@planu/cli 5.0.0 → 5.1.1

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.0.0",
+      "bom-ref": "pkg:cargo/planu-core@5.1.1",
       "type": "library",
       "name": "planu-core",
-      "version": "5.0.0",
+      "version": "5.1.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fc9c98775c98b2f91d36ce9cb74567a547512ba5d11635052f230868af9ca9e3"
+          "content": "301863177ab4858bbbcd6f1d5ac86af8f98c424512a54c28b5343c01c1bd377b"
         }
       ]
     }
@@ -291,9 +291,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/globset@0.4.19",
+      "bom-ref": "pkg:cargo/globset@0.4.20",
       "name": "globset",
-      "version": "0.4.19",
+      "version": "0.4.20",
       "externalReferences": [
         {
           "type": "distribution",
@@ -529,9 +529,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/regex-automata@0.4.16",
+      "bom-ref": "pkg:cargo/regex-automata@0.4.18",
       "name": "regex-automata",
-      "version": "0.4.16",
+      "version": "0.4.18",
       "externalReferences": [
         {
           "type": "distribution",
@@ -1046,12 +1046,12 @@
       ]
     },
     {
-      "ref": "pkg:cargo/globset@0.4.19",
+      "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },
@@ -1069,10 +1069,10 @@
       "ref": "pkg:cargo/ignore@0.4.25",
       "dependsOn": [
         "pkg:cargo/crossbeam-deque@0.8.7",
-        "pkg:cargo/globset@0.4.19",
+        "pkg:cargo/globset@0.4.20",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/same-file@1.0.6",
         "pkg:cargo/walkdir@2.5.0",
         "pkg:cargo/winapi-util@0.1.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.0.0",
+      "ref": "pkg:cargo/planu-core@5.1.1",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1151,7 +1151,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/regex-automata@0.4.16",
+      "ref": "pkg:cargo/regex-automata@0.4.18",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
@@ -1167,7 +1167,7 @@
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },

package/dist/engine/reverse-engineer/api-detector.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const ROUTE_PATTERNS = [
     // Express/Koa/Hono: app.get('/path', handler) or router.post(...)
     {
@@ -69,18 +70,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.kt',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 function collectSourceFiles(dir) {
     const results = [];
     const queue = [dir];
@@ -97,7 +86,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/complexity-analyzer.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const SOURCE_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -14,18 +15,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.rs',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 // Patterns that increase cyclomatic complexity
 const BRANCH_PATTERNS = [
     /\bif\s*\(/g,
@@ -73,7 +62,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/config-analyzer.js

@@ -1,6 +1,7 @@
 import { technologyValue } from '../technology-registry.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const ENV_VAR_PATTERNS = [
     // JS/TS: process.env.VAR_NAME
     /process\.env\.([A-Z_][A-Z0-9_]*)/g,
@@ -55,18 +56,6 @@ const INFRA_INDICATORS = {
     'azure-pipelines.yml': 'Azure Pipelines',
     'cloudbuild.yaml': 'Google Cloud Build',
 };
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 const SOURCE_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -97,7 +86,7 @@ function collectAllFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/dependency-graph.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const IMPORT_PATTERNS = [
     // ES import: import ... from './foo'
     /(?:import\s+(?:[\s\S]*?)\s+from\s+['"]([^'"]+)['"])/g,
@@ -22,18 +23,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.rs',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 const HUB_THRESHOLD = 10;
 function collectSourceFiles(dir) {
     const results = [];
@@ -51,7 +40,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/test-analyzer.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const TEST_PATTERNS = [
     /\.test\.\w+$/,
     /\.spec\.\w+$/,
@@ -25,18 +26,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.c',
     '.swift',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 export function isTestFile(filePath) {
     const basename = path.basename(filePath);
     if (TEST_PATTERNS.some((p) => p.test(basename))) {
@@ -61,7 +50,7 @@ function collectFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/walk-ignore.d.ts

