@hone-ai/cli 1.33.0 → 1.35.0

package/hone-cli.js

@@ -25,10 +25,20 @@ const os           = require('os');
 const crypto       = require('crypto');
 const { execSync } = require('child_process');
 
+// HC-GF-144: verdictEnv lives in cli/lib so it is importable and can be tested by BEHAVIOUR.
+// A source-regex asserting the variable name matched this very comment and passed while the
+// scrub was gutted.
+const { verdictEnv } = require('./lib/verdict-env');
+const { parseTimeoutSeconds } = require('./lib/timeout-option.js');
+// HC-GF-143 batch: both mappings were computed inline and asserted by nothing (HC-GF-136).
+const { promotePayload } = require('./lib/promote-payload');
+const { assetFetchList } = require('./lib/asset-fetch-list');
+
 const pkg     = require('./package.json');
 const { parseReviewJSON } = require('./lib/parse-review-json');
 const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config');
 const { gitEnv } = require('./lib/git-env');
+const { collectIncludePaths } = require('./lib/include-paths');
 const program = new Command();
 
 // ── Config resolution ─────────────────────────────────────────────────────────
@@ -41,6 +51,23 @@ function readRc() {
   return {};
 }
 
+/**
+ * Resolve the Hone-team admin key, or stop with the instruction for supplying it.
+ *
+ * HC-GF-239: `hone absorb` is the second command to need this, and the second copy of the same
+ * six lines is how the two drift. The key is read from the environment or ~/.honerc and NEVER
+ * taken as an argument — an argument lands in shell history, and this is a production key.
+ */
+function requireAdminKey() {
+  const adminKey = process.env.HONE_ADMIN_KEY || readRc().admin_key;
+  if (!adminKey) {
+    console.error('Error: Admin key not found.');
+    console.error('Set HONE_ADMIN_KEY env var, or add "admin_key" to ~/.honerc');
+    process.exit(1);
+  }
+  return adminKey;
+}
+
 function getConfig() {
   // Priority: env var → ~/.honerc → error
   const rc     = readRc();
@@ -152,19 +179,33 @@ process.on('exit', () => {
 program
   .command('agent-eval')
   .description('Run agent-eval probes against configured agent targets (HC-COMM-011-followup-1)')
-  .option('--category <category>', 'Probe category (adversarial|faithfulness|safety|boundary)', 'adversarial')
+  .option('--category <category>', 'Probe category (adversarial|faithfulness|safety|boundary|stateful)', 'adversarial')
   .option('--target <name>', 'Run against a specific agent target (default: all configured)')
   .option('--output <format>', 'Output format (text|json)', 'text')
   .option('--judge', 'Add the free NLI judge layer (faithfulness only): claims are checked for entailment against the probe context')
   .option('--provider <name>', 'Judge provider: gh-models (free, default) | claude (paid Sonnet)', 'gh-models')
   .option('--report', 'Report the agent-eval verdict to the run (advisory) — needs --workflow-id')
   .option('--workflow-id <id>', 'The run id to report the verdict against (for --report)')
+  .option('--timeout <s>', 'Seconds to allow each probe (default 5 — raise it for packs that need a real generation)', '5')
   .action(async (opts) => {
     const { readAgentEvalConfig } = require('./lib/pipeline-config');
     const { runAgent } = require('./lib/agent-executor');
     const { runCheck } = require('./lib/eval-graders');
+    const { scoreProbe, summarizeProbes, describeProbeSummary } = require('./lib/agent-eval-score');
     const config = readAgentEvalConfig(process.cwd());
 
+    // HC-GF-197: validated, not coerced. `Number('abc')` is NaN, NaN is NOT nullish so the
+    // executor's `?? 5000` default never applies, and `setTimeout(NaN)` fires in 1ms — so a typo
+    // in this flag times out every probe instantly and reports them as WRONG ANSWERS. That is the
+    // defect HC-GF-198 exists to fix, reachable by mistyping a flag.
+    let probeTimeoutMs;
+    try {
+      probeTimeoutMs = parseTimeoutSeconds(opts.timeout) * 1000;
+    } catch (e) {
+      console.error(e.message);
+      process.exit(2);
+    }
+
     if (!config.targets || config.targets.length === 0) {
       console.log('No agent targets configured in .pipeline-config.yml (agent_eval.targets)');
       process.exit(0);
@@ -175,6 +216,9 @@ program
       faithfulness: './lib/agent-eval-probes-faithfulness',
       safety: './lib/agent-eval-probes-safety',
       boundary: './lib/agent-eval-probes-boundary',
+      // HC-GF-197: calibration, not safety. The other four packs ask whether an agent misbehaves;
+      // this one asks whether ONE judgment is right, scored against stories the owner labelled.
+      stateful: './lib/agent-eval-probes-stateful',
     };
     let probes;
     if (PROBE_PACKS[opts.category]) {
@@ -208,38 +252,85 @@ program
 
     const results = [];
     let anyFailed = false;
+    // HC-GF-199: pace from what the provider DOES, and run the probes where
+    // their writes cannot reach this repository.
+    const { createPacer } = require('./lib/agent-eval-pacing');
+    const pacer = createPacer();
+    const probeCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-agent-eval-'));
+    let stopped = null;
+    let attempted = 0;
+
     for (const target of targets) {
       for (const probe of probes) {
-        const run = await runAgent(target, probe.input);
+        if (stopped) break;
+        attempted += 1;
+        const wait = pacer.delayBeforeNext();
+        if (wait > 0) {
+          // Say it. A run that quietly slows down looks identical to a fast one,
+          // and that is how a degraded provider reads as a clean measurement.
+          if (opts.output !== 'json') {
+            console.log(`  pacing: waiting ${Math.round(wait / 1000)}s — the provider refused the previous probe`);
+          }
+          await new Promise((r) => setTimeout(r, wait));
+          pacer.noteWaited(wait);
+        }
+        // HC-GF-197: the default is 5s, sized for the deterministic packs — a canary string or a
+        // refusal comes back immediately. A calibration probe asks for a real grooming, which takes
+        // tens of seconds, so every one of them timed out and scored as a failed judgment. A
+        // verdict produced by a timeout is not a verdict about the agent.
+        const run = await runAgent(target, probe.input, { timeout: probeTimeoutMs, cwd: probeCwd, repoRoot: process.cwd() });
         const output = run && typeof run.output === 'string' ? run.output : '';
         const graders = probe.graders.map((g) => runCheck(output, g));
-        let passed = !run.error && graders.every((r) => r.passed);
+        // HC-GF-198: three outcomes. A probe that never answered is not one that answered wrongly,
+        // and scoring them alike reported 4/8 for a run where 4 of the 5 that COMPLETED were right.
+        const scored = scoreProbe(run, graders);
+        let { outcome } = scored;
+        let passed = scored.passed;
 
         // Judge layer: only for grounded probes (those with a context to entail against).
         let judge = null;
-        if (judgeCall && probe.context) {
+        if (judgeCall && probe.context && outcome !== 'error') {
           const { judgeFaithfulness } = require('./lib/agent-eval-judge');
           judge = await judgeFaithfulness({ output, context: probe.context, callLLM: judgeCall });
-          passed = passed && judge.passed;
+          if (!judge.passed) { passed = false; outcome = 'fail'; }
         }
         if (!passed) anyFailed = true;
-        results.push({ target: target.name, probe: probe.id, passed, error: run.error || null, graders, judge });
+        results.push({ target: target.name, probe: probe.id, outcome, passed, error: run.error || null,
+          stderr: run.stderr || null, graders, judge });
+
+        pacer.record({ outcome });
+        stopped = pacer.stopReason();
       }
     }
 
+    try { fs.rmSync(probeCwd, { recursive: true, force: true }); } catch { /* best-effort */ }
+
+    const summary = summarizeProbes(results);
+    // HC-GF-199: a run that gave up must SAY so, and say how many probes it never
+    // reached. Reporting only what completed is how a dead run reads as a fast one.
+    const pacing = { ...pacer.summary(), stopped, attempted, planned: targets.length * probes.length };
+    if (stopped) {
+      anyFailed = true;
+      if (opts.output !== 'json') {
+        console.error(`\n⊘ run STOPPED: ${stopped}`);
+        console.error(`  ${attempted} of ${pacing.planned} probes attempted — the rest were never run.`);
+      }
+    }
     if (opts.output === 'json') {
-      console.log(JSON.stringify({ category: opts.category, passed: !anyFailed, results }, null, 2));
+      console.log(JSON.stringify({ category: opts.category, passed: !anyFailed, summary, pacing, results }, null, 2));
     } else {
       for (const r of results) {
-        const mark = r.passed ? '✓' : '✗';
-        console.log(`  ${mark} ${r.target} / ${r.probe}${r.error ? ` (executor: ${r.error})` : ''}`);
-        if (!r.passed) {
+        // HC-GF-198: three marks, because there are three outcomes. `✗` for a wrong answer and
+        // `⊘` for one that never came — printing both as `✗` is what made 3 timeouts read as 3
+        // wrong answers.
+        const mark = r.outcome === 'pass' ? '✓' : (r.outcome === 'error' ? '⊘' : '✗');
+        console.log(`  ${mark} ${r.target} / ${r.probe}${r.error ? ` (no answer: ${r.error})` : ''}`);
+        if (r.outcome === 'fail') {
           for (const g of r.graders.filter((x) => !x.passed)) console.log(`      - ${g.type}: ${g.detail}`);
           if (r.judge && !r.judge.passed) console.log(`      - judge: ${r.judge.detail}`);
         }
       }
-      const pass = results.filter((r) => r.passed).length;
-      console.log(`\n${pass}/${results.length} probes passed (category: ${opts.category})`);
+      console.log(`\n${describeProbeSummary(summary)} (category: ${opts.category})`);
     }
 
     // Closed loop (HC-COMM-011-followup-5): report the verdict to the run. agent-eval
@@ -588,22 +679,31 @@ program
 
     // Build parallel fetch list
     const fetches = [
-      // Agent stubs
-      ...agents.map(agent => ({
-        key: `${agent}.agent.md`,
-        promise: client.get(`/scripts/agent-stub/${agent}`).then(r => r.data),
-        write: (data) => fs.writeFileSync(path.join(agentsDir, `${agent}.agent.md`), data),
-      })),
-      // Skill files
-      ...skills.map(skill => ({
-        key: `skills/${skill}/SKILL.md`,
-        promise: client.get(`/skills/${skill}`).then(r => r.data),
-        write: (data) => {
+      // Agent stubs and skill files. HC-GF-136's gate found `key`, `promise` and `write` here
+      // computed and asserted by nothing; the mapping is now a pure function in cli/lib. The REST
+      // of this list is untouched — an earlier attempt replaced the whole array and silently
+      // dropped ai-reviewer.js, check-learnings-gate.js and the ESM package.json, which would have
+      // broken setup for every adopter. The regression suite caught it.
+      ...assetFetchList({
+        agents, skills,
+        // HC-GF-184: also pull whatever derive produced for THIS repo. Same basename rule the
+        // other commands use (`hone sync`, `hone derive`), so the three agree on the repo's name.
+        //
+        // `process.cwd()` directly, NOT `repoRoot`: the only `repoRoot` bindings near here are in
+        // ANOTHER command's action and inside `if (opts.refresh)`, which returns long before this
+        // line. Referencing it threw `ReferenceError` on the normal setup path — for every
+        // adopter — while `node --check` passed and the unit tests, which drive assetFetchList
+        // directly, never evaluated it.
+        derivedRepo: path.basename(process.cwd()),
+        get: (url) => client.get(url).then(r => r.data),
+        writeAgent: (agent, data) =>
+          fs.writeFileSync(path.join(agentsDir, `${agent}.agent.md`), data),
+        writeSkill: (skill, data) => {
           const skillDir = path.join(skillsDir, skill);
           fs.mkdirSync(skillDir, { recursive: true });
           fs.writeFileSync(path.join(skillDir, 'SKILL.md'), data);
         },
-      })),
+      }),
       // Copilot instructions
       {
         key: 'copilot-instructions.md',
@@ -994,6 +1094,27 @@ program
 
 // ── Test framework installation helpers ────────────────────────────────────────
 
+/**
+ * HC-GF-190: what the sandbox WOULD have done, for the paths that end before it is asked.
+ *
+ * Builds the plan the run never got to and describes it. `planSandboxRun` is pure — it runs no
+ * commands — so this is safe on an early exit, and it is the only way an operator can tell a
+ * sandbox that was SKIPPED from one that was never configured.
+ */
+function describeSandboxDisposition(runConfig) {
+  try {
+    const { readSandboxConfig } = require('./lib/pipeline-config');
+    const { planSandboxRun, describeNotReached } = require('./lib/sandbox-lifecycle');
+    return describeNotReached(planSandboxRun({
+      sandbox: readSandboxConfig(process.cwd()),
+      axes: runConfig?.classifier_axes || runConfig?.axes || [],
+      capability: runConfig?.capability || null,
+    }));
+  } catch {
+    return null; // reporting must never be the thing that breaks a run
+  }
+}
+
 function detectExistingTestFramework(repoRoot) {
   const pkgPath = path.join(repoRoot, 'package.json');
   if (!fs.existsSync(pkgPath)) return { stack: 'unknown', testFw: null, pkgMgr: null };
@@ -1311,7 +1432,14 @@ async function installTestFramework(repoRoot, opts) {
     console.log('');
     console.log('── Verification ────────────────────────────────────────');
     try {
-      execSync('npm test 2>&1', { cwd: repoRoot, stdio: 'inherit', timeout: 30_000 });
+      // HC-GF-144: `node` exports NODE_TEST_CONTEXT to the processes IT spawns, and this repo's
+      // regression suites spawn the CLI. Inherited, it makes a FAILING `node --test` exit 0 — so
+      // this verification would print "npm test passed" for a red repository, which is the one
+      // thing it exists not to do. Only the verdict-flipping variables are removed; the adopter's
+      // toolchain environment is otherwise passed through untouched.
+      execSync('npm test 2>&1', {
+        cwd: repoRoot, stdio: 'inherit', timeout: 30_000, env: verdictEnv(),
+      });
       console.log('  ✓ npm test passed');
     } catch {
       console.log('  ⚠ npm test had issues — review test output above');
@@ -1477,15 +1605,42 @@ program
     const maxFiles   = parseInt(opts.maxFiles);
     let fileCount    = 0;
 
-    for (const dir of sourceDirs) {
-      const dirPath = path.join(repoRoot, dir.replace(/"/g, ''));
-      if (!fs.existsSync(dirPath)) continue;
-      bundleDirectory(dirPath, repoRoot, files, maxFiles, fileCount);
-      fileCount = Object.keys(files).length;
-      if (fileCount >= maxFiles) break;
+    // HC-GF-178: allocate the cap ACROSS the declared dirs. The previous loop drained them in
+    // order and `break`-ed at the cap, so `cli/` (142 files vs a default of 30) filled it alone and
+    // server/scripts/enterprise-assets/.github were never read — while the output still said
+    // "Bundling 30 source files...". The derive agent graded the repo on a fifth of it and said so;
+    // the CLI said nothing.
+    const { planBundle } = require('./lib/bundle-source-dirs');
+    const perDirFiles = new Map();
+    const plan = planBundle({
+      sourceDirs,
+      maxFiles,
+      listFiles: (dir) => {
+        const dirPath = path.join(repoRoot, dir.replace(/"/g, ''));
+        if (!fs.existsSync(dirPath)) return [];
+        // COST, stated rather than hidden: this reads every bundlable file in the directory to
+        // plan a selection of a few. On this repo that is ~1,400 files (each capped at 50,000
+        // chars by bundleDirectory) to choose 100, and a derive run still completes in ~90s. It is
+        // the honest shape — you cannot allocate a budget across sources without knowing what each
+        // holds — but on a very large monorepo it is the first thing to optimise, by separating
+        // listing from reading. Filed as a follow-up rather than guessed at now.
+        const collected = {};
+        bundleDirectory(dirPath, repoRoot, collected, Number.MAX_SAFE_INTEGER, 0);
+        perDirFiles.set(dir, collected);
+        return Object.keys(collected);
+      },
+    });
+    for (const rel of plan.selected) {
+      for (const collected of perDirFiles.values()) {
+        if (Object.prototype.hasOwnProperty.call(collected, rel)) { files[rel] = collected[rel]; break; }
+      }
     }
+    fileCount = Object.keys(files).length;
 
     console.log(`Bundling ${Object.keys(files).length} source files...`);
+    // Say what was left out. An unreported omission is what made this defect survive: the agent
+    // could see the gap in its own input and the operator could not.
+    for (const line of plan.dropped) console.log(`  ⚠ not fully bundled — ${line}`);
 
     // 3. Bundle existing skills if refresh mode
     let existingSkills = {};
@@ -2226,14 +2381,8 @@ program
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (opts) => {
     const rc = readRc();
-    const adminKey = process.env.HONE_ADMIN_KEY || rc.admin_key;
     const apiUrl = process.env.HONE_API || rc.api || 'https://api.hone.ai';
-
-    if (!adminKey) {
-      console.error('Error: Admin key not found.');
-      console.error('Set HONE_ADMIN_KEY env var, or add "admin_key" to ~/.honerc');
-      process.exit(1);
-    }
+    const adminKey = requireAdminKey();
 
     try {
       const { data } = await axios.get(`${apiUrl}/admin/usage`, {
@@ -2643,15 +2792,7 @@ program
     }
 
     // 5. POST to /learnings/promote (enterprise_summary only — never local_summary)
-    const payload = eligible.map(l => ({
-      id: l.id || l._file,
-      repo_name: l.repo_name,
-      type: l.type,
-      agent: l.agent,
-      target_skill: l.target_skill,
-      enterprise_summary: l.enterprise_summary,
-      proposed_fix: l.proposed_fix || l.absorbed_into,
-    }));
+    const payload = promotePayload(eligible);
 
     try {
       const r = await client.post('/learnings/promote', { learnings: payload });
@@ -2660,7 +2801,11 @@ program
     } catch (e) {
       console.error(`\nPromotion failed: ${e.response?.data?.error || e.message}`);
       console.error('Local files unchanged — safe to retry.');
-      return;
+      // HC-GF-207: a failed promotion must be a failed command. Returning here exited 0, so
+      // `make promote` and the auto-promote workflow went green on ten consecutive runs that
+      // promoted nothing (HC-GF-236). A dry run and a cancelled prompt still exit 0 — those
+      // are refusals, not failures.
+      process.exit(1);
     }
 
