@nurix/etna 0.19.91 → 0.20.0

package/data/harnesses/code/hooks/compliance.mjs

@@ -11,7 +11,8 @@ import { readStdin, resolveProjectDir } from "./lib/ownership.mjs";
 import { readSafe, relIfInside, git, commandRoot, backtickTokens, SOURCE_EXT } from "./lib/repo.mjs";
 import { openGatedPlans, inPlanScope } from "./lib/plans.mjs";
 import { stagedExempt } from "./lib/exempt.mjs";
-import { readQueue, countRows, askedThisSession, recordAsked } from "./lib/state.mjs";
+import { readQueue, countRows, rowsBlockingCommit, askedThisSession, recordAsked } from "./lib/state.mjs";
+import { liveRows } from "./lib/sweep.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
@@ -150,7 +151,15 @@ function commitGate(projectDir, sessionId) {
     .split("\n")
     .map((s) => s.trim())
     .filter(Boolean);
-  if (staged.length > 0 && !stagedExempt(staged)) {
+  // A rename-only staged set is on the changelog rule's exemption list; the gate can now honor it
+  // the way CI's caller already does. At least one line, and every line a rename — one edit joins
+  // the set and the wall returns.
+  const nameStatus = (git(projectDir, ["diff", "--cached", "--name-status", "-M"]) || "")
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const allRenames = nameStatus.length > 0 && nameStatus.every((line) => line.startsWith("R"));
+  if (staged.length > 0 && !stagedExempt(staged) && !allRenames) {
     if (!staged.some((f) => f.startsWith("docs/history/changelog/"))) {
       return deny(
         projectDir,
@@ -161,24 +170,31 @@ function commitGate(projectDir, sessionId) {
       );
     }
   }
-  const counts = countRows(readQueue(projectDir));
-  if (counts.unresolved > 0) {
+  // The bookkeeping wall is scoped to the staged set — the grammar and its fail-closed cases are
+  // `lib/state.mjs` § What a row implicates. Rows about files this commit does not touch are
+  // somebody else's, and holding a commit behind rows its session may not drain is a wait with no
+  // action that clears it. The read goes through `liveRows` first: a gate tests conditions at gate
+  // time, never a cached record of them — a row whose condition died since the last sweep must not
+  // wall anything. Pure by design; the detector's next sweep deletes what this filtered out.
+  const { blocking, unrelated } = rowsBlockingCommit(liveRows(projectDir, readQueue(projectDir)), staged);
+  if (blocking.length > 0) {
+    const shown = blocking.slice(0, 8);
+    const lines = shown.map(({ row, hits }) =>
+      hits.length > 0
+        ? `  - ${row.kind}: ${row.body}\n    ↳ implicates staged ${hits.join(", ")}`
+        : `  - ${row.kind}: ${row.body}\n    ↳ names no staged path — a row like this blocks every commit`
+    );
+    if (blocking.length > shown.length) lines.push(`  - …and ${blocking.length - shown.length} more`);
     return deny(
       projectDir,
       sessionId,
       "bookkeeping",
       "git commit",
-      `BLOCKED — bookkeeping. ${counts.unresolved} unresolved row(s) in docs/operations/bookkeeping.md. Dispatch the bookkeeper, resolve, or convert to \`waived:\` with a reason and expiry.`
-    );
-  }
-
-  // This session's own open denials wall the commit too — a commit is the arc's end as much as a
-  // stop is, and an undisclosed failure must not ride out inside one.
-  const open = unresolvedDenials(projectDir, sessionId).filter((pair) => !pair.startsWith("changelog ·") && !pair.startsWith("bookkeeping ·"));
-  if (open.length > 0) {
-    return decision(
-      "deny",
-      `BLOCKED — session gate log. ${open.length} denial(s) this session have no resolved line (${open.join("; ")}). Append \`resolved\` to the session log — retried-ok happens automatically on a successful retry; otherwise \`waived → {ref}\` or \`disclosed → {changelog entry}\`. Never delete log lines.`
+      `BLOCKED — bookkeeping. ${blocking.length} unresolved row(s) in docs/operations/bookkeeping.md implicate this commit (each re-verified against the repo just now — these are live):\n${lines.join("\n")}\n` +
+        "Dispatch the bookkeeper, resolve them, or convert to `waived:` with a reason and expiry; a successful retry re-tests everything again." +
+        (unrelated > 0
+          ? ` (${unrelated} further unresolved row(s) implicate nothing staged here — another session's work, and not yours to drain.)`
+          : "")
     );
   }
 
@@ -423,9 +439,13 @@ function stopGate(projectDir, payload) {
   if (payload.stop_hook_active) return null; // the runtime's infinite-loop guard — never re-block
 
