@open-agent-toolkit/cli 0.3.15 → 0.3.17

package/assets/NOTICES.md

@@ -154,3 +154,51 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
+
+## tkstang/skills
+
+**Source:** https://github.com/tkstang/skills/tree/main/skills/complexity-review
+**License:** MIT
+**Version referenced:** `complexity-review` 1.0.2 (commit `8767bce4819a2cae1a9f257de650a5ed0ae0afc1`)
+
+### `complexity-review` skill
+
+Source files: `skills/complexity-review/SKILL.md` and
+`skills/complexity-review/references/evidence-guide.md`.
+
+Passages adapted and condensed into `.agents/docs/complexity-review-fallback.md`:
+the core premise, contract restatement, simplest viable baseline, machinery
+inventory, deletion test, evidence and recommendation scales, ledger columns,
+verdict criteria, report sections, and reviewer stance. The OAT version adds
+the budget-exhaustion triggers, the installed-skill probe, the read-only
+dispatch contract, the REQUIRES-OPERATOR, open-finding, and disposition
+sections, and the decision-message record.
+
+Consumer OAT skills: `oat-project-implement`, `oat-project-quick-start`, and
+`oat-project-review-receive` (each vendors the doc under `references/docs/`).
+
+### Upstream MIT license
+
+```text
+MIT License
+
+Copyright (c) 2026 Thomas Stang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/assets/agents/oat-phase-implementer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-phase-implementer
-version: 1.1.6
+version: 1.1.7
 description: Implements one plan phase end-to-end, commits each task separately, self-checks between tasks, and handles bounded review fixes when resumed by oat-project-implement.
 tools: Read, Write, Edit, Bash, Grep, Glob, Task
 color: cyan
@@ -142,11 +142,23 @@ replaces every task and phase verification command below.
 Artifact and recovery-ledger bookkeeping commits must first resolve scope with
 `oat project scope "$PROJECT_PATH" --format value`. A `synced` project uses
 `oat project push` with the original bookkeeping message; other scopes keep the
-existing scoped `git add` and `git commit` commands. Scope resolution fails
+shared `oat internal commit-paths --identity "$COMMIT_IDENTITY" --message "$BOOKKEEPING_MESSAGE" -- "${BOOKKEEPING_OWNED_FILES[@]}"` command with exact producer-owned files. Set a unique operation identity before the first attempt and retain it and the literal file list through retries. Scope resolution fails
 closed. A nonzero project-push exit stops bookkeeping until the reported
 recovery is resolved and the push is retried. Planned code task commits such as
 `feat(pNN-tNN)` are unchanged.
 
+## Recovery Capacity Disclosure
+
+Report the supplied effective phase limit, prior durable usage, remaining
+capacity and reconciled pending attempt in phase progress and boundary reports.
+The root owns policy resolution and its source/override disclosure; use the
+brief and authoritative `state.md` ledger, never a guessed local counter.
+Capacity is not permission: failed-attempt terminality, eligibility/proof,
+exact-target continuity and repository authority still apply when allowance
+remains. Recovery events, warnings and route retries are distinct from reserved
+attempt usage. Do not interpret remaining capacity as continue-after-failure
+authority.
+
 ## Prevention and Post-Commit Recovery
 
 Prevention is the first recovery control. Before every planned task commit:
@@ -431,11 +443,19 @@ For every task:
    prevention does not consume a recovery attempt.
 6. Self-review requirements, behavioral tests, scope, and accidental changes.
 7. Fix any issue before committing.
-8. Create exactly one task commit using `commit_convention`.
+8. Create exactly one task commit using `commit_convention` through the shared
+   `oat internal commit-paths --identity "${ORIGINAL_REQUEST_ID}:${TASK_ID}" --message "$TASK_COMMIT_MESSAGE" -- "${TASK_OWNED_FILES[@]}"` primitive.
+   Before task edits, initialize `TASK_OWNED_FILES=()` and append each exact
+   created, modified or removed file at its producer, including both rename
+   sides. Retain the list and request/task identity for retries; never discover
+   ownership from the staged index or pass directory pathspecs. Verify the
+   command's help first; if missing, stop and update the CLI with no alternate
+   Git commit route. A blocked/failed result stops with its receipt/diagnostic.
    In a smoke child, source preflight owns repository-wide hook validation and
-   the child intentionally has no dependency install. Use
-   `git -c core.hooksPath=/dev/null commit ...` for that task commit; do not
-   mutate Git config or use `--no-verify`.
+   the child intentionally has no dependency install. Keep that launcher-owned
+   hook policy on the same primitive using per-process
+   `env GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null oat internal commit-paths ...`;
+   do not mutate Git config or use `--no-verify`. Ordinary tasks keep hooks enabled.
 9. Verify:
    - HEAD is exactly one commit after `PRE_TASK_HEAD`;
    - the commit changes only files in the effective task boundary, which is

package/assets/agents/oat-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-reviewer
-version: 1.2.10
+version: 1.2.11
 description: Unified reviewer for OAT projects - mode-aware verification of requirements/design alignment and code quality. Writes a review artifact to disk by default, or returns structured findings in-memory when dispatched in structured-output mode.
 tools: Read, Bash, Grep, Glob, Write, Task
 color: yellow
@@ -201,6 +201,49 @@ Strategy`, check whether the evidence matches the declared strategy, covers
    - Code that doesn't map to any requirement
    - If significant: add to High findings (potential scope creep)
 
