@mmerterden/multi-agent-pipeline 17.6.0 → 19.0.0

package/pipeline/lib/run-paths.sh

@@ -0,0 +1,335 @@
+#!/bin/bash
+# run-paths.sh  -  the single resolver for pipeline run-state paths (shell side).
+#
+# Shell twin of pipeline/scripts/_run-paths.mjs. The two must agree; the
+# contract is asserted by pipeline/scripts/smoke-run-path-canonical.sh, which
+# runs both over the same fixture tree and diffs their answers.
+#
+# A run's files live under the log root in ONE of two layouts:
+#
+#   nested   <root>/<project>/<task_id>/     documented canonical
+#   flat     <root>/<task_id>/               what phase-tracker.sh writes
+#
+# Both are populated on real machines, so every reader accepts both. This file
+# does NOT change where anything is written: measured on a real install, 90 of
+# 103 runs are flat and every tracker-state.json is. A task id present in both
+# layouts is ONE run; the most recently written directory wins. Relocation is
+# opt-in and explicit: `migrate-state.mjs --relocate`.
+#
+# No `set -e` on purpose: this is a sourced library and changing the caller's
+# shell options is not this file's business.
+#
+# Usage:
+#   . "$(dirname "$0")/../lib/run-paths.sh"
+#   root=$(ma_logs_root)
+#   dir=$(ma_resolve_run_dir "{JIRA_KEY}-123") || echo "unknown run"
+#   f=$(ma_resolve_run_file "{JIRA_KEY}-123" tracker-state.json)
+#   ma_list_runs   # task_id<TAB>project<TAB>dir<TAB>layout, one per run
+#
+# Bash 3.2 compatible: no associative arrays, no `mapfile`, no `grep -P`.
+
+# Marker files and reserved names are spelled out at each test rather than held
+# in a space-separated variable iterated with `for x in $VAR`. bash word-splits
+# an unquoted variable; zsh does not, so there the loop would run ONCE with the
+# whole string as a single word, every test would fail, and the library would
+# answer "no runs" instead of erroring. This file is sourced, so the caller's
+# shell decides - and answering zero is the failure mode that looks like data.
+
+ma_logs_root() {
+  printf '%s\n' "${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}"
+}
+
+# ma_is_run_dir <dir> -> 0 when the directory holds at least one run marker
+# Phase 4 removes the worktree and salvages the run's files into `artifacts/`
+# inside the same run directory, so a shipped run keeps its state one level
+# deeper. A reader that only looks at the top level reports it as stateless.
+MA_ARTIFACTS_SUBDIR=artifacts
+
+ma_is_run_dir() {
+  local d="$1"
+  [ -f "$d/agent-state.json" ] && return 0
+  [ -f "$d/tracker-state.json" ] && return 0
+  [ -f "$d/agent-log.md" ] && return 0
+  [ -f "$d/$MA_ARTIFACTS_SUBDIR/agent-state.json" ] && return 0
+  [ -f "$d/$MA_ARTIFACTS_SUBDIR/tracker-state.json" ] && return 0
+  [ -f "$d/$MA_ARTIFACTS_SUBDIR/agent-log.md" ] && return 0
+  return 1
+}
+
+ma_is_reserved() {
+  case "$1" in
+    review-watch | jira-backups | shadow-git | _analysis-jira | prompts) return 0 ;;
+  esac
+  return 1
+}
+
+# Newest mtime across a run directory's markers, as epoch seconds. GNU-first
+# `stat -c` ordering is required: `stat -f` is a valid GNU flag
+# (--file-system) that SUCCEEDS, so BSD-first would silently win on Linux.
+ma_run_mtime() {
+  local d="$1" m t newest=0 b
+  for b in "$d" "$d/$MA_ARTIFACTS_SUBDIR"; do
+    for m in agent-state.json tracker-state.json agent-log.md; do
+      [ -f "$b/$m" ] || continue
+      # -L follows symlinks. Some nested run directories are symlink bridges to
+      # the flat copy of the same run (3 such pairs on the install this was
+      # measured on); without -L the shell reads the LINK's mtime while the
+      # .mjs twin's fs.statSync reads the TARGET's, and the two picked
+      # different winners for one record. Both must read the same clock.
+      t=$(stat -L -c %Y "$b/$m" 2>/dev/null || stat -L -f %m "$b/$m" 2>/dev/null || echo 0)
+      [ -n "$t" ] || t=0
+      [ "$t" -gt "$newest" ] && newest="$t"
+    done
+  done
+  printf '%s\n' "$newest"
+}
+
+# ma_canonical_run_dir <task_id> [project] -> where a NEW run should be written
+ma_canonical_run_dir() {
+  local task_id="$1" project="${2:-}" root
+  root=$(ma_logs_root)
+  if [ -n "$project" ]; then
+    printf '%s\n' "$root/$project/$task_id"
+  else
+    printf '%s\n' "$root/$task_id"
+  fi
+}
+
+# ma_run_dir_candidates <task_id> [project] -> candidate dirs, most specific
+# first. Existence is not checked here.
+ma_run_dir_candidates() {
+  local task_id="$1" project="${2:-}" root d n
+  root=$(ma_logs_root)
+  [ -n "$project" ] && printf '%s\n' "$root/$project/$task_id"
+  printf '%s\n' "$root/$task_id"
+  [ -n "$project" ] && return 0
+  # No project given: the run may still be nested under one.
+  #
+  # `find` rather than a `*/` glob on purpose: an unmatched glob is a literal
+  # string in bash and a hard error in zsh, and this file is sourced, so the
+  # caller's shell decides. find behaves identically in both.
+  while IFS= read -r d; do
+    [ -n "$d" ] || continue
+    n=$(basename "$d")
+    ma_is_reserved "$n" && continue
+    [ "$n" = "$task_id" ] && continue
+    ma_is_run_dir "$root/$n/$task_id" && printf '%s\n' "$root/$n/$task_id"
+  done <<EOF
+$(find "$root" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+EOF
+  return 0
+}
+
+# ma_realpath <path> -> the path with every symlink resolved, or the input when
+# it cannot be resolved. BSD realpath first, python3 as the fallback (both are
+# already hard requirements of this tree).
+ma_realpath() {
+  realpath "$1" 2>/dev/null ||
+    python3 -c 'import os,sys; print(os.path.realpath(sys.argv[1]))' "$1" 2>/dev/null ||
+    printf '%s\n' "$1"
+}
+
+# ma_is_bridge_dir <dir> -> 0 when any marker in it is a symlink elsewhere.
+# Some nested run directories are symlink bridges into the flat copy of the
+# same run. They are one record seen twice, not two copies.
+ma_is_bridge_dir() {
+  local d="$1" m
+  for m in agent-state.json tracker-state.json agent-log.md; do
+    [ -L "$d/$m" ] && return 0
+  done
+  return 1
+}
+
+# ma_same_record <dir_a> <dir_b> -> 0 when both are views of ONE record.
+ma_same_record() {
+  local a="$1" b="$2" m ra rb
+  for m in agent-state.json tracker-state.json agent-log.md; do
+    [ -e "$a/$m" ] && [ -e "$b/$m" ] || continue
+    ra=$(ma_realpath "$a/$m")
+    rb=$(ma_realpath "$b/$m")
+    [ "$ra" = "$rb" ] && return 0
+  done
+  return 1
+}
+
+# ma_rank_fields <dir> -> "<mtime>\t<has_state>\t<depth>", the three ranking