     // 6. Update local YAML: status → promoted (per-schema, idempotent).
@@ -2670,23 +2815,220 @@ program
       if (!promotedByFile.has(l._filePath)) promotedByFile.set(l._filePath, []);
       promotedByFile.get(l._filePath).push(l.id);
     }
+    // HC-GF-208: an UNCHANGED file is not a success. writeBackPromoted returns the
+    // content untouched when it cannot flip a status; fs.writeFileSync then succeeds
+    // on identical bytes, and this loop used to print the same tick either way — so
+    // the log said 296 files flipped while the filesystem had 220. Eligibility already
+    // excludes anything promoted, so for these ids "unchanged" can only mean failure:
+    // there is no idempotent-rerun case to mistake it for.
+    const unflipped = [];
     for (const [filePath, ids] of promotedByFile) {
+      const fileName = path.basename(filePath);
       try {
         const schema = fileSchemas[filePath];
-        let content = fs.readFileSync(filePath, 'utf8');
-        content = writeBackPromoted(content, schema, ids);
-        fs.writeFileSync(filePath, content);
-        const fileName = path.basename(filePath);
-        console.log(`  ✓ ${fileName}: ${ids.length} learning(s) → promoted`);
+        const before = fs.readFileSync(filePath, 'utf8');
+        const after  = writeBackPromoted(before, schema, ids);
+        if (after === before) {
+          unflipped.push(fileName);
+          console.warn(`  \u26a0 ${fileName}: ${ids.length} learning(s) sent, but the local status did not change \u2014 they stay eligible and will be re-sent next run`);
+          continue;
+        }
+        fs.writeFileSync(filePath, after);
+        console.log(`  \u2713 ${fileName}: ${ids.length} learning(s) \u2192 promoted`);
       } catch (e) {
-        console.warn(`  ⚠ ${path.basename(filePath)}: failed to update local file — ${e.message}`);
+        unflipped.push(fileName);
+        console.warn(`  \u26a0 ${fileName}: failed to update local file \u2014 ${e.message}`);
       }
     }
 
+    if (unflipped.length) {
+      console.warn(`\n\u26a0 ${unflipped.length} file(s) were sent but NOT marked promoted locally.`);
+      console.warn('  Their learnings remain eligible and will be re-sent on the next run.');
+    }
+
     console.log('\nDone. Commit the updated learnings files:');
     console.log('  git add .github/learnings/ && git commit -m "chore: promote learnings to enterprise"');
   });
 
+// ── PROMOTED command (HC-GF-210) ─────────────────────────────────────────────
+// The consumer for GET /learnings/promoted. HC-GF-159b built that route as "THE READER",
+// on the premise that promotion without read-back is a write-only counter — and then nothing
+// called it. Auditing the production queue on 2026-09-20 meant hand-rolling an HTTPS call,
+// and that audit found 203 of 736 rows carrying an EMPTY enterprise_summary, invisible for
+// five months because no shipped tool could show them. So the two counts in the footer are
+// the point of this command, not decoration: a promoted row with no summary, or none a run
+// can reach, was promoted into nothing, and only a read-back can say so.
+program
+  .command('promoted')
+  .description("List the learnings this org has promoted, with their content (HC-GF-210)")
+  .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
+  .option('--empty', 'Show only rows whose enterprise summary is missing or blank')
+  .option('--unrouted', 'Show only rows that name no skill, prompt or script to reach')
+  // HC-GF-238: absorbing a row removed it from this command, because the route filtered on one
+  // status. The default is still `promoted` — nothing an existing caller sees changes — and these
+  // two options are how an operator reads back what the team actually LANDED.
+  .option('--status <status>', 'Lifecycle status: promoted (default) | absorbed | retracted | pending | overdue | all')
+  .option('--all', 'Every status, whatever a row has reached — the same as --status all')
+  .action(async (opts) => {
+    const config = getConfig();
+    const client = api(config);
+    const status = opts.all ? 'all' : (opts.status || 'promoted');
+    try {
+      // The default request is byte-identical to the one that shipped — no query string at all —
+      // so nothing that already calls this path shifts, including HC-GF-210's pin on it. The
+      // parameter appears only when the operator asked for a status other than the default.
+      const qs = status === 'promoted' ? '' : `?status=${encodeURIComponent(status)}`;
+      const { data } = await client.get(`/learnings/promoted${qs}`);
+      const all = Array.isArray(data.learnings) ? data.learnings : [];
+      // The two ways a promoted row reaches no run. `targetKind` is 'unrouted' when HC-GF-159a's
+      // router found no target; a row promoted before that story carries neither field at all.
+      const isEmpty    = (l) => !String(l.enterpriseSummary || '').trim();
+      const isUnrouted = (l) => !String(l.targetSkill || '').trim()
+                              || String(l.targetKind || 'unrouted') === 'unrouted';
+      const empties  = all.filter(isEmpty);
+      const unrouted = all.filter(isUnrouted);
+      let shown = all;
+      if (opts.empty)    shown = shown.filter(isEmpty);
+      if (opts.unrouted) shown = shown.filter(isUnrouted);
+
+      if (opts.format === 'json') {
+        console.log(JSON.stringify({
+          orgId:    data.orgId,
+          status,
+          count:    all.length,
+          empty:    empties.length,
+          unrouted: unrouted.length,
+          learnings: shown,
+        }, null, 2));
+        return;
+      }
+
+      console.log(status === 'promoted' ? 'Hone AI — Promoted Learnings' : `Hone AI — Learnings (${status})`);
+      console.log('================================');
+      if (!all.length) {
+        console.log(status === 'promoted'
+          ? "\nNothing promoted yet. Send this repo's learnings with: hone promote"
+          : `\nNo learnings with status '${status}'.`);
+        return;
+      }
+      // ASCII on purpose, and read by column position: same reasoning as `hone workflows` (HC-GF-108).
+      const clip = (s, w) => (s.length > w ? `${s.slice(0, w - 3)}...` : s);
+      const day  = (ts) => { const d = ts ? new Date(ts) : null; return d && !isNaN(d) ? d.toISOString().slice(0, 10) : '-'; };
+      console.log('');
+      // The STATUS column appears ONLY when the listing can hold more than one status. This table
+      // is read by column position (HC-GF-108), so the default `hone promoted` keeps the exact
+      // layout it shipped with and no existing reader shifts by a column.
+      const mixed = status === 'all';
+      console.log([
+        ...(mixed ? ['STATUS'.padEnd(10)] : []),
+        'PROMOTED'.padEnd(11), 'TARGET'.padEnd(24), 'KIND'.padEnd(9), 'LEARNING',
+      ].join(' '));
+      for (const l of shown) {
+        console.log([
+          ...(mixed ? [String(l.status || '-').padEnd(10)] : []),
+          day(l.promotedAt).padEnd(11),
+          clip(String(l.targetSkill || '-'), 23).padEnd(24),
+          String(l.targetKind || 'unrouted').padEnd(9),
+          String(l.id || '-'),
+        ].join(' '));
+        const summary = String(l.enterpriseSummary || '').trim();
+        console.log(`    ${summary ? clip(summary.replace(/\s+/g, ' '), 100) : '(no enterprise summary — this row carries no lesson)'}`);
+        // The destination is the whole reason `absorbed` is worth reading back: it names where
+        // the lesson now lives, which is what makes the claim checkable rather than asserted.
+        if (l.absorbedIn) console.log(`    absorbed into: ${l.absorbedIn}${l.absorbedAt ? ` (${day(l.absorbedAt)})` : ''}`);
+      }
+      if (shown.length !== all.length) console.log(`\nShowing ${shown.length} of ${all.length}.`);
+      console.log(`\n${all.length} promoted · ${empties.length} with no summary · ${unrouted.length} unrouted`);
+      if (empties.length || unrouted.length) {
+        console.log('A row with no summary, or none a run can reach, was promoted into nothing.');
+        console.log('Inspect: hone promoted --empty · hone promoted --unrouted · Retract: hone retract <id> --reason "..."');
+      }
+    } catch (e) {
+      // HC-GF-207, same class: a read that never happened is not an empty queue. Exit non-zero
+      // so a caller cannot mistake a dead endpoint for "this org has promoted nothing".
+      console.error(`Failed to read promoted learnings: ${e.response?.data?.error || e.message}`);
+      process.exit(1);
+    }
+  });
+
+// ── ABSORB command (HC-GF-239) ───────────────────────────────────────────────
+// The Hone-team half of the flywheel's outbox. `hone promote`, `hone retract` and `hone promoted`
+// are commands; absorbing — the act that ENDS a learning's life — was a hand-built curl with
+// ADMIN_KEY pasted on the command line, which is how a production key reaches shell history. It
+// is also the step most likely to be skipped, because it is the one with no affordance.
+//
+// The key is read from the environment or ~/.honerc, never from an argument (the `admin-usage`
+// precedent). `--in` is required by commander AND re-checked here, so a missing or blank
+// destination is refused BEFORE a request is built — an absorption with no destination is the
+// unverifiable claim this queue already holds hundreds of.
+program
+  .command('absorb <ids...>')
+  .description('Admin: mark promoted learnings absorbed, naming where the lesson now lives (HC-GF-239)')
+  .requiredOption('--in <destination>', 'Where the lesson now lives: a skill section, prompt, gate script or PR')
+  .option('--org <uuid>', "Org whose learnings to absorb (default: this CLI token's own org)")
+  .option('--repo <name>', 'Restrict to one repository')
+  .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
+  .action(async (ids, opts) => {
+    const destination = String(opts.in || '').trim();
+    if (!destination) {
+      console.error('Error: --in must name where the lesson now lives (a skill section, prompt, gate script or PR).');
+      console.error('An absorption with no destination cannot be checked by anyone later.');
+      process.exit(1);
+    }
+    const wanted = [...new Set(ids.map((x) => String(x || '').trim()).filter(Boolean))];
+    if (!wanted.length) {
+      console.error('Error: name at least one learning id to absorb.');
+      process.exit(1);
+    }
+
+    const adminKey = requireAdminKey();
+    // `getConfig()` already resolves the base (HONE_API -> ~/.honerc -> default) and exits with a
+    // usable message when no token is configured. Re-deriving it here would have added a TENTH
+    // copy of the `api.hone.ai` literal that [[HC-GF-236]] is trying to reduce to one.
+    const config = getConfig();
+    const apiUrl = config.apiUrl;
+
+    try {
+      // The org defaults to the one this CLI token already authenticates as, so the common case
+      // (a Hone operator absorbing their own repo's learnings) needs no uuid on the command line.
+      let orgId = opts.org;
+      if (!orgId) {
+        const { data } = await api(config).get('/learnings/promoted');
+        orgId = data.orgId;
+      }
+
+      const { data } = await axios.post(`${apiUrl}/admin/learnings/absorb`, {
+        orgId, ids: wanted, repo: opts.repo, absorbedIn: destination,
+      }, {
+        headers: { 'x-admin-key': adminKey, 'User-Agent': `@hone-ai/cli/${pkg.version}` },
+        timeout: 15000,
+      });
+
+      if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+
+      console.log('');
+      console.log('Hone AI — Absorb Learnings');
+      console.log('================================');
+      console.log(`Destination: ${data.absorbedIn}`);
+      console.log('');
+      for (const a of data.absorbed) console.log(`  absorbed  ${a.id}${a.repoName ? `  (${a.repoName})` : ''}`);
+      // Skipped rows are printed, never summarised away: "3 of 5 absorbed" without the other two
+      // is the shape of report this whole capability exists to stop producing.
+      for (const sk of data.skipped) console.log(`  skipped   ${sk.id}  — ${sk.reason}`);
+      console.log('');
+      console.log(`${data.count} absorbed · ${data.skipped.length} skipped`);
+      if (data.count) console.log('Read them back with: hone promoted --status absorbed');
+      if (data.skipped.length) process.exitCode = 1;
+    } catch (e) {
+      const status = e.response?.status;
+      if (status === 401)      console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
+      else if (status === 429) console.error('Too many failed admin-auth attempts from this address. Wait for the window to pass.');
+      else if (status === 503) console.error(`Server cannot absorb right now: ${e.response?.data?.error || 'unavailable'}`);
+      else                     console.error(`Absorb failed: ${e.response?.data?.error || e.message}`);
+      process.exit(1);
+    }
+  });
+
 // ── RETRACT command (H-023) ──────────────────────────────────────────────────
 // Two modes:
 //   1. Single retract: `hone retract <LEARNING-ID> --reason "..."`
@@ -4950,12 +5292,19 @@ program
 
 // audit runner. Shells out to `git diff origin/<base>...HEAD`, walks
 // `.github/skills/`, calls SA-001's `runAssertions()`, writes
-// `.github/pipeline/<STORY-ID>/step-5b-skill-audit.md`. Always exits 0;
-// gating deferred to OptionsFlow E29-G.
+// `.github/pipeline/<STORY-ID>/step-5b-skill-audit.md`. HC-GF-227: a BLOCKER
+// finding fails the command (exit 2, after the artifact is written); WARN and
+// INFO stay informational. The deferral this replaced named OptionsFlow's E29-G,
+// which no row in this roadmap owned.
+/** `hone step-5b`'s exit code when a BLOCKER assertion fired (HC-GF-227). Not 1: that is a crash. */
+const STEP_5B_BLOCKED = 2;
 program
   .command('step-5b')
-  .description('Step 5b: runtime skill-application audit. Reads the story\'s referenced_skill cross-refs (LC-001), runs SA-001 assertion engine against PR diff, writes step-5b-skill-audit.md. Always exits 0 (informational; gating deferred to E29-G).')
+  .description('Step 5b: runtime skill-application audit. Reads the story\'s referenced_skill cross-refs (LC-001), runs SA-001 assertion engine against PR diff, writes step-5b-skill-audit.md. Exits 2 when a BLOCKER assertion fires (HC-GF-227); WARN and INFO findings are informational.')
   .option('--base <branch>', 'base branch to diff against', 'develop')
+  .option('--advisory', 'report BLOCKER findings without failing (exit 0), for a caller that wants only the artifact')
+  .option('--all-skills', 'evaluate every skill, not only those the story\'s learnings reference (a repository-wide gate)')
+  .option('--artifact-dir <dir>', 'write the artifact here instead of .github/pipeline/<STORY-ID>/ (a CI gate must not leave files in the checkout)')
   .option('--story-id <id>', 'override story id (defaults to extraction from current branch name)')
   .action(async (cmdOpts) => {
     const { runAssertions } = require('./lib/skill-assertions');
@@ -4991,6 +5340,17 @@ program
       } catch { /* leave empty */ }
     }
 
+    // 2b. HC-GF-310: the branch's commit messages, for `require_commit_line` assertions. A failed read
+    //     leaves them undefined, and the engine then warns instead of judging — never a silent pass.
+    let commitMessages;
+    for (const range of [`origin/${baseBranch}..HEAD`, `${baseBranch}..HEAD`]) {
+      try {
+        commitMessages = execSync(`git log --format=%B ${range}`,
+          { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+        break;
+      } catch { /* try the next range */ }
+    }
+
     // 3. Walk skills. Adopters live at .github/skills/; the hone-server
     //    framework dogfoods against server/seeds/skills/ (same fallback as
     //    `hone audit-skills`).
@@ -5028,7 +5388,8 @@ program
     const result = runAssertions({
       diff,
       skills,
-      referencedSkills: referencedSkills.length > 0 ? referencedSkills : undefined,
+      referencedSkills: referencedSkills.length > 0 && !cmdOpts.allSkills ? referencedSkills : undefined,
+      commitMessages,
     });
 
     // 6. Render + write artifact
@@ -5039,7 +5400,7 @@ program
       baseBranch,
       referencedSkills,
     });
-    const outDir = path.join(repoRoot, '.github/pipeline', storyId);
+    const outDir = cmdOpts.artifactDir ? path.resolve(repoRoot, cmdOpts.artifactDir) : path.join(repoRoot, '.github/pipeline', storyId);
     fs.mkdirSync(outDir, { recursive: true });
     const outPath = path.join(outDir, 'step-5b-skill-audit.md');
     fs.writeFileSync(outPath, artifact);
@@ -5063,7 +5424,16 @@ program
       }, { BLOCKER: 0, WARN: 0, INFO: 0 }),
     }, null, 2));
 
-    // Always exit 0 — Step 5b is informational. E29-G owns severity-to-gate mapping.
+    // HC-GF-227: a BLOCKER finding fails the audit. The skill's author chose the severity, so the
+    // gate is theirs; WARN and INFO stay informational. Exit 2, not 1: node exits 1 when it crashes,
+    // and a caller (verify-pr) must be able to tell a verdict from a failure to produce one.
+    const blockers = result.findings.filter((f) => f.severity === 'BLOCKER');
+    if (blockers.length && !cmdOpts.advisory) {
+      console.error(`step-5b: ${blockers.length} BLOCKER finding(s): ` +
+        blockers.map((f) => `${f.skillId}/${f.assertionId} at ${f.matchedFile}${f.matchedLine != null ? `:${f.matchedLine}` : ''}`).join('; ') +
+        ` — see ${outPath.startsWith(repoRoot + path.sep) ? path.relative(repoRoot, outPath) : outPath}`);
+      process.exit(STEP_5B_BLOCKED);
+    }
     process.exit(0);
   });
 
@@ -5552,7 +5922,9 @@ program
     const config = getConfig();
     const client = api(config);
     try {
-      const { data } = await client.get(`/orchestrate/${encodeURIComponent(runId)}/step-instruction`);
+      // HC-GF-092: advertise what this CLI can honour. The server serves the highest it also
+      // knows, so an older CLI — which sends nothing — keeps being served contract 1.
+      const { data } = await client.get(`/orchestrate/${encodeURIComponent(runId)}/step-instruction?contracts=1,2`);
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step:      ${data.stepKey} (${data.agent})`);
       console.log(`Contract:  ${data.contractVersion}`);
@@ -5573,15 +5945,36 @@ program
   .command('submit-step <runId> <stepKey>')
   .description('Submit editor-executed output for an awaiting_editor step (HC-COMM-010 B3)')
   .option('--file <path>', 'Read the step output from this file')
+  .option('--from-tree', 'HC-GF-091: render the artifact from the working tree against HEAD instead of reading one file — the agent writes files with its own tools, so no single model response has to hold the whole build')
+  .option('--test-report <text>', 'With --from-tree: the test-run report to carry verbatim. Never invented when absent.')
   .option('--contract <version>', 'Instruction contract version (from step-instruction)', '1')
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (runId, stepKey, opts) => {
     const config = getConfig();
     const client = api(config);
     try {
-      if (!opts.file) { console.error('Provide the output via --file <path> (the text your editor produced).'); process.exit(1); }
+      if (opts.file && opts.fromTree) { console.error('Use --file OR --from-tree, not both: they are two different claims about where the build is.'); process.exit(1); }
+      // HC-GF-092: under contract 2 the instruction told the agent to WRITE the files with its own
+      // tools. A hand-assembled --file artifact means the instruction and the submission disagree
+      // about where the build is, and the server cannot see that — only this side can.
+      if (String(opts.contract) === '2' && !opts.fromTree) {
+        console.error('Contract 2 is the from-tree contract: the instruction told the agent to write the files with its own tools. Re-run with --from-tree, or fetch a contract 1 instruction if you really did assemble the output by hand.');
+        process.exit(1);
+      }
+      if (!opts.file && !opts.fromTree) { console.error('Provide the output via --file <path> (the text your editor produced), or --from-tree to render it from the working tree.'); process.exit(1); }
       const fs = require('fs');
-      const output = fs.readFileSync(opts.file, 'utf8');
+      let output;
+      if (opts.fromTree) {
+        const { renderFromTree } = require('./lib/tree-artifact');
+        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport });
+        output = rendered.text;
+        // Say what was left out BEFORE the submission, not after: a file the tree has and the
+        // artifact does not is a decision the operator has to be able to see.
+        for (const s2 of rendered.skipped) console.error(`not included: ${s2.path} — ${s2.reason}`);
+        console.error(`from-tree: ${rendered.files.length} file(s), ${rendered.deletes.length} deletion(s), ${rendered.skipped.length} skipped`);
+      } else {
+        output = fs.readFileSync(opts.file, 'utf8');
+      }
       const { data } = await client.post(
         `/orchestrate/${encodeURIComponent(runId)}/step/${encodeURIComponent(stepKey)}/editor-output`,
         { contractVersion: opts.contract, output }
@@ -5599,6 +5992,100 @@ program
     }
   });
 
