@gobing-ai/spur 0.3.91 → 0.3.92

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.91",
+            "version": "0.3.92",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -36,10 +36,10 @@
             "decision": null
         },
         "history-anatomy": {
-            "modelQueries": 4,
+            "modelQueries": 3,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
+            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the history-anatomy-cache paths command.",
             "decision": null
         },
         "wayfinder-resolution": {

package/config/plugin-scripts.json

@@ -48,7 +48,13 @@
         },
         {
             "rel": "inline-run-setup.ts",
-            "contract": "repo-only"
+            "contract": "standard",
+            "twin": "inline-run-setup.mjs"
+        },
+        {
+            "rel": "feature-verification-steps.ts",
+            "contract": "standard",
+            "twin": "feature-verification-steps.mjs"
         },
         {
             "rel": "idea-coverage-check.ts",
@@ -63,11 +69,21 @@
             "contract": "standard",
             "twin": "pr-reviewing.mjs"
         },
+        {
+            "rel": "record-feature-sync.ts",
+            "contract": "standard",
+            "twin": "record-feature-sync.mjs"
+        },
         {
             "rel": "quality-gate.ts",
             "contract": "standard",
             "twin": "quality-gate.mjs"
         },
+        {
+            "rel": "residual-scan.ts",
+            "contract": "standard",
+            "twin": "residual-scan.mjs"
+        },
         {
             "rel": "script-contract-check.ts",
             "contract": "repo-only"

package/config/workflows/feature-lifecycle.yaml

@@ -40,9 +40,17 @@ states:
     onEnter:
       # Caller wiring (task 0880, ADR-119): entering verification RUNS the
       # feature-scoped pass instead of only passively reading its status file.
+      # 0948 R1: pass BOTH vars the inner workflow needs. `--vars` was documented as
+      # replace-not-merge and a partial override silently blanked `spurBin`; the engine
+      # merges declared defaults today (0948 R2), but the caller stays explicit so the
+      # nested run is self-sufficient under either semantic.
       - kind: shell
         options:
-          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\"}"'
+          # Pass featureId and spurBin together. A partial --vars map used to be
+          # applied as a replacement, so the inner run lost spurBin and loadModule
+          # fell into source mode (0948 R1). The nested JSON is shell-expanded:
+          # $spurBin inside the double quotes keeps a multi-word invocation intact.
+          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\",\"spurBin\":\"$spurBin\"}"'
   - id: blocked
     description: Impediment; work suspended.
   - id: done
@@ -68,13 +76,14 @@ transitions:
   - from: verifying
     to: done
     description: >
-      Feature verified — complete. Requires the feature-scoped verification pass
-      (ADR-119) to have recorded PASS, then strict check (AC validated,
-      traceability clean).
+      Feature verified — complete. The strict check at the done boundary also
+      validates the bound verification receipt (D63 task 0915): current, PASS,
+      matching feature identity and verifier contract, digest-chained to the
+      checked inputs. Stale/missing/failed evidence denies the hop.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS && $spurBin feature check $featureId --strict --as done'
+        command: '$spurBin feature check $featureId --strict --as done'
 