+# columns used to pick between candidate directories for one task id.
+#
+# ma_sort_key packs the same three into one space-separated key for callers
+# that sort a single column; both must match compareCandidates in
+# _run-paths.mjs exactly.
+#
+# mtime alone is not an order: two directories written in the same second tie,
+# and each implementation then fell back to its own traversal order - which is
+# how the two came to disagree about a run present in both layouts. The tail of
+# the key defines the answer: richer record first (agent-state.json is what
+# every reader wants), then the documented nested layout, then the path.
+ma_rank_fields() {
+  local d="$1" t has_state depth real
+  t=$(ma_run_mtime "$d")
+  has_state=0
+  [ -f "$d/agent-state.json" ] && has_state=1
+  depth=$(printf '%s' "$d" | awk -F/ '{print NF}')
+  real=1
+  ma_is_bridge_dir "$d" && real=0
+  printf '%s\t%s\t%s\t%s\n' "$real" "$t" "$has_state" "$depth"
+}
+
+ma_sort_key() {
+  local d="$1" t has_state depth real
+  t=$(ma_run_mtime "$d")
+  has_state=0
+  [ -f "$d/agent-state.json" ] && has_state=1
+  depth=$(printf '%s' "$d" | awk -F/ '{print NF}')
+  real=1
+  ma_is_bridge_dir "$d" && real=0
+  printf '%d %012d %d %04d %s\n' "$real" "$t" "$has_state" "$depth" "$d"
+}
+
+# ma_resolve_run_dir <task_id> [project] -> the directory, or rc 1 when unknown.
+ma_resolve_run_dir() {
+  local task_id="$1" project="${2:-}" c best
+  best=$(
+    while IFS= read -r c; do
+      [ -n "$c" ] || continue
+      ma_is_run_dir "$c" || continue
+      ma_sort_key "$c"
+    done <<EOF
+$(ma_run_dir_candidates "$task_id" "$project")
+EOF
+  )
+  [ -n "$best" ] || return 1
+  # Descending on mtime, then has-state, then depth; ascending on path.
+  printf '%s\n' "$best" | sort -k1,1nr -k2,2nr -k3,3nr -k4,4nr -k5,5 | head -1 | cut -d' ' -f5-
+}
+
+# ma_task_id_variants <id> -> the spellings one task id has been written under,
+# in preference order. `#316` arrives from a GitHub issue reference, `316` from
+# the bare-number input class, `task-316` from an older directory convention.
+# Callers used to inline this list; dropping a spelling silently stops old runs
+# from resolving.
+ma_task_id_variants() {
+  local raw="$1" bare
+  bare="${raw#\#}"
+  printf '%s\n' "$raw"
+  [ "$bare" != "$raw" ] && printf '%s\n' "$bare"
+  printf '%s\n' "task-$bare"
+}
+
+# ma_resolve_run_dir_any <task_id> [project] -> dir for any spelling, or rc 1
+ma_resolve_run_dir_any() {
+  local task_id="$1" project="${2:-}" v dir
+  while IFS= read -r v; do
+    [ -n "$v" ] || continue
+    dir=$(ma_resolve_run_dir "$v" "$project") && {
+      printf '%s\n' "$dir"
+      return 0
+    }
+  done <<EOF
+$(ma_task_id_variants "$task_id")
+EOF
+  return 1
+}
+
+# ma_resolve_run_file <task_id> <filename> [project] -> path, or rc 1.
+# Every spelling of the id is tried.
+ma_resolve_run_file() {
+  local task_id="$1" filename="$2" project="${3:-}" v dir
+  while IFS= read -r v; do
+    [ -n "$v" ] || continue
+    dir=$(ma_resolve_run_dir "$v" "$project") || continue
+    if [ -f "$dir/$filename" ]; then
+      printf '%s\n' "$dir/$filename"
+      return 0
+    fi
+    # The salvaged copy Phase 4 leaves behind.
+    if [ -f "$dir/$MA_ARTIFACTS_SUBDIR/$filename" ]; then
+      printf '%s\n' "$dir/$MA_ARTIFACTS_SUBDIR/$filename"
+      return 0
+    fi
+  done <<EOF
+$(ma_task_id_variants "$task_id")
+EOF
+  return 1
+}
+
+# ma_list_runs -> one TAB-separated row per run, deduplicated by task id:
+#   task_id<TAB>project<TAB>dir<TAB>layout
+# `project` is "-" when the layout does not name one.
+ma_list_runs() {
+  local root d n kd kn rows row id
+  root=$(ma_logs_root)
+  [ -d "$root" ] || return 0
+  rows=""
+  while IFS= read -r d; do
+    [ -n "$d" ] || continue
+    n=$(basename "$d")
+    ma_is_reserved "$n" && continue
+    if ma_is_run_dir "$root/$n"; then
+      rows="$rows$n	-	$root/$n	flat	$(ma_rank_fields "$root/$n")
+"
+      continue
+    fi
+    while IFS= read -r kd; do
+      [ -n "$kd" ] || continue
+      kn=$(basename "$kd")
+      ma_is_run_dir "$root/$n/$kn" || continue
+      rows="$rows$kn	$n	$root/$n/$kn	nested	$(ma_rank_fields "$root/$n/$kn")
+"
+    done <<EOF
+$(find "$root/$n" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+EOF
+  done <<EOF
+$(find "$root" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+EOF
+  # Dedup by task id using the same total order as resolveRunDir and as
+  # compareCandidates in the .mjs twin: mtime desc, has-state desc, depth desc,
+  # path ASC. The sub-keys are separate columns on purpose - a single reverse
+  # sort over a composite key also reverses the path, which is the one
+  # component that has to ascend.
+  printf '%s' "$rows" | grep -v '^$' |
+    sort -t'	' -k1,1 -k5,5nr -k6,6nr -k7,7nr -k8,8nr -k3,3 | awk -F'	' '
+    !seen[$1]++ { print $1 "\t" $2 "\t" $3 "\t" $4 }
+  ' | sort -t'	' -k1,1
+}
+
+# ma_duplicate_run_ids -> task ids that exist as two SEPARATE records in the two
+# layouts, one per line. A symlink bridge is excluded: it is one record seen
+# twice, and reporting it overstates the drift.
+ma_duplicate_run_ids() {
+  local root d n kd kn pairs id dirs a b
+  root=$(ma_logs_root)
+  [ -d "$root" ] || return 0
+  pairs=$(
+    while IFS= read -r d; do
+      [ -n "$d" ] || continue
+      n=$(basename "$d")
+      ma_is_reserved "$n" && continue
+      if ma_is_run_dir "$root/$n"; then
+        printf '%s\t%s\n' "$n" "$root/$n"
+        continue
+      fi
+      while IFS= read -r kd; do
+        [ -n "$kd" ] || continue
+        kn=$(basename "$kd")
+        ma_is_run_dir "$root/$n/$kn" && printf '%s\t%s\n' "$kn" "$root/$n/$kn"
+      done <<EOF
+$(find "$root/$n" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+EOF
+    done <<EOF
+$(find "$root" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+EOF
+  )
+  # Ids seen more than once, minus the ones whose two directories resolve to the
+  # same underlying files (a symlink bridge is one record, not drift).
+  while IFS= read -r id; do
+    [ -n "$id" ] || continue
+    dirs=$(printf '%s\n' "$pairs" | awk -F'\t' -v k="$id" '$1==k {print $2}')
+    a=$(printf '%s\n' "$dirs" | sed -n 1p)
+    b=$(printf '%s\n' "$dirs" | sed -n 2p)
+    [ -n "$b" ] || continue
+    ma_same_record "$a" "$b" || printf '%s\n' "$id"
+  done <<EOF
+$(printf '%s\n' "$pairs" | awk -F'\t' '{print $1}' | sort | uniq -d)
+EOF
+}

