@gtrabanco/pi-agentic-workflow 0.30.0 → 0.34.0

package/skills/log-session/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: log-session
 user-invocable: true
-version: 2.2.1
+version: 2.3.0
 argument-hint: "[note to prepend to the entry]"
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -124,6 +124,22 @@ the HEAD sha and start time at session open.
    open a PR just for a log entry, and never `git add -A` here — a concurrent
    conversation's work must not be swept into a log commit.
 
+## The canonical split — this skill's half (feature 66, D2)
+
+Two writers exist on purpose; neither mirrors the other:
+
+- **`docs/LOGS.md` (this skill)** is the **human/team journal** — what a session
+  set out to do, what it decided, where to resume. It travels with git, so a
+  teammate or a fresh clone reads it with no local state.
+- **Engram (`mem_session_summary`, and the lane's `unit/<NN-slug>/doc` topic)**
+  is **local decision and gotcha recall keyed by unit id**, written by
+  `unit-lane` and `execute-phase` at unit boundaries. It stays on the machine.
+
+Engram never mirrors this log, and this log never mirrors Engram: team memory
+travels with git, agent recall stays local. Write the journal half here; the
+protocol half (boundaries, recall order, degradation) lives in the lane's
+memory reference, `../unit-lane/references/MEMORY.md`.
+
 ## Guardrails
 
 - **Never use an expensive model for this.** It's summarization; `qwen3.6`

package/skills/orchestration-envelope/references/TURN_CONTRACT.md

@@ -17,7 +17,8 @@
 ```
 
 **A box that runs a command discloses what the command needs.** When a box
-invokes a script with a placeholder (`node scripts/x.mjs <unit-dir>`), the same
+invokes a script with a placeholder (`bun scripts/x.mjs <unit-dir>`; node fallback
+if bun is not installed), the same
 skill's text must name the artifact that placeholder requires — the script
 declares it (`PREREQUISITES` in `scripts/needs-input.mjs`) and
 `scripts/promise-coherence.mjs` checks the disclosure. A box that instructs a

package/skills/pre-execution-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pre-execution-review
 user-invocable: false
-version: 2.8.0
+version: 2.8.2
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/pre-execution-review/references/LEDGERS.md

@@ -8,13 +8,35 @@ Plan snapshot binds them, and `execute-phase` may not invent a substitute.
 |---|---|---|---|
 | Planning evidence | `### Planning evidence` inside the unit doc (XS/S) · separate file (M/L) | `unit-lane:planning-evidence` | `execute-phase`, `fold-findings`, `audit-pr` |
 | Obligations | `### Obligations` inside the unit doc (XS/S) · separate file (M/L) | `unit-lane:obligations` | `execute-phase`, `fold-findings`, `audit-pr` |
-| Findings | `review-findings.md` (one per unit, both stages) | reviewers append; only the stage's author resolves | `execute-phase` on re-review, `audit-pr` |
+| Findings | the unit doc's `## Findings` (a migrated unit, issue #308) · `review-findings.md` (a legacy unit) | reviewers append; only the stage's author resolves | `execute-phase` on re-review, `audit-pr` |
 
 XS/S embeds both tables in the SPEC to stay within the size's artifact budget;
 the Plan snapshot then binds them through the whole-SPEC row (kind `spec`), and
 the `planning-evidence` / `obligations` snapshot rows are `absent`, not forged.
 M/L freeze the separate files and bind them with their own rows. Never both.
 
+**One findings carrier per unit, one read path.** A unit opened after the
+`spec-by-reference` re-cut (issue #308) carries its OPEN rows in the unit doc's
+`## Findings` table and its folded history, review marks (`REVIEW-RAN`), finding
+marks (`VF-<n>`) and gate runs (`GATE-RAN`) as `## Log` lines whose kind token is
+the `log-kind@1` vocabulary. That unit has **no `review-findings.md`**. A legacy
+unit keeps the side ledger it was written with and is never rewritten to migrate
+it. Readers probe the doc first and fall back to the file; a unit with the
+section never reads both, so a stale side file can never outvote the doc. The
+carrier change retires nothing the review machinery produces: each mark a legacy
+ledger row carried is a log line here, with the same identifier, the same head
+SHA and the same exit code — no new receipt enters without one retiring.
+
+Both carriers are **one truth class**: the `review-findings` row below owns the
+writers of the OPEN rows and every mark in either carrier — the map keys one *file* per
+class, so a migrated unit's `## Findings`/`## Log` are that ledger inside the unit doc,
+never a new class or a second owner set. One mark, two grammars: review run =
+`review-mark@1` row / `## Log` `R` line; gate run = `gate-ran@1` row / `G` line; finding
+verification = `finding-mark@1` row / `V` line; folded finding = the `folded: no → yes`
+flip / the row leaving for an `F` line; OPEN finding = seven-column row / six-column
+`findings-table@1` row. A migrated unit has no `folded` cell to flip; a legacy unit has
+no `R`/`V` grammar.
+
 ### 1. Planning evidence
 
 Row shape — the base row, the closed `authority-kind` / `freshness` vocabularies,
@@ -167,7 +189,9 @@ documentation, not by this map.
 A review that ends with no fix-now finding writes no finding row, so the map gives
 it a row of its own in the unit's `review-findings.md` ledger, under
 `review-change:review-mark`. [POLICY.md](POLICY.md) §8 owns *when* an act marks;
-this owns the shape:
+this owns the shape. A **migrated** unit writes the same mark as a `## Log` `R` line —
+`- **R<n>** — <date>, review at HEAD <40-hex> · verdict <verdict> · cycle <n> · gate
+exit <code>` — and `scripts/workflow-status.mjs` reads either carrier, never both:
 
