@nurix/etna 0.20.6 → 0.20.8

package/README.md

@@ -2,7 +2,7 @@
 
 CLI to bootstrap a project with a Nurix harness. Copies the harness's `CLAUDE.md`, skills, agents, rules, and hooks (plus scripts, if the harness ships any) into the project so they live with the code — version-controllable, editable per project, and visible without leaving the repo.
 
-A second install path also exists and is fully supported: `/plugin install <plugin>@nurixlabs` from inside Claude Code, which installs the harness as a plugin from the `nurixlabs/skills` marketplace. The two paths are first-class equals — pick the one that matches how you want to manage the harness. See [`docs/architecture/harness/Readme.md`](../../docs/architecture/harness/Readme.md#the-install-model) for the comparison.
+A second install path also exists and is fully supported: `/plugin install <plugin>@nurixlabs` from inside Claude Code, which installs the harness as a plugin from the `nurixlabs/skills` marketplace. The two paths are first-class equals — pick the one that matches how you want to manage the harness. See [`docs/playbooks/harness/Readme.md`](../../docs/playbooks/harness/Readme.md#the-install-model) for the comparison.
 
 ## Usage
 

package/data/catalog/rules/testing.md

@@ -37,6 +37,7 @@ Rules for the plan regime between the plan gate and the verification gate:
 - **On a rendered surface, browser driving LEADS the gate — it is not its final rung.** The order inverted deliberately: the defects that reach users through an interface are geometric and compositional, and a simulated DOM computes no layout, so a suite that is entirely green says nothing about whether anything is where it should be. **Reach the browser Chrome-CDP-first and Playwright second** — CDP drives a real browser interactively and needs no script written in advance, which is what discovery requires; Playwright is the fallback where CDP is unavailable and the tool of record for whatever must run unattended afterwards. Cheap oracles run in the same pass and are what the drive's findings get pinned into; they are no longer a gate to pass before looking. A surface with nothing rendered — a CLI, a service, a library — drives its own real binary or wire instead, and this clause does not apply.
 - **A judged drive discovers; a scripted assertion guards.** Only the first finds a defect nobody has seen — a script asserting a control's value passes over a control drawn on top of its own label. Scripts are written after a judged drive names the class of defect, never generated ahead of one, and **a red script is never regenerated** — regeneration re-derives the assertion from the surface as it currently is, which turns a defect into the asserted truth with everything green.
 - **Report what happened, including failures.** A gate that reports green while a suite is red is worse than no gate; state the failing test and its output.
+- **`cmd > log; echo "EXIT=$?"` reports the echo's status, never the command's** — a SIGTERM'd suite surfaces as "exit code 0", which is the worst direction for a gate to be wrong in. Read the real status from the log, or drop the trailing echo. Adjacent trap: a runner that never emits a summary is a dying **worker**, not a slow test — `--testTimeout` bounds neither, so bound the run and read the log.
 - **Abandonment does not erase debt.** Before `Status: Abandoned` freezes a plan whose code was committed, convert its undischarged rows into backlog items; uncommitted code owes nothing.
 
 ## Frameworks by stack

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "5e362f34919c",
+    "fingerprint": "bcf04d8d525c",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/lld-mode.md

@@ -18,10 +18,10 @@ You do NOT write the LLD — you return structured research that the main agent
 Map the documentation landscape — what exists, what is adjacent, how detailed the LLD should be, and what code paths are already owned:
 
 1. Read `./docs/structure.md` to understand the documentation structure
-2. If `./docs/features/README.md` exists, read it to see existing feature LLDs and where the new one fits; otherwise glob the feature docs directly
+2. Locate the repo's feature-doc layer from `structure.md` — the standard shape is `./docs/features/`, but a repo may document components under their own subject folders. Read that layer's index if it has one; otherwise glob for docs carrying `owns:` frontmatter
 3. If `./docs/memory/lld-mode.md` exists (or the legacy `./docs/memory/spec-mode.md`), read it for feature doc inventory, ownership conflict zones, and lessons from previous research
-4. Read 1-2 existing feature LLDs in `./docs/features/` to calibrate format and depth
-5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob `docs/features/**/*.md` and read each doc's `owns:` frontmatter directly.
+4. Read 1-2 existing feature LLDs from that layer to calibrate format and depth
+5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob the docs tree (excluding `docs/history/`) and read the `owns:` frontmatter of every doc that declares it.
 
 ## What You Research
 

package/data/harnesses/code/agents/maintenance.md

@@ -44,15 +44,15 @@ Decide the mode once, up front, from the version marker — then run.
 
 ## Part A — Coherence audit (always runs)
 
-The ownership source of truth is the **union of every feature doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
+The ownership source of truth is the **union of every doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing the docs tree for docs that declare `owns:`.
 
 ### Step 1: Build the ownership map
 
 1. Read `docs/structure.md` for the authority map.
-2. Glob `docs/features/**/*.md`, ignoring `*.bkp.*` files (installer backups awaiting the fold); for each, parse the frontmatter `owns:` globs and `module:` label.
+2. Glob the docs tree for markdown carrying `owns:` frontmatter, ignoring `*.bkp.*` files (installer backups awaiting the fold) and anything under `docs/history/` (frozen records quote retired globs as provenance). **Ownership is declared, not positional** — the standard shape files these docs under `docs/features/`, but a repo may declare ownership on any doc, and the index reads them all. For each, parse the `owns:` globs and `module:` label.
 3. Build a map: glob → owning doc + module. Narrower glob wins on overlap. **This IS the source of truth.**
 
-**Architecture-first fallback.** If no feature doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
+**Architecture-first fallback.** If no doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
 
 ### Step 2: Validate ownership
 
@@ -109,7 +109,7 @@ For each stale doc: update the doc directly when the drift is clear (renamed fun
 
 For each feature doc you verified accurate or updated this pass, stamp `last-reviewed:` in its frontmatter with today's date (add the key if absent). Never write review dates into the body — it's frontmatter metadata only.
 