package/pipeline/multi-agent-refs/_account-picker.md

@@ -12,7 +12,7 @@ First step of every `multi-agent` flow **that touches a remote provider**.
 > question, no token lookup. Detection: `freetext` flow first fetches local
 > repos (`repo-cache.sh local "$HOME"`); if the picker resolves to local-only
 > repos, account-picker is bypassed and the state file's `accountId` is left
-> `null` with `tokens={}`. Phases 6/7 read these as "local-only" signals.
+> `null` with `tokens={}`. Phases 4/5 read these as "local-only" signals.
 
 > **Language**: see `picker-contract.md` + `rules.md` Language Application matrix.
 

package/pipeline/multi-agent-refs/_dev-context.md

@@ -70,7 +70,7 @@ Selects extra repos the pipeline may touch beyond the primary repo(s)  -  typica
    is not written here is a candidate the check can never see.
 
    Resolve each entry's `stack` from its local checkout, with the marker table
-   in `phases/phase-1-analysis.md` Step 2 (`.xcodeproj` / `Package.swift` →
+   in `phases/phase-1-plan.md` Step 2 (`.xcodeproj` / `Package.swift` →
    `ios`, `build.gradle(.kts)` → `android`, and so on). No checkout, or no
    marker matched → `stack: "unknown"` and `root: null`. Never infer a stack
    from the repo NAME: `my-app-android` is a naming convention, not a marker,

package/pipeline/multi-agent-refs/_input-parser.md

@@ -35,7 +35,7 @@ The top-level `multi-agent` command classifies user arguments per the rules belo
 
 ¹ Account picker is **skipped** when the resolved primary repo is local-only
   (`provider="local"`). No token lookup, no provider auth  -  the pipeline
-  proceeds with `accountId=null` and Phases 6/7 honor the local-only mode.
+  proceeds with `accountId=null` and Phases 4/5 honor the local-only mode.
 
 ² Free-text flow merges `github`+`bitbucket`+`local` repo caches into a
   single picker list; `(local)` rows come from `repo-cache.sh local "$HOME"`.

package/pipeline/multi-agent-refs/analysis/evidence.md

@@ -225,12 +225,3 @@ The tier boundary is not advisory. A signal row that reaches Section 4 (business
 
 Per source: reachable and answered, reachable and empty, or unreachable. All three are recorded; only the third produces a `fetchErrors[]` entry, and none of them halts.
 
-**Lite mode auto-detection (Locked 25, v9.1.0 scoring)**: at the end of Phase 1c, evaluate three signals and score each:
-
-| Signal | True condition | Score |
-|---|---|---|
-| Confluence spec body lines | < 100 | 1 |
-| Figma frames count | <= 1 | 1 |
-| Repo evidence direct-match count | >= 8 | 1 |
-
-`liteModeAuto = (totalScore >= 2)`. Two of three signals true is enough; the v8.12.0..v9.0.x AND-threshold (all three) forced too many small features into Full mode when one signal was marginal (e.g. a tiny spec with 2 Figma frames). User overrides via `--full` or `--lite` always win over scoring.

package/pipeline/multi-agent-refs/analysis/intake.md

@@ -1,6 +1,6 @@
 # Intake (analysis Phase 0)
 
-> The picker chain that fills `state.analysisSpec.*` before any fetch runs. Loaded by `/multi-agent:analysis`. Pipeline Phase 1 does NOT load this file: in a pipeline run the account, project, repos and task already came from the orchestrator's own Phase 0, and only the source and coverage batches below are asked (see `phase-1-analysis.md` Step 4).
+> The picker chain that fills `state.analysisSpec.*` before any fetch runs. Loaded by `/multi-agent:analysis`. Pipeline Phase 1 does NOT load this file: in a pipeline run the account, project, repos and task already came from the orchestrator's own Phase 0, and only the source and coverage batches below are asked (see `phase-1-plan.md` Step 4).
 
 ### Phase 0 - Intake
 

package/pipeline/multi-agent-refs/analysis/locked.md

@@ -1,25 +1,25 @@
-# Locked decisions (37)
+# Locked decisions (36)
 
-> The 37 Locked decisions of the analysis flow. Loaded by `/multi-agent:analysis`, by `/multi-agent:analysis-resolve` (which inherits them) and by pipeline Phase 1 when it runs the analysis engine. Numbering is canonical: cite as `Locked <n> (<short label>)`.
+> The 36 Locked decisions of the analysis flow. Loaded by `/multi-agent:analysis`, by `/multi-agent:analysis-resolve` (which inherits them) and by pipeline Phase 1 when it runs the analysis engine. Numbering is canonical: cite as `Locked <n> (<short label>)`.
 
 ### Index by category (v9.1.0+)
 
-Browse-friendly grouping of the 37 Locked decisions. Numbering stays canonical (matches the list below); the index is read-only navigation.
+Browse-friendly grouping of the 36 Locked decisions. Numbering stays canonical (matches the list below); the index is read-only navigation.
 
