@mstar-harness/dsh 3.2.6 → 3.4.0

package/dist/index.js

@@ -1106,7 +1106,7 @@ var require_lib2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync22, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
 import { join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import {
@@ -1122,22 +1122,22 @@ import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync as readFileSync2, statSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "node:path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync2, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname5, join as join6, resolve as resolve5, sep } from "node:path";
-import { dirname as dirname4, isAbsolute as isAbsolute3, join as join4, resolve as resolve4 } from "node:path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join8, relative as relative2, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, resolve as resolve3 } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync } from "node:fs";
+import { dirname as dirname4, join as join6, resolve as resolve4, sep } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
-import { isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute5, join as join7, resolve as resolve7 } from "node:path";
-import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute5, join as join9, resolve as resolve8 } from "node:path";
 import { existsSync as existsSync8, readdirSync as readdirSync8, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename5, isAbsolute as isAbsolute7, join as join12, relative as relative4, resolve as resolve10, sep as sep4 } from "node:path";
+import { basename as basename5, isAbsolute as isAbsolute7, join as join12, relative as relative4, resolve as resolve11, sep as sep4 } from "node:path";
 import { existsSync as existsSync9 } from "node:fs";
 import { join as join13 } from "node:path";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
@@ -1276,220 +1276,380 @@ function isAtOrBelow(dir, root) {
   const rel = relative(root, dir);
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
-function resolveHarnessDir(startDir = process.cwd(), opts = {}) {
-  const start = resolve3(startDir);
-  const explicit = opts.harnessDir ?? process.env.MSTAR_HARNESS_DIR;
-  if (explicit)
-    return resolve3(start, explicit);
-  const boundary = resolve3(start, opts.workspaceRoot ?? defaultWorkspaceRoot(start));
-  const rc = loadMstarc(start, boundary);
-  if (rc !== null && rc.config.harnessDir)
-    return resolve3(rc.dir, rc.config.harnessDir);
-  let dir = start;
-  for (;; ) {
-    if (!isAtOrBelow2(dir, boundary))
-      return null;
-    for (const candidate of [join3(dir, ".mstar"), join3(dir, ".agents"), join3(dir, ".plans"), join3(dir, "plans")]) {
-      if (isDirectory(candidate))
-        return candidate;
-    }
-    if (dir === boundary)
-      return null;
-    const parent = dirname3(dir);
-    if (parent === dir)
-      return null;
-    dir = parent;
-  }
+var COMPASS_STATUSES = ["active", "locked", "completed"];
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var PLAN_STATUS_DONE = "Done";
+function typeName(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  return typeof value;
 }
-function defaultWorkspaceRoot(startDir) {
-  try {
-    const cdup = execFileSync("git", ["rev-parse", "--show-cdup"], {
-      cwd: startDir,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!cdup)
-      return startDir;
-    let boundary = startDir;
-    for (const segment of cdup.split(/[\\/]/)) {
-      if (segment && segment !== ".")
-        boundary = dirname3(boundary);
+function validateCompassShape(doc) {
+  const issues = [];
+  const expectString = (key, opts = {}) => {
+    const value = doc[key];
+    if (typeof value !== "string") {
+      issues.push({ path: [key], message: `expected string, received ${typeName(value)}` });
+      return;
     }
-    return resolve3(boundary);
-  } catch {}
-  return startDir;
-}
-function isAtOrBelow2(dir, root) {
-  const rel = relative2(root, dir);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
-}
-function mstarcDirOverride(harnessDir, key) {
-  const dir = resolve3(harnessDir);
-  const rc = loadMstarc(dir, dirname3(dir));
-  const declared = rc?.config[key];
-  return declared ? resolve3(rc.dir, declared) : null;
-}
-function assertSafePathComponent(value, what) {
-  if (value === "" || value === "." || value === ".." || !/^[A-Za-z0-9._-]+$/.test(value)) {
-    throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
+    if (opts.min !== undefined && value.length < opts.min) {
+      issues.push({ path: [key], message: `string must contain at least ${opts.min} character(s)` });
+      return;
+    }
+    if (opts.regex !== undefined && !opts.regex.test(value)) {
+      issues.push({ path: [key], message: `string must match ${opts.regex}` });
+    }
+  };
+  expectString("iteration_id", { min: 1 });
+  expectString("start_date", { regex: DATE_RE });
+  const status = doc.status;
+  if (typeof status !== "string" || !COMPASS_STATUSES.includes(status)) {
+    issues.push({
+      path: ["status"],
+      message: `expected one of ${COMPASS_STATUSES.map((s) => `'${s}'`).join(" | ")}, received ${typeName(status)}`
+    });
   }
-}
-function resolveSddDir(harnessDir, planId) {
-  assertSafePathComponent(planId, "planId");
-  const base = resolve3(harnessDir);
-  const declared = mstarcDirOverride(base, "sddDir");
-  const sddBase = declared !== null ? declared : join3(base, "sdd");
-  return join3(sddBase, planId);
-}
-function resolveIterationDir(harnessDir) {
-  const declared = mstarcDirOverride(harnessDir, "iterationDir");
-  if (declared !== null)
-    return declared;
-  return join3(resolve3(harnessDir), "iterations");
-}
-function resolveHarnessSubdir(startDir, opts, key, fallback) {
-  const harness = resolveHarnessDir(startDir, opts);
-  if (harness === null) {
-    throw new Error(`harness dir not found from ${resolve3(startDir)} — cannot resolve the ${fallback} dir (run \`mstar init\`, pass opts.harnessDir, or set MSTAR_HARNESS_DIR)`);
+  expectString("iteration_base_branch", { min: 1 });
+  expectString("target_branch", { min: 1 });
+  const plans = doc.plans;
+  if (plans !== undefined) {
+    if (!Array.isArray(plans)) {
+      issues.push({ path: ["plans"], message: `expected array, received ${typeName(plans)}` });
+    } else {
+      plans.forEach((entry, index) => {
+        if (typeof entry !== "string") {
+          issues.push({ path: ["plans", index], message: `expected string, received ${typeName(entry)}` });
+        } else if (entry.length < 1) {
+          issues.push({ path: ["plans", index], message: "string must contain at least 1 character(s)" });
+        }
+      });
+    }
   }
-  const declared = mstarcDirOverride(harness, key);
-  return declared !== null ? declared : join3(resolve3(harness), fallback);
-}
-function resolveWorkflowDir(startDir = process.cwd(), opts = {}) {
-  return resolveHarnessSubdir(startDir, opts, "workflowDir", "workflows");
-}
-function resolveProjectDir(startDir = process.cwd(), opts = {}) {
-  return resolveHarnessSubdir(startDir, opts, "projectDir", "projects");
-}
-var GITIGNORE_SNIPPET = `# Morning Star harness (.mstar/)
-# Principle: process stays local; results are shared with the team.
-# Default-ignore everything under .mstar/, then re-include the tracked results.
-.mstar/**
-!.mstar/AGENTS.md
-!.mstar/knowledge/
-!.mstar/knowledge/**
-!.mstar/specs/
-!.mstar/specs/**
-# .mstarc — repo-local harness config (may declare [config] harness_dir=<name>)
-.mstarc
-`;
-var GITIGNORE_SNIPPET_AGENTS = `# Morning Star harness (.agents/) — legacy
-# Default-ignore everything under .agents/, then re-include the tracked results.
-.agents/**
-!.agents/AGENTS.md
-!.agents/knowledge/
-!.agents/knowledge/**
-!.agents/specs/
-!.agents/specs/**
-`;
-var GITIGNORE_PROCESS_ENTRIES = GITIGNORE_SNIPPET.split(`
-`).filter((line) => line.startsWith(".mstar/") || line.startsWith("!.mstar/")).map((line) => line.trim());
-var GITIGNORE_PROCESS_ENTRIES_AGENTS = GITIGNORE_SNIPPET_AGENTS.split(`
-`).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
-function isDirectory(dir) {
-  try {
-    return statSync2(dir).isDirectory();
-  } catch {
-    return false;
+  const end_date = doc.end_date;
+  if (end_date !== undefined) {
+    if (typeof end_date !== "string") {
+      issues.push({ path: ["end_date"], message: `expected string, received ${typeName(end_date)}` });
+    } else if (!DATE_RE.test(end_date)) {
+      issues.push({ path: ["end_date"], message: `string must match ${DATE_RE}` });
+    }
   }
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+  if (issues.length > 0)
+    return { ok: false, issues };
+  return {
+    ok: true,
+    data: {
+      iteration_id: doc.iteration_id,
+      start_date: doc.start_date,
+      status,
+      iteration_base_branch: doc.iteration_base_branch,
+      target_branch: doc.target_branch,
+      ...plans !== undefined ? { plans } : {},
+      ...end_date !== undefined ? { end_date } : {}
+    }
+  };
 }
 function violation(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
-function validateNonEmptyString(violations, value, field, missingCode, invalidCode) {
-  if (value === undefined) {
-    violations.push(violation("high", missingCode, `missing required field: ${field}`));
-  } else if (typeof value !== "string" || value.trim() === "") {
-    violations.push(violation("medium", invalidCode, `${field} must be a non-empty string`));
-  }
-}
-var DATE_PART = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
-var RFC3339_Z_RE = new RegExp(String.raw`^${DATE_PART}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
-var DATE_ONLY_RE = new RegExp(String.raw`^${DATE_PART}$`);
-function isValidClaimedAt(value) {
-  return typeof value === "string" && (RFC3339_Z_RE.test(value) || DATE_ONLY_RE.test(value));
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function validateExecutionLease(lease) {
-  const violations = [];
-  if (!isPlainObject(lease)) {
+function validateCompassFrontmatter(doc) {
+  if (!isPlainObject(doc)) {
     return {
       ok: false,
       violations: [
-        violation("high", "lease.execution-lease.invalid", "execution_lease must be an object — null and tombstone objects are invalid; writers delete the key on release")
+        violation("medium", "COMPASS_INVALID_FIELD", "Compass frontmatter must be a YAML object with iteration_id / start_date / status / iteration_base_branch / target_branch (template: mstar-iteration §1.3)", "Fix the frontmatter of {ITERATION_DIR}/<iteration-id>/delivery-compass.md")
       ]
     };
   }
-  validateNonEmptyString(violations, lease.holder, "holder", "lease.execution-lease.missing-holder", "lease.execution-lease.invalid-holder");
-  if (lease.claimed_at === undefined) {
-    violations.push(violation("high", "lease.execution-lease.missing-claimed-at", "missing required field: claimed_at"));
-  } else if (!isValidClaimedAt(lease.claimed_at)) {
-    violations.push(violation("medium", "lease.execution-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T02:30:00Z) or a YYYY-MM-DD date"));
-  }
-  if (lease.worktree_path === undefined) {
-    violations.push(violation("high", "lease.execution-lease.missing-worktree-path", "missing required field: worktree_path"));
-  } else if (typeof lease.worktree_path !== "string" || lease.worktree_path.trim() === "") {
-    violations.push(violation("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be a non-empty string"));
-  } else if (!isAbsolute3(lease.worktree_path)) {
-    violations.push(violation("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be an absolute path — it identifies the dedicated feature-worktree root (and MUST differ from metadata.control_worktree_path)"));
-  }
-  validateNonEmptyString(violations, lease.working_branch, "working_branch", "lease.execution-lease.missing-working-branch", "lease.execution-lease.invalid-working-branch");
-  if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
-    violations.push(violation("medium", "lease.execution-lease.invalid-session-label", "session_label must be a string (display only — never used for ownership comparison)"));
-  }
-  return { ok: violations.length === 0, violations };
-}
-function validateIntegrationMergeLease(lease) {
-  const violations = [];
-  if (!isPlainObject(lease)) {
+  const parsed = validateCompassShape(doc);
+  if (!parsed.ok) {
     return {
       ok: false,
-      violations: [
-        violation("high", "lease.merge-lease.invalid", "integration_merge_lease must be an object — absent means unclaimed; null and tombstone objects are invalid; writers delete the key on release")
-      ]
+      violations: parsed.issues.map((issue) => {
+        const field = issue.path.join(".") || "(root)";
+        return violation("medium", "COMPASS_INVALID_FIELD", `Compass frontmatter field '${field}' is invalid: ${issue.message}`, `Fix '${field}' in {ITERATION_DIR}/<iteration-id>/delivery-compass.md frontmatter (template: mstar-iteration §1.3)`);
+      })
     };
   }
-  validateNonEmptyString(violations, lease.holder, "holder", "lease.merge-lease.missing-holder", "lease.merge-lease.invalid-holder");
-  if (lease.claimed_at === undefined) {
-    violations.push(violation("high", "lease.merge-lease.missing-claimed-at", "missing required field: claimed_at"));
-  } else if (!isValidClaimedAt(lease.claimed_at)) {
-    violations.push(violation("medium", "lease.merge-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T04:00:00Z) or a YYYY-MM-DD date"));
+  const violations = [];
+  const { status, end_date } = parsed.data;
+  if (status === "completed" && end_date === undefined) {
+    violations.push(violation("high", "COMPASS_END_DATE_REQUIRED", "Compass frontmatter status is 'completed' but end_date is missing — end_date is required at iteration-close (mstar-iteration §3.4, template Fields guide)", "Add `end_date: YYYY-MM-DD` to the frontmatter"));
   }
-  validateNonEmptyString(violations, lease.plan_id, "plan_id", "lease.merge-lease.missing-plan-id", "lease.merge-lease.invalid-plan-id");
-  validateNonEmptyString(violations, lease.source_branch, "source_branch", "lease.merge-lease.missing-source-branch", "lease.merge-lease.invalid-source-branch");
-  validateNonEmptyString(violations, lease.target_branch, "target_branch", "lease.merge-lease.missing-target-branch", "lease.merge-lease.invalid-target-branch");
-  if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
-    violations.push(violation("medium", "lease.merge-lease.invalid-session-label", "session_label must be a string (display only — never used for ownership comparison)"));
+  if (status !== "completed" && end_date !== undefined) {
+    violations.push(violation("medium", "COMPASS_END_DATE_NOT_ALLOWED", `Compass frontmatter sets end_date while status is '${status}' — end_date is only written at iteration-close (mstar-iteration §3.4)`, "Remove end_date until iteration-close"));
   }
   return { ok: violations.length === 0, violations };
 }
-function planExecutionLeaseLocations(row) {
-  return { row: row.execution_lease };
+function registeredPlanIds(compassDoc) {
+  if (!Array.isArray(compassDoc.plans))
+    return [];
+  return compassDoc.plans.filter((plan) => typeof plan === "string" && plan.length > 0);
 }
-function verifyPlanExecutionLease(row, planId) {
-  const { row: rowLease } = planExecutionLeaseLocations(row);
-  const lease = rowLease;
-  if (lease === undefined) {
-    if (row.status === "InProgress") {
-      return {
-        ok: false,
-        violations: [
-          violation("high", "lease.verify.orphan", "plan is InProgress without an execution_lease — orphan: STOP, no writable dispatch until recovery (status-and-residuals.md § Orphan recovery)")
-        ]
-      };
-    }
-    return {
-      ok: false,
-      violations: [
-        violation("high", "lease.verify.missing", `plan ${planId} has no execution_lease at the SSOT location plans[].execution_lease`)
-      ]
-    };
+function findPlanRow(snapshotDoc, planId) {
+  if (!Array.isArray(snapshotDoc.plans))
+    return null;
+  for (const row of snapshotDoc.plans) {
+    if (!isPlainObject(row))
+      continue;
+    const rowId = typeof row.id === "string" ? row.id : typeof row.plan_id === "string" ? row.plan_id : null;
+    if (rowId === planId)
+      return row;
   }
+  return null;
+}
+function entryPlansAllDone(snapshotDoc, registered) {
   const violations = [];
-  violations.push(...validateExecutionLease(lease).violations);
-  return { ok: violations.length === 0, violations, lease };
+  if (registered.length === 0) {
+    violations.push(violation("medium", "COMPASS_NO_PLANS", "Compass frontmatter registers no plans — the all-plans-Done transition cannot be verified (mstar-iteration §1.3 / Phase transition gates)", "List the iteration's plan ids in the compass frontmatter `plans`"));
+    return violations;
+  }
+  for (const planId of registered) {
+    const row = findPlanRow(snapshotDoc, planId);
+    if (row === null) {
+      violations.push(violation("high", "PLAN_NOT_IN_STATUS", `Plan '${planId}' is registered in the compass frontmatter but has no row in the workflow snapshot plans[] (mstar-iteration §3.1 entry item 1)`, "Add the plan row to {HARNESS_DIR}/workflows/<id>/snapshot.json"));
+      continue;
+    }
+    if (row.status !== PLAN_STATUS_DONE) {
+      violations.push(violation("high", "PLAN_NOT_DONE", `Plan '${planId}' status is ${JSON.stringify(row.status)} in the workflow snapshot — all compass-registered plans must be 'Done' before iteration-close (mstar-iteration §3.1 entry item 1)`));
+    }
+  }
+  return violations;
+}
+function entryFrontmatterComplete(compassDoc) {
+  return validateCompassFrontmatter(compassDoc).violations;
+}
+function exitFrontmatterClosed(compassDoc) {
+  const violations = [];
+  if (compassDoc.status !== "completed") {
+    violations.push(violation("high", "EXIT_STATUS_NOT_COMPLETED", `Compass frontmatter status must be 'completed' at close exit — current: ${JSON.stringify(compassDoc.status)} (mstar-iteration §3.4 / §3.5 exit item 4)`));
+  }
+  const endDate = compassDoc.end_date;
+  if (typeof endDate !== "string" || !DATE_RE.test(endDate)) {
+    violations.push(violation("high", "EXIT_END_DATE_REQUIRED", "Compass frontmatter end_date (YYYY-MM-DD) is required when closing (mstar-iteration §3.4 / §3.5 exit item 4)"));
+  }
+  return violations;
+}
+function exitBranchCheck(opts) {
+  const violations = [];
+  const { currentBranch, specIntegrationBranch } = opts;
+  if (currentBranch === undefined || specIntegrationBranch === undefined) {
+    violations.push(violation("medium", "EXIT_BRANCH_UNVERIFIABLE", "Cannot verify the current branch is spec_integration_branch — missing currentBranch / specIntegrationBranch probe inputs (mstar-iteration §3.5 exit item 5)"));
+  } else if (currentBranch !== specIntegrationBranch) {
+    violations.push(violation("high", "EXIT_BRANCH_MISMATCH", `Current branch '${currentBranch}' is not the spec_integration_branch '${specIntegrationBranch}' (mstar-iteration §3.5 exit item 5)`));
+  }
+  return violations;
+}
+function exitPrBaseCheck(compassDoc, opts) {
+  const violations = [];
+  const target = compassDoc.target_branch;
+  const { prBaseBranch } = opts;
+  if (prBaseBranch === undefined) {
+    violations.push(violation("medium", "EXIT_PR_BASE_UNVERIFIABLE", "Cannot verify the PR base — missing prBaseBranch probe input (mstar-iteration §3.5 exit item 6)"));
+  } else if (typeof target !== "string" || prBaseBranch !== target) {
+    violations.push(violation("high", "EXIT_PR_BASE_MISMATCH", `PR base '${prBaseBranch}' must equal the compass target_branch '${String(target)}' — not an undocumented branch (mstar-iteration §3.5 exit item 6)`));
+  }
+  return violations;
+}
+function evaluatePhaseGate(snapshotDoc, compassDoc, opts = {}) {
+  const registered = registeredPlanIds(compassDoc);
+  const entryViolations = [
+    ...entryPlansAllDone(snapshotDoc, registered),
+    ...entryFrontmatterComplete(compassDoc)
+  ];
+  const exitViolations = [
+    ...exitFrontmatterClosed(compassDoc),
+    ...exitBranchCheck(opts),
+    ...exitPrBaseCheck(compassDoc, opts)
+  ];
+  const allPlansDone = registered.length > 0 && registered.every((planId) => {
+    const row = findPlanRow(snapshotDoc, planId);
+    return row !== null && row.status === PLAN_STATUS_DONE;
+  });
+  const entry = { ok: entryViolations.length === 0, violations: entryViolations };
+  const exit = { ok: exitViolations.length === 0, violations: exitViolations };
+  let transition;
+  if (!allPlansDone)
+    transition = "phase-2-execute";
+  else if (entry.ok && exit.ok)
+    transition = "phase-4-pr-delivery";
+  else
+    transition = "phase-3-close";
+  const gateBlocking = allPlansDone ? [...entryViolations, ...exitViolations] : [];
+  return {
+    transition,
+    allPlansDone,
+    entry,
+    exit,
+    ok: gateBlocking.length === 0,
+    violations: gateBlocking
+  };
+}
+function parseCompassFrontmatter(filePath) {
+  return parseCompassFrontmatterText(readFileSync3(filePath, "utf8"), filePath);
+}
+function parseCompassFrontmatterText(content, filePath) {
+  const lines = content.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") {
+    throw new Error(`no YAML frontmatter fence in ${filePath} (expected first line "---")`);
+  }
+  const end = lines.indexOf("---", 1);
+  if (end === -1) {
+    throw new Error(`unterminated YAML frontmatter in ${filePath} (no closing "---")`);
+  }
+  const doc = {};
+  let listKey = null;
+  for (let i = 1;i < end; i += 1) {
+    const line = lines[i] ?? "";
+    if (!line.trim() || line.trim().startsWith("#"))
+      continue;
+    if (listKey !== null && /^\s*-\s+/.test(line)) {
+      const item = line.replace(/^\s*-\s+/, "").trim().replace(/^["']|["']$/g, "");
+      if (!Array.isArray(doc[listKey]))
+        doc[listKey] = [];
+      doc[listKey].push(item);
+      continue;
+    }
+    listKey = null;
+    const kv = line.match(/^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (!kv) {
+      throw new Error(`unsupported frontmatter line in ${filePath}: ${JSON.stringify(line)}`);
+    }
+    const value = kv[2].trim();
+    doc[kv[1]] = value === "" ? null : /^\[.*\]$/.test(value) ? parseFlowArray(value, filePath) : value.replace(/^["']|["']$/g, "");
+    listKey = value === "" ? kv[1] : null;
+  }
+  return doc;
+}
+function parseFlowArray(raw, filePath) {
+  const inner = raw.slice(1, -1);
+  if (/[[\]]/.test(inner)) {
+    throw new Error(`nested flow-style array in ${filePath}: ${JSON.stringify(raw)} — only flat scalar items are supported (e.g. [a, b])`);
+  }
+  let quote = null;
+  for (const ch of inner) {
+    if (ch === '"' || ch === "'") {
+      if (quote === null)
+        quote = ch;
+      else if (quote === ch)
+        quote = null;
+    } else if (ch === "," && quote !== null) {
+      throw new Error(`ambiguous flow-style array in ${filePath}: ${JSON.stringify(raw)} — quoted item containing comma cannot be split unambiguously (flat scalar items only)`);
+    }
+  }
+  if (quote !== null) {
+    throw new Error(`unterminated ${quote} quote in flow-style array in ${filePath}: ${JSON.stringify(raw)}`);
+  }
+  const items = [];
+  for (const part of inner.split(",")) {
+    const item = part.trim().replace(/^["']|["']$/g, "");
+    if (item === "")
+      continue;
+    items.push(item);
+  }
+  return items;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function violation2(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function validateNonEmptyString(violations, value, field, missingCode, invalidCode) {
+  if (value === undefined) {
+    violations.push(violation2("high", missingCode, `missing required field: ${field}`));
+  } else if (typeof value !== "string" || value.trim() === "") {
+    violations.push(violation2("medium", invalidCode, `${field} must be a non-empty string`));
+  }
+}
+var DATE_PART = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
+var RFC3339_Z_RE = new RegExp(String.raw`^${DATE_PART}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
+var DATE_ONLY_RE = new RegExp(String.raw`^${DATE_PART}$`);
+function isValidClaimedAt(value) {
+  return typeof value === "string" && (RFC3339_Z_RE.test(value) || DATE_ONLY_RE.test(value));
+}
+function validateExecutionLease(lease) {
+  const violations = [];
+  if (!isPlainObject2(lease)) {
+    return {
+      ok: false,
+      violations: [
+        violation2("high", "lease.execution-lease.invalid", "execution_lease must be an object — null and tombstone objects are invalid; writers delete the key on release")
+      ]
+    };
+  }
+  validateNonEmptyString(violations, lease.holder, "holder", "lease.execution-lease.missing-holder", "lease.execution-lease.invalid-holder");
+  if (lease.claimed_at === undefined) {
+    violations.push(violation2("high", "lease.execution-lease.missing-claimed-at", "missing required field: claimed_at"));
