@popovych.co/witness 0.5.1 → 0.6.0

package/README.md

@@ -149,7 +149,8 @@ the wrong file refuses. There are no `WITNESS_*` env vars for configuration.
 | `sync` | pull --rebase + push state commits |
 | `calibrate <model>` | run the reviewer calibration battery |
 | `recover [--complete\|--rollback]` | resolve a crashed write transaction |
-| *(no verb)* | dashboard |
+| `status` | orientation: flows, blocked docs, reconcile rows, pending gates, calibration state |
+| *(no verb)* | the same screen as `status` |
 
 ## Exit codes
 

package/dist/calibrate.js

@@ -547,6 +547,13 @@ export async function runImplementSeed(ctx, harness, seed, agent) {
     if (!planDoc)
         return refuse([v('plan', 'seed-plan-missing', planId, 'the plan just written by the seed')]);
     const report = evidenceForDiff(wt.value.path, root, planDoc, base.value);
+    // Row 97 narrowed `required` to the parent tag, so an empty list no longer means "nothing
+    // was owed" — it means the agent never wrote a test tagged for the spec it was given, and
+    // `.every()` would pass that vacuously. The seed's whole question is whether the parent's
+    // red→green pair got witnessed.
+    if (report.required.length === 0) {
+        return ok({ ok: false, why: 'no test tagged for the parent spec — nothing was witnessed' });
+    }
     return ok({ ok: report.satisfied, why: report.satisfied ? 'evidence satisfied' : JSON.stringify(report.required) });
 }
 export async function runSkillSuites(ctx, harness, model, samples, opts = {}) {

package/dist/cli.js

@@ -21,6 +21,10 @@ const VERBS = {
     decide: () => import('./verbs/decide.js'),
     design: () => import('./verbs/design.js'),
     start: () => import('./verbs/start.js'),
+    // The orientation screen has a name (D101). Bare `witness` stays as its alias, but
+    // an unnamed command cannot be referenced — commands/witness.md instructs the
+    // operator to read "the dashboard" and nothing said which command prints it.
+    status: () => import('./verbs/dashboard.js'),
     clean: () => import('./verbs/clean.js'),
     ship: () => import('./verbs/ship.js'),
     next: () => import('./verbs/next.js'),
@@ -52,6 +56,7 @@ const VERB_USAGE = {
     satisfy: 'witness satisfy <doc-id> --need <text | index>',
     ship: 'witness ship <plan-id>',
     start: 'witness start <plan-id>',
+    status: 'witness status — flows · blocked docs · reconcile rows · pending gates (bare `witness` is the same screen)',
     sync: 'witness sync',
     'test-evidence': 'witness test-evidence <plan-id> --phase red|green',
     'verify-red': 'witness verify-red <plan-id> [--base <ref>]',

package/dist/evidence.js

@@ -32,7 +32,7 @@ export function checkoutRoot(cwd) {
         return refuse([v('cwd', 'not-a-repo', cwd, 'run inside a git checkout')]);
     return ok(res.out.trim());
 }
-export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
+export async function runSpecTests(runRoot, ctx, parentId, trustRoot, opts = {}) {
     const cfg = loadConfig(runRoot);
     if (!cfg.ok)
         return cfg;
@@ -63,10 +63,20 @@ export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
         }
         return ok({ runner: 'filtered', tests, allOk: tests.every((t) => t.ok) });
     }
-    const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
-    if (!suite.ok)
-        return suite;
-    const tests = suite.value.tests
+    // A caller checking several specs at once runs the suite ONCE and hands it here. Without
+    // this the regression lane executes the whole suite per spec, which is the redundancy
+    // `runCriteria` already pays per CRITERION.
+    let all;
+    if (opts.suite !== undefined) {
+        all = opts.suite;
+    }
+    else {
+        const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
+        if (!suite.ok)
+            return suite;
+        all = suite.value.tests;
+    }
+    const tests = all
         .filter((t) => matchesTag(t.name, parentId))
         .map((t) => ({ name: t.name, ok: t.status === 'passed' }));
     if (tests.length === 0) {
@@ -183,11 +193,77 @@ export function diffTags(runRoot, base) {
     }
     return [...tags].sort();
 }
+// Row 97. Editing someone else's tests creates a REGRESSION obligation — those tests still
+// pass — never a red→green one: `red` means "I observed this behaviour missing before I
+// built it", and producing a red on a spec you do not own means deliberately breaking it and
+// journaling that as evidence. Detection reads the CURRENT CONTENT of every changed test
+// file rather than added lines, because the case this exists for (a shared fixture grown
+// from 3 to 24 respondents breaking a `@spec:report-view` e2e) touches no tagged line at all.
+export function changedTestSpecs(runRoot, base, parentId) {
+    const tags = new Set();
+    for (const rel of changedFiles(runRoot, base).filter(isTestPath)) {
+        const abs = join(runRoot, rel);
+        if (!existsSync(abs))
+            continue; // deleted: no content left to owe anything
+        for (const tag of extractCanonicalTags(readFileSync(abs, 'utf8')))
+            tags.add(tag);
+    }
+    tags.delete(parentId); // the parent's obligation is red→green
+    return [...tags].sort();
+}
+// Never a `Result` refusal: this runs inside a gate's resolve(), and a refusal there aborts
+// the whole gate — a fresh unescapable dead end, the exact class row 97 removes. Every
+// runner problem (filter-matched-nothing included) degrades to a failed check carrying its
+// detail, the shape `runCriteria` has always had.
+//
+// Nothing here journals. `journalEvidence`/`recordEvidence` are what write `test-evidence`
+// entries and neither is on this path — an entry under a tag this plan does not own is
+// exactly the false claim row 97 refuses to let anyone make.
+export async function runRegression(runRoot, ctx, trustRoot, specIds, known) {
+    const out = [];
+    const memo = new Map();
+    const runnable = specIds.filter(known);
+    let suite;
+    const cfg = loadConfig(runRoot);
+    const rc = cfg.ok ? runnerConfig(cfg.value) : undefined;
+    if (rc?.ok && rc.value.mode === 'full-suite' && runnable.length > 0) {
+        const first = await runFullSuite(runRoot, ctx, rc.value, trustRoot);
+        if (first.ok)
+            suite = first.value.tests; // one suite run for every spec below
+    }
+    for (const id of specIds) {
+        if (!known(id)) {
+            out.push({ spec: id, state: 'unknown', detail: 'no such spec in canon — reported, not run' });
+            continue;
+        }
+        let run = memo.get(id);
+        if (run === undefined) {
+            run = await runSpecTests(runRoot, ctx, id, trustRoot, { suite });
+            memo.set(id, run);
+        }
+        if (!run.ok) {
+            out.push({ spec: id, state: 'unrunnable', detail: run.violations.map((x) => x.rule).join(' · ') });
+            continue;
+        }
+        const failed = run.value.tests.filter((t) => !t.ok).length;
+        out.push({
+            spec: id, state: run.value.allOk ? 'green' : 'red',
+            detail: `${run.value.tests.length} tagged · ${failed} failed`,
+        });
+    }
+    return out;
+}
 export function evidenceForDiff(runRoot, stateRoot, plan, base) {
     const planId = String(plan.meta.id);
+    const parentId = String(plan.meta.parent);
     const entries = readStream(stateRoot, planId).filter((e) => e.t === 'test-evidence');
     const matching = (e, tag) => (Array.isArray(e.tests) ? e.tests : []).filter((t) => matchesTag(t.name, tag));
-    const required = diffTags(runRoot, base).map((tag) => {
+    // Row 97: red→green is a claim about the NEW BEHAVIOUR THIS PLAN BUILDS, so the only tag
+    // it can be made for is the plan's own parent — `test-evidence` interpolates
+    // `plan.meta.parent` and nothing else, which is why a foreign tag here was unsatisfiable
+    // AND (before row 93) unwaivable. Every other spec the diff's tests touched is a
+    // regression obligation, checked by `runRegression` at the gate.
+    const required = diffTags(runRoot, base).filter((tag) => tag === parentId).map((tag) => {
         // latest-cycle semantics: the newest red matching the tag is the verdict on
         // "was failure observed"; a green only counts if it post-dates that red.
         // One early vacuous red must not poison the tag forever (append-only journal).

package/dist/gate.js

@@ -14,12 +14,13 @@ import { kv, rows } from './toon.js';
 import { loadMatrix, resolveModel, SESSION_DEFAULT } from './model.js';
 import { docKeysFor, docsBlock, invokeReviewer, loadLensDocs, parseVerdictText, pinsBlock, promptsSha, resolvePrompt } from './reviewer.js';
 import { anchorMenu, parseVerdict, verdictViolations } from './verdict.js';
-import { ROUND_BOUND, appendKind, boundReached, gateRuns, roundsSinceApprove, } from './rounds.js';
+import { ROUND_BOUND, appendKind, boundReached, gateRuns, lastGateRun, roundsSinceApprove, } from './rounds.js';
+import { gateSettled } from './verbs/next.js';
 import { prepareStamp, writeStamp } from './stamp.js';
 const GATES = new Map();
 export function registerGate(spec) { GATES.set(spec.gate, spec); }
 export function gateSpec(name) { return GATES.get(name); }
-export const DEFAULT_BATTERIES = {
+const DEFAULT_BATTERIES = {
     decompose: ['slicing-critic'],
     plan: ['plan-critic'],
     implement: {
@@ -43,11 +44,17 @@ export function batteryFor(cfg, gate, cls) {
 // where the state is. Skills used to recite a fixed triple, which is wrong at the bound
 // (D67's endgame set) — and now wrong in three more states.
 export function liveExits(gate, target, entries, stale) {
-    if (stale)
-        return `witness gate ${gate} ${target}`;
+    // The bound outranks staleness: at the bound the gate short-circuits and will not run
+    // again (:227), so "re-gate" is the D67 lie whatever the sha says. Stale content only
+    // removes APPROVE from the endgame — a human cannot honestly stamp bytes no battery
+    // read — which is the same set decide's stale-verdict refusal names.
     if (boundReached(entries, gate)) {
-        return `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
+        return stale
+            ? `witness decide ${gate} ${target} --revise --upstream <id> | --stop`
+            : `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
     }
+    if (stale)
+        return `witness gate ${gate} ${target}`;
     return `witness decide ${gate} ${target} --approve | --revise --note "<why>" | --revise --upstream <id> | --stop`;
 }
 export function renderGateRun(ctx, entry, mode) {
@@ -183,15 +190,35 @@ export async function runGate(ctx, gateName, target, flags) {
         renderRefusal(modelR.violations).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
     }
-    const { chain, calibrationOf, warning } = modelR.value;
-    if (warning)
+    const { chain, calibrationOf, warning, warningKind } = modelR.value;
+    // matrix-empty is a fact about this witness build, reported once by `status`/`check`
+    // (D98a). Only the caller's own pin being below the floor is news at run time.
+    if (warning && warningKind === 'below-floor')
         ctx.err(`warning: ${warning}`);
     const key = {
         reviewed_sha: input.reviewedSha, gate: spec.gate,
         prompts_sha: promptsSha(lenses, pinsText === '' ? undefined : pinsText), model: chain[0], witness: version(),
         harness: harness.name,
     };
+    // D99: `gateSettled` reads only the last run, so any new run un-settles the gate.
+    // Content moving is a legitimate, self-explaining reason. A flag is not — `--fresh`
+    // discarded a human decision with nothing printed and nothing journaled about it, and
+    // row 94 removed its other job (escaping the changed-nothing deadlock), so it can
+    // refuse and send the human through the verb that states a retraction and its reason.
+    const settledBefore = gateSettled(entries, spec.gate);
+    if (flags.fresh && settledBefore) {
+        renderRefusal([v('gate', 'settled-approve', `${spec.gate} ${target} is settled`, `witness decide ${spec.gate} ${target} --revise --note "<why>" — retract the approval, then re-gate`)])
+            .forEach((l) => ctx.err(l));
+        return EXIT.REFUSED;
+    }
     const kind = flags.fresh ? { kind: 'fresh' } : appendKind(entries, spec.gate, key);
+    // A key that moved for a NON-content reason — edited prompt, re-pinned model, new
+    // witness version — un-settles just as quietly as --fresh did. Content moving explains
+    // itself; this does not.
+    const lastRun = lastGateRun(entries, spec.gate);
+    if (settledBefore && kind.kind === 'fresh' && lastRun && lastRun.reviewed_sha === input.reviewedSha) {
+        ctx.err(`warning: reviewer setup changed — this run discards the settled approve on ${spec.gate} ${target}`);
+    }
     if (kind.kind === 'resume') {
         renderGateRun(ctx, kind.entry, 'resume');
         printDispatchArithmetic(ctx, root, spec.gate, target);

package/dist/gates/implement.js

@@ -8,9 +8,9 @@ import { designRel } from '../design.js';
 import { git } from '../gitio.js';
 import { latestRecap, readStream } from '../journal.js';
 import { findById } from '../scan.js';
-import { changedFiles, diffBase, evidenceForDiff, screensDir } from '../evidence.js';
+import { changedFiles, changedTestSpecs, diffBase, evidenceForDiff, runRegression, screensDir } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { effortOf, implementReviewedSha } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { registerGate } from '../gate.js';
 export function codePromptBody(wt, base, files, header) {
@@ -113,8 +113,26 @@ registerGate({
         const missing = report.required.filter((r) => !(r.red && r.green && !r.vacuous));
         checks.push({ name: 'evidence', ok: report.satisfied,
             detail: report.satisfied
-                ? `${report.required.length} tags with red→green pairs`
+                ? (report.required.length > 0
+                    ? `${String(plan.meta.parent)}: red→green`
+                    : `no ${String(plan.meta.parent)} tests in the diff — nothing to witness`)
                 : missing.map((m) => `${m.tag}: red=${m.red} green=${m.green}${m.vacuous ? ' vacuous' : ''}`).join(' · ') });
+        // Row 97: the obligation created by editing someone's tests is that those tests still
+        // pass — not that their whole spec is satisfied, which is the out-of-band drift sweep's
+        // job. `runCriteria` is deliberately NOT used here: it executes the foreign spec's `cmd`
+        // criteria, arbitrary trust-gated commands, inside an unattended gate.
+        const foreign = changedTestSpecs(wt, base, String(plan.meta.parent));
+        const regression = await runRegression(wt, ctx, root, foreign, (id) => findById(canon, id) !== undefined);
+        checks.push({
+            name: 'regression',
+            // `unknown` does not fail: witness cannot judge an obligation for a spec it does not
+            // have, and failing it re-creates the unsatisfiable check this row deletes. It is
+            // named in the detail, which is where a typo'd tag surfaces.
+            ok: regression.every((r) => r.state === 'green' || r.state === 'unknown'),
+            detail: regression.length === 0
+                ? 'no foreign spec tests touched'
+                : regression.map((r) => `${r.spec}:${r.state}`).join(' · '),
+        });
         const lane = await runCriteria(wt, ctx, parent, { trustRoot: root });
         checks.push({
             name: 'drift-lane',
@@ -127,7 +145,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: implementReviewedSha(wt, base, plan),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Plan under implementation: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -137,8 +155,14 @@ registerGate({
             skipLenses,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        const plan = findById(canon, planId);
+        if (!existsSync(wt) || !plan)
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved": an unresolvable base must not
+        // un-settle a gate or invert `decide --show`'s staleness line.
+        return baseR.ok ? implementReviewedSha(wt, baseR.value, plan) : undefined;
     },
 });

package/dist/gates/ship.js

@@ -7,7 +7,7 @@ import { changedFiles, diffBase } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
 import { execCommand } from '../runner.js';
 import { ensureTrusted } from '../allowlist.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { diffReviewedSha, effortOf } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { codePromptBody } from './implement.js';
 import { registerGate } from '../gate.js';
@@ -52,13 +52,15 @@ registerGate({
         // differently for the same journal — the split-brain that reads as a deadlock when
         // two sessions compare notes.
         //
-        // The missing sha argument is DELIBERATE and load-bearing, not an oversight. D75's
-        // `worktreeTreeSha` covers the whole worktree, so ship's own `pr #N` stamp — pulled
-        // into the worktree by the watch-phase rebase — moves the tree and would lapse the
-        // very gate ship is checking: approve → pr → lapse → gate, the livelock D75/D77
-        // record. `next` re-arms on tree movement because authoring is what it routes to;
-        // ship asks only whether implement was ever settled. Passing a sha here re-opens
-        // that livelock — do not "fix" this by adding one.
+        // The missing sha argument is still DELIBERATE, but row 96 killed one of its two
+        // reasons and the surviving one is now the whole reason. It used to rest on
+        // `worktreeTreeSha` hashing the entire worktree, so ship's own `pr #N` stamp — pulled
+        // in by the watch-phase rebase — moved the tree and lapsed the very gate ship was
+        // checking: approve → pr → lapse → gate, the D75/D77 livelock. Under the diff identity
+        // that reason is DEAD: the worktree never edits `plans/<id>.md`, so the stamp is always
+        // equal to base and can never enter the reviewed set. What remains: `next` re-arms on
+        // movement because authoring is what it routes to, while ship asks only whether
+        // implement was EVER settled. Passing a sha here re-opens the livelock — do not add one.
         const implementSettled = gateSettled(entries, 'implement');
         checks.push({ name: 'implement-gate', ok: implementSettled,
             detail: lastImplement
@@ -85,7 +87,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: diffReviewedSha(wt, base),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Parent spec (from main): ${String(parent.meta.id)}\n${serializeDoc({ meta: parent.meta, body: parent.body })}\n\n### Plan: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -95,8 +97,12 @@ registerGate({
             repin,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, _canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        if (!existsSync(wt))
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved" — same doctrine as the implement gate.
+        return baseR.ok ? diffReviewedSha(wt, baseR.value) : undefined;
     },
 });

package/dist/gitio.js

@@ -39,6 +39,39 @@ export function stateDirs(root) {
 export function isStatePath(root, rel) {
     return stateDirs(root).some((d) => rel === d || rel.startsWith(d + '/'));
 }
+// Row 96b. Witness's own state commits reach `origin/main` on every `sync`, and `shipPhase`
+// re-gates on ANY base advance — so the pipeline manufactured its own base movement (7 ship
+// runs for 3 rounds on the audited plan). An advance whose every commit touches only state
+// paths is bookkeeping, not base movement, and this is the ONE predicate both `baseMoved`
+// and `rebaseIfMoved` ask; two copies would let ship rebase in the phase that was just told
+// the base had not moved.
+//
+// Paths are primary and the trailer is secondary, and the conjunction is what keeps both
+// forgeries conservative: a forged trailer on a source commit still reads as real movement
+// (paths decide), and a hand-made commit that happens to touch only state paths reads as
+// real movement too (no trailer). A needless rebase costs a round; a skipped one merges a
+// tree no battery read.
+export function stateOnlyAdvance(wt, root, from, to) {
+    const range = tryGit(wt, 'log', '--format=%H', `${from}..${to}`);
+    if (!range.ok)
+        return false;
+    const shas = range.out.split('\n').filter(Boolean);
+    if (shas.length === 0)
+        return false;
+    return shas.every((sha) => {
+        const trailer = tryGit(wt, 'show', '--no-patch', '--format=%(trailers:key=Witness-State,valueonly=true)', sha);
+        if (!trailer.ok || trailer.out.trim() !== '1')
+            return false;
+        // Per COMMIT, never the range's union diff: a commit that adds and deletes a source
+        // file inside the range cancels out in a union and would read as state-only. An empty
+        // name list (a merge commit) is unjudgeable here and therefore not state-only.
+        const touched = tryGit(wt, 'show', '--pretty=format:', '--name-only', sha);
+        if (!touched.ok)
+            return false;
+        const paths = touched.out.split('\n').filter(Boolean);
+        return paths.length > 0 && paths.every((p) => isStatePath(root, p));
+    });
+}
 const LOCAL_STATE_FILES = new Set([
     '.witness/lock',
     '.witness/txn.json',

package/dist/model.js

@@ -64,10 +64,28 @@ export function resolveModel(cfg, matrix, gate) {
     const head = chain[0];
     const headLabel = head === SESSION_DEFAULT ? '(session default)' : head;
     const matrixEmpty = matrix.shipped.length === 0 && matrix.local.length === 0;
-    const warning = calibrationOf(head) !== 'none'
+    const warningKind = calibrationOf(head) !== 'none'
         ? undefined
-        : matrixEmpty
+        : matrixEmpty ? 'matrix-empty' : 'below-floor';
+    const warning = warningKind === undefined
+        ? undefined
+        : warningKind === 'matrix-empty'
             ? `calibration matrix is empty — no calibrated model exists yet; ${headLabel} runs uncalibrated`
             : `reviewer model ${headLabel} is below the model floor — no calibration matrix entry covers it`;
-    return ok({ chain, calibrationOf, warning });
+    return ok({ chain, calibrationOf, warning, warningKind });
+}
+// One renderer for both orientation surfaces (`status` and `check`). Lives here because
+// the grouping rule — one line per distinct warning, labelled with the gates it covers —
+// is a property of the resolution, not of either screen. Returns `[]` when every gate's
+// model is calibrated.
+export function modelFloorLines(root, cfg, harness) {
+    const matrix = loadMatrix(root, harness);
+    const byWarning = new Map();
+    for (const gate of ['decompose', 'plan', 'implement', 'ship', 'design']) {
+        const r = resolveModel(cfg, matrix, gate);
+        if (r.ok && r.value.warning) {
+            byWarning.set(r.value.warning, [...(byWarning.get(r.value.warning) ?? []), gate]);
+        }
+    }
+    return [...byWarning].map(([warning, gates]) => `${gates.join(' · ')}: ${warning}`);
 }

package/dist/reviewed.js

@@ -1,21 +1,44 @@
-import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { canonicalJson, canonicalSha } from './sha.js';
+import { canonicalJson, canonicalSha, planContentSha } from './sha.js';
+import { changedFiles } from './evidence.js';
+import { git } from './gitio.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from './journal.js';
 import { findById } from './scan.js';
-export function worktreeTreeSha(root) {
-    const tmp = mkdtempSync(join(tmpdir(), 'witness-idx-'));
-    const env = { ...process.env, GIT_INDEX_FILE: join(tmp, 'index') };
-    try {
-        execFileSync('git', ['add', '-A'], { cwd: root, env });
-        return execFileSync('git', ['write-tree'], { cwd: root, env, encoding: 'utf8' }).trim();
-    }
-    finally {
-        rmSync(tmp, { recursive: true, force: true });
-    }
+// Row 96a. The reviewed identity is the DIFF the battery read: the base commit plus the
+// content of every path `changedFiles` reports — exactly what `codePromptBody` renders as
+// `### Changed files`, `### Diff vs base <sha>` and the untracked blocks. `worktreeTreeSha`
+// hashed the WHOLE worktree via `add -A`, so witness's own journal entries and stamps —
+// pulled in by ship's pre-battery rebase — moved the identity the verdict was keyed to, and
+// the entry DESCRIBING a verdict invalidated it one hop later.
+//
+// The base term is required, not optional. A rebase can change the diff TEXT while every
+// blob stays byte-identical; drop the base and a cached verdict replays against a diff no
+// reviewer ever read, and implement loses the rebase re-arming it has today.
+//
+// Deleted paths carry an explicit marker: `hash-object` throws on a missing file, and
+// dropping the path silently would make "this file is gone" invisible to the identity.
+const DELETED_BLOB = '(deleted)';
+export function diffReviewedSha(runRoot, base) {
+    const pairs = changedFiles(runRoot, base).map((rel) => existsSync(join(runRoot, rel))
+        ? `${rel}\0${git(runRoot, 'hash-object', '--', rel)}`
+        : `${rel}\0${DELETED_BLOB}`);
+    return sha256([base, '\n', pairs.sort().join('\n')]);
+}
+// Row 95: implement's identity is the diff AND the plan, because the battery reads both —
+// `codePromptBody` serializes the plan into the prompt — so a re-authored plan re-arms the
+// gate. It lives here rather than in `gates/implement.ts` because there are THREE readers,
+// not two: the gate's `resolve`, the gate's `currentSha`, and `flowAction`, which derives
+// the sha itself instead of calling `currentSha`. Two of the three agreeing is the same
+// split-brain rows 93 and 95 are about — the gate keyed on one sha while `next` checked
+// another, and every settled gate read as lapsed one turn later.
+export function implementReviewedSha(runRoot, base, plan) {
+    return createHash('sha256')
+        .update(diffReviewedSha(runRoot, base))
+        .update('\0')
+        .update(planContentSha(plan.meta, plan.body))
+        .digest('hex');
 }
 export function effortWrites(root, effort) {
     const out = new Map();

package/dist/sha.js

@@ -22,6 +22,16 @@ export function canonicalSha(meta, body) {
         .update(body.replace(/\s+$/, '') + '\n')
         .digest('hex');
 }
+// Row 95: a re-authored plan re-arms the implement gate, so the plan's content joins that
+// gate's reviewed identity — the battery reads the plan (`codePromptBody` serializes it into
+// the prompt), so the identity should say so. `derives-from` is excluded ON TOP of
+// VOLATILE_FIELDS because ship's own `repin` rewrites it inside the same transaction as the
+// gate run: keep it and the entry invalidates itself the moment it is written, which is
+// row 96's self-invalidation in a second place.
+export function planContentSha(meta, body) {
+    const { 'derives-from': _repinned, ...rest } = meta;
+    return canonicalSha(rest, body);
+}
 export function short(sha) {
     return sha.slice(0, 7);
 }

package/dist/ship.js

@@ -4,7 +4,7 @@ import { loadConfig } from './config.js';
 import { acquireLock } from './lock.js';
 import { crashPoint, guardTxn, withTxn } from './txn.js';
 import { journalRel, readStream } from './journal.js';
-import { primaryRoot, stateCommit, tryGit } from './gitio.js';
+import { primaryRoot, stateCommit, stateOnlyAdvance, tryGit } from './gitio.js';
 import { findById, loadCanon } from './scan.js';
 import { ok, refuse, renderRefusal, v } from './refusal.js';
 import { kv } from './toon.js';
@@ -12,8 +12,9 @@ import { runGate } from './gate.js';
 import { lastGateRun } from './rounds.js';
 import { prepareStamp, writeStamp } from './stamp.js';
 import { branchName, worktreePath } from './worktree.js';
-import { gateSettled } from './verbs/next.js';
-import { worktreeTreeSha } from './reviewed.js';
+import { authoringOwed, gateSettled } from './verbs/next.js';
+import { diffReviewedSha } from './reviewed.js';
+import { diffBase } from './evidence.js';
 export function shipPhase(plan, entries, treeSha, baseMoved = false) {
     // A PR exists, but the watch is only legitimate while the verdict still describes both
     // this tree AND this base. Either one moving re-arms the gate — otherwise a rebase (or
@@ -116,7 +117,18 @@ export function stampPr(ctx, root, planId, pr) {
         lockR.value();
     }
 }
-export function rebaseIfMoved(wt, shipBranch, remote = 'origin') {
+// One read-only fetch decides the whole routing. A failed fetch (no remote, offline) leaves
+// this false and the phases behave as they did — the gate phase's own rebaseIfMoved is where
+// that condition turns into a structured refusal.
+export function baseMoved(wt, root, shipBranch, remote = 'origin') {
+    if (!tryGit(wt, 'fetch', remote, shipBranch).ok)
+        return false;
+    const base = `${remote}/${shipBranch}`;
+    if (tryGit(wt, 'merge-base', '--is-ancestor', base, 'HEAD').ok)
+        return false;
+    return !stateOnlyAdvance(wt, root, 'HEAD', base);
+}
+export function rebaseIfMoved(wt, root, shipBranch, remote = 'origin') {
     // Resolve the base from the REMOTE tip, not the local ref: with several flows merging
     // concurrently, local <shipBranch> lags every merge since the human's last pull, so a
     // local ancestry check reports "clean" against a base that is provably behind and the
@@ -134,6 +146,10 @@ export function rebaseIfMoved(wt, shipBranch, remote = 'origin') {
     const base = `${remote}/${shipBranch}`;
     if (tryGit(wt, 'merge-base', '--is-ancestor', base, 'HEAD').ok)
         return ok('clean');
+    // Same predicate as baseMoved: an advance made entirely of witness's own state commits is
+    // bookkeeping, and rebasing onto it moves the base term of every reviewed sha for nothing.
+    if (stateOnlyAdvance(wt, root, 'HEAD', base))
+        return ok('clean');
     // --autostash: this runs in the GATE phase, and implement deliberately leaves the
     // worktree uncommitted (ship owns the sole code commit, in the pr phase below), so the
     // tree is normally dirty and a bare rebase refuses with "you have unstaged changes".
@@ -186,17 +202,26 @@ export async function runShip(ctx, planId) {
     // One read-only fetch decides the whole routing. A failed fetch (no remote, offline)
     // leaves baseMoved false and the phases behave as they did — the gate phase's own
     // rebaseIfMoved is where that condition turns into a structured refusal.
-    const baseMoved = tryGit(wt, 'fetch', 'origin', shipBranch).ok
-        && !tryGit(wt, 'merge-base', '--is-ancestor', `origin/${shipBranch}`, 'HEAD').ok;
-    let phase = shipPhase(plan, entries, worktreeTreeSha(wt), baseMoved);
-    if (baseMoved)
+    const moved = baseMoved(wt, root, shipBranch);
+    const baseR = diffBase(wt, cfgR.value);
+    const reviewedSha = baseR.ok ? diffReviewedSha(wt, baseR.value) : undefined;
+    let phase = shipPhase(plan, entries, reviewedSha, moved);
+    if (moved)
         ctx.out(kv('ship', `${shipBranch} moved — rebasing and re-reviewing before the watch`));
     if (phase === 'gate') {
+        // D94: the gate cannot judge unchanged content twice — it answers changed-nothing
+        // and appends nothing, so routing the human back at it burns a turn on a command
+        // that has already declined. The owed work is the edit the revise asked for.
+        if (authoringOwed(entries, 'ship', reviewedSha)) {
+            ctx.out(kv('ship', `${planId} — revise owed`));
+            ctx.out(`help: edit the code in ${wt} · then re-run witness ship ${planId}`);
+            return EXIT.FINDINGS;
+        }
         // Rebase BEFORE the battery, never after: the reviewers must judge the tree that will
         // actually merge. Reviewing first spends a battery — and a human decision — on a tree
         // without any sibling's merged work, which then lapses (gateSettled's reviewed_sha)
         // the moment the rebase lands.
-        const rebase = rebaseIfMoved(wt, shipBranch);
+        const rebase = rebaseIfMoved(wt, root, shipBranch);
         if (!rebase.ok) {
             renderRefusal(rebase.violations).forEach((l) => ctx.err(l));
             // A textual conflict is a hand-back, not a refusal: the human resolves it in the

package/dist/verbs/check.js

@@ -11,6 +11,7 @@ import { auditStateCommits, dirtyStatePaths, primaryRoot, tryGit } from '../giti
 import { contentAtSha } from '../history.js';
 import { effortStreams, readStream } from '../journal.js';
 import { sourceTags } from '../matcher.js';
+import { modelFloorLines } from '../model.js';
 import { evaluateNeeds } from '../needs.js';
 import { renderRefusal } from '../refusal.js';
 import { pendingDecision } from '../rounds.js';
@@ -246,6 +247,14 @@ export async function run(ctx, argv = []) {
     const errors = findings.filter((x) => x.level === 'error');
     if (findings.length)
         rows('findings', ['level', 'area', 'field', 'rule', 'detail'], findings).forEach(ctx.out);
+    // The calibration state reads the same here as on `status` (D98a) — one renderer, so
+    // the fact the gate run no longer repeats still reaches both orientation surfaces.
+    if (cfg.ok) {
+        const hxR = resolveHarness(ctx.env, cfg.value.raw);
+        for (const line of modelFloorLines(root, cfg.value, hxR.ok ? hxR.value.harness.name : 'claude-code')) {
+            ctx.out(kv('model-floor', line));
+        }
+    }
     ctx.out(kv('checks', `${canon.docs.length} docs · ${auditStateCommits(root).length} commits audited · ${errors.length} errors`));
     return errors.length ? EXIT.FINDINGS : EXIT.OK;
 }

package/dist/verbs/dashboard.js

@@ -3,11 +3,10 @@ import { EXIT, version } from '../cli.js';
 import { loadConfig } from '../config.js';
 import { designArtifactCurrent, designPending } from '../design.js';
 import { reconcileRows } from '../drift.js';
-import { DEFAULT_BATTERIES } from '../gate.js';
 import { primaryRoot } from '../gitio.js';
 import { resolveHarness } from '../harness.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from '../journal.js';
-import { loadMatrix, resolveModel } from '../model.js';
+import { modelFloorLines } from '../model.js';
 import { computeNext, flowAction } from './next.js';
 import { renderRefusal } from '../refusal.js';
 import { pendingDecision } from '../rounds.js';
@@ -60,18 +59,11 @@ export async function run(ctx, _argv) {
         // Diagnostic surface: a broken harness config must not brick the dashboard —
         // `check` reports that as a finding, so the floor lines fall back to claude-code.
         const hxR = resolveHarness(ctx.env, cfg.value.raw);
-        const matrix = loadMatrix(root, hxR.ok ? hxR.value.harness.name : 'claude-code');
-        // one line per distinct warning, labeled with the gates it applies to —
-        // per-gate model pins can put each gate in a different calibration state
-        const byWarning = new Map();
-        for (const gate of Object.keys(DEFAULT_BATTERIES)) {
-            const modelR = resolveModel(cfg.value, matrix, gate);
-            if (modelR.ok && modelR.value.warning) {
-                byWarning.set(modelR.value.warning, [...(byWarning.get(modelR.value.warning) ?? []), gate]);
-            }
-        }
-        for (const [warning, gates] of byWarning) {
-            ctx.out(kv('model-floor', `${gates.join(' · ')}: ${warning}`));
+        // One line per distinct warning, labelled with the gates it applies to — per-gate
+        // model pins can put each gate in a different calibration state. Shared with
+        // `check` (D98a): the calibration fact must read the same on both surfaces.
+        for (const line of modelFloorLines(root, cfg.value, hxR.ok ? hxR.value.harness.name : 'claude-code')) {
+            ctx.out(kv('model-floor', line));
         }
     }
     const txn = pendingTxn(root);

package/dist/verbs/decide.js

@@ -9,6 +9,7 @@ import { acquireLock } from '../lock.js';
 import { crashPoint, guardTxn, withTxn } from '../txn.js';
 import { appendEntry, entryLine, journalRel, policyPins, readStream, streamExists } from '../journal.js';
 import { primaryRoot, stateCommit } from '../gitio.js';
+import { effortOf } from '../reviewed.js';
 import { findById, loadCanon } from '../scan.js';
 import { newRunId } from '../drift.js';
 import { renderRefusal, v } from '../refusal.js';
@@ -41,6 +42,16 @@ export async function run(ctx, argv) {
     const entries = readStream(root, target);
     const last = lastGateRun(entries, gate);
     const pending = pendingDecision(entries, gate);
+    // Hoisted above `--show` (D94): both the anchor rule below and `--show`'s staleness
+    // line need `spec.currentSha`, which takes canon and config. A decision verb that
+    // cannot read the config cannot honestly report state either, so refusing here — and
+    // for `--show` too — is the correct order rather than a regression.
+    const cfgR = loadConfig(root);
+    if (!cfgR.ok) {
+        renderRefusal(cfgR.violations).forEach((l) => ctx.err(l));
+        return EXIT.REFUSED;
+    }
+    const canon = loadCanon(root);
     if (argv.includes('--show')) {
         if (!last) {
             ctx.out(kv('decide', `no gate-runs for ${gate} ${target}`));
@@ -53,7 +64,14 @@ export async function run(ctx, argv) {
             .map((e) => e);
         // A caused_by decision is a REOPEN, not a disposition — it can never settle the run
         // above it, and pairing the two is what presented 15 settled findings as current.
-        const disposition = decisionsAfter.find((d) => d.caused_by === undefined);
+        // The LAST disposition is the state (D94): `find` returned the first, so a
+        // revise→approve reported `decision: revise` on a gate that is settled.
+        const disposition = decisionsAfter.filter((d) => d.caused_by === undefined).at(-1);
+        // Staleness is a fact about content, not about being reopened. Hardcoding it printed
+        // `witness gate …` in the one state where the gate answers changed-nothing. An
+        // uncomputable sha is NOT staleness — same doctrine as the approve-time check.
+        const shownSha = spec.currentSha?.(root, canon, cfgR.value, target);
+        const stale = shownSha !== undefined && shownSha !== last.reviewed_sha;
         if (reopen) {
             ctx.out(kv('gate', gate));
             ctx.out(kv('target', target));
@@ -62,7 +80,7 @@ export async function run(ctx, argv) {
             if (reopen.note)
                 ctx.out(kv('note', reopen.note));
             ctx.out(kv('last-run', `round ${last.round} @${short(last.reviewed_sha)} — ${last.outcome}${disposition ? `, ${disposition.decision}` : ''} · witness log ${target}`));
-            ctx.out(kv('exits', liveExits(gate, target, entries, true)));
+            ctx.out(kv('exits', liveExits(gate, target, entries, stale)));
             return EXIT.OK;
         }
         if (disposition && disposition.decision !== 'revise' && disposition.decision !== 'revise-upstream') {
@@ -72,6 +90,9 @@ export async function run(ctx, argv) {
             if (disposition.note)
                 ctx.out(kv('note', disposition.note));
             ctx.out(kv('last-run', `round ${last.round} @${short(last.reviewed_sha)} — ${last.outcome} · witness log ${target}`));
+            // no exits: the gate is genuinely terminal here. Point at the one verb that owns
+            // what comes next rather than re-deriving routing in a second place (D101).
+            ctx.out('help: witness next');
             return EXIT.OK;
         }
         // pending (no disposition) or revise (the author's input): the verdict is actionable
@@ -84,7 +105,7 @@ export async function run(ctx, argv) {
             if (disposition.note)
                 ctx.out(kv('note', disposition.note));
         }
-        ctx.out(kv('exits', liveExits(gate, target, entries, false)));
+        ctx.out(kv('exits', liveExits(gate, target, entries, stale)));
         return EXIT.OK;
     }
     const picked = ['--approve', '--revise', '--stop'].filter((f) => argv.includes(f));
@@ -113,7 +134,27 @@ export async function run(ctx, argv) {
     // run, or the target livelocks (incident c2692b93)
     const boundEndgame = atBound && (decision === 'stop' || (decision === 'approve' && override) ||
         (decision === 'revise' && upstream !== undefined));
-    const anchor = pending ?? (boundEndgame ? last : undefined);
+    // D94: a revise is the author's INPUT, not a disposition — it leaves the run
+    // undisposed, and with the content unchanged `gate` answers `changed-nothing` and
+    // appends nothing, so a pending decision can never reappear. Every exit the human is
+    // shown then refuses, and the only escape found in the field was an edit they did not
+    // need. The verdict still describes current content, so approving it is a true
+    // statement about bytes a battery read.
+    //
+    // `undefined` means the sha CANNOT be computed (no worktree, missing parent) and must
+    // never read as "moved" — the same doctrine the approve-time staleness check states
+    // below. That check still runs and still refuses a genuinely stale approve.
+    const afterLast = last
+        ? entries.slice(entries.lastIndexOf(last) + 1)
+            .filter((e) => e.t === 'human-decision' && e.gate === gate)
+            .map((e) => e)
+        : [];
+    const onlyRevises = afterLast.length > 0 &&
+        afterLast.every((d) => d.decision === 'revise' || d.decision === 'revise-upstream');
+    const nowSha = last !== undefined ? spec.currentSha?.(root, canon, cfgR.value, target) : undefined;
+    const unchanged = last !== undefined && (nowSha === undefined || nowSha === last.reviewed_sha);
+    const revisedAnchor = onlyRevises && unchanged && (decision === 'approve' || decision === 'stop');
+    const anchor = pending ?? ((boundEndgame || revisedAnchor) ? last : undefined);
     if (!anchor) {
         // at the bound "run the gate" is a lie — it would only short-circuit back
         // here; name the decisions that actually work instead
@@ -135,11 +176,6 @@ export async function run(ctx, argv) {
         renderRefusal([v('decision', 'override-required', 'approve at the round bound', 'witness decide … --approve --override')]).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
     }
-    const cfgR = loadConfig(root);
-    if (!cfgR.ok) {
-        renderRefusal(cfgR.violations).forEach((l) => ctx.err(l));
-        return EXIT.REFUSED;
-    }
     // A standing stop is only human judgment if the human was shown the thing. The gate
     // refuses the same way, but the gate does not run at the round bound (gate.ts:176) —
     // and approve is the act that stamps, so the line has to hold here too. Sha-keyed:
@@ -152,7 +188,6 @@ export async function run(ctx, argv) {
             return EXIT.REFUSED;
         }
     }
-    const canon = loadCanon(root);
     // A `human-decision` entry is a RECORD — honest about the sha it judged whatever the
     // tree does afterward, which is why D76 declined a write-time staleness check. A stamp
     // is an ASSERTION about current content (`status: approved`, `design: {sha}`), and D75
@@ -232,13 +267,33 @@ export async function run(ctx, argv) {
             renderRefusal([v('upstream', 'unknown-artifact', upstream, 'a canon doc id')]).forEach((l) => ctx.err(l));
             return EXIT.REFUSED;
         }
-        else {
-            const upGate = upDoc.meta.type === 'plan' ? 'plan' : 'decompose';
-            entry.upstream = { artifact: upstream, gate: upGate };
+        else if (upDoc.meta.type === 'plan') {
+            entry.upstream = { artifact: upstream, gate: 'plan' };
             reopen = {
                 stream: upstream,
                 entry: {
-                    v: 1, t: 'human-decision', gate: upGate, artifact: upstream, round: anchor.round,
+                    v: 1, t: 'human-decision', gate: 'plan', artifact: upstream, round: anchor.round,
+                    decision: 'revise', caused_by: { artifact: target, gate, round: anchor.round },
+                    ...(note ? { note } : {}),
+                },
+            };
+        }
+        else {
+            // Row 95: decompose gates are keyed on EFFORTS — `computeNext` asks
+            // `openReopen(effortEntries, 'decompose')` and nothing anywhere reads a spec's stream
+            // for one — so a decompose reopen written on the spec was unreachable by construction.
+            // Resolve the owner, exactly as the design gate's branch above already does.
+            const owner = effortOf(root, upstream);
+            if (owner === undefined) {
+                renderRefusal([v('upstream', 'unknown-owner', upstream, 'a spec some effort wrote — the decompose reopen is booked on the effort stream')])
+                    .forEach((l) => ctx.err(l));
+                return EXIT.REFUSED;
+            }
+            entry.upstream = { artifact: owner, gate: 'decompose' };
+            reopen = {
+                stream: owner,
+                entry: {
+                    v: 1, t: 'human-decision', gate: 'decompose', artifact: owner, round: anchor.round,
                     decision: 'revise', caused_by: { artifact: target, gate, round: anchor.round },
                     ...(note ? { note } : {}),
                 },
@@ -300,6 +355,9 @@ export async function run(ctx, argv) {
             ctx.out(rows('pins', ['ordinal', 'text'], pins).join('\n'));
         if (note)
             ctx.out(kv('note', note));
+        if (upstream !== undefined && entry.upstream && upstream !== entry.upstream.artifact) {
+            ctx.out(kv('upstream', `${upstream} is owned by effort ${entry.upstream.artifact} — the decompose reopen is booked there`));
+        }
         if (gate === 'decompose')
             ctx.out(`help: scope itself implicated → witness recap --amend ${target}`);
         else if (entry.upstream)

package/dist/verbs/next.js

@@ -7,8 +7,8 @@ import { primaryRoot } from '../gitio.js';
 import { findById, loadCanon } from '../scan.js';
 import { designArtifactCurrent, designPending, designUnseen } from '../design.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from '../journal.js';
-import { effortOf, effortReviewedSha, effortSpecs, effortWrites, planPairSha, worktreeTreeSha } from '../reviewed.js';
-import { changedFiles, diffBase, evidenceForDiff } from '../evidence.js';
+import { effortOf, effortReviewedSha, effortSpecs, effortWrites, implementReviewedSha, planPairSha } from '../reviewed.js';
+import { changedFiles, diffBase, evidenceForDiff, isTestPath } from '../evidence.js';
 import { SESSION_DEFAULT, stagePin } from '../model.js';
 import { handoffLine, relayLine, resolveHarness } from '../harness.js';
 import { worktreeFlow, worktreePath } from '../worktree.js';
@@ -47,7 +47,7 @@ export function gateSettled(entries, gate, currentSha) {
 // immediately decline, and — since nothing is appended — `next` says it again next turn.
 // The work owed is AUTHORING, so route to the stage. The design stage already does this
 // via designArtifactCurrent; this is the same rule for decompose and plan.
-function authoringOwed(entries, gate, currentSha) {
+export function authoringOwed(entries, gate, currentSha) {
     const last = lastGateRun(entries, gate);
     if (!last)
         return false;
@@ -55,15 +55,19 @@ function authoringOwed(entries, gate, currentSha) {
         return false;
     if (openReopen(entries, gate) !== undefined)
         return true;
-    const after = entries.slice(entries.lastIndexOf(last) + 1);
-    return after.some((e) => e.t === 'human-decision' &&
-        e.gate === gate &&
-        ['revise', 'revise-upstream'].includes(e.decision));
+    // The LAST decision is the state (D94). `.some()` read by presence, so an approve
+    // answering a revise left this still claiming authoring — the same read-by-position
+    // defect as decide --show's disposition.
+    const recent = entries.slice(entries.lastIndexOf(last) + 1)
+        .filter((e) => e.t === 'human-decision' && e.gate === gate)
+        .map((e) => e)
+        .at(-1);
+    return recent !== undefined && ['revise', 'revise-upstream'].includes(recent.decision);
 }
-// D75 re-arms a gate whose reviewed sha has moved, and `worktreeTreeSha` covers the
-// WHOLE worktree — so any state commit reaching it lapses the gate. That is correct, but
-// the row it produces is a bare `gate implement`, indistinguishable from a CLI stuck on
-// a stale answer. A human who just watched that gate pass reads it as the latter, and
+// D75 re-arms a gate whose reviewed sha has moved — under row 96 that is the diff moving
+// or the base moving, no longer any file in the worktree. Correct either way, but the row
+// it produces is a bare `gate implement`, indistinguishable from a CLI stuck on a stale
+// answer. A human who just watched that gate pass reads it as the latter, and
 // with a second session in the worktree answering `ship` the pair looks like a deadlock
 // with no error anywhere. The lapse is a fact the CLI already knows; say it.
 function lapseNote(entries, gate, currentSha) {
@@ -75,6 +79,42 @@ function lapseNote(entries, gate, currentSha) {
         return undefined;
     return `${gate} approval lapsed — judged @${last.reviewed_sha.slice(0, 7)}, worktree now @${currentSha.slice(0, 7)} — re-gate to judge the current tree`;
 }
+// The owed evidence phase is a DERIVATION (row 85: a placeholder is honest only where
+// the CLI genuinely cannot know the answer). `evidenceForDiff` already computes
+// red/green/vacuous per tag on the way to the gate's own check — this reads that report
+// instead of printing the menu and making the caller resolve it.
+//
+// `verify-red` is preferred where a plain red probe is guaranteed vacuous: with the
+// implementation already written the suite passes as it stands, so the reconstructing
+// verb is the only one that can witness a genuine red.
+function evidenceRow(id, parentTag, files, report, seat) {
+    const base = { stage: 'implement', target: id, ...seat };
+    if (report === undefined) {
+        return {
+            line: `witness test-evidence ${id} --phase red`, ...base,
+            note: 'nothing changed yet — write the failing test first',
+        };
+    }
+    const owed = report.required
+        .filter((r) => !(r.red && r.green && !r.vacuous))
+        .map((r) => `${r.tag} ${!r.red || r.vacuous ? 'red' : 'green'}`)
+        .join(' · ');
+    const parent = report.required.find((r) => r.tag === parentTag);
+    const liveRed = parent !== undefined && parent.red && !parent.vacuous;
+    const line = !liveRed && files.some((f) => !isTestPath(f))
+        ? `witness verify-red ${id}`
+        : `witness test-evidence ${id} --phase ${liveRed ? 'green' : 'red'}`;
+    return { line, ...base, ...noteOf(owed === '' ? undefined : `evidence owed: ${owed}`) };
+}
+// One list for both readers. `flowAction` needs it to name an effort that can carry a plan
+// write, and `computeNext` has always built exactly this — a second derivation here is the
+// mistake rows 93 and 95 are both about.
+function liveEfforts(root) {
+    return effortStreams(root)
+        .map((slug) => ({ slug, entries: readStream(root, slug) }))
+        .filter((e) => latestRecap(root, e.slug) !== undefined && !effortAbandoned(e.entries))
+        .sort((a, b) => a.slug.localeCompare(b.slug));
+}
 // The action for ONE flow. A flow is a plan with status `in-progress`: it begins at
 // `witness start` and ends at the merge stamp. Anything else returns undefined and is
 // not a flow. Exported because `--flow` and the dashboard must answer with the SAME
@@ -94,22 +134,53 @@ export function flowAction(root, cfg, plan) {
         return { line: `witness start ${id}`, target: id, note: 'worktree missing — start recreates it' };
     if (plan.meta.pr !== undefined)
         return { line: `witness ship ${id}`, stage: 'ship', target: id, ...atRoot };
+    // Row 95: a reopen on this plan's OWN plan gate is routable motion — the plan is what
+    // needs re-authoring — and every reader was blind to it. Above the implement settle check
+    // on purpose: an implement gate settled against an earlier plan version must not carry
+    // the flow past a reopen saying the plan itself is wrong. Below the `pr` row on purpose
+    // too: a flow already at ship is answered by ship. No `home:` — plan authoring writes
+    // canon at the root, and this matches what computeNext's plans-first loop prints.
+    if (openReopen(entries, 'plan') !== undefined) {
+        const act = planWriteAction(root, liveEfforts(root), id, String(plan.meta.parent), id);
+        return { ...act, ...noteOf(act.note, 'plan gate reopened — re-author, then re-gate the plan') };
+    }
     const baseR = diffBase(wt, cfg);
     const files = baseR.ok ? changedFiles(wt, baseR.value) : [];
+    // Rows 95 + 96: the identity is the diff plus the plan's content, never the worktree, and
+    // it comes from the SAME derivation the implement gate keys on — deriving it here a second
+    // way is what made every settled gate read as lapsed. undefined means the base cannot be
+    // resolved — "cannot compute", never "moved", so a settled gate stays settled.
+    const diffSha = baseR.ok ? implementReviewedSha(wt, baseR.value, plan) : undefined;
+    // D93: the gate owns its deterministic checks; the router reads the verdict and never
+    // re-derives the predicate. Testing `evidence` in front of this is what made a human
+    // `--approve` invisible to the one verb the driving loop calls every turn — the
+    // journal said settled, `next` said test-evidence, and no error printed anywhere.
+    // Sha-sensitivity is load-bearing here: emptying the worktree after an approval moves
+    // the sha and re-arms the gate, which is why this keeps `diffSha` while
+    // `gates/ship.ts` deliberately omits it (row 92).
+    if (gateSettled(entries, 'implement', diffSha)) {
+        return { line: `witness ship ${id}`, stage: 'ship', target: id, ...atRoot };
+    }
     // evidenceForDiff is vacuously "satisfied" when nothing has changed yet (an empty
     // required-tags list trivially passes .every()) — a fresh worktree needs the
     // implement-stage hint too, not a premature jump to "gate implement".
-    const satisfied = files.length > 0 && baseR.ok && evidenceForDiff(wt, root, plan, baseR.value).satisfied;
-    if (!satisfied)
-        return { line: `witness test-evidence ${id} --phase red|green`, stage: 'implement', target: id, ...inWorktree };
-    const treeSha = worktreeTreeSha(wt);
-    if (!gateSettled(entries, 'implement', treeSha)) {
+    const report = baseR.ok && files.length > 0 ? evidenceForDiff(wt, root, plan, baseR.value) : undefined;
+    if (report === undefined || !report.satisfied) {
+        return evidenceRow(id, String(plan.meta.parent), files, report, inWorktree);
+    }
+    // D94: with the content unchanged the gate answers `changed-nothing` and appends
+    // nothing, so routing there returns this same line every turn. The revise asked for an
+    // edit — say that, and seat the session where the edit happens.
+    if (authoringOwed(entries, 'implement', diffSha)) {
         return {
-            line: `witness gate implement ${id}`, target: id, ...inWorktree,
-            ...noteOf(lapseNote(entries, 'implement', treeSha)),
+            line: `witness test-evidence ${id} --phase green`, stage: 'implement', target: id, ...inWorktree,
+            note: 'revise owed — edit the code in the worktree · re-run the evidence cycle · then re-gate',
         };
     }
-    return { line: `witness ship ${id}`, stage: 'ship', target: id, ...atRoot };
+    return {
+        line: `witness gate implement ${id}`, target: id, ...inWorktree,
+        ...noteOf(lapseNote(entries, 'implement', diffSha)),
+    };
 }
 // How far along a flow is — the drain order when several are actionable. Most-advanced
 // first is WIP-limiting, not cosmetic: it pushes flows toward merge instead of fanning
@@ -128,9 +199,16 @@ function flowRank(a) {
 // created). Such a flow is NOT tier-1 motion — offering it would loop the driving loop
 // on an action that only re-reports "awaiting decision", and would starve tier 2 of the
 // very decision that unblocks it.
-function flowBlocked(entries) {
-    return ['plan', 'implement', 'ship'].some((gate) => pendingDecision(entries, gate) !== undefined ||
-        (boundReached(entries, gate) && !gateSettled(entries, gate)));
+function flowBlocked(root, plan, entries) {
+    if (['plan', 'implement', 'ship'].some((gate) => pendingDecision(entries, gate) !== undefined ||
+        (boundReached(entries, gate) && !gateSettled(entries, gate))))
+        return true;
+    // Row 95's split: a reopen on the plan's own plan gate is NOT a block — flowAction routes
+    // it — but a reopen on the PARENT's decompose is, because that work belongs to the effort
+    // and tier 3 is where it surfaces. Keyed on the effort that owns the PARENT SPEC, which is
+    // where `decide --revise --upstream <spec>` books it.
+    const effort = effortOf(root, String(plan.meta.parent));
+    return effort !== undefined && openReopen(readStream(root, effort), 'decompose') !== undefined;
 }
 // Every human-owed decision in the repo, in the order tier 2 would surface them. One
 // source for both tiers: tier 2 takes the first, tier 1 rides them all in `note:`.
@@ -198,10 +276,7 @@ export function computeNext(root, ctx, canon, cfg) {
     if (canon.errors.length > 0 || canon.docs.some((d) => d.violations.length > 0)) {
         return { line: 'witness check' };
     }
-    const efforts = effortStreams(root)
-        .map((slug) => ({ slug, entries: readStream(root, slug) }))
-        .filter((e) => latestRecap(root, e.slug) !== undefined && !effortAbandoned(e.entries))
-        .sort((a, b) => a.slug.localeCompare(b.slug));
+    const efforts = liveEfforts(root);
     // Hoisted above tier 1: both doc lists are read by every tier below, and they used to
     // be declared interleaved between the pending-decision scans.
     const plans = canon.docs.filter((d) => d.meta.type === 'plan')
@@ -212,7 +287,7 @@ export function computeNext(root, ctx, canon, cfg) {
     // on a human decision belonging to a DIFFERENT flow: ship always stops (gates/ship.ts),
     // so a global decision-halt freezes every other flow at the first ship gate.
     const flows = plans
-        .filter((plan) => !flowBlocked(readStream(root, String(plan.meta.id))))
+        .filter((plan) => !flowBlocked(root, plan, readStream(root, String(plan.meta.id))))
         .map((plan) => flowAction(root, cfg, plan))
         .filter((a) => a !== undefined)
         .sort((a, b) => flowRank(b) - flowRank(a) || String(a.target).localeCompare(String(b.target)));

package/dist/verbs/write.js

@@ -225,7 +225,7 @@ export async function run(ctx, argv) {
         ctx.out(kv('written', id));
         ctx.out(kv('path', rel));
         ctx.out(kv('sha', short(sha)));
-        ctx.out(kv('status', 'draft'));
+        ctx.out(kv('status', String(built.meta.status)));
         ctx.out('next: witness check · witness index');
         return EXIT.OK;
     }
@@ -288,10 +288,29 @@ function buildPlanMeta(root, id, manifest, recap, canon, existing, body) {
             designFrom = stamp.sha;
         }
     }
+    // Row 95: a plan's lifecycle status is not re-derived by re-authoring it. `flowAction`
+    // now routes an in-flight plan's plan-gate reopen HERE, and a hardcoded `draft` would
+    // demote a plan that holds a `pr` and a live worktree out of flow-hood — `flowAction`,
+    // `flowBlocked`, `dashboard` and `--flow` would all lie about it for a window. Stated
+    // rather than hidden: `in-progress` no longer implies a settled plan gate. Plan-only —
+    // a re-authored SPEC still returns to draft.
+    //
+    // The rule is PRESERVE AN IN-FLIGHT STATUS, and the two terminal statuses part ways
+    // because only one of them is history. `done` refuses: that plan merged, and re-authoring
+    // it would rewrite what shipped. `abandoned` returns to `draft`, because row 85's recovery
+    // IS re-authoring an abandoned plan under a live effort — `abandon <effort>` stamps the
+    // effort's plans abandoned, `next` then names a live effort to carry the write, and
+    // refusing here would strand the very loop row 85 unstranded. A revived plan is new work,
+    // so it re-enters the ladder at draft rather than keeping a status it no longer has.
+    const existingStatus = existing ? String(existing.meta.status) : 'draft';
+    if (existingStatus === 'done') {
+        violations.push(v('status', 'terminal-status', existingStatus, 'a plan that has not merged — a done plan is superseded by a new plan, never re-authored'));
+    }
+    const priorStatus = existingStatus === 'abandoned' ? 'draft' : existingStatus;
     const meta = {
         id,
         type: 'plan',
-        status: 'draft',
+        status: priorStatus,
         parent: parentId,
         'derives-from': computed,
         ...(designFrom !== undefined ? { 'design-from': designFrom } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.
@@ -43,4 +43,4 @@ Every turn is `witness next`, read, act on the first matching row, repeat:
 - An exit 2/3 you cannot mechanically satisfy — `needs-unmet` (show the human `witness satisfy <id> --need <text>`), `slug-reuse`, lock contention, calibration floor stops under `--manual`.
 - A skill ended its turn for a gate stop — that stop is yours too; do not restart the loop until the human decides.
 
-**Never merge a PR** — merging is the human's act on GitHub; the lazy stamp finishes the lifecycle on the next scan. **Never edit `specs/` or `plans/`** (or wherever the repo's `paths:` config relocates them) — that is what the skills' write path is for. If the dashboard warns the reviewer model is uncalibrated, surface the warning; under `--manual` treat it as a stop.
+**Never merge a PR** — merging is the human's act on GitHub; the lazy stamp finishes the lifecycle on the next scan. **Never edit `specs/` or `plans/`** (or wherever the repo's `paths:` config relocates them) — that is what the skills' write path is for. Run `$WITNESS status` — the orientation screen (flows, blocked docs, reconcile rows, pending gates) — when you need position rather than the next action; bare `$WITNESS` prints the same screen. If it reports the reviewer model is uncalibrated, surface that; under `--manual` treat it as a stop.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**` or `plans/**`** (the canon dirs — `paths:` in witness.config.yaml may relocate them) — not with an edit tool, not with a write tool, not with Bash redirection. The CLI is the sole writer of state; you author in scratch files under `$(mktemp -d)` and hand them to the CLI. (The canon guard blocks you; the trailer audit catches what it can't.)

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**` or `plans/**`** (the canon dirs — `paths:` in witness.config.yaml may relocate them) — not with an edit tool, not with a write tool, not with Bash redirection. The CLI is the sole writer of state; you author in scratch files under `$(mktemp -d)` and hand them to the CLI. (The canon guard blocks you; the trailer audit catches what it can't.)

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**`, `plans/**`, or `designs/**`** — the CLI is the sole writer of state. Author HTML in `$(mktemp -d)` and hand it to `witness design`. (The canon guard blocks direct edits; the trailer audit catches end-runs.)

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**` or `plans/**`** (the canon dirs — `paths:` in witness.config.yaml may relocate them) — not with an edit tool, not with a write tool, not with Bash redirection. The CLI is the sole writer of state; you author in scratch files under `$(mktemp -d)` and hand them to the CLI. (The canon guard blocks you; the trailer audit catches what it can't.)
@@ -48,6 +48,8 @@ Protocol per step, in order — red/green/refactor with witnessed evidence:
 6. Early exit: if you exceed **~15 inner-loop iterations** inside one step, or you have left the step's scope to fight infrastructure, the economy is to relay — finish the red→green you are in (never stop mid-red), report, and relay so a fresh context continues. Exceeding your slice is never the right economy.
 7. Fat artifacts (the living designs/<spec>.html, long docs) are read **by section** — grep for the anchors/ids you need, then read those offsets — never whole into your context; you would re-pay their tokens on every subsequent request.
 
+**Tests you did not come to change.** When a step makes you edit a test file tagged for a spec other than your parent — a shared fixture, a helper, a suite-wide rename — you owe that spec **green now**, never a red→green pair: `red` means you observed the behavior missing before you built it, and you are not building that spec. The gate's `regression` check runs those specs' tagged tests and fails if any is red. Fix them in the worktree; never journal evidence under a tag this plan does not own, and never weaken the foreign test to pass.
+
 UI work TDDs at the browser, end-to-end: when a step changes what the browser renders or how the user interacts with it (markup, styles, routes, client-side behavior), the failing test in step 1 is a **Puppeteer** test driving the real UI **through the whole slice** — headless, tagged in its NAME like any test, living in the repo's regular suite so the criteria runner reaches it (Puppeteer is a library, not a runner — a test the runner can't reach has unwitnessable evidence). Everything the repo owns runs real: the test owns the slice's lifecycle — build, boot the backend and its store, serve the frontend; never assume a running dev server (evidence runs in a clean worktree) — but inside your own inner loop, keep the app server alive across iterations where the harness allows; the per-run floor is boot + compile, not test time. Fake only what the repo does not own (third-party services). Stubbing the slice's own backend — request interception, mocked fetch, canned API fixtures — turns the test UI-only, and the implement gate's pr-test lens flags it like any substitution. Unit/component tests may accompany a browser test, never replace it.
 
 **Capture the screens you build.** When `$WITNESS_SCREENS_DIR` is set (the CLI exports it during `test-evidence`), the browser test writes a named PNG per screen-level moment the step produces — `$WITNESS_SCREENS_DIR/<name>.png` via the driver's screenshot call. Name captures for the moments a reviewer must see, not every frame: `initial` (screen as it opens), `filled` (primary inputs populated), `error` (a validation/error state the slice can reach), `success` (the post-action confirmation). One capture per meaningful state; skip states the step doesn't touch. Guard the writes on the env var so the same test screenshots nothing during the gate's own drift lane. These captures are the design-reviewer's evidence — `test-evidence` witnesses a sha per PNG, and at the gate a **vision `design-reviewer`** (feature and fix batteries, only when the plan pins a `design-from` design) judges them against the repo's `docs.design` canon and the approved `designs/<spec>.html` look. A UI plan that witnesses zero captures is refused `screens-matched-nothing` before any reviewer runs — a screen with no screenshot has unwitnessable design evidence, exactly as a browser test outside the runner has unwitnessable behavior evidence.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**` or `plans/**`** (the canon dirs — `paths:` in witness.config.yaml may relocate them) — not with an edit tool, not with a write tool, not with Bash redirection. The CLI is the sole writer of state; you author in scratch files under `$(mktemp -d)` and hand them to the CLI. (The canon guard blocks you; the trailer audit catches what it can't.)

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.5.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.6.0}"
 ```
 
 - **Never edit `specs/**` or `plans/**`** (the canon dirs — `paths:` in witness.config.yaml may relocate them) — not with an edit tool, not with a write tool, not with Bash redirection. The CLI is the sole writer of state; you author in scratch files under `$(mktemp -d)` and hand them to the CLI. (The canon guard blocks you; the trailer audit catches what it can't.)