+### Step 3.5: Probe Changed Consequential Boundaries
+
+For code reviews, inventory the changed trust, input, size and limit boundaries
+within the resolved review scope. For each boundary, name a credible failure
+and a focused probe with an independent expected outcome. Include assurance
+contracts expressed in executable guidance when that guidance is the changed
+public boundary. Do not manufacture a probe for unchanged behavior or a
+merely cosmetic edit.
+
+Run applicable focused probes within existing containment and write authority;
+preserve review independence and never mutate product files to repair a
+finding. Record the exact command, input or fixture/artifact provenance,
+expected categorical result, observed categorical result and any concrete
+execution limitation. A passing suite alone cannot substantiate a changed
+consequential guarantee. Inspect a failing control that exercises the claimed
+bad state and an accepted control that shows the valid state still works.
+
+When execution is unavailable, independently read and inspect implementer
+probe artifacts, exact commands, the recorded failing and accepted controls,
+and their correspondence to the reviewed code and immutable revision. Exact
+commands, artifact provenance and the limitation must be recorded. This may
+satisfy the evidence obligation when the controls credibly substantiate the
+guarantee; an unsupported implementer assertion is insufficient. A limitation
+by itself is not evidence of correctness.
+
+Missing consequential evidence requires a blocking finding under the existing
+severity model. Use the
+existing Critical/High severity model for the guarantee's risk, name the
+unresolved claim and smallest missing proof, and do not report that guarantee
+as accepted. Do not add a new severity, gate status or acceptance exception.
+
+| Evidence case                                                  | Review disposition                                                         |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| Consequential guarantee, absent evidence                       | Blocking finding; guarantee unresolved                                     |
+| Inspected failing + accepted controls, reviewer cannot execute | Eligible evidence when independently verified; record execution limitation |
+| Unsupported implementer assertion                              | Blocking finding; assertion cannot substantiate the guarantee              |
+| Docs-only, no credible changed boundary                        | No manufactured probe obligation; use conservation review                  |
+
+Keep scope proportional: no new harness, broad testing campaign or
+model-efficacy claim. Docs-only changes with no credible changed boundary have
+no manufactured probe obligation. Preserve containment, independence,
+dispatch controls and the existing output schemas.
+
 ### Step 4: Verify Artifact Quality
 
 This step applies to **artifact reviews** only.
@@ -487,6 +530,10 @@ worker claims, and root-inline coverage}
 
