@renzrollon/interlock 1.4.2 → 1.5.0

package/lib/verify.mjs

@@ -87,7 +87,7 @@ export const SKIP_REASONS = {
   NO_COMMAND: 'no-detectable-command',
   /** The failures were already red before this change touched anything. */
   PRE_EXISTING: 'failures-are-pre-existing',
-  /** `LIMITS.interWaveVerifyBudgetMs` spent; only typecheck still runs. */
+  /** The inter-wave verify budget the caller passed is spent; only typecheck still runs. */
   BUDGET_EXCEEDED: 'verify-budget-exceeded',
   /** `e2e.enabled` is false in the profile. */
   E2E_DISABLED: 'e2e-not-enabled',
@@ -180,6 +180,37 @@ function step(kind, command, extra = {}) {
   }
 }
 
+
+/**
+ * The inter-wave verify budget for a run, derived from its test profile.
+ *
+ * `unit.timeout_ms` is the profile's allowance for one suite run; a run may
+ * spend at most `LIMITS.interWaveVerifications` checkpoints, so the allowance
+ * for the checkpoints the cap already permits is their product. The published
+ * `LIMITS.interWaveVerifyBudgetMs` is a floor: a profile can only raise the
+ * budget, never buy less verification with a small timeout. `source` says which
+ * one the budget came from, and `timeoutMs` is the profile's value when it was
+ * usable (null when it was not), so a budget left at the floor because the
+ * profile said nothing reads differently from one left there because the
+ * profile's own allowance is small.
+ *
+ * `planVerification` is deliberately untouched: its callers pass `budgetMs`.
+ *
+ * @param {object|null} profile parsed `.claude/testing/profile.json`, or null
+ * @returns {{ms: number, source: 'profile'|'published', timeoutMs: number|null}}
+ */
+export function interWaveVerifyBudget(profile) {
+  const unit = isObject(profile) && isObject(profile.unit) ? profile.unit : {}
+  const timeoutMs =
+    Number.isSafeInteger(unit.timeout_ms) && unit.timeout_ms > 0 ? unit.timeout_ms : null
+  if (timeoutMs === null) {
+    return { ms: LIMITS.interWaveVerifyBudgetMs, source: 'published', timeoutMs: null }
+  }
+  const derived = Math.min(LIMITS.interWaveVerifications * timeoutMs, Number.MAX_SAFE_INTEGER)
+  if (derived > LIMITS.interWaveVerifyBudgetMs) return { ms: derived, source: 'profile', timeoutMs }
+  return { ms: LIMITS.interWaveVerifyBudgetMs, source: 'published', timeoutMs }
+}
+
 /**
  * Decide which verification commands should run for this change.
  *

package/lib/waves.mjs

@@ -1587,9 +1587,16 @@ export const HALT_INTER_WAVE_VERIFY = 'inter-wave-verify'
 // report — and a reconstruction cannot be validated, bounded or refused.
 //
 // So it is a schema with a character cap, and it fails closed. A packet that is
-// missing, malformed or over budget fails its task; it is never truncated and
-// never passed through as prose for the next wave to interpret. Truncation is
-// the exact silent degradation this replaces.
+// missing, malformed or over budget is REJECTED: it is never truncated and never
+// passed through as prose for the next wave to interpret. Truncation is the
+// exact silent degradation this replaces.
+//
+// What a rejection does to the task is decided by the task's own claim. A task
+// that reported failure stays failed with its own reason. A task that reported
+// success stays done: the packet's shape was never evidence of work, and the
+// work is already in the tree. The rejection is recorded on its own
+// (`rejectedReports`), never counted toward the task-failure halt, and the next
+// wave is told the task filed no usable report.
 
 /** Version tag on every stored packet, so a later shape change is detectable. */
 export const HANDOFF_SCHEMA = 'interlock.wave-handoff/1'
@@ -1600,6 +1607,18 @@ const HANDOFF_STATUSES = new Set(['ok', 'blocked', 'partial'])
 const EVIDENCE_LOCATOR = /^[^\s:]+(:\d+(-\d+)?)?$/
 const MAX_EVIDENCE = 8
 
+// An agent-supplied value quoted inside a rejection reason. The reason travels
+// — to the banner, the run state, the next wave's briefing and the review — so
+// the quote is a short single-line diagnostic: JSON-escaped, so a newline in it
+// cannot break the line it is printed on, and clipped, so a pasted file body
+// cannot ride along as "the reason".
+const MAX_ECHO = 160
+
+function echo(value) {
+  const text = JSON.stringify(value) ?? String(value)
+  return text.length > MAX_ECHO ? `${text.slice(0, MAX_ECHO - 1)}…` : text
+}
+
 function handoffError(reason) {
   return { ok: false, error: reason }
 }
@@ -1622,16 +1641,16 @@ export function validateHandoff(taskId, packet) {
   // version is different — that is a packet written against another contract.
   const schema = packet.schema === undefined ? HANDOFF_SCHEMA : packet.schema
   if (schema !== HANDOFF_SCHEMA) {
-    return handoffError(`unknown handoff schema "${schema}" (expected ${HANDOFF_SCHEMA})`)
+    return handoffError(`unknown handoff schema ${echo(String(schema))} (expected ${HANDOFF_SCHEMA})`)
   }
 
   if (typeof packet.taskId !== 'string' || packet.taskId !== taskId) {
-    return handoffError(`taskId must be "${taskId}", got ${JSON.stringify(packet.taskId)}`)
+    return handoffError(`taskId must be "${taskId}", got ${echo(packet.taskId)}`)
   }
 
   if (!HANDOFF_STATUSES.has(packet.status)) {
     return handoffError(
-      `status must be one of ${[...HANDOFF_STATUSES].join('|')}, got ${JSON.stringify(packet.status)}`
+      `status must be one of ${[...HANDOFF_STATUSES].join('|')}, got ${echo(packet.status)}`
     )
   }
 
@@ -1657,7 +1676,7 @@ export function validateHandoff(taskId, packet) {
   for (const entry of evidence) {
     if (typeof entry !== 'string' || !EVIDENCE_LOCATOR.test(entry)) {
       return handoffError(
-        `evidence entry ${JSON.stringify(entry)} is not a locator (path, path:line or path:start-end)`
+        `evidence entry ${echo(entry)} is not a locator (path, path:line or path:start-end)`
       )
     }
   }
@@ -2147,6 +2166,7 @@ export function nextStep(state) {
     tasks: wave.batches[batchIndex],
     remainingBatches: wave.batches.slice(batchIndex),
     previousHandoffs: previousWaveHandoffs(state, waveIndex),
+    ...rejectedReportsField(state, waveIndex),
     // The wave's changed-file set, canonically deduplicated. A caller that
     // fuses the inter-wave verify plan into the record-batch ping (ship.js
     // does) needs it here, and recomputing it from raw `task.paths` is how
@@ -2189,6 +2209,91 @@ function previousWaveHandoffs(state, waveIndex) {
   return out
 }
 
+/**
+ * The tasks of the wave immediately before this one that claimed success and
+ * filed no usable report, with the reason and what they said they touched.
+ *
+ * Same scope as `previousWaveHandoffs`, for the same reason. The rejected
+ * packet's own text is never carried: that would be truncation by another name.
+ * Paths come from `reportedPaths`, the task's own report of what it touched.
+ *
+ * @returns {Array<{taskId: string, reason: string, paths: string[], pathsOmitted?: number}>}
+ */
+function previousWaveRejectedReports(state, waveIndex) {
+  const previous = state.waves[waveIndex - 1]
+  if (!previous) return []
+  const rejected = Array.isArray(state.rejectedReports) ? state.rejectedReports : []
+  const reported =
+    state.reportedPaths && typeof state.reportedPaths === 'object' ? state.reportedPaths : {}
+  const ids = new Set(waveTasks(previous).map(t => t.id))
+  const out = []
+  for (const r of rejected) {
+    if (!r || !ids.has(r.id)) continue
+    out.push(rejectedReportEntry(r, reported))
+  }
+  return out
+}
+
+/**
+ * One rejected report as it is handed on: the task, the short reason, and the
+ * paths the task said it touched.
+ *
+ * A rejected report must not hand its reader more than a valid packet may. The
+ * reason is the short adjudication reason. The paths are the task's own
+ * unvalidated strings, so they are listed only while each is a single line and
+ * the list still fits the published handoff cap; whatever is left out is
+ * counted, never dropped in silence. `pathsOmitted` is present only when
+ * something was left out, so an entry that fits is what it always was.
+ */
+function rejectedReportEntry(record, reported) {
+  const claimed = Array.isArray(reported[record.id]) ? reported[record.id] : []
+  const paths = []
+  let used = 0
+  let full = false
+  for (const p of claimed) {
+    if (full || typeof p !== 'string' || /[\r\n]/.test(p)) continue
+    if (used + p.length > LIMITS.maxHandoffChars) {
+      // The first path that does not fit closes the list: what is shown is a
+      // prefix of what was reported, not whichever entries happened to be short.
+      full = true
+      continue
+    }
+    paths.push(p)
+    used += p.length
+  }
+  const entry = {
+    taskId: record.id,
+    reason: shortReason(record.reason) || 'handoff rejected',
+    paths
+  }
+  if (paths.length < claimed.length) entry.pathsOmitted = claimed.length - paths.length
+  return entry
+}
+
+/**
+ * Every rejected report of the run, in the order they were recorded.
+ *
+ * For a reader that sees the whole change at once — the review — rather than
+ * one wave's successor. A wave with no later wave has nobody else to tell.
+ *
+ * @returns {Array<{taskId: string, reason: string, paths: string[], pathsOmitted?: number}>}
+ */
+export function runRejectedReports(state) {
+  const rejected = state && Array.isArray(state.rejectedReports) ? state.rejectedReports : []
+  const reported =
+    state && state.reportedPaths && typeof state.reportedPaths === 'object' ? state.reportedPaths : {}
+  return rejected
+    .filter(r => r && typeof r.id === 'string')
+    .map(r => rejectedReportEntry(r, reported))
+}
+
+// Present on the step only when non-empty, so a step for a run that rejected
+// nothing is byte-identical to one produced before the field existed.
+function rejectedReportsField(state, waveIndex) {
+  const list = previousWaveRejectedReports(state, waveIndex)
+  return list.length ? { previousRejectedReports: list } : {}
+}
+
 // Groups a replan may still touch: implementation waves at or after the first
 // index the cursor has not committed to, minus anything already executed.
 function firstMutableIndex(state) {
@@ -2248,14 +2353,18 @@ function normalizeTaskResults(result) {
       }
     }
 
