@pilotspace/add 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -4,6 +4,66 @@ All notable changes to the ADD method (`@pilotspace/add` on npm,
 `pilotspace-add` on PyPI) are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/); versions follow semver.
 
+## [2.3.0] — 2026-07-24
+
+Minor: three waves — a **signal graph** view over the task DAG, the **§2
+Scenarios fold** into §4, and a **call-lean pass** that kills the two measured
+WM1 freeze/scope call sinks. Engine changes are additive; templates migrate
+in place (no manual task-file edits).
+
+### Signal graph — one addressable node for every note/todo/delta
+- **unified signal model** — note, todo, and spec-delta collapse into ONE
+  addressable `signal` node (status + edges), projected as a VIEW, not a new
+  store; `_signals` reader.
+- **`graph --signals`** — opt-in overlay renders signals on the task DAG;
+  **exit-criteria** render as `ec_` *delivered-by* nodes (a milestone's own
+  criteria appear as ✓/○ nodes wired to the tasks that meet them).
+- **`graph --html`** — emits a self-rendering HTML page to tmp (Mermaid inline,
+  no external host).
+- **atomicity signal** — the freeze SEEDS a persistent atomicity signal into the
+  task's todos instead of an ephemeral print, so the nudge survives the session.
+
+### §2 Scenarios folded into §4 — one place for cases
+- the standalone **§2 SCENARIOS** section is **retired in place**: pass/fail cases
+  now live with the tests in **§4 · TESTS & SCENARIOS** (primary-case rigor). The
+  §3–§7 numbers are unchanged so the freeze parser and every §-reference keep
+  working — the §1→§3 jump is intentional.
+- **PROJECT.md** gains a managed `ADD:SPECS` pointer block (init/migrate inject it
+  from the 5-DD spec set); foundation references reconciled to the `.add/specs/`
+  model; the generated **CLAUDE.md** block finalized in the generator.
+- the Step-2 Scenarios book chapter folds into Step-4; `add-flow.png` retired.
+
+### Call-lean pass — the WM1 freeze/scope sinks die at the source
+- **freeze-flag slot** — `PLAN.md.tmpl` §3 carries a drafted-blank *Least-sure
+  flag* slot; the first freeze no longer fails `unflagged_freeze` (0/6 reps in the
+  re-measure, was 3/3). The unfilled part-menu placeholder still never satisfies
+  the gate — the floor holds.
+- **scope-first freeze** — a §3 Scope that resolves to zero cover is now refused
+  `scope_unresolved` AT the freeze with a paste-ready fix, instead of surfacing
+  later as `scope_violation` → re-cross → re-gate. UNDECLARED stays grandfathered;
+  greenfield `[MISSING]` tokens still freeze; a `.add/tasks/` token gets a
+  task-dir teach note.
+- **scope-walk prunes** — `.venv` · `venv` · `.tox` · `.mypy_cache` · `.ruff_cache`
+  · `.eggs` and any `*.egg-info` dir are pruned from the scope walk, so an
+  in-workspace virtualenv or `pip install -e .` metadata is never read as an
+  out-of-scope write. `dist`/`build` stay watched (can be a real write-set). The
+  untouched-Scope-default warning now self-explains (a note, not a blocker; clears
+  only by editing the Scope line — re-cross does not clear it).
+- **honest fidelity meter** — the artifact-blind LLM `spec_fidelity` metric is
+  replaced by a deterministic `requirement_coverage` (frozen per-WM checklists +
+  probes, no LLM in the metric path); `oracle_pass_rate` promoted to the headline;
+  the judge demoted to an advisory `code_quality_annotation`.
+- **§3 Build-strategy relabel** — *Scope (may touch)* is the HARD scope-lock; the
+  rest (Strategy · Regression floor · Persona) is SOFT/optional. `MILESTONE.md`
+  gains a drafted-blank `## Strategy` slot.
+
+Retired (no CLI/install surface change): the standalone **§2 SCENARIOS** section
+(folded into §4) · the **ccsk / rule-file** mode · `add-flow.png`.
+
+Pinned by `test_release_2_3_0.py`. `ENGINE_MD5` re-aimed to `60eef504…`
+(scope refusal + walk prunes); the four tooling twins stay byte-identical;
+full tooling suite green (2277 tests).
+
 ## [2.2.0] — 2026-07-22
 
