@techierathore/techieflow 1.0.2 → 1.0.3

package/.tfcore/telemetry/SCHEMA.md

@@ -39,7 +39,7 @@ Questions 1–3 are answered by `gates.jsonl`, which remains **the primary strea
 | `project_type_inferred` | bool | Present **only when `true`** — `metrics.project_type` was absent from `core-config.yaml` and `app` was assumed. Reports must label these records **unclassified**, never silently pool them. |
 | `backfilled` | bool | Present **only when `true`** — the record was reconstructed after the fact, not written at the moment of the event. Written exclusively by `tf-metrics.sh --backfill-*`. |
 | `inferred` | string[] | Present only on backfilled records. Names the fields that were **guessed rather than read**. |
-| `harness` | string \| null | `claude-code` \| `opencode` \| `codex` \| `null`. **Detected by `tf-emit.sh`, never declared by a task** — see below. |
+| `harness` | string \| null | `claude-code` \| `opencode` \| `null`. **Detected by `tf-emit.sh`, never declared by a task** — see below. `codex` is retired (2026-09-07): nothing writes it, and records that carry it stay valid and readable. |
 
 ### `project_type` — what it is and why it exists
 
@@ -70,11 +70,11 @@ So `install-metrics.sh` now re-examines **`docs` alone**, on a later refresh, an
 
 ### `harness` — detected, never declared
 
-The framework runs under **three harnesses**: Claude Code (`.claude/commands/TechieFlow/`), OpenCode (agents/tasks loaded from `opencode.jsonc`), and Codex (`.agents/skills/` plus `.codex/agents/`). The task content is identical across harnesses. A task template therefore **cannot know which one is executing it** — an agent copying a literal from the markdown would stamp whichever harness the example happened to name, and every per-harness comparison would be quietly wrong.
+The framework runs under **two harnesses**: Claude Code (`.claude/commands/TechieFlow/`) and OpenCode (agents/tasks loaded from `opencode.jsonc`). A third, Codex, was retired on 2026-09-07; records written before then may carry `harness: "codex"` and stay valid. The task content is identical across harnesses. A task template therefore **cannot know which one is executing it** — an agent copying a literal from the markdown would stamp whichever harness the example happened to name, and every per-harness comparison would be quietly wrong.
 
 So `tf-emit.sh` detects it and injects it. **Never write `harness` into an emit template.** Detection order:
 
-1. the adapter-owned `TF_HARNESS`, then harness environment variables (`CLAUDECODE`, `CLAUDE_CODE_*` → `claude-code`; any `OPENCODE*` → `opencode`; Codex thread/session markers → `codex`);
+1. the adapter-owned `TF_HARNESS`, then harness environment variables (`CLAUDECODE`, `CLAUDE_CODE_*` → `claude-code`; any `OPENCODE*` → `opencode`);
 2. the parent process chain, bounded to 12 levels (OpenCode sets no `OPENCODE_*` variables, so the process name is the only honest signal);
 3. **`null`** if neither resolves.
 
@@ -93,7 +93,7 @@ So `tf-emit.sh` detects it and injects it. **Never write `harness` into an emit
 
 | Field | Type | Values / notes |
 |---|---|---|
-| `cmd` | string | `day1-brownfield` \| `day1-greenfield` \| `split-brd` \| `mockups` \| `build-phase` \| `verify-phase` \| `fix-issues` \| `triage-issues` \| `log-miss` \| `devguide` \| `productguide` \| `handoff-phase` \| `refresh-status` \| `amend-docs` |
+| `cmd` | string | `day1-brownfield` \| `day1-greenfield` \| `split-brd` \| `mockups` \| `build-phase` \| `verify-phase` \| `fix-issues` \| `triage-issues` \| `log-miss` \| `devguide` \| `productguide` \| `handoff-phase` \| `refresh-status` \| `amend-docs` \| `deploy-checklist` (added 2026-09-06) \| `metrics-report` \| `generate-html` \| `render-workflow-docs` \| `triage-and-fix` \| `framework-reset` (framework maintenance, D-19; all five added 2026-09-07, after FR-37's check was built and found 27 records already carrying a value the schema did not list). A value outside this list is a defect in the emitting task, not in the reader: the reader keeps it. |
 | `mode` | string \| null | `build` \| `fix`. `build-phase` already distinguishes these (FIX mode) — capture it; the ratio is the rework metric. `null` for commands with no mode. |
 | `started` | string | ISO-8601 UTC. When the task began — the timestamp you noted at step 0, not "now minus a guess". |
 | `ended` | string | ISO-8601 UTC. Normally equal to `ts`. |
@@ -104,6 +104,7 @@ So `tf-emit.sh` detects it and injects it. **Never write `harness` into an emit
 | `files_written` | int | A count the agent **already knows**. Do not shell out to compute it. |
 | `build_result` | string \| null | `pass` \| `fail` \| `not-run`. |
 | `harness` | string \| null | Injected by `tf-emit.sh` (§1). **Do not emit it yourself.** |
+| `yolo` | bool | Whether YOLO / goal mode was on for this run (D-12, FR-35; added 2026-09-05). Written by the task from the flag file at the status gate; wired into every task in Session 4c. |
 
 ---
 
@@ -120,7 +121,7 @@ So `tf-emit.sh` detects it and injects it. **Never write `harness` into an emit
 | `routed` | bool | `model == tier_model`. Present only when both are known. Routing is observed, never enforced — `routed:false` is drift made visible, not an error. |
 | `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write` | int | Σ over assistant messages whose timestamp ∈ [`started`, `ended`]. Requires the record to carry `started` + `ended` and the session pointer (`.tfcore/.session/<harness>.json` — written by the `session-pointer.sh` hook on Claude, by the plugin on OpenCode). |
 | `cost_usd` | number \| null | Σ real per-message cost from `opencode.db` on OpenCode; **always `null` on Claude Code** (the transcript has no cost and a rate-card estimate would be an estimate presented as a measurement). |
-| `tokens_scope` | string | `tree` = the full session tree — OpenCode: pointer session + descendant sessions; Claude: pointer transcript + the subagent transcripts beside it (`<transcript-dir>/<session-id>/subagents/agent-*.jsonl`, a deterministic path verified 2026-08-20 via a `SubagentStop` payload's `agent_transcript_path`). `main` = Claude main thread only (no subagents dir existed). `conversation` = an exact persisted Codex rollout counter bounded by documented conversation events; measured session data, not an estimate. `none` = window could not be computed (no pointer / unreadable store / empty window) — **tokens are never estimated**. |
+| `tokens_scope` | string | `tree` = the full session tree — OpenCode: pointer session + descendant sessions; Claude: pointer transcript + the subagent transcripts beside it (`<transcript-dir>/<session-id>/subagents/agent-*.jsonl`, a deterministic path verified 2026-08-20 via a `SubagentStop` payload's `agent_transcript_path`). `main` = Claude main thread only (no subagents dir existed). `conversation` = an exact persisted  measured session data, not an estimate. `none` = window could not be computed (no pointer / unreadable store / empty window) — **tokens are never estimated**. |
 
