@polymorphism-tech/morph-spec 8.35.0 → 8.36.0

package/src/commands/project/doctor.js

@@ -1,4 +1,4 @@
-import { join, relative } from 'path';
+import { join, relative, resolve } from 'path';
 import { execSync } from 'child_process';
 import { existsSync } from 'fs';
 import { platform, homedir } from 'os';
@@ -9,6 +9,7 @@ import { pathExists, readJson } from '../../utils/file-copier.js';
 import { checkClaudeMdImport } from '../../utils/claude-md-injector.js';
 import { buildPrIndex } from '../../lib/git/pr-index.js';
 import { pendingPrFeatures, MORPH_BRANCH_RE } from '../../lib/git/pending-prs.js';
+import { prCarriesFeature } from '../../lib/git/pr-files.js';
 import {
   checkCLIOutdated,
   checkProjectOutdated,
@@ -19,9 +20,27 @@ import { checkMissingAgents, checkAgentsDrift } from '../../utils/agents-install
 import { getProjectTags } from '../../lib/stack-filter.js';
 import { auditGraph } from '../../lib/graph/graph-health.js';
 import { auditFeatureLifecycle } from '../../core/state/lifecycle-audit.js';
-import { validateTestNodes, morphConfigPath } from '../../lib/tasks/test-nodes.js';
+import { validateTestNodes, morphConfigPath, discoverFrontendPackages } from '../../lib/tasks/test-nodes.js';
+import { samePathCase } from '../../lib/worktree/docker-audit.js';
 
 const isWindows = platform() === 'win32';
+
+/**
+ * Resolved-path equality for a `cwd` string against the project root —
+ * `"./src/web"`, `"src/web/"` and (on win32) `"src\\web"` must compare equal
+ * to `"src/web"`. Case-insensitive on win32 only, through `samePathCase` of
+ * `src/lib/worktree/docker-audit.js` — the one copy of that rule (#87 F5): NTFS
+ * itself is case-insensitive, so two spellings that differ only in case are
+ * the same directory there and nowhere else.
+ *
+ * @param {string} root - Project root the cwd is relative to
+ * @param {string|null|undefined} cwd
+ * @returns {string}
+ */
+function normCwd(root, cwd) {
+  return samePathCase(resolve(root, String(cwd ?? '.')).replace(/\\/g, '/'));
+}
+
 /**
  * Check which required Claude Code plugins are installed.
  * @param {Object} pluginsData - The `plugins` object from installed_plugins.json
@@ -402,6 +421,37 @@ async function doctorFullCommand(frameworkRoot) {
         broken.length > 0
           ? broken.map((n) => n.reason ?? `invalid-test-node: ${n.id}`).join('; ')
           : '');
+
+      // #87 PR B: a vitest/jest package.json declared tests[] never mentions is
+      // exactly the shape F30 exploited — a real suite sitting outside the gate.
+      // WARN-only, never ✗: the fail-closed barrier is `verify`, this just informs.
+      // Compared by RESOLVED path, not raw string: "./src/web", "src/web/" and
+      // (win32) "src\\web" all address the same node as "src/web" and must not
+      // produce a spurious warning just because the spelling differs.
+      const declaredCwds = new Set(declared.map((n) => normCwd(frameworkRoot, n.cwd)));
+      const uncoveredPkgs = discoverFrontendPackages(frameworkRoot, testsConfig)
+        .filter((pkg) => !declaredCwds.has(normCwd(frameworkRoot, pkg.cwd)));
+      if (uncoveredPkgs.length > 0) {
+        check(
+          `config tests[] cobre package.json de frontend — sem nó: ${uncoveredPkgs.map((p) => `${p.cwd} (${p.runner})`).join(', ')}`,
+          false, true,
+        );
+      }
+    } else if (typeof testsConfig?.project?.testCommand === 'string' && testsConfig.project.testCommand.trim()) {
+      // Mesma checagem, para o caso testCommand-only: o comando é OPACO (uma
+      // string de shell), então cobertura aqui é só "o comando MENCIONA o
+      // runner do package.json" — não confirmar isso seria ruído para quem já
+      // roda vitest por dentro do testCommand.
+      const testCommand = testsConfig.project.testCommand;
+      const uncoveredPkgs = discoverFrontendPackages(frameworkRoot, testsConfig)
+        .filter((pkg) => !testCommand.includes(pkg.runner));
+      if (uncoveredPkgs.length > 0) {
+        console.log(chalk.cyan('\n  .morph/config/config.json — project.testCommand'));
+        check(
+          `config testCommand cobre package.json de frontend — sem nó: ${uncoveredPkgs.map((p) => `${p.cwd} (${p.runner})`).join(', ')}`,
+          false, true,
+        );
+      }
     }
   }
 