-For unowned code paths, append: `- **[P2]** No feature doc owns \`{dir}/\` — discovered by maintenance` (`{dir}` = the actual unowned source directory).
+For an unowned code **region**, append: `- **[P2]** No feature doc owns \`{dir}/\` — discovered by maintenance` (`{dir}` = the actual unowned source directory). The target is **every region has an owner**, never every file: an individual shared file that several features import is expected to be unowned, because its authority is the contract it exposes rather than any one consumer. Report a directory that no doc's region covers; never mint a row for a shared file, and never propose closing a gap by adding a file glob to whichever doc happens to import it.
 
 **Declined realignment.** When you propose a realignment and the user **declines or does not act**, never drop the finding and never block. Append it to `docs/history/backlog.md` as `- **[P0–P3]** <finding> — discovered by maintenance`, priority = the finding's own severity **on the same P0–P3 scale as code items** — never a segregated "compliance" section, never auto-relegated to the lowest tier. Record once: dedupe against existing entries; if already present, leave it.
 
@@ -238,6 +238,7 @@ Apply the **§ Strategy memory** retirement procedure to `docs/memory/maintenanc
 - **A clean report is valid** — do not invent issues.
 - **Declarative, idempotent.** Re-running baseline mode on a current repo reshapes nothing — a second pass is just the audit plus the module proposal. Converge to the current shape; never replay a version ladder; never reconstruct a past shape.
 - **Brownfield extraction (operator-ruled 2026-08-19).** When baseline mode meets a repo with a real source tree and few or no feature docs, the module *proposal* is not enough — run the extraction pass: produce feature docs for the recognized modules (docs/features/, full frontmatter: `owns:` · `module:` · `keywords:` · `status:` · `last-reviewed:` · `type: feature` · `derivation: "extracted (baseline YYYY-MM-DD, codegraph + source read)"`), plus the architecture, tests, and operations layers. Use the `codegraph` skill where installed — localize through the index before reading; the docs record intent, the index answers facts. **Every extracted feature doc carries a `## History & Ownership` section** — top contributors with recency, churn posture, and bus-factor notes, dated "as of YYYY-MM-DD" (operator ruling: this section is mandatory in extraction output even though doc-lint flags dated narrative in truth docs; the findings are accepted for now, and a future harness version may retire the section in favor of live index pointers). `status:` is evidence-graded: `deprecated` only when history shows the area dead, never by guess. Scale by fan-out (one extraction lane per module, a completeness critic over the result) rather than one long cold read.
+- **Diagrams ride the baseline (operator-ruled 2026-08-24).** Whenever baseline mode produces or converges the architecture layer, draw two ASCII diagrams from the real source, each in its own fenced code block: (1) an **architecture diagram** in the system-design/architecture doc — the actual processes, entry points, and wire surfaces as boxes, the calls/queues/files between them as labelled arrows; (2) a **DB ER diagram** wherever the repo declares a relational schema (DDL, migrations, an ORM schema) — one box per table listing its key columns, FK edges drawn to the table they reference, cardinality on the edge; it lands in the domain-model doc, or `docs/architecture/data-model.md` when none exists. Box-drawing characters (`┌─┐│└┘├┤`), width ≤ 100 columns. Derived only from what the code declares — a diagram never invents a component the source does not show, and a repo with no relational schema gets **no** ER diagram rather than an imagined one. Diagrams are truth-document sections: later baselines and audits converge them in place like any other section.
 - **Tool tiers.** The SessionStart context names each manifest-declared tool with its tier; calibrate the run to it, never stall on it. **Present-fresh** (`Tool: codegraph 0.2.0`): use it — check `codegraph projects` for staleness, re-run `codegraph index` if HEAD has moved, then localize every question through the index before reading source. **Present-stale** (below the catalog minimum): still use it, but note the version gap and the upgrade command in the run report — a stale contract may lack answer shapes the skill assumes. **Absent** (`Tool: codegraph MISSING`): fall back to the cold method (Glob/Grep/read), state in the run report that the tool was absent and give the install command — degraded output is acceptable, silent degradation is not.
 - **One sentinel.** `docs/structure.md` `harness-version` is the only baseline/version marker.
 - **Modules are labels, layout-blind.** Seed from the code's bounded contexts; never from `pnpm-workspace.yaml`/workspace walls. Propose, don't force; acting is a `module:` tag, never a folder.

package/data/harnesses/code/codex/agents/lld-mode.toml

@@ -14,9 +14,9 @@ You do NOT write the LLD — you return structured research that the main agent
 Map the documentation landscape — what exists, what is adjacent, how detailed the LLD should be, and what code paths are already owned:
 
 1. Read `./docs/structure.md` to understand the documentation structure
-2. If `./docs/features/README.md` exists, read it to see existing feature LLDs and where the new one fits; otherwise glob the feature docs directly
+2. Locate the repo's feature-doc layer from `structure.md` — the standard shape is `./docs/features/`, but a repo may document components under their own subject folders. Read that layer's index if it has one; otherwise glob for docs carrying `owns:` frontmatter
 3. If `./docs/memory/lld-mode.md` exists (or the legacy `./docs/memory/spec-mode.md`), read it for feature doc inventory, ownership conflict zones, and lessons from previous research
-4. Read 1-2 existing feature LLDs in `./docs/features/` to calibrate format and depth
+4. Read 1-2 existing feature LLDs from that layer to calibrate format and depth
 5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob `docs/features/**/*.md` and read each doc's `owns:` frontmatter directly.
 
 ## What You Research

package/data/harnesses/code/codex/agents/maintenance.toml

@@ -42,15 +42,15 @@ Decide the mode once, up front, from the version marker — then run.
 
