@sylad/cadence 1.13.0 → 1.14.1

package/dist/ref/diff.js

@@ -1,4 +1,4 @@
-import { writeFileSync } from 'node:fs';
+import { existsSync, writeFileSync } from 'node:fs';
 import { RafError } from '../plan.js';
 import { TYPES, checkInventaire, readInventaire } from './check.js';
 import { affirmation, identite } from './evaluate.js';
@@ -116,13 +116,16 @@ function confianceConcordant(ea, eb) {
     return { confiance: ea.confiance === 'mesure' || eb.confiance === 'mesure' ? 'mesure' : 'lu' };
 }
 /**
- * L'inventaire réconcilié (genre « inventaire »), ids renumérotés `<slug>#<type>-<n>` et renvois suivis. Un divergent est `incertain` avec les deux
+ * L'inventaire réconcilié (genre « inventaire »), ids `<slug>#<type>-<n>` (renumérotés, sauf pour un élément de `precedent`) et renvois suivis. Un divergent est `incertain` avec les deux
  * versions ; un seul écarté par le troisième regard disparaît (avec ce qui ne tient plus sans lui), un seul confirmé garde sa confiance (un doute
  * reste un doute), un seul sans décision reste `incertain` : `regard` dit si le troisième regard a eu lieu (sa cause le dit).
  * Un élément apparié tient tant que l'une de ses deux versions renvoie à des éléments gardés (la lecture A d'abord) : quand l'autre version renvoyait à un
  * élément écarté, il est gardé, rattaché d'après la version qui tient, et `incertain` avec la cause du rattachement ; il disparaît quand aucune ne tient.
+ * `precedent` : l'inventaire que ce passage remplace, du même document. Un élément relu (même type, même page, même identité, zone qui recouvre le plus)
+ * y garde son id ; un élément neuf prend un numéro au-dessus du plus grand de son type, jamais celui d'un élément disparu : un lot qui cite un id
+ * continue de viser le même élément, et les `exclusions` écrites passent dans le nouvel inventaire.
  */
-export function assembler(a, b, rec, regard = false) {
+export function assembler(a, b, rec, regard = false, precedent) {
     const entrees = rec.items.map((item) => ({ item, supprimee: item.statut === 'seul' && item.decision?.verdict === 'ecarte' }));
     const proprietaire = new Map();
     for (const en of entrees) {
@@ -162,16 +165,7 @@ export function assembler(a, b, rec, regard = false) {
                 en.version = v;
         }
     }
-    const compteur = new Map();
-    const nouvelId = new Map();
-    for (const en of entrees) {
-        if (en.supprimee)
-            continue;
-        const type = en.item.element.type;
-        const n = (compteur.get(type) ?? 0) + 1;
-        compteur.set(type, n);
-        nouvelId.set(en, `${a.document.slug}#${type}-${n}`);
-    }
+    const nouvelId = idsStables(entrees, a, b, precedent);
     const elements = entrees.filter((en) => !en.supprimee).map((en) => {
         const { item } = en;
         const v = en.version;
@@ -213,7 +207,43 @@ export function assembler(a, b, rec, regard = false) {
         }
         return e;
     });
-    return { version: 1, genre: 'inventaire', document: { slug: a.document.slug, sha256: a.document.sha256 }, elements };
+    const exclusions = memeDocument(precedent, a) ? precedent.exclusions : undefined;
+    return { version: 1, genre: 'inventaire', document: { slug: a.document.slug, sha256: a.document.sha256 }, elements, ...(exclusions !== undefined ? { exclusions } : {}) };
+}
+const memeDocument = (precedent, a) => (precedent?.genre === 'inventaire' || precedent?.genre === 'lecture') && precedent.document?.slug === a.document.slug && Array.isArray(precedent.elements);
+/** Les ids du nouvel inventaire : ceux de `precedent` pour les éléments relus, des numéros neufs pour les autres (ordre de l'inventaire, numérotation par type). */
+function idsStables(entrees, a, b, precedent) {
+    const slug = a.document.slug;
+    const anciens = memeDocument(precedent, a) ? precedent.elements : [];
+    const parAncien = new Map(anciens.map((e) => [e.id, e]));
+    const parA = new Map(a.elements.map((e) => [e.id, e]));
+    const parB = new Map(b.elements.map((e) => [e.id, e]));
+    const reprise = new Set();
+    const nouvelId = new Map();
+    for (const en of entrees.filter((x) => !x.supprimee)) {
+        const e = en.item.element;
