@nurix/etna 0.19.69 → 0.19.71

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "67265cb7e0bf",
+    "fingerprint": "6492994f8d44",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/code/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.8.2",
+  "version": "3.9.1",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "39fd82e32002"
+  "digest": "bc889c51aa02"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -186,6 +186,13 @@ function driftBanner(projectDir) {
 }
 
 function sessionStart(projectDir) {
+  // Stamp the session's start so gitless repos still have a "modified since" horizon for the
+  // outcome detector's fallback scan (dirtyPaths). Overwritten per session; best-effort.
+  try {
+    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), new Date().toISOString() + "\n");
+  } catch (e) {
+    /* the stamp is a convenience for the fallback; git repos never need it */
+  }
   const lines = [];
   const pm = detectPackageManager(projectDir);
   if (pm) lines.push(`Package manager: ${pm}`);
@@ -366,7 +373,7 @@ function detectRenames(projectDir, command, meta, rows) {
 // Fails open: no git, or a git error, reads as an empty list.
 function dirtyPaths(projectDir) {
   const res = spawnSync("git", ["status", "--porcelain"], { cwd: projectDir, encoding: "utf8", timeout: 5000 });
-  if (res.status !== 0) return [];
+  if (res.status !== 0) return mtimeFallbackPaths(projectDir);
   return (res.stdout || "")
     .split("\n")
     .filter(Boolean)
@@ -377,6 +384,44 @@ function dirtyPaths(projectDir) {
     .map((p) => p.replace(/^"|"$/g, ""));
 }
 
+// No git ⇒ no porcelain, and the outcome detector went blind (a real run edited a frozen plan
+// via `sed -i` in a gitless repo, unseen). Fall back to "modified since this session started":
+// the SessionStart stamp bounds the scan, and the scan covers exactly the two surfaces the
+// detector reads — package manifests and docs/history records. No stamp ⇒ empty, as before.
+function mtimeFallbackPaths(projectDir) {
+  let since = 0;
+  try {
+    since = fs.statSync(path.join(stateDir(projectDir), "session-started")).mtimeMs;
+  } catch (e) {
+    return [];
+  }
+  const out = [];
+  const walk = (dirRel, depth, wanted) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(path.join(projectDir, dirRel), { withFileTypes: true });
+    } catch (e) {
+      return;
+    }
+    for (const en of entries) {
+      if (en.name === "node_modules" || en.name.startsWith(".")) continue;
+      const rel = dirRel ? `${dirRel}/${en.name}` : en.name;
+      if (en.isDirectory()) {
+        if (depth > 0) walk(rel, depth - 1, wanted);
+      } else if (wanted(en.name)) {
+        try {
+          if (fs.statSync(path.join(projectDir, rel)).mtimeMs >= since) out.push(rel);
+        } catch (e) {
+          /* raced away — not dirty */
+        }
+      }
+    }
+  };
+  walk("", 3, (name) => name === "package.json");
+  walk("docs/history", 4, (name) => name.endsWith(".md"));
+  return out;
+}
+
 // OUTCOME RECOMPUTATION — the gates deny wrong actions, but an action can be routed around by
 // any tool that writes bytes (a manifest written by a script, a frozen record touched by sed).
 // State cannot be routed around: recompute the two outcomes the gates guard and raise what

package/data/harnesses/code/hooks/check-ownership.mjs

@@ -1,22 +1,57 @@
-// harness/code/hooks/check-ownership.mjs — CI backstop: every owns: glob must match at least one
-// file, unless an unexpired `waived:` dead-glob row in docs/operations/bookkeeping.md covers it
-// (the waiver names the glob verbatim). Exit 1 on any unwaived dead glob.
+// harness/code/hooks/check-ownership.mjs — CI backstop for docs/features/ ownership. Two checks,
+// one walk of the tree:
+//
+//   1. dead-glob         — every owns: glob matches at least one file
+//   2. ownership-overlap — no two feature docs claim a common file at EQUAL specificity, which
+//                          leaves "most specific wins" unable to pick an owner
+//
+// Either is silenced by an unexpired `waived:` row in docs/operations/bookkeeping.md naming its
+// kind plus the offending glob (dead-glob) or the shared path (ownership-overlap) verbatim.
+// Exit 1 on anything unwaived.
+//
+// A glob at strictly HIGHER specificity carving a sub-path out of a broader `**` is the designed
+// layering, not a conflict — only an exact tie is reported.
 