 ```text
 review-mark@1
@@ -203,6 +227,10 @@ or a re-review trigger. The mark's `confirmed | refuted` value and the
 `recheck` cell (the method the finding's axis demands) are what let a driver
 outside the repo consume the verification the review performed.
 
+A **migrated** unit signs the same way as a `## Log` `V` line — `- **V<n>** —
+<file:line> · reviewer <name> · HEAD <40-hex> · recheck <method + reproducer> ·
+confirmed | refuted` — whose `recheck` cell `fold-findings` consumes.
+
 `fold-findings` reads the `recheck` cell to **materialize** the finding's
 reproducer as its regression check — it never re-derives it; a `recheck` cell
 that cannot be materialized yields `BLOCKED <missing input>`. This consumption

package/skills/review-change/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-change
 user-invocable: true
-version: 3.12.1
+version: 3.13.0
 argument-hint: <path-or-glob> [--adversarial N] [--synthesize]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT

package/skills/review-change/references/OUTPUT_AND_GUARDRAILS.md

@@ -27,7 +27,8 @@ lost, and none becomes reviewer-created backlog (D3):
   always fix-now / replan-in-unit — never a postpone/tradeoff/wontfix/new-issue
   escape.
 - **fix-now / `replan-in-unit`** (too large to fold as-is) → keeps its fix-now
-  class and ledger row; run `node scripts/unit-route.mjs <unit>` — its
+  class and ledger row; run `bun scripts/unit-route.mjs <unit>` (node fallback
+  if bun is not installed) — its
   `route: replan` line prints the planner command (`/unit-lane <unit>` for a
   feature, `/unit-lane --fix <n>` for a fix). The lane re-runs its plan step on
   this branch, the user confirms the appended SPEC phase(s), its review step

package/skills/review-change/references/PERSIST_AND_DECIDE.md

@@ -4,16 +4,35 @@ When the unit's review receipt is missing or stale, the re-entry command is the
 **emitted** `next.continuation` (`rendering` for display) — quote it, never author
 exact command tokens.
 
-11. **Persist fix-now findings to the fold ledger.** The unit's **fix-now fold
-   ledger** is `review-findings.md`, located beside its other docs
+11. **Persist fix-now findings to the fold ledger.** A migrated unit (issue #308)
+   carries the ledger in its own `SPEC.md`: OPEN rows in `## Findings`, and the
+   review, gate and finding-verification marks as `## Log` lines (the `R`, `G` and
+   `V` kinds of the published `log-kind@1` vocabulary) carrying their exit codes and
+   head SHA. A legacy unit keeps the side file beside its other docs
    (`docs/features/<NN>-<slug>/review-findings.md` for a feature,
-   `docs/fix/<n>-<topic>/review-findings.md` for a fix), fixed schema:
-
+   `docs/fix/<n>-<topic>/review-findings.md` for a fix). Probe the doc first and
+   write to exactly one carrier — a unit with the `## Findings` section never
+   gains a side file. Each carrier has **its own** fixed schema; a row is never
+   written in the other's grammar:
 