+  } else if (!isValidClaimedAt(lease.claimed_at)) {
+    violations.push(violation2("medium", "lease.execution-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T02:30:00Z) or a YYYY-MM-DD date"));
+  }
+  if (lease.worktree_path === undefined) {
+    violations.push(violation2("high", "lease.execution-lease.missing-worktree-path", "missing required field: worktree_path"));
+  } else if (typeof lease.worktree_path !== "string" || lease.worktree_path.trim() === "") {
+    violations.push(violation2("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be a non-empty string"));
+  } else if (!isAbsolute2(lease.worktree_path)) {
+    violations.push(violation2("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be an absolute path — it identifies the dedicated feature-worktree root (and MUST differ from metadata.control_worktree_path)"));
+  }
+  validateNonEmptyString(violations, lease.working_branch, "working_branch", "lease.execution-lease.missing-working-branch", "lease.execution-lease.invalid-working-branch");
+  if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
+    violations.push(violation2("medium", "lease.execution-lease.invalid-session-label", "session_label must be a string (display only — never used for ownership comparison)"));
+  }
+  return { ok: violations.length === 0, violations };
+}
+function validateIntegrationMergeLease(lease) {
+  const violations = [];
+  if (!isPlainObject2(lease)) {
+    return {
+      ok: false,
+      violations: [
+        violation2("high", "lease.merge-lease.invalid", "integration_merge_lease must be an object — absent means unclaimed; null and tombstone objects are invalid; writers delete the key on release")
+      ]
+    };
+  }
+  validateNonEmptyString(violations, lease.holder, "holder", "lease.merge-lease.missing-holder", "lease.merge-lease.invalid-holder");
+  if (lease.claimed_at === undefined) {
+    violations.push(violation2("high", "lease.merge-lease.missing-claimed-at", "missing required field: claimed_at"));
+  } else if (!isValidClaimedAt(lease.claimed_at)) {
+    violations.push(violation2("medium", "lease.merge-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T04:00:00Z) or a YYYY-MM-DD date"));
+  }
+  validateNonEmptyString(violations, lease.plan_id, "plan_id", "lease.merge-lease.missing-plan-id", "lease.merge-lease.invalid-plan-id");
+  validateNonEmptyString(violations, lease.source_branch, "source_branch", "lease.merge-lease.missing-source-branch", "lease.merge-lease.invalid-source-branch");
+  validateNonEmptyString(violations, lease.target_branch, "target_branch", "lease.merge-lease.missing-target-branch", "lease.merge-lease.invalid-target-branch");
+  if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
+    violations.push(violation2("medium", "lease.merge-lease.invalid-session-label", "session_label must be a string (display only — never used for ownership comparison)"));
+  }
+  return { ok: violations.length === 0, violations };
+}
+function planExecutionLeaseLocations(row) {
+  return { row: row.execution_lease };
+}
+function verifyPlanExecutionLease(row, planId) {
+  const { row: rowLease } = planExecutionLeaseLocations(row);
+  const lease = rowLease;
+  if (lease === undefined) {
+    if (row.status === "InProgress") {
+      return {
+        ok: false,
+        violations: [
+          violation2("high", "lease.verify.orphan", "plan is InProgress without an execution_lease — orphan: STOP, no writable dispatch until recovery (status-and-residuals.md § Orphan recovery)")
+        ]
+      };
+    }
+    return {
+      ok: false,
+      violations: [
+        violation2("high", "lease.verify.missing", `plan ${planId} has no execution_lease at the SSOT location plans[].execution_lease`)
+      ]
+    };
+  }
+  const violations = [];
+  violations.push(...validateExecutionLease(lease).violations);
+  return { ok: violations.length === 0, violations, lease };
 }
 var heldLockDirs = new AsyncLocalStorage;
 var BRANCH_FORMS_HINT = '"Working branch: <existing>" | "Working branch: create <new> from <base>" | "Branch policy: direct on <branch> — <reason>"';
@@ -1498,7 +1658,7 @@ var REQUIRED_FIELDS = [
   { key: "delegation", label: "Delegation", code: "delegation" },
   { key: "taskCategory", label: "Task category", code: "task-category" }
 ];
-function violation2(severity, code, message, fix) {
+function violation3(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
 function parseAssignmentFields(assignmentText) {
@@ -1548,11 +1708,11 @@ function parseEnforcementFlag(text) {
 }
 function requireField(violations, value, label, code) {
   if (value === undefined) {
-    const v = violation2("high", `assignment.field.missing-${code}`, `missing required Assignment field: ${label}`, `add "**${label}**: <value>" to the Assignment`);
+    const v = violation3("high", `assignment.field.missing-${code}`, `missing required Assignment field: ${label}`, `add "**${label}**: <value>" to the Assignment`);
     v.aliases = [`assignment.presence.missing-${code}`];
     violations.push(v);
   } else if (value === "") {
-    const v = violation2("high", `assignment.field.invalid-${code}`, `${label} must be non-empty`, `fill in "**${label}**: <value>"`);
+    const v = violation3("high", `assignment.field.invalid-${code}`, `${label} must be non-empty`, `fill in "**${label}**: <value>"`);
     v.aliases = [`assignment.presence.missing-${code}`];
     violations.push(v);
   }
@@ -1611,20 +1771,20 @@ function validateAssignmentFields(assignmentText, opts = {}) {
     const formCount = Number(workingPresent) + Number(policyPresent);
     const forms = parseAssignmentBranchForms(assignmentText);
     if (formCount === 0) {
-      violations.push(violation2("high", "assignment.field.branch-missing", "writable assignment must contain exactly one branch form", `add exactly one of: ${BRANCH_FORMS_HINT}`));
+      violations.push(violation3("high", "assignment.field.branch-missing", "writable assignment must contain exactly one branch form", `add exactly one of: ${BRANCH_FORMS_HINT}`));
     } else if (formCount > 1) {
-      violations.push(violation2("high", "assignment.field.branch-multiple", `writable assignment contains ${formCount} branch forms (Working branch + Branch policy) — exactly one required`, `keep exactly one of: ${BRANCH_FORMS_HINT}`));
+      violations.push(violation3("high", "assignment.field.branch-multiple", `writable assignment contains ${formCount} branch forms (Working branch + Branch policy) — exactly one required`, `keep exactly one of: ${BRANCH_FORMS_HINT}`));
     } else if (workingPresent) {
       const create = forms.createForm;
       if (create !== undefined && (create.base === undefined || create.base.trim() === "" || create.name.trim() === "")) {
-        violations.push(violation2("high", "assignment.field.branch-missing-base", `create-form Working branch is incomplete: "${fields.workingBranch}" (expected "create <new-branch> from <base>")`, "write both the new branch name and the ancestor branch after `from` (main / existing feature branch / remote-tracking branch / `current`)"));
+        violations.push(violation3("high", "assignment.field.branch-missing-base", `create-form Working branch is incomplete: "${fields.workingBranch}" (expected "create <new-branch> from <base>")`, "write both the new branch name and the ancestor branch after `from` (main / existing feature branch / remote-tracking branch / `current`)"));
       }
     } else if (policyPresent) {
       const direct = forms.directOn;
       if (direct === undefined) {
-        violations.push(violation2("high", "assignment.field.branch-policy-missing-branch", `unparseable Branch policy: "${fields.branchPolicy}" (expected "direct on <branch> — <reason>")`, "start the field with `direct on <branch>`"));
+        violations.push(violation3("high", "assignment.field.branch-policy-missing-branch", `unparseable Branch policy: "${fields.branchPolicy}" (expected "direct on <branch> — <reason>")`, "start the field with `direct on <branch>`"));
       } else if (direct.reason === "") {
-        violations.push(violation2("high", "assignment.field.branch-policy-missing-reason", `Branch policy "direct on ${direct.branch}" is missing the reason`, 'append "— <reason>" after the branch name'));
+        violations.push(violation3("high", "assignment.field.branch-policy-missing-reason", `Branch policy "direct on ${direct.branch}" is missing the reason`, 'append "— <reason>" after the branch name'));
       }
     }
   }
@@ -1635,7 +1795,7 @@ function assertDefaultBranchProtected(branch, opts = {}) {
   const violations = [];
   const normalized = branch.trim();
   if (normalized !== "" && defaultBranches.includes(normalized) && opts.directOnException !== true) {
-    violations.push(violation2("high", "dispatch.default-branch.protected", `writable work on default protected branch "${normalized}" requires an explicit direct-on exception`, `add "Branch policy: direct on ${normalized} — <reason>" to the Assignment, or use a feature branch`));
+    violations.push(violation3("high", "dispatch.default-branch.protected", `writable work on default protected branch "${normalized}" requires an explicit direct-on exception`, `add "Branch policy: direct on ${normalized} — <reason>" to the Assignment, or use a feature branch`));
   }
   return { ok: violations.length === 0, violations };
 }
@@ -1644,7 +1804,7 @@ function executionModeToN(executionMode, opts = {}) {
   const mode = executionMode.trim().toLowerCase().split(/\s+/)[0] ?? "";
   let n;
   if (mode === "") {
-    violations.push(violation2("high", "dispatch.execution-mode.missing", "missing required Assignment field: Execution mode", 'add "**Execution mode**: sdd | inline | targeted"'));
+    violations.push(violation3("high", "dispatch.execution-mode.missing", "missing required Assignment field: Execution mode", 'add "**Execution mode**: sdd | inline | targeted"'));
   } else if (mode === "sdd") {
     n = 3;
   } else if (mode === "inline") {
@@ -1652,14 +1812,14 @@ function executionModeToN(executionMode, opts = {}) {
   } else if (mode === "targeted") {
     const seats = [...new Set((opts.seats ?? []).map((s) => s.trim()).filter((s) => s !== ""))];
     if (seats.length === 0) {
-      violations.push(violation2("high", "dispatch.execution-mode.missing-seats", 'execution mode "targeted" requires listed reviewer seats', 'add "QC re-review: targeted — reviewers: <role-id>, …" to the Assignment and pass the seats'));
+      violations.push(violation3("high", "dispatch.execution-mode.missing-seats", 'execution mode "targeted" requires listed reviewer seats', 'add "QC re-review: targeted — reviewers: <role-id>, …" to the Assignment and pass the seats'));
     } else if (seats.length > 3) {
-      violations.push(violation2("high", "dispatch.execution-mode.too-many-seats", `execution mode "targeted" lists ${seats.length} reviewer seats — at most 3 (targeted re-review seats are the tri seats, N = 1–3)`, "list at most three reviewer seats for the targeted re-review"));
+      violations.push(violation3("high", "dispatch.execution-mode.too-many-seats", `execution mode "targeted" lists ${seats.length} reviewer seats — at most 3 (targeted re-review seats are the tri seats, N = 1–3)`, "list at most three reviewer seats for the targeted re-review"));
     } else {
       n = seats.length;
     }
   } else {
-    violations.push(violation2("high", "dispatch.execution-mode.unknown", `unknown execution mode "${executionMode.trim()}" (expected sdd | inline | targeted)`, "fix the Execution mode field"));
+    violations.push(violation3("high", "dispatch.execution-mode.unknown", `unknown execution mode "${executionMode.trim()}" (expected sdd | inline | targeted)`, "fix the Execution mode field"));
   }
   return n === undefined ? { ok: false, violations } : { ok: true, violations, n };
 }
@@ -1705,7 +1865,7 @@ function antiRecursionPrecheck(subagentType, executeAs) {
     return {
       ok: false,
       violations: [
-        violation2("critical", "dispatch.anti-recursion.empty-binding", `empty host role binding — the host cannot report which agent is calling, so anti-recursion cannot be proven (a dispatch could silently recurse)`, "set the host role-binding field (omp task entry `agent` / opencode `subagent` / cursor `subagent_type` / dsh `dispatchBinding`) before dispatching")
+        violation3("critical", "dispatch.anti-recursion.empty-binding", `empty host role binding — the host cannot report which agent is calling, so anti-recursion cannot be proven (a dispatch could silently recurse)`, "set the host role-binding field (omp task entry `agent` / opencode `subagent` / cursor `subagent_type` / dsh `dispatchBinding`) before dispatching")
       ]
     };
   }
@@ -1713,7 +1873,7 @@ function antiRecursionPrecheck(subagentType, executeAs) {
     return {
       ok: false,
       violations: [
-        violation2("critical", "dispatch.anti-recursion.self-type", `recursive dispatch refused: role binding "${subagentType}" equals Execute as "${executeAs}" (leaf executors must not re-invoke their own role)`, "complete the work in this session, or return Blocked to project-manager")
+        violation3("critical", "dispatch.anti-recursion.self-type", `recursive dispatch refused: role binding "${subagentType}" equals Execute as "${executeAs}" (leaf executors must not re-invoke their own role)`, "complete the work in this session, or return Blocked to project-manager")
       ]
     };
   }
@@ -1723,45 +1883,45 @@ var WORKFLOW_SNAPSHOT_FILE = "snapshot.json";
 var WORKFLOW_LIFECYCLE_STATUSES = ["running", "paused", "completed", "failed", "stopped"];
 var WORKFLOW_TERMINAL_STATUSES = ["completed", "failed", "stopped"];
 var WORKFLOW_LIFECYCLE_TYPES = ["plan", "iteration"];
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function violation3(severity, code, message, fix) {
+function violation4(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
 function validateNonEmptyString2(violations, value, field, missingCode, invalidCode) {
   if (value === undefined) {
-    violations.push(violation3("high", missingCode, `missing required field: ${field}`));
+    violations.push(violation4("high", missingCode, `missing required field: ${field}`));
   } else if (typeof value !== "string" || value.trim() === "") {
-    violations.push(violation3("medium", invalidCode, `${field} must be a non-empty string`));
+    violations.push(violation4("medium", invalidCode, `${field} must be a non-empty string`));
   }
 }
 function validateWorkflowSnapshot(doc) {
   const violations = [];
-  if (!isPlainObject2(doc)) {
+  if (!isPlainObject3(doc)) {
     return {
       ok: false,
-      violations: [violation3("high", "workflow.snapshot.invalid", "workflow snapshot must be an object")]
+      violations: [violation4("high", "workflow.snapshot.invalid", "workflow snapshot must be an object")]
     };
   }
   if (doc.schema_version === undefined) {
-    violations.push(violation3("high", "workflow.snapshot.missing-schema-version", "missing required field: schema_version"));
+    violations.push(violation4("high", "workflow.snapshot.missing-schema-version", "missing required field: schema_version"));
   } else if (doc.schema_version !== 1) {
-    violations.push(violation3("high", "workflow.snapshot.invalid-schema-version", `schema_version must be 1 — got ${JSON.stringify(doc.schema_version)} (version is reserved for the root file discriminator)`));
+    violations.push(violation4("high", "workflow.snapshot.invalid-schema-version", `schema_version must be 1 — got ${JSON.stringify(doc.schema_version)} (version is reserved for the root file discriminator)`));
   }
   if (doc.version !== undefined) {
-    violations.push(violation3("medium", "workflow.snapshot.reserved-version", `top-level version is reserved for the root status.json discriminator — snapshots use schema_version; remove the version key (got ${JSON.stringify(doc.version)})`, "remove the version key from the snapshot"));
+    violations.push(violation4("medium", "workflow.snapshot.reserved-version", `top-level version is reserved for the root status.json discriminator — snapshots use schema_version; remove the version key (got ${JSON.stringify(doc.version)})`, "remove the version key from the snapshot"));
   }
   validateNonEmptyString2(violations, doc.id, "id", "workflow.snapshot.missing-id", "workflow.snapshot.invalid-id");
   if (doc.type === undefined) {
-    violations.push(violation3("high", "workflow.snapshot.missing-type", "missing required field: type"));
+    violations.push(violation4("high", "workflow.snapshot.missing-type", "missing required field: type"));
   } else if (typeof doc.type !== "string" || !WORKFLOW_LIFECYCLE_TYPES.includes(doc.type)) {
-    violations.push(violation3("medium", "workflow.snapshot.invalid-type", `type must be one of ${WORKFLOW_LIFECYCLE_TYPES.join(" | ")} — got ${JSON.stringify(doc.type)}`));
+    violations.push(violation4("medium", "workflow.snapshot.invalid-type", `type must be one of ${WORKFLOW_LIFECYCLE_TYPES.join(" | ")} — got ${JSON.stringify(doc.type)}`));
   }
   if (doc.status === undefined) {
-    violations.push(violation3("high", "workflow.snapshot.missing-status", "missing required field: status"));
+    violations.push(violation4("high", "workflow.snapshot.missing-status", "missing required field: status"));
   } else if (typeof doc.status !== "string" || !WORKFLOW_LIFECYCLE_STATUSES.includes(doc.status)) {
-    violations.push(violation3("medium", "workflow.snapshot.invalid-status", `status must be one of ${WORKFLOW_LIFECYCLE_STATUSES.join(" | ")} — got ${JSON.stringify(doc.status)}`));
+    violations.push(violation4("medium", "workflow.snapshot.invalid-status", `status must be one of ${WORKFLOW_LIFECYCLE_STATUSES.join(" | ")} — got ${JSON.stringify(doc.status)}`));
   }
   validateNonEmptyString2(violations, doc.started_at, "started_at", "workflow.snapshot.missing-started-at", "workflow.snapshot.invalid-started-at");
   validateNonEmptyString2(violations, doc.updated_at, "updated_at", "workflow.snapshot.missing-updated-at", "workflow.snapshot.invalid-updated-at");
@@ -1769,35 +1929,35 @@ function validateWorkflowSnapshot(doc) {
     validateNonEmptyString2(violations, doc.ended_at, "ended_at", "workflow.snapshot.missing-ended-at", "workflow.snapshot.invalid-ended-at");
   }
   if (doc.phase !== undefined && typeof doc.phase !== "string") {
-    violations.push(violation3("medium", "workflow.snapshot.invalid-phase", "phase must be a string (free-form phase machine label)"));
+    violations.push(violation4("medium", "workflow.snapshot.invalid-phase", "phase must be a string (free-form phase machine label)"));
   }
   if (doc.plans === undefined) {
-    violations.push(violation3("high", "workflow.snapshot.missing-plans", "missing required field: plans"));
+    violations.push(violation4("high", "workflow.snapshot.missing-plans", "missing required field: plans"));
   } else if (!Array.isArray(doc.plans)) {
-    violations.push(violation3("high", "workflow.snapshot.invalid-plans", "plans must be an array of legacy plan rows"));
+    violations.push(violation4("high", "workflow.snapshot.invalid-plans", "plans must be an array of legacy plan rows"));
   } else {
     for (const row of doc.plans) {
       violations.push(...validatePlanRow(row).violations);
-      if (isPlainObject2(row) && row.execution_lease !== undefined) {
+      if (isPlainObject3(row) && row.execution_lease !== undefined) {
         violations.push(...validateExecutionLease(row.execution_lease).violations);
       }
     }
   }
   if (doc.execution_policy !== undefined) {
-    if (!isPlainObject2(doc.execution_policy)) {
-      violations.push(violation3("medium", "workflow.snapshot.invalid-execution-policy", "execution_policy must be an object"));
+    if (!isPlainObject3(doc.execution_policy)) {
+      violations.push(violation4("medium", "workflow.snapshot.invalid-execution-policy", "execution_policy must be an object"));
     }
   }
   if (doc.integration_merge_lease !== undefined) {
     violations.push(...validateIntegrationMergeLease(doc.integration_merge_lease).violations);
   }
   if (doc.branch !== undefined) {
-    if (!isPlainObject2(doc.branch)) {
-      violations.push(violation3("medium", "workflow.snapshot.invalid-branch", "branch must be an object"));
+    if (!isPlainObject3(doc.branch)) {
+      violations.push(violation4("medium", "workflow.snapshot.invalid-branch", "branch must be an object"));
     } else {
       for (const key of ["base", "integration", "target"]) {
         if (doc.branch[key] !== undefined && (typeof doc.branch[key] !== "string" || doc.branch[key].trim() === "")) {
-          violations.push(violation3("medium", "workflow.snapshot.invalid-branch", `branch.${key} must be a non-empty string`));
+          violations.push(violation4("medium", "workflow.snapshot.invalid-branch", `branch.${key} must be a non-empty string`));
         }
       }
     }
@@ -1805,8 +1965,8 @@ function validateWorkflowSnapshot(doc) {
   if (doc.control_worktree_path !== undefined) {
     validateNonEmptyString2(violations, doc.control_worktree_path, "control_worktree_path", "workflow.snapshot.missing-control-worktree-path", "workflow.snapshot.invalid-control-worktree-path");
   }
-  if (doc.legacy_metadata !== undefined && !isPlainObject2(doc.legacy_metadata)) {
-    violations.push(violation3("medium", "workflow.snapshot.invalid-legacy-metadata", "legacy_metadata must be an object"));
+  if (doc.legacy_metadata !== undefined && !isPlainObject3(doc.legacy_metadata)) {
+    violations.push(violation4("medium", "workflow.snapshot.invalid-legacy-metadata", "legacy_metadata must be an object"));
   }
   if (doc.compass_ref !== undefined) {
     validateNonEmptyString2(violations, doc.compass_ref, "compass_ref", "workflow.snapshot.missing-compass-ref", "workflow.snapshot.invalid-compass-ref");
@@ -1814,29 +1974,29 @@ function validateWorkflowSnapshot(doc) {
   const terminal = typeof doc.status === "string" && WORKFLOW_TERMINAL_STATUSES.includes(doc.status);
   if (terminal) {
     if (doc.ended_at === undefined) {
-      violations.push(violation3("high", "workflow.snapshot.missing-ended-at", `terminal status ${JSON.stringify(doc.status)} requires ended_at — a terminal snapshot must record when the lifecycle ended`));
+      violations.push(violation4("high", "workflow.snapshot.missing-ended-at", `terminal status ${JSON.stringify(doc.status)} requires ended_at — a terminal snapshot must record when the lifecycle ended`));
     }
     if (Array.isArray(doc.plans)) {
       for (const row of doc.plans) {
-        if (isPlainObject2(row) && row.execution_lease !== undefined) {
-          violations.push(violation3("high", "workflow.snapshot.terminal-dangling-execution-lease", `terminal snapshot must not carry a row execution_lease (dangling lease) — release every lease before the lifecycle ends`));
+        if (isPlainObject3(row) && row.execution_lease !== undefined) {
+          violations.push(violation4("high", "workflow.snapshot.terminal-dangling-execution-lease", `terminal snapshot must not carry a row execution_lease (dangling lease) — release every lease before the lifecycle ends`));
         }
       }
     }
     if (doc.integration_merge_lease !== undefined) {
-      violations.push(violation3("high", "workflow.snapshot.terminal-dangling-merge-lease", "terminal snapshot must not carry integration_merge_lease (dangling lease) — release the merge lease before the lifecycle ends"));
+      violations.push(violation4("high", "workflow.snapshot.terminal-dangling-merge-lease", "terminal snapshot must not carry integration_merge_lease (dangling lease) — release the merge lease before the lifecycle ends"));
     }
   }
   return { ok: violations.length === 0, violations };
 }
-var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var DATE_RE2 = /^\d{4}-\d{2}-\d{2}$/;
 var PLAN_STATUSES = ["Todo", "InProgress", "InReview", "Blocked", "Done"];
 var RESIDUAL_DECISIONS = ["defer", "accept", "risk-accepted"];
 var RESIDUAL_LIFECYCLES = ["open", "resolved", "waived", "superseded", "duplicate"];
-function isPlainObject3(value) {
+function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function violation4(severity, code, message, fix) {
+function violation5(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
 function normalizeSeverity(value) {
@@ -1853,19 +2013,19 @@ function isOpenResidual(entry) {
 }
 function validateNonEmptyString3(violations, value, field, missingCode, invalidCode) {
   if (value === undefined) {
-    violations.push(violation4("high", missingCode, `missing required field: ${field}`));
+    violations.push(violation5("high", missingCode, `missing required field: ${field}`));
   } else if (typeof value !== "string" || value.trim() === "") {
-    violations.push(violation4("medium", invalidCode, `${field} must be a non-empty string`));
+    violations.push(violation5("medium", invalidCode, `${field} must be a non-empty string`));