 ## Part A — Coherence audit (always runs)
 
-The ownership source of truth is the **union of every feature doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
+The ownership source of truth is the **union of every doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
 
 ### Step 1: Build the ownership map
 
 1. Read `docs/structure.md` for the authority map.
-2. Glob `docs/features/**/*.md`, ignoring `*.bkp.*` files (installer backups awaiting the fold); for each, parse the frontmatter `owns:` globs and `module:` label.
+2. Glob the docs tree for markdown carrying `owns:` frontmatter, ignoring `*.bkp.*` files and anything under `docs/history/`. **Ownership is declared, not positional** — the standard shape files these under `docs/features/`, but a repo may declare ownership on any doc. For each, parse the `owns:` globs and `module:` label.
 3. Build a map: glob → owning doc + module. Narrower glob wins on overlap. **This IS the source of truth.**
 
-**Architecture-first fallback.** If no feature doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
+**Architecture-first fallback.** If no doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
 
 ### Step 2: Validate ownership
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.14.2",
+  "version": "3.14.6",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -25,5 +25,5 @@
     }
   ],
   "docsRoot": "docs",
-  "digest": "410e5186a8b8"
+  "digest": "ec29198342ff"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -15,6 +15,7 @@ import {
   buildEdgeIndex,
   scanFeatureDocs,
   owningDocs,
+  owningDoc,
   listRepoFiles,
   deadGlobs,
   globToRegExp,
@@ -273,8 +274,14 @@ function sessionStart(projectDir, payload = {}) {
   // The doc→code index answers "which doc owns this file"; the edge index answers "which docs does
   // this doc implicate" — both directions of the same graph, and neither is hand-maintained.
   const edges = buildEdgeIndex(projectDir);
-  const context = [block, index, edges].filter(Boolean).join("\n\n");
+  let context = [block, index, edges].filter(Boolean).join("\n\n");
   if (!context) return;
+  // Announce the next growth cliff instead of leaving it to be discovered by an audit. The pipe
+  // buffer is 65,536 bytes; the harness's own always-loaded budget is far smaller than that.
+  const bytes = Buffer.byteLength(context, "utf8");
+  if (bytes > 60000) {
+    context = `# INDEX SIZE WARNING: this payload is ${bytes} bytes and is approaching the 65,536-byte pipe limit.\n${context}`;
+  }
   process.stdout.write(
     JSON.stringify({
       hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: context },
@@ -351,7 +358,15 @@ function detectorForFile(projectDir, rel, meta, rows) {
         })
       );
     }
-    for (const owner of owners) {
+    // ONE ROW FOR ONE OWNER. "Most specific wins" decides which doc a change implicates, so a file
+    // under both packages/x/** and packages/x/y/z/** implicates the narrower doc alone — raising a
+    // row per matching doc made the busiest shared files mint three or four blocking rows apiece,
+    // all but one of them noise a bookkeeper then had to drain.
+    const resolved = owningDoc(projectDir, rel);
+    // A tie is a real ambiguity — CI already treats equal specificity as a conflict — so on a tie
+    // every tied doc still gets its row rather than the tie being resolved by list order.
+    const implicated = resolved ? [resolved.doc, ...resolved.tied] : [];
+    for (const owner of implicated) {
       rows.push(
         formatAutoRow({
           ...meta,
@@ -550,5 +565,9 @@ try {
 } catch (e) {
   // Inform-only module: on any failure, inject nothing, write nothing, never block.
 } finally {
-  process.exit(0);
+  // NEVER process.exit() HERE. Node does not flush pending async stdout writes on exit, so a payload
+  // larger than the 65,536-byte pipe buffer is severed mid-write and arrives as unparseable JSON —
+  // which reads downstream as "no index" rather than as an error. Setting the code lets the runtime
+  // drain the pipe and exit on its own.
+  process.exitCode = 0;
 }

package/data/harnesses/code/hooks/lib/ownership.mjs

@@ -157,15 +157,21 @@ export function buildIndex(projectDir) {
       deprecated += 1;
       continue; // keep deprecated docs out of the routing lines
     }
+    if (!entry.owns.length) continue;
+    // METADATA ONCE PER DOC, NOT ONCE PER GLOB. Re-emitting a doc's keyword array beside every one
+    // of its globs makes the index grow with the dependency graph rather than the doc count: on a
+    // 42-keyword doc owning 15 paths the same 42 facts were repeated 15 times, and keywords
+    // outweighed the glob paths — the only part that routes — by more than four to one.
     const kw = entry.keywords.length ? `[${entry.keywords.join(", ")}]` : "[]";
-    for (const glob of entry.owns) {
-      lines.push(`${glob} → ${entry.doc} · ${entry.module} · ${kw} · ${entry.status}`);
-    }
+    lines.push(
+      `${entry.doc} · ${entry.module} · ${entry.status}\n  ${kw}\n` +
+        entry.owns.map((glob) => `  ${glob}`).join("\n")
+    );
   }
   if (lines.length === 0) return "";
   lines.sort();
   const header =
-    "# Ownership index (generated) — code-path glob → owning feature doc · module · keywords · status\n" +
+    "# Ownership index (generated) — owning feature doc · module · status, then the code regions it governs.\n" +
     "# Match the file or topic you're about to touch, then read the owning doc before changing it.\n";
   const indexed = docs.length - deprecated;
   const skipped = total - docs.length;
@@ -329,6 +335,35 @@ export function specificity(glob) {
   return { literal, wildcard };
 }
 
+// The single owning doc for a path, applying the "most specific wins" ladder the harness has always
+// stated in prose and never executed — `specificity()` was reachable only from `overlaps()`, which
+// runs in CI. Returns { doc, glob, tied } where `tied` lists the other docs matching at the SAME
+// specificity. A tie is never collapsed silently: an equal-specificity overlap is already a CI
+// error, so it must stay loud here rather than be resolved by list order.
+export function owningDoc(projectDir, relPath, docs) {
+  const matches = owningDocs(projectDir, relPath, docs);
+  if (matches.length <= 1) return matches.length ? { doc: matches[0], glob: null, tied: [] } : null;
+  const rel = String(relPath).split(path.sep).join("/");
+  const scored = [];
+  for (const entry of matches) {
+    // A doc may own a path through several globs; it competes on its most specific matching one.
+    let best = null;
+    for (const glob of entry.owns) {
+      if (!globToRegExp(glob).test(rel)) continue;
+      const s = specificity(glob);
+      if (!best || s.literal > best.s.literal || (s.literal === best.s.literal && s.wildcard < best.s.wildcard)) {
+        best = { glob, s };
+      }
+    }
+    if (best) scored.push({ entry, ...best });
+  }
+  if (!scored.length) return null;
+  scored.sort((a, b) => b.s.literal - a.s.literal || a.s.wildcard - b.s.wildcard);
+  const top = scored[0];
+  const tied = scored.filter((x) => x !== top && x.s.literal === top.s.literal && x.s.wildcard === top.s.wildcard);
+  return { doc: top.entry, glob: top.glob, tied: tied.map((x) => x.entry) };
+}
+
 // Cross-doc equal-specificity ownership conflicts: two globs from DIFFERENT feature docs that
 // match a common file at the same specificity, so "most specific wins" cannot pick an owner and
 // the path is doubly owned. Returns [{ a: {doc, glob}, b: {doc, glob}, example }] — one pass