@@ -0,0 +1,3 @@
+export declare const WALK_IGNORE_DIRS: ReadonlySet<string>;
+export declare function shouldIgnoreDir(name: string): boolean;
+//# sourceMappingURL=walk-ignore.d.ts.map

package/dist/engine/reverse-engineer/walk-ignore.js

@@ -0,0 +1,26 @@
+// engine/reverse-engineer/walk-ignore.ts — shared directory-walk ignore list
+// Consumed by all reverse-engineer analyzers (dependency-graph, test-analyzer,
+// api-detector, config-analyzer, complexity-analyzer) so the ignore rules stay
+// in one place instead of five duplicated copies.
+export const WALK_IGNORE_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'out',
+    '.next',
+    '.nuxt',
+    'coverage',
+    'vendor',
+    '__pycache__',
+    '.worktrees',
+    '.claude',
+    'planu',
+    'website',
+    'data',
+    'benchmarks',
+]);
+export function shouldIgnoreDir(name) {
+    return WALK_IGNORE_DIRS.has(name);
+}
+//# sourceMappingURL=walk-ignore.js.map

package/dist/engine/spec-format/acceptance-criteria.js

@@ -1,6 +1,7 @@
 import { parseFrontmatterScenarios } from '../validator/spec-compliance-runner.js';
 import { stripFrontmatter } from '../frontmatter-parser.js';
 import { extractListItems, extractSection } from './markdown-sections.js';
+import { stripFencedBlocks } from './text-fences.js';
 import { createCriterionIdentity, normalizeCriterionText } from '../criterion-identity.js';
 const BDD_STEP = /^(GIVEN|WHEN|THEN|AND|DADO|CUANDO|ENTONCES|Y)\b/i;
 const BDD_START = /^(GIVEN|DADO)\b/i;
@@ -91,7 +92,7 @@ function extractSectionCriteria(section) {
     return extractBddBlocks(section);
 }
 function extractBodyCriteria(raw, options) {
-    const body = stripFrontmatter(raw);
+    const body = stripFencedBlocks(stripFrontmatter(raw));
     const acceptanceCriteria = extractSection(body, 'acceptance criteria', 'criterios de aceptaci');
     if (acceptanceCriteria) {
         const sectionCriteria = extractSectionCriteria(acceptanceCriteria);
@@ -99,18 +100,18 @@ function extractBodyCriteria(raw, options) {
             return sectionCriteria;
         }
     }
-    if (options.allowLegacyBodyFallback === false) {
-        return [];
-    }
-    const checkboxCriteria = body
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => /^-\s*\[[ x]\]/i.test(line))
-        .map((line) => line.replace(/^-\s*\[[ x]\]\s*/i, '').trim());
-    if (checkboxCriteria.length > 0) {
-        return checkboxCriteria;
+    if (options.allowLegacyBodyFallback !== false) {
+        const checkboxCriteria = body
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => /^-\s*\[[ x]\]/i.test(line))
+            .map((line) => line.replace(/^-\s*\[[ x]\]\s*/i, '').trim());
+        if (checkboxCriteria.length > 0) {
+            return checkboxCriteria;
+        }
+        return extractBddBlocks(body);
     }
-    return extractBddBlocks(body);
+    return [];
 }
 function buildCriterion(text, source, index) {
     const trimmed = text.trim();

package/dist/engine/spec-format/text-fences.js

@@ -4,7 +4,25 @@
  * Returns the remaining prose only, preserving line structure.
  */
 export function stripFencedBlocks(md) {
-    // Match ``` or ~~~ fences (with optional language specifier) spanning multiple lines
-    return md.replace(/^(`{3,}|~{3,})[^\n]*\n[\s\S]*?^\1\s*$/gm, '');
+    const lines = md.split('\n');
+    let openFence;
+    return lines
+        .map((line) => {
+        if (openFence !== undefined) {
+            const close = new RegExp(`^ {0,3}${openFence.marker}{${String(openFence.length)},}[ \\t]*\\r?$`);
+            if (close.test(line)) {
+                openFence = undefined;
+            }
+            return '';
+        }
+        const opening = /^ {0,3}(`{3,}|~{3,})[^\r\n]*\r?$/.exec(line);
+        if (opening?.[1]) {
+            const marker = opening[1][0];
+            openFence = { marker, length: opening[1].length };
+            return '';
+        }
+        return line;
+    })
+        .join('\n');
 }
 //# sourceMappingURL=text-fences.js.map

package/dist/engine/spec-state-syncer.js

@@ -72,7 +72,7 @@ async function processSingleSpec(filePath, dataStatusMap, report) {
  * The caller (tool layer) is responsible for persisting updates to storage.
  */
 export async function detectSpecStateDivergences(projectPath, dataEntries) {
-    const report = { synced: 0, divergences: [], errors: [], rejected: [] };
+    const report = { synced: 0, divergences: [], errors: [], rejected: [], ghosts: [] };
     const updates = [];
     const dataStatusMap = new Map(dataEntries.map((s) => [s.id, s.status]));
     let specFiles;

