@gtrabanco/pi-agentic-workflow 0.36.0 → 4.10.0

package/skills/fold-findings/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fold-findings
 user-invocable: true
-version: 1.11.0
+version: 4.10.0
 argument-hint: [finding-id …]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -34,6 +34,18 @@ skill fixes each root cause, never relabeling, deferring, or weakening its check
 ✓ 5. The closing `Folded: n/m · Disputed: k · Blocked: j[ · Replan: r]` tally
      and outcome-branched `→ Next:` block are printed as the ABSOLUTE last output.
      Every affected finding ID is named in that block, joined with ` + `.
+✓ 6. Claim-evidence loop ran: before committing, every claim the repair
+     introduces was reproduced with the command and observed output pasted
+     into the claim table (`claim | command | output | status`). Loop ran until
+     green inside the same turn. (S5)
+✓ 7. Class escalation checked: ≥ 2 folded rows sharing mechanism+axis
+     were escalated to one class-level fix-now finding. (S1)
+✓ 8. Evidence-bound check: every finding citation was verified — the cited
+     file:line exists and the snippet matches the working tree verbatim. (S10)
+✓ 9. Reviewer anti-invention check: new findings are grounded in
+     provably-changed bytes (git-computed) or a mis-run cited check. (S10)
+✓ 10. Net narration diff ≤ 0 per fold: lines deleted, not moved. (S10)
+✓ 11. Closure status printed: `closure: complete | open(n)`. (S4)
 ```
 
 Any unchecked box means the turn is not done.
@@ -73,8 +85,22 @@ Per Workflow conventions, read:
 2. Queue the carrier's open rows — a legacy `folded: no` row, a migrated row of
    `## Findings` (all of them are open); explicit IDs restrict the queue and leave
    other rows untouched. Group by root cause, verifier and rollback boundary.
-3. The project's verification gate and forge CLI (use the declared forge).
-4. Whether the branch has an open PR; this decides immediate push after commit.
+3. **Class escalation (S1).** After grouping: ≥ 2 folded rows sharing
+   mechanism+axis ⇒ one class-level fix-now finding whose repair targets the
+   *mechanism*, not a repeated instance. The two-cycle cap then means what it
+   was built to mean: a class the loop refuses to repair is a planning defect,
+   not more folds. Document the escalation as `F<next> (class: <mechanism>,
+   replaces F<a> + F<b> + …)` in the ledger.
+4. **Evidence-bound check (S10, from #218).** Before processing, verify every
+   finding's citation: the cited `file:line` exists and the snippet matches the
+   working tree verbatim. Wrong-citation and position-drift findings are
+   discarded mechanically — `refuted` with evidence, no cycle consumed.
+5. **Reviewer anti-invention check (S10, from #205).** Any new finding surfaced
+   during fold must be grounded in **provably-changed bytes** (git-computed) or
+   a **mis-run cited check** (the cited validator's own output contradicts it).
+   A finding without changed-bytes grounding is a report-note, never fix-now.
+6. The project's verification gate and forge CLI (use the declared forge).
+7. Whether the branch has an open PR; this decides immediate push after commit.
 
 ## Progressive loading — fold queue
 
@@ -87,6 +113,58 @@ code or the ledger:
 Both are normative and one hop from this file. Missing resource → stop; never
 infer a classification or fold procedure.
 
+## Claim-evidence loop (S5 — mandatory before commit)
+
+Before committing the fold fix, run the claim-evidence loop. This is not optional;
+a turn that writes without verifying its own claims is the exact failure class
+that produced unit 79's F49→F50→F51.
+
+1. **Claim ledger.** Enumerate every claim the repair introduces: each new
+   figure, cross-reference, "X is now Y"; in code: each behavior the fix
+   declares. Write one row per claim.
+2. **Mandatory reproduction.** Every claim is executed, never asserted:
+   re-derive the figure with the command, resolve the reference with grep,
+   reproduce the behavior. Paste command + observed output into the claim
+   table — never type the expected result by hand.