 Minor: the Direction beat gains a **fable reasoning discipline** — a prompt-only

package/bin/cli.js

@@ -39,7 +39,7 @@ function parseArgs(argv) {
   // hint only echoes flags the user actually chose (shortest true command).
   const args = { _: [], force: false, check: false, noSkill: false, stage: null, name: null,
                  yes: false, nonInteractive: false, global: false, globalData: false,
-                 fromGlobalData: false, ruleFile: false, lockTimeout: null };
+                 fromGlobalData: false, lockTimeout: null };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--force") args.force = true;
@@ -61,9 +61,6 @@ function parseArgs(argv) {
     // already provides the `add` skill, so a plugin bootstrap uses this to materialize
     // .add/tooling/ into the project without a duplicate .claude/skills/add.
     else if (a === "--no-skill") args.noSkill = true;
-    // --rule-file: write the ADD block to .claude/rules/add-workflows.md + reference it from
-    // CLAUDE.md instead of inlining (auto-on for ccsk projects with a .ccsk/ dir).
-    else if (a === "--rule-file") args.ruleFile = true;
     else if (a === "--stage" || a === "--name") {
       const v = argv[++i];
       // fail loudly on a trailing/abutting flag — never silently drop a value
@@ -263,126 +260,6 @@ function writeAgentPointer(target, profile) {
   }
 }
 