 ## Verification Commands
 
+{Changed-boundary probes: exact commands, input/artifact provenance,
+expected/observed categorical outcomes and limitations; distinguish executed
+commands, suggested reruns and independently inspected evidence.}
+
 Run these to verify the implementation:
 
 ```bash
@@ -559,6 +606,9 @@ interface StructuredFindings {
 - `severity` MUST be one of the four enum values, mapped from the same Critical/High/Medium/Low buckets as Step 7.
 - `file` and `line` MUST both be set or both be `null`. A finding with a concrete location sets both; a reviewer-level finding without a specific location sets both to `null` and is conveyed via the `summary` / its own `body`, not as an inline location.
 - `id` prefixes follow the existing convention (`C`/`H`/`M`/`L`) and are stable within a single dispatch — no renumbering.
+- Use existing `summary` and finding bodies for compact probe results and limitations,
+  including independently inspected control provenance. Keep exact repeatable
+  commands in `verification_commands`; add no fields to `StructuredFindings`.
 - `verification_commands` carries what Step 8's "Verification Commands" section would have carried, as an array of command strings.
 
 Default behavior is unaffected: when `oat_output_mode` is absent or set to anything other than `structured`, follow Steps 8-9 and write the artifact exactly as before. Analysis reviews MUST honor `oat_output_mode: structured` whenever supplied by an auto-review loop: return the `StructuredFindings` object and write no artifact.

package/assets/bundle-metadata.json

@@ -1,4 +1,4 @@
 {
   "schemaVersion": 1,
-  "oatVersion": "0.3.15"
+  "oatVersion": "0.3.17"
 }

package/assets/docs/contributing/documentation.md

@@ -52,6 +52,10 @@ Documentation should ship with the code it explains. This page covers the core d
 ## Authoring Expectations
 
 - Keep docs aligned with the current repo behavior and current command surface.
+- Give each Markdown or MDX page exactly one document H1. `pnpm docs:validate`
+  reports the file and count when a page has zero or multiple H1s. ATX and
+  Setext headings count, including headings inside blockquotes or lists;
+  frontmatter and fenced code do not.
 - Prefer cross-links over duplicated conceptual content.
 - Use `oat-docs-authoring` for targeted OAT/Fumadocs docs edits; it delegates
   universal page-quality guidance to `authoring-docs` and keeps local

package/assets/docs/contributing/skills.md

@@ -238,7 +238,9 @@ the bundle strips — requires bumping that skill's `metadata.version` in the
 same PR, one bump per changed skill in the final PR diff, even if the skill was
 edited multiple times on the branch. A change to a skill's `scripts/` or
 `references/` therefore needs the bump just as an edit to `SKILL.md` does: both
-ship to every `oat tools install` consumer. Changing a canonical agent role
+ship to every `oat tools install` consumer. Changes under `.agents/docs/`
+also require a bump for every skill that vendors the changed document through
+a file or directory symlink, because bundling follows those links. Changing a canonical agent role
 under `.agents/agents/*.md` requires bumping that file's top-level `version:`;
 agent roles deliberately keep the top-level field, so the gate accepts either
 declaration shape and never demands `metadata.version` of them. The gate reads

package/assets/docs/getting-started/bootstrap.md

@@ -50,7 +50,7 @@ After core initialization completes, `oat init` can enter an interactive guided
    - after placement is chosen, repository `AGENTS.md` guidance is a separate opt-in. Accepting creates the root file with the managed `OAT tools` section when it is absent, and appends that section to an existing file or contained symlink target that lacks it, with one append-only write. An existing file is never replaced: when the section exists but differs, OAT prints a repository-relative, copy-pasteable managed-block patch instead. Declining leaves `AGENTS.md` unchanged
    - installing `project-management` installs the capability only. Adopting it for this repository is a third, separate choice made with `oat pjm init` — see [Install vs. initialize](tool-packs.md#install-vs-initialize)
 2. **Local paths** — multi-select from default gitignored artifact paths (analysis, PR, reviews, ideas). Pre-existing paths are pre-checked; only new paths are added.
-3. **Documentation** — detect or enter docs metadata for the repo when documentation exists.
+3. **Documentation** — detect or enter docs metadata for the repo when documentation exists. For existing plain documentation, choose **Plain Markdown** in the manual tooling menu and enter its docs root. Guided setup saves `documentation.tooling: "markdown"` and the normalized `documentation.root` while preserving the other documentation/config settings. Fumadocs remains the manual menu default; MkDocs, Docusaurus, VitePress and Nextra remain available. This choice does not add automatic Markdown detection or scaffold a framework.
 4. **Provider sync** — sync provider project views via `oat sync --scope project`.
 5. **Summary** — reports what was configured: active providers, tool packs status, local paths added/existing, and provider sync status. Includes suggested next steps.
 

package/assets/docs/getting-started/index.md

@@ -55,10 +55,6 @@ view is the file or link that tool reads.
   available it falls back to the best available reviewer, which can be from the
   same family, and only records a warning. See
   [How independent the reviewer must be](../workflows/advanced/workflow-gates.md#how-independent-the-reviewer-must-be).
-- **Re-running `oat pjm init` removes remote settings.** It replaces the `pjm`
-  section of `.oat/config.json` and deletes any `pjm.remote` settings, so back
-  the file up first. See
-  [Remote Project Management](../workflows/backlog-and-planning/remote-project-management.md#prerequisite).
 - **Ad-hoc reviews run in the agent you invoke them in.** `oat-review-provide`
   cannot send a review to a different model; to get another model's review,
   run the skill in that model's coding tool. See

package/assets/docs/getting-started/tool-packs.md

@@ -1294,10 +1294,3 @@ that: later pack updates and `oat tools remove` leave them alone.
   loads; OAT does not resolve that for you.
 
 Installing any pack never gives OAT permission to publish to an issue tracker.
-
-> [!WARNING]
-> Rerunning `oat pjm init` or `oat pjm migrate --apply` deletes the `pjm.remote`
-> settings from `.oat/config.json`, so every remote setting silently returns to
-> its default. Afterwards, check `git diff .oat/config.json` and restore the
-> settings you need with `oat config set` (shared remote storage is restored
-> with `oat pjm remote storage shared`) before doing more remote work.

package/assets/docs/provider-sync/commands.md

@@ -98,6 +98,27 @@ Key behavior:
   failures, but skew present — apply reports
   `Manifest version refreshed; no content changes required.` instead of
   `No changes required.`, so a manifest write is never described as a no-op.
+- A faithful copy-strategy entry whose manifest row records a stale
+  `contentHash` (a pre-framing legacy digest or a tampered value) is planned as
+  `skip` with the reason
+  `already in sync; restamp stale manifest content hash`, and `--json` plan
+  entries carry the verified digest as `restampContentHash`. Apply writes that
+  digest, so the next run is a no-op. Only a row that tracks the same provider
+  path that sync checked is restamped. Dry-run then reports
+  `Run without --dry-run to restamp N stale manifest content hashes.` instead
+  of `No changes to apply.`. Apply reports
+  `Manifest content hash restamped for N entries; no content changes required.`
+  (combined with the version-refresh sentence when both happen), or
+  `Manifest content hash restamped for N entries.` beside a partial failure.
+- A copy-strategy canonical skill directory without `SKILL.md`, or agent
+  directory without `AGENT.md`, is planned as an `error` operation whose reason
+  names the missing file, instead of a copy that never verifies and is retried
+  on every run. It changes nothing and is not a planned operation; other
+  entries still sync. Apply reports it as a failed result (`status: failed`
+  with a `failure` in `--json` `operationResults`) and exits 1. Dry-run lists
+  it, warns `N entry cannot sync until its configuration error is fixed.`,
+  counts it in `summary.failed`, and still exits 0. Symlink strategy is
+  unaffected.
 
 `oat sync` is not the only command that replaces a manifest's producer version.
 `oat init`, `oat remove skill`, and `oat status` each capture the manifest's

package/assets/docs/reference/cli-reference.md

@@ -37,6 +37,47 @@ Each full command reference should include:
 
 The first practical expansion path is to keep improving the existing owners: [Docs App Commands](../docs-tooling/commands.md), [Provider Interop Commands](../provider-sync/commands.md), [Config and Local State](config-and-local-state.md), [Tool Packs](../getting-started/tool-packs.md), [Workflow & Projects](../workflows/projects/index.md), and [Repository PR Comment Analysis](repository-pr-comments.md).
 
+## Exact-path maintenance commits
+
+`oat internal commit-paths --identity <operation> --message <message> -- <files...>`
+commits an explicit list of owned files with enabled Git hooks. Include tracked
+removals and both names of a rename. Directories, untracked missing paths,
+unmerged entries and paths outside the repository are rejected; the command
+does not discover ownership or expand directory/glob pathspecs. Unrelated staged
+entries and worktree bytes remain preserved, including partially staged files.
+On success, owned index/worktree bytes match the hook-final commit.
+
+Choose a unique identity before the first attempt and retain the identity,
+message and literal path list for retries. With global `--json`, outcomes are
+`committed`, `already-matching`, `nothing`, `blocked` or `failed`.
+Success exits 0, `blocked` exits 1 and `failed` exits 2. A blocked result can
+name a verified commit whose owned-index publication still needs repair; do not
+claim settlement until a matching retry succeeds. Ignored receipts under the
+Git directory verify the exact identity, commit, tree and paths before reuse.
+Lock inspection/retry is bounded and never deletes another writer's lock.
+
+If the command is unavailable, stop and update the CLI; there is no broad Git
+commit fallback. Synced project artifacts still use `oat project push` after
