@windyroad/itil 0.60.0 → 0.61.0-preview.1035

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "0.60.0"
+  "version": "0.61.0"
 }

package/bin/wr-itil-migrate-story-status-mirror

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Generated by scripts/sync-shim-wrappers.sh from
+# packages/shared/lib/shim-wrapper-template.sh. DO NOT EDIT individual
+# shim files in packages/*/bin/wr-* directly; edit the template + run
+# `npm run sync:shim-wrappers` to regenerate.
+#
+# Resolution (ADR-080):
+#   1. If the wrapper's parent dir is semver-shaped, treat as installed-
+#      cache execution and resolve to the highest-version sibling's
+#      scripts/ entry below.
+#   2. Otherwise (parent dir is e.g. `architect`), treat as source-
+#      monorepo execution and dispatch to own scripts/. The source-repo-
+#      guard `exec` is the anchor parsed by
+#      packages/retrospective/scripts/check-tarball-shipped-shims.sh.
+#   3. If the cache parent contains zero semver-shaped siblings, exit
+#      127 with a stderr message naming the cache parent (per SQ-080-2).
+#
+# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
+# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem P343 (mid-session staleness window)
+
+set -euo pipefail
+
+SHIM_DIR="$(cd "$(dirname "$0")" && pwd)"
+OWN_VERSION_DIR="$(dirname "$SHIM_DIR")"
+OWN_VERSION_NAME="$(basename "$OWN_VERSION_DIR")"
+CACHE_PARENT="$(dirname "$OWN_VERSION_DIR")"
+
+SEMVER_RE='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$'
+
+# Source-repo guard: own parent dir is NOT semver → dispatch to own scripts/.
+if ! [[ "$OWN_VERSION_NAME" =~ $SEMVER_RE ]]; then
+  exec "$SHIM_DIR/../scripts/migrate-story-status-mirror.sh" "$@"
+fi
+
+# Cache execution: pick the highest-semver sibling under CACHE_PARENT.
+HIGHEST=""
+while IFS= read -r dir; do
+  name="$(basename "$dir")"
+  [[ "$name" =~ $SEMVER_RE ]] || continue
+  if [[ -z "$HIGHEST" ]] || [[ "$(printf '%s\n%s\n' "$HIGHEST" "$name" | sort -V | tail -1)" == "$name" ]]; then
+    HIGHEST="$name"
+  fi
+done < <(find "$CACHE_PARENT" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+
+if [[ -z "$HIGHEST" ]]; then
+  printf 'wr-shim: no cached versions in %s\n' "$CACHE_PARENT" >&2
+  exit 127
+fi
+
+exec "$CACHE_PARENT/$HIGHEST/scripts/migrate-story-status-mirror.sh" "$@"

package/hooks/hooks.json

@@ -1,84 +1,215 @@
 {
   "hooks": {
     "SessionStart": [
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/bin/check-deps.sh wr-itil wr-risk-scorer" }] },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/bin/check-deps.sh wr-itil wr-risk-scorer"
+          }
+        ]
+      },
+      {
+        "matcher": "startup",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-pending-questions-surface.sh"
+          }
+        ]
+      },
       {
         "matcher": "startup",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-pending-questions-surface.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-oversight-nudge.sh"
+          }
+        ]
       },
       {
         "matcher": "startup",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-oversight-nudge.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-story-mirror-migration-nudge.sh"
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-assistant-output-gate.sh" }] },
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-correction-detect.sh" }] },
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/staleness-check.sh" }] }
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-assistant-output-gate.sh"
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-correction-detect.sh"
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/staleness-check.sh"
+          }
+        ]
+      }
     ],
     "PreToolUse": [
       {
         "matcher": "Bash|Write|Edit|Read",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-runtime-sid-marker.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-runtime-sid-marker.sh"
+          }
+        ]
       },
       {
         "matcher": "Write",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/manage-problem-enforce-create.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/manage-problem-enforce-create.sh"
+          }
+        ]
       },
       {
         "matcher": "Write|Edit",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-claude-space-protection.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-claude-space-protection.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/p057-staging-trap-detect.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/p057-staging-trap-detect.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-no-implement-draft-gate.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-no-implement-draft-gate.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-bash-polling-antipattern-detect.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-bash-polling-antipattern-detect.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/pre-publish-intake-gate.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/pre-publish-intake-gate.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-changeset-discipline.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-changeset-discipline.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-readme-refresh-discipline.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-readme-refresh-discipline.sh"
+          }
+        ]
       }
     ],
     "PostToolUse": [
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-trailer-advisory.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-trailer-advisory.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-commit-trailer-transition-advisory.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-commit-trailer-transition-advisory.sh"
+          }
+        ]
       },
       {
         "matcher": "Bash",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fix-title-lifecycle-advisory.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fix-title-lifecycle-advisory.sh"
+          }
+        ]
       },
       {
         "matcher": "Write|Edit|MultiEdit",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fictional-defer-detect.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fictional-defer-detect.sh"
+          }
+        ]
       },
       {
         "matcher": "Write|Edit|MultiEdit",
-        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-deferral-cadence-gate.sh" }]
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-deferral-cadence-gate.sh"
+          }
+        ]
       }
     ],
     "Stop": [
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-assistant-output-review.sh" }] },
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-mid-loop-ask-detect.sh" }] }
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-assistant-output-review.sh"
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-mid-loop-ask-detect.sh"
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/itil-correction-detect.sh