 | `attempt` | int | **`runs` only, added 2026-08-21.** `1 +` the number of prior non-backfilled `run` records with the same `cmd` whose `reqs_touched` intersects this record's. Stamped only when the record carries a non-empty `reqs_touched`; absent on backfilled records and on REQ-less runs (`metrics-report`, renders). Distinct from the gate-level `attempt` in §3.1 (per REQ per verify). This is the counter `routing.yaml` `escalation:` reads **at launch** — `bash .tfcore/utils/tf-emit.sh --next-run-attempt <cmd> <REQ-ID>...` prints the value the next record would get. Advisory: telemetry records, it never switches a model (DECISIONS.md 2026-08-21). |
 
@@ -172,7 +173,7 @@ Failure:
 |---|---|---|
 | `run_id` | string | The `started` timestamp of the owning run. Ties every REQ verdict in one verify pass together. |
 | `req_id` | string | e.g. `REQ-UI-004`. |
-| `req_class` | string | `UI` \| `FN` \| `RAG` \| `NFR` — the prefix segment of `req_id`. |
+| `req_class` | string | `UI` \| `FN` \| `RAG` \| `NFR` — the prefix segment of `req_id`. **`FR` added 2026-09-07**: the framework's own requirement lines (`docs/TechieFlow-Requirements.md`), graded by `tests/requirements/run.sh`. It is the one `req_class` that does not come from an application's checklist, and it never pools with the others — a framework line and a screen requirement are not the same unit. |
 | `attempt` | int | See §3.1. Derive it; never guess it. |
 | `verdict` | string | Mirrors the checklist vocabulary **exactly**: `Verified` \| `Needs re-verify` \| `FAIL` \| `Blocked` \| `Implemented` \| `Done (pre-existing)`. |
 | `gate` | string \| null | **The FIRST gate that failed**, or `null` on a pass. See §3.2. |
@@ -392,6 +393,8 @@ This is the only stream that carries **three record kinds**: `miss` opens, `miss
 | `found_gate` | string \| null | When `found_by == "gate"`, which gate — same vocabulary as §3.2. `null` otherwise. |
 | `found_run_id` | string \| null | `started` of the finding run. |
 | `failure_class` | string \| null | The §3.3 closed vocabulary, reused verbatim. `null` where none applies. |
+| `what` | string \| null | **The one free-text field** (added 2026-09-05, reset Sitting 4a; D-10). One sentence, in the owner's words, saying what was missed. Never requirement text, file content or a secret (§9). Written into the human-readable `docs/<App>-Misses.md` beside the record by the emitter (§5.5.10, Session 5). |
+| `sort` | string \| null | **Whose gap it was** (added 2026-09-07, reset Session 5; FR-32). The four questions of the miss protocol, asked in order, the first that fits: `spec` (the app's spec did not say it; fix the checklist line) · `unsaid` (the framework never said it; one requirement line plus a check) · `weak-check` (a check existed and did not catch it; fix the check) · `ignored` (it was written and not followed; a hook, or delete the rule). Required by `tf-log-miss.sh`; defaulted by `tf-triage.sh` (`weak-check` for a demoted row, `spec` for a new one, `ignored` for a code edit during triage); amendable (§5.5.7). `null` on records written before the field existed; `FIELD_SINCE` keeps them out of the denominator. |
 
 **`origin_model`, `origin_harness` and `origin_confidence` are never written by an agent** — the same rule as `harness` (§1) and for the same reason: task markdown is shared byte-identically across three harnesses, so a copied literal would stamp the wrong model on every record and quietly corrupt every per-model comparison built on it. `tf-emit.sh` resolves all three from `origin_run_id`, and **forces `origin_model` / `origin_harness` to `null` whenever the lookup fails, overwriting anything the caller supplied.** A guess is worse than a gap here, because nothing downstream can see that it was one.
 
@@ -419,7 +422,7 @@ The agent's job on a `miss` record is therefore small and honest: name what was
 | `verdict_after` | string | `Verified` \| `Needs re-verify` \| `FAIL` \| `deferred` \| `wont-fix` |
 | `reopened` | bool | `true` when this miss had already closed `Verified` and a later escape re-opened it. |
 | `cost_attribution` | string | **Derived by `tf-emit.sh`** from the fix run's `reqs_touched`: `sole` \| `shared:<n>` \| `none` — §5.5.3. |
-| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `cost_usd`, `tokens_scope`, `model` | — | **Injected by `tf-emit.sh`** from the `fix_run_id` window, by exactly the §2.5 mechanism. Never written by an agent. `cost_usd` stays `null` on Claude Code and Codex, per §4. |
+| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `cost_usd`, `tokens_scope`, `model` | — | **Injected by `tf-emit.sh`** from the `fix_run_id` window, by exactly the §2.5 mechanism. Never written by an agent. `cost_usd` stays `null` on Claude Code, per §4. |
 
 ### 5.5.3 `cost_attribution` — the field the money number stands on
 
@@ -507,6 +510,7 @@ That is what keeps it inside the append-only rule rather than an edit wearing a
 | Field | Vocabulary |
 |---|---|
 | `why_missed` | §5.5.6's seven values |
+| `sort` | `spec` · `unsaid` · `weak-check` · `ignored` (§5.5.1; added 2026-09-07) |
 
 - **A judgement may be completed; an observation may not.** `why_missed` is a classification an analyst can still make honestly next week. `found_gate` is a fact about a run that is over — §3.5's *"never backfill the old records with a verdict they never had"* is this same rule seen from the other side.
 - **Nothing the emitter derives is ever amendable** — `origin_model`, `origin_harness`, `origin_confidence`, `cost_attribution` and every token/cost field are excluded outright. An amend that could set them would be a hole straight through §5.5.1's central rule.
@@ -526,6 +530,8 @@ It **prints its refusal on stdout** rather than failing silently — an agent th
 
 ### 5.5.7b Closed vocabularies are enforced ON WRITE (added 2026-08-31)
 
+**Since 2026-09-05 (reset Sitting 4a) the emitter also refuses:** a record with no `kind`; a record carrying a field this document does not define for its kind (the allowlist is `_ALLOWED` in `tf-emit.sh`, kept in step with these tables); and a `miss` with no `miss_id`. It also overwrites, never merely fills, `harness` when the harness is detected, every derived cost and model field on a `runs`/`gates` record, and the cost fields on a `miss-fix`. A caller cannot self-report any of them. The `_metrics-emit-gate.md` prose that used to say all this was deleted in the same sitting; the script is the rule.
+
 `tf-emit.sh` validates `miss_class`, `artifact`, `severity`, `found_by` and `why_missed` on a `miss`, and `verdict_after` and `fix_cmd` on a `miss-fix`, against the vocabularies above. **A record carrying a value outside one is refused and never appended**, with the reason and the allowed values printed on stdout. It still exits 0 — telemetry has no veto (§10), and neither does a refused record.
 