package/data/harnesses/code/rules/testing.md

@@ -37,6 +37,7 @@ Rules for the plan regime between the plan gate and the verification gate:
 - **On a rendered surface, browser driving LEADS the gate — it is not its final rung.** The order inverted deliberately: the defects that reach users through an interface are geometric and compositional, and a simulated DOM computes no layout, so a suite that is entirely green says nothing about whether anything is where it should be. **Reach the browser Chrome-CDP-first and Playwright second** — CDP drives a real browser interactively and needs no script written in advance, which is what discovery requires; Playwright is the fallback where CDP is unavailable and the tool of record for whatever must run unattended afterwards. Cheap oracles run in the same pass and are what the drive's findings get pinned into; they are no longer a gate to pass before looking. A surface with nothing rendered — a CLI, a service, a library — drives its own real binary or wire instead, and this clause does not apply.
 - **A judged drive discovers; a scripted assertion guards.** Only the first finds a defect nobody has seen — a script asserting a control's value passes over a control drawn on top of its own label. Scripts are written after a judged drive names the class of defect, never generated ahead of one, and **a red script is never regenerated** — regeneration re-derives the assertion from the surface as it currently is, which turns a defect into the asserted truth with everything green.
 - **Report what happened, including failures.** A gate that reports green while a suite is red is worse than no gate; state the failing test and its output.
+- **`cmd > log; echo "EXIT=$?"` reports the echo's status, never the command's** — a SIGTERM'd suite surfaces as "exit code 0", which is the worst direction for a gate to be wrong in. Read the real status from the log, or drop the trailing echo. Adjacent trap: a runner that never emits a summary is a dying **worker**, not a slow test — `--testTimeout` bounds neither, so bound the run and read the log.
 - **Abandonment does not erase debt.** Before `Status: Abandoned` freezes a plan whose code was committed, convert its undischarged rows into backlog items; uncommitted code owes nothing.
 
 ## Frameworks by stack

package/data/harnesses/code/skills/brainstorm/README.md

@@ -6,7 +6,7 @@ correctly, the record stays readable at any pause, and the session ends with a h
 complete that the session folder is useless — it moves to history and the user deletes or
 commits it.
 
-> Spec (single source of truth): `docs/architecture/skills/brainstorm/` in the etna repo. The etna
+> Spec (single source of truth): `docs/skills/brainstorm/` in the etna repo. The etna
 > copy of this skill (`skills/brainstorm/`) is canonical; the user-level path
 > `~/.claude/skills/brainstorm/` is a symlink to it.
 

package/data/harnesses/code/skills/brainstorm/references/doctrine.md

@@ -96,3 +96,25 @@ These bind every writer of the working surface — facilitator (ops), twin (ever
 5. **Directional steering is not feature truth.** A harvested principle informs many decisions
    and changes slowly; a feature fact belongs to its feature doc and changes at code speed. The
    harvest links between the two layers, never duplicates prose across them.
+
+## Field lessons — capture and converge
+
+Measured on live sessions; each is the rule, distilled.
+
+- **Separate user voice from facilitator re-derivation before ledgering** when both arrive in one
+  turn. Only the user's half is ledgerable; a re-derivation that quietly re-reads an existing
+  commitment into a new shape is caught as a fork with a named amendment to the affected `D#`,
+  never as an edit — a commitment recorded in the user's words is amended only by the user.
+- **Stamp in UTC, always** — take the stamp from `date -u`, never from the runtime's injected
+  local date; the two disagree for part of every working day in some offsets, and a local-date
+  stamp runs the ledger a day ahead of capture.
+- **Run the blindspot pass immediately after a converge burst, before the manifest gate.** When
+  several picks land in one sitting the strain migrates *between* them — collisions between
+  commitments taken within the same hour, found only by reading two together. The burst is the
+  cheapest moment to catch them and the last before they freeze.
+- **When a pick answers three of a fork's four close-condition clauses, close it and file the
+  residue as a new fork in the same pass** — closing silently and leaving it open both lose
+  information; name the unanswered clause in the resolving entry and carry it under a new `F#`.
+- **When a ledger entry's `Why` contains "already", verify it before the manifest.** A commitment
+  that declines to build something because it already exists rests on a fact, not a judgment, and
+  the stop gate is the last place that fact is checkable — after the folder moves it is not.