   }
 }
 function validatePlanRow(row) {
   const violations = [];
-  if (!isPlainObject3(row)) {
-    return { ok: false, violations: [violation4("high", "status.plan-row.invalid", "plan row must be an object")] };
+  if (!isPlainObject4(row)) {
+    return { ok: false, violations: [violation5("high", "status.plan-row.invalid", "plan row must be an object")] };
   }
   const { id, plan_id: planId, title, file, status, metadata, execution_lease } = row;
   if (id === undefined && planId === undefined) {
-    violations.push(violation4("high", "status.plan-row.missing-id", "missing required field: id (or legacy plan_id)"));
+    violations.push(violation5("high", "status.plan-row.missing-id", "missing required field: id (or legacy plan_id)"));
   } else {
     if (id !== undefined) {
       validateNonEmptyString3(violations, id, "id", "status.plan-row.missing-id", "status.plan-row.invalid-id");
@@ -1874,31 +2034,31 @@ function validatePlanRow(row) {
       validateNonEmptyString3(violations, planId, "plan_id", "status.plan-row.missing-plan-id", "status.plan-row.invalid-plan-id");
     }
     if (id !== undefined && planId !== undefined && id !== planId) {
-      violations.push(violation4("medium", "status.plan-row.dual-id", "row has both id and plan_id with different values — write one canonical key (prefer id)"));
+      violations.push(violation5("medium", "status.plan-row.dual-id", "row has both id and plan_id with different values — write one canonical key (prefer id)"));
     }
   }
   validateNonEmptyString3(violations, title, "title", "status.plan-row.missing-title", "status.plan-row.invalid-title");
   validateNonEmptyString3(violations, file, "file", "status.plan-row.missing-file", "status.plan-row.invalid-file");
   if (status === undefined) {
-    violations.push(violation4("high", "status.plan-row.missing-status", "missing required field: status"));
+    violations.push(violation5("high", "status.plan-row.missing-status", "missing required field: status"));
   } else if (typeof status !== "string" || !PLAN_STATUSES.includes(status)) {
-    violations.push(violation4("medium", "status.plan-row.invalid-status", `status must be one of ${PLAN_STATUSES.join(" | ")} — got ${JSON.stringify(status)}`));
+    violations.push(violation5("medium", "status.plan-row.invalid-status", `status must be one of ${PLAN_STATUSES.join(" | ")} — got ${JSON.stringify(status)}`));
   }
-  if (metadata !== undefined && !isPlainObject3(metadata)) {
-    violations.push(violation4("medium", "status.plan-row.invalid-metadata", "metadata must be an object"));
+  if (metadata !== undefined && !isPlainObject4(metadata)) {
+    violations.push(violation5("medium", "status.plan-row.invalid-metadata", "metadata must be an object"));
   }
-  if (execution_lease !== undefined && !isPlainObject3(execution_lease)) {
-    violations.push(violation4("medium", "status.plan-row.invalid-execution-lease", "execution_lease must be an object"));
+  if (execution_lease !== undefined && !isPlainObject4(execution_lease)) {
+    violations.push(violation5("medium", "status.plan-row.invalid-execution-lease", "execution_lease must be an object"));
   }
   if (status === "Done" && execution_lease !== undefined) {
-    violations.push(violation4("medium", "status.plan-row.done-with-lease", 'plan status Done must not carry an execution_lease — the Done authority deletes the lease in the same complete-file update as status: "Done" (status-and-residuals.md § Hold, release, and override)', 'delete plans[].execution_lease in the same update that sets status: "Done"'));
+    violations.push(violation5("medium", "status.plan-row.done-with-lease", 'plan status Done must not carry an execution_lease — the Done authority deletes the lease in the same complete-file update as status: "Done" (status-and-residuals.md § Hold, release, and override)', 'delete plans[].execution_lease in the same update that sets status: "Done"'));
   }
   return { ok: violations.length === 0, violations };
 }
 function validateResidual(entry) {
   const violations = [];
-  if (!isPlainObject3(entry)) {
-    return { ok: false, violations: [violation4("high", "status.residual.invalid", "residual entry must be an object")] };
+  if (!isPlainObject4(entry)) {
+    return { ok: false, violations: [violation5("high", "status.residual.invalid", "residual entry must be an object")] };
   }
   const { id, title, severity, source, scope, decision, owner, target, tracking, detail_doc, lifecycle, closed_at } = entry;
   validateNonEmptyString3(violations, id, "id", "status.residual.missing-id", "status.residual.invalid-id");
@@ -1907,42 +2067,42 @@ function validateResidual(entry) {
   validateNonEmptyString3(violations, scope, "scope", "status.residual.missing-scope", "status.residual.invalid-scope");
   validateNonEmptyString3(violations, owner, "owner", "status.residual.missing-owner", "status.residual.invalid-owner");
   if (severity === undefined) {
-    violations.push(violation4("high", "status.residual.missing-severity", "missing required field: severity"));
+    violations.push(violation5("high", "status.residual.missing-severity", "missing required field: severity"));
   } else if (typeof severity !== "string" || !SEVERITY_ORDER.includes(severity) && severity !== "warning") {
-    violations.push(violation4("medium", "status.residual.invalid-severity", `severity must be one of ${SEVERITY_ORDER.join(" | ")} — got ${JSON.stringify(severity)}`));
+    violations.push(violation5("medium", "status.residual.invalid-severity", `severity must be one of ${SEVERITY_ORDER.join(" | ")} — got ${JSON.stringify(severity)}`));
   } else if (severity === "warning") {
-    violations.push(violation4("low", "status.residual.legacy-warning", `severity "warning" is legacy — forbidden on new entries; read paths normalize it to "low"`, `use "low" (normalizeSeverity maps 'warning' → 'low')`));
+    violations.push(violation5("low", "status.residual.legacy-warning", `severity "warning" is legacy — forbidden on new entries; read paths normalize it to "low"`, `use "low" (normalizeSeverity maps 'warning' → 'low')`));
   }
   if (decision === undefined) {
-    violations.push(violation4("high", "status.residual.missing-decision", "missing required field: decision"));
+    violations.push(violation5("high", "status.residual.missing-decision", "missing required field: decision"));
   } else if (typeof decision !== "string" || !RESIDUAL_DECISIONS.includes(decision)) {
-    violations.push(violation4("medium", "status.residual.invalid-decision", `decision must be one of ${RESIDUAL_DECISIONS.join(" | ")} — got ${JSON.stringify(decision)}`));
+    violations.push(violation5("medium", "status.residual.invalid-decision", `decision must be one of ${RESIDUAL_DECISIONS.join(" | ")} — got ${JSON.stringify(decision)}`));
   }
   if (target === undefined) {
-    violations.push(violation4("high", "status.residual.missing-target", "missing required field: target"));
+    violations.push(violation5("high", "status.residual.missing-target", "missing required field: target"));
   } else if (typeof target !== "string" && target !== null) {
-    violations.push(violation4("medium", "status.residual.invalid-target", "target must be a string or null"));
+    violations.push(violation5("medium", "status.residual.invalid-target", "target must be a string or null"));
   }
   if (tracking === undefined) {
-    violations.push(violation4("high", "status.residual.missing-tracking", "missing required field: tracking"));
+    violations.push(violation5("high", "status.residual.missing-tracking", "missing required field: tracking"));
   } else if (typeof tracking !== "string" && tracking !== null) {
-    violations.push(violation4("medium", "status.residual.invalid-tracking", "tracking must be a string or null"));
+    violations.push(violation5("medium", "status.residual.invalid-tracking", "tracking must be a string or null"));
   }
   if (detail_doc !== undefined && typeof detail_doc !== "string" && detail_doc !== null) {
-    violations.push(violation4("medium", "status.residual.invalid-detail-doc", "detail_doc must be a string or null"));
+    violations.push(violation5("medium", "status.residual.invalid-detail-doc", "detail_doc must be a string or null"));
   }
-  if (closed_at !== undefined && (typeof closed_at !== "string" || !DATE_RE.test(closed_at))) {
-    violations.push(violation4("medium", "status.residual.invalid-closed-at", "closed_at must be YYYY-MM-DD"));
+  if (closed_at !== undefined && (typeof closed_at !== "string" || !DATE_RE2.test(closed_at))) {
+    violations.push(violation5("medium", "status.residual.invalid-closed-at", "closed_at must be YYYY-MM-DD"));
   }
   if (lifecycle !== undefined) {
     if (typeof lifecycle !== "string" || !RESIDUAL_LIFECYCLES.includes(lifecycle)) {
-      violations.push(violation4("medium", "status.residual.invalid-lifecycle", `lifecycle must be one of ${RESIDUAL_LIFECYCLES.join(" | ")} — got ${JSON.stringify(lifecycle)}`));
+      violations.push(violation5("medium", "status.residual.invalid-lifecycle", `lifecycle must be one of ${RESIDUAL_LIFECYCLES.join(" | ")} — got ${JSON.stringify(lifecycle)}`));
     } else if (lifecycle !== "open") {
       if (closed_at === undefined) {
-        violations.push(violation4("high", "status.residual.closed-missing-closed-at", `lifecycle "${lifecycle}" requires closed_at (YYYY-MM-DD)`, 'set closed_at (e.g. "2026-08-08")'));
+        violations.push(violation5("high", "status.residual.closed-missing-closed-at", `lifecycle "${lifecycle}" requires closed_at (YYYY-MM-DD)`, 'set closed_at (e.g. "2026-08-08")'));
       }
       if (entry.closure_note === undefined) {
-        violations.push(violation4("medium", "status.residual.closed-missing-closure-note", `lifecycle "${lifecycle}" requires closure_note (what changed; how verified)`, "add closure_note explaining the close"));
+        violations.push(violation5("medium", "status.residual.closed-missing-closure-note", `lifecycle "${lifecycle}" requires closure_note (what changed; how verified)`, "add closure_note explaining the close"));
       }
     }
   }
@@ -1957,25 +2117,25 @@ function isHarnessRelativePath(dir) {
 }
 function validateWorkflowEntry(entry) {
   const violations = [];
-  if (!isPlainObject3(entry)) {
+  if (!isPlainObject4(entry)) {
     return {
       ok: false,
-      violations: [violation4("high", "status.workflow.invalid", "workflow entry must be an object")]
+      violations: [violation5("high", "status.workflow.invalid", "workflow entry must be an object")]
     };
   }
   validateNonEmptyString3(violations, entry.id, "id", "status.workflow.missing-id", "status.workflow.invalid-id");
   if (entry.type === undefined) {
-    violations.push(violation4("high", "status.workflow.missing-type", "missing required field: type"));
+    violations.push(violation5("high", "status.workflow.missing-type", "missing required field: type"));
   } else if (typeof entry.type !== "string" || !WORKFLOW_LIFECYCLE_TYPES.includes(entry.type)) {
-    violations.push(violation4("medium", "status.workflow.invalid-type", `type must be one of ${WORKFLOW_LIFECYCLE_TYPES.join(" | ")} — got ${JSON.stringify(entry.type)}`));
+    violations.push(violation5("medium", "status.workflow.invalid-type", `type must be one of ${WORKFLOW_LIFECYCLE_TYPES.join(" | ")} — got ${JSON.stringify(entry.type)}`));
   }
   validateNonEmptyString3(violations, entry.started_at, "started_at", "status.workflow.missing-started-at", "status.workflow.invalid-started-at");
   if (entry.dir === undefined) {
-    violations.push(violation4("high", "status.workflow.missing-dir", "missing required field: dir"));
+    violations.push(violation5("high", "status.workflow.missing-dir", "missing required field: dir"));
   } else if (typeof entry.dir !== "string" || entry.dir.trim() === "") {
-    violations.push(violation4("medium", "status.workflow.invalid-dir", "dir must be a non-empty string"));
+    violations.push(violation5("medium", "status.workflow.invalid-dir", "dir must be a non-empty string"));
   } else if (!isHarnessRelativePath(entry.dir)) {
-    violations.push(violation4("medium", "status.workflow.invalid-dir", `dir must be a harness-relative path (no absolute paths, no ".." segments) — got ${JSON.stringify(entry.dir)}`));
+    violations.push(violation5("medium", "status.workflow.invalid-dir", `dir must be a harness-relative path (no absolute paths, no ".." segments) — got ${JSON.stringify(entry.dir)}`));
   }
   return { ok: violations.length === 0, violations };
 }
@@ -1985,24 +2145,24 @@ function validateStatusV2(docOrPath, opts = {}) {
   if (typeof docOrPath === "string") {
     try {
       doc = readJson(docOrPath);
-      harnessDir = dirname5(resolve5(docOrPath));
+      harnessDir = dirname4(resolve4(docOrPath));
     } catch (error) {
       return {
         ok: false,
-        violations: [violation4("high", "status.invalid-json", error.message)]
+        violations: [violation5("high", "status.invalid-json", error.message)]
       };
     }
   } else {
     doc = docOrPath;
   }
-  if (!isPlainObject3(doc)) {
-    return { ok: false, violations: [violation4("high", "status.invalid-doc", "status document must be an object")] };
+  if (!isPlainObject4(doc)) {
+    return { ok: false, violations: [violation5("high", "status.invalid-doc", "status document must be an object")] };
   }
   if (doc.version !== 2) {
     return {
       ok: false,
       violations: [
-        violation4("high", "status.migration-required", `status.json schema version 2 required — got ${JSON.stringify(doc.version)} (v1 or unknown version); run \`mstar migrate\` to convert the tree`, "run `mstar migrate`")
+        violation5("high", "status.migration-required", `status.json schema version 2 required — got ${JSON.stringify(doc.version)} (v1 or unknown version); run \`mstar migrate\` to convert the tree`, "run `mstar migrate`")
       ]
     };
   }
@@ -2010,7 +2170,7 @@ function validateStatusV2(docOrPath, opts = {}) {
     return {
       ok: false,
       violations: [
-        violation4("high", "status.migration-required", "v1-shaped status.json (root plans[]) is not a v2 document — run `mstar migrate` to convert the tree", "run `mstar migrate`")
+        violation5("high", "status.migration-required", "v1-shaped status.json (root plans[]) is not a v2 document — run `mstar migrate` to convert the tree", "run `mstar migrate`")
       ]
     };
   }
@@ -2018,27 +2178,27 @@ function validateStatusV2(docOrPath, opts = {}) {
     return {
       ok: false,
       violations: [
-        violation4("high", "status.migration-required", "v1-shaped status.json (root residual_findings) is not a v2 document — run `mstar migrate` to convert the tree", "run `mstar migrate`")
+        violation5("high", "status.migration-required", "v1-shaped status.json (root residual_findings) is not a v2 document — run `mstar migrate` to convert the tree", "run `mstar migrate`")
       ]
     };
   }
   const violations = [];
   if (doc.updated_at === undefined) {
-    violations.push(violation4("high", "status.missing-updated-at", "missing required field: updated_at"));
-  } else if (typeof doc.updated_at !== "string" || !DATE_RE.test(doc.updated_at)) {
-    violations.push(violation4("medium", "status.invalid-updated-at", "updated_at must be YYYY-MM-DD"));
+    violations.push(violation5("high", "status.missing-updated-at", "missing required field: updated_at"));
+  } else if (typeof doc.updated_at !== "string" || !DATE_RE2.test(doc.updated_at)) {
+    violations.push(violation5("medium", "status.invalid-updated-at", "updated_at must be YYYY-MM-DD"));
   }
   if (doc.workflows === undefined) {
-    violations.push(violation4("high", "status.missing-workflows", "missing required field: workflows"));
+    violations.push(violation5("high", "status.missing-workflows", "missing required field: workflows"));
   } else if (!Array.isArray(doc.workflows)) {
-    violations.push(violation4("high", "status.invalid-workflows", "workflows must be an array"));
+    violations.push(violation5("high", "status.invalid-workflows", "workflows must be an array"));
   } else {
     const seen = new Set;
     for (const entry of doc.workflows) {
       violations.push(...validateWorkflowEntry(entry).violations);
-      if (isPlainObject3(entry) && typeof entry.id === "string") {
+      if (isPlainObject4(entry) && typeof entry.id === "string") {
         if (seen.has(entry.id)) {
-          violations.push(violation4("medium", "status.workflow.duplicate-id", `duplicate workflow id in workflows[]: ${JSON.stringify(entry.id)}`));
+          violations.push(violation5("medium", "status.workflow.duplicate-id", `duplicate workflow id in workflows[]: ${JSON.stringify(entry.id)}`));
         }
         seen.add(entry.id);
       }
@@ -2047,40 +2207,40 @@ function validateStatusV2(docOrPath, opts = {}) {
   if (harnessDir !== undefined && Array.isArray(doc.workflows)) {
     let realHarnessDir = null;
     try {
-      realHarnessDir = realpathSync2(harnessDir);
+      realHarnessDir = realpathSync(harnessDir);
     } catch {}
     for (const entry of doc.workflows) {
-      if (!isPlainObject3(entry) || typeof entry.dir !== "string")
+      if (!isPlainObject4(entry) || typeof entry.dir !== "string")
         continue;
       const relSnapshot = join6(entry.dir, WORKFLOW_SNAPSHOT_FILE);
       const snapshotPath = join6(harnessDir, relSnapshot);
       const label = typeof entry.id === "string" ? entry.id : relSnapshot;
       let physical;
       try {
-        physical = realpathSync2(snapshotPath);
+        physical = realpathSync(snapshotPath);
       } catch {
-        violations.push(violation4("high", "status.workflow.snapshot-missing", `workflows[] lists ${JSON.stringify(label)} but its snapshot does not exist at ${JSON.stringify(relSnapshot)} — the root holds active lifecycles only; unregister the id when its snapshot is removed`));
+        violations.push(violation5("high", "status.workflow.snapshot-missing", `workflows[] lists ${JSON.stringify(label)} but its snapshot does not exist at ${JSON.stringify(relSnapshot)} — the root holds active lifecycles only; unregister the id when its snapshot is removed`));
         continue;
       }
       if (realHarnessDir !== null && physical !== realHarnessDir && !physical.startsWith(`${realHarnessDir}${sep}`)) {
-        violations.push(violation4("high", "status.workflow.snapshot-outside-harness", `workflows[] lists ${JSON.stringify(label)} but its snapshot resolves outside the harness dir (${JSON.stringify(physical)}) — symlinked snapshot paths are rejected; the snapshot must physically live under ${JSON.stringify(harnessDir)}`));
+        violations.push(violation5("high", "status.workflow.snapshot-outside-harness", `workflows[] lists ${JSON.stringify(label)} but its snapshot resolves outside the harness dir (${JSON.stringify(physical)}) — symlinked snapshot paths are rejected; the snapshot must physically live under ${JSON.stringify(harnessDir)}`));
         continue;
       }
       let snapshot;
       try {
         snapshot = readJson(snapshotPath);
       } catch (error) {
-        violations.push(violation4("high", "status.workflow.snapshot-invalid", `snapshot at ${JSON.stringify(relSnapshot)} is not valid JSON: ${error.message}`));
+        violations.push(violation5("high", "status.workflow.snapshot-invalid", `snapshot at ${JSON.stringify(relSnapshot)} is not valid JSON: ${error.message}`));
         continue;
       }
       if (typeof snapshot.status === "string" && WORKFLOW_TERMINAL_STATUSES.includes(snapshot.status)) {
-        violations.push(violation4("high", "status.workflow.terminal-listed", `workflows[] lists ${JSON.stringify(label)} whose snapshot status is terminal (${snapshot.status}) — removal-at-terminal: terminal writers unregister AFTER the snapshot write`));
+        violations.push(violation5("high", "status.workflow.terminal-listed", `workflows[] lists ${JSON.stringify(label)} whose snapshot status is terminal (${snapshot.status}) — removal-at-terminal: terminal writers unregister AFTER the snapshot write`));
       }
       if (typeof entry.type === "string" && typeof snapshot.type === "string" && entry.type !== snapshot.type) {
-        violations.push(violation4("medium", "status.workflow.mismatched-type", `workflows[] entry ${JSON.stringify(label)} type ${JSON.stringify(entry.type)} does not match its snapshot type ${JSON.stringify(snapshot.type)} — the root entry mirrors the snapshot; align them`));
+        violations.push(violation5("medium", "status.workflow.mismatched-type", `workflows[] entry ${JSON.stringify(label)} type ${JSON.stringify(entry.type)} does not match its snapshot type ${JSON.stringify(snapshot.type)} — the root entry mirrors the snapshot; align them`));
       }
       if (typeof entry.started_at === "string" && typeof snapshot.started_at === "string" && entry.started_at !== snapshot.started_at) {
-        violations.push(violation4("medium", "status.workflow.mismatched-started-at", `workflows[] entry ${JSON.stringify(label)} started_at ${JSON.stringify(entry.started_at)} does not match its snapshot started_at ${JSON.stringify(snapshot.started_at)} — workflow ${JSON.stringify(label)} collided with another writer (e.g. a concurrent/re-run \`audit promote\` with the same workflow id rewrote the snapshot); the root entry mirrors the snapshot — align them or remove the colliding workflow`));
+        violations.push(violation5("medium", "status.workflow.mismatched-started-at", `workflows[] entry ${JSON.stringify(label)} started_at ${JSON.stringify(entry.started_at)} does not match its snapshot started_at ${JSON.stringify(snapshot.started_at)} — workflow ${JSON.stringify(label)} collided with another writer (e.g. a concurrent/re-run \`audit promote\` with the same workflow id rewrote the snapshot); the root entry mirrors the snapshot — align them or remove the colliding workflow`));
       }
     }
   }
@@ -2120,8 +2280,8 @@ function resolveCompassEnforcement(harnessDir) {
   return { hard: false, source: "none" };
 }
 function resolveMstarcEnforcement(harnessDir) {
-  const dir = resolve5(harnessDir);
-  const rc = loadMstarc(dir, dirname5(dir));
+  const dir = resolve4(harnessDir);
+  const rc = loadMstarc(dir, dirname4(dir));
   const value = rc?.config.enforcement;
   if (value === "hard")
     return { hard: true, source: "mstarc" };
@@ -2135,30 +2295,243 @@ function resolveRepoEnforcement(harnessDir) {
     return rc;
   return resolveCompassEnforcement(harnessDir);
 }
-var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
-function probeTimeoutMs() {
-  const raw = process.env.MSTAR_GIT_PROBE_TIMEOUT_MS;
-  if (raw === undefined || raw.trim() === "")
-    return DEFAULT_PROBE_TIMEOUT_MS;
-  const parsed = Number(raw);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PROBE_TIMEOUT_MS;
+var PROJECT_ROADMAP_FILE = "roadmap.md";
+var PROJECT_REGISTER_FILE = "residuals.json";
+var _DEFAULT_PROJECT = "_default";
+var DATE_RE3 = /^\d{4}-\d{2}-\d{2}$/;
+function isPlainObject5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function violation5(severity, code, message, fix) {
+function violation6(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
-function gate(violations) {
-  return { ok: violations.length === 0, violations };
+function validateNonEmptyString4(violations, value, field, missingCode, invalidCode) {
+  if (value === undefined) {
+    violations.push(violation6("high", missingCode, `missing required field: ${field}`));
+  } else if (typeof value !== "string" || value.trim() === "") {
+    violations.push(violation6("medium", invalidCode, `${field} must be a non-empty string`));
+  }
 }
-function probeBranch(worktreePath, opts) {
-  const precomputed = opts.branchOf?.(worktreePath);
-  if (precomputed !== undefined)
-    return { branch: precomputed };
-  const timeout = opts.timeoutMs ?? probeTimeoutMs();
-  try {
-    const stdout = execFileSync2(opts.gitPath ?? "git", ["-C", worktreePath, "branch", "--show-current"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout
+function validateProjectRegister(doc) {
+  const violations = [];
+  if (!isPlainObject5(doc)) {
+    return {
+      ok: false,
+      violations: [violation6("high", "project.register.invalid", "project register must be an object")]
+    };
+  }
+  if (doc.entries === undefined) {
+    violations.push(violation6("high", "project.register.missing-entries", "missing required field: entries"));
+  } else if (!isPlainObject5(doc.entries)) {
+    violations.push(violation6("high", "project.register.invalid-entries", "entries must be an object keyed by plan id"));
+  } else {
+    for (const [key, entries] of Object.entries(doc.entries)) {
+      if (key.trim() === "") {
+        violations.push(violation6("medium", "project.register.invalid-key", "entries keys must be non-empty plan ids"));
+      }