   # Rework: verifying → active (mandatory History entry)
   - from: verifying

package/config/workflows/feature-verification.yaml

@@ -1,29 +1,34 @@
-# Feature-scoped verification pass (ADR-119, feature D62, task 0872).
+# Feature-scoped verification pass (ADR-119, feature D62, task 0872; D63 task
+# 0915 remediation folds the evidence contract into a workflow-owned script).
 #
 # Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
-# invariant spans the repository rather than a single task's diff — corpus
-# consistency, contract baselines, dependency/schema drift, the frozen History
-# surface, and the repo-wide test set. They run once per feature, deliberately
-# the slow pass; `feature-lifecycle`'s verifying entry invokes this workflow (task
-# 0880 caller wiring), and its verifying→done guard refuses to complete the
-# feature until this pass records PASS (ADR-119 consequence: a feature is not
-# done until it passes).
+# invariant spans the repository rather than a single task's diff. They run
+# once per feature, deliberately the slow pass; `feature-lifecycle`'s verifying
+# entry invokes this workflow (task 0880 caller wiring), and its verifying→done
+# guard refuses to complete the feature until this pass records PASS (ADR-119
+# consequence: a feature is not done until it passes).
 #
-# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D62"}'
+# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D63"}'
 #
-# Shape: verify -> done | failed. The shell action writes the verdict to
-# `.spur/run/<featureId>-feature-verification.status` and always exits 0; the
-# transition guard reads the status so a missing, corrupt or FAIL verdict routes
-# to `failed` (fail-closed), never a silent PASS.
+# Shape: verify -> done | failed. The onEnter step runs the standard script
+# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# resolves this very definition for the verifier identity (name, source path,
+# layer, definition digest), records the RUNNING receipt (run-scoped +
+# feature-latest copies), registers the run-scoped receipt as a run artifact,
+# runs the configured verification command via the safe launch splitter, and
+# completes the receipt PASS/FAIL with the after-pass proof-input digest. A
+# changed tree during the pass records FAIL.
 #
 # Reliability (aligned with task-pipeline / ADR-043): no agent.run nodes; the
-# verification command is a trusted config var executed via `sh -c` (same
-# surface as task-pipeline's qualityGateCmd — never interpolate untrusted input).
+# verification command comes from `vars.verificationCmd` below and is never
+# interpolated through a shell. The always-exit-0 onEnter means missing,
+# corrupt or FAIL evidence routes to `failed` via the guard (fail-closed),
+# never a silent PASS; infrastructure errors exit nonzero and surface.
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-verification
 version: "1"
-description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records PASS/FAIL. Invoked by feature-lifecycle's verifying entry."
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records a bound PASS/FAIL evidence receipt. Invoked by feature-lifecycle's verifying entry."
 iterationBound: 2
 initialState: verify
 terminalStates:
@@ -35,37 +40,40 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
+  __runId: ""
 
 states:
   - id: verify
     description: >
-      Run the repo-wide check set, record the verdict, always exit 0.
+      Run the repo-wide check set via the standard verification script, which
+      records the bound evidence receipt (verifier identity, checked-input
+      digest, run identity) and the coarse status file, always exit 0 so the
+      transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run;
-            sh -c "$verificationCmd" > ".spur/run/$featureId-feature-verification.log" 2>&1
-            && printf 'PASS\n' > ".spur/run/$featureId-feature-verification.status"
-            || printf 'FAIL\n' > ".spur/run/$featureId-feature-verification.status";
-            exit 0
+            bun plugins/sp/scripts/feature-verification-steps.ts verify
+            --feature-id "$featureId"
+            --run-id "$__runId"
+            --spur-bin "$spurBin"
 
   - id: done
-    description: Terminal — repo-wide checks passed.
+    description: Terminal — repo-wide checks passed and the receipt is bound.
 
   - id: failed
-    description: Terminal — repo-wide checks failed or the verdict is missing/corrupt.
+    description: Terminal — repo-wide checks failed or the evidence is missing/corrupt.
 
 transitions:
   - from: verify
     to: done
-    description: Repo-wide checks passed — the feature-scoped verification pass records PASS.
+    description: Repo-wide checks passed — the script completed the receipt with PASS.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS'
+        command: 'test "$(cat .spur/run/$__runId-feature-verification.status 2>/dev/null)" = PASS'
   - from: verify
     to: failed
-    description: Repo-wide checks failed (or the verdict is missing/corrupt) — stop at failed.
+    description: Repo-wide checks failed (or the evidence is missing/corrupt) — stop at failed.
     guard:
       kind: always