package/data/harnesses/code/skills/brainstorm/references/harvest.md

@@ -84,3 +84,37 @@ Then the offer, relayed by the facilitator: **delete the moved folder, or commit
 decides; the design assumes deletion — nothing anywhere may depend on the folder surviving.
 Committing is the explicit way to keep git-history forensics; an uncommitted folder deleted here
 is gone, and that residual is accepted by design.
+
+## Field lessons — apply
+
+Measured on live harvests; each is the rule, distilled.
+
+- **Run the move gate clean immediately before the move and treat that as the verdict** — the
+  gate's checks read `ops/`, which the move deletes, so a post-move re-run fails by construction.
+  Verify the post-move state by hand: `Status: harvested`, no `ops/`, both index rows,
+  `check-links` clean. And **distil the process record into `state.md` before the move** — the
+  sync log dies with `ops/`, and a ten-line dispatch summary is what separates a record that shows
+  its workings from one that asserts its commitments from nowhere.
+- **Uncommitted harvest artifacts are deleted, not deprecated** — deprecate-in-place protects
+  readers holding a pointer, and a never-committed file has none; a tombstone for a
+  twenty-minute-old file is ceremony.
+- **Audit the *other* decision records for impact at manifest time** — the manifest routes
+  through the docs the commitments name and will not think of the neighbours. The test is
+  commitment-level, not textual (grep finds nothing); read each AD's Decision and Open Questions
+  against the new commitments, and report the unimpacted verdicts with evidence too.
+- **A manifest enumerates sites; the file you open contains more of them.** Fix every
+  same-doctrine site inside a file the manifest already opens — a self-contradicting document is
+  worse than a wider diff — but never wander into an unnamed file: that becomes a backlog row.
+  Say which you did, per row, in the application record.
+- **Re-run the uselessness test when the destination *set* changes**, not only when content does —
+  a consolidation that moves referrers produces a document set no cold reader has graded. The
+  recurring find: a truth doc stating a decided-but-unbuilt mechanism in the present tense; the
+  fix is one clause naming the unbuilt prerequisite.
+- **Retirement wording beats suppression.** doc-lint's heuristics block the honest retirement
+  sentence (`superseded by`, `no longer`); rephrase with no loss of meaning — "retired by
+  AD-00N", "is not the product's position", "lives in a package that is gone" — and reach for
+  `doc-lint-disable` only when the banned phrase is itself the claim.
+- **Amending another session's draft: change the contradicting claim everywhere it is asserted,
+  and nothing else** — a claim stated in nine places and fixed in three leaves the doc worse; a
+  one-paragraph note saying what moved and what did not keeps the amendment legible to the doc's
+  author.