@@ -688,7 +738,10 @@ const PR_STALE_DAYS = 7;
  *                         revisão que nenhuma superfície local reivindica.
  *   pr-merged-not-landed — o PR mergeou mas `archive/{f}` não está aqui. O
  *                         archive viaja no diff do PR, então ou falta um
- *                         `git pull`, ou ele não estava no diff.
+ *                         `git pull`, ou ele não estava no diff. Branch
+ *                         `morph/*` cujo diff nunca tocou
+ *                         `.morph/{features,archive}/{f}/` não conta: o nome
+ *                         não prova feature (ver pr-files.js).
  *
  * Offline-safe: índice `null` devolve `null`, NUNCA lista vazia — lista vazia
  * afirmaria "perguntei e não achei nada", que é diferente de "não pude
@@ -718,6 +771,9 @@ function auditPullRequests(root) {
     if (!m || pr.state !== 'MERGED') continue;
     const feature = m[1];
     if (existsSync(join(root, '.morph', 'archive', feature))) continue;
+    // Só `false` (diff lido, sem a feature) cala o aviso; `null` — não pude
+    // ler o diff — o mantém, ou um `git pull` realmente faltando ficaria mudo.
+    if (prCarriesFeature(root, pr.number, feature) === false) continue;
     issues.push({
       feature,
       type: 'pr-merged-not-landed',

package/src/commands/project/worktree.js

@@ -1303,19 +1303,46 @@ function classifyRemovalError(stderr) {
  * @returns {Promise<{ removed: boolean, failure: {kind: string, detail: string}|null }>}
  */
 async function attemptWorktreeRemoval(worktreePath, root) {
-  let lastStderr = '';
+  const stderrs = [];
   for (let round = 0; round < 2; round++) {
     for (const args of [['worktree', 'remove', worktreePath], ['worktree', 'remove', '--force', worktreePath]]) {
       try {
         execFileSync('git', args, { cwd: root, stdio: 'pipe' });
         return { removed: true, failure: null };
       } catch (err) {
-        lastStderr = err?.stderr ? String(err.stderr) : (err?.message || '');
+        stderrs.push(err?.stderr ? String(err.stderr) : (err?.message || ''));
       }
     }
     if (round === 0) await new Promise((r) => setTimeout(r, 200));
   }
-  return { removed: false, failure: classifyRemovalError(lastStderr) };
+  return { removed: false, failure: pickRemovalFailure(stderrs) };
+}
+
+/**
+ * Which of the attempts' errors the user should read.
+ *
+ * The LAST one used to win, and it was the worst choice: when the first
+ * `git worktree remove` deletes the content and de-registers the tree but the
+ * directory itself is held (a session with its cwd there), every later attempt
+ * answers only `'…' is not a working tree` — an echo that hid the real cause
+ * (the lock) and made the hint send the user to a command that can no longer
+ * reach the tree. A lock anywhere wins; otherwise the first REAL error wins.
+ *
+ * @param {string[]} stderrs - one entry per failed attempt, in order
+ * @returns {{ kind: string, detail: string, alreadyDeregistered: boolean }}
+ */
+export function pickRemovalFailure(stderrs) {
+  const list = (stderrs || []).map((s) => String(s || '')).filter((s) => s.trim());
+  const notAWorktree = (s) => /is not a working tree/i.test(s);
+  const classified = list.map(classifyRemovalError);
+  const firstReal = list.findIndex((s) => !notAWorktree(s));
+  const chosen = classified.find((c) => c.kind === 'in-use')
+    || (firstReal >= 0 ? classified[firstReal] : classified[classified.length - 1])
+    || { kind: 'unknown', detail: '' };
+  // Git dropped the registration BETWEEN attempts: a failure for another reason
+  // followed by "is not a working tree". Only the directory is left.
+  const alreadyDeregistered = firstReal >= 0 && list.slice(firstReal + 1).some(notAWorktree);
+  return { ...chosen, alreadyDeregistered };
 }
 