package/config/workflows/history-anatomy.yaml

@@ -11,7 +11,7 @@
 # would exceed the shell composition threshold and be flagged as an owned-capability candidate.
 #
 # Shape:
-#   start -> resolve-scope -> resolve-paths -> analyze -> cache-probe
+#   start -> resolve-paths -> analyze -> cache-probe
 #            (hit  -> refresh-provenance -> publish -> published)
 #            (miss -> render -> enrich -> structure-gate -> validate -> stamp -> publish)
 #            (structure-gate FAIL -> correct (max 2 total) -> structure-gate; exhausted -> failed)
@@ -28,7 +28,7 @@
 #
 # Vars (all must be declared here — the vars: block is the only safe shape; `spur workflow
 # validate` and the skill-structure test enforce it):
-#   mode      — "daily" (default) | "ad-hoc" (validated in resolve-scope)
+#   mode      — "daily" (default) | "ad-hoc" (validated deterministically by the helper `paths` command)
 #   date      — YYYY-MM-DD for --date (daily); empty for ad-hoc
 #   since     — inclusive ISO lower bound (ad-hoc; also normalizes daily via the DST-aware rule)
 #   until     — inclusive ISO upper bound (ad-hoc)
@@ -39,7 +39,7 @@
 #   focus     — ad-hoc focus string (required in ad-hoc mode, rejected in daily)
 #   recompute — "true" forces the full analyze/render/enrich/validate path (cache disposition
 #               forced-recompute)
-#   output    — explicit report output path; default run directory
+#   output    — explicit report output path; default docs/report/<date>-history-anatomy.md
 #   agent     — executor for the agent.run stages (enrich/validate)
 #   spurBin   — PATH-independent spur invocation (overridden by CLI at run start)
 #   __runId   — run-scoped id for explicit artifact paths (allocated in start)
@@ -85,28 +85,22 @@ states:
     description: >
       Allocate the run-scoped id and root. Every analyze/render path in this workflow writes to
       an explicit unique path under this run id — no stage reads the mutable latest.json pointer.
+      The retained identity is `.spur/run/<runId>-history-anatomy-run.id` (0948 R8). The fixed
+      `history-anatomy-run.id` name is only a latest pointer and is overwritten by the next run.
     onEnter:
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run;
             if [ -z "$__runId" ]; then __runId=$(uuidgen | tr 'A-Z' 'a-z' | cut -c1-8); fi;
-            echo "$__runId" > .spur/run/history-anatomy-run.id
+            echo "$__runId" > ".spur/run/$__runId-history-anatomy-run.id";
+            cp ".spur/run/$__runId-history-anatomy-run.id" .spur/run/history-anatomy-run.id
+          # 0948 R8 retention disposition: `history-anatomy-run.id` is a SINGLE fixed-name
+          # pointer that is overwritten every run — it does not accumulate, so it needs no
+          # reclamation path (unlike the run-record pair and legacy `.log` files, which
+          # `spur workflow clean --logs` owns). It is deliberately NOT a run record and is
+          # exempt from the catalog record-name sweep (see run-record-catalog.test.ts).
 
-  - id: resolve-scope
-    description: >
-      Dispatch the skill's mode validation (0658 references/modes.md): daily is the default and
-      rejects focus/since/until/output; ad-hoc requires a non-empty focus plus two ordered
-      inclusive bounds and rejects --date/--recompute. Writes the normalized selector artifact.
-    onEnter:
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: "Validate the mode arguments per sp:history-anatomy references/modes.md and write the normalized selector to .spur/run/${vars.__runId}-selector.json. mode=${vars.mode} date=${vars.date} since=${vars.since} until=${vars.until} focus=${vars.focus}. Reject conflicting arguments, naming the offending one; a rejection marks the run failed."
-          # Declared Layer-1 role (0538 R2): mode validation is a reviewer-standard judgment.
-          role: reviewer
-          expectFile: .spur/run/${vars.__runId}-selector.json
-          timeoutMs: ${vars.stepTimeoutMs}
 
   - id: resolve-paths
     description: >
@@ -122,6 +116,7 @@ states:
             h=$(superskill script path sp history-anatomy-cache.mjs);
             node "$h" paths --helper "$h" --report-dir "$reportDir" --date "$date"
             --output "$output" --mode "$mode" --since "$since" --until "$until"
+            --focus "$focus" --recompute "$recompute" --run-id "$__runId"
             --out .spur/run/$__runId-paths.txt
 