-    // Claiming success is what obliges a report. Fail closed.
+    // Claiming success is what obliges a report, and a report that cannot be
+    // used is rejected rather than passed on. The task keeps its own claim: the
+    // packet's shape says nothing about the work, which is already in the tree.
+    // The rejection is carried beside the success, not in place of it.
     if (!checked.ok) {
       return {
         id: t.id,
-        ok: false,
-        error: `invalid handoff: ${checked.error}`,
+        ok: true,
+        error,
         filesChanged,
-        handoff: null
+        handoff: null,
+        reportRejected: checked.error
       }
     }
     return { id: t.id, ok: true, error, filesChanged, handoff: checked.handoff }
@@ -2298,6 +2407,7 @@ export function recordBatchResult(state, result, opts = {}) {
   // initialized, never treated as malformed. (design.md — Migration Plan.)
   if (!next.reportedPaths || typeof next.reportedPaths !== 'object') next.reportedPaths = {}
   if (!next.evidenceAudits || typeof next.evidenceAudits !== 'object') next.evidenceAudits = {}
+  if (!Array.isArray(next.rejectedReports)) next.rejectedReports = []
 
   // Resolved once per batch: git's answer is about the working tree, not about
   // one task, so asking it per task would be the same answer at a higher cost
@@ -2319,8 +2429,19 @@ export function recordBatchResult(state, result, opts = {}) {
         { source: observed.length ? 'observed' : 'reported', reportedPaths: t.filesChanged }
       )
     }
-    if (t.ok) next.completed.push(t.id)
-    else {
+    if (t.ok) {
+      next.completed.push(t.id)
+      if (typeof t.reportRejected === 'string') {
+        next.rejectedReports.push({
+          id: t.id,
+          wave: wave.group,
+          waveKind: wave.kind,
+          // Capped where it is stored, so every reader of the record holds a
+          // short adjudication reason and none of them a transcript.
+          reason: shortReason(t.reportRejected) || 'handoff rejected'
+        })
+      }
+    } else {
       next.failures.push({
         id: t.id,
         wave: wave.group,
@@ -2393,8 +2514,9 @@ export function recordBatchResult(state, result, opts = {}) {
 // What a batch recorded
 // ---------------------------------------------------------------------------
 //
-// `recordBatchResult` already adjudicates every task — an invalid or oversized
-// packet fails it, a lane result missing an outcome fails the whole lane — and
+// `recordBatchResult` already adjudicates every task — a task that claimed
+// success with an unusable packet is done with its report rejected, a lane result
+// missing an outcome fails the whole lane — and
 // then tells its caller nothing but the next action. So a caller learned what
 // to do next and never learned what had just been decided, and both ship hosts
 // ticked checkboxes and counted waves from the agent's own claim instead. That
@@ -2404,7 +2526,11 @@ export function recordBatchResult(state, result, opts = {}) {
 // describes one batch, and a durable field holding it would be read as current
 // by a run resumed a day later.
 
