@mstar-harness/dsh 3.9.1 → 3.9.3

package/dist/index.js

@@ -1401,12 +1401,18 @@ var REQUIRED_FIELDS = [
   { key: "delegation", label: "Delegation", code: "delegation" },
   { key: "taskCategory", label: "Task category", code: "task-category" }
 ];
+var REVIEW_SEAT_ROLES = ["qc-specialist", "qc-specialist-2", "qc-specialist-3", "code-reviewer", "qa-engineer"];
+var BUDGET_LABELS = ["Budget (review / QC seats)", "Budget"];
+var RETURN_SHAPE_LABELS = ["Return shape (review / QC seats)", "Return shape"];
 function violation2(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
+function describeAbsence(value) {
+  return value === undefined ? "the field is absent" : value === "" ? "the field is empty" : value.trim().toLowerCase() === "n/a" ? 'the value is "N/A"' : undefined;
+}
 function parseAssignmentFields(assignmentText) {
   const fields = {};
-  for (const line of assignmentText.split(/\r?\n/)) {
+  for (const line of assignmentHeaderRegion(assignmentText).split(/\r?\n/)) {
     const match = line.match(/^[ \t]*(?:[-*][ \t]+)?\*\*\s*([^*:]+?)\s*\*\*\s*:\s*(.*)$/) ?? line.match(/^[ \t]*(?:[-*][ \t]+)?([A-Za-z][A-Za-z -]*?)\s*:\s*(.*)$/);
     if (!match)
       continue;
@@ -1421,6 +1427,10 @@ function parseAssignmentFields(assignmentText) {
       fields.workingBranch = value;
     else if (label === "Branch policy")
       fields.branchPolicy = value;
+    else if (BUDGET_LABELS.includes(label))
+      fields.budget = value;
+    else if (RETURN_SHAPE_LABELS.includes(label))
+      fields.returnShape = value;
   }
   return fields;
 }
@@ -1508,6 +1518,33 @@ function validateAssignmentFields(assignmentText, opts = {}) {
   for (const { key, label, code } of REQUIRED_FIELDS) {
     requireField(violations, fields[key], label, code);
   }
+  const role = (fields.executeAs ?? "").trim().replace(/^@/, "").toLowerCase().split(/\s+/)[0] ?? "";
+  const reviewSeat = REVIEW_SEAT_ROLES.includes(role);
+  const category = (fields.taskCategory ?? "").replace(/^[*_`"'\s]+/, "").toLowerCase();
+  const auditRound = /^audit(?![A-Za-z0-9])/.test(category);
+  if (reviewSeat || auditRound) {
+    const subject = reviewSeat ? `review seat "${role}"` : `audit round (Task category: ${category})`;
+    const boundingFields = [
+      {
+        code: "assignment.field.budget-missing",
+        label: "Budget",
+        fix: `add "**Budget (review / QC seats)**: <cap> — may only tighten the default in mstar-harness-core § 定向执行与验证边界, never loosen it"`,
+        value: fields.budget
+      },
+      {
+        code: "assignment.field.return-shape-missing",
+        label: "Return shape",
+        fix: `add "**Return shape (review / QC seats)**: <what the seat returns and how it stops — verdict + findings shape; a clean round returns findings: [] explicitly>"`,
+        value: fields.returnShape
+      }
+    ];
+    for (const field of boundingFields) {
+      const missing = describeAbsence(field.value);
+      if (missing === undefined)
+        continue;
+      violations.push(violation2("high", field.code, `${subject} must declare a round ${field.label} — ${missing}`, field.fix));
+    }
+  }
   if (writable) {
     const workingPresent = fields.workingBranch !== undefined && fields.workingBranch !== "";
     const policyPresent = fields.branchPolicy !== undefined && fields.branchPolicy !== "";
@@ -2454,7 +2491,9 @@ function findingsCleanupGate(register, planId, opts) {
     const id = typeof entry.id === "string" ? entry.id : "<unnamed>";
     const label = `R#${id}`;
     if (mode === "zero-residual") {
-      if (entry.severity === "nit") {
+      if (normalizeSeverity(entry.severity) === "critical") {
+        violations.push(violation6("high", "findings.zero-residual-critical", `${label}: unresolved critical blocks approval under zero-residual — fix now or close via explicit risk acceptance`));
+      } else if (entry.severity === "nit") {
         violations.push(violation6("medium", "findings.zero-residual-nit", `${label}: style-only nits must be fixed in-session or dropped — never left open under zero-residual`));
       } else if (entry.decision === "risk-accepted" || entry.lifecycle === "waived") {
         violations.push(violation6("medium", "findings.zero-residual-risk-accepted", `${label}: waived/risk-accepted findings must be closed/archived, not left open under zero-residual`));
@@ -4163,6 +4202,8 @@ function findEphemeralCitations(skillText) {
   }
   return citations;
 }
+var DATED_SLUG_TOKEN_SOURCE = "\\b20\\d{6}-[a-z0-9][a-z0-9-]*\\b(?!\\.\\d)";
+var DATED_SLUG_TOKEN_RE = new RegExp(DATED_SLUG_TOKEN_SOURCE, "g");
 var WORKFLOW_VERB_START_RE = /^(?:explains?|describes?|covers?|provides?|walks?|guides?|shows?|lists?|details?|demonstrates?|outlines?|teaches?|summarizes?)\b/i;
 var PRONOUN_RE = /\bI\b(?!\/)|\b(?:we|you|my|our|your|us)\b/gi;
 var DESCRIPTION_MAX_WORDS = 120;

package/harness-skills/mstar-artifacts/references/plan-quality-bar.md

@@ -21,7 +21,7 @@ Before a plan is locked, verify every item:
 
 ### 2. Verification gates
 
-Each verification step names the changed behavior, exact scoped command and expected result, or reusable evidence with its applicability. Use only checks needed for this change; discovering a repository command does not make it a gate. Scope authority → `mstar-harness-core` § 定向执行与验证边界.
+Each verification step names the changed behavior, exact scoped command and expected result, or reusable evidence with its applicability. Use only checks needed for this change; discovering a repository command does not make it a gate. Scope authority → `mstar-harness-core` § 定向执行与验证边界. Verification gates stay inside the change's own layer: a development plan's task never gates on real-browser, device, or installed-deployment E2E — that verification lives only in a separately requested `mstar-e2e` workflow, whose own scenario rows are its legitimate tasks.
 