 /**
@@ -1451,6 +1478,10 @@ export async function teardownWorktree(worktreePath, { root, feature, branch, op
           ? `worktree NÃO removido: o backup falhou. Estes arquivos existem só neste worktree e a remoção os apagaria: ${sample(ignored.shieldable)}. `
             + (ignored.replicable.length ? `(${sample(ignored.replicable)} são idênticos aos da raiz — esses não são o problema.) ` : '')
             + `O backup iria para \`${backupDir}\`; libere espaço/permissão ali e rode \`${removeCmd}\`, ou copie os arquivos você mesmo e rode \`${removeCmd} --discard-ignored\` para pular o backup`
+          : removalFailure?.alreadyDeregistered
+            ? `worktree NÃO removido por inteiro: a 1ª tentativa do git já apagou o conteúdo e desregistrou o worktree, mas o diretório "${worktreePath}" ficou`
+              + (removalFailure.kind === 'in-use' ? ' — EM USO por outro processo (instância do Claude Code, VS Code, dev server ou terminal com cwd nele)' : '')
+              + `${removalFailure.detail ? ` (${removalFailure.detail})` : ''}. \`${removeCmd}\` não o alcança mais — o git não o conhece. Feche o que o usa, confira que está vazio e sem junction, e apague só o diretório (sem recursão)`
           : removalFailure?.kind === 'in-use'
             ? `worktree NÃO removido: o diretório está EM USO por outro processo (instância do Claude Code, VS Code, dev server ou terminal com cwd em "${worktreePath}"). A infra compartilhada ficou DESMONTADA de propósito — feche o que está usando o diretório e rode \`${removeCmd}\`. Se preferir continuar trabalhando nele, restaure a infra com \`morph-spec worktree link --all\``
             : `worktree NÃO removido: a remoção falhou${removalFailure?.detail ? ` (${removalFailure.detail})` : ''}. A infra compartilhada ficou DESMONTADA de propósito — rode \`${removeCmd}\` para tentar de novo, ou \`morph-spec worktree link --all\` para voltar a trabalhar nele`;
@@ -1497,6 +1528,30 @@ export function cwdIsInsideWorktree(cwd, worktreePath) {
   return cwdNorm === wtNorm || cwdNorm.startsWith(`${wtNorm}/`);
 }
 
+/**
+ * Is the Claude Code SESSION that ran this command anchored in the worktree?
+ *
+ * Not the same question as `cwdIsInsideWorktree`. That one sees the PROCESS
+ * cwd, and `cd <root> && morph-spec finish` answers it "no" — while the session
+ * stays anchored in the worktree: its CLAUDE_PROJECT_DIR is the worktree, and
+ * every project hook runs `node "$CLAUDE_PROJECT_DIR/.morph/framework/hooks/…"`.
+ * Tearing that worktree down unlinks the junction those hooks resolve through,
+ * and the directory stays held by the session — so the removal fails half-way
+ * and every hook of every later tool call dies with MODULE_NOT_FOUND.
+ *
+ * The anchor arrives as MORPH_SESSION_PROJECT_DIR, exported by the
+ * `worktree-env-inject` PreToolUse hook (the Bash tool does not export
+ * CLAUDE_PROJECT_DIR itself); CLAUDE_PROJECT_DIR is honoured when present.
+ *
+ * @param {string} worktreePath
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+export function sessionAnchoredInWorktree(worktreePath, env = process.env) {
+  const anchor = env.MORPH_SESSION_PROJECT_DIR || env.CLAUDE_PROJECT_DIR || '';
+  return anchor ? cwdIsInsideWorktree(anchor, worktreePath) : false;
+}
+
 // ── remove ───────────────────────────────────────────────────────────────
 
 /**
@@ -1580,6 +1635,16 @@ export async function worktreeRemoveCommand(featureArg, options = {}) {
       hint: `saia do worktree antes de removê-lo — o processo trava o próprio diretório de trabalho. Rode de novo a partir de "${root}"` }, 1);
   }
 