+        const par = en.item.a ? parA : parB;
+        const libres = anciens.filter((p) => !reprise.has(p) && p.type === e.type && p.source?.page === e.source?.page && identite(p, parAncien) === identite(e, par));
+        const ancien = libres.reduce((best, c) => (best === undefined || recouvrement(e, c) > recouvrement(e, best) ? c : best), undefined);
+        if (ancien) {
+            reprise.add(ancien);
+            nouvelId.set(en, ancien.id);
+        }
+    }
+    const compteur = new Map();
+    for (const e of anciens) {
+        const n = Number(String(e.id).slice(String(e.id).lastIndexOf('-') + 1));
+        compteur.set(e.type, Math.max(compteur.get(e.type) ?? 0, Number.isInteger(n) ? n : 0));
+    }
+    for (const en of entrees) {
+        if (en.supprimee || nouvelId.has(en))
+            continue;
+        const type = en.item.element.type;
+        const n = (compteur.get(type) ?? 0) + 1;
+        compteur.set(type, n);
+        nouvelId.set(en, `${slug}#${type}-${n}`);
+    }
+    return nouvelId;
 }
 function lireLecture(path) {
     const doc = readInventaire(path);
@@ -232,6 +262,60 @@ export function parseSeuil(text, commande) {
         throw new RafError(`${commande} : --seuil invalide : « ${text} » (une part en pour cent, de 0 à 100)`);
     return Number(text) / 100;
 }
+/**
+ * Ce qu'un passage de `ref analyse` remplace et dont il reprend les ids : l'inventaire du dossier du document, sinon sa lecture `lectures/a.json`
+ * (une lecture unique ou la lecture A d'une double), du moment qu'elle est valide ; sinon rien.
+ */
+export function precedentDe(inventaire, lecture) {
+    const inv = inventairePrecedent(inventaire);
+    if (inv)
+        return inv;
+    if (!existsSync(lecture))
+        return undefined;
+    try {
+        const doc = readInventaire(lecture);
+        return doc.genre === 'lecture' && checkInventaire(doc).length === 0 ? doc : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Une lecture seule (`ref analyse` sans `--double`) numérote ses éléments par son propre ordre : ceux qui relisent un élément de `precedent` (même règle
+ * que `assembler`) reprennent son id, les renvois suivent, et les `exclusions` écrites passent dans la lecture. Sans `precedent` du même document, rien ne change.
+ */
+export function reprendreIds(lecture, precedent) {
+    if (!memeDocument(precedent, lecture))
+        return;
+    const elements = lecture.elements;
+    const entrees = elements.map((e) => ({ item: { statut: 'concordant', element: e, a: e }, supprimee: false }));
+    const nouvelId = idsStables(entrees, lecture, lecture, precedent);
+    const ancienVersNeuf = new Map(entrees.map((en) => [en.item.element.id, nouvelId.get(en)]));
+    for (const e of elements) {
+        if (e.type === 'composant')
+            e.ecran = ancienVersNeuf.get(e.ecran) ?? e.ecran;
+        if (e.type === 'etat')
+            e.cible = ancienVersNeuf.get(e.cible) ?? e.cible;
+        if (e.type === 'statut')
+            e.couvre = e.couvre.map((id) => ancienVersNeuf.get(id) ?? id);
+    }
+    for (const e of elements)
+        e.id = ancienVersNeuf.get(e.id);
+    if (precedent.exclusions !== undefined)
+        lecture.exclusions = precedent.exclusions;
+}
+/** L'inventaire que `--out` va remplacer, s'il en est un de valide ; sinon rien (un fichier illisible ou d'une autre forme n'est pas un inventaire précédent). */
+export function inventairePrecedent(path) {
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const doc = readInventaire(path);
+        return doc.genre === 'inventaire' && checkInventaire(doc).length === 0 ? doc : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** `ref diff <a> <b> [--out inventaire.json] [--seuil 30]` : 0 réconcilié, 1 trop d'éléments non appariés (rien d'écrit), 2 fichier ou appel refusé. */
 export function diffLectures(o) {
     const seuil = parseSeuil(o.seuil, 'ref diff');
@@ -257,6 +341,6 @@ export function diffLectures(o) {
         return 1;
     }
     if (o.out !== undefined)
-        writeFileSync(o.out, `${JSON.stringify(assembler(a, b, rec), null, 2)}\n`);
+        writeFileSync(o.out, `${JSON.stringify(assembler(a, b, rec, false, inventairePrecedent(o.out)), null, 2)}\n`);
     return 0;
 }

