@mmerterden/multi-agent-pipeline 16.20.0 → 16.23.0

package/CHANGELOG.md

@@ -16,6 +16,65 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [16.23.0] - 2026-09-09
+
+### Fixed
+
+- **The progress signal reached stdout and stopped there.** `phase-tracker.sh render` prints a bordered card at every phase boundary and it was always correct on disk. It was also invisible: the hosts collapse tool output into `Ran 8 shell commands`, so the card the contract calls "the last tool result in the chat" has not been in the chat for a while. A run showed its pickers, went quiet for forty minutes, and finished without ever drawing its shape.
+
+  Each host has a widget and now the tracker names its calls instead of hoping they are remembered. `phase-tracker.sh tiles` reads the phase set already registered by `add` and prints the registration calls for the host it runs from: a `TaskCreate` list on Claude Code, one `update_plan` payload on Codex, and on Copilot CLI - which has no task widget at all - the instruction to reprint the card inside the reply, plus the card. Every `update` then prints a `-- NEXT (required) --` block carrying that host's mirror call. Phase 0 Step −1 calls `tiles` right after the `add` loop; the Copilot instructions template does the same.
+
+- **`phase-tracker.sh tokens` was documented, linted for, and never called.** Not once: no run in the local log tree had a `tokens_in`, `tokens_out` or `model` field on any phase, going back weeks. Every phase priced at `-`, every required completion line printed without its numbers, and every gate stayed green - because `smoke-tracker-tokens-invocation.sh` lints that the phase docs _mention_ the call, which is a claim about prose, not about a run. `payload-contracts.md` had already written that limitation down.
+
+  The gate moved to where the call would have landed: `update <N> completed` now **exits 3** for phases 1-4 when nothing was recorded, prints the two commands that clear it, and leaves the phase exactly as it was - record, then re-run, nothing lost. A phase that genuinely ran no LLM call completes with `--no-llm`, which is recorded so the report can tell "nothing" from "unknown". Phases 0 and 5-7 are orchestration and are not gated, and `skipped` never is, because Short skips 1 and 2 by design.
+
+- **A full model id silently cost nothing.** `cost-table.json` is keyed by family (`opus`, `sonnet`, `gpt-5.6`) while the name an agent has at hand is `claude-opus-5`, and the mismatch priced the phase at `-` with no complaint anywhere. `model` now resolves the family and says so out loud, listing the priced names, when it cannot.
+
+### Added
+
+- **`phase-tracker.sh report` - the closing report the run never printed.** Per phase: status, elapsed, tokens in/out, model and USD; then the run total, and an explicit list of any phase it could not price rather than a silent gap. Phase 7 prints it beside `render-work-summary.sh` (scope delivered, changed files with line counts, PR and commit links) so the end of a run answers both questions at once - what the pipeline spent, and what it changed. `format_span` gives the total an hours bucket; the per-phase card keeps minutes.
+
+- **`smoke-tracker-widget.sh`** - 31 checks over the parts that were failing quietly: `tiles` emits the right call for each of the three hosts and starts at phase 0, the accounting gate fires and is recoverable, `--no-llm` is honoured and recorded, a full model id resolves to a priced family, every `update` carries its host's mirror call, the report prices what it can and names what it cannot, and the phase docs actually make these calls.
+
+### Removed
+
+- **The four `dev` redirect stubs are gone from the command surface.** `16.0.0` turned pipeline depth into a question the run asks at Phase 0 Step 7.5 and left `multi-agent-dev`, `multi-agent-dev-autopilot`, `multi-agent-dev-local` and `multi-agent-dev-local-autopilot` behind as stubs that printed a redirect and nothing else. Each one said, in its own body, that it would be deleted in the next minor. Twenty-one minors later they were still in the picker: typing `/multi-agent:` still offered `dev`, still described it as removed, and the description was the only thing it did.
+
+  Deleted from every surface that carries them - Claude Code commands, the shared skill tree, the Copilot dash-command skills, the Codex refs mirror - along with the generated indexes (`.skills-index.json`, `skills-index.md`, `shared/README.md`, `.skill-manifest.json`, now 207 skills rather than 211) and the migration lines in `multi-agent-help` and the Copilot instructions template. `smoke-pipeline-surface.sh` check 5b, the gate that fails when a shipped file points a reader at a retired name, loses the four exemptions that existed only because the stubs and their generated index rows were allowed to name themselves; it is strictly tighter now.
+
+  Nothing about the surface changes for anyone who has already migrated: the break shipped in `16.0.0`, this is the tombstone coming down. `/multi-agent` and `/multi-agent:local` still ask Full or Short, and Short is still what the removed flag used to mean.
+
+- **The four names themselves, everywhere they were still readable.** Deleting the directories left the names sitting in prose, and prose is what a user acts on. Gone from the dispatcher routing table (the `--dev` / `dev-*` redirect row), from `modes.md` and `phase-3-dev.md`, from `resume-local` and `local-autopilot` (which described themselves in terms of a command that no longer exists), and from the `ios-coding-standard` picker description, which had been telling readers to hand their remediation plan to `dev/dev-local` - a description is the one piece of a command everybody reads.
+
+  `examples/03-dev-mode-fast-path.md` was the worst of them and no gate could see it: `smoke-pipeline-surface.sh` check 2 scanned `pipeline/`, `docs/`, `install/` and `test/`, never `examples/`, so a whole worked example kept teaching `--dev` fourteen minors after the flag was removed - and contradicted itself while doing it, listing Phase 4 as skipped when Review has not been skippable since `14.0.0`. It is now `examples/03-short-run-fast-path.md`, written against the depth question, with the phase list and the transcript corrected. The `--dev` invocations in examples 01 and 02 and in the bug-report issue template went with it.
+
+  With nothing left to detect, the deprecation-era gates came out too: `smoke-pipeline-surface.sh` loses check 2 (the `--dev` flag scan), check 5b (the retired-name scan) and both planted probes, and `smoke-mode-dispatch-drift.sh` loses the two loops that named the four modes - the generator's unknown-mode guard already covers them. The gate is 203 lines down to 98 and every remaining check asserts something that can still be false.
+
+  Left alone on purpose: `CHANGELOG.md`, `CHANGELOG-archive.md`, `ROADMAP.md`, `docs/internal/` and the calibration log in `token-budget.json` are history, and rewriting them would misrepresent what shipped when. So is the runtime label `"dev"` that `state.onlyDevelop` still produces for the cost report and the component-dispatch payload: that is a run shape, not a command name, and renaming it would break the plugin contract and orphan every log already written.
+
+## [16.21.0] - 2026-09-08
+
+### Added
+
+- **A read-size gate, and a cheap worker to send an oversized read to.** `offload-ref.sh` took half the machinery bill in 15.10.0 - the build log, the diff, the test output become a pointer plus a tail. The other half was never looked at, because nothing could look at it: only a `PreToolUse` hook sees a tool call before it runs. A phase that reads six 900-line files pays for 5,400 lines at that phase's own rung, and the part it needed was a handful of symbols.
+
+  `check-read-size.sh` (+ `check-read-size.py`, the decision core) is the third hook in `install/templates/claude-hooks.json` and the first on the READ side. `bulk-read.sh` is where a blocked read goes instead: the file reaches a haiku-rung worker over the `bulk-reader` persona, and what comes back is a structured summary with LINE NUMBERS, so the caller's next step is a bounded `Read(offset:limit:)` around the region that matters - which is cheap, exact, and passes the gate. The full text is parked under `.multi-agent/refs/`, the same place and the same promise `offload-ref.sh` makes.
+
+  **`observe` is a real mode, not a debug flag.** It decides and logs, blocks nothing, and it is what `bulkRead.mode` should be set to first: a gate switched straight to `enforce` has no baseline to be compared against, and "we cut tokens" becomes a claim nothing can check. The saving is measured from `metrics.jsonl` (`read.observed` / `read.blocked` / `bulk_read.delegated`), not asserted here - this entry deliberately quotes no percentage.
+
+  **Phase 3 is exempt, and that is load-bearing.** Claude Code's `Edit` requires the same file to have been `Read` first, so a gate that blocks reads while code is being changed blocks the change. So does any file the run itself has touched (`phases[n].files[]`). The gate is for the phases that read to UNDERSTAND. A draft of the decision core read `run.phase` and `dev.editSet` - neither of which `agent-state.schema.json` declares - so the exemption could never have engaged and development would have been blocked by a hook whose message read like advice; `smoke-bulk-read.sh` now asserts the field names against the schema so it cannot come back quietly.
+
+  **A ceiling, because delegation is not free either** (`bulkRead.maxBytes`, default 1 MB). Past some size the worker's own input bill approaches the read it replaced, and a file large enough to strain its window comes back truncated - a partial summary presented as a whole one is the one thing this feature must never produce. Over the ceiling the caller is told to narrow first (grep, then a bounded read). The check runs BEFORE the file is hashed or parked, so the guard is not theatre.
+
+  **The command parser is per-tool, because the flags are not shared.** `cat -n` NUMBERS LINES rather than taking a count, and reading its next token as one swallowed the filename, left no operand, and let `cat -n <bigfile>` through the gate entirely. `sed -n '1,900p'` looked bounded because it carried a flag, when the range in its script IS the bound. An unparseable count reads as UNBOUNDED, never as 1. A `tail -f` is a stream and passes, because blocking it would be a false positive with no cheap alternative to offer.
+
+  Off by default (`bulkRead.mode: "off"`), so merging the hook block is not itself a behaviour change. The worker degrades rather than inventing: no CLI, no auth, a timeout, or a non-JSON answer prints why and tells the caller to do a bounded read. A fabricated summary of a file nobody read is the one outcome worse than paying full price for the file.
+
+### Changed
+
+- **`multi-agent:setup` Step 8 and the picker-contract stop miscounting the hooks.** Both said two gates ship, and the setup step called the secret scan "the only deterministic gate that is OS-enforceable as a hook" - untrue since `agent-guard.sh` landed. Three ship now, and both places say so, along with which side of the run each one inspects.
+- **`smoke-gate-hooks.sh` covers all three gates** rather than two, and asserts the shipped defaults are safe (the read gate off, phase 3 exempt) - a read gate that shipped switched on would have been a breaking change disguised as a merge.
+
 ## [16.20.0] - 2026-09-07
 
 A comparison against `msitarzewski/agency-agents`, a 150k-star persona catalog, found nothing to copy wholesale and three things to fix: the personas were never registered, the circuit-breaker was prose, and a review finding had no identity from one round to the next. This release gives findings that identity and builds the loop controls, the handoff records and the evidence rules on top of it.
@@ -151,7 +210,6 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 
 - **Usage reporting only ever reported runs that finished.** The reporter was called from Phase 7, and Phase 7 is the phase a run is least likely to reach: across the whole local log history, exactly one run got there. So the admin dashboard read zero of everything while the table held real rows, and the question it exists to answer - who is using this - had no answer. Phase 0's exit gate now reports the run as started, on the same upsert key, so Phase 7 replaces that row with the final state and nothing is double-counted. The read side of the same bug is fixed in the dashboard: its rollup folded only `terminal` rows, and an unfinished run was scored `fail`.
 
-
 ### Changed
 
 - **`/multi-agent:help` now covers the plugins and the toolkit MCP.** It named both in passing - a `refactor` line, a `sync` line, a `design-check` footnote - and never said what they are or how to call one. The catalog gained a Plugins & tools block in both languages: how a stack skill is invoked, which plugins are always on, and the MCP's 83 tools grouped by what they drive (device control, web, design comparison, store and accessibility audits), with the note that its registration survives uninstall. Paid for by compressing the `design-check` entry, which was restating its own contract in fifteen lines: 353 tokens reclaimed before a byte was added, so the file sits within its 8500 ceiling. The tool count that went in with it was wrong and is now absent: `rules/outside-the-pipeline.md` said 83 while the server serves 84, and the pipeline cannot check either number because it does not vendor the toolkit. Both places now say 80+, which stays true; the exact count lives in the toolkit's own README, where a gate boots the server and compares `tools/list` against it.
@@ -173,22 +231,21 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 
 ### Added
 
-- **`/multi-agent:graph`  -  a deterministic code graph, built without an LLM.** Phase 1 re-scanned the repo with grep and read on every task and defaulted to the "very thorough" tier on feature work; Phase 7 wrote `architecture.md` from one task's window and let it age for 90 days. Both wanted the same answer: where does this live, and what depends on it. `graph-build.mjs` extracts symbols, imports and references by regex over comment-stripped source into `~/.claude/knowledge/<project>/code-graph.json`; `graph-query.mjs` runs a token-budgeted traversal, `graph-affected.mjs` walks it backwards for impact, `graph-report.mjs` renders `GRAPH_REPORT.md`, and `validate-code-graph.mjs` fails a build whose edges point at missing nodes. Zero runtime dependencies, zero API cost, read-only on the repo. Design reference: `Graphify-Labs/graphify`; the reasoning, the trade and the numbers are in `docs/adr/0010-own-code-graph.md`.
+- **`/multi-agent:graph` - a deterministic code graph, built without an LLM.** Phase 1 re-scanned the repo with grep and read on every task and defaulted to the "very thorough" tier on feature work; Phase 7 wrote `architecture.md` from one task's window and let it age for 90 days. Both wanted the same answer: where does this live, and what depends on it. `graph-build.mjs` extracts symbols, imports and references by regex over comment-stripped source into `~/.claude/knowledge/<project>/code-graph.json`; `graph-query.mjs` runs a token-budgeted traversal, `graph-affected.mjs` walks it backwards for impact, `graph-report.mjs` renders `GRAPH_REPORT.md`, and `validate-code-graph.mjs` fails a build whose edges point at missing nodes. Zero runtime dependencies, zero API cost, read-only on the repo. Design reference: `Graphify-Labs/graphify`; the reasoning, the trade and the numbers are in `docs/adr/0010-own-code-graph.md`.
 - **Phase 1 Step 2.6 and Phase 7 graph refresh, behind `prefs.global.codeGraph.enabled` (default `false`).** When on, Phase 1 queries the graph and hands Explore a ranked starting set instead of a full scan, and Phase 7 rebuilds the graph after the branch changed code. Off, the pipeline behaves exactly as before. Measured on a 4,300-file Swift app at a fixed 30k retrieval budget: 80.4% coverage at 18,465 tokens against 66.0% at 24,555 for grep-and-read. The win is entirely in domain-word searches (63.3% vs 32.0% at under half the cost); when the task already names an exact type, `grep -lw` is still slightly better and slightly cheaper, and the command says so.
 - **`_path-match.mjs`.** The glob matcher `test-gap-scan.mjs` carried inline is now shared with the graph engine, so the two cannot drift apart on what a repo excludes.
 - **Code-graph rules for Android, Node and Python.** Four stacks now build: measured on a 4,229-file Kotlin app (25,234 nodes, 70,897 edges), this repo (126 sources) and a 43-file Python service, each validated and each hub list checked by hand rather than assumed correct. Two engine defects surfaced doing it, both of which iOS had been getting away with. Nesting was read from the pattern's match column, so `public final class Foo` counted as nested because the match starts at `class` seven columns in; it now reads the line's indentation. And the import pass read a fully stripped body, which blanks a JavaScript module specifier because the specifier IS a string literal - every import edge in that stack would have vanished with nothing to notice it. iOS was re-gated after both and scored identically (80.4% at 18,467 tokens).
 - **A nested declaration is a node but never a reference target.** Kotlin sealed cases and Python inner classes are named after the concept they model - `Icon`, `Color`, `Success`, `Disabled` - and each is declared exactly once, so the ambiguity rule never caught them. Every Kotlin file that merely mentioned Compose's `Color` gained an edge to one app's nested case: 4,072 false edges out of 74,969, and four of the top eight architectural hubs were wrong. They stay findable by name through their `defines` edge.
-- **`prefs.global.modelFallback.fableEnabled` (default `true`)  -  the fable rung as a switch, not only as a fallback.** Every other trigger in the fallback contract reacts to something going wrong; this one asserts up front that a rung is not in play, so there is no dispatch attempt and no error to recover from. `false` starts `ios/android/backend-architect`, `code-reviewer` and triage on `opus`. Claude Code only: Copilot CLI does not offer Fable 5, and on Codex CLI the `fable` rung means `gpt-5.6 @ xhigh`, a different vendor's model on a different account, which the switch deliberately leaves alone. Turning it off also collapses the Phase 4 Claude Code panel to two reviewers, because Reviewer 1 lands on the `opus` Reviewer 2 already holds and one model dispatched twice is not cross-model review; `consensus.reviewerCount` records `2`. Set `costBudget.priceAt` to `opus` alongside it, or the estimate keeps pricing at a rung nothing runs on and trips the ceiling early.
+- **`prefs.global.modelFallback.fableEnabled` (default `true`) - the fable rung as a switch, not only as a fallback.** Every other trigger in the fallback contract reacts to something going wrong; this one asserts up front that a rung is not in play, so there is no dispatch attempt and no error to recover from. `false` starts `ios/android/backend-architect`, `code-reviewer` and triage on `opus`. Claude Code only: Copilot CLI does not offer Fable 5, and on Codex CLI the `fable` rung means `gpt-5.6 @ xhigh`, a different vendor's model on a different account, which the switch deliberately leaves alone. Turning it off also collapses the Phase 4 Claude Code panel to two reviewers, because Reviewer 1 lands on the `opus` Reviewer 2 already holds and one model dispatched twice is not cross-model review; `consensus.reviewerCount` records `2`. Set `costBudget.priceAt` to `opus` alongside it, or the estimate keeps pricing at a rung nothing runs on and trips the ceiling early.
 
