@gobing-ai/spur 0.3.93 → 0.3.95

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.93",
+            "version": "0.3.95",
             "source": "./plugins/sp"
         }
     ]

package/README.md

@@ -59,6 +59,21 @@ If `~/.local/bin` isn't already on your `PATH`, add it (e.g. `export PATH="$HOME
 in your shell profile). Supported targets: `darwin-arm64`, `darwin-x64`, `linux-arm64`, `linux-x64`.
 Windows: use the Bun path under WSL.
 
+**Verification.** The installer downloads to a temp file, checks it against the release's
+`SHA256SUMS`, and only then atomically replaces `spur`. A failed download, a checksum mismatch, or a
+missing `SHA256SUMS` leaves an existing install untouched and exits non-zero. `SPUR_RELEASE_URL`
+overrides the download base URL (a mirror, or a `file://` directory in tests).
+
+The checksum is a **code-execution** boundary, not just an integrity check: having verified the
+download, the installer *runs* it (`spur init`), so a release whose `SHA256SUMS` cannot be verified
+is a release you cannot safely install. `SPUR_SKIP_VERIFY=1` is the single explicit bypass and
+prints a warning — keep it for local or air-gapped installs, and pipe the script into `sh` only from
+a source you trust.
+
+**Releasing standalone binaries.** Run `bun run build:binaries` in `apps/cli`, then upload **all**
+of `dist/cli/spur-*` **and** `dist/cli/SHA256SUMS` to the GitHub Release for the tag. A release
+without `SHA256SUMS` makes the installer fail by default.
+
 ### Package layout (what ships)
 
 The published tarball is a self-contained Bun bundle plus static assets:
@@ -98,6 +113,33 @@ spur status
 
 Every command supports `--json` for machine-readable output.
 
+### Extending the Spur Board
+
+A project can add its own Board modules — a compiled React tool or an embedded URL app — without
+editing this package. An installed Board reads them from a fresh project's `.spur/config.yaml`:
+
+```yaml
+bootstrap:
+  modules:
+    - id: team-board
+      name: Team board
+      icon: "🧭"
+      type: react
+      directory: board/team-board/dist
+      entry: index.js
+      styles: [index.css]
+    - id: docs
+      name: Documentation
+      icon: "📚"
+      type: iframe
+      url: https://docs.example.test/
+```
+
+`spur init` seeds `modules: []` (built-ins only); change selection with a config edit, then restart
+`spur serve` and reload. The full authoring contract — the declaration union, the
+`@gobing-ai/spur/board` type export, the Vite library setup and the frame/trust limits — is in the
+[downstream Board modules design](https://github.com/gobing-ai/spur/blob/main/docs/design/downstream-board-modules.md).
+
 ## Documentation
 
 Full docs, architecture, and the complete command surface live in the

package/board/index.d.ts

@@ -0,0 +1,38 @@
+// Generated by scripts/commands/emit-board-types.ts from
+// apps/web/src/modules/contribution.ts — edit the authoring source, then regenerate.
+import type { ComponentType } from 'react';
+/**
+ * Public authoring contract for a native (compiled React) Board module contribution
+ * (A8 / task 0988 R1).
+ *
+ * This file is the ONE authoring source for the declaration-only `@gobing-ai/spur/board`
+ * package export: `scripts/commands/emit-board-types.ts` emits `apps/cli/board/index.d.ts`
+ * from it, so the published ABI cannot drift from the Board's own types. Keep it
+ * type-only — no React *value* import may reach the CLI or plugin artifacts (the CLI
+ * ships no React; the contributor supplies compatible React types through its own
+ * devDependencies).
+ *
+ * Module metadata (id/name/icon/route) is deliberately absent: it is project
+ * configuration (one selection authority), while this shape carries only what the
+ * renderer needs to mount a contribution.
+ */
+export interface BoardModuleContribution {
+    /** Contribution protocol version this Board accepts. */
+    readonly apiVersion: 1;
+    /**
+     * Workspace component. Rendered inside the Board's React tree with the Board's own
+     * React instance — it must not call `createRoot`, and no private Board context is
+     * exported to it.
+     */
+    readonly component: ComponentType;
+    /** Optional companion the Board's right panel renders while this module is active. */
+    readonly rightPanelComponent?: ComponentType;
+}
+/**
+ * The named export a native Board module entry must publish.
+ *
+ * Declared rather than implemented: `@gobing-ai/spur/board` is a declaration-only export,
+ * not a runtime SDK (consumers import its types; their compiled ESM entry exports this
+ * name for the renderer).
+ */
+export declare const webModule: BoardModuleContribution;