+3. **Loop until green.** red → repair → re-run, *inside the same turn*, until
+   every claim in the closure set verifies. The repairer's turn does not end
+   with unreproduced claims.
+4. **Admission rule.** If no command can verify the sentence, it is not a
+   claim, it is an opinion, and it does not get written. This extends the
+   repo's own tests-first rule to documentation artifacts.
+
+Output the claim table as:
+
+```
+## Claim-evidence table
+| claim | command | output | status |
+|---|---|---|---|
+| <claim text> | `<command>` | `<observed output>` | ✓ |```
+
+All rows must have `status: ✓`. A `status: ✗` row means the turn is not done
+— repair and re-run the claim.
+
+The row shape is published grammar, not convention (`evidence-row@1` in
+`@gtrabanco/agentic-workflow-schema`: `EVIDENCE_ROW_COLUMNS`,
+`EVIDENCE_ROW_VERDICTS`, `validateEvidenceRow`). A row whose claim is empty, whose
+command or output is not a backticked command/observation, or whose verdict is
+outside `✓ | ✗` is a shape violation — prose in the command cell is refused
+exactly like an empty one, because a typed expectation is the defect the shape
+exists to stop.
+
+## Closure status (S4, S11)
+
+At the end of the fold, print the closure status:
+
+```
+closure: complete | open(n)
+```
+
+- `complete` — all findings in the queue are resolved (folded, refuted, disputed, or replanned).
+- `open(n)` — n findings remain open (blockers that need user input). Print the count and the blocker IDs.
+
+Cycle-count stops being the health metric; closure is the invariant.
+
 ## Report — return exactly this structure (fixed output contract)
 
 Per finding, in processing order:
@@ -152,6 +230,10 @@ table: [`FOLD_PROCESS.md`](references/FOLD_PROCESS.md) §Batch classification.
 
 ## Guardrails
 
+- The all-stages no-assumption rule binds fold work — **ask-don't-infer**, owner
+  `skills/unit-lane/references/DESIGN.md` (`ask-dont-infer@1`): a repair the
+  evidence does not settle is researched and asked about, never assumed.
+
 Scope is the ledger (or explicit ID subset); unlisted discoveries are proposals
 for user triage. Batch only when one root-cause correction, validator set and
 rollback boundary own the rows: one commit/push, individual ticks/lines. Split
@@ -193,6 +275,36 @@ every declared grep and fails closed with `sweep-mismatch`, naming
 `file:line`, the regex and the observed count. A fold that changes such a
 surface and emits no declaration is a `workflow` finding at review.
 
+**Re-review skip default inversion (S9, feature 30).** The `RE-REVIEW-OPTIONAL/SKIPPED`
+branch shipped in feature 30 was never exercised once (11 cycles on docs-only
+changes). Fix: for docs-only batches with a green sweep declaration
+(#315's claim kind), **skip becomes the machine-decided default** — re-review
+requires recorded justification. Why safe *now*: the residual risk the default
+hedged (stale survivors) becomes a pre-commit failure once #315's sweep kind
+exists. The decision moves from human inertia (always yes) to machine rule
+(batch class + sweep green ⇒ skip).
+
+**Net narration diff ≤ 0 (S10 1).** Each fold must strictly decrease the defect
+surface. Add a computed check: the net narration diff per fold must be ≤ 0 —
+lines deleted, not moved. Measured by `git diff --numstat` over the fold's
+commit. This is the arithmetic that makes #307's "deterministic gates converge"
+possible.
+
+**Defect identity: mechanism, not file:line (S4).** Defect identity in the ledger
+moves from `file:line` to the *mechanism* (the site stays as evidence). When
+folding, group by mechanism+axis, not by file:line+axis. The same bug surfacing
+as F49, then F50, then F51 costs a full review cycle each time when grouped by
+file:line; grouped by mechanism, one class escalation fixes all three.