 This closes an asymmetry that was real and was hit: the emitter checked the `miss-amend` allowlist meticulously (§5.5.7) and checked a `miss` record's own enums **not at all**. So a single typo in `miss_class` landed permanently on an append-only stream, invented a category in every distribution built on it, and **could not be corrected** — `miss_class` is not amendable (§5.5.7 admits only closed-vocabulary judgements the emitter does not derive), and constraint 5 forbids editing the file. The only legal move left was to report it.
@@ -567,6 +573,36 @@ resolved in this direction, so the two implementations agree by construction rat
 
 ---
 
+### 5.5.9 `kind: "review"` — an owner review, and what it cost (FR-36; built 2026-09-06, Sitting 4b)
+
+Decided in Session 2 of the reset (D-17): every phase that ends in an owner review records the review's outcome, so the cost of deviation is measurable in every phase, not only in build and verify. UAT issues stay `miss` records; a review record is the owner reading a phase's output and giving corrections.
+
+Written by the run that applies the corrections (`day1-greenfield --stage2`, `amend-docs`; build, verify and handoff reviews are wired in Sitting 4c), after that run's own `runs.jsonl` record exists:
+
+```json
+{"kind":"review","phase":"day1-review","reviewed_run_id":"2026-09-05T16:19:38Z",
+ "correction_run_id":"2026-09-06T05:02:11Z","corrections":2,
+ "what":"the lock screen had no way out and the acceptance lines were too dense to read"}
+```
+
+| Field | Type | Meaning |
+|---|---|---|
+| `phase` | string | `day1-review` · `build-review` · `verify-review` · `handoff-review` (closed vocabulary, enforced on write) |
+| `reviewed_run_id` | string | the `started` of the run that produced the reviewed output |
+| `correction_run_id` | string \| null | the `started` of the run that applied the corrections; null when the owner applied them by hand |
+| `corrections` | integer | how many corrections the owner gave (required) |
+| `what` | string | one sentence in the owner's words; the only free text, like `miss.what` |
+| `tokens_produce`, `cost_produce_usd`, `model_produce` | derived | copied from the run `reviewed_run_id` names (`tokens_out`, `cost_usd`, `model`); null when no run record matches |
+| `tokens_correct`, `cost_correct_usd`, `model_correct` | derived | the same from the run `correction_run_id` names |
+
+The two costs are the review's two numbers: what it cost to produce something the owner had to correct, and what the corrections cost. A caller's cost figure is discarded, as on `miss-fix`. Readers that count misses ignore this kind; `tf-metrics.sh` reports reviews since Session 5 (2026-09-07): the count, the corrections given, by phase, and the two token means over the records that carry them (§5.5.8).
+
+### 5.5.10 The readable file — `docs/<App>-Misses.md` (FR-31; built 2026-09-07, Session 5)
+
+The stream is for scripts. The owner reads `docs/<App>-Misses.md`: one row per `miss` record, newest first, in three tables (open, fixed, will not fix), each row holding the miss id and its row, when and by whom it was found, whose gap it was (`sort`, in words) and the `what` sentence. A record without a sentence shows its class and artifact instead; a record from before ids were required still gets a row.
+
+`tf-emit.sh` rebuilds the file and its HTML through `tf-misses-md.py` after **every** write to the misses stream, whichever door wrote it (log-miss, triage, fix-close, a hand-written record, an amend), so the file is never older than the record. It is **derived**: nothing reads it, nobody edits it, and a wrong row is corrected by a new record. A project whose stream predates the script gets the file by running `bash .tfcore/utils/tf-misses-md.sh` once. The check for FR-31 is in `tests/bugs/run.sh`: the row count equals the record count.
+
 ## 6. Provenance — three separations, one rule applied three times
 
 **Data from different provenances never merges.**

package/.tfcore/telemetry/tf-metrics.sh

@@ -34,6 +34,7 @@ import re
 import subprocess
 import sys
 from collections import Counter, defaultdict, OrderedDict
+from datetime import datetime
 
 STREAMS = ("runs", "gates", "sessions", "commits", "misses")
 VERDICTS = ("Verified", "Needs re-verify", "FAIL", "Blocked", "Implemented", "Done (pre-existing)")
@@ -52,7 +53,7 @@ LATE_GATES = {"perf": "2026-08-10", "assets": "2026-08-31", "mockup-parity": "20
 # fill, so counting it as "not assessed" understates the practice being measured.
 # It leaves that field's denominator and is reported separately. SCHEMA.md §5.5.6 /
 # §3.5. Keep this table in sync when an optional field is added to any stream.
-FIELD_SINCE = {"why_missed": "2026-08-28"}
+FIELD_SINCE = {"why_missed": "2026-08-28", "sort": "2026-09-07"}
 
 # Fields a `miss-amend` record may complete, and their closed vocabularies.
 # Kept identical to tf-emit.sh's `_AMENDABLE`; the emitter enforces it on write and
@@ -62,7 +63,11 @@ AMENDABLE_FIELDS = {
     "why_missed": ("missing-checklist-item", "insufficient-verify-method",
                    "code-audit-limitation", "ambiguous-acceptance",
                    "dependency-not-declared", "instruction-ignored", "other"),
+    "sort": ("spec", "unsaid", "weak-check", "ignored"),
 }
+# The four-question sort in words, for the report (SCHEMA.md §5.5.10).
+SORT_WORDS = {"spec": "the app's spec did not say it", "unsaid": "the framework never said it",
+              "weak-check": "the check was too weak", "ignored": "said and ignored"}
 MIN_N = 3  # fewer supporting records than this -> "insufficient data", never a number
 
 
@@ -206,6 +211,7 @@ def analyse_misses(misses):
     opened = [m for m in misses if m.get("kind") == "miss" and not m.get("backfilled")]
     fixes = [m for m in misses if m.get("kind") == "miss-fix" and not m.get("backfilled")]
     amends = [m for m in misses if m.get("kind") == "miss-amend"]
+    reviews = [m for m in misses if m.get("kind") == "review"]
 