package/config/plugin-scripts.json

@@ -93,6 +93,11 @@
             "rel": "script-contract-check.ts",
             "contract": "repo-only"
         },
+        {
+            "rel": "script-root.ts",
+            "contract": "standard",
+            "twin": "script-root.mjs"
+        },
         {
             "rel": "stage-registry-adapter.ts",
             "contract": "repo-only"

package/config/rules/boundary/test-subpath-boundary.yaml

@@ -0,0 +1,48 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Test-only subpath boundary — @gobing-ai/spur-app/testing and the app's testing/
+# module are for tests and the mock itself, never production sources (task 0975 R3).
+#
+# WHY: `@gobing-ai/spur-app/testing` (packages/app/src/testing/history-board-mock.ts)
+# is a test-only mock subpath (E82). A production import couples shipped code to a
+# fake, and it crept toward the server transport before 0961 severed the seam. The
+# evaluator's glob matcher is segment-aware with `*`/`**` only (no brace groups), so
+# the ts/tsx globs would need separate entries — the repo carries .ts sources only,
+# matching the dao-boundary precedent.
+#
+# Scope covers src trees only: `<workspace>/tests/**` directories stay outside, and
+# `packages/app/src/testing/**` (the mock's own home) is exempted explicitly.
+rules:
+  - id: no-testing-subpath-import
+    description: >
+      Production sources must not import the @gobing-ai/spur-app/testing subpath
+      (history-board mock, E82/0961). Tests under <workspace>/tests/** and the
+      packages/app/src/testing/** module itself are exempt.
+    severity: error
+    evaluator:
+      type: forbidden-import
+      config:
+        forbidden:
+          - specifier: "@gobing-ai/spur-app/testing"
+        scope:
+          include:
+            - "apps/**/src/**/*.ts"
+            - "packages/**/src/**/*.ts"
+          exclude:
+            - "packages/app/src/testing/**"
+
+  - id: no-relative-testing-module-import
+    description: >
+      packages/app production sources must not reach the testing/ module through
+      relative imports (from './testing/…' or '../…/testing…'). The testing/**
+      module itself and workspace tests/ directories are exempt.
+    severity: error
+    evaluator:
+      type: forbidden-import
+      config:
+        forbidden:
+          - pattern: "(?:from\\s+|import\\(\\s*)['\"](\\.\\.?/)+(?:[^'\"]*/)?testing(?:/|['\"])"
+        scope:
+          include:
+            - "packages/app/src/**/*.ts"
+          exclude:
+            - "packages/app/src/testing/**"

package/config/rules/strict/runtime-boundaries.yaml

@@ -73,6 +73,7 @@ rules:
 
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks
-            - "packages/app/src/services/workflow-service.ts" # composition advisory source (0775: facts extracted from the live definition inside the synchronous validate path; the baseline snapshot sync read was retired)
+            - "packages/app/src/services/workflow-service.ts" # run-log/checkpoint reclamation realpath confinement (:988, :1014)
+            - "packages/app/src/workflow/run-record.ts" # confined sync run-record reads: realpath + fstat byte-window (moved from workflow-service.ts, 0962)
             - "apps/cli/src/release-ops.ts" # sync manifest/workspace reads + Bun.write rewrites inside the git release flow (task 0617); mirrors task.ts sync-template exemption
             - "apps/cli/src/version-carriers.ts" # sync manifest reads + Bun.write rewrites for registered release carriers (task 0854); mirrors release-ops.ts sync exemption

package/config/rules/structure/protected-files.yaml

@@ -37,6 +37,10 @@ rules:
             # this rule's include scope — scanning generated copies only adds noise
             # (e.g. `id: task-implement-transition` trips the sk- token shape).
             - "apps/cli/config/"
+            # `apps/cli/plugins/` is the same kind of gitignored build:bundle output — a staged
+            # npm copy of `plugins/`, itself outside the include scope. Minified generated libs
+            # there trip the api-key shape (0976: HEAD's inline-run.generated.mjs fires too).
+            - "apps/cli/plugins/"
 