-// --- rule-file mode: ccsk-style relocation of the CLAUDE.md block ---------------------
-// Mirror of add.py / _installer.py rule-file logic (twins by duplication). For ccsk projects
-// (.ccsk/ dir) or an explicit --rule-file, the ADD pointer goes to .claude/rules/add-workflows.md
-// and CLAUDE.md keeps only a reference bullet. CLAUDE-only — AGENTS.md/.clinerules stay inline.
-const RULES_FILE_REL = path.join(".claude", "rules", "add-workflows.md");
-const WORKFLOW_HEADINGS = ["Rules & Workflows", "Workflows", "Rules"];
-const RULE_REF_LINE = "- ADD (AI-Driven Development) Workflows rules: ./.claude/rules/add-workflows.md";
-
-// True when the ADD block belongs in .claude/rules/add-workflows.md instead of inline.
-// Re-derived from disk: explicit flag, a ccsk project (.ccsk/), or a rule file already present.
-function ruleFileMode(root, flag) {
-  if (flag) return true;
-  try {
-    if (fs.existsSync(path.join(root, ".ccsk")) &&
-        fs.statSync(path.join(root, ".ccsk")).isDirectory()) return true;
-    if (fs.existsSync(path.join(root, RULES_FILE_REL))) return true;
-  } catch (_e) { /* fail-soft */ }
-  return false;
-}
-
-// Remove an inline ADD:BEGIN..END region (migration), collapsing the gap. An unterminated
-// BEGIN is left as-is rather than eating the rest of the file.
-function stripInlineBlock(text) {
-  const begin = text.indexOf(GUIDE_BEGIN);
-  if (begin === -1) return text;
-  let end = text.indexOf(GUIDE_END, begin);
-  if (end === -1) return text;
-  end += GUIDE_END.length;
-  const head = text.slice(0, begin).replace(/\n+$/, "");
-  const tail = text.slice(end).replace(/^\n+/, "");
-  if (head && tail) return head + "\n\n" + tail;
-  return head || tail;
-}
-
-// Insert the ADD rule-file bullet under an existing Workflows/Rules heading, or append a fresh
-// '## Workflows' section. Caller guarantees the bullet is absent.
-function insertRuleReference(text) {
-  const lines = text.split("\n");
-  let headingIdx = -1;
-  for (let i = 0; i < lines.length; i++) {
-    const m = lines[i].match(/^(#{1,6})\s+(.*?)\s*$/);
-    if (m && WORKFLOW_HEADINGS.some((h) => m[2].trim().toLowerCase() === h.toLowerCase())) {
-      headingIdx = i;
-      break;
-    }
-  }
-  if (headingIdx === -1) {
-    const body = text.replace(/\n+$/, "");
-    const sep = body ? "\n\n" : "";
-    return body + sep + "## Workflows\n\n" + RULE_REF_LINE + "\n";
-  }
-  const level = lines[headingIdx].match(/^(#{1,6})/)[1].length;
-  let end = lines.length;
-  for (let j = headingIdx + 1; j < lines.length; j++) {
-    const m = lines[j].match(/^(#{1,6})\s+/);
-    if (m && m[1].length <= level) { end = j; break; }
-  }
-  let insertAt = headingIdx + 1;
-  for (let j = headingIdx + 1; j < end; j++) {
-    if (lines[j].trim()) insertAt = j + 1;
-  }
-  lines.splice(insertAt, 0, RULE_REF_LINE);
-  return lines.join("\n");
-}
-
-// Make CLAUDE.md reference the ADD rule file under a Workflows/Rules heading, migrating any prior
-// inline ADD block out. created|updated|unchanged|skipped; .bak on change; fail-soft.
-function ensureClaudeReference(claudeMd) {
-  try {
-    const existed = fs.existsSync(claudeMd);
-    const current = existed ? fs.readFileSync(claudeMd, "utf8") : "";
-    let next = stripInlineBlock(current);
-    if (next.indexOf("add-workflows.md") === -1) next = insertRuleReference(next);
-    if (!next.endsWith("\n")) next += "\n";
-    if (next === current) return "unchanged";
-    if (existed) fs.writeFileSync(claudeMd + ".bak", current);
-    fs.writeFileSync(claudeMd, next);
-    return existed ? "updated" : "created";
-  } catch (e) {
-    warn("could not write CLAUDE.md — " + (e && e.message ? e.message : e) + "; skipped");
-    return "skipped";
-  }
-}
-
-// Rule-file variant of writeAgentPointer for the Claude profile: write the ADD pointer block to
-// .claude/rules/add-workflows.md and leave a reference in CLAUDE.md. Fail-soft.
-function writeRuleFilePointer(target, profile) {
-  const rulesPath = path.join(target, RULES_FILE_REL);
-  const block = agentPointerBlock(profile);
-  try {
-    if (fs.existsSync(rulesPath)) {
-      const current = fs.readFileSync(rulesPath, "utf8");
-      const begin = current.indexOf(GUIDE_BEGIN);
-      let next;
-      if (begin !== -1) {
-        const endIdx = current.indexOf(GUIDE_END, begin);
-        if (endIdx !== -1) {
-          next = current.slice(0, begin) + block + current.slice(endIdx + GUIDE_END.length);
-        } else {
-          next = current.replace(/\n+$/, "") + "\n\n" + block + "\n";
-        }
-      } else {
-        next = current.replace(/\n+$/, "") + "\n\n" + block + "\n";
-      }
-      if (next !== current) {
-        fs.writeFileSync(rulesPath + ".bak", current);
-        fs.writeFileSync(rulesPath, next);
-      }
-    } else {
-      fs.mkdirSync(path.dirname(rulesPath), { recursive: true });
-      fs.writeFileSync(rulesPath, block + "\n");
-    }
-  } catch (e) {
-    warn("could not write " + RULES_FILE_REL + " — " + (e && e.message ? e.message : e) + "; skipped");
-    return "skipped";
-  }
-  ensureClaudeReference(path.join(target, "CLAUDE.md"));
-  return "ok";
-}
-
 // --- interactive layer (clack on a real TTY; plain text everywhere else) -----
 // Designed-for-failure: any doubt (non-TTY, CI, --yes, a failed import, an
 // un-promptable stream) degrades to the EXACT plain-text path below. The clack
@@ -650,16 +527,7 @@ function dropFiles(args, target, profile, intent) {
   // Agent detection: write THE detected agent's integration file (a marker-delimited
   // pointer init's sync-guidelines later supersedes) + tailor the closing next-step.
   // Best-effort + fail-soft — never aborts the successful drop above.
-  // Rule-file mode (ccsk projects / --rule-file) relocates the CLAUDE.md pointer to
-  // .claude/rules/add-workflows.md + a reference — CLAUDE-only; other agents stay inline.
-  if (profile.integration_file === "CLAUDE.md" && ruleFileMode(target, args.ruleFile)) {
-    if (fs.existsSync(path.join(target, ".ccsk"))) {
-      log("  ccsk detected — ADD rules go to .claude/rules/add-workflows.md");
-    }
-    writeRuleFilePointer(target, profile);
-  } else {
-    writeAgentPointer(target, profile);
-  }
+  writeAgentPointer(target, profile);
 