   // The Stop wall is scoped to this session's own rows (plus sid-less ones) — a concurrent
-  // session's open work must not block this one's stop. The commit wall stays global.
-  const mine = readQueue(projectDir).filter(
-    (row) => !/\bsid=/.test(row.body) || row.body.includes(`sid=${payload.session_id}`)
+  // session's open work must not block this one's stop. End-of-session accountability is per
+  // session and stays that way; the commit wall scopes by staged path instead, and CI by nothing.
+  // Filtered through `liveRows` (sid first — fewer verifier runs): the wall blocks on conditions
+  // that hold NOW, not on rows the last sweep happened to leave written down.
+  const mine = liveRows(
+    projectDir,
+    readQueue(projectDir).filter((row) => !/\bsid=/.test(row.body) || row.body.includes(`sid=${payload.session_id}`))
   );
   const counts = countRows(mine);
   if (counts.unresolved > 0 && !bookkeeperDispatched(payload.transcript_path)) {

package/data/harnesses/code/hooks/lib/ledger.mjs

@@ -1,31 +1,54 @@
-// harness/code/hooks/lib/ledger.mjs — the Test Obligations table, read the way the walls read it.
-// A row is discharged when its Outcome cell states one of the gate's three outcomes. The plan file
-// is the checked truth — a discharge held only in conversation memory does not exist, which is what
+// harness/code/hooks/lib/ledger.mjs — the plan's two ledgers, read the way the walls read them.
+// A row is discharged when its Outcome cell states one of the closed outcomes. The plan file is
+// the checked truth — a discharge held only in conversation memory does not exist, which is what
 // forces the gate to re-read the ledger from disk. Tables without an Outcome column predate the
 // contract and are out of scope: the same legacy tolerance the Gates: line gets, so an upgrade
 // cannot brick a plan already Complete.
 
 const OUTCOME = /^(satisfied|owes nothing|blocked)\b/i;
+const DOC_OUTCOME = /^(updated|owes nothing|blocked)\b/i;
 
-// Row numbers (the `#` column) of every ledger row whose Outcome cell is empty or off-vocabulary.
-export function undischargedRows(planText) {
-  const start = (planText || "").search(/^##\s+Test Obligations\b/m);
-  if (start === -1) return [];
+// The table rows of one `## <heading>` section, split into trimmed cells, plus the Outcome column
+// index (null when the table predates the column — legacy, out of contract).
+function sectionTable(planText, heading) {
+  const start = (planText || "").search(new RegExp(`^##\\s+${heading}\\b`, "m"));
+  if (start === -1) return null;
   const body = [];
   for (const line of planText.slice(start).split("\n").slice(1)) {
-    if (/^##\s/.test(line)) break; // next section
+    if (/^##\s/.test(line)) break;
     body.push(line);
   }
   const rows = body.filter((line) => /^\s*\|/.test(line));
-  if (rows.length < 3) return []; // header + divider + at least one data row
+  if (rows.length < 3) return null; // header + divider + at least one data row
   const header = rows[0].split("|").map((cell) => cell.trim().toLowerCase());
   const col = header.indexOf("outcome");
-  if (col === -1) return []; // legacy table — predates the Outcome contract
+  return { rows: rows.slice(2).map((line) => line.split("|").map((cell) => cell.trim())), col: col === -1 ? null : col };
+}
+
+// Row numbers (the `#` column) of every ledger row whose Outcome cell is empty or off-vocabulary.
+export function undischargedRows(planText) {
+  const table = sectionTable(planText, "Test Obligations");
+  if (!table || table.col === null) return [];
   const out = [];
-  for (const line of rows.slice(2)) {
-    const cells = line.split("|").map((cell) => cell.trim());
+  for (const cells of table.rows) {
     if (!/^\d+$/.test(cells[1] || "")) continue;
-    if (!OUTCOME.test(cells[col] || "")) out.push(cells[1]);
+    if (!OUTCOME.test(cells[table.col] || "")) out.push(cells[1]);
+  }
+  return out;
+}
+
+// Doc names of every Doc Obligations row whose Outcome cell is empty or off-vocabulary. Cells may
+// be bolded (**updated**); a table without the column is legacy and passes — same tolerance as the
+// test ledger, so the column's arrival cannot brick a plan already Complete.
+export function undischargedDocRows(planText) {
+  const table = sectionTable(planText, "Doc Obligations");
+  if (!table || table.col === null) return [];
+  const out = [];
+  for (const cells of table.rows) {
+    const doc = (cells[1] || "").replace(/`/g, "");
+    if (!doc || /^-+$/.test(doc)) continue;
+    const outcome = (cells[table.col] || "").replace(/\*/g, "").trim();
+    if (!DOC_OUTCOME.test(outcome)) out.push(doc);
   }
   return out;
 }

package/data/harnesses/code/hooks/lib/state.mjs

@@ -9,15 +9,20 @@
 // only while its expires= date is in the future; past it, the deferral is over and the wall returns.
 // Rows are also re-verified against the repo before the walls read them (awareness.mjs's sweep),
 // so a row whose condition died is deleted rather than waiting for its date.
+//
+// The three walls read the queue at three widths: the commit wall takes only the rows implicating
+// the commit's staged set (§ What a row implicates), the Stop wall takes the ending session's own
+// rows, and CI takes every row. Accountability is per session; a commit is per set of files.
 
