@gobing-ai/spur 0.3.90 → 0.3.92

package/plugins/sp/scripts/surface-drift-inventory.ts

@@ -346,6 +346,67 @@ export function checkNounVerbFlags(
     }
 }
 
+// ─── Semantic operand layer (I7 / task 0906 R2) ─────────────────────────────
+
+/**
+ * Metadata-only operands the I6 sweep classified. This is the audit boundary, not a
+ * CLI section matrix: a key that is ALSO a genuine body heading for the noun (feature
+ * `Scope`) is accepted per-noun in checkSectionOperand; anything outside this set is
+ * not statically classifiable and stays unverified.
+ */
+const SECTION_METADATA_KEYS = new Set([
+    'tags',
+    'priority',
+    'status',
+    'phase',
+    'id',
+    'parent',
+    'name',
+    'owner',
+    'scope',
+]);
+
+/** Body headings that overlap the swept metadata keys, per noun (case-insensitive). */
+const NOUN_BODY_SECTIONS: Record<string, ReadonlySet<string>> = {
+    feature: new Set(['scope']),
+};
+
+/**
+ * Semantic operand check (I7 / task 0906 R2): `--section` is a real flag on
+ * task/feature update, so existence parity passes while the operand names a
+ * metadata-only key instead of a body section. Classify literal operands only —
+ * dynamic operands (placeholders) stay unverified under the existing scanner
+ * convention, and quoted/equal forms are handled alongside the spaced form.
+ * Comparison is case-normalized; the original operand text stays in the row evidence.
+ */
+export function checkSectionOperand(spanRaw: string, occ: { file: string; line: number }): void {
+    const parsed = parseInvocation(spanRaw);
+    if (!parsed) return;
+    const noun = parsed.nouns[0];
+    if ((noun !== 'task' && noun !== 'feature') || !parsed.verbs.includes('update')) return;
+    for (const m of spanRaw.matchAll(/--section(?:=|\s+)("([^"]*)"|'([^']*)'|[^\s]+)/g)) {
+        const operand = (m[2] ?? m[3] ?? m[1] ?? '').replace(/[.,;:]+$/, '');
+        if (!operand || PLACEHOLDER.test(operand)) continue; // dynamic — unverified by convention
+        const key = operand.toLowerCase();
+        if ((NOUN_BODY_SECTIONS[noun] ?? new Set()).has(key)) continue; // genuine body heading
+        if (!SECTION_METADATA_KEYS.has(key)) continue; // outside the audit boundary — unverified
+        // P3 (0906 review): feature update owns the generic --field/--value pair; task update
+        // exposes metadata only via dedicated flags (no --field/--value, no --tags), so the hint
+        // must not suggest a pair that would fail with VALIDATION_FAILED on task rows.
+        const remediation =
+            noun === 'feature'
+                ? `use --field ${operand} --value <value>`
+                : `task update exposes metadata only via dedicated flags (e.g. --priority <value>), not --section`;
+        record(
+            `spur ${noun} update --section ${operand}`,
+            'semantic-operand(I6 metadata keys vs noun body sections)',
+            'mismatch',
+            `--section writes a body section; "${operand}" is a metadata-only ${noun} operand — ${remediation}`,
+            occ,
+        );
+    }
+}
+
 export function sweepPluginTrees(root: string = PLUGIN_ROOT): void {
     const files = [
         ...walk(join(root, 'commands'), ['.md']),
@@ -398,6 +459,7 @@ export function sweepPluginTrees(root: string = PLUGIN_ROOT): void {
                         continue;
                     }
                     checkNounVerbFlags(parsed.nouns, parsed.verbs, parsed.flags, occ);
+                    checkSectionOperand(span, occ);
                 }
                 if (file.endsWith('.ts')) return;
                 if (inVerbTable && refNoun && /^\|/.test(line)) {
@@ -430,7 +492,10 @@ export function sweepPluginTrees(root: string = PLUGIN_ROOT): void {
             } else {
                 for (const span of lineInvocationSpans(line)) {
                     const parsed = parseInvocation(span);
-                    if (parsed) checkNounVerbFlags(parsed.nouns, parsed.verbs, parsed.flags, occ);
+                    if (parsed) {
+                        checkNounVerbFlags(parsed.nouns, parsed.verbs, parsed.flags, occ);
+                        checkSectionOperand(span, occ);
+                    }
                 }
             }
         });
@@ -764,11 +829,11 @@ export function sweepWorkflows(opts: { run?: CliRunner; wfDir?: string; link?: s
             .forEach((line: string, i: number) => {
                 for (const span of lineInvocationSpans(line)) {
                     const parsed = parseInvocation(span);
-                    if (parsed)
-                        checkNounVerbFlags(parsed.nouns, parsed.verbs, parsed.flags, {
-                            file: path,
-                            line: i + 1,
-                        });
+                    if (parsed) {
+                        const occ = { file: path, line: i + 1 };
+                        checkNounVerbFlags(parsed.nouns, parsed.verbs, parsed.flags, occ);
+                        checkSectionOperand(span, occ);
+                    }
                 }
             });
     }