 | Pattern | Weak (do not use) | Strong (scope first) |
 |---------|-------------------|----------------------|

package/harness-skills/mstar-artifacts/references/status-and-residuals.md

@@ -186,8 +186,8 @@ Only these five, **lowercase English**:
 
 | `severity` | Meaning |
 | ---------- | ------- |
-| `critical` | Merge-blocking; maps to QC **Critical** findings. |
-| `high` | Not blocking but high impact (security, correctness, data, significant tech debt); fix, escalate, or open residual with PM follow-up. |
+| `critical` | **Unsafe to ship, reachable on this merge** — correctness bug, security hole, data loss, or broken public contract whose unsafe outcome can be triggered here; merge-blocking. Maps to QC **Critical** findings. |
+| `high` | Not blocking — the same unsafe-to-ship classes whose unsafe outcome is **not reachable on this merge** (narrow reach, unreachable path, or already mitigated), **or significant tech debt**; fix, escalate, or open a residual with PM follow-up. |
 | `medium` | Should address this or next milestone; may be open residual. |
 | `low` | Small impact, cheap fix; may be open residual. |
 | `nit` | Style, naming, wording, non-behavior doc nits; **lighter than `low`**. PM may omit from the register if no tracking needed. |
@@ -196,17 +196,33 @@ Summary vs `mstar-review-qc`: unresolved **`critical`** → usually `Request Cha
 
 ### 4. QC report section → JSON `severity`
 
+Grade by **what would happen if the finding is true**, never by how uncertain you are. Whether a finding blocks turns on whether its unsafe outcome is **reachable on this merge** — the axis defined in §3 — and not on the report section (Critical / Warning / Suggestion) it was filed under; the filing is a routing hint, not a severity decision. Two classes reach `high` or above: (a) **unsafe to ship** — correctness, security, data loss, broken public contract → `critical` / `high` even at low confidence; (b) **significant tech debt** → `high`. Everything else stays below: documentation accuracy, citations/line numbers, naming, wording, and test polish are `low` / `nit` — including inside a normative document — **unless the defect would itself drive an unsafe outcome** (a normative instruction that leads an executor into a correctness, security, or data failure), in which case it grades by that consequence. Evidence confidence belongs in the report (`Confidence`), not encoded by inflating `severity`. When the uncertainty is about **scope** (reachability) rather than severity class, record the worst-case class among the plausible ones and state the open question in the entry's `scope`.
+
 When registering into the project register (template in `mstar-review-qc`):
 
 | Report Findings section | JSON `severity` |
 | ----------------------- | --------------- |
-| **Critical** | Default `critical`. PM may record `high` if “not blocking this merge but follow up soon” — state reason in `title`/`scope`. |
-| **Warning** | `high` or `medium`: security/correctness/data → `high`; other substantive non-blocking → `medium`; **when unsure, use `high`**. |
+| **Critical** | Default `critical`. PM may record `high` only when the §3 axis puts the unsafe outcome outside reachability on this merge, with the reasoning stated in `title`/`scope`. |
+| **Warning** | `medium` for ordinary substantive non-blocking items. A security/correctness/data finding follows the same §3 reachability axis as the **Critical** row: `high` when the unsafe outcome is not reachable on this merge, `critical` when it is — note the Warning filing in `title`/`scope`. |
 | **Suggestion** | `low` or `nit`: substantive improvement → `low`; pure style/optional → `nit`. |
 
 **Common mistake:** report **Warning** is not a valid `severity` string; there is no `warning` in the enum (see legacy below).
 
-### 5. Legacy `"severity": "warning"`
+### 5. Cross-chain vocabulary (one axis, four labels)
+
+The blocking judgement is decided **once**, on the §3 axis. Each chain's label set is a different projection of that one decision — map by **axis band**, never by label shape:
+
+| Blocking judgement (§3 axis) | register `severity` | audit Merge class | plan-QC report section | L2 task review |
+| ---------------------------- | ------------------- | ----------------- | ---------------------- | -------------- |
+| **Blocking** — unsafe outcome reachable on this change/merge | `critical` | `must-fix` | **Critical** | `Critical` |
+| High impact, non-blocking — unsafe but not reachable here, or significant tech debt | `high` | `should-fix` | **Warning** | `Important` |
+| Substantive, non-blocking — below the above | `medium` | `should-fix` | **Warning** | `Important` |
+| Small and cheap | `low` | `nit` | **Suggestion** | `Minor` |
+| Style / naming / wording | `nit` | `nit` | **Suggestion** | `Minor` |
+
+**A cross-chain translation never changes the judgement** — a label is a projection of the axis, so moving a finding between chains must not promote or demote it.
+
+### 6. Legacy `"severity": "warning"`
 
 In old JSON, **`"severity": "warning"`** is read and rolled up as **`low`**. **Forbidden** on new entries.
 
@@ -238,14 +254,14 @@ Intent: clear findings in the current plan session whenever possible. Open resid
 1. After QC: default path is **fix-now + targeted re-review**, not `Approve with residuals`.
 2. Do **not** register open R# for items that can be fixed in this session.
 3. **`nit`**: fix in-session **or** drop with no R# (existing “no tracking needed”); **never** open residual for style-only nits.
-4. **`Approve with residuals`** only when every remaining open item is a true blocker-defer (`decision: defer`, `target` = next iteration/milestone, Durable Roadmap Gate written).
+4. **`Approve with residuals`** only when every remaining open item is a true blocker-defer (`decision: defer`, `target` = next iteration/milestone, Durable Roadmap Gate written) — **except `critical`** (unsafe outcome reachable on this merge, §3): a `critical` is fixed now, or the risk is explicitly accepted and the entry is **closed** per item 6, never left open as the approval's remaining item.
 5. **True defer** only: external dependency; product/scope decision for a later iteration; or explicit **current-turn** user defer — plus Durable Roadmap Gate.
 6. **`waived` / `risk-accepted`**: still require PM + user/architect alignment; **close in the register** (do not leave open). Prefer a cheap fix over waive-as-shortcut.
-7. Plan **Done**: prefer an empty `entries[<plan_id>]` in the register. If any open entries remain, **every** one must be blocker-defer + roadmap; otherwise keep `InReview` / `Blocked`.
+7. Plan **Done**: prefer an empty `entries[<plan_id>]` in the register. If any open entries remain, **every** one must be blocker-defer + roadmap and none may be `critical` (item 4); otherwise keep `InReview` / `Blocked`.
 