     # ---- fold amendments into their parents BEFORE anything is counted (§5.5.7).
     # An amend completes a field the miss left null; it can never overwrite one, so
@@ -235,8 +241,10 @@ def analyse_misses(misses):
     # reported separately — never silently, and never backfilled with a value
     # nobody assessed at the time.
     def _eligible(rec, field):
+        # A record written after the field existed, or one that carries it anyway (an older
+        # record completed by an amend is sorted, whatever its date; Session 5, 2026-09-07).
         since = FIELD_SINCE.get(field)
-        return not since or (rec.get("ts") or "") >= since
+        return not since or (rec.get("ts") or "") >= since or bool(rec.get(field))
 
     # Latest fix per miss decides open/closed; a fix naming no known miss is an orphan.
     known = {m.get("miss_id") for m in opened}
@@ -349,13 +357,22 @@ def analyse_misses(misses):
     sole_tokens, sole_priced_n = tok(sole)
     shared_priced = [f for f in shared if f.get("tokens_out") is not None]
 
-    # Dollars exist ONLY where a harness measured them. Claude Code and Codex carry
+    # Dollars exist ONLY where a harness measured them. Claude Code carries
     # cost_usd:null permanently (SCHEMA.md §4) and are never priced from a rate card
     # here — a pooled sum over mixed harnesses would silently under-report.
     paid = [f for f in sole if f.get("cost_usd") is not None]
     escaped = [m for m in opened if m.get("found_by") in ("owner", "production")]
     design = [m for m in opened if m.get("miss_class") == "unspecified-gap"]
 
+    # Owner reviews (§5.5.9): how many corrections each phase's output needed, and what
+    # producing it and correcting it cost. Token means divide by the records that carry the
+    # figure (§5.5.8), never by all of them.
+    def _mean(key):
+        xs = [r[key] for r in reviews if isinstance(r.get(key), (int, float))]
+        return (round(float(sum(xs)) / len(xs), 1) if len(xs) >= MIN_N else None), len(xs)
+    tp, tp_n = _mean("tokens_produce")
+    tc, tc_n = _mean("tokens_correct")
+
     return {
         "misses_total": len(opened),
         "miss_fixes_total": len(fixes),
@@ -381,6 +398,22 @@ def analyse_misses(misses):
                                    if m.get("found_by") in ("owner", "production")
                                    and not m.get("why_missed")
                                    and _eligible(m, "why_missed")),
+        # Whose gap (§5.5.10, FR-32): the four-question sort. Same denominator rule as
+        # why_missed — records that carry it, out of records that could have.
+        "sort_n": sum(1 for m in opened if m.get("sort")),
+        "sort_eligible": sum(1 for m in opened if _eligible(m, "sort")),
+        "sort_predates_field": sum(1 for m in opened if not _eligible(m, "sort")),
+        "sort": OrderedDict(
+            sorted(Counter(m["sort"] for m in opened if m.get("sort")).items(),
+                   key=lambda kv: (-kv[1], kv[0]))),
+        # Owner reviews (§5.5.9)
+        "reviews_n": len(reviews),
+        "review_corrections": sum(r["corrections"] for r in reviews if isinstance(r.get("corrections"), int)),
+        "reviews_by_phase": OrderedDict(
+            sorted(Counter(r.get("phase") or "?" for r in reviews).items(),
+                   key=lambda kv: (-kv[1], kv[0]))),
+        "review_tokens_produce_mean": tp, "review_tokens_produce_n": tp_n,
+        "review_tokens_correct_mean": tc, "review_tokens_correct_n": tc_n,
         "class_distribution": OrderedDict(
             sorted(Counter(m.get("miss_class") or "?" for m in opened).items(),
                    key=lambda kv: (-kv[1], kv[0]))),
@@ -455,7 +488,7 @@ def analyse_phases(runs):
          confident fan-out figures largely composed of runs that could not have
          seen a subagent. Tree-scope only, with the exclusion printed.
 
-      3. DOLLARS.  Never pooled across harness (SCHEMA.md §4). Claude and Codex
+      3. DOLLARS.  Never pooled across harness (SCHEMA.md §4). Claude
          carry cost_usd:null permanently; a sum over mixed records under-reports
          silently. Reported per harness or not at all.
 
@@ -464,6 +497,34 @@ def analyse_phases(runs):
     when someone asks how it was measured."""
     live = [r for r in runs if r.get("kind", "run") == "run" and not r.get("backfilled")]
 
+    # A run that carries both ends but no `duration_s` was silently worth ZERO TIME here,
+    # while its tokens still counted — so a phase's total time was a sum over some of its
+    # runs and its tokens a sum over others (found 2026-09-07: the reset's own 13 runs
+    # reported 16h49m, because 6 of them predate the field and the true figure is ~55h).
+    # Deriving it is arithmetic on two recorded facts, not a guess, so it is done — and
+    # counted, so the report can say how many of its minutes were derived rather than read.
+    # `ended` itself may be absent on an older record; SCHEMA.md's own rule is that `ended`
+    # IS the moment the record was written, which is exactly what `ts` holds.
+    def _secs(a, b):
+        try:
+            fmt = "%Y-%m-%dT%H:%M:%SZ"
+            return int((datetime.strptime(b, fmt) - datetime.strptime(a, fmt)).total_seconds())
+        except Exception:
+            return None
+
+    derived_n = 0
+    for r in live:
+        if r.get("duration_s") or not r.get("started"):
+            continue
+        end = r.get("ended") or r.get("ts")
+        if not end:
+            continue
+        d = _secs(r["started"], end)
+        if d is not None and d >= 0:
+            r["duration_s"] = d
+            r["duration_derived"] = "ended" if r.get("ended") else "ts"
+            derived_n += 1
+
     def scope_of(r):
         return r.get("tokens_scope") or "absent"
 