 import fs from "node:fs";
 import path from "node:path";
+import { globToRegExp } from "./ownership.mjs";
 
 export const QUEUE_PATH = ["docs", "operations", "bookkeeping.md"];
 
 export const QUEUE_HEADER = `# Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to \`waived:\`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`.\n\n**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — \`waived:\` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a \`waived:\` row carries \`expires=\`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to \`waived:\`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`.\n\n**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — \`waived:\` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a \`waived:\` row carries \`expires=\`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
 `;
 
 export function queueFile(projectDir) {
@@ -143,6 +148,85 @@ export function countRows(rows, today = new Date().toISOString().slice(0, 10)) {
   return c;
 }
 
+// The unresolved rows themselves — the same set countRows() tallies, as rows rather than a number.
+export function unresolvedRows(rows, today = new Date().toISOString().slice(0, 10)) {
+  return rows.filter((row) => {
+    if (row.kind !== "waived") return true;
+    const expires = waiverExpiry(row);
+    return !expires || expires < today;
+  });
+}
+
+// --- What a row implicates -------------------------------------------------------------------
+//
+// THE COMMIT WALL IS SCOPED BY PATH. Every mechanical finding names the file it is about, so a
+// commit can be walled by the rows implicating ITS staged set rather than by the whole queue.
+// A global wall is unattributable the moment agents share a checkout: sibling agents also share a
+// session id, so an agent ready to commit was held behind rows a concurrent sibling raised — rows
+// the ownership etiquette (drain only what your own edits raised) forbids it from draining, which
+// makes the wall a wait with no action that clears it. Measured on the fleet: a 15-minute stall
+// behind a sibling's ten rows, and two agents in 5–6-minute mutual politeness loops.
+//
+// The shapes below mirror the ones awareness.mjs's ROW_VERIFIERS re-test — one grammar, two
+// readers. Each rule captures every path the row names: the file the finding is about AND the doc
+// that owns or records it, since staging either one is a commit answering for that row.
+//
+// A ROW THIS CANNOT PARSE IMPLICATES EVERYTHING. Scoping may narrow a wall on evidence, never on
+// ignorance — so an unrecognized row, a judgment row, and a commit with nothing staged to compare
+// against all keep the old repo-wide block.
+const ROW_PATH_RULES = [
+  /·\s*doc-implicated\s*·\s*(\S+)\s+changed;\s+owning doc\s+(\S+?)\s+may need/,
+  /·\s*doc-lint\s*·\s*(\S+)\s+has\s/,
+  /·\s*header-missing\s*·\s*(\S+)\s+lacks\s/,
+  /·\s*index-row-missing\s*·\s*(\S+)\s+is not linked from\s+(\S+)/,
+  /·\s*package-rejected\s*·\s*(\S+)\s+declares\s/,
+  /·\s*frozen-record-edited\s*·\s*(\S+)\s+is a frozen record/,
+  /·\s*dead-glob\s*·\s*owns: glob\s+`([^`]+)`\s+in\s+(\S+)\s+matches/,
+  /→\s*lands-in:\s*(\S+\/\S+)/, // a note: row names the doc its context lands in
+];
+
+// The paths a row implicates, or null when its grammar yields none.
+export function rowPaths(row) {
+  for (const re of ROW_PATH_RULES) {
+    const m = re.exec(row.body);
+    if (!m) continue;
+    const paths = m.slice(1).filter(Boolean);
+    if (paths.length > 0) return paths;
+  }
+  return null;
+}
+
+// True when one of a row's tokens names a staged file. A token carrying `*` — the glob a dead-glob
+// row quotes — compiles through the ownership index's engine; a plain token matches a staged file
+// exactly, or as the directory it sits in.
+function tokenHitsStaged(token, staged) {
+  if (token.includes("*")) {
+    const re = globToRegExp(token);
+    return staged.some((f) => re.test(f));
+  }
+  return staged.some((f) => f === token || f.startsWith(token + "/"));
+}
+
+// The unresolved rows a commit staging `staged` must answer for, each with the staged paths it
+// implicates. `needs-session:` rows and expired waivers are judgments rather than mechanical
+// findings — they carry no reliable path and stay global by kind, which is the semantics they had
+// before scoping. Returns { blocking, unrelated }: `unrelated` counts the rows this commit is
+// walked past, which the block message reports so scoping is visible rather than silent.
+export function rowsBlockingCommit(rows, staged, today = new Date().toISOString().slice(0, 10)) {
+  const blocking = [];
+  let unrelated = 0;
+  for (const row of unresolvedRows(rows, today)) {
+    const paths = row.kind === "auto" || row.kind === "note" ? rowPaths(row) : null;
+    const hits = paths && staged.length > 0 ? paths.filter((p) => tokenHitsStaged(p, staged)) : null;
+    if (hits && hits.length === 0) {
+      unrelated += 1;
+      continue;
+    }
+    blocking.push({ row, hits: hits || [] });
+  }
+  return { blocking, unrelated };
+}
+
 // Format one auto: row per the grammar; the sid tail is the only provenance kept —
 // a transcript path or timestamp is machine noise in a PR-reviewed queue.
 export function formatAutoRow({ date, kind, description, action, sessionId }) {