+  // The SESSION's anchor, not the process cwd (see sessionAnchoredInWorktree):
+  // refusing here, before the junctions are touched, leaves the session's hooks
+  // intact. Unlike finish there is nothing else to do in this command, so the
+  // refusal IS the deferral.
+  if (sessionAnchoredInWorktree(worktreePath)) {
+    const again = featureAddressable && feature ? `morph-spec worktree remove ${feature}` : `morph-spec worktree remove --target "${worktreePath}"`;
+    emit({ removed: false, error: 'session-anchored-in-worktree', path: worktreePath, root,
+      hint: `a sessão do Claude Code que rodou este comando está ancorada neste worktree — os hooks dela resolvem \`.morph/framework\` por ele, e desmontá-lo quebraria todo tool call seguinte (e o diretório seguiria travado pela sessão). Feche esta sessão e rode \`${again}\` de uma sessão aberta em "${root}"` }, 1);
+  }
+
   // `--if-clean` — the WorktreeRemove hook's contract: Claude Code fires it
   // when it believes the tree is disposable, but "disposable" is the user's
   // call, not the harness's. Any uncommitted or untracked file refuses the

package/src/commands/state/finish.js

@@ -11,6 +11,7 @@ import {
   buildBranchName,
   branchExists,
   cwdIsInsideWorktree,
+  sessionAnchoredInWorktree,
   classifyIgnoredLeftovers,
 } from '../project/worktree.js';
 import { detectDefaultBranch, hasOriginRemote } from '../../lib/git/default-branch.js';
@@ -587,6 +588,14 @@ export function finishPreflight({ feature, root, worktreePath, cwd, mode, branch
 
     const inside = cwdIsInsideWorktree(cwd, worktreePath);
     out.cwdInsideWorktree = inside;
+    if (!inside && sessionAnchoredInWorktree(worktreePath)) {
+      out.teardownDeferred = 'session-anchored';
+      warnings.push(
+        `a sessão do Claude Code está ancorada em ${out.worktreePath}: o finish vai integrar, mas ADIAR o desmonte `
+        + '(desmontar agora quebraria os hooks desta sessão). Depois, feche a sessão e rode '
+        + `\`morph-spec worktree remove ${feature}\` de uma sessão aberta na raiz`,
+      );
+    }
     if (inside) {
       warnings.push(
         `você está DENTRO de ${out.worktreePath}: o finish de verdade recusa aqui, antes de qualquer mutação `
@@ -705,9 +714,16 @@ async function integrateMerge({ emit, root, feature, expectedBranch, defaultBran
     // mount and the port block all belong to that tree, and once it is gone
     // there is nothing left to address the containers by.
     const e2e = reclaimStack(feature, { root, worktreePath, options });
-    const teardown = await teardownWorktree(worktreePath, { root, feature, branch: expectedBranch, options, deleteBranch: true });
+    // The session that ran this finish may be ANCHORED in the worktree (its
+    // hooks resolve `.morph/framework` through it): tearing it down now would
+    // kill every hook of that session. The integration is done; only the
+    // teardown waits (see sessionAnchoredInWorktree).
+    const deferred = sessionAnchoredInWorktree(worktreePath);
+    const teardown = deferred
+      ? null
+      : await teardownWorktree(worktreePath, { root, feature, branch: expectedBranch, options, deleteBranch: true });
     dropFromRootIndex(root, feature);
-    emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish, worktreePath, teardown, shedBackup }), ...ucNote, e2e });
+    emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish, worktreePath, teardown, shedBackup, deferred }), ...ucNote, e2e });
     process.exit(0);
   }
 