    ```
    | id | file:line | axis | severity | class | route | folded |
    ```
 
+   is the legacy schema, and only a legacy unit is written with it. A migrated unit
+   writes `findings-table@1` — six columns, no `folded` cell, and `class` holding
+   the owner that repairs the row (`product`/`plan`/`source`/`environment`/`runtime`)
+   while `route` holds the disposition (`fold`/`replan-in-unit`/`decision-required`/
+   `product owner — …`) — the grammar the unit doc itself publishes:
+
+   ```
+   | id | S# / file:line | axis | severity | class | route |
+   ```
+
+   `folded: no → yes` is therefore a **legacy-only** flip: in a migrated carrier a
+   closing fold deletes the row and appends its `## Log` `F` line, and `ledger-ownership@1`
+   / `fold-findings:folded-flag` stays the sole writer of whichever close it is.
+
    **Merged unit → no write** (a PR exists and its state is `MERGED` — check
    `gh pr view --json state` when a PR is open; otherwise the unit is unmerged
    by definition). Otherwise, for each **fix-now** finding of severity `high`
@@ -22,11 +41,12 @@ exact command tokens.
    `CLASSIFY.md`):
    append a row
    (create the file with the header row when missing), carrying the
-   verbatim `Sev` value into `severity`; `folded` always starts `no` — that
+   verbatim `Sev` value into `severity`; a legacy row's `folded` always starts `no`
+   (a migrated row has no such cell — every row in `## Findings` is open) — that
    row comes from a **confirmed** candidate only and carries its
-   `finding-mark@1` signature on a **separate `VF-` row** (reviewer, head SHA,
-   recheck + reproducer), as modeled in `LEDGERS.md` (§finding-mark@1) and the
-   fixture.
+   `finding-mark@1` signature as a **separate `VF-` row** in a legacy carrier, or as
+   a `## Log` `V` line in a migrated one (reviewer, head SHA, recheck + reproducer),
+   as modeled in `LEDGERS.md` (§finding-mark@1) and the fixture.
    `ledger-ownership@1` / `fold-findings:folded-flag` is the sole writer of
    the `folded: no → yes` flip.
    A `low` finding is **never persisted to the fold ledger** — report-only
@@ -138,7 +158,8 @@ exact command tokens.
         fix); the lane re-runs its plan step on this branch, its review step
         gates, then `/execute-phase <unit>` (yes: list the finding ids; no: omit
         this line)
-      · any finding owned by product? → `node scripts/unit-route.mjs <unit>` prints
+      · any finding owned by product? → `bun scripts/unit-route.mjs <unit>` (node fallback
+        if bun is not installed) prints
         `route: product` + the lane hand-off — `/unit-lane <unit>` for a feature,
         `/unit-lane --fix <n>` for a fix: the lane repairs the half, its review
         step re-judges it (yes: list the ids; no: omit this line)