 ### Fixed
 
 - **`derivedSkillSources` could not say which repo held the derived copies.** `localPath` reads as relative to the current repo, so both entries pointed at the UPSTREAM tree and stayed wrong through a plugin rename: the drift check was comparing a path that did not exist. Added `localRepo`, corrected both entries, and re-derived their skill lists from the tree instead of from memory.
 - **Two `excludePathGlobs` shapes were silently inert.** A pattern with a wildcard and no `**` fell through to a literal `endsWith` / `includes` test against the pattern text, which can never be true: nothing ends with the characters `*.d.ts`. So `*.d.ts` in the node rules and `*.egg-info/` in the python rules excluded nothing, and generated typings and build residue reached every consumer of those rules, `test-gap-scan.mjs` included. Both shapes now translate to an anchored regex, and eight glob cases are pinned by the smoke.
 - **`--all-data` left the knowledge base behind.** Full uninstall removed the log root and the per-repo memory root but never `~/.claude/knowledge/`, which holds `architecture.md`, `patterns.md`, `gotchas.md`, `decisions.md` and now `code-graph.json`. That is prose about a private codebase plus every symbol name in it, and it is the data a user most likely means by "remove everything". A default uninstall still keeps all of it, and memory written inside a repo (`$PROJECT_ROOT/.multi-agent/memory/`) is still never touched by either mode: it lives in the user's working tree and may be committed.
-- **`modelFallback.floorModel` could not be set.** The fallback contract has documented it since the two-step ladder landed, but it was absent from `prefs.schema.json`, whose `modelFallback` object forbids extra keys  -  so a prefs file that followed the documented example failed validation. Declared, defaulted to `haiku`, and added to the template.
+- **`modelFallback.floorModel` could not be set.** The fallback contract has documented it since the two-step ladder landed, but it was absent from `prefs.schema.json`, whose `modelFallback` object forbids extra keys - so a prefs file that followed the documented example failed validation. Declared, defaulted to `haiku`, and added to the template.
 - **The consensus rule still claimed two reviewers on Claude Code.** v16.12.0 added the third reviewer and updated the matrix but not the `reviewerCount` line 300 lines below it. `smoke-cross-cli-behavior.sh` reads the matrix, so it never noticed. The line now says what it should have said all along: the count is the reviewers that actually dispatched, not the configured maximum.
 
-
 ## [16.12.0] - 2026-08-27
 
 ### Added
@@ -217,14 +274,13 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 - The analysis ref ceiling moves 148000 -> 154000 across two raises in one session. Everything that could live outside the count already does: the scan in `figma-screenshot.sh`, the reviewer rubric in `analysis/review.md` which a subagent loads and the orchestrator does not, and all four new gates in `validate-analysis-doc.mjs`. The tree was measured for reclaimable duplication first and had none.
 - `smoke-validate-analysis-doc.sh` replaces four section-number pairing assertions with the `AS-NN` contract in both directions.
 
-
 ## [16.11.0] - 2026-08-27
 
 ### Changed
 
 - **Picker option labels now follow `outputLanguage`.** Only the `AskUserQuestion` `header` chip stays English, because it is capped at 12 characters and most Turkish equivalents overflow it. A Turkish run used to render a Turkish question with English buttons, which reads as a half-translated dialogue rather than a contract. `rules.md` carries the new per-field matrix; `picker-contract.md` carries what the caller now owns: branch on which option was picked, never on its rendered text, and pass `default` / `ASK_CHOICE_DEFAULT` as a 1-based index. The host's own **Other** row is injected in English and no run can localize it.
 - **`Frontend` is `Web` across the pipeline** - the platform picker, the stack command, the schemas, the conventions tables, the phase docs and `frontend-guide.md`, now `web-guide.md`. The published `ai-frontend-toolkit` plugin id, the `frontendRepos` / `frontendRoots` prefs keys and the `frontend` stack alias all keep working: `web` is canonical and `frontend` still resolves, so nothing written before this release stops loading. `webRepos` / `webRoots` are the new spelling; the old pair is documented as deprecated rather than removed.
-- **A repo-less analysis run keeps its channel split.** It used to flatten everything into one document because there were no repo conventions to project onto. But a phone screen and a browser screen carry different requirements whether or not a repository exists; only the *projection* half of the split needed conventions. Channels are now derived from the evidence (`intake.md` Step 3 carries the signal table) and one document is emitted per channel. `mobile` stays one channel rather than iOS plus Android, since without conventions nothing tells the two apart.
+- **A repo-less analysis run keeps its channel split.** It used to flatten everything into one document because there were no repo conventions to project onto. But a phone screen and a browser screen carry different requirements whether or not a repository exists; only the _projection_ half of the split needed conventions. Channels are now derived from the evidence (`intake.md` Step 3 carries the signal table) and one document is emitted per channel. `mobile` stays one channel rather than iOS plus Android, since without conventions nothing tells the two apart.
 
 ### Fixed
 
@@ -246,7 +302,6 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 - The analysis ref ceiling moves 145000 -> 148000. Unlike the v16.6.0 raise this one is not compensating for a measurement error: the tree gained three features and the number is right. About 1.4 kB of new prose was trimmed back before the ceiling was touched.
 - `smoke-language-matrix.sh` and `smoke-language-axis.sh` now assert the new rule in both directions - label follows `outputLanguage`, header stays English - and three more phrasings were added to the contradiction list after one slipped past the old set.
 
-
 ### Fixed
 
 - **The website sync committed under whatever identity the run carried, and the site silently stopped updating.** Step 4 ran a bare `git commit`, so the commit took the active account's address. The deploy platform builds only a commit whose author is a contributor on the project; any other author is accepted by the push and then never built - the deployment is created, reports `readyState: BLOCKED` (rendered by the CLI as `UNKNOWN` with a 0ms build), and the live site keeps serving the previous version. v16.4.0 and v16.5.0 were both pushed that way, neither was ever built, and both syncs reported the website as done.
@@ -261,7 +316,7 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 
 ### Fixed
 
-- **`write-state.mjs` could delete a live lock and lose a writer's update.** The stale-lock reclaim deleted by path: between judging a lock stale and unlinking it, the holder can release and a third writer can acquire a fresh one, so the unlink removed a *live* lock and two writers then held it. It is the same failure the PID-window comment in that file already describes, at a different point in the acquire loop, and it survived because it only reproduces under load - `smoke-write-state.sh` failed inside a full gate run and passed 12/12 when run alone. Reclaim is now by identity: the inode and mtime judged stale must still be the file at that path, otherwise it belongs to somebody else and is left alone. Twelve runs under artificial load are clean, which is evidence and not proof - a race cannot be proven absent.
+- **`write-state.mjs` could delete a live lock and lose a writer's update.** The stale-lock reclaim deleted by path: between judging a lock stale and unlinking it, the holder can release and a third writer can acquire a fresh one, so the unlink removed a _live_ lock and two writers then held it. It is the same failure the PID-window comment in that file already describes, at a different point in the acquire loop, and it survived because it only reproduces under load - `smoke-write-state.sh` failed inside a full gate run and passed 12/12 when run alone. Reclaim is now by identity: the inode and mtime judged stale must still be the file at that path, otherwise it belongs to somebody else and is left alone. Twelve runs under artificial load are clean, which is evidence and not proof - a race cannot be proven absent.
 
 - **Counts that had drifted from the tree.** `skills-index.md` and `skills/shared/README.md` still said 208 skills against 210 on disk; both are generated, so they were regenerated rather than hand-edited. `/multi-agent:update` quoted "245 scripts, 208 skills" for what an install lays down; it is 263 and 210. A comment in `smoke-command-inventory.sh` used "51 commands" as its example, which is the kind of number that goes stale the moment a command lands - it now says what it means without pinning a figure.
 
@@ -271,7 +326,7 @@ Three debts the last few releases kept naming, closed.
 
 ### Added
 
-- **`smoke-help-sync.sh` pairs each command's own description with the line `/multi-agent:help` shows for it.** Three releases running shipped the same defect: 16.7.1 (two commands absent from help entirely), 16.8.1 (the analysis entry describing behaviour from two releases earlier), 16.9.0 (a telemetry block still saying "optional, opt-in" after the default flipped). Every other gate was green through all three, because none of them asked whether the sentence a user reads still matches what the command does. The gate hashes both sides and fails when one moved without the other. Its limit is written into the file: it cannot tell whether either text is *correct* - a maintainer who edits both to say something equally wrong still passes. What it forces is that the pair gets looked at together, which is exactly what did not happen those three times.
+- **`smoke-help-sync.sh` pairs each command's own description with the line `/multi-agent:help` shows for it.** Three releases running shipped the same defect: 16.7.1 (two commands absent from help entirely), 16.8.1 (the analysis entry describing behaviour from two releases earlier), 16.9.0 (a telemetry block still saying "optional, opt-in" after the default flipped). Every other gate was green through all three, because none of them asked whether the sentence a user reads still matches what the command does. The gate hashes both sides and fails when one moved without the other. Its limit is written into the file: it cannot tell whether either text is _correct_ - a maintainer who edits both to say something equally wrong still passes. What it forces is that the pair gets looked at together, which is exactly what did not happen those three times.
 
 ### Changed
 
@@ -286,7 +341,7 @@ Three debts the last few releases kept naming, closed.
 
 ### Added
 
-- **`/multi-agent:analysis` emits a run record.** It is a pipeline of its own now - its own phases, its own gates, its own report - but telemetry was only wired into the dev pipeline's Phase 7, so analysis runs were invisible. The panel showed dev work only, and the command people reach for *before* writing any code did not exist in the usage data. Phase 5 now writes its own `agent-state.json` through `write-state.mjs` (atomic, lock-guarded, so concurrent runs cannot wipe each other) and calls the reporter. `mode` carries the profile, which is what tells one analysis run from another: a `global` run and a `corporate` run are different work. `project` is `null` on a stack-optional run - there is no repository to name - and is digested before it leaves the machine either way. The reporter stays best-effort: a failure there never touches the run, whose summary is already printed.
+- **`/multi-agent:analysis` emits a run record.** It is a pipeline of its own now - its own phases, its own gates, its own report - but telemetry was only wired into the dev pipeline's Phase 7, so analysis runs were invisible. The panel showed dev work only, and the command people reach for _before_ writing any code did not exist in the usage data. Phase 5 now writes its own `agent-state.json` through `write-state.mjs` (atomic, lock-guarded, so concurrent runs cannot wipe each other) and calls the reporter. `mode` carries the profile, which is what tells one analysis run from another: a `global` run and a `corporate` run are different work. `project` is `null` on a stack-optional run - there is no repository to name - and is digested before it leaves the machine either way. The reporter stays best-effort: a failure there never touches the run, whose summary is already printed.
 
 ### Fixed
 
@@ -446,7 +501,7 @@ Four ideas taken from github/spec-kit, obra/superpowers, karpathy/llm-council an
   platform's promised files enter one denominator instead of the first one
   standing in for the run.
 - **A plan with zero steps passed.** `todos: []` reported `0/0 steps accounted
-  for` and exited 0, so a Phase 2 that produced nothing - or a state whose todos
+for` and exited 0, so a Phase 2 that produced nothing - or a state whose todos
   were cleared - read as a fully delivered plan. An empty plan is now exit 2,
   the same as a missing one.
 - **A malformed reviewer dispatch vanished.** A reviewer whose `findings` came
@@ -690,10 +745,12 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.21.0] - 2026-08-23
 
 ### Added
+
 - **A confirmation pass that shows what was derived and asks only what was not.** Phase 2 Step 0.9 runs before planning: the platform set, the seven convention groups, the existing components, the localization keys and the analytics events all came out of the repos in Phase 1, so they are shown for confirmation rather than asked. Only Section 20 rows are asked, through the resolve engine, one row with at most three source-labeled candidates plus Defer - and never an invented one. It sits here rather than in Phase 4 because Phase 4 runs after development, where an answer arrives too late to change anything.
 - A corrected derived value rewrites its Pass B footnote as `^[user-override: resolved <date>]` (Locked 24), so where a value came from stays traceable even after a human overrode it.
 
 ### Changed
+
 - **The analysis stopped asking for the platform.** Every repo selected in Phase 0 already carries a stack tag from the project scan, so the platform set is the distinct tags of the selected repos. It is derived and shown in the breadcrumb; the question survives only as a fallback for an untaggable repo or a user who wants fewer platforms than the repos imply.
 - **The analysis stopped asking for repos.** That was the third place asking the same thing - Phase 0 Step 2 selects projects, `_dev-context.md` adds editable siblings, and analysis re-derived its own list on top. Repos now come from Phase 0, and the platform-to-repo mapping falls out of the stack tags.
 - `prefs.projects[<key>].frontendRepos[]` moved into `_dev-context.md`. Only the analysis command read it, which meant the pipeline's own dev-context picker could never offer a frontend repo - they are rarely submodules, so submodule detection never finds them.
@@ -702,45 +759,54 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.20.0] - 2026-08-23
 
 ### Added
+
 - **The analysis can read a Word file now.** Nothing in the pipeline handled `.docx`, which is the format most feature specs actually arrive in - a spec had to be pasted or re-typed into Confluence before the analysis could cite it. `pipeline/lib/fetch-document.sh` handles `.docx`, `.pdf`, `.md` and `.txt`, as a local path or a URL, and the extractor gained a `document` type that recognises both. It is distinct from `generic-doc`, which is an HTML page: this one is a file that must be converted before it can be read.
 - **No new dependency for the common case.** A `.docx` is a zip, so `word/document.xml` is parsed with the python3 standard library the lib layer already requires; the same code path runs on macOS, Linux and Windows. Requiring pandoc or libreoffice would have been the wrong dependency for a tool that must work everywhere. PDF has no stdlib path: `pdftotext` is used when present and its absence is a soft skip (exit 6, `converter-not-available`), which on Windows is the normal case, not an error. The converter binary is configurable via `DOCUMENT_PDFTOTEXT`, which is also how the smoke exercises the degrade path without breaking `PATH`.
 - **The analysis test plan is now the TDD RED input.** Phase 3's pre-flight read the concept table and even claimed test method names come from the analysis, while nothing read Section 15 - so RED invented its own tests and the carefully written test matrix never reached development. Step 5b loads it into `state.dev.testPlan[]` and RED writes those rows. Phase 4 step 1.45 then cross-checks every planned row against a real test: missing is `important`, present-but-asserting-something-else is `blocking`. That is what makes "analysis quality is output quality" a finding rather than a slogan.
 
 ### Fixed
+
 - The local-document matcher also matched the path inside a URL, so `https://x/api.pdf` produced a phantom local file `//x/api.pdf`. Matches overlapping a URL span are skipped; the smoke asserts a document URL yields exactly one entry.
 
 ## [15.19.0] - 2026-08-23
 
 ### Added
+
 - **Business rules are written in EARS now.** Section 4.4 rule statements were free prose, so Locked 31's "two readers must not disagree on pass/fail" was carried only by the acceptance criterion, not by the rule it came from. EARS (Easy Approach to Requirements Syntax, IEEE RE'09, five patterns) fixes the clause order and the keyword set, which is what removes the ambiguity. EARS states the rule, Gherkin still states how you check it - Locked 13 widens, it does not change.
 - **Section 15.7, manual test scenarios.** The pipeline already emitted this format as the Jira test-scenario comment from `resume-local`; the analysis had no place for it, so the document a QA engineer needs was the one thing the spec did not carry. Defined once, read by both. Every MT row carries its `BR-` id, and the validator enforces it: a scenario nobody can trace to a rule is a scenario nobody can tell is stale.
 - **Section 6.X is the whole variant axis, not the part this screen used.** New Phase 1b.2 walks each Code Connect-bound instance to its main component and reads `componentPropertyDefinitions`, so "used subset" finally has a set to be a subset of. Locked 29 promised this table for four releases with no step that could produce it. It has to happen in Phase 1: Locked 30 forbids Figma access afterwards, so an axis missed here is missed for the run.
 - **Three layer headings**: `Bölüm A - Analiz` (what to build), `B - Teknik Analiz` (what is true), `C - Geliştirme Analizi` (how to build it), with a boundary rule - remove the row, what becomes unclear - and the corollary that A carries no technology name and C no business rationale. Additive `#` headings only: section numbers are referenced in 172 places including two validators, so nothing renumbers, and Confluence gains a two-level table of contents for free.
 