   - id: analyze
@@ -338,14 +333,8 @@ states:
 
 transitions:
   - from: start
-    to: resolve-scope
-    description: Scope resolved.
-    guard:
-      kind: always
-
-  - from: resolve-scope
     to: resolve-paths
-    description: Mode valid — resolve helper/skill/target paths once.
+    description: Mode/window grammar validated and paths resolved once (deterministic).
     guard:
       kind: always
 

package/config/workflows/idea-pipeline.yaml

@@ -461,10 +461,12 @@ states:
       plan, ac, decisions, dependencies, premises) so the deterministic task
       check passes, then writes the run-scoped ready evidence sidecar
       (.spur/run/${vars.__runId}-idea-ready.json) with one row per task: wbs,
-      status (ready|failed|skipped), planningDigest, and seven check rows.
-      Handoff-finalize verifies presence, digest and checklist evidence before
-      recommending auto runall; missing or failing evidence never fails the
-      run — it degrades the recommendation to ready-depth refineall.
+      status (ready|failed|skipped), planningDigest, and seven check rows,
+      with the premises row carrying tree-verified path:line citations
+      (0947). Handoff-finalize verifies presence, digest, feature binding and
+      checklist evidence before recommending auto runall; missing or failing
+      evidence never fails the run — it degrades the recommendation to
+      ready-depth refineall.
     onEnter:
       - kind: agent.run
         options:
@@ -483,7 +485,9 @@ states:
             for feature ${vars.featureId} per sp:spur-dev
             references/planning-workflow.md § Step 5.6 (Ready preparation): read
             .spur/run/${vars.__runId}-idea-batch-create-result.json and write
-            .spur/run/${vars.__runId}-idea-ready.json.
+            .spur/run/${vars.__runId}-idea-ready.json. The premises check row passes only
+            when each material premise was verified against the current tree and its evidence
+            cites at least one verified path:line (handoff-finalize lints it; task 0947).
           answerFile: .spur/run/${vars.__runId}-ready-prepare-answer.txt
           expectFile: .spur/run/${vars.__runId}-ready-prepare-answer.txt
       # Fail-closed shape validation (mirrors the order-sidecar guard). Absence is

package/config/workflows/task-pipeline.yaml

@@ -6,13 +6,18 @@
 # through the normal `spur task update <wbs> <status>` verb so the lifecycle guards
 # (0055) apply identically. Run linkage is written to `task_run_links` (kind=pipeline).
 #
-# Shape: precheck → implement → test[→test-fix↔test-recheck] → review → approve(HITL)
+# Shape: precheck → implement[→escalate] → test[→test-fix↔test-recheck] → review → approve(HITL)
 #        → verify → record → done
 #        (precheck failure short-circuits to `failed`; approve routes to `failed` on
 #        operator rejection or `cancelled` on operator cancel — R1, bug-750).
 #        `test` is the project quality gate (shell + bounded /sp:dev-fixall), not
 #        /sp:dev-unit (coverage gap-fill; router C3/C5).
 #
+# F96 residual sweep (0950): precheck captures the resume-safe base commit; verify
+# scans and folds residuals between the verdict and the proof bind (blocking leftovers
+# downgrade PASS → PARTIAL and take the existing remediation edge); done settles
+# deferrals; failed renders the recovery report. No new state, edge, or model query.
+#
 # Vars (passed as a JSON object via `--vars`):
 #   wbs                       — task WBS (required)
 #   profile                   — "auto" skips HITL approve (R4)
@@ -21,6 +26,7 @@
 #   implementTimeoutMs        — implement agent.run budget (ms)
 #   qualityGateCmd            — project gate (default: bun run spur-check)
 #   qualityGateMaxFixAttempts — max /sp:dev-fixall hops after a red gate (default: 2)
+#   maxEscalations            — max operator-question pauses per implement chain (default: 2)
 #
 # Seeded by `spur init`. agent.run inputs are pure slash commands (ADR-043).
 