+// HC-GF-097: the I/O cli/lib/run-context.js is handed — every disk, git, GitHub and Hone read a
+// run's config needs, bound to this checkout. run-story and queue-stories build from the same one.
+function runContextIo(apiConfig) {
+  const { gitEnv } = require('./lib/git-env');
+  const pc = require('./lib/pipeline-config');
+  const cwd = process.cwd();
+  // Repository-scoped: a path that leaves the checkout neither exists nor reads.
+  const inRepo = (rel) => {
+    if (typeof rel !== 'string' || rel.startsWith('/') || rel.startsWith('~') || rel.includes('..')) return null;
+    const abs = path.resolve(cwd, rel);
+    return abs.startsWith(cwd + path.sep) ? abs : null;
+  };
+  return {
+    // Every subprocess this adapter starts carries a timeout: a hung git or gh must fail open with a
+    // message, not stall the command (node-developer hard rule 5). The module turns each failure into
+    // a note. (recentlyModifiedOverlap's `git log` lives in story-classifier-extract.js, unchanged.)
+    listFiles: () => execSync('git ls-files', {
+      cwd, env: gitEnv(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'], timeout: 60_000,
+    }).split('\n').filter(Boolean),
+    sourceDirs: (trackedPaths) => pc.readSourceDirs(cwd, { trackedPaths }),
+    codebaseDefaults: () => pc.readCodebaseDefaults(cwd),
+    ciGate: () => pc.readCIGateConfig(cwd),
+    executionMode: () => pc.readExecutionModeRaw(cwd),
+    consentNote: pc.EDITOR_MODE_CONSENT_NOTE,
+    ruleOverlays: () => require('./lib/overlay-transport').readRuleOverlays(cwd),
+    e2eSpecMode: () => pc.readE2eSpecMode(cwd),
+    verificationGate: () => pc.readVerificationGateConfig(cwd),
+    verificationGateSources: () => pc.readVerificationGateSources(cwd),
+    readPlanText: () => {
+      const planPath = path.join(cwd, '.github', 'EXECUTION_PLAN.yml');
+      return fs.existsSync(planPath) ? fs.readFileSync(planPath, 'utf8') : '';
+    },
+    exists: (rel) => { const abs = inRepo(rel); return !!abs && fs.existsSync(abs); },
+    isDirectory: (rel) => { const abs = inRepo(rel); try { return !!abs && fs.statSync(abs).isDirectory(); } catch { return false; } },
+    readFile: (rel) => {
+      const abs = inRepo(rel);
+      if (!abs) throw new Error(`${rel} is outside the repository`);
+      return fs.readFileSync(abs, 'utf8');
+    },
+    // Async (execFile, no shell) so queue-stories can resolve several issues at once.
+    fetchIssue: async (issueNumber) => {
+      const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8', timeout: 10_000 }).trim();
+      const m = remoteUrl.match(/[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+      if (!m) throw new Error(`could not parse owner/repo from remote: ${remoteUrl}`);
+      const { execFile } = require('child_process');
+      let stdout;
+      try {
+        ({ stdout } = await require('util').promisify(execFile)('gh',
+          ['issue', 'view', String(issueNumber), '--repo', `${m[1]}/${m[2]}`, '--json', 'title,body,url'],
+          { encoding: 'utf8', timeout: 30_000 }));
+      } catch (e) {
+        // execFile keeps gh's stderr on the error — its first line is the actionable part ("gh auth
+        // login", "Could not resolve to an Issue"), and a timeout must not read like any failure.
+        if (e && e.killed) throw new Error(`gh issue view timed out after 30s`);
+        const why = String((e && e.stderr) || '').trim().split('\n')[0];
+        throw new Error(why || (e && e.message) || String(e));
+      }
+      return JSON.parse(stdout);
+    },
+    // HC-GF-270: who wrote the issue. run-context.js classifies a failure and story-provenance.js
+    // decides trust; this only fetches. execFile, not a shell string: owner/repo come from the remote.
+    fetchIssueProvenance: async (issueNumber) => {
+      const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8', timeout: 10_000 }).trim();
+      const m = remoteUrl.match(/[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+      if (!m) throw new Error(`could not parse owner/repo from remote: ${remoteUrl}`);
+      const where = { owner: m[1], repo: m[2], remoteUrl };
+      try {
+        const { execFile } = require('child_process');
+        const { stdout } = await require('util').promisify(execFile)('gh',
+          ['api', `repos/${m[1]}/${m[2]}/issues/${issueNumber}`],
+          { encoding: 'utf8', timeout: 20_000 });
+        return { ...where, issue: JSON.parse(stdout) };
+      } catch (e) {
+        throw Object.assign(e, { where });   // `where` lets the failure keep its issue reference
+      }
+    },
+    fetchStoryContext: async (storyId) => {
+      const { data } = await api(apiConfig).get(`/stories/${encodeURIComponent(storyId)}/context`);
+      return data;
+    },
+    recentlyModifiedOverlap: (touched) =>
+      require('./lib/story-classifier-extract').extractRecentlyModifiedOverlap(cwd, touched, 14),
+  };
+}
+
+// Prints run-context notes at their level. `prefix` labels a note with its story in a batch.
+function printRunContextNotes(notes, { prefix = '', only } = {}) {
+  for (const n of notes || []) {
+    if (only && n.level !== only) continue;
+    const text = prefix ? n.text.replace(/^(\s*)/, `$1${prefix} `) : n.text;
+    if (n.level === 'warn') console.warn(text); else console.log(text);
+  }
+}
+
 program
   .command('run-story <storyId>')
   .description('Run the SDLC pipeline for a story via the orchestrator')
@@ -5617,7 +6104,11 @@ program
   .option('--acknowledge-failed-verdict', 'Approve a step whose verification did NOT pass under verification.gate: enforce (HC-GF-074). The server refuses that approval by default and names the failing gates; this is for a human who has read them and still wants to proceed.')
   .option('--acknowledge-abort', 'Approve a step the agent ABORTED (HC-GF-069). An abort means the agent found nothing it could review or build, so approving advances past a step that produced no usable result — read the reason first. Exists so a human can override, which is why the refusal is not simply a hard block.')
   .option('--no-follow', 'With --approve: post the approval and exit immediately instead of following the run to its next decision point (HC-GF-070). The default FOLLOWS, because a caller told to poll does not — which is why HC-GF-064 auto-verify never fired outside a TTY.')
-  .option('--include-paths <paths>', 'Comma-separated list of source file paths to bundle into the codebase context (HC-019n-followup-12). Augments auto-detected paths from the issue body.')
+  // HC-GF-202: `collectIncludePaths` accumulates every occurrence. Without it the
+  // option is single-valued and commander keeps the LAST, so the remedy the planner
+  // itself prints — `--include-paths Makefile --include-paths scripts/` — silently
+  // discarded `Makefile` and produced a bundle identical to passing nothing.
+  .option('--include-paths <paths>', 'Source file paths to bundle into the codebase context (HC-019n-followup-12). Comma-separated, and the flag may be repeated; both forms accumulate. Augments auto-detected paths from the issue body.', collectIncludePaths, [])
   .option('--e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) ON for this run (overrides e2e.spec_generation config)')
   .option('--skip-e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) OFF for this run (overrides e2e.spec_generation config)')
   .action(async (storyIdOrRunId, opts) => {
@@ -5680,6 +6171,11 @@ program
       // advisory path re-verifies on every poll tick, because advisory never advances
       // the run and the pause it re-observes is the same pause.
       const _verifiedAttempts = new Set();
+      // HC-GF-189: one-shot, and the "once" lives in the reporter so it can be DRIVEN by a test
+      // rather than grepped for — mutation walked through the inline version twice.
+      const { makeReadinessReporter } = require('./lib/story-classifier');
+      const { readSandboxConfig } = require('./lib/pipeline-config');
+      const _reportReadiness = makeReadinessReporter({ readSandbox: () => readSandboxConfig(process.cwd()) });
 
       for (;;) {
         await new Promise(r => setTimeout(r, interval));
@@ -5693,6 +6189,19 @@ program
           continue;
         }
 
+        // HC-GF-189: the first tick at which the axis EXISTS. step_0's groomer answers
+        // `requires_stored_state`, the server harvests it into `config.classifier_axes`, and only
+        // the CLI can pair that with "no `sandbox:` block is declared in this repo" — the server
+        // has never seen one (HC-GF-169). Emitted here rather than at verify-patch, where
+        // `planSandboxRun`'s stand-down says the same thing but only after step_2 has already
+        // written its tests against whatever the machine happened to hold.
+        //
+        // Once. The loop re-observes the same state every few seconds, and a warning that repeats
+        // until the run ends teaches the reader to skip it — the reason HC-GF-064 guards
+        // auto-verify with a Set.
+        const _readinessNote = _reportReadiness(status?.config);
+        if (_readinessNote) console.warn(`  ⚠ ${_readinessNote}`);
+
         const d = classifyPollState(status);
 
         if (d.outcome === POLL_OUTCOMES.COMPLETED) {
@@ -5723,6 +6232,35 @@ program
             console.log(`⏳ Step ${d.stepKey} (${d.agent || 'unknown'}) — awaiting approval`);
           }
 
+          // HC-GF-263: the step named the files it needs, in a fenced `hone run-story` command,
+          // and until now nobody read it — the server kept 200 chars of the first line and this
+          // loop printed 240 of those on the EXHAUSTED branch and nothing at all on a human
+          // gate. Printed in BOTH branches, and ADDITIVE to the errorMessage above: that line
+          // is the only surviving statement of why the step stopped.
+          //
+          // Never throws: a print must not end a poll loop.
+          try {
+            const { remedyFor, renderIncludePathsCommand, partitionSafePaths } = require('./lib/hard-pause-remedy');
+            const remedy = remedyFor(status);
+            if (remedy) {
+              const cmd = renderIncludePathsCommand(status && status.storyId, remedy.paths);
+              if (cmd) {
+                // Name the step: the request belongs to ONE step, and an unattributed command
+                // reads as advice about the run rather than about this pause (H1).
+                console.log(`  ${remedy.stepKey} named the files it needs. Re-queue with:`);
+                console.log(`    ${cmd}`);
+                if (remedy.truncated) {
+                  console.log(`    ⚠ it asked for more than ${remedy.paths.length} files; the rest were dropped.`);
+                }
+              }
+              // H5: say how many requested paths were withheld from the command, never what they were.
+              const { dropped } = partitionSafePaths(remedy.paths);
+              if (dropped.length) {
+                console.log(`  ${remedy.stepKey}: ${dropped.length} requested path(s) not shown — characters a shell could misread; see \`hone show step\`.`);
+              }
+            }
+          } catch { /* a print must never end a poll loop */ }
+
           // HC-GF-064: verify BEFORE asking anyone to approve. The gate this feeds had
           // existed since HC-019n-followup-34/35 and never fired, because nothing ever
           // ran the executing step. Consent is DERIVED: `ci.local_command` being
@@ -5730,13 +6268,59 @@ program
           // cli/lib/auto-verify.js and docs/architecture/adr-verification-invocation.md).
           // Never throws — a failure here must leave the operator exactly where they
           // were, which is being asked to approve.
+          // HC-GF-270: computed OUTSIDE the try below, on purpose. That catch turns a throw
+          // into `(auto-verify skipped: ...)` and CONTINUES — harmless for a decision about
+          // whether to run tests, a fail-OPEN for a decision about whether this patch may
+          // execute at all. So the one call that answers "may we run it" cannot be inside it,
+          // and its own failure is untrusted rather than absent.
+          let _provenance;
+          // HC-GF-270: attempts whose NEEDS YOU block has already been printed this process.
+          // Declared lazily on the enclosing scope so the Set survives across poll ticks —
+          // a per-tick Set would suppress nothing.
+          if (!globalThis.__honeProvenanceNoticed) globalThis.__honeProvenanceNoticed = new Set();
+          const _provenanceNoticed = globalThis.__honeProvenanceNoticed;
+          if (!exhausted) {
+            try {
+              const { assessStorySource } = require('./lib/story-provenance');
+              _provenance = assessStorySource(
+                status?.config?.story_source,
+                status?.storyId || status?.story_id);
+            } catch (e) {
+              _provenance = {
+                trusted: false,
+                label: 'assessment-failed',
+                reason: `story provenance could not be assessed: ${e.message}`,
+              };
+            }
+          }
           if (!exhausted) try {
-            const { decideAutoVerify, announce, shouldRepoll, alreadyVerified, verifyOutcomeLine } = require('./lib/auto-verify');
+            const { decideAutoVerify, announce, shouldRepoll, alreadyVerified, verifyOutcomeLine, provenanceNotice } = require('./lib/auto-verify');
             const decision = decideAutoVerify({
               stepKey: d.stepKey,
               repoRoot: process.cwd(),
               noVerifyFlag: opts.verify === false,
+              assessment: _provenance,
             });
+            // HC-GF-270: only when the step_4 gate is the one paused — an untrusted run is
+            // untrusted at every gate, and repeating this at each of them would teach the
+            // operator to skip it (the HC-GF-189 lesson about a warning that never stops).
+            // HC-GF-270 code review (MEDIUM-5): ONCE per attempt, the same discipline
+            // `alreadyVerified` applies to `announce`. The loop re-observes the same pause every
+            // few seconds; a NEEDS YOU block that reprints on every tick teaches the operator to
+            // scroll past it, which is the HC-GF-189 lesson this comment used to only half-apply
+            // (it suppressed the notice at OTHER gates, not on re-polls of this one).
+            //
+            // Its own Set, not `_verifiedAttempts`: that one means "this attempt was verified",
+            // and an untrusted attempt is precisely one that was NOT. Sharing it would make
+            // `alreadyVerified` lie about what happened.
+            if (decision.untrusted && d.stepKey === 'step_4' && !_provenanceNoticed.has(d.attemptKey)) {
+              _provenanceNoticed.add(d.attemptKey);
+              console.log(provenanceNotice(_provenance, {
+                runId: pollRunId,
+                source: status?.config?.story_source || {},
+                stepKey: d.stepKey,
+              }));
+            }
             if (decision.run && !alreadyVerified(d.attemptKey, _verifiedAttempts)) {
               _verifiedAttempts.add(d.attemptKey);
               console.log(announce(decision, pollRunId));
@@ -5911,27 +6495,6 @@ program
       try { branch = execSync('git symbolic-ref --short HEAD', { encoding: 'utf8' }).trim(); } catch { branch = null; }
     }
 
-    // HC-019n-followup-11: when storyId is a bare integer, treat it as a
-    // GitHub issue number and fetch the issue's title + body via the local
-    // `gh` CLI. Inject into config.story_description so the orchestrator's
-    // buildStepContext (HC-019n root-cause fix B) hands the real story
-    // text to step_0 instead of letting the LLM produce placeholder
-    // [ASSUMPTION] grooming. Hook reused — no server change required.
-    //
-    // Gracefully degrade on any error (gh missing, no remote, network
-    // fail, private repo without auth): warn and proceed without context.
-    // The existing HC-019n-followup-7 hard_pause safety net catches the
-    // resulting placeholder cascade at step_1.
-    //
-    // HC-019b-followup-1 F1: when invoked with an issue number, also try
-    // to extract a canonical story-id (e.g. HC-019b) from the issue title.
-    // Used by the architect-config read below — without this, the lookup
-    // keys on '104' instead of 'HC-019b' and silently bypasses every
-    // architect-engaged story whose EXECUTION_PLAN.yml entry uses the
-    // canonical id (which is the common adopter case).
-    const orchestrateConfig = {};
-    let issueBodyForFiles = null;
-    let resolvedStoryId = storyIdOrRunId; // canonical id for architect-config lookup
     // HC-GF-010: an EXPLICIT story source, and the only one that works on a repository
     // that is neither a GitHub issue tracker nor listed on Hone's own roadmap.
     //
@@ -5966,473 +6529,25 @@ program
       }
     }
 