package/plugins/sp/scripts/task-evidence-precheck.ts

@@ -74,10 +74,15 @@ function parseArgs(argv: string[]): { wbs: string; spurBin: string } {
         if (arg === '--spur-bin') {
             spurBin = argv[i + 1] ?? defaultSpurBin();
             i += 2;
-        } else if (!arg.startsWith('--')) {
-            wbs = arg;
-            i++;
+        } else if (arg.startsWith('-')) {
+            // 0948 R4: an unknown flag is a mis-invocation, not something to swallow.
+            // The old `else { i++; }` let `script 0926 --task-file x.md` run against x.md.
+            console.error(`task-evidence-precheck: unknown flag: ${arg}`);
+            usage();
         } else {
+            // 0948 R4: first positional wins — a later positional must never overwrite
+            // `wbs` (it used to write a garbage-named status file and mask the exit code).
+            if (wbs === '') wbs = arg;
             i++;
         }
     }

package/plugins/sp/scripts/task-size-precheck.ts

@@ -124,10 +124,15 @@ function parseArgs(argv: string[]): {
         } else if (arg === '--max-plan-items') {
             maxPlanItems = Number(argv[i + 1]) || 16;
             i += 2;
-        } else if (!arg.startsWith('--')) {
-            wbs = arg;
-            i++;
+        } else if (arg.startsWith('-')) {
+            // 0948 R4: an unknown flag is a mis-invocation, not something to swallow.
+            // The old `else { i++; }` let `script 0926 --task-file x.md` run against x.md.
+            console.error(`task-size-precheck: unknown flag: ${arg}`);
+            usage();
         } else {
+            // 0948 R4: first positional wins — a later positional must never overwrite
+            // `wbs` (it used to write a garbage-named status file and mask the exit code).
+            if (wbs === '') wbs = arg;
             i++;
         }
     }

package/plugins/sp/scripts/validate-flag-contracts.ts

@@ -406,9 +406,9 @@ export function extractTriggerTable(crossCuttingRaw: string): string[] | null {
 function adrAgentClaims(adrRaw: string): Map<string, SurfaceBehavior> | null {
     if (adrRaw.includes('## ADR-047')) {
         const out = new Map<string, SurfaceBehavior>();
-        // G5 amendment (feature G5 / task 0565): explicit inline is host-session-only — headless
-        // surfaces reject it with the stable special error; 0508 native-subagent eligibility
-        // applies to omitted --agent only, never explicit inline.
+        // ADR-087 (task 0687) retired the G5 frozen rejection: explicit `inline` on a headless
+        // surface resolves via role/tier substitution with one warning. This claims map mirrors
+        // the ADR-047 amendment text as written; ADR-087-aware parsing is a follow-up.
         out.set('inline', {
             surfaces: new Set(['inline']),
             conditional: false,

package/plugins/sp/skills/branch-workflow/SKILL.md

@@ -81,6 +81,7 @@ git push
 ```bash
 git branch -d feature/<slug>        # Delete merged branch
 git worktree remove ../<project>-feature-<slug>  # Remove worktree if used
+spur projects remove ../<project>-feature-<slug> 2>/dev/null || true # Deregister from projects.json if registered
 git worktree prune                  # Clean up stale worktree references
 ```
 

package/plugins/sp/skills/branch-workflow/references/worktree-patterns.md

@@ -46,6 +46,7 @@ Shows all worktrees with their branches and paths.
 
 ```bash
 git worktree remove ../project-hotfix
+spur projects remove ../project-hotfix 2>/dev/null || true
 ```
 
 ### Prune (clean up stale references)
@@ -83,6 +84,7 @@ After removing a worktree, run `git worktree prune` and `git gc` to reclaim spac
 
 ```bash
 git worktree remove ../old-worktree
+spur projects remove ../old-worktree 2>/dev/null || true
 git worktree prune
 git gc --aggressive
 ```

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -52,6 +52,23 @@ When this skill is entered via `/sp:dev-run --mode implement <wbs>` (the form
 The structural guard is the slash form itself (`--mode implement`). Prose in the workflow YAML
 `agent.run` `input` is the wrong place for this rule; it belongs here and in `dev-run.md`.
 