@@ -532,6 +593,10 @@ def analyse_phases(runs):
                 "median": median(durs),
                 "max": max(durs) if durs else None,
                 "n": len(durs),
+                # how many of those minutes were computed from the record's own two
+                # timestamps because the record predates `duration_s` — arithmetic on
+                # recorded facts, but the reader is told rather than left to assume.
+                "derived_n": sum(1 for r in rs if r.get("duration_derived")),
             },
             "share_of_duration": pct(sum(durs), grand_dur),
             "tokens_measured_n": len(priced),
@@ -549,6 +614,27 @@ def analyse_phases(runs):
                 key=lambda kv: (-kv[1]["tokens_out"], kv[0]))),
             "harnesses": OrderedDict(sorted(Counter(r.get("harness") or "?" for r in rs).items())),
             "modes": OrderedDict(sorted(Counter(r.get("mode") or "—" for r in rs).items())),
+            # A phase run in named modes (a reset's sessions, a build's fresh/fix passes)
+            # is several different jobs under one `cmd`. The per-mode split says which,
+            # in the order they happened. Same denominators as the phase above: a run
+            # with no computable window contributes no tokens, never a zero.
+            "by_mode": OrderedDict(
+                (mode, {
+                    "runs": len([r for r in rs if (r.get("mode") or "—") == mode]),
+                    "duration_s": sum(r.get("duration_s") or 0
+                                      for r in rs if (r.get("mode") or "—") == mode),
+                    "tokens_out": sum(r.get("tokens_out") or 0
+                                      for r in rs if (r.get("mode") or "—") == mode and has_tokens(r)),
+                    "tokens_unmeasured_n": len([r for r in rs
+                                                if (r.get("mode") or "—") == mode and not has_tokens(r)]),
+                    "files_written": sum(r.get("files_written") or 0
+                                         for r in rs if (r.get("mode") or "—") == mode),
+                    "first_started": min((r.get("started") or "" for r in rs
+                                          if (r.get("mode") or "—") == mode), default=""),
+                })
+                for mode in sorted({(r.get("mode") or "—") for r in rs},
+                                   key=lambda m: min((r.get("started") or "" for r in rs
+                                                      if (r.get("mode") or "—") == m), default=""))),
             "build_result": OrderedDict(sorted(Counter(r.get("build_result") or "—" for r in rs).items())),
             "reqs_touched_total": sum(r.get("reqs_count") or 0 for r in rs),
             "files_written_total": sum(r.get("files_written") or 0 for r in rs),
@@ -919,30 +1005,50 @@ def analyse(repos):
     live = [g for g in gates if not g.get("backfilled")]
     back = [g for g in gates if g.get("backfilled")]
 
+    # `attempt` is DEFINED by §3.1 as 1 + the number of prior live gate records for the same
+    # requirement in the same app — a count over this very stream, not a judgement. A record
+    # that omits it was therefore being read as "no attempt", which drops it out of the
+    # first-pass rate and reports 0% for a set of records that all passed on their first and
+    # only verdict (found 2026-09-07 on the framework's own requirement lines). Derived here,
+    # in stream order, for records that lack it. A record that carries one is never touched.
+    _seen = {}
+    for g in sorted(live, key=lambda r: (r.get("ts") or "", r.get("run_id") or "")):
+        key = (g.get("app"), g.get("req_id"))
+        _seen[key] = _seen.get(key, 0) + 1
+        if g.get("attempt") is None:
+            g["attempt"] = _seen[key]
+            g["attempt_derived"] = True
+
     # REQs with ANY backfilled record are excluded from the live first-pass rate:
     # their live `attempt` numbering restarts at 1 (SCHEMA.md §3.1).
-    tainted = {g.get("req_id") for g in back}
+    # A requirement is keyed by (app, req_id): REQ-UI-001 exists in every project, so a rollup that
+    # keyed on req_id alone counted TfLens's and TechieBlog's as one requirement and its first-pass
+    # rate was wrong (MISS-TechieFlow-20260907-03, Session 5).
+    def rk(r):
+        return (r.get("app"), r.get("req_id"))
+
+    tainted = {rk(g) for g in back}
 
-    out = {"per_repo": per_repo, "tainted_reqs": sorted(x for x in tainted if x),
+    out = {"per_repo": per_repo, "tainted_reqs": sorted("%s:%s" % x for x in tainted if x[1]),
            "live": {}, "backfilled": {}, "pooled": {},
            "misses": analyse_misses(misses),
            "phases": analyse_phases(runs)}
 
     for label, bucket in (("live", live), ("backfilled", back)):
         for ptype, recs in sorted(seg(bucket).items()):
-            eligible = [r for r in recs if label == "backfilled" or r.get("req_id") not in tainted]
-            reqs = {r.get("req_id") for r in eligible}
-            first_pass = {r.get("req_id") for r in eligible
+            eligible = [r for r in recs if label == "backfilled" or rk(r) not in tainted]
+            reqs = {rk(r) for r in eligible}
+            first_pass = {rk(r) for r in eligible
                           if r.get("attempt") == 1 and r.get("verdict") == "Verified"}
             failures = [r for r in recs if r.get("verdict") not in ("Verified", "Done (pre-existing)")]
             dist = Counter(r.get("gate") or "unattributed" for r in failures)
-            escaped_reqs = {r.get("req_id") for r in recs if r.get("gate") == "escaped"}
-            failed_reqs = {r.get("req_id") for r in failures}
+            escaped_reqs = {rk(r) for r in recs if r.get("gate") == "escaped"}
+            failed_reqs = {rk(r) for r in failures}
             out[label][ptype] = {
                 "records": len(recs),
                 "reqs_scored": len(reqs),
                 "reqs_excluded_backfill_taint":
-                    len({r.get("req_id") for r in recs if r.get("req_id") in tainted})
+                    len({rk(r) for r in recs if rk(r) in tainted})
                     if label == "live" else 0,
                 "first_pass_n": len(first_pass),
                 "first_pass_rate": pct(len(first_pass), len(reqs)) if len(reqs) >= MIN_N else "insufficient data (n=%d)" % len(reqs),
@@ -1154,8 +1260,9 @@ def print_phases(p, W):
     for cmd, m in p["phases"].items():
         print("  [%s]  %d run(s)" % (cmd, m["runs"]))
         d = m["duration_s"]
-        print("     wall clock       : total %s · median %s · max %s   (n=%d timed)"
-              % (_hms(d["total"]), _hms(d["median"]), _hms(d["max"]), d["n"]))
+        print("     wall clock       : total %s · median %s · max %s   (n=%d timed%s)"
+              % (_hms(d["total"]), _hms(d["median"]), _hms(d["max"]), d["n"],
+                 ", %d derived from the record's own timestamps" % d["derived_n"] if d.get("derived_n") else ""))
         t = m["tokens"]
         print("     tokens           : out %s · in %s · cache-read %s · cache-write %s"
               % (_k(t["out"]), _k(t["in"]), _k(t["cache_read"]), _k(t["cache_write"])))
@@ -1217,7 +1324,15 @@ def print_phases(p, W):
             print("     cost (%s)  : $%s over %d record(s) — MEASURED, never pooled "
                   "across harness" % (h, c["usd"], c["records"]))
         if m["reqs_touched_total"] or m["files_written_total"]:
-            print("     work             : %d REQ touch(es) · %d file(s) written"
+            bm = m.get("by_mode") or {}
+        if len(bm) > 1:
+            print("     by mode          : (in the order they ran)")
+            for mode, v in bm.items():
+                unm = ("  [%d unmeasured]" % v["tokens_unmeasured_n"]) if v["tokens_unmeasured_n"] else ""
+                print("         %-22s %2d run(s)  %8s  %8s out  %3d file(s)%s"
+                      % (mode, v["runs"], _hms(v["duration_s"]), _k(v["tokens_out"]),
+                         v["files_written"], unm))
+        print("     work             : %d REQ touch(es) · %d file(s) written"
                   % (m["reqs_touched_total"], m["files_written_total"]))
         print("")
 