package/skills/review-change/references/REVIEW_PROCESS.md

@@ -170,12 +170,20 @@ cycles without convergence, the review prints
 LOOP CAP REACHED — <unit>
 - Finding ids: <every open id>
 - Cycles: 2 (REVIEW-RAN marks + forge receipts)
-- Route: /triage-issue --prioritize-now <unit> F<k> … (or the programmatic outer driver)
+- Expected diff: <per finding: files cited and whether it hits a normative surface>
+- Decision: the owner decides — no route is auto-selected
 ```
 
 A **third cycle never starts** unless the user explicitly instructs it — it is
-the user's escape, never a reviewer election. The residue routes to
-`triage-issue --prioritize-now` (or the programmatic outer driver), and a unit
-that needs a third cycle has a planning or root-cause defect, not a review
-deficit. Re-runs count **separate review invocations**, not in-session steps:
-`/review-change` is invoked by the user in a fresh turn each time.
+the user's escape, never a reviewer election. The cap **stops and hands the
+decision back**, emitting no route of its own: this is the moment with the least
+evidence about the findings, and an auto-selected escape is how a fix escapes
+its own gate (F34).
+
+**`--prioritize-now` is an escape, never the default.** The owner may force
+`/triage-issue --prioritize-now <unit> F<k>` for an **in-scope** finding whose
+expected diff is small: at most two files, no `normative-surfaces@1` surface, no
+published contract or package version. Size is the only gate — a `security` or
+`package` row is never "too expensive to fold now".
+Re-runs are **separate review invocations** and not in-session steps:
+`/review-change` is invoked by the user in a fresh turn.

package/skills/review-implementation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-implementation
 user-invocable: false
-version: 1.11.1
+version: 1.12.0
 argument-hint: <path-or-glob>
 allowed-tools: Read, Grep, Glob, Bash, WebFetch
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
@@ -69,6 +69,13 @@ then the current-unit contract (fix-now / replan-in-unit / decision-required
 for in-scope work), then `proposal` for genuinely independent future
 capabilities. One pass — no per-pass or per-reviewer classification.
 
+Every classified row also carries an explicit `scope: in-unit | new-unit` cell
+(`#308` review, F33) filled from evidence — the row's `file:line` against the
+unit's `## Impact` set and the files the unit's own commits touch — never from
+an impression of size or axis. Scope decides disposition (in-unit is always
+`fix-now`); size decides only whether that fix folds directly or needs
+`replan-in-unit`. `triage-issue` consumes the cell and never re-derives it.
+
 ## Context budget
 
 The input is the synthesized table, not the diff. Read at most 10 non-diff
@@ -97,7 +104,8 @@ each classification as its table row immediately and drop raw file content.
   rubric.
 - Sits in **Stage 4** of the feature workflow (verification & review).
 - `fix-now` folds into the current unit; `replan-in-unit` runs
-  `node scripts/unit-route.mjs <unit>`, whose `route: replan` line names the
+  `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed),
+  whose `route: replan` line names the
   planner that appends user-confirmed phases before `execute-phase`;
   `decision-required` blocks for the user; independent work becomes proposals
   the user routes to `triage-issue` (D3).

package/skills/review-implementation/references/CLASSIFY.md

@@ -96,6 +96,22 @@ reviewer-created issue creation are **forbidden** (AC 10). A previously approved
 trade-off is **cited as existing evidence**, never reinvented by review.
 `disputed` remains a later fold/user outcome, not a reviewer shortcut.
 
+### Scope is evidence, not impression (F33)
+
+Every classified row carries a `scope: in-unit | new-unit` cell, contrasted
+with what the unit declared:
+
+| Answer | Test |
+|---|---|
+| **in-unit** | path in the unit's `## Impact` set, in files its commits touch, or a surface it created/moved/claimed unchanged |
+| **new-unit** | path outside that set **and** the defect already exists at the base commit |
+| **undecidable** | the set is missing or the path is ambiguous — state the gap; never guess `new-unit` to escape |
+
+**Scope decides disposition, never size:** an in-unit defect is `fix-now`
+whatever its axis (`security`/`package` included); size only chooses fold vs
+`replan-in-unit`. "The unit did it" outranks "the path looks foreign".
+`triage-issue` consumes the cell, never re-derives it.
+
 ### Step 3 — Independent future capabilities → proposals, never issues
 
 Only a **truly independent future capability** — work the current unit does not
@@ -109,7 +125,7 @@ the user routes a proposal to `triage-issue`.
 An in-scope fix-now too large to fold as-is (multi-file redesign, or evidence
 the unit should have been split) keeps its **fix-now** class — size is never a
 reason to downgrade. Set its `Route` to **`replan-in-unit`**: run
-`node scripts/unit-route.mjs <unit>` — its `route: replan` line prints the
+`bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed) — its `route: replan` line prints the
 planner command (`/unit-lane <unit>` for a feature, `/unit-lane --fix <n>` for a
 fix) — and the unit's SPEC `## Phases`
 ledger gets one or more new phases covering the work, on the SAME branch, the
@@ -152,7 +168,8 @@ your domains):
 
 - **fix-now** → fold directly into the current unit's open phase; never a
   tracked issue, never a standalone planner (AC 12).
-- **fix-now / `replan-in-unit`** → `node scripts/unit-route.mjs <unit>` prints
+- **fix-now / `replan-in-unit`** → `bun scripts/unit-route.mjs <unit>` (node fallback
+  if bun is not installed) prints
   `route: replan`; the planner command it prints re-cuts the SPEC `## Phases`
   ledger