+## Escalation contract (task 0933, implement step only)
+
+When the pipeline runs implement headless, you have a bounded channel to surface a question
+instead of guessing. The rules, in decision order:
+
+- **Decide without asking** when the answer follows from the task's frozen Design /
+  Requirements / Q&A, the project and global instructions, or the codebase itself. Ambiguity
+  you can resolve from evidence is not a question.
+- **Escalate only when a requirement or design ambiguity would change scope, correctness, or
+  authorization.** Style preferences, implementation details, and curiosity are not escalations.
+- **To escalate:** write ONE concise question — with options and a recommendation — to the
+  escalation file, then exit 0 **without further edits**. The pipeline pauses the run and an
+  operator answers; the transcript of prior Q/A pairs lives at the `--escalation-file` path
+  (the ask loop is bounded, default 2 — a third pause fails the task).
+- **Read `--escalation-file` if it exists and treat its answers as binding.** They are the
+  operator's recorded decisions for this pass, not suggestions.
+
 ## One WBS per implement pass (task 0487 R1)
 
 The target WBS is the **only** task you implement. Sibling tasks in the corpus are context you do

package/plugins/sp/skills/code-verification/SKILL.md

@@ -259,13 +259,34 @@ the deterministic Testing writer `spur task record` (section authorship never ha
 
 ```bash
 # write .spur/run/<wbs>-verdict.json (shape in references/verdict-schema.md), then:
+# F96 residual sweep (observe-only): scan + fold BEFORE record, under every --fix mode.
+RESIDUAL=$(superskill script path sp residual-scan.mjs)
+node "$RESIDUAL" scan --wbs <wbs> --base .spur/run/<wbs>-base.sha
+node "$RESIDUAL" fold --wbs <wbs> --verdict .spur/run/<wbs>-verdict.json
 spur task record <wbs> --verdict-file .spur/run/<wbs>-verdict.json  # renders ## Testing
 ```
 
+> **Residual fold (F96).** `scan` reads `.spur/run/` artifacts and writes `residuals.json` +
+> `residual-report.md`; `fold` rewrites the **just-written** verdict artifact's `residual-sweep`
+> check in place (PASS → PARTIAL when a blocking residual exists), so `record` transcribes the
+> downgraded verdict — a manual verify cannot certify what the pipeline would reject. Resolve the
+> script via `superskill script path sp residual-scan.mjs`; shipped surfaces never reference
+> `plugins/sp/scripts/` directly (script-contract-check rule 4). When the task reaches `done`
+> through `--next`, run `residual-scan settle` (links follow-up tasks; best-effort).
+
 > **Corrections: the answer file is the source of truth.** `spur task record` re-transcribes
 > `## Testing` from the verdict artifact — direct `--section Testing` writes are futile. Fix
 > `.spur/run/<wbs>-verify-answer.txt` → `spur task verdict <wbs> --from-answer <file>` → re-record.
 
+> **Scenario-key carry-forward (standalone `--force` re-verifies).** When you author a fresh
+> verdict artifact for a task whose `## Testing` already carries feature scenario-title rows
+> (`Scenario: <title>` / `AC-N` keys with MET status), **copy those rows into the new artifact**
+> keyed the same way — record re-transcribes `## Testing` wholesale, so a fresh artifact keyed by
+> bare `R1`-style ids drops the scenario keys `spur feature check` needs for satisfaction
+> (`L4.scenario-unverified` regresses; 0921/D63). Since 0936, `record` warns on stderr (exit 0)
+> for each dropped MET-matched scenario key and when the new rows match no feature scenario —
+> treat those warnings as a re-key instruction, not noise.
+
 > **Do not write `## Review` directly, ever.** The `## Review` section is owned by the
 > `review` coordinator (`/sp:dev-review` → `sp:super-reviewer`), which merges
 > `functional-review` + `code-verification` review mode + `code-improvement` fragments. The

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -136,6 +136,7 @@ Wave C verification can emit the following additive `checks[]` rows:
 | `evidence-rule-pass` | All behavior-bearing AC rows had executable evidence or were explicitly non-behavioral. |
 | `evidence-rule-failed` | One or more MET behavior-bearing AC rows lacked `test` / `command` evidence and were downgraded to PARTIAL. |
 | `cli-golden-path-present` | CLI-surface tasks supplied, or failed to supply, one golden-path command evidence row. |
+| `residual-sweep` | Post-verdict residual scan (F96): `fail` when blocking leftovers exist (P1–P3 findings, added diff markers, unchecked boxes); evidence lists blocking/deferrable/advisory/housekeeping counts plus blocking and deferrable item ids. A `fail` downgrades an otherwise-PASS verdict to PARTIAL via the fold step. |
 
 ## How the gate reads it
 

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -194,8 +194,9 @@ On **every** step resolve:
 
 The final report MUST include a `### 3. Monitor Ledger` section containing those rows (cardinality:
 row count == the declared executed steps). Cardinality, full methodology, column contract,
-token/cache estimation, multi-source Cost honesty, the cache-health finding rule, and the
-**cache-conservation discipline** live in
+token/context-reuse estimation, multi-source Cost honesty, the evidence-based reuse and
+pipeline-provenance observation rules (supported 0912 baseline findings, owner handoffs,
+INSUFFICIENT_EVIDENCE limits — task 0913), and the **cache-conservation discipline** live in
 **[monitor-ledger.md](references/monitor-ledger.md)** — apply conservation while monitoring; low
 cache% is usually the driver re-fetching data it already holds.
 