 ### Fixed
+
 - **A layer heading could have satisfied a required section.** `validate-analysis-doc.mjs` matched required sections by substring over every `#{1,3}` heading, so a layer named `Bölüm B - Mimari ve Teknik` would have reported the architecture requirement as met with Section 13 absent. The matcher now only reads numbered section headings. Caught while adding the headings, not after shipping them.
 
 ### Changed
+
 - UI test scenarios default ON for `taskType == component` and for any task carrying a Figma reference. They were opt-in everywhere, so UI work started with UI tests switched off.
 - The doc validator gained the 15.7 and 6.X rules; `smoke-validate-analysis-doc.sh` grew from 10 to 13 assertions, one per new contract, each planted-and-proven rather than asserted.
 
 ## [15.18.0] - 2026-08-22
 
 ### Added
+
 - **`/multi-agent:analysis` is a pipeline mode now, not a command standing beside the pipeline.** It runs on the same 8-phase machinery - tracker tiles, `:resume`, the cost ledger, the channels report - with four phases reinterpreted the way `--dev` reinterprets Phase 3: Phase 3 and Phase 5 skip, Phase 4 reviews the document instead of a diff, Phase 6 publishes instead of committing. Phase set 0/1/2/4/6/7, generated by `gen-mode-dispatch.mjs --mode=analysis` and drift-checked like every other mode.
 - Phase 4 in analysis mode asks reviewers one question: could an implementer build the right thing from this document alone? A finding is anything that would force them to guess. The Section 20 walk runs there too, and a deferred row reports `review_blocking` rather than quietly staying open.
 - No `local` or `autopilot` variant, on purpose: worktree isolation buys nothing when no code is written, and the intake, the convention preview and the open-question walk are interactive by nature.
 
 ### Changed
+
 - The engine keeps moving out of commands and into `multi-agent-refs/analysis/`: `intake.md` and `resolve.md` join `locked/evidence/synthesis/render`. `analysis-resolve` and pipeline Phase 4 now mount the same resolution walk instead of describing it twice, and `analysis/SKILL.md` fits under the 6000 hard cap that applied once its grace entry was retired.
 - Phase-doc token budget: total 54900 -> 55250. Compression came first and three times, twice on the new prose and once on old: both mode branches shrank by pointing at the refs that hold the actual walks, and the front-matter parse contract stopped being spelled out identically in two pre-flights.
 
 ## [15.17.0] - 2026-08-22
 
 ### Fixed
+
 - **The full pipeline demanded a document nothing produced.** Phase 2 and Phase 3 pre-flights have BLOCKED on `analysis/<feature-slug>-<platform>.md` since v9.0.0, and Phase 1 never wrote it - its output was `analysis.json`, a different artefact. So a full run either aborted at Phase 2 telling the user to go run `/multi-agent:analysis` by hand, or the model quietly ignored its own BLOCKING contract. Phase 1 Step 4 now produces the document, and both pre-flights read `state.analysis.docStatus` instead of guessing from the filesystem: `produced` / `reused` continue, `not-applicable` is a legitimate skip (bugfix or chore with no Figma reference), and only a contract breach aborts. Neither phase sends the user to another command any more, because producing the file is Phase 1's job.
 
 ### Changed
+
 - **The analysis engine moved out of the command and into on-demand refs.** `multi-agent-refs/analysis/{locked,evidence,synthesis,render}.md` now carry the 31 Locked decisions, the evidence gathering, the two-pass synthesis and the render/publish flow. `/multi-agent:analysis` keeps them as its contract and Phase 1 loads the same four files, so there is one engine with two entry points rather than a command the pipeline cannot reach. Side effect worth naming: `analysis/SKILL.md` went from 18081 to 5974 tokens and its lint grace entry (ceiling 18500) is retired - the grace list only ratchets down.
 - Whether the document is produced is decided from signals Phase 0 already computed, so no new question: `feature` / `refactor` / `component` always, `bugfix` / `chore` only with a Figma reference. An existing document whose `evidence_digest` still matches is reused rather than regenerated (Locked 27).
 - `analysis-output.schema.json` gains `docStatus`, `docPath[]` and `openQuestions[]` - the fields the two pre-flights branch on.
@@ -749,18 +815,21 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.16.1] - 2026-08-22
 
 ### Fixed
+
 - **The humanizer punctuation check never ran on macOS.** Two SKILL files told the agent to verify the emitted document with `grep -P '[\x{2013}...]'`. BSD grep has no `-P`, so on the pipeline's primary platform the command errored out and "returns zero matches" was trivially true - the policy's only mechanical check was a shipped no-op. Both now call the deterministic Node validator that already implements the same policy (`validate-analysis-doc.mjs`, `validate-complaint-doc.mjs`), which behaves identically on macOS, Linux and Windows.
 - The repo already banned `grep -P` (`smoke-shell-portability.sh`, "no guarded form"), and that gate was green the whole time: it only scanned `*.sh`. A markdown instruction file is executed too - an agent reads `grep -P ...` and runs it verbatim - so the scanner now covers `commands/`, `multi-agent-refs/` and `skills/` markdown as well. It distinguishes a prohibition from an invocation, so a line that forbids the construct still passes. Adding it immediately surfaced a second instance in `complaint-analysis/SKILL.md` that no one had noticed, which is the argument for the gate.
 
 ## [15.16.0] - 2026-08-22
 
 ### Added
+
 - **More than one Firebase project per team.** `keychainMapping.firebase` held exactly one service-account key, which is wrong for the normal case: a legacy app next to its redesign, or staging next to production, each with its own key. A crash URL from the project you did not pick failed the `project_id` check and reported it as a configuration error, which it was, but not the one the message suggested. `global.firebase.accounts[]` maps `projectId` to a keychain key, `fetch-crashlytics.sh` reads the projectId out of the console URL and picks the matching account, and the single slot stays the fallback so a one-project setup needs no config at all. `/multi-agent:setup` now loops the Firebase pass (`Add another Firebase project? [y/N]`), reading `project_id` from each decoded JSON rather than asking for it.
 - A `project_id` mismatch now names the key it used and prints the `accounts[]` entry to add. With several projects in play, "project mismatch" alone does not say whether the URL is wrong or the mapping is incomplete.
 
 - **Jira project keys are discovered instead of recalled.** The token is saved and the host is known by the time setup asks for a project key, so it now asks Jira: one search for issues the person assigned or reported, most-recently-updated first, and the distinct project keys become a picker. A corporate instance has thousands of projects and a typed key is a typo that routes branches and new issues at the wrong board. The free-text prompt stays as the fallback for no-VPN and fresh accounts, and the per-repo mapping offers the discovered keys rather than asking for them again.
 
 ### Changed
+
 - `setup/SKILL.md` lost its third copy of the service-ID table and its second copy of the `keychainMapping` shape; both live in `refs/keychain.md`, which the flow already cites. What stayed is the column nothing else had: where to generate each token. The Firebase host-exemption note also stopped being stated twice, two paragraphs apart.
 - The App Store Connect tier reasoning moved into the ref that owns that flow, and `refs/keychain.md` gained the four App Store Connect standard key names so it is now the complete answer for every service setup points at.
 - `smoke-url-enrichment.sh` follows the type label to where it now lives and adds eight assertions: five for the multi-account contract (including that the single-slot fallback survives) and three for Jira discovery and the completeness of the key-name reference.
@@ -768,30 +837,36 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.15.0] - 2026-08-22
 
 ### Added
+
 - **Graylog has two instances now, because it always did.** Test and production are separate Graylog deployments, and a trx id minted by a tester does not exist in production - so searching production alone answered "no logs" for a complaint that was fully logged one host over, and that answer was indistinguishable from a genuine miss. `hosts.graylogTest` and the optional `keychainMapping.graylog_test` (which falls back to the production key, correct for shared-token deployments) make the second instance addressable. `fetch-graylog.sh --env auto` is the new default: production first, test when production returns nothing or is unreachable. `--env prod` / `--env test` pin one.
 - **The payload names the instance that answered** (`source.environment`, `source.searchedEnvironments[]`), and `/multi-agent:complaint-analysis` now has to cite it. A production complaint corroborated only by test logs is `insufficient-evidence`, not a confirmed `bff` fault, and the old payload gave the triage no way to tell those apart.
 - `/multi-agent:setup` asks for the two things the previous release added a consumer for but no collector: the Graylog test host plus its optional separate token, and `fortify.versionIds`. `versionIds` shipped in 15.14.0 as the only way to resolve an instance-id-only Fortify ticket, and nothing asked for it, so that path silently no-opped for everyone.
 - **`smoke-graylog-environments.sh`**, 15 assertions over the resolution rules that are easy to get subtly wrong: auto stops at production when production answers, falls back on empty AND on unreachable, degrades (never blocks) when both are down, treats a pinned environment with no host as exit 6 rather than silently searching the other one, and lets a 401 on one instance fall through instead of masking a working answer from the other.
 
 ### Fixed
+
 - A pinned `--env` with no configured host now exits 6 naming the exact pref, instead of falling back to whichever host happened to be set. Attaching test logs to a production complaint is worse than attaching none.
 
 ### Changed
+
 - `fetch-graylog.sh` resolves host and token per environment instead of once at the top, and reads prefs through one helper rather than three near-identical inline python blocks.
 
 ## [15.14.0] - 2026-08-22
 
 ### Added
+
 - **A release can now be required, not just available.** `/multi-agent:update` stays exactly what it was, and most releases change nothing: the run-start check keeps reading `dist-tags.latest` and keeps asking politely. What is new is a second tag. `npm dist-tag add <pkg>@<version> required` names the oldest version a user may run, and an install below that floor is not behind, it is wrong - it would produce work against a contract that no longer holds, which then has to be redone. Below the floor, Phase 0 Step 0.6 halts: it runs the update flow and stops, and the user re-issues the command on the new version. It does not continue on the freshly updated install, because this run's phase docs, refs and scripts were already loaded from the old one, and that is the drift the floor exists to prevent. Interactive and autopilot behave identically - there is nothing to decide.
 - **`require-supported-version.sh`** turns the signal into an exit code for shell callers: 0 = proceed, 3 = halt, with `force|<local>|<latest>|<required>` on stdout and a human block on stderr. It shares `update-check.sh`'s cache, so a second command inside the TTL window costs no network call.
 
 ### Fixed
+
 - **The Firebase Crashlytics fetcher called an endpoint that does not exist.** It built the app reference by hand as `<platform>:<bundle>` and asked for `/v1alpha/projects/<p>/apps/<ref>/issues/<issueId>`. The appId is opaque (`1:1234567890:ios:abcdef`) and cannot be derived from a bundle, and v1alpha has no get-issue-by-id route, so every fetch failed - and the failure was reported as `api-not-enabled`, which sent anyone debugging it to look at Google's API allowlist instead of at the URL. It now resolves the real appId through the Firebase Management API (`iosApps` / `androidApps`, matching `bundleId` / `packageName`), then reads `reports/topIssues` for the summary and metrics and `events?filter.issue.id=<id>` for the newest event. The payload gains what that event carries and the old shape could not: the full `stackTrace[]`, the breadcrumb and log timeline with screen names, session and occurrence counts, and the console URI. A multi-app project with no bundle match exits 3 as `app-not-found` rather than picking a neighbouring app.
-- **Fortify findings that arrive without a URL are no longer invisible.** A scanner-to-tracker bridge writes the instance id and the `file:line` into the ticket and never writes the SSC link - it knows the id, and the person reading the ticket never needed the URL. The extractor was URL-only, so those tickets produced an empty `contextLinks[]`, Phase 0 skipped the deep fetch, and Phase 4's Fortify gate reported `n/a` on a ticket that exists *because of* a security finding. It now also matches a labelled `Fortify Instance ID` / `issue instance id` / `fortify id` and emits a URL-less entry, the same shape graylog trx ids already used. `fetch-fortify.sh --instance-id <id>` resolves the project version by asking each id in `prefs.global.fortify.versionIds` in order. To stay off prose, the id must be at least 16 characters and contain a digit, and the bare label `instance id` is deliberately not matched.
+- **Fortify findings that arrive without a URL are no longer invisible.** A scanner-to-tracker bridge writes the instance id and the `file:line` into the ticket and never writes the SSC link - it knows the id, and the person reading the ticket never needed the URL. The extractor was URL-only, so those tickets produced an empty `contextLinks[]`, Phase 0 skipped the deep fetch, and Phase 4's Fortify gate reported `n/a` on a ticket that exists _because of_ a security finding. It now also matches a labelled `Fortify Instance ID` / `issue instance id` / `fortify id` and emits a URL-less entry, the same shape graylog trx ids already used. `fetch-fortify.sh --instance-id <id>` resolves the project version by asking each id in `prefs.global.fortify.versionIds` in order. To stay off prose, the id must be at least 16 characters and contain a digit, and the bare label `instance id` is deliberately not matched.
 - **`prefs.global.fortify` did not exist.** Phase 4 Gate 5 documented `fortify.alwaysCheck` as its opt-in from the day it shipped, but `global` is closed to additional properties and the schema had no `fortify` object, so setting it failed validation - the gate could only ever run off a referenced URL. The object now exists with `alwaysCheck` and `versionIds`.
 - Fortify URLs of the form `/ssc/html/ssc/version/<id>` and `#/version/<id>` now yield a version id. Only the API shape `/projectVersions/<id>` was matched before, so the UI links people actually paste parsed to `projectId: null`.
 
 ### Changed
+
 - `update-check.sh` reads both tags in one call and now uses the abbreviated packument (60 kB instead of 250 kB for the same answer). Its own contract is unchanged and deliberately so: it still always exits 0, still says nothing when the registry is unreachable, and still emits `<local>|<latest>` for a plain update. The floor appends a third field, `force`, which a `cut -f1`/`-f2` reader ignores. The cache file grows a third field too; a two-field cache written by an older install still reads, and its missing floor means "unknown", never "none".
 - **Fail-open, on purpose.** Offline, a blocked registry, an undeterminable local version, a `required` tag published above `latest`, or no tag at all: every one of these exits 0. A version gate that bricks the pipeline on a flaky network is worse than the drift it guards against.
 - **Not opt-out.** `updateCheck.enabled: false` silences the advisory "update available" prompt, which is what it always meant; it does not lift a floor. The single override is the env var `MULTI_AGENT_ALLOW_OUTDATED=1`, which exits 0 with a warning and is logged in the run record, so a broken release cannot strand someone mid-incident. Exempt commands - `update`, `setup`, `uninstall`, `help`, `status`, `log`, `search`, `routines`, `forget`, `language` - are the remedy or cannot depend on a contract.
@@ -803,126 +878,151 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.13.0] - 2026-08-22
 
 ### Fixed
+
 - **Three settings that were declared and did nothing are now wired up.** `learningsLedger.maxBriefEntries` had a default of 20 while both phase docs hardcoded `--max 20`, so raising it changed nothing. `testGap.scanTree` and `testGap.promoteSeverity` were declared in the schema AND implemented as `--scan-tree` / `--severity-promote` in the scanner, with nothing in between reading the pref and passing the flag: the plumbing existed at both ends and the middle was missing. A user who set any of the three got the default back with no error and no warning, and the schema told them they had done it right.
 
 ### Added
+
 - **`smoke-prefs-consumed.sh`: every setting the schema declares must be read by something.** This class has now shipped five times - the two `contextOffload` fields fixed in 15.11.0 and the three above - which is enough to gate rather than to keep catching by hand. The check walks the nested schema and asserts each leaf key is mentioned as a whole word somewhere outside `schemas/`. Deliberately loose: it asks "did anyone wire this up", not "is the wiring correct", because a stricter rule would have to understand shell, JS and markdown, and a gate that is wrong is worse than one that is broad. `keychainMapping.*` is exempt with a reason - those are resolved dynamically, so the literal name never appears in code by design. Verified by planting a setting nothing reads and watching the gate go red.
 
 ### Changed
+
 - Phase-doc token budget: total 53950 -> 54050. The 94 tokens are the wiring itself, not prose - two `--max` substitutions and a three-line flag block. Compression came first and twice: the rationale moved into the new gate's header, where it is enforced rather than described, and a `--severity-promote` table row was dropped because the invocation above it now shows the flag and names the pref that triggers it.
 