package/dist/release.js

@@ -204,7 +204,11 @@ function steps(p, files, branch) {
         `git push origin ${branch} ${tag}    (le tag lance le workflow de publication)`,
         'gh run watch    (jusqu\'à la fin du run de publication)',
         ...(p.isPrivate || p.packageName === '' ? [] : [`npm view ${p.packageName} version    (doit répondre ${p.version})`]),
-        ...(p.pluginName ? [`claude plugin update ${p.pluginName}${p.marketplaceName ? `@${p.marketplaceName}` : ''}    (le plugin se lit depuis le dépôt poussé)`] : []),
+        ...(p.pluginName ? [
+            ...(p.marketplaceName ? [`claude plugin marketplace update ${p.marketplaceName}    (sans elle, le plugin installé reste à l'ancienne version)`] : []),
+            `claude plugin update ${p.pluginName}${p.marketplaceName ? `@${p.marketplaceName}` : ''}    (le plugin se lit depuis le dépôt poussé)`,
+            '/reload-plugins    (dans la session Claude Code ouverte, pour charger la nouvelle version)',
+        ] : []),
     ];
     return out.map((s, i) => `  ${i + 1}. ${s}`);
 }

package/dist/session.js

@@ -5,6 +5,7 @@ import { audit, exemptPlanOnly, gateWaiting, nextUp, planCommits } from './audit
 import { diffDays, maxDay } from './dates.js';
 import { repoStatus } from './git.js';
 import { linkCommits } from './link.js';
+import { staleNoteLines, staleNotes, staleText } from './stale-notes.js';
 import { lockAlive, readLock, readNext, readSessionMark, writeSessionMark } from './state.js';
 const FACTS_TIMEOUT = 120_000;
 /**
@@ -107,7 +108,7 @@ export function sessionStart(ctx, opts) {
     out(`${plan.project} — reprise du ${today}`);
     const next = readNext(ctx.state);
     if (next)
-        section(out, `Notes de la dernière clôture (${next.date})`, next.lines.map((l) => `- ${l}`));
+        section(out, `Notes de la dernière clôture (${next.date})`, staleNoteLines(next.lines, lots).map((l) => `- ${l}`));
     const lock = lockStatus(ctx.shared);
     if (lock)
         out(`\n${lock.line}`);
@@ -152,6 +153,11 @@ export function sessionClose(ctx, opts) {
         commits.push(`${recent.orphans.length} commit(s) sans lot :`, ...recent.orphans.map((c) => `  ${short(c)}`));
     }
     section(out, `Commits de la période (${window.label})`, commits.length ? commits : ['(aucun)']);
+    const next = readNext(ctx.state);
+    if (next) {
+        const stale = staleNotes(next.lines, plan.lots()).filter((n) => n.stale.length);
+        section(out, `Notes de la dernière clôture à réécrire (${next.date})`, stale.map((n) => `${n.line} ${staleText(n.stale)} — cadence session next les remplace`));
+    }
     const quiet = plan.lots().filter((l) => l.status === 'doing' && !isRecurring(l) && !recent.byLot.has(l.id));
     section(out, 'Lots en cours', quiet.map((l) => `${l.id}  ${l.title} — aucun commit sur la période : ${plan.readonly ? "le fermer ou l'annoter avec l'outil du projet" : 'raf done ou raf note'}`));
     const issues = audit(plan, ctx.root, ctx.newsDir, today);