+      if (!Array.isArray(entries)) {
+        violations.push(violation6("high", "project.register.invalid-entry-list", `entries[${JSON.stringify(key)}] must be an array of residual entries (one entry per residual; v1 multi-finding semantics)`));
+        continue;
+      }
+      for (const entry of entries) {
+        violations.push(...validateResidual(entry).violations);
+        if (!isPlainObject5(entry))
+          continue;
+        validateNonEmptyString4(violations, entry.source_plan, "source_plan", "project.register.missing-source-plan", "project.register.invalid-source-plan");
+        if (entry.registered_at === undefined) {
+          violations.push(violation6("high", "project.register.missing-registered-at", "missing required field: registered_at"));
+        } else if (typeof entry.registered_at !== "string" || !DATE_RE3.test(entry.registered_at)) {
+          violations.push(violation6("medium", "project.register.invalid-registered-at", "registered_at must be YYYY-MM-DD"));
+        }
+        if (entry.lifecycle_id !== undefined && (typeof entry.lifecycle_id !== "string" || entry.lifecycle_id.trim() === "")) {
+          violations.push(violation6("medium", "project.register.invalid-lifecycle-id", "lifecycle_id must be a non-empty string"));
+        }
+        if (typeof entry.source_plan === "string" && entry.source_plan.trim() !== "" && entry.source_plan !== key) {
+          violations.push(violation6("medium", "project.register.mismatched-source-plan", `source_plan ${JSON.stringify(entry.source_plan)} does not match the entries key ${JSON.stringify(key)} — entries are keyed by plan id`));
+        }
+      }
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function findingsCleanupGate(register, planId, opts) {
+  const mode = opts?.mode ?? "allow-residual";
+  const violations = [];
+  const entries = isPlainObject5(register.entries) ? register.entries[planId] : undefined;
+  if (entries === undefined) {
+    return { ok: true, violations };
+  }
+  if (!Array.isArray(entries)) {
+    violations.push(violation6("high", "project.register.invalid-entry-list", `entries[${JSON.stringify(planId)}] must be an array of residual entries (one entry per residual; v1 multi-finding semantics)`));
+    return { ok: false, violations };
+  }
+  if (entries.length === 0) {
+    return { ok: true, violations };
+  }
+  for (const entry of entries) {
+    if (!isOpenResidual(entry))
+      continue;
+    const id = typeof entry.id === "string" ? entry.id : "<unnamed>";
+    const label = `R#${id}`;
+    if (mode === "zero-residual") {
+      if (entry.severity === "nit") {
+        violations.push(violation6("medium", "findings.zero-residual-nit", `${label}: style-only nits must be fixed in-session or dropped — never left open under zero-residual`));
+      } else if (entry.decision === "risk-accepted" || entry.lifecycle === "waived") {
+        violations.push(violation6("medium", "findings.zero-residual-risk-accepted", `${label}: waived/risk-accepted findings must be closed/archived, not left open under zero-residual`));
+      } else if (entry.decision === "defer") {
+        if (typeof entry.target !== "string" || entry.target.trim() === "") {
+          violations.push(violation6("medium", "findings.zero-residual-defer-no-target", `${label}: blocker-defer requires a target (next iteration/milestone) under zero-residual`));
+        }
+      } else {
+        violations.push(violation6("medium", "findings.zero-residual-open-fixable", `${label}: fixable finding must not remain open under zero-residual — fix now or convert to a blocker-defer`));
+      }
+    } else if (normalizeSeverity(entry.severity) === "critical") {
+      violations.push(violation6("high", "findings.allow-residual-critical", `${label}: unresolved critical blocks Approve with residuals`));
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function resolveHarnessDir(startDir = process.cwd(), opts = {}) {
+  const start = resolve6(startDir);
+  const explicit = opts.harnessDir ?? process.env.MSTAR_HARNESS_DIR;
+  if (explicit)
+    return resolve6(start, explicit);
+  const boundary = resolve6(start, opts.workspaceRoot ?? defaultWorkspaceRoot(start));
+  const rc = loadMstarc(start, boundary);
+  if (rc !== null && rc.config.harnessDir)
+    return resolve6(rc.dir, rc.config.harnessDir);
+  let dir = start;
+  for (;; ) {
+    if (!isAtOrBelow2(dir, boundary))
+      return null;
+    for (const candidate of [join8(dir, ".mstar"), join8(dir, ".agents"), join8(dir, ".plans"), join8(dir, "plans")]) {
+      if (isDirectory(candidate))
+        return candidate;
+    }
+    if (dir === boundary)
+      return null;
+    const parent = dirname5(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function defaultWorkspaceRoot(startDir) {
+  try {
+    const cdup = execFileSync("git", ["rev-parse", "--show-cdup"], {
+      cwd: startDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!cdup)
+      return startDir;
+    let boundary = startDir;
+    for (const segment of cdup.split(/[\\/]/)) {
+      if (segment && segment !== ".")
+        boundary = dirname5(boundary);
+    }
+    return resolve6(boundary);
+  } catch {}
+  return startDir;
+}
+function isAtOrBelow2(dir, root) {
+  const rel = relative2(root, dir);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+}
+function mstarcDirOverride(harnessDir, key) {
+  const dir = resolve6(harnessDir);
+  const rc = loadMstarc(dir, dirname5(dir));
+  const declared = rc?.config[key];
+  return declared ? resolve6(rc.dir, declared) : null;
+}
+function assertSafePathComponent(value, what) {
+  if (value === "" || value === "." || value === ".." || !/^[A-Za-z0-9._-]+$/.test(value)) {
+    throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
+  }
+}
+function resolveSddDir(harnessDir, planId) {
+  assertSafePathComponent(planId, "planId");
+  const base = resolve6(harnessDir);
+  const declared = mstarcDirOverride(base, "sddDir");
+  const sddBase = declared !== null ? declared : join8(base, "sdd");
+  return join8(sddBase, planId);
+}
+function resolveIterationDir(harnessDir) {
+  const declared = mstarcDirOverride(harnessDir, "iterationDir");
+  if (declared !== null)
+    return declared;
+  return join8(resolve6(harnessDir), "iterations");
+}
+function resolveHarnessSubdir(startDir, opts, key, fallback) {
+  const harness = resolveHarnessDir(startDir, opts);
+  if (harness === null) {
+    throw new Error(`harness dir not found from ${resolve6(startDir)} — cannot resolve the ${fallback} dir (run \`mstar harness scaffold\`, pass opts.harnessDir, or set MSTAR_HARNESS_DIR)`);
+  }
+  const declared = mstarcDirOverride(harness, key);
+  return declared !== null ? declared : join8(resolve6(harness), fallback);
+}
+function resolveWorkflowDir(startDir = process.cwd(), opts = {}) {
+  return resolveHarnessSubdir(startDir, opts, "workflowDir", "workflows");
+}
+function resolveProjectDir(startDir = process.cwd(), opts = {}) {
+  return resolveHarnessSubdir(startDir, opts, "projectDir", "projects");
+}
+var GITIGNORE_SNIPPET = `# Morning Star harness (.mstar/)
+# Principle: process stays local; results are shared with the team.
+# Default-ignore everything under .mstar/, then re-include the tracked results.
+.mstar/**
+!.mstar/AGENTS.md
+!.mstar/knowledge/
+!.mstar/knowledge/**
+!.mstar/specs/
+!.mstar/specs/**
+# .mstarc — repo-local harness config (may declare [config] harness_dir=<name>)
+.mstarc
+`;
+var GITIGNORE_SNIPPET_AGENTS = `# Morning Star harness (.agents/) — legacy
+# Default-ignore everything under .agents/, then re-include the tracked results.
+.agents/**
+!.agents/AGENTS.md
+!.agents/knowledge/
+!.agents/knowledge/**
+!.agents/specs/
+!.agents/specs/**
+`;
+var GITIGNORE_PROCESS_ENTRIES = GITIGNORE_SNIPPET.split(`
+`).filter((line) => line.startsWith(".mstar/") || line.startsWith("!.mstar/")).map((line) => line.trim());
+var GITIGNORE_PROCESS_ENTRIES_AGENTS = GITIGNORE_SNIPPET_AGENTS.split(`
+`).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
+function isDirectory(dir) {
+  try {
+    return statSync3(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
+function probeTimeoutMs() {
+  const raw = process.env.MSTAR_GIT_PROBE_TIMEOUT_MS;
+  if (raw === undefined || raw.trim() === "")
+    return DEFAULT_PROBE_TIMEOUT_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PROBE_TIMEOUT_MS;
+}
+function violation7(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function gate(violations) {
+  return { ok: violations.length === 0, violations };
+}
+function probeBranch(worktreePath, opts) {
+  const precomputed = opts.branchOf?.(worktreePath);
+  if (precomputed !== undefined)
+    return { branch: precomputed };
+  const timeout = opts.timeoutMs ?? probeTimeoutMs();
+  try {
+    const stdout = execFileSync2(opts.gitPath ?? "git", ["-C", worktreePath, "branch", "--show-current"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout
     });
     const branch = stdout.trim();
     if (branch === "")
@@ -2177,25 +2550,25 @@ function l1PreDispatchCheck(input, opts = {}) {
   const violations = [];
   const { controlWorktreePath, leaseWorktreePath, leaseWorkingBranch, planId } = input;
   if (controlWorktreePath.trim() === "") {
-    violations.push(violation5("high", "worktree.l1.control-missing", "metadata.control_worktree_path is not recorded — the L1 control worktree (integration-branch checkout) must be recorded in status.json before writable dispatch", "record the control worktree path in status.json metadata.control_worktree_path"));
+    violations.push(violation7("high", "worktree.l1.control-missing", "metadata.control_worktree_path is not recorded — the L1 control worktree (integration-branch checkout) must be recorded in status.json before writable dispatch", "record the control worktree path in status.json metadata.control_worktree_path"));
   }
   if (leaseWorktreePath.trim() === "") {
-    violations.push(violation5("high", "worktree.l1.lease-missing", `execution_lease.worktree_path is empty for plan "${planId}" — no verified execution_lease to dispatch against`, "claim the execution_lease with an absolute feature worktree path before dispatch"));
+    violations.push(violation7("high", "worktree.l1.lease-missing", `execution_lease.worktree_path is empty for plan "${planId}" — no verified execution_lease to dispatch against`, "claim the execution_lease with an absolute feature worktree path before dispatch"));
   }
   if (leaseWorkingBranch.trim() === "") {
-    violations.push(violation5("high", "worktree.l1.lease-branch-missing", `execution_lease.working_branch is empty for plan "${planId}"`, "record the lease working_branch before dispatch"));
+    violations.push(violation7("high", "worktree.l1.lease-branch-missing", `execution_lease.working_branch is empty for plan "${planId}"`, "record the lease working_branch before dispatch"));
   }
-  if (controlWorktreePath !== "" && leaseWorktreePath !== "" && resolve6(controlWorktreePath) === resolve6(leaseWorktreePath)) {
-    violations.push(violation5("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+  if (controlWorktreePath !== "" && leaseWorktreePath !== "" && resolve7(controlWorktreePath) === resolve7(leaseWorktreePath)) {
+    violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
   }
-  if (leaseWorktreePath !== "" && !existsSync4(leaseWorktreePath)) {
-    violations.push(violation5("high", "worktree.l1.feature-missing", `feature worktree directory "${leaseWorktreePath}" does not exist for plan "${planId}"`, `create it before dispatch: git worktree add ${leaseWorktreePath} <working-branch>`));
+  if (leaseWorktreePath !== "" && !existsSync6(leaseWorktreePath)) {
+    violations.push(violation7("high", "worktree.l1.feature-missing", `feature worktree directory "${leaseWorktreePath}" does not exist for plan "${planId}"`, `create it before dispatch: git worktree add ${leaseWorktreePath} <working-branch>`));
   } else if (leaseWorktreePath !== "" && leaseWorkingBranch !== "") {
     const probe = probeBranch(leaseWorktreePath, opts);
     if ("error" in probe) {
-      violations.push(violation5("high", "worktree.l1.branch-probe-failed", `cannot probe branch at "${leaseWorktreePath}" for plan "${planId}": ${probe.error}`, "verify the path is a git worktree checkout on the lease working branch (not detached)"));
+      violations.push(violation7("high", "worktree.l1.branch-probe-failed", `cannot probe branch at "${leaseWorktreePath}" for plan "${planId}": ${probe.error}`, "verify the path is a git worktree checkout on the lease working branch (not detached)"));
     } else if (probe.branch !== leaseWorkingBranch) {
-      violations.push(violation5("high", "worktree.l1.branch-mismatch", `feature worktree "${leaseWorktreePath}" is on branch "${probe.branch}", expected execution_lease.working_branch "${leaseWorkingBranch}" (plan "${planId}")`, `checkout ${leaseWorkingBranch} in the feature worktree`));
+      violations.push(violation7("high", "worktree.l1.branch-mismatch", `feature worktree "${leaseWorktreePath}" is on branch "${probe.branch}", expected execution_lease.working_branch "${leaseWorkingBranch}" (plan "${planId}")`, `checkout ${leaseWorkingBranch} in the feature worktree`));
     }
   }
   return gate(violations);
@@ -2205,588 +2578,215 @@ function l2PreDispatchCheck(input, opts = {}) {
   const tracks = input.tracks ?? [];
   const seenPaths = new Set;
   if (tracks.length < 1) {
-    violations.push(violation5("high", "worktree.l2.no-tracks", "no parallel writable tracks — the L2 pre-dispatch checklist requires at least one track with an absolute worktreePath and Working branch", "pass each track's absolute Worktree path and PM-approved Working branch"));
+    violations.push(violation7("high", "worktree.l2.no-tracks", "no parallel writable tracks — the L2 pre-dispatch checklist requires at least one track with an absolute worktreePath and Working branch", "pass each track's absolute Worktree path and PM-approved Working branch"));
   }
   tracks.forEach((track, index) => {
     if (track.worktreePath.trim() === "" || track.workingBranch.trim() === "") {
-      violations.push(violation5("high", "worktree.l2.track-invalid", `track ${index + 1} is missing worktreePath and/or workingBranch`, "fill both fields for every track"));
+      violations.push(violation7("high", "worktree.l2.track-invalid", `track ${index + 1} is missing worktreePath and/or workingBranch`, "fill both fields for every track"));
       return;
     }
     if (!isAbsolute4(track.worktreePath)) {
-      violations.push(violation5("high", "worktree.l2.track-path-relative", `track ${index + 1} worktreePath "${track.worktreePath}" is not an absolute path — L2 tracks MUST use absolute worktree checkout paths (consistent with the lease validator's absolute worktree_path enforcement)`, `use an absolute path for track ${index + 1} (e.g. /Users/<you>/worktrees/<branch>)`));
+      violations.push(violation7("high", "worktree.l2.track-path-relative", `track ${index + 1} worktreePath "${track.worktreePath}" is not an absolute path — L2 tracks MUST use absolute worktree checkout paths (consistent with the lease validator's absolute worktree_path enforcement)`, `use an absolute path for track ${index + 1} (e.g. /Users/<you>/worktrees/<branch>)`));
       return;
     }
-    const normalized = resolve6(track.worktreePath);
+    const normalized = resolve7(track.worktreePath);
     if (seenPaths.has(normalized)) {
-      violations.push(violation5("high", "worktree.l2.track-path-collision", `duplicate worktreePath "${track.worktreePath}" across parallel tracks — L2 parallel-writable isolation requires a distinct absolute Worktree path per track (N parallel invokes ≠ isolation)`, "give every parallel track its own git worktree checkout"));
+      violations.push(violation7("high", "worktree.l2.track-path-collision", `duplicate worktreePath "${track.worktreePath}" across parallel tracks — L2 parallel-writable isolation requires a distinct absolute Worktree path per track (N parallel invokes ≠ isolation)`, "give every parallel track its own git worktree checkout"));
       return;
     }
     seenPaths.add(normalized);
-    if (!existsSync4(track.worktreePath)) {
-      violations.push(violation5("high", "worktree.l2.track-missing", `track worktree directory "${track.worktreePath}" does not exist`, `create it before dispatch: git worktree add ${track.worktreePath} ${track.workingBranch}`));
+    if (!existsSync6(track.worktreePath)) {
+      violations.push(violation7("high", "worktree.l2.track-missing", `track worktree directory "${track.worktreePath}" does not exist`, `create it before dispatch: git worktree add ${track.worktreePath} ${track.workingBranch}`));
       return;
     }
-    const probe = probeBranch(track.worktreePath, opts);
-    if ("error" in probe) {
-      violations.push(violation5("high", "worktree.l2.branch-probe-failed", `cannot probe branch at "${track.worktreePath}": ${probe.error}`, "verify the path is a git worktree checkout on its Working branch (not detached)"));
-    } else if (probe.branch !== track.workingBranch) {
-      violations.push(violation5("high", "worktree.l2.branch-mismatch", `track worktree "${track.worktreePath}" is on branch "${probe.branch}", expected Working branch "${track.workingBranch}"`, `checkout ${track.workingBranch} in that worktree`));
-    }
-  });
-  return gate(violations);
-}
-class SddScriptError extends Error {
-  exitCode;
-  constructor(message, exitCode) {
-    super(message);
-    this.name = "SddScriptError";
-    this.exitCode = exitCode;
-  }
-}
-function isDirectory2(dir) {
-  try {
-    return statSync4(dir).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function isFile2(file) {
-  try {
-    return statSync4(file).isFile();
-  } catch {
-    return false;
-  }
-}
-var GIT_CAPTURE_MAX_BYTES = 64 * 1024 * 1024;
-function gitOut(cwd, args) {
-  try {
-    return execFileSync3("git", args, {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      maxBuffer: GIT_CAPTURE_MAX_BYTES
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function probeHarnessWithStatus(root) {
-  if (isFile2(join7(root, ".mstar", "status.json")))
-    return join7(root, ".mstar");
-  if (isFile2(join7(root, ".agents", "status.json")))
-    return join7(root, ".agents");
-  if (hasWorkflowSnapshot(join7(root, ".mstar")))
-    return join7(root, ".mstar");
-  if (hasWorkflowSnapshot(join7(root, ".agents")))
-    return join7(root, ".agents");
-  return null;
-}
-function hasWorkflowSnapshot(harnessDir) {
-  let workflowsDir;
-  try {
-    workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
-  } catch {
-    workflowsDir = join7(harnessDir, "workflows");
-  }
-  if (!isDirectory2(workflowsDir))
-    return false;
-  try {
-    for (const entry of readdirSync3(workflowsDir, { withFileTypes: true })) {
-      if (entry.isDirectory() && isFile2(join7(workflowsDir, entry.name, "snapshot.json")))
-        return true;
-    }
-  } catch {
-    return false;
-  }
-  return false;
-}
-function isLinkedWorktree(root) {
-  const gitDirRaw = gitOut(root, ["rev-parse", "--git-dir"]);
-  const commonRaw = gitOut(root, ["rev-parse", "--git-common-dir"]);
-  if (gitDirRaw === null || commonRaw === null)
-    return false;
-  const gitDir = isAbsolute5(gitDirRaw) ? gitDirRaw : join7(root, gitDirRaw);
-  const common = isAbsolute5(commonRaw) ? commonRaw : join7(root, commonRaw);
-  if (gitDir.includes("/.git/worktrees/") || gitDir.includes("/worktrees/"))
-    return true;
-  try {
-    const gdParent = realpathSync3(dirname6(gitDir));
-    const cmAbs = realpathSync3(common);
-    return join7(gdParent, basename3(gitDir)) !== cmAbs && gitDir !== cmAbs;
-  } catch {
-    return false;
-  }
-}
-function sddWorkspace(planId, opts = {}) {
-  if (!planId) {
-    throw new SddScriptError(`usage: mstar sdd workspace PLAN_ID [CONTROL_ROOT]
-` + "  Set MSTAR_CONTROL_ROOT=<control_worktree_path> when running from a feature worktree.", 2);
-  }
-  const cwd = opts.cwd ?? process.cwd();
-  const controlRoot = opts.controlRoot ?? (process.env.MSTAR_CONTROL_ROOT || undefined);
-  let root;
-  if (controlRoot) {
-    if (!isDirectory2(controlRoot)) {
-      throw new SddScriptError(`mstar sdd workspace: CONTROL_ROOT / MSTAR_CONTROL_ROOT is not a directory: ${controlRoot}`, 1);
-    }
-    root = realpathSync3(controlRoot);
-  } else {
-    const topLevel = gitOut(cwd, ["rev-parse", "--show-toplevel"]);
-    root = realpathSync3(topLevel ?? cwd);
-  }
-  if (!controlRoot && isLinkedWorktree(root)) {
-    throw new SddScriptError(`mstar sdd workspace: linked worktree at ${root} has no {HARNESS_DIR}/status.json (default gitignore).
-` + `  Refusing to create a second SDD tree under the feature checkout.
-` + `  Re-run with MSTAR_CONTROL_ROOT=<control_worktree_path> or: mstar sdd workspace ${planId} <control_worktree_path>
-` + `  See mstar-branch-worktree «Harness path SSOT under default gitignore».`, 1);
-  }
-  const harnessOverride = opts.harnessDir ?? (process.env.MSTAR_HARNESS_DIR || undefined);
-  let harnessDir;
-  if (harnessOverride) {
-    harnessDir = resolve7(root, harnessOverride);
-  } else {
-    const rc = findMstarc(root, root);
-    const rcHarnessDir = rc !== null ? parseMstarc(readFileSync5(rc, "utf8")).harnessDir : undefined;
-    if (rcHarnessDir) {
-      harnessDir = resolve7(rc !== null ? dirname6(rc) : root, rcHarnessDir);
-    } else {
-      const probed = probeHarnessWithStatus(root);
-      if (probed) {
-        harnessDir = probed;
-      } else if (isDirectory2(join7(root, ".mstar"))) {
-        harnessDir = join7(root, ".mstar");
-      } else if (isDirectory2(join7(root, ".agents"))) {
-        harnessDir = join7(root, ".agents");
-      } else {
-        harnessDir = join7(root, ".mstar");
-      }
-    }
-  }
-  const sddDir = resolveSddDir(harnessDir, planId);
-  mkdirSync5(sddDir, { recursive: true });
-  writeFileSync3(join7(sddDir, ".gitignore"), `*
-`);
-  return realpathSync3(sddDir);
-}
-function taskBrief(planFile, taskN, outFile, opts = {}) {
-  if (!planFile || !Number.isInteger(taskN) || taskN < 1) {
-    throw new SddScriptError("usage: mstar sdd task-brief PLAN_FILE TASK_NUMBER [OUTFILE]", 2);
-  }
-  let content;
-  try {
-    content = readFileSync5(planFile, "utf8");
-  } catch {
-    throw new SddScriptError(`no such plan file: ${planFile}`, 2);
-  }
-  let out;
-  if (outFile) {
-    out = outFile;
-  } else {
-    const sddDir = opts.sddDir ?? process.env.SDD_DIR;
-    if (!sddDir) {
-      throw new SddScriptError("mstar sdd task-brief: set SDD_DIR or pass OUTFILE (run mstar sdd workspace PLAN_ID first)", 2);
-    }
-    mkdirSync5(sddDir, { recursive: true });
-    out = join7(sddDir, `task-${taskN}-brief.md`);
-  }
-  const records = content.endsWith(`
-`) ? content.split(`
-`).slice(0, -1) : content.split(`
-`);
-  const headingRe = /^#+[ \t]+Task[ \t]+[0-9]+/;
-  const targetRe = new RegExp(`^#+[ 	]+Task[ 	]+${taskN}([^0-9]|$)`);
-  let infence = false;
-  let intask = false;
-  const printed = [];
-  for (const line of records) {
-    if (/^```/.test(line))
-      infence = !infence;
-    if (!infence && headingRe.test(line))
-      intask = targetRe.test(line);
-    if (intask)
-      printed.push(line);
-  }
-  const output = printed.length > 0 ? `${printed.join(`
-`)}
-` : "";
-  writeFileSync3(out, output);
-  if (printed.length === 0) {
-    throw new SddScriptError(`task ${taskN} not found in ${planFile} (no heading matching Task ${taskN})`, 3);
-  }
-  return out;
-}
-var COMPASS_STATUSES = ["active", "locked", "completed"];
-var DATE_RE2 = /^\d{4}-\d{2}-\d{2}$/;
-var PLAN_STATUS_DONE = "Done";
-function typeName(value) {
-  if (value === null)
-    return "null";
-  if (Array.isArray(value))
-    return "array";
-  return typeof value;
-}
-function validateCompassShape(doc) {
-  const issues = [];
-  const expectString = (key, opts = {}) => {
-    const value = doc[key];
-    if (typeof value !== "string") {
-      issues.push({ path: [key], message: `expected string, received ${typeName(value)}` });
-      return;
-    }
-    if (opts.min !== undefined && value.length < opts.min) {
-      issues.push({ path: [key], message: `string must contain at least ${opts.min} character(s)` });
-      return;
-    }
-    if (opts.regex !== undefined && !opts.regex.test(value)) {
-      issues.push({ path: [key], message: `string must match ${opts.regex}` });
-    }
-  };
-  expectString("iteration_id", { min: 1 });
-  expectString("start_date", { regex: DATE_RE2 });
-  const status = doc.status;
-  if (typeof status !== "string" || !COMPASS_STATUSES.includes(status)) {
-    issues.push({
-      path: ["status"],
-      message: `expected one of ${COMPASS_STATUSES.map((s) => `'${s}'`).join(" | ")}, received ${typeName(status)}`
-    });
-  }
-  expectString("iteration_base_branch", { min: 1 });
-  expectString("target_branch", { min: 1 });
-  const plans = doc.plans;
-  if (plans !== undefined) {