   (user confirms), the lane's `review` step gates, then `execute-phase`
@@ -174,8 +191,8 @@ finding in its `Route` cell.
 | Owning stage | Hand-off | Never |
 |---|---|---|
 | `source` | fold locally: `/fold-findings`, then re-run `/review-change` on the changed HEAD | — |
-| `plan` | run `node scripts/unit-route.mjs <unit>` → `route: replan`; the planning author re-cuts the artifact (SPEC `## Phases`, an obligation row, an acceptance mapping, a ledger) on the same branch with the user's confirmation, then the lane's **`review` step** precedes `execute-phase` | fold it in code and leave the plan describing the old build |
-| `product` | run `node scripts/unit-route.mjs <unit>` → `route: product` → `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix): the lane repairs the half through its `design` step, its `review` step re-judges it | patch the product claim into agreement in code |
+| `plan` | run `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed) → `route: replan`; the planning author re-cuts the artifact (SPEC `## Phases`, an obligation row, an acceptance mapping, a ledger) on the same branch with the user's confirmation, then the lane's **`review` step** precedes `execute-phase` | fold it in code and leave the plan describing the old build |
+| `product` | run `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed) → `route: product` → `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix): the lane repairs the half through its `design` step, its `review` step re-judges it | patch the product claim into agreement in code |
 | `environment` / `runtime` | the existing retry/`BLOCKED` paths | translate into a PASS, or an issue |
 
 - `fix-now` with a `plan` or `product` owner keeps its severity but is **not**

package/skills/triage-issue/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: triage-issue
 user-invocable: true
-version: 2.11.0
+version: 2.12.0
 argument-hint: <issue-number> [more issue numbers…] | <audit-id> F<k> [F<j>…] | --prioritize-now <unit> F<k> [F<j>…]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >
   Verify an issue, persisted audit finding, or unresolved review finding against
   current code, classify it, and write only the contracted forge/ledger
-  outcome. Supports independent batches and an immediate-fix review-finding
-  route. Triggers: "triage-issue", "triage issue N", "triage this finding",
+  outcome. Supports independent batches and a routed review-finding
+  route: a `fix-now` row is handed to `/fold-findings`, never implemented
+  here. Triggers: "triage-issue", "triage issue N", "triage this finding",
   "is this trigger met".
 ---
 
@@ -25,7 +26,7 @@ premature work (acting on a deferred item whose trigger is unmet) and silent rot
 ✓ One fixed-format verdict block per issue (Trigger / Checked / Evidence / VERDICT / Action) — plus the summary table when batched
 ✓ Nothing deferred was implemented inline
 ✓ Audit-finding mode (`<audit-id> F<k>`): the audit file carries its `↳ triaged` note, and any opened issue cites `Origin: product audit <id>, finding F<k>`
-✓ Review-finding mode (`--prioritize-now <unit> F<k>`): every named unresolved finding gets a verdict, an immediate-fix attempt, or an explicit replan/user-decision route
+✓ Review-finding mode (`--prioritize-now <unit> F<k>`): every named unresolved finding gets a verdict **and a route** — a `fix-now` row is routed to `/fold-findings` (or an explicit `/execute-phase <unit> P<n>`), never implemented in this turn
 ✓ Batched input? The closing recommendation maps every issue/finding ID to its own next command, joined with ` + `; it never collapses to one generic action
 ✓ Artifact language: explicit user instruction > the project's declared docs language > English. The CONVERSATION language never decides — a Spanish prompt still produces English PRs/issues/commits/SPECs unless one of the first two says otherwise
 ✓ The closing `→ Next:` block is printed as the ABSOLUTE last output
@@ -47,10 +48,14 @@ first on purpose).
   from a persisted `product-audit` report instead of existing issues (see
   *Audit-finding mode* below). Batching works the same way.
 - **Review findings** — `triage-issue --prioritize-now <unit> F<k> [F<j> …]`
-  triages unresolved rows from the current feature/fix unit's
-  `review-findings.md`. This route is for findings that `fold-findings` could
-  not close. `--prioritize-now` means attempt to resolve every named finding
-  immediately; it does not permit a downgrade, postponement, or silent drop.
+  triages unresolved rows from the current feature/fix unit's findings carrier:
+  its `## Findings` section in `SPEC.md` for a migrated unit (issue #308), or
+  `review-findings.md` for a legacy one — probe the doc first, never both. This
+  route is for findings that `fold-findings` could not close. `--prioritize-now`
+  forces the fold route for the named rows in this turn instead of queuing them
+  for a later turn; it does not permit a downgrade, postponement, or silent
+  drop, and it never authorizes implementing them here — the fold owns the fix
+  and the `folded:` flip.
 
 
 ## Step 0 — Discover the project (always first)
@@ -86,7 +91,7 @@ read another `references/` path. After Step 0:
 - Before applying an urgency or disposition label, read
   [label vocabulary](references/LABELS.md); this file is the sole definition of
   names, colors, and mutation rules.
-- Only when the verdict is `fix-in-unit`, read
+- Only when the verdict writes a row (`fix-in-unit` or `fix-now`), read
   [fold ledger](references/FOLD_LEDGER.md) before writing the row.
 
 Every resource is one hop from this file. A missing source artifact or required
@@ -121,9 +126,10 @@ triage-issue ────┤                    or fold-findings (ledger row)
                  └─ wontfix ─────────▶ propose close
 ```
 