@@ -90,6 +96,10 @@ vars:
     # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
     # Empty by default; only meaningful once the approve state has been entered.
     __hitlAnswer: ""
+    # Operator answer captured by the escalate hop's hitl.input (0933). Empty by
+    # default; set by `spur workflow continue --answer-text` after the pause and read
+    # by the escalate→implement / escalate→failed guards. Non-empty = answered.
+    __hitlInput: ""
     # Proof-state bracket (task 0612, ADR-071; restructured by task 0703). `proofDigest` is the
     # canonical capture taken at quality-gate ENTRY — immediately before the evidence-producing
     # final chain (quality → review → verify) — and re-captured at `test-recheck` when bounded
@@ -134,6 +144,14 @@ vars:
     # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
     # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
     qualityGateMaxFixAttempts: "2"
+    # Max operator-question pauses (0933) before the implement chain routes to failed.
+    # Escalation counter: .spur/run/<wbs>-escalation-count. Default 2 = two answered
+    # questions; a third pause routes to failed with a report note.
+    maxEscalations: "2"
+    # Runtime-written, 0933: the escalate hop's file.read.into-var fills this from
+    # .spur/run/<wbs>-question.md; the hitl.input prompt below references it. Declared
+    # here (empty) so the static var-reference validator sees the template source.
+    escalationQuestion: ""
     # Post-implement auto-format. Overridable like qualityGateCmd so a non-Bun seeded
     # project can point it at its own formatter; invoked best-effort (a missing or
     # failing formatter must never abort a run — the quality gate is the real gate).
@@ -156,6 +174,12 @@ vars:
     # (default) = on; set to "off" to bypass:
     # `--vars '{"implementScopeGuard":"off"}'`.
     implementScopeGuard: ""
+    # 0931 R5: parallel batches defer the per-task feature sync so a task branch never
+    # touches feature files or docs/features/INDEX.md. When "true", the record step's
+    # post-record shell appends a deferral note and skips the sync; the parallel batch
+    # orchestrator runs the sync + `spur feature refresh` once per touched feature on the
+    # base ref after integration. Sequential/inline keep the default "false" (unchanged).
+    deferFeatureSync: "false"
 
 states:
     - id: precheck
@@ -189,6 +213,12 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; S=plugins/sp/scripts/task-evidence-precheck.ts; [ -f "$S" ] || S="$(superskill script path sp task-evidence-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin"; else echo "task-evidence-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-evidence.status"; fi; exit 0
+          # (e) F96 R1 (0950): capture the run's base commit once — a resumed or re-entered run
+          # keeps its original base so residual scans stay anchored to the same diff.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; [ -f ".spur/run/$wbs-base.sha" ] || git rev-parse HEAD > ".spur/run/$wbs-base.sha"; exit 0
           # (e) route-reason lookup and routes log; proportional-routing tests locate it
           # (0759 R1/R5 run-scoped artifact; 0804 R8 run-id safety — one line, no in-scalar `#`).
           - kind: shell
@@ -222,6 +252,20 @@ states:
           that command DRIVES this pipeline, so calling it here recurses.
           --mode implement is the single-step implement entry.
       onEnter:
+          # 0933 R27 (guard-lines compression): the transcript append lives HERE, on
+          # (re-)entry, not in the escalate→implement guard. On first entry there is no
+          # pending question (no-op); on a resume entry the guard already confirmed a
+          # non-empty $__hitlInput and a fresh question file, so this shell records the
+          # Q/A pair (## Q<n>/## A<n>, R3) and consumes the question file before the
+          # agent.run re-dispatches — which also disarms the implement→escalate edge.
+          - kind: shell
+            options:
+                command: >-
+                    test -n "$__hitlInput" -a -s .spur/run/$wbs-question.md || exit 0;
+                    qn="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                    printf '## Q%s\n%s\n\n## A%s\n%s\n' "$qn" "$(cat .spur/run/$wbs-question.md 2>/dev/null)" "$qn" "$__hitlInput" >> .spur/run/$wbs-escalation.md;
+                    rm -f .spur/run/$wbs-question.md;
+                    exit 0
           - kind: agent.run
             options:
                 agent: ${vars.implementAgent}
@@ -232,13 +276,23 @@ states:
                 # resumes the implement session instead of re-reading the task cold.
                 session: reuse
                 # lives in /sp:dev-run --mode implement → sp:code-implementation, not YAML prose.
-                input: /sp:dev-run --mode implement ${vars.wbs} --auto
+                # 0933 R28: --escalation-file names the Q/A transcript the implement
+                # agent appends to when pausing and reads back on re-dispatch; absent
+                # on a first attempt means "no prior escalations".
+                input: /sp:dev-run --mode implement ${vars.wbs} --auto --escalation-file .spur/run/${vars.wbs}-escalation.md
                 timeoutMs: ${vars.implementTimeoutMs}
                 # R3 (task 0424): empty-implement no-op guard — the agent.run action
                 # fails the step when exit 0 produced zero non-corpus file changes, so
                 # a silent no-op routes the run to `failed` here instead of drifting
                 # into test/review and being caught a full pass later.
                 requireDiff: true
+                # 0933 R26: escalation contract — the agent.run option names the QUESTION
+                # file (the pause signal, deleted pre-dispatch for freshness); a paused
+                # attempt (agent wrote its question there and exited 0) succeeds with
+                # data.escalated=true and skips requireDiff for THAT attempt only. The
+                # Q/A transcript (.spur/run/<wbs>-escalation.md) is separate: it reaches
+                # the agent via --escalation-file in the input below.
+                escalationFile: .spur/run/${vars.wbs}-question.md
                 # 0706 R6: this stage mutates the working tree unattended under the
                 # auto profile, so it declares minimum execution-capability
                 # requirements. Dispatch fails closed (before spawn) when the
@@ -273,6 +327,39 @@ states:
             options:
                 command: "$formatCmd ; exit 0"
 