-import { deadGlobs } from "./lib/ownership.mjs";
+import { deadGlobs, listRepoFiles, overlaps } from "./lib/ownership.mjs";
 import { readQueue, unexpiredWaivers } from "./lib/state.mjs";
 
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const today = new Date().toISOString().slice(0, 10);
 
-const dead = deadGlobs(projectDir);
-const waivers = unexpiredWaivers(readQueue(projectDir), "dead-glob", today);
-const unwaived = dead.filter((d) => !waivers.some((w) => w.body.includes(d.glob)));
+const files = listRepoFiles(projectDir);
+const queue = readQueue(projectDir);
 
-if (unwaived.length === 0) {
-  console.log(`check-ownership: OK (${dead.length} dead glob(s), all waived or none)`);
+const dead = deadGlobs(projectDir, files);
+const deadWaivers = unexpiredWaivers(queue, "dead-glob", today);
+const unwaivedDead = dead.filter((d) => !deadWaivers.some((w) => w.body.includes(d.glob)));
+
+const conflicts = overlaps(projectDir, files);
+const overlapWaivers = unexpiredWaivers(queue, "ownership-overlap", today);
+const unwaivedOverlaps = conflicts.filter((c) => !overlapWaivers.some((w) => w.body.includes(c.example)));
+
+if (unwaivedDead.length === 0 && unwaivedOverlaps.length === 0) {
+  console.log(
+    `check-ownership: OK (${dead.length} dead glob(s), ${conflicts.length} equal-specificity overlap(s), all waived or none)`,
+  );
   process.exit(0);
 }
-console.error(`check-ownership: ${unwaived.length} unwaived dead owns: glob(s):`);
-for (const d of unwaived) console.error(`  ${d.glob} → ${d.doc}`);
-console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row with reason + expires=.");
+
+if (unwaivedDead.length > 0) {
+  console.error(`check-ownership: ${unwaivedDead.length} unwaived dead owns: glob(s):`);
+  for (const d of unwaivedDead) console.error(`  ${d.glob} → ${d.doc}`);
+  console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row with reason + expires=.");
+}
+
+if (unwaivedOverlaps.length > 0) {
+  console.error(`check-ownership: ${unwaivedOverlaps.length} unwaived equal-specificity overlap(s):`);
+  for (const c of unwaivedOverlaps) {
+    console.error(`  ${c.example}`);
+    console.error(`    ${c.a.glob} → ${c.a.doc}`);
+    console.error(`    ${c.b.glob} → ${c.b.doc}`);
+  }
+  console.error(
+    "Narrow one doc's glob so a single owner wins, or add a `waived:` ownership-overlap row naming the shared path with reason + expires=.",
+  );
+}
+
 process.exit(1);

package/data/harnesses/code/hooks/compliance.mjs

@@ -12,7 +12,7 @@ import { readStdin, resolveProjectDir, frontmatter } from "./lib/ownership.mjs";
 import { readQueue, countRows, askedThisSession, recordAsked } from "./lib/state.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
-import { appendEvent, unresolvedDenials, sessionLogPath } from "./lib/session-log.mjs";
+import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
 import { approvedPackages } from "./lib/approved.mjs";
 
 function readSafe(file) {
@@ -337,9 +337,61 @@ function bashGate(projectDir, command, sessionId) {
     );
   }
 
+  const shellWrite = bashWriteScreen(projectDir, command, sessionId);
+  if (shellWrite) return shellWrite;
+
   return packageGate(projectDir, command, sessionId);
 }
 
