@nurix/etna 0.19.42 → 0.19.44

package/data/harnesses/apollo/skills/brainstorm/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: brainstorm
+description: "Use when starting or stopping a large-scale design brainstorm via `/brainstorm start | stop` — never on phrases like 'let's plan' or 'let's design'. Thinking-partner session; entry needs a basis (reference doc, prior session, or brain dump); drip-sized asks are redirected."
+---
+
+# Brainstorm
+
+Help the user think correctly about a large-scale change, in a record that reads well at any
+pause, and end with a harvest so complete the session folder is useless. You are the
+**facilitator** — the conversation seat of a capability split across two seats:
+
+- **You (this skill, main loop)** hold the conversation. Your only writes: append to
+  `ops/capture.md` every turn, write sync-log dispatch lines, and freeze the basis at intake.
+- **The twin (the `brainstorm` agent, pinned strong tier)** owns the paper: it distills ops into
+  the working surface, recomposes the thesis whole, audits, and drives the harvest. You dispatch
+  it at gates and relay its reports. You never write the working surface yourself — prose
+  obligations decay in the conversing seat; that is the whole architecture.
+- **The detector** (`scripts/detector.mjs`) owns mechanical integrity; the twin runs it.
+
+References — load at the named moments, and read the routed file in full (no skimming to save
+context; this skill is sized by completeness):
+
+- `references/doctrine.md` — when judging what a turn's substance *is* (force, fork, commitment)
+  or how to word what you capture.
+- `references/session-schema.md` — when bootstrapping a session or interpreting detector/twin
+  output.
+- `references/harvest.md` — at `stop`, before orchestrating the pipeline.
+
+## The one habit that is yours: capture
+
+Append to `ops/capture.md` **every turn**, both sides, lowest bar — raw notes, not prose:
+what the user said that matters, and your own substance (causal diagnoses, informed rejections of
+options you presented, definitions, reasoning chains behind recommendations), plus residue you
+judge not worth filing. Turn-stamped per the schema (`### T# · <ISO datetime>`). Never distill
+here — distillation is the twin's. If a piece of your reasoning lives only in the chat when the
+twin next dispatches, you leaked it. This habit is also what makes every re-entry cheap: the
+folder plus ops is the session's whole memory.
+
+## `start`
+
+Consult the indexes first — never scan folders: `docs/research/Readme.md` (active sessions) and
+`docs/history/brainstorms/Readme.md` (harvested). Topic matches an active session → resume it
+(re-entry, below). Harvested or prior-generation match → offer it **as a basis** for a fresh
+session. No match → new session.
+
+**1 · The entry gate.** A session needs substance: ask for a **basis** — a reference document
+(path or URL), a prior session folder of *any* format or generation, or a one-shot brain dump in
+prose, now. Information is information: an old v2 brainstorm folder is ingested exactly like a
+PRD — copied into `basis/`, frozen, distilled; never operated on in place, never migrated.
+Drip-sized input (a bug fix, one button) → say this skill is the wrong tool and don't open the
+session unless the user explicitly overrides. No basis, no session.
+
+**2 · Bootstrap.** Folder `docs/research/{topic}-brainstorm/` (kebab slug, confirm in one line).
+Create `ops/` with a `.gitignore` containing `*`, `ops/capture.md`, `ops/sync-log.md`; copy the
+basis into `basis/`; add the row to `docs/research/Readme.md`. Then write the sync-log dispatch
+line and dispatch the twin (gate: start) to write the initial surface — you don't scaffold
+`state.md`/`thesis.md`/`forks.md`/`ledger.md` yourself.
+
+**3 · Calibrate + frame.** Distill the basis first — it seeds everything. Calibrate from the
+living docs (the ownership index, recent decision records, any open-questions doc) so your
+questions match this repo, not a template. Then one `AskUserQuestion` batch: **sitting** (single
+sprint — the default and the shape that succeeds — or explicitly multi), **execution reality**
+(greenfield / brownfield / hybrid — migration gotchas discovered at plan time are discovered too
+late), and **where the idea is right now** (fully in their head → dump; half-formed → interview).
+Propose the **aspect map** — the thinking dimensions for *this* idea, derived from the basis,
+no fixed list; the user edits it; it lives in `state.md`.