 | Category | Decisions | Concern |
 |---|---|---|
-| **A. Governance** | 1, 5, 6, 7, 10, 26, 27, 32, 36 | Run-level process rules: one feature per run, default output, auto-commit ban, punctuation policy, output picker timing, Pass B preview, evidence digest cache, analysis profile, document reviewed before publish |
-| **B. Citation and Evidence** | 3, 4, 8, 11, 24, 30, 34 | Every fact in the doc traces back to a source: citation discipline, forward-looking spec, standards binding, repo-evidence reuse-first, Pass B footnote mandatory, analysis self-contained (pipeline-wide), references built from the evidence record |
-| **C. Output Format and Structure** | 2, 9, 13, 14, 16, 17, 20, 21, 25, 33, 35, 37 | How the document is laid out: section omission rule, per-platform output split, Gherkin user stories, Goals + Non-Goals paired, Files-to-Add tag, API response variants exhaustive, localization mode (ownership-aware), References at the bottom, Lite mode, corporate backbone always renders, stack-optional render, redesign records v1 before planning v2 |
+| **A. Governance** | 1, 5, 6, 7, 10, 25, 26, 31, 35 | Run-level process rules: one feature per run, default output, auto-commit ban, punctuation policy, output picker timing, Pass B preview, evidence digest cache, analysis profile, document reviewed before publish |
+| **B. Citation and Evidence** | 3, 4, 8, 11, 24, 29, 33 | Every fact in the doc traces back to a source: citation discipline, forward-looking spec, standards binding, repo-evidence reuse-first, Pass B footnote mandatory, analysis self-contained (pipeline-wide), references built from the evidence record |
+| **C. Output Format and Structure** | 2, 9, 13, 14, 16, 17, 20, 21, 32, 34, 36 | How the document is laid out: section omission rule, per-platform output split, Gherkin user stories, Goals + Non-Goals paired, Files-to-Add tag, API response variants exhaustive, localization mode (ownership-aware), References at the bottom, corporate backbone always renders, stack-optional render, redesign records v1 before planning v2 |
 | **D. Design Source and Pipeline Architecture** | 12, 22, 23 | Where design comes from and how the pipeline renders: Figma 3-tier access (BLOCKING), platform-agnostic template + Pass B render, convention extraction (Phase 1c) |
-| **E. UI, Variant, and Test Coverage** | 15, 18, 19, 28, 29, 31 | UI artefact rules: SVG default for new assets, screenshots embedded, all Figma variants drilled, SwiftUI Preview block (iOS), variant usage explicit, business-rule to acceptance-criterion to test traceability |
+| **E. UI, Variant, and Test Coverage** | 15, 18, 19, 27, 28, 30 | UI artefact rules: SVG default for new assets, screenshots embedded, all Figma variants drilled, SwiftUI Preview block (iOS), variant usage explicit, business-rule to acceptance-criterion to test traceability |
 
 When citing a Locked decision in code or docs, prefer `Locked <n> (<short label>)` form so the category is inferable (e.g. `Locked 30 (analysis self-contained, category B)`).
 