   - id: no-unsafe-git-commands
     description: "Unsafe git commands (force-push, hard reset) can overwrite history or cause data loss (AGENTS.md CRITICAL safety)."

package/config/workflows/feature-verification.yaml

@@ -50,13 +50,16 @@ states:
       digest, run identity) and the coarse status file, always exit 0 so the
       transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
+      # 0960 R2: run-start script-resolution identity — record which tree this run
+      # resolved (source-repo vs installed) before the verification step runs. Never aborts.
       - kind: shell
         options:
           command: >-
-            bun plugins/sp/scripts/feature-verification-steps.ts verify
-            --feature-id "$featureId"
-            --run-id "$__runId"
-            --spur-bin "$spurBin"
+            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; S=plugins/sp/scripts/feature-verification-steps.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp feature-verification-steps.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/idea-pipeline.yaml

@@ -84,6 +84,12 @@ states:
       handoff — no task execution. Soft agent doctor (status file) so doctor red
       routes to `failed` via transitions instead of a raw lifecycle abort.
     onEnter:
+      # 0960 R2: run-start script-resolution identity — record which tree this run
+      # resolved (source-repo vs installed) before any step executes. Never aborts.
+      - kind: shell
+        options:
+          command: >-
+            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
       - kind: note
         options:
           message: "Idea pipeline start for idea: ${vars.idea}"
@@ -254,12 +260,12 @@ states:
         options:
           command: >-
             mkdir -p .spur/run &&
-            S=plugins/sp/scripts/idea-coverage-check.ts &&
-            if [ ! -f "$S" ]; then S="$(superskill script path sp idea-coverage-check.ts 2>/dev/null)"; fi &&
+            S=plugins/sp/scripts/idea-coverage-check.ts;
+            [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp idea-coverage-check.ts 2>/dev/null)";
             if [ -n "$S" ] && [ -f "$S" ]; then
               bun "$S" --run-id "$__runId" --report ".spur/run/$__runId-idea-eval-report.md" --ac ".spur/run/$__runId-idea-ac-content.md" || printf 'FAIL run=%s checker exited nonzero (bun missing or checker crash)\n' "$__runId" > ".spur/run/$__runId-idea-coverage.reason";
             else
-              printf 'FAIL run=%s checker not found — run superskill install sp\n' "$__runId" | tee ".spur/run/$__runId-idea-coverage.reason" >&2;
+              printf 'FAIL run=%s checker not found — run superskill install sp --marketplace gobing-ai/spur\n' "$__runId" | tee ".spur/run/$__runId-idea-coverage.reason" >&2;
               printf 'FAIL\n' > ".spur/run/$__runId-idea-coverage.status";
             fi
       # 0945 R2: derive the route facts ONCE at this boundary (0769 pattern) — guards read these
@@ -558,7 +564,7 @@ states:
             elif H="$(superskill script path sp idea-handoff.mjs 2>/dev/null)" && [ -f "$H" ]; then
               node "$H";
             else
-              echo "idea handoff failed closed — idea-handoff script not found — run 'superskill install sp'" >&2;
+              echo "idea handoff failed closed — idea-handoff script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
               exit 1;
             fi
   - id: handoff