+    # ── escalate hop (operator-question pause, 0933) ──────────────────────────
+    # The implement agent paused on an operator question: it wrote
+    # .spur/run/<wbs>-question.md and exited 0 (agent.run reported
+    # data.escalated=true, skipping requireDiff for that attempt). This hop bounds
+    # the asks (counter), surfaces the question verbatim through the HITL responder
+    # (the run pauses here), and — after `spur workflow continue --answer-text <a>`
+    # delivers __hitlInput — resumes implement with the Q/A transcript
+    # (.spur/run/<wbs>-escalation.md) named in the implement input via
+    # --escalation-file. The transcript append + question-file consumption happen in
+    # the escalate→implement guard so a stale question can never re-trigger the hop
+    # after the answered attempt.
+    - id: escalate
+      description: >-
+          Operator-question pause (0933): the implement agent asked a question
+          headlessly; surface it to the operator and resume implement with the answer.
+      onEnter:
+          # Bounded asks: increment the per-task escalation counter before pausing.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)"; echo $((n + 1)) > .spur/run/$wbs-escalation-count; exit 0
+          # The agent's question, verbatim, becomes the pause prompt.
+          - kind: file.read.into-var
+            options:
+                file: .spur/run/${vars.wbs}-question.md
+                var: escalationQuestion
+          # Pause for the operator (responder pause:true stops the run after this
+          # onEnter; `spur workflow continue --answer-text <answer>` writes
+          # __hitlInput and re-evaluates the escalate guards).
+          - kind: hitl.input
+            options:
+                prompt: "${vars.escalationQuestion}"
+
     # ── test hop (quality gate + bounded auto-fix) ─────────────────────────────
     # NOT /sp:dev-unit. That command (sp:code-testing) *extends/generates* tests toward
     # a coverage target; it is not the project quality gate. Coverage gap-fill remains
@@ -358,6 +445,14 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; A=".spur/run/$wbs-test-fix-attempt"; n=$(cat "$A" 2>/dev/null || echo 0); printf '%s\n' "$((n + 1))" > "$A"; [ ! -f ".spur/run/$wbs-verdict.json" ] || { echo '--- verify verdict (remediation input, task 0703 R4) ---'; cat ".spur/run/$wbs-verdict.json"; } >> ".spur/run/$wbs-test-gate.log"; exit 0
+          # (d) F96 R3 (0950): hand the residual list to the remediation loop — dev-fixall
+          # treats residual items as fix targets and may defer P3/markers to
+          # residual-deferrals.json (see dev-fixall.md). Fold already merged the anchors
+          # into <wbs>-test-gate.findings; this carries the structured artifact too.
+          - kind: shell
+            options:
+                command: >-
+                    [ ! -f ".spur/run/$wbs-residuals.json" ] || { echo '--- residual artifact (F96 fix targets; deferrals go to residual-deferrals.json, P3/markers only) ---'; cat ".spur/run/$wbs-residuals.json"; } >> ".spur/run/$wbs-test-gate.log"; exit 0
           # R3 (0482): project the extracted gate anchors into a var so the dispatch input
           # can NAME the failing file:line, not merely point at a log. A vars template cannot
           # run a shell, so the read is an action, not an inline `$(cat ...)` substitution.
@@ -530,6 +625,16 @@ states:
           - kind: shell
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
+          # (d) F96 R2 (0950): residual-scan.ts owns the sweep; shell only resolves it.
+          # ONE hard action (scan+fold): a scanner crash fails verify closed — the
+          # verify→failed catch-all routes a missing/malformed verdict. Runs AFTER
+          # `task verdict` and BEFORE the jq bind so a blocking residual turns PASS
+          # into PARTIAL (fold rewrites the verdict artifact) and takes the existing
+          # verify→test-fix edge while attempts remain.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ ! -f "$S" ]; then echo "residual-scan failed closed — scanner not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'" >&2; exit 1; fi; case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" scan "$wbs" --spur-bin "$spurBin" && "$RUNNER" "$S" fold "$wbs" --spur-bin "$spurBin"
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
           # 0757 R4; definitionDigest 0759 R5; honest review stamp 0785 R4; soft action + hard guard).
           - kind: shell
@@ -584,10 +689,16 @@ states:
           # (d) feature-sync-bounded.ts owns the sync; shell adds the orphan note and fallbacks
           # (0411 retry-suppression; 0328 / ADR-0322). Best-effort `exit 0` — feature status sync is a
           # follow-up, not a completion gate; `record → done` runs `spur task check`.
+          # 0931 R5: with deferFeatureSync "true" (parallel mode) the deferral note lands in the
+          # task report and the sync is skipped entirely, so task branches never touch feature
+          # corpus files; the batch orchestrator performs the deferred sync on the base ref.
+          # The sync itself is owned by record-feature-sync.ts (ADR-115: the guard plus the old
+          # inline chain cannot share one shell); resolution follows the standard in-repo-first,
+          # superskill-staged fallback used by every pipeline checker.
           - kind: shell
             options:
                 command: >-
-                    FID=$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null); if [ -z "$FID" ]; then echo "Orphan task $wbs — no feature_id linked — proposal: consider linking to a parent feature." >> ".spur/run/$wbs-report.txt"; elif [ -f plugins/sp/scripts/feature-sync-bounded.ts ]; then bun plugins/sp/scripts/feature-sync-bounded.ts "$FID" --spur-bin "$spurBin" --json; elif M="$(superskill script path sp feature-sync-bounded.mjs 2>/dev/null)" && [ -f "$M" ]; then node "$M" "$FID" --spur-bin "$spurBin" --json; else $spurBin feature sync "$FID" --json; fi; exit 0
+                    S=plugins/sp/scripts/record-feature-sync.ts; [ -f "$S" ] || S="$(superskill script path sp record-feature-sync.mjs 2>/dev/null)"; [ "$deferFeatureSync" = "true" ] && echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt" || if [ -f "$S" ]; then bun "$S" --spur-bin "$spurBin"; else echo "feature sync skipped — record-feature-sync not found in plugins/sp/scripts/ nor staged" >> ".spur/run/$wbs-report.txt"; fi; exit 0
 