package/dist/stale-notes.js

@@ -0,0 +1,22 @@
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** « 2026-10-24 » → « 24-10 » : la note est récente, l'année ne se lit pas. */
+const dayMonth = (d) => `${d.slice(8, 10)}-${d.slice(5, 7)}`;
+/**
+ * Pour chaque ligne de note, les lots `done` ou `dropped` qu'elle cite, dans l'ordre de la ligne. Un identifiant se
+ * lit entier : `L2` n'est pas cité par `L217`, ni `B28` par `B28.8`, mais un point final (`reprendre L2.`) ne le prolonge pas.
+ */
+export function staleNotes(lines, lots) {
+    const finished = lots.filter((l) => l.status === 'done' || l.status === 'dropped');
+    return lines.map((line) => {
+        const hits = finished
+            .map((l) => ({ l, at: line.search(new RegExp(`(?<![\\w./-])${escape(l.id)}(?![\\w/-]|\\.\\w)`)) }))
+            .filter((h) => h.at >= 0)
+            .sort((a, b) => a.at - b.at);
+        return { line, stale: hits.map(({ l }) => `${l.id} ${l.status}${l.finished ? ` le ${dayMonth(l.finished)}` : ''}`) };
+    });
+}
+export const staleText = (stale) => `⚠ note périmée : ${stale.join(', ')}`;
+/** Les notes telles quelles, celles qui citent un lot fini suivies de « ⚠ note périmée : … ». */
+export function staleNoteLines(lines, lots) {
+    return staleNotes(lines, lots).map((n) => (n.stale.length ? `${n.line} ${staleText(n.stale)}` : n.line));
+}