 ### `allow-residual` (legacy default)
 
-Non-blocking Warning/Suggestion may ship with open register entries and `Approve with residuals` when no unresolved Critical remains (existing residual lifecycle unchanged).
+Non-blocking register entries — `severity` below `critical` on the §3 axis — may ship with open entries and `Approve with residuals` when no unresolved `critical` remains (existing residual lifecycle unchanged).
 
 > **Engine check (when available):** run `mstar status findings-cleanup <plan-id> [--project <id>] [--mode zero-residual|allow-residual]` (or import `findingsCleanupGate` from `@mstar-harness/engine` in a host hook) to enforce the mode above against the plan's register entries. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 

package/harness-skills/mstar-artifacts/templates/plan.main.md

@@ -14,7 +14,7 @@
 
 ## Global Constraints
 
-[Project requirements — version floors, naming, exact values — copied verbatim from spec. Every task includes them. Verification scope follows `mstar-harness-core` § 定向执行与验证边界: only changed behavior and direct contracts; no local full suites without explicit user permission.]
+[Project requirements — version floors, naming, exact values — copied verbatim from spec. Every task includes them. Verification scope follows `mstar-harness-core` § 定向执行与验证边界: only changed behavior and direct contracts; no local full suites without explicit user permission. Never assign real-browser/device/installed-deployment E2E evidence as a task or a gate of a development plan; each layer proves itself with its own unit/integration tests. Real-environment verification lives only in a separately requested `mstar-e2e` workflow, whose named scenarios are that workflow's own plan rows.]
 
 ---
 

package/harness-skills/mstar-audit/references/pr-review.md

@@ -187,11 +187,13 @@ Classify each **accepted** finding (after vet) as exactly one class. Do not inve
 
 | Class | Use when | Verdict effect |
 | --- | --- | --- |
-| `must-fix` | Shipping this issue is unsafe: correctness bug, security hole, data loss, auth/authz bypass, or a broken public contract. Same meaning as today's `blocked` gloss ("a must-fix issue stands in the way of shipping"). | Any count ≥ 1 → `blocked` |
-| `should-fix` | A real issue that should be addressed before merge but is not itself a ship-stopper. Same meaning as today's middle gloss ("issues found; address before merge"). | Else if count ≥ 1 → `needs fixes` |
+| `must-fix` | Shipping this issue is unsafe **and** the unsafe outcome is reachable in the reviewed change: correctness bug, security hole, data loss, auth/authz bypass, or a broken public contract. This is the same class the register records as `critical` (class pointer below). Same meaning as today's `blocked` gloss ("a must-fix issue stands in the way of shipping"). | Any count ≥ 1 → `blocked` |
+| `should-fix` | A real issue that should be addressed before merge but is not itself a ship-stopper: unsafe but **not** reachable in this change, significant tech debt, or otherwise substantive non-blocking — the register's `high` / `medium` bands. Same meaning as today's middle gloss ("issues found; address before merge"). | Else if count ≥ 1 → `needs fixes` |
 | `nit` | Optional cleanup, naming, comment, or small suggestion that does **not** change merge-readiness. Lint-covered cosmetics stay ignored (existing lens rule) — they are not findings. | Does not change verdict |
 
-Tie-break: unsafe to ship → `must-fix`; should be addressed before merge but ship-safe → `should-fix`; otherwise `nit`. A LOW-confidence smell that fails evidence rules is **not** a finding (existing disqualify rules) — put it on `- unverified:` if it must be mentioned.
+**Class ↔ register:** these three classes are this chain's projection of the one blocking judgement — the register `severity` value, plan-QC report section, and L2 task-review label sitting at each band are tabulated in `mstar-artifacts` `references/status-and-residuals.md` § Residual findings: `severity` → §5 Cross-chain vocabulary. Translate by band; never re-grade on translation.
+
+Tie-break: unsafe to ship **and reachable in this change** → `must-fix`; should be addressed before merge but ship-safe → `should-fix`; otherwise `nit`. A LOW-confidence smell that fails evidence rules is **not** a finding (existing disqualify rules) — put it on `- unverified:` if it must be mentioned.
 
 Presumptive-structural classes: a refactor that relocates complexity instead of reducing it · a change pushing a file past the size boundary with no decomposition · feature logic added to a shared module · a near-duplicate of an existing canonical helper · a silent fallback hiding an unclear invariant → default `should-fix`; downgrade to `nit` only with a stated reason; never `must-fix` on shape alone without correctness/security evidence.
 

package/harness-skills/mstar-e2e/SKILL.md

@@ -16,7 +16,7 @@ This is an explicitly requested verification workflow, separate from development
 ## Workflow
 
 1. **PM scopes the request.** Record the existing user authorization, build/ref, environment/device, named scenarios and expected results, permitted side effects, capability, and report path. Ask only for missing required inputs; never infer production, accounts, or devices. Reuse relevant knowledge without a new global scan.
-2. **PM registers independent work.** Use existing workflow `type: plan`, its own workflow/plan IDs and working context. Snapshot states are `running | paused | completed | failed | stopped`; plan rows use `Todo → InProgress → InReview → Done/Blocked`. Do not insert an iteration phase, ordinary QA gate, or automatic QC tri-review into a verification-only run.
+2. **PM registers independent work.** Use existing workflow `type: plan`, its own workflow/plan IDs and working context. Snapshot states are `running | paused | completed | failed | stopped`; plan rows use `Todo → InProgress → InReview → Done/Blocked`. Do not insert an iteration phase, ordinary QA gate, or automatic QC tri-review into a verification-only run. The scenario rows registered here are the legitimate exception to the "never a development plan's task" boundary in `mstar-harness-core` § 定向执行与验证边界 — that boundary governs development plans, not this verification-only workflow.
 3. **PM dispatches ops.** Use `Execute as: ops-engineer`, `Task category: ops`, `Delegation: forbidden`, and the existing Scope / Inputs / Constraints / Evidence Required / Acceptance Criteria fields. Pass the concrete report path under `{WORKFLOW_DIR}/<workflow-id>/reports/e2e.md`. Ops executes only the named scenarios and records actual results using `references/report-template.md`.
 4. **Run independent scenarios concurrently** when sessions, devices, data, and writable state are isolated. Serialize shared state. Stop when the assigned scenarios finish; new environments or broader suites need matching user authorization.
 5. **PM reviews the scoped report and closes.** `InReview` means report acceptance against the scenario list, not another broad code review. Ops returns evidence and cannot mark Done. PM owns the final plan/workflow state and any bounded repair handoff; preserve the originating iteration's state and unit-test evidence.