package/config/workflows/task-pipeline.yaml

@@ -13,9 +13,10 @@
 #        `test` is the project quality gate (shell + bounded /sp:dev-fixall), not
 #        /sp:dev-unit (coverage gap-fill; router C3/C5).
 #
-# F96 residual sweep (0950): precheck captures the resume-safe base commit; verify
-# scans and folds residuals between the verdict and the proof bind (blocking leftovers
-# downgrade PASS → PARTIAL and take the existing remediation edge); done settles
+# F96 residual sweep (0950, reordered 0983): precheck captures the resume-safe base
+# commit; record scans and folds residuals AFTER `task record` flips the verdict-proven
+# boxes (a post-record blocking leftover downgrades PASS → PARTIAL, fails the record →
+# done guard closed, and re-records Testing before the failed edge); done settles
 # deferrals; failed renders the recovery report. No new state, edge, or model query.
 #
 # Vars (passed as a JSON object via `--vars`):
@@ -187,6 +188,12 @@ states:
           Fast deterministic task readiness and size checks. Failures route to the
           `failed` terminal state (not a raw lifecycle abort mid-enter).
       onEnter:
+          # 0960 R2: run-start script-resolution identity — record which tree this run
+          # resolved (source-repo vs installed) before any step executes. Never aborts.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
           # (e) git-status hygiene advisory; never fails the run (0487 R6 / 0511 R1).
           - kind: shell
             options:
@@ -207,12 +214,12 @@ states:
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; S=plugins/sp/scripts/task-size-precheck.ts; [ -f "$S" ] || S="$(superskill script path sp task-size-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin" --max-reqs "$maxImplementReqs" --max-plan-items "$maxImplementPlanItems"; else echo "task-size-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-size.status"; fi; exit 0
+                    mkdir -p .spur/run; S=plugins/sp/scripts/task-size-precheck.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp task-size-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin" --max-reqs "$maxImplementReqs" --max-plan-items "$maxImplementPlanItems"; else echo "task-size-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp --marketplace gobing-ai/spur'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-size.status"; fi; exit 0
           # (d) task-evidence-precheck.ts owns the check; shell only resolves it and fails closed (0726 R2).
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; S=plugins/sp/scripts/task-evidence-precheck.ts; [ -f "$S" ] || S="$(superskill script path sp task-evidence-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin"; else echo "task-evidence-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-evidence.status"; fi; exit 0
+                    mkdir -p .spur/run; S=plugins/sp/scripts/task-evidence-precheck.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp task-evidence-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin"; else echo "task-evidence-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp --marketplace gobing-ai/spur'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-evidence.status"; fi; exit 0
           # (e) F96 R1 (0950): capture the run's base commit once — a resumed or re-entered run
           # keeps its original base so residual scans stay anchored to the same diff.
           - kind: shell
@@ -286,6 +293,13 @@ states:
                 # a silent no-op routes the run to `failed` here instead of drifting
                 # into test/review and being caught a full pass later.
                 requireDiff: true
+                # Verification-only re-run admission (task 0976): when requireDiff
+                # sees zero non-corpus changes because the implementation already
+                # landed through another path, `spur task check <wbs>` PASS admits
+                # the empty implement as a certification pass; a check failure
+                # keeps the 0424 R3 empty-implement violation. Static option —
+                # deliberately no run-var knob (ADR-115).
+                requireDiffAllowCleanCheck: true
                 # 0933 R26: escalation contract — the agent.run option names the QUESTION
                 # file (the pause signal, deleted pre-dispatch for freshness); a paused
                 # attempt (agent wrote its question there and exited 0) succeeds with
