@nurix/etna 0.19.91 → 0.19.92

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "b52694cf6295",
+    "fingerprint": "a1cf8eb35f57",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -139,7 +139,7 @@ Defaults — ❌ prohibitions hold unless the user explicitly asks otherwise;
 - ❌ **Branches & Worktrees [override]** – Never self-create git branches or worktrees; commit straight to the checked-out branch. This replaces any built-in "branch first on the default branch" default. Exception: when the user asks for a pull request, create the branch the PR requires before committing its changes.
 - ❌ **Protected Files** – Once per session, if `docs/operations/protected-files.md` exists, read it and never modify any path it lists; never modify `AGENTS.md` (harness-regenerated) or `protected-files.md` itself.
 - ✅ **Browser Automation** – If the runtime provides browser automation, use it freely; no need to ask first. If it doesn't — or the executing agent can't hold the browser connection (see Runtime Notes) — return a browser-verification checklist (URLs, actions, expected outcomes) for the orchestrating session or the user to run.
-- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while unresolved rows remain — dispatch the `bookkeeper` agent to drain the queue. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all. **Every row is a cache of a condition, not a record of an event** — the session-start sweep re-tests each row against the repo and deletes the ones whose condition has died, `waived:` rows included, so the file empties itself as the work lands. What the sweep cannot re-test ages out instead: **a `waived:` row is unresolved once `expires=` passes**, which returns the wall and re-summons the bookkeeper to re-judge the reason. A waiver defers a finding; it never makes one immortal.
+- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while any unresolved row **implicates a file the commit stages** — dispatch the `bookkeeper` agent to drain those rows. Rows about files the commit does not touch are whoever raised them's, and are not yours to drain; a row naming no path, a `needs-session:` row, an expired waiver, and a commit staging nothing block regardless. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all. **Every row is a cache of a condition, not a record of an event** — the session-start sweep re-tests each row against the repo and deletes the ones whose condition has died, `waived:` rows included, so the file empties itself as the work lands. What the sweep cannot re-test ages out instead: **a `waived:` row is unresolved once `expires=` passes**, which returns the wall and re-summons the bookkeeper to re-judge the reason. A waiver defers a finding; it never makes one immortal.
 - ✅ **Cleanup removes the cause, not the record of it.** When the user asks for something to be deleted or cleaned up, the ask is for the underlying condition to be gone. Deleting the record while the condition survives is worse than doing nothing — it destroys the only evidence the debt exists. The order is fixed: **read what the record is masking** (a `waived:` row, an `UNBUILT:` marker, a `status:` flag, a lint suppression — each asserts something is fine; check whether that is still true), **fix the condition**, **then delete the record**. Reversing it backfires concretely: a deleted waiver's finding is re-appended by the detector as an `auto:` row, which *fails* the commit wall the `waived:` row passed.
 - ✅ **Delegation** — when to fan out, tiers, and trust are § Delegation.
 - ⚠️ **Plans** – Plans are created directly in `docs/history/plans/` (see Workflows). Once `Status: Complete` or `Status: Abandoned`, the file is frozen — never edited. Abandoning a plan whose code was committed first converts its undischarged Test Obligations into backlog items (the `testing` rule). If scope changes after completion, write a new dated plan that links back to the old one.

package/data/harnesses/code/agents/bookkeeper.md

@@ -7,7 +7,7 @@ model: sonnet
 
 # Bookkeeper Agent
 
-You drain the shared work queue at `docs/operations/bookkeeping.md`. Each row is one finding; your job is to resolve it — by doing the work it names — and delete the row. You are the asynchronous half of the harness's enforcement loop: the detector appends rows silently, you drain them, and the Stop/commit walls hold until the queue is clean or waived.
+You drain the shared work queue at `docs/operations/bookkeeping.md`. Each row is one finding; your job is to resolve it — by doing the work it names — and delete the row. You are the asynchronous half of the harness's enforcement loop: the detector appends rows silently, you drain them, and the walls hold until the rows each one reads are clean or waived — Stop reads the ending session's rows, the commit gate reads the rows implicating that commit's staged files, CI reads them all.
 