package/data/harnesses/code/hooks/lib/sweep.mjs

@@ -0,0 +1,172 @@
+// harness/code/hooks/lib/sweep.mjs — row re-verification, shared by the detector and the walls.
+//
+// THE QUEUE IS DERIVED, NOT ACCUMULATED. Every finding here is recomputable from the repo, so a row
+// is a cache of a condition rather than a record of an event — and a cache nothing invalidates is
+// an archive. Two consumers, two shapes: `sweepResolvedRows` (the detector's writer — deletes dead
+// rows from the queue file) and `liveRows` (the walls' pure read — same verifiers, NO file writes,
+// because a PreToolUse gate or a CI check must never mutate the queue: on `git commit -a` a sweep's
+// deletions would ride into the commit unauthored).
+//
+// THIS RUNS OVER `waived:` ROWS TOO, WHICH IS THE POINT. A waiver defers a finding; it does not
+// make the finding immortal. Without this, waiving was strictly WORSE than leaving a row alone —
+// the one existing resolver filtered `kind === "auto"`, so waiving a self-clearing row opted it out
+// of its own return path forever. The condition, not the row's kind, decides.
+//
+// A kind with no verifier here is not swept — it ages out through `expires=` instead. Add a
+// verifier whenever a finding becomes mechanically checkable; silence is the only failure mode
+// this file has, so a verifier that is unsure must return false and leave the row standing.
+
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { globToRegExp, listRepoFiles } from "./ownership.mjs";
+import { readSafe } from "./repo.mjs";
+import { resolveRows } from "./state.mjs";
+import { rejectedPackages } from "./approved.mjs";
+
+// Spawn the installed doc-lint over one file; returns finding lines (empty when absent/clean).
+export function docLint(projectDir, rel) {
+  const script = path.join(projectDir, ".claude", "skills", "documentation", "scripts", "doc-lint.mjs");
+  if (!fs.existsSync(script)) return [];
+  const res = spawnSync("node", [script, rel], { cwd: projectDir, encoding: "utf8", timeout: 5000 });
+  const out = `${res.stdout || ""}`;
+  return out.split("\n").filter((line) => /:\d+ \[(block|warn)\]/.test(line));
+}
+
+// True when a source file's first lines carry its repo-relative path (the header-comment rule).
+export function hasHeaderComment(projectDir, rel) {
+  const head = readSafe(path.join(projectDir, rel)).split("\n").slice(0, 5).join("\n");
+  return head.includes(rel) || head.includes(path.basename(rel));
+}
+
+// Verifier keys the detector no longer emits — swept when machine-raised, never taught to authors.
+export const RETIRED_KINDS = ["doc-placement", "boundary-scan-suggested"];
+
+export const ROW_VERIFIERS = {
+  // "<rel> lacks its file-path header comment" — dead once the header is there (or the file is gone).
+  "header-missing": (projectDir, body) => {
+    const m = /·\s+header-missing\s+·\s+(\S+)\s+lacks/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    return hasHeaderComment(projectDir, rel);
+  },
+
+  // "owns: glob `<glob>` in <doc> matches no files" — dead once the glob matches something again.
+  "dead-glob": (projectDir, body, ctx) => {
+    const m = /`([^`]+)`/.exec(body);
+    if (!m) return false;
+    const re = globToRegExp(m[1]);
+    return ctx.repoFiles.some((f) => re.test(f));
+  },
+
+  // "<rel> is a frozen record and carries uncommitted modifications" — dead once it is committed.
+  // Immutability begins at commit, so the finding exists only while the edit is still in flight.
+  "frozen-record-edited": (projectDir, body) => {
+    const m = /·\s+frozen-record-edited\s+·\s+(\S+)\s+is a frozen record/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    const res = spawnSync("git", ["diff", "--quiet", "HEAD", "--", rel], { cwd: projectDir, timeout: 5000 });
+    // status 0 = no uncommitted modifications. A git failure leaves the row standing.
+    return res.status === 0;
+  },
+
+  // "<src> changed; owning doc <doc> may need an update" — dead once the doc is newer than the
+  // source that implicated it, which is the same freshness test the drift report already applies.
+  "doc-implicated": (projectDir, body) => {
+    const m = /·\s+doc-implicated\s+·\s+(\S+)\s+changed;\s+owning doc\s+(\S+?)\s+may need/.exec(body);
+    if (!m) return false;
+    const [, src, doc] = m;
+    const mtime = (rel) => {
+      try {
+        return fs.statSync(path.join(projectDir, rel)).mtimeMs;