package/dist/engine/timing/budget.js

@@ -107,7 +107,11 @@ export async function withTotalBudget(operationName, ceilingMs, fn) {
                 timedOut: false,
                 category: 'operation_failed',
                 elapsedMs,
-                warning: `[SPEC-713] Operation "${operationName}" failed after ${String(elapsedMs)}ms (operation_failed)`,
+                // SPEC-1351: keep the thrown error's message — the production bug this
+                // fixed surfaced only as an opaque "operation_failed" with no way to
+                // tell what actually broke — but never leak the raw call stack into
+                // this user-facing warning string.
+                warning: `[SPEC-713] Operation "${operationName}" failed after ${String(elapsedMs)}ms (operation_failed): ${outcome.error.message}`,
             };
         }
         return {

package/dist/server/routes/specs.js

@@ -26,9 +26,7 @@ const VALID_STATUSES = [
     'discarded',
 ];
 function containsReconciliationAuthorityFields(body) {
-    return ('reconciliationRequestId' in body ||
-        'expectedImplementingTransitionId' in body ||
-        'implementationReviewDigest' in body);
+    return 'reconciliationRequestId' in body || 'expectedImplementingTransitionId' in body;
 }
 /** Resolve projectPath from the request Host header or fallback to process.cwd(). */
 function getProjectPath(ctx) {
@@ -192,10 +190,13 @@ export async function handleUpdateSpecStatus(ctx) {
         sendBadRequest(ctx.res, 'Request body must be a JSON object');
         return;
     }
-    const { status } = body;
+    const { status, implementationReviewDigest } = body;
     if (containsReconciliationAuthorityFields(body)) {
         ctx.res.writeHead(403, { 'Content-Type': 'application/json' });
-        ctx.res.end(JSON.stringify({ error: 'Reconciliation is available only through local MCP.' }));
+        ctx.res.end(JSON.stringify({
+            error: 'Reconciliation is available only through local MCP.',
+            code: 'RECONCILIATION_UNTRUSTED_SURFACE',
+        }));
         return;
     }
     if (typeof status !== 'string' || !VALID_STATUSES.includes(status)) {
@@ -219,6 +220,7 @@ export async function handleUpdateSpecStatus(ctx) {
             projectPath,
             trigger: 'http',
             actor: 'http-api',
+            implementationReviewDigest: implementationReviewDigest,
         });
         if (result.isError) {
             const reason = result.content[0]?.type === 'text' ? result.content[0].text : 'Gate blocked transition';

package/dist/tools/challenge-spec-helpers.d.ts

@@ -1,5 +1,14 @@
 import type { FailureScenario, ConcurrencyAnalysis, RiskLevel, Spec, ProjectKnowledge } from '../types/index.js';
-export declare function generateConcurrencyAnalysis(_spec: Spec, content: string, _knowledge: ProjectKnowledge): ConcurrencyAnalysis;
+/**
+ * Result of generateConcurrencyAnalysis. `suppressedCount` tracks candidates
+ * that matched a domain keyword (counter/status/file/session/cache) but were
+ * dropped because the spec content contains no corroborating concurrency
+ * context (e.g. "concurrent", "simultaneously", "multiple users") — SPEC-1350.
+ */
+export interface ConcurrencyAnalysisResult extends ConcurrencyAnalysis {
+    suppressedCount: number;
+}
+export declare function generateConcurrencyAnalysis(_spec: Spec, content: string, _knowledge: ProjectKnowledge): ConcurrencyAnalysisResult;
 export declare function buildScalabilityAssessment(spec: Spec, knowledge: ProjectKnowledge, scenarios: FailureScenario[]): string;
 export declare function calculateOverallRisk(scenarios: FailureScenario[], concurrency: ConcurrencyAnalysis): RiskLevel;
 export declare function readSpecContent(spec: Spec): Promise<string>;