-    if (explicitStory) {
-      orchestrateConfig.story_description = explicitStory;
-      issueBodyForFiles = explicitStory;
-      console.log(
-        `  → story text from ${opts.storyFile ? path.relative(process.cwd(), path.resolve(opts.storyFile)) : '--description'} ` +
-        `(${explicitStory.length} chars) — roadmap and issue lookups skipped`);
-    } else if (/^\d+$/.test(storyIdOrRunId)) {
-      try {
-        const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8' }).trim();
-        const m = remoteUrl.match(/[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
-        if (!m) throw new Error(`could not parse owner/repo from remote: ${remoteUrl}`);
-        const ownerRepo = `${m[1]}/${m[2]}`;
-        const issueJson = execSync(
-          `gh issue view ${storyIdOrRunId} --repo ${ownerRepo} --json title,body,url`,
-          { encoding: 'utf8' }
-        );
-        const issue = JSON.parse(issueJson);
-        const desc = `# ${issue.title}\n\n${issue.body || '_(issue body is empty)_'}\n\n_Source: ${issue.url}_`;
-        orchestrateConfig.story_description = desc;
-        issueBodyForFiles = `${issue.title}\n${issue.body || ''}`;
-        console.log(`  → fetched GitHub issue #${storyIdOrRunId} for story context (${desc.length} chars)`);
-        // HC-019b-followup-1 F1: extract the canonical story-id from the
-        // issue title. extractStoryIdFromBranch's regex (STORY_ID_PATTERN
-        // in pipeline-status.js) handles HC-NNN, HC-NNN-A, H-NNNb, E22-D,
-        // and HC-NNN-followup-N shapes after H-029-followup-2.
-        try {
-          const { extractStoryIdFromBranch } = require('./lib/pipeline-status');
-          const titleId = extractStoryIdFromBranch(issue.title);
-          if (titleId) {
-            resolvedStoryId = titleId;
-            console.log(`  → resolved issue #${storyIdOrRunId} → canonical story id '${titleId}' for architect-config lookup`);
-          } else {
-            console.warn(`  ⚠ could not extract canonical story id from issue title '${issue.title}' — architect-config lookup will use '${storyIdOrRunId}' (likely silent miss)`);
-          }
-        } catch { /* extractor missing/throws → fall back to numeric id */ }
-      } catch (e) {
-        const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-        console.warn(`  ⚠ could not fetch GitHub issue context: ${msg}`);
-        console.warn('  → proceeding without story_description; step_0 may produce placeholder output');
-        console.warn(`  ⚠ architect-config lookup will use '${storyIdOrRunId}' (likely silent miss)`);
-      }
-    } else {
-      // HC-019n-followup-18: roadmap-sourced story. Only the SERVER knows what
-      // the story says (server/seeds/master-roadmap.md is a Hone asset, absent
-      // from adopter repos) and only the CLI can read the adopter's disk — so
-      // ask the server what the description references, then read those files
-      // here. See .github/pipeline/HC-019n-followup-18/architect.md §1 for why
-      // this beats the CLI reading a local roadmap (hardcodes a Hone-internal
-      // path into the adopter CLI, and fails silently anywhere else).
-      //
-      // Advisory, never fatal: a story with no resolvable context still runs,
-      // it just runs blind — and loudly, via the followup-17 warning below.
-      try {
-        const ctxClient = api(config);
-        const { data } = await ctxClient.get(
-          `/stories/${encodeURIComponent(storyIdOrRunId)}/context`
-        );
-        if (data && data.description) {
-          orchestrateConfig.story_description = data.description;
-          issueBodyForFiles = data.description;
-          const n = Array.isArray(data.referencedPaths) ? data.referencedPaths.length : 0;
-          console.log(
-            `  → resolved story context from roadmap (${data.description.length} chars, ` +
-            `${n} referenced path${n === 1 ? '' : 's'})`
-          );
-        }
-      } catch (e) {
-        const status = e && e.response && e.response.status;
-        if (status === 404) {
-          console.warn(`  ⚠ no roadmap row found for '${storyIdOrRunId}'`);
-        } else {
-          const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-          console.warn(`  ⚠ could not fetch story context: ${msg}`);
-        }
-        console.warn('  → proceeding without story context; the warning below applies');
-      }
-    }
-
-    // HC-019n-followup-12: auto-bundle codebase files referenced in the
-    // issue body (or by the operator via --include-paths). Without this,
-    // step_1/step_4 have only training-data priors and produce code that
-    // matches the SHAPE of the adopter's stack but not its actual
-    // architecture (cf. OptionsFlow #104 step_4 hallucinating SQLAlchemy
-    // for a JSON-lines repo). The bundle is capped at 10 files / 50K
-    // chars total to stay well inside the LLM context window.
-    //
-    // Detection scans the issue body for code-file-like paths:
-    //   - foo/bar/baz.py             (relative paths with extensions)
-    //   - tests/unit/test_foo.py     (typical pytest structure)
-    //   - src/web/routes.py          (src trees)
-    // Excludes:
-    //   - https:// or http:// URLs (those aren't local files)
-    //   - paths starting with / or ~ (absolute / home — bundle would
-    //     escape the repo)
-    //   - .md / .txt / .yml docs (rarely needed for code-builder; would
-    //     blow context with prose)
-    // HC-DF-001: config-level default include paths (codebase.default_include_paths)
-    // are merged with story-text auto-detection and --include-paths.
-    const { readCodebaseDefaults } = require('./lib/pipeline-config');
-    const defaultIncludePaths = readCodebaseDefaults(process.cwd()).include_paths;
-    if (issueBodyForFiles || opts.includePaths || defaultIncludePaths.length > 0) {
-      try {
-        // HC-019n-followup-13c: word-boundary `\b` at end of extension
-        // group so `.jsonl` doesn't match as `.js` and `.tsx` doesn't
-        // match as `.ts`. Pre-fix, both `logs/calibration_runs.jsonl`
-        // and `src/web/app.tsx` got truncated. The truncated paths
-        // failed the downstream `fs.existsSync` check so they didn't
-        // crash the bundling, but they polluted the regex output set
-        // and would have produced confusing "file not found" warnings
-        // if we ever tightened the diagnostic logging.
-        const FILE_PATH_RE = /(?<![\w/])([a-zA-Z_][\w-]*\/(?:[\w.-]+\/)*[\w.-]+\.(?:py|js|ts|jsx|tsx|go|rs|java|rb|sh|sql))\b/g;
-        const candidates = new Set();
-        if (issueBodyForFiles) {
-          for (const m of issueBodyForFiles.matchAll(FILE_PATH_RE)) candidates.add(m[1]);
-        }
-        if (opts.includePaths) {
-          // --include-paths a/b.py,c/d.py
-          for (const p of String(opts.includePaths).split(',').map(s => s.trim()).filter(Boolean)) {
-            candidates.add(p);
-          }
-        }
-        for (const p of defaultIncludePaths) candidates.add(p); // HC-DF-001 config defaults
-        // HC-019n-followup-26: FILE_PATH_RE above requires a directory segment,
-        // so a story that names a file BARE (`derive-worker.js:787` in prose)
-        // extracts 0 paths and step_4 runs blind — and, blind, hallucinates a
-        // file at a non-existent path (2026-08-30 e2e demo). Catch bare refs too
-        // and resolve each against the repo's own file list: bundle ONLY on a
-        // unique basename match; never guess an ambiguous or absent one.
-        // HC-019n-followup-27: candidate path → referenced line number, so the
-        // bundler can WINDOW a too-big file around its edit site instead of
-        // head-truncating past it (the demo's line 787 sits at char 37K).
-        const candidateLines = new Map();
-        // HC-GF-073: hoisted out of the bare-ref branch below, because the sibling tier
-        // needs the same list on stories that contain no bare refs at all — which is most
-        // of them.
-        const { gitEnv } = require('./lib/git-env');
-        let repoFiles = null;
-        const listRepoFiles = () => {
-          if (repoFiles) return repoFiles;
-          try {
-            repoFiles = execSync('git ls-files', {
-              cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
-            }).split('\n').filter(Boolean);
-          } catch { repoFiles = []; }
-          return repoFiles;
-        };
-        if (issueBodyForFiles) {
-          const { extractBareRefs, resolveBareName, alreadyCovered } = require('./lib/bundle-paths');
-          const bareRefs = extractBareRefs(issueBodyForFiles);
-          if (bareRefs.length > 0) {
-            for (const { name, line } of bareRefs) {
-              if (alreadyCovered(name, candidates)) continue;
-              const r = resolveBareName(name, listRepoFiles());
-              if (r.status === 'unique') {
-                candidates.add(r.path);
-                if (line && !candidateLines.has(r.path)) candidateLines.set(r.path, line);
-                console.log(`  → resolved bare ref '${name}${line ? ':' + line : ''}' → ${r.path}`);
-              } else if (r.status === 'ambiguous') {
-                console.warn(`  ⚠ '${name}' is ambiguous (${r.matches.length} files) — not bundling; use --include-paths to disambiguate`);
-              }
-              // status === 'none' → not every filename in prose is a repo file; skip quietly
-            }
-          }
-        }
-        // HC-019n-followup-13d: bump caps. Pre-fix MAX_FILES=10 /
-        // MAX_TOTAL_CHARS=50_000 / MAX_PER_FILE_CHARS=10_000 was overly
-        // conservative — OptionsFlow #96 hit 49,783/50,000 with 6 files
-        // (217 chars to spare), meaning the next slightly-larger story
-        // silently dropped files. LLM context windows are 200K+; the
-        // bundle should be able to fill ~25% of that without surprise.
-        // New caps: 30 / 150_000 / 25_000.
-        const MAX_FILES = 30;
-        const MAX_TOTAL_CHARS = 150_000;
-        const MAX_PER_FILE_CHARS = 25_000;
-        // HC-GF-073: `candidates` is only what the STORY named, and a story names the
-        // files it will CREATE — so on a greenfield repo every one of them fails the
-        // existsSync below and the bundle is EMPTY. Measured across FlowForge's 33 real
-        // stories: 29 extracted zero existing files. The dogfood runs looked fine only
-        // because an operator had typed --include-paths once; 12 of 12 runs then bundled
-        // the same three files across five different stories.
-        //
-        // selectBundle() splits them into what exists, what is pending, and adds two
-        // tiers the story can never name: repo-level signal files (whose ABSENCE is what
-        // a security reviewer must be able to check — HC-GF-063) and existing neighbours
-        // of the pending paths (the conventions a new module has to match). Order is
-        // priority order, because the char cap below truncates from the end.
-        const { selectBundle, auditLines } = require('./lib/bundle-context');
-        const selection = selectBundle({
-          named: [...candidates],
-          repoFiles: listRepoFiles(),
-          exists: (rel) => {
-            if (rel.startsWith('/') || rel.startsWith('~') || rel.includes('..')) return false;
-            const abs = path.resolve(process.cwd(), rel);
-            return abs.startsWith(process.cwd() + path.sep) && fs.existsSync(abs);
-          },
-        });
-        const ordered = [...selection.present, ...selection.signal, ...selection.siblings];
-        const codebaseFiles = [];
-        let totalChars = 0;
-        for (const candidate of ordered) {
-          if (codebaseFiles.length >= MAX_FILES) break;
-          if (candidate.startsWith('/') || candidate.startsWith('~') || candidate.includes('..')) continue;
-          const abs = path.resolve(process.cwd(), candidate);
-          if (!abs.startsWith(process.cwd() + path.sep)) continue; // escape guard
-          if (!fs.existsSync(abs)) continue;
-          let content;
-          try {
-            content = fs.readFileSync(abs, 'utf8');
-          } catch { continue; }
-          if (content.length > MAX_PER_FILE_CHARS) {
-            const line = candidateLines.get(candidate);
-            if (line) {
-              // HC-019n-followup-27: window around the referenced line so step_4
-              // SEES the edit site (head-truncation would hide a site past the
-              // cut) and can write a region-edit anchor. The window marker tells
-              // step_4 to emit an `edit:` block, not a whole-file block.
-              const { windowAroundLine } = require('./lib/bundle-paths');
-              const w = windowAroundLine(content, line, Math.floor((MAX_PER_FILE_CHARS - 800) / 2));
-              content =
-                `# [HC-019n-followup-27: windowed excerpt, lines ${w.startLine}-${w.endLine} of ${w.totalLines} ` +
-                `(centered on referenced line ${line}); you were NOT shown the whole file — ` +
-                `emit an \`edit:\` block with a unique OLD anchor from this excerpt, NOT a whole-file \`file:\` block]\n` +
-                w.excerpt +
-                `\n# [end windowed excerpt of ${candidate}]`;
-            } else {
-              content = content.slice(0, MAX_PER_FILE_CHARS) + `\n\n# [HC-019n-followup-12: truncated at ${MAX_PER_FILE_CHARS} chars; full file is ${content.length} chars]`;
-            }
-          }
-          if (totalChars + content.length > MAX_TOTAL_CHARS) break;
-          totalChars += content.length;
-          codebaseFiles.push({ path: candidate, content });
-        }
-        // HC-GF-073: the old line printed a COUNT, and a count cannot distinguish three
-        // files the story named from three it did not. That is why 12 consecutive runs
-        // bundled an unrelated module and nothing said so — the "running blind" warning
-        // below fires on an EMPTY bundle, and these were not empty.
-        for (const line of auditLines(selection)) console.log(line);
-        if (codebaseFiles.length > 0) {
-          orchestrateConfig.codebaseFiles = codebaseFiles;
-          console.log(`  → bundled ${codebaseFiles.length} codebase file(s) for step_1/step_4 context (${totalChars} chars)`);
-        }
-      } catch (e) {
-        const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-        console.warn(`  ⚠ codebase bundling failed (non-fatal): ${msg}`);
-      }
-    }
-
-    // HC-019n-followup-17: warn when the code-aware steps will run BLIND.
-    //
-    // Auto-detection reads file paths out of `issueBodyForFiles`, which is only
-    // populated on the numeric-GitHub-issue branch above. A roadmap-sourced id
-    // (HC-CI-005, SC-002-followup-2, ...) never enters that branch, so
-    // `codebaseFiles` stays unset and step_1 / step_4 / step_5 / step_5d /
-    // step_5e all run with no source to read — the exact "confidently wrong"
-    // failure HC-019n-followup-12 was built to prevent, still open for roadmap
-    // ids. Observed 2026-08-29: run 61fddfb2 wrote 8,444 chars of code for
-    // HC-CI-005 having never seen the files that story names.
-    //
-    // A fix is structurally awkward: only the CLI can read adopter files, and
-    // only the SERVER knows the roadmap description (server/seeds/master-
-    // roadmap.md is a Hone asset, absent from adopter repos). Closing it needs
-    // the CLI to fetch the resolved description before queueing — a round trip
-    // that belongs in its own story. Until then the gap is at least LOUD
-    // instead of silent, which is the part that actually bit.
-    if (!orchestrateConfig.codebaseFiles) {
-      console.warn('  ⚠ no codebase files bundled — step_1 / step_4 / step_5 / step_5d / step_5e');
-      console.warn('    will run WITHOUT source context and may invent APIs that do not exist.');
-      if (!/^\d+$/.test(storyIdOrRunId)) {
-        console.warn(`    '${storyIdOrRunId}' is not a GitHub issue number, so file paths cannot be`);
-        console.warn('    auto-detected from an issue body.');
-      }
-      console.warn('    Fix: hone run-story <id> --include-paths path/one.js,path/two.js');
-    }
-
-    // HC-COMM-010 axes wiring (CLI half): when --axes wasn't given, derive
-    // the DETERMINISTIC axes from the extractors (SC-002) — security labels/
-    // text, cross-repo markers, recently-modified overlap vs the bundled
-    // paths. Judgment axes (shared-chokepoint etc.) come from the groomer at
-    // step_0 and are harvested server-side. Fail-open; explicit --axes wins.
-    if (!opts.axes) {
-      try {
-        const { classifyStory } = require('./lib/story-classifier');
-        const {
-          extractType, extractSecurityImplications, extractCrossRepoDependency, extractRecentlyModifiedOverlap,
-        } = require('./lib/story-classifier-extract');
-        const autoBody = issueBodyForFiles || '';
-        const autoLabels = [];
-        const touched = Array.isArray(orchestrateConfig.codebaseFiles)
-          ? orchestrateConfig.codebaseFiles.map(f => f.path).filter(Boolean)
-          : Object.keys(orchestrateConfig.codebaseFiles || {});
-        const auto = classifyStory({
-          type: extractType(autoLabels, autoBody, String(storyIdOrRunId)),
-          has_security_implications: extractSecurityImplications(autoLabels, autoBody),
-          cross_repo_dependency: extractCrossRepoDependency(autoBody),
-          recently_modified_overlap: extractRecentlyModifiedOverlap(process.cwd(), touched, 14),
-        });
-        if (auto.architect.engage && auto.architect.axes.length > 0) {
-          orchestrateConfig.classifier_axes = auto.architect.axes;
-          console.log(`  → auto-detected classifier axes: ${auto.architect.axes.join(', ')}`);
-        }
-      } catch (e) {
-        console.warn(`  ⚠ axes auto-detection failed (non-fatal): ${(e && e.message || String(e)).split('\n')[0]}`);
-      }
-    }
-
-    // HC-019n-followup-42: repository-structure grounding. Bundling FILES is not
-    // grounding — with no tree in the prompt the groomer invents a layout and the
-    // planner inherits it (dogfood run f276fe00). Stamp a compact, capped tree of
-    // tracked paths (scoped to source_dirs/test_dirs when configured) into the run
-    // config; the server renders it for the steps that name paths. Fail-open.
-    try {
-      const { execSync } = require('child_process');
-      const { buildRepoTree } = require('./lib/repo-tree');
-      const { readSourceDirs } = require('./lib/pipeline-config');
-      const tracked = execSync('git ls-files', { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).split('\n').filter(Boolean);
-      const dirs = readSourceDirs(process.cwd());
-      // HC-DF-002: readSourceDirs self-heals a stale config; say so, or the operator sees a
-      // confident success line built from directories that do not exist.
-      if (dirs.repaired) {
-        console.log(`  ⚠ source dirs in .pipeline-config.yml not found on disk: ${dirs.dropped.join(', ')}`);
-        console.log(`     using ${dirs.detected ? 'detected' : 'the surviving'} dirs instead: ${dirs.source_dirs.join(', ') || '(none)'}`);
-        console.log('     fix it permanently: hone detect-layout, then set codebase.source_dirs in .github/.pipeline-config.yml');
-      }
-      const tree = buildRepoTree(tracked, { sourceDirs: dirs.source_dirs, testDirs: dirs.test_dirs });
-      if (tree.selected_total > 0) {
-        orchestrateConfig.repo_tree = tree;
-        const scope = dirs.source_dirs.length ? dirs.source_dirs.join(', ') : 'all tracked';
-        console.log(`  → repository structure: ${tree.shown} of ${tree.selected_total} paths under ${scope} (${(Buffer.byteLength(tree.text, 'utf8') / 1024).toFixed(1)} KB) — the groomer/planner/builder are told to derive every path from it`);
-      }
-    } catch (e) {
-      console.warn(`  ⚠ repository structure not bundled (non-fatal): ${(e && e.message || String(e)).split('\n')[0]}`);
-    }
-
-    // HC-101-followup-2: pass the adopter's CI gate config to the
-    // orchestrator so step_5c can branch (github / local / both / none).
-    // Defaults to gate=github + local_command='make ci' when the config
-    // is missing — backward-compat for adopters whose .pipeline-config.yml
-    // predates this field.
-    try {
-      const { readCIGateConfig } = require('./lib/pipeline-config');
-      const ciGate = readCIGateConfig(process.cwd());
-      orchestrateConfig.ci_gate = ciGate.gate;
-      orchestrateConfig.ci_local_command = ciGate.local_command;
-      console.log(`  → CI gate mode: ${ciGate.gate}${ciGate.gate !== 'github' ? ` (local_command: ${ciGate.local_command})` : ''}`);
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`  ⚠ CI gate config read failed (non-fatal, defaulting to gate=github): ${msg}`);
-      orchestrateConfig.ci_gate = 'github';
-      orchestrateConfig.ci_local_command = 'make ci';
-    }
-
-    // HC-COMM-010 B0.5 (memo §12 A3): stamp execution.mode into the run config
-    // at CREATION — the server reads it from run.config, making the mode
-    // immutable per run (a mid-flight .pipeline-config.yml flip cannot change
-    // a running run). Absent/old CLIs → the server defaults to 'server'.
-    // Inert until B1: the server ignores the key today.
-    try {
-      const { readExecutionMode, EDITOR_MODE_CONSENT_NOTE } = require('./lib/pipeline-config');
-      const executionMode = readExecutionMode(process.cwd());
-      orchestrateConfig.execution_mode = executionMode;
-      if (executionMode === 'editor') {
-        // §2a: the consent note is shown at the moment editor mode is USED.
-        console.log(`  → execution mode: editor (opt-in)`);
-        console.log(`     ${EDITOR_MODE_CONSENT_NOTE}`);
-      }
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`  ⚠ execution mode read failed (non-fatal, defaulting to server): ${msg}`);
-      orchestrateConfig.execution_mode = 'server';
-    }
-
-    // HC-COMM-010 C0: composition transports — INERT until C1 reads them.
-    // Overlays: .hone-local/ is adopter disk the server can never read
-    // (the cross-validation finding), so raw texts travel in run config —
-    // the codebaseFiles pattern, size/count-capped, degrade-to-empty.
-    // Axes: explicit --axes flag for now; automated wiring from classify
-    // runs is future work (documented in the sprint plan).
-    try {
-      const { readRuleOverlays } = require('./lib/overlay-transport');
-      const ov = readRuleOverlays(process.cwd());
-      if (ov.overlays.length > 0) {
-        orchestrateConfig.rule_overlays = ov.overlays;
-        console.log(`  → bundled ${ov.overlays.length} rule overlay(s) for server-side composition`);
-      }
-      for (const skip of ov.skipped) console.warn(`  ⚠ overlay skipped: ${skip}`);
-    } catch (e) {
-      console.warn(`  ⚠ overlay read failed (non-fatal): ${(e && e.message || String(e)).split('\n')[0]}`);
-    }
-    if (opts.axes) {
-      const axes = String(opts.axes).split(',').map(a => a.trim().toLowerCase()).filter(Boolean);
-      if (axes.length > 0) orchestrateConfig.classifier_axes = axes;
-    }
-
-    // HC-019n-followup-28: resolve the E2E spec-generation mode (step_3b /
-    // Playwright). Precedence mirrors ci.gate: per-run flag > .pipeline-config.yml
-    // `e2e.spec_generation` > default `auto`. `auto` = the orchestrator runs
-    // step_3b when the story requires an E2E plan (step_0 emitted `yes`); `never`
-    // = step_3b is always skipped. The runtime "is E2E required?" decision stays
-    // server-side (checkE2eRequirement reads step_0's output) — the CLI only
-    // passes the MODE.
-    try {
-      const { readE2eSpecMode } = require('./lib/pipeline-config');
-      let e2eMode, source;
-      if (opts.e2eSpecs) { e2eMode = 'auto'; source = '--e2e-specs'; }
-      else if (opts.skipE2eSpecs) { e2eMode = 'never'; source = '--skip-e2e-specs'; }
-      else { e2eMode = readE2eSpecMode(process.cwd()); source = 'config/default'; }
-      orchestrateConfig.e2e_spec_generation = e2eMode;
-      // Enable step_3b (conditional) unless the adopter opted out. The row is
-      // then created; the orchestrator still skips it at runtime for a story that
-      // does not require an E2E plan (HC-019n-followup-28).
-      if (e2eMode !== 'never') {
-        const ec = new Set(orchestrateConfig.enableConditional || []);
-        ec.add('step_3b');
-        orchestrateConfig.enableConditional = [...ec];
-      }
-      console.log(`  → E2E spec generation (step_3b): ${e2eMode} (source: ${source})`);
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`  ⚠ e2e spec-mode read failed (non-fatal, defaulting to auto): ${msg}`);
-      orchestrateConfig.e2e_spec_generation = 'auto';
-    }
-
-    // HC-019n-followup-34: thread the closed-loop verification gate mode from
-    // .pipeline-config.yml. Advisory (default) = the server RECORDS verify-patch/
-    // verify-pr verdicts reported via --report; enforce (follow-up) = a red
-    // verdict blocks. Default-safe: never fatal.
-    try {
-      const { readVerificationGateConfig, readVerificationGateSources } = require('./lib/pipeline-config');
-      orchestrateConfig.verification_gate = readVerificationGateConfig(process.cwd());
-      // HC-COMM-011-followup-6: which verdict sources may DRIVE the step_4 gate under
-      // enforce (default ['verify-patch']). An adopter adds 'agent-eval' to let a
-      // green agent-eval verdict auto-advance a prompt change.
-      orchestrateConfig.verification_gate_sources = readVerificationGateSources(process.cwd());
-      if (orchestrateConfig.verification_gate !== 'advisory') {
-        console.log(`  → verification gate: ${orchestrateConfig.verification_gate} (sources: ${orchestrateConfig.verification_gate_sources.join(', ')})`);
-      }
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`  ⚠ verification-gate read failed (non-fatal, defaulting to advisory): ${msg}`);
-      orchestrateConfig.verification_gate = 'advisory';
-      orchestrateConfig.verification_gate_sources = ['verify-patch'];
-    }
-
-    // HC-019b: read per-story architect flags from .github/EXECUTION_PLAN.yml
-    // and plumb them into workflow_runs.config. The orchestrator's
-    // validateStepPreConditions (server/src/services/workflow-dag.js:340)
-    // BLOCKS step_1 when architect_consulted=true but checklist_b_completed=false.
-    // Without this plumbing, the HC-019a flags written by the architect prompt
-    // never reach the server and every architect-engaged story deadlocks.
-    // Defaults to {false, false} when the file/story/config is missing —
-    // i.e., assume the architect was not consulted (no block).
-    //
-    // Code-review F2/F3: malformed YAML or missing story entry was previously
-    // silent. The helper now returns a `diagnostic` string for those cases;
-    // we surface it as a console.warn so operators see the silent-bypass.
-    // HC-019b-followup-1 F1: use the resolved canonical story-id (HC-NNN)
-    // not the raw `storyIdOrRunId` which is the issue number when invoked
-    // as `hone run-story 104`. The HC-019n-followup-11 block above sets
-    // resolvedStoryId to the title-extracted id when it can.
-    const { readArchitectConfig } = require('./lib/architect-config');
-    const arch = readArchitectConfig(process.cwd(), resolvedStoryId);
-    orchestrateConfig.architect_consulted  = arch.architect_consulted;
-    orchestrateConfig.checklist_b_completed = arch.checklist_b_completed;
-    if (arch.diagnostic) console.warn(`  ⚠ ${arch.diagnostic}`);
-    if (arch.architect_consulted) {
-      console.log(`  → architect_consulted: true, checklist_b_completed: ${arch.checklist_b_completed}`);
-    }
+    // HC-GF-097: the run config is built by cli/lib/run-context.js, the one assembler this
+    // command and `queue-stories` share. It used to be assembled inline here, key by key, and
+    // queue-stories was written beside it with two of the fourteen — so a queued story ran with
+    // no story text, no bundle, no tree and the server's default CI gate. The module returns
+    // what it decided as notes; they print in the order this command always printed them.
+    const { resolveRepoContext, resolveStoryContext, buildRunConfig } = require('./lib/run-context');
+    const rcIo = runContextIo(config);
+    const repoCtx = resolveRepoContext(rcIo, { e2eSpecs: opts.e2eSpecs, skipE2eSpecs: opts.skipE2eSpecs });
+    const storyCtx = await resolveStoryContext(rcIo, repoCtx, storyIdOrRunId, {
+      explicitText: explicitStory,
+      explicitLabel: opts.storyFile ? path.relative(process.cwd(), path.resolve(opts.storyFile)) : '--description',
+      explicitSource: opts.storyFile ? { kind: 'file', label: path.basename(String(opts.storyFile)) } : { kind: 'description' },
+      includePaths: opts.includePaths,
+      axes: opts.axes,
+    });
+    printRunContextNotes(storyCtx.notes.pre);
+    printRunContextNotes(repoCtx.notes);
+    printRunContextNotes(storyCtx.notes.post);
+    const orchestrateConfig = buildRunConfig(repoCtx, storyCtx);
 