 ### Full list
 
 1. **One feature per run.** Every Figma URL, Confluence page, Jira ID, and Standards source the user supplies belongs to the **same feature**. The command never asks "which feature is this for?" or "which URL is primary?". Mixed inputs covering multiple features are treated as user error: surface the conflict, stop, and ask the user to split into separate runs.
-2. **Section omission rule.** Sections with zero evidence are dropped entirely; no `TBD` placeholder section. Numbering remains sequential `1..N` over the rendered set.
+2. **Section omission rule.** Sections with zero evidence are dropped entirely; no `TBD` placeholder section. **A rendered section keeps its canonical template number**, so the set has gaps and that is correct: `1, 2, 4, 9, 13, 14, 21` is a valid rendered document. This clause used to say numbering re-flows sequentially `1..N`, which could not hold alongside Locked 30 - that decision threads ids across sections BY NUMBER (`Section 15.1 scenario`, `Section 4.4`, `Section 3/5 layout cells`), and a re-flowed document sends every one of those cross-references to the wrong section or to nothing. No emitted document ever re-flowed; the rule was the part that was wrong. What IS checked: every rendered number is a real template number, and the numbers ascend without repeating.
 3. **Citation discipline.** Every quoted UI string, endpoint path, error code, or analytics event name in Sections 2-4 must carry an inline citation: `[Figma annotation <nodeId>]` for copy taken from a Dev Mode annotation, `[Figma <nodeId>]` (MCP) or `[figma-export: <project-slug>/<screen-slug>:<nodeId>]` (local source) for design strings; `file:line` for repo evidence; `Confluence:<pageId>:<heading-slug>` for spec text. **Annotation-as-copy precedence:** when the project's `figma-config` has `annotations.enabled` and a node carries a Dev Mode annotation, that annotation is the authoritative copy for the node and the visible text layer is treated as a placeholder; cite the annotation, not the layer text. Never invent copy - blank beats a guess; a node whose annotation has the base language but is missing a target language emits a Section 20 (Risks) row rather than a fabricated value. Uncited quotes are downgraded to `[label TBD - see Open Questions]` and a row is added to Section 7 Risks. Subagent prose and Code Connect snippets are not citations.
 4. **The spec is forward-looking.** Section bodies describe the new feature as drawn / specified. Findings that exist only in legacy code or the existing branch appear as `> Legacy reference: <text> (file:line)` blockquotes inside the relevant section, never as the lead sentence or a primary table row. A legacy-only finding with no forward counterpart goes to Section 7 Risks as a decision item: "current code does X; should the new feature keep, change, or drop this?".
 5. **Output default = Local file.** The Phase 3.5 output picker keeps `Local file` pre-selected. Confluence and Jira outputs are never default-selected (see `analysis-output-confluence-on-request` memory).
@@ -44,17 +44,16 @@ When citing a Locked decision in code or docs, prefer `Locked <n> (<short label>
 22. **Platform-agnostic template + Pass B render.** The template (`$HOME/.claude/multi-agent-refs/analysis-template.md`) describes concepts (state holder, view, navigator, use case, repository, DTO, state model, DI register, localization key, accessibility identifier, test method) without platform-specific class names. Pass B (Phase 2b) projects each concept onto the selected platform using conventions extracted at Phase 1c.
 23. **Convention extraction mandatory (Phase 1c).** After Phase 1b repo evidence, Phase 1c extracts seven pattern groups (folder structure, class naming, UI state model, test method naming, accessibility identifier, localization key, DI registration) per selected repo via `~/.claude/lib/extract-conventions.sh`. Output lands in `state.analysisSpec.evidence.conventions[<repo>]` with confidence levels (high / medium / low / none) and evidence file citations.
 24. **Pass B cell footnote mandatory.** Every cell Pass B fills in Section 13 (Architecture Plan concept table) and any other per-platform projection carries a footnote of the form `^[<convention-key> <confidence>: <evidence-source>]` pointing back to Phase 1c output. Cells with `confidence: low | none` cite `conventions-defaults.md:C<n>-<platform>` and emit a row in Section 20 Risks ("convention fallback applied"). Footnote-less cells fail the dispatch gate.
-25. **Lite mode for small features.** When Phase 1 signals indicate a small feature, Lite mode auto-activates and renders only Sections 1, 2, 4, 9, 13, 14, 21, plus optional 23 Changelog. The user can force Lite with `--lite` or force Full with `--full`. Full mode is the default for new feature analyses. **Scoring (v9.1.0+):** three independent signals - `confluenceSpecLines < 100`, `figmaFramesCount <= 1`, `repoDirectMatchCount >= 8`. Each true signal scores 1 point; Lite auto-activates at `score >= 2`. Previous AND-threshold (`v8.12.0..v9.0.x`) was too strict and forced small features into Full mode when one signal was just over the line. Explicit user flags (`--lite` / `--full`) always win over auto-scoring.
-26. **Pass B preview before render.** Phase 2a presents the resolved convention table to the user before Phase 2b emits any platform file. The user can approve, override individual cells, or cancel. Empty answers do not imply consent (`feedback_no-inferred-defaults-from-empty-answer`); the picker re-asks on empty submit.
-27. **Evidence digest caches Phase 1b and 1c.** `evidence_digest = sha256(featureName || sorted(platforms) || repoEvidence.summary || conventions.summary)`. When the same feature name is invoked again against the same set of repos and the digest matches, Phase 1b and 1c are skipped and the cached `evidence.repoEvidence` / `evidence.conventions` is reused. Cache TTL is 24 hours; manual invalidation via `--no-cache` flag.
-28. **SwiftUI Preview block mandatory (iOS projection, SwiftUI only).** When the iOS file is produced AND the affected view is a SwiftUI view (detected via `import SwiftUI` + `: View` protocol conformance in `evidence.repoEvidence[<repo>].buckets.uiComponents`), Section 13.6 renders a Preview block table covering at minimum: canonical default (LTR Light), Dark, RTL, Dynamic Type accessibilityLarge, and one error variant. Loading state and edge-case variants are added when distinct from canonical. UIKit-only features (no SwiftUI view artefact) drop Section 13.6 with note `(N/A: UIKit-only feature)`. Preview macro convention (`#Preview` for Swift 5.9+ vs legacy `PreviewProvider`) is read from `evidence.conventions[<repo>].previewMacro`. Each Preview variant listed in Section 13.6 must have a matching row in Section 15.2 Snapshot Tests; a Preview without a snapshot row triggers a Section 20 Risk.
-29. **Variant usage explicit and bounded.** Section 6 inventory rows list which variants this feature consumes per component (concrete enum case + bool value). New Section 6.X (Variant Usage Matrix) catalogues the full variant axis vs. used subset with a rationale per excluded variant. Sections 13.6 (Preview) and 15.2 (Snapshot) cover only the used subset; expanding the variant set requires updating Section 6.X first.
-30. **Analysis as self-contained design bridge - no MCP outside analysis phase (BLOCKING, pipeline-wide).** The analysis document is the sole design source for every downstream phase. After Phase 1 of `/multi-agent:analysis` produces `analysis/<feature>-<platform>.md`, Phase 2 Planning, Phase 3 Dev, Phase 4 Review, Phase 5 Test, Phase 6 Commit, and Phase 7 Report consume only the analysis document plus repo Code Connect mappings (`*.figma.swift` / `*.figma.kt`). Calling `mcp__claude_ai_Figma__*`, hitting `api.figma.com`, or fetching a `figma.com/design/...` URL during Phase 2+ is a violation. Applies to every mode that runs Phase 2+: `/multi-agent`, `/multi-agent:autopilot`, `/multi-agent:local`, `/multi-agent:local-autopilot`, at either depth. Hard requirement (v9.0.0): Phase 2 Pre-item and Phase 3 Pre-item (BLOCKING) abort the run when the analysis document is missing. Memory: `[[mcp-only-in-analysis]]`. Generic rule rationale and access matrix: see `$HOME/.claude/rules/figma-pipeline.md` "MUST: No MCP outside analysis phase".
-31. **Business-rule to acceptance-criterion to test traceability (AI + human spine).** The analysis is a development handoff that both an AI implementer and a human reviewer must act on, so it is bound by one shared-ID vocabulary. Every business rule carries a stable id `BR-<slug>-NN` (Section 4.4). Each rule maps to at least one acceptance criterion written Given / When / Then (binary - two readers must not be able to disagree on pass/fail). Each acceptance criterion maps to unit-test scenarios in Section 15.1, one row per case across happy / boundary / error / empty-nil (enumerate at least the failure modes; agents hallucinate error handling when it is omitted). The same ids thread onward: Section 15.6 UI-test flows reference the `BR-` ids and use stable selectors (accessibilityIdentifier / testTag), Section 16 accessibility items reuse those identifiers, Section 11 analytics events cite their triggering rule or story, and Section 5/7 layout cells carry token + Figma node refs. Never invent copy or values (blank beats a guess; a missing source becomes a Section 20 Open Question). **Mode-aware gate:** in Full mode a business rule with no acceptance criterion, or an acceptance criterion with no Section 15.1 scenario, fails the dispatch gate. In **Lite mode Section 15 is not rendered**, so the rule-to-test half does not apply - Section 4.4 still lists each rule with its Given/When/Then acceptance criterion (the acceptance criterion is itself the testable statement), and the 15.1 mapping is deferred to whenever the feature is later analyzed in Full or implemented by a dev run. The rule-to-acceptance-criterion half always holds, in both modes.
-