   // Gemini CLI auto-loads GEMINI.md, not AGENTS.md — so for the gemini profile we ALSO merge
   // .gemini/settings.json (context.fileName) to load the AGENTS.md pointer. Fail-soft + idempotent.
@@ -1985,7 +1853,4 @@ module.exports = {
   scopeOptions: scopeOptions,
   writeIntentNote: writeIntentNote,
   writeGeminiSettings: writeGeminiSettings,
-  ruleFileMode: ruleFileMode,
-  ensureClaudeReference: ensureClaudeReference,
-  writeRuleFilePointer: writeRuleFilePointer,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pilotspace/add",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "ADD (AI-Driven Development) 2.0. The agent is the hands; ADD is the memory, judgment, and conscience — a minimal, state-tracked skill: one freeze per feature, trust from passing tests, state on disk so context rot never survives a new session.",
   "bin": {
     "add": "bin/cli.js"

package/skill/add/SKILL.md

@@ -3,7 +3,7 @@ name: add
 description: >-
   ADD (AI-Driven Development) — a minimal, state-tracked workflow: the AI writes
   the code, the human owns direction and verification. Drives every feature through
-  one lean PLAN.md: Specify → Scenarios → Plan → Tests → Build → Verify → Observe,
+  one lean PLAN.md: Specify → Plan → Tests & Scenarios → Build → Verify → Observe,
   red/green TDD built in. Use whenever a repo has `.add/`, or the user says "add",
   "start a task", "next phase", "specify this feature", "ADD method", "AI-driven
   development", or wants spec/tests-first discipline over vague-prompt coding. Also
@@ -15,7 +15,7 @@ argument-hint: "status | init | continue | --todo <text> | [describe new short g
 license: MIT
 metadata:
   author: add
-  version: "2.0.0"
+  version: "2.3.0"
 ---
 
 # ADD — memory · judgment · conscience (the agent is the hands)
@@ -70,9 +70,9 @@ confirms. Unsharp intent? **Interview before you size** (`intake.md`). A milesto
 Every task is three beats (seven steps, folded), three engine calls, ONE human decision:
 