package/dist/tools/challenge-spec-helpers.js

@@ -1,55 +1,96 @@
 // tools/challenge-spec-helpers.ts — Concurrency, risk, and spec-reader helpers for challenge-spec
 import { readFile } from 'node:fs/promises';
 import { readSpecTechnicalSection } from '../engine/spec-format/read-technical-section.js';
-// --- Concurrency analysis ---
+import { hasAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../engine/text-signal-boundaries.js';
+// Bare keyword matches (counter, status, draft, ...) are common in unrelated
+// prose (variable names, file paths, section headers, bug narratives). They
+// only ground a race-condition/shared-state finding when the spec content
+// also affirms an explicit concurrency context — otherwise they are boilerplate.
+const CONCURRENCY_CONTEXT_PATTERN = /\b(?:concurrent(?:ly)?|simultaneous(?:ly)?|in\s+parallel|parallel\s+writes?|race\s+condition|multiple\s+users?|at\s+the\s+same\s+time|two\s+users|shared\s+state|atomic(?:ally)?|thread-safe|synchroniz(?:e|es|ed|ing|ation)|multiple\s+(?:tabs|devices|requests|clients))\b/i;
+const AUTH_PATTERN = /\b(?:login|auth)\b/i;
+const LIST_SEARCH_PATTERN = /\b(?:list|search|feed)\b/i;
+const WRITE_PATTERN = /\b(?:submit|create|update)\b/i;
+const COUNTER_PATTERN = /\b(?:counter|increment|balance|stock|quantity|vote)\b/i;
+const STATUS_PATTERN = /\bstatus\b/i;
+const TRANSITION_PATTERN = /\b(?:update|transition)\b/i;
+const FILE_PATTERN = /\b(?:file|upload|resource)\b/i;
+const SESSION_PATTERN = /\b(?:session|cart|draft)\b/i;
+const CACHE_PATTERN = /\b(?:cache|global|config)\b/i;
+/** Grounded, boundary-aware, negation-aware match against contract prose only. */
+function affirms(content, pattern) {
+    return hasAffirmedMatch(content, pattern);
+}
 export function generateConcurrencyAnalysis(_spec, content, _knowledge) {
-    const lower = content.toLowerCase();
+    // Drop frontmatter, code fences, and quoted/backticked examples before
+    // keyword inference — mirrors detectChallengeCapabilities so this generator
+    // reads the same "contract prose" the capability gate already reads.
+    const contract = stripMetaAnalysisText(stripNonContractText(content));
     const hotPaths = [];
     const raceConditions = [];
     const sharedState = [];
     const recommendations = [];
-    // Detect hot paths
-    if (lower.includes('login') || lower.includes('auth')) {
+    let suppressedCount = 0;
+    // Hot paths are informational only (they do not feed overallRisk), so a
+    // plain boundary-aware match is sufficient here — no context gate needed.
+    if (affirms(contract, AUTH_PATTERN)) {
         hotPaths.push('Authentication endpoint (high-frequency, shared session state)');
     }
-    if (lower.includes('list') || lower.includes('search') || lower.includes('feed')) {
+    if (affirms(contract, LIST_SEARCH_PATTERN)) {
         hotPaths.push('List/search endpoints (high read frequency)');
     }
-    if (lower.includes('submit') || lower.includes('create') || lower.includes('update')) {
+    if (affirms(contract, WRITE_PATTERN)) {
         hotPaths.push('Write endpoints (mutation-heavy, lock-prone)');
     }
-    // Detect race conditions
-    if (lower.includes('counter') ||
-        lower.includes('increment') ||
-        lower.includes('balance') ||
-        lower.includes('stock') ||
-        lower.includes('quantity') ||
-        lower.includes('vote')) {
+    const hasConcurrencyContext = affirms(contract, CONCURRENCY_CONTEXT_PATTERN);
+    const counterMatched = affirms(contract, COUNTER_PATTERN);
+    if (counterMatched && hasConcurrencyContext) {
         raceConditions.push('Counter/balance updates may lose increments under concurrent writes');
         recommendations.push('Use database-level atomic increments (UPDATE SET count = count + 1) instead of read-modify-write');
     }
-    if (lower.includes('status') && (lower.includes('update') || lower.includes('transition'))) {
+    else if (counterMatched) {
+        suppressedCount += 1;
+    }
+    const statusMatched = affirms(contract, STATUS_PATTERN) && affirms(contract, TRANSITION_PATTERN);
+    if (statusMatched && hasConcurrencyContext) {
         raceConditions.push('Status transitions may conflict when two users update simultaneously');
         recommendations.push('Use optimistic locking (version column) or pessimistic locking (SELECT FOR UPDATE)');
     }
-    if (lower.includes('file') || lower.includes('upload') || lower.includes('resource')) {
+    else if (statusMatched) {
+        suppressedCount += 1;
+    }
+    const fileMatched = affirms(contract, FILE_PATTERN);
+    if (fileMatched && hasConcurrencyContext) {
         raceConditions.push('Concurrent file writes to same resource may corrupt data');
         recommendations.push('Use advisory locks or rename-and-swap pattern for file operations');
     }
-    // Detect shared state
-    if (lower.includes('session') || lower.includes('cart') || lower.includes('draft')) {
+    else if (fileMatched) {
+        suppressedCount += 1;
+    }
+    const sessionMatched = affirms(contract, SESSION_PATTERN);
+    if (sessionMatched && hasConcurrencyContext) {
         sharedState.push('User session state (may be accessed from multiple tabs/devices)');
     }
-    if (lower.includes('cache') || lower.includes('global') || lower.includes('config')) {
+    else if (sessionMatched) {
+        suppressedCount += 1;
+    }
+    const cacheMatched = affirms(contract, CACHE_PATTERN);
+    if (cacheMatched && hasConcurrencyContext) {
         sharedState.push('Global cache or configuration (requires synchronized access)');
     }
-    // General recommendations
+    else if (cacheMatched) {
+        suppressedCount += 1;
+    }
+    // General recommendations — only emitted once a race condition is actually
+    // grounded, otherwise a formatting-only spec would still surface generic
+    // "use database transactions" boilerplate (SPEC-1350 AC1).
     if (raceConditions.length === 0) {
         recommendations.push('No obvious race conditions detected, but test concurrent scenarios in integration tests');
     }
-    recommendations.push('Use database transactions for multi-step operations');
-    recommendations.push('Implement idempotency keys for all mutation endpoints');
-    return { hotPaths, raceConditions, sharedState, recommendations };
+    else {
+        recommendations.push('Use database transactions for multi-step operations');
+        recommendations.push('Implement idempotency keys for all mutation endpoints');
+    }
+    return { hotPaths, raceConditions, sharedState, recommendations, suppressedCount };
 }
 // --- Scalability and risk ---
 export function buildScalabilityAssessment(spec, knowledge, scenarios) {