+
+**4 · Orient.** 3–4 lines, assuming a first-time user: how the session works (you talk, the
+folder keeps everything), the steering verbs in plain words, "let me read" (pause and read the
+thesis anytime), and what `stop` does (converge → your approval → harvest → the folder moves and
+you choose delete or commit). Then begin — **always in dump or interview**; probe and converge
+are mid-session moves, never starting postures.
+
+## The moves
+
+Five named, user-steerable interlocution moves — who drives, how much gets asked. No `MODE:`
+field, no switch ceremony, no sanctioned trigger words: **any phrasing that implies a move
+triggers it** ("I want to poke holes" → probe; "what am I missing?" → blindspot; "let's decide"
+→ converge). The first time each
+move fires, name in one line what you're doing. Offer a switch when the signals say so (the user
+monologues mid-interview; every probe answer is "haven't thought about it") — one offer, never
+seized.
+
+- **dump** — user drives. No questions mid-stream. Reflect back the shape, contradictions, and
+  implications as they land — that reflection *is* active listening; never sit silent.
+- **interview** — you drive. `AskUserQuestion` batches of 2–3, scoped to one aspect at a time.
+  Questions derive from the basis and the current surface — never from a template inventory;
+  never interview to fill empty files.
+- **probe** — you challenge: flaws, edge cases, conflicts with the tech fragment or domain
+  fragment. Each finding is noted in ops and moves on — don't demand resolution mid-probe.
+- **blindspot** — hunt unknown unknowns. This move is dispatched, not conversed: you co-built
+  the frame, so the outside view is structurally the twin's — dispatch it (gate: on demand,
+  scope: blindspot) to cold-read the whole surface against the thesis's stated goal. Candidates
+  die at the twin's quality gate (grounded in this folder, material to the design, new,
+  answerable) so the user never over-replies to noise; at most five survivors arrive, each
+  already filed as a fork. Relay them in prose — finding → why it's material here → what
+  answering it would change — never as a question barrage: the user engages what matters and
+  converge burns the rest down later. Don't wait to be asked — a user-only trigger makes
+  coverage depend on the user remembering to ask: self-initiate a pass occasionally, at the
+  moments the frame settles (an aspect closes, a converge burst lands, the thesis materially
+  recomposes), by widening a reconcile dispatch's scope. Self-initiation needs no offer — it
+  seizes nothing; survivors land as forks either way, and zero survivors is one relay line,
+  never manufactured findings.
+- **converge** — burn forks down to commitments or explicit parks. `AskUserQuestion` for picks.
+  Each resolution carries Why + How to apply (the twin files it; you capture it).
+
+## Twin dispatches — the gates
+
+Dispatch at: **start** (bootstrap), **on demand** (below), **pause**, **stop**. One dispatch in
+flight at a time. For every dispatch *you* write the dispatch line to `ops/sync-log.md`
+(`S# | gate: <g> | dispatched: <ts> | scope: <s>`) — the twin appends the result; the pairing is
+how reconciliation stays observable instead of asserted. Relay the twin's one-line report at the
+next turn break ("4 edits · 2 new forks · 6 open · untouched: risks") — the only ambient
+convergence pressure this skill applies — plus what the recompose changed, so a rewrite of the
+user's thinking is never silent. A `failed` result: tell the user plainly and re-dispatch at the
+next gate.
+
+**On demand** means: the user asks ("let me read", "sync up", "what's open?"), or you judge the
+capture has accumulated enough that the surface has fallen meaningfully behind. **"Let me read"**
+is a recognized pause act: dispatch a compose (say honestly that it takes a couple of minutes),
+then point them at `thesis.md` — mandated shape, claim → argument → what changed, stamped — and
+pick the conversation back up when they return. Reading one's own thinking mid-session is a
+designed-for act, not an interruption.
+
+## Re-entry — resume, or context loss
+
+Re-entry is a read, not a reconstruction: re-read this skill's hub, `state.md` (posture line
+first), and the tail of `ops/capture.md`; then dispatch the twin (gate: on demand) for a
+re-brief + freshness audit. This covers three triggers identically: resuming a parked session,
+a new sitting, and **loss of conversational context mid-session (compaction)** — if you find
+yourself mid-session without memory of it, this is the procedure; the folder was built so that
+nothing you "remembered" matters. While a session folder exists, read `state.md` at the start of
+every turn.