 1. **DIRECTION** — load the domain-fit persona (seed via add-worker persona-mode if none), then compose
-   the whole bundle in ONE silent draft — §1–§3 + §5-scope, no per-section narration; §4 then runs red — in PLAN.md: §1 rules + ranked ⚠ flag (co-specify) ·
-   §2 scenarios (optional gherkin — §4 is canonical) · §3 PLAN (grounding → frozen contract shape → build-strategy + Scope + Target) ·
-   §4 red suite — one test per Must & per Reject (a Must/Reject encoded in neither §2 nor §4 = §1 not understood — stop); run red for the RIGHT reason; fill each `covers:` key. Then the ONE approval,
+   the whole bundle in ONE silent draft — §1·§3 + §5-scope, no per-section narration; §4 then runs red — in PLAN.md: §1 rules + ranked ⚠ flag (co-specify) ·
+   §3 PLAN (grounding → frozen contract shape → build-strategy + Scope + Target) ·
+   §4 TESTS & SCENARIOS — the red suite (cases live here; optional inline gherkin when a human needs it): one test per Must & per Reject (a Must/Reject encoded in no §4 test = §1 not understood — stop); minor behaviors are prose build-guidance, not gated; run red for the RIGHT reason; fill each `covers:` key. Then the ONE approval,
    presented lowest-confidence-first: `add.py freeze` (a setup session's baseline `lock` IS this approval).
 2. **BUILD** — code in `src/` until every red is green; change no test, no frozen contract; stay
    inside the §3 Scope. A test OUTSIDE your suite failing? `add.py locate` names the owning node, the

package/skill/add/deltas.md

@@ -43,7 +43,7 @@ If a learning touches two, ask "which competency, once updated, would have PREVE
 
 ```
 emit (OBSERVE)        human review
-   open  ───────────▶  folded     (merged into PROJECT.md; version bumps)
+   open  ───────────▶  folded     (merged into its `.add/specs/<dd>` spec; version bumps)
          └──────────▶  rejected   (deliberately NOT consolidated — trail kept)
 ```
 

package/skill/add/design.md

@@ -42,7 +42,7 @@ Record **before** review-domain: project **defaults** in DESIGN.md's `## Design
 
 ### 1 · review-domain
 Start from the **domain**, not a blank canvas. Read the domain model — entities, flows, the
-ubiquitous language in `PROJECT.md` / `GLOSSARY.md` — and derive **which screens** the feature needs
+ubiquitous language in `.add/specs/domain.md` / `GLOSSARY.md` — and derive **which screens** the feature needs
 + each screen's **regions**. Map each entity to a *presentational* component (owns no domain
 decision). Output: the screen list + regions.
 

package/skill/add/phases/build.md

@@ -5,6 +5,28 @@ acceptance check — passes, without changing any test or the contract. This is
 AI leads; §1–§4 removed all ambiguity. Write code into `.add/tasks/<slug>/src/` (a non-coding
 task writes its artifact to the path its §5 Scope declares).
 
+## The reasoning discipline — build's slice of the arc (definitions: `phases/direction.md`)
+
+**Fluent ≠ true** holds in code: a diff feels done in proportion to how much you wrote, not how
+much you verified — a green you haven't refuted is a claim, not evidence. Run the arc per batch:
+
+- **FRAME** — restate the batch's tests and the frozen §3 clause they cover before writing a line.
+- **GROUND** — open every anchor before editing it; a recalled file/symbol/flag is `[PRIOR]`
+  until re-confirmed against the live tree THIS session; a live read outranks memory.
+- **REASON** — name the mechanism ("because…"), simulate one concrete input through the change
+  before committing it; when a red survives a fix, hold a second hypothesis instead of patching harder.
+- **ATTACK** — before presenting green: re-run the suite fresh, then reviewer-read your own diff
+  hunting the cheap falsifying input (file · line · values). An earned green is one you tried to
+  kill. Security findings stay HARD-STOP.
+- **DELIVER** — the green report leads with the outcome and tags its claims: a pass you ran THIS
+  session is `[OBSERVED]`; a remembered pass is `[PRIOR]` — never present it bare.
+- **Constraint loop on the §5 Scope allowlist** — don't eyeball it: list the files actually
+  touched (`git status` / diff) and check each against the declared Scope tokens mechanically
+  before the gate; a miss is `scope_violation` — caught by you, not by the engine.
+- **Follow-through (the Floor's second check)** — green tests ≠ the goal reached; simulate the
+  human's end state once — run the artifact under the BARE declared runtime — before calling
+  the batch done.
+
 ## Work in small batches
 