@@ -16,6 +16,24 @@
 # Forward-compat: advertises /wr-itil:capture-problem (ADR-032 — not
 # yet shipped) with /wr-itil:manage-problem as the today-target
 # fallback. When capture-problem ships the wording stays valid.
+#
+# P430 / STORY-047 — WR_SUPPRESS_CORRECTION_DETECT is a DISTINCT guard
+# class, not a split of WR_SUPPRESS_OVERSIGHT_NUDGE. That guard means
+# "an absent user cannot ratify"; this one means "nobody authored a
+# correction". A machine-authored iter prompt carrying an ordinary
+# imperative ("DO NOT skip the gate") is not a correction signal, and
+# conflating the two would couple this gate's suppression to the
+# ADR-068 / ADR-047 oversight-nudge contract. Provenance is a property
+# of the spawning process, so the dispatcher asserts it — the hook does
+# not sniff content for it.
+
+# Machine-authored prompt: no correction happened and no user is present to act
+# on the nudge. Ahead of the jq parses so the suppressed path costs one string
+# comparison, and before any marker write so the once-per-session budget is not
+# burned by a prompt that produced no output.
+if [ "${WR_SUPPRESS_CORRECTION_DETECT:-}" = "1" ]; then
+  exit 0
+fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib/session-marker.sh