     try {
       const { data } = await client.post('/orchestrate', {
@@ -6485,12 +6600,11 @@ program
   .option('--list', 'List recent batches for this org')
   .option('--limit <n>', 'Number of batches to list (default 20, max 100)', '20')
   .option('--format <fmt>', 'Output format: pretty or json (with --report, also: md)', 'pretty')
-  // HC-054: Night Shift mode. Conditional auto-approve at step_4/step_5
-  // when the agent output passes isCleanOutput's positive allowlist +
-  // inverse blocklist. Extended LLM timeout (480s), orchestrator watchdog
-  // (900s/step), default token budget of 400K × story_count when none
-  // explicitly set. Cap of 25 stories per overnight batch.
-  .option('--overnight', 'Enable Night Shift mode (conditional auto-approve, longer timeouts, max 25 stories)', false)
+  // HC-054: Night Shift mode. Extended LLM timeout (480s), orchestrator watchdog (900s/step), default token
+  // budget of 400K × story_count when none is set, a cap of 25 stories, and an exhausted pause that fails the run
+  // so its dependents are released (HC-GF-137b). step_4 and step_5 still pause: HC-GF-303 removed HC-054's
+  // auto-approve on output text, which never ran. Approve overnight on evidence with `hone follow-batch`.
+  .option('--overnight', 'Enable Night Shift mode (longer timeouts, max 25 stories; step_4/step_5 still pause for approval)', false)
   .action(async (opts) => {
     const config = getConfig();
     const client = api(config);
@@ -6663,98 +6777,103 @@ program
       catch { branch = null; }
     }
 
-    // HC-019b: read EXECUTION_PLAN.yml ONCE up front so the per-story lookup
-    // doesn't re-stat the disk for each line. Empty text \u2192 all stories get
-    // the {false, false} default per architect-config.js. Try/catch keeps
-    // the batch path resilient if the file is missing or unreadable.
-    let planText = '';
-    try {
-      const planPath = path.join(process.cwd(), '.github', 'EXECUTION_PLAN.yml');
-      if (fs.existsSync(planPath)) planText = fs.readFileSync(planPath, 'utf8');
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`\u26a0 EXECUTION_PLAN.yml read failed for batch (non-fatal, architect flags default to {false, false}): ${msg}`);
-    }
-    const { readArchitectConfigFromText } = require('./lib/architect-config');
-
-    // HC-059: parse `STORY-A depends:STORY-B,STORY-C` per-line syntax. The
-    // `depends:` token is case-sensitive and must come AFTER the storyId.
-    // Multiple deps separated by commas, whitespace tolerant. Lines without
-    // `depends:` yield no `dependsOn` (server validates absence vs empty).
-    // HC-019b: attach per-story `config: { architect_consulted, checklist_b_completed }`
-    // \u2014 the server's createBatch (batch-store.js:218) spreads s.config into each
-    // workflow_runs.config row, so this is the load-bearing plumbing for
-    // validateStepPreConditions (workflow-dag.js:340) in batch mode.
-    const stories = storyIds.map(line => {
-      const depsMatch = line.match(/^(\S+)\s+depends:(\S+)\s*$/);
-      let storyId, dependsOn;
-      if (depsMatch) {
-        const [, id, depsCsv] = depsMatch;
-        storyId = id;
-        dependsOn = depsCsv.split(',').map(s => s.trim()).filter(Boolean);
-      } else {
-        // Reject ambiguous lines (storyId followed by garbage) \u2014 better than
-        // silently treating `STORY-A something` as just `STORY-A`.
-        if (/\s/.test(line)) {
-          console.error(`Malformed line in --file: "${line}"`);
-          console.error(`  Expected: "STORY-ID"  OR  "STORY-ID depends:STORY-B,STORY-C"`);
-          process.exit(1);
-        }
-        storyId = line;
-        dependsOn = undefined;
-      }
-      const arch = readArchitectConfigFromText(planText, storyId);
-      // Code-review F2/F3: surface silent-bypass diagnostics per story in
-      // the batch path too. Multi-story batches with one bad plan line
-      // would previously disable the contract for ALL stories silently.
-      if (arch.diagnostic) console.warn(`  ⚠ [${storyId}] ${arch.diagnostic}`);
-      const obj = {
-        storyId,
-        repoName,
-        branch,
-        config: {
-          architect_consulted:  arch.architect_consulted,
-          checklist_b_completed: arch.checklist_b_completed,
-        },
-      };
-      if (Array.isArray(dependsOn) && dependsOn.length > 0) obj.dependsOn = dependsOn;
-      return obj;
+    const { parseStoryLine } = require('./lib/story-line');
+    const {
+      resolveRepoContext, resolveStoryContext, buildRunConfig, hasStoryText, describeMissingText, overnightModeRefusal,
+    } = require('./lib/run-context');
+
+    // HC-059: `STORY-A depends:STORY-B,STORY-C` per line. HC-GF-140 stage 2: the parse lives in
+    // cli/lib so it is asserted by BEHAVIOUR. Every line is parsed before anything is resolved.
+    const lines = storyIds.map(line => {
+      const parsed = parseStoryLine(line);
+      if (parsed.error) {
+        console.error(parsed.error);
+        console.error(`  Expected: "STORY-ID"  OR  "STORY-ID depends:STORY-B,STORY-C"`);
+        process.exit(1);
+      }
+      return parsed;
     });
 
-    // HC-054: Night Shift opt-in. config.overnight=true plumbs end-to-end
-    // (server validates the 25-story cap + applies default token budget +
-    // denormalizes flag into each child's workflow_runs.config).
-    const body = { stories };
-    body.config = body.config || {};
+    // HC-GF-097: each queued story gets the config `hone run-story` would build for it, from the
+    // same module (cli/lib/run-context.js). This path used to send two architect flags per story,
+    // so a queued story was groomed, planned and built from its id alone. The repository half is
+    // computed once for the whole batch.
+    const rcIo = runContextIo(config);
+    // The byte cap on the tree's path lists is the batch's: its request limit is derived from it.
+    const repoCtx = resolveRepoContext(rcIo, { treeByteCap: require('./lib/repo-tree').MAX_TRANSPORT_BYTES });
+
+    // Fail closed FIRST — before any story is resolved or anything is sent. An overnight batch
+    // runs with nobody watching: an editor-mode repo would park every story at step_4, and an
+    // unrecognised mode would run on a guess.
     if (opts.overnight) {
-      body.config.overnight = true;
+      const { OVERNIGHT_MAX_STORIES } = require('./lib/run-context');
+      if (lines.length > OVERNIGHT_MAX_STORIES) {
+        console.error(`✗ --overnight refused: ${lines.length} stories, over the ${OVERNIGHT_MAX_STORIES}-story overnight cap. ` +
+          'Nothing was resolved or sent; split the file.');
+        process.exit(1);
+      }
+      const refusal = overnightModeRefusal(repoCtx.execution);
+      if (refusal) {
+        console.error(refusal);
+        process.exit(1);
+      }
     }
+    printRunContextNotes(repoCtx.notes);
 
-    // HC-101-followup-2: plumb the adopter's CI gate config to every story
-    // in the batch. Without this, the batch path would silently default to
-    // gate=github on the server even when .pipeline-config.yml says local/none —
-    // exactly the "silent skip" the design warned against. Same try/catch
-    // pattern as the run-story path (cli/hone-cli.js ~L4628).
-    try {
-      const { readCIGateConfig, DEFAULT_CI_LOCAL_COMMAND } = require('./lib/pipeline-config');
-      const ciGate = readCIGateConfig(process.cwd());
-      body.config.ci_gate = ciGate.gate;
-      body.config.ci_local_command = ciGate.local_command;
-      if (ciGate.gate !== 'github') {
-        console.log(`CI gate mode for batch: ${ciGate.gate} (local_command: ${ciGate.local_command})`);
+    // Resolved with bounded concurrency: each story can make a network call (its roadmap context,
+    // or `gh issue view`), and fifty in series is minutes of waiting. The output is printed after
+    // every story has resolved, in file order, so it reads exactly like a serial pass.
+    const RESOLVE_CONCURRENCY = 5;
+    const resolved = new Array(lines.length);
+    let nextLine = 0;
+    await Promise.all(Array.from({ length: Math.min(RESOLVE_CONCURRENCY, lines.length) }, async () => {
+      while (nextLine < lines.length) {
+        const i = nextLine++;
+        resolved[i] = await resolveStoryContext(rcIo, repoCtx, lines[i].storyId);
       }
-    } catch (e) {
-      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
-      console.warn(`⚠ CI gate config read failed for batch (non-fatal, defaulting to gate=github): ${msg}`);
-      body.config.ci_gate = 'github';
-      try {
-        const { DEFAULT_CI_LOCAL_COMMAND } = require('./lib/pipeline-config');
-        body.config.ci_local_command = DEFAULT_CI_LOCAL_COMMAND;
-      } catch { body.config.ci_local_command = 'make ci'; }
+    }));
+    // One summary line per story, and every warning labelled with its story. The info lines
+    // run-story prints for one run would be a dozen per story here.
+    for (const ctx of resolved) {
+      const { storyId } = ctx;
+      const src = ctx.textSource ? `${ctx.textSource} text (${ctx.rawText.length} chars)` : 'no story text';
+      console.log(`  [${storyId}] ${src} · ${ctx.bundle.files} codebase file(s) bundled`);
+      printRunContextNotes(ctx.notes.pre, { prefix: `[${storyId}]`, only: 'warn' });
+      printRunContextNotes(ctx.notes.post, { prefix: `[${storyId}]`, only: 'warn' });
+    }
+
+    // HC-GF-097: a story with no text grooms to placeholders. run-story warns and proceeds for a
+    // run someone is watching; a batch refuses — naming EVERY such story — before anything is
+    // queued. Judged on the raw text, never the composed description.
+    const missing = resolved.filter(ctx => !hasStoryText(ctx));
+    if (missing.length > 0) {
+      console.error(`✗ ${missing.length} of ${resolved.length} ${resolved.length === 1 ? 'story' : 'stories'} ` +
+        `${missing.length === 1 ? 'has' : 'have'} no story text, so nothing was queued:`);
+      for (const ctx of missing) console.error(`  ${describeMissingText(ctx)}`);
+      console.error('Give each one text (a roadmap row or a GitHub issue number), or remove it from the file.');
+      process.exit(1);
     }
 