@@ -787,6 +803,7 @@ async function integratePr({ emit, root, feature, expectedBranch, defaultBranch,
   const e2e = isWorktreeFlow
     ? (options.keep ? null : reclaimStack(feature, { root, worktreePath, options }))
     : reclaimStack(feature, { root, worktreePath: null, options });
+  let teardownDeferred = false;
   if (isWorktreeFlow && !options.keep) {
     // Shed the transient root-side scaffold BEFORE teardown — exactly as --merge
     // does. The real `create --worktree` leaves the root's .morph/features/{f}
@@ -796,7 +813,13 @@ async function integratePr({ emit, root, feature, expectedBranch, defaultBranch,
     // the feature in BOTH features/ and archive/ at once — active and archived.
     // The branch/PR owns the authoritative copy; the root scaffold is transient.
     shedBackup = shedRootFeatureScope(root, feature).shedBackup;
-    teardown = await teardownWorktree(worktreePath, { root, feature, branch: expectedBranch, options, deleteBranch: false });
+    // Same deferral as --merge: never tear down the worktree the running
+    // session is anchored in (see sessionAnchoredInWorktree).
+    if (sessionAnchoredInWorktree(worktreePath)) {
+      teardownDeferred = true;
+    } else {
+      teardown = await teardownWorktree(worktreePath, { root, feature, branch: expectedBranch, options, deleteBranch: false });
+    }
     // The shed removed the root's features/{f} scaffold from disk, but runArchive
     // dropped the feature only from the WORKTREE's index (its cwd). Drop it from
     // the ROOT index too — exactly as --merge does — or `doctor`'s lifecycle audit
@@ -835,7 +858,13 @@ async function integratePr({ emit, root, feature, expectedBranch, defaultBranch,
             worktree: { path: worktreePath, branch: expectedBranch },
             hint: `worktree preservado em ${worktreePath} — feche depois com \`morph-spec worktree remove ${feature}\`.`,
           }
-          : {}),
+          : teardownDeferred
+            ? {
+              teardownDeferred: 'session-anchored',
+              worktree: { path: worktreePath, branch: expectedBranch },
+              hint: deferredTeardownHint(feature, worktreePath),
+            }
+            : {}),
       }),
   };
   emit(out);
@@ -955,7 +984,7 @@ function mergeNextStep(publish) {
  *   publish: ReturnType<typeof publicationState>, worktreePath?: string|null,
  *   teardown?: object|null, shedBackup?: string|null, kept?: boolean }} args
  */
-function mergeOutput({ feature, branch, defaultBranch, publish, worktreePath = null, teardown = null, shedBackup = null, kept = false }) {
+function mergeOutput({ feature, branch, defaultBranch, publish, worktreePath = null, teardown = null, shedBackup = null, kept = false, deferred = false }) {
   return {
     finished: true,
     integrated: true,
@@ -964,6 +993,7 @@ function mergeOutput({ feature, branch, defaultBranch, publish, worktreePath = n
     merged: branch,
     into: defaultBranch,
     ...(kept ? { kept: true } : {}),
+    ...(deferred ? { teardownDeferred: 'session-anchored', worktree: { path: worktreePath, branch }, hint: deferredTeardownHint(feature, worktreePath, { deleteBranch: true }) } : {}),
     worktreeRemoved: teardown ? teardown.worktreeRemoved : false,
     nextStep: mergeNextStep(publish),
     publish,
@@ -981,6 +1011,19 @@ function mergeOutput({ feature, branch, defaultBranch, publish, worktreePath = n
   };
 }
 
+/**
+ * Hint for a teardown deferred because the session is anchored in the worktree
+ * (both modes). Names the safe command, never `git worktree remove`. `--merge`
+ * would have deleted the (now integrated) branch, so its hint carries
+ * `--delete-branch`; `--pr` keeps the branch — the PR needs it.
+ */
+function deferredTeardownHint(feature, worktreePath, { deleteBranch = false } = {}) {
+  return `worktree mantido em ${worktreePath}: a sessão do Claude Code que rodou o finish está ancorada nele, `
+    + 'e desmontá-lo agora quebraria todos os hooks dela (eles resolvem `.morph/framework` por ele) — '
+    + `o diretório, aliás, seguiria travado pela sessão. Feche esta sessão e rode \`morph-spec worktree remove ${feature}${deleteBranch ? ' --delete-branch' : ''}\` `
+    + 'de uma sessão aberta na raiz do repo.';
+}
+
 /** Shared teardown reporting for both modes (kept identical to the old finish). */
 function teardownExtras(teardown, worktreePath, branch, deleteBranch) {
   const out = {};

package/src/commands/tasks/dag.js

@@ -5,6 +5,7 @@ import { parseTasksJsonLenient } from '../../lib/tasks/tasks-json-parser.js';
 import { planDispatch } from '../../lib/tasks/dispatch-planner.js';
 import { renderMermaidFlowchart } from '../../lib/tasks/mermaid-renderer.js';
 import { checkUseCases } from '../../lib/specs/usecase-check.js';
+import { checkArtifactCriteria } from '../../lib/specs/done-criteria-check.js';
 
 /**
  * `morph-spec dag <feature>` — analyze the tasks.json DAG and print the
@@ -51,10 +52,16 @@ export async function dagCommand(featureName, options = {}) {
     // against a plan that points at a use case nobody can read.
     const ucCheck = checkUseCases(data, join(planDir, 'usecases'));
 
+    // Artifact-postcondition warning (issue #87). Lexical, not wiring — it
+    // runs over ALL tasks even when the feature has no use cases at all
+    // (checkUseCases short-circuits above in that case), because a task's
+    // own doneCriteria can describe an artifact with no use case in sight.
+    const artifactCriteria = checkArtifactCriteria(data, join(planDir, 'usecases'));
+
     const plan = planDispatch(data);
 
     if (options.json) {
-      console.log(JSON.stringify({ ...plan, useCases: ucCheck }, null, 2));
+      console.log(JSON.stringify({ ...plan, useCases: ucCheck, artifactCriteria }, null, 2));
       if (ucCheck.errors.length) process.exit(1);
       return;
     }
@@ -71,6 +78,11 @@ export async function dagCommand(featureName, options = {}) {
       console.error(chalk.yellow(`\n⚠ Use cases — ${plural(ucCheck.warnings.length, 'aviso', 'avisos')}`));
       for (const w of ucCheck.warnings) console.error(chalk.yellow(`  ${w}`));
     }
+    if (artifactCriteria.warnings.length) {
+      console.error(chalk.yellow(`\n⚠ Critérios de artefato — ${plural(artifactCriteria.warnings.length, 'aviso', 'avisos')}`));
+      for (const w of artifactCriteria.warnings) console.error(chalk.yellow(`  ${w}`));
+      console.error(chalk.gray('  Teste que lê texto de arquivo não prova comportamento (morph-plan §2, "Por que artefato").'));
+    }
 
     console.log(chalk.bold(`\n📊 DAG — ${featureName}`));
     console.log('━'.repeat(60));

package/src/commands/validation/verify.js

@@ -1,9 +1,8 @@
 import chalk from 'chalk';
-import { existsSync, readFileSync } from 'fs';
+import { readFileSync } from 'fs';
 import { resolve, join } from 'path';
 import { getFeature, updateFeature } from '../../core/state/state-manager.js';
-import { getAbsoluteOutputPath } from '../../core/paths/output-schema.js';
-import { runVerify, VerifyUsageError } from '../../lib/validators/verify-runner.js';
+import { runVerify, readTask, VerifyUsageError } from '../../lib/validators/verify-runner.js';
 import { resolvePrimaryRoot } from '../project/worktree.js';
 import { getHeadSha } from '../../lib/git/default-branch.js';
 import { EVAL_RUNNER } from '../../lib/tasks/eval-node.js';
@@ -15,6 +14,28 @@ function statusIcon(status) {
   return chalk.gray('–');
 }
 
+/**
+ * One line per test run naming what the task-scope recorte did to it (#87):
+ * narrowed (how many selectors, from how many test files), whole, out of scope
+ * or full, each with its reason. A green `tests` line alone cannot say that the
+ * task ran 12 tests instead of 3.082. Feature-scope runs carry no selection and
+ * print nothing extra; `feedback[]` is untouched either way.
+ *
+ * @param {Array<{id: string, selection: object|null}>} [runs]
+ * @returns {string[]}
+ */
+function selectionLines(runs = []) {
+  return runs
+    .filter((run) => run.selection)
+    .map((run) => {
+      const { mode, reason, selectors = [], files = [] } = run.selection;
+      const detail = mode === 'narrowed'
+        ? `${selectors.length} selector(s) from ${files.length} test file(s)`
+        : (reason ?? '');
+      return chalk.gray(`      ↳ ${run.id.padEnd(10)} ${mode.padEnd(12)} ${detail}`);
+    });
+}
+
 /**
  * Human-readable rendering of a runVerify() result — mirrors the
  * ✓/✗-per-node + feedback-list style of formatScoreBreakdown() in
@@ -51,6 +72,7 @@ function formatVerifyResult(result) {
       detail = `${node.durationMs}ms`;
     }
     lines.push(`  ${icon} ${name.padEnd(11)} ${node.status.padEnd(5)} ${chalk.gray(detail)}`);
+    if (name === 'tests') lines.push(...selectionLines(node.runs));
   }
 
   if (result.feedback.length > 0) {
@@ -166,17 +188,6 @@ function evalsStatusOf(result) {
   return 'skip';
 }
 