+      } catch (e) {
+        return null;
+      }
+    };
+    const docTime = mtime(doc);
+    const srcTime = mtime(src);
+    if (docTime === null) return false; // the doc is gone — a real finding, not a resolved one
+    if (srcTime === null) return true; // the source is gone; nothing implicates the doc any more
+    return docTime >= srcTime;
+  },
+
+  // "<rel> has N doc-lint finding(s)" — dead once a re-run comes back clean (or the doc is gone).
+  "doc-lint": (projectDir, body) => {
+    const m = /·\s+doc-lint\s+·\s+(\S+)\s+has/.exec(body);
+    if (!m) return false;
+    if (!fs.existsSync(path.join(projectDir, m[1]))) return true;
+    return docLint(projectDir, m[1]).length === 0;
+  },
+
+  // "<rel> is not linked from docs/README.md" — dead once the index names it (or it is gone).
+  "index-row-missing": (projectDir, body) => {
+    const m = /·\s+index-row-missing\s+·\s+(\S+)\s+is not linked/.exec(body);
+    if (!m) return false;
+    if (!fs.existsSync(path.join(projectDir, m[1]))) return true;
+    return readSafe(path.join(projectDir, "docs", "README.md")).includes(path.basename(m[1]));
+  },
+
+  // "<rel> declares `<name>` (package-rejected)" — dead once the manifest drops the package
+  // or the table stops rejecting it.
+  "package-rejected": (projectDir, body) => {
+    const m = /·\s+package-rejected\s+·\s+(\S+)\s+declares\s+`([^`]+)`/.exec(body);
+    if (!m) return false;
+    const [, rel, name] = m;
+    let manifest;
+    try {
+      manifest = JSON.parse(readSafe(path.join(projectDir, rel)));
+    } catch (e) {
+      return !fs.existsSync(path.join(projectDir, rel)); // gone ⇒ resolved; unparseable ⇒ standing
+    }
+    const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+    if (!(name in declared)) return true;
+    return !rejectedPackages(projectDir).has(name);
+  },
+
+  // Retired detector kinds — the harness no longer raises these, so a standing row caches a
+  // condition nothing can re-derive. Swept unconditionally — but only machine-raised rows: a
+  // note: or waived: row whose free text merely mentions the phrase is a human's, not ours.
+  "doc-placement": (projectDir, body, ctx, row) => row.kind === "auto",
+  "boundary-scan-suggested": (projectDir, body, ctx, row) => row.kind === "auto",
+};
+
+// The repo-file list is only needed by the dead-glob verifier — walk the tree lazily, once.
+function verifierContext(projectDir, repoFiles) {
+  let cached = repoFiles || null;
+  return {
+    get repoFiles() {
+      if (!cached) cached = listRepoFiles(projectDir);
+      return cached;
+    },
+  };
+}
+
+// True when the row's condition no longer holds. Unsure (no verifier, verifier threw) ⇒ false.
+function conditionDead(projectDir, row, ctx) {
+  if (row.kind === "needs-session") return false; // a human judgment, never swept mechanically
+  for (const [kind, verify] of Object.entries(ROW_VERIFIERS)) {
+    if (!row.body.includes(kind)) continue;
+    try {
+      return verify(projectDir, row.body, ctx, row);
+    } catch (e) {
+      return false; // never drop a row because a verifier threw
+    }
+  }
+  return false;
+}
+
+// The walls' read: rows whose condition still holds, re-tested against the repo as it is NOW.
+// Pure — the queue file is untouched; the detector's next sweep deletes what this filtered out.
+export function liveRows(projectDir, rows, repoFiles) {
+  const ctx = verifierContext(projectDir, repoFiles);
+  return rows.filter((row) => !conditionDead(projectDir, row, ctx));
+}
+
+// The detector's writer: delete every row — `auto:` or `waived:` — whose condition no longer
+// holds. Returns the count removed.
+export function sweepResolvedRows(projectDir, repoFiles) {
+  const ctx = verifierContext(projectDir, repoFiles);
+  return resolveRows(projectDir, (row) => conditionDead(projectDir, row, ctx));
+}

package/data/harnesses/code/rules/frontend.md

@@ -29,7 +29,7 @@ Every package compiles under `strict: true` and `noUncheckedIndexedAccess: true`
 
 - **Never** `any` to silence the checker. Unknown value → type `unknown`, then narrow (type guard / `zod` parse).
 - **Never** weaken strictness: no `// @ts-nocheck`; `// @ts-expect-error` only with a same-line reason.
-- Infer locals and return types; annotate at boundaries (exports, props, contracts).
+- Annotate at boundaries (exports, props, contracts).
 