 Pick ONE task-sized slice, restate its tests, implement, iterate to green —

package/skill/add/phases/direction.md

@@ -153,7 +153,7 @@ Rejects: `not_classified` · `dangling_criterion` · `no_milestone` · `duplicat
 
 ---
 
-## Rules (§1) + scenarios (§2) — co-specification
+## Rules (§1) — co-specification
 
 State what the feature MUST do and MUST REJECT — zero ambiguity left to guessing. Co-specify in three moves: **Diverge** (surface the 2–3 genuine framings +
 open questions; let the user react), **Converge** (draft §1 by PROJECTING from the milestone
@@ -171,8 +171,10 @@ the design-definition loop (`design.md`).
   `⚠ <assumption> — lowest confidence because <why>; if wrong: <cost>`.
 </output_format>
 
-Every Must and Reject must be checkable — canonically as a §4 test (its `covers:` tag); §2 gherkin is
-an OPTIONAL readable projection, added only when a human needs prose cases at the freeze, never as ceremony:
+Every Must and Reject must be checkable — canonically as a §4 test (its `covers:` tag). Cases live
+in §4 · TESTS & SCENARIOS (the old standalone §2 SCENARIOS section is retired). A Given/When/Then
+line is an OPTIONAL readable projection, added inline in §4 only when a human needs prose cases at
+the freeze, never as ceremony:
 
 ```gherkin
 Scenario: <short name>
@@ -182,16 +184,17 @@ Scenario: <short name>
   And <what must remain unchanged>   # REQUIRED for every rejection
 ```
 
-Then sweep the edge cases — boundary · duplicate · partial failure · concurrency · malformed input —
-one per applicable case, or rule it out on purpose. Every Then is specific and observable, never
+Then sweep the edge cases — boundary · duplicate · partial failure · concurrency · malformed input.
+Gate the PRIMARY cases + primary edge cases with a red test each; minor/secondary behaviors are
+DESCRIBED in prose as build-guidance, not a red test. Every Then is specific and observable, never
 "then it works". Your §1 ranking feeds the bundle-level flag the human reads at the freeze.
 
 <exit_gate>
 - [ ] Framings weighed noted; every required behavior stated; every rejection has a named error code.
 - [ ] Assumptions ordered lowest-confidence first; the 1–2 `⚠` flags carry why + cost — or an honest
       "none material" that still names the single biggest risk (never a blank "none").
-- [ ] Every Must and Reject is encoded — a §4 test (canonical) or an optional §2 gherkin scenario;
-      every rejection asserts what stays unchanged; edge cases covered or ruled out on purpose.
+- [ ] Every Must and Reject is encoded as a §4 test (`covers:` tag); every rejection asserts what
+      stays unchanged; primary edge cases covered or ruled out on purpose (minor ones may be prose).
 </exit_gate>
 
 ---
@@ -259,7 +262,7 @@ first, then walk the rest before saying yes:
   waiting at verify.
 - **⚠ flags first** — read the lowest-confidence flags; accept each knowing its cost if wrong. The engine refuses an unflagged freeze before build (`unflagged_freeze`).
 - **Intent** — does §1 say what you actually want built?
-- **Cases** — does every Must and Reject have an observable §2 scenario?
+- **Cases** — does every Must and Reject have an observable §4 test/scenario (`covers:` tag)?
 - **Shape** — glossary names, error codes, additive vs breaking: is THIS the shape to freeze?
 - **Shape self-verify (the constraint loop)** — for the mechanically-checkable output-shape rules — the
   frozen §3 tag census (the closed XML vocabulary), the §5 Scope path tokens, each §4 `covers:` key, any
@@ -280,8 +283,8 @@ Reject any line → the bundle goes back to draft; the freeze stays the only gat
 Run the suite now, with no implementation — **red for the right reason** (missing implementation,
 not a broken harness). A test green before code exists is testing nothing. **A test is any
 machine-checkable assertion**, not only xUnit code — a metric threshold (ML/data), a reconciliation
-query, a plan-diff (infra), a rendered-screen diff (UI). Produce: one executable test per §2
-scenario asserting **behavior, not internals** · contract-conformance tests (shapes + error
+query, a plan-diff (infra), a rendered-screen diff (UI). Produce: one executable test per PRIMARY
+case/scenario asserting **behavior, not internals** · contract-conformance tests (shapes + error
 responses) · side-effect assertions on rejection paths (`assert balance unchanged`) · a recorded
 coverage target.
 