@@ -532,7 +533,8 @@ Do NOT:
 - [references/report-template.md](references/report-template.md) — report section contract,
   mandatory footer, task-sink L3 rule.
 - [references/monitor-ledger.md](references/monitor-ledger.md) — live-ledger column contract,
-  token/cache estimation, cache-health finding rule.
+  token/context-reuse estimation, evidence-based reuse observation rule, pipeline-run provenance
+  observation rules.
 
 ## Platform Notes
 

package/plugins/sp/skills/dogfood-testing/references/monitor-ledger.md

@@ -1,6 +1,6 @@
 ---
 name: monitor-ledger
-description: "The dogfood monitor methodology + on-disk live ledger column contract + dual-write + token/cache estimation heuristic + the cache-health finding rule. The on-disk ledger is the single source of truth the report is assembled from — recorded live, per step, never reconstructed."
+description: "The dogfood monitor methodology + on-disk live ledger column contract + dual-write + token/cache estimation heuristic + evidence-based context-reuse observation rules. The on-disk ledger is the single source of truth the report is assembled from — recorded live, per step, never reconstructed."
 see_also:
   - dogfood-testing
   - report-template
@@ -99,14 +99,16 @@ in the report's §6 Findings (no exemption applies).
 | `Finding` | One-line finding surfaced at this step, or `—`. A finding does **not** change `Outcome`. |
 | `Fresh Tokens` | Estimated fresh context for the step. Prefix with `~`. |
 | `Cached Tokens` | Estimated reused context for the step. Prefix with `~`. |
-| `Cache %` | `Cached Tokens / (Fresh Tokens + Cached Tokens)`, rounded to the nearest whole percent. An `~unknown` row carries `—`, never `0%` — unknown basis is not an observed zero. |
+| `Cache %` | Estimated context-reuse share: `Cached Tokens / (Fresh Tokens + Cached Tokens)`, rounded to the nearest whole percent. This is a **heuristic estimate** of how much context the step reused — it is not observed provider cache behavior (task 0913, R3). An `~unknown` row carries `—`, never `0%` — unknown basis is not an observed zero. |
 | `Basis` | Observable basis for the estimate: command output, prior file read reused, generated text, etc. |
 | `Wall-clock` | Elapsed time for the step. |
 
-## Token + cache estimation heuristic
+## Token + context-reuse estimation heuristic
 
 A skill **cannot read its own exact token meter** — derive an estimate and label every number
-`~estimate`. The accepted methodology is deterministic from the ledger rows:
+`~estimate`. These chars/4 figures estimate **context volume and reuse within the driver's own
+session**; they do not measure provider cache hits, cache cost, or realized savings (task 0913,
+R3). The accepted methodology is deterministic from the ledger rows:
 
 1. Estimate **Fresh Tokens** from new material consumed or produced by the step:
    - text read from files or command output: `ceil(characters / 4)`, rounded to the nearest 100;
@@ -122,8 +124,9 @@ A skill **cannot read its own exact token meter** — derive an estimate and lab
    both sums (or surfaced as a separate unknown bucket), never folded in as `Cached ~0`:
    `aggregate cache% = round(sum(Cached Tokens) / sum(Fresh Tokens + Cached Tokens) * 100)`.
 
-The **trend across runs** is the signal, not the absolute value: rising cache% = the testee is
-reusing context efficiently; falling cache% = context bloat creeping in.
+The **trend across runs** is the signal, not the absolute value: a falling estimated reuse share
+suggests context bloat creeping in; a rising one, efficient reference reuse. Trend claims from
+estimates stay labeled as such — they never become causal waste findings on their own.
 
 > Never print a precise token number you cannot substantiate. The numbers exist to show a *trend*,
 > not to bill anyone.
@@ -169,27 +172,58 @@ missing, mark the row `~unknown`, exclude it from the aggregate (or surface it a
 bucket), and explain the missing basis — never fold it in as `Cached Tokens = ~0`: unknown cache use
 is not an observed zero-percent hit rate, and a low-cache diagnosis needs observed data.
 