+
+## `stop` — the fixed pipeline
+
+Read `references/harvest.md` first. The pipeline always runs — a stop *is* convergence plus
+harvest; you orchestrate, the twin executes each leg:
+
+1. **Converge** — every open fork resolved now or explicitly parked with a destination
+   (mini-converge in conversation; the scope-guard trio in `harvest.md` disambiguates parks).
+   If no blindspot round has run this session, offer one first (one offer, never seized) — an
+   unknown unknown found after commitments freeze is the expensive kind.
+2. **Final sync + manifest** — dispatch the twin (gate: stop). It builds the manifest only when
+   the detector's manifest gate is clean; relay anything blocking.
+3. **One approval** — present the manifest via `AskUserQuestion`. Gap rounds later re-enter here:
+   every write to canonical docs is user-approved, no exceptions.
+4. **Apply → uselessness test → move** — the twin's legs; relay results. Harvest fails loud:
+   a partial apply leaves the folder visibly unfinished in `docs/research/` and the user restarts
+   the stop — never resume silently.
+5. **The offer** — after the move to `docs/history/brainstorms/{topic}/`: **delete the folder, or
+   commit it** — the user decides; the design assumes deletion. Relay via `AskUserQuestion`.
+
+## Conduct — holds for the whole session
+
+1. **Speak plain English; codes live in files.** Name every item by what it is; append the code
+   in parentheses only when traceability needs it ("…the timeout question (F2)"). Never lead
+   with a bare `F3`/`D7`.
+2. **No production code outside the session folder while open.** Illustrative snippets live in
+   the folder. Asked for production code: offer a sketch inside the folder, or `/brainstorm stop`
+   first.
+3. **`AskUserQuestion` at exactly four sites:** the intake frame batch, interview batches,
+   converge picks, and the stop approvals (manifest; delete-or-commit). Everywhere else, prose.
+4. **Suggested, never seized.** Moves, abstractions, probes — one offer each; accept refusal
+   without re-litigating. Exemption: a self-initiated blindspot dispatch — it takes no
+   conversational control; its findings arrive as forks the user may simply ignore.
+5. **Nothing lives only in the transcript.** Ops is the floor: if it isn't in the folder or in
+   ops, it doesn't exist. Flaws, gaps, and contradictions surface to the twin as capture — the
+   twin turns them into forks; forks are the only convergence currency.
+6. **The user decides when to converge and when to stop.** Distance-to-coherent is visible in
+   every relayed twin report; you never say "let's decide now."
+7. **Only `/brainstorm start` and `/brainstorm stop` enter or leave a session.** No
+   auto-invocation, ever.

package/data/harnesses/apollo/skills/brainstorm/references/doctrine.md

@@ -0,0 +1,98 @@
+# Doctrine — the epistemic core
+
+Load when: composing or auditing any working-surface file; deciding what a turn's substance *is*
+(a force, a fork, a commitment); judging whether a record is complete enough to harvest.
+
+The session's product is a defensible design position. Five elements carry it — thesis, forces,
+forks, commitments, consequences. They are ADR epistemics with the ceremony removed: everything
+that made a decision record *citable* survives; everything that made it *bureaucratic* is dropped.
+
+## The five elements
+
+**Thesis** — the claim under construction. One composed document (`thesis.md`) in a mandated
+readable shape: the **claim** (what we are building and the position taken), the **argument** (the
+forces bearing on it and the reasoning chain from forces to claim), then **what most recently
+changed and why**. Composed prose from turn one, rewritten whole at every compose — a document
+maintained by appending can never read well. Every compose carries a `Current as of:` stamp so
+staleness is visible instead of trusted.
+
+**Forces** — the pressures that shape the design: user constraints stated in the conversation,
+evidence from the repo or the field, platform realities, costs, prior doctrine. Forces are not a
+file; they are the argument's raw material. A force lives wherever the reasoning that uses it
+lives — the thesis argument, a commitment's Why — and is stated concretely enough to be checked
+("the CLI gates consumer refresh", never "deployment concerns").
+
+**Forks** — the open questions. A fork is the session's only convergence currency: flaws, gaps,
+contradictions, uncovered aspects all funnel into `forks.md` or they don't exist. Every fork
+carries a **close condition** — what resolution looks like: a pick, a confirmed fact, an accepted
+risk. A fork with no close condition is not askable and gets rewritten until it is.
+
+**Commitments** — the resolved calls, in `ledger.md`. Field set per entry:
+
+- **Decision** — the call, one sentence, present tense.