@@ -1225,7 +1340,7 @@ def print_phases(p, W):
 def print_misses(m, W):
     """The §5.5 block. Two exclusions are printed with the figures they bound —
     an exclusion the reader cannot see is indistinguishable from a bug."""
-    if not m["misses_total"] and not m["miss_fixes_total"]:
+    if not m["misses_total"] and not m["miss_fixes_total"] and not m.get("reviews_n"):
         return
     print("")
     print("-" * W)
@@ -1269,9 +1384,29 @@ def print_misses(m, W):
               % m["escapes_missing_why"])
         print("       nothing recorded why. That is the most valuable record in the stream.")
         print("       Complete it: tf-emit.sh --amend <miss_id> why_missed <value>  (§5.5.7)")
+    # whose gap — the four-question sort (§5.5.10). Its own denominator, like why_missed.
+    if m.get("sort"):
+        print("  whose gap           : (%d of %d misses sorted)" % (m["sort_n"], m["sort_eligible"]))
+        for k, n in m["sort"].items():
+            print("      %-12s %4d  %-5s %s" % (k, n, pct(n, m["sort_n"]), SORT_WORDS.get(k, "")))
+    if m.get("sort_predates_field"):
+        print("     %d miss(es) predate the sort field (added %s); sort them with"
+              % (m["sort_predates_field"], FIELD_SINCE["sort"]))
+        print("     tf-emit.sh --amend <miss_id> sort <spec|unsaid|weak-check|ignored>")
     if m["amendments_applied"]:
         print("  amendments folded   : %d field(s) completed by miss-amend records (§5.5.7)"
               % m["amendments_applied"])
+    # owner reviews (§5.5.9): corrections per reviewed phase, and the two costs
+    if m.get("reviews_n"):
+        print("  owner reviews       : %d review(s), %d correction(s) given — "
+              % (m["reviews_n"], m["review_corrections"])
+              + "  ".join("%s=%d" % kv for kv in m["reviews_by_phase"].items()))
+        print("     tokens to produce the reviewed output : %s (n=%d)"
+              % (m["review_tokens_produce_mean"] if m["review_tokens_produce_mean"] is not None
+                 else "insufficient data", m["review_tokens_produce_n"]))
+        print("     tokens to apply the corrections       : %s (n=%d)"
+              % (m["review_tokens_correct_mean"] if m["review_tokens_correct_mean"] is not None
+                 else "insufficient data", m["review_tokens_correct_n"]))
     if m["orphan_amends"]:
         print("     ⚠ %d miss-amend record(s) name no known miss, or a field outside the"
               % m["orphan_amends"])
@@ -1315,7 +1450,7 @@ def print_misses(m, W):
     else:
         print("        USD per miss        : no measured dollars (%d priced records)"
               % m["cost_usd_records"])
-        print("           Claude Code and Codex carry cost_usd:null permanently and are NEVER")
+        print("           Claude Code carries cost_usd:null permanently and is NEVER")
         print("           priced from a rate card here (SCHEMA.md §4). Real dollars come from")
         print("           OpenCode runs; token counts are the honest figure everywhere else.")
     print("     shared (apportioned): %d fix records — equal division, NOT a measurement"

package/.tfcore/templates/project-brief-tmpl.yaml

@@ -150,7 +150,7 @@ sections:
       - id: architecture-considerations
         title: Architecture Considerations
         template: |
-          - **Repository Structure:** {{repo_thoughts}}
+          - **Repository Structure:** decided at day-1 from the stack answer set; name no projects or folders here (owner, 2026-09-06)
           - **Service Architecture:** {{service_thoughts}}
           - **Integration Requirements:** {{integration_needs}}
           - **Security/Compliance:** {{security_requirements}}

