@sylad/cadence 0.6.0 → 0.8.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.6.0",
+      "version": "0.8.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -25,8 +25,23 @@ reports a page left empty or in error.
   Your comments and hand edits are preserved.
 - A commit belongs to a lot when its message cites the id: `feat(L3): …`,
   `fix: L3/t1 …`. The link is **computed from `git log`**, never stored, so
-  committing never dirties the plan.
+  committing never dirties the plan. The id is read as a whole word: `XL3`,
+  `L3x` and `L3.4` do not cite `L3`, while `L3.` at the end of a sentence does.
+  When the subject has a scope that cites lots (`feat(L3): …`,
+  `chore(L31,L32): …`), **the scope alone decides**: a passing mention
+  (`page équipe (L27)`), a range (`L28–L31`, `L45 à L48`) or the body does not
+  count. Without a scope citing a lot, the whole message is read as before.
 - `raf check` audits drift between the plan and the history.
+- Plan upkeep needs no lot. A commit is plan upkeep when **every file it
+  touches is a plan file**: the plan itself, its Gantt page (only at its default place, `gantt.html` next to the plan — written elsewhere with `raf gantt -o`, declare it under `plan.files`), the `plan:` key of the config file in use (`cadence.yaml`, or
+  the `--config` file; a change to `deliver:`/`session:` is work), or a file the
+  project lists under `plan.files` in `cadence.yaml` (a page it generates from
+  the plan, a journal). Such a commit is never a "commit without a lot", and it
+  does not count as work on the lots it cites: it is absent from `raf commits`,
+  does not start a `todo` lot, does not make a code review stale, and
+  `cadence deliver` does not announce the lots it cites as delivered. The files
+  decide, never the subject: a `chore(plan): …` commit that touches a source
+  file is a commit like any other.
 - `raf gantt` writes a single self-contained HTML page (no server, no CDN).
 
 ```sh
@@ -56,7 +71,7 @@ raf gantt                         # docs/plan/gantt.html
 | `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first |
 | `raf now` | what to do next |
 | `raf list [--status s]` | flat list |
-| `raf check [--since date] [--idle 7]` | since the plan's adoption date by default: commits without a lot (commits touching only the plan are exempt), unknown ids, `todo` lots that already have commits, idle lots, `done` lots with open sub-tasks, bad or circular dependencies |
+| `raf check [--since date] [--idle 7]` | since the plan's adoption date by default: commits without a lot (commits touching only plan files are exempt), unknown ids, `todo` lots that already have commits, idle lots, `done` lots with open sub-tasks, bad or circular dependencies |
 | `raf gantt [-o file]` | standalone Gantt page |
 | `raf hook install` | add the (non-blocking, read-only) post-commit hook |
 
@@ -96,6 +111,18 @@ format, and the plan stays writable:
 plan: planning/todo.yaml
 ```
 