+- **Why** — the forces and reasoning that produced it. This is where declined options live:
+  a **Declined:** line inside the commitment names the option, the evidence it was declined
+  against *at decline time*, and a **re-evaluate condition** where one exists — the condition
+  under which the rejection deserves another look. A deliberate call must never read later as an
+  unexamined one; the re-evaluate condition is what turns a past-tense rejection into a standing
+  tripwire.
+- **How to apply** — what acting on the decision looks like in this repo.
+- **Resolves** — the fork(s) this closes.
+
+The ledger is **append-only with amendment-by-annotation**: a decision is real the moment it
+lands; reversing it is a new entry that names what it reverses, plus a one-line annotation on the
+old entry ("Reversed by …"). There is no tentative/committed/rescinded state machine — the fleet's
+best sessions all proved append-plus-annotation carries the same information with none of the
+ceremony.
+
+**Consequences** — what a commitment obligates beyond itself: follow-on work, constraints it
+places on future decisions, and where its knowledge must land at harvest. Consequences surface as
+new forks ("committing to X opens the question of Y"), backlog candidates, or fragment content —
+they are the element that keeps a ledger from being a list of verdicts with no forward pressure.
+
+## What ADR epistemics keep
+
+The parts that made decision records worth citing in shipped source:
+
+- A decision is **addressable** — it can be named, cited, amended, and reversed by reference.
+- The **reasoning travels with the verdict** — Why is mandatory, and declined alternatives ride
+  inside it with their evidence.
+- **Reversal is first-class** — a new entry naming what it reverses, never a silent edit.
+- **Consequences are part of the record** — a decision that obligates work says so.
+
+## What ceremony drops
+
+The parts that died in every real session, kept out deliberately:
+
+- **Status lifecycles** (Proposed → Accepted → Deprecated) — a commitment is live when it lands;
+  reversal is an entry, not a state transition.
+- **One-document-per-decision granularity** — the ledger is one file; harvest may split by
+  subject, the session never does.
+- **Immutability ritual** — annotation is allowed and expected; only the *meaning* of past entries
+  is protected (annotate, never rewrite history).
+- **Committee numbering as identity** — entries get short stable handles for cross-reference
+  (D-notation), but conversation names decisions by what they are in plain words; codes are
+  parenthetical.
+
+## Epistemic rules
+
+These bind every writer of the working surface — facilitator (ops), twin (everything else):
+
+1. **Distilled, never verbatim.** Capture is interpretation: name the claim, the reasoning, and
+   the implication. The ban is on transcript-pasting, not on quoting — integrity copies (printed
+   enumerations, cited excerpts) are self-containment, not stenography.
+2. **Examples are examples.** Record the general claim and cite the user's phrase as an instance
+   of it. Never promote one phrasing into the frame — a thesis that reads beautifully but no
+   longer says what the user meant is worse than one that reads badly.
+3. **No naked pointers.** No pillar may lean on anything undefined in-folder: an enumeration
+   cited by number gets printed once, a term gets a one-line gloss, an external citation carries
+   an excerpt of its substance. A cold reader must never need the transcript or an external file
+   to parse the surface. The same bar applies to harvest destinations — the uselessness test
+   checks it there.
+4. **Both sides are session knowledge.** The facilitator's own substance — causal diagnoses,
+   informed rejections of options it presented, definitions of terms the surface cites, reasoning
+   chains behind recommendations — is captured with the same discipline as the user's words. This
+   is the historically leaked knowledge class; the ops ledger exists so it lands at zero cost.
+5. **Directional steering is not feature truth.** A harvested principle informs many decisions
+   and changes slowly; a feature fact belongs to its feature doc and changes at code speed. The
+   harvest links between the two layers, never duplicates prose across them.

package/data/harnesses/apollo/skills/brainstorm/references/harvest.md

@@ -0,0 +1,86 @@
+# Harvest — the stop pipeline
+
+Load when: `/brainstorm stop` is invoked (facilitator), or executing any stop-gate dispatch
+(twin). The pipeline's mechanical gates live in the detector (`--gate=manifest`, `--gate=move`);
+this reference carries the routing judgment.