package/dist/verify-gate.js

@@ -0,0 +1,138 @@
+import { spawn } from 'node:child_process';
+import { lstatSync, mkdtempSync, rmSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { onTermination } from './proc.js';
+import { failedTests, hasUnnamedFailure, unloadedSuites } from './orchestrate/baseline.js';
+import { git, gitFailure, linkDeclared, linkIgnored } from './orchestrate/worktree.js';
+/** Délai de chaque commande de la porte : celui du rejeu de la ligne de base de la vague. */
+const GATE_TIMEOUT_MS = 30 * 60_000;
+/** Lignes de la fin de la sortie montrées quand aucun test n'est identifiable dans une sortie rouge. */
+const TAIL_LINES = 10;
+function killGroup(pgid) {
+    try {
+        process.kill(-pgid, 'SIGKILL');
+    }
+    catch {
+        // groupe déjà vide
+    }
+}
+/**
+ * Une commande `sh -c` dans `cwd`, sortie standard et d'erreur réunies ; au délai, tout son groupe de processus est tué.
+ * `group` reçoit le groupe en cours : le nettoyage d'un signal reçu par cadence le tue avant de retirer le worktree.
+ */
+function sh(cmd, cwd, timeoutMs, group) {
+    return new Promise((resolve) => {
+        const child = spawn('sh', ['-c', cmd], { cwd, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+        const pgid = child.pid;
+        if (pgid === undefined) {
+            child.once('error', (e) => resolve({ code: 127, output: e.message }));
+            return;
+        }
+        group.pgid = pgid;
+        let output = '';
+        for (const stream of [child.stdout, child.stderr])
+            stream.on('data', (d) => (output += d.toString()));
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killGroup(pgid);
+        }, timeoutMs);
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            killGroup(pgid); // ce que la commande a laissé en arrière-plan ne survit pas à elle
+            group.pgid = undefined;
+            resolve({ code: timedOut ? 124 : (code ?? 1), output: timedOut ? `${output}\ndélai dépassé (${Math.round(timeoutMs / 60_000)} min)` : output });
+        });
+    });
+}
+/**
+ * `cadence verify --gate` (L348) : la porte du projet (`orchestrate.build`, puis `orchestrate.test`, dans l'ordre de la vague : les tests lisent ce que le build produit)
+ * rejouée au `sha` dans un worktree jetable, hors du dépôt, dont les dépendances non suivies sont reliées depuis le dépôt vivant (`orchestrate.worktreeDeps`,
+ * sinon les dossiers ignorés de tout niveau, comme les worktrees de vague). Les deux commandes sont rejouées même si la première est rouge : le compte rendu est entier.
+ * Le worktree est retiré dans tous les cas. 0 vert, 1 rouge (avec les tests en échec), 2 rien à rejouer ou worktree impossible.
+ */
+export async function verifyGate(ctx) {
+    const { repo, sha, config, out } = ctx;
+    const steps = [
+        ...(config.build ? [{ name: 'build', cmd: config.build }] : []),
+        ...(config.test ? [{ name: 'tests', cmd: config.test }] : []),
+    ];
+    const short = sha.slice(0, 7);
+    if (steps.length === 0) {
+        out('verify --gate : ni orchestrate.test ni orchestrate.build déclarés dans cadence.yaml — rien à rejouer');
+        return 2;
+    }
+    const dir = mkdtempSync(join(tmpdir(), 'cadence-verify-'));
+    const links = [];
+    const group = {};
+    const cleanup = () => {
+        if (group.pgid !== undefined)
+            killGroup(group.pgid);
+        for (const k of links)
+            if (lstatSync(k, { throwIfNoEntry: false })?.isSymbolicLink())
+                unlinkSync(k);
+        try {
+            git(repo, 'worktree', 'remove', '--force', dir);
+        }
+        catch {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        try {
+            git(repo, 'worktree', 'prune');
+        }
+        catch {
+            // rien à élaguer
+        }
+    };
+    // Ctrl-C, SIGTERM ou raccrochage reçu par cadence : la commande est tuée et le worktree retiré avant de mourir du signal.
+    const forget = onTermination(cleanup);
+    try {
+        try {
+            git(repo, 'worktree', 'add', '--detach', '-f', dir, sha);
+        }
+        catch (e) {
+            out(`verify --gate : worktree de ${short} impossible — ${gitFailure(e)}`);
+            return 2;
+        }
+        if (config.worktreeDeps) {
+            const linked = linkDeclared(repo, dir, config.worktreeDeps);
+            links.push(...linked.links);
+            if (linked.missing.length)
+                out(`dépendances déclarées absentes de l'arbre principal, non liées : ${linked.missing.join(', ')}`);
+        }
+        else {
+            links.push(...linkIgnored(repo, dir));
+        }
+        let red = 0;
+        for (const step of steps) {
+            const r = await sh(step.cmd, dir, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group);
+            if (r.code === 0) {
+                out(`✓ ${step.name} (${step.cmd})`);
+                continue;
+            }
+            red++;
+            out(`✗ ${step.name} (${step.cmd}) — code ${r.code}`);
+            const tests = step.name === 'tests';
+            const names = tests ? failedTests(r.output) : [];
+            const unloaded = tests ? unloadedSuites(r.output) : [];
+            for (const n of names)
+                out(`  - ${n}`);
+            for (const n of unloaded)
+                out(`  - ${n} (ne se charge pas)`);
+            if (names.length + unloaded.length === 0 || hasUnnamedFailure(r.output, true)) {
+                if (names.length + unloaded.length)
+                    out('  (au moins un échec que la sortie ne rattache à aucun test)');
+                if (r.output.trim())
+                    for (const l of r.output.trimEnd().split('\n').slice(-TAIL_LINES))
+                        out(`  | ${l}`);
+            }
+        }
+        out(red === 0 ? `verify --gate ${short} : vert` : `verify --gate ${short} : rouge (${red} étape${red > 1 ? 's' : ''} sur ${steps.length})`);
+        return red === 0 ? 0 : 1;
+    }
+    finally {
+        forget();
+        cleanup();
+    }
+}