 ## [15.12.2] - 2026-08-22
 
 ### Fixed
+
 - **`grep -P` is banned in shell, and the ban is enforced.** Unlike the other divergences the portability gate tracks, this one has no guarded form: BSD grep has no `-P` at all, so it exits 2 with "invalid option", and the `2>/dev/null` that nearly every check carries turns that error into an empty result, which reads as "found nothing". A check written that way passes on every input including the one it was meant to catch. Two gates in this repo did exactly that, were handed a file with the defect deliberately planted in it, and reported a clean tree. The scan covers every shell file under `scripts/` and `lib/`, not only the shipped ones, because the two that broke were smoke gates that never ship - and a gate that cannot fail is worse than no gate, since it is trusted. The check opens by proving its own detector fires on a planted invocation.
 - **Always-loaded context is back under budget with its designed headroom.** The fixed per-run load had reached 60000 of a 60000 ceiling, so the next edit to either tracked file would have broken the gate. The cause was the pattern the gate exists to catch: `core/multi-agent/SKILL.md` carried a full transcription of the Phase 0 contract, restating all eight steps that `refs/phases/phase-0-init.md` already defines, while its own text said the transcription "does not replace the contract, read the ref". Its citations into that ref had also drifted - `L221` now points at the token pre-check, not the branch picker it claimed. Every rule was verified present in the ref before cutting (per-repo branch picker, shared branch name with per-repo collision, per-repo identity, serial per-repo worktrees). What stays in the always-loaded file is the part that enforces rather than describes: the blocking exit gate and the credential-inventory rule. 2422 bytes reclaimed, load now 57576 of 60000. The ceiling was not raised.
 
 ## [15.12.1] - 2026-08-22
 
 ### Fixed
-- **The pre-push gate no longer runs inside the push.** Git opens the connection to the remote before the hook fires, so the six-minute chain 15.12.0 wired in idled that connection until the server dropped it: the first two attempts to push the rename died on a broken pipe with every gate green. The hook is now verify-only and instant - it checks a stamp keyed to the exact tree (HEAD plus a hash of the working tree) and refuses the push when there is none. `npm run gate` produces the stamp. Refusing is the point: no stamp means nothing has verified this tree, and the reason this file exists is that nothing else will.
-
 
+- **The pre-push gate no longer runs inside the push.** Git opens the connection to the remote before the hook fires, so the six-minute chain 15.12.0 wired in idled that connection until the server dropped it: the first two attempts to push the rename died on a broken pipe with every gate green. The hook is now verify-only and instant - it checks a stamp keyed to the exact tree (HEAD plus a hash of the working tree) and refuses the push when there is none. `npm run gate` produces the stamp. Refusing is the point: no stamp means nothing has verified this tree, and the reason this file exists is that nothing else will.
 
 ## [15.12.0] - 2026-08-22
 
 ### Changed
+
 - **The companion MCP server is now `@mmerterden/multi-agent-toolkit-mcp` (v3.0.0), registered as `multi-agent-toolkit`.** The old name read as internal scaffolding; the server is standalone (three runtime dependencies, 83 tools, no coupling to any orchestrator) and the name now says which family it belongs to. The MCP tool namespace moves with it: every `mcp__dev-toolkit__*` reference across 24 files is now `mcp__multi-agent-toolkit__*`, because a host derives the tool prefix from the server name and the old prefix would have addressed a server that no longer answers.
 - **Existing registrations are migrated, not duplicated.** A host keys its registration by name, so a rename does not upgrade an entry in place: without a migration an install ends up with both `dev-toolkit` (pointing at the now-frozen 2.26.0) and `multi-agent-toolkit`, two servers advertising the same 83 tools with the host choosing between them. The installer removes the legacy entry before adding the new one, and `uninstall` clears both names - "removes the pipeline's footprint" has to mean the footprint it ever had.
 - Declared minimums move to `v3.0.0+`; 2.x only ever existed under the old package name.
 
 ### Migration
+
 - `@mmerterden/dev-toolkit-mcp` stays published at 2.26.0 and is deprecated with a pointer. Nothing is unpublished, so a pinned consumer keeps resolving. The toolkit also keeps `dev-toolkit-mcp` as a second `bin` alias.
 - A hand-registered client that the pipeline installer does not manage needs `<cli> mcp remove dev-toolkit` once.
 
 ### Fixed
+
 - **`pre-push-check.sh` ran three of the eleven gate steps.** It was missing both linters, three of the four evals, `validate-prefs` and `scorecard`, and drove the smoke suites through the bare `for f in smoke-*.sh` loop that `run-smokes.mjs` was written to replace - the loop that cannot tell a passing suite from one that exited 0 having asserted nothing. It now runs `npm test`, defined once in `package.json` so the hook cannot drift behind the chain, plus eslint and the personal-data scan. Because a full run takes about six minutes and git has already opened the connection to the remote by the time the hook fires, the verdict is cached against the exact tree that produced it (HEAD plus a hash of the working tree): re-pushing an unchanged tree is instant, one edited byte re-runs everything. Without that, the first push after the fix died on a broken pipe with every gate green. Verified by planting a defect that only the previously-missing steps catch: the old subset reported 434 unit tests passing and a clean tree; the new gate blocked the push. The hook's header also claimed the repo has no CI, which stopped being true some time ago.
 
 ## [15.11.0] - 2026-08-21
 
 ### Changed
+
 - **Nothing the pipeline posts carries a decorative glyph any more.** The work summary rendered task marks and a phase strip in checkmarks and hourglasses, the PR review emitter prefixed every finding with a coloured dot and signed it with a robot, and the GitHub issue Progress table was three traffic lights. All of it now reads in words: `[done]` / `[pending]` for tasks, `done · active · failed · skipped · pending` for the phase strip, `done` / `partial` / `pending` for the issue flags, and the severity is the bold label it always was. `channels/jira.md` had banned decorative glyphs in a comment body for releases while the renderers filled it with them; the rule and the emitters now agree, and `smoke-channel-glyphs.sh` holds them to it. The pipeline's own terminal output is deliberately out of scope: a `✓` in a console summary is a UI affordance, not a document somebody reads later.
 
 ### Fixed
+
 - **Jira no longer manufactures smileys the pipeline never typed.** Comments are posted as Jira wiki markup, and Jira's renderer converts `:)` `:D` `;)` and, far more easily hit in technical prose, `(x)` `(/)` `(!)` `(i)` `(y)` `(+)` `(on)` `(*)` into emoticon images at render time. Nothing escaped them. `channels/jira.md` now carries the escaping table and orders it after the markdown conversion and before the POST. This was never something the humanizer could fix: the text is legitimate, and `(x)` in a comparison table renders correctly on GitHub and Confluence - only the Jira conversion knows the target parser.
 
 ### Tests
+
 - `smoke-channel-glyphs.sh` (8 checks) and a glyph assertion in `smoke-work-summary.sh`. Both detect with node's `\p{Extended_Pictographic}` rather than `grep -P`: the first draft of the gate used a PCRE class, reported a clean tree with a checkmark deliberately planted in an emitter, and passed. Under `bash` on a stock macOS `grep` is BSD grep, which has no `-P` at all - it exits 2 with "invalid option", the `2>/dev/null` swallowed the message, and an empty result read as "no glyphs". The gate now opens by proving its own detector fires on a planted glyph before it trusts any verdict, and both gates were re-checked by planting one and watching them go red.
 
 ## [15.10.1] - 2026-08-21
 
 ### Fixed
+
 - **`uninstall --all-data` now removes the per-repo memory root.** `~/.claude/memory/multi-agent/` holds the learnings ledger and triage corpus: durable knowledge written in prose about the repos it was collected from, which on a corporate checkout is concrete information about the codebase. It survived even the full-cleanup mode, so "removes everything but your tokens" was not true in the one place a user is most likely to mean it. The default run still keeps it, alongside settings and logs, and both halves of that promise are now tested.
 - **Offloaded tool payloads are reclaimable.** v15.10.0 added `offload-ref.sh` without a way to clean up after it. In worktree modes the payloads die with the worktree, but the `--local` modes write into the real checkout, and because `.multi-agent/refs/` is gitignored the files never appear in `git status` and nothing reclaims them. New `gc-refs.sh`, dispatched as a third phase of `/multi-agent:garbage-collect`, sweeps them with the same contract as the /tmp sweeper: dry-run until `--yes`, a root guard that refuses `/` and `$HOME`, a grace window so a sweep cannot pull a ref out from under a running phase, and node-id matching so a file the user put in that directory survives. `--all` sweeps every checkout under `$HOME`.
 
 ## [15.10.0] - 2026-08-21
 
 ### Added
+
 - **Per-repo memory now recalls by relevance, not by recency.** Both memory stores ranked by something that was not relevance: `triage-memory.mjs query` scored a raw token overlap with no IDF, so a word present in every row ("view", "test", "error") counted as much as the one word that identified the bug, and `learnings-ledger.mjs brief` did not rank at all - it replayed the newest 20 entries. Past a few hundred rows both degrade the same way: the injected context stops being about the task in hand. New `pipeline/scripts/_retrieval.mjs` owns the arithmetic for both (the way `_cost.mjs` owns pricing): field-weighted BM25, exponential recency, and Reciprocal Rank Fusion with per-ranking damping so recency separates comparably relevant rows without ever promoting an unrelated one. The tokenizer indexes identifiers whole and split (`KeychainStore` is reachable from "keychain") and folds regular plurals, which is what lets a query phrased as prose reach a row that names a symbol. Zero dependencies: no embedding service, no vector store, no second model call. `prefs.global.memoryRecall.strategy: "legacy"` restores the old behaviour in one flag.
 - **`learnings-ledger.mjs profile` and drill-down pointers.** Durable knowledge is now two blocks instead of one, because relevance and prompt-cache reuse pull against each other. `profile` emits a task-INDEPENDENT `<repo-profile>` ordered by confidence, then kind, then statement - byte-stable across runs, so it belongs at the head of a phase prompt where an unchanged prefix is served from cache and grows into an asset as a repo is learned. `brief --task` emits `<task-relevant-memory>`, ranked against the task, and goes after the task text where a per-run difference costs nothing. Every rendered line ends with an `L:<id>` pointer instead of spelling out its evidence; `learnings-ledger.mjs show --id` and `triage-memory.mjs show --id` return the full row. `multi-agent-refs/prompt-assembly.md` carries the placement contract.
 - **`offload-ref.sh`: bulky tool payloads become a pointer plus a tail.** Phase 3 already teed its build output to a file, but nothing decided how much of that file reached the model, so in practice all of it did. The filter parks the full text at `.multi-agent/refs/<node_id>.md` (content-addressed, gitignored) and prints a `[[ref:<node_id>]]` stub with the last lines - where a failing build's error already is. The evidence gate keeps reading the whole log, so what counts as a verified pass is unchanged; only what reaches the prompt shrinks. Wired into Phase 3 builds and Phase 4 test output, opt-in via `prefs.global.contextOffload.enabled`, and a pass-through when off, so the pipe is always safe to write.
 - **Recall precision is measured.** Phase 1 and Phase 4 emit `memory.injected` / `memory.hit`, and `learning-curve.mjs` trends the ratio alongside the existing KPIs. Without the pair, a ranking change that injects the right rows and one that injects noise are indistinguishable from outside: both return five hits and exit 0. `smoke-learnings-ledger.sh` holds the emitter and the consumer to the same event names, so renaming one side fails a gate instead of silently emptying the column.
 
 ### Security
+
 - **Entry text cannot forge the boundary of the block it is injected into.** `from-triage` builds ledger statements out of a finding's own words, which are model output, so a statement is untrusted content placed inside a structure the reader parses. Statements are now stored as one line (the schema always said "in one line"; nothing enforced it), and the block delimiters are neutralised at render time in both the ledger blocks and `<repo-memory>`. Angle brackets that are not delimiters are untouched, so `Array<String>` still reads as itself.
 
 ### Changed
+
 - `memory-load.sh` takes optional task text and ranks the MEMORY.md pointers against it. The previous `head -30` was a truncation, not a summary - the thirty-first pointer was invisible however precisely it matched, so the block got less useful the longer a repo was worked on. With no task text the index order is unchanged.
 - Phase 4 prior-art lookup and the rejected-preference brief are both ranked against the findings under triage; a finding whose wording matches nothing now returns nothing instead of the three newest rows.
 - `prefs.global.contextOffload.minLines` and `tailLines` are read by `offload-ref.sh`. They shipped in the schema and were honoured by nothing, so a user who set `tailLines: 50` got 20 with no way to tell; config that does nothing documents a control that is not there. An explicit flag still beats the pref, and a non-numeric or zero value falls back to the shipped default.
 - Phase-doc token budget: total 53350 -> 53950. The new prose was compressed twice first (1168 tokens down to 580) by keeping the reasoning in `prompt-assembly.md` and the `offload-ref.sh` header, both outside the budget. Phase 3 and Phase 4 are left amber on their warn lines on purpose - that is the signal that those two docs are next for structural compression rather than another bump.
 
 ### Tests
+
 - `test/retrieval.test.mjs` (20 unit assertions on the ranking primitives), `pipeline/scripts/eval-recall.mjs` + `pipeline/eval/recall-cases.json` (8 end-to-end recall cases against a deliberately noisy corpus, each reporting what the pre-ranking scorer would have returned), `smoke-offload-ref.sh`, and new coverage in `smoke-learnings-ledger.sh` and `smoke-per-repo-memory.sh`.
 
 ## [15.9.1] - 2026-08-20
 
 ### Changed
+
 - **Telemetry logs the GitHub account name, never the git `identity.name`.** The reporter resolved the run's user to `identity.username || identity.name`, and since prefs identities carried no `username`, it fell back to `identity.name` - which can be a full corporate title/brand string, landing verbatim in the usage store. It now resolves to the identity's GitHub username, then the active `gh` account login resolved live, then null; the git `identity.name` is no longer a fallback. Self-registration (`/multi-agent:update` step 5b) resolves the same way.
 
 ## [15.9.0] - 2026-08-20
 
 ### Fixed
+
 - **Telemetry emitter and run scripts: 21 verified defects from a refactor bug hunt.** The emitter now reads `usageLog.optOut` as a hard block, refuses non-TLS endpoints so the write-only token never travels in cleartext, resolves the credential store and version marker across all host trees (Copilot/Codex-only installs), prices each phase at its own model rate instead of opus-for-all, keeps hyphenated MCP server names, drops plugins mapped to `false`, and gates before touching the keychain. `phase-tracker.sh` uses a per-process temp file so the fail-open lock cannot publish a torn state, honors `$TRACKER_FILE` on init, and builds OTEL attrs with jq. `build-stack-plugins.mjs` aborts on a flag given without a value and reports content-only changes in `--dry-run`; `localize-commands.mjs` is Windows- and CRLF-safe; `account-resolver.sh`, `channels-multi-repo.sh` and `figma-mcp-refresh.sh` gaps closed. Covered by `test/usage-report.test.mjs`.
 
 ### Changed
+
 - **`purge` and `uninstall` are no longer model-auto-invocable** (`disable-model-invocation: true`): the two irreversible, full-data-loss commands run only on an explicit user request.
 - **`humanizer` skill (v1.1.0):** a self-critique pass re-verifies the rewrite against the original (meaning preserved, nothing invented, patterns actually gone); trailing-participle and connective-padding patterns added.
 - Stale version tables refreshed: `SECURITY.md` supported-versions moves to the 15.x line; `ROADMAP.md` "Current Release" becomes a rolling "Recent Releases".
 
 ### Companion
+
 - **`dev-toolkit-mcp` v2.26.0** (shipped alongside): CallTool boundary now validates arguments against each tool's inputSchema (lenient-but-safe), closing the command-injection class where a string reached a numeric shell interpolation; every caller-derived path is single-quoted; a new gate backstops it. Backward-compatible, 83 tools unchanged.
 
 ## [15.8.1] - 2026-08-19
 
 ### Fixed
+
 - **Self-registration follows the endpoint redirect**: the default reporting host answers `/register` with a 308 to the canonical domain; the update step's curl now passes `-L`, so the token actually arrives instead of the redirect page. Without it, v15.8.0's self-registration silently reported "registration unreachable" on every machine.
 
 ## [15.8.0] - 2026-08-19
 
 ### Added
+
 - **Operational reporting self-registers on update**: when no ingest token is onboarded, `/multi-agent:update` requests a per-machine write-only token from the reporting endpoint's `/register` route, stores it only in the OS credential store, and enables `usageLog`. Registration failing (offline, endpoint down, ingest disabled) leaves reporting off with a one-line notice - never an error. Hard opt-out via `usageLog.optOut: true` blocks both the registration and the auto-enable; setup Step 2.7 (admin-issued token) still takes precedence. The emitter's payload is unchanged: coarse run metadata only, never prompts, code, diffs, or paths.
 
 ## [15.7.0] - 2026-08-19
 
 ### Added
+
 - **Setup walks missing credentials one by one**: Step 3 gained a strict sequential onboarding loop - fixed service order, one Token Save Flow prompt per service (token -> author -> host), per-service skips that never abort the loop, and `figma` / `figma_mcp` as distinct passes. The discovery summary can no longer end setup.
 - **Per-repo Jira project keys in setup**: the Jira pass closes with an optional multi-select mapping (repo -> project key) written to `prefs.projects[{slug}].jiraProjectKeys`; per-repo keys resolve before `global.defaultJiraKey` everywhere a key is needed. Re-open with `/multi-agent:setup jira-keys`.
 - **Figma MCP mode question**: the `figma_mcp` pass opens with Remote / Local. Remote generates the `figu_` OAuth token for the current user (Dynamic Client Registration + PKCE; `prefs.global.figmaMcp.remoteGeneratorScript` drives the flow when set); Local wires the PAT-based `@anthropic-ai/figma-mcp` server (`localGeneratorScript` supported). Prefs schema: new `global.figmaMcp` block plus `supabase_access` / `supabase_service_role` keychainMapping keys.
 