+
+**Per-file review state (S10 6, from #218; shipped as S16).** `review-state.json`
+per unit, single writer = `scripts/review-state.mjs`, model passes read-only: each
+file in the affecting-path inventory ends a cycle `reviewed@<sha>` or
+`skipped@<sha>` with a concrete reason; skips auto-invalidate when a later diff
+touches the file; coverage closure `inventory − reviewed − skipped = 0` is a
+mechanical receipt check. Run `node scripts/review-state.mjs check --unit <slug>`
+and paste the block — `closure: complete` exits 0, `closure: open(n)` exits 1 and
+is a blocker, never a note.
+
 ## Portability (agents other than Claude Code)
 
 Use explicit fallbacks when a primitive is absent: open named `SKILL.md` files in
@@ -251,8 +363,9 @@ decision to skip.
 |---|---|---|
 | freeze-batch (≥ 1 product-owned row) | `PRODUCT-ROUTE` | `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix) when the router concludes `product` — the lane repairs the half through its `design` step, its `review` step re-judges it; the conclusion printed by `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed; discovery step the fold already ran) |
 | freeze-batch (≥ 1 replan-class row) | `REPLAN-ROUTE` | `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix) when the router concludes `replan` — user confirms, the lane's `plan` step appends the phases and its `review` step gates, then `/execute-phase` on this unit; on `route: decision` stop and surface the decision to the user — the conclusion printed by `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed; discovery step the fold already ran) |
-| `all-repair-in-place` + docs-only + no folded row severity `high` + prior consumer skip decision | `RE-REVIEW-SKIPPED` | skip — consumer has explicitly decided to skip the re-review |
-| `all-repair-in-place` + docs-only + no folded row severity `high` | `RE-REVIEW-OPTIONAL` | `/review-change` (default, delta mode) — or the consumer's recorded skip decision |
+| `all-repair-in-place` + docs-only + green sweep declaration + no folded row severity `high` | `RE-REVIEW-SKIPPED` | skip — green sweep (#315) + docs-only ⇒ skip is default (S9); re-review requires recorded justification |
+| `all-repair-in-place` + docs-only + no sweep declaration + no folded row severity `high` + prior consumer skip decision | `RE-REVIEW-SKIPPED` | skip — consumer has explicitly decided to skip the re-review |
+| `all-repair-in-place` + docs-only + no sweep declaration + no folded row severity `high` | `RE-REVIEW-OPTIONAL` | `/review-change` (default, delta mode) — or the consumer's recorded skip decision |
 | empty batch (class `none`) | `RE-REVIEW-OPTIONAL` | `/review-change` by default — safe: the head is unchanged |
 | anything else (behavioral surface or any folded row `high`) | `RE-REVIEW-REQUIRED (delta)` | `/review-change` — delta mode mandatory default |
 
@@ -264,7 +377,12 @@ decision to skip.
 - **Frozen-severity-`high` override.** A folded row whose frozen severity is
   `high` forces `RE-REVIEW-REQUIRED (delta)` even on a docs-only diff. Frozen
   fields are never edited to reach a branch.
-- **SKIPPED requires prior consumer decision (E-D2).** `RE-REVIEW-SKIPPED`
-  is printed only by a turn carrying an explicit prior consumer decision to
-  skip. A turn with no recorded prior consumer decision prints
+- **SKIPPED with sweep (S9).** `RE-REVIEW-SKIPPED` is printed when the batch
+  is docs-only + has a green sweep declaration (#315's claim kind), even
+  without a prior consumer decision. This is the default inversion: skip is
+  the machine-decided default for docs-only + sweep green. Prior consumer
+  decision is still accepted (backwards-compatible).
+- **SKIPPED without sweep (E-D2).** `RE-REVIEW-SKIPPED` requires an explicit
+  prior consumer decision when the batch is docs-only but has no sweep
+  declaration. A turn with no recorded prior consumer decision prints
   `RE-REVIEW-OPTIONAL` + the re-review default, **never** `RE-REVIEW-SKIPPED`.