+successful scope resolution. During development, run the current source entry:
+
+```bash
+pnpm --silent run cli -- internal commit-paths --identity "$COMMIT_IDENTITY" --message "$COMMIT_MESSAGE" -- "${OWNED_FILES[@]}"
+```
+
+A `dist` invocation requires a fresh build after the latest CLI source changes.
+
+For `oat backlog archive --json`, use the complete returned `affectedPaths`
+array as the archive-owned list, converting absolute paths to literal
+repository-relative files against the same repository root. Union per-item
+results, append an owned
+handoff's filesystem deletion, and format only existing supported text with
+the repository command before the helper commit. Include both old/new item
+paths and every ledger/index/reference output; never stage only the old
+missing name. A settled noop may return no paths and needs no commit. Pending
+Git retries include prior outputs only with HEAD ownership evidence, while
+no-Git retries report current-pass mutations. See [Backlog
+Lifecycle](../workflows/backlog-and-planning/backlog-lifecycle.md).
+
 ## Command Groups
 
 | Command group                                   | What it covers                                                                                                                                                                                                             | Go deeper                                                                                   |
@@ -155,14 +196,14 @@ Notable commands introduced in the current CLI surface:
 - `oat project list --json` - summary state for tracked projects under the configured projects root
 - `oat project closeout-check <project-path> [--autonomous] [--json]` - read-only check of the closeout invariant: a closeout that must snapshot its post-implementation sequence cannot reach terminal completion until its `oat_post_implement_sequence` snapshot exists, every stored step is recorded complete, approval is recorded, and the snapshot reached `status: complete`. A snapshot is required when the effective layered `workflow.postImplementSequence` is configured, when the closeout is autonomous (`--autonomous`, or `OAT_AUTONOMOUS=1` in the environment even without the flag), or when `oat_workflow_mode` is `lite`. Once a snapshot exists its recorded state is authoritative and current configuration is not consulted. JSON output reports `status` (`complete`, `not_required`, or `incomplete`), the missing `invariant` (`snapshot_missing`, `snapshot_malformed`, `sequence_failed`, `pre_approval_step_pending`, `approval_pending`, `post_approval_step_pending`, or `sequence_not_complete`), `route` (`oat-project-implement` when incomplete), `nextOwner` (the next stored step and its skill, or the approval), and the evaluated `inputs`. An incomplete or malformed result exits 1.
 - `oat project complete-state <project-path> [--archived] [--autonomous]` - apply the canonical completed-state mutation to a project's `state.md`; used by `oat-project-complete` during lifecycle closeout. It first evaluates the same closeout invariant as `oat project closeout-check` and refuses, with the same message and without writing, a configured, autonomous, or lite closeout whose snapshot is absent, malformed, or incomplete. A project whose implementation finished before closeout snapshots existed recovers by running `oat-project-implement`, which persists the snapshot (`completion-and-closeout.md` Step 15) and completes its stored steps; there is no override flag. An unconfigured, interactive, non-lite closeout without a snapshot completes as before.
-- `oat project archive [project-path] [--project-recap-run <project-relative-path>] [--no-commit]` - archive a tracked project through the same local move, summary export, and configured S3 upload path used by completion. When omitted, the project path falls back to the active project. The optional recap path must identify a `project-recap` run inside the project's `explainers/` directory. Archive stages the selected complete package into `.oat/repo/reference/project-recaps/<YYYYMMDD-project-slug>/`, verifies every manifest-declared file byte, then atomically installs the export before deleting the active project. Existing destinations, incomplete inventory coverage, stale bytes, path escapes, and recipe mismatches fail without removing the active project. For synced projects, a configured S3 upload must succeed before terminal cleanup. Successful closeout makes `refs/oat/completed/<project>` authoritative, deletes the tracked JSON record and nested checkout, and leaves archive metadata sufficient for an idempotent recordless retry. With `--json`, the terminal receipt reports `completedRef`, `verifiedSourceSha`, whether `activeAliasDisposition` was `retained` or `removed`, whether `recordRetired` completed, and the parent `lifecycleCommit`. `--no-commit` is a manual/library-only option: for a synced project it still removes the checkout but deliberately leaves `lifecycleCommit` null. Never pass it through `oat-project-complete`, which requires that receipt.
+- `oat project archive [project-path] [--project-recap-run <project-relative-path>] [--no-commit]` - archive a tracked project through the same local move, summary export, and configured S3 upload path used by completion. When omitted, the project path falls back to the active project. The optional recap path must identify a `project-recap` run inside the project's `explainers/` directory. Archive verifies the complete selected package and every immutable file byte, then atomically exports one self-contained `.oat/repo/reference/project-recaps/<YYYYMMDD-project-slug>.html` page before deleting the active project. The full original package remains in the archived project. JSON `projectRecapExport` identifies `runId`, `page.sourceRelativePath`, `page.originalSha256`, `page.exportedSha256`, `verifiedArtifactCount`, and the flat `exportRoot`. No tracked sidecar is created. Matching dated pages are adopted on retry; conflicting destinations, incomplete inventory coverage, stale bytes, path escapes, and recipe mismatches fail without removing the active project. Summary and PR links point to the tracked page. For synced projects, a configured S3 upload must succeed before terminal cleanup. Successful closeout makes `refs/oat/completed/<project>` authoritative, deletes the tracked JSON record and nested checkout, and leaves archive metadata sufficient for an idempotent recordless retry. With `--json`, the terminal receipt reports `completedRef`, `verifiedSourceSha`, whether `activeAliasDisposition` was `retained` or `removed`, whether `recordRetired` completed, and the parent `lifecycleCommit`. `--no-commit` is a manual/library-only option: for a synced project it still removes the checkout but deliberately leaves `lifecycleCommit` null. Never pass it through `oat-project-complete`, which requires that receipt.
 - `oat repo archive sync [project-name]` - hydrate archived project snapshots from the configured repo-scoped S3 archive into `.oat/projects/archived/`. The old `oat project archive sync` path remains as a deprecated shim.
 - `oat project dispatch record --event-file <json-file-or-dash>` - validate one generic dispatch record plus its namespaced OAT evidence event and print the result with `status: validated-only`. The command writes nothing; launches are recorded in the calling workflow's run record. Managed, effort-pinned Claude launches run it before launch: the input carries `claudeLaunch` with the real resolver result, generated definition, and proposed payload, plus `recordBase` and `event`. The command validates their agreement and derives the configured invocation fields; callers cannot copy those fields into `recordBase`. One validation run reports every violation across `claudeLaunch`, `recordBase`, and `event` in a single error message, one `stage path: message` line each; the `recordBase` cross-field rules run even when a required field is missing, checks that need a value that failed to parse are skipped and named on a final line, secret-shaped values and absolute paths are scrubbed from the message, and the exit code stays 1. A validated input per role is published at `.agents/skills/oat-dispatch-subagents/references/managed-claude-example.json`. The command validates evidence only — it never launches a provider. A `runtime-observation` event may carry either a finished `observation` or the provider `metadata` envelope (`provider`, `observedAt`, `entries`) to normalize, but not both. `entries` may be raw provider output: they are projected through the owning parser's allowlist, are never echoed in the output, and both forms have their `match` derived from the record's configured invocation rather than trusted from the caller, with the observation's `provider` bound to the record's. With `--json`, the result adds `runtimeIdentity` with separate `configured` and `observed` objects plus a `match` of `matching`, `mismatching`, `not-comparable`, or `null`; observation is corroboration only and never overrides configured invocation. Error output is redacted on a best-effort basis; absolute paths in identity fields are rejected outright, while some prose forms (colon-prefixed, URL routes) can survive. See [Evidence Layers](../workflows/advanced/evidence-layers.md).
 - `oat project dispatch canonical-role --role <name> --request-id <id> --skill-dir <dir> [--json]` - resolve a canonical role through the loaded, user (`$HOME/.agents`), and project (`<repo>/.agents`) tiers and print the `canonical-role-resolution` event that `oat project dispatch record` accepts unchanged: redacted `canonicalPath` and `selectedPath` in the form `<loaded|user|project>/agents/<name>.md`, the role's `contentDigest`, and `candidateMisses`. `--skill-dir` is required because the loaded tier is derived from the loaded skill's directory; a missing or invalid directory exits 1 with a redacted error. An unknown role prints `missing` evidence with its recovery commands. Read-only; the dependency is the `workflows` pack.
 - `oat project validate-plan --project-path <path>` - validates `oat_plan_parallel_groups` metadata in `plan.md`; exits non-zero on invalid. Lite plans must contain exactly one phase, declare no parallel groups, and give every Validation Criteria bullet either a backticked command or a `manual:` instruction. See [Implementation Execution](../workflows/projects/execution/implementation-execution.md#parallel-phase-groups).