 ### Generics
 

package/data/harnesses/code/rules/general.md

@@ -19,11 +19,11 @@ How a package's `src/` is laid out. A single-runtime package drops `server/` and
 
 **Never `core/`** — its membership test collapses to "is it important?", making it the queue for files nobody could place; a bare `lib/` holding everything non-visual fails the same way, which is what `shared/` prevents. A route's own nested `lib/` is private and is **never** hoisted, and **dependencies point down** — a shared folder importing one route folder is a defect.
 
-**A folder earns its place at ~4+ files, or by being a boundary somebody could delete whole.** Below that, inline it: a folder around one file is a longer filename, and a folder holding only another folder is cascade with nothing at it. Density — not depth, not root breadth — is what makes a tree read as sprawling. The boundary clause splits the one-file cases: a one-file route folder stays, a one-file component folder goes.
+**A folder earns its place at ~4+ files, or by being a boundary somebody could delete whole.** Below that, inline it. The boundary clause splits the one-file cases: a one-file route folder stays, a one-file component folder goes.
 
-**Never judge dead code by a name grep** — a relative import never contains its own parent's path, so `grep "x/brand"` cannot see `from "./brand/Detail"`, and every folder imported only by its parent reads as dead. Test by transitive reachability from the real entry points, resolving specifiers as the bundler does (`.ts`, `.tsx`, `.css`, `/index.ts`; strip `?raw`/`?url`; map a `.js` specifier onto its `.ts` source), running the test tree as a **second, separate** entry set — reachable from tests alone means a suite pinning code nothing ships, and both go together. Ambient `.d.ts` files enter through tsconfig `include`, so a sweep always reports them dead. A retired mechanism spans more than source — grep the build config for the same concept before calling a removal complete. **Unreachable ≠ unwanted**: a routed surface rendering dummy data is reachable and still not product, and retiring it removes a route, which is a product decision.
+**Never judge dead code by a name grep** — a relative import never contains its own parent's path, so every folder imported only by its parent reads as dead. Test by transitive reachability from the real entry points, resolving specifiers as the bundler does (`.ts`, `.tsx`, `.css`, `/index.ts`; strip `?raw`/`?url`; map a `.js` specifier onto its `.ts` source), with the test tree as a **second, separate** entry set — reachable from tests alone is a suite pinning code nothing ships. Ambient `.d.ts` files enter through tsconfig `include`, so a sweep always reports them dead; grep the build config for a retired mechanism before calling its removal complete. **Unreachable ≠ unwanted**: retiring a routed dummy surface removes a route — a product decision.
 
-**Reshape an existing tree largest-lever-first**, verifying typecheck plus the full suite between steps: purge unreachable files → collapse single-occupancy and pass-through folders → push domain-coupled components down → name the shared layer (the only step that adds a top-level name) → optionally add a path alias, which makes depth invisible at the import site and dissolves most "flatten it" instincts. **Delete and promote before you move** — a folder whose name misdescribes its contents just relocates the lie.
+**Reshape an existing tree largest-lever-first**, verifying typecheck plus the full suite between steps: purge unreachable files → collapse single-occupancy and pass-through folders → push domain-coupled components down → name the shared layer (the only step that adds a top-level name) → optionally add a path alias (depth becomes invisible at the import site). **Delete and promote before you move** — a folder whose name misdescribes its contents just relocates the lie.
 
 ## Runtime Versions
 

package/data/harnesses/code/rules/nomenclature.md

@@ -20,11 +20,7 @@ Names state intent in full words — clarity over brevity; no abbreviations unle
 
 | Identifier | Shape | Example |
 | --- | --- | --- |
-| Variable | noun phrase | `paymentStatus` |
-| Function / method | verb phrase naming the action | `validateInput` |
 | Boolean | `is` / `has` / `can` / `should` prefix — **never** a bare adjective | `hasPermission` |
 | Array / collection | plural noun | `errorMessages` |
-| Class / component | singular noun phrase | `RequestHandler` |
 | Event handler | `handle` or `on` prefix | `handleSubmit`, `onPageLoad` |
 | Interface | `I` prefix acceptable; type aliases stay plain | `IConfigOptions`, `AuthResponse` |
-| Async function | verb phrase; `Async` suffix acceptable | `loadConfigAsync` |

package/data/harnesses/code/rules/pnpm.md

@@ -1,6 +1,6 @@
 # pnpm — `@nurix/*` Workspaces: naming, boundaries, and consuming
 
-How a `@nurix/*` repo is **named**, **structured**, and how its packages are **consumed** — every repo takes the workspace shape, single-package frontends included. Publishing and CLI design live in the `nustack` skill, not here.
+How a `@nurix/*` repo is **named**, **structured**, and how its packages are **consumed** — every repo takes the workspace shape, single-package frontends included. Publishing and CLI design live in the `nustack` skill, not here — no `nustack` skill in the runtime ⇒ ask before crossing the publish boundary.
 