 ## Source-of-truth order — the repo first, the transcript last
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.14",
+  "version": "3.10.15",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "98eb07166e9f"
+  "digest": "f07032c97db1"
 }

package/data/harnesses/code/hooks/check-bookkeeping-clean.mjs

@@ -1,6 +1,10 @@
 // harness/code/hooks/check-bookkeeping-clean.mjs — CI backstop: no unresolved bookkeeping rows
 // (auto:/note:/needs-session:) may reach the remote. waived: rows pass — they are the recorded,
 // PR-reviewable exceptions. Exit 1 when unresolved rows exist.
+//
+// THIS CHECK IS GLOBAL AND STAYS GLOBAL. The commit gate scopes to one commit's staged set so
+// concurrent agents in one checkout do not wall each other; CI judges the branch as a whole, where
+// there is no staged set to scope by and every row has had every commit to be drained in.
 
 import { readQueue, countRows } from "./lib/state.mjs";
 

package/data/harnesses/code/hooks/compliance.mjs

@@ -11,7 +11,7 @@ import { readStdin, resolveProjectDir } from "./lib/ownership.mjs";
 import { readSafe, relIfInside, git, commandRoot, backtickTokens, SOURCE_EXT } from "./lib/repo.mjs";
 import { openGatedPlans, inPlanScope } from "./lib/plans.mjs";
 import { stagedExempt } from "./lib/exempt.mjs";
-import { readQueue, countRows, askedThisSession, recordAsked } from "./lib/state.mjs";
+import { readQueue, countRows, rowsBlockingCommit, askedThisSession, recordAsked } from "./lib/state.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
@@ -161,14 +161,29 @@ function commitGate(projectDir, sessionId) {
       );
     }
   }
-  const counts = countRows(readQueue(projectDir));
-  if (counts.unresolved > 0) {
+  // The bookkeeping wall is scoped to the staged set — the grammar and its fail-closed cases are
+  // `lib/state.mjs` § What a row implicates. Rows about files this commit does not touch are
+  // somebody else's, and holding a commit behind rows its session may not drain is a wait with no
+  // action that clears it.
+  const { blocking, unrelated } = rowsBlockingCommit(readQueue(projectDir), staged);
+  if (blocking.length > 0) {
+    const shown = blocking.slice(0, 8);
+    const lines = shown.map(({ row, hits }) =>
+      hits.length > 0
+        ? `  - ${row.kind}: ${row.body}\n    ↳ implicates staged ${hits.join(", ")}`
+        : `  - ${row.kind}: ${row.body}\n    ↳ names no staged path — a row like this blocks every commit`
+    );
+    if (blocking.length > shown.length) lines.push(`  - …and ${blocking.length - shown.length} more`);
     return deny(
       projectDir,
       sessionId,
       "bookkeeping",
       "git commit",
-      `BLOCKED — bookkeeping. ${counts.unresolved} unresolved row(s) in docs/operations/bookkeeping.md. Dispatch the bookkeeper, resolve, or convert to \`waived:\` with a reason and expiry.`
+      `BLOCKED — bookkeeping. ${blocking.length} unresolved row(s) in docs/operations/bookkeeping.md implicate this commit:\n${lines.join("\n")}\n` +
+        "Dispatch the bookkeeper, resolve them, or convert to `waived:` with a reason and expiry." +
+        (unrelated > 0
+          ? ` (${unrelated} further unresolved row(s) implicate nothing staged here — another session's work, and not yours to drain.)`
+          : "")
     );
   }
 
@@ -423,7 +438,8 @@ function stopGate(projectDir, payload) {
   if (payload.stop_hook_active) return null; // the runtime's infinite-loop guard — never re-block
 
   // The Stop wall is scoped to this session's own rows (plus sid-less ones) — a concurrent
-  // session's open work must not block this one's stop. The commit wall stays global.
+  // session's open work must not block this one's stop. End-of-session accountability is per
+  // session and stays that way; the commit wall scopes by staged path instead, and CI by nothing.
   const mine = readQueue(projectDir).filter(
     (row) => !/\bsid=/.test(row.body) || row.body.includes(`sid=${payload.session_id}`)
   );

package/data/harnesses/code/hooks/lib/state.mjs

@@ -9,15 +9,20 @@
 // only while its expires= date is in the future; past it, the deferral is over and the wall returns.
 // Rows are also re-verified against the repo before the walls read them (awareness.mjs's sweep),
 // so a row whose condition died is deleted rather than waiting for its date.
+//
+// The three walls read the queue at three widths: the commit wall takes only the rows implicating
+// the commit's staged set (§ What a row implicates), the Stop wall takes the ending session's own
+// rows, and CI takes every row. Accountability is per session; a commit is per set of files.
 
 import fs from "node:fs";
 import path from "node:path";
+import { globToRegExp } from "./ownership.mjs";
 
 export const QUEUE_PATH = ["docs", "operations", "bookkeeping.md"];
 
 export const QUEUE_HEADER = `# Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to \`waived:\`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`.\n\n**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — \`waived:\` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a \`waived:\` row carries \`expires=\`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to \`waived:\`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`.\n\n**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — \`waived:\` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a \`waived:\` row carries \`expires=\`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
 `;
 
 export function queueFile(projectDir) {
@@ -143,6 +148,85 @@ export function countRows(rows, today = new Date().toISOString().slice(0, 10)) {
   return c;
 }
 