+// A file write arriving by shell hits the same wall the Edit tool does. Only tokens in a
+// WRITING position count — redirect targets, `tee`/`mv`/`cp` destinations, and any path on an
+// in-place editor line (`sed -i`, `perl -i`) — so reading a frozen record into a pipe stays
+// legal. A token that isn't an existing repo path falls through frozenStatus/protected as a
+// no-op, which keeps sed expressions and flags harmless without shell-parsing them.
+function bashWriteTargets(command) {
+  const targets = [];
+  let m;
+  const redirect = />{1,2}\s*([^\s;|&<>]+)/g;
+  while ((m = redirect.exec(command))) targets.push(m[1]);
+  const tee = /\btee\s+(?:-\S+\s+)*([^\s;|&<>]+)/g;
+  while ((m = tee.exec(command))) targets.push(m[1]);
+  const moveCopy = /\b(?:mv|cp)\s+(?:-\S+\s+)*\S+\s+([^\s;|&<>]+)/g;
+  while ((m = moveCopy.exec(command))) targets.push(m[1]);
+  if (/\b(?:sed|perl)\s+(?:-\S*\s+)*-\S*i/.test(command) || /\bsed\s+--in-place\b/.test(command)) {
+    for (const t of command.split(/[\s"']+/)) {
+      if (t && !t.startsWith("-") && /[/.]/.test(t)) targets.push(t);
+    }
+  }
+  return targets;
+}
+
+function bashWriteScreen(projectDir, command, sessionId) {
+  for (const target of bashWriteTargets(command)) {
+    const rel = relIfInside(projectDir, target);
+    if (!rel) continue;
+    const frozen = frozenStatus(projectDir, rel);
+    if (frozen.frozen) {
+      return deny(
+        projectDir,
+        sessionId,
+        "frozen-record",
+        rel,
+        `BLOCKED — frozen record. \`${rel}\` is committed history and is never edited (${frozen.reason}) — a shell write is still a write. A correction is a new dated entry that links back.`
+      );
+    }
+    if (protectedPaths(projectDir).includes(rel)) {
+      return deny(
+        projectDir,
+        sessionId,
+        "protected-file",
+        rel,
+        `BLOCKED — protected file. \`${rel}\` is on the protected list — a shell write is still a write.`
+      );
+    }
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Stop
 // ---------------------------------------------------------------------------
@@ -463,13 +515,21 @@ function stopGate(projectDir, payload) {
   const openDenials = unresolvedDenials(projectDir, payload.session_id);
   if (openDenials.length > 0) {
     const rel = path.relative(projectDir, sessionLogPath(projectDir, payload.session_id));
+    // A resolution that doesn't parse reads to the session as "my resolution didn't count"
+    // with no explanation — name the offending lines and the grammar instead of staying mute.
+    const bad = malformedEventLines(projectDir, payload.session_id);
+    const badNote =
+      bad.length > 0
+        ? ` NOTE: ${bad.length} line(s) look like events but don't parse — the grammar is \`- HH:MM:SS denied|resolved · gate · target[ · detail]\` (a resolved line missing its timestamp is invisible to the wall): ${bad.join(" | ")}.`
+        : "";
     return {
       decision: "block",
       reason:
         `${openDenials.length} gate denial(s) this session have no resolved line in ${rel}: ${openDenials.join("; ")}. ` +
         "For each, either retry the operation properly (a success appends `retried-ok` automatically), convert it to a waiver and append " +
         "`resolved · {gate} · {target} · waived → {ref}`, or record the failure honestly in the changelog entry and append " +
-        "`resolved · {gate} · {target} · disclosed → {entry file}`. Never delete log lines — the log is a record, not a queue.",
+        "`resolved · {gate} · {target} · disclosed → {entry file}`. Never delete log lines — the log is a record, not a queue." +
+        badNote,
     };
   }
 