 ---
 

package/data/harnesses/code/rules/testing.md

@@ -32,6 +32,7 @@ Rules for the plan regime between the plan gate and the verification gate:
 - **Precondition: the ledger exists.** A plan with no Test Obligations section is blocked at the gate — run the `testing` skill (plan-gate mode) on it first; an empty ledger passes vacuously and the gap surfaces only after the file is frozen.
 - **The verdict is never delegated** (the root policy file § Delegation), and where browser work is main-session-only (its § Runtime Notes), the driving is too. Fan-out may prepare fixtures or draft test bodies; the driving and the verdict stay inline.
 - **The gate needs no stronger tier than the session default** — a standard-tier session suffices whatever tier built the plan; the plan and its ledger carry all the state the gate needs, so gating in a fresh session loses nothing.
+- **Browser driving is the gate's final rung.** Playwright / Chrome CDP drives run once, at the end, after suites and cheap oracles are green — never interleaved mid-loop; they are the most expensive oracle in time and tokens.
 - **Report what happened, including failures.** A gate that reports green while a suite is red is worse than no gate; state the failing test and its output.
 - **Abandonment does not erase debt.** Before `Status: Abandoned` freezes a plan whose code was committed, convert its undischarged rows into backlog items; uncommitted code owes nothing.
 

package/data/harnesses/code/skills/boundary/SKILL.md

@@ -65,7 +65,7 @@ The packs are a floor, not a fence: report any contract that passes the ships-gr
 
    **BLOCK** = any CRITICAL. HIGH findings yield **PASS WITH AMENDMENTS** — fold the amendments into the plan before coding. Order amendments sequencing-first: many violations dissolve by reordering steps (expand-then-contract, migrate-before-code) rather than changing what ships — prefer that fix, drawn from the entry's safe-change sequence.
 
-6. **Record the verdict in the plan's `Gates:` line.** Rewrite only your own segment, to exactly `Boundary: passed YYYY-MM-DD` (PASS, or PASS WITH AMENDMENTS once the amendments are folded) or `Boundary: blocked YYYY-MM-DD` (BLOCK). The compliance hook greps these exact forms — implementation edits stay blocked while the segment reads `pending`. A plan with no `Gates:` line predates the format; add the line rather than skipping the write-back.
+6. **Record the verdict in the plan's `Gates:` line.** Rewrite only your own segment, to exactly `Boundary: passed YYYY-MM-DD` (PASS, or PASS WITH AMENDMENTS once the amendments are folded) or `Boundary: blocked YYYY-MM-DD` (BLOCK). The compliance hook greps exactly this segment — implementation edits inside the plan's scope stay blocked while it reads `Boundary: pending` (the other gates are enforced by section presence, not segment text). A plan with no `Gates:` line predates the format; add the line rather than skipping the write-back.
 
 ## Rules
 

package/data/harnesses/code/skills/documentation/SKILL.md

@@ -113,7 +113,7 @@ The two guarantees are complementary and both break on mixing: a reader holding
 | Plan | Record | `YYYY-MM-DD-kebab-case.md` | Freezes at `Complete` / `Abandoned` |
 | Changelog entry | Record | `YYYY-MM-DD-kebab-case.md` | Frozen; master index append-only |
 | Migration runbook | Record | `YYYY-MM-DD-kebab-case.md` | Freezes once executed, outcome stamped |
-| Research | Record | `history/research/{topic}/` | Frozen snapshot |
+| Research | Record | in progress: `docs/research/{topic}/` · harvested: `docs/history/brainstorms/{topic}/` | Frozen at harvest |
 | Memory | Record | `{agent-name}.md` | Append-only dated ledger |
 
 ---

package/data/harnesses/code/skills/documentation/templates/behavioral-checklist.md

@@ -2,7 +2,7 @@
 
 Truth document. Use for: **how to verify one feature's promised behavior by driving the real product** — the browser, the CLI binary, HTTP against the running service. One file per feature, named for the feature doc that owns the code (`docs/features/auth.md` → `docs/tests/auth.md`). No frontmatter; a checklist owns no code.
 