+
+The pipeline, end to end:
+
+```
+converge → final sync/compose → manifest (Status: proposed)
+  → ONE user approval (Status: approved)
+  → apply, reading both sides of every destination (Status: applied)
+  → uselessness test → gaps? new Round, back to approval
+  → move to docs/history/brainstorms/{topic}/  ← the completion marker
+  → offer: delete or commit — the user decides
+```
+
+**Harvest fails loud, never silent.** The move happens only after the full apply passes the
+uselessness test. A partial apply — twin death, session kill, anything — leaves the folder
+visibly unfinished in `docs/research/` and the user restarts the stop. The pipeline never resumes
+silently from a half-applied state, and canonical docs are never written without an approved
+manifest (gap-round fixes included).
+
+## The routing map
+
+Route each piece of the surface by scope. Format every artifact via the `documentation` skill;
+where it is unavailable, fall back to own formatting and record which path ran in the manifest.
+Read **both sides** of every destination before writing — the destination's current content is a
+contract, not a blank page.
+
+| What | Goes to | Shape |
+| --- | --- | --- |
+| **Source of truth** | The repo's canonical home for that knowledge: `docs/features/` for a feature, `docs/architecture/` for cross-cutting doctrine, else a topic `Readme.md` | One consolidated reader-first doc distilled from the whole surface: thesis → what it is; domain fragment → how it works; ledger → present-tense rationale **without entry codes** |
+| **Executable work** | `docs/history/plans/` | Split by deliverable, never by pillar |
+| **Decision records** | One record per decision *subject* | A decision revising an already-recorded subject updates that record in place (its changelog carries the journey) rather than minting a new one; declined alternatives ride along with their re-evaluate conditions |
+| **Domain-model changes** | The living domain-model doc | The information-architecture contract the `boundary` skill reads at the next plan check |
+| **Still-open (parked) forks** | The repo's open-questions home | Each with a *resolution-lands-in* pointer |
+| **Backlog items** | The repo backlog | See the scope-guard trio below |
+| **Fragments** | Their destinations — they were drafted in destination format precisely so this is a move, not a translation | Merge per the destination's existing structure |
+
+**The scope-guard trio** disambiguates everything that isn't a commitment:
+
+- *Will build later* → **backlog**.
+- *Deliberately not building* → **non-goals**.
+- *Weighed and chose another option* → a **Declined:** line inside the deciding ledger entry,
+  with its evidence and re-evaluate condition — carried into the harvested decision record.
+
+**Directional steering is not feature truth.** A harvested principle informs many decisions and
+changes slowly; a feature fact belongs to its feature doc and changes at code speed. The harvest
+**links** between the steering layer and feature docs — it never duplicates prose across them,
+and it never invents a new top-level home for principles (they land in the *existing* living
+docs).
+
+Rejection rationale and reasoning chains must have explicit destinations — options-considered
+sections, decision changelogs — or the uselessness test fails: the folder may never be deleted
+into a knowledge loss.
+
+## The uselessness test
+
+The deletion-safety gate: after the apply, the post-harvest living docs alone must be enough.
+
+- **The reader is always a freshly spawned, context-free agent** — a full-context reader cannot
+  cold-read; it already knows every undefined term.
+- **Isolation is enforced, not instructed:** the cold reader's prompt contains an explicit
+  allowed-path list (the manifest's destinations — never the session folder), and the detector
+  independently verifies no harvested doc links back into the session folder (BS-HARVEST-01) — a
+  link into scaffolding is itself a harvest defect.
+- **The task:** reconstruct the design — thesis, commitments, reasoning, declined branches — from
+  the allowed paths only.
+- **Grading:** the twin diffs the reconstruction against the ledger and thesis and names every
+  gap; the session-replay evals audit the grading itself. Anything unrecoverable is a named
+  harvest gap → recorded in the manifest (`Result: fail`), fixes enter a new manifest `Round`,
+  approved like the first. Iterate until the folder is redundant.
+
+## The move, and the offer
+
+When the detector's move gate is clean: delete `ops/` entirely (transcript-grade residue never
+enters git), `git mv` the folder to `docs/history/brainstorms/{topic}/`, set
+`Status: harvested`, and update both indexes (row out of `docs/research/Readme.md`, row into
+`docs/history/brainstorms/Readme.md`). The move is the completion marker — a folder still under
+`docs/research/` is by definition unfinished, which is exactly what the maintenance census reads.
+
+Then the offer, relayed by the facilitator: **delete the moved folder, or commit it.** The user
+decides; the design assumes deletion — nothing anywhere may depend on the folder surviving.
+Committing is the explicit way to keep git-history forensics; an uncommitted folder deleted here
+is gone, and that residual is accepted by design.