package/hooks/itil-story-mirror-migration-nudge.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# wr-itil — SessionStart hook (P474 / RFC-059 / STORY-054).
+#
+# Surfaces a one-line nudge when any story still carries the `**Status**:` body
+# line that duplicates its frontmatter `status:`. That duplicate is why an accept
+# transition used to drift a story's own oversight fingerprint — the story read
+# as unratified moments after being ratified, and the no-implement gate then
+# denied its own implementing commit.
+#
+# Why a hook and not just a release note. The migration ships as a PATH shim, so
+# it never appears in `/` autocomplete, and a release note cannot fire inside an
+# adopter's repo — as a control it depends entirely on someone remembering. A
+# maintenance action with no automatic trigger does not happen, so artefacts
+# predating the fix would keep the defect indefinitely while newly captured
+# stories were immune. JTBD-009 already sanctions this shape: "Idempotency is
+# what makes the speculative invocation safe — and what makes the skill safe to
+# wire into bootstrap / install flows."
+#
+# NUDGE ONLY — this hook MUST NOT run the migration. JTBD-009's ratified
+# "Foreground-synchronous + self-committed" outcome is explicit that the
+# developer reviews the rewritten artefacts before they ship, so migrating
+# unattended would breach a ratified outcome rather than serve it.
+#
+# Names the ADR-049 PATH shim, never a repo-relative `packages/...` path — the
+# latter resolves only in the source monorepo, which is exactly the blind spot
+# source-repo dogfooding hides (P151/P153/P219/P317).
+#
+# Detection is token-cheap: one grep over story filenames, no body reads beyond
+# the match, no LLM call. Silent when clean (the steady state after migrating),
+# fail-open, one line, within the ADR-040 ≤2KB budget.
+#
+# AFK self-suppress: shares the suite-wide WR_SUPPRESS_OVERSIGHT_NUDGE guard
+# with the architect / jtbd / itil-rfc oversight nudges, so an orchestrator
+# exports it once and every nudge self-suppresses rather than firing at an
+# absent user (JTBD-006 friction guard). Only the literal "1" suppresses.
+
+set -uo pipefail
+
+if [ "${WR_SUPPRESS_OVERSIGHT_NUDGE:-}" = "1" ]; then
+  exit 0
+fi
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+STORIES_DIR="$PROJECT_DIR/docs/stories"
+
+[ -d "$STORIES_DIR" ] || exit 0
+
+# STORY-*.md only. README.md documents the template and legitimately shows the
+# field, so scanning it would make this nudge fire forever on a clean corpus.
+COUNT=0
+while IFS= read -r f; do
+  [ -f "$f" ] || continue
+  if grep -qE '^\*\*Status\*\*:' "$f" 2>/dev/null; then
+    COUNT=$((COUNT + 1))
+  fi
+done < <(find "$STORIES_DIR" -mindepth 1 -maxdepth 2 -name 'STORY-*.md' -type f 2>/dev/null)
+
+[ "$COUNT" -gt 0 ] 2>/dev/null || exit 0
+
+if [ "$COUNT" -eq 1 ]; then
+  echo "[wr-itil] 1 story still duplicates its status in a \`**Status**:\` body line, so accepting it will drop its ratification — run \`wr-itil-migrate-story-status-mirror docs/stories\` once to remove the duplicate and carry each ratification forward."
+else
+  echo "[wr-itil] $COUNT stories still duplicate their status in a \`**Status**:\` body line, so accepting them will drop their ratification — run \`wr-itil-migrate-story-status-mirror docs/stories\` once to remove the duplicates and carry each ratification forward."
+fi

package/hooks/test/itil-correction-detect.bats

@@ -20,9 +20,15 @@ setup() {
   REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
   HOOK="$REPO_ROOT/packages/itil/hooks/itil-correction-detect.sh"
   SID="itil-correction-test-$$-$RANDOM"
+  # An AFK iter exports WR_SUPPRESS_CORRECTION_DETECT=1, which the hook
+  # self-suppresses on. Unset it so the positive-detection cases below do not
+  # false-RED when this suite runs inside such an iter (the P391 hermeticity
+  # class). Suppression is asserted per-invocation via `run env ...` instead.
+  unset WR_SUPPRESS_CORRECTION_DETECT
 }
 
 teardown() {
+  unset WR_SUPPRESS_CORRECTION_DETECT
   rm -f "/tmp/itil-correction-detect-announced-${SID}"
   rm -f "/tmp/itil-correction-detect-announced-${SID}-alt"
 }
@@ -134,3 +140,50 @@ run_hook() {
   [ -z "$output" ]
   [ ! -f "/tmp/itil-correction-detect-announced-${SID}" ]
 }
+
+# --- P430 / STORY-047: prompt-authorship guard --------------------------------
+# A framework-authored iter prompt carrying an ordinary imperative ("DO NOT
+# skip the gate") is not a correction — nobody is correcting anything, and the
+# absent user cannot act on the nudge. Provenance is a property of the spawning
+# process, so the dispatcher asserts it via env var rather than the hook
+# guessing from content.
+
+run_hook_env() {
+  local guard="$1" sid="$2" prompt="$3"
+  echo "{\"session_id\":\"$sid\",\"prompt\":$(printf '%s' "$prompt" | jq -Rs .)}" \
+    | env WR_SUPPRESS_CORRECTION_DETECT="$guard" bash "$HOOK"
+}
+
+@test "correction-detect: WR_SUPPRESS_CORRECTION_DETECT=1 suppresses a correction prompt" {
+  run run_hook_env 1 "$SID" "DO NOT skip the architect gate"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "correction-detect: suppressed path writes no announcement marker" {
+  run run_hook_env 1 "$SID" "FFS, you didn't run the test"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+  # The once-per-session budget must survive a prompt that produced no output,
+  # or the first real correction in the orchestrator session emits only the
+  # terse reminder.
+  [ ! -f "/tmp/itil-correction-detect-announced-${SID}" ]
+}
+
+@test "correction-detect: same prompt still fires with the guard unset" {
+  run run_hook "$SID" "DO NOT skip the architect gate"
+  [ "$status" -eq 0 ]
+  [ "${#output}" -gt 300 ]
+  [[ "$output" == *"MANDATORY"* ]]
+}
+
+@test "correction-detect: only the literal value 1 suppresses" {
+  for v in 0 true yes ""; do
+    run run_hook_env "$v" "$SID-$RANDOM" "FFS, that's wrong"
+    [ "$status" -eq 0 ]
+    [ -n "$output" ] || {
+      echo "guard value '$v' wrongly suppressed"
+      false
+    }
+  done
+}