package/skills/fold-findings/references/FOLD_PROCESS.md

@@ -78,7 +78,7 @@ hard-wrapped across several lines, never joined into one prose line.
 ## REPAIR-RECEIPT — fixed printed block (verbatim copy)
 
 Printed after the per-finding table and tally, as part of the ABSOLUTE-last
-output together with the branching `→ Next:` block. Six fields, always
+output together with the branching `→ Next:` block. Seven fields, always
 present:
 
 ```text
@@ -87,6 +87,12 @@ present:
 - Refuted/open: <F-ids joined ` + `, or `none`>
 - Gate: <command> → exit <n> at head <40-hex sha> · n/a when nothing was folded
 - Batch class: <all-repair-in-place | frozen (replan present) | frozen (product owner present) | none>
+- Closure: <complete | open(n)> · open names the blocker ids
 - Fold diff: <shortstat from a real `git diff` run> · none when nothing was folded
 - Branch: <RE-REVIEW-REQUIRED (delta) | RE-REVIEW-OPTIONAL | RE-REVIEW-SKIPPED | REPLAN-ROUTE | PRODUCT-ROUTE>
 ```
+
+The claim-evidence table the fold prints before this block (§ Claim-evidence
+loop in SKILL.md) is what makes `Closure:` a receipt rather than a claim: a row
+with `status: ✗` means the fold is not closed, and `Closure: complete` is only
+printable once every row reads ✓.

package/skills/init-workspace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: init-workspace
 user-invocable: true
-version: 4.3.0
+version: 4.10.0
 argument-hint: <target-dir>
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT

package/skills/log-session/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: log-session
 user-invocable: true
-version: 2.3.0
+version: 4.10.0
 argument-hint: "[note to prepend to the entry]"
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT

package/skills/orchestration-envelope/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: orchestration-envelope
 user-invocable: false
-version: 2.4.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/phase-contract/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: phase-contract
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/pre-execution-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pre-execution-review
 user-invocable: false
-version: 2.8.3
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/product-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: product-audit
 user-invocable: true
 disable-model-invocation: true
-version: 3.4.0
+version: 4.10.0
 metadata:
   opencode/autoinvoke: false
 argument-hint: <path-or-area> (optional — defaults to the whole product)
@@ -159,6 +159,9 @@ security items to track first").
 
 ## Guardrails
 
+- **The all-stages no-assumption rule binds this audit** — **ask-don't-infer**,
+  owner `skills/unit-lane/references/DESIGN.md` (`ask-dont-infer@1`); an
+  unevidenced expectation is asked, never invented.
 - **Never auto-fixes, never opens issues, never edits the roadmap.** Output is a
   report + proposals; **every action is the user's decision.** The one file this
   skill writes is its own report under `docs/audits/` (plus `mkdir -p

package/skills/product-audit/references/AUDIT_DIMENSIONS.md

@@ -11,6 +11,9 @@
 | **SEO** | Indexability, metadata, structured data | web |
 | **Brand / voice** | User-facing copy vs. the brand guide | surfaces with copy |
 | **Tech debt** | Accumulated shortcuts, TODO/FIXME, stale abstractions | all |
+| **Residue — duplication** | Duplicate content across code **and skill/docs prose** — a grammar block, checklist, table, contract or paragraph copied where a reference should carry it; the duplication check today diff-scoped in `review-code`, re-swept product-wide (see § Residue sweeps) | all |
+| **Residue — unused code** | Code — and skill prose, same rule — that nothing consumes, classified two ways per the classifier's rule (§ Residue sweeps): delivered-feature-without-consumer → bug finding; orphaned-by-requested-replacement/removal → deletion candidate; the dead-code check today diff-scoped in `review-code`, re-swept product-wide | all |
+| **Residue — documentation** | Obsolete docs (they describe surfaces that no longer exist) and missing docs (a live **consumer-facing** surface with no consumer-facing doc — the document-or-don't-coin residue); composes `audit-docs` and never restates its axes (see § Residue sweeps) | all |