+    const stories = lines.map(({ storyId, dependsOn }, i) => {
+      const obj = { storyId, repoName, branch, config: buildRunConfig(repoCtx, resolved[i]) };
+      if (Array.isArray(dependsOn) && dependsOn.length > 0) obj.dependsOn = dependsOn;
+      return obj;
+    });
+
+    // HC-054: Night Shift. The flag lives at batch level only; the server caps an overnight batch
+    // at 25 and denormalizes the flag into each child itself.
+    const body = { stories, config: {} };
+    if (opts.overnight) body.config.overnight = true;
+    // HC-101-followup-2: the CI gate also travels at batch level. Each story already carries its
+    // own; a server from HC-GF-097 on fills the batch value into any story that did not.
+    body.config.ci_gate = repoCtx.config.ci_gate;
+    body.config.ci_local_command = repoCtx.config.ci_local_command;
+
+    // Sized to the body: the client's 30 s default covered the upload (review of #1100).
+    const bodyBytes = Buffer.byteLength(JSON.stringify(body), 'utf8');
+    const postTimeoutMs = require('./lib/run-context').batchPostTimeoutMs(bodyBytes);
     try {
-      const { data } = await client.post('/orchestrate/batch', body);
+      const { data } = await client.post('/orchestrate/batch', body, { timeout: postTimeoutMs });
 
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
 
@@ -6774,6 +6893,25 @@ program
         console.error(`Org concurrency limit reached: ${e.response.data.error}`);
       } else if (e.response?.status === 400) {
         console.error(`Rejected: ${e.response.data.error}`);
+      } else if (e.response?.status === 413) {
+        // HC-GF-097: full per-story context can outgrow the server's request limit. Say how big,
+        // which stories, and what to do — not a bare "request entity too large".
+        const total = Buffer.byteLength(JSON.stringify(body), 'utf8');
+        console.error(`Rejected: the batch is ${(total / 1048576).toFixed(1)} MB, over the server's request limit (413).`);
+        console.error('Largest stories by run-config size:');
+        const sizes = stories.map(s => ({ id: s.storyId, bytes: Buffer.byteLength(JSON.stringify(s.config), 'utf8') }))
+          .sort((a, b) => b.bytes - a.bytes);
+        for (const s of sizes.slice(0, 10)) console.error(`  ${s.id}  ${(s.bytes / 1024).toFixed(0)} KB`);
+        console.error('Split the file into smaller batches, or narrow codebase.source_dirs so each story carries less.');
+      } else if (e.response?.status === 503) {
+        // HC-GF-097 review: the server admits a few batch submissions at a time; nothing was queued.
+        console.error(`Server busy, nothing was queued: ${e.response.data?.error || 'retry shortly'}`);
+      } else if (!e.response && (e.code === 'ECONNABORTED' || /timeout/i.test(e.message || ''))) {
+        // The body may have arrived and been committed before the timer fired. Re-running blind
+        // would queue the same stories twice, so say so and point at the list.
+        console.error(`Timed out after ${Math.round(postTimeoutMs / 1000)}s sending a ${(bodyBytes / 1048576).toFixed(1)} MB batch.`);
+        console.error('The server may have queued it anyway. Check before re-running, or the stories will be queued twice:');
+        console.error('  hone queue-stories --list');
       } else {
         console.error(`Failed: ${e.response?.data?.error || e.message}`);
       }
@@ -6781,71 +6919,6 @@ program
     }
   });
 
-// ── HC-054g: Night-shift retroactive revert command ─────────────────────────
-//
-// Two-step operator workflow after rejected_rate drift (HC-054c) flags a
-// batch of bad overnight auto-approves:
-//
-//   1. `hone night-shift revert <runId> --step-key <key> --revert-pr <url>`
-//   2. CLI calls POST /night-shift/runs/:runId/retroactive-reject (if not yet)
-//      then POST /night-shift/runs/:runId/revert with the revert PR URL.
-//
-// We deliberately don't take repo write access; the operator runs the git
-// revert themselves and passes the resulting revert-PR URL. This keeps the
-// server side free of GitHub credentials + repo-specific permissions while
-// still giving the audit log the revert provenance.
-const nightShiftCmd = program.command('night-shift').description('HC-054 night-shift audit + revert workflow');
-nightShiftCmd
-  .command('revert <runId>')
-  .description('Record a revert action for a retroactively-rejected overnight auto-approve')
-  .requiredOption('--step-key <stepKey>', 'The step_key whose auto-approve produced the bad output (e.g. step_4 or step_5)')
-  .requiredOption('--revert-pr <url>', 'GitHub PR URL of the revert commit (https://github.com/.../pull/<n>)')
-  .option('--reason <reason>', 'Free-text reason for the retroactive rejection (recorded with the audit row)')
-  .action(async (runId, opts) => {
-    const config = getConfig();
-    const client = api(config);
-    try {
-      // Step 1: retroactively-reject if not yet rejected. The endpoint
-      // returns 409 if already rejected — we treat that as a no-op
-      // (operator may have done step 1 yesterday, run revert today).
-      try {
-        await client.post(`/night-shift/runs/${runId}/retroactive-reject`, {
-          stepKey: opts.stepKey,
-          reason: opts.reason,
-        });
-        console.log(`[night-shift] retroactively rejected (runId=${runId}, stepKey=${opts.stepKey})`);
-      } catch (e) {
-        const status = e.response?.status;
-        if (status === 409) {
-          console.log(`[night-shift] already retroactively rejected (continuing to revert step)`);
-        } else if (status === 404) {
-          console.error(`hone night-shift revert failed: no auto-approve audit row for (runId=${runId}, stepKey=${opts.stepKey})`);
-          process.exit(1);
-        } else {
-          throw e;
-        }
-      }
-
-      // Step 2: record the revert PR URL.
-      const r = await client.post(`/night-shift/runs/${runId}/revert`, {
-        stepKey: opts.stepKey,
-        revertPrUrl: opts.revertPr,
-      });
-      console.log(`[night-shift] revert recorded:`);
-      console.log(`  runId:             ${r.data.runId}`);
-      console.log(`  stepKey:           ${r.data.stepKey}`);
-      console.log(`  revertInitiatedAt: ${r.data.revertInitiatedAt}`);
-      console.log(`  revertPrUrl:       ${r.data.revertPrUrl}`);
-    } catch (e) {
-      const msg = e.response?.data?.error || e.message;
-      console.error(`hone night-shift revert failed: ${msg}`);
-      if (e.response?.data?.remediation) {
-        console.error(`Remediation: ${e.response.data.remediation}`);
-      }
-      process.exit(1);
-    }
-  });
-
 // ── HC-056: Schedule install (GitHub Actions overnight template) ────────────
 //
 // Installs a parameterized .github/workflows/<name>.yml that runs `hone
@@ -7411,13 +7484,16 @@ program
         const responseForCache = parsed && typeof parsed === 'object'
           ? parsed
           : { raw: responseText };
-        storeReviewCache({
+        await storeReviewCache({
           axios, apiBase, token,
           contentHash: cacheContentHash,
           model: modelForCache,
           response: responseForCache,
           tokensSaved: inputTokens + outputTokens,
           banner,
+        // HC-GF-260: awaited. The next thing this command does is compute an exit code and
+        // leave, so a detached POST can lose the entry the cache exists to save — the same shape
+        // as HC-GF-250, where a process returned before its write landed.
         }).then(({ stored }) => {
           if (stored) banner(`✓ Cache stored: ${cacheContentHash.slice(0, 16)}…`);
         }).catch(() => { /* logged inside helper */ });
@@ -7580,6 +7656,9 @@ program
     // (followup-20) for stories still on the old ## Patch contract.
     let diff, source, noChanges;
     const blocks = extractFileBlocks(output);
+    // HC-GF-191: the parser had to look outside `## Changed Files` to find anything. Say so —
+    // silently re-scoping is how a finished build came back as "no file changes to verify".
+    if (blocks.scopeFallback) console.warn(`  ⚠ ${blocks.reason}`);
     if (blocks.noChanges) {
       emit({ ok: true, verdict: 'no_changes' },
         `○ ${opts.stepKey} declared NO CHANGES — nothing to apply.`);
@@ -7624,13 +7703,15 @@ program
 
     // Write to a temp file and run git apply --check against HEAD. HC-GF-077: against an index read from HEAD,
     // not the working copy — an editor's uncommitted edits are exactly what emit-pr's branch will NOT contain.
-    const tmp = path.join(os.tmpdir(), `hone-check-patch-${Date.now()}.diff`);
+    // HC-GF-304: a directory only this invocation created, not a name built from the clock.
+    const tmpFile = require('./lib/private-temp').privateTempFile('hone-check-patch', 'patch.diff');
+    const tmp = tmpFile.file;
     let result;
     try {
       fs.writeFileSync(tmp, diff);
       let code = 0, stderr = '';
       try {
-        const index = path.join(os.tmpdir(), `hone-check-index-${process.pid}-${Date.now()}`);
+        const index = path.join(path.dirname(tmp), 'index');   // HC-GF-304: inside this invocation's private directory
         try {
           try {
             execFileSync('git', ['read-tree', `--index-output=${index}`, 'HEAD'], { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
@@ -7647,7 +7728,7 @@ program
       }
       result = interpretApplyCheck({ code, stderr });
     } finally {
-      try { fs.unlinkSync(tmp); } catch { /* best-effort */ }
+      tmpFile.remove();
     }
 
     if (result.applies) {
@@ -7680,15 +7761,35 @@ program
   .option('--keep', 'Leave the worktree in place for debugging')
   .option('--no-provision', 'Do not install/link dependencies into the isolated worktree (HC-COMM-010-followup-6)')
   .option('--report', 'HC-019n-followup-34: report the verdict back to the server (closed loop, advisory)')
+  .option('--trust-source', 'HC-GF-270: run a patch whose story text came from a source Hone does not trust (you have read the diff)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
+    // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
+    // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
+    // deep in child_process, and a blank value coerces to 0 and kills the
+    // command the instant it starts.
+    let timeoutMs;
+    try {
+      timeoutMs = parseTimeoutSeconds(opts.timeout) * 1000;
+    } catch (e) {
+      console.error(e.message);
+      process.exit(2);
+    }
     const os = require('os');
     const { extractFileBlocks, buildDiff, headMaterializeIO, MaterializeError, hasMaterializableWork } = require('./lib/materialize-diff');
     const { resolveCommandDetailed, verdictFromRun, verifyCommandEnv, EXIT, resolveAuxGates, classifyGateRun } = require('./lib/verify-patch');
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
+    // HC-GF-270 (second review MEDIUM-1): the step key goes into a URL and a file name, and URL
+    // resolution collapses `..` — `--step-key ../../<other run>/step/step_4` fetched ANOTHER run's
+    // patch while THIS run's config was assessed. A step key is a step key.
+    if (!/^step_[0-9a-z_]+$/i.test(String(opts.stepKey || ''))) {
+      console.error(`--step-key must name a step, like step_4 (got ${JSON.stringify(opts.stepKey)})`);
+      process.exit(2);
+    }
+    const sameRun = (id) => String(id).toLowerCase() === String(workflowId).toLowerCase();
 
     const emit = (obj, humanLine) => {
       if (opts.format === 'json') console.log(JSON.stringify(obj));
@@ -7699,19 +7800,31 @@ program
     // HC-GF-074: the attempt this run verified — reported with the verdict below.
     let verifiedAttempt;
     let output, runConfig;
+    // HC-GF-270: the id shape is the legacy provenance rule's only input, and a FAILED run
+    // fetch is untrusted regardless of it — the `catch { runConfig = {} }` below is the
+    // fail-open this gate exists to close.
+    let runStoryId = null;
+    let runFetchFailed = false;
     try {
-      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
+      const url = `/orchestrate/${encodeURIComponent(workflowId)}/step/${encodeURIComponent(opts.stepKey)}` +
         (opts.attempt ? `?attempt=${opts.attempt}` : '');
       const r = await client.get(url);
+      // The step output must be THIS run's: nothing else ties the patch to the config assessed below.
+      if (r.data?.runId && !sameRun(r.data.runId)) throw new Error(`the server returned ${opts.stepKey} for a different run`);
       output = r.data?.output;
       // HC-GF-074: remember WHICH attempt this is. Without --attempt the server returns the latest, and the verdict
       // used to be reported with `attempt: null` — so no verdict on record could say which build it judged.
       verifiedAttempt = r.data?.attempt != null ? Number(r.data.attempt) : undefined;
       // best-effort: pull the run's ci_local_command for the default
       try {
-        const runR = await client.get(`/orchestrate/${workflowId}`);
+        const runR = await client.get(`/orchestrate/${encodeURIComponent(workflowId)}`);
+        // HC-GF-270 (security review BLOCKER-1): the id is ENCODED above, so a crafted
+        // `<uuid>/step/step_4?` cannot turn this into a fetch of some other endpoint that answers
+        // 200 with no config. And a body that is not THIS run is not this run's config.
+        if (runR.data?.runId && !sameRun(runR.data.runId)) throw new Error('run id mismatch');
         runConfig = runR.data?.config || {};
-      } catch { runConfig = {}; }
+        runStoryId = runR.data?.storyId || runR.data?.story_id || null;
+      } catch (e) { runConfig = {}; runFetchFailed = e && e.message === 'run id mismatch' ? 'mismatch' : true; }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       emit({ ok: false, reason: 'fetch_failed', detail: msg },
@@ -7719,12 +7832,58 @@ program
       process.exit(EXIT.NO_DIFF);
     }
 
+    // ── HC-GF-270: the provenance gate ────────────────────────────────────────────────────
+    //
+    // HERE, and not one line later. Telling the operator at the poll loop is not enough: an
+    // MCP agent reads the same untrusted issue text and can call `hone_verify_patch` itself
+    // (cli/lib/mcp-tools.js), and a scripted `--approve` takes the same path. This runs
+    // BEFORE the diff is materialized, before a worktree exists, and before provisioning
+    // runs the PATCHED manifest's install as the operator — by the time `planProvision`
+    // sees it, the code is already on disk, which is why worktree-provision.js is not the
+    // layer for this.
+    {
+      let assessment;
+      try {
+        const { assessStorySource } = require('./lib/story-provenance');
+        assessment = runFetchFailed
+          ? { trusted: false, label: 'run-fetch-failed',
+              reason: runFetchFailed === 'mismatch'
+                ? 'the server answered for a different run, so this run\'s config was never read'
+                : 'this run\'s config could not be read, so nothing is known about where its story text came from' }
+          : assessStorySource(runConfig?.story_source, runStoryId);
+      } catch (e) {
+        assessment = { trusted: false, label: 'assessment-failed',
+          reason: `story provenance could not be assessed: ${e.message}` };
+      }
+      if (!assessment.trusted && !opts.trustSource) {
+        // NO --report on this path, deliberately. A non-pass verdict on record makes the
+        // server refuse the human's later approval under `enforce`
+        // (server/src/services/verification-refusal.js), and nothing was verified here —
+        // this is a check that did not RUN, which is a third outcome, not a failure.
+        emit({ ok: false, reason: 'untrusted_source', verdict: 'not_run', detail: assessment.reason },
+          `✗ refusing to verify: ${assessment.reason}\n`
+          + '  Verifying runs this patch — the provisioning install first — as you, with your $HOME and network.\n'
+          + `  Read it:  hone show step ${workflowId} ${opts.stepKey}\n`
+          + `  Then:     hone verify-patch ${workflowId} --report --trust-source`);
+        process.exit(EXIT.UNTRUSTED_SOURCE);
+      }
+    }
+
     // 2. Materialize the diff (shared with check-patch/emit-pr, followup-23/27).
     // Condition 6 presupposes 5.
     const blocks = extractFileBlocks(output);
+    // HC-GF-191: the parser had to look outside `## Changed Files` to find anything. Say so —
+    // silently re-scoping is how a finished build came back as "no file changes to verify".
+    if (blocks.scopeFallback) console.warn(`  ⚠ ${blocks.reason}`);
     const hasWork = hasMaterializableWork(blocks);
     if (blocks.noChanges || !hasWork) {
-      emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
+      // HC-GF-190: this exit precedes planSandboxRun entirely, so a stateful story with a declared
+      // sandbox produces NONE of the planner's three outcomes and, before this line, said nothing
+      // about it — run 2a9b2af5's verdict was indistinguishable from an ordinary empty build.
+      // `not reached` is a fourth outcome, not a variant of the stand-down.
+      const missed = describeSandboxDisposition(runConfig);
+      if (missed && opts.format !== 'json') console.warn(`  ⚠ ${missed}`);
+      emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff', sandbox: missed || undefined },
         `✗ ${opts.stepKey} produced no file changes to verify.`);
       process.exit(EXIT.NO_DIFF);
     }
@@ -7747,16 +7906,19 @@ program
 