-In review-finding mode, `replan-in-unit` runs `node scripts/unit-route.mjs
-<unit>`: its `route: replan` line prints the planner command — `/unit-lane
-<unit>` for a feature, `/unit-lane --fix <n>` for a fix — which re-runs the
+In review-finding mode, `replan-in-unit` runs `bun scripts/unit-route.mjs
+<unit>` (node fallback if bun is not installed): its `route: replan` line prints
+the planner command — `/unit-lane <unit>` for a feature, `/unit-lane --fix <n>`
+for a fix — which re-runs the
 lane's `plan` catalog step and appends new `P<n>` phases to the same unit. The
 lane's own `review` step is the gate before execution. The user manually runs
 those phases; this skill never implements them.

package/skills/triage-issue/references/FOLD_LEDGER.md

@@ -1,14 +1,22 @@
 ## Ledger-append mechanism (`fix-in-unit` → fold-into-ledger sub-route)
 
 When the *fold into the unit's ledger* sub-route (step 3 above) applies,
-append one row to the open unit's `review-findings.md` — the same fold ledger
-`review-change` and `audit-pr` write to, in their **fixed 7-column schema,
-never redefined here**:
+append one row to the open unit's findings carrier — probe the unit doc first: a
+migrated unit (#308) carries its OPEN rows in `SPEC.md ## Findings` and never gains
+a side file, a legacy unit keeps `review-findings.md`. It is the same fold ledger
+`review-change` and `audit-pr` write to, in the **carrier's own fixed schema, never
+redefined here** — the legacy 7-column row:
 
 ```
 | id | file:line | axis | severity | class | route | folded |
 ```
 
+and the migrated 6-column `findings-table@1` row (`id`, `S# / file:line`, `axis`,
+`severity`, `class` = the owner that repairs it, `route` = the disposition), whose
+rows are open by definition: closing one deletes the row and appends a `## Log` `F`
+line. Writing a 7-column row, or a `folded` flip, into a migrated unit's table is a
+carrier violation, not a formatting slip.
+
 The appended row: `folded` starts `no` (this skill never sets `folded: yes` —
 that transition belongs solely to `/fold-findings`), and the `route` cell
 carries a **provenance marker** identifying this row was born from a triage

package/skills/triage-issue/references/ISSUE_PROCESS.md

@@ -22,8 +22,9 @@
      issue on that unit's own branch, never as a new standalone unit. Pick
      exactly one of these sub-routes:
      - *repairable as-is* → **fold into the unit's** current/next phase, or
-       append a provenance-marked row to the unit's `review-findings.md` (see
-       *Ledger-append mechanism* below).
+       append a provenance-marked row to the unit's findings carrier — `SPEC.md
+       ## Findings` for a migrated unit (#308), `review-findings.md` for a legacy
+       one, never both (see *Ledger-append mechanism* below).
      - *changes the unit's shape* → **incremental replan** on the same unit:
        name the exact command — `/unit-lane <slug>` (the lane re-reads the
        SPEC, re-triages, and re-runs its `design`/`plan` catalog steps) — or a