 - `oat project log append|check|synthesize|rollup` - manage the optional append-only project observation log: append validated judgment or structural entries, inspect grammar and synthesis status, complete end-of-run synthesis, and roll observations into `summary.md` plus the configured repository ledger. See [Project Log](../workflows/projects/execution/project-log.md).
 - `oat project set-mode` — deprecated no-op. Execution mode is no longer user-selectable; emits a deprecation warning and preserves the `--json` contract.
-- `oat gate review <prompt...>` - run a stateful, headless OAT review through the target registry, parse the produced review artifact, and exit nonzero for configured blocking findings. `--timeout-ms <milliseconds>` overrides target, `workflow.gateTimeouts`, environment, and scope defaults; accepted values are 1,000–14,400,000. Final/phase/range code reviews default to 30 minutes, while task code and artifact reviews default to 15 minutes. With `--json`, the result envelope on exit is the canonical completion signal: `status` is `ok` | `blocked` | `review_failed` | `artifact_missing` | `artifact_validation_failed` | `targeting_correlation_failed`, alongside `runId`, `generatedAt`, and `artifactPath` when available. `artifact_missing` means an accepted child exited cleanly without an artifact; fix synchronous review/artifact completion and start a new run, without review-receive or same-run remediation. For `targeting_correlation_failed`, correct the project declaration or artifact routing and start a new run; do not run review-receive even if an artifact path is present. For `artifact_validation_failed`, correct the artifact and rerun the gate until it revalidates as `ok` or `blocked`. Invoke `oat-project-review-receive` only when all three conditions hold: `status` is `ok` or `blocked`, `receiveEligible` is `true`, and `handoff` is non-null. `review_failed` may include structured `refusal`, `noOutputProduced`, and metadata-only `activityEvidence`; these diagnostic fields never make a run receive-eligible. After a timeout, a validated run-correlated artifact returns the ordinary `ok` or `blocked` envelope with additive `lateCompletion: true`. When post-selection work fails after the reviewer already committed a run-correlated artifact, the gate re-validates that selected snapshot through the same eligibility path rather than re-parsing whatever the path now holds, never re-dispatching, and returns the ordinary `ok` or `blocked` envelope with additive `postSelectionRecovery: true`; the artifact must still be present and unchanged for re-validation to succeed. When nothing recovers, `review_failed` names the failing sub-step in `postSelection.step` and its cause in `postSelection.code`. Duplicate run-ID matches or a changed artifact with a mismatched run ID retain `targeting_correlation_failed` and `receiveEligible: false`. Orchestrators should read the structured result rather than poll the filesystem. See [Workflow Gates](../workflows/advanced/workflow-gates.md).
+- `oat gate review <prompt...>` - run a stateful, headless OAT review through the target registry, parse the produced review artifact, and exit nonzero for configured blocking findings. `--timeout-ms <milliseconds>` overrides target, `workflow.gateTimeouts`, environment, and scope defaults; accepted values are 1,000–14,400,000. Final/phase/range code reviews and artifact reviews default to 30 minutes, while task code reviews default to 15 minutes. With `--json`, the result envelope on exit is the canonical completion signal: `status` is `ok` | `blocked` | `review_failed` | `artifact_missing` | `artifact_validation_failed` | `targeting_correlation_failed`, alongside `runId`, `generatedAt`, and `artifactPath` when available. `artifact_missing` means an accepted child exited cleanly without an artifact; fix synchronous review/artifact completion and start a new run, without review-receive or same-run remediation. For `targeting_correlation_failed`, correct the project declaration or artifact routing and start a new run; do not run review-receive even if an artifact path is present. For `artifact_validation_failed`, correct the artifact and rerun the gate until it revalidates as `ok` or `blocked`. Invoke `oat-project-review-receive` only when all three conditions hold: `status` is `ok` or `blocked`, `receiveEligible` is `true`, and `handoff` is non-null. `review_failed` may include structured `refusal`, `noOutputProduced`, and metadata-only `activityEvidence`; these diagnostic fields never make a run receive-eligible. After a timeout, a validated run-correlated artifact returns the ordinary `ok` or `blocked` envelope with additive `lateCompletion: true`. When post-selection work fails after the reviewer already committed a run-correlated artifact, the gate re-validates that selected snapshot through the same eligibility path rather than re-parsing whatever the path now holds, never re-dispatching, and returns the ordinary `ok` or `blocked` envelope with additive `postSelectionRecovery: true`; the artifact must still be present and unchanged for re-validation to succeed. When nothing recovers, `review_failed` names the failing sub-step in `postSelection.step` and its cause in `postSelection.code`. Duplicate run-ID matches or a changed artifact with a mismatched run ID retain `targeting_correlation_failed` and `receiveEligible: false`. Orchestrators should read the structured result rather than poll the filesystem. See [Workflow Gates](../workflows/advanced/workflow-gates.md).
 - `oat gate route --expect-runtime <runtime> --expect-model <model> --can-await <true|false> --json` - return the headless child route (`inline`, `delegate-sync`, or `refuse`) from provider-marker and model evidence. Ambiguous or contradictory evidence never routes inline.
 - `oat gate exec <prompt...>` / `oat gate cross-provider-exec <prompt...>` - run a generic target prompt. `--timeout-ms` uses the same validated CLI override; untyped runs otherwise retain the legacy default path.
 - `oat gate target set <id> --invocation-model <model|provider-default> --invocation-reasoning-effort <effort|provider-default>` - persist optional configured invocation metadata alongside an exec target without inferring it from the target command.
@@ -203,6 +244,7 @@ The `workflow.*` namespace holds user-facing workflow preferences that let you a
 - `workflow.hillCheckpointDefault` (`every` | `final`) — default HiLL checkpoint behavior in `oat-project-implement`
 - `workflow.archiveOnComplete` (`boolean`) — skip the archive prompt in `oat-project-complete`
 - `workflow.createPrOnComplete` (`boolean`) — skip the "Open a PR?" prompt in `oat-project-complete`
+- `workflow.autonomousComplete` (`boolean`, default `false`) — standing opt-in for the non-interactive `oat-project-complete-auto` companion; when `false` it stops with "interactive completion required"
 - `workflow.postImplementSequence` (legacy `wait` | `summary` | `pr` | `docs-pr`, or structured `{preApproval, postApproval}` arrays) — approval-aware post-implementation chaining
 - `workflow.reviewExecutionModel` (`subagent` | `inline` | `fresh-session`) — default final-review execution model
 - `workflow.autoReviewAtHillCheckpoints` (`boolean`) — auto-run the extra lifecycle review at HiLL checkpoints

package/assets/docs/reference/config-and-local-state.md

@@ -50,7 +50,7 @@ The command validates all inputs before creating the scaffold or writing an item
 
 - Validates the item's current `status` against the enum (`open | in_progress | closed | wont_do`); an out-of-enum value such as `done` is a hard error with a fix hint. Archiving is legal from any valid status — a `closed` item still in `items/` just gets its move finished.
 - For the default `closed` path, validates and trims a nonblank `--summary` before any file or index mutation. The `wont_do` path may omit the summary and completion-ledger entry.
-- Rewrites only the `status:` and `updated:` frontmatter lines (preserving any inline enum comment), then moves the item from `items/` to `archived/` with `git mv` inside a work tree, falling back to a plain rename (with a warning) outside git or if `git mv` fails.
+- Rewrites only the `status:` and `updated:` frontmatter lines (preserving any inline enum comment), then moves the item from `items/` to `archived/` with a filesystem rename. Archive leaves the Git index unchanged on initial archive and retry; callers own formatting, staging and committing the complete operation.
 - `closed` archives append a canonical newest-first `completed.md` entry (`YYYY-MM-DD — <id> — Title — summary`). `wont_do` archives append an entry only when `--summary` is provided. A missing `completed.md` is scaffolded from the starter template; a missing `## Completed Items` heading is scaffolded with a warning.
 - Rewrites inbound references to the moved file across Markdown under `.oat/repo/**` — tracked and untracked files that Git does not ignore, or every `.md` file outside a Git work tree — (external plans, decision records, other backlog items): relative links, `.oat/repo`-relative and repository-root path strings (including `oat_external_plan_sources` frontmatter) that resolve to `items/<id>.md` now point at `archived/<id>.md`, and the moved item's own relative links (inline links with any title form, and reference-style definitions; never footnotes or prose) are rebased when their target exists, so they keep resolving. An inline code span whose whole content is a path to the item (optionally with an `#anchor`), such as an external plan's `Source artifact or scope` citation, is rewritten; any other code span or fenced code block that mentions `items/<id>.md` is left as written with a warning, so recorded commands keep their meaning. Only references that resolve to the item's former `items/<id>.md` path change, and a link that already resolves to a different existing file is never repointed; URLs are never touched, and symlinked Markdown files are skipped so nothing outside `.oat/repo` is read or written. Each rewritten file is reported; a reference that names `items/<id>.md` but cannot be resolved is left untouched with a warning.
 - Regenerates the managed backlog index after the move.
@@ -77,11 +77,18 @@ On success the payload is the archive result object:
   "rewrittenReferences": [
     ".oat/repo/reference/external-plans/2026-07-05-example-plan.md"
   ],
+  "affectedPaths": [
+    "/repo/.oat/repo/pjm/backlog/items/BL-260705-example.md",
+    "/repo/.oat/repo/pjm/backlog/archived/BL-260705-example.md",
+    "/repo/.oat/repo/pjm/backlog/completed.md",
+    "/repo/.oat/repo/pjm/backlog/index.md",
+    "/repo/.oat/repo/reference/external-plans/2026-07-05-example-plan.md"
+  ],
   "warnings": []
 }
 ```
 