-/** A task the batch recorded as done. */
+/**
+ * A task the batch recorded as done. When its handoff packet was unusable the
+ * outcome still reads ok and carries `reportRejected` beside it: the task's
+ * claim and its record agree, and the rejection is a fact about the report.
+ */
 export const OUTCOME_OK = 'ok'
 /** A task the batch adjudicated as failed, with the reason it was failed for. */
 export const OUTCOME_FAILED = 'failed'
@@ -2447,7 +2573,8 @@ function plannedBatchIds(state) {
  *
  * @param {object} before the state passed to `recordBatchResult`
  * @param {object} after the state it returned
- * @returns {Array<{id: string, outcome: string, reason?: string}>} this batch's
+ * @returns {Array<{id: string, outcome: string, reason?: string,
+ *   reportRejected?: string}>} this batch's
  *   outcomes only — never the run's accumulated history. Ordered by the plan,
  *   with anything recorded that the plan did not name appended after it.
  */
@@ -2457,9 +2584,21 @@ export function batchOutcomes(before, after) {
   const completed = after && Array.isArray(after.completed) ? after.completed.slice(prevCompleted) : []
   const failures = after && Array.isArray(after.failures) ? after.failures.slice(prevFailures) : []
 
+  const prevRejected =
+    before && Array.isArray(before.rejectedReports) ? before.rejectedReports.length : 0
+  const rejected = new Map()
+  for (const r of after && Array.isArray(after.rejectedReports) ? after.rejectedReports.slice(prevRejected) : []) {
+    if (r && typeof r.id === 'string') rejected.set(r.id, shortReason(r.reason))
+  }
+
   const outcomes = new Map()
   for (const id of completed) {
-    if (typeof id === 'string') outcomes.set(id, { id, outcome: OUTCOME_OK })
+    if (typeof id !== 'string') continue
+    const reportRejected = rejected.get(id)
+    outcomes.set(
+      id,
+      reportRejected ? { id, outcome: OUTCOME_OK, reportRejected } : { id, outcome: OUTCOME_OK }
+    )
   }
   for (const f of failures) {
     if (!f || typeof f.id !== 'string') continue
@@ -2664,6 +2803,7 @@ function summarize(state) {
     waves: state.waves.length,
     tasksCompleted: state.completed.length,
     taskFailures: state.failures.length,
+    reportsRejected: Array.isArray(state.rejectedReports) ? state.rejectedReports.length : 0,
     replansUsed: state.replansUsed,
     unresolved: state.unresolved,
     skippedVerifications: state.skippedVerifications,
@@ -2708,10 +2848,12 @@ export function formatRunState(state) {
   requireState(state)
   const step = nextStep(state)
   const lines = []
+  const reportsRejected = Array.isArray(state.rejectedReports) ? state.rejectedReports.length : 0
   lines.push(
     `run: ${state.completed.length} task(s) done, ${state.failures.length} failed ` +
       `(halts above ${LIMITS.taskFailureHalt}), ` +
-      `${state.replansUsed}/${LIMITS.replansPerRun} replans used`
+      `${state.replansUsed}/${LIMITS.replansPerRun} replans used` +
+      (reportsRejected > 0 ? `, ${reportsRejected} report(s) rejected` : '')
   )
   lines.push(`  next: ${describeStep(step)}`)
   for (const f of state.failures) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@renzrollon/interlock",
-  "version": "1.4.2",
-  "description": "Autonomous spec-driven development orchestration for Claude Code, layered on OpenSpec",
+  "version": "1.5.0",
+  "description": "Spec-driven development for Claude Code, layered on OpenSpec. You read one spec; parallel agents ship it to a tested commit.",
   "type": "module",
   "engines": {
     "node": ">=18"

package/shared/TEST-PROFILE.md

@@ -67,7 +67,7 @@ the profile.
 | `single_file` | How to run one file (string with path implied, or template) |
 | `env` | Extra env vars required for a green run (not secrets — names/placeholders only) |
 | `prerequisites` | Human-readable setup steps (dev server, seeded DB, `npx playwright install`, …) |
-| `timeout_ms` | Soft budget for one full suite run; do not raise to mask races |
+| `timeout_ms` | Soft budget for one full suite run; do not raise to mask races. The ship run's inter-wave verify budget is derived from `unit.timeout_ms` (floored at the published budget); `interlock verify plan --context inter-wave --json` prints the result |
 | `coverage.enabled` | Whether a coverage command is known. `false` = not configured (never an error) |
 | `coverage.command` | Full shell command that produces a coverage report (e.g. `npm run coverage`) |
 | `coverage.report_path` | Where the report lands, relative to `unit.cwd` (`coverage/lcov.info`, `coverage/coverage-summary.json`, …) |

package/skills/bootstrap/SKILL.md

@@ -32,21 +32,28 @@ This is archaeology, not design. Every spec you write describes behavior that ex
 test -f openspec/config.yaml || openspec init --tools claude
 
 # Build the structural graph once — it seeds every explorer below.
-# Never swallow the outcome: stderr stays visible, and both failure modes
-# (build errored / nothing indexable) get a banner.
+# Never swallow the outcome: stderr stays visible, and every way the graph can
+# come back less than whole (build errored / nothing readable / nothing
+# indexable / some paths unreadable) gets a banner.
 graph_log=$(interlock-graph build .)
 graph_status=$?
 printf '%s\n' "$graph_log"
 if [ "$graph_status" -ne 0 ]; then
   echo "GRAPH UNAVAILABLE: build errored (exit $graph_status) — explorers fall back to grep and will be slower"
+elif printf '%s' "$graph_log" | grep -q 'nothing indexable under the root could be read'; then
+  echo "GRAPH UNAVAILABLE: nothing under the root could be read — explorers fall back to grep and will be slower"
 elif printf '%s' "$graph_log" | grep -q 'nodes=0'; then
   echo "GRAPH UNAVAILABLE: nothing indexable found — explorers fall back to grep and will be slower"
+elif printf '%s' "$graph_log" | grep -q 'skipped='; then
+  echo "GRAPH PARTIAL: some paths were unreadable and are not in the graph (each is named above as GRAPH SKIPPED UNREADABLE) — a missing edge for one of them is not evidence of absence"
 fi
 ```
 
 **A graph failure is not a stop.** Bootstrap works without it — docs and OpenSpec indexing still happen — so print the banner, carry it to the final report, and continue with degraded expectations: the explorers grep instead of following edges, and they are slower for it.
 
-`nodes=0` is the ordinary case for a repo the graph doesn't structurally index (Go, Rust, Java, Ruby — structural indexing covers JavaScript/TypeScript, Python and shell). Say which of the two reasons applied rather than presenting either as a defect.
+**A partial graph is not a failure, and not a whole graph either.** `interlock-graph build` exits 0 when it meets a path it cannot read: it skips the path, names it on stderr as `GRAPH SKIPPED UNREADABLE: <path> (<code>)`, and ends its summary line in `skipped=<n>`. The exit code alone no longer tells you the graph is complete. The explorers still follow edges, but nothing about a skipped path is in the graph, so tell them which paths those were and have them `Read` or grep there instead of trusting an empty result.
+
+`nodes=0` is the ordinary case for a repo the graph doesn't structurally index (Go, Rust, Java, Ruby — structural indexing covers JavaScript/TypeScript, Python, shell, C# (`.cs`, `.csproj`) and Bicep (`.bicep`)). Say which reason applied — an unsupported language, or a tree that could not be read — rather than presenting either as a defect.
 
 When the build did produce a graph, **read `.claude/graph/GRAPH_REPORT.md` before spawning anything**. Its hub nodes and module boundaries tell the explorers where to look, so they don't rediscover the tree from scratch.
 
@@ -159,7 +166,7 @@ Fill in the project context in `openspec/config.yaml` with what was discovered
 
 ## 6. REPORT
 
-- Any `GRAPH UNAVAILABLE: <reason> — explorers fall back to grep and will be slower` banner from pre-flight, repeated verbatim. If the graph built, say so in one line instead — a report that mentions neither reads like a graph-backed run that never happened.
+- Any `GRAPH UNAVAILABLE: <reason> — explorers fall back to grep and will be slower` banner from pre-flight, repeated verbatim. A `GRAPH PARTIAL` banner is repeated verbatim too, followed by the paths the build named as `GRAPH SKIPPED UNREADABLE`. If the graph built whole, say so in one line instead — a report that mentions none of these reads like a graph-backed run that never happened.
 - Architecture doc path and what it covers
 - Specs created, and specs skipped because they already existed
 - Features deliberately not specced, with the reason

package/skills/fix-tests/SKILL.md

@@ -109,6 +109,7 @@ Run the full suite again, then assert against the baseline:
 ## 7. Persist
 
 - Refresh `.claude/testing/profile.json` (`updated`, `known_flaky`, `notes`) with anything learned about running tests. Preserve every key you did not resolve yourself.
+- After a green **full** unit run, record `unit.timeout_ms` as that run's wall time in whole milliseconds, rounded up — a JSON integer, never seconds, a decimal or a string, any of which either aborts verification planning or reads as a far smaller allowance. Never write a value below a wall time you measured: a ship run derives its inter-wave verify budget from this field, and a value under the real runtime makes every checkpoint skip the suite. Do not apply a multiplier and do not copy a number from elsewhere — the measured time is the input.
 - Confirm the `## Testing` block is still a single idempotent pair of markers.
 - Write at most **3** `.claude/memory/failure-modes/<slug>.md` entries for genuinely recurring gotchas, with index lines in `.claude/memory/MEMORY.md`. One-off typos do not belong in memory.
 - Write `.claude/metrics/fix-tests-<YYYYMMDD-HHMMSS>.json` with the baseline, final counts, clusters, fixes applied, and anything unresolved.

package/skills/graph/SKILL.md

@@ -14,10 +14,21 @@ metadata:
 
 Build and query a **local, deterministic** codebase knowledge graph. No vector store, no external service, no network.
 
-**What gets indexed:** JS/TS, Python (`.py`/`.pyi`), shell (`.sh`/`.bash`), and curated small config JSON (`package.json`, `tsconfig*.json` — not lockfiles). Markdown stays on the bounded-retrieval path (`DOCS_DIGEST.md` / `context` / `docs`) plus the OpenSpec overlay — never dump every `*.md` into `graph.json`.
+**What gets indexed:** JS/TS, Python (`.py`/`.pyi`), shell (`.sh`/`.bash`), C# (`.cs`, and `.csproj` project references), Bicep (`.bicep`), and curated small config JSON (`package.json`, `tsconfig*.json` — not lockfiles). Markdown stays on the bounded-retrieval path (`DOCS_DIGEST.md` / `context` / `docs`) plus the OpenSpec overlay — never dump every `*.md` into `graph.json`.
 
 Languages outside that set (Go, Rust, Java, Ruby) are **not** structurally indexed: you still get the docs and OpenSpec overlays, but no import/symbol edges. Say so plainly rather than implying the graph is complete.
 
+**C# is inferred, not resolved.** A `.csproj` `ProjectReference` is an `EXTRACTED` project-to-project edge. A C# type reference and a test-to-type link are `INFERRED`: they come from identifier matching against the namespaces a file can see, not from a compiler. Treat them as hints to verify. Four limits are known and not worked around:
+
+- A type named only by its fully-qualified name, with no `using`, is not seen.
+- `global using` applies to the file that holds it, not to its project.
+- A nested type is a symbol with no record of its nesting.
+- A declaration-shaped line inside a verbatim or raw string literal is a false positive.
+
+**Unreadable paths do not stop a build.** A file or directory the build cannot read is skipped, and each one is named on stderr as `GRAPH SKIPPED UNREADABLE: <path> (<code>)`. `build` and `update` still finish and exit 0; the summary line carries `skipped=<n>` and `GRAPH_REPORT.md` lists the paths under a "Not indexed" heading. Report those paths to the user rather than treating the graph as complete.
+
+**A query says when its graph is partial.** `query`, `consumers`, `path`, `explain` and `context` print one line on stderr, `GRAPH PARTIAL: <n> path(s) were unreadable when this graph was built…`, whenever the graph they read was built past skipped paths. Their stdout and exit code are unchanged. When you see it, an empty or short answer is not evidence about the skipped paths: read `GRAPH_REPORT.md` for which they are, then `Read` or grep those paths directly before claiming a symbol has no other consumers.
+
 **Artifacts, all project-local under `.claude/graph/`:**
 
 | Path | Role |

package/workflows/ship.js

@@ -164,7 +164,8 @@ const RUNAWAY_BACKSTOP = 1000
 // file whose first line carries its sha256; this script hands the worker the
 // path and requires the hash back. A result whose `briefing` is absent or
 // differs is treated as a null result — the task fails closed with a named
-// reason, exactly as a missing handoff packet does.
+// reason. (A missing handoff packet no longer does: that task stays done and its
+// report is rejected.)
 //
 // This text is plumbing, not policy: it names a file and a field and says
 // nothing whatsoever about the work. It is pinned against