package/docs/deliver.md

@@ -273,3 +273,40 @@ everything is green, the red effects and the summary otherwise. It is a fact lik
 the others: it never changes the exit code, and an unreachable network shows up
 as red lines ("erreur réseau") without blocking the session. No section for a
 project without `deliver.verify`.
+
+## verify --gate: replay the project's gate at a sha (L348)
+
+`cadence verify` above replays the *effect* of a delivery. `cadence verify --gate --sha <sha>`
+replays the *gate* of the project, `orchestrate.build` then `orchestrate.test` of `cadence.yaml`
+(the order of the wave's gate: the tests read what the build produces), at one commit, for the
+lead's re-verification (« the lead re-verifies itself », skill `lead`). It never touches the shared
+tree, which holds the lots still running.
+
+```sh
+cadence verify --gate --sha 6b0d9aa                  # in the project
+cadence verify --gate --sha 6b0d9aa --project app    # from the parent folder, the project `app` (its own git repository)
+```
+
+It adds a throwaway worktree of the sha under the OS temporary folder (`cadence-verify-…`), links
+the **untracked dependencies** of the main tree into it, runs the commands there, and removes the worktree
+whatever the result. A bare worktree has no `node_modules` or `.venv`: on 26-10 the re-verification of a lot
+in one gave nine red suites that were only missing dependencies. Which dependencies:
+
+- `orchestrate.worktreeDeps: [node_modules, .venv, front/node_modules]` in `cadence.yaml`: those paths, relative to the repository
+  (no absolute path, no `..`); one that does not exist in the main tree is reported and skipped;
+- absent: the same folders as the worktrees of a wave (the ignored folders of every level, `node_modules`, `.venv`…; build outputs such as `dist` excluded). The
+  workspace links of a `node_modules` are made again towards the worktree, so the code run is the sha's.
+
+```
+✓ build (npx tsc --noEmit)
+✗ tests (npx vitest run) — code 1
+  - test/a.test.ts > R3 — …
+verify --gate 6b0d9aa : rouge (1 étape sur 2)
+```
+
+Both commands always run, even when the first is red, so the report is whole. A red step lists the failing
+tests the output names (the same reading as the wave's baseline) and the test files that do not load (`- test/a.test.ts (ne se charge pas)`, the typical sign of a missing dependency); with none identifiable, the last 10 lines of the output.
+Each command has 30 minutes (then its whole process group is killed, code 124). Ctrl-C, SIGTERM or a hangup received by cadence kills the running command and removes the worktree before cadence dies.
+`--sha` is required (the moving head of a wave is not a sha to re-verify) and `--retry` does not apply. Exit code:
+**0** green · **1** red · **2** nothing to replay (neither `orchestrate.build` nor `orchestrate.test`), unknown sha or a worktree that cannot be made.
+The Node of the `.nvmrc` is not selected here, and `CADENCE_TEST_WORKERS` is not set: the commands run with the environment of the caller (`PATH` included), so a re-verification run during a wave should export the session's `CADENCE_TEST_WORKERS` itself, or vitest takes every core.

package/docs/fonctionnement.md

@@ -100,7 +100,8 @@ The final review is always played; the budget bounds the writing passes. A `scre
 - Never two sessions in the same repository at the same time. (The worktree mode, `orchestrate.worktrees: true` — on in cadence's own `cadence.yaml`, off where the key is absent — lets two independent lots of one repository play at once, each in its own worktree — [docs/orchestrate.md](orchestrate.md#one-worktree-per-lot-orchestrateworktrees-l279).)
 - A session cannot ask the human anything: it stops and reports, and the lead brings the question back.
 - A sealed acceptance test that contradicts its sheet is corrected by the lead with
-  `cadence spec reseal <lot> <test> --reason "…"`, never by editing `acceptation.json`.
+  `cadence spec reseal <lot> <test> --reason "…"`, never by editing `acceptation.json`; a lot closed by hand
+  and left at `vert: false` is put back to green with `cadence spec green <lot>` (L366).
 - Deliveries and the `raf ux` / `raf review` verdicts belong to the lead, one project at a time.
 
 See also the [orchestrate](orchestrate.md#orchestrate) page and the

package/docs/lead.md

@@ -85,6 +85,7 @@ picture, not its source.
 | At most **as many subagents as the session cap** running at once (2 by default; the human sets it with `CADENCE_MAX_SESSIONS`), orchestrate sessions included | `cadence orchestrate --status` and `cadence lead tour` print `créneaux libres : N sur M`, M being the configured cap and the sessions the lead started by hand (`cadence lead hold`, L255) being subtracted; the lead never raises `--max-sessions` or `CADENCE_MAX_SESSIONS` itself |
 | Never two sessions in the same repository at the same time; the lead does not commit where a wave runs (with `orchestrate.worktrees: true` two lots of one repository play at once, each in its own worktree: not a rule for the lead) | a wave's lock refuses `cadence deliver` while a lot still works there |
 | A locked acceptance test that contradicts the sheet is corrected by the lead with `cadence spec reseal <lot> <test> --reason "…"` (lot in progress, outside a wave and with no wave that is not `done` keeping open a lot of the repository still `doing` in its plan, the resealed lot or another, e.g. a question waiting: `--resume --wave <wave> --answer` or `--drop` first, the one error lists every wave concerned, the live one that holds the lock (to wait for) and the stopped ones, and gives for each stopped wave the single `cd <launch folder> && cadence orchestrate --resume --wave <wave> --drop <project>:<lot> [--drop …]` to run, a `--drop` per open lot of the repository in that wave, the queued ones that are not `doing` in the plan included, since `--resume` would relaunch them and they would take the lock back, L238 L239; an amended sheet is accepted once committed, every commit that touched it citing the lot, L217, never put it back to the red state; a delivered lot with an unstable test: add `--porteur <lot in progress>`, L212), then a new `cadence orchestrate <project>:<lot>` for a lot handed back (`--resume` skips it) | never by a session, never by editing `acceptation.json` |
+| A lot closed by hand (`raf done`) and left at `vert: false` in its `acceptation-<lot>.json` is put back to green by the lead with `cadence spec green <lot>` (L366, GitHub issue #18): the program runs the lot's acceptance command and, green, sets `vert: true`, reseals the listed tests refined since the red commit and commits the file alone, citing the lot; red, nothing changes. `spec reseal` does not cover it (a lot `doing`, or `vert: true` with `--porteur`). `raf done` refuses such a lot without `--force`, and `cadence orchestrate --dry-run` prints `acceptation rouge d'un lot clos` before the wave starts | closed like that it keeps the lock total on its tests, and every later wave of the repository is handed back with `verrou des tests d'acceptation … premier commit fautif` on lots that never touched them; never by editing `acceptation.json` |
 | Deliveries and the `raf ux` / `raf review` verdicts belong to the lead, one project at a time | never to a subagent, never two deliveries in parallel |
 | The UX verdict is the human's unless `lead.ux: lead` (parent `cadence.yaml`, default `human`) | then the lead decides from the report and the captures, and brings any doubt to the human |
 | A session cannot ask the human anything | it stops and reports; the lead brings the question back |
@@ -136,9 +137,9 @@ cadence config set orchestrate.build 'npx tsc --noEmit' --all
 