+A project that publishes its plan (a JSON generated from it and committed with it)
+declares that file, so a commit touching only the plan and its published copy is
+plan upkeep; the plan keeps raf's format and stays writable:
+
+```yaml
+plan:
+  files: [frontend/public/plan-data/plan.json]
+```
+
+Until the file is declared, such a commit is reported as a "commit without a
+lot" when it cites none, and counts as work on the lots it cites.
+
 A project that already keeps its plan with its own tool is read **without migrating it**: describe
 the file, and `raf now`, `raf list`, `raf commits`, `raf check`, `raf gantt` and
 `cadence session start|close` work on it. Such a plan is **read-only** —
@@ -177,6 +204,15 @@ captures: [captures/l8.png]
 Imported statements now read **3.000** as three thousand, not three.
 ```
 
+A screenshot can say what it shows: write it as `{ file, alt }` instead of a
+bare path, one text per screenshot.
+
+```yaml
+captures:
+  - { file: captures/l8-before.png, alt: "Statement total read as 3 instead of 3,000" }
+  - captures/l8-after.png          # a bare path still works: no alternative text
+```
+
 | Command | Effect |
 |---|---|
 | `cadence news new <lot…> [--title t]` | entry skeleton, dated and timed now (`date`, `created`), titled after the lot |
@@ -189,7 +225,11 @@ Imported statements now read **3.000** as three thousand, not three.
 The Markdown is deliberately small: paragraphs, `-` lists, `**bold**`,
 `` `code` ``, `[links](url)`; everything else is escaped text. The JSON holds
 `{ project, generated, entries: [{ slug, title, date, lots, captures, html }] }`,
-with screenshot paths relative to the JSON file.
+with screenshot paths relative to the JSON file. `captures` is always a list of
+paths; an entry that gives at least one alternative text also carries `alts`,
+the texts in the same order (`""` for a screenshot without one) — an entry
+without any keeps exactly the shape above. The built page puts the text in the
+image's `alt`, and falls back to "Capture : <title>".
 
 **Order.** Everywhere (`list`, `build`, the JSON), entries are strictly newest
 first: by `date`, then, on the same day, by creation time. Every entry carries
@@ -216,8 +256,8 @@ raf ux L8 "no screen: calculation fix"
 
 With the rule on, `raf done` refuses a visible lot without a review (`--force`
 to override) and `raf check` reports visible lots finished after the `uxSince`
-day without one. An empty verdict is refused. Plans without `uxSince` are not
-affected.
+day without one. An empty verdict is refused, and one left empty or blank by hand
+in the YAML counts as no review. Plans without `uxSince` are not affected.
 
 ### Code review
 
@@ -231,8 +271,8 @@ The counterpart of the UX review, off by default. With the rule on, `raf done`
 refuses a lot that has at least one commit citing it and no recorded verdict
 (`--force` to override), and `raf check` reports such lots finished after the
 `reviewSince` day. A lot with no commit has nothing to review; neither does a
-lot whose only commits touch the plan itself, predate the plan's `since` or
-match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
+lot whose only commits touch plan files alone (the plan, or a file listed under
+`plan.files`), predate the plan's `since` or match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
 
 The verdict is tied to what was reviewed: `raf review` stores it on the lot with
 the sha of the lot's latest counted commit (`review: { date, verdict, commit }`,
@@ -241,7 +281,8 @@ makes the review stale: `raf done` refuses (`--force` to override), and
 `raf check` reports a finished lot, until the lot is reviewed again and
 `raf review` is rerun. A verdict
 written by hand without a `commit` field is not checked for staleness. An empty
-verdict is refused. Plans without `reviewSince` are not affected.
+verdict is refused, and one left empty or blank by hand in the YAML counts as no
+review. Plans without `reviewSince` are not affected.
 
 ### QA review
 
@@ -319,9 +360,13 @@ cadence session start --since "3 days ago" --idle 2
 cadence session close              # today's commits by lot, commits without a lot, lots in progress
                                    # with no commit today, drift, uncommitted / unpushed work
                                    # exit 1 while something is still open
-cadence session next "finish L3" "review L4"    # shown by the next session start
+cadence session next "finish L3" "review L4"    # shown by the next session start; replaces the previous notes
+cadence session next --clear       # erase those notes, on purpose
 ```
 