package/data/harnesses/code/skills/design/SKILL.md

@@ -118,4 +118,4 @@ skills/design/
                           # elevation/ motion/ iconography.md · tells.csv · charts/ (census)
 ```
 
-This folder is the shipped skill, byte-for-byte. The six taste dictionaries are served by the design MCP; their authored source lives in the etna design record (`docs/architecture/skills/design-skill/`), which a run never reads.
+This folder is the shipped skill, byte-for-byte. The six taste dictionaries are served by the design MCP; their authored source lives in the etna design record (`docs/skills/design/`), which a run never reads.

package/data/harnesses/code/skills/design/components/index.md

@@ -1,6 +1,6 @@
 # Component catalog — the fused index
 
-> **Generated folder — never hand-edit.** Everything under `skills/design/components/` is emitted by the components-repo regen instruction set (`docs/architecture/skills/case-studies/components-regen-spec.md`, run against the `@nurix/components` library checkout). Regeneration may reshape any file beneath this one; the design skill's only seam with this folder is this index.
+> **Generated folder — never hand-edit.** Everything under `skills/design/components/` is emitted by the components-repo regen instruction set (`docs/playbooks/skills/case-studies/components-regen-spec.md`, run against the `@nurix/components` library checkout). Regeneration may reshape any file beneath this one; the design skill's only seam with this folder is this index.
 
 **Load contract.** This index loads in **both** positions of the project's `primitives` switch (`design.md`, `primitives: nurix | native`) — it is how the skill knows what chrome *exists* to compose with. The per-category deep references beside it ([inputs](inputs.md), [overlays](overlays.md), [collections](collections.md), [navigation](navigation.md), [layout](layout.md), [feedback](feedback.md), [charts](charts.md), [typography](typography.md), [media](media.md), [motion](motion.md), [hooks](hooks.md), [utils](utils.md), plus [setup](setup.md) for install/Tailwind wiring) load **only under `primitives: nurix`**, and only when that category is touched.
 

package/data/harnesses/code/skills/documentation/SKILL.md

@@ -24,7 +24,7 @@ Document contracts and architecture, not implementation details. Show function s
 
 The journey — dates, migrations, progress, supersessions — lives only in records (`docs/history/`); when reality changes, a truth document simply becomes correct. The full strip-list and the record-side rules: [`references/style-guide.md`](references/style-guide.md) § The Two Natures — Tense & History.
 
-The mechanical subset of these rules is checked by [`scripts/doc-lint.mjs`](scripts/doc-lint.mjs) — run it over changed docs before finishing. Block-severity findings must be fixed; `<!-- doc-lint-disable: <id> -->` with a reason beside it is the escape hatch.
+The mechanical subset of these rules is checked by [`scripts/doc-lint.mjs`](scripts/doc-lint.mjs) — run it over changed docs before finishing. Block-severity findings must be fixed; `<!-- doc-lint-disable: <id> -->` with a reason beside it is the escape hatch. Two invocation traps: the disable comment takes **bare rule ids only** — prose inside the comment silently breaks the parse, so put the reason in a second comment beside it — and the script grades truth-vs-record scope by matching `docs/(history|research|memory)/` against **the path string it is given**, so always hand it a repo-root-relative path; linting a record from inside its own folder grades it as a truth document.
 
 ---
 
@@ -85,7 +85,7 @@ The two guarantees are complementary and both break on mixing: a reader holding
 | Derive/update a feature doc's `owns:` | [`references/frontmatter.md`](references/frontmatter.md) |
 | Update existing doc | § Editing an existing doc (below) |
 | Instruction file (`CLAUDE.md`, a rule, an agent, skill prose) | [`references/instruction-style.md`](references/instruction-style.md) — not these templates; every-load prose stays lean, and the present-tense rule still applies |
-| Author or restructure a **skill** (fit, triggers, shape, anatomy, shipping) | The skill-authoring field guide — the `etna` repo (`nurixlabs/etna`), folder `docs/architecture/skills/playbook/`, chapters `00`–`10`. **No etna checkout available ⇒ ask the user for access to the etna repo, or proceed from first principles** with [`references/instruction-style.md`](references/instruction-style.md) governing the prose. This row is the only place the playbook is referenced |
+| Author or restructure a **skill** (fit, triggers, shape, anatomy, shipping) | The skill-authoring field guide — the `etna` repo (`nurixlabs/etna`), folder `docs/playbooks/skills/`, chapters `00`–`10`. **No etna checkout available ⇒ ask the user for access to the etna repo, or proceed from first principles** with [`references/instruction-style.md`](references/instruction-style.md) governing the prose. This row is the only place the playbook is referenced |
 | **No template matches** | [`references/untemplated.md`](references/untemplated.md) — shape decisions + the co-authoring workflow |
 
 ---

package/data/harnesses/code/skills/documentation/references/frontmatter.md

@@ -24,13 +24,20 @@ A feature doc's ownership frontmatter is `owns:` (required), `module:` (optional
 
 **1. `owns:`** (the path scope)
 
-Read the doc's content. Extract every source file path it references (file listings, function locations, component paths). Group them into the narrowest glob patterns that cover all referenced files without overlapping another doc's `owns:` globs at equal specificity. A doc may own several globs.
+`owns:` names the **regions whose truth this doc holds** — the directories where a change must be reconciled against this document before it ships. It is an authority claim a human makes, not an inventory of what the feature touches.
 
-| Doc references                       | Glob                      |
-| ------------------------------------ | ------------------------- |
-| Multiple files under one directory   | `src/feature/**`          |
-| Specific files in a shared directory | List each file explicitly |
-| A single entry-point file            | The exact file path       |
+**A file the doc merely references is not a file the doc owns.** Reaching across a boundary into a shared module is a fact about the code, and it belongs to whoever owns that module's region. Transcribing those reach edges as `owns:` entries is how an index stops being a routing table and becomes a hand-maintained import graph: rows then track the dependency graph rather than the feature count, and the shared upstream file ends up filed under whichever downstream feature happened to name it first — a consumer recorded as the authority.
+
+Prefer one region glob over many file globs. Ten paths say nothing about which is the entry point; one region says where the doc's writ runs.
+
+| The doc governs                              | Glob                                 |
+| -------------------------------------------- | ------------------------------------ |
+| A feature's own directory                     | `src/feature/**`                     |
+| A feature split across two directories        | One glob each                        |
+| A single entry-point file, and nothing beside it | The exact file path                  |
+| A shared file several features import         | **Nothing — leave it unowned**       |
+
+**An unowned shared file is the system working, not a gap.** A shared module's authority is the contract it exposes, not any one consumer, so a library-references file or a common utility legitimately has no owning doc. Claiming it would make the index bigger and the routing less certain at once.
 
 Glob each pattern against the codebase. At `status: active`, drop any that match nothing; at `status: draft`, projected globs may match nothing yet — confirm them against real code when the doc flips to `active`.
 

package/data/harnesses/code/skills/documentation/templates/plan.md

@@ -71,7 +71,10 @@ Why this work is happening *now*. Link to the spec for *what* we're building; th
 <!-- Written by the `testing` skill (plan-gate mode) at the plan gate (after `boundary`). One row per
      promised behavior: layer · target file · oracle · fixtures · an empty Outcome cell the
      verification gate fills (satisfied / owes nothing / blocked → backlog). Amendable while the