@@ -425,7 +439,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; if [ -f plugins/sp/scripts/quality-gate.ts ]; then bun plugins/sp/scripts/quality-gate.ts run; elif Q="$(superskill script path sp quality-gate.mjs 2>/dev/null)" && [ -f "$Q" ]; then node "$Q" run; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    mkdir -p .spur/run; if [ -f config/plugin-scripts.json -a -f plugins/sp/scripts/quality-gate.ts ]; then bun plugins/sp/scripts/quality-gate.ts run; elif Q="$(superskill script path sp quality-gate.mjs 2>/dev/null)" && [ -f "$Q" ]; then node "$Q" run; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: test-fix
       description: >
@@ -508,7 +522,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; if [ -f plugins/sp/scripts/quality-gate.ts ]; then bun plugins/sp/scripts/quality-gate.ts recheck; elif Q="$(superskill script path sp quality-gate.mjs 2>/dev/null)" && [ -f "$Q" ]; then node "$Q" recheck; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    mkdir -p .spur/run; if [ -f config/plugin-scripts.json -a -f plugins/sp/scripts/quality-gate.ts ]; then bun plugins/sp/scripts/quality-gate.ts recheck; elif Q="$(superskill script path sp quality-gate.mjs 2>/dev/null)" && [ -f "$Q" ]; then node "$Q" recheck; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: triage
       description: >-
@@ -528,7 +542,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; if [ -f plugins/sp/scripts/task-diffstat.ts ]; then bun plugins/sp/scripts/task-diffstat.ts --spur-bin "$spurBin"; elif D="$(superskill script path sp task-diffstat.mjs 2>/dev/null)" && [ -f "$D" ]; then node "$D"; else echo "task-diffstat failed closed — task-diffstat script not found — run 'superskill install sp'" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; fi; exit 0
+                    mkdir -p .spur/run; if [ -f config/plugin-scripts.json -a -f plugins/sp/scripts/task-diffstat.ts ]; then bun plugins/sp/scripts/task-diffstat.ts --spur-bin "$spurBin"; elif D="$(superskill script path sp task-diffstat.mjs 2>/dev/null)" && [ -f "$D" ]; then node "$D"; else echo "task-diffstat failed closed — task-diffstat script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; fi; exit 0
           # (b)+(c) lane pre-guard BEFORE decide: a caller-set mode is projected verbatim (R2b);
           # a sensitive path or >400 changed lines pins safety (R2c) and the decide result below
           # is never consulted. A missing/malformed diffstat row (producer crashed or never ran,
@@ -577,31 +591,24 @@ states:
           Deterministic failure-class router on a red gate (0943 R3). The engine has no onEnter
           conditionals, so the FAIL branch from `test`/`test-recheck` lands here as its own
           deterministic state (the sanctioned alternative), while the green branch goes to
-          `triage`. `decide failure-class` reads the bounded gate findings and routes: retryable
-          → test-recheck (the attempt is counted on entry, so qualityGateMaxFixAttempts still
-          bounds the loop), fix → test-fix (the repair hop, as before), stop → failed with
-          terminalReason failed-check. A missing/corrupt decision fails closed to failed-check.
+          `triage`. `decide failure-class` reads the bounded gate findings and routes: fix →
+          test-fix (the bounded repair hop; its default, recorded as `source: default` when no
+          backend decides — 0976 R2), stop → failed with terminalReason failed-check. A
+          missing/corrupt decision fails closed to failed-check. (0976 R2 collapsed the former
+          `retryable` lane: the declared default made it unreachable on the inline path.)
       onEnter:
           - kind: decide
             options:
                 id: failure-class
                 method: choice
                 question: >-
-                    The quality gate failed. Is the failure retryable (transient or environmental
-                    — just re-run the gate), fixable by the repair agent, or should the run stop
-                    here?
-                choices: [retryable, fix, stop]
+                    The quality gate failed. Is the failure fixable by the repair agent, or should
+                    the run stop here?
+                choices: [fix, stop]
                 default: fix
                 evidence:
                     - .spur/run/${vars.wbs}-test-gate.findings
                 resultFile: .spur/run/${vars.wbs}-failure-class.decision
-          # A retryable classification still counts an attempt so the existing
-          # qualityGateMaxFixAttempts cap bounds the recheck loop (0943 R3; the cap edge reads
-          # the same counter the fixall path uses).
-          - kind: shell
-            options:
-                command: >-
-                    A=".spur/run/$wbs-test-fix-attempt"; [ "$(jq -r '.value // ""' ".spur/run/$wbs-failure-class.decision" 2>/dev/null)" = retryable ] && { n="$(cat "$A" 2>/dev/null || echo 0)"; printf '%s\n' "$((n + 1))" > "$A"; }; exit 0
 