+// The unresolved rows themselves — the same set countRows() tallies, as rows rather than a number.
+export function unresolvedRows(rows, today = new Date().toISOString().slice(0, 10)) {
+  return rows.filter((row) => {
+    if (row.kind !== "waived") return true;
+    const expires = waiverExpiry(row);
+    return !expires || expires < today;
+  });
+}
+
+// --- What a row implicates -------------------------------------------------------------------
+//
+// THE COMMIT WALL IS SCOPED BY PATH. Every mechanical finding names the file it is about, so a
+// commit can be walled by the rows implicating ITS staged set rather than by the whole queue.
+// A global wall is unattributable the moment agents share a checkout: sibling agents also share a
+// session id, so an agent ready to commit was held behind rows a concurrent sibling raised — rows
+// the ownership etiquette (drain only what your own edits raised) forbids it from draining, which
+// makes the wall a wait with no action that clears it. Measured on the fleet: a 15-minute stall
+// behind a sibling's ten rows, and two agents in 5–6-minute mutual politeness loops.
+//
+// The shapes below mirror the ones awareness.mjs's ROW_VERIFIERS re-test — one grammar, two
+// readers. Each rule captures every path the row names: the file the finding is about AND the doc
+// that owns or records it, since staging either one is a commit answering for that row.
+//
+// A ROW THIS CANNOT PARSE IMPLICATES EVERYTHING. Scoping may narrow a wall on evidence, never on
+// ignorance — so an unrecognized row, a judgment row, and a commit with nothing staged to compare
+// against all keep the old repo-wide block.
+const ROW_PATH_RULES = [
+  /·\s*doc-implicated\s*·\s*(\S+)\s+changed;\s+owning doc\s+(\S+?)\s+may need/,
+  /·\s*doc-lint\s*·\s*(\S+)\s+has\s/,
+  /·\s*header-missing\s*·\s*(\S+)\s+lacks\s/,
+  /·\s*index-row-missing\s*·\s*(\S+)\s+is not linked from\s+(\S+)/,
+  /·\s*package-rejected\s*·\s*(\S+)\s+declares\s/,
+  /·\s*frozen-record-edited\s*·\s*(\S+)\s+is a frozen record/,
+  /·\s*dead-glob\s*·\s*owns: glob\s+`([^`]+)`\s+in\s+(\S+)\s+matches/,
+  /→\s*lands-in:\s*(\S+\/\S+)/, // a note: row names the doc its context lands in
+];
+
+// The paths a row implicates, or null when its grammar yields none.
+export function rowPaths(row) {
+  for (const re of ROW_PATH_RULES) {
+    const m = re.exec(row.body);
+    if (!m) continue;
+    const paths = m.slice(1).filter(Boolean);
+    if (paths.length > 0) return paths;
+  }
+  return null;
+}
+
+// True when one of a row's tokens names a staged file. A token carrying `*` — the glob a dead-glob
+// row quotes — compiles through the ownership index's engine; a plain token matches a staged file
+// exactly, or as the directory it sits in.
+function tokenHitsStaged(token, staged) {
+  if (token.includes("*")) {
+    const re = globToRegExp(token);
+    return staged.some((f) => re.test(f));
+  }
+  return staged.some((f) => f === token || f.startsWith(token + "/"));
+}
+
+// The unresolved rows a commit staging `staged` must answer for, each with the staged paths it
+// implicates. `needs-session:` rows and expired waivers are judgments rather than mechanical
+// findings — they carry no reliable path and stay global by kind, which is the semantics they had
+// before scoping. Returns { blocking, unrelated }: `unrelated` counts the rows this commit is
+// walked past, which the block message reports so scoping is visible rather than silent.
+export function rowsBlockingCommit(rows, staged, today = new Date().toISOString().slice(0, 10)) {
+  const blocking = [];
+  let unrelated = 0;
+  for (const row of unresolvedRows(rows, today)) {
+    const paths = row.kind === "auto" || row.kind === "note" ? rowPaths(row) : null;
+    const hits = paths && staged.length > 0 ? paths.filter((p) => tokenHitsStaged(p, staged)) : null;
+    if (hits && hits.length === 0) {
+      unrelated += 1;
+      continue;
+    }
+    blocking.push({ row, hits: hits || [] });
+  }
+  return { blocking, unrelated };
+}
+
 // Format one auto: row per the grammar; the sid tail is the only provenance kept —
 // a transcript path or timestamp is machine noise in a PR-reviewed queue.
 export function formatAutoRow({ date, kind, description, action, sessionId }) {

package/data/harnesses/code/skills/documentation/templates/bookkeeping.md

@@ -1,13 +1,15 @@
 # Bookkeeping ledger (docs/operations/bookkeeping.md)
 
-Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop and commit — a commit is possible only when every row is resolved (deleted) or converted to `waived:`. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop, at commit, and in CI. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+
+**Each wall reads the queue at its own width.** Stop takes the ending session's own rows, because accountability for an arc is per session. The commit gate takes only the rows **implicating that commit's staged files** — a row names the file its finding is about, and holding a commit behind rows raised by somebody else's edits is a wait nothing the committer may do can clear. CI takes every row on the branch, where there is no staged set to scope by. Fail-closed cases stay repo-wide at the commit gate: a row whose grammar names no path, a `needs-session:` row, an expired waiver, and a commit staging nothing at all.
 
 The row grammar is machine-read by the hooks and CI; keep it exact. A `waived:` row's `expires=` date is enforced: CI honors the waiver until the date, then fails. `waived:` rows whose finding kind is `dead-glob` double as the dead-glob allowlist.
 
 ```
 # Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to `waived:`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to `waived:`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
 
 - auto: YYYY-MM-DD · {finding-kind} · {description} → {action} | sid={session_id} tp={transcript_path} ts={ISO}
 - note: YYYY-MM-DD · {area} · {one-line context only the session holds} → lands-in: {owning doc | backlog | memory} | sid=… tp=… ts=…

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "7358b638bff2"
+  "digest": "3bb0c6640019"
 }

package/data/harnesses/delivery/skills/documentation/templates/bookkeeping.md

@@ -1,13 +1,15 @@
 # Bookkeeping ledger (docs/operations/bookkeeping.md)
 
-Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop and commit — a commit is possible only when every row is resolved (deleted) or converted to `waived:`. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop, at commit, and in CI. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+
+**Each wall reads the queue at its own width.** Stop takes the ending session's own rows, because accountability for an arc is per session. The commit gate takes only the rows **implicating that commit's staged files** — a row names the file its finding is about, and holding a commit behind rows raised by somebody else's edits is a wait nothing the committer may do can clear. CI takes every row on the branch, where there is no staged set to scope by. Fail-closed cases stay repo-wide at the commit gate: a row whose grammar names no path, a `needs-session:` row, an expired waiver, and a commit staging nothing at all.
 
 The row grammar is machine-read by the hooks and CI; keep it exact. A `waived:` row's `expires=` date is enforced: CI honors the waiver until the date, then fails. `waived:` rows whose finding kind is `dead-glob` double as the dead-glob allowlist.
 
 ```
 # Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to `waived:`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to `waived:`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
 
 - auto: YYYY-MM-DD · {finding-kind} · {description} → {action} | sid={session_id} tp={transcript_path} ts={ISO}
 - note: YYYY-MM-DD · {area} · {one-line context only the session holds} → lands-in: {owning doc | backlog | memory} | sid=… tp=… ts=…

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.8",
+  "version": "1.5.9",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "f2edee92fac2"
+  "digest": "269767b3abdf"
 }

package/data/harnesses/etna/skills/documentation/templates/bookkeeping.md

@@ -1,13 +1,15 @@
 # Bookkeeping ledger (docs/operations/bookkeeping.md)
 
-Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop and commit — a commit is possible only when every row is resolved (deleted) or converted to `waived:`. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop, at commit, and in CI. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+
+**Each wall reads the queue at its own width.** Stop takes the ending session's own rows, because accountability for an arc is per session. The commit gate takes only the rows **implicating that commit's staged files** — a row names the file its finding is about, and holding a commit behind rows raised by somebody else's edits is a wait nothing the committer may do can clear. CI takes every row on the branch, where there is no staged set to scope by. Fail-closed cases stay repo-wide at the commit gate: a row whose grammar names no path, a `needs-session:` row, an expired waiver, and a commit staging nothing at all.
 
 The row grammar is machine-read by the hooks and CI; keep it exact. A `waived:` row's `expires=` date is enforced: CI honors the waiver until the date, then fails. `waived:` rows whose finding kind is `dead-glob` double as the dead-glob allowlist.
 
 ```
 # Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to `waived:`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to `waived:`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
 
 - auto: YYYY-MM-DD · {finding-kind} · {description} → {action} | sid={session_id} tp={transcript_path} ts={ISO}
 - note: YYYY-MM-DD · {area} · {one-line context only the session holds} → lands-in: {owning doc | backlog | memory} | sid=… tp=… ts=…

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.19.91",
+  "version": "0.19.92",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "b52694cf6295"
+  "etnaFingerprint": "a1cf8eb35f57"
 }