.test.ts"
+  - "apps/web/tests/modules/projects/WorkView.test.tsx"
 rules:
   - id: no-leaky-mock-module
     description: >

package/config/rules/typescript/no-module-scope-import-calls.yaml

@@ -35,8 +35,6 @@ include:
   - "packages/**/src/**/*.ts"
   - "packages/**/src/**/*.tsx"
 exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
   - "**/tests/**"
   - "**/*.test.ts"
   - "**/*.test.tsx"

package/config/rules/typescript/no-syscall-emulation-in-boundary-mock.yaml

@@ -29,9 +29,6 @@ include:
   - "packages/**/tests/**/*.test.tsx"
   - "plugins/**/tests/**/*.test.ts"
   - "plugins/**/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: no-syscall-emulation-in-boundary-mock

package/config/rules/typescript/no-unmocked-module-eval-side-effects.yaml

@@ -34,9 +34,6 @@ include:
   - "apps/**/tests/**/*.test.tsx"
   - "packages/**/tests/**/*.test.ts"
   - "packages/**/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
   # All known side-effect modules are resolved. When a new one is discovered,
   # exclude files that already mock the dependency before importing it.
 

package/config/rules/typescript/output-boundaries.yaml

@@ -7,9 +7,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 include:
   - "apps/**/src/**/*.ts"
   - "packages/**/src/**/*.ts"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: no-console-output

package/config/rules/typescript/prefer-accessible-role-for-button-queries.yaml

@@ -13,9 +13,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 include:
   - "apps/web/tests/**/*.test.ts"
   - "apps/web/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: prefer-accessible-role-for-button-queries

package/config/rules/ui/ui-import-boundary.yaml

@@ -27,8 +27,6 @@ rules:
             - "apps/web/src/**/*.tsx"
           exclude:
             - "apps/web/src/ui.ts"
-            - "**/tests/**"
-            - "**/node_modules/**"
 
   - id: no-daisyui-class-leak
     description: >
@@ -48,7 +46,5 @@ rules:
     include:
       - "apps/web/src/**/*.tsx"
     exclude:
+      # Sanctioned class-authoring site (Rule B seam).
       - "apps/web/src/components/ui/**"
-      - "apps/web/src/ui.ts"
-      - "**/tests/**"
-      - "**/node_modules/**"

package/config/transition-shims.json

@@ -15,19 +15,19 @@
             "keepsWorking": "a pre-existing agent spec carrying only type (no executor field) still drains: --agent <specId> falls back to the spec's coding-agent type instead of resolving a missing executor",
             "removalCondition": "every spec under .spur/agents/ records an executor field (scan .spur/agents/*.yaml for the key; re-materialize the demo team first)"
         },
-        {
-            "id": "agent-flag-spec-id",
-            "wbs": "0542",
-            "file": "apps/cli/src/commands/agent.ts",
-            "keepsWorking": "a team spec id passed to --agent <spec-id> still addresses the spec and drives the drain path, warned once by warnAgentSpecIdOnce; --spec <id> is the canonical carrier",
-            "removalCondition": "no --agent <spec-id> usage remains in config/workflows/, plugins/sp/, or docs/ (scan for --agent values that match a .spur/agents/ spec id)"
-        },
         {
             "id": "agent-default-executor",
             "wbs": "0542",
             "file": "packages/app/src/services/agent-service.ts",
             "keepsWorking": "a configured executor name in agent.default still resolves during the transition, warned once by warnAgentDefaultExecutorOnce; the value domain moved to roles (recommended default: coder)",
             "removalCondition": "no agent.default value names an agent.executors entry (scan .spur/config.yaml and config/config.example.yaml against the agent.executors names)"
+        },
+        {
+            "id": "team-noun-retired",
+            "wbs": "0848",
+            "file": "apps/cli/src/commands/team.ts",
+            "keepsWorking": "the `spur team` noun keeps working after its six verbs moved to owning nouns (0848): assign → `spur task update --assignee`, status → `spur agent list --specs`, up → fleet materialization at serve start (`spur projects list --fleet` for --check), down/start/stop → `spur agent stop|start|stop <spec-id>`; a one-time stderr warning (warnTeamNounRetiredOnce) names the replacement for the invoked verb and every verb keeps its previous exit code and output",
+            "removalCondition": "no `spur team` invocation remains in config/workflows/, plugins/sp/, scripts/, or docs/, and the cutover window is recorded in docs/features/G64_retire-workspace-inbox-teams-and-spur-team.md"
         }
     ]
 }