package/harness-skills/mstar-harness-core/SKILL.md

@@ -137,9 +137,10 @@ Read **`mstar-host`** after this skill; detect host per its table, then Read the
 
 - **本地全量测试默认禁止，完整套件交 CI。** 只有用户明确许可才能例外；Assignment 的 `Constraints` 引用许可，`Evidence Required` 写明命令、范围、环境与次数。PM 字段、风险等级、缺证据、fix wave 和早期探索都不产生许可；不得拆成多个无关“小测试”绕过全量边界。
 - **全域只读调查限早期探索。** 实现、fix、QC、QA 只查本次变更、直接影响接口及相关 knowledge；不重新全仓扫描、测试或审查。通过知识索引只选相关 Active 条目；缺口超出范围时报告具体所缺信息，不自行扩展任务。
+- **只读审查席位有界。** review / QC / L2 task review 的范围是 Assignment 的 diff pack 加直接影响接口；只在 must-fix 线索上跟进出界。默认 **≤ 12 次文件打开或 ≤ 10 分钟**（PM 按 Assignment `Budget` 收紧，不得放宽）；席位还必须写明 `Return shape`（返回什么、如何在预算内停下），干净轮次显式返回 `findings: []` 而非散文。`Task category: audit` 的轮次同受这两项约束，即使 `Execute as` 不在 QC 席位集内（`audit` 类请求可落在 `@code-reviewer` 之外的执行者上）。触达即停止扩展：返回当前 verdict 与已得 findings，并在报告 `## Scope` 声明 `Truncated coverage:`。**截断 ≠ `Unconfirmed`**——后者仍是证据通道失败态并阻断 `Approve`；未覆盖范围按既有「未提及 = 未审查」由 PM 汇总，且部分覆盖的运行不可作为批准——门禁语义 → `mstar-review-qc`。
 - **验证按变更映射。** 可执行逻辑使用对应单测；非可执行文档与 prompt/skill 策略使用真实定向静态或 before/after 证据，不制造测试文件。SDD 的 `Verification mode: scoped-check` 格式与适用性 → `mstar-sdd/references/file-handoffs.md`。报告结构校验不证明命令执行或 diff 适用性，也不是任意 shell 拦截器。
 - **只使受影响证据失效。** HEAD 或 Review range 改变不等于全部重跑；复用仍有效的 L1/CI/先前 QA 证据，记明原范围及仍适用的理由。fix 只验证相关回归；QC 复审只看归属 finding、fix delta 与直接接口。`full tri-review` 表示席位数量，不授权全仓 review；QC 不运行 test/build/install。
-- **QA 仅定向单元测试与验收证据映射。** 模式仅 `acceptance-only` / `targeted` / `report-only`。用户许可的本地全量由实现 owner 或 ops 另接明确行动，QA 只消费证据。真实浏览器、真机、安装/部署 E2E 仅由用户显式启动独立 `mstar-e2e` workflow，PM 编排、ops 执行；不作为迭代 QA gate。未验证的真实环境行为如实记录，不伪称通过。
+- **QA 仅定向单元测试与验收证据映射。** 模式仅 `acceptance-only` / `targeted` / `report-only`。用户许可的本地全量由实现 owner 或 ops 另接明确行动，QA 只消费证据。真实浏览器、真机、安装/部署 E2E 仅由用户显式启动独立 `mstar-e2e` workflow，PM 编排、ops 执行；**不作为迭代 QA gate，也不作为开发 plan 的 task 或任何 gate 的证据义务**——各层以自身单测/集成测试自证；真实环境验证只在该独立 workflow 内发生，其命名场景即该 workflow 的 plan rows。未验证的真实环境行为如实记录，不伪称通过。
 - **依赖允许即并行。** PM 对无依赖、写所有权及 worktree 隔离的 ready tasks 并行派发；共享写目标、同一 session/ledger、前置接口与 integration merge 才按具体约束串行。leaf 不因并行策略获得派发权限。
 - **完成即交付。** Assignment 给出任务、输入、所有权、允许检查与可观察结果；执行者只解答这些问题，不重复分析已解决内容、不顺手修复或增加“保险”检查。真实范围缺口返回 PM，已有证据充分即停止。
 

package/harness-skills/mstar-iteration/references/phase-2-worktree-lease.md

@@ -26,7 +26,7 @@ starts at **Phase 2 entry**.
 
 **本 Phase 定义 per-plan 派发循环的完整流程**：前置条件检查、session todos、backlog 读取、integration 分支管理、per-plan dispatch 循环（分支→实现→QC→**QA gate**→Done→合并）、dispatch-first 约束。PM 读取本 Phase（含 §2.0–§2.5 与下方 lease 细则）即可执行迭代。
 
-**Findings cleanup（默认）**：Phase 2 每个 plan Assignment 默认 **`Findings cleanup: zero-residual`**（可修 findings 当轮 fix→re-review 清干净；仅真 blocker-defer + Durable Roadmap 可留 open R#）。compass 或 Assignment 可显式覆写为 `allow-residual`。SSOT → **`mstar-artifacts`**「Findings cleanup modes」。
+**Findings cleanup（默认）**：Phase 2 每个 plan Assignment 默认 **`Findings cleanup: zero-residual`**（可修 findings 当轮 fix→re-review 清干净；仅真 blocker-defer + Durable Roadmap 可留 open R#，`critical` 不属 defer）。compass 或 Assignment 可显式覆写为 `allow-residual`。SSOT → **`mstar-artifacts`**「Findings cleanup modes」。
 