-    if (!Array.isArray(plans)) {
-      issues.push({ path: ["plans"], message: `expected array, received ${typeName(plans)}` });
-    } else {
-      plans.forEach((entry, index) => {
-        if (typeof entry !== "string") {
-          issues.push({ path: ["plans", index], message: `expected string, received ${typeName(entry)}` });
-        } else if (entry.length < 1) {
-          issues.push({ path: ["plans", index], message: "string must contain at least 1 character(s)" });
-        }
-      });
-    }
-  }
-  const end_date = doc.end_date;
-  if (end_date !== undefined) {
-    if (typeof end_date !== "string") {
-      issues.push({ path: ["end_date"], message: `expected string, received ${typeName(end_date)}` });
-    } else if (!DATE_RE2.test(end_date)) {
-      issues.push({ path: ["end_date"], message: `string must match ${DATE_RE2}` });
-    }
-  }
-  if (issues.length > 0)
-    return { ok: false, issues };
-  return {
-    ok: true,
-    data: {
-      iteration_id: doc.iteration_id,
-      start_date: doc.start_date,
-      status,
-      iteration_base_branch: doc.iteration_base_branch,
-      target_branch: doc.target_branch,
-      ...plans !== undefined ? { plans } : {},
-      ...end_date !== undefined ? { end_date } : {}
-    }
-  };
-}
-function violation6(severity, code, message, fix) {
-  return { ok: false, severity, code, message, fix };
-}
-function isPlainObject4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function validateCompassFrontmatter(doc) {
-  if (!isPlainObject4(doc)) {
-    return {
-      ok: false,
-      violations: [
-        violation6("medium", "COMPASS_INVALID_FIELD", "Compass frontmatter must be a YAML object with iteration_id / start_date / status / iteration_base_branch / target_branch (template: mstar-iteration §1.3)", "Fix the frontmatter of {ITERATION_DIR}/<iteration-id>/delivery-compass.md")
-      ]
-    };
-  }
-  const parsed = validateCompassShape(doc);
-  if (!parsed.ok) {
-    return {
-      ok: false,
-      violations: parsed.issues.map((issue) => {
-        const field = issue.path.join(".") || "(root)";
-        return violation6("medium", "COMPASS_INVALID_FIELD", `Compass frontmatter field '${field}' is invalid: ${issue.message}`, `Fix '${field}' in {ITERATION_DIR}/<iteration-id>/delivery-compass.md frontmatter (template: mstar-iteration §1.3)`);
-      })
-    };
-  }
-  const violations = [];
-  const { status, end_date } = parsed.data;
-  if (status === "completed" && end_date === undefined) {
-    violations.push(violation6("high", "COMPASS_END_DATE_REQUIRED", "Compass frontmatter status is 'completed' but end_date is missing — end_date is required at iteration-close (mstar-iteration §3.4, template Fields guide)", "Add `end_date: YYYY-MM-DD` to the frontmatter"));
-  }
-  if (status !== "completed" && end_date !== undefined) {
-    violations.push(violation6("medium", "COMPASS_END_DATE_NOT_ALLOWED", `Compass frontmatter sets end_date while status is '${status}' — end_date is only written at iteration-close (mstar-iteration §3.4)`, "Remove end_date until iteration-close"));
-  }
-  return { ok: violations.length === 0, violations };
-}
-function registeredPlanIds(compassDoc) {
-  if (!Array.isArray(compassDoc.plans))
-    return [];
-  return compassDoc.plans.filter((plan) => typeof plan === "string" && plan.length > 0);
-}
-function findPlanRow(snapshotDoc, planId) {
-  if (!Array.isArray(snapshotDoc.plans))
-    return null;
-  for (const row of snapshotDoc.plans) {
-    if (!isPlainObject4(row))
-      continue;
-    const rowId = typeof row.id === "string" ? row.id : typeof row.plan_id === "string" ? row.plan_id : null;
-    if (rowId === planId)
-      return row;
-  }
-  return null;
-}
-function entryPlansAllDone(snapshotDoc, registered) {
-  const violations = [];
-  if (registered.length === 0) {
-    violations.push(violation6("medium", "COMPASS_NO_PLANS", "Compass frontmatter registers no plans — the all-plans-Done transition cannot be verified (mstar-iteration §1.3 / Phase transition gates)", "List the iteration's plan ids in the compass frontmatter `plans`"));
-    return violations;
-  }
-  for (const planId of registered) {
-    const row = findPlanRow(snapshotDoc, planId);
-    if (row === null) {
-      violations.push(violation6("high", "PLAN_NOT_IN_STATUS", `Plan '${planId}' is registered in the compass frontmatter but has no row in the workflow snapshot plans[] (mstar-iteration §3.1 entry item 1)`, "Add the plan row to {HARNESS_DIR}/workflows/<id>/snapshot.json"));
-      continue;
-    }
-    if (row.status !== PLAN_STATUS_DONE) {
-      violations.push(violation6("high", "PLAN_NOT_DONE", `Plan '${planId}' status is ${JSON.stringify(row.status)} in the workflow snapshot — all compass-registered plans must be 'Done' before iteration-close (mstar-iteration §3.1 entry item 1)`));
-    }
-  }
-  return violations;
-}
-function entryFrontmatterComplete(compassDoc) {
-  return validateCompassFrontmatter(compassDoc).violations;
-}
-function exitFrontmatterClosed(compassDoc) {
-  const violations = [];
-  if (compassDoc.status !== "completed") {
-    violations.push(violation6("high", "EXIT_STATUS_NOT_COMPLETED", `Compass frontmatter status must be 'completed' at close exit — current: ${JSON.stringify(compassDoc.status)} (mstar-iteration §3.4 / §3.5 exit item 4)`));
-  }
-  const endDate = compassDoc.end_date;
-  if (typeof endDate !== "string" || !DATE_RE2.test(endDate)) {
-    violations.push(violation6("high", "EXIT_END_DATE_REQUIRED", "Compass frontmatter end_date (YYYY-MM-DD) is required when closing (mstar-iteration §3.4 / §3.5 exit item 4)"));
-  }
-  return violations;
-}
-function exitBranchCheck(opts) {
-  const violations = [];
-  const { currentBranch, specIntegrationBranch } = opts;
-  if (currentBranch === undefined || specIntegrationBranch === undefined) {
-    violations.push(violation6("medium", "EXIT_BRANCH_UNVERIFIABLE", "Cannot verify the current branch is spec_integration_branch — missing currentBranch / specIntegrationBranch probe inputs (mstar-iteration §3.5 exit item 5)"));
-  } else if (currentBranch !== specIntegrationBranch) {
-    violations.push(violation6("high", "EXIT_BRANCH_MISMATCH", `Current branch '${currentBranch}' is not the spec_integration_branch '${specIntegrationBranch}' (mstar-iteration §3.5 exit item 5)`));
-  }
-  return violations;
-}
-function exitPrBaseCheck(compassDoc, opts) {
-  const violations = [];
-  const target = compassDoc.target_branch;
-  const { prBaseBranch } = opts;
-  if (prBaseBranch === undefined) {
-    violations.push(violation6("medium", "EXIT_PR_BASE_UNVERIFIABLE", "Cannot verify the PR base — missing prBaseBranch probe input (mstar-iteration §3.5 exit item 6)"));
-  } else if (typeof target !== "string" || prBaseBranch !== target) {
-    violations.push(violation6("high", "EXIT_PR_BASE_MISMATCH", `PR base '${prBaseBranch}' must equal the compass target_branch '${String(target)}' — not an undocumented branch (mstar-iteration §3.5 exit item 6)`));
-  }
-  return violations;
-}
-function evaluatePhaseGate(snapshotDoc, compassDoc, opts = {}) {
-  const registered = registeredPlanIds(compassDoc);
-  const entryViolations = [
-    ...entryPlansAllDone(snapshotDoc, registered),
-    ...entryFrontmatterComplete(compassDoc)
-  ];
-  const exitViolations = [
-    ...exitFrontmatterClosed(compassDoc),
-    ...exitBranchCheck(opts),
-    ...exitPrBaseCheck(compassDoc, opts)
-  ];
-  const allPlansDone = registered.length > 0 && registered.every((planId) => {
-    const row = findPlanRow(snapshotDoc, planId);
-    return row !== null && row.status === PLAN_STATUS_DONE;
-  });
-  const entry = { ok: entryViolations.length === 0, violations: entryViolations };
-  const exit = { ok: exitViolations.length === 0, violations: exitViolations };
-  let transition;
-  if (!allPlansDone)
-    transition = "phase-2-execute";
-  else if (entry.ok && exit.ok)
-    transition = "phase-4-pr-delivery";
-  else
-    transition = "phase-3-close";
-  const gateBlocking = allPlansDone ? [...entryViolations, ...exitViolations] : [];
-  return {
-    transition,
-    allPlansDone,
-    entry,
-    exit,
-    ok: gateBlocking.length === 0,
-    violations: gateBlocking
-  };
-}
-function parseCompassFrontmatter(filePath) {
-  return parseCompassFrontmatterText(readFileSync6(filePath, "utf8"), filePath);
-}
-function parseCompassFrontmatterText(content, filePath) {
-  const lines = content.split(/\r?\n/);
-  if (lines[0]?.trim() !== "---") {
-    throw new Error(`no YAML frontmatter fence in ${filePath} (expected first line "---")`);
-  }
-  const end = lines.indexOf("---", 1);
-  if (end === -1) {
-    throw new Error(`unterminated YAML frontmatter in ${filePath} (no closing "---")`);
-  }
-  const doc = {};
-  let listKey = null;
-  for (let i = 1;i < end; i += 1) {
-    const line = lines[i] ?? "";
-    if (!line.trim() || line.trim().startsWith("#"))
-      continue;
-    if (listKey !== null && /^\s*-\s+/.test(line)) {
-      const item = line.replace(/^\s*-\s+/, "").trim().replace(/^["']|["']$/g, "");
-      if (!Array.isArray(doc[listKey]))
-        doc[listKey] = [];
-      doc[listKey].push(item);
-      continue;
-    }
-    listKey = null;
-    const kv = line.match(/^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/);
-    if (!kv) {
-      throw new Error(`unsupported frontmatter line in ${filePath}: ${JSON.stringify(line)}`);
-    }
-    const value = kv[2].trim();
-    doc[kv[1]] = value === "" ? null : /^\[.*\]$/.test(value) ? parseFlowArray(value, filePath) : value.replace(/^["']|["']$/g, "");
-    listKey = value === "" ? kv[1] : null;
-  }
-  return doc;
+    const probe = probeBranch(track.worktreePath, opts);
+    if ("error" in probe) {
+      violations.push(violation7("high", "worktree.l2.branch-probe-failed", `cannot probe branch at "${track.worktreePath}": ${probe.error}`, "verify the path is a git worktree checkout on its Working branch (not detached)"));
+    } else if (probe.branch !== track.workingBranch) {
+      violations.push(violation7("high", "worktree.l2.branch-mismatch", `track worktree "${track.worktreePath}" is on branch "${probe.branch}", expected Working branch "${track.workingBranch}"`, `checkout ${track.workingBranch} in that worktree`));
+    }
+  });
+  return gate(violations);
 }
-function parseFlowArray(raw, filePath) {
-  const inner = raw.slice(1, -1);
-  if (/[[\]]/.test(inner)) {
-    throw new Error(`nested flow-style array in ${filePath}: ${JSON.stringify(raw)} — only flat scalar items are supported (e.g. [a, b])`);
+class SddScriptError extends Error {
+  exitCode;
+  constructor(message, exitCode) {
+    super(message);
+    this.name = "SddScriptError";
+    this.exitCode = exitCode;
   }
-  let quote = null;
-  for (const ch of inner) {
-    if (ch === '"' || ch === "'") {
-      if (quote === null)
-        quote = ch;
-      else if (quote === ch)
-        quote = null;
-    } else if (ch === "," && quote !== null) {
-      throw new Error(`ambiguous flow-style array in ${filePath}: ${JSON.stringify(raw)} — quoted item containing comma cannot be split unambiguously (flat scalar items only)`);
-    }
+}
+function isDirectory2(dir) {
+  try {
+    return statSync4(dir).isDirectory();
+  } catch {
+    return false;
   }
-  if (quote !== null) {
-    throw new Error(`unterminated ${quote} quote in flow-style array in ${filePath}: ${JSON.stringify(raw)}`);
+}
+function isFile2(file) {
+  try {
+    return statSync4(file).isFile();
+  } catch {
+    return false;
   }
-  const items = [];
-  for (const part of inner.split(",")) {
-    const item = part.trim().replace(/^["']|["']$/g, "");
-    if (item === "")
-      continue;
-    items.push(item);
+}
+var GIT_CAPTURE_MAX_BYTES = 64 * 1024 * 1024;
+function gitOut(cwd, args) {
+  try {
+    return execFileSync3("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: GIT_CAPTURE_MAX_BYTES
+    }).trim();
+  } catch {
+    return null;
   }
-  return items;
 }
-var PROJECT_ROADMAP_FILE = "roadmap.md";
-var PROJECT_REGISTER_FILE = "residuals.json";
-var _DEFAULT_PROJECT = "_default";
-var DATE_RE3 = /^\d{4}-\d{2}-\d{2}$/;
-function isPlainObject5(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function probeHarnessWithStatus(root) {
+  if (isFile2(join9(root, ".mstar", "status.json")))
+    return join9(root, ".mstar");
+  if (isFile2(join9(root, ".agents", "status.json")))
+    return join9(root, ".agents");
+  if (hasWorkflowSnapshot(join9(root, ".mstar")))
+    return join9(root, ".mstar");
+  if (hasWorkflowSnapshot(join9(root, ".agents")))
+    return join9(root, ".agents");
+  return null;
 }
-function violation7(severity, code, message, fix) {
-  return { ok: false, severity, code, message, fix };
+function hasWorkflowSnapshot(harnessDir) {
+  let workflowsDir;
+  try {
+    workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
+  } catch {
+    workflowsDir = join9(harnessDir, "workflows");
+  }
+  if (!isDirectory2(workflowsDir))
+    return false;
+  try {
+    for (const entry of readdirSync5(workflowsDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && isFile2(join9(workflowsDir, entry.name, "snapshot.json")))
+        return true;
+    }
+  } catch {
+    return false;
+  }
+  return false;
 }
-function validateNonEmptyString4(violations, value, field, missingCode, invalidCode) {
-  if (value === undefined) {
-    violations.push(violation7("high", missingCode, `missing required field: ${field}`));
-  } else if (typeof value !== "string" || value.trim() === "") {
-    violations.push(violation7("medium", invalidCode, `${field} must be a non-empty string`));
+function isLinkedWorktree(root) {
+  const gitDirRaw = gitOut(root, ["rev-parse", "--git-dir"]);
+  const commonRaw = gitOut(root, ["rev-parse", "--git-common-dir"]);
+  if (gitDirRaw === null || commonRaw === null)
+    return false;
+  const gitDir = isAbsolute5(gitDirRaw) ? gitDirRaw : join9(root, gitDirRaw);
+  const common = isAbsolute5(commonRaw) ? commonRaw : join9(root, commonRaw);
+  if (gitDir.includes("/.git/worktrees/") || gitDir.includes("/worktrees/"))
+    return true;
+  try {
+    const gdParent = realpathSync3(dirname6(gitDir));
+    const cmAbs = realpathSync3(common);
+    return join9(gdParent, basename3(gitDir)) !== cmAbs && gitDir !== cmAbs;
+  } catch {
+    return false;
   }
 }
-function validateProjectRegister(doc) {
-  const violations = [];
-  if (!isPlainObject5(doc)) {
-    return {
-      ok: false,
-      violations: [violation7("high", "project.register.invalid", "project register must be an object")]
-    };
+function sddWorkspace(planId, opts = {}) {
+  if (!planId) {
+    throw new SddScriptError(`usage: mstar sdd workspace PLAN_ID [CONTROL_ROOT]
+` + "  Set MSTAR_CONTROL_ROOT=<control_worktree_path> when running from a feature worktree.", 2);
   }
-  if (doc.entries === undefined) {
-    violations.push(violation7("high", "project.register.missing-entries", "missing required field: entries"));
-  } else if (!isPlainObject5(doc.entries)) {
-    violations.push(violation7("high", "project.register.invalid-entries", "entries must be an object keyed by plan id"));
+  const cwd = opts.cwd ?? process.cwd();
+  const controlRoot = opts.controlRoot ?? (process.env.MSTAR_CONTROL_ROOT || undefined);
+  let root;
+  if (controlRoot) {
+    if (!isDirectory2(controlRoot)) {
+      throw new SddScriptError(`mstar sdd workspace: CONTROL_ROOT / MSTAR_CONTROL_ROOT is not a directory: ${controlRoot}`, 1);
+    }
+    root = realpathSync3(controlRoot);
   } else {
-    for (const [key, entries] of Object.entries(doc.entries)) {
-      if (key.trim() === "") {
-        violations.push(violation7("medium", "project.register.invalid-key", "entries keys must be non-empty plan ids"));
-      }
-      if (!Array.isArray(entries)) {
-        violations.push(violation7("high", "project.register.invalid-entry-list", `entries[${JSON.stringify(key)}] must be an array of residual entries (one entry per residual; v1 multi-finding semantics)`));
-        continue;
-      }
-      for (const entry of entries) {
-        violations.push(...validateResidual(entry).violations);
-        if (!isPlainObject5(entry))
-          continue;
-        validateNonEmptyString4(violations, entry.source_plan, "source_plan", "project.register.missing-source-plan", "project.register.invalid-source-plan");
-        if (entry.registered_at === undefined) {
-          violations.push(violation7("high", "project.register.missing-registered-at", "missing required field: registered_at"));
-        } else if (typeof entry.registered_at !== "string" || !DATE_RE3.test(entry.registered_at)) {
-          violations.push(violation7("medium", "project.register.invalid-registered-at", "registered_at must be YYYY-MM-DD"));
-        }
-        if (entry.lifecycle_id !== undefined && (typeof entry.lifecycle_id !== "string" || entry.lifecycle_id.trim() === "")) {
-          violations.push(violation7("medium", "project.register.invalid-lifecycle-id", "lifecycle_id must be a non-empty string"));
-        }
-        if (typeof entry.source_plan === "string" && entry.source_plan.trim() !== "" && entry.source_plan !== key) {
-          violations.push(violation7("medium", "project.register.mismatched-source-plan", `source_plan ${JSON.stringify(entry.source_plan)} does not match the entries key ${JSON.stringify(key)} — entries are keyed by plan id`));
-        }
+    const topLevel = gitOut(cwd, ["rev-parse", "--show-toplevel"]);
+    root = realpathSync3(topLevel ?? cwd);
+  }
+  if (!controlRoot && isLinkedWorktree(root)) {
+    throw new SddScriptError(`mstar sdd workspace: linked worktree at ${root} has no {HARNESS_DIR}/status.json (default gitignore).
+` + `  Refusing to create a second SDD tree under the feature checkout.
+` + `  Re-run with MSTAR_CONTROL_ROOT=<control_worktree_path> or: mstar sdd workspace ${planId} <control_worktree_path>
+` + `  See mstar-branch-worktree «Harness path SSOT under default gitignore».`, 1);
+  }
+  const harnessOverride = opts.harnessDir ?? (process.env.MSTAR_HARNESS_DIR || undefined);
+  let harnessDir;
+  if (harnessOverride) {
+    harnessDir = resolve8(root, harnessOverride);
+  } else {
+    const rc = findMstarc(root, root);
+    const rcHarnessDir = rc !== null ? parseMstarc(readFileSync7(rc, "utf8")).harnessDir : undefined;
+    if (rcHarnessDir) {
+      harnessDir = resolve8(rc !== null ? dirname6(rc) : root, rcHarnessDir);
+    } else {
+      const probed = probeHarnessWithStatus(root);
+      if (probed) {
+        harnessDir = probed;
+      } else if (isDirectory2(join9(root, ".mstar"))) {
+        harnessDir = join9(root, ".mstar");
+      } else if (isDirectory2(join9(root, ".agents"))) {
+        harnessDir = join9(root, ".agents");
+      } else {
+        harnessDir = join9(root, ".mstar");
       }
     }
   }
-  return { ok: violations.length === 0, violations };
+  const sddDir = resolveSddDir(harnessDir, planId);
+  mkdirSync6(sddDir, { recursive: true });
+  writeFileSync4(join9(sddDir, ".gitignore"), `*
+`);
+  return realpathSync3(sddDir);
 }
-function findingsCleanupGate(register, planId, opts) {
-  const mode = opts?.mode ?? "allow-residual";
-  const violations = [];
-  const entries = isPlainObject5(register.entries) ? register.entries[planId] : undefined;
-  if (entries === undefined) {
-    return { ok: true, violations };
-  }
-  if (!Array.isArray(entries)) {
-    violations.push(violation7("high", "project.register.invalid-entry-list", `entries[${JSON.stringify(planId)}] must be an array of residual entries (one entry per residual; v1 multi-finding semantics)`));
-    return { ok: false, violations };
+function taskBrief(planFile, taskN, outFile, opts = {}) {
+  if (!planFile || !Number.isInteger(taskN) || taskN < 1) {
+    throw new SddScriptError("usage: mstar sdd task-brief PLAN_FILE TASK_NUMBER [OUTFILE]", 2);
   }
-  if (entries.length === 0) {
-    return { ok: true, violations };
+  let content;
+  try {
+    content = readFileSync7(planFile, "utf8");
+  } catch {
+    throw new SddScriptError(`no such plan file: ${planFile}`, 2);
   }
-  for (const entry of entries) {
-    if (!isOpenResidual(entry))
-      continue;
-    const id = typeof entry.id === "string" ? entry.id : "<unnamed>";
-    const label = `R#${id}`;
-    if (mode === "zero-residual") {
-      if (entry.severity === "nit") {
-        violations.push(violation7("medium", "findings.zero-residual-nit", `${label}: style-only nits must be fixed in-session or dropped — never left open under zero-residual`));
-      } else if (entry.decision === "risk-accepted" || entry.lifecycle === "waived") {
-        violations.push(violation7("medium", "findings.zero-residual-risk-accepted", `${label}: waived/risk-accepted findings must be closed/archived, not left open under zero-residual`));
-      } else if (entry.decision === "defer") {
-        if (typeof entry.target !== "string" || entry.target.trim() === "") {
-          violations.push(violation7("medium", "findings.zero-residual-defer-no-target", `${label}: blocker-defer requires a target (next iteration/milestone) under zero-residual`));
-        }
-      } else {
-        violations.push(violation7("medium", "findings.zero-residual-open-fixable", `${label}: fixable finding must not remain open under zero-residual — fix now or convert to a blocker-defer`));
-      }
-    } else if (normalizeSeverity(entry.severity) === "critical") {
-      violations.push(violation7("high", "findings.allow-residual-critical", `${label}: unresolved critical blocks Approve with residuals`));
+  let out;
+  if (outFile) {
+    out = outFile;
+  } else {
+    const sddDir = opts.sddDir ?? process.env.SDD_DIR;
+    if (!sddDir) {
+      throw new SddScriptError("mstar sdd task-brief: set SDD_DIR or pass OUTFILE (run mstar sdd workspace PLAN_ID first)", 2);
     }
+    mkdirSync6(sddDir, { recursive: true });
+    out = join9(sddDir, `task-${taskN}-brief.md`);
   }
-  return { ok: violations.length === 0, violations };
+  const records = content.endsWith(`
+`) ? content.split(`
+`).slice(0, -1) : content.split(`
+`);
+  const headingRe = /^#+[ \t]+Task[ \t]+[0-9]+/;
+  const targetRe = new RegExp(`^#+[ 	]+Task[ 	]+${taskN}([^0-9]|$)`);
+  let infence = false;
+  let intask = false;
+  const printed = [];
+  for (const line of records) {
+    if (/^```/.test(line))
+      infence = !infence;
+    if (!infence && headingRe.test(line))
+      intask = targetRe.test(line);
+    if (intask)
+      printed.push(line);
+  }
+  const output = printed.length > 0 ? `${printed.join(`
+`)}
+` : "";
+  writeFileSync4(out, output);
+  if (printed.length === 0) {
+    throw new SddScriptError(`task ${taskN} not found in ${planFile} (no heading matching Task ${taskN})`, 3);
+  }
+  return out;
 }
 function violation8(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
@@ -3190,6 +3190,9 @@ function completenessLevel(frontmatterText, checklist) {
 function violation9(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
+var AUDIT_EFFORTS = ["XS", "S", "M", "L", "XL"];
+var AUDIT_RISKS = ["LOW", "MED", "HIGH"];
+var AUDIT_CONFIDENCES = ["HIGH", "MED", "LOW"];
 var AUDIT_STATUS_FIELDS = ["Priority", "Effort", "Risk", "Depends on", "Category", "Planned at"];
 function parseStatusBlocks(planText) {
   const blocks = [];
@@ -3538,7 +3541,7 @@ function referenceExists(repoRoot, docText) {
   for (const { ref, isSymbol, module } of refs) {
     if (!isSymbol || module === undefined) {
       const candidate = ref.replace(LINE_SUFFIX_RE, "").replace(ANCHOR_RE, "");
-      if (existsSync8(resolve10(repoRoot, candidate))) {
+      if (existsSync8(resolve11(repoRoot, candidate))) {
         checked++;
       } else {
         violations.push(violation10("medium", "compound.reference.missing-file", `referenced path \`${ref}\` does not exist under ${repoRoot} (compound-refresh Phase 2: referenced code still exists?)`, "update the doc to reference an existing path, or delete the stale reference"));
@@ -3613,9 +3616,9 @@ function isFileLikeRoot(root) {
   return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename5(root));
 }
 function scopeGuard(path, allowedRoots) {
-  const resolved = resolve10(path);
+  const resolved = resolve11(path);
   for (const root of allowedRoots) {
-    const r = resolve10(root);
+    const r = resolve11(root);
     if (isFileLikeRoot(r)) {
       if (resolved === r)
         return { ok: true, violations: [] };
@@ -3947,6 +3950,9 @@ function lintFiveQuestion(bodyText, mode = "authoring") {
 function resolveAssetPath(skillName, relPath, host) {
   return `skill \`${skillName}\` → ${relPath} (${resolveSkillRoot(host, { skill: skillName, rel: relPath })})`;
 }
+var EFFORT_ENUM_RE = new RegExp(`^(?:${AUDIT_EFFORTS.join("|")})(?:\\s*\\(|$)`);
+var RISK_ENUM_RE = new RegExp(`^(?:${AUDIT_RISKS.join("|")})(?:\\b|$)`);
+var CONFIDENCE_ENUM_RE = new RegExp(`^(${[...AUDIT_CONFIDENCES, "MEDIUM"].join("|")})\\b`, "i");
 