package/.tfcore/templates/stack-defaults/dotnet.md

@@ -0,0 +1,35 @@
+# TechieFlow — Stack Defaults: .NET
+
+| | |
+|---|---|
+| Purpose | An answer set for `TechieFlow-Stack-Questions.md`. These are the defaults the framework's author uses for their own .NET / Blazor / MAUI projects. Naming this answer set at day-1 fills in the questions it covers; the agent asks the rest. |
+| Audience | Owners of .NET projects using TechieFlow. Owners in other stacks write their own answer set with the same structure. |
+| Status | Drafted in Session 2 of the reset (2026-09-04) from the author's answers. Becomes a file under `.tfcore/templates/stack-defaults/` in Session 3. Configuration document read by agents; not rendered to HTML. |
+| Applies to | Projects that declare `stack: dotnet` and name this answer set. Change any row for a project by overriding it in that project's Architecture Stack Decisions section; the override wins. |
+
+---
+
+## Answers
+
+| Q | Topic | Default | Still asked at day-1? |
+|---|---|---|---|
+| Q1 | Configuration | Non-secret configuration lives in `appsettings.json`, layered by `appsettings.{Environment}.json`. No other configuration mechanism is created. | No |
+| Q2 | Secrets in development | Project user secrets (`dotnet user-secrets`), visible to the developer, never committed. `appsettings.Development.json` is committed and therefore never holds a real secret. A `secrets.example.json` in the project lists every key the application reads. | No |
+| Q3 | Database | PostgreSQL, running in Docker, for development and production. Docker is always running on the development machine because WSL, where the harness runs, depends on it. If PostgreSQL is unreachable the container is stopped: the agent starts it and continues. Only if no PostgreSQL container exists at all does the agent stop and ask the owner for connection details. It never substitutes another engine and never creates its own database container. | No, unless no container exists |
+| Q4 | Authentication | Two choices only: **AppManager**, the author's shared platform for identity, roles, licences and subscriptions, which counts as part of the application and not as an external integration; or a different mechanism named by the owner. | **Yes**: "AppManager, or something else?" |
+| Q5 | Logging | Serilog, always, with file logging wired at startup before anything else can fail. | No |
+| Q6 | Tests | xUnit, always. A test project exists from day-1. | No |
+| Q7 | Layout and naming | `src/` and `tests/` at the root. The primary executable project is named exactly `<App>`; `<App>.App` is banned. Secondary heads take a descriptive suffix (`<App>.Api`, `<App>.Desktop`). | No |
+| Q8 | User interface | TrBlazeUI for every Blazor head and every MAUI Blazor Hybrid head. Native controls for WinForms, WPF and non-Blazor MAUI heads. Rendering mode is chosen per project and recorded. | Rendering mode only |
+| Q9 | Hosting | Web applications run containerised on a Bluehost VPS. The owner supplies a pipeline guidance document at UAT go-ahead, and a deployment checklist is produced from it. | Asked at UAT go-ahead, as the questionnaire specifies |
+| Q10 | Production secrets | Decided when the owner asks for the production pipeline, after UAT. Until then no document states where production secrets live. | Asked after UAT |
+| Q11 | Standing rules and prohibitions | 1. Never add a NuGet package without a line in the Architecture document saying why. 2. Never create a second configuration mechanism. 3. When TechieFlow, TrBlazeUI, TechieRag or any other internal library lacks something, record it in that library's feedback file and hold the feature until the library is fixed. Never implement a workaround. 4. Data access is always Dapper. 5. Database migrations live in a dedicated project named `<App>Db` (console or library) using the DbUp package. The web application runs the migration at startup, or the pipeline runs it after deployment. Never a `database` folder of loose scripts at the repository root. 6. Log files are written under the build output folder (`bin/`), which is git-ignored. Never at the repository root. 7. No unnecessary folders at the repository root (`data`, `database`, `scripts` and the like). Everything sits under `src/` or `tests/` according to what it belongs to. | No |
+
+---
+
+## Notes
+
+- Q4 is asked on purpose even with this answer set, because the choice differs per product.
+- Q3's "start the container, never create one" replaces the behaviour that produced TfLens's own database container: an agent that cannot reach the expected database restarts it or asks, and never builds an alternative.
+- Q11.5 replaces the `database` folder of loose migration scripts that TfLens accumulated.
+- Q11.3 is a standing framework convention restated as a stack rule so that it is recorded per project and its violations can be counted.

package/.tfcore/templates/stack-questions.md

@@ -0,0 +1,77 @@
+# TechieFlow — Stack Questions
+
+| | |
+|---|---|
+| Purpose | The questions the framework asks the owner about a project's technology and conventions, when it asks them, and where the answers are recorded. The framework itself is technology-neutral; these answers are what make a project's documents and code specific. |
+| Audience | Framework agents (the questionnaire is asked verbatim), project owners, contributors. |
+| Status | Drafted in Session 2 of the reset (2026-09-04). Becomes a template under `.tfcore/templates/` in Session 3. Configuration document read by agents; not rendered to HTML. |
+| Related | `TechieFlow-Stack-Defaults-DotNet.md` (an answer set), `TechieFlow-Requirements.md` (FR-01, FR-02) |
+
+---
+
+## 1. Principle
+
+The framework never assumes a language, a UI library, a database, an authentication scheme, a test framework or a hosting target. Before any project document is written, the agent asks the questions below and records the answers in one place: the **Stack Decisions** section of the project's Architecture document. Every later command reads its stack facts from there and nowhere else.
+
+An owner who always works in one stack answers once by naming an **answer set**, a file that holds their standard answers. The framework ships one answer set, `TechieFlow-Stack-Defaults-DotNet.md`, described as the defaults its author uses for their own .NET projects. Any owner may copy it, change it, or write a different one. Naming an answer set fills in every question it covers; the agent then asks only the questions the set leaves open.
+
+---
+
+## 2. When the questions are asked
+
+| Moment | Questions | Why then |
+|---|---|---|
+| Day-1, before any document is written | Q1 to Q8 | Every document depends on the answers. |
+| When the owner gives the go-ahead for user acceptance testing (UAT) | Q9 | Hosting decisions made earlier are guesses; by UAT the application is real. |
+| When the owner asks for a production deployment pipeline, after UAT | Q10 | Production secrets and infrastructure are decided by the people who run production. |
+
+In YOLO mode the agent does not skip the day-1 questions; it takes the answer set's value where one exists and stops with a clear message where none does. A document written without a recorded answer is a defect.
+
+---
+
+## 3. The questions
+
+**Q1. Configuration.** Where does non-secret configuration live, and how is it layered per environment?
+
+**Q2. Secrets in development.** Where do secrets live on a developer machine, and what must never be committed?
+
+**Q3. Database.** Which database engine in development and which in production? Is a container for the database acceptable, and under what condition? What does the agent do if the database is not reachable?
+
+**Q4. Authentication and authorisation.** Which identity mechanism: a shared platform, the framework's built-in identity, an external provider, or none? Who owns roles, licences and subscriptions?
+
+**Q5. Logging.** Which logging library, which sinks, and is file logging mandatory?
+
+**Q6. Tests.** Which test framework? Is a test project mandatory from day one? Which categories of test are expected (unit, integration, browser)?
+
+**Q7. Solution layout and naming.** Folder layout for source and tests; naming rule for the primary executable project and for secondary heads.
+
+**Q8. User interface.** Which UI framework or component library for each kind of head (web, mobile, desktop)? Which rendering mode by default?
+
+**Q9. Hosting and deployment.** Where does the application run, in what form (container, service, static files), and is there a deployment guidance document to follow? Is a deployment checklist required?
+
+**Q10. Production secrets and pipeline.** Where do production secrets live, and how does the pipeline inject them?
+
+**Q11. Standing rules and prohibitions.** Anything an agent must always or never do in this repository that is not already enforced by a hook. Recorded as a list; the framework treats each item as a rule and tracks whether it is honoured. Two rules are present by default in every project, whatever the stack, and an owner may remove them only by saying so:
+
+1. Log files are written under the build output folder, which is git-ignored. Never at the repository root.
+2. No unnecessary folders at the repository root (`data`, `database`, `scripts` and the like). Everything sits under the source folder or the tests folder according to what it belongs to.
+
+---
+
+## 4. Where the answers go
+
+The Architecture document gains a section, **Stack Decisions**, placed first, one row per question:
+
+| Q | Decision | Source | Date |
+|---|---|---|---|
+| Q1 | `appsettings.json` plus `appsettings.{Environment}.json` | answer set: DotNet | 2026-09-04 |
+| Q3 | PostgreSQL in a container for development and production | owner, day-1 | 2026-09-04 |
+| … | | | |
+
+"Source" is either the answer set name or "owner" with the moment it was asked. Q9 and Q10 rows are added when they are answered; until then they read "not yet asked (UAT)" and "not yet asked (production)". The Coding Standards document references this section instead of restating it.
+
+---
+
+## 5. What this replaces
+
+Before this document, the framework had one standing technology decision (Serilog file logging) written into the day-1 tasks, the BRD template and the Architecture template, and no place for any other. Projects therefore invented their own arrangements at build time; TfLens ended with settings in three places. This questionnaire moves every such decision to day-1 and to one recorded location.