package/config/workflows/basic.yaml

@@ -56,6 +56,8 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (e) 0825: 10 lines — soft probe must run the trusted compound gate via `sh -c`
+          # and write the status file the guards read, always exit 0 (0771 R1 contract).
           command: >-
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-basic-gate.status" &&
@@ -83,6 +85,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-fixall "${vars.qualityGateCmd}"
+          answerFile: .spur/run/${vars.__runId}-basic-fix-answer.txt
+          expectFile: .spur/run/${vars.__runId}-basic-fix-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: coder
           timeoutMs: ${vars.stepTimeoutMs}

package/config/workflows/docs-pipeline.yaml

@@ -138,12 +138,8 @@ states:
       # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
       - kind: shell
         options:
-          # 0760 R1 (sibling of 0751 R2): task-path lookup fails closed. Drop
-          # `2>/dev/null`, `|| true`, and the forced `exit 0` so an unresolved
-          # wbs exits non-zero with a named message. The resolved path folds
-          # into the proof digest via `taskFile:` below; a silent miss would
-          # degrade the docs-pipeline proof to tree-only (same hazard 0751 R2
-          # removed from task-pipeline). (0769: run-scoped capture path.)
+          # (e) 0825: 6 lines — fail-closed lookup feeds the verdict/digest file names
+          # (0760 R1); a silent miss would degrade the proof to tree-only.
           command: >-
             set -e;
             task_path="$($spurBin task path $wbs --json | jq -r '.path // .filePath // empty')";
@@ -159,6 +155,8 @@ states:
       # folding a stale spec into the proof.
       - kind: shell
         options:
+          # (e) 0825: 9 lines — per-check rc capture (task show/feature show/jq) keeps an
+          # orphan task and a broken linked feature distinguishable (0785 R2 contract).
           command: >-
             set -e;
             FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null)";
@@ -191,6 +189,7 @@ states:
           role: reviewer
           timeoutMs: ${vars.stepTimeoutMs}
           answerFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
+          expectFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
       - kind: shell
         options:
           command: "$spurBin task verdict $wbs --from-answer .spur/run/$__runId-docs-verify-answer.txt"
@@ -199,6 +198,8 @@ states:
       # guard below, not this step.
       - kind: shell
         options:
+          # (e) 0825: 6 lines — stamp shell freezes the docs proof digest for the closing
+          # guard; the record→done guard compares against this stamp.
           command: >-
             V=".spur/run/$wbs-verdict.json";
             if [ -f "$V" ] && [ -n "$proofDigest" ]; then
@@ -263,7 +264,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$wbs-docs-precheck.status 2>/dev/null)" = PASS'
+        command: 'test "$(cat .spur/run/$__runId-docs-precheck.status 2>/dev/null)" = PASS'
   - from: precheck
     to: failed
     description: Precheck FAIL — stop before draft.
@@ -313,17 +314,13 @@ transitions:
     guard:
       kind: shell
       options:
-        # Hardened (0703 P2 carry): every operand is required non-empty (`test -n`) so a
-        # missing file or empty var fails closed instead of empty-equals-empty passing.
+        # (e) 0825: 8-line operand ladder condensed to one jq select — same file, same
+        # digest-locked PASS semantics (0769 R4/R5); empty/malformed still fail closed.
         command: >-
           test -n "$proofDigest" &&
           test -n "$proofDigestNow" &&
           test "$proofDigestNow" = "$proofDigest" &&
-          test -f ".spur/run/$wbs-verdict.json" &&
-          test -n "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
-          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
-          test -n "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
-          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
+          test "$(jq -r --arg d "$proofDigest" 'select(.proof.digest == $d) | .verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS
   - from: verify
     to: failed
     description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
@@ -338,6 +335,8 @@ transitions:
     guard:
       kind: shell
       options:
+        # (e) 0825: 5-line guard — captured record PASS + digest-locked persisted verdict
+        # must both hold before done; a failed `task record` never converts to success.
         command: >-
           test "$(cat .spur/run/$__runId-docs-record.status 2>/dev/null)" = PASS &&
           test -f ".spur/run/$wbs-verdict.json" &&

package/config/workflows/feature-dev.yaml

@@ -91,35 +91,11 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (d) 0825: the 12-command identity/roster program moved into
+          # plugins/sp/scripts/feature-dev-precheck.ts (§1.1 owner); same messages,
+          # artifacts and soft-fail exit-0 contract, wrapper fails closed.
           command: >-
-            mkdir -p .spur/run;
-            FEATURE_JSON=".spur/run/$__runId-feature-dev-feature.json";
-            ROSTER_JSON=".spur/run/$__runId-feature-dev-roster.json";
-            TASKS_TXT=".spur/run/$__runId-feature-dev-tasks.txt";
-            PRECHECK_STATUS=".spur/run/$__runId-feature-dev-precheck.status";
-            rm -f "$PRECHECK_STATUS";
-            set +e;
-            test -n "$featureId" && test -n "$__runId";
-            id_rc=$?;
-            if [ "$id_rc" -eq 0 ]; then $spurBin feature show "$featureId" --json > "$FEATURE_JSON" 2>&1; show_rc=$?; else show_rc=1; fi;
-            if [ "$id_rc" -eq 0 ] && [ "$show_rc" -eq 0 ] && jq -e --arg id "$featureId" 'type == "object" and .id == $id' "$FEATURE_JSON" > /dev/null 2>&1; then $spurBin task list --feature "$featureId" --json > "$ROSTER_JSON" 2>&1; list_rc=$?; else list_rc=1; fi;
-            if [ "$id_rc" -ne 0 ] || [ "$show_rc" -ne 0 ] || [ "$list_rc" -ne 0 ]; then
-              echo "feature-dev precheck: missing featureId/runId, unknown feature '$featureId', or unreadable roster (rc $id_rc/$show_rc/$list_rc) — supply an existing planned feature via /sp:dev-plan or /sp:dev-idea; nothing was auto-created or re-planned" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif ! jq -e 'type == "array" and length > 0' "$ROSTER_JSON" > /dev/null 2>&1; then
-              echo "feature-dev precheck: roster at $ROSTER_JSON is malformed, not an array, or empty — plan the feature first via /sp:dev-plan; refusing to replan or run an empty batch" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif ! jq -e 'all(.[]; (.wbs | type == "string" and length > 0)) and ([.[].wbs] | length == (unique | length)) and all(.[]; .status == "todo" or .status == "done" or .status == "cancelled" or .status == "backlog" or .status == "wip" or .status == "testing" or .status == "blocked")' "$ROSTER_JSON" > /dev/null 2>&1; then
-              echo "feature-dev precheck: roster has empty/duplicate/mismatched WBS identities or unknown statuses at $ROSTER_JSON — repair the task corpus; refusing to batch a broken roster" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif [ "$(jq '[.[] | select(.status == "backlog" or .status == "wip" or .status == "testing" or .status == "blocked")] | length' "$ROSTER_JSON")" -gt 0 ]; then
-              echo "feature-dev precheck: linked task(s) are backlog/wip/testing/blocked — refine or resume them through their own task pipelines before batching; refusing to launch overlapping work" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            else
-              printf '%s' "$(jq -r '[.[] | select(.status == "todo") | .wbs] | sort | join(",")' "$ROSTER_JSON")" > "$TASKS_TXT";
-              printf 'PASS\n' > "$PRECHECK_STATUS";
-            fi;
-            exit 0
+            mkdir -p .spur/run; if [ -f plugins/sp/scripts/feature-dev-precheck.ts ]; then bun plugins/sp/scripts/feature-dev-precheck.ts; elif W="$(superskill script path sp feature-dev-precheck.mjs 2>/dev/null)" && [ -f "$W" ]; then node "$W"; else echo "feature-dev precheck failed closed — feature-dev-precheck script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$__runId-feature-dev-precheck.status"; fi; exit 0
       - kind: note
         options:
           message: "Feature-dev start for existing feature ${vars.featureId} (0782 reuse path): roster resolved under .spur/run/${vars.__runId}-feature-dev-roster.json; frozen todo list at .spur/run/${vars.__runId}-feature-dev-tasks.txt."
@@ -143,6 +119,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-runall --tasks ${vars.featureTaskIds} --auto
+          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
+          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           timeoutMs: ${vars.stepTimeoutMs}
@@ -162,6 +140,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-runall --tasks ${vars.featureTaskIds}
+          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
+          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           timeoutMs: ${vars.stepTimeoutMs}
@@ -177,17 +157,10 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (e) 0825: 9 lines — `feature check --as done` runs EXACTLY ONCE per run (0782 R3)
+          # and owns the status write the guards read; split would re-run the check.
           command: >-
-            mkdir -p .spur/run;
-            VERIFY_JSON=".spur/run/$__runId-feature-dev-verify.json";
-            VERIFY_STATUS=".spur/run/$__runId-feature-dev-verify.status";
-            VERIFY_TMP=".spur/run/$__runId-feature-dev-verify.status.tmp";
-            rm -f "$VERIFY_STATUS";
-            set +e;
-            $spurBin feature check "$featureId" --as done --json > "$VERIFY_JSON" 2>&1;
-            check_rc=$?;
-            set -e;
-            if [ "$check_rc" -eq 0 ] && jq -e 'type == "array" and length > 0 and all(.[]; .pass == true)' "$VERIFY_JSON" > /dev/null 2>&1; then printf 'PASS\n' > "$VERIFY_TMP" && mv -f "$VERIFY_TMP" "$VERIFY_STATUS"; else printf 'FAIL\n' > "$VERIFY_TMP" && mv -f "$VERIFY_TMP" "$VERIFY_STATUS"; fi
+            mkdir -p .spur/run; rm -f ".spur/run/$__runId-feature-dev-verify.status"; $spurBin feature check "$featureId" --as done --json > ".spur/run/$__runId-feature-dev-verify.json" 2>&1 && jq -e 'type == "array" and length > 0 and all(.[]; .pass == true)' ".spur/run/$__runId-feature-dev-verify.json" > /dev/null 2>&1 && R=PASS || R=FAIL; printf '%s\n' "$R" > ".spur/run/$__runId-feature-dev-verify.status.tmp" && mv -f ".spur/run/$__runId-feature-dev-verify.status.tmp" ".spur/run/$__runId-feature-dev-verify.status"
       - kind: note
         options:
           message: "Feature verification for ${vars.featureId}: decision at .spur/run/${vars.__runId}-feature-dev-verify.status (evidence at .spur/run/${vars.__runId}-feature-dev-verify.json) — exactly one `feature check --as done --json` invocation per run (0782 R3)."
@@ -211,36 +184,18 @@ states:
       `requireCleanReview=true` turns a non-clean COLLECTED verdict (including
       collect FAIL) into the blocking edge declared first below.
     onEnter:
+      # (e) 0825: one request action + one collect action (same verdicts, same files,
+      # collect gated on the captured head SHA as before) to hold the §1.2 budgets.
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-integration-review.status" &&
-            REQUEST_JSON=".spur/run/$__runId-integration-review.json" &&
-            COLLECT_JSON=".spur/run/$__runId-integration-review-collect.json" &&
-            COLLECT_STATUS=".spur/run/$__runId-integration-review-collect.status" &&
-            PR_REQUEST_STATUS=".spur/run/$__runId-integration-review-pr-request.status" &&
-            set +e &&
-            bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json
-            --status-file "$PR_REQUEST_STATUS" > "$REQUEST_JSON" 2>&1;
-            request_rc=$?; set -e &&
-            if [ "$request_rc" -eq 0 ]; then
-              printf 'PASS\n' > "$STATUS_FILE";
-            else
-              printf 'FAIL\n' > "$STATUS_FILE";
-            fi &&
-            HEAD_SHA=$(jq -r '.head // empty' "$REQUEST_JSON" 2>/dev/null || true) &&
-            if [ -z "$HEAD_SHA" ]; then
-              echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2;
-              printf 'FAIL\n' > "$COLLECT_STATUS";
-            else
-              set +e &&
-              bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$HEAD_SHA" --json
-              --status-file "$COLLECT_STATUS" > "$COLLECT_JSON" 2>&1;
-              collect_rc=$?; set -e &&
-              echo "integration-review: collect rc=$collect_rc status=$(cat "$COLLECT_STATUS" 2>/dev/null || echo missing) — verdict captured to $COLLECT_JSON" >&2;
-            fi;
-            exit 0
+            mkdir -p .spur/run; bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json --status-file ".spur/run/$__runId-integration-review-pr-request.status" > ".spur/run/$__runId-integration-review.json" 2>&1 && printf 'PASS\n' > ".spur/run/$__runId-integration-review.status" || printf 'FAIL\n' > ".spur/run/$__runId-integration-review.status"; exit 0
+      - kind: shell
+        options:
+          # (e) 0825: 8 lines — collect stays head-locked to the request record and records
+          # its verdict status file; the rc/status echo is the audible soft-fail contract.
+          command: >-
+            if H=$(jq -er '.head // empty | select(. != "")' ".spur/run/$__runId-integration-review.json" 2>/dev/null); then bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$H" --json --status-file ".spur/run/$__runId-integration-review-collect.status" > ".spur/run/$__runId-integration-review-collect.json" 2>&1; rc=$?; echo "integration-review: collect rc=$rc status=$(cat ".spur/run/$__runId-integration-review-collect.status" 2>/dev/null || echo missing) — verdict captured to .spur/run/$__runId-integration-review-collect.json" >&2; else echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2; printf 'FAIL\n' > ".spur/run/$__runId-integration-review-collect.status"; fi; exit 0
       - kind: note
         options:
           message: "Integration review for feature ${vars.featureId}: request verdict at .spur/run/${vars.__runId}-integration-review.status (request state only — REQUESTED/ALREADY_* are NEVER clean evidence); collected verdict at .spur/run/${vars.__runId}-integration-review-collect.status (CLEAN/FINDINGS/PENDING — the only clean evidence). Advisory unless requireCleanReview=true."

package/config/workflows/history-anatomy.yaml

@@ -72,7 +72,10 @@ vars:
   agent: "claude"
   spurBin: "spur"
   __runId: ""
-  stepTimeoutMs: "1800000"
+  # 2026-09-12: raised 30m -> 60m. Observed runs on zai/glm-5.3-flash butt against the
+  # 30m ceiling (correct exited at exactly 30m00s; a prior run passed at 29m52s) — the
+  # enrich/validate/correct stages legitimately need >30m for the 60KB candidate report.
+  stepTimeoutMs: "3600000"
   workflowFile: "config/workflows/history-anatomy.yaml"
   contractVersion: "1"
   reportDir: "docs/report"
@@ -225,6 +228,24 @@ states:
           role: reviewer
           expectFile: .spur/run/${vars.__runId}-validation.txt
           timeoutMs: ${vars.stepTimeoutMs}
+      - kind: shell
+        options:
+          # 2026-09-13 verdict-placement normalization: the 0771 guard reads ONLY the
+          # final line, but models sometimes lead with `Verdict: PASS` and close with
+          # prose — a substantive PASS must not die as a format phantom (observed
+          # 2026-09-13 run 94c4d6dc). Moves the verdict line to the end ONLY when
+          # exactly one exact-line verdict exists and it is PASS. Any `Verdict: FAIL`
+          # line anywhere (or multiple/ambiguous verdict lines) suppresses
+          # normalization, so the guard still fails and a real FAIL can never be
+          # laundered into a PASS.
+          command: >-
+            f=.spur/run/$__runId-validation.txt;
+            if [ -f "$f" ] && ! tail -n 1 "$f" | grep -qx 'Verdict: PASS'; then
+              p=$(grep -cx 'Verdict: PASS' "$f"); q=$(grep -cx 'Verdict: FAIL' "$f");
+              if [ "$p" = 1 ] && [ "$q" = 0 ]; then
+                grep -vx 'Verdict: PASS' "$f" > "$f.tmp" && printf 'Verdict: PASS\n' >> "$f.tmp" && mv "$f.tmp" "$f";
+              fi;
+            fi
       - kind: shell
         options:
           command: >-