+`cadence session next` without a line refuses (exit 2) and leaves the notes of the
+last close as they are — it used to erase them silently; erasing is `--clear`.
+
 Proposals come from the plan only: lots in progress, then ready lots (dependencies
 done), quick wins first. Local state lives in the git directory, never committed:
 the close notes per worktree, the delivery lock and log in `.git/cadence/`, shared
@@ -372,7 +417,35 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   process died is removed with a warning); with `ci: github`, `gh` installed and
   logged in.
 - Every command is killed when it exceeds its budget (CI, `deployTimeout`, what is
-  left of `verifyTimeout`) and reported as "délai dépassé".
+  left of `verifyTimeout`) and reported as "délai dépassé". Killed means the
+  whole tree, followed while the command runs: every 200 ms cadence lists the
+  command's descendants and remembers each process it has seen with its start
+  time, so a process whose parent exits (re-parented to init — a background
+  child of a script, `sh`'s fork for each command) stays known. To kill, cadence
+  takes every remembered process still alive with the same start time (never a
+  recycled pid) plus all its current descendants, stops each one first
+  (`SIGSTOP`, the tree is re-read until nothing new appears), then kills them
+  (`SIGKILL`). This happens on a delay overrun, and at once when cadence
+  receives `SIGTERM`. On Ctrl-C or a hangup the tree has already received the
+  signal from the terminal: cadence gives the whole followed set, not just the
+  command, up to 2 seconds to finish (a script's `trap`, git removing its
+  `index.lock`), carries on the moment none of it is alive, and kills what is
+  left after the 2 seconds, a background child that ignores Ctrl-C included.
+  A delay overrun and `SIGTERM` give no grace: a script's own `trap` does not
+  get to finish there. The lock is held until the followed set is empty: when
+  cadence dies of the signal it dies after the tree, and its stale lock, which
+  the next delivery removes, leaves nothing of the first delivery running.
+  What can still outlive cadence and run concurrently with the next delivery:
+  a process that leaves the tree before cadence first sees it (a daemon's
+  double fork, `setsid`, `nohup … &` from a shell that exits, all within less
+  than 200 ms), a process of another user that cadence may not signal (`sudo`),
+  a background process still running when the command returns normally (it is
+  neither waited for nor killed), and everything if cadence itself is killed
+  with `SIGKILL` (`kill -9`, the OOM killer).
+- Commands run in cadence's own process group and session, attached to the
+  terminal: `ssh`, `sudo` or `pinentry` can prompt on `/dev/tty`, and Ctrl-C or
+  closing the terminal stops the running command together with cadence (within
+  the limits above).
 - **CI** `github`: polls `gh run list --commit <sha>` every 15 s; no run after
   5 minutes is a failure (you probably pushed another commit than the one you
   deliver); every run must end `success`, `skipped` or `neutral`. `gh` errors
@@ -380,7 +453,12 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
 - Commands get `CADENCE_SHA`, `CADENCE_SHORT` (7 characters) and `CADENCE_BRANCH`;
   `${SHA}` and `${SHORT}` are replaced in `url` and `contains`.
 - On success the lots cited by the commits since the previous delivery are
-  listed, so you can `raf done` those whose effect you have seen.
+  listed, so you can `raf done` those whose effect you have seen. With a
+  read-only plan, only the lots that were in progress when the delivery started
+  are listed: an id quoted in a message for context (a finished lot, a
+  reservation number that looks like one) is not a delivered lot. Plan upkeep
+  commits (see "Plan upkeep needs no lot") are skipped in that list: they cite
+  lots without delivering anything.
 
 ### A project with its own delivery script
 
@@ -413,6 +491,60 @@ intact. If the script commits and pushes during the delivery (stamping a
 changelog entry, say), the new `HEAD` is the sha recorded as delivered. Exit code
 0 of the script means delivered; `verify` checks, if any, run after it.
 
+### verify: replay the effect checks, outside a delivery
+
+A green delivery says the effect was right *then*. `cadence verify` replays the
+`deliver.verify` checks of `cadence.yaml` at any time — no CI, no deploy, no lock,
+no journal entry, nothing written.
+
+```sh
+cadence verify                # one pass, one line per check, then a one-line summary
+cadence verify --retry 60     # retry each failing check for up to 60 s (deliver's 300 s is not applied)
+cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: last delivery, else HEAD)
+```
+
+```
+✓ GET https://ol.example/api/health → 200
+✗ GET https://ol.example/api/lineup → 200, contient « "starters" » — « "starters" » absent de la réponse
+verify : 1 effet rouge sur 2 vérifications
+```
+
+Exit code: **0** every check green · **1** at least one red effect · **2** nothing
+to verify or invalid configuration.
+
+Time limits differ from deliver's. `verify` runs all the checks **in parallel**,
+each try with the whole 120 s limit (a `url` request gives up after 20 s; a slow
+check is killed at its limit, "délai dépassé", and takes nothing from the others); results are printed in the order
+of `cadence.yaml`. Retries repeat every 10 s (deliver's interval) up to `--retry`
+seconds for each check on its own, so a run lasts at most `--retry` + 120 s.
+deliver, by contrast, runs its checks one after the other, retries each until
+`verifyTimeout` (300 s by default) is spent, and stops at the first check that
+never turns green. The check code is deliver's own (`url` / `status` /
+`contains` / `command`, same messages). A project with
+a delivery script (`deliver.script`) and no `verify` declares no effect checks —
+`verify` says so and exits 2 (its script's own checks stay its business); add
+`deliver.verify` to replay some.
+
+Each `command` check of `verify` (and of `session start`) runs in a process group
+of its own, detached from the terminal (no `/dev/tty`: a check must not prompt).
+At its time limit the whole group is killed, so no child survives it; Ctrl-C,
+`SIGTERM` or a closed terminal is passed on to the running checks before cadence
+exits. As the checks run together, the output of their commands may interleave;
+the result lines come after it, in order.
+
+Make `verify` count: a health endpoint stays green while the data is wrong (a
+lineup served empty for 38 h behind a green `/api/health`). Add a check on the
+content that matters, e.g. `url: …/api/lineup` with `contains: '"starters"'`.
+
+`cadence session start` runs the same checks in parallel (one try each, command
+output muted), each with a 10 s limit, so the whole step takes about 10 s at worst;
+it is not deliver's `verifyTimeout`, and there is no retry. It adds an
+**"Effets en production"** section to the morning report: a single `✓` line when
+everything is green, the red effects and the summary otherwise. It is a fact like
+the others: it never changes the exit code, and an unreachable network shows up
+as red lines ("erreur réseau") without blocking the session. No section for a
+project without `deliver.verify`.
+
 ## Claude Code skills
 