package/skill/add/phases/verify.md

@@ -9,13 +9,34 @@ sufficient. Fill **§6** in PLAN.md including the GATE RECORD.
 > **security is always a HARD-STOP and is never auto-passed**. Under `conservative`, or whenever
 > residue is found, this phase is **human-led** (auto-PASS conditions: `run.md`).
 
+## The reasoning discipline — verify's slice of the arc (definitions: `phases/direction.md`)
+
+**Fluent ≠ true** holds for verdicts: a verdict's confidence tracks how much evidence prose you
+wrote, not what you checked — a checkbox ticked from memory is a guess wearing a PASS. The arc
+at the gate:
+
+- **GROUND** — every Part-one checkbox is a factual claim: tick it only `[OBSERVED]` — you ran
+  the suite / read the evidence THIS session; a remembered pass is `[PRIOR]` — re-run it, never
+  recall it. A safety-grep counts only once you confirmed it actually matched.
+- **ATTACK** — verify IS the arc's attack beat: the earned-green refute-read (Part four) whose
+  primary output is a concrete falsifying input, and the three lenses of Part two. Security
+  stays HARD-STOP.
+- **DELIVER** — the gate card leads with the outcome, exposes the residue yourself
+  lowest-confidence-first, and tags its claims by evidence basis — never a bare "all green".
+- **Floor Goal check** — before recording PASS, restate the goal in the human's world: a suite
+  that satisfies the §4 words but misses what they actually wanted is the most expensive miss,
+  and this gate is the last place to catch it.
+- **Constraint loop on the §6 record** — the record blocks (3-lens verdict · Deep checks ·
+  Refute-read verdict · `Reported:`) are mechanically checkable: sweep them as a census before
+  the gate — an unfilled block is an unrecorded verdict, caught by you, not by the spot-audit.
+
 ## Part one — confirm the evidence
 
 - [ ] All tests pass — or, for a non-coding task, every §4 acceptance check is green (the evidence it names is real).
 - [ ] Coverage did not decrease.
 - [ ] No test or contract was altered during build.
 - [ ] The §3 Target (measurable) is hit — including any declared outcome tests can't show, confirmed by real evidence.
-- [ ] §1 rules trace to §2/§4 — an untraced rule is a coverage gap (`add.py check` warns on it).
+- [ ] §1 rules trace to a §4 test (`covers:` tag) — an untraced rule is a coverage gap (`add.py check` warns on it).
 - [ ] every §3-cited symbol still resolves in the CURRENT tree.
 
 If any is false, stop and return to Build.
@@ -73,7 +94,7 @@ python3 .add/tooling/add.py gate PASS          # marks the task done
 Verify owns the loop's tail since the six-phase merge. After the gate, fill §7:
 
 1. **Release behind a scope-of-impact limit** — a flag and/or gradual rollout.
-2. **Reuse scenarios as monitors** — the §2 scenarios that defined "correct" define
+2. **Reuse scenarios as monitors** — the §4 scenarios/tests that defined "correct" define
    what you alert on: overall error rate, each rejection's rate, latency of the risky op.
 3. **Draft the next spec delta** — every defect, surprise, or new need becomes a change
    that re-enters the flow at Specify (a new task). Emit lessons tagged by the