     - id: review
       description: Three-dimensional code review via /sp:dev-review (functional requirements traceability + SECUA framework (Security, Efficiency, Correctness, Usability, Architecture) + architecture depth), findings written to `## Review`.
@@ -706,10 +713,10 @@ states:
             options:
                 command: >-
                     LINT_SCRIPT="plugins/sp/scripts/verify-answer-lint.ts";
-                    [ -f "$LINT_SCRIPT" ] ||
+                    [ -f config/plugin-scripts.json -a -f "$LINT_SCRIPT" ] ||
                     LINT_SCRIPT="$(superskill script path sp verify-answer-lint.ts 2>/dev/null)";
                     if [ -z "$LINT_SCRIPT" ] || [ ! -f "$LINT_SCRIPT" ]; then
-                      echo "verify-answer-lint: checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'" >&2;
+                      echo "verify-answer-lint: checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
                       exit 1;
                     fi;
                     bun "$LINT_SCRIPT" "$wbs"
@@ -718,16 +725,6 @@ states:
           - kind: shell
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
-          # (d) F96 R2 (0950): residual-scan.ts owns the sweep; shell only resolves it.
-          # ONE hard action (scan+fold): a scanner crash fails verify closed — the
-          # verify→failed catch-all routes a missing/malformed verdict. Runs AFTER
-          # `task verdict` and BEFORE the jq bind so a blocking residual turns PASS
-          # into PARTIAL (fold rewrites the verdict artifact) and takes the existing
-          # verify→test-fix edge while attempts remain.
-          - kind: shell
-            options:
-                command: >-
-                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ ! -f "$S" ]; then echo "residual-scan failed closed — scanner not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'" >&2; exit 1; fi; case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" scan "$wbs" --spur-bin "$spurBin" && "$RUNNER" "$S" fold "$wbs" --spur-bin "$spurBin"
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
           # 0757 R4; definitionDigest 0759 R5; honest review stamp 0785 R4; soft action + hard guard).
           - kind: shell
@@ -745,7 +742,11 @@ states:
           evidence (0785 R4) — before any task record or status mutation. Post-record step
           conditionally syncs feature status via the bounded `feature-sync-bounded` wrapper
           (task 0411 retry-suppression) if `feature_id` is present, or appends an orphan
-          link proposal to the run report if absent (task 0328 / ADR-0322).
+          link proposal to the run report if absent (task 0328 / ADR-0322). The post-record
+          residual sweep (0983) re-scans the task file after the verdict-proven box flips and
+          folds blocking leftovers into the verdict before `record → done`; a downgrade
+          re-records Testing from the final artifact so a failed task never keeps a stale
+          PASS narrative.
       onEnter:
           # 0785 R3: BOUND verify-verdict registration — FIRST action, before any task record or
           # status mutation, replacing the redundant proof.fingerprint compare (the action itself
@@ -771,7 +772,11 @@ states:
             options:
                 id: task-record-transition
                 executable: "${vars.spurBin}"
-                args: ["task", "record", "${vars.wbs}", "--solution-from-diff", "--transition", "testing"]
+                # 0980: --no-lifecycle mirrors the wip/done hops — the pipeline run is
+                # already the lifecycle record, so a record-stage transition must not
+                # spawn a nested task-lifecycle run that outlives the pipeline as a
+                # `running` orphan. The target-aware check gate still runs (inline).
+                args: ["task", "record", "${vars.wbs}", "--solution-from-diff", "--transition", "testing", "--no-lifecycle"]
                 retry:
                     maxAttempts: 2
                     delayMs: 2000
@@ -791,7 +796,30 @@ states:
           - kind: shell
             options:
                 command: >-
-                    S=plugins/sp/scripts/record-feature-sync.ts; [ -f "$S" ] || S="$(superskill script path sp record-feature-sync.mjs 2>/dev/null)"; [ "$deferFeatureSync" = "true" ] && echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt" || if [ -f "$S" ]; then bun "$S" --spur-bin "$spurBin"; else echo "feature sync skipped — record-feature-sync not found in plugins/sp/scripts/ nor staged" >> ".spur/run/$wbs-report.txt"; fi; exit 0
+                    S=plugins/sp/scripts/record-feature-sync.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp record-feature-sync.mjs 2>/dev/null)"; [ "$deferFeatureSync" = "true" ] && echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt" || if [ -f "$S" ]; then bun "$S" --spur-bin "$spurBin"; else echo "feature sync skipped — record-feature-sync not found in plugins/sp/scripts/ nor staged" >> ".spur/run/$wbs-report.txt"; fi; exit 0
+          # (d) F96 (0983): residual-scan.ts owns the sweep; shell only resolves it. The
+          # scan moved here from verify: it must read the task file AFTER `task record`
+          # flipped the verdict-proven Requirement/AC boxes (0692), or a proven-but-unticked
+          # box folds every good run to PARTIAL and the done guard is unreachable (0967).
+          # Classification unchanged: any box still unchecked post-record (unproven R/AC,
+          # unfinished Plan) stays blocking and fails the record → done guard closed.
+          # ONE hard action (scan+fold): a scanner crash fails record closed.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ ! -f "$S" ]; then echo "residual-scan failed closed — scanner not found in plugins/sp/scripts/ nor staged — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 1; fi; case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" scan "$wbs" --spur-bin "$spurBin" && "$RUNNER" "$S" fold "$wbs" --spur-bin "$spurBin"
+          # (e) F96 R5 (0983): a sweep downgrade must reach the task record — re-record from
+          # the FINAL (post-fold) artifact so Testing carries the downgraded verdict; a failed
+          # task must not retain a stale PASS Testing narrative. Soft (exit 0): the downgrade
+          # itself already fails the record → done guard; a re-record failure prints its
+          # re-run command and the failed state renders the recovery report.
+          # 0980: --no-lifecycle for the same orphan reason as the main record command —
+          # inert today (the task is already at testing, so this is a same-status no-op),
+          # but it keeps the no-nested-lifecycle invariant if the flow shifts.
+          - kind: shell
+            options:
+                command: >-
+                    verdict="$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)"; if [ -n "$verdict" ] && [ "$verdict" != PASS ]; then $spurBin task record $wbs --solution-from-diff --transition testing --no-lifecycle || echo "post-downgrade re-record failed — re-run: $spurBin task record $wbs" >&2; fi; exit 0
 