-     plan is open. Do not hand-author. -->
+     plan is open. Do not hand-author. NEVER put a pipe in a ledger cell, escaped or not — the
+     compliance hook splits rows on `|` at a fixed column index with no unescaping, so a
+     markdown-legal `\|` shifts every later cell and the wall blocks a row that is in fact
+     discharged. Write "`install` or `update`", not "`install \| update`". -->
 
 ## Open Questions
 

package/data/harnesses/code/skills/issue-bridge/SKILL.md

@@ -38,7 +38,7 @@ Read the codegraph status from the session context (`Tool:` line). **Present-fre
 
 ## The dossier
 
-Frontmatter: `tracker`, `issue` (id + URL), `date`, `confidence`, `type: triage`. Sections, in order: **Verdict** (1–3 sentences) · Classification · Owning docs (paths) · Root cause (cited, graded) · Blast radius · Suggested fix plan (feeds the plan → PR loop; you never implement) · Test surface · Duplicates & related · **Prior-thread corrections** (claims already on the tracker thread — bot answers, maintainer comments — that your evidence shows to be wrong, each with the citation that refutes it) · Open questions. A dossier is a dated working artifact — it never claims `owns:` globs and never masquerades as a feature doc.
+Frontmatter: `type: triage`, `tracker`, `date`, `confidence`, and the subject key — `issue: {id: <n>, url: <url>}` with a **numeric** id for a tracker item, `issue: {id: local:<record-id>}` for a locally-authored record, `pr: {id: <n>}` when the dossier resolves a pull request. This shape is machine-read: the Apollo desktop's Issues panel joins dossiers to tracker rows on exactly this key, so a quoted number, a missing id, or a renamed key leaves the dossier orphaned — written but never surfaced beside its issue. Sections, in order: **Verdict** (1–3 sentences) · Classification · Owning docs (paths) · Root cause (cited, graded) · Blast radius · Suggested fix plan (feeds the plan → PR loop; you never implement) · Test surface · Duplicates & related · **Prior-thread corrections** (claims already on the tracker thread — bot answers, maintainer comments — that your evidence shows to be wrong, each with the citation that refutes it) · Open questions. A dossier is a dated working artifact — it never claims `owns:` globs and never masquerades as a feature doc.
 
 ## File — harness finding in, tracker issue out
 

package/data/harnesses/code/skills/testing/SKILL.md

@@ -156,7 +156,7 @@ When writing or discharging a ledger row, name the stratum, not just the altitud
 
 Runs as the tail of every build pass — the session opens it the moment the unit's code is written, without asking (constraints — preconditions, verdict-inline, tier, honesty — are `.claude/rules/testing.md` § The gate). **Drive the real thing first, then pin what must not regress**: driving finds the defects that matter to a user, and shows which behaviors are worth the permanent cost of a test.
 
-1. **Write the checklist** — derive or update `docs/tests/{feature}.md` from the ledger and the LLD's promises (the `documentation` skill's `templates/behavioral-checklist.md`; one `**Assert**` per observable). Derived before the driving it is the script; derived after, it is merely a report with nothing to trace tests back to.
+1. **Write the checklist** — derive or update `docs/tests/{feature}.md` from the ledger and the LLD's promises (the `documentation` skill's `templates/behavioral-checklist.md`; one `**Assert**` per observable). Derived before the driving it is the script; derived after, it is merely a report with nothing to trace tests back to. `docs/tests/{feature}.md` pairs with `docs/features/{feature}.md` — writing a checklist whose feature doc does not exist is the tell that one is owed; check here, when the checklist is named.
 
    **The gate owns these files, not just their first draft.** Whoever drives a checklist maintains it in the same pass — nothing else in the repo is watching, because a checklist owns no code and no `owns:` glob implicates it, so a surface can be rewritten under a checklist and every hook stays silent. Before driving, reconcile the file against the surface you are about to drive: **retire** sections whose behavior no longer exists (delete them — a checklist is a truth document, and the history lives in git), **add** sections for behavior shipped since the last run, and **repair every `Pinned:` trace**, because a trace naming a test that no longer exists is worse than no trace — it reports coverage that cannot fail. A section you cannot pin says `none yet` and names the test it owes. **Never soften an assertion to make the run green**: the checklist states what the feature promises, the run records what happened, and the backlog carries the difference.
 2. **Drive the real surface, and on a rendered surface drive it visually FIRST.** The old order ran every cheap oracle before earning the right to look at the product; it inverted here because the defects that reach users on a rendered surface are the ones no simulated DOM can see. A slider thumb sitting on its own labels, a settings panel that grows the box someone types into: a suite of two hundred component tests is blind to both by construction, and the only oracle that caught them was judgement applied to real pixels.

package/data/harnesses/delivery/agents/lld-mode.md

@@ -18,10 +18,10 @@ You do NOT write the LLD — you return structured research that the main agent
 Map the documentation landscape — what exists, what is adjacent, how detailed the LLD should be, and what code paths are already owned:
 
 1. Read `./docs/structure.md` to understand the documentation structure
-2. If `./docs/features/README.md` exists, read it to see existing feature LLDs and where the new one fits; otherwise glob the feature docs directly
+2. Locate the repo's feature-doc layer from `structure.md` — the standard shape is `./docs/features/`, but a repo may document components under their own subject folders. Read that layer's index if it has one; otherwise glob for docs carrying `owns:` frontmatter
 3. If `./docs/memory/lld-mode.md` exists (or the legacy `./docs/memory/spec-mode.md`), read it for feature doc inventory, ownership conflict zones, and lessons from previous research
-4. Read 1-2 existing feature LLDs in `./docs/features/` to calibrate format and depth
-5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob `docs/features/**/*.md` and read each doc's `owns:` frontmatter directly.
+4. Read 1-2 existing feature LLDs from that layer to calibrate format and depth
+5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob the docs tree (excluding `docs/history/`) and read the `owns:` frontmatter of every doc that declares it.
 
 ## What You Research
 

package/data/harnesses/delivery/agents/maintenance.md

@@ -44,15 +44,15 @@ Decide the mode once, up front, from the version marker — then run.
 
 ## Part A — Coherence audit (always runs)
 
-The ownership source of truth is the **union of every feature doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
+The ownership source of truth is the **union of every doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing the docs tree for docs that declare `owns:`.
 
 ### Step 1: Build the ownership map
 
 1. Read `docs/structure.md` for the authority map.
-2. Glob `docs/features/**/*.md`, ignoring `*.bkp.*` files (installer backups awaiting the fold); for each, parse the frontmatter `owns:` globs and `module:` label.
+2. Glob the docs tree for markdown carrying `owns:` frontmatter, ignoring `*.bkp.*` files (installer backups awaiting the fold) and anything under `docs/history/` (frozen records quote retired globs as provenance). **Ownership is declared, not positional** — the standard shape files these docs under `docs/features/`, but a repo may declare ownership on any doc, and the index reads them all. For each, parse the `owns:` globs and `module:` label.
 3. Build a map: glob → owning doc + module. Narrower glob wins on overlap. **This IS the source of truth.**
 
-**Architecture-first fallback.** If no feature doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
+**Architecture-first fallback.** If no doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
 
 ### Step 2: Validate ownership
 
@@ -109,7 +109,7 @@ For each stale doc: update the doc directly when the drift is clear (renamed fun
 
 For each feature doc you verified accurate or updated this pass, stamp `last-reviewed:` in its frontmatter with today's date (add the key if absent). Never write review dates into the body — it's frontmatter metadata only.
 