-`result` is `archived` or `noop` (already archived); `completedEntry` is `written`, `scaffolded`, or `skipped` (e.g. a `wont_do` archive without `--summary`); `movedTo` is the destination path or `null`; `rewrittenReferences` lists the repository-relative Markdown files whose references to the moved item were rewritten (on a no-op this lists anything the retried rewrite changed, and the human output prints each file on both paths). On an actionable failure the payload is `{ "result": "error", "id": "<id>", "message": "<why + fix>" }`.
+`result` is `archived` or `noop` (already archived); `completedEntry` is `written`, `scaffolded`, or `skipped` (e.g. a `wont_do` archive without `--summary`); `movedTo` is the destination path or `null`; `rewrittenReferences` lists the repository-relative Markdown files whose references to the moved item were rewritten (on a no-op this lists anything the retried rewrite changed, and the human output prints each file on both paths). `affectedPaths` is the deduplicated, normalized absolute operation path list: old item path (a tracked deletion), archived destination, index, completed ledger when written, and rewritten references. Retries report actual current-pass changes. In Git, a retry also reports prior uncommitted outputs only when HEAD still contains the old item and lacks the destination: the item move, a newly inserted ledger entry, a removed index entry, and references whose HEAD bytes still resolve to the old item. Existing archived links and unrelated edits in already-settled files are not claimed. Without Git history, retries report current-pass mutations only. A `wont_do` archive without an entry does not claim unrelated ledger changes. Capture each successful JSON result, deduplicate the union of `affectedPaths`, add any owned handoff filesystem deletion, and format existing affected text using the repository command. Pass that complete literal list to `oat internal commit-paths` with enabled hooks and a unique retained operation identity; stop on unavailable or blocked/failed helper, preserve unrelated staged/unstaged work, and never stage only the missing old path. An empty settled-noop list requires no commit. On an actionable failure the payload is `{ "result": "error", "id": "<id>", "message": "<why + fix>" }`.
 