 ### Changed
+
 - **Help spells out the --dev pipeline**: the Pipeline section now carries the dev chain (Phases 1-2 skipped, Review never skipped, Opus dev). Stale notes claiming Test or Review are skipped in --dev were corrected in both languages.
 - **Setup Step 5 (Repo Discovery) split to a reference**: the full contract moved to `multi-agent-refs/setup/repo-discovery.md`; the SKILL keeps the opt-in prompt and a summary.
 
 ### Fixed
+
 - **build-stack-plugins.mjs dead import**: unused `APPLE_ONLY` import removed (superseded by the `STACK_ONLY` routing table).
 
 ## [15.6.1] - 2026-08-19
 
 ### Changed
+
 - **`/multi-agent:update` installs from npm, not from a git clone**: the registry is the single update channel - latest published release resolved with a direct registry read (never `npm view`'s cache), downloaded via `npm pack` with the registry pinned, installed with `install.js --all`, changes rendered from the packaged CHANGELOG, smokes run from the tarball. A pipeline repo clone is now purely a maintainer workspace (synced by `/multi-agent:sync`); consumers need no git access at all, so collaborator grants on the private repo can stay read-only or be dropped.
 
 ### Fixed
+
 - **`node --test` runs stop pinging the live dashboard**: the tracker-entities suite calls `phase-tracker.sh init` outside run-smokes' `MULTI_AGENT_SMOKE` guard, so every test run left a phantom "probe" row on the timeline. The suite now sets the flag itself, and `usage-report.mjs` refuses to emit under it as the last line of defense for any caller.
 - **Usage report reads the tracker as it is actually written**: `tracker-state.json` stores `phases` as an array, but the reporter iterated it with `Object.entries`, so dashboard phase ids were array indexes - every phase after a skipped one was mislabeled (Commit id "6" reported as Faz 5). Failed-phase error tags carried the same wrong ids.
 - **Run duration and terminal timestamp resolve from the tracker**: nothing stamps `state.finishedAt`, so every run reported `du=null` and a terminal emit was stamped with the reporter's wall clock (wrong for backfills). Both now fall back to the tracker's phase span (earliest start to latest completion).
@@ -931,28 +1031,34 @@ Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine fr
 ## [15.6.0] - 2026-08-18
 
 ### Fixed
+
 - **The heart goes platform-blind** (platform-dynamic audit, 15 findings): Phase 3's RED run, target resolution and build verification become `case "$STACK"` arms (gradle/pytest/npm beside xcodebuild, with the Gradle build-lock decision stated); Phase 4 Gate 1 matches its own stack-generic Gates 2-3; Phase 2 dispatches the platform's architect agent; Phase 5's device-check table gains the Android MCP tools; the figma-config schema stops claiming SwiftUI as universal; wiki scope gains a `platform` value.
 
 ### Added
+
 - **Per-stack routing hatches**: `STACK_ONLY` lists in `_stack-routing.mjs` so a stack-only skill (ktlint, hilt-di, ...) routes with one list entry instead of a regex widening - and `--check-routing` now FAILS on unrouted skills. `lint-skills` accepts `platform: backend|frontend`.
 
 ## [15.5.0] - 2026-08-18
 
 ### Added
+
 - **`sharedUtilities` census bucket** - the bind-don't-rebuild inventory: formatter families, validation rule types + per-module facades and design-token namespaces living outside screen slices, counted with samples; Phase 3 treats a non-empty bucket as binding.
 
 ### Fixed
+
 - **Smoke runs never touch the live dashboard** - run-smokes exports `MULTI_AGENT_SMOKE=1` and phase-tracker's live ping returns under it (test gates were leaving phantom "running" rows on the timeline).
 - **Routing resolves the multi-agent-plugins toolkit first** - the public toolkit family is the pipeline's standard companion; a corporate variant is the fallback, not the default.
 
 ## [15.4.0] - 2026-08-18
 
 ### Added
+
 - **Per-project `testPolicy`** (`tdd` | `tests-after` | `none`): Phase 0 resolves it after project selection for every input type, asking once via a native picker when absent (autopilot defaults to `tdd` and notes it). Phase 3 gates the TDD cycle on it; Phase 5 skips the gap scan under `none` and runs only pre-existing targets. Prefs schema + template carry the field.
 - **Ordered stack-toolkit routing candidates**: the ios/android rows resolve the corporate `-engineering-` variant before its public derivation, and a full probe miss records every candidate tried. The conventions census learns a `CrossDomains` root; screen-creation tasks bind the routed toolkit's `create-screen` workflow.
 - **ios-module-structure 0.3.0 / ios-coding-standard 1.2.0** (authoring source): the settled architecture becomes the standard - UnitDialect slot, unit vocabulary roles, STRUCT-18..21 with checker support, UNIT-01..03 / SAFE-03 / MOD-08; the pre-conversion spellings are named residue.
 
 ### Fixed
+
 - The test-policy step resolves for Jira-ID and URL inputs, not only free-text; STRUCT-18 reports an unbound contracts root as disabled coverage instead of passing silently.
 
 ## [15.3.2] - 2026-08-17
@@ -1030,7 +1136,7 @@ places at once.
   delivered a different stack than the repo asked for. Repo settings are now read
   first, user-global second, `--platform` last.
 - **Copilot's skipped-stack prune could delete user-authored skills.** The prune
-  was derived from catalog *names*, so a user's own `~/.copilot/skills/<name>/`
+  was derived from catalog _names_, so a user's own `~/.copilot/skills/<name>/`
   sharing a catalog name was removed with no prompt. It is now scoped to the
   previous delivery manifest (or, pre-manifest, to dirs byte-identical to the
   catalog) - the same contract `uninstall` already used.
@@ -1131,7 +1237,6 @@ places at once.
   were already at (or 193 bytes past) their limit; the always-on surface itself
   shrank with the local copy gone.
 
-
 ### Added
 
 - **`/multi-agent:complaint-analysis`** — customer-complaint / customer-reported-error
@@ -1183,7 +1288,7 @@ places at once.
   `gzip` preserves the source file's mtime by default, so rotating log
   content already older than `KEEP_DAYS` produced a `.gz` that inherited
   that old mtime - and the very next line's retention sweep (`find -mtime
-  +$KEEP_DAYS -delete`) deleted it in the same run, before it was ever read.
++$KEEP_DAYS -delete`) deleted it in the same run, before it was ever read.
   The archive's mtime is now reset to rotation time, so retention counts
   from when it was archived, not from the age of the content inside it.
 - The mode banner claimed pickers stay English when they didn't - language +
@@ -1204,26 +1309,26 @@ places at once.
 
 - **`testflight-validation` merged into a new `/multi-agent:store-ready`, and the
   Android side brought to parity.** The iOS archive audit existed twice with
-  identical arguments  -  `ios_app_store_audit({archive_path, rules: "all"})` in the
+  identical arguments - `ios_app_store_audit({archive_path, rules: "all"})` in the
   command's Gate 1 and again inside `sim-test.md`'s `store-ready` scenario. Two
   copies of one call is how the second door grew with no Gate 2, no Gate 3 and no
   Android equivalent. There is now one implementation.
   Gates are symmetric per platform, because the failure modes are: a malformed
   package, a package the store itself refuses, and a policy a human enforces.
 
-  | Gate | iOS | Android |
-  |---|---|---|
-  | 1 Static | `ios_app_store_audit`, 18 rules | `android_apk_audit` + `google-play-compliance`, 21 rules |
-  | 2 Authoritative | `altool --validate-app` | `SKIPPED` |
-  | 3 Policy | `app-store-review` vs source | `play-store-review` vs source |
+  | Gate            | iOS                             | Android                                                  |
+  | --------------- | ------------------------------- | -------------------------------------------------------- |
+  | 1 Static        | `ios_app_store_audit`, 18 rules | `android_apk_audit` + `google-play-compliance`, 21 rules |
+  | 2 Authoritative | `altool --validate-app`         | `SKIPPED`                                                |
+  | 3 Policy        | `app-store-review` vs source    | `play-store-review` vs source                            |
 
   Gate 2's asymmetry is reported as an asymmetry rather than smoothed over: Play's
   authoritative check exists only server-side, through a Publishing API draft edit,
   and the pipeline ships no client for it. An Android run therefore clears at most
   2 of 3 and never prints `passed`. `bundletool validate` is Gate 1 and is not
   promoted to fill the hole.
-  The running-app sweep became Step A rather than a separate errand  -  a build can
-  be structurally perfect and still ship an unreadable screen  -  and it degrades to
+  The running-app sweep became Step A rather than a separate errand - a build can
+  be structurally perfect and still ship an unreadable screen - and it degrades to
   `SKIPPED (no booted device)` instead of halting the package validation.
 
   Nothing was removed. `testflight-validation` is a thin iOS-pinned alias (removing
@@ -1254,7 +1359,7 @@ places at once.
 - **Copilot's `purge` could not see a single worktree.** It discovered them with
   `find {repo}/.worktrees/ -name "agent-state.json"`, and no worktree carries that
   file: Phase 0 writes state to `$HOME/.claude/logs/multi-agent/{project}/{task-id}/`.
-  Verified on a repo with two live task worktrees  -  the marker scan returns zero
+  Verified on a repo with two live task worktrees - the marker scan returns zero
   while `purge.sh`'s own directory enumeration finds both. So the skill reported
   "nothing to purge" as success with real worktrees on disk. The Claude Code command
   had already been fixed by delegating to `purge.sh`; the Copilot mirror never
@@ -1277,7 +1382,7 @@ places at once.
   `.worktrees/PROJ-*/agent-log.md` and `agent-state.json`; Phase 0 has written both
   to `$HOME/.claude/logs/multi-agent/{project}/{task-id}/` since the layout moved.
   Against the current tree the scan matches zero files, so the op reported "logs
-  cleared, deleted 0" as success while every real log stayed on disk  -  worse than a
+  cleared, deleted 0" as success while every real log stayed on disk - worse than a
   missing command, because it reads as done. There was also no `clear-logs` command
   directory, so the `/multi-agent:clear-logs` entry in the Copilot help pointed at a
   slash command that was never installed.
@@ -1291,7 +1396,7 @@ places at once.
   reaching either fell through to the general sweep and was reported as the scenario
   asked for. Neither can be built symmetrically today: biometric has `ios_biometric`
   and no Android counterpart, launch timing has `android_launch_time` and no iOS
-  counterpart, and the file auto-detects platform  -  so each would work on one
+  counterpart, and the file auto-detects platform - so each would work on one
   platform and silently do nothing on the other. Both rows are withdrawn with the
   reason recorded in place, rather than shipped as half-features or left advertised.
   Advertised scenarios and implemented sections now match one to one.
@@ -1388,7 +1493,7 @@ own toolkit says apply, and clean up after itself.
   so `bugfix` / `feature` / `refactor` / `chore` had no skill dispatch at all:
   whichever skills the host surfaced by description match were the ones used, and
   nothing recorded or required any of them. That was the dev-side half of the gap
-  v14.0.0 closed on the review side  -  review asked "was this built to the rules it
+  v14.0.0 closed on the review side - review asked "was this built to the rules it
   was supposed to follow" while nobody had chosen any rules.
 
   The routing table is NOT copied into this repo. A second copy would drift the
@@ -1398,7 +1503,7 @@ own toolkit says apply, and clean up after itself.
   6-row table). Routed skills land in `telemetry.skillCalls[]` with
   `routedBy: "<toolkit>:index@<version>"`, so Phase 4 conformance can hold the run to
   what its own toolkit chose. An absent or disabled toolkit is a recorded no-op, not
-  a halt  -  a backend repo has no toolkit and must still run.
+  a halt - a backend repo has no toolkit and must still run.
   Contract: `refs/features/stack-skill-routing.md`.
 
 - **Phase 6 removes a task's worktree once its PR is open** (`worktree-finalize.sh`,
@@ -1406,7 +1511,7 @@ own toolkit says apply, and clean up after itself.
   salvages `agent-state.json`, `phase-tracker.json`, `triage-output.json`,
   `.pipeline/`, `.build.log`, `.test.log` and `.review-diff.txt` into the log dir
   first, because Phase 7's triage-memory ingest, the learnings-ledger distill,
-  `render-work-summary.sh`, `:resume`, `:status` and `:log` all read them  -  and the
+  `render-work-summary.sh`, `:resume`, `:status` and `:log` all read them - and the
   first three are `[ -f ]`-guarded, so a removal without salvage would have degraded
   silently rather than failing.
 
@@ -1446,7 +1551,7 @@ own toolkit says apply, and clean up after itself.
   `f.file` from the diff-risk report, which declares and emits `path`, so each
   finding carried `file: undefined` and read "Test file 'undefined' shrinks". That
   is useless to the developer and rejected by `reviewer-output.schema.json`, which
-  requires `file` with `minLength: 1`  -  on the one gate that deliberately has no
+  requires `file` with `minLength: 1` - on the one gate that deliberately has no
   opt-out. It stayed invisible because the smoke's own fixtures used `"file"`, the
   key the bug read: the fixture matched the bug instead of the schema. Fixtures
   corrected, and a new assertion checks the finding names a real path (verified by
@@ -1458,14 +1563,13 @@ own toolkit says apply, and clean up after itself.
   elsewhere in those files' prose. Added check 4b: every name in an inventory must be
   a command that exists in the tree (verified against a planted `ghostcmd`).
 
-
 ## [14.0.0] - 2026-07-29
 
 The `--dev` family reviews its own work, and review now checks the code against the
 criteria it was supposed to be built to instead of general good taste.
 
 Major because a command was renamed: `/multi-agent:finish` is now `/multi-agent:ship`.
-No alias is kept  -  `installCommands()` replaces the command tree wholesale, so a clean
+No alias is kept - `installCommands()` replaces the command tree wholesale, so a clean
 cut leaves nothing half-migrated.
 
 ### Added
@@ -1478,7 +1582,7 @@ cut leaves nothing half-migrated.
   without them, while review judges work that now exists and has no substitute. Accepted
   blocking findings return to Phase 3 under the existing 3-iteration hard kill; the
   autopilot variants auto-fix without prompting and halt on the existing rework-storm
-  circuit breaker rather than committing. No new machinery for either  -  both were already
+  circuit breaker rather than committing. No new machinery for either - both were already
   built and became reachable the moment Phase 4 entered the phase set.
 - **Phase 4 Step 1.78, criteria resolution** (`skill-conformance.mjs`, zero LLM). Resolves
   which rule registries apply to this diff, scoped to its languages and paths, and writes
@@ -1493,7 +1597,7 @@ cut leaves nothing half-migrated.
 - **Every registry declares its own `scope`** (`languages`, `paths`, `excludePaths`,
   `notCovered`), and per-rule `scope` narrows it further. Measured before this landed: only
   2 of the iOS registry's 99 rules carried any applicability field, and the rest wrote their
-  scope as English prose inside `mechanism`  -  so an Objective-C or UIKit diff would have
+  scope as English prose inside `mechanism` - so an Objective-C or UIKit diff would have
   collected all 99 SwiftUI-shaped rules, manufacturing findings and burying the real ones.
 - `references/rules.yml` for `apple-archive-compliance` (18 rules) and
   `google-play-compliance` (21), converted from their existing SKILL.md tables with IDs and
@@ -1502,7 +1606,7 @@ cut leaves nothing half-migrated.
 - **Exception-marker audit**: expired, reason-less, expiry-less, or unknown-ID
   `standard:exception(...)` markers become rule-ID-bearing findings. The marker template is
   read from the registry, never hardcoded, so a registry with different comment syntax works.
-- `state.telemetry.skillCalls[]`  -  Phase 3 records each skill, plugin skill and guide it
+- `state.telemetry.skillCalls[]` - Phase 3 records each skill, plugin skill and guide it
   consulted, with the files it applied them to.
 - `prefs.global.skillConformance.blockOnCoverageGap` (default **false**) and
   `prefs.global.ship.autoFix`, the latter referenced by the tail command's spec since it
@@ -1522,13 +1626,13 @@ cut leaves nothing half-migrated.
 - **Reviewers cite rule IDs.** `reviewer-output.schema.json` 1.0.0 -> 1.1.0 adds `ruleId`,
   `criteriaSource` and the per-rule `conformance[]` array; `triage-output.schema.json`
   3.2.0 -> 3.3.0 carries both through triage. `code-reviewer.md` gains a `${CRITERIA}`
-  injection slot  -  the phase doc had claimed for some time that "skills are injected into
+  injection slot - the phase doc had claimed for some time that "skills are injected into
   reviewer prompt context" while the agent definition had no slot for them, which is exactly
   why review could not cite a rule.
 - `validate-reviewer.mjs` enforces the checklist with `--criteria`: a selected ID with no
   verdict, a verdict for an ID that was never selected, a `conformant` row with no file
   evidence, and a `violated` row with no matching finding all fail. Without this the field
-  would be decoration  -  the validator is hand-written and does not apply
+  would be decoration - the validator is hand-written and does not apply
   `additionalProperties`, so any array at all would have passed.
 - `${CRITERIA}` lives in the shared cacheable prefix, identical for every reviewer.
   Subsetting it per reviewer would invalidate the prefix for the whole panel and re-bill the
@@ -1550,7 +1654,7 @@ cut leaves nothing half-migrated.
 