-For unowned code paths, append: `- **[P2]** No feature doc owns \`{dir}/\` — discovered by maintenance` (`{dir}` = the actual unowned source directory).
+For an unowned code **region**, append: `- **[P2]** No feature doc owns \`{dir}/\` — discovered by maintenance` (`{dir}` = the actual unowned source directory). The target is **every region has an owner**, never every file: an individual shared file that several features import is expected to be unowned, because its authority is the contract it exposes rather than any one consumer. Report a directory that no doc's region covers; never mint a row for a shared file, and never propose closing a gap by adding a file glob to whichever doc happens to import it.
 
 **Declined realignment.** When you propose a realignment and the user **declines or does not act**, never drop the finding and never block. Append it to `docs/history/backlog.md` as `- **[P0–P3]** <finding> — discovered by maintenance`, priority = the finding's own severity **on the same P0–P3 scale as code items** — never a segregated "compliance" section, never auto-relegated to the lowest tier. Record once: dedupe against existing entries; if already present, leave it.
 
@@ -238,6 +238,7 @@ Apply the **§ Strategy memory** retirement procedure to `docs/memory/maintenanc
 - **A clean report is valid** — do not invent issues.
 - **Declarative, idempotent.** Re-running baseline mode on a current repo reshapes nothing — a second pass is just the audit plus the module proposal. Converge to the current shape; never replay a version ladder; never reconstruct a past shape.
 - **Brownfield extraction (operator-ruled 2026-08-19).** When baseline mode meets a repo with a real source tree and few or no feature docs, the module *proposal* is not enough — run the extraction pass: produce feature docs for the recognized modules (docs/features/, full frontmatter: `owns:` · `module:` · `keywords:` · `status:` · `last-reviewed:` · `type: feature` · `derivation: "extracted (baseline YYYY-MM-DD, codegraph + source read)"`), plus the architecture, tests, and operations layers. Use the `codegraph` skill where installed — localize through the index before reading; the docs record intent, the index answers facts. **Every extracted feature doc carries a `## History & Ownership` section** — top contributors with recency, churn posture, and bus-factor notes, dated "as of YYYY-MM-DD" (operator ruling: this section is mandatory in extraction output even though doc-lint flags dated narrative in truth docs; the findings are accepted for now, and a future harness version may retire the section in favor of live index pointers). `status:` is evidence-graded: `deprecated` only when history shows the area dead, never by guess. Scale by fan-out (one extraction lane per module, a completeness critic over the result) rather than one long cold read.
+- **Diagrams ride the baseline (operator-ruled 2026-08-24).** Whenever baseline mode produces or converges the architecture layer, draw two ASCII diagrams from the real source, each in its own fenced code block: (1) an **architecture diagram** in the system-design/architecture doc — the actual processes, entry points, and wire surfaces as boxes, the calls/queues/files between them as labelled arrows; (2) a **DB ER diagram** wherever the repo declares a relational schema (DDL, migrations, an ORM schema) — one box per table listing its key columns, FK edges drawn to the table they reference, cardinality on the edge; it lands in the domain-model doc, or `docs/architecture/data-model.md` when none exists. Box-drawing characters (`┌─┐│└┘├┤`), width ≤ 100 columns. Derived only from what the code declares — a diagram never invents a component the source does not show, and a repo with no relational schema gets **no** ER diagram rather than an imagined one. Diagrams are truth-document sections: later baselines and audits converge them in place like any other section.
 - **Tool tiers.** The SessionStart context names each manifest-declared tool with its tier; calibrate the run to it, never stall on it. **Present-fresh** (`Tool: codegraph 0.2.0`): use it — check `codegraph projects` for staleness, re-run `codegraph index` if HEAD has moved, then localize every question through the index before reading source. **Present-stale** (below the catalog minimum): still use it, but note the version gap and the upgrade command in the run report — a stale contract may lack answer shapes the skill assumes. **Absent** (`Tool: codegraph MISSING`): fall back to the cold method (Glob/Grep/read), state in the run report that the tool was absent and give the install command — degraded output is acceptable, silent degradation is not.
 - **One sentinel.** `docs/structure.md` `harness-version` is the only baseline/version marker.
 - **Modules are labels, layout-blind.** Seed from the code's bounded contexts; never from `pnpm-workspace.yaml`/workspace walls. Propose, don't force; acting is a `module:` tag, never a folder.

package/data/harnesses/delivery/codex/agents/lld-mode.toml

@@ -14,9 +14,9 @@ You do NOT write the LLD — you return structured research that the main agent
 Map the documentation landscape — what exists, what is adjacent, how detailed the LLD should be, and what code paths are already owned:
 
 1. Read `./docs/structure.md` to understand the documentation structure
-2. If `./docs/features/README.md` exists, read it to see existing feature LLDs and where the new one fits; otherwise glob the feature docs directly
+2. Locate the repo's feature-doc layer from `structure.md` — the standard shape is `./docs/features/`, but a repo may document components under their own subject folders. Read that layer's index if it has one; otherwise glob for docs carrying `owns:` frontmatter
 3. If `./docs/memory/lld-mode.md` exists (or the legacy `./docs/memory/spec-mode.md`), read it for feature doc inventory, ownership conflict zones, and lessons from previous research
-4. Read 1-2 existing feature LLDs in `./docs/features/` to calibrate format and depth
+4. Read 1-2 existing feature LLDs from that layer to calibrate format and depth
 5. Consult the **injected ownership index** (the generated `glob → doc · module · keywords · status` map — the union of every feature doc's `owns:` frontmatter) to build the ownership map. It is the source of truth for what code paths are already owned. If the index isn't present in context, glob `docs/features/**/*.md` and read each doc's `owns:` frontmatter directly.
 
 ## What You Research

package/data/harnesses/delivery/codex/agents/maintenance.toml

@@ -42,15 +42,15 @@ Decide the mode once, up front, from the version marker — then run.
 
 ## Part A — Coherence audit (always runs)
 
-The ownership source of truth is the **union of every feature doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
+The ownership source of truth is the **union of every doc's `owns:` frontmatter** — the same source the SessionStart ownership index derives from. There is no `docs/routing.md` and no precomputed file to regenerate; you rebuild the map by globbing `docs/features/`.
 
 ### Step 1: Build the ownership map
 
 1. Read `docs/structure.md` for the authority map.
-2. Glob `docs/features/**/*.md`, ignoring `*.bkp.*` files (installer backups awaiting the fold); for each, parse the frontmatter `owns:` globs and `module:` label.
+2. Glob the docs tree for markdown carrying `owns:` frontmatter, ignoring `*.bkp.*` files and anything under `docs/history/`. **Ownership is declared, not positional** — the standard shape files these under `docs/features/`, but a repo may declare ownership on any doc. For each, parse the `owns:` globs and `module:` label.
 3. Build a map: glob → owning doc + module. Narrower glob wins on overlap. **This IS the source of truth.**
 
-**Architecture-first fallback.** If no feature doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
+**Architecture-first fallback.** If no doc carries `owns:` yet (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. The `owns:` map becomes primary the moment any feature doc declares ownership — this is a fallback, not a replacement.
 
 ### Step 2: Validate ownership
 

package/data/harnesses/delivery/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.23",
+  "version": "0.2.27",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "530448328369"
+  "digest": "b36abb3f2f60"
 }