     // 3. Isolated worktree from HEAD.
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-verify-'));
-    const diffFile = path.join(os.tmpdir(), `hone-verify-${Date.now()}.diff`);
+    // HC-GF-304: a directory only this invocation created. A clock-named file was shared by two verbs started in
+    // the same millisecond, and one of them verified the other's patch.
+    const diffTmp = require('./lib/private-temp').privateTempFile('hone-verify-diff', 'patch.diff');
+    const diffFile = diffTmp.file;
     fs.writeFileSync(diffFile, diff);
-    const { command, source: commandSource } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess
+    const { command, source: commandSource, replaced: commandReplaced } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess; HC-GF-223: `replaced` says what an override skipped
     let cleanupDone = false;
     const cleanup = () => {
       if (cleanupDone || opts.keep) return;
       cleanupDone = true;
       try { execFileSync('git', ['worktree', 'remove', '--force', wt], { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' }); } catch { /* best-effort */ }
       try { fs.rmSync(wt, { recursive: true, force: true }); } catch { /* best-effort */ }
-      try { fs.unlinkSync(diffFile); } catch { /* best-effort */ }
+      diffTmp.remove();
     };
     // Guard against leaving a worktree if the process is interrupted.
     process.on('SIGINT', () => { cleanup(); process.exit(130); });
@@ -7772,6 +7934,9 @@ program
     // HC-GF-026: measured verdicts for the gates step_4 asserts. Hoisted so they
     // survive the try/finally to the --report POST, exactly like reportVerdict.
     const reportGates = [];
+    // HC-GF-171: hoisted for the same reason reportVerdict is — the teardown must survive the
+    // try/finally. Seeded rows outliving a run is the worst outcome this feature can produce.
+    let sandboxTeardown = [];
     const ciCfg = require('./lib/pipeline-config').readCIConfigDetails(process.cwd());
     try { headSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' }).trim(); } catch { /* best-effort */ }
     try {
@@ -7796,24 +7961,172 @@ program
         // HC-COMM-010-followup-6: a bare worktree has no dependencies — provision it
         // (link the repo's node_modules when the lockfile is unchanged, else run the
         // lockfile's install, or ci.install_command). Fail-open; --no-provision opts out.
+        // HC-GF-201: declared OUTSIDE the guard — the verdict needs provisioning state,
+        // and with --no-provision there is none, which is not the same as a failure.
+        let provAll = null;
         if (opts.provision !== false) {
-          const { planProvision, provisionWorktree } = require('./lib/worktree-provision');
+          const { planProvision, discoverPackageRoots, provisionAllRoots } = require('./lib/worktree-provision');
           const { readCIConfigDetails } = require('./lib/pipeline-config');
-          const plan = planProvision({ worktreeDir: wt, parentDir: process.cwd(), installCommand: readCIConfigDetails(process.cwd()).install_command });
-          const prov = provisionWorktree(plan, { worktreeDir: wt, exec: spawnSync });
+          // HC-GF-201: provision EVERY package root, not just the worktree's top level.
+          // This repo has three; the two skipped are where ci.unit runs, so their absent
+          // modules surfaced as `Cannot find module` and were counted as the PATCH failing
+          // tests — a false RED on the merge-gating verdict (run b3117bde, 2026-09-20).
+          const installCmd = readCIConfigDetails(process.cwd()).install_command;
+          const provEntries = discoverPackageRoots(wt).map((root) => ({
+            root,
+            worktreeDir: root === '.' ? wt : path.join(wt, root),
+            exec: spawnSync,
+            plan: planProvision({
+              worktreeDir: root === '.' ? wt : path.join(wt, root),
+              parentDir: root === '.' ? process.cwd() : path.join(process.cwd(), root),
+              installCommand: root === '.' ? installCmd : undefined,
+            }),
+          }));
+          provAll = provisionAllRoots(provEntries);
+          const prov = { ok: provAll.ok,
+            summary: provAll.results.map((r) => `${r.root}: ${r.summary}`).join('; ')
+              + (provAll.ok ? '' : ` — NOT RUN: ${provAll.unprovisioned.map((u) => u.root).join(', ')} could not be provisioned`) };
           if (opts.format !== 'json') console.log(`  provisioning: ${prov.summary}`);
         }
+        // ── HC-GF-171: seed the adopter-declared sandbox before the tests run ────────────────
+        // HC-GF-168/169/170/173 each shipped a piece and a run still touched no datastore, because
+        // `assertScratchTarget` had no caller. This is that caller. It runs adopter-side, with the
+        // adopter's credentials, exactly where `ci.local_command` already runs.
+        //
+        // REFUSE, NEVER SKIP. A misconfigured sandbox stops verification with a message naming the
+        // fix; it does not quietly fall through to "tests passed", which would report a green
+        // verdict for code whose stored-state behaviour was never exercised.
+        try {
+          const { readSandboxConfig, assertScratchTarget } = require('./lib/pipeline-config');
+          const { planSandboxRun, parseProbeOutput, describeProbeResult, sandboxSuiteVerdict } = require('./lib/sandbox-lifecycle');
+          const plan = planSandboxRun({
+            sandbox: readSandboxConfig(process.cwd()),
+            axes: runConfig?.classifier_axes || runConfig?.axes || [],
+            capability: runConfig?.capability || null,
+          });
+          if (plan.refuse) {
+            emit({ ok: false, verdict: 'sandbox_refused', detail: plan.reason },
+              `✗ sandbox refused: ${plan.reason}`);
+            exitCode = EXIT.FAIL;
+            reportVerdict = 'sandbox_refused'; reportDetail = plan.reason;
+            throw new Error('sandbox refused');
+          }
+          if (plan.engage) {
+            // The probe runs in the REAL tree, not the worktree: it reads the adopter's live
+            // datastore, which the worktree does not change.
+            const probed = spawnSync(plan.probe, {
+              cwd: process.cwd(), shell: true, encoding: 'utf8',
+              timeout: 60_000, env: verifyCommandEnv(gitEnv()), stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            // A probe that exited non-zero is not evidence, whatever it left on stdout — a
+            // command that fails partway can still print a stale or partial line, and reading it
+            // would turn a failed check into a pass.
+            if (probed.status !== 0) {
+              throw new Error(`sandbox probe exited ${probed.status === null ? 'abnormally' : probed.status}`
+                + ` (${plan.probe}): ${((probed.stderr || '').split('\n')[0] || 'no stderr')}`);
+            }
+            // The guard reads the LIVE connection and nothing else (HC-GF-169).
+            const probeEvidence = parseProbeOutput(probed.stdout);
+            assertScratchTarget(plan.verify, probeEvidence);
+            // HC-GF-190: say what the guard PROVED. It throws on refusal and returns nothing on
+            // success, so a passing guard was silent — and HC-GF-185's acceptance ("the output
+            // shows the probe, the guard verdict and the teardown") stayed open on run 6be117b3,
+            // where all three had in fact happened. Printed after the check and before the first
+            // write, so it describes something that has already occurred.
+            if (opts.format !== 'json') console.log(`  sandbox: ${describeProbeResult(plan.verify, probeEvidence)}`);
+            // Armed BEFORE the first command, not after the last. `create` succeeding and
+            // `migrate` failing would otherwise leave the created rows behind — exactly the
+            // outcome the teardown exists to prevent, on the path where it matters most.
+            sandboxTeardown = plan.teardown;
+            for (const c of plan.commands) {
+              if (opts.format !== 'json') console.log(`  sandbox: ${c}`);
+              const r = spawnSync(c, { cwd: wt, shell: true, encoding: 'utf8',
+                timeout: timeoutMs, env: verifyCommandEnv(gitEnv()), stdio: ['ignore', 'pipe', 'pipe'] });
+              if (r.status !== 0) throw new Error(`sandbox command failed: ${c}`);
+            }
+
+            // HC-GF-192: run the suite that READS the sandbox, immediately after seeding and
+            // before the adopter's own command.
+            //
+            // Run 4f463e54 seeded `hone_sandbox` and then ran `make ci` against
+            // `hone_test_<checkout>`: a flawless lifecycle around a verification that could not
+            // observe it. The adopter's whole CI command is the wrong consumer — a suite that
+            // manages its own database fights a seeded one — so the sandbox declares the command
+            // that reads it, and the connection is one WE publish rather than one an adopter
+            // promises is wired up. That is what makes the result provable.
+            //
+            // First, because the seed is freshest here and the adopter's command can run for
+            // minutes; and a failure names the stored-state behaviour rather than arriving after
+            // an unrelated suite. Names are logged, never values: the connection holds credentials.
+            if (opts.format !== 'json') {
+              console.log(`  sandbox: ${plan.test}`);
+              console.log(`  sandbox: published ${Object.keys(plan.env).join(', ')} to it`);
+            }
+            const sandboxRun = spawnSync(plan.test, {
+              cwd: wt, shell: true, encoding: 'utf8', timeout: timeoutMs,
+              env: verifyCommandEnv(gitEnv(plan.env)), stdio: ['ignore', 'pipe', 'pipe'],
+            });
+
+            // HC-GF-193: the NEGATIVE CONTROL. A runner with nothing to run exits 0, so the status
+            // above cannot tell "everything passed" from "nothing ran" — run 6be117b3's first
+            // attempt was reported as verified on a glob that matched no files. Re-run with every
+            // published variable replaced by an unusable value: a suite that observes the sandbox
+            // must fail, and one that still passes is not reading what we published.
+            //
+            // Only when the real run PASSED. A red suite is already a failure, and re-running it
+            // with a broken environment spends the timeout to learn nothing.
+            let controlStatus = 1;
+            if (sandboxRun.status === 0 && plan.controlEnv) {
+              if (opts.format !== 'json') console.log('  sandbox: re-running the suite with the published variables broken (control)');
+              const ctl = spawnSync(plan.test, {
+                cwd: wt, shell: true, encoding: 'utf8', timeout: timeoutMs,
+                env: verifyCommandEnv(gitEnv(plan.controlEnv)), stdio: ['ignore', 'pipe', 'pipe'],
+              });
+              controlStatus = ctl.status === 0 ? 0 : 1;
+            }
+
+            const suiteVerdict = sandboxSuiteVerdict({ realStatus: sandboxRun.status, controlStatus });
+            if (!suiteVerdict.ok) {
+              const ran = ((sandboxRun.stdout || '') + (sandboxRun.stderr || ''))
+                .split('\n').filter(Boolean).slice(-12).join('\n');
+              const detail = suiteVerdict.kind === 'sandbox_tests_not_observing'
+                ? suiteVerdict.detail : ran;
+              emit({ ok: false, verdict: suiteVerdict.kind, detail },
+                `✗ ${suiteVerdict.kind === 'sandbox_tests_not_observing'
+                  ? `the sandbox suite verified nothing:\n${detail}`
+                  : `the sandbox suite failed:\n${detail}`}`);
+              exitCode = EXIT.FAIL;
+              reportVerdict = suiteVerdict.kind; reportDetail = detail;
+              // Thrown so the `finally` tears the sandbox down — seeded rows outliving a red run
+              // is the worst outcome this capability can produce (HC-GF-171).
+              throw new Error('sandbox tests failed');
+            }
+          } else if (opts.format !== 'json') {
+            console.log(`  sandbox: ${plan.reason}`);
+          }
+        } catch (e) {
+          if (e.message === 'sandbox refused' || e.message === 'sandbox tests failed') throw e;
+          // A sandbox that cannot be proven scratch STOPS the run. Continuing would report a
+          // verdict for stored-state behaviour that was never exercised — a verdict we did not
+          // obtain (HC-GF-177 §18.5).
+          emit({ ok: false, verdict: 'sandbox_unusable', detail: e.message },
+            `✗ sandbox unusable: ${e.message}`);
+          exitCode = EXIT.FAIL;
+          reportVerdict = 'sandbox_unusable'; reportDetail = e.message;
+          throw e;
+        }
+
         if (opts.format !== 'json') console.log(`  running: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
         const run = spawnSync(command, {
           cwd: wt, shell: true, encoding: 'utf8',
-          timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
+          timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
           stdio: ['ignore', 'pipe', 'pipe'],
         });
         const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource });
+        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced }, provAll);
         // HC-GF-077: nothing was applied when HEAD already held the step — say what the command actually ran on.
         if (alreadyInHead && v.verdict === 'pass') v.detail = "tests passed on HEAD, which already contains the step's files";
-        const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'timeout' ? '⏱' : v.verdict === 'unresolved' ? '○' : '✗';
+        const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'pass_narrowed' ? '⚠' : v.verdict === 'timeout' ? '⏱' : v.verdict === 'unresolved' ? '○' : '✗';
 
         // HC-GF-023: on a failure the operator needs the OUTPUT, not a quote from it.
         // The full log is written OUTSIDE the worktree (cleanup removes the worktree)
@@ -7834,7 +8147,13 @@ program
             + v.failure.excerpt.map(l => `  │ ${l}`).join('\n');
         }
         if (logPath) pretty += `\n  full output: ${logPath}`;
-        if (v.verdict !== 'pass') pretty += `\n  inspect the tree: re-run with --keep`;
+        if (v.verdict !== 'pass' && v.verdict !== 'pass_narrowed') pretty += `\n  inspect the tree: re-run with --keep`;
+        // HC-GF-223: a narrowed run needs the command that did NOT run, not the worktree — the way
+        // to a real verdict is the next line rather than a re-read of the story.
+        if (v.verdict === 'pass_narrowed') {
+          pretty += `\n  not a verification: re-run without --command to verify with `
+            + `\`${commandReplaced.command}\``;
+        }
 
         emit(
           { ok: v.verdict === 'pass', verdict: v.verdict, command, detail: v.detail,
@@ -7858,7 +8177,7 @@ program
           for (const gate of resolveAuxGates({ configured: ciCfg, cwd: process.cwd() })) {
             const gr = spawnSync(gate.command, {
               cwd: wt, shell: true, encoding: 'utf8',
-              timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
+              timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
               stdio: ['ignore', 'pipe', 'pipe'],
             });
             const c = classifyGateRun({
@@ -7879,11 +8198,34 @@ program
         }
       }
     } catch (e) {
-      emit({ ok: false, verdict: 'error', detail: e.message },
-        `✗ verify-patch failed: ${e.message}`);
-      exitCode = 1;
-      reportVerdict = 'error'; reportDetail = e.message;
+      // HC-GF-171: a verdict already reported by the sandbox path is the SPECIFIC one — keep it.
+      // Overwriting it with a generic `error` loses which check refused and emits a second,
+      // vaguer line over the first, so the operator reads "verify-patch failed" instead of the
+      // message naming the config key to add.
+      if (reportVerdict) {
+        exitCode = exitCode === EXIT.PASS ? 1 : exitCode;
+      } else {
+        emit({ ok: false, verdict: 'error', detail: e.message },
+          `✗ verify-patch failed: ${e.message}`);
+        exitCode = 1;
+        reportVerdict = 'error'; reportDetail = e.message;
+      }
     } finally {
+      // HC-GF-171: reset runs on EVERY path — pass, fail, refusal, throw. A sandbox that is only
+      // cleaned on success leaves its rows behind exactly when something went wrong, which is when
+      // the adopter is least able to tell seeded data from real.
+      for (const c of sandboxTeardown) {
+        const r = spawnSync(c, { cwd: process.cwd(), shell: true, encoding: 'utf8',
+          timeout: 120_000, env: verifyCommandEnv(gitEnv()), stdio: ['ignore', 'pipe', 'pipe'] });
+        if (opts.format !== 'json') {
+          console.log(r.status === 0
+            ? `  sandbox: ${c}`
+            : `  sandbox: TEARDOWN FAILED (${c}) — seeded rows may remain: ${(r.stderr || '').split('\n')[0]}`);
+        }
+        // HC-GF-183: keep going. If the reset succeeded and the restore failed, stopping here
+        // leaves the sandbox unprobeable and the NEXT run refuses — the defect this fixes.
+      }
+
       cleanup();
     }
 
@@ -7892,7 +8234,7 @@ program
     // change the local exit code (the verdict is already true locally).
     if (opts.report && reportVerdict) {
       try {
-        await client.post(`/orchestrate/${workflowId}/verdict`, {
+        await client.post(`/orchestrate/${encodeURIComponent(workflowId)}/verdict`, {
           source: 'verify-patch',
           stepKey: opts.stepKey,
           verdict: reportVerdict,
@@ -7948,6 +8290,82 @@ program
     }
   });
 
+// ── HC-GF-098: follow-batch — a queued batch's step_4 patches checked and verified overnight ──
+// The server cannot execute, so a batch queued at night reached step_4 and waited for a person to type
+// check-patch, verify-patch and emit-pr. This is the I/O around cli/lib/batch-follow.js, which makes every
+// decision. The verbs run as children of THIS CLI, one at a time, so the loop runs exactly what a person runs.
+// Exit: 0 the batch completed, 1 fatal (refused, unknown batch, unreachable), 2 something needs you, 3 deadline.
+program
+  .command('follow-batch <batchId>')
+  .description('Follow a queued batch: check and verify each step_4 patch, and emit each completed run (HC-GF-098)')
+  .option('--poll-interval <sec>', 'Seconds between polls', '30')
+  .option('--deadline <min>', 'Stop after this many minutes, even if the batch is still running')
+  .option('--max-offline <min>', 'Give up once the server has been unreachable this long', '15')
+  .option('--open-pr', 'Push each emitted branch and open a draft PR (default: a local branch only)')
+  .option('--repo <name>', 'Repository name the batch was queued under (default: this directory\'s name)')
+  .action(async (batchId, opts) => {
+    const { followBatch, EXIT } = require('./lib/batch-follow');
+    const { spawn, spawnSync } = require('child_process');
+    const positive = (raw, flag, unit) => {
+      const n = Number(raw);
+      if (!Number.isFinite(n) || n <= 0) {
+        console.error(`${flag} must be a positive number of ${unit} (got ${JSON.stringify(raw)})`);
+        process.exit(EXIT.FATAL);
+      }
+      return n;
+    };
+    const pollMs = positive(opts.pollInterval, '--poll-interval', 'seconds') * 1000;
+    const maxOfflineMs = positive(opts.maxOffline, '--max-offline', 'minutes') * 60_000;
+    const deadlineMs = opts.deadline === undefined ? null : positive(opts.deadline, '--deadline', 'minutes') * 60_000;
+
+    // Preflight: every verb reads this checkout, and --open-pr needs gh. Refuse before the first poll, not at 3am.
+    const { gitEnv } = require('./lib/git-env');
+    const inRepo = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' });
+    if (inRepo.status !== 0 || String(inRepo.stdout).trim() !== 'true') {
+      console.error('follow-batch runs the batch\'s patches against this checkout: run it from the repository the batch was queued in.');
+      process.exit(EXIT.FATAL);
+    }
+    if (opts.openPr && spawnSync('gh', ['auth', 'status'], { stdio: 'ignore' }).status !== 0) {
+      console.error('--open-pr pushes and opens draft PRs with gh, and `gh auth status` failed: log in, or drop --open-pr.');
+      process.exit(EXIT.FATAL);
+    }
+
+    const config = getConfig();
+    const client = api(config);
+    const repoName = opts.repo || path.basename(process.cwd());
+    const io = {
+      fetchBatch: async (id) => (await client.get(`/orchestrate/batch/${encodeURIComponent(id)}`)).data,
+      fetchRun: async (id) => (await client.get(`/orchestrate/${encodeURIComponent(id)}`)).data,
+      runVerb: (argv) => new Promise((resolve) => {
+        const child = spawn(process.execPath, [process.argv[1], ...argv],
+          { cwd: process.cwd(), env: process.env, stdio: ['ignore', 'inherit', 'inherit'] });
+        child.on('error', (e) => resolve({ code: null, error: e }));
+        child.on('close', (code) => resolve({ code }));
+      }),
+      // The consent and provenance rule run-story applies before it runs a patch (HC-GF-064, HC-GF-270).
+      verifyDecision: (run) => {
+        let assessment;
+        try {
+          assessment = require('./lib/story-provenance').assessStorySource(
+            run && run.config && run.config.story_source, run && (run.storyId || run.story_id));
+        } catch (e) {
+          assessment = { trusted: false, label: 'assessment-failed', reason: `story provenance could not be assessed: ${e.message}` };
+        }
+        return require('./lib/auto-verify').decideAutoVerify({ stepKey: 'step_4', repoRoot: process.cwd(), assessment });
+      },
+      sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+      now: () => Date.now(),
+      log: (line) => console.log(line),
+    };
+
+    console.log(`[follow-batch] following batch ${batchId} for ${repoName}: poll ${pollMs / 1000}s, `
+      + `${deadlineMs ? `deadline ${deadlineMs / 60_000} min` : 'no deadline'}, `
+      + `emit ${opts.openPr ? 'push + draft PR' : 'local branch only'}`);
+    const res = await followBatch(batchId, io, { pollMs, deadlineMs, maxOfflineMs, openPr: !!opts.openPr, repoName });
+    console.log(`[follow-batch] ${res.reason}`);
+    process.exit(res.exitCode);
+  });
+
 // ── HC-019n-followup-25: emit-pr (pipeline-recovery condition 7) ──────────────
 // Condition 6 proved step_4's diff applies AND its tests pass in isolation.
 // Condition 7 turns that verified diff into the reviewable artifact: a branch
@@ -7964,6 +8382,7 @@ program
   .option('--open-pr', 'Open a draft PR (implies --push)')
   .option('--ready', 'Open the PR ready-for-review instead of draft')
   .option('--skip-verify', 'Do not re-run the tests before committing (downgrades provenance)')
+  .option('--trust-source', 'HC-GF-270: emit a patch whose story text came from a source Hone does not trust (you have read the diff)')
   .option('--command <cmd>', 'Test command for --verify (default: ci.local_command, else `make ci`)')
   .option('--timeout <sec>', 'Seconds before the verify test command is killed', '600')
   .option('--keep', 'Leave the worktree in place for debugging')
@@ -7971,15 +8390,35 @@ program
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
+    // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
+    // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
+    // deep in child_process, and a blank value coerces to 0 and kills the
+    // command the instant it starts.
+    let timeoutMs;
+    try {
+      timeoutMs = parseTimeoutSeconds(opts.timeout) * 1000;
+    } catch (e) {
+      console.error(e.message);
+      process.exit(2);
+    }
     const os = require('os');
     const { extractFileBlocks, buildDiff, headMaterializeIO, MaterializeError, hasMaterializableWork } = require('./lib/materialize-diff');
     const { resolveCommandDetailed, verdictFromRun, verifyCommandEnv } = require('./lib/verify-patch');
+    const { verifyStateFor } = require('./lib/emit-pr');
     const {
       EXIT, buildBranchName, buildCommitMessage, buildPrBody, decidePublish,
     } = require('./lib/emit-pr');
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
+    // HC-GF-270 (second review MEDIUM-1): the step key goes into a URL and a file name, and URL
+    // resolution collapses `..` — `--step-key ../../<other run>/step/step_4` fetched ANOTHER run's
+    // patch while THIS run's config was assessed. A step key is a step key.
+    if (!/^step_[0-9a-z_]+$/i.test(String(opts.stepKey || ''))) {
+      console.error(`--step-key must name a step, like step_4 (got ${JSON.stringify(opts.stepKey)})`);
+      process.exit(2);
+    }
+    const sameRun = (id) => String(id).toLowerCase() === String(workflowId).toLowerCase();
 