-32. **Analysis profile selected at intake.** `state.analysisSpec.profile` is `global` (default) or `corporate`, asked once at Phase 0 Step 1b and never re-asked mid-run. `global` renders `$HOME/.claude/multi-agent-refs/analysis-template.md` (23 sections, development handoff). `corporate` renders `$HOME/.claude/multi-agent-refs/analysis-template-corporate.md` (requirements document: `IG -> UC -> FG` spine, three traceability matrices, current-to-target state with impact analysis, then Technical Analysis and Development Analysis). **Both profiles read the same `state.analysisSpec.evidence.*`** - intake, fetching, repo evidence and convention extraction are shared and profile-independent; only the projection differs. This is what keeps the two templates from drifting into two products. One run emits one profile: rendering both from a single run would produce two documents describing the same feature, and the next reader would have to decide which one is current. When only one profile is available (`prefs.global.analysisProfiles` lists one, or the corporate profile has no binding configuration), the step auto-resolves and prints its breadcrumb with the resolution noted, per the picker contract.
-33. **Corporate backbone always renders.** In the `corporate` profile the Locked 2 omission rule is replaced for Part A and the footer: those sections render even with zero evidence, carrying `N/A` when the section is genuinely out of scope for the feature and `EKLENECEK` when evidence is expected but missing. This is the point of a requirements document - a reader has to be able to tell "we considered hardware needs and there are none" from "nobody looked". Every `EKLENECEK` emits a matching Section 20 Risks and Open Questions row naming what is missing and who can answer it; an `EKLENECEK` with no such row fails the dispatch gate, because an unanswered question nobody owns is how a placeholder reaches production. **Missing inputs never block the run**: the corporate source practice of halting until every input arrives is deliberately not adopted - the document is produced with `EKLENECEK` in the gaps and the gaps are raised in Section 20. Part B follows the global omission table unchanged. In the `global` profile Locked 2 applies as written, with no placeholder of any kind.
-34. **References are built from the evidence record, not written.** Section 21 is emitted by `$HOME/.claude/scripts/build-references.mjs` from `state.analysisSpec.evidence.*` in both profiles. Each row carries a precision anchor in its `Sürüm / Ref` column - Figma node id, Confluence `pageId` plus page version, the commit SHA a repo was read at, the Swagger spec version - because a reference with no anchor points at a moving target. Each row carries an `Erişim / Access` cell: a declared source that could not be fetched still gets a row reading `erişilemedi (<reason>)`, since a silently dropped source reads to the next person as a source that never existed. User statements from the conversation that no fetched source contains are recorded as `Serbest metin` rows, quoted verbatim, with the decision they settled. **Coverage gate**: every entry in `evidence.figma[]`, `confluence[]`, `jira[]`, `swagger[]`, `repo[]`, `standards[]`, `firebase[]`, `documents[]`, `outside[]`, `freeText[]` and every entry in `evidence.fetchErrors[]` must appear as a row, and every row must map to an evidence entry. A source that shaped the document but is missing from References fails the dispatch gate; so does an invented row with no evidence behind it.
-35. **Stack-optional render.** Platform and repo selection are optional. When `state.analysisSpec.platforms[]` is empty, the run still completes: the analysis layers that do not need a target repository render in full - Part A and Part B in the corporate profile, Sections 1-12 and 16-17 in the global profile - and only the development layer is dropped (corporate Part C; global Sections 13, 14, 15) along with the Pass B projection, since there are no conventions to project onto. A Section 20 row records that the development analysis awaits a repo selection. **The channel split survives the missing repo.** Channels are derived from the evidence instead of repo stack tags (`intake.md` Step 3 carries the signal table) and one document is emitted per derived channel - `mobile`, `web`, or both. A phone screen and a browser screen carry different requirements before anyone has picked a repository; the split (Locked 9) exists to carry that difference and only its *projection* half needs conventions. `mobile` stays one channel rather than iOS plus Android, since without conventions nothing tells the two apart. Evidence with no interface at all yields a single channel-agnostic `<feature>.md`. Files land under `~/Desktop/multiAgentAnalysis/<feature-name>/`, named `<feature>-<channel>.md` (or `<feature>.md` for the channel-agnostic case): the repo-relative `analysis/` path has nothing to be relative to without a repo, and the current working directory is never used, since for a repo-less run it is arbitrary. Desktop rather than a hidden directory because the document is a deliverable somebody is meant to open and hand over, and `multiAgentAnalysis` rather than a bare `Analysis` because a generic word collides with whatever else is on a desktop while the producer name groups every run this command ever writes. The Phase 3.5 picker shows the resolved path and takes an override through its Other input. A requirements document is useful before anyone has decided which repository will hold the code, and refusing to produce one until that decision exists inverts the order the work actually happens in.
-36. **The document is reviewed before it is published.** An analysis run used to go from draft straight to dispatch behind a deterministic validator, so nothing read what it was about to publish: one run put a channel it never searched for, an open question about a frame it never opened, and twenty-three unowned `EKLENECEK` markers onto a live page. Every one is what a reader catches on the first pass. Phase 3.2 runs `phases/phase-4-review.md` Step 0 (strict validator, the host's three-reviewer set, triage) on the draft before the destination is chosen: a finding is cheap while nothing is written. Reviewers are subagents holding `analysis/review.md`, never the context that wrote the document, which cannot notice a search it never thought to run. A blocking finding returns to Phase 2b with dispatch closed and never becomes an open question, since "the document is wrong" is not something to ask the reader; capped at two returns. Phase 3.3 sorts every remaining gap into searched-and-closed, asked-and-answered, or `AS-NN`; an unstamped gap fails the dispatch gate. Autopilot runs both; only the asking degrades, into rows stamped `autopilot: could not ask`.
-37. **A redesign records v1 before it plans v2.** `options.redesign` is an opt-in on the `options.uiTests` axis, never a third `mode` value: `mode` says how many sections, `redesign` says which content, and a `mode: redesign` would switch off the Full-mode traceability, Test Plan and rule-to-test gates in exactly the documents that need them. It adds three sub-sections and no top-level section: current behaviour with `CB-<slug>-NN` ids and `repo/file:line` citations, the v1 to v2 endpoint mapping, and a difference list over a closed status vocabulary. Every `Missing` and `Partial` owes a Section 20 row by `AS-NN`, and a `CB-` id in one table but not the other fails in both directions - a behaviour that is in the code and on nobody's difference list is what a redesign loses and production finds. Evidence and certainty are derived from `repoEvidence`, never graded by the writer (Locked 24, same reason), and `options.redesign` is an `evidence_digest` input. Contract and the eight checks: `analysis/redesign.md`, loaded only on a redesign run.
+25. **Pass B preview before render.** Phase 2a presents the resolved convention table to the user before Phase 2b emits any platform file. The user can approve, override individual cells, or cancel. Empty answers do not imply consent (`feedback_no-inferred-defaults-from-empty-answer`); the picker re-asks on empty submit.
+26. **Evidence digest caches Phase 1b and 1c.** `evidence_digest = sha256(featureName || sorted(platforms) || repoEvidence.summary || conventions.summary)`. When the same feature name is invoked again against the same set of repos and the digest matches, Phase 1b and 1c are skipped and the cached `evidence.repoEvidence` / `evidence.conventions` is reused. Cache TTL is 24 hours; manual invalidation via `--no-cache` flag.
+27. **SwiftUI Preview block mandatory (iOS projection, SwiftUI only).** When the iOS file is produced AND the affected view is a SwiftUI view (detected via `import SwiftUI` + `: View` protocol conformance in `evidence.repoEvidence[<repo>].buckets.uiComponents`), Section 13.6 renders a Preview block table covering at minimum: canonical default (LTR Light), Dark, RTL, Dynamic Type accessibilityLarge, and one error variant. Loading state and edge-case variants are added when distinct from canonical. UIKit-only features (no SwiftUI view artefact) drop Section 13.6 with note `(N/A: UIKit-only feature)`. Preview macro convention (`#Preview` for Swift 5.9+ vs legacy `PreviewProvider`) is read from `evidence.conventions[<repo>].previewMacro`. Each Preview variant listed in Section 13.6 must have a matching row in Section 15.2 Snapshot Tests; a Preview without a snapshot row triggers a Section 20 Risk.
+28. **Variant usage explicit and bounded.** Section 6 inventory rows list which variants this feature consumes per component (concrete enum case + bool value). New Section 6.X (Variant Usage Matrix) catalogues the full variant axis vs. used subset with a rationale per excluded variant. Sections 13.6 (Preview) and 15.2 (Snapshot) cover only the used subset; expanding the variant set requires updating Section 6.X first.