     - id: done
       description: >
@@ -805,7 +833,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" settle "$wbs" --spur-bin "$spurBin" || echo "residual-settle failed — re-run: residual-scan settle $wbs" >&2; else echo "residual-scan not staged — settle skipped — re-run: residual-scan settle $wbs" >&2; fi; exit 0
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" settle "$wbs" --spur-bin "$spurBin" || echo "residual-settle failed — re-run: residual-scan settle $wbs" >&2; else echo "residual-scan not staged — settle skipped — re-run: residual-scan settle $wbs" >&2; fi; exit 0
           # (c) command.gate owns the done transition with classified transient retry.
           - kind: command.gate
             options:
@@ -852,7 +880,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" report "$wbs" --spur-bin "$spurBin" || echo "residual-report failed — re-run: residual-scan report $wbs" >&2; else echo "residual-scan not staged — report skipped — re-run: residual-scan report $wbs" >&2; fi; exit 0
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" report "$wbs" --spur-bin "$spurBin" || echo "residual-report failed — re-run: residual-scan report $wbs" >&2; else echo "residual-scan not staged — report skipped — re-run: residual-scan report $wbs" >&2; fi; exit 0
 
     - id: cancelled
       description: Terminal — pipeline cancelled by operator at the approval gate (R1).
@@ -1007,8 +1035,7 @@ transitions:
           options:
               command: 'test "$mode" != fast'
     # ── failure-class routing (0943 R3): stop first (never mislabeled by the cap), then the
-    # attempt cap (bounds BOTH lanes — retryable counted on entry, fix as before), then the
-    # decision lanes, then the fail-closed defense. Declaration order matters.
+    # attempt cap, then the fix lane, then the fail-closed defense. Declaration order matters.
     - from: test-fail-triage
       to: failed
       terminalReason: failed-check
@@ -1021,7 +1048,7 @@ transitions:
     - from: test-fail-triage
       to: failed
       terminalReason: retry-exhausted
-      description: Attempt cap reached — qualityGateMaxFixAttempts bounds the retryable recheck and fix lanes alike.
+      description: Attempt cap reached — qualityGateMaxFixAttempts bounds the fix lane.
       # (warn) 5 commands: named fix attempts (legibility, 0874).
       guard:
           kind: shell
@@ -1029,14 +1056,6 @@ transitions:
               command: >-
                   fix_attempts="$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)";
                   test "$fix_attempts" -ge "$qualityGateMaxFixAttempts"
-    - from: test-fail-triage
-      to: test-recheck
-      description: Failure class retryable and under the cap — re-run the gate without fixall; the attempt was counted on entry.
-      guard:
-          kind: shell
-          options:
-              command: >-
-                  jq -e '.value == "retryable"' ".spur/run/$wbs-failure-class.decision" >/dev/null 2>&1
     - from: test-fail-triage
       to: test-fix
       description: Failure class fix and under the cap — the bounded repair hop, as before.
@@ -1172,6 +1191,6 @@ transitions:
     - from: record
       to: failed
       terminalReason: failed-check
-      description: Task check failed or proof evidence missing/malformed/mismatched — block before done.
+      description: Task check failed, a post-record residual downgrade, or proof evidence missing/malformed/mismatched — block before done.
       guard:
           kind: always