package/hooks/test/itil-story-mirror-migration-nudge.bats

@@ -0,0 +1,122 @@
+#!/usr/bin/env bats
+# Behavioural tests for itil-story-mirror-migration-nudge.sh — the P474 / RFC-059
+# self-firing cadence for the story `**Status**:` mirror migration.
+#
+# Why this exists: the migration is a PATH shim, so it does not surface in
+# autocomplete, and its only announcement was the release note. Release notes
+# cannot fire in an adopter's repo — prose counts as zero control paths — so
+# artefacts predating the fix would keep the defect indefinitely while newly
+# captured stories were immune. A maintenance action with no automatic trigger
+# does not happen.
+#
+# Three contract conditions this suite locks, per the JTBD-009 review:
+#   1. Nudge-only, never auto-run — JTBD-009's "I review the rewritten artefacts
+#      before they ship" is a ratified outcome, so the hook must not migrate.
+#   2. Names the PATH shim, never a repo-relative `packages/...` path, which
+#      would only resolve in the source monorepo (P151/P153/P219/P317).
+#   3. Silent when clean, so steady state costs nothing.
+#
+# @problem P474  @adr ADR-049 ADR-090  @story STORY-054
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOK="$REPO_ROOT/packages/itil/hooks/itil-story-mirror-migration-nudge.sh"
+  TMPD="$(mktemp -d)"
+  mkdir -p "$TMPD/docs/stories/draft" "$TMPD/docs/stories/accepted"
+  # AFK iters export the shared oversight guard; unset so the positive cases do
+  # not false-RED inside one (the P391 hermeticity class).
+  unset WR_SUPPRESS_OVERSIGHT_NUDGE
+}
+teardown() { unset WR_SUPPRESS_OVERSIGHT_NUDGE; rm -rf "$TMPD"; }
+
+seed_with_mirror() {
+  printf -- '---\nstatus: draft\n---\n\n# STORY-901: x\n\n**Status**: draft\n**Reported**: 2026-07-30\n' \
+    > "$TMPD/docs/stories/draft/STORY-901-x.md"
+}
+seed_clean() {
+  printf -- '---\nstatus: draft\n---\n\n# STORY-902: y\n\n**Reported**: 2026-07-30\n' \
+    > "$TMPD/docs/stories/draft/STORY-902-y.md"
+}
+
+@test "fires when a story still carries the **Status** mirror" {
+  seed_with_mirror
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -n "$output" ]
+  [[ "$output" == *"[wr-itil]"* ]]
+}
+
+@test "names the PATH shim so it resolves in an adopter install" {
+  seed_with_mirror
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [[ "$output" == *"wr-itil-migrate-story-status-mirror"* ]]
+}
+
+# The recurring adopter-portability class: a repo-relative path resolves only in
+# the source monorepo, so source-repo dogfooding hides the breakage.
+@test "never emits a repo-relative packages/ path" {
+  seed_with_mirror
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [[ "$output" != *"packages/itil"* ]]
+  [[ "$output" != *"scripts/migrate-story-status-mirror.sh"* ]]
+}
+
+@test "silent when no story carries the mirror" {
+  seed_clean
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "silent when there is no stories directory at all" {
+  run env CLAUDE_PROJECT_DIR="$(mktemp -d)" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "counts affected stories rather than reporting a bare flag" {
+  seed_with_mirror
+  printf -- '---\nstatus: draft\n---\n\n# STORY-903: z\n\n**Status**: draft\n' \
+    > "$TMPD/docs/stories/accepted/STORY-903-z.md"
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [[ "$output" == *"2"* ]]
+}
+
+# Ratified JTBD-009 outcome: the developer reviews the rewrite before it ships.
+# A nudge that migrated on its own would breach that, so assert the file is
+# untouched — this is the condition that keeps the hook inside the job.
+@test "NEVER migrates — the story file is left exactly as found" {
+  seed_with_mirror
+  local before; before="$(cat "$TMPD/docs/stories/draft/STORY-901-x.md")"
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ "$before" = "$(cat "$TMPD/docs/stories/draft/STORY-901-x.md")" ]