package/.tfcore/templates/v4custom/app-agents-md-tmpl.md

@@ -1,7 +1,7 @@
 # {AppName} — project session memory (all harnesses)
 
 <!-- This file is COMMITTED (unlike CLAUDE.md, which is gitignored and imports it).
-     OpenCode and Codex auto-load AGENTS.md; Claude Code loads it through CLAUDE.md's
+     OpenCode auto-loads AGENTS.md; Claude Code loads it through CLAUDE.md's
      @AGENTS.md import. Keep everything in here harness-neutral — Claude-only
      material (permissions, tool preference) lives in app-claude-md-tmpl.md. -->
 
@@ -13,9 +13,9 @@ ALWAYS read and follow:
 
 ## Hard rules (non-negotiable — the harness enforces #1)
 
-1. **Git is manual — agents NEVER run `git` or `gh`.** Not to commit, and not to read (`status`/`log`/`diff`/`grep`/`blame`). All harnesses enforce this mechanically: Claude Code via `.claude/settings.json` and `block-git.sh`; OpenCode via `opencode.jsonc` plus its plugin bridge; Codex via `.codex/rules/techieflow.rules` plus `.codex/hooks.json`. A blocked git call is the policy working, not an obstacle to route around. Evidence for status updates / "what changed" = the checklist Requirements Status table + the working-tree files (+ mtimes) + a fresh `dotnet build` (`.tfcore/tasks/_status-update-gate.md`). The OWNER commits, in a separate terminal.
+1. **Git is manual — agents NEVER run `git` or `gh`.** Not to commit, and not to read (`status`/`log`/`diff`/`grep`/`blame`). All harnesses enforce this mechanically: Claude Code via `.claude/settings.json` and `block-git.sh`; OpenCode via `opencode.jsonc` plus its plugin bridge. A blocked git call is the policy working, not an obstacle to route around. Evidence for status updates / "what changed" = the checklist Requirements Status table + the working-tree files (+ mtimes) + a fresh `dotnet build` (`.tfcore/tasks/_status-update-gate.md`). The OWNER commits, in a separate terminal.
 2. **Run the app yourself — the test harness is fully set up.** Headless Playwright + Chromium live in WSL; the Windows/MAUI dotnet bridge is rung #4 of the build ladder; MAUI Android/iOS/Mac Catalyst are driven over the Appium bridge (`core-config.yaml → runtimeVerification.appium`). NEVER ask the owner to boot the app, run a build, or execute a command — "can't run on Linux/WSL", "it targets Windows", "it's MAUI", "Playwright needs a GUI", "the dependent service is down" are BANNED excuses (`.tfcore/tasks/_smoke-test-policy.md`). Asking the owner is the LAST resort, only after the build ladder + `verify-phase §3a` escalation genuinely fail — and even then you still run the test yourself once they reply.
-3. **The framework tree is invisible to search — a search that finds nothing is NOT proof a file is missing.** `.tfcore/`, `.claude/`, `.codex/`, `.opencode/` and `.agents/skills/` are hidden dot-directories AND gitignored here (deliberate — deployed framework copies are never committed). File search skips hidden paths *and* honours `.gitignore`, so it takes **both** (`rg -uu`; `--hidden` alone is not enough), and `git grep`/`git ls-files` see nothing at all. Confirm a framework file by **reading its literal path** — every one has a single canonical location, and whatever needs it names that path. Never write "not present in this tree" into a verdict, a checklist Remarks cell, a BRD row, or a blocker without having tried the path and failed: that false negative propagates into the docs and the next agent treats it as fact. If a framework file really is absent, the repo needs `update-framework.sh <repo>` run once on this machine — report that instead of reimplementing what it does. (`.tfcore/tasks/_status-update-gate.md` §"The framework tree is INVISIBLE to search".)
+3. **The framework tree is invisible to search — a search that finds nothing is NOT proof a file is missing.** `.tfcore/`, `.claude/`, `.opencode/` and `.agents/skills/` are hidden dot-directories AND gitignored here (deliberate — deployed framework copies are never committed). File search skips hidden paths *and* honours `.gitignore`, so it takes **both** (`rg -uu`; `--hidden` alone is not enough), and `git grep`/`git ls-files` see nothing at all. Confirm a framework file by **reading its literal path** — every one has a single canonical location, and whatever needs it names that path. Never write "not present in this tree" into a verdict, a checklist Remarks cell, a BRD row, or a blocker without having tried the path and failed: that false negative propagates into the docs and the next agent treats it as fact. If a framework file really is absent, the repo needs `update-framework.sh <repo>` run once on this machine — report that instead of reimplementing what it does. (`.tfcore/tasks/_status-update-gate.md` §"The framework tree is INVISIBLE to search".)
 4. **Native-head automation binds to the app's own window.** Drive a MAUI head only through a session attached to the app under test (Windows: launched PID → its top-level window handle; Android/iOS/Catalyst: the app's package/bundle id), interact element-by-element via `AutomationId`, and NEVER inject global keyboard/mouse input — it lands in whatever window happens to have focus, not the app (`verify-phase.md §3b`).
 
 ## Project basics
@@ -41,7 +41,6 @@ never silently worked around.
 
 ## Slash-command syntax (READ ME if a `/agent *command` invocation fails)
 
-**Codex:** use repository skills such as `$techieflow-build`, `$techieflow-verify`, and `$techieflow-refresh-status`, or ask for the skill by name in plain language. Skills load the canonical `.tfcore/tasks/*.md` workflow. When a task calls for fan-out, delegate to the registered `tf_builder`, `tf_test_writer`, `tf_explorer`, `trblazeui`, or `techierag` Codex role and wait for its result. Defining a role alone does not authorize delegation; the user request or applicable skill must call for it. Project config and hooks require repository trust; review changed hooks with `/hooks`.
 
 **Claude Code** registers TechieFlow-native agents under the path-derived namespace `TechieFlow:agents:<name>`. The short `/<agent>` form does NOT always resolve. When in doubt use the full form: