@polymorphism-tech/morph-spec 9.3.0 → 9.5.0

package/framework/hooks/claude-code/core/enforce-phase-writes.js

@@ -18,7 +18,6 @@ const PHASE_DIR_ENTRY_GATE = {
 
 const ALWAYS_WRITABLE_DIR = '2-plan';
 import { blockResult, runStandalone } from '../../shared/hook-response.js';
-import { logHookActivity } from '../../shared/activity-logger.js';
 import { getFilePath, resolveMorphRoot, resolveTargetPath } from '../../shared/payload-utils.js';
 
 export async function run(payload) {
@@ -57,7 +56,6 @@ export async function run(payload) {
     if (targetDir !== allowedDir) {
       const absolutePath = resolveTargetPath(filePath, root);
       if (existsSync(absolutePath)) {
-        logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
         return null;
       }
 
@@ -69,11 +67,8 @@ export async function run(payload) {
           && existsSync(resolveTargetPath(`.morph/features/${featureName}/1-design`, root));
 
         if (!tookDesignBranch || isGateApproved(featureName, 'uiux', root)) {
-          logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
           return null;
         }
-
-        logHookActivity('enforce-phase-writes', 'PreToolUse', 'blocked');
         return blockResult(
           `MORPH-SPEC: Writing to '${targetDir}/' is not allowed yet.\n` +
           `This feature entered the uiux branch (1-design/ exists) and the 'uiux' gate is still pending.\n\n` +
@@ -87,7 +82,6 @@ export async function run(payload) {
       const treeNote = root !== process.cwd().replace(/\\/g, '/')
         ? `\n(phase read from the tree that owns the file: ${root})`
         : '';
-      logHookActivity('enforce-phase-writes', 'PreToolUse', 'blocked');
       return blockResult(
         `MORPH-SPEC: Writing to '${targetDir}/' is not allowed during ${phaseLabel} phase.\n` +
         `Current phase '${phase}' only permits writes to '${allowedDir}/'.${treeNote}\n\n` +
@@ -96,8 +90,6 @@ export async function run(payload) {
         `(run it in that tree — the gate is recorded in its own feature.json).`
       );
     }
-
-    logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
     return null;
   } catch {
     return null;

package/framework/hooks/claude-code/core/gate-guard.js

@@ -4,7 +4,6 @@
 import { loadState, stateExists, getActiveFeature } from '../../shared/state-reader.js';
 import { contextResult, runStandalone } from '../../shared/hook-response.js';
 import { gateFromQuestion } from '../../shared/gate-question.js';
-import { logHookActivity } from '../../shared/activity-logger.js';
 import { resolveMorphRoot, resolveTargetPath } from '../../shared/payload-utils.js';
 import { locateFeatureForQuestion } from '../../shared/feature-locator.js';
 
@@ -61,7 +60,6 @@ function checkAskUserQuestion(input, sessionRoot) {
     const decision = getDecision(state, feature, gate);
     if (!decision) continue;
     if (decision.pause === false) {
-      logHookActivity('gate-guard', 'PostToolUse', 'divergent', cwd);
       return contextResult(
         `⚠️ [morph-spec] GATE OVER-PAUSE — você apresentou o Gate "${gate}" via AskUserQuestion, ` +
         `mas a decisão registrada em state.json (gateDecisions.${gate}) era pause:false ` +
@@ -72,7 +70,6 @@ function checkAskUserQuestion(input, sessionRoot) {
         'PostToolUse'
       );
     }
-    logHookActivity('gate-guard', 'PostToolUse', 'coherent', cwd);
     return null;
   }
   return null;
@@ -94,8 +91,6 @@ function checkStateEdit(input, sessionRoot) {
   if (!state) return null;
   const feature = featureFromStatePath(filePath) || getActiveFeature(cwd)?.name;
   if (!feature) return null;
-
-  let checked = false;
   const gates = state.features?.[feature]?.approvalGates ?? {};
   for (const gate of ['plan', 'uiux', 'review']) {
     const g = gates[gate];
@@ -104,7 +99,6 @@ function checkStateEdit(input, sessionRoot) {
     const decision = getDecision(state, feature, gate);
     if (!decision) continue;
     if (decision.pause === true) {
-      logHookActivity('gate-guard', 'PostToolUse', 'divergent', cwd);
       return contextResult(
         `⚠️ [morph-spec] GATE SKIPPED PAUSE — o Gate "${gate}" foi marcado approvedBy:"auto", ` +
         `mas a decisão registrada (gateDecisions.${gate}) era pause:true ` +
@@ -114,9 +108,7 @@ function checkStateEdit(input, sessionRoot) {
         'PostToolUse'
       );
     }
-    checked = true;
   }
-  if (checked) logHookActivity('gate-guard', 'PostToolUse', 'coherent', cwd);
   return null;
 }
 

package/framework/hooks/claude-code/core/loop-detect.js

@@ -5,7 +5,6 @@ import { join } from 'path';
 import { stateExists } from '../../shared/state-reader.js';
 import { contextResult, runStandalone } from '../../shared/hook-response.js';
 import { getCommandSignature } from '../../shared/payload-utils.js';
-import { logEvent } from '../../shared/activity-logger.js';
 
 const MAX_BUFFER = 15;
 const LOOP_WINDOW = 8;
@@ -60,8 +59,6 @@ export async function run(payload) {
 
     writeFileSync(cooldownPath, JSON.stringify({ lastDetected: new Date().toISOString() }), 'utf-8');
 
-    logEvent('loop_detected', { signatures: uniqueSigs.size }, process.cwd());
-
     const sigList = [...uniqueSigs].join(', ');
     return contextResult(
       `⚠️ [morph-spec] LOOP DETECTED — the last ${LOOP_WINDOW} actions repeat only ${uniqueSigs.size} pattern(s): ${sigList}\n\n` +

package/framework/hooks/claude-code/core/pre-bash-denylist.js

@@ -54,8 +54,9 @@ export async function run(payload) {
     }
 
     for (const rule of denylist.executableArgs || []) {
+      if (rule.subagentOnly && !payload.agent_id) continue;
       if (matchesExecutableRule(command, rule)) {
-        const shown = [rule.executable, ...(rule.flags || []).map((group) => group[0]), rule.args[0]].join(' ');
+        const shown = rule.display ?? [rule.executable, ...(rule.flags || []).map((group) => group[0]), rule.args[0]].join(' ');
         return blockResult(`Comando bloqueado pela denylist: \`${shown}\` ${rule.reason}.`);
       }
     }

package/framework/hooks/claude-code/core/protect-spec-files.js

@@ -9,7 +9,6 @@ import {
   PROTECTED_SPEC_FILES
 } from '../../shared/phase-utils.js';
 import { blockResult, runStandalone } from '../../shared/hook-response.js';
-import { logHookActivity } from '../../shared/activity-logger.js';
 import { getFilePath, getToolName, resolveMorphRoot, resolveTargetPath } from '../../shared/payload-utils.js';
 import { ERRATA_HEADING, errataViolation } from '../../shared/errata.js';
 
@@ -57,7 +56,6 @@ export async function run(payload) {
     // Generated only by the CLI: a hand-written one would carry checks the parser never judged.
     // Decided before the creation carve-out, since chore/hotfix are born with the plan gate stamped.
     if (filename === CHECKS_FILE) {
-      logHookActivity('protect-spec-files', 'PreToolUse', 'blocked');
       return blockResult(
         `MORPH-SPEC: '${CHECKS_FILE}' is generated — never written by hand.\n` +
         `Edit 2-plan/plan.md and run \`morph-spec plan-check ${featureName}\`: it parses the plan and writes ${CHECKS_FILE}.\n` +
@@ -67,7 +65,6 @@ export async function run(payload) {
     }
 
     if (!isGateApproved(featureName, requiredGate, root)) {
-      logHookActivity('protect-spec-files', 'PreToolUse', 'ok');
       return null;
     }
 
@@ -76,7 +73,6 @@ export async function run(payload) {
     // A file not yet on disk is its CREATION (chore/hotfix are born with `plan` stamped), not an edit of a frozen spec.
     // The criterion is existence, never `approvedBy`: by signature, deleting a spec first would license rewriting it.
     if (!existsSync(absPath)) {
-      logHookActivity('protect-spec-files', 'PreToolUse', 'ok:absent');
       return null;
     }
 
@@ -90,11 +86,8 @@ export async function run(payload) {
     } catch {}
 
     if (errataCheck?.ok) {
-      logHookActivity('protect-spec-files', 'PreToolUse', 'ok');
       return null;
     }
-
-    logHookActivity('protect-spec-files', 'PreToolUse', 'blocked');
     return blockResult(
       `MORPH-SPEC: '${filename}' is locked — the '${requiredGate}' gate has been approved.\n` +
       `Editing an approved artifact breaks its contract.\n\n` +

package/framework/hooks/claude-code/core/validate-completion.js

@@ -7,7 +7,6 @@ import {
   stateExists, getActiveFeature, getMostRecentFeature, derivePhaseForFeature,
 } from '../../shared/state-reader.js';
 import { contextResult, runStandalone } from '../../shared/hook-response.js';
-import { logHookActivity, logEvent } from '../../shared/activity-logger.js';
 import { appendTelemetryEvent } from '../../shared/telemetry-logger.js';
 import { readTranscriptUsage, usageDelta } from '../../shared/transcript-usage.js';
 import { sliceProgress, sliceReportPath, inspectReport } from '../../shared/slice-progress.js';
@@ -145,9 +144,6 @@ export async function run(payload) {
       'MORPH-SPEC:',
       ...warnings.map(w => `  ${w}`),
     ].join('\n');
-
-    logHookActivity('validate-completion', 'Stop', `warnings(${warnings.length})`);
-    logEvent('session_end', { feature: name, phase: currentPhase, warnings: warnings.length });
     return contextResult(message, 'Stop');
   } catch {
     return null;

package/framework/hooks/claude-code/core/worktree-context.js

@@ -13,7 +13,6 @@ import { sliceProgress } from '../../shared/slice-progress.js';
 import { collectNextSignals, decideNext, formatNext } from '../../shared/next-step.js';
 import { contextResult, runStandalone } from '../../shared/hook-response.js';
 import { acquireClaim, foreignClaim, claimAge } from '../../shared/claim-registry.js';
-import { rotateActivityLogIfLarge } from '../../shared/activity-logger.js';
 import { rotateEventsLogIfLarge } from '../../shared/telemetry-logger.js';
 import { kickGraphRefresh, seedFromPrimary } from '../../shared/graph-refresh.js';
 import { kickAgentReap } from '../../shared/agent-reap.js';
@@ -226,7 +225,6 @@ export async function run(payload) {
       return null;
     }
 
-    try { rotateActivityLogIfLarge(dir); } catch {}
     try { rotateEventsLogIfLarge(dir); } catch {}
     // Only the ROOT's graph is refreshed in background: a detached process holding a worktree directory made `finish` fail on win32.
     try { seedFromPrimary(dir); } catch {}

package/framework/hooks/claude-code/statusline.py

@@ -457,49 +457,13 @@ def get_active_features(cwd):
     return result
 
 
-def get_last_hook(cwd):
-    """Name of the most recent hook from .morph/logs/activity.jsonl.
-
-    activity-logger.js (R1.2) writes append-only JSONL now, one event per
-    line (`{"kind": "hook", ...}` or `{"kind": "event", ...}`), instead of a
-    single JSON doc rewritten whole on every call. The log can grow up to the
-    rotation threshold (2 MB, see ROTATE_THRESHOLD_BYTES in activity-logger.js)
-    between SessionStarts, and this function runs on every prompt redraw, so
-    only the trailing slice is read — never the whole file.
-
-    The age is deliberately not shown: activity-logger.js only records
-    HH:MM:SS, so any age computed from it is wrong across midnight.
-    """
-    try:
-        path = Path(cwd) / '.morph' / 'logs' / 'activity.jsonl'
-        size = path.stat().st_size
-        tail_bytes = 8192
-        with path.open('rb') as f:
-            if size > tail_bytes:
-                f.seek(-tail_bytes, 2)
-            tail = f.read().decode('utf-8', errors='ignore')
-        for line in reversed(tail.splitlines()):
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                obj = json.loads(line)
-            except Exception:
-                continue
-            if obj.get('kind') == 'hook':
-                return obj.get('name') or None
-        return None
-    except Exception:
-        return None
-
-
 # ── Line renderers ────────────────────────────────────────────────────────────
 
-def render_morph_line(feature, hook_name, columns):
+def render_morph_line(feature, columns):
     """Line 0 — the active MORPH feature.
 
     Goes through join_to_width like the status line: a feature name plus phase,
-    slice bar, gate and hook is the longest thing this script prints, and a
+    slice bar and gate is the longest thing this script prints, and a
     wrapping line 0 would defeat the whole point of the single-row layout.
     """
     parts = [(0, f"{CYAN}{BOLD}► {feature['name']}{R}")]
@@ -523,9 +487,6 @@ def render_morph_line(feature, hook_name, columns):
     if feature['pending']:
         parts.append((2, f"{RED}⛔ gate: {feature['pending']}{R}"))
 
-    if hook_name:
-        parts.append((4, f"{GRAY}🪝 {hook_name}{R}"))
-
     return join_to_width(parts, columns)
 
 
@@ -722,10 +683,8 @@ def main():
         # worktree. In the primary tree it resurrects stale feature names
         # during unrelated work, so there the status line is a single row.
         if get_worktree_label(payload, cwd):
-            hook_name = get_last_hook(cwd)
             for feature in get_active_features(cwd):
-                print(render_morph_line(feature, hook_name, columns))
-                hook_name = None  # annotate the first line only
+                print(render_morph_line(feature, columns))
 
         status_line = render_status_line(payload, cwd, settings, columns)
         if status_line:

package/framework/hooks/shared/build-check.js

@@ -4,6 +4,7 @@ import { join } from 'path';
 
 const DOTNET_BUILD_CMD = 'dotnet build --no-restore --nologo -v q';
 const TSC_BUILD_CMD = 'npx tsc --noEmit';
+const ESLINT_CONFIGS = ['eslint.config.mjs', 'eslint.config.js', 'eslint.config.cjs'];
 
 export function isDotnetStack(s) {
   return s.includes('dotnet') || s.includes('aspnet');
@@ -13,26 +14,9 @@ function isFrontendStack(s) {
   return s.includes('nextjs') || s.includes('node') || s.includes('react') || s.includes('vue');
 }
 
-// Single stack only: a compound stack resolves to `dotnet build` alone. Use
-// `getBuildSteps()` for those.
-export function getBuildCommand(stack, hasTsConfig = false) {
-  if (!stack) return null;
-  const s = stack.toLowerCase();
-
-  if (isDotnetStack(s)) {
-    return DOTNET_BUILD_CMD;
-  }
-
-  if (isFrontendStack(s) && hasTsConfig) {
-    return TSC_BUILD_CMD;
-  }
-
-  return null;
-}
-
 // A compound stack checks BOTH sides, each from its own directory.
 // `backendTarget` names the solution when the backend directory holds none.
-export function getBuildSteps(stack, { cwd, frontendPath, backendPath, backendTarget } = {}) {
+export function getBuildSteps(stack, { cwd, frontendPath, backendPath, backendTarget, lintFiles = [] } = {}) {
   if (!stack || !cwd) return [];
   const s = stack.toLowerCase();
   const steps = [];
@@ -51,6 +35,15 @@ export function getBuildSteps(stack, { cwd, frontendPath, backendPath, backendTa
     ) {
       steps.push({ command: TSC_BUILD_CMD, cwd: frontendDir });
     }
+    // Only the files the feature touched: legacy lint debt never turns a feature's verify red.
+    if (
+      lintFiles.length > 0 &&
+      ESLINT_CONFIGS.some((name) => existsSync(join(frontendDir, name))) &&
+      existsSync(join(frontendDir, 'node_modules', 'eslint'))
+    ) {
+      const files = lintFiles.map((file) => JSON.stringify(file)).join(' ');
+      steps.push({ command: `npx eslint --quiet --no-warn-ignored ${files}`, cwd: frontendDir });
+    }
   }
 
   return steps;
@@ -68,7 +61,7 @@ export function parseBuildResult(exitCode, output) {
 
 /** @returns {{ status: 'pass'|'fail'|'skip', output: string }} */
 export function runBuildCheck(cwd, stack, timeout = 30000, paths = {}) {
-  const steps = getBuildSteps(stack, { cwd, frontendPath: paths.frontendPath, backendPath: paths.backendPath, backendTarget: paths.backendTarget });
+  const steps = getBuildSteps(stack, { cwd, frontendPath: paths.frontendPath, backendPath: paths.backendPath, backendTarget: paths.backendTarget, lintFiles: paths.lintFiles });
   if (steps.length === 0) return { status: 'skip', output: '' };
 
   const failures = [];

package/framework/hooks/shared/command-tokens.js

@@ -108,6 +108,23 @@ function simpleCommands(head) {
   return commands.filter((c) => c.length > 0);
 }
 
+const GIT_EXECUTABLE = /(^|[\\/])git(\.exe)?$/i;
+const GIT_GLOBAL_WITH_VALUE = new Set(['-c', '-C', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env']);
+
+/** Each `git <sub> …` the command runs, global options skipped, one `{ sub, args }` per simple command. */
+export function gitInvocations(command) {
+  const invocations = [];
+  for (const tokens of simpleCommands(command)) {
+    const texts = tokens.map((t) => t.text);
+    const at = texts.findIndex((t) => GIT_EXECUTABLE.test(t));
+    if (at < 0) continue;
+    let j = at + 1;
+    while (j < texts.length && texts[j].startsWith('-')) j += GIT_GLOBAL_WITH_VALUE.has(texts[j]) ? 2 : 1;
+    if (j < texts.length) invocations.push({ sub: texts[j].toLowerCase(), args: texts.slice(j + 1) });
+  }
+  return invocations;
+}
+
 function positionals(args, takesValue) {
   const out = [];
   const values = [];

package/framework/hooks/shared/comment-rules.js

@@ -37,6 +37,15 @@ function isBanner(text) {
   return words === '' || /^[-=*#~_+]{3,}.*[-=*#~_+]{3,}$/.test(body);
 }
 
+const CODE_KEYWORD = /^(?:const|let|var|return|await|throw|if|else|for|foreach|while|switch|import|export|using|new|public|private|protected|internal|function|class)\b/;
+
+function isCommentedCode(text) {
+  const body = bodyOf(text);
+  if (/^[}\])]+[;,)]*$/.test(body)) return true;
+  if (/\{$/.test(body)) return CODE_KEYWORD.test(body) || /[=(]/.test(body);
+  return /;$/.test(body) && (CODE_KEYWORD.test(body) || /[=(.]/.test(body));
+}
+
 function isDocComment(text, isCs) {
   return isCs ? /^\/\/\/(?!\/)/.test(text) : /^\/\*\*(?!\*)/.test(text);
 }
@@ -103,7 +112,7 @@ function addedRegionLines(before, after) {
   return out;
 }
 
-/** @returns {Array<{ line: number, rule: 'process'|'banner'|'doc-comment'|'long-block', text: string }>} */
+/** @returns {Array<{ line: number, rule: 'process'|'banner'|'commented-code'|'doc-comment'|'long-block', text: string }>} */
 export function commentFindings({ file, before, after, docCommentsForbidden: docForbidden = false }) {
   const isCs = /\.cs$/i.test(file);
   const all = commentLines(after, file);
@@ -120,6 +129,7 @@ export function commentFindings({ file, before, after, docCommentsForbidden: doc
     if (ALLOWED.some((re) => re.test(text))) continue;
     if (citesProcess(text)) flag(line, 'process', text);
     else if (isBanner(text)) flag(line, 'banner', text);
+    else if (!isDocComment(text, isCs) && isCommentedCode(text)) flag(line, 'commented-code', text);
   }
   for (const { line, text } of addedRegionLines(before, after)) flag(line, 'banner', text);
 

package/framework/hooks/shared/hook-response.js

@@ -30,10 +30,6 @@ export function blockResult(reason) {
   return { decision: 'block', reason };
 }
 
-export function approveResult(context) {
-  return context ? { decision: 'approve', additionalContext: context } : null;
-}
-
 export function contextResult(text, eventName) {
   return { hookSpecificOutput: { hookEventName: eventName, additionalContext: text } };
 }

package/framework/hooks/shared/payload-utils.js

@@ -1,29 +1,5 @@
 import { createHash } from 'crypto';
-import { existsSync } from 'fs';
-import { dirname, join, isAbsolute } from 'path';
-
-// A sub-agent may edit inside its own worktree: the build root comes from the
-// file, not from the session's cwd.
-export function resolveRootForFile(filePath, fallbackCwd, markers = ['package.json']) {
-  try {
-    if (!filePath) return fallbackCwd;
-    let p = String(filePath).replace(/\\/g, '/');
-    if (!isAbsolute(p)) p = join(fallbackCwd, p);
-
-    let dir = dirname(p);
-    let prev = null;
-    while (dir && dir !== prev) {
-      for (const marker of markers) {
-        if (existsSync(join(dir, marker))) return dir;
-      }
-      prev = dir;
-      dir = dirname(dir);
-    }
-    return fallbackCwd;
-  } catch {
-    return fallbackCwd;
-  }
-}
+import { join, isAbsolute } from 'path';
 
 // State is resolved from the target PATH, never the session: a session in the
 // primary root may write a feature that lives in a worktree. `lastIndexOf` picks
@@ -58,16 +34,6 @@ export function getFilePath(payload) {
   return raw.replace(/\\/g, '/');
 }
 
-export function getContentToValidate(payload) {
-  const input = payload?.tool_input;
-  if (!input) return '';
-  return input.content || input.new_string || '';
-}
-
-export function isWriteOperation(payload) {
-  return typeof payload?.tool_input?.content === 'string';
-}
-
 export function getToolName(payload) {
   return payload?.tool_name || 'unknown';
 }

package/framework/hooks/shared/phase-utils.js

@@ -2,8 +2,6 @@
 // Source of truth: src/core/paths/output-schema.js
 // Regenerate with: node scripts/generate-refs.js
 
-export const PHASE_ORDER = ["plan","uiux","implement","review"];
-
 export const PHASE_DIRS = {
   plan: '2-plan',
   uiux: '1-design',
@@ -63,16 +61,6 @@ export function isFeaturePath(filePath) {
   return normalized.includes('.morph/features/');
 }
 
-export function isFrameworkPath(filePath) {
-  const normalized = filePath.replace(/\\/g, '/');
-  return normalized.includes('.morph/framework/');
-}
-
-export function isStatePath(filePath) {
-  const normalized = filePath.replace(/\\/g, '/');
-  return normalized.endsWith('.morph/state.json');
-}
-
 export function getBasename(filePath) {
   const normalized = filePath.replace(/\\/g, '/');
   return normalized.split('/').pop();

package/framework/hooks/shared/slice-progress.js

@@ -7,8 +7,6 @@ export const PARTIAL_MARKER = /^[\s#>*_]*PARCIAL\b/;
 /** `BLOQUEADO`: the slice waits on a decision only the human can make; re-dispatching it repeats the question. */
 export const BLOCKED_MARKER = /^[\s#>*_]*BLOQUEADO\b/;
 
-export const SLICE_STATUSES = ['pendente', 'parcial', 'bloqueado', 'feito'];
-
 export function checksPath(featureDir) {
   return join(featureDir, '2-plan', 'checks.json');
 }

package/framework/hooks/shared/state-reader.js

@@ -185,11 +185,6 @@ export function derivePhaseFrom(feature, hasArtifact) {
   return PHASE_INDEX[implied] > PHASE_INDEX[artifactPhase] ? implied : artifactPhase;
 }
 
-export function gateImpliedPhase(featureName, projectPath) {
-  const designDir = join(projectPath || process.cwd(), '.morph/features', featureName, DESIGN_DIR);
-  return gateImpliedPhaseFrom(getFeature(featureName, projectPath), existsSync(designDir));
-}
-
 export function derivePhaseForFeature(featureName, projectPath) {
   const basePath = join(projectPath || process.cwd(), '.morph/features', featureName);
   return derivePhaseFrom(getFeature(featureName, projectPath), diskArtifactProbe(basePath));
@@ -219,17 +214,3 @@ export function pendingGatesFrom(feature) {
 export function getPendingGates(featureName, projectPath) {
   return pendingGatesFrom(getFeature(featureName, projectPath));
 }
-
-export function getOutputs(featureName, projectPath) {
-  const feature = getFeature(featureName, projectPath);
-  return feature?.outputs || null;
-}
-
-export function getMissingOutputs(featureName, projectPath) {
-  const feature = getFeature(featureName, projectPath);
-  if (!feature?.outputs) return [];
-
-  return Object.entries(feature.outputs)
-    .filter(([, output]) => !output.created)
-    .map(([type, output]) => ({ type, path: output.path }));
-}

package/framework/hooks/shared/telemetry-logger.js

@@ -70,7 +70,7 @@ export function readTelemetryEvents(projectPath) {
   }
 }
 
-// `events-` prefix: activity-logger archives share `sessions/` without one.
+// `events-` prefix: older activity-log archives in `sessions/` carry none.
 function archiveEvents(projectPath) {
   try {
     const eventsPath = getEventsPath(projectPath);

package/framework/rules/csharp-standards.md

@@ -8,13 +8,15 @@ stacks:
 
 # C# and .NET VSA Standards
 
-- **architecture-vertical-slice-vertical-slice** (`architecture/vertical-slice/vertical-slice.md`) — Uma slice por operação em `Features/{Entity}Feature/{Verb}{Entity}/`: Request/Response `sealed record`, Handler, Validator e Endpoint `IApiEndpoint` `internal sealed`. Decorators Scrutor: Logging → Validation → Handler. PROIBIDO: MediatR/`IRequest`, AggregateRoot, DomainEvent, CQRS formal, camada Application Service, DTO compartilhado entre features, `IRepository<T>`/`IUnitOfWork`.
-- **backend-dotnet-vsa-handler-patterns** (`backend/dotnet/vsa-handler-patterns.md`) — Handler `sealed class` com primary constructor implementando `IHandler<TRequest, TResponse>` (não MediatR): injeta `ApplicationDbContext` direto, usa `Guid.CreateVersion7()` (nunca `Guid.NewGuid()`), passa `CancellationToken` em tudo e devolve `Result<T>`. Erros em `{Feature}Errors.cs`. SQL cru ou store dedicado só com justificativa em `plan.md` (`## Decisões`).
+- **architecture-vertical-slice-vertical-slice** (`architecture/vertical-slice/vertical-slice.md`) — Uma slice por operação em `Features/{Entity}Feature/{Verb}{Entity}/`: Request/Response `record`, Handler, Validator e Endpoint `IApiEndpoint`. Decorators Scrutor: Logging → Validation → Handler. PROIBIDO: MediatR/`IRequest`, AggregateRoot, DomainEvent, CQRS formal, camada Application Service, DTO compartilhado entre features, `IRepository<T>`/`IUnitOfWork`.
+- **backend-dotnet-vsa-handler-patterns** (`backend/dotnet/vsa-handler-patterns.md`) — Handler implementando `IHandler<TRequest, TResponse>` (não MediatR): injeta `ApplicationDbContext` direto e devolve `Result<T>`. Erros em `{Feature}Errors.cs`. SQL cru ou store dedicado só com justificativa em `plan.md` (`## Decisões`).
 - **backend-dotnet-result-pattern** (`backend/dotnet/result-pattern.md`) — Falha esperada é `Result`/`Result<T>`, nunca exceção. Endpoint: `result.Match(value => Results.Ok(value), error => error.ToHttpResult())`; nunca leia `.Value` fora do `Match`. Status pelo `ErrorType` (Validation 400, NotFound 404, Conflict 409, Unauthorized 401, Forbidden 403, Unexpected 500), nunca BadRequest para tudo. PROIBIDO: try/catch no handler, retornar null, erro string sem código.
-- **backend-dotnet-fluent-validation-vsa** (`backend/dotnet/fluent-validation-vsa.md`) — Um `sealed AbstractValidator<TRequest>` (FluentValidation 12) por request, na pasta da slice; o `ValidationDecorator` roda antes do handler e devolve `Result.Failure(ValidationError)`. `AddValidatorsFromAssembly()` ANTES de `AddHandlersFromAssembly()`. Sempre `.WithMessage()`; tempo via `TimeProvider` lido DENTRO da regra. Nunca lance `ValidationException`.
+- **backend-dotnet-fluent-validation-vsa** (`backend/dotnet/fluent-validation-vsa.md`) — Um `AbstractValidator<TRequest>` (FluentValidation 12) por request, na pasta da slice; o `ValidationDecorator` roda antes do handler e devolve `Result.Failure(ValidationError)`. `AddValidatorsFromAssembly()` ANTES de `AddHandlersFromAssembly()`. Sempre `.WithMessage()`; tempo via `TimeProvider` lido DENTRO da regra. Nunca lance `ValidationException`.
 - **backend-dotnet-scrutor** (`backend/dotnet/scrutor.md`) — `AddHandlersFromAssembly` registra cada `IHandler<,>` como Scoped (filtro `!t.ContainsGenericParameters`) e depois `Decorate` Validation e então Logging (o último registrado é o mais externo). Endpoints `IApiEndpoint` via `TryAddEnumerable` Transient + `MapApiEndpoints`. Nunca registre handler um a um.
 - **backend-dotnet-scalar-ui** (`backend/dotnet/scalar-ui.md`) — Scalar no lugar do Swagger: `Microsoft.AspNetCore.OpenApi` 10.0.0 + `Scalar.AspNetCore` 2.12.40, nunca Swashbuckle. `MapOpenApi()` só em `IsDevelopment()` e antes de `MapScalarApiReference`. Todo endpoint com `.WithTags(ApiTags.X)` (constantes), `.Produces<T>` e `.ProducesProblem(status)` por falha possível.
+- **backend-dotnet-analyzers** (`backend/dotnet/analyzers.md`) — O build cobra, a prosa não repete: `Guid.NewGuid()` é erro RS0030 (use `Guid.CreateVersion7()`) e token recebido e não repassado é erro CA2016, por `Directory.Build.props` + `BannedSymbols.txt` + `morph.globalconfig` na raiz. `sealed`, primary constructor e `var` são gosto: siga o arquivo vizinho.
 - **backend-api-validation** (`backend/api/validation.md`) — O validator checa só FORMA (sem DbContext); existência, unicidade e estado ficam no handler com `{Entity}Errors` tipados. Checagem de estado valida o INVÁLIDO (enum ordenado, estados de erro em 100+). PROIBIDO: lançar exceção, validar na lambda do endpoint, misturar DataAnnotations, `if (status != Expected)`, switch exaustivo sobre estados válidos.
 - **architecture-code-comments** (`architecture/code-comments.md`) — Padrão é nenhum comentário: renomeie, extraia, tipe ou teste antes. Só o porquê que o código não mostra (invariante, ordem, quirk externo com link), até ~3 linhas. PROIBIDO: história de processo (task, UC, ADR, Gate), repetir o código, XML doc/JSDoc que repete a assinatura, banner, `#region`, código comentado, TODO solto. O hook `comment-guard` bloqueia.
+- **architecture-engineering-lens** (`architecture/engineering-lens.md`) — Escreva para quem herda amanhã: convenção do projeto, o mais simples, causa raiz. PROIBIDO no que você adiciona: `catch` que engole, flag booleana que bifurca o método (são dois métodos), efeito colateral escondido, símbolo/flag/config sem consumidor, abstração ou camada sem segundo uso, literal repetido sem constante. Nomes de domínio buscáveis, funções pequenas, ≤ 3 parâmetros, condicional positiva. Commit em Conventional Commits (hook `conventional-commit`).
 
 > Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/dotnet-templates.md

@@ -40,8 +40,8 @@ For each new feature slice, follow the patterns in these templates:
 |----------|------|---------|
 | Endpoint | `.morph/framework/templates/code/dotnet/feature/endpoint.cs.hbs` | IApiEndpoint with MapEndpoint() |
 | Handler | `.morph/framework/templates/code/dotnet/feature/handler.cs.hbs` | IHandler<TRequest, TResponse> |
-| Request | `.morph/framework/templates/code/dotnet/feature/request.cs.hbs` | Sealed record DTO |
-| Response | `.morph/framework/templates/code/dotnet/feature/response.cs.hbs` | Sealed record DTO |
+| Request | `.morph/framework/templates/code/dotnet/feature/request.cs.hbs` | record DTO |
+| Response | `.morph/framework/templates/code/dotnet/feature/response.cs.hbs` | record DTO |
 | Validator | `.morph/framework/templates/code/dotnet/feature/validator.cs.hbs` | FluentValidation AbstractValidator |
 | Entity | `.morph/framework/templates/code/dotnet/feature/entity.cs.hbs` | Domain entity |
 | Errors | `.morph/framework/templates/code/dotnet/feature/errors.cs.hbs` | Error factory |

package/framework/rules/frontend-standards.md

@@ -9,8 +9,7 @@ stacks:
 
 # Frontend Standards
 
-- **frontend-design-system-naming** (`frontend/design-system/naming.md`) — BEM para componente reutilizável (`.card`, `.card__header`, `.card--featured`); prefixo de página para elemento específico (`.home-hero`). Custom properties em `:root` com namespace `--app-`. Estado por sufixo fixo: `--active`, `--disabled`, `--loading`, `--error`.
-- **frontend-design-system-animations** (`frontend/design-system/animations.md`) — Classes `.animate-*`, `.duration-fast/normal/slow`, `.stagger-1..10`. Lista escalonada exige `animation-delay` E `animation-fill-mode: backwards`. Sempre o bloco `prefers-reduced-motion: reduce`. Além do CSS: Motion (`motion/react`) para enter/exit/layout; GSAP só para ScrollTrigger, SVG morph e timelines.
+- **frontend-design-system-animations** (`frontend/design-system/animations.md`) — Lista escalonada exige `animation-delay` E `animation-fill-mode: backwards` (senão pisca antes do atraso). Sempre o bloco `prefers-reduced-motion: reduce`. Além do CSS: Motion (`motion/react`) para enter/exit/layout; GSAP só para ScrollTrigger, SVG morph e timelines.
 - **frontend-design-system-art-direction** (`frontend/design-system/art-direction.md`) — Tela nova ou alterada segue a direção escrita em `1-design/direcao.md` e o protótipo de `1-design/prototipos/`: celular composto (folha inferior, alvos de 44px), movimento só em `transform`/`opacity` com versão estática em `prefers-reduced-motion`, nenhum número inventado em cena ilustrativa.
 
 > Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/nextjs-standards.md

@@ -8,16 +8,18 @@ stacks:
 
 # Next.js Standards
 
-- **frontend-nextjs-naming-conventions** (`frontend/nextjs/naming-conventions.md`) — Arquivo SEMPRE kebab-case (`user-card.tsx`); export PascalCase para componente e `useX` para hook. Zod em `.schemas.ts`, tipos em `.types.ts` via `z.infer`. Named export (só `page.tsx` usa `default`). Nunca misture casos na mesma categoria.
-- **frontend-nextjs-project-structure** (`frontend/nextjs/project-structure.md`) — `src/app/` só roteia e importa de `features/`. Cada `src/features/{f}/` tem `components/`, `hooks/`, `types/` e `index.ts` como API pública (import de `@/features/users`, nunca deep path). NUNCA uma feature importa outra; `components/ui/` é shadcn e não se edita.
-- **frontend-nextjs-app-router** (`frontend/nextjs/app-router.md`) — Server Component por padrão; `'use client'` só para interação, browser API ou TanStack Query. Nunca fetch em `useEffect`. `loading.tsx`/`error.tsx` ao lado do `page.tsx` (`error.tsx` é client). Server Component chama o .NET com `BACKEND_API_PREFIX`; evite `route.ts`.
-- **frontend-nextjs-components** (`frontend/nextjs/components.md`) — `components/ui/` é saída do shadcn CLI (nunca editar; envolva em `components/`); `components/` sem regra de negócio e sem importar `features/`; `features/*/components/` conhece o domínio. Props tipadas e validadas com Zod, sempre com `className` opcional.
-- **frontend-nextjs-data-fetching** (`frontend/nextjs/data-fetching.md`) — Server Component com `BACKEND_API_PREFIX`; Client Component só pelo proxy same-origin com `PROXY_API_PREFIX`. TanStack Query 5 com key factory por feature e `invalidateQueries({ queryKey })`; toda resposta passa por Zod. PROIBIDO: `useEffect(() => fetch…)` e paginar/filtrar a coleção inteira no browser.
+- **frontend-nextjs-lint** (`frontend/nextjs/lint.md`) — O lint cobra o mecânico: `framer-motion`, Zustand/Redux, driver de banco, Form legado, deep import de feature, fronteiras `components`/`features`/`app`/`hooks`, fetch em `useEffect`, `'use client'` no layout raiz, `export default` fora de rota, `any`. O `verify` roda o eslint nos arquivos da feature quando há `eslint.config.*`; sem `eslint.config.mjs`: `morph-spec standards --show frontend-nextjs-lint#files`. Regra mecânica nova vira linha nele, nunca prosa.
+- **frontend-nextjs-naming-conventions** (`frontend/nextjs/naming-conventions.md`) — Arquivo SEMPRE kebab-case (`user-card.tsx`); componente PascalCase. Zod em `.schemas.ts`, tipos em `.types.ts` via `z.infer`. Nunca misture casos na mesma categoria.
+- **frontend-nextjs-project-structure** (`frontend/nextjs/project-structure.md`) — `src/app/` só roteia; a lógica da tela mora em `src/features/{f}/` (`components/`, `hooks/`, `types/`, `index.ts` como API pública). NUNCA uma feature importa outra (extraia para `components/` ou `lib/`); `components/ui/` é shadcn e não se edita.
+- **frontend-nextjs-app-router** (`frontend/nextjs/app-router.md`) — Server Component por padrão; `'use client'` só para interação, browser API ou TanStack Query. `loading.tsx`/`error.tsx` ao lado do `page.tsx`. Server Component chama o .NET com `BACKEND_API_PREFIX`; evite `route.ts`.
+- **frontend-nextjs-components** (`frontend/nextjs/components.md`) — `components/ui/` é saída do shadcn CLI (nunca editar; envolva em `components/`); `components/` sem regra de negócio; `features/*/components/` conhece o domínio e entrega props tipadas, nunca a resposta crua da API.
+- **frontend-nextjs-data-fetching** (`frontend/nextjs/data-fetching.md`) — Server Component com `BACKEND_API_PREFIX`; Client Component só pelo proxy same-origin com `PROXY_API_PREFIX`. TanStack Query 5 com key factory por feature e `invalidateQueries({ queryKey })`; toda resposta passa por Zod. PROIBIDO paginar/filtrar a coleção inteira no browser.
 - **frontend-nextjs-forms** (`frontend/nextjs/forms.md`) — react-hook-form + Zod (`zodResolver`) + Field do shadcn via `Controller`; tipo por `z.infer`; nunca `useState` por campo. Submit por `useMutation`, erro em `root`. Edição reusa o schema de criação (`.partial()`). Zod 4: `z.email()`.
-- **frontend-nextjs-state-management** (`frontend/nextjs/state-management.md`) — Estado de servidor no TanStack Query, nunca copiado para `useState`. Página, ordenação, filtros e aba ativa na URL (`searchParams`). Context só para tema, usuário ou locale. NUNCA Zustand/Redux antes de esgotar Server Components + TanStack Query.
+- **frontend-nextjs-state-management** (`frontend/nextjs/state-management.md`) — Estado de servidor no TanStack Query, nunca copiado para `useState`. Página, ordenação, filtros e aba ativa na URL (`searchParams`). Context só para tema, usuário ou locale.
 - **frontend-nextjs-testing** (`frontend/nextjs/testing.md`) — Vitest + Testing Library; MSW para API; Playwright para e2e. Teste comportamento, não implementação. Orçamento por risco: um teste por cenário com `risco:` + o de regressão do bug, componente sem risco é `leitura`/`e2e`; cenários do mesmo comportamento em `it.each`; nada de teste que só confere string de copy.
-- **frontend-nextjs-nextjs-patterns** (`frontend/nextjs/nextjs-patterns.md`) — Route Handler é BFF: `auth.getSession()` (401 sem sessão) e delega ao .NET; banco NUNCA em route handler. Zod no client e no server (`safeParse`, 400). `strict: true` + `noUncheckedIndexedAccess`; sem `any` em resposta de API. shadcn via `npx shadcn@latest add`.
-- **frontend-nextjs-motion-patterns** (`frontend/nextjs/motion-patterns.md`) — Motion via `motion/react` (nunca `framer-motion` junto). Variants em `motion/variants.ts` com durations/easings de `@/lib/design-tokens`. `useReducedMotion()` obrigatório; o `layout.tsx` raiz segue Server Component. 3–5 momentos de motion por página; cena guiada por scroll é do GSAP, nunca no mesmo elemento.
+- **frontend-nextjs-nextjs-patterns** (`frontend/nextjs/nextjs-patterns.md`) — Route Handler é BFF: `auth.getSession()` (401 sem sessão) e delega ao .NET. Zod no client e no server (`safeParse`, 400). `strict: true` + `noUncheckedIndexedAccess`. shadcn via `npx shadcn@latest add`.
+- **frontend-nextjs-motion-patterns** (`frontend/nextjs/motion-patterns.md`) — Motion via `motion/react`. Variants em `motion/variants.ts` com durations/easings de `@/lib/design-tokens`. `useReducedMotion()` obrigatório. Cena guiada por scroll é do GSAP, nunca no mesmo elemento que o Motion.
 - **architecture-code-comments** (`architecture/code-comments.md`) — Padrão é nenhum comentário: renomeie, extraia, tipe ou teste antes. Só o porquê que o código não mostra (invariante, ordem, quirk externo com link), até ~3 linhas. PROIBIDO: história de processo (task, UC, ADR, Gate), repetir o código, XML doc/JSDoc que repete a assinatura, banner, `#region`, código comentado, TODO solto. O hook `comment-guard` bloqueia.
+- **architecture-engineering-lens** (`architecture/engineering-lens.md`) — Escreva para quem herda amanhã: convenção do projeto, o mais simples, causa raiz. PROIBIDO no que você adiciona: `catch` que engole, flag booleana que bifurca o método (são dois métodos), efeito colateral escondido, símbolo/flag/config sem consumidor, abstração ou camada sem segundo uso, literal repetido sem constante. Nomes de domínio buscáveis, funções pequenas, ≤ 3 parâmetros, condicional positiva. Commit em Conventional Commits (hook `conventional-commit`).
 
 > Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.