 // src/index.ts
 import { createUserMessage as createUserMessage2 } from "@deepseek-ai/dsh-llm";
@@ -3984,8 +3990,8 @@ class DshMstar extends Service {
 
 // src/gates/_shared.ts
 var import_schemastery = __toESM(require_lib2(), 1);
-import { existsSync as existsSync6 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var STATUS_FILE = "status.json";
 var PERSONA_INTERPOLATION_HAZARD = /\{\{[\s\S]*\}\}/;
@@ -4039,7 +4045,7 @@ function resolvePackagedSkillsDir(fileUrl) {
   for (const rel of ["../harness-skills", "../../harness-skills"]) {
     try {
       const dir = fileURLToPath2(new URL(rel, fileUrl));
-      if (existsSync6(dir))
+      if (existsSync4(dir))
         return dir;
     } catch {}
   }
@@ -4058,7 +4064,7 @@ function resolvePackagedAgentsDir(fileUrl) {
   for (const rel of ["../harness-agents", "../../harness-agents"]) {
     try {
       const dir = fileURLToPath2(new URL(rel, fileUrl));
-      if (existsSync6(dir))
+      if (existsSync4(dir))
         return dir;
     } catch {}
   }
@@ -4078,14 +4084,14 @@ class HarnessResolver {
   explicit;
   cache = new Map;
   constructor(explicit) {
-    this.explicit = explicit !== undefined && explicit.trim() !== "" ? resolve8(process.cwd(), explicit) : null;
+    this.explicit = explicit !== undefined && explicit.trim() !== "" ? resolve5(process.cwd(), explicit) : null;
   }
   forWorkspace(cwd) {
     if (this.explicit !== null)
       return this.explicit;
     if (cwd === undefined || cwd.trim() === "")
       return null;
-    const abs = resolve8(cwd);
+    const abs = resolve5(cwd);
     const hit = this.cache.get(abs);
     if (hit !== undefined)
       return hit;
@@ -4126,27 +4132,27 @@ function skillLocalConfig(config) {
 }
 