-## Cache-health finding rule
-
-Cache% is the operational signal for testee-tuning:
-
-- Any **individual step with cache% < 40%** → it is re-reading files or re-sending prompt context
-  unnecessarily. Emit a **P3** finding naming that step, **even if the step succeeded**.
-- A run with **aggregate cache% < 50%** → the testee is a tuning candidate regardless of the
-  PASS/PARTIAL/FAIL verdict. Emit a **P3** finding: "Low cache hit rate — candidate for
-  context-window or prompt trimming."
-
-These feed the report's §6 Findings (see [report-template.md](report-template.md)).
+## Context-reuse observation rule (task 0913, R3 — replaces the fixed-threshold cache-health rule)
+
+The estimated reuse share is a **heuristic** (chars/4 over the driver's own session); it cannot
+prove provider cache behavior, unnecessary re-reading, or realized savings. Threshold crossings
+(40%, 50%, or any other fixed line) therefore **never auto-generate a causal waste finding**.
+Instead:
+
+- **Estimated-only evidence** (chars/4 ledger, no external meter): a low estimated reuse share may
+  be reported only as a **labeled hypothesis** finding carrying the `[unverifiable]` tag, naming
+  the confirmation it needs (per-step provider telemetry, a real meter, or a measured reread
+  trace). Example shape: `P3 — estimated reuse share 36%, below the run's own trend — hypothesis:
+  repeated task-list refetching; confirm with per-step metering` `[unverifiable]`.
+- **Measured evidence** (ccusage session/day delta, or agent usage fields in tool results): report
+  the measured figures with their scope label and confidence, and keep them out of per-step ledger
+  cells. A waste finding may then name the measured evidence — still without claiming causality
+  the meter does not show.
+- **Unavailable evidence**: print `Meter: n/a` and totals `n/a` rather than a fabricated share;
+  route the missing-measurement gap to its owner as an improvement proposal.
+
+Unobservable chained-step cost keeps its **mandatory** P3 finding (`P3 — chained-step cost not
+observable`, task 0278 R3) — that rule reports missing evidence, not causal waste, and stays.
+
+These findings feed the report's §6 Findings (see [report-template.md](report-template.md)).
+
+## Pipeline-run provenance observations (task 0913, R5)
+
+When the testee drives a task pipeline, the driver may adopt the supported findings from the
+0912 workflow baseline (`docs/reports/i31/0912-workflow-baseline.md`) as bounded observations —
+with artifact anchors and owner handoffs, never as invented performance conclusions:
+
+- **Run-row closure / structured emission (supported, pilot-selected):** if the observed pipeline
+  run leaves a non-terminal run row or emits no `action_runs` rows, record the observation with
+  the run id as anchor and hand off to the owners named in the baseline (driver adoption: D62;
+  row-closure defect: P). These are the baseline's pilot-eligible findings (F1/F2).
+- **Performance conclusions (INSUFFICIENT_EVIDENCE in the baseline):** no token/USD, percentage,
+  speedup, or fleet claim may be derived from a dogfood run. Record the limitation explicitly
+  (what was unmeasured and why) and route the missing evidence to the baseline's named gaps
+  (session/cost joins E6; scoped-gate experiment F3/F4; fleet serve session S5).
+- Historical comparison, recurrence, and cohort trends stay with history-anatomy and existing
+  doctor tooling — the dogfood report owns only what its own ledger observed.
 
 ## Cache-conservation discipline (how to keep cache% high)
 
-The cache-health rule above *detects* waste; this section is the mitigation. The dogfooding driver
+The context-reuse observation rule above interprets the signal; this section is the mitigation. The
+dogfooding driver
 (the agent running Phase 2/3) controls most of the cache% it later reports — low cache% is usually
 the driver re-fetching data it already holds. Apply these while monitoring each step:
 
 ### Driver cache checklist (task 0278 R7)
 
-When aggregate cache% risks falling under 50%, apply this checklist **before** re-reading:
+When the estimated reuse share looks low (or trends down across runs), apply this checklist
+**before** re-reading:
 
 | # | Action | Why |
 | --- | -------- | ----- |
@@ -198,12 +232,13 @@ When aggregate cache% risks falling under 50%, apply this checklist **before** r
 | 3 | Prefer `--json` CLI over re-parsing freeform prose | Smaller, stable payloads |
 | 4 | Dual-write ledger rows without re-reading the whole report each step | Append/patch; don't full-file re-load |
 | 5 | Skip redundant `bun test` full suite between steps when a focused file suite already green | Run the broad suite once at the end |
-| 6 | For batch testees (`verifyall` / `runall` / `refineall`): freeze `task list --json` once at resolve | Re-listing the set per task is the #1 sub-50% cache pattern on feature dogfoods |
-| 7 | On re-verify of done tasks: re-read only cited `file:line` anchors, not full Solution blobs | Anchor-first re-verify keeps cache% above the 50% floor |
+| 6 | For batch testees (`verifyall` / `runall` / `refineall`): freeze `task list --json` once at resolve | Re-listing the set per task is the #1 low-reuse-estimate pattern on feature dogfoods |
+| 7 | On re-verify of done tasks: re-read only cited `file:line` anchors, not full Solution blobs | Anchor-first re-verify keeps the reuse estimate honest and high |
 
 1. **Reuse CLI output already in context.** If a prior step (or a prior tool call this step)
    captured `spur task show`/`check`/`list` output, do **not** re-invoke the same command for that
-   data — reference the prior result. Re-invocation is the #1 cause of sub-40% steps. Only re-fetch
+   data — reference the prior result. Re-invocation is the #1 cause of low estimated-reuse steps.
+   Only re-fetch
    when the underlying state *changed* (e.g. you just wrote a section and need the new
    `requiredSections`).
 2. **Don't re-ground shared scaffolding per step.** Command docs, the skill preamble, and the
@@ -217,7 +252,8 @@ When aggregate cache% risks falling under 50%, apply this checklist **before** r
    useful as a trend if it reflects what actually happened.
 