+29. **Analysis as self-contained design bridge - no MCP outside analysis phase (BLOCKING, pipeline-wide).** The analysis document is the sole design source for every downstream phase. After Phase 1 of `/multi-agent:analysis` produces `analysis/<feature>-<platform>.md`, Phase 1 Plan, Phase 2 Dev, Phase 3 Review, Phase 3 Review, Phase 4 Commit, and Phase 5 Report consume only the analysis document plus repo Code Connect mappings (`*.figma.swift` / `*.figma.kt`). Calling `mcp__claude_ai_Figma__*`, hitting `api.figma.com`, or fetching a `figma.com/design/...` URL during Phase 2+ is a violation. Applies to every mode that runs Phase 2+: `/multi-agent`, `/multi-agent:autopilot`, `/multi-agent:local`, `/multi-agent:local-autopilot`, at either depth. Hard requirement (v9.0.0): Phase 2 Pre-item and Phase 3 Pre-item (BLOCKING) abort the run when the analysis document is missing. Memory: `[[mcp-only-in-analysis]]`. Generic rule rationale and access matrix: see `$HOME/.claude/rules/figma-pipeline.md` "MUST: No MCP outside analysis phase".
+30. **Business-rule to acceptance-criterion to test traceability (AI + human spine).** The analysis is a development handoff that both an AI implementer and a human reviewer must act on, so it is bound by one shared-ID vocabulary. Every business rule carries a stable id `BR-<slug>-NN` (Section 4.4). Each rule maps to at least one acceptance criterion written Given / When / Then (binary - two readers must not be able to disagree on pass/fail). Each acceptance criterion maps to unit-test scenarios in Section 15.1, one row per case across happy / boundary / error / empty-nil (enumerate at least the failure modes; agents hallucinate error handling when it is omitted). The same ids thread onward: Section 15.6 UI-test flows reference the `BR-` ids and use stable selectors (accessibilityIdentifier / testTag), Section 16 accessibility items reuse those identifiers, Section 11 analytics events cite their triggering rule or story, and Section 3/5 layout cells carry token + Figma node refs. Never invent copy or values (blank beats a guess; a missing source becomes a Section 20 Open Question). **Gate:** a business rule with no acceptance criterion, or an acceptance criterion with no Section 15.1 scenario, fails the dispatch gate. There is no mode clause: the rule used to be suspended in Lite mode, which deferred the rule-to-test half to "whenever the feature is later analyzed in Full" - a debt nothing tracked and nothing ever paid. Section 15 renders when there is evidence for it and is dropped when there is not, like every other section, and the gate applies to whatever was rendered.
+
+31. **Analysis profile selected at intake.** `state.analysisSpec.profile` is `global` (default) or `corporate`, asked once at Phase 0 Step 1b and never re-asked mid-run. `global` renders `$HOME/.claude/multi-agent-refs/analysis-template.md` (23 sections, development handoff). `corporate` renders `$HOME/.claude/multi-agent-refs/analysis-template-corporate.md` (requirements document: `IG -> UC -> FG` spine, three traceability matrices, current-to-target state with impact analysis, then Technical Analysis and Development Analysis). **Both profiles read the same `state.analysisSpec.evidence.*`** - intake, fetching, repo evidence and convention extraction are shared and profile-independent; only the projection differs. This is what keeps the two templates from drifting into two products. One run emits one profile: rendering both from a single run would produce two documents describing the same feature, and the next reader would have to decide which one is current. When only one profile is available (`prefs.global.analysisProfiles` lists one, or the corporate profile has no binding configuration), the step auto-resolves and prints its breadcrumb with the resolution noted, per the picker contract.
+32. **Corporate backbone always renders.** In the `corporate` profile the Locked 2 omission rule is replaced for Part A and the footer: those sections render even with zero evidence, carrying `N/A` when the section is genuinely out of scope for the feature and `EKLENECEK` when evidence is expected but missing. This is the point of a requirements document - a reader has to be able to tell "we considered hardware needs and there are none" from "nobody looked". Every `EKLENECEK` emits a matching Section 20 Risks and Open Questions row naming what is missing and who can answer it; an `EKLENECEK` with no such row fails the dispatch gate, because an unanswered question nobody owns is how a placeholder reaches production. **Missing inputs never block the run**: the corporate source practice of halting until every input arrives is deliberately not adopted - the document is produced with `EKLENECEK` in the gaps and the gaps are raised in Section 20. Part B follows the global omission table unchanged. In the `global` profile Locked 2 applies as written, with no placeholder of any kind.
+33. **References are built from the evidence record, not written.** Section 21 is emitted by `$HOME/.claude/scripts/build-references.mjs` from `state.analysisSpec.evidence.*` in both profiles. Each row carries a precision anchor in its `Sürüm / Ref` column - Figma node id, Confluence `pageId` plus page version, the commit SHA a repo was read at, the Swagger spec version - because a reference with no anchor points at a moving target. Each row carries an `Erişim / Access` cell: a declared source that could not be fetched still gets a row reading `erişilemedi (<reason>)`, since a silently dropped source reads to the next person as a source that never existed. User statements from the conversation that no fetched source contains are recorded as `Serbest metin` rows, quoted verbatim, with the decision they settled. **Coverage gate**: every entry in `evidence.figma[]`, `confluence[]`, `jira[]`, `swagger[]`, `repo[]`, `standards[]`, `firebase[]`, `documents[]`, `outside[]`, `freeText[]` and every entry in `evidence.fetchErrors[]` must appear as a row, and every row must map to an evidence entry. A source that shaped the document but is missing from References fails the dispatch gate; so does an invented row with no evidence behind it.
+34. **Stack-optional render.** Platform and repo selection are optional. When `state.analysisSpec.platforms[]` is empty, the run still completes: the analysis layers that do not need a target repository render in full - Part A and Part B in the corporate profile, Sections 1-12 and 16-17 in the global profile - and only the development layer is dropped (corporate Part C; global Sections 13, 14, 15) along with the Pass B projection, since there are no conventions to project onto. A Section 20 row records that the development analysis awaits a repo selection. **The channel split survives the missing repo.** Channels are derived from the evidence instead of repo stack tags (`intake.md` Step 3 carries the signal table) and one document is emitted per derived channel - `mobile`, `web`, or both. A phone screen and a browser screen carry different requirements before anyone has picked a repository; the split (Locked 9) exists to carry that difference and only its *projection* half needs conventions. `mobile` stays one channel rather than iOS plus Android, since without conventions nothing tells the two apart. Evidence with no interface at all yields a single channel-agnostic `<feature>.md`. Files land under `~/Desktop/multiAgentAnalysis/<feature-name>/`, named `<feature>-<channel>.md` (or `<feature>.md` for the channel-agnostic case): the repo-relative `analysis/` path has nothing to be relative to without a repo, and the current working directory is never used, since for a repo-less run it is arbitrary. Desktop rather than a hidden directory because the document is a deliverable somebody is meant to open and hand over, and `multiAgentAnalysis` rather than a bare `Analysis` because a generic word collides with whatever else is on a desktop while the producer name groups every run this command ever writes. The Phase 3.5 picker shows the resolved path and takes an override through its Other input. A requirements document is useful before anyone has decided which repository will hold the code, and refusing to produce one until that decision exists inverts the order the work actually happens in.
+35. **The document is reviewed before it is published.** An analysis run used to go from draft straight to dispatch behind a deterministic validator, so nothing read what it was about to publish: one run put a channel it never searched for, an open question about a frame it never opened, and twenty-three unowned `EKLENECEK` markers onto a live page. Every one is what a reader catches on the first pass. Phase 3.2 runs `phases/phase-3-review.md` Step 0 (strict validator, the host's three-reviewer set, triage) on the draft before the destination is chosen: a finding is cheap while nothing is written. Reviewers are subagents holding `analysis/review.md`, never the context that wrote the document, which cannot notice a search it never thought to run. A blocking finding returns to Phase 2b with dispatch closed and never becomes an open question, since "the document is wrong" is not something to ask the reader; capped at two returns. Phase 3.3 sorts every remaining gap into searched-and-closed, asked-and-answered, or `AS-NN`; an unstamped gap fails the dispatch gate. Autopilot runs both; only the asking degrades, into rows stamped `autopilot: could not ask`.
+36. **A redesign records v1 before it plans v2.** `options.redesign` is an opt-in on the `options.uiTests` axis, never a third `mode` value: `mode` says how many sections, `redesign` says which content, and a `mode: redesign` would switch off the Full-mode traceability, Test Plan and rule-to-test gates in exactly the documents that need them. It adds three sub-sections and no top-level section: current behaviour with `CB-<slug>-NN` ids and `repo/file:line` citations, the v1 to v2 endpoint mapping, and a difference list over a closed status vocabulary. Every `Missing` and `Partial` owes a Section 20 row by `AS-NN`, and a `CB-` id in one table but not the other fails in both directions - a behaviour that is in the code and on nobody's difference list is what a redesign loses and production finds. Evidence and certainty are derived from `repoEvidence`, never graded by the writer (Locked 24, same reason), and `options.redesign` is an `evidence_digest` input. Contract and the eight checks: `analysis/redesign.md`, loaded only on a redesign run.