     - id: done
       description: >
@@ -595,6 +706,13 @@ states:
           guard runs `spur task check` before certifying; a genuinely non-compliant
           task routes to `failed` instead of a silent bad `done`.
       onEnter:
+          # (d) F96 R4 (0950): residual-scan.ts owns the settle; shell only resolves it.
+          # Soft best-effort (exit 0) — runs after certification and must never change
+          # the outcome; failure prints the re-run command.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" settle "$wbs" --spur-bin "$spurBin" || echo "residual-settle failed — re-run: residual-scan settle $wbs" >&2; else echo "residual-scan not staged — settle skipped — re-run: residual-scan settle $wbs" >&2; fi; exit 0
           # (c) command.gate owns the done transition with classified transient retry.
           - kind: command.gate
             options:
@@ -620,7 +738,28 @@ states:
     - id: failed
       description: >
           Terminal — precheck, quality-gate exhaustion, verify non-PASS, record check
-          failure, or operator rejection; reported, not advanced.
+          failure, or operator rejection; reported, not advanced. Also receives an
+          escalation-bound pause or an operator give-up (0933).
+      onEnter:
+          # 0933 R30 (guard-lines compression): the escalation-bound report note lives
+          # here as a conditional — no-op unless the run reached failed with a pending
+          # question at (or above) the ask bound (bound pause or final give-up). The
+          # unanswered question itself is appended to the task report (report.txt, R2).
+          - kind: shell
+            options:
+                command: >-
+                    n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                    test "$n" -ge "$maxEscalations" -a -s .spur/run/$wbs-question.md || exit 0;
+                    printf '\n## Escalation bound reached\n\nThe implement step asked an operator question %s times (bound %s) and ended without a resumable answer. Unanswered question:\n\n' "$n" "$maxEscalations" >> .spur/run/$wbs-report.txt;
+                    cat .spur/run/$wbs-question.md >> .spur/run/$wbs-report.txt;
+                    exit 0
+          # (d) F96 R5 (0950): residual-scan.ts owns the report; shell only resolves it.
+          # Soft (exit 0): a run that exhausts its fix budget on residuals leaves the
+          # report + recovery line while the task stays `wip`.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" report "$wbs" --spur-bin "$spurBin" || echo "residual-report failed — re-run: residual-scan report $wbs" >&2; else echo "residual-scan not staged — report skipped — re-run: residual-scan report $wbs" >&2; fi; exit 0
 