 For full project-management repo-reference setup, use [`oat pjm init`](../getting-started/tool-packs.md#install-vs-initialize). It scaffolds the two-layer PJM surface (`pjm/current-state.md`, `pjm/roadmap.md`, `reference/decisions/`, and AGENTS guides) and delegates the backlog sub-surface to `oat backlog init`.
 
@@ -209,6 +216,8 @@ with `oat pjm init` as the recovery instead of treating absent
 `.oat/repo/pjm/` files as drift. See
 [Install vs. initialize](../getting-started/tool-packs.md#install-vs-initialize).
 
+`oat pjm init` and `oat pjm migrate` update only their adoption markers; they preserve `pjm.remote` and other existing, unowned configuration fields.
+
 Workflow automation preferences are also visible through `oat config` and can be set at local, shared, or user scope. Notable review-loop keys:
 
 - `workflow.autoArtifactReview.plan` - default-on bounded artifact review for generated `plan.md` files before implementation handoff

package/assets/docs/reference/configuration.md

@@ -272,7 +272,13 @@ packaged `assets/` directory next to the installed CLI. Setting a non-empty
   required bundle directory is empty in the packed tarball.
 - Produce a matching bundle with `bash packages/cli/scripts/bundle-assets.sh`
   while `OAT_ASSETS_DIR` points at the target directory (the script already
-  honors the variable as its destination).
+  honors the variable as its destination). Because publishing replaces the
+  destination, the script accepts an override destination only when it is
+  absent, an empty directory, or a previous bundle (a directory holding
+  `bundle-metadata.json`); it refuses anything else, including a directory it
+  cannot list. The default `packages/cli/assets` destination is exempt. The
+  script also stops before copying when an inventory lookup comes back empty,
+  absolute, climbing with `..`, or naming the repository root.
 
 This is primarily a test-isolation and packaging seam; day-to-day use of the CLI
 does not need it.
@@ -294,7 +300,7 @@ must be integer milliseconds from `1,000` through `14,400,000`.
   "workflow": {
     "gateTimeouts": {
       "code": 2400000,
-      "artifact": 900000
+      "artifact": 2400000
     },
     "gates": {
       "execTargets": {
@@ -712,6 +718,7 @@ Workflow preference keys live under the `workflow.*` namespace:
 - `workflow.hillCheckpointDefault` — `every` or `final`. Default HiLL checkpoint behavior in `oat-project-implement` (a HiLL, or human-in-the-loop, checkpoint is a stop for your review): pause after every phase or only after the last phase. When unset, the skill prompts. See [Choosing a checkpoint default](#choosing-a-checkpoint-default).
 - `workflow.archiveOnComplete` — boolean. Skip the "Archive after completion?" prompt in `oat-project-complete`. When unset, the skill prompts.
 - `workflow.createPrOnComplete` — boolean. Skip the "Open a PR?" prompt in `oat-project-complete`; when true, completion auto-triggers PR creation. When unset, the skill prompts.
+- `workflow.autonomousComplete` — boolean, default `false`. Standing opt-in for `oat-project-complete-auto`, the non-interactive completion companion that runs only when a workflow names it as a step (today `oat-wave-execute` closeout step 8 and the `oat-wave-program` completion checkpoint). Its `OAT_AUTONOMOUS` lifecycle route refuses until a lifecycle skill names the companion, and none does today. When `false`, the companion stops with "interactive completion required" and writes nothing. The interactive `oat-project-complete` is unaffected.
 - `workflow.postImplementSequence` — legacy `wait`, `summary`, `pr`, or `docs-pr`, or `{ "preApproval": [...], "postApproval": [...] }`. Legacy values remain strings and keep their existing mappings. Structured arrays contain ordered, globally unique `summary`, `document`, `pr`, and `retro` steps. `retro` is post-approval only: a structured value containing it in `preApproval` is rejected. Pre-approval steps run after final review and before final HiLL approval; post-approval steps run only after that approval. Plain retrieval keeps legacy strings and prints structured values as compact JSON; `--json` returns the raw value.
 - `workflow.retro.filing.repo` — `issues`, `backlog`, or `none`; unset by default. Selects the repo-lane filing destination.
 - `workflow.retro.filing.upstream` — `issues` or `none`; unset by default. Selects the upstream-lane filing destination.
@@ -889,6 +896,7 @@ Other preferences **depend on per-repo configuration** to be safe. These should
 - `workflow.archiveOnComplete` — correctness depends on the repo's `archive.s3Uri` / `archive.s3SyncOnComplete` being configured. A user-level `true` would try to archive in repos that aren't set up for it.
 - `workflow.postImplementSequence` — correctness depends on `documentation.requireForProjectCompletion`. Setting `pr` at user level would foot-gun you in any repo that requires docs, because completion would later block on the docs gate while the PR is already open.
 - `workflow.createPrOnComplete` — this key is almost always redundant with `postImplementSequence`-driven flows. When it's meaningful, its correctness depends on the same per-repo docs and PR gates. Prefer shared scope, or omit it entirely and rely on `postImplementSequence: pr` or `docs-pr` to handle PR creation at the end of implement.
+- `workflow.autonomousComplete` — authorizes unattended completion, which archives with the repo's `workflow.archiveOnComplete` and `archive.*` settings. It never creates a PR: it reads and reports `workflow.createPrOnComplete` without acting on it, and only updates the description of an already tracked PR. A user-level `true` would authorize autonomous completion in every repo, including ones whose archive settings were never chosen for it. Set it with `--shared` (or `--local` for one checkout) in each repo whose completion settings you have reviewed.
 