 The point is not to game the number — it is to drive the testee (and your own monitoring) toward
-reusing context, which is the real cost saving the cache% signal stands for.
+reusing context, which is the context-efficiency gain the estimated reuse share stands for. The
+share itself remains a heuristic trend signal (task 0913, R3), not a measured saving.
 
 ## Worked ledger example
 
@@ -230,6 +266,7 @@ reusing context, which is the real cost saving the cache% signal stands for.
 | 4 profile | 1 | PASS | — | — | ~500 | ~350 | 41% | command output + prior profile reused | ~2s |
 ```
 
-Aggregate: total = `3700 + 2050 = 5750`; cached = `2050`; cache% =
-`round(2050 / 5750 * 100) = 36%` `[~estimate]` — below the 50% floor, so emit the P3 cache-health
-finding.
+Aggregate: total = `3700 + 2050 = 5750`; cached = `2050`; estimated reuse share =
+`round(2050 / 5750 * 100) = 36%` `[~estimate]`. A low estimated reuse share is reported only as a
+labeled-hypothesis `[unverifiable]` finding (or backed by a real meter) — never as an automatic
+causal waste claim (task 0913, R3).

package/plugins/sp/skills/dogfood-testing/references/report-template.md

@@ -96,8 +96,21 @@ Skeleton is written in Phase 1; filled as the run progresses; finalized in Phase
 - **Mode:** `observe-only (--max-retry 0)` | `fix (--max-retry N)`
 - **Task under test:** WBS + title (if applicable)
 - **Run id:** `<run_id>` · **Live:** `<live_path>` · **Report:** `<report_path>`
+- **Source evidence:** `<commit sha>` + dirty-state (`clean` | `porcelain hash` | `unrecorded`)
+- **Definition:** resolved definition digest, or `path+hash`; `unknown` when not resolvable
+- **Execution mode:** `<observe-only | fix>` · driver/testee separation noted for chained legs
+- **Measurement scope:** `<driver ledger (chars/4, per-step) | ccusage <day\|session> | agent usage fields>`; external meter name or `none`
+- **Sample coverage:** `<k>/<n>` executed steps observed; testee workflow/run/session IDs `<ids | unknown>`
 ```
 
+**Provenance and comparability (task 0913, R4 — additive).** The provenance lines above are
+optional in `@1.2`: legacy reports without them remain readable and valid, but are **not
+automatically eligible for comparison**. Before treating two reports as comparable, require
+compatible measurement scope, execution mode, and resolved definition identity; otherwise emit
+**`not comparable`** and route the missing evidence to its owner. Unsupported identifiers are
+recorded as `unknown` — never invented. Driver cost and testee/chained-leg cost stay separate
+rows; pilot comparisons must not mix them.
+
 When `status` is `aborted` or the report is partial, add under §1:
 
 ```
@@ -122,14 +135,22 @@ When `status` is `aborted` or the report is partial, add under §1:
 
 **Cost honesty rules:**
 
-- Always include ledger-derived `~estimate` total / cached / cache% with a **Method** line and
+- Separate the three evidence classes in every Cost block (task 0913, R3): **measured** usage
+  (real meter, scope-labeled), **heuristic estimates** (chars/4 ledger, labeled `~estimate`,
+  confidence `LOW`), and **unavailable** values rendered `n/a` — never a fabricated number or a
+  share computed over unknown rows.
+- Always include ledger-derived `~estimate` total / cached / reuse share with a **Method** line and
   **confidence** (`LOW` when estimate-only; `MEDIUM` when a real meter is also present).
 - Optional meters when available (never invent):
   - `ccusage` session/daily delta — label scope (`day` / `session`), **not** per-step
   - agent usage fields if present in tool results
-- If no meter: print `Meter: n/a` explicitly.
+- If no meter: print `Meter: n/a` explicitly; if no ledger row is observable, print totals and
+  share as `n/a` rather than folding unknowns into zero.
 - Never present an unsubstantiated precise integer as billed/metered cost.
-- Aggregate cache% MUST equal the ledger formula (see §3); otherwise the report is invalid.
+- Observable totals MUST satisfy `total = fresh + cached` and the share MUST equal the ledger
+  formula over observable rows within display rounding (±1 point); the validator (task 0913)
+  rejects violations. The chars/4 figures estimate the driver session's context reuse — they are
+  **not** provider cache measurements and establish no realized savings.
 - **Chained-step segmentation (@1.2):** when a derived step is implement-heavy (the step runs a
   pipeline leg, writes code, or mutates more than its own arguments), its cost MUST be a separate
   ledger row tagged `chained:<step>` and kept out of the driver's row. If the chained leg ran in a
@@ -251,8 +272,8 @@ from the trailing feasibility tag:
 ```
 
 Omitting the class preserves the current line shape; untagged findings remain valid and the
-protocol stays `sp:dogfood-testing@1.2` (the validator gains no required field; the cache-health
-P3 above needs no class).
+protocol stays `sp:dogfood-testing@1.2` (the validator gains no required field; an
+evidence-based reuse observation needs no class).
 