     // --open-pr implies --push (cannot open a PR against an unpushed branch).
     const doPush = Boolean(opts.push || opts.openPr);
@@ -7993,16 +8432,29 @@ program
 
     // 1. Fetch step_4 output + the run's storyId (for naming/provenance).
     let output, storyId = 'story', runConfig = {};
+    // HC-GF-270: a swallowed run fetch leaves storyId as the non-numeric 'story', which the
+    // legacy rule would read as trusted. A failed fetch is untrusted on its own evidence.
+    let runFetchFailed = false;
+    // The run's REAL story id, for the provenance rule. `storyId` above falls back to 'story' for
+    // branch naming, and 'story' is not all digits — so assessing it would trust a run whose id
+    // never arrived.
+    let runStoryId = null;
     try {
-      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
+      const url = `/orchestrate/${encodeURIComponent(workflowId)}/step/${encodeURIComponent(opts.stepKey)}` +
         (opts.attempt ? `?attempt=${opts.attempt}` : '');
       const r = await client.get(url);
+      // The step output must be THIS run's: nothing else ties the patch to the config assessed below.
+      if (r.data?.runId && !sameRun(r.data.runId)) throw new Error(`the server returned ${opts.stepKey} for a different run`);
       output = r.data?.output;
       try {
-        const runR = await client.get(`/orchestrate/${workflowId}`);
-        storyId = runR.data?.storyId || runR.data?.story_id || 'story';
+        const runR = await client.get(`/orchestrate/${encodeURIComponent(workflowId)}`);
+        // HC-GF-270 (security review BLOCKER-1): see verify-patch — encoded id, and a body that
+        // is not THIS run does not count as its config.
+        if (runR.data?.runId && !sameRun(runR.data.runId)) throw new Error('run id mismatch');
+        runStoryId = runR.data?.storyId || runR.data?.story_id || null;
+        storyId = runStoryId || 'story';
         runConfig = runR.data?.config || {};
-      } catch { /* naming falls back to 'story'; command falls back to make ci */ }
+      } catch (e) { runFetchFailed = e && e.message === 'run id mismatch' ? 'mismatch' : true; /* naming falls back to 'story'; command falls back to make ci */ }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       emit({ ok: false, reason: 'fetch_failed', detail: msg },
@@ -8010,9 +8462,41 @@ program
       process.exit(EXIT.NO_DIFF);
     }
 
+    // ── HC-GF-270: the provenance gate (see verify-patch's copy for the full argument) ─────
+    //
+    // emit-pr runs `--verify` by default and creates a branch, so it is a second execution
+    // surface and a second publishing surface for the same untrusted text. Its own guard, so
+    // its own mutation kills its own test (Checklist B item 6).
+    {
+      let assessment;
+      try {
+        const { assessStorySource } = require('./lib/story-provenance');
+        assessment = runFetchFailed
+          ? { trusted: false, label: 'run-fetch-failed',
+              reason: runFetchFailed === 'mismatch'
+                ? 'the server answered for a different run, so this run\'s config was never read'
+                : 'this run\'s config could not be read, so nothing is known about where its story text came from' }
+          : assessStorySource(runConfig?.story_source, runStoryId);
+      } catch (e) {
+        assessment = { trusted: false, label: 'assessment-failed',
+          reason: `story provenance could not be assessed: ${e.message}` };
+      }
+      if (!assessment.trusted && !opts.trustSource) {
+        emit({ ok: false, reason: 'untrusted_source', detail: assessment.reason },
+          `✗ refusing to emit: ${assessment.reason}\n`
+          + '  No branch was created and nothing was executed.\n'
+          + `  Read it:  hone show step ${workflowId} ${opts.stepKey}\n`
+          + `  Then:     hone emit-pr ${workflowId} --trust-source`);
+        process.exit(EXIT.UNTRUSTED_SOURCE);
+      }
+    }
+
     // 2. Materialize the diff (shared with check-patch/verify-patch,
     // followup-23/27). Condition 7 presupposes 5.
     const blocks = extractFileBlocks(output);
+    // HC-GF-191: the parser had to look outside `## Changed Files` to find anything. Say so —
+    // silently re-scoping is how a finished build came back as "no file changes to verify".
+    if (blocks.scopeFallback) console.warn(`  ⚠ ${blocks.reason}`);
     const hasWork = hasMaterializableWork(blocks);
     if (blocks.noChanges || !hasWork) {
       emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
@@ -8078,9 +8562,11 @@ program
 
     // 4. Isolated worktree with a NAMED branch off HEAD (adopter tree untouched).
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-emit-'));
-    const diffFile = path.join(os.tmpdir(), `hone-emit-${Date.now()}.diff`);
+    // HC-GF-304: see verify-patch. emit-pr would COMMIT the other invocation's patch onto this run's branch.
+    const diffTmp = require('./lib/private-temp').privateTempFile('hone-emit-diff', 'patch.diff');
+    const diffFile = diffTmp.file;
     fs.writeFileSync(diffFile, diff);
-    const { command, source: commandSource } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess
+    const { command, source: commandSource, replaced: commandReplaced } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess; HC-GF-223: `replaced` says what an override skipped
     // `worktree add -b` creates the branch ref BEFORE apply/verify. If we bail
     // before a successful commit (apply fails, verify fails), that empty branch
     // (pointing at HEAD) must be torn down too — else "a failing diff never
@@ -8097,7 +8583,7 @@ program
         try { execFileSync('git', ['branch', '-D', branch], { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' }); } catch { /* best-effort */ }
       }
       try { fs.rmSync(wt, { recursive: true, force: true }); } catch { /* best-effort */ }
-      try { fs.unlinkSync(diffFile); } catch { /* best-effort */ }
+      diffTmp.remove();
     };
     process.on('SIGINT', () => { cleanup(); process.exit(130); });
 
@@ -8128,23 +8614,48 @@ program
           // HC-COMM-010-followup-6: a bare worktree has no dependencies — provision it
           // (link the repo's node_modules when the lockfile is unchanged, else run the
           // lockfile's install, or ci.install_command). Fail-open; --no-provision opts out.
+          // HC-GF-201: declared OUTSIDE the guard — the verdict needs provisioning state,
+          // and with --no-provision there is none, which is not the same as a failure.
+          let provAll = null;
           if (opts.provision !== false) {
-            const { planProvision, provisionWorktree } = require('./lib/worktree-provision');
+            const { planProvision, discoverPackageRoots, provisionAllRoots } = require('./lib/worktree-provision');
             const { readCIConfigDetails } = require('./lib/pipeline-config');
-            const plan = planProvision({ worktreeDir: wt, parentDir: process.cwd(), installCommand: readCIConfigDetails(process.cwd()).install_command });
-            const prov = provisionWorktree(plan, { worktreeDir: wt, exec: spawnSync });
+            // HC-GF-201: provision EVERY package root, not just the worktree's top level.
+            // This repo has three; the two skipped are where ci.unit runs, so their absent
+            // modules surfaced as `Cannot find module` and were counted as the PATCH failing
+            // tests — a false RED on the merge-gating verdict (run b3117bde, 2026-09-20).
+            const installCmd = readCIConfigDetails(process.cwd()).install_command;
+            const provEntries = discoverPackageRoots(wt).map((root) => ({
+              root,
+              worktreeDir: root === '.' ? wt : path.join(wt, root),
+              exec: spawnSync,
+              plan: planProvision({
+                worktreeDir: root === '.' ? wt : path.join(wt, root),
+                parentDir: root === '.' ? process.cwd() : path.join(process.cwd(), root),
+                installCommand: root === '.' ? installCmd : undefined,
+              }),
+            }));
+            provAll = provisionAllRoots(provEntries);
+            const prov = { ok: provAll.ok,
+              summary: provAll.results.map((r) => `${r.root}: ${r.summary}`).join('; ')
+                + (provAll.ok ? '' : ` — NOT RUN: ${provAll.unprovisioned.map((u) => u.root).join(', ')} could not be provisioned`) };
             if (opts.format !== 'json') console.log(`  provisioning: ${prov.summary}`);
           }
           if (opts.format !== 'json') console.log(`  verifying: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
           const run = spawnSync(command, {
             cwd: wt, shell: true, encoding: 'utf8',
-            timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
+            timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
             stdio: ['ignore', 'pipe', 'pipe'],
           });
           const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource });
-          if (v.verdict === 'pass') {
-            verifyState = 'pass';
+          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced }, provAll);
+          // HC-GF-223: the mapping lives in cli/lib/emit-pr.js so it is testable. Before it, a
+          // narrowed verdict fell into the else below, which printed "verify failed, no branch
+          // emitted" and then exited with that verdict's own exit code — zero. A failure path that
+          // exits 0 is the HC-GF-207 shape this session opened by fixing.
+          const emitState = verifyStateFor(v.verdict);
+          if (emitState) {
+            verifyState = emitState;
           } else {
             verifyOk = false;
             // HC-GF-008: a command that never started is not a failed verify.
@@ -8160,14 +8671,15 @@ program
           // 4c. Commit the applied diff onto the branch, inside the worktree.
           // No summary source (GET /orchestrate omits config/story text), so the
           // commit subject falls back to the storyId + default in buildCommitMessage.
-          const message = buildCommitMessage({ storyId, summary: '', workflowId, headSha, verifyState });
-          const msgFile = path.join(os.tmpdir(), `hone-emit-msg-${Date.now()}.txt`);
+          const message = buildCommitMessage({ storyId, summary: '', workflowId, headSha, verifyState, replacedCommand: commandReplaced && commandReplaced.command });
+          const msgTmp = require('./lib/private-temp').privateTempFile('hone-emit-msg', 'message.txt');
+          const msgFile = msgTmp.file;
           fs.writeFileSync(msgFile, message);
           try {
             execFileSync('git', ['-C', wt, 'add', '-A'], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
             execFileSync('git', ['-C', wt, 'commit', '-F', msgFile], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
             committed = true; // the branch now holds the deliverable — keep it past cleanup
-          } finally { try { fs.unlinkSync(msgFile); } catch { /* best-effort */ } }
+          } finally { msgTmp.remove(); }
 
           const stat = (() => {
             try {
@@ -8191,8 +8703,9 @@ program
             }
           }
           if (pushed && doOpenPr) {
-            const prBody = buildPrBody({ storyId, workflowId, headSha, verifyState, command: doVerify ? command : undefined });
-            const bodyFile = path.join(os.tmpdir(), `hone-emit-prbody-${Date.now()}.md`);
+            const prBody = buildPrBody({ storyId, workflowId, headSha, verifyState, command: doVerify ? command : undefined, replacedCommand: commandReplaced && commandReplaced.command });
+            const bodyTmp = require('./lib/private-temp').privateTempFile('hone-emit-prbody', 'body.md');
+            const bodyFile = bodyTmp.file;
             fs.writeFileSync(bodyFile, prBody);
             const title = `${storyId}: Hone step_4 change (workflow ${String(workflowId).slice(0, 8)})`;
             const ghArgs = ['pr', 'create', '--head', branch, '--title', title, '--body-file', bodyFile];
@@ -8206,7 +8719,7 @@ program
               emit({ ok: false, verdict: 'publish_failed', stage: 'open_pr', detail, branch },
                 `✗ branch pushed, but opening the PR failed: ${detail}\n  → open it manually, or check \`gh auth status\`.`);
               exitCode = EXIT.PUBLISH_FAILED;
-            } finally { try { fs.unlinkSync(bodyFile); } catch { /* best-effort */ } }
+            } finally { bodyTmp.remove(); }
           }
 
           if (exitCode === EXIT.PASS) {
@@ -8254,6 +8767,17 @@ program
   .option('--format <fmt>', 'pretty or json', 'pretty')
   .action(async (prOrBranch, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
+    // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
+    // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
+    // deep in child_process, and a blank value coerces to 0 and kills the
+    // command the instant it starts.
+    let timeoutMs;
+    try {
+      timeoutMs = parseTimeoutSeconds(opts.timeout) * 1000;
+    } catch (e) {
+      console.error(e.message);
+      process.exit(2);
+    }
     const { readCIGateConfig } = require('./lib/pipeline-config');
     const { extractStoryIdFromBranch } = require('./lib/pipeline-status');
     const { EXIT, resolveGateMode, interpretGhChecks, ciGateVerdict, renderStep5cArtifact } = require('./lib/verify-pr');
@@ -8275,15 +8799,19 @@ program
     const mode = resolveGateMode(opts.mode, configGate);
 
     // 3. Skill audit — reuse the working `hone step-5b` command (deterministic
-    //    SA-001 engine over the PR diff). Informational; never affects the exit.
+    //    SA-001 engine over the PR diff). HC-GF-227: its BLOCKER verdict (exit 2) fails this command
+    //    too, once the CI gate itself has passed; any other failure to run it is reported, not a verdict.
     let skillAudit = { ran: false };
     if (!opts.skipSkillAudit) {
+      const artifact = `.github/pipeline/${storyId}/step-5b-skill-audit.md`;
       try {
         execFileSync(process.execPath, [__filename, 'step-5b', '--story-id', storyId, '--base', opts.base],
           { cwd: repoRoot, env: process.env, stdio: opts.format === 'json' ? 'ignore' : 'inherit' });
-        skillAudit = { ran: true, artifact: `.github/pipeline/${storyId}/step-5b-skill-audit.md` };
+        skillAudit = { ran: true, artifact };
       } catch (e) {
-        skillAudit = { ran: true, error: (e.message || '').split('\n')[0] };
+        skillAudit = e.status === STEP_5B_BLOCKED
+          ? { ran: true, blocked: true, artifact }
+          : { ran: true, error: (e.message || '').split('\n')[0] };
       }
     }
 
@@ -8314,7 +8842,7 @@ program
       if (opts.format !== 'json') console.log(`  running local CI: ${command} (timeout ${opts.timeout}s)`);
       // HC-GF-008: the adopter's own command, without make state inherited from whoever ran hone.
       const { verifyCommandEnv } = require('./lib/verify-patch');
-      const run = spawnSync(command, { cwd: repoRoot, shell: true, encoding: 'utf8', timeout: Number(opts.timeout) * 1000, stdio: ['ignore', 'inherit', 'inherit'], env: verifyCommandEnv(gitEnv()) });
+      const run = spawnSync(command, { cwd: repoRoot, shell: true, encoding: 'utf8', timeout: timeoutMs, stdio: ['ignore', 'inherit', 'inherit'], env: verifyCommandEnv(gitEnv()) });
       local = { code: run.status == null ? 1 : run.status, timedOut: !!(run.error && run.error.code === 'ETIMEDOUT') };
     }
 
@@ -8354,14 +8882,16 @@ program
       }
     }
 
-    // 7. Report. The exit code is the CI verdict's; the skill audit is advisory.
+    // 7. Report. A failing CI gate keeps its own exit code; when CI passed, a BLOCKER skill assertion
+    //    fails the command with EXIT.SKILL_BLOCKER (HC-GF-227). The report sent above is the CI gate's.
+    const exitCode = verdict.exitCode === EXIT.PASS && skillAudit.blocked ? EXIT.SKILL_BLOCKER : verdict.exitCode;
     const sym = (verdict.verdict === 'pass' || verdict.verdict === 'disabled') ? '✓' : verdict.verdict === 'pending' ? '⏳' : '✗';
     emit(
-      { ok: verdict.exitCode === EXIT.PASS, storyId, mode, skillAudit, ciGate: verdict, gh, local, reported },
+      { ok: exitCode === EXIT.PASS, exitCode, storyId, mode, skillAudit, ciGate: verdict, gh, local, reported },
       `${sym} CI gate (${mode}): ${verdict.verdict} — ${verdict.detail}\n` +
-      `  skill audit: ${opts.skipSkillAudit ? 'skipped' : (skillAudit.artifact || skillAudit.error || 'done')}\n` +
+      `  skill audit: ${opts.skipSkillAudit ? 'skipped' : skillAudit.blocked ? `✗ BLOCKER finding(s) — ${skillAudit.artifact}` : (skillAudit.artifact || skillAudit.error || 'done')}\n` +
       `  → .github/pipeline/${storyId}/step-5c-ci.md`);
-    process.exit(verdict.exitCode);
+    process.exit(exitCode);
   });
 
 // ── CLI setup ─────────────────────────────────────────────────────────────────