 // src/gates/catalog.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9, readdirSync as readdirSync7 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync8, readdirSync as readdirSync6 } from "node:fs";
+import { join as join10 } from "node:path";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 
 // src/gates/agent-flow.ts
-import { appendFileSync, closeSync, existsSync as existsSync13, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync7, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { appendFileSync, closeSync, existsSync as existsSync12, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync5, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 
 // src/gates/dispatch.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { basename as basename4, join as join8, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { basename as basename4, join as join5, resolve as resolve9 } from "node:path";
 
 // src/gates/workflow-selection.ts
-import { existsSync as existsSync10, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
-import { dirname as dirname7, join as join5, relative as relative3 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname7, join as join3, relative as relative3 } from "node:path";
 var TERMINAL_STATUS_CACHE_MAX = 64;
 var terminalStatusCache = new Map;
 function terminalStatusOf(snapshotPath) {
   let mtimeMs;
   try {
-    mtimeMs = statSync3(snapshotPath).mtimeMs;
+    mtimeMs = statSync2(snapshotPath).mtimeMs;
   } catch {
     terminalStatusCache.delete(snapshotPath);
     return;
@@ -4173,8 +4179,8 @@ function terminalStatusOf(snapshotPath) {
   return verdict;
 }
 function resolveActiveWorkflow(harnessDir) {
-  const statusPath = join5(harnessDir, STATUS_FILE);
-  if (!existsSync10(statusPath)) {
+  const statusPath = join3(harnessDir, STATUS_FILE);
+  if (!existsSync7(statusPath)) {
     return {
       kind: "error",
       code: "status.missing",
@@ -4232,7 +4238,7 @@ function resolveReadWorkflow(harnessDir) {
   if (active.kind === "error" && active.code !== "workflow.selection.no-active")
     return active;
   const workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
-  if (!existsSync10(workflowsDir)) {
+  if (!existsSync7(workflowsDir)) {
     return {
       kind: "error",
       code: "workflow.selection.no-snapshot",
@@ -4241,7 +4247,7 @@ function resolveReadWorkflow(harnessDir) {
   }
   let entries;
   try {
-    entries = readdirSync5(workflowsDir, { withFileTypes: true });
+    entries = readdirSync3(workflowsDir, { withFileTypes: true });
   } catch {
     return {
       kind: "error",
@@ -4253,8 +4259,8 @@ function resolveReadWorkflow(harnessDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const snapshotPath = join5(workflowsDir, entry.name, WORKFLOW_SNAPSHOT_FILE);
-    if (!existsSync10(snapshotPath)) {
+    const snapshotPath = join3(workflowsDir, entry.name, WORKFLOW_SNAPSHOT_FILE);
+    if (!existsSync7(snapshotPath)) {
       terminalStatusCache.delete(snapshotPath);
       continue;
     }
@@ -4262,11 +4268,11 @@ function resolveReadWorkflow(harnessDir) {
     if (verdict === undefined || !verdict.terminal)
       continue;
     if (best === undefined || verdict.mtimeMs > best.mtimeMs) {
-      best = { workflowId: entry.name, dir: join5(relative3(harnessDir, workflowsDir), entry.name), mtimeMs: verdict.mtimeMs };
+      best = { workflowId: entry.name, dir: join3(relative3(harnessDir, workflowsDir), entry.name), mtimeMs: verdict.mtimeMs };
     }
   }
   for (const cachedPath of terminalStatusCache.keys()) {
-    if (!existsSync10(join5(dirname7(cachedPath), WORKFLOW_SNAPSHOT_FILE))) {
+    if (!existsSync7(join3(dirname7(cachedPath), WORKFLOW_SNAPSHOT_FILE))) {
       terminalStatusCache.delete(cachedPath);
     }
   }
@@ -4459,12 +4465,12 @@ function leaseGateViolations(harnessDir, exec, writable, prompt) {
     if (!sdd)
       return [];
     if (selection.kind === "error" && selection.code === "status.unreadable") {
-      return [leaseViolation("lease.dispatch.unreadable", `cannot read ${join8(harnessDir, STATUS_FILE)}: the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "restore a valid status.json (the status gate refuses invalid writes)")];
+      return [leaseViolation("lease.dispatch.unreadable", `cannot read ${join5(harnessDir, STATUS_FILE)}: the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "restore a valid status.json (the status gate refuses invalid writes)")];
     }
-    return [leaseViolation("lease.dispatch.unverifiable", `${join8(harnessDir, STATUS_FILE)}: ${selection.kind === "error" ? selection.message : "no active workflow"} — the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "create a valid v2 status.json registering an active workflow (first implement dispatch requires a plan row + lease)")];
+    return [leaseViolation("lease.dispatch.unverifiable", `${join5(harnessDir, STATUS_FILE)}: ${selection.kind === "error" ? selection.message : "no active workflow"} — the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "create a valid v2 status.json registering an active workflow (first implement dispatch requires a plan row + lease)")];
   }
-  const snapshotPath = join8(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
-  if (!existsSync12(snapshotPath)) {
+  const snapshotPath = join5(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+  if (!existsSync10(snapshotPath)) {
     if (!sdd)
       return [];
     return [leaseViolation("lease.dispatch.unverifiable", `${snapshotPath} is missing — the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "create a valid workflow snapshot registering the plan row (first implement dispatch requires a plan row)")];
@@ -4497,7 +4503,7 @@ function leaseGateViolations(harnessDir, exec, writable, prompt) {
     const wt = worktree === undefined ? undefined : firstToken(worktree);
     if (isNaValue(wt)) {
       violations.push(leaseViolation("lease.dispatch.worktree-mismatch", "Assignment declares no Worktree path — cannot confirm this dispatch matches execution_lease.worktree_path", "add the absolute Worktree path to the Assignment (must equal the lease worktree_path)"));
-    } else if (resolve11(wt) !== resolve11(String(lease.worktree_path ?? ""))) {
+    } else if (resolve9(wt) !== resolve9(String(lease.worktree_path ?? ""))) {
       violations.push(leaseViolation("lease.dispatch.worktree-mismatch", `Assignment Worktree path "${wt}" differs from execution_lease.worktree_path "${String(lease.worktree_path)}"`, "align the Assignment with the lease worktree path (or update the lease)"));
     }
     const forms = parseAssignmentBranchForms(header);
@@ -4538,7 +4544,7 @@ function worktreeL2Violations(header) {
   return violations;
 }
 function activeSnapshotRows(harnessDir) {
-  if (!existsSync12(join8(harnessDir, STATUS_FILE)))
+  if (!existsSync10(join5(harnessDir, STATUS_FILE)))
     return { rows: null, controlWorktreePath: undefined, unreadable: false };
   const selection = resolveActiveWorkflow(harnessDir);
   if (selection.kind !== "active") {
@@ -4548,8 +4554,8 @@ function activeSnapshotRows(harnessDir) {
       unreadable: selection.kind === "error" && selection.code !== "workflow.selection.no-active"
     };
   }
-  const snapshotPath = join8(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
-  if (!existsSync12(snapshotPath))
+  const snapshotPath = join5(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+  if (!existsSync10(snapshotPath))
     return { rows: null, controlWorktreePath: undefined, unreadable: true };
   let doc;
   try {
@@ -4639,7 +4645,7 @@ function gateWorkflow(ctx, harnessDir, config, adapter, exec) {
   }
   const pb = writableFanOutUncovered(harnessDir);
   if (pb.unreadable) {
-    const statusLabel = harnessDir === null ? STATUS_FILE : join8(harnessDir, STATUS_FILE);
+    const statusLabel = harnessDir === null ? STATUS_FILE : join5(harnessDir, STATUS_FILE);
     ctx.logger(DISPATCH_LOGGER).warn(`workflow gate (${toolName}) (fail-open): cannot read ${statusLabel} — P-b lease attribution degraded; call allowed`);
   }
   const verdict = workflowPolicy(config, adapter.workflowAskCache, {
@@ -4829,7 +4835,7 @@ function callPairingKey(exec) {
 function resolveAgentFlowWriteDir(harnessDir) {
   const selection = resolveActiveWorkflow(harnessDir);
   if (selection.kind === "active")
-    return join10(harnessDir, selection.dir);
+    return join7(harnessDir, selection.dir);
   const message = selection.kind === "error" ? selection.message : "no active lifecycle (unexpected terminal selection — the active-set resolver has no history view)";
   if (!noActiveWarned) {
     noActiveWarned = true;
@@ -4846,7 +4852,7 @@ function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 function withWorkflowDirLock(workflowDir, fn, opts = {}) {
-  const lockDir = join10(workflowDir, WORKFLOW_LEDGER_LOCKDIR);
+  const lockDir = join7(workflowDir, WORKFLOW_LEDGER_LOCKDIR);
   if (heldWorkflowLocks.has(lockDir)) {
     throw new Error(`${lockDir} is already held by this process — withWorkflowDirLock is not reentrant; a nested acquisition on the same workflow dir is a bug`);
   }
@@ -4856,7 +4862,7 @@ function withWorkflowDirLock(workflowDir, fn, opts = {}) {
   let acquired = null;
   for (;; ) {
     try {
-      mkdirSync3(lockDir);
+      mkdirSync2(lockDir);
       const st = statSync5(lockDir);
       acquired = { dev: st.dev, ino: st.ino };
       break;
@@ -4872,7 +4878,7 @@ function withWorkflowDirLock(workflowDir, fn, opts = {}) {
   heldWorkflowLocks.add(lockDir);
   try {
     try {
-      writeFileSync2(join10(lockDir, WORKFLOW_LOCKER_HOLDER_PID), String(process.pid), "utf8");
+      writeFileSync2(join7(lockDir, WORKFLOW_LOCKER_HOLDER_PID), String(process.pid), "utf8");
     } catch {}
     return fn();
   } finally {
@@ -4881,7 +4887,7 @@ function withWorkflowDirLock(workflowDir, fn, opts = {}) {
       const current = statSync5(lockDir);
       if (acquired !== null && current.dev === acquired.dev && current.ino === acquired.ino) {
         try {
-          unlinkSync2(join10(lockDir, WORKFLOW_LOCKER_HOLDER_PID));
+          unlinkSync2(join7(lockDir, WORKFLOW_LOCKER_HOLDER_PID));
         } catch {}
         rmdirSync(lockDir);
       }
@@ -4889,13 +4895,13 @@ function withWorkflowDirLock(workflowDir, fn, opts = {}) {
   }
 }
 function appendEvent(workflowDir, event) {
-  const file = join10(workflowDir, AGENT_FLOW_FILE);
+  const file = join7(workflowDir, AGENT_FLOW_FILE);
   withWorkflowDirLock(workflowDir, () => {
     appendFileSync(file, `${JSON.stringify(event)}
 `);
     if (statSync5(file).size <= AGENT_FLOW_SIZE_GATE_BYTES)
       return;
-    const content = readFileSync7(file, "utf8");
+    const content = readFileSync5(file, "utf8");
     const lines = content.replace(/\n$/, "").split(`
 `);
     if (lines.length > AGENT_FLOW_MAX_EVENTS) {
@@ -5246,7 +5252,7 @@ function summaryOf(events) {
 function ledgerContent(file, n) {
   const size = statSync5(file).size;
   if (size <= AGENT_FLOW_TAIL_READ_THRESHOLD_BYTES) {
-    return readFileSync7(file, "utf8");
+    return readFileSync5(file, "utf8");
   }
   let windowBytes = AGENT_FLOW_TAIL_READ_THRESHOLD_BYTES;
   const fd = openSync(file, "r");
@@ -5278,8 +5284,8 @@ function ledgerContent(file, n) {
   }
 }
 function readAgentFlow(workflowDir, limit) {
-  const file = join10(workflowDir, AGENT_FLOW_FILE);
-  if (!existsSync13(file)) {
+  const file = join7(workflowDir, AGENT_FLOW_FILE);
+  if (!existsSync12(file)) {
     return { events: [], summary: [] };
   }
   const n = limit === undefined ? AGENT_FLOW_DEFAULT_LIMIT : Math.max(0, Math.floor(limit));
@@ -5404,7 +5410,7 @@ function residualSeverityIndex(severity) {
 function pluginVersion() {
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
-      const pkg = JSON.parse(readFileSync9(new URL(rel, import.meta.url), "utf8"));
+      const pkg = JSON.parse(readFileSync8(new URL(rel, import.meta.url), "utf8"));
       if (typeof pkg.version === "string" && pkg.version !== "")
         return pkg.version;
     } catch {}
@@ -5533,8 +5539,8 @@ function hhmm(ts) {
 function harnessStateSource(harnessDir) {
   if (harnessDir === null)
     return null;
-  const statusPath = join11(harnessDir, STATUS_FILE);
-  if (!existsSync14(statusPath))
+  const statusPath = join10(harnessDir, STATUS_FILE);
+  if (!existsSync13(statusPath))
     return null;
   try {
     const selection = resolveReadWorkflow(harnessDir);
@@ -5553,9 +5559,9 @@ function harnessStateSource(harnessDir) {
     if (selection.kind === "error") {
       return selectionErrorState(selection, rollup, harnessDir, compass);
     }
-    const snapshotPath = join11(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+    const snapshotPath = join10(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
     let snapshot;
-    if (!existsSync14(snapshotPath)) {
+    if (!existsSync13(snapshotPath)) {
       return selectionErrorState({
         kind: "error",
         code: "workflow.selection.snapshot-unreadable",
@@ -5617,7 +5623,7 @@ function harnessStateSource(harnessDir) {
       leases,
       knowledge: knowledgeDigest(harnessDir),
       direction: compass !== undefined ? compassDirection(compass.compassPath) : null,
-      agentFlow: readAgentFlow(join11(harnessDir, selection.dir), 50)
+      agentFlow: readAgentFlow(join10(harnessDir, selection.dir), 50)
     };
   } catch {
     return null;
@@ -5647,21 +5653,21 @@ function selectionErrorState(selection, rollup, harnessDir, compass) {
 function projectRollupSource(harnessDir, residuals) {
   const milestones = [];
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (existsSync14(projectsDir)) {
+  if (existsSync13(projectsDir)) {
     let entries;
     try {
-      entries = readdirSync7(projectsDir, { withFileTypes: true });
+      entries = readdirSync6(projectsDir, { withFileTypes: true });
     } catch {
       entries = [];
     }
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const roadmapPath = join11(projectsDir, entry.name, PROJECT_ROADMAP_FILE);
-      if (!existsSync14(roadmapPath))
+      const roadmapPath = join10(projectsDir, entry.name, PROJECT_ROADMAP_FILE);
+      if (!existsSync13(roadmapPath))
         continue;
       try {
-        const doc = parseCompassFrontmatterText(readFileSync9(roadmapPath, "utf8"), roadmapPath);
+        const doc = parseCompassFrontmatterText(readFileSync8(roadmapPath, "utf8"), roadmapPath);
         if (Array.isArray(doc.milestones)) {
           for (const milestone of doc.milestones) {
             if (typeof milestone === "string" && milestone.trim() !== "")
@@ -5723,11 +5729,11 @@ function residualRollup(harnessDir) {
 }
 function projectRegisters(harnessDir) {
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (!existsSync14(projectsDir))
+  if (!existsSync13(projectsDir))
     return [];
   let entries;
   try {
-    entries = readdirSync7(projectsDir, { withFileTypes: true });
+    entries = readdirSync6(projectsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -5735,8 +5741,8 @@ function projectRegisters(harnessDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const registerPath = join11(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync14(registerPath))
+    const registerPath = join10(projectsDir, entry.name, PROJECT_REGISTER_FILE);
+    if (!existsSync13(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -5747,13 +5753,13 @@ function projectRegisters(harnessDir) {
   return registers;
 }
 function knowledgeDigest(harnessDir) {
-  const indexPath = join11(harnessDir, "knowledge", "README.md");
-  if (!existsSync14(indexPath))
+  const indexPath = join10(harnessDir, "knowledge", "README.md");
+  if (!existsSync13(indexPath))
     return null;
   try {
     const categories = new Set;
     let docCount = 0;
-    for (const line of readFileSync9(indexPath, "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync8(indexPath, "utf8").split(/\r?\n/)) {
       const row = line.trim().match(/^\|(.+)\|$/);
       if (row === null)
         continue;
@@ -5776,7 +5782,7 @@ function knowledgeDigest(harnessDir) {
 }
 function compassDirection(compassPath) {
   try {
-    const content = readFileSync9(compassPath, "utf8");
+    const content = readFileSync8(compassPath, "utf8");
     const section = content.match(/^## Direction lock[^\n]*\n+([\s\S]*?)(?=\n## |$)/m);
     if (section === null)
       return null;
@@ -5793,23 +5799,23 @@ function compassDirection(compassPath) {
 }
 function steeringCompassPath(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync14(iterationsDir))
+  if (!existsSync13(iterationsDir))
     return;
   let entries;
   try {
-    entries = readdirSync7(iterationsDir, { withFileTypes: true });
+    entries = readdirSync6(iterationsDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const compassPath = join11(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync14(compassPath))
+    const compassPath = join10(iterationsDir, entry.name, "delivery-compass.md");
+    if (!existsSync13(compassPath))
       continue;
     let content;
     try {
-      content = readFileSync9(compassPath, "utf8");
+      content = readFileSync8(compassPath, "utf8");
     } catch {
       continue;
     }
@@ -5823,8 +5829,8 @@ function steeringCompassPath(harnessDir) {
 function iterationGateSource(harnessDir) {
   if (harnessDir === null)
     return;
-  const statusPath = join11(harnessDir, STATUS_FILE);
-  if (!existsSync14(statusPath))
+  const statusPath = join10(harnessDir, STATUS_FILE);
+  if (!existsSync13(statusPath))
     return;
   const compass = steeringCompassPath(harnessDir);
   if (compass === undefined)
@@ -5832,7 +5838,7 @@ function iterationGateSource(harnessDir) {
   const selection = resolveReadWorkflow(harnessDir);
   if (selection.kind === "error")
     return;
-  const snapshotPath = join11(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+  const snapshotPath = join10(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
   try {
     const snapshotDoc = readJson(snapshotPath);
     const compassDoc = parseCompassFrontmatter(compass.compassPath);
@@ -5886,11 +5892,11 @@ function agentDigestKey(agent, cwd) {
 }
 