 ## 2.0 前置条件（五道闸）
 
@@ -212,7 +212,7 @@ Iteration Phase 2 附加：
 - PM **NEVER** 在 PM 线程实现产品代码（delegate dev；hotfix 例外见 **`mstar-phase-gates`**）
 - `Subagent invokes issued: 0` 而 Assignment 已写出 → **`dispatch incomplete`**；下一条补发 invoke，禁止 PM 顶替
 - QC 初轮：**SDD → N=3**；**inline → N=1**；plan QC tri 三席 **同条消息 N=3**（非 implement 轨数）
-- **`Findings cleanup: zero-residual`（默认）**：QC 后可修 Warning/Suggestion → 继续 fix→targeted re-review，直至 clean `Approve` 或仅剩真 blocker-defer；**禁止**把可修项登记为 open residual 草草 `Approve with residuals`
+- **`Findings cleanup: zero-residual`（默认）**：QC 后可修 Warning/Suggestion → 继续 fix→targeted re-review，直至 clean `Approve` 或仅剩真 blocker-defer（`critical` 不属 defer —— 定义 → **`mstar-artifacts`**「Findings cleanup modes」）；**禁止**把可修项登记为 open residual 草草 `Approve with residuals`
 
 ## Feature worktree (per plan)
 

package/harness-skills/mstar-phase-gates/SKILL.md

@@ -110,6 +110,7 @@ per-plan Done 是 per-plan 的闭环终点；compound 是迭代级收口活动
 - Prepare 阶段证据：问题定义、歧义结论、plan 链接。
 - Execute 阶段证据：tasks 清单、实现自检、审查/验证证据。
 - 结论证据：不得仅写"done"，必须可复核（命令、输出、截图或复现步骤）。
+- **证据与变更同层。** 单测/集成测试是 plan task 的默认证据；**开发 plan** 中，真实浏览器、真机、安装/部署 E2E **不写成 task，也不构成任何 gate 的证据义务**——各层自行测试，缺环境如实记为未验证。这类验证的**唯一**落点是用户显式请求的独立 `mstar-e2e` workflow：该 workflow 自身以 plan 注册并承载命名场景，是此边界的合法例外（授权来源见 `mstar-harness-core` § 定向执行与验证边界）。issue/需求/验收文本中出现的端到端场景**不构成**在开发 plan 中加 task 的授权。
 
 ## References
 

package/harness-skills/mstar-project-governance/SKILL.md

@@ -89,7 +89,7 @@ Register 文档形状（`entries[<plan-id>]` 数组 JSON）、**9 个必填字
 ### Findings cleanup（与 Assignment 联动）
 
 - Assignment **`Findings cleanup: zero-residual | allow-residual`** 是唯一 mode 来源（`metadata.findings_cleanup` mirror 已删）；迭代 Phase 2 默认 `zero-residual`。
-- `zero-residual`：可修 findings 当轮 fix → re-review 清干净；仅真 blocker 可 defer 且须 Durable Roadmap + `target`；`nit` 必须当场修或删；waived/risk-accepted 必须关闭，不得留 open。
+- `zero-residual`：可修 findings 当轮 fix → re-review 清干净；仅真 blocker 可 defer 且须 Durable Roadmap + `target`（`critical` 不属 defer —— 定义 → **`mstar-artifacts`**「Findings cleanup modes」）；`nit` 必须当场修或删；waived/risk-accepted 必须关闭，不得留 open。
 - `allow-residual`：仅 unresolved **critical** 阻止 Approve。
 - mode 全文与 enforcement → **`mstar-artifacts`** `references/status-and-residuals.md`（「Findings cleanup modes」+ 其 engine check）。
 

package/harness-skills/mstar-review-qc/SKILL.md

@@ -38,7 +38,7 @@ description: "Morning Star QC orchestration — **SDD mandatory plan QC tri-revi
 ## Residual Findings 留档门禁（PM）
 
 - 先读 Assignment **`Findings cleanup`**（`plans[].metadata.findings_cleanup` mirror 已删——Assignment 是唯一 mode 来源）→ **`mstar-artifacts/references/status-and-residuals.md`**「Findings cleanup modes」。
-- **`Findings cleanup: zero-residual`**（iteration Phase 2 默认）：可修 **Warning / Suggestion / Critical** → **fix-now + targeted re-review**，**禁止**把可修项登记为 open R# 或用 `Approve with residuals` 收口；**`nit`** 当场修或丢弃（无 R#）。仅 **真 blocker-defer**（外部依赖 / 须下轮产品决策 / 用户本轮显式 defer + Durable Roadmap）可登记 open R#（`decision: defer`）。此时 `Approve with residuals` **仅**允许剩余项全是该类 defer。
+- **`Findings cleanup: zero-residual`**（iteration Phase 2 默认）：可修 **Warning / Suggestion / Critical** → **fix-now + targeted re-review**，**禁止**把可修项登记为 open R# 或用 `Approve with residuals` 收口；**`nit`** 当场修或丢弃（无 R#）。仅 **真 blocker-defer**（外部依赖 / 须下轮产品决策 / 用户本轮显式 defer + Durable Roadmap）可登记 open R#（`decision: defer`）。此时 `Approve with residuals` **仅**允许剩余项全是该类 defer，且**不含 `critical`**（不安全后果本次 merge 可达，见上文「Findings cleanup modes」）；`critical` 当场修复，或走显式 risk acceptance 并在 register 内关闭，**不得**作为批准遗留项。
 - **`Findings cleanup: allow-residual`**（standalone / hotfix / inline 默认）：阻断项修复后仍有 **Warning / Suggestion** 或技术债 → 必须留档；**`Approve with residuals`** 仅当无 open **Critical**；PM 汇总结论须含 residual 清单与跟踪位置。
 - **`severity`** 仅允许 `mstar-artifacts/references/status-and-residuals.md` 枚举。
 - **Open SSOT**：`{PROJECT_DIR}/<id>/residuals.json`（默认 `{HARNESS_DIR}/projects/<id>/`；无项目流程 `_default`）→ `entries[<plan-id>]`；PM 在 consolidated 决策分配 **R1…** 并写入。关闭 → 在 register 内 **in place** 置 `lifecycle` / `closed_at` / `closure_note`（v1 `archived/residuals/` 与 `archive-residuals` 已移除）。
@@ -60,6 +60,14 @@ Leaf reviewers apply verdict per **`mstar-roles/references/qc-specialist/report-
 - **汇总层零注入**：consolidated 中每条发现可溯源到某 `qcN.md`；PM 不得在汇总层引入席位报告之外的新声明（PM 自身观察走独立 Status Update，不混入 gate 决策输入）。
 - **Unconfirmed 传导**：任一席位 verdict = `Unconfirmed`（`report-template.md` 定义的证据通道失败态）→ gate 决策不得为 `Approve`——先补证据（重发 review-package / 修 diff 基线）再收敛；受影响席位走既有 targeted re-review 机制（同 `qcN.md` `## Revalidation` 原位更新 verdict），不新增 re-review 形态、不改 N 规则。
 