package/data/harnesses/apollo/skills/brainstorm/references/session-schema.md

@@ -0,0 +1,186 @@
+# Session schema — the single format authority
+
+Load when: bootstrapping a session, writing any working-surface file, dispatching the twin, or
+interpreting detector output. The detector (`scripts/detector.mjs`) is the mechanical half of this
+contract — every rule below that carries a rule ID is machine-checked; everything else is the
+twin's semantic judgment.
+
+## Folder layout
+
+```
+docs/research/{topic}-brainstorm/     ← open session (kebab-case topic slug)
+├── state.md                          ← anchor + aspect map (twin-written)
+├── thesis.md                         ← composed claim → argument → what changed (twin-written)
+├── forks.md                          ← open questions with close conditions (twin-written)
+├── ledger.md                         ← commitments (twin-written)
+├── basis/                            ← frozen entry material (facilitator-written once, at intake)
+├── fragments/                        ← harvest-native fragments (twin-written; materialize on
+│                                        first real content, drafted in destination format)
+└── ops/                              ← untracked capture layer (deleted at stop)
+    ├── .gitignore                    ← contains `*` — ops/ never enters git      [BS-OPS-01/02]
+    ├── capture.md                    ← facilitator's raw append ledger (its ONLY write)
+    ├── sync-log.md                   ← paired twin-dispatch log
+    └── manifest.md                   ← harvest manifest (created by the stop pipeline)
+```
+
+On a passed harvest the folder **moves** to `docs/history/brainstorms/{topic}/` (ops/ deleted
+first) — the move is the completion marker; the user then deletes or commits it. A folder still
+under `docs/research/` is by definition unfinished.
+
+**Write protocol (one writer per file):** the facilitator appends to `ops/capture.md` and writes
+the initial `basis/` copy plus the sync-log *dispatch* lines — nothing else, ever. The twin writes
+every other file, at gates. The user may hand-edit anything; the twin diffs each file against its
+own last compose before rewriting and folds foreign edits as first-class user signal.
+
+## state.md
+
+```markdown
+# State
+
+- Status: open | stopping | harvested
+- Posture: mid-probe on the sync-layer aspect, three forks open
+- Started: 2026-07-08
+- Sitting: single | multi
+- Last compose: 2026-07-08T14:30Z | never
+
+## Aspect map
+
+- persistence — how session state survives restarts → F1, D3
+- onboarding — the first-run experience → thesis
+- risks — failure modes and mitigations → none yet
+```
+
+- `Status` transitions only forward: `open → stopping → harvested` (the twin flips `stopping` when
+  the stop pipeline begins, `harvested` at the move). [BS-STATE-01]
+- The aspect map is derived per idea from the basis and edited by the user. Each aspect carries
+  `→` refs to the content covering it: fork IDs (`F#`), ledger IDs (`D#`), `thesis`,
+  `fragment:{name}`, or `none yet` (an open coverage gap — informational mid-session
+  [BS-ASPECT-01], blocking at the manifest gate [BS-ASPECT-02]). Ref *presence* is the detector's
+  half; whether the content actually covers the aspect is the twin's.
+
+## thesis.md
+
+```markdown
+# {Topic} — thesis
+
+Current as of: 2026-07-08T14:30Z
+
+## Claim
+## Argument
+## What changed
+```
+
+Composed prose, rewritten whole at every compose, never appended. The three sections and the
+stamp are mandatory [BS-THESIS-01]; the stamp must equal state.md's `Last compose`
+[BS-COMPOSE-01]. At the manifest gate, `Last compose` must be later than the newest
+`ops/capture.md` entry — a compose over unsynced capture is stale [BS-COMPOSE-02].
+
+## forks.md
+
+```markdown
+## F3 — Should reads wait for a compose? [open]
+
+Full self-contained prose in the user's framing.
+
+- Raised by: user | twin (S4) | probe | harvest
+- Closes when: a pick between wait-for-fresh and read-stale-with-warning
+```
+
+- IDs `F1, F2, …` unique, never reused [BS-FORK-01]. Status marker: `[open]` or
+  `[parked → {destination}]`. Every fork carries `Closes when:` [BS-FORK-01].
+- `Raised by: twin (S#)` must cite a reconciled sync-log entry [BS-SYNC-02].