 - `<key>` is a dotted path (`orchestrate.escalation`); `<value>` is read as YAML, so `true`, a command, or a flow mapping like `{ model: fable }` all work. A key already at that value is left alone.
 - The rest of the file is kept as it is, byte for byte — comments, key order, blank lines, inline lists (`[a, b]`) and mappings: only the lines of the key change (a new key goes at the end of its parent; a value replaced in place keeps its end-of-line comment). The only exception is a file whose rewrite by the YAML library moves lines other than the key's (its line count changes, a comment lands on another line, or the lines carried over would not read back as the same document): then the whole file is rewritten in the library's style. A project with no `cadence.yaml` gets one.
-- In each project it creates a **config lot** that quotes the key (`config cadence.yaml : <key> = <value>`, estimate 0.05), as `raf add` then `raf start` would, and commits `cadence.yaml` and the plan file with explicit paths (`chore(L12): cadence.yaml — <key> = <value>`): nothing else in the index or the working tree goes in. The lot is left `doing`: closing it (`raf done`) stays the lead's step. **Nothing is pushed.**
-- The new text is read back with cadence's own config loaders (plan, news, hook, perf, session, orchestrate, docs, references, migrate, lead.ux, depth, priority, deliver) before anything is written. A `cadence.yaml` that does not read back — before the change or after it — **stops the run** (exit code 1) at that project, with nothing written there; the projects after it are named `non traités`. A commit the repository refuses (a hook) stops it the same way, the two files put back as they were.
-- A project is **skipped**, with the reason, when: it is not its own git repository; the key is already at that value; the key cannot be set in its file (a plain value in the way); `cadence.yaml` or the plan file has uncommitted changes (the explicit-path commit would take them); or its plan is read-only (kept by another tool) and `cadence.yaml` names no creation command. A read-only plan that names one with `plan.add` (a shell command containing `{title}`, replaced by the quoted title of the config lot, e.g. `plan: { path: taches.yaml, lots: taches, add: 'mytool add {title}' }`) gets its config lot from that command, run in the project folder; the lot id is the first id-like word of its output (the commit subject has none when there is none), and `cadence.yaml` and the plan file are committed together. The command alone decides the lot's status.
+- In each project it creates a **config lot** that quotes the key (`config cadence.yaml : <key> = <value>`, estimate 0.05), as `raf add` then `raf start` would, and commits `cadence.yaml`, the plan file and, when the project names `plan.onWrite`, the files that command produces (it runs when the plan is written; see `docs/raf.md`) with explicit paths (`chore(L12): cadence.yaml — <key> = <value>`): nothing else in the index or the working tree goes in. The lot is left `doing`: closing it (`raf done`) stays the lead's step. **Nothing is pushed.**
+- The new text is read back with cadence's own config loaders (plan, news, hook, perf, session, orchestrate, docs, references, migrate, lead.ux, depth, priority, deliver) before anything is written. A `cadence.yaml` that does not read back — before the change or after it — **stops the run** (exit code 1) at that project, with nothing written there; the projects after it are named `non traités`. A commit the repository refuses (a hook) or a `plan.onWrite` command that fails stops it the same way (`lot ou commit impossible`), `cadence.yaml`, the plan file and the produced files put back as they were (a produced file HEAD does not know is deleted).
+- A project is **skipped**, with the reason, when: it is not its own git repository; the key is already at that value; the key cannot be set in its file (a plain value in the way); `cadence.yaml`, the plan file or a file named by `plan.onWrite.files` has uncommitted changes (the explicit-path commit would take them); or its plan is read-only (kept by another tool) and `cadence.yaml` names no creation command. A read-only plan that names one with `plan.add` (a shell command containing `{title}`, replaced by the quoted title of the config lot, e.g. `plan: { path: taches.yaml, lots: taches, add: 'mytool add {title}' }`) gets its config lot from that command, run in the project folder; the lot id is the first id-like word of its output (the commit subject has none when there is none), and `cadence.yaml` and the plan file are committed together. The command alone decides the lot's status.
 - `--dry-run` prints the same lines, prefixed `+ … serait fait`, and writes and commits nothing. The last line counts what was done and skipped. Without `--all` the command refuses (run `raf`/an editor inside the project for a single one).
 
 ## lead tour
@@ -158,7 +159,7 @@ beta · en cours rien · dérive aucune · notes : aucune · prochain T2 Second
 |---|---|
 | `en cours` | ids of the lots in progress, each with its number of commits (`0 commit` included: a close note on a lot without commit is not « done, `raf done` forgotten »); then `aucune activité` when it has no activity at all, `silencieux Nj` when the lot's last activity (commit, note or start) is more than `--idle` days old (default 3) |
 | `dérive` | the gaps `raf check` reports (a lot whose commits leave a document behind, [`docs.sync`](news.md#documentation-that-follows-the-code), included), counted and the first two shown |
-| `notes` | the notes left by the last `session close`, joined with ` / ` and cut at 120 characters |
+| `notes` | the notes left by the last `session close`, joined with ` / ` and cut at 120 characters; when one quotes a lot already `done` or `dropped` (L347), ` ⚠ note périmée : L217 done le 24-10` follows (not cut) — relay it as stale, never as work to do (`--json`: `staleNotes`, absent when none is stale) |
 | `prochain` | the first ready lot (quick wins first) — id and title cut at 60 characters; a lot whose [`gate`](raf.md#plan-file) is not met is not ready |
 | `attend` | only when a lot waits on its `gate`: `attend L190` |
 | `dépôt` | `non commité` (modified or untracked files), `non poussé` (commits ahead of the upstream), `livraison en cours` (live delivery lock); `propre` otherwise |