 | **Process & docs** | Incomplete phases, aging open issues, **solvable known-issues**, doc completeness, missing/optimizable workflow docs, capability-inventory freshness (`docs/CAPABILITIES.md` ↔ code drift) | all |
 | **Workflow discipline** | The workflow's own rules held: branch/PR discipline, `done · #<pr>` links, phase naming (`P1…`), per-phase docs, commit format, dependency closures, artifact language — **run `audit-docs` checks mechanically** (cite the count from `audit-docs`; never restated in the dimension table); never assume a rule held because it "should". **Scope-export recurrence:** across the most recent units (merged or in-flight), each with a non-empty `## Amendments` descope log or a descope-classified born issue (`audit-pr`'s scope-bleed gate) counts as one scope-exporting unit — **≥ 2 consecutive** such units is a planning-quality finding ("features cut too big for real capacity"), routed to the atomicity/split rules (**#64**), not re-litigated as a per-unit defect | all |
 | **Roadmap coherence** | Stale/obsolete/superseded features, missing dependencies, gaps & opportunities | all |
@@ -22,3 +25,34 @@ internal review pack (`review-code`, `review-security`, `review-verify`,
 `review-debt`, `review-design`, `review-a11y`, `review-brand`, `review-perf`,
 `review-seo`) — installed with the workflow, so an applicable axis can never be
 "missing". Platform skills the project installed run as optional extras on top.
+
+## Residue sweeps (pass-only-if)
+
+The three residue dimensions run product-wide across code **and skill/docs
+prose** — "code" includes prose everywhere in this section (#340). A sampled
+sweep states what it sampled, like every dimension. Findings route through the
+classifier (`review-implementation`, `CLASSIFY.md`) like every other finding.
+
+**Duplicate content** — pass only if:
+
+- ✓ every duplicated grammar block, checklist, table, contract or paragraph found is either a reference to a single owner or carries its declared reason for the copy
+- ✓ each confirmed duplicate is one finding citing both locations
+- ✓ the same sweep run over the clean fixture twin (below) yields zero findings
+
+**Unused code, two ways, never conflated** — pass only if:
+
+- ✓ every unconsumed exported/defined symbol (or unreferenced prose block) is classified exactly one way: written as part of a delivered feature that **no functionality invokes** → **bug finding** (the feature was not implemented completely — the unit shipped half of what was asked); orphaned because a requested change **replaced or removed** that feature or part → **deletion candidate** (`fix-now (delete)`, not a bug)
+- ✓ the classification cites what requested the original feature and what replaced it — classifier evidence, never the auditor's impression
+- ✓ after any proposed deletion, **features-preserved-without-it** is verified: every requested feature still works without the removed code or prose — a deletion that breaks a requested feature is a finding, not a cleanup
+
+**Obsolete & missing documentation** — pass only if:
+
+- ✓ every doc describing a surface that no longer exists is a finding (obsolete), citing the live-tree search that proves the surface gone
+- ✓ every live **consumer-facing** surface with no consumer-facing doc is a finding (missing — the document-or-don't-coin residue); internal-only helpers are not findings
+- ✓ `audit-docs`' own axes were run or their result cited — this sweep adds the residue cases, never restates the coherence checks
+
+The seeded fixture (`scripts/product-audit-residue-fixture.mjs <dir>`, written
+on demand outside the repository) carries one seed per residue class — a
+duplicated grammar copy, an exported-but-unconsumed function, a doc naming a
+removed surface, a live surface with no doc — plus a clean twin: the sweeps
+must yield exactly one finding per seed on `seeded/` and zero on `clean/`.

package/skills/product-audit/references/AUDIT_PROCESS.md

@@ -4,7 +4,11 @@
 2. **Sweep code & axes** — run the applicable axes across the codebase: compose
    `review-implementation` plus the internal review pack's applicable passes
    (each returns its fixed-format table + PASS|FAIL), and any optional installed
-   extras. Classify findings (severity + closed class set from review-implementation/CLASSIFY.md).