package/pipeline/multi-agent-refs/analysis/render.md

@@ -46,7 +46,7 @@
 
 Locked 36 carries the rule. Operationally:
 
-1. Run `phases/phase-4-review.md` Step 0, the analysis-mode branch. It already defines
+1. Run `phases/phase-3-review.md` Step 0, the analysis-mode branch. It already defines
    the strict validator, the host's three-reviewer set with its model routing, and the
    triage. Do not restate it here; a second definition is the one that rots.
 2. Dispatch reviewers as subagents, each given the draft path, the state JSON and

package/pipeline/multi-agent-refs/analysis/synthesis.md

@@ -52,8 +52,8 @@ Convention preview - Pass B will render with:
 | DI | UserProfileDependencyConfigurator ^[C7 high] | UserProfileModule (Hilt) ^[C7 fallback: defaults] |
 
 Confidence summary:
-  iOS:     7/7 high, 0 medium, 0 low, 0 fallback
-  Android: 5/7 high, 1 medium, 0 low, 1 fallback
+  iOS:     5/5 high, 0 medium, 0 low, 0 fallback
+  Android: 3/5 high, 1 medium, 0 low, 1 fallback
 ```
 
 AskUserQuestion shape:
@@ -86,11 +86,17 @@ For each `platform` in `state.analysisSpec.platforms[]`:
    - `android` → `~/.claude/rules/kotlin-android.md` first → `evidence.standards[]` entries whose path contains `android` or `kotlin`
    - `backend` → `evidence.standards[]` entries matching language hints (`python`, `go`, `node`, `fastapi`) → fall back to `~/.claude/rules/security.md` + `code-style.md`
    - `web` → `evidence.standards[]` entries matching `react`, `vue`, `next`, `sveltekit` → `~/.claude/rules/code-style.md`
-2. **Apply per-platform omission rules.** Backend-only file drops Sections 5, 6, 7, 8, 16. Web with no UI inventory still keeps 5 (UI exists in code). Sections 1, 2, 4, 9, 13, 14, 20, 21 always present per Locked decision 2 + 13.
-3. **Resolve mode.** If user passed `--lite` → Lite. If user passed `--full` → Full. Otherwise use `state.analysisSpec.liteModeAuto`. Lite mode renders only Sections 1, 2, 4, 9, 13, 14, 21 plus optional 23.
-4. **Produce YAML front-matter header** (see `$HOME/.claude/multi-agent-refs/analysis-template.md`). Include `profile: <state.analysisSpec.profile | global>` and `platform: <platform | none>` so the validator applies the right contract per profile (Locked 32) and recognises the stack-optional render (Locked 35), `mode: full | lite`, plus `ui_tests: <state.analysisSpec.options.uiTests | false>`, `a11y_depth: <state.analysisSpec.options.a11yDepth | basic>` and `redesign: <state.analysisSpec.options.redesign | false>` so the pre-dispatch validator can enforce the opt-in coverage (15.6 present when ui_tests, 16.2 walkthrough present when a11y_depth is full, 4.5 / 4.6 / 9.5 present when redesign). `status` is written only by `/multi-agent:analysis-resolve`; a rendered document is a draft.
+2. **Apply per-platform omission rules.** Backend-only file drops Sections 5, 6, 7, 8, 16. Web with no UI inventory still keeps 5 (UI exists in code). Sections 1, 2, 4, 9, 13, 14, 20, 21 always present per Locked decision 2 + 13; their numbers are canonical and never re-flowed.
+3. **Resolve the section set from evidence, not from a mode.** There is one
+   pipeline. A section renders when it has evidence and is dropped when it does
+   not, per Locked 2. Lite mode used to answer this question with a fixed list
+   (1, 2, 4, 9, 13, 14, 21 plus optional 23) chosen by a three-signal score, and
+   that list fought Locked 2 in both directions: a small feature with rich
+   business rules lost Section 15 because it was not on the list, and a feature
+   with no API contract kept Section 9 because it was. Evidence decides now.
+4. **Produce YAML front-matter header** (see `$HOME/.claude/multi-agent-refs/analysis-template.md`). Include `profile: <state.analysisSpec.profile | global>` and `platform: <platform | none>` so the validator applies the right contract per profile (Locked 32) and recognises the stack-optional render (Locked 35), plus `ui_tests: <state.analysisSpec.options.uiTests | false>`, `a11y_depth: <state.analysisSpec.options.a11yDepth | basic>` and `redesign: <state.analysisSpec.options.redesign | false>` so the pre-dispatch validator can enforce the opt-in coverage (15.6 present when ui_tests, 16.2 walkthrough present when a11y_depth is full, 4.5 / 4.6 / 9.5 present when redesign). `status` is written only by `/multi-agent:analysis-resolve`; a rendered document is a draft.
 5. **Read conventions for this platform's repo.** For each cell Pass B fills in Section 13 and in any per-platform projection (Sections 5, 6, 7, 8, 10, 11, 13, 14, 15, 16, 17), read `state.analysisSpec.evidence.conventions[<repo>].<field>` and emit the value with a footnote (Locked 24). If `conventionOverrides` has an entry for that field, use the override and footnote with `^[user-override: <reason>]` instead of evidence path.
-6. **Concatenate non-null sections in canonical order.** Numbering stays sequential `1..N` over the rendered set (omitted sections do not create gaps).
+6. **Concatenate non-null sections in canonical order.** Each rendered section keeps its canonical template number, so omitted sections DO leave gaps - `1, 2, 4, 9, 13, 14, 21` is a correct rendered document. Locked 30 cites sections by number across the whole document; re-flowing them would break every one of those references.
 7. **Schema validation** on the per-platform spec object:
    ```bash
    python3 -c "import json,jsonschema; jsonschema.validate(json.load(open('state/<feature>-<platform>.json')), json.load(open('$HOME/.claude/schemas/analysis-spec.schema.json')))"