+### 席位预算与截断（PM）
+
+- **座次不放宽范围。** N=3 只增加视角：每个席位仍只审其 diff pack 与直接影响接口，预算也不因席位增加而变宽。PM 用 Assignment `Budget` 收紧；默认与数字 SSOT → **`mstar-harness-core`** § 定向执行与验证边界。
+- **截断报告保留 verdict。** 席位因触达预算而声明 `Truncated coverage:` 时，其 verdict 有效，PM **不得**因此升级为 `Unconfirmed`——`Unconfirmed` 仍是证据通道失败态（见上条传导规则）。
+- **未覆盖范围不改写门禁。** 席位 verdict 只涵盖其已审范围：当 Assignment 范围未被完整覆盖时，**gate decision 不得为 `Approve`**。PM 二选一——把未覆盖范围按 targeted re-review 重新派发（席位在预算内补完），或显式收窄 `Review range` 并把收窄依据记入 `qc-consolidated.md` 后再收敛。截断范围仍按「未提及 = 未审查」在 `qc-consolidated.md` 中如实标注 `unreviewed`，PM 不重审无关内容来补全它。
+
+> **Engine check (when available):** run `mstar qc validate-report <report.md>` on each seat report (and `mstar dispatch validate <assignment-file>` for the Assignment-side round-bounding gate — `Budget` + `Return shape` on review / audit rounds; or `import { validateQcReport } from "@mstar-harness/engine"` in a host hook). On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
+
 ## 证据规则（PM · consolidated 输入）
 
 - Critical 发现须含触发条件、影响范围、修复建议。

package/harness-skills/mstar-roles/references/code-reviewer.md

@@ -45,6 +45,18 @@ Layering anchor: `mstar-review-qc/references/review-responsibility-boundaries.md
 
 `⚠️ Cannot verify from diff` items do not block other findings — PM resolves them before marking the task complete.
 
+### Issue severity (Mode A)
+
+`Critical` / `Important` / `Minor` are this mode's projection of the one blocking judgement — the axis itself is defined once in `mstar-artifacts` `references/status-and-residuals.md` (§ Residual findings: `severity` → §5 Cross-chain vocabulary). Do not re-derive its ladder here.
+
+| Label | Threshold on the axis | Effect |
+| --- | --- | --- |
+| `Critical` | Unsafe **and** reachable in this task's diff: correctness bug, security hole, data loss, auth/authz bypass, broken public contract. | Blocks the task — drives the per-task fix loop (`mstar-sdd` `references/file-handoffs.md` § Fix loop). |
+| `Important` | High-impact but non-blocking: unsafe but **not** reachable in this diff, significant tech debt, or otherwise substantive. | Drives the per-task fix loop (same). |
+| `Minor` | Small and cheap, or style / naming / wording only. | Not a fix-loop driver — handed to `## Minor (for plan QC)` in the same ledger file (`mstar-sdd` SKILL.md). |
+
+Mode B (audit) does not use this vocabulary either — it reports with the audit finding format (`Impact` / `Effort` / `Risk` / `Confidence` per finding, no severity class; `mstar-audit` `references/finding-format.md`) and ranks plans by `Priority` in the audit index (`mstar-audit` `references/codebase-audit.md` § Execution order & status). Mode C (PR review) is the only mode that classifies with the **Merge class** (`must-fix` / `should-fix` / `nit`; `mstar-audit` `references/pr-review.md` § Merge class — PR findings only). Never mix label sets in one report.
+
 ## Mode B — Audit Executor (`Task category: audit`)
 
 - Execute the `mstar-audit` codebase-audit variant: SKILL.md common core (Recon → Vet & prioritize) + `references/codebase-audit.md` (Audit — parallel category scout fan-out; ≤4 concurrent `standard`, ≤8 `deep` → Write plans at `{PLAN_DIR}/audit-<date>/`).

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -11,6 +11,7 @@ The concise gate summary remains in `references/project-manager.md`.
 - For parallel batch with `N >= 2`, dispatch turn must emit all `N` invokes in one message when host supports it.
 - **Same-repo writable parallel tracks**: tool concurrency and worktree isolation are **separate gates**. Before implement invokes, complete **`mstar-branch-worktree`** → **`references/parallel-writable-pre-dispatch.md`**.
 - **Scope and stopping are explicit**: apply `mstar-harness-core` § 定向执行与验证边界. Give each leaf one result, owned paths/symbols, relevant inputs, named checks/selectors, and an evidence-based stopping condition. Reuse unaffected evidence; do not inject a suite merely because the repo exposes it. Independent ready assignments run concurrently after their dependency/isolation checks.
+- **Review/QC rounds are quantitative, not adjectival**: a read-only review / QC dispatch states a `Budget` (expansion cap) and a `Return shape`, so the seat stops when its assigned questions are answered or the cap is reached, returns the verdict it has plus a truncated-coverage declaration, and never expands until a human steers. Budget defaults, the truncation marker, and its relation to `Unconfirmed` → `mstar-harness-core` § 定向执行与验证边界. The severity bar for the round's findings → `mstar-artifacts` `references/status-and-residuals.md`.
 - **Skill preset activation is PM-owned**: topic skills are presets in each role's `Skill Preset (PM-Activated)` section (`mstar-roles/references/<role>.md`), not self-loaded defaults. Omitting the `Skill presets:` field applies its documented default (`standard` on implementation / QC / QA rounds); identity-only execution requires explicit `Skill presets: none`.
 