+   extras. Run the **residue sweeps** (`AUDIT_DIMENSIONS.md` § Residue sweeps):
+   duplicate content, unused code classified two ways, obsolete + missing
+   documentation — product-wide, across code and skill/docs prose, with the
+   features-preserved-without-it check after every proposed deletion. Classify
+   findings (severity + closed class set from review-implementation/CLASSIFY.md).
 
 **Evidence-provenance gate (fixed):** applies during every evidence-collecting sweep
 step (2–5). Each item ends with exactly one fallback; never pick another one mid-audit.

package/skills/resolve-repository-state/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: resolve-repository-state
 user-invocable: true
-version: 1.2.2
+version: 4.10.0
 argument-hint: <contradiction-id>
 description: >
   Resolve an explicit Normalized Repository State contradiction. This is the

package/skills/review-a11y/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-a11y
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-brand/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-brand
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-change/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-change
 user-invocable: true
-version: 3.13.0
+version: 4.10.0
 argument-hint: <path-or-glob> [--adversarial N] [--synthesize]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -95,8 +95,10 @@ survives the attempt, that survival *is* the review outcome. So:
   or the requirement leaves the user's expectation unclear, surface it as a
   question in non-technical terms (a technical user asks for an app; a
   non-technical user asks for “an app to measure my heart rate”) — never as an
-  assumed intent. This extends ask-don't-infer from acceptance criteria to every
-  expectation the change is judged against.
+  assumed intent. This review applies the all-stages no-assumption rule —
+  **ask-don't-infer**, owner `skills/unit-lane/references/DESIGN.md`
+  (`ask-dont-infer@1`) — to every expectation the change is judged against;
+  the rule is owned there, never restated here.
 - **Repo-wide hunting is not this review.** Open-ended bug hunting, security
   research and broken-version investigation *across the repository* belong to
   `product-audit`, where the sweep is scoped and budgeted; this review stays on
@@ -182,6 +184,19 @@ Architectural invariants rules.
 Resources are one hop from this file. Fixed reviewer/synthesis/output contracts are
 literal. Missing required resource → stop; never approximate a review contract.
 
+## Reviewer anti-invention rule (S10, from #205)
+
+After cycle 1, a *new* finding is admissible only when grounded in:
+1. **Provably-changed bytes** (git-computed diff between the reviewed state
+   and the base), or
+2. A **mis-run cited check** (the cited validator's own output contradicts it).
+
+A finding without changed-bytes grounding is a report-note, never fix-now.
+This is narrower and stronger than the delta-mode "genuinely new" admission:
+it bounds what a reviewer may invent at all, not only where it may re-report.
+The classifier routes `fix-now (delete)` for genuine findings; report-notes
+route to `info` severity and do not block.
+
 ## Portability
 
 Keep reviewer contexts isolated. Use [portability](references/PORTABILITY.md) for

package/skills/review-code/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-code
 user-invocable: false
-version: 1.3.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >
@@ -16,7 +16,9 @@ description: >
 
 Composed by `review-change` / `product-audit` within their conversation — on any
 agent, follow this file inline as the routed step. **Findings only; never edits,
-never refactors.**
+never refactors.** Questions an unclear expectation raises obey the all-stages
+no-assumption rule — **ask-don't-infer**, owner
+`skills/unit-lane/references/DESIGN.md` (`ask-dont-infer@1`).
 
 ## Scope
 
@@ -51,6 +53,30 @@ default branch. State the scope at the top of the returned table.
   `sweep-mismatch`
 ✓ Edge cases the SPEC's dev scenarios name are actually handled in code, not
   just in tests
+✓ **Is deleting the surface the complete fix? (S8)** — before any edit is
+  proposed, check: does removing the surface entirely achieve the goal more
+  reliably than repairing it? If yes → route `fix-now (delete)`, not
+  `fix-now (repair)`. This is the deletion mandate: design and plan produce
+  retirements as first-class deliverables.