-**This is the driving script, and it is the source the suite is drawn from.** At the verification gate it does double duty: rung 1 drives the real surface *against these steps*, and rung 2 pins the durable subset *of these assertions* as suite tests. Writing it is therefore not a report written afterwards — it is authored or updated **before** the driving, so the gate has something to execute and the tests have something to be derived from. Which assertions earn a permanent test is decided by `verification.md` § What earns a durable test, and each section records the answer on its `Pinned:` line.
+**This is the driving script, and it is the source the suite is drawn from.** At the verification gate it does double duty: rung 1 drives the real surface *against these steps*, and rung 2 pins the durable subset *of these assertions* as suite tests. Writing it is therefore not a report written afterwards — it is authored or updated **before** the driving, so the gate has something to execute and the tests have something to be derived from. Which assertions earn a permanent test is decided by the `testing` skill (gate mode) § What earns a suite test, and each section records the answer on its `Pinned:` line.
 
 A checklist outlives the tests it seeds. Where a Playwright script breaks on every selector change, a checklist states the behavior and lets the implementation move under it — so it is written in the product's own vocabulary (labels, URLs, rows) and never in the code's (function names, props, internal state).
 

package/data/harnesses/code/skills/documentation/templates/bookkeeping.md

@@ -1,18 +1,24 @@
 # Bookkeeping ledger (docs/operations/bookkeeping.md)
 
-Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop and commit — a commit is possible only when every row is resolved (deleted) or converted to `waived:`. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
+Truth document with an unusual lifecycle: a **work queue**, not an archive. Rows are appended mechanically by the awareness hook (`auto:`) and deliberately by working sessions (`note:`), drained by the `bookkeeper` agent, and walled at Stop, at commit, and in CI. What survives in git — `waived:` and `needs-session:` rows — is exactly what a PR reviewer should see.
 
-The row grammar is machine-read by the hooks and CI; keep it exact. A `waived:` row's `expires=` date is enforced: CI honors the waiver until the date, then fails. `waived:` rows whose finding kind is `dead-glob` double as the dead-glob allowlist.
+**Each wall reads the queue at its own width, and re-verifies conditions at gate time.** Stop takes the ending session's own rows, because accountability for an arc is per session. The commit gate takes only the rows **implicating that commit's staged files** — a row names the file its finding is about, and holding a commit behind rows raised by somebody else's edits is a wait nothing the committer may do can clear. CI takes every row on the branch, where there is no staged set to scope by. All three re-test each row against the repo before blocking, so a row whose condition has died walls nothing. Fail-closed cases stay repo-wide at the commit gate: a row whose grammar names no path, a `needs-session:` row, an expired waiver, and a commit staging nothing at all.
+
+The fenced block's prose is a **verbatim quote of the queue header the hooks self-heal** (`QUEUE_HEADER` in the hooks' `lib/state.mjs`) — code is canonical; a wording change starts there. The row grammar lines beneath it are taught here and parsed by the hooks; keep both exact.
 
 ```
 # Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to `waived:`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`. A `waived:` row carries `expires=` and is PR-reviewable history.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit goes through only when every row **implicating one of its staged files** is either **resolved, which deletes it**, or converted to `waived:`. A row about files the commit does not touch belongs to whoever raised it; a row naming no file, and a commit staging none, block everything. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the `documentation` skill's `templates/bookkeeping.md`.
+
+**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — `waived:` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a `waived:` row carries `expires=`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
 
-- auto: YYYY-MM-DD · {finding-kind} · {description} → {action} | sid={session_id} tp={transcript_path} ts={ISO}
-- note: YYYY-MM-DD · {area} · {one-line context only the session holds} → lands-in: {owning doc | backlog | memory} | sid=… tp=… ts=…
-- needs-session: YYYY-MM-DD · {what the bookkeeper could not ground} → main session resolves | refs={original row ts}
-- waived: YYYY-MM-DD · {what is deferred} · reason: {why} → expires=YYYY-MM-DD
+- auto: YYYY-MM-DD · {finding-kind} · {description} → {action} | sid={session_id}
+- note: YYYY-MM-DD · {area} · {one-line context only the session holds} → lands-in: {owning doc | backlog | memory} | sid={session_id}
+- needs-session: YYYY-MM-DD · {what the bookkeeper could not ground} → main session resolves | refs={implicated file}
+- waived: YYYY-MM-DD · {finding-kind} · `{subject}` · reason: {why} → expires=YYYY-MM-DD
 ```
 
-Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `package-rejected` · `frozen-record-edited`.
+**A waiver covers a finding only when it names the finding's kind and its subject in backticks** — the matcher (`waiverCovers`) tests the backticked subject exactly, so a waiver written without them silences nothing and the wall stands. A `waived:` row's `expires=` date is enforced: CI honors the waiver until the date, then fails. `dead-glob` waivers double as the dead-glob allowlist; `ownership-overlap` waivers cover the CI ownership check the same way.
+
+Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `package-rejected` · `frozen-record-edited`. The CI ownership check additionally accepts `waived:` rows of kind `ownership-overlap`.