 As a plugin:

package/bin/cadence.js

@@ -13,7 +13,7 @@ const io = {
 
 if (tool === 'raf') {
   process.exitCode = await run(args, io);
-} else if (['news', 'session', 'deliver', 'skills'].includes(tool)) {
+} else if (['news', 'session', 'deliver', 'verify', 'skills'].includes(tool)) {
   process.exitCode = await run([tool, ...args], io);
 } else if (tool === '--version' || tool === '-v') {
   const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
@@ -26,10 +26,14 @@ if (tool === 'raf') {
   cadence session start [--since "24 hours ago"] [--idle 2]
                     faits de reprise : notes de la veille, en cours, fait depuis, écarts, propositions
   cadence session close [--since …]    faits de clôture ; code 1 tant que ce n'est pas fermé
-  cadence session next "ligne" …       notes pour la prochaine session (sans argument : efface)
+  cadence session next "ligne" …       notes pour la prochaine session (remplacent les précédentes)
+  cadence session next --clear         efface ces notes ; sans ligne ni --clear, la commande refuse
   cadence deliver [--dry-run] [--sha rév] [--config cadence.yaml] [-- arguments du script du projet]
                     CI du sha poussé → déploiement → vérifications de l'effet ;
                     ou le script de livraison du projet (deliver.script), sous verrou et journal
+  cadence verify [--retry secondes] [--sha rév]
+                    rejoue les vérifications d'effet (deliver.verify) hors livraison, une passe, en parallèle ;
+                    code 0 tout vert, 1 un effet rouge, 2 rien à vérifier ; « session start » la lance aussi
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;