 **Cross-repo foot-gun example:** If you set `workflow.createPrOnComplete: true --user`, it applies to every repo you work on. In a repo with `documentation.requireForProjectCompletion: true` and `postImplementSequence: pr` (no docs step), running `oat-project-complete` would try to auto-create a PR, then immediately hit the docs gate and block you — leaving you with an open PR and a stuck completion. Your user-level preference silently asserted something that only holds in a specific shared-config shape.
 

package/assets/docs/reference/project-artifacts.md

@@ -75,6 +75,34 @@ implementation-then-regression, static/build, or manual/visual. Static or build
 checks alone fit only changes that cannot affect runtime behavior; every
 behavioral change needs evidence that fails without the change.
 
+## Blockers in state.md
+
+`oat_blockers` accepts legacy reason strings and structured workflow records:
+
+```yaml
+oat_blockers:
+  - task_id: p01-t03
+    reason: Waiting on API contract
+    since: '2026-10-03'
+  - waiting on review
+```
+
+The control plane exposes `ProjectBlocker` as
+`string | { task_id: string; reason: string; since: string }`.
+`oat project status --json` preserves the three literal fields. Human status
+shows the task, reason and date for records, and the reason for legacy strings.
+`--field project.blockers` emits JSON; `--shell BLOCKERS=project.blockers`
+emits a shell-quoted JSON assignment. Select a single field such as
+`--field project.blockers.0.reason` to read a structured reason alone.
+
+Empty lists remain empty. Mixed lists retain entries in order, with
+legacy string normalization unchanged. Records missing any nonempty string
+field, nested lists and non-string scalars become diagnostic legacy strings:
+`Malformed blocker entry: <JSON>`. They remain visible to blocker checks and
+human output without `[object Object]` coercion. The parser also accepts
+JSON-encoded blocker lists for compatibility. These representations do not change workflow recommendations
+or the state refresh command's existing raw-frontmatter handling.
+
 ## Supporting artifacts
 
 - `summary.md`: generated by `oat-project-summary` — re-runnable, tracks its own state via frontmatter for incremental updates after revisions
@@ -99,9 +127,12 @@ different retention contracts:
   the tracked branch with the active project tree. It remains only in the local
   archived project.
 - A selected final `project-recap` is a durable completion record. Before a
-  shared project is removed, archive copies the complete selected run to
-  `.oat/repo/reference/project-recaps/<YYYYMMDD-project-slug>/`, verifies its
-  package inventory and hashes, and reports that tracked export path. Summary
+  shared project is removed, archive verifies the complete selected run and
+  exports one self-contained HTML page to
+  `.oat/repo/reference/project-recaps/<YYYYMMDD-project-slug>.html`. The
+  report identifies the run, original page/hash, exported hash, and verified
+  artifact count. The full original run, manifest, source, and QA evidence
+  remain in the archived project. Summary
   and PR links use this export, never the gitignored local archive. Lifecycle
   callers identify the selected project-relative run with:
 
@@ -110,12 +141,16 @@ different retention contracts:
     --project-recap-run explainers/<recap-slug>
   ```
 
-The archive exports at most one selected recap package. It rejects an existing
-dated destination and requires the selected path to stay under the project's
+The archive exports at most one selected recap page, with local assets embedded
+and unavailable project-source links removed. It adopts a byte-identical dated
+page on retry and refuses a differing existing destination without overwriting
+it. It creates no tracked manifest, fact-base, QA, or hash sidecar and requires the selected path to stay under the project's
 `explainers/` directory with a `project-recap` manifest. Verification checks
-the manifest's exact inventory, every declared file byte, the fact base and
-ledger, resolved theme, authored page, and QA result before deleting the active
-project.
+the manifest version's exact inventory and raw immutable file-byte hashes before
+deleting the active project. Direct CLI archive also accepts legacy v1 recaps:
+the v1 contract verifies canonical fact-base and resolved-theme JSON identities
+and build-record run/outcome agreement. The v2 contract additionally requires
+ledger and QA evidence coverage. Project completion selects v2 recap runs.
 
 Both `built` and `built-needs-review` are complete, archivable outcomes.
 `built-needs-review` means the browser rung was unavailable or found an issue;

package/assets/docs/skills/index.md

@@ -145,6 +145,7 @@ for policy, storage, approval, and recovery details.
     - `oat-explainer-kit`
     - `oat-wrap-up`
     - `oat-project-complete`
+    - `oat-project-complete-auto`
     - `oat-wave-program`
     - `oat-wave-execute`
 

package/assets/docs/skills/recon.md

@@ -303,11 +303,14 @@ downgrades. Every claim a review kept below `verified` (an unresolved issue
 scoped to it or global to its review, a coverage finding that names it, or a
 non-affirming disposition) is listed under Review Downgrades with the review's
 own text, even when it is not a key claim, so a `complete` packet cannot hide a
-downgraded claim. A claim that a required review left without a disposition stays
-`unresolved`. Any claim below `verified` that an incorporated assurance review,
-core or thorough, listed in its brief but left without a disposition is listed
-there as not reviewed by that review; a claim outside a review's brief is never
-reported as its omission. A review's
+downgraded claim. The required reviews are semantic, adversarial, and coverage,
+plus redundant verification when the run achieves `thorough`; contradiction
+resolution is never required. A claim that any required review left without a
+disposition stays `unresolved`, so the run publishes an honest packet instead of
+failing validation. Any claim below `verified` that an incorporated assurance
+review, core or thorough, listed in its brief but left without a disposition is
+listed there as not reviewed by that review; a claim outside a required review's
+brief is listed as outside its brief, never as that review's omission. A review's
 `unresolvedIssues` entry may name the claim IDs it affects or apply to the
 whole review; a legacy plain-string entry is read as review-wide. A material
 coverage gap does not fail publication by itself: the claims it affects stay