 - **`ios-coding-standard` in the repo was a version behind the installed copy** (95 rules
   v1.0.0 vs 99 rules v1.1.0). Because `installSkills()` copies the repo over the
-  destination, the next `/multi-agent:update` would have downgraded a user's registry  - 
+  destination, the next `/multi-agent:update` would have downgraded a user's registry -
   harmless while nothing read it, a correctness regression the moment Phase 4 blocks on rule
   IDs. Resynced to 99 rules.
 - `modules/*.yml` overlays and `references/EXAMPLES.md` are deliberately NOT shipped: they
@@ -1576,8 +1680,8 @@ gates are named per item.
 
 - **The Tier 2 Figma PAT could not be found on any migrated install.** `migrate-prefs.mjs`
   consolidated `keychainMapping.figma_pat` into `.figma` and deleted the old key, but the
-  setup wizard kept *writing* `figma_pat` (so the next migration deleted the mapping it
-  had just created), both Tier 2 fetchers kept *reading* it, and the failure text told the
+  setup wizard kept _writing_ `figma_pat` (so the next migration deleted the mapping it
+  had just created), both Tier 2 fetchers kept _reading_ it, and the failure text told the
   user to map the one key guaranteed not to survive. Tier 2 reported `missing-token` while
   a valid PAT sat under the new name. Claude Code's MCP tier masked it; Copilot and Codex,
   which serve no Figma MCP tools at all, fell straight to Tier 3. The lookup now lives once
@@ -1636,7 +1740,7 @@ gates are named per item.
   written. Copilot now rewrites the trees it owns, and installs `rules/` as well, closing
   the same silent-nothing fallback Codex's installer already documented.
 - **`phase-tracker.sh` never reclaimed a stale lock on Linux.** It tried `stat -f %m`
-  before `stat -c %Y`, and on GNU coreutils `stat -f` is a *valid* flag (`--file-system`,
+  before `stat -c %Y`, and on GNU coreutils `stat -f` is a _valid_ flag (`--file-system`,
   where `%m` is the mount point): it succeeds, returns something like `/`, the `||` never
   fires, and the age arithmetic runs on a path. Every tracker call then spun the full ~5s
   bound and fell open with a warning. Every other `stat` call site in the repo already had
@@ -1651,7 +1755,7 @@ gates are named per item.
   the previous generation. Now `claude-opus-5` and `claude-sonnet-5`, with the rung/ID split
   stated in the fallback contract. Gate: a generation guard in `smoke-model-fallback.sh`.
 - **`rules/pipeline-output-formatting.md` did not exist.** Two shipped skills named it as
-  the PR-body contract to follow. The install-layout smoke had been *reporting* paths that
+  the PR-body contract to follow. The install-layout smoke had been _reporting_ paths that
   exist on no host as a note rather than failing on them, which is how it survived; that
   claim is now strict.
 - **A pre-migration preferences file failed validation before the migration could fix it.**
@@ -1708,7 +1812,7 @@ gates are named per item.
 
 - **Every fetcher died on a Copilot-only or Codex-only install.** Eleven runtime scripts
   loaded `credential-store-resolver.sh` as `. "$HOME/.claude/lib/..." || . <next> || {
-  error }`, all of them under `set -e`. Sourcing a file that does not exist aborts the
+error }`, all of them under `set -e`. Sourcing a file that does not exist aborts the
   shell outright - `||` included - so on a host without `~/.claude/lib` the chain reached
   neither its later candidates nor its error branch: bare exit 1, no message. Reordering
   does not help, because whichever candidate is absent aborts at that point. All eleven
@@ -1799,7 +1903,7 @@ gates are named per item.
   `--dev` skips the LLM phases, not Phase 0's pickers.
 - **An unreachable external source is announced instead of absorbed.** Exit code `3`
   used to mean "mark it failed and continue", so an expired token and a VPN-off remote
-  both reached the analysis phase as *no data*, indistinguishable from a ticket that
+  both reached the analysis phase as _no data_, indistinguishable from a ticket that
   referenced nothing. The run then planned from a partial picture and reported success.
   `external-context-injection.md` now classifies the stderr and surfaces a decision -
   refresh the credential, connect the VPN and retry, supply a current URL, or continue
@@ -1821,7 +1925,7 @@ gates are named per item.
   `api.figma.com` returned 403 for a healthy token and would have sent the user to
   regenerate something that worked. It is now reported as not-probeable, with liveness
   left to `figma-mcp-refresh.sh`, which owns the grant.
-- A failed `curl` wrote `000` through `write-out` *and* triggered the `|| echo "000"`
+- A failed `curl` wrote `000` through `write-out` _and_ triggered the `|| echo "000"`
   fallback, producing `000000` and a bogus verdict for what was simply a closed VPN.
   Any non-three-digit status now reads as `probe-error` rather than being dressed up as
   a service verdict.
@@ -1858,7 +1962,7 @@ gates are named per item.
 ### Fixed
 
 - **`build-stack-plugins.mjs` never propagated content edits.** It copied a skill only
-  when the skill *set* changed, so editing a routed skill in `shared/external` reached
+  when the skill _set_ changed, so editing a routed skill in `shared/external` reached
   no plugin while the generator reported "all plugins up to date" - which read as
   confirmation. This falsified the single-authoring-source guarantee the whole
   `shared/external` design rests on. Found by converting banned punctuation in
@@ -1890,7 +1994,7 @@ The iOS coding standard reaches all three hosts, and works outside the pipeline.
 The 95-rule registry lived as a pipeline-local routine. Two consequences, both
 measured: only Claude Code could reach it, because `local-only` commands are
 deliberately never synced (verified absent on Copilot CLI and Codex CLI), and it
-applied only when the routine was invoked explicitly  -  nothing pulled the rules in
+applied only when the routine was invoked explicitly - nothing pulled the rules in
 while Swift was being written. The plugin's own `reference/code-style` skill is 154
 lines of prose with zero rule IDs, so the registry was not reachable that way either.
 
@@ -1934,7 +2038,6 @@ lines of prose with zero rule IDs, so the registry was not reachable that way ei
   predates this change and `tools/validate.py` warns on it; routing `knowledge/` behind
   the plugin's `index` skill is the fix and is separate work.
 
-
 ## [13.1.0] - 2026-07-27
 
 Six gates, from one branch that spent half its commits on rework.
@@ -1944,7 +2047,7 @@ chain, measured from the run's own artefacts: Phase 0 reported `completed` havin
 written only `tracker-state.json`, so `agent-state.json` and its `taskType` never
 existed, so Phase 3's component dispatch could not fire. The stack plugin already
 ships `create-screen`, `figma-validate` (7 criteria including design-token compliance
-and Code Connect strategy) and `figma-review` (14-item checklist)  -  none of them ran.
+and Code Connect strategy) and `figma-review` (14-item checklist) - none of them ran.
 Padding came out 16 where the frame said `Spacing/12`. Three of six commits were fixes,
 the last a full sheet rebuild.
 
@@ -1961,7 +2064,7 @@ invokes a skill that was already written but never called.
   gate is testable without reproducing a run.
 - **Phase 4 Step 2.8, visual conformance gate.** Runs `figma-review` and
   `/multi-agent:design-check` for component/screen work, with the coverage gate, and
-  asserts Code Connect was **published** rather than merely written  -  a
+  asserts Code Connect was **published** rather than merely written - a
   `*.figma.swift` on disk with "Not published" in Figma is a binding that exists for
   nobody. `design-check` had been a command with no phase invoking it, so the only
   thing standing between a build and visual drift was the user opening the app.
@@ -1976,14 +2079,14 @@ invokes a skill that was already written but never called.
 
 - **Component dispatch halts instead of degrading.** The contract used to send an
   incomplete-state component task down the generic TDD path while the next sentence
-  said "never silently skip the Figma work"  -  taking the generic path *is* skipping
+  said "never silently skip the Figma work" - taking the generic path _is_ skipping
   it. That wording authorised the exact failure above.
 - **Dispatch routes on scope, not just platform.** A screen and a component are
   different jobs and the plugin ships a skill for each; routing a screen to the
   component skill is why one run produced entities and a mapper but left the screen
   half-wired. `figma-validate` now runs before the create skill.
 - **Phase 1 captures spacing by token name, per atom.** Phase 3 is forbidden from
-  calling Figma, so a pixel number  -  or a missing entry  -  is unrecoverable later. A
+  calling Figma, so a pixel number - or a missing entry - is unrecoverable later. A
   UI frame with no spacing entries is a capture failure, not an empty frame.
 - **Phase 3 records that generated trees are not editable.** A mock fixture went into
   the generated tree; the fix moved it to the custom tree and registered the scenario
@@ -1993,7 +2096,6 @@ invokes a skill that was already written but never called.
   Planning by design, so there is no phase that turns a document into a plan. The doc
   becomes context for one pass and work lands in whatever order it was read.
 
-
 ## [13.0.0] - 2026-07-27
 
 > **Why major and not minor.** The additions here are additive, but two defaults
@@ -2003,7 +2105,6 @@ invokes a skill that was already written but never called.
 > comparing Codex on skill directories would read a correct install as drift).
 > Per the versioning policy that is a changed default, not a new option.
 
-
 Codex CLI becomes a third supported host, and a new pre-submission validation command.
 
 ### Added
@@ -2014,19 +2115,19 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
   with per-agent model and reasoning effort, hooks, MCP and a plugin marketplace,
   so it earns the same treatment as the other two rather than an adapter.
   `install/codex.mjs` writes `~/.codex/{skills/multi-agent,multi-agent-refs,
-  agents/*.toml,prompts/multi-agent.md,scripts,lib,schemas,rules}` plus a managed
+agents/*.toml,prompts/multi-agent.md,scripts,lib,schemas,rules}` plus a managed
   span in `~/.codex/AGENTS.md`, and registers the dev-toolkit MCP server through
   `codex mcp add` rather than hand-merging TOML that Codex owns.
 - **`/multi-agent:testflight-validation`** (command 43). Three gates, each seeing
   what the others structurally cannot: the static 18-rule archive audit, Apple's
   own `altool --validate-app`, and a Review-Guidelines check against repo evidence.
-  ITMS codes are mapped to the rule each implies. It validates only  -  never
-  `--upload-app`  -  so a validation run cannot ship a build by accident.
+  ITMS codes are mapped to the rule each implies. It validates only - never
+  `--upload-app` - so a validation run cannot ship a build by accident.
 - **App Store Connect credentials in `/multi-agent:setup`**, inside the Step 1
   discovery / Step 2 mapping / Step 3b onboarding flow alongside Jira and
   Bitbucket, not as a late add-on: a user who already has one in their keychain
   gets it mapped automatically. Tier 1 is an API key, tier 2 an Apple ID plus an
-  app-specific password  -  which matters because creating an API key needs an
+  app-specific password - which matters because creating an API key needs an
   Admin or App Manager role many developers on a corporate team do not have.
 
 ### Changed
@@ -2042,8 +2143,8 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
   gpt-5.6 @ medium, triage at max) with two measured constraints written into the
   contract: a `spawn_agent` that sets `model` without `fork_turns: "none"`
   **silently inherits the parent model**, collapsing the panel onto one
-  perspective; and 4 concurrency slots *including the orchestrator* make three
-  reviewers the ceiling. Single-vendor caveat recorded  -  consensus among three
+  perspective; and 4 concurrency slots _including the orchestrator_ make three
+  reviewers the ceiling. Single-vendor caveat recorded - consensus among three
   OpenAI models is weaker evidence than the same consensus on a two-vendor host.
 - `tracker-contract.md` gains the `codex` visual channel: the native `update_plan`
   tool, with its no-parallel-call and no-plan-mode caveats.
@@ -2063,7 +2164,7 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
 - **The Phase 0 branch-collision probe read a failed probe as "no collision".**
   With `2>/dev/null` and an empty-output test, an auth or network failure was
   indistinguishable from "the ref does not exist", so the run created a branch
-  that already existed on the remote  -  surfacing as a rejected push at Phase 6,
+  that already existed on the remote - surfacing as a rejected push at Phase 6,
   far from its cause. Exit codes are now distinguished (0 exists, 2 free, anything
   else unknown-and-recorded).
 - **`/multi-agent:update` deleted the Codex prompt on every run**, pruning
@@ -2076,14 +2177,14 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
   (added in v12.11.0) holds the banned characters as its own assertion list and
   was never allowlisted.
 - **Half-English pickers on Turkish runs: six shipped files contradicted the
-  canonical language matrix.** `rules.md` is unambiguous  -  `AskUserQuestion`
+  canonical language matrix.** `rules.md` is unambiguous - `AskUserQuestion`
   `question` and `options[].description` render in `outputLanguage`, only `label`,
   `header` and host chrome are pinned to English. But `/multi-agent:setup` Step 0
   claimed `promptLanguage` governs "interactive pickers and prompts ... Picker UI is
   always English", `/multi-agent:language` claimed "confirmation prompts ... are
   authored in English. Only the assistant's free-form replies follow
   `outputLanguage`", and four more files said variations of the same. Those are the
-  two commands a user goes to *configure* this, so the model followed whichever
+  two commands a user goes to _configure_ this, so the model followed whichever
   canonical-looking doc it read first and gate questions came out English. All six
   corrected to describe `promptLanguage`'s real scope: the button and chip chrome,
   never the question a user reads.
@@ -2093,7 +2194,7 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
 - New `smoke-language-matrix.sh`: asserts `rules.md` still pins the per-field
   matrix, then greps every shipped command / skill / ref for the seven phrasings
   that actually shipped and contradicted it. Two authoritative docs giving opposite
-  answers is a spec with two answers, not a wording nit  -  the gate found a sixth
+  answers is a spec with two answers, not a wording nit - the gate found a sixth
   violation (`_input-parser.md`) that the manual sweep had missed.
 
 ### Gates
@@ -2105,7 +2206,7 @@ Codex CLI becomes a third supported host, and a new pre-submission validation co
 - `smoke-install-layout.sh` extended to three targets, including a check that every
   concrete `$HOME/.codex` reference **resolves on disk**. The earlier "no `.claude`
   references remain" check was blind to a wrongly-rewritten path, which is how
-  `commands/multi-agent.md` became `multi-agent-refs/commands.md`  -  well-formed,
+  `commands/multi-agent.md` became `multi-agent-refs/commands.md` - well-formed,
   pointing at nothing. A miss is classified by whether the Claude counterpart
   exists, so broken-by-rewrite fails and broken-upstream is only reported.
 - New `test/codex-install.test.mjs` (24 assertions) locks the path-rewrite map,
@@ -2138,11 +2239,11 @@ bug that produced it.
 
 **All three encodings**, because a title can arrive in any of them:
 
-| | ampersand | less-than | em-dash |
-|---|---|---|---|
-| named | `&amp;` | `&lt;` | `&mdash;` |
-| decimal | `&#38;` | `&#60;` | `&#8212;` |
-| hex | `&#x26;` | `&#x3C;` | `&#x2014;` |
+|         | ampersand | less-than | em-dash    |
+| ------- | --------- | --------- | ---------- |
+| named   | `&amp;`   | `&lt;`    | `&mdash;`  |
+| decimal | `&#38;`   | `&#60;`   | `&#8212;`  |
+| hex     | `&#x26;`  | `&#x3C;`  | `&#x2014;` |
 
 The first version of this fix handled only the named column, which is the same bug
 fixed for one spelling out of three.
@@ -2360,7 +2461,7 @@ entry, so the count would have under-reported by 100+ files.
 ### Four gates that were tested, green, and never ran
 
 Every gate in this repo checks its own behaviour. Nothing checked that a gate is
-*reachable*. Four were not - each with a passing unit test and a passing smoke,
+_reachable_. Four were not - each with a passing unit test and a passing smoke,
 and no reference from `pipeline/commands/`, `multi-agent-refs/`, `agents/`,
 `skills/` or `install/`:
 
@@ -2521,7 +2622,7 @@ while fixing them.
 Two threads. The design-check command gains a scenario inventory, a coverage
 gate and MCP-currency gating, and the refactor/sync pair learns to research,
 audit and ship the companion dev-toolkit MCP server. Alongside that, a defect
-sweep found eight gates and features that exited 0 while doing nothing -  six
+sweep found eight gates and features that exited 0 while doing nothing - six
 of them guarded by a smoke test whose fixture had the wrong shape, so the suite
 stayed green the whole time.
 