+  grep -qE '^\*\*Status\*\*: draft' "$TMPD/docs/stories/draft/STORY-901-x.md"
+}
+
+@test "self-suppresses under the shared AFK oversight guard" {
+  seed_with_mirror
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=1 CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "only the literal value 1 suppresses" {
+  seed_with_mirror
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=yes CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ -n "$output" ]
+}
+
+# README documents the template and legitimately shows the field; scanning it
+# would make the nudge fire forever on a clean corpus.
+@test "ignores docs/stories/README.md" {
+  printf -- '# Stories\n\n**Status**: <status>\n' > "$TMPD/docs/stories/README.md"
+  run env CLAUDE_PROJECT_DIR="$TMPD" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "registered on SessionStart startup in hooks.json" {
+  run grep -c 'itil-story-mirror-migration-nudge.sh' "$REPO_ROOT/packages/itil/hooks/hooks.json"
+  [ "$output" -ge 1 ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.60.0",
+  "version": "0.61.0-preview.1035",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/scripts/migrate-story-status-mirror.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# migrate-story-status-mirror.sh — P474 one-time migration.
+#
+# Removes the redundant `**Status**:` body line from story artefacts and carries
+# each artefact's existing ratification forward.
+#
+# WHY the mirror is removed rather than normalised out of the oversight hash:
+# the body line only repeats the frontmatter `status:` key that
+# `oversight_content_hash` already excludes. Left in place, advancing a story
+# from draft to accepted changed hashed content, so a story the maintainer had
+# just ratified read as unratified and the no-implement gate denied its own
+# implementing commit. Normalising the line out of the hash would have worked
+# too, but it was the FOURTH such lifecycle mirror in a family of three and a
+# fifth was already anticipated — one normaliser rule per mirror, forever.
+# Maintainer direction 2026-07-29: kill the class, not the instance.
+#
+# RE-FINGERPRINT, NOT RE-RATIFY — the safety property this script rests on.
+# `human-oversight: confirmed` asserts that a human confirmed something; this
+# script NEVER writes it. `oversight-hash` asserts no event at all — it only
+# identifies WHICH content the confirmation covered. Recomputing that pointer,
+# over content whose sole delta is a mechanical mirror of an already-excluded
+# field, removes zero ratified substance from coverage. That argument is what
+# distinguishes this from the P348 hollow-marker class, and it holds ONLY
+# because of two guards:
+#
+#   1. Per-artefact validity gate — re-fingerprint only when the stored hash
+#      still matches the content as it stands. An artefact that had already
+#      drifted stays drifted; nothing is silently revived. Without this the
+#      migration is a blanket re-bless, which IS P348.
+#   2. Mirror-agreement precondition — if the body line disagrees with the
+#      frontmatter, it is carrying independent information (the real corpus had
+#      `superseded (was: draft)` and `in-progress (2026-07-23)`), so deleting it
+#      would lose content rather than de-duplicate it. Those are SKIPPED and
+#      REPORTED for a human to resolve, never rewritten.
+#
+# Idempotent: an artefact with no body mirror is untouched, so re-running after
+# the fix ships is a no-op. Reports every artefact it touches, so the
+# re-fingerprint set is auditable from the commit that ran it.
+#
+# Usage: migrate-story-status-mirror.sh [<stories-dir>...]   (default: docs/stories)
+# Exit:  0 = completed (including "nothing to do"); 2 = usage / missing lib.
+#
+# Authority: ADR-090 (oversight