package/data/harnesses/code/hooks/lib/ownership.mjs

@@ -242,3 +242,60 @@ export function deadGlobs(projectDir, repoFiles) {
   }
   return dead;
 }
+
+// Specificity of an owns: glob as a (literal, wildcard) segment tuple. The ownership rule is
+// "most specific wins", so a glob at strictly higher specificity legitimately carves a sub-path
+// out of a broader `**` — that is the designed layering, never a conflict. Only an exact tie
+// leaves the owner ambiguous, which is what `overlaps()` reports.
+export function specificity(glob) {
+  let literal = 0;
+  let wildcard = 0;
+  for (const segment of String(glob).split("/")) {
+    if (segment === "") continue;
+    if (segment.includes("*") || segment.includes("?")) wildcard++;
+    else literal++;
+  }
+  return { literal, wildcard };
+}
+
+// Two globs are equally specific when both tuple components match.
+export function sameSpecificity(a, b) {
+  return a.literal === b.literal && a.wildcard === b.wildcard;
+}
+
+// Cross-doc equal-specificity ownership conflicts: two globs from DIFFERENT feature docs that
+// match a common file at the same specificity, so "most specific wins" cannot pick an owner and
+// the path is doubly owned. Returns [{ a: {doc, glob}, b: {doc, glob}, example }].
+//
+// This is the mechanical half of a rule the harness has always stated and never checked — the
+// `documentation` skill's frontmatter reference calls an equal-specificity overlap "an ownership
+// conflict to resolve", and the `maintenance` agent is told to flag one. Without this, both had
+// to be enforced by eye.
+export function overlaps(projectDir, repoFiles) {
+  const files = repoFiles || listRepoFiles(projectDir);
+  const owners = [];
+  for (const entry of scanFeatureDocs(projectDir)) {
+    if (entry.status === "deprecated") continue;
+    for (const glob of entry.owns) {
+      const re = globToRegExp(glob);
+      owners.push({ doc: entry.doc, glob, spec: specificity(glob), files: files.filter((f) => re.test(f)) });
+    }
+  }
+  return pairOverlaps(owners);
+}
+
+// The pure core of `overlaps()`, split out so tests can feed synthetic owners without a repo tree.
+export function pairOverlaps(owners) {
+  const found = [];
+  for (let i = 0; i < owners.length; i++) {
+    for (let j = i + 1; j < owners.length; j++) {
+      const a = owners[i];
+      const b = owners[j];
+      if (a.doc === b.doc) continue;
+      if (!sameSpecificity(a.spec, b.spec)) continue;
+      const example = a.files.find((f) => b.files.includes(f));
+      if (example) found.push({ a: { doc: a.doc, glob: a.glob }, b: { doc: b.doc, glob: b.glob }, example });
+    }
+  }
+  return found;
+}

package/data/harnesses/code/hooks/lib/session-log.mjs

@@ -73,3 +73,23 @@ export function unresolvedDenials(projectDir, sessionId) {
   }
   return [...open.keys()];
 }
+
+// Lines that LOOK like events but don't parse — a resolution missing its timestamp token, a
+// hand-typed variant of the grammar. The pair-matcher above skips them silently, which reads
+// to the session as "my resolution didn't count" with no explanation (a real session burned
+// its tail debugging exactly this). The walls surface these loudly instead.
+export function malformedEventLines(projectDir, sessionId) {
+  let text = "";
+  try {
+    text = fs.readFileSync(sessionLogPath(projectDir, sessionId), "utf8");
+  } catch (e) {
+    return [];
+  }
+  const bad = [];
+  for (const line of text.split("\n")) {
+    if (!/^- .*\b(denied|resolved)\b\s*·/.test(line)) continue;
+    if (/^- \S+ (denied|resolved) · ([^·]+) · ([^·\n]+?)(?: · |$)/.test(line)) continue;
+    bad.push(line.trim());
+  }
+  return bad;
+}

package/data/harnesses/code/rules/testing.md

@@ -55,7 +55,7 @@ Test packages install at `latest` — outside the approved-packages pin set. Fak
 - **Wire the canonical command.** `"test"` in `package.json` runs the whole unit suite (`vitest run`); e2e under `"test:e2e"`. A repo where `pnpm test` / `npm test` doesn't run the suite is misconfigured — fix the wiring, **never** route around it.
 - **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob.
 - **No test doubles for what you own.** Prefer real instances — in-memory SQLite for drizzle, the actual Express app via `supertest` — over mocks; mock **only** true externals (network via `msw`, time via the runner's fake timers).
-- **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone and in any order.
+- **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone, in any order, **and from a cold shell** — never against a hand-started dev server (Workers: `@cloudflare/vitest-pool-workers`; Express: `supertest` against the app instance).
 