 ## Executor Anti-Recursion Rules
@@ -50,6 +51,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - Anti-patterns must be action-oriented ("auto-dispatch to …", "treat … as invoke", "start … before …") — not abstract descriptions.
 - If the assignment involves multiple QCs or parallel tracks, add a specific bullet about NOT serializing or pre-empting the parallel dispatch.
 - If the assignment is part of a broader staged plan with follow-up tasks, add a bullet about NOT auto-extending scope into downstream tasks.
+- **Anti-pattern — unbounded negative acceptance:** an Acceptance Criterion phrased as a repo-wide negative property ("prove no surviving claim of X anywhere", "make sure nothing else uses Y") with no termination rule. Scope it to the assigned diff pack plus directly affected interfaces, or state the budget that bounds the search — the seat stops there and declares what it did not cover. An open-ended "prove no X anywhere" acceptance is a dispatch defect, not a review task.
 
 ```markdown
 ## Assignment
@@ -116,6 +118,10 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - In: <owned files/symbols, directly affected interfaces; finding + fix delta for re-review>
 - Out: <excluded work and specific boundary>
 **Inputs**: <brief, diff, relevant knowledge, reusable evidence with original range>
+**Budget (review / QC seats)**: <expansion cap (file opens / wall clock) — may only tighten the default in `mstar-harness-core` § 定向执行与验证边界, never loosen it; `N/A` on implement / ops rounds>
+**Return shape (review / QC seats)**: <what the seat returns and how it stops — verdict + findings shape; a clean round returns `findings: []` explicitly instead of prose; `N/A` when the round produces no findings>
+**Severity bar**: <what this round must treat as blocking — the blocking classes are unsafe-to-ship or significant tech debt; class definitions and the full report-section mapping → `mstar-artifacts` `references/status-and-residuals.md`; `N/A` on rounds with no findings>
+**Input provenance**: <how the seat grounds its claims — the command plus observed output for a `declared` / `recorded` / `written` artifact claim, and provenance for an asserted `path:line` citation; `N/A` when the round asserts neither>
 **Deliverables**: ...
 **Acceptance Criteria**:
 - [ ] ...
@@ -123,7 +129,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - [ ] <AC → exact affected unit-test selector or scoped static check; expected result>
 - [ ] <reused evidence + why unchanged, or new observable proof>
 - [ ] commit proof
-**Constraints**: <no scope expansion; no local full suite without referenced explicit user permission; QA unit-only; no spontaneous browser/device/E2E; stop on concrete missing inputs and return once acceptance is evidenced>
+**Constraints**: <no scope expansion; no local full suite without referenced explicit user permission; QA unit-only; no spontaneous browser/device/E2E; review / QC seats stop at the assigned budget and declare truncated coverage instead of expanding; stop on concrete missing inputs and return once acceptance is evidenced>
 **Effort (agent-oriented)**: <XS/S/M/L/XL + session band>
 **Orchestration Guard** (see `**You are a leaf executor. You MUST NOT:**` block at top for primary anti-patterns):
 - No recursive same-role dispatch
@@ -135,6 +141,13 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 **Execution evidence**: <RCA/test-first/review feedback/evidence expectations for the assignee, if applicable>
 ```
 
+## PM Self-Check (artifact claims and citations)
+
+State a claim only as strongly as the evidence in hand:
+
+- An artifact claim — `declared` / `recorded` / `written` — is stated only together with the command and the observed output that shows it; without both, describe the artifact as pending rather than done.
+- An asserted `path:line` carries its provenance: a normative-document citation is traced (`git show <ref>:<path>`) or fetched raw with a content identity check, so the quoted text is shown to come from the revision being cited — not from memory of the file.
+
 ## L1 path fields (iteration Phase 2, lease gate not waived)
 
 When iteration **L1** is active (the integration worktree is recorded in the workflow snapshot `integration_worktree_path`; worktree mode is **not** waived):

package/harness-skills/mstar-roles/references/project-manager/qc-and-residuals.md

@@ -69,9 +69,9 @@ Read Assignment **`Findings cleanup`** first (`mstar-artifacts` — Findings cle
 
 - Prefer **fix-now + targeted re-review** for Critical / Warning / Suggestion that can be fixed this session.
 - **NEVER** park fixable findings as open R# or use `Approve with residuals` for them.
-- Register open R# **only** for true blocker-defers (`decision: defer` + Durable Roadmap + `target` next iteration/milestone).
+- Register open R# **only** for true blocker-defers (`decision: defer` + Durable Roadmap + `target` next iteration/milestone) — never a `critical` (`mstar-artifacts` Findings cleanup modes).
 - `nit`: fix or drop (no R#).
-- Plan Done: prefer empty open list; any remaining open R# must all be blocker-defer + roadmap.
+- Plan Done: prefer empty open list; any remaining open R# must all be blocker-defer + roadmap — never a `critical` (`mstar-artifacts` Findings cleanup modes).
 
 ### When `Findings cleanup: allow-residual` (or unset outside iteration Phase 2)
 

package/harness-skills/mstar-roles/references/qc-specialist/report-template.md

@@ -6,6 +6,8 @@ Extension of `references/qc-specialist-shared.md`. Frontmatter and path rules re
 
 Write under the Assignment-provided **`{SDD_DIR}/review/qc#.md`** (`qc1`…`qc3` or `qc.md`). YAML frontmatter first (see `qc-specialist-shared.md`), then:
 