+✓ **Unused code routes two ways (#340)** — every unconsumed symbol (or
+  unreferenced prose block) is a deletion candidate routed through the
+  classifier's two-way rule (`review-implementation`, `CLASSIFY.md`):
+  delivered-feature-without-consumer → bug finding; orphaned by a requested
+  replacement/removal → `fix-now (delete)`. The row cites what requested the
+  feature and what replaced it — the two classes are never conflated
+✓ **Duplication is a deletion candidate (#340)** — a duplicated block,
+  checklist or contract (code or prose) proposes its own deletion, or carries
+  the recorded reason the copy must exist; a silent duplicate is a finding
+✓ **Features-preserved-without-it (#340)** — after any proposed deletion
+  (code or skill prose; "code" includes prose), verify every requested
+  feature still works without the removed part before merge; a deletion that
+  breaks a requested feature is a finding, not a cleanup
+✓ **Removal-feature cascade (#340)** — a change whose purpose is to remove a
+  feature deletes the code **and** its documentation **and** every sibling
+  mention the context makes necessary, with one sweep declaration per deleted
+  truth (`swept: /<pattern>/<flags> → expected <n> in <glob>`); when the
+  cascade's extent is unclear, the reviewer researches, understands and
+  contrasts — it does not guess the cascade's extent
 
 ## Materiality bar
 

package/skills/review-debt/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-debt
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >
@@ -36,12 +36,18 @@ workarounds pinned to upstream fixes) into explicit, payable debt items:
 ✓ Attribute it to the axis already recorded in the table — never re-litigate ownership
 ✓ Confirm every debt item carries a TRIGGER: the condition under which it must be
   paid (e.g. "3rd consumer appears", ">100k rows") — a debt item without a
-  trigger is itself a finding
+  trigger is itself a finding. Scheduled deletions carry their trigger as the
+  removal condition (S8: review-debt items become *scheduled deletions* whose
+  TRIGGER names the removal — executable by a fold batch, not archival prose).
 ✓ Verify no current-unit debt was mislabeled non-blocking: current-unit work
   cannot be `postpone`/`tradeoff`/`wontfix` — a table showing one is flagged back
   to the classifier, never reclassified here
 ✓ Honor the dead-code exception: staged/planned code cross-checked against the
   roadmap/SPEC/TASKS is not dead code — mark *verify* when unsure, never assert
+✓ **Deletion route.** A debt item that proposes removal of a surface carries
+  `route: fix-now (delete)`, not `route: fix-now (repair)`. The TRIGGER
+  specifies what proves the surface is safe to remove (e.g. "no consumer in
+  grep <scope> returns >0").
 
 ## Return exactly
 

package/skills/review-design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-design
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-implementation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-implementation
 user-invocable: false
-version: 1.12.0
+version: 4.10.0
 argument-hint: <path-or-glob>
 allowed-tools: Read, Grep, Glob, Bash, WebFetch
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"

package/skills/review-implementation/references/CLASSIFY.md

@@ -142,6 +142,29 @@ depends on whether the final `Hardening & PR` phase has already run:
 
 The finding is not folded directly; it is folded by the new phase(s).
 
+### Unused code routes two ways, never conflated (#340)
+
+An unused-code finding — code, or skill prose under the same rule, that nothing
+consumes — classifies exactly one way, and the two classes never merge.
+*Consumes* means a call site, an import, or the doc that orders the surface to
+exist: a path mention does not consume, and a surface the runtime invokes as the
+tree's entry point is not unconsumed — flagging it would make the sweep find the
+thing it runs on, not the residue it hunts:
+
+- **Delivered feature, no consumer** — the code was written as part of a
+delivered feature and **no functionality invokes it**: the feature was not
+implemented completely → **bug finding**. Class `fix-now`; the missing half
+(the consumer or the delivery) is folded — **deletion is not the fix** for
+this class.