package/dist/audit.js

@@ -1,12 +1,34 @@
 import { dirname, join, relative } from 'node:path';
 import { check } from './check.js';
-import { changedFiles, readCommits } from './git.js';
+import { parse } from 'yaml';
+import { changedFiles, fileAt, readCommits } from './git.js';
 import { linkCommits } from './link.js';
 import { loadEntries, newsIssues } from './news.js';
 import { isOpen } from './plan.js';
-/** Le plan, sa page Gantt et les fichiers tenus avec lui (cadence.yaml : plan.files). */
+/** Chemin de la configuration lue, relatif à la racine : celui de --config, sinon cadence.yaml. */
+function configRel(plan, root) {
+    return plan.configFile ? relative(root, plan.configFile) : 'cadence.yaml';
+}
+/** Le plan, sa page Gantt, la configuration lue (cadence.yaml) et les fichiers tenus avec lui (plan.files). */
 function ownFiles(plan, root) {
-    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), ...plan.files]);
+    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), configRel(plan, root), ...plan.files]);
+}
+function withoutPlanKey(text) {
+    if (text === null)
+        return '{}';
+    try {
+        const { plan: _plan, ...rest } = (parse(text) ?? {});
+        return JSON.stringify(rest, (_k, v) => (v && typeof v === 'object' && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).sort(([x], [y]) => x.localeCompare(y))) : v));
+    }
+    catch {
+        return null;
+    }
+}
+/** Le commit ne change de la configuration que la clé `plan:` ? Un fichier illisible avant ou après compte comme du travail. */
+function onlyPlanKeyChanged(root, sha, file) {
+    const before = withoutPlanKey(fileAt(root, `${sha}^`, file));
+    const after = withoutPlanKey(fileAt(root, sha, file));
+    return before !== null && before === after;
 }
 /** Commits du dépôt sans les commits automatiques (motifs `ignore`) : ni audités ni comptés pour un lot. */
 export function planCommits(plan, root, opts = {}) {
@@ -14,25 +36,25 @@ export function planCommits(plan, root, opts = {}) {
     const commits = readCommits(root, opts);
     return patterns.length ? commits.filter((c) => !patterns.some((re) => re.test(c.subject))) : commits;
 }
-/** Le commit ne touche-t-il que le plan (ou la page Gantt) ? */
+/**
+ * Commit d'entretien du plan : TOUS ses fichiers sont des fichiers du plan (le plan, sa page Gantt,
+ * plan.files — son plan publié par exemple — et la configuration lue, mais celle-ci seulement quand la
+ * clé `plan:` est la seule à changer : deliver/session/… sont du travail). Les fichiers décident,
+ * jamais le sujet : « chore(plan): … » qui touche un fichier source est un commit comme un autre.
+ */
 export function isPlanOnly(sha, plan, root) {
     const own = ownFiles(plan, root);
+    const config = configRel(plan, root);
     const files = changedFiles(root, sha);
-    return files.length > 0 && files.every((f) => own.has(f));
+    return files.length > 0 && files.every((f) => own.has(f) && (f !== config || onlyPlanKeyChanged(root, sha, f)));
 }
 /**
- * N'ont pas besoin de citer un lot : un commit qui ne touche que le plan (ou la page Gantt), et un
- * commit automatique dont le sujet correspond à un motif `ignore:` du plan.
+ * N'ont pas besoin de citer un lot : un commit d'entretien du plan (cf. isPlanOnly) et un commit
+ * automatique dont le sujet correspond à un motif `ignore:` du plan.
  */
 export function exemptPlanOnly(linked, plan, root) {
-    const own = ownFiles(plan, root);
     const { patterns } = plan.ignore;
-    const orphans = linked.orphans.filter((c) => {
-        if (patterns.some((re) => re.test(c.subject)))
-            return false;
-        const files = changedFiles(root, c.sha);
-        return files.length === 0 || !files.every((f) => own.has(f));
-    });
+    const orphans = linked.orphans.filter((c) => !patterns.some((re) => re.test(c.subject)) && !isPlanOnly(c.sha, plan, root));
     return { ...linked, orphans };
 }
 /** Fenêtre de l'audit : --since, sinon la date d'adoption du plan, sinon 30 jours. */

package/dist/cli.js

@@ -6,16 +6,17 @@ import { audit, exemptPlanOnly, isPlanOnly, lotWork, nextUp, planCommits, unrevi
 import { short } from './check.js';
 import { isDay, toDay } from './dates.js';
 import { deliver, parseDeliverConfig, realDeps } from './deliver.js';
+import { effectLines, realCheckDeps, verifyCommand } from './verify.js';
 import { ganttData, renderGantt } from './gantt.js';
-import { gitRoot, readCommits } from './git.js';
+import { gitRoot, headSha, readCommits, resolveCommit } from './git.js';
 import { installHook } from './hook.js';
-import { linkCommits } from './link.js';
+import { citedRefs, linkCommits } from './link.js';
 import { buildNews, loadEntries, newEntry, newsData, newsIssues, stampEntries } from './news.js';
 import { Plan, RafError, STATUSES } from './plan.js';
 import { schedule } from './schedule.js';
 import { AGENTS_DIR, installAgents, installSkills, SKILLS_DIR } from './skills.js';
 import { sessionClose, sessionStart } from './session.js';
-import { sharedStateDir, stateDir, writeNext } from './state.js';
+import { clearNext, lastDelivery, readNext, sharedStateDir, stateDir, writeNext } from './state.js';
 const HELP = `raf — plan « reste à faire » versionné dans le dépôt, relié aux commits
 
   raf init [--project nom] [--prefix L] [--no-hook]
@@ -32,9 +33,15 @@ const HELP = `raf — plan « reste à faire » versionné dans le dépôt, reli
   raf check [--since date] [--idle 7]   (défaut : date « since » du plan) code 1 s'il y a des écarts
   raf gantt [-o docs/plan/gantt.html]
   raf hook install
+  cadence verify [--retry s] [--sha rév]   rejoue deliver.verify hors livraison : 0 vert, 1 effet rouge, 2 rien à vérifier
   raf news new <lot…> [--title t] | list | check | stamp | build [-o dossier]   (aussi « cadence news … »)
 
 Un commit appartient à un lot quand son message cite l'identifiant : « feat(L3): … », « L3/t1 ».
+Quand la portée du sujet cite des lots — « feat(L3): … », « chore(L31,L32): … » — elle seule décide : une
+mention en passage (« page équipe (L27) »), une plage (« L28–L31 », « L45 à L48 ») ou le corps n'y comptent pas.
+Sans portée citant un lot, tout le message est lu : « fix: L3 corrigé », « L3/t1 ».
+Un commit qui ne touche que le plan, la clé plan: de cadence.yaml (deliver/session sont du travail) (et les fichiers déclarés sous plan.files, un plan
+publié par exemple) n'a pas à en citer, et ne compte pas pour les lots qu'il cite ; le sujet n'y change rien.
 Un lot --visible attend une entrée Nouveautés (docs/nouveautes/, --dir) avec capture ; raf check le vérifie.
 Un texte qui commence par « - » se passe après « -- » : raf note L1 -- "-5 %".
 Le plan est docs/plan/raf.yaml, ou celui que nomme « plan: » dans cadence.yaml ; un plan tenu par un
@@ -85,6 +92,8 @@ function dispatch(argv, io) {
             config: { type: 'string' },
             'dry-run': { type: 'boolean' },
             sha: { type: 'string' },
+            retry: { type: 'string' },
+            clear: { type: 'boolean' },
             help: { type: 'boolean', short: 'h' },
         },
     });
@@ -103,7 +112,7 @@ function dispatch(argv, io) {
     const installing = command === 'skills' || (command === 'hook' && rest[0] === 'install');
     const planConfig = installing ? null : readPlanConfig(configPath);
     const planPath = resolve(io.cwd, values.file ?? io.env.RAF_FILE ?? resolve(root, planConfig?.path ?? 'docs/plan/raf.yaml'));
-    const loadPlan = () => Plan.load(planPath, planConfig?.settings);
+    const loadPlan = () => Plan.load(planPath, { ...planConfig?.settings, config: configPath });
     const newsDir = resolve(io.cwd, values.dir ?? join(root, 'docs/nouveautes'));
     const need = (n, usage) => {
         if (rest.length < n)
@@ -228,7 +237,14 @@ function dispatch(argv, io) {
                 throw new RafError('session : à lancer dans un dépôt git');
             // « next » n'écrit que les notes : la commande du projet ne se joue qu'à la reprise et à la clôture.
             const facts = rest[0] === 'start' || rest[0] === 'close' ? readSessionConfig(configPath)[rest[0]] : undefined;
-            return session(rest, { plan: loadPlan(), root, newsDir, state: stateDir(root), shared: sharedStateDir(root), today, out: io.out, facts }, values);
+            const sctx = { plan: loadPlan(), root, newsDir, state: stateDir(root), shared: sharedStateDir(root), today, out: io.out, facts };
+            if (rest[0] !== 'start')
+                return session(rest, sctx, values);
+            // La reprise rejoue les vérifications d'effet (un essai, borné) : un effet rouge d'hier se lit avec les faits du matin.
+            const effects = morningEffects(configPath, root);
+            if (effects === null)
+                return session(rest, sctx, values);
+            return Promise.resolve(effects).then((lines) => session(rest, { ...sctx, effects: lines }, values));
         }
         case 'deliver': {
             if (!gitRoot(io.cwd))
@@ -240,6 +256,20 @@ function dispatch(argv, io) {
             const ctx = { root, state: sharedStateDir(root), plan, config, today, dryRun: !!values['dry-run'], sha: values.sha, args: rest, out: io.out, err: io.err };
             return deliver(ctx, realDeps(root));
         }
+        case 'verify': {
+            if (!gitRoot(io.cwd))
+                throw new RafError('verify : à lancer dans un dépôt git');
+            if (!existsSync(configPath))
+                throw new RafError(`pas de configuration : ${configPath} (voir « cadence.yaml » dans le README)`);
+            const retry = values.retry === undefined ? 0 : Number(values.retry);
+            if (!Number.isFinite(retry) || retry < 0)
+                throw new RafError(`--retry invalide : ${values.retry} (secondes, 0 ou plus)`);