+**Machine-checked lines** (`mstar qc validate-report <report.md>`): the frontmatter fields `report_kind` / `reviewer` / `reviewer_index` / `plan_id` / `verdict` / `generated_at`; the body `**Verdict**:` line must agree with the frontmatter `verdict` (trailing prose is fine); each `## Summary` count must equal the top-level entries under the matching `## Findings` severity section — `## Summary` and `## Findings` are the report's SINGLE current state, so an in-place revalidation refreshes both instead of appending a second tally (`qc-specialist-shared.md` § Targeted re-review); `Approve` is refused while Critical/Warning counts are non-zero; `Unconfirmed` is refused while the report declares `Truncated coverage:`. A cap stop is not a channel failure — keep the earned verdict and write the truncation line.
+
 ```markdown
 # Code Review Report
 
@@ -24,6 +26,7 @@ Write under the Assignment-provided **`{SDD_DIR}/review/qc#.md`** (`qc1`…`qc3`
 - Working branch (verified): {name}
 - Review cwd (verified): {path from git rev-parse --show-toplevel}
 - Files reviewed: {count}
+- Truncated coverage: {present only when the seat budget stopped expansion — name what was not covered; omit this line otherwise. The verdict stands: truncation is not `Unconfirmed`}
 - Commit range (if not identical to Review range line, explain): {hash..hash}
 - Analysis methods: {e.g. git-diff, read, grep, deep-lens: <names> — not test/build runs}
 

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-workflow.md

@@ -29,7 +29,7 @@ Layer SSOT → `mstar-review-qc/references/review-responsibility-boundaries.md`.
 2. **Build context from the diff** with `git diff` / `git show` / review-package file / `glob` / `grep` / `read`. Use the supplied relevant knowledge/context; do not launch global exploration or delegate navigation.
 3. Re-verify branch vs **`Working branch` / `Branch policy`** before concluding.
 4. **Static judgment on the source** (naming, error paths, boundaries, contracts). Default tooling = read/grep only. **Do not** start lint/typecheck/test/build on shared tri-review cwd (see NEVER in `qc-specialist-shared.md`).
-5. Apply only the **`reviewer-checklist.md`** items affected by the diff. Reuse unchanged L2 evidence; re-review only the assigned findings and fix delta. Stop when these questions have evidence.
+5. Apply only the **`reviewer-checklist.md`** items affected by the diff. Reuse unchanged L2 evidence; re-review only the assigned findings and fix delta. **Stop** when the assigned review questions are answered or the Assignment **`Budget`** is reached (default → `mstar-harness-core` § 定向执行与验证边界) — no repo-wide tracing to "be sure". A budget stop keeps the verdict and records `Truncated coverage:` in `## Scope`; it is never a reason to emit `Unconfirmed`.
 6. Produce structured findings with severity and evidence. PM maps report sections to register **`severity`** (`projects/<id>/residuals.json` → `entries[<plan-id>]`) per `mstar-artifacts/references/status-and-residuals.md` — do not invent non-canonical severity strings.
 7. **Write report:** Write `.md` to the Assignment-provided `{SDD_DIR}/review/` report path. Do not commit raw bundle reports unless Assignment explicitly says `Review archive mode: tracked reports`.
 8. **No stall:** When done, emit **Completion Report** in the same turn — no “notify PM?” choosers.

package/harness-skills/mstar-roles/references/qc-specialist-shared.md

@@ -21,6 +21,8 @@ Your output is a structured QC report plus Completion Report.
 
 **Scope:** follow **`mstar-harness-core`** § 定向执行与验证边界. Initial review covers assigned changed hunks and directly affected interfaces; reuse L2 evidence. Re-review covers only assigned findings and fix delta. Seat count never authorizes full-repository review or fresh global exploration.
 
+**Budget and stopping (hard):** honour the Assignment **`Budget`** and **`Return shape`** (return the declared verdict + findings; a clean round returns `findings: []` explicitly instead of prose); when `Budget` is omitted, the default in the core section applies — it may be tightened, never loosened. Follow past the assigned range only on a must-fix trail. On reaching the budget, stop expanding: keep the verdict for what was reviewed and declare `Truncated coverage:` in the report `## Scope`. A cap stop is **not** `Unconfirmed` — the evidence channel was intact, only scope was cut; `Unconfirmed` stays reserved for a failed channel. The Assignment-side presence of `Budget` and `Return shape` is machine-checked by `mstar dispatch validate`, and the report-side `Truncated coverage:` / verdict pairing by `mstar qc validate-report` (see the engine check in **`mstar-review-qc`** § 席位预算与截断).
+
 **Do (L3):** Read `git diff` / review-package; reason about correctness, security, contracts, maintainability, reliability; flag coverage **gaps in the diff** (missing tests for changed behavior); write findings with evidence from source.
 
 **Do not (leave to L1 / L4):** Run test suites, builds, package installs, or heavy project toolchains that mutate caches — see NEVER rules and `reviewer-workflow.md`.
@@ -73,6 +75,7 @@ Write the Assignment-provided path under **`{SDD_DIR}/review/{report_suffix}.md`
 When Assignment includes **`QC re-review: targeted`**:
 
 - Edit the **same** bundle `{report_suffix}.md` — add **`## Revalidation`**, update frontmatter verdict/`generated_at`.
+- **Refresh the current state in place**: `## Summary` and the `## Findings` sections must describe the state AFTER the fix delta (a closed finding leaves its section, counts drop), so the report carries exactly ONE tally. `## Revalidation` records the process — what was re-checked, findings closed/kept per ID — and never holds a second count. Leaving the original `## Summary` counts in place while the verdict moves to `Approve` makes the report contradict itself.
 - Do **not** create `qcN-rev2.md` on this path.
 - Full tri re-review → new basenames per `mstar-artifacts/references/plan-files-and-reports.md`.
 

package/harness-skills/mstar-sdd/references/task-reviewer-prompt.md

@@ -39,12 +39,17 @@ Dispatch:
     Diff file: [DIFF_FILE]
 
     Read the diff file once. Do not re-run git. Do not mutate checkout.
-    Review only the assigned task diff and directly affected interfaces.
-    No repository-wide exploration or full test suite. Reuse relevant
-    implementer evidence; a specific doubt permits only the assigned focused
-    unit check. Non-executable docs/policy may use scoped-check evidence;
-    verify its applicability against the diff, never invent a test obligation.
-    Stop once the assigned acceptance questions are answered.
+    Review only the assigned task diff and directly affected interfaces;
+    no repository-wide tracing unless a blocking finding requires it.
+    No full test suite. Reuse relevant implementer evidence; a specific
+    doubt permits only the assigned focused unit check. Non-executable
+    docs/policy may use scoped-check evidence; verify its applicability
+    against the diff, never invent a test obligation. Stop once the
+    assigned acceptance questions are answered.
+    The task diff plus directly affected interfaces are this review's budget
+    (default bounded-seat cap → `mstar-harness-core` § 定向执行与验证边界);
+    when it is reached, stop there and return the assessment for what was
+    reviewed plus a `Truncated coverage: <what was not covered>` line.
 
     ## Output
 
@@ -55,7 +60,7 @@ Dispatch:
     ### Strengths
 
     ### Issues
-    #### Critical | Important | Minor
+    #### Critical | Important | Minor     # thresholds + fix-loop routing → mstar-roles/references/code-reviewer.md § Issue severity (Mode A)
 
     ### Assessment
     **Task quality:** Approved | Needs fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/dsh",
-  "version": "3.9.1",
+  "version": "3.9.3",
   "description": "Morning Star harness dsh (DeepSeek Harness) cordis function plugin — in-process engine gates (status/dispatch/lease) with hard refusal channels.",
   "keywords": [
     "dsh",