-/** Read tasks.json's task list for a feature; [] if missing/corrupt. */
-function readTasks(featureName) {
-  try {
-    const tasksPath = getAbsoluteOutputPath(process.cwd(), featureName, 'tasks');
-    if (!existsSync(tasksPath)) return [];
-    return JSON.parse(readFileSync(tasksPath, 'utf8')).tasks || [];
-  } catch {
-    return [];
-  }
-}
-
 /**
  * `morph-spec verify <feature> [task]` — the deterministic code-before-judge
  * gate: build + tests + validators, BEFORE the LLM eval. See verify-runner.js
@@ -194,7 +205,8 @@ function readTasks(featureName) {
  *     `morph-spec score` gives for the same situation);
  *   - `--filter` that matches no declared node (a filtered-to-empty run is
  *     green and proves nothing);
- *   - `--record-baseline` with nowhere to write (no `config.json`);
+ *   - `--record-baseline` with nowhere to write (no `config.json`), or with a
+ *     task id (a recorte de task is never a fleet baseline, #87);
  *   - `--linux` without Docker.
  * The last three arrive as `VerifyUsageError` from the runner.
  */
@@ -210,9 +222,10 @@ export async function verifyCommand(featureName, taskId, options = {}) {
     process.exit(2);
   }
 
+  // The runner's own reader (one reader of tasks.json for verify, #87): null
+  // means tasks.json or the task is missing, and both are this usage error.
   if (taskId) {
-    const tasks = readTasks(featureName);
-    if (!tasks.some((t) => t.id === taskId)) {
+    if (!readTask(process.cwd(), featureName, taskId)) {
       console.error(chalk.red(`\n❌ Task "${taskId}" not found in tasks.json for feature "${featureName}"\n`));
       process.exit(2);
     }
@@ -232,6 +245,9 @@ export async function verifyCommand(featureName, taskId, options = {}) {
       refreshCache: options.refreshCache,
       linux: options.linux,
       linuxImage: options.linuxImage,
+      // Task scope: switch the recorte off (#87). At feature scope nothing is
+      // ever narrowed, so the flag is a documented no-op there, not an error.
+      full: options.full,
     });
   } catch (err) {
     // A wrong invocation is exit 2, like an unknown feature or task — never a
@@ -249,9 +265,22 @@ export async function verifyCommand(featureName, taskId, options = {}) {
   // the suite in order to write `expectedCount`. Persisting a `verification`
   // stamp from it would let a maintenance run stand in for the proof a gate
   // asks for — the same class of confusion as a hand-typed baseline.
+  //
+  // `--filter` at FEATURE scope is the other side of the same hole (#87): the
+  // run is narrowed to a subset of nodes, but the stamp it would write carries
+  // `scope: 'feature'` — the one scope risk-detector.js trusts unconditionally.
+  // A partial run must not stand in for the proof a gate asks for, same as
+  // `--record-baseline` above. Task-scope `--filter` is unaffected: that stamp
+  // already says `scope: 'task:{id}'`, and `taskVerifications` never claimed
+  // to cover more than the task in the first place. Checked AFTER `--no-persist`
+  // (via the `!options.noPersist` guard) so an explicit `--no-persist` keeps its
+  // own reason instead of being reported as 'filtered' — the flags are both
+  // "don't write", but decidePersistence() already owns the former's reason.
   const { persist, reason } = options.recordBaseline
     ? { persist: false, reason: 'record-baseline' }
-    : decidePersistence({ cwd: process.cwd(), featureName, noPersist: options.noPersist });
+    : (!options.noPersist && !taskId && options.filter)
+      ? { persist: false, reason: 'filtered' }
+      : decidePersistence({ cwd: process.cwd(), featureName, noPersist: options.noPersist });
 
   let compact = null;
   if (persist) {

package/src/core/paths/output-schema.js

@@ -72,6 +72,13 @@ export const OUTPUT_SCHEMA = {
 
   // 3-implement/
   recap:          { filename: 'recap.md',              phaseDir: '3-implement', phase: 'implement', protected: false },
+  // N files, one per task whose doneCriteria judges what a MODEL answers
+  // (morph-plan §5). Runtime evidence: input, model, output, verdict — pointing
+  // at the `runner: "evals"` node when the stack declares one. CONDITIONAL by
+  // construction: never in phases.json requiredOutputs. Readers: morph-review
+  // dispatch prompt, proof rubric eval-de-modelo, test-coverage Q7.
+  evidencias:     { dirname: 'evidencias', filenamePattern: '^T\\d+\\.md$', displayFilename: '{taskId}.md',
+                    phaseDir: '3-implement', phase: 'implement', protected: false, multi: true },
 
   // 4-review/
   reviewReport:   { filename: 'review-report.md',      phaseDir: '4-review',    phase: 'review',    protected: false },