+            const config = parseDeliverConfig(readFileSync(configPath, 'utf8'), configPath);
+            const sha = values.sha ? (resolveCommit(root, values.sha) ?? '') : (lastDelivery(sharedStateDir(root)) ?? headSha(root) ?? '');
+            if (values.sha && !sha)
+                throw new RafError(`--sha ${values.sha} : commit introuvable`);
+            return verifyCommand({ config, sha, retry, out: io.out }, realCheckDeps(root));
+        }
         case 'skills': {
             if (rest[0] !== 'install')
                 throw new RafError('usage : cadence skills install [--dir .claude] [--force]');
@@ -342,7 +372,7 @@ function postCommit(load, newsDir, root, io) {
         const head = readCommits(root, { range: '-1' })[0];
         if (!head)
             return 0;
-        const refs = plan.refs(`${head.subject}\n${head.body}`);
+        const refs = citedRefs(head, plan.refs);
         if (refs.length === 0) {
             const planOnly = exemptPlanOnly({ byLot: new Map(), orphans: [head], unknown: [] }, plan, root).orphans.length === 0;
             if (!planOnly && !/^Merge\b/.test(head.subject)) {
@@ -419,6 +449,27 @@ function news([sub, ...args], plan, dir, today, values, io) {
             throw new RafError('usage : cadence news new|list|check|stamp|build');
     }
 }
+/**
+ * Reprise : lignes d'effets à rejouer, ou null quand il n'y a rien à vérifier (sans cadence.yaml, sans deliver,
+ * script sans verify) — la reprise reste alors synchrone. Ne lève jamais.
+ */
+function morningEffects(configPath, root) {
+    if (!existsSync(configPath))
+        return null;
+    const text = readFileSync(configPath, 'utf8');
+    if (!/^deliver\s*:/m.test(text))
+        return null;
+    try {
+        const config = parseDeliverConfig(text, configPath);
+        if (config.verify.length === 0)
+            return null;
+        const sha = lastDelivery(sharedStateDir(root)) ?? headSha(root) ?? '';
+        return effectLines(config, sha, realCheckDeps(root, { quiet: true }));
+    }
+    catch (e) {
+        return [`✗ ${e.message}`];
+    }
+}
 function session([sub, ...args], ctx, values) {
     switch (sub) {
         case 'start': {
@@ -429,10 +480,26 @@ function session([sub, ...args], ctx, values) {
         }
         case 'close':
             return sessionClose(ctx, { since: values.since ?? `${ctx.today} 00:00` });
-        case 'next':
-            writeNext(ctx.state, ctx.today, args);
+        case 'next': {
+            const lines = args.filter((l) => l.trim() !== '');
+            if (values.clear) {
+                if (lines.length)
+                    throw new RafError('session next --clear efface les notes : ne pas lui passer de ligne');
+                const gone = clearNext(ctx.state);
+                ctx.out(gone ? `notes effacées (${gone.lines.length} ligne(s) du ${gone.date})` : 'aucune note à effacer');
+                return 0;
+            }
+            // Lancée sans ligne (variable vide dans un script, agent pressé), la commande effaçait en silence
+            // les notes de la dernière clôture : effacer se demande exprès.
+            if (lines.length === 0) {
+                const kept = readNext(ctx.state);
+                throw new RafError(`session next : aucune ligne — ${kept ? `${kept.lines.length} ligne(s) du ${kept.date} conservée(s)` : "rien n'est écrit"} ; ` +
+                    'usage : cadence session next "ligne" … (pour effacer les notes exprès : cadence session next --clear)');
+            }
+            writeNext(ctx.state, ctx.today, lines);
             return 0;
+        }
         default:
-            throw new RafError('usage : cadence session start [--since …] [--idle 2] | close [--since …] | next "ligne" …');
+            throw new RafError('usage : cadence session start [--since …] [--idle 2] | close [--since …] | next "ligne" … | next --clear');
     }
 }