 ## Discipline
 

package/data/harnesses/code/skills/documentation/templates/plan.md

@@ -15,7 +15,7 @@ The **`Gates:`** line is machine-read: the compliance hook greps exactly the for
 **Gates:** Boundary: pending · Test-plan: pending · Docs: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
-**Completed:** YYYY-MM-DD   <!-- fill when status flips to Complete -->
+**Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete: the flip freezes the file instantly, so a date left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->
 
 ## Background
 

package/data/harnesses/code/skills/testing/SKILL.md

@@ -152,7 +152,7 @@ Runs only when the user triggers the verification gate (constraints — precondi
 
 1. **Write the checklist** — derive or update `docs/tests/{feature}.md` from the ledger and the LLD's promises (the `documentation` skill's `templates/behavioral-checklist.md`; one `**Assert**` per observable). Derived before the driving it is the script; derived after, it is merely a report with nothing to trace tests back to.
 2. **Drive the real surface** — browser automation for web UI (the `/test` runner skill where the repo wires it), the actual CLI binary, HTTP against the running worker. **A failing checklist assertion is never softened to make a run green** — record the defect, send it to the backlog. Where the runtime offers no browser automation, emit the browser-verification checklist for the user to run; their report is the rung's verdict and `Status: Complete` waits for it.
-3. **Pin the durable behaviors** as suite tests per `testing.md`, naming each test's stratum (§ Bridge). A test is a permanent maintenance cost, bought deliberately:
+3. **Pin the durable behaviors** as suite tests per `testing.md`, naming each test's stratum (§ Bridge). **A pinned test must pass from a cold shell** — `pnpm test` with no dev server hand-started, no seeded state assumed beyond what the suite builds for itself. A test whose oracle is "fetch the server I happen to have running" is a driven check wearing a test's name: it goes red the moment the session ends (on Workers, `@cloudflare/vitest-pool-workers` is the self-contained harness; an Express app is driven via `supertest`, never a port). Before discharging, run the suite once from a clean shell — a suite that needs the session's environment discharges nothing. A test is a permanent maintenance cost, bought deliberately:
 
    | Earns a suite test | Verified by driving alone |
    | --- | --- |

package/data/harnesses/delivery/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/delivery/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.6",
+  "version": "0.2.9",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "6687f84006a3"
+  "digest": "cebc16bda479"
 }

package/data/harnesses/delivery/skills/documentation/templates/plan.md

@@ -15,7 +15,7 @@ The **`Gates:`** line is machine-read: the compliance hook greps exactly the for
 **Gates:** Boundary: pending · Test-plan: pending · Docs: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
-**Completed:** YYYY-MM-DD   <!-- fill when status flips to Complete -->
+**Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete: the flip freezes the file instantly, so a date left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->
 
 ## Background
 

package/data/harnesses/etna/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/etna/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.4.5",
+  "version": "1.4.8",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "8713f233f073"
+  "digest": "e69567759f7b"
 }

package/data/harnesses/etna/rules/testing.md

@@ -55,7 +55,7 @@ Test packages install at `latest` — outside the approved-packages pin set. Fak
 - **Wire the canonical command.** `"test"` in `package.json` runs the whole unit suite (`vitest run`); e2e under `"test:e2e"`. A repo where `pnpm test` / `npm test` doesn't run the suite is misconfigured — fix the wiring, **never** route around it.
 - **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob.
 - **No test doubles for what you own.** Prefer real instances — in-memory SQLite for drizzle, the actual Express app via `supertest` — over mocks; mock **only** true externals (network via `msw`, time via the runner's fake timers).
-- **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone and in any order.
+- **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone, in any order, **and from a cold shell** — never against a hand-started dev server (Workers: `@cloudflare/vitest-pool-workers`; Express: `supertest` against the app instance).
 
 ## Discipline
 

package/data/harnesses/etna/skills/documentation/templates/plan.md

@@ -15,7 +15,7 @@ The **`Gates:`** line is machine-read: the compliance hook greps exactly the for
 **Gates:** Boundary: pending · Test-plan: pending · Docs: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
-**Completed:** YYYY-MM-DD   <!-- fill when status flips to Complete -->
+**Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete: the flip freezes the file instantly, so a date left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->
 
 ## Background
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.69",
+    "version": "0.19.71",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "67265cb7e0bf"
+    "etnaFingerprint": "6492994f8d44"
 }