 - `testee` — a defect in the testee's contract (the protocol the run grades). Bounded fix-mode
   may repair it, unchanged.
@@ -278,13 +299,15 @@ Severity scale:
   finding:** when a drift row (`drift:external`) is present in the ledger, a P2 finding naming the
   drifted paths is mandatory in the report (not optional). The finding states the run's evidence is
   degraded, not voided. See [SKILL.md §Workspace-drift guard](../SKILL.md#workspace-drift-guard-r2--task-0296).
-- **P3** — efficiency / DX / observation (includes the cache-health rule below).
+- **P3** — efficiency / DX / observation (includes evidence-based context-reuse observations below).
 - **P4** — nice-to-have, cosmetic, or speculative.
 
-**Cache-health rule** (from [monitor-ledger.md](monitor-ledger.md)): if aggregate cache% < 50% or any
-step < 40%, emit a **P3** — "Low cache hit rate — candidate for context-window or prompt trimming"
-with the offending step(s). Absolute token totals from the heuristic are trend-only (`[unverifiable]`
-as billable cost proof is expected).
+**Context-reuse observation rule** (task 0913 — replaces the fixed-threshold cache-health rule;
+see [monitor-ledger.md](monitor-ledger.md)): estimated reuse shares (chars/4) never auto-generate
+causal waste findings. Report a low estimated share only as a labeled-hypothesis finding carrying
+`[unverifiable]` and naming the confirmation needed, or cite measured meter evidence with its
+scope. Absolute token totals from the heuristic are trend-only (`[unverifiable]` as billable cost
+proof is expected).
 
 **Migration grep rule.** When dogfooding migrations or retired surfaces, distinguish intentional
 legacy-term mentions in guidance from live routed surfaces. Pair any broad grep for old skill or

package/plugins/sp/skills/history-anatomy/references/modes.md

@@ -1,7 +1,9 @@
 # Mode contract — `sp:history-anatomy` (HA-S1, 0658)
 
 The skill resolves exactly two modes. Everything else fails loud. This matrix is the enforcement
-surface the workflow (0660) and the skill share; keep the vocabulary frozen.
+surface the workflow (0660) and the skill share; keep the vocabulary frozen. Execution note
+(0920): argument validation runs deterministically in the `history-anatomy-cache` helper `paths`
+command before the workflow starts; the model hop no longer performs it.
 
 ## Mode vocabulary (frozen)
 
@@ -26,7 +28,7 @@ Rejected arguments (each fails loud, naming the offending argument):
 | --- | --- |
 | focus text (positional) | Daily mode has no focus string. |
 | `--since` / `--until` | Daily always uses the calendar-day window. |
-| `--output` | Daily always writes to the run directory (see 0660). |
+| `--output` | Daily always writes to `docs/report/<date>-history-anatomy.md` (the executing helper's default; 0660). |
 
 A daily invocation must print the normalized **inclusive ISO bounds** and the timezone used, so the
 wall-clock window is auditable.
@@ -40,7 +42,7 @@ Requires a **non-empty focus** and **two ordered inclusive bounds**.
 | focus (positional) | Required; a missing or empty focus fails loud. |
 | `--since <iso>` | Required; the inclusive lower bound. |
 | `--until <iso>` | Required; must be present with `--since`; must not be earlier than `--since`. |
-| `--output <path>` | Optional; when present, writes to that explicit path. When absent, writes to the run directory. |
+| `--output <path>` | Optional; when present, writes to that explicit path. When absent, writes to `docs/report/<date>-history-anatomy.md` (the executing helper's default). |
 
 Rejected arguments (each fails loud, naming the offending argument):
 

package/plugins/sp/skills/next-feature/references/ranking-rubric.md

@@ -40,7 +40,7 @@ and no command-derived number or `file:line` citation is a defect in the report,
 ## The gated list
 
 Gated features are listed **separately, never ranked**, each with its gate reason from the
-actionability pass (`blocked: 0142 — external trigger` / `no open tasks` / `all tasks terminal`).
+actionability pass (`blocked: <wbs> — external trigger` / `no open tasks` / `all tasks terminal`).
 Features whose gate reason is "all tasks terminal" are T4 candidates — say so once, in the sync-first
 block, rather than repeating per row.
 