+- **Orphaned by a requested change** — the code lost its consumer because a
+requested change **replaced or removed** that feature or part: **marked for
+deletion** → `fix-now (delete)`, not a bug. The deletion is a planned task
+with its negative-capability pin, sweep grep and surviving-reference count
+(the plan step's retirement shape).
+
+The row cites what requested the original feature and what replaced it; an
+unused-code row without both citations is not classifiable.
+
 ### Decision table
 
 For every finding, give the reasoning columns. Example (generic — your findings,
@@ -152,6 +175,8 @@ your domains):
 | API token committed in a config file | security | high | fix-now | Credential exposure | Low (move to secret store) | Incident risk | no | fold into phase |
 | New export endpoint has no failure-mode test | tests | med | fix-now | Untested error path | Low | Regression risk | no | fold into phase |
 | Fixing this backend bug pulls in an auth redesign | correctness | high | decision-required | Unavoidable product/architecture decision | — | Blocking | no | surface decision, block |
+| Exported helper of a delivered feature that nothing invokes | residue | med | fix-now | The unit shipped half of what was asked — the consumer was never delivered (bug, not cleanup) | Low (deliver the consumer or fold the missing half) | Feature stays incomplete | no | fold into phase |
+| Module orphaned by the unit's own replacement of its feature | residue | med | fix-now (delete) | Superseded part left behind by a requested change | Low (delete + sweep declaration) | Dead weight grows | no | fold deletion task |
 | Rate limiter reusable across the fleet | architecture | low | proposal | Independent of this unit (D3) | — | — | yes | batch proposal + trigger |
 | Single-caller wrapper around a stdlib call | overengineering | low | ignore | Indirection with no payoff | — | Negligible | no | note rationale |
 

package/skills/review-perf/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-perf
 user-invocable: false
-version: 1.2.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-security/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-security
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-seo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-seo
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/review-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-verify
 user-invocable: false
-version: 1.1.0
+version: 4.10.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >
@@ -18,6 +18,12 @@ Composed by `review-change` / `product-audit` within their conversation — on a
 agent, follow this file inline as the routed step. **Findings only; never edits,
 never refactors.**
 
+**Shift from discoverer to auditor of recorded evidence (S5).** The implementer's
+claim-evidence loop is the primary verification. This review *audits* the
+recorded evidence: re-runs a sample of the recorded commands instead of
+re-deriving the whole change. This is the cost-scaling invariant — reviewers
+dig into code only when evidence is absent or contradicts.
+
 ## Scope
 
 The diff or path/glob the caller passes; default the current change vs the
@@ -25,10 +31,21 @@ default branch. State the scope at the top of the returned table.
 
 ## Checklist (evaluate EVERY item — none is optional; n/a must be stated)
 
+✓ **Evidence audit.** Sample the unit doc's Evidence rows: re-run ≥ 3 of the
+  recorded commands and compare observed output against what the implementer
+  recorded. Mismatch → finding: "evidence contradicts observation at <file:line>".
+✓ **Claim-evidence loop verification.** Check the fold's claim table (if
+  present): every row has `status: ✓`. Any `✗` row means the implementer's
+  turn did not complete its claim-evidence loop.
+✓ **Unit-route triage currency.** Re-run `bun scripts/unit-route.mjs --triage
+  <slug>` and compare the `Steps:` line against the unit doc's Evidence section.
+  Mismatch → stale triage.
 ✓ The project's verification gate ran in THIS review (type-check, tests, build
   per the project's declared commands) — paste exit status per command
 ✓ The change's primary claimed behavior was exercised for real (run the
-  CLI/endpoint/function; paste the actual observed output)
+  CLI/endpoint/function; paste the actual observed output) — *in addition to*
+  the evidence audit, verify at least one behavioral claim not covered by
+  recorded evidence
 ✓ At least one failure-mode from the SPEC's dev scenarios was reproduced (bad
   input, missing file, error path) and behaved as specified
 ✓ New/changed tests actually fail when the implementation is reverted or