package/dist/tools/challenge-spec.js

@@ -171,9 +171,24 @@ export async function handleChallengeSpec(args, server) {
     // SPEC-615 AC3: Check criteria against prior decisions for technology contradictions
     await runPriorDecisionContradictions(projectId, spec.title, spec.tags, specContent, failureScenarios);
     // 6. Generate concurrency analysis
-    const concurrencyAnalysis = focusAreas.includes('concurrency') && capabilities.concurrency
+    const concurrencyResult = focusAreas.includes('concurrency') && capabilities.concurrency
         ? generateConcurrencyAnalysis(spec, specContent, knowledge)
-        : { hotPaths: [], raceConditions: [], sharedState: [], recommendations: [] };
+        : {
+            hotPaths: [],
+            raceConditions: [],
+            sharedState: [],
+            recommendations: [],
+            suppressedCount: 0,
+        };
+    // SPEC-1350: concurrency candidates that matched a domain keyword but lacked
+    // a corroborating concurrency context are suppressed before risk/summary math.
+    const concurrencySuppressedCount = concurrencyResult.suppressedCount;
+    const concurrencyAnalysis = {
+        hotPaths: concurrencyResult.hotPaths,
+        raceConditions: concurrencyResult.raceConditions,
+        sharedState: concurrencyResult.sharedState,
+        recommendations: concurrencyResult.recommendations,
+    };
     // Unsupported domain templates are removed before prioritization and risk calculation.
     const actionableFailureScenarios = failureScenarios.filter((scenario) => isScenarioSupportedByCapabilities(scenario, capabilities));
     const suppressedScenarioCount = failureScenarios.length - actionableFailureScenarios.length;
@@ -219,7 +234,7 @@ export async function handleChallengeSpec(args, server) {
         summary: {
             totalScenarios: failureScenarios.length,
             actionableScenarios: failureScenariosScored.length,
-            suppressedLowRelevanceScenarios: suppressedScenarioCount,
+            suppressedLowRelevanceScenarios: suppressedScenarioCount + concurrencySuppressedCount,
             shownByDefault: 3,
             mustAddressBeforeCoding: prioritizedSummary,
             criticalImpact: actionableFailureScenarios.filter((s) => s.impact === 'critical').length,