@@ -2553,14 +2654,14 @@ Requires `@mmerterden/dev-toolkit-mcp` >= v2.9.0 for the App Store audit path.
   `smoke-personal-data.sh --root`, keeping one pattern list.
 - **shellcheck moves from `error` to `warning` severity.** `error` returns zero
   findings across all 175 scripts, so the gate could not catch this repo's
-  actual defect class -  SC2046 is a warning. Noisy codes are excluded with a
+  actual defect class - SC2046 is a warning. Noisy codes are excluded with a
   per-code rationale. Four real findings surfaced and are fixed, including two
   unguarded `cd` calls in `smoke-shadow-git.sh`, one preceding a relative
   `rm -rf`.
 - **`credential-store.sh` resolves logical keys through
   `prefs.global.keychainMapping`.** `get github` searched the backend for a
   credential literally named "github" and returned empty with exit 1 -
-  indistinguishable from "no such credential" -  because the entry is named by
+  indistinguishable from "no such credential" - because the entry is named by
   the mapping. Applied in `get`/`set`/`delete`, falling back to the logical key
   when no mapping exists.
 
@@ -2770,6 +2871,7 @@ all project specifics live in per-project `figma-config` / prefs.
 ## [12.2.0] - 2026-07-21
 
 ### Added
+
 - **Graylog log-fetch integration** — when a task's ticket/issue carries a transaction id (`trx`/`trxId`/`transaction id`) and/or a conversation id (`conversationId`/`convId`/`X-conversationId`), the pipeline fetches the matching Graylog log messages and injects them as advisory diagnostic context into Phase 1 analysis. Mirrors the Crashlytics analysis-context adapter (advisory only, no Phase-4 gate).
   - New `lib/fetch-graylog.sh` adapter (mirrors the Fortify hosted-service shape): host from `prefs.global.hosts.graylog` (+ `GRAYLOG_HOST_OVERRIDE`), token via `prefs.global.keychainMapping.graylog` → `${USER}_Graylog_Access_Token` through the credential-store resolver. Graylog PAT auth is HTTP Basic `<token>:token` delivered only via a `curl -K` process-substitution config (never on argv). Universal/relative search by full-text OR of the ids, range + limit configurable via env.
   - **Non-blocking by design:** any network/VPN failure degrades to an empty normalized result and exit 0 — a log fetch never blocks a run. Exit codes: 0 ok/degraded, 2 missing-token, 3 genuine auth rejection, 4 usage, 6 host-not-configured.
@@ -2778,6 +2880,7 @@ all project specifics live in per-project `figma-config` / prefs.
 ## [12.1.1] - 2026-07-21
 
 ### Changed
+
 - **Channel outputs no longer carry decorative/emotive emoji or smileys.** Jira/issue comments, Confluence & Wiki pages, and PR bodies are plain technical prose. Added an explicit no-emoji hard-rule to each channel template (`multi-agent-refs/channels/{jira,issue-comment,confluence,wiki}.md`) and an emoji-stripping pattern to the humanizer (`shared/external/humanizer`). Functional status/severity marks a fixed template defines (`✅/⏳` phase ticks, `🔴/🟡` severity labels) are unaffected.
 
 ---
@@ -2785,20 +2888,25 @@ all project specifics live in per-project `figma-config` / prefs.
 ## [12.1.0] - 2026-07-21
 
 ### Security
+
 - **`agent-guard.sh` is now wired by the default installer** (was opt-in via the setup template). A plain `install` now OS-enforces the two load-bearing git gates on every `Bash` tool call: no AI/assistant attribution in commit messages, and no force-push to a protected branch (`main`/`master`/`develop`).
 - **Force-push protection now fails CLOSED.** A detected force-push that can't be tokenized, or a bare force-push while the current branch can't be confirmed non-protected, is blocked rather than allowed. (The general guard stays fail-open; only the data-loss path is fail-closed.)
 - **Multi-repo clone hardening.** `cmd_prepare` disables git's `ext::`/`fd::` remote helpers (`protocol.ext.allow=never`, `protocol.fd.allow=never`) and ends options with `--`, closing an arbitrary-command-execution / option-injection vector on repo URLs sourced from `.gitmodules` suggestions. Local/file/https/ssh clones are unaffected.
 
 ### Changed
+
 - **Node floor raised to 20** (`.nvmrc`, `engines.node` → `>=20.0.0`). Node 18 was EOL and untested by CI; the matrix already covers 20/22.
 
 ### Refactored
+
 - **Token-cost pricing is now a single source.** The per-Mtok cost formula, previously copy-pasted across ~6 bash/mjs scripts, lives in `cost-lib.sh` (bash) + `_cost.mjs` (Node), both reading the shared `cost-table.json`. Zero runtime dependencies preserved.
 
 ### Added
+
 - **`smoke-source-parity.sh`** — guards feature-set drift between the two source trees (`commands/multi-agent/<name>` vs `skills/shared/core/multi-agent-<name>`); fails if a feature exists in one tree but not the other.
 
 ### Docs
+
 - Refreshed post-v12 doc drift: `SECURITY.md` + `ROADMAP.md` support/version markers → 12.x; `docs/features.md` smoke-suite count `10` → `100+`; ADR index now lists 0008 and 0008 carries a v10.7.0 amendment (the `_adapters.mjs` module was removed); `CONTRIBUTING.md` coverage claim clarified (local-only) and the stale phase-docs path corrected to `pipeline/multi-agent-refs/phases/`.
 
 ---
@@ -2918,7 +3026,7 @@ research, bug hunt, category scoring, upstream-drift check).
 - **False-success family.** `multi-repo-pipeline.sh` no longer prints
   "committed/pushed" on failure; `repo-cache.sh` keeps the previous cache when a
   refresh fails instead of serving an empty file for the TTL; `review-watch.sh
-  --watch` survives transient gh failures and its cursor can no longer move
+--watch` survives transient gh failures and its cursor can no longer move
   backwards.
 - **`issue-fetcher.sh`** classifies bare `#316` / `316` correctly (repo picker
   path instead of a malformed `//issues/` URL).
@@ -2928,7 +3036,7 @@ research, bug hunt, category scoring, upstream-drift check).
   code, ballooning snapshots with DerivedData), and `restore --files` removes
   files created after the snapshot instead of keeping half the change.
 - **macOS bash 3.2 portability**: `${URL,,}` in `fetch-swagger.sh`, `date -r
-  <file>` in `audit-log-rotate.sh` (which also rotates atomically now).
+<file>` in `audit-log-rotate.sh` (which also rotates atomically now).
 - **Glob translation** in `triage-memory.mjs` / `test-gap-scan.mjs`: `**` no
   longer breaks after the `*` pass (nested-path filters match again).
 - **`migrate-prefs.mjs`** errors on unknown flags (a `--dry-rnu` typo used to
@@ -3024,7 +3132,7 @@ Self-audit patch (found by running `/multi-agent:refactor` on the pipeline itsel
   lists it in the PRESERVED summary.
 - **Fix (gate regression): `lint-skills` scoped to `pipeline/skills`.** The
   v11.3.0 command-layout migration made command files match `find pipeline -name
-  SKILL.md`; slash commands have no `name:` frontmatter, so the skill linter
+SKILL.md`; slash commands have no `name:` frontmatter, so the skill linter
   started erroring on all 37 of them (latent because CI is billing-paused and
   releases were published manually). The linter now only checks actual skills.
 - **Fix: `.skills-index.json` is idempotent** - dropped the `generatedAt`
@@ -3035,7 +3143,7 @@ Self-audit patch (found by running `/multi-agent:refactor` on the pipeline itsel
 - **Fix: install "dev-only excluded" count** is now the real file count (the
   `fixtures/` directory was under-counted as one entry).
 - **Security (supply-chain):** `release.yml` publishes with `npm publish
-  --provenance` (`id-token: write`); all GitHub Actions pinned to commit SHAs;
+--provenance` (`id-token: write`); all GitHub Actions pinned to commit SHAs;
   added `.github/dependabot.yml` (actions + npm dev deps); `credential-store.sh`
   escapes single quotes in the Windows PowerShell paths.
 - **New: `eval-mine-corpus.mjs`** turns recorded triage decisions
@@ -3147,7 +3255,7 @@ command is a breaking surface change).
   skeleton (Task/Story: Detailed Description, Scope, Acceptance Criteria, Test
   Scenarios; Bug: Detailed Description, Steps to Reproduce, Expected/Actual
   Result, Environment). Conditional sections (Design Reference, API Contract /
-  Swagger, Screenshots, Notes) render only when their trigger is present  -  no
+  Swagger, Screenshots, Notes) render only when their trigger is present - no
   empty placeholder headings, nothing invented.
 - **Test Scenarios pulled from Jira convention.** Detects linked Xray/Zephyr test
   issues or a dominant test-scenario heading style and reuses it; falls back to an
@@ -3290,7 +3398,7 @@ Live tracker UX: per-tile cost, a real "currently doing X" line, and tracker con
   history (elapsed, tokens, USD) survives, Phase 5 is closed with a Result
   meta, the Claude Code TaskList is rebuilt from state, and one line
   summarizes the inherited history (`Continuing <id>: phases 0-3 finished
-  earlier (12m, 38.4k tok, ~$0.74)`). `add` is idempotent to make this safe.
+earlier (12m, 38.4k tok, ~$0.74)`). `add` is idempotent to make this safe.
 - **`/multi-agent:resume` rebuilds the phase tiles** from `tracker-state.json`
   (the contract documented it; the command now actually does it).
 - **Phase 0 + 7 token forwarding**: the clarifier call and the Phase 7 report
@@ -3591,7 +3699,7 @@ Generic SwiftUI interaction coverage for the figma-to-swiftui pipeline. Three
 new cross-cutting integration skills (navigation, overlays, bottom sheets) plus
 a reconcile-and-extend workflow, all native-SwiftUI-first with an optional
 per-project `ui.*` config hook so the same capabilities work on any SwiftUI
-codebase  -  no app-specific coupling. Phase 3D dev detection and Phase 4 review
+codebase - no app-specific coupling. Phase 3D dev detection and Phase 4 review
 both consume them.
 
 ### Added
@@ -3609,12 +3717,12 @@ both consume them.
   component against current Figma (drift-heal) + additively extend it for a
   need, behind a mandatory human gate; distinct from `figma-to-swiftui`
   (build new), `figma-mend` (rebuild), and `figma-fix` (review bug).
-- **`animated-gradient-border` UI pattern** (`figma-ui-patterns/patterns/`)  -
+- **`animated-gradient-border` UI pattern** (`figma-ui-patterns/patterns/`) -
   self-contained native-SwiftUI recipe (angular-gradient stroke + Reduce-Motion
   gate), no external dependency.
-- **`ui` block in `figma-project-config.schema.json`**  -  optional
+- **`ui` block in `figma-project-config.schema.json`** - optional
   `navigationSystem` / `overlaySystem` / `sheetSystem` (`mode: native | custom`
-  + type names). Absent → native SwiftUI.
+  - type names). Absent → native SwiftUI.
 
 ### Changed
 
@@ -3650,7 +3758,7 @@ stale worktrees, and validates state before resume.
   Opus. This also resolves the prior CLAUDE.md-vs-phase-doc inconsistency
   (CLAUDE.md already documented Opus for these stages).
 - **Model fallback ladder is now `opus -> sonnet`** (was `fable -> opus ->
-  sonnet`). `modelFallback.fallbackModel` default is `sonnet`. The
+sonnet`). `modelFallback.fallbackModel` default is `sonnet`. The
   `premiumTierUntil` date gate is kept as a generic mechanism for any future
   plan-window-limited premium tier. `model-fallback.md` bumped to v10.1.0 and
   `smoke-model-fallback.sh` updated to assert the new ladder + Opus personas.
@@ -3728,12 +3836,12 @@ token ledger agree on what an input token is.
 - **Prompt-cache reuse ratio in metrics.** `aggregate-metrics.mjs` now sums
   `tokens_cached` per model and reports `cache_ratio = cached / (in + cached)`
   - the share of input tokens served from the host prompt cache - per model and
-  overall, in all three output modes (json / markdown / text). This is the
-  single number that says whether cache-friendly prompt structuring is paying
-  off. Backward-compatible: a phase that omits `tokens_cached` reads as 0%.
+    overall, in all three output modes (json / markdown / text). This is the
+    single number that says whether cache-friendly prompt structuring is paying
+    off. Backward-compatible: a phase that omits `tokens_cached` reads as 0%.
 - **PR review iteration counter derived from the PR itself.** On a `needs_work`
   post, the iteration number is re-derived as `max("iteration #N" already on the
-  PR) + 1` instead of trusting agent-state. Standalone `/multi-agent:review`
+PR) + 1` instead of trusting agent-state. Standalone `/multi-agent:review`
   runs use a fresh task id each time, so the PR comments are the only reliable
   cross-run source of truth.
 
@@ -3743,7 +3851,7 @@ token ledger agree on what an input token is.
   `render-agent-log-cost.sh` treated `tokens_in` as cache-inclusive and
   subtracted the cached count (`fresh = in - min(cached, in)`), while the new
   `aggregate-metrics.mjs` treated `tokens_in` as cache-exclusive (`total =
-  in + cached`). Fed real data with high cache reuse (`cached > in`), the
+in + cached`). Fed real data with high cache reuse (`cached > in`), the
   renderer collapsed `fresh` to 0 and underpriced the row. Standardized on the
   **cache-exclusive** convention that matches the host usage report
   (`input_tokens` and `cache_read_input_tokens` are disjoint): the renderer no
@@ -3786,7 +3894,7 @@ reproduced locally by putting GNU coreutils' gnubin ahead of PATH.
   `search-logs.sh` (since-filter, scoring, JSON/TSV output) and
   `repo-cache.sh` TTLs. Probe order flipped to GNU-first (`stat -c` first;
   BSD rejects `-c`, so the fallback chain is safe both ways). `date -r
-  <epoch>` display calls gained a GNU `date -d @` fallback.
+<epoch>` display calls gained a GNU `date -d @` fallback.
 - **Hardcoded maintainer layout `$HOME/multi-agent-pipeline` removed** from
   `smoke-schema-validation.sh` (preferences-template path) and
   `smoke-pat-audit.sh` (.gitignore audit-log check) - both now derive the
@@ -4138,10 +4246,12 @@ Disk hygiene + correctness hardening, all gate-backed.
 Toward proven (not just designed): measure the features instead of asserting them, and ship the evidence-collection harness.
 
 ### Added
+
 - **Measured intent-guard accuracy** (`eval-intent.mjs` + `pipeline/eval/intent-cases.json`). 26 labeled EN+TR cases run through `classify-intent.sh`; the gate uses operationally-safe accuracy (the only dangerous errors are a task read as a question -> work skipped, or a question read as a task -> a spurious worktree; `ambiguous` proceeds as a task so it is safe for task cases). Currently 100% safe / 96.2% exact. Wired into `npm test`. Turns the heuristic into a number with a regression set.
 - **Per-run outcome metrics** (`run-metrics.mjs` + fixture + `smoke-run-metrics.sh`). Parses an `agent-state.json` into the numbers that answer "did this run go well": review iterations (rework loops), first-pass-clean, reviewer signal-to-noise (accepted / raw findings), consensus verdict, build outcome. Phase 7 emits it; accumulating the output across real runs is the real-world validation corpus that golden tasks + benchmarks only approximate.
 
 ### Notes
+
 - These address the honest "measure, don't assume" gap from the self-review: the intent guard and review signal are now quantified, and the harness exists to turn real runs into evidence. The remaining step (running real tasks + a public benchmark) is the user's, and cannot be fabricated.
 - CI auto-run stays disabled in `test.yml` (the maintainer paused it for GitHub Actions billing); re-enabling the push/PR triggers is a billing decision, not changed here.
 
@@ -4150,6 +4260,7 @@ Toward proven (not just designed): measure the features instead of asserting the
 Closes the structural gaps the adversarial review surfaced: the deterministic gates now actually RUN on the three adapter platforms, and the multi-model review is restored there using each platform's real model lineup.
 