package/skills/triage-issue/references/REVIEW_FINDING_PROCESS.md

@@ -4,8 +4,12 @@ Use this route only for `/triage-issue --prioritize-now <unit> F<k> [F<j> …]`
 after `/fold-findings` leaves rows unresolved.
 
 1. Read the target unit's SPEC, frozen acceptance, current PR HEAD, the full
-   `review-findings.md`, and the evidence for every named row. Confirm that
-   each row is still `folded: no`; never triage a row already folded.
+   findings carrier — the unit doc's `## Findings` for a migrated unit (#308),
+   `review-findings.md` for a legacy one, probed in that order and never both —
+   and the evidence for every named row. Confirm the row is still open in its own
+   carrier: `folded: no` in a legacy ledger, still present in `## Findings` for a
+   migrated unit (a folded row has left that table for a `## Log` `F` line); never
+   triage a row already folded.
 2. Reproduce or verify every finding against the current code. Keep the
    finding's original ID, severity, class, and route in the report. Do not
    turn a review finding into a generic issue just to make it disappear.
@@ -13,11 +17,16 @@ after `/fold-findings` leaves rows unresolved.
 
    - A complete correction that fits the current unit and is reviewable now
      remains on the current unit. Route it to `/fold-findings` or an explicit
-     `/execute-phase <unit> P<n>`.
+     `/execute-phase <unit> P<n>` — **never implement it in this turn**. The
+     fold owns the fix, the gate and the `folded:` flip: writing the flip here
+     would make this skill the second owner of a state
+     `ledger-ownership@1` assigns solely to `fold-findings:folded-flag`
+     (`LEDGERS.md`), so a row this skill appends starts `folded: no` and stays
+     that way until the fold closes it.
    - A correction too large for the current fold is `replan-in-unit`. Run
-     `node scripts/unit-route.mjs <unit>`; its `route: replan` line prints the
-     planner command — `/unit-lane <unit>` for a feature, `/unit-lane --fix <n>`
-     for a fix — which re-runs the lane's `plan` step and appends concrete
+     `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed);
+     its `route: replan` line prints the planner command — `/unit-lane <unit>` for a
+     feature, `/unit-lane --fix <n>` for a fix — which re-runs the lane's `plan` step and appends concrete
      `P<n>` phases to the unit's SPEC, preserving the finding's acceptance
      evidence. The lane's `review` step gates execution.
    - A product, architecture, or acceptance decision that blocks safe work is
@@ -26,8 +35,8 @@ after `/fold-findings` leaves rows unresolved.
      and show the evidence; do not mark it folded or silently delete it.
    - A `fix-now` finding whose owning stage is `product` — the finding is
      against the product half, not the code — is `product-repair` (#293). Run
-     `node scripts/unit-route.mjs <unit>`; its `route: product` line prints the
-     lane hand-off (`/unit-lane <unit>` for a feature, `/unit-lane --fix <n>`
+     `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed);
+     its `route: product` line prints the lane hand-off (`/unit-lane <unit>` for a feature, `/unit-lane --fix <n>`
      for a fix): the lane repairs the half, its review step re-judges it. Never
      fold it into the current unit — the fold loop repairs source, not
      authority (`pre-execution-review` POLICY §4).