     - id: cancelled
       description: Terminal — pipeline cancelled by operator at the approval gate (R1).
@@ -644,12 +783,54 @@ transitions:
       guard:
           kind: always
 
+    # ── implement routing: escalation first (0933 R26/R30), then the linear body ──
+    # Declaration order matters: the escalation bound is checked FIRST — a paused
+    # attempt that already exhausted its maxEscalations asks routes to failed (with a
+    # report note appended in the same guard) instead of asking forever; then the
+    # question-presence hop; then the normal always edge. The bound guard requires a
+    # fresh question file so a COMPLETED implement after max asks still routes to test.
+    - from: implement
+      to: failed
+      description: Escalation bound exhausted — the agent paused again after maxEscalations operator answers.
+      # 0933 R30 (guard-lines compression): thin predicate; the report note is written
+      # by the failed state's onEnter when it observes a bound-exhausted pause.
+      guard:
+          kind: shell
+          options:
+              command: >-
+                  n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                  test "$n" -ge "$maxEscalations" -a -s .spur/run/$wbs-question.md
+    - from: implement
+      to: escalate
+      description: Implement agent paused on an operator question (non-empty question file) — pause for an answer.
+      guard:
+          kind: shell
+          options:
+              command: 'test -s .spur/run/$wbs-question.md'
     # ── linear body ──
     - from: implement
       to: test
       description: Implementation done — quality-gate probe.
       guard:
           kind: always
+    # escalate branching (0933 R27): an answered pause resumes implement — the transcript
+    # append and question consumption happen in implement's onEnter (guards stay thin
+    # under ADR-115 guard-lines caps); an empty answer is an operator give-up → failed
+    # (question + transcript preserved as evidence).
+    - from: escalate
+      to: implement
+      description: Operator answered — re-enter implement, which records the Q/A transcript and consumes the question.
+      guard:
+          kind: shell
+          options:
+              command: 'test -n "$__hitlInput"'
+    - from: escalate
+      to: failed
+      description: Empty operator answer — give-up routes to failed (question + transcript preserved as evidence).
+      guard:
+          kind: shell
+          options:
+              command: 'test -z "$__hitlInput"'
     # Soft probe branching (declaration order: PASS first, then FAIL, then defense).
     - from: test
       to: verify