 ### Added
+
 - **Shared runtime so gates execute on Cursor / Antigravity / VS Code Copilot Chat.** The gate scripts + lib + schemas are installed once to `~/.multi-agent/` (dev-only / PII files excluded) and the emitted agents/commands/workflow reference them by absolute path (`installSharedRuntime` / `rewriteScriptRefs` in `_base.mjs`). Previously the emitted agents referenced `pipeline/scripts/...` which did not exist in the consumer project, so the deterministic gates could not run there at all. Uninstall removes the runtime. Enforced by `smoke-shared-runtime.sh`.
 - **Cross-vendor 2-model review on the adapter platforms.** A second reviewer agent (`ma-code-reviewer-x`) is emitted pinned to a different vendor, using each platform's actual model lineup (researched mid-2026, centralized in `_base.mjs#REVIEWER_MODELS`): Cursor `inherit` + `gpt-5.5`; VS Code Copilot Chat `Claude Opus 4.8` + `GPT-5.5`; Antigravity documents a `Gemini 3 Pro` + `Claude Opus 4.6` pair (its models are dropdown-selected, not file-pinned). Restores the cross-model diversity that was Claude-Code / Copilot-CLI-only.
 - **Recommended PreToolUse hooks template** (`install/templates/claude-hooks.json`) wiring the secret scan as a HARD pre-commit gate on Claude Code; `multi-agent:setup` Step 8 offers to merge it. The secret scan is the one gate that is OS-hookable (no run-specific args); the others are phase-invoked by contract. Enforced by `smoke-gate-hooks.sh`.
@@ -4157,9 +4268,11 @@ Closes the structural gaps the adversarial review surfaced: the deterministic ga
 - **Reviewer-count contract checks** in `smoke-cross-cli-behavior.sh`: locks Claude=2 / Copilot=3 + the documented adapter-platform reviewer set against drift.
 
 ### Fixed
+
 - VS Code Copilot Chat agents emitted `model: inherit`, which is not a valid Copilot model (there is no `inherit` keyword; omitting `model` inherits the picker). Normal personas now omit `model`; the two reviewers pin a picker label.
 
 ### Notes (stated honestly)
+
 - The adapter platforms still have no `PreToolUse` equivalent, so their gates are workflow-enforced (run as steps) rather than OS-blocked.
 - Pinned adapter models depend on the user's subscription; swap them in `REVIEWER_MODELS` / the Antigravity dropdown if a model is unavailable.
 - Old PII-bearing versions (9.3.0-9.3.3) remain in the private registry: GitHub Packages does not support `npm deprecate` (E400), and deleting versions / rewriting git history are irreversible and were left to an explicit owner decision. The package + repo are private, so this is not a public exposure.
@@ -4169,12 +4282,14 @@ Closes the structural gaps the adversarial review surfaced: the deterministic ga
 Second round of review-driven fixes - the lower-severity findings left open in 9.3.3, plus an honesty correction on the multi-platform claim.
 
 ### Fixed
+
 - **Arg parsers dropped values starting with `--`.** `learnings-ledger.mjs` and `evidence-gate.mjs` now accept the `--key=value` form, so a statement / pattern that begins with `--` (e.g. `--statement="-- prefer let"`) is preserved instead of silently failing.
 - **Secret scan skipped filenames with spaces.** `pre-commit-check.sh` now iterates staged files NUL-delimited (`git diff --name-only -z`), closing a false-negative where a secret in `my file.txt` went unscanned.
 - **`learnings-ledger forget` rewrite is now atomic** (temp file + rename) so a crash or concurrent reader never sees a half-written ledger.
 - **`from-triage` scope for a top-level file** is now the filename itself, not a stray `./*` glob.
 
 ### Changed
+
 - **Honest multi-platform claim.** The README and the adapter-emitted orchestration commands now state plainly that Claude Code + Copilot CLI run the pipeline natively (gate scripts installed), while Cursor / Antigravity / VS Code Copilot Chat receive the workflow + subagents + MCP but run the deterministic gates as ADVISORY (the gate scripts are not copied into those projects). Making those gates execute on the three adapter platforms is tracked work (needs a uniform script-path resolution + per-platform testing), not yet shipped. Stale `cursor.mjs` header ("26 commands can't run there") corrected.
 
 ## [9.3.3] - 2026-05-30
@@ -4182,68 +4297,82 @@ Second round of review-driven fixes - the lower-severity findings left open in 9
 A 4-agent adversarial review of the v9.3.x work surfaced real defects in the features just shipped; this release fixes them.
 
 ### Fixed
+
 - **evidence-gate was bypassable.** A failing build log that also contained the word "SUCCESS" (cached-step note, banner) passed because success and failure were weighed equally. Failure markers are now DECISIVE (a definitive failure marker fails the claim regardless of success text), success markers were narrowed (dropped the generic `\bSUCCESS\b`), and caller-supplied `--success/--failure-pattern` are length-capped + compiled in a try/catch so a bad pattern is a clean usage error, not a crash. (`evidence-gate.mjs`, `smoke-evidence-gate.sh`)
 - **intent-guard misclassified questions as tasks.** "does it support offline mode", "should we enable caching" were read as tasks (the imperative check beat the interrogative) and would spin up a worktree. A strong question signal (interrogative lead / trailing `?` / TR particle) now wins over a bare imperative verb; an explicit polite request ("can you split this file") stays a task. (`classify-intent.sh`, `smoke-intent-guard.sh`)
 - **consensus block was decorative.** `validate-triage.mjs` validated the v3.1.0 consensus block structurally but never cross-checked it: `unanimous-block` + `approved:true`, `unanimous-pass` + an accepted blocker, and a single-reviewer "unanimous" verdict now all fail validation. (`smoke-phase4-triage.sh`)
 - **A malformed `tokens_cached` poisoned the whole tokens call.** `log-metric.sh` now sanitizes a non-integer cached count to 0 before forwarding, so the valid in/out counts still land. (`smoke-agent-log-cost.sh`)
 
 ### Security
+
 - **Stopped real maintainer/employer identifiers from shipping in the npm tarball.** The dev-only figma substitution map (a scrub table that by design holds real upstream values), the two personal-data scanners, and two internal planning docs were excluded from the package via negated `files` entries; stray corporate hosts / repo names / a private Jira key in CHANGELOG + docs examples were genericized. The leak gate now scans the published npm tarball (not just the install tree), closing the hole that let these ship in 9.3.0-9.3.2. The repo/package are private, so this was not a public exposure. (`smoke-install-leak-gate.sh`, `.npmignore`, `package.json` files)
 
 ### Changed
+
 - README "What's new" refreshed to v9.3.3; em-dashes removed from README and the `MANDATORY` keyword removed from `install/templates/copilot-instructions.md` (project style rules).
 
 ## [9.3.2] - 2026-05-30
 
 ### Fixed
+
 - **Cost-ledger cache pricing is now wired end-to-end.** v9.3.0 added `cacheReadPerMtok` pricing + a cache-reads line to `render-agent-log-cost.sh`, but nothing fed `tokens_cached` to the tracker, so the feature was dormant. `phase-tracker.sh tokens` now accepts an optional 4th `cached` arg (defaults to 0, fully back-compatible), `log-metric.sh` forwards `tokens_cached=` into it, and the Phase 4 telemetry doc documents passing the host's `cache_read_input_tokens`. Verified end-to-end in `smoke-agent-log-cost.sh`.
 - `evidence-gate.mjs` made executable to match its sibling `.mjs` scripts.
 
 ### Changed
+
 - README "What's new" refreshed to v9.3.x (was stale at v8.8.1).
 
 ## [9.3.1] - 2026-05-30
 
 ### Fixed
+
 - **Learnings ledger no longer auto-suppresses rejected BLOCKING findings.** `learnings-ledger.mjs from-triage` previously distilled every rejected finding into a durable "do not re-flag" preference regardless of severity; a single wrong rejection of a blocking issue could permanently silence that class on future runs. Blocking-severity rejections are now skipped (reported as `skippedBlocking`); only lower-severity rejections become durable preferences, and they are recorded at `low` confidence.
 
 ### Added
+
 - **`learnings-ledger.mjs forget`** subcommand to remove a bad or stale ledger entry by statement substring and/or kind (the one non-append operation), so a wrong learning can be cleared instead of persisting forever. Enforced by `smoke-learnings-ledger.sh`.
 
 ## [9.3.0] - 2026-05-30
 
 ### Added
+
 - **Review consensus surfacing (anti-correlation).** Phase 4 triage now records an optional `consensus` block (triage-output schema v3.1.0): `reviewerCount`, a `verdict` (`unanimous-pass` / `unanimous-block` / `split` / `unverified`), and `disagreements[]`. Unanimous agreement among same-base-model reviewers on a judgment-heavy surface (security, auth, concurrency, money, migration) is marked `unverified` and surfaced to the user instead of being trusted as a pass. Disagreements are shown at the Step 4 checkpoint and written to the agent-log "Review Consensus" section. Validated by `validate-triage.mjs` + new fixtures in `smoke-phase4-triage.sh`.
 - **Persistent learnings ledger** (`pipeline/scripts/learnings-ledger.mjs`, schema `learnings-ledger.schema.json`). A per-repo, append-only store of durable architectural facts, conventions, and explicitly rejected review preferences, stored next to the triage corpus. A compact `<repo-learnings>` brief is injected into Phase 1 analysis and Phase 4 triage so agents stop re-discovering structure and reviewers stop re-flagging rejected feedback (the most-cited cold-boot-amnesia complaint). Phase 7 distills each run's rejected findings into the ledger. On by default via `prefs.global.learningsLedger`; per-repo isolated. Enforced by `smoke-learnings-ledger.sh`.
 - **Default-FAIL evidence gate** (`pipeline/scripts/evidence-gate.mjs`). A build/test/review "passed" claim is only trusted when a substantiating log artifact exists and shows success; the gate fails CLOSED on missing, empty, or contradicting evidence. Wired into Phase 3 (build), Phase 4 Stage 1 gates (build + test), and Phase 6 (commit). Enforced by `smoke-evidence-gate.sh`.
 - **Conceptual-vs-edit intent guard** (`pipeline/lib/classify-intent.sh`). A deterministic, language-aware (EN + TR) classifier runs on free-text input at Phase 0; a question is answered in place instead of spinning up a branch/worktree. On by default via `prefs.global.intentGuard`. Enforced by `smoke-intent-guard.sh`.
 
 ### Changed
+
 - **Secret pre-commit gate** (`pre-commit-check.sh`) extended beyond pattern matching: high-signal provider-token prefixes (GitHub PAT, Slack, Google API key, Stripe, npm, GitLab), JWT detection, and a Shannon-entropy scan that catches custom/unknown secrets while exempting lockfiles, integrity hashes, source maps, and snapshots.
 - **Per-phase cost ledger** (`render-agent-log-cost.sh`) now prices prompt-cache reads at the discounted `cacheReadPerMtok` rate (cost-table schema 1.1.0; backward-compatible, defaults to 0 cached), appends a "Top cost driver" line so the report shows where spend went, and surfaces a cache-reads line when the tracker recorded cache hits.
 - Uninstall header and package description refreshed to the current 5-platform set (Cursor / Antigravity / VS Code Copilot Chat), replacing stale Windsurf/Cline references.
 
 ### Fixed
+
 - Cursor uninstall left an empty `.cursor/commands/` directory behind, and the `.cursor` parent-empty cleanup ran before orchestration teardown so the parent was never reclaimed. Both now clean up after the orchestration uninstall.
 
 ## [9.2.0] - 2026-05-30
 
 ### Added
+
 - **Full-pipeline orchestration on three more platforms** (previously knowledge-layer only). Cursor (`.cursor/agents/ma-*.md` subagents + `.cursor/commands/multi-agent.md` + `.cursor/mcp.json`), Antigravity (`.agent/workflows/multi-agent.md` + `.agent/rules/` + `AGENTS.md` + `.agent/mcp_config.json`), and VS Code Copilot Chat (`.github/agents/ma-*.agent.md` + `.github/prompts/multi-agent.prompt.md` + `.vscode/mcp.json`). Each adapter transforms the pipeline personas into the platform's subagent/agent format and registers the dev-toolkit MCP server. Install with `--cursor` / `--antigravity` / `--copilot-chat` (or `--all-tools`).
 - **Picker contract** (`refs/picker-contract.md`) + `pipeline/lib/ask-choice.sh`: a cross-platform single-choice abstraction so confirmations degrade gracefully where there is no native `AskUserQuestion` (numbered-menu fallback; `ASK_CHOICE_DEFAULT` for autopilot/CI).
 - **Proactive token-budget cap** (`prefs.global.costBudget` + `cost-budget-check.mjs`): prices the phase-tracker accumulators live and warns/halts before spend runs away.
 - **Eval harness** expanded from 2 to 7 golden tasks across all stacks and every triage bucket.
 
 ### Changed
+
 - **Confirmations are now native pickers** instead of typed keywords (`AskUserQuestion` on Claude Code, degrading per the picker contract elsewhere). Removed the typed `y/N` / `onayla`/`iptal` prompts.
 - **Command/skill instruction files are English** throughout (token efficiency + model comprehension); `outputLanguage` still governs all runtime user-facing text.
 - Phase 5 (User Test) now runs only in interactive worktree-backed modes (`dev`, `full`); every autopilot/local variant skips it.
 - Analysis->plan contract field names aligned across schema, validator, and phase docs; the "no MCP outside analysis" gate made enforceable (telemetry recorded + checked).
 
 ### Fixed
+
 - Command-injection vectors in `diff-explain.mjs` and `figma-screenshot.sh`; `review-watch` cursor loss (re-reviewed PRs forever); `diff-risk` / `classify-plan-safety` / `match-skills` logic defects; `write-state` stale-lock deadlock; several pre-existing test failures (mode-dispatch drift, README/install-layout counts, token budgets).
 
 ### Removed
+
 - Dead `--windsurf` / `--cline` / `--continue` / `--zed` install flags (the adapters were dropped in 8.5.4; only the advertising lingered).
 
 ## [9.1.1] - 2026-05-16
@@ -4257,7 +4386,7 @@ A 4-agent adversarial review of the v9.3.x work surfaced real defects in the fea
   - `pipeline/commands/multi-agent/channels.md`: 103 chars
   - `pipeline/skills/shared/core/multi-agent/SKILL.md`: 97 chars
   - `pipeline/commands/multi-agent/setup.md`: 79 chars
-- Mapping: `U+2014` -> ` - `, `U+2013` -> `-`, `U+2026` -> `...`, `U+201C/D` -> `"`, `U+2018/9` -> `'`, `U+00A7` -> `section`.
+- Mapping: `U+2014` -> `-`, `U+2013` -> `-`, `U+2026` -> `...`, `U+201C/D` -> `"`, `U+2018/9` -> `'`, `U+00A7` -> `section`.
 
 ### Excluded from sweep
 
@@ -4301,13 +4430,13 @@ A 4-agent adversarial review of the v9.3.x work surfaced real defects in the fea
 
 Six measurable improvements on the hot path:
 
-| Fix | Before | After | Speedup |
-|---|---|---|---|
-| `smoke-personal-data.sh` pattern alternation (single grep vs 22 invocations) | 3.348s | 1.545s | 2.2x |
-| `smoke-no-token-prompt.sh` multi-`-e` (single grep vs 7x7=49 invocations) | 0.485s | 0.014s | 35x |
-| `phase-tracker.sh` render batched jq (U+001F separator preserves empty fields) | ~7 jq calls per phase + ~3 per sub | 1 batch + 1 per active sub/meta | ~120 subprocess azalma per render |
-| `issue-fetcher.sh` python3 batch (single inline vs 7 separate calls per fetch) | 0.806s / 3 iter | 0.136s / 3 iter | 5.9x |
-| `md2confluence-v3.py` HTTP retry wrapper (3-attempt exponential backoff on 5xx / 429) + `ThreadPoolExecutor(max_workers=4)` paralel attachment | sequential N x ~1.5s | parallel ~max(individual) | up to 4x on multi-screenshot pages, plus transient-error resilience |
+| Fix                                                                                                                                                                                   | Before                                                                    | After                                      | Speedup                                                                           |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------- |
+| `smoke-personal-data.sh` pattern alternation (single grep vs 22 invocations)                                                                                                          | 3.348s                                                                    | 1.545s                                     | 2.2x                                                                              |
+| `smoke-no-token-prompt.sh` multi-`-e` (single grep vs 7x7=49 invocations)                                                                                                             | 0.485s                                                                    | 0.014s                                     | 35x                                                                               |
+| `phase-tracker.sh` render batched jq (U+001F separator preserves empty fields)                                                                                                        | ~7 jq calls per phase + ~3 per sub                                        | 1 batch + 1 per active sub/meta            | ~120 subprocess azalma per render                                                 |
+| `issue-fetcher.sh` python3 batch (single inline vs 7 separate calls per fetch)                                                                                                        | 0.806s / 3 iter                                                           | 0.136s / 3 iter                            | 5.9x                                                                              |
+| `md2confluence-v3.py` HTTP retry wrapper (3-attempt exponential backoff on 5xx / 429) + `ThreadPoolExecutor(max_workers=4)` paralel attachment                                        | sequential N x ~1.5s                                                      | parallel ~max(individual)                  | up to 4x on multi-screenshot pages, plus transient-error resilience               |
 | `extract-conventions.sh` env override `EXTRACT_CONV_EXTRA_ROOTS` + auto-add `.gitmodules` paths, bucket timeout 30s -> 10s, `xargs basename` -> `awk -F/ '{print $NF}'` (8 callsites) | scan roots too narrow on monorepos with submodules; per-bucket 30s budget | submodule paths auto-detected, faster fail | resolves "confidence: none" on submodule-heavy repos; ~100-300ms saved per bucket |
 
 ### Verified