+- **A resolved fork's entry is deleted** by the twin — the resolving ledger entry's `Resolves:`
+  field is the record. forks.md holds only open and parked forks; a ledger `Resolves: F3`
+  coexisting with an open F3 is an inconsistency [BS-FORK-02]. Parked forks survive to the
+  manifest, which must route each one [BS-MANIFEST-01].
+- The manifest gate requires zero `[open]` forks [BS-FORK-03].
+
+## ledger.md
+
+```markdown
+## D4 — Sessions initialize in dump or interview
+
+- Decision: every session opens in dump or interview; probe and converge are mid-session moves.
+- Why: a first-time user cannot be asked to pick a posture they have no vocabulary for.
+  Declined: free initial posture — observed cold-starts stall in probe; re-evaluate if
+  session-replay evals show experienced users fighting the default.
+- How to apply: the facilitator's start calibration offers only the two entry moves.
+- Resolves: F2
+```
+
+- IDs `D1, D2, …` unique, append-only [BS-LEDGER-01]. `Decision`, `Why`, `How to apply` are
+  mandatory; `Resolves:` when the commitment closes forks. Amendments and reversals are
+  annotations plus a new entry ("Reversed by D9" on the old; D9 names what it reverses) — never a
+  rewrite. Declined options live inside `Why` per [doctrine.md](doctrine.md).
+
+## ops/capture.md
+
+The facilitator's per-turn append — its one write duty. Lowest possible bar: raw, unpolished,
+everything session-relevant from *both* sides (user substance and facilitator substance —
+diagnoses, informed rejections, definitions, reasoning chains), including residue judged not
+worth pillar filing. Format:
+
+```markdown
+---
+### T14 · 2026-07-08T14:22Z
+
+<raw notes for this turn>
+```
+
+Turn IDs `T#` ascending with an ISO timestamp — the timestamp is what compose-freshness checks
+against [BS-COMPOSE-02]. Never distill here; distillation is the twin's job.
+
+## ops/sync-log.md
+
+Paired-written, one pair per twin dispatch:
+
+```
+S4 | gate: on-demand | dispatched: 2026-07-08T14:25Z | scope: full reconcile + compose
+S4 → reconciled | 2026-07-08T14:29Z | 4 edits · 2 new forks · 6 open · untouched: risks
+```
+
+The **facilitator** writes the dispatch line as it dispatches; the **twin** appends the result
+line (`reconciled` or `failed`) on return — no single author holds both sides. Every dispatch
+line must acquire a result line; only the newest entry may be unpaired (in flight) [BS-SYNC-01].
+A `failed` result is surfaced to the user at the next turn break and re-run at the next gate.
+
+## ops/manifest.md
+
+Created by the stop pipeline; gates the harvest apply:
+
+```markdown
+# Harvest manifest — {topic}
+
+Round: 1
+Status: proposed | approved | applied
+
+| # | What | Source | Destination | Action |
+|---|------|--------|-------------|--------|
+| 1 | consolidated source of truth | thesis + fragments + ledger | docs/features/{x}.md | create |
+| 2 | parked fork F7 | forks.md | docs/architecture/open-questions.md | append |
+
+## Uselessness test
+
+- Result: pass | fail
+- Cold-reader allowed paths: <the destination docs above>
+- Gaps: none | <named gaps → next Round>
+```
+
+Every parked fork and every fragment must have a row [BS-MANIFEST-01]. `Status: approved` is set
+only after the user approves; gap fixes re-enter as a new `Round` with the same approval
+requirement. After apply, no destination doc may link into the session folder [BS-HARVEST-01];
+the move to history requires a recorded passing uselessness test [BS-USELESS-01].
+
+## Detector
+
+`node scripts/detector.mjs <session-folder> [--gate=session|manifest|move] [--json]`
+
+- `session` (default) — the always-on integrity rules; run at any gate.
+- `manifest` — adds the convergence gates (zero open forks, full aspect coverage, fresh compose);
+  the twin may not construct a manifest while any of these fail.
+- `move` — adds the post-apply gates (manifest applied, uselessness pass recorded, no links into
+  scaffolding); the folder may not move while any fail.
+
+Exit code 0 = clean, 1 = violations (listed with rule IDs), 2 = unusable input. Rules degrade
+gracefully: no git context ⇒ BS-OPS-02 reports `skipped`, never blocks. Rule IDs are stable —
+consumers (the twin, the evals, the maintenance census) key on them.