 // src/gates/status.ts
-import { existsSync as existsSync15, readdirSync as readdirSync9 } from "node:fs";
-import { basename as basename6, join as join14, relative as relative5, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync9 } from "node:fs";
+import { basename as basename6, join as join14, relative as relative5, resolve as resolve12 } from "node:path";
 var LOGGER_NAME = "mstar/status-gate";
 function harnessDocKindOfTarget(harnessDir, targetPath) {
-  const resolved = resolve13(targetPath);
+  const resolved = resolve12(targetPath);
   const name = basename6(resolved);
   if (name !== STATUS_FILE && name !== WORKFLOW_SNAPSHOT_FILE && name !== PROJECT_REGISTER_FILE)
     return null;
@@ -5969,7 +5975,7 @@ function projectRegisterDocs(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const registerPath = join14(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync15(registerPath))
+    if (!existsSync14(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -6042,7 +6048,7 @@ async function editIntentListener(ctx, resolver, config, adapter, target, actor,
 }
 
 // src/gates/skill-lint.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
 import { basename as basename7, dirname as dirname9, resolve as resolve14, sep as sep2 } from "node:path";
 var SKILL_LINT_LOGGER = "mstar/skill-lint";
 
@@ -6123,7 +6129,7 @@ function gateSkillIntent(ctx, harnessDir, config, target) {
     if (!isSkillTarget(roots, target))
       return;
     const skillPath = resolve14(target.displayPath);
-    if (!existsSync16(skillPath))
+    if (!existsSync15(skillPath))
       return;
     let doc;
     try {
@@ -6174,7 +6180,7 @@ async function skillWriteIntentListener(ctx, resolver, config, target, actor, ne
 }
 
 // src/gates/seams.ts
-import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync11 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13, readdirSync as readdirSync11 } from "node:fs";
 import { basename as basename8, dirname as dirname10, join as join16, resolve as resolve15, sep as sep3 } from "node:path";
 
 // ../engine/dist/audit.js
@@ -6229,9 +6235,11 @@ var GITIGNORE_PROCESS_ENTRIES2 = GITIGNORE_SNIPPET2.split(`
 var GITIGNORE_PROCESS_ENTRIES_AGENTS2 = GITIGNORE_SNIPPET_AGENTS2.split(`
 `).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
 var WHOLE_MATCH_PATTERNS = [
-  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g },
+  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g },
   { type: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
   { type: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+  { type: "github-pat", re: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/g },
+  { type: "stripe-live-key", re: /\bsk_live_[A-Za-z0-9]{16,}\b/g },
   { type: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\b/g },
   { type: "api-secret-key", re: /\bsk-[A-Za-z0-9-]{20,}\b/g }
@@ -6242,6 +6250,28 @@ var VALUE_PATTERNS = [
     re: /(["']?)\b(password|passwd|api[_-]?key|access[_-]?token|auth[_-]?token|secret|token)\b(["']?)(\s*[:=]\s*)("[^"\n]{8,}"|'[^'\n]{8,}'|[A-Za-z0-9_./+\-=]{16,})/gi
   }
 ];
+var CI_IAC_LEAK_SHAPES = [
+  {
+    kind: "actions-plaintext-env",
+    description: "GitHub Actions env assignment with plaintext literal",
+    re: /^\s*(?:-\s+)?env:\s*[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|KEY)[A-Z0-9_]*\s*[:=]\s*["']?[A-Za-z0-9_/+=-]{8,}["']?\s*$/
+  },
+  {
+    kind: "actions-secret-echo",
+    description: "echo of a GitHub Actions secrets context value",
+    re: /\becho\b[^#\n]*\$\{\{\s*secrets\.[A-Za-z0-9_]+\s*\}\}/
+  },
+  {
+    kind: "dockerfile-credential-env",
+    description: "Dockerfile ENV/ARG with credential-looking name",
+    re: /^\s*(?:ENV|ARG)\s+[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Z0-9_]*\b/i
+  },
+  {
+    kind: "terraform-hardcoded-password",
+    description: "Terraform hardcoded password attribute",
+    re: /^\s*password\s*=\s*"[^$\{][^"]*"\s*$/
+  }
+];
 function buildLineStarts(text) {
   const starts = [0];
   for (let i = 0;i < text.length; i++) {
@@ -6263,17 +6293,25 @@ function lineAt(starts, index) {
   }
   return lo + 1;
 }
+function lineStartOf(text, index) {
+  return text.lastIndexOf(`
+`, index - 1) + 1;
+}
 function redactSecrets(text, filePath) {
   const starts = buildLineStarts(text);
   const marker = (type, index) => `[REDACTED ${type}@${lineAt(starts, index)}${filePath === undefined ? "" : ` in ${filePath}`}]`;
-  const replacements = [];
-  const findings = [];
+  const spans = [];
   for (const pattern of WHOLE_MATCH_PATTERNS) {
     for (const match of text.matchAll(pattern.re)) {
       if (match.index === undefined)
         continue;
-      replacements.push({ index: match.index, length: match[0].length, text: marker(pattern.type, match.index) });
-      findings.push({ line: lineAt(starts, match.index), type: pattern.type });
+      spans.push({
+        start: match.index,
+        end: match.index + match[0].length,
+        priority: 0,
+        text: marker(pattern.type, match.index),
+        type: pattern.type
+      });
     }
   }
   for (const pattern of VALUE_PATTERNS) {
@@ -6282,14 +6320,51 @@ function redactSecrets(text, filePath) {
         continue;
       const type = pattern.typeOf(match[2]);
       const replacement = `${match[1]}${match[2]}${match[3]}${match[4]}${marker(type, match.index)}`;
-      replacements.push({ index: match.index, length: match[0].length, text: replacement });
-      findings.push({ line: lineAt(starts, match.index), type });
+      spans.push({ start: match.index, end: match.index + match[0].length, priority: 1, text: replacement, type });
+    }
+  }
+  for (const shape of CI_IAC_LEAK_SHAPES) {
+    const lineScoped = new RegExp(shape.re.source, shape.re.ignoreCase ? "gim" : "gm");
+    for (const match of text.matchAll(lineScoped)) {
+      if (match.index === undefined)
+        continue;
+      const lineEnd = text.indexOf(`
+`, match.index);
+      const end = lineEnd === -1 ? text.length : lineEnd;
+      spans.push({
+        start: match.index,
+        end,
+        priority: 2,
+        text: `${" ".repeat(match.index - lineStartOf(text, match.index))}${marker(shape.kind, match.index)}`,
+        type: shape.kind
+      });
     }
   }
-  replacements.sort((a, b) => b.index - a.index);
+  spans.sort((a, b) => a.start - b.start || b.end - a.end || b.priority - a.priority);
+  const merged = [];
+  let groupMaxEnd = -1;
+  let best = null;
+  for (const span of spans) {
+    if (span.start < groupMaxEnd) {
+      if (groupMaxEnd < span.end)
+        groupMaxEnd = span.end;
+      if (span.end - span.start > best.end - best.start)
+        best = span;
+    } else {
+      if (best !== null)
+        merged.push(best);
+      groupMaxEnd = span.end;
+      best = span;
+    }
+  }
+  if (best !== null)
+    merged.push(best);
   let out = text;
-  for (const r of replacements)
-    out = out.slice(0, r.index) + r.text + out.slice(r.index + r.length);
+  for (let i = merged.length - 1;i >= 0; i--) {
+    const r = merged[i];
+    out = out.slice(0, r.start) + r.text + out.slice(r.end);
+  }
+  const findings = merged.map((r) => ({ line: lineAt(starts, r.start), type: r.type }));
   const deduped = new Map;
   for (const f of findings)
     deduped.set(`${f.line}:${f.type}`, f);
@@ -6372,7 +6447,7 @@ function validateDesignDoc(doc, path) {
   const violations = [...validateDesignTokenFrontmatter(doc).violations];
   const isDark = basename8(path) === "DESIGN.dark.md";
   const sibling = join16(dirname10(path), isDark ? "DESIGN.md" : "DESIGN.dark.md");
-  if (existsSync17(sibling)) {
+  if (existsSync16(sibling)) {
     const light = isDark ? readFileSync13(sibling, "utf8") : doc;
     const dark = isDark ? doc : readFileSync13(sibling, "utf8");
     violations.push(...assertLightDarkParity(light, dark).violations);
@@ -6399,7 +6474,7 @@ function validateRolesState(rolesDir, skillsRoot = dirname10(rolesDir)) {
     if (!entry.isDirectory() || !entry.name.startsWith("mstar-"))
       continue;
     const skillFile = join16(skillsRoot, entry.name, "SKILL.md");
-    if (!existsSync17(skillFile))
+    if (!existsSync16(skillFile))
       continue;
     try {
       skillTexts[entry.name] = readFileSync13(skillFile, "utf8");
@@ -6433,7 +6508,7 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
     if (!isSeamTarget(seam, harnessDir, target))
       return;
     const path = resolve15(target.displayPath);
-    if (!existsSync17(path))
+    if (!existsSync16(path))
       return;
     let doc;
     try {
@@ -6503,7 +6578,7 @@ function lintRolesWrite(doc, options) {
 }
 
 // src/gates/tools.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
 import { join as join17, resolve as resolve16 } from "node:path";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 var ITERATION_VIOLATION_SCHEMA = {
@@ -6669,9 +6744,9 @@ function registerSddIterationTools(ctx, resolver) {
       presentResult: (_args, _result) => ({ card: "generic", title: "Iteration gate evaluation" }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        if (!existsSync18(args.snapshot_path))
+        if (!existsSync17(args.snapshot_path))
           throw new Error(`workflow snapshot not found: ${args.snapshot_path}`);
-        if (!existsSync18(args.compass_path))
+        if (!existsSync17(args.compass_path))
           throw new Error(`compass file not found: ${args.compass_path}`);
         const snapshotDoc = readJson(args.snapshot_path);
         const compassDoc = parseCompassFrontmatter(args.compass_path);
@@ -6726,7 +6801,7 @@ function registerSeamTools(ctx, resolver) {
       async execute(args) {
         const abs = resolve16(args.dir);
         const lightPath = join17(abs, "DESIGN.md");
-        if (!existsSync18(lightPath))
+        if (!existsSync17(lightPath))
           throw new Error(`design file not found: ${lightPath}`);
         const light = readFileSync14(lightPath, "utf8");
         const result = validateDesignDoc(light, lightPath);
@@ -6779,7 +6854,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const abs = resolve16(args.plan_path);
-        if (!existsSync18(abs))
+        if (!existsSync17(abs))
           throw new Error(`plan file not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const result = validateAuditDoc(text, abs);
@@ -6819,7 +6894,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args, exec) {
         const abs = resolve16(args.doc_path);
-        if (!existsSync18(abs))
+        if (!existsSync17(abs))
           throw new Error(`knowledge doc not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const base = validateCompoundDoc(text, abs, args.repo_root !== undefined ? null : resolver.forAgent(exec.agent));
@@ -6864,7 +6939,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const rolesDir = resolve16(args.roles_dir);
-        if (!existsSync18(join17(rolesDir, "SKILL.md")))
+        if (!existsSync17(join17(rolesDir, "SKILL.md")))
           throw new Error(`roles dir not found: ${rolesDir}`);
         const result = validateRolesState(rolesDir, args.skills_root !== undefined ? resolve16(args.skills_root) : undefined);
         return { ok: result.ok, violations: result.violations.map(iterationViolationView) };
@@ -6874,7 +6949,7 @@ function registerSeamTools(ctx, resolver) {
 }
 
 // src/gates/adapter.ts
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 import { join as join18 } from "node:path";
 import { Service as Service2 } from "@deepseek-ai/cordis";
 var HOST_LOGGER = "mstar/host-adapter";
@@ -6911,7 +6986,7 @@ class DshHostAdapter extends Service2 {
     this.logSink(level, msg);
   }
   statusGate(path, kind, harnessDir) {
-    if (!existsSync19(path))
+    if (!existsSync18(path))
       return { ok: true, violations: [] };
     return validateStatusDoc(path, kind, harnessDir);
   }
@@ -6992,7 +7067,7 @@ class DshHostAdapter extends Service2 {
 }
 
 // src/gates/agent-personas.ts
-import { readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync6 } from "node:fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync7 } from "node:fs";
 import { join as join19, resolve as resolve17, sep as sep5 } from "node:path";
 var ROLE_ID_PATTERN = /^[a-z0-9-]{1,32}$/;
 var defaultCache = new Map;
@@ -7040,7 +7115,7 @@ function defaultFromMirror(agentsDir, roleId, warn) {
     return;
   let stat;
   try {
-    stat = statSync6(file);
+    stat = statSync7(file);
   } catch {
     return;
   }
@@ -7239,7 +7314,7 @@ function log2(level, message) {
 }
 
 // src/gates/workflow-ledger.ts
-import { readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join20 } from "node:path";
 var WORKFLOW_LEDGER_LOGGER = "mstar/workflow-ledger";
 var TOOL_WORKFLOW_RUN_START = "tool-workflow/run-start";
@@ -7309,7 +7384,7 @@ function saveWatermark(workflowDir, watermark) {
   try {
     const file = join20(workflowDir, WORKFLOW_LEDGER_WATERMARK_FILE);
     const tmp = `${file}.tmp`;
-    writeFileSync4(tmp, JSON.stringify({ v: 1, cursors: Object.fromEntries(watermark) }));
+    writeFileSync5(tmp, JSON.stringify({ v: 1, cursors: Object.fromEntries(watermark) }));
     renameSync3(tmp, file);
   } catch (error) {
     log3("warn", `workflow-ledger watermark write failed for ${workflowDir} — in-memory only (restart re-records): ${errorMessage3(error)}`);
@@ -7523,7 +7598,7 @@ function registerWorkflowLedger(ctx, resolver, workflowAskCache) {
 }
 
 // src/gates/goal-bridge.ts
-import { existsSync as existsSync20, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
 import { join as join21 } from "node:path";
 var GOAL_BRIDGE_LOGGER = "mstar/goal-bridge";
 var DEFAULT_MAX_GOAL_ROUNDS = 256;
@@ -7552,7 +7627,7 @@ function projectRegisterPointer(harnessDir) {
       if (!entry.isDirectory())
         continue;
       const registerPath = join21(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-      if (existsSync20(registerPath))
+      if (existsSync19(registerPath))
         return registerPath;
     }
   } catch {}
@@ -7567,7 +7642,7 @@ function iterationGoalObjective(iterationId) {
 }
 function steeringCompass(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync20(iterationsDir))
+  if (!existsSync19(iterationsDir))
     return;
   let entries;
   try {
@@ -7579,7 +7654,7 @@ function steeringCompass(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const compassPath = join21(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync20(compassPath))
+    if (!existsSync19(compassPath))
       continue;
     let content;
     try {
@@ -7759,7 +7834,7 @@ function registerGoalBridge(ctx, resolver, config) {
 }
 
 // src/gates/plan-mode-bridge.ts
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { join as join22 } from "node:path";
 var PLAN_MODE_BRIDGE_LOGGER = "mstar/plan-mode-bridge";
 var PLAN_STATUS_TODO = "Todo";
@@ -7777,7 +7852,7 @@ function errorMessage5(error) {
 }
 function hasPrepareWindow(harnessDir) {
   const statusPath = join22(harnessDir, STATUS_FILE);
-  if (!existsSync21(statusPath))
+  if (!existsSync20(statusPath))
     return false;
   const selection = resolveReadWorkflow(harnessDir);
   if (selection.kind === "error")
@@ -7852,7 +7927,7 @@ function errorMessage6(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function mstarLoadLine(roleId) {
-  return `Load mstar-roles (references/${roleId}.md) and the role's Required Skill Dependencies before acting.`;
+  return `Load mstar-roles (references/${roleId}.md) first — identity comes before skills; load topic skills only when the Assignment activates them via its Skill presets field.`;
 }
 async function declareMstarSeeds(service, options) {
   const { agentsDir, log: log6 } = options;
@@ -8236,7 +8311,7 @@ var inject = ["loader"];
 function packagedCommandsDir() {
   try {
     const dir = fileURLToPath3(new URL("../harness-commands", import.meta.url));
-    return existsSync22(dir) ? dir : undefined;
+    return existsSync21(dir) ? dir : undefined;
   } catch {
     return;
   }