package/skills/unit-lane/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: unit-lane
 user-invocable: true
-version: 2.3.0
+version: 2.4.3
 argument-hint: <NN-slug | "<idea>"> [--retriage] | --fix <issue-number> | --from-issue <issue-number>
 description: >
   One-shot lane conductor for a delivery unit: triage, implement, evidence, and
@@ -23,8 +23,9 @@ done:
 ```
 ✓ Required user inputs were answered concretely (not defaulted). Nothing here
   is inferred: a gap re-enters provenance → research, and a gap surviving both
-  runs `node scripts/needs-input.mjs <unit-dir>` and stops with the
-  `open-questions@1` block routed back to the owning stage.
+  runs `bun scripts/needs-input.mjs <unit-dir>` (node fallback if bun is not
+  installed) and stops with the `open-questions@1` block routed back to the
+  owning stage.
 ✓ Every claim the SPEC or the plan asserts (objective, why, ACs, tasks) cites
   its source — `path:line`, a doc, or an owner answer in the unit folder's
   `sources.md`. A claim with none is a question, never a default.
@@ -37,8 +38,11 @@ done:
   if new, with all mandatory sections filled or n/a)
 ✓ Guard ran (bun scripts/diff-guard.mjs --base <ref>) after each implement step;
   on BREACH: re-triage or record exception, never shrink the diff
-✓ Unit doc's Evidence rows updated (command → exit/digest → output → verified-by)
-  and Progress log updated (dated entry) before every commit
+✓ The unit's evidence carrier updated (Evidence rows, or `## Log` `E` lines for a
+  re-cut unit — command → exit/digest → output → verified-by) and its progress
+  recorded (dated Progress entry, or a `## Log` `P` line) before every commit
+✓ Memory boundaries ran — probe verdict once, saves at unit start / each phase
+  transition / close under `unit/<NN-slug>/doc`, degradation recorded as pending
 ✓ → Next: block printed as the absolute last output
 ```
 
@@ -167,6 +171,20 @@ Before every commit:
 - **Progress log**: `YYYY-MM-DD HH:MM — <what was done> → <commit sha> — next:
   <what is next>`
 
+### 5b. Memory boundaries
+
+Engram is the required memory substrate; a down layer never blocks a unit —
+follow [the memory protocol](references/MEMORY.md).
+
+- **Probe once**, before the first memory read: `agentic-workflow memory probe`
+  → paste the verdict into Evidence; `degraded` is recorded and said once.
+- **Save at unit start, each phase transition, and close** under
+  `topic_key: "unit/<NN-slug>/doc"`, with explicit `project` and explicit
+  session attribution (§5 names what carries it on each write surface).
+- **Recall** `mem_context` → scoped search → one explicit `all_projects: true`
+  retry → `mem_get_observation` → the unit doc wins. A miss is keyword-bound,
+  never proof nothing was saved; an unavailable mirror is marked pending.
+
 ### 6. Close the unit — the close-out ladder
 
 When all triaged steps are done, in order:

package/skills/unit-lane/references/DESIGN.md

@@ -6,7 +6,7 @@ A blank or vague scope or acceptance-criteria input is a gap, not a licence to
 infer. The order is fixed: search the repository's own docs first and append an
 `open-question` row to the unit folder's `decisions.md` recording where; research
 an external gap into 2–3 concrete options. A gap surviving both runs
-`node scripts/needs-input.mjs <unit-dir>`, pastes the `open-questions@1` block
+`bun scripts/needs-input.mjs <unit-dir>` (node fallback if bun is not installed), pastes the `open-questions@1` block
 and stops — route `design` for scope/architecture questions. "Decide for me" is
 a legitimate answer: the lane chooses and records the choice with its reason.
 Cheap-to-change defaults are recorded as assumptions, never silent.

package/skills/unit-lane/references/EVIDENCE.md

@@ -7,12 +7,16 @@ output (≤2 lines), verified-by. A reviewer re-runs it.
 
 ## Inputs
 
-- The unit's Acceptance criteria
-- The Evidence section (where evidence rows are appended)
+- The unit's Acceptance criteria (`## Acceptance criteria`, or `## Specs` for a
+  re-cut unit — `scripts/unit-route.mjs` resolves the shape)
+- The unit's evidence carrier: the `## Evidence` section (legacy shape) or the
+  `## Log` section (re-cut shape, where each run is one `E` line)
 
 ## Fixed output contract
 
-Append to the unit doc's **Evidence** table. One row per AC:
+Append one row per AC to the unit doc's **Evidence** table (legacy shape). A
+re-cut unit (#308) has no Evidence section: append one `## Log` `E` line per AC in
+the same order, carrying the same five facts.
 
 | AC | What was run | Exit / digest | Output (≤2 lines) | Verified-by |
 |---|---|---|---|---|