package/plugins/sp/skills/next-router/references/routing-table.md

@@ -113,6 +113,13 @@ token, deterministic).
 | C3 | A5/A6 when Testing empty/N/A **and** verify would fail for missing tests — only if prior implement claims code exists | Coverage/test signal: `bun test` fail attributed to task paths OR explicit "insufficient tests" in prior verify verdict artifact `.spur/run/<wbs>-verdict.json` | test fail / coverage gap | `/sp:dev-unit <wbs> --auto` | continue |
 | C4 | A3/A5/A6 when operator or task tags mention rules, OR `spur rule run` last report dirty in `.spur/` if present | `spur rule run` (default project preset) non-zero with findings | rule findings | **HITL STOP** — print rule summary; suggest `/sp:rule-scan` or `rule-add`/`rule-refine` (do not auto-author rules) | continue |
 | C5 | A6 only | Existing `.spur/run/<wbs>-verdict.json` with FAIL and findings pointing at coverage | verdict artifact | `/sp:dev-unit <wbs>` then re-verify on next invocation (`--once` friendly) | `/sp:dev-verify …` |
+| C6 | A4/A5 | `.spur/run/<wbs>-verdict.json` has a failing (PARTIAL/FAIL) `residual-sweep` check — the bounded remediation loop already ran and failed (F96) | folded verdict artifact | **HITL STOP** — print `.spur/run/<wbs>-residual-report.md` and the recovery command `/sp:dev-run <wbs>`; never auto-dispatch a fix (repeating the loop unattended burns quota without new information) | continue |
+
+**C-row precedence note (F96):** C6 outranks C2/C3/C5 for the same task — a residual-sweep failure
+means the workspace holds unfinished task residue, so fixall/unit reruns would either clean it
+unintentionally or re-certify a folded verdict. C6 fires before any fix/unit dispatch; recovery is
+the operator re-running the pipeline (`/sp:dev-run <wbs>`), which re-enters the normal
+verify → test-fix remediation budget.
 
 **Explicit non-probes in v1:** no freeform chat history; no always-on full `bun run test` for every
 call; no git dirtiness as a route (optional advisory print only).

package/plugins/sp/skills/parallel-execution/references/dispatch-surface.md

@@ -37,7 +37,7 @@ native subagent.
 | 1 | **Different model or coding agent required** | The step needs a model or a coding agent the host session cannot provide (`--model`, `--agent`). | "verify on o3" where the host is Claude Code; "run this through omp" from a non-omp host. |
 | 2 | **Headless or unattended step** | The step must run without a live session - scheduled, detached, or driven by a non-interactive caller. | A batch launched by `spur workflow run --async` with no operator attached. |
 | 3 | **Durable auditable run record required** | The dispatch must produce a persisted run record (cost ledger, trace, exit code) for after-the-fact audit. | `spur agent run` writes `.spur/run/` artifacts; a native subagent does not. |
-| 4 | **Workspace or credential isolation required** | The step must run in a separate workspace, worktree, or credential scope from the orchestrating session. | A destructive step isolated to a throwaway worktree; a step that must not inherit the session's `cwd` secrets. |
+| 4 | **Workspace or credential isolation required** | The step must run in a separate workspace, worktree, or credential scope from the orchestrating session. | A destructive step isolated to a throwaway worktree; a step that must not inherit the session's `cwd` secrets; `--mode parallel` batch fan-out, one worktree per task ([execution-batch.md § Parallel isolation](../../spur-dev/references/execution-batch.md#parallel-isolation---mode-parallel)). |
 
 ## The naming requirement
 

package/plugins/sp/skills/session-review/SKILL.md

@@ -84,7 +84,14 @@ three buckets — never skip triage and start fixing from the raw findings list.
    Apply the placement rule in
    [the environment-improvement mapping](../../references/environment-lens.md): automate with a
    check when possible, place coding standards on the review path, and keep always-loaded steering
-   as navigation pointers.
+   as navigation pointers. When the session drove a task pipeline, at most three bounded
+   diagnostic questions may be drawn from the supported observations (F1/F2) and measured
+   overhead candidates (F3/F4) in the 0912 workflow baseline
+   (`docs/reports/i31/0912-workflow-baseline.md`) — e.g. repeated gate runs (F4), full-loss
+   test-fix timeouts (F3), or unemitted/non-terminal run rows (F1/F2) — each citing its artifact
+   anchor and owner handoff (driver adoption D62, row-closure defect P). Areas the baseline marks
+   INSUFFICIENT_EVIDENCE (token/USD, percentages, fleet) stay excluded; record the limitation
+   instead of a performance conclusion.
 5. **Render the report.** Use the exact compact output contract below. Omit empty table rows, not
    headings; write `None observed` when a section has no supported entry.
 
@@ -123,7 +130,10 @@ session. Do not list ordinary implementation steps as issues.
 ### Process and environment improvements
 
 For each supported proposal, name its owner surface, expected impact, verification method, and
-reversibility. Proposals remain report-only: apply no change and create no task.
+reversibility. Proposals remain report-only: apply no change and create no task. A pipeline
+observation adopted from the 0912 workflow baseline cites its anchor
+(`docs/reports/i31/0912-workflow-baseline.md`) and owner handoff, and carries no unsupported
+performance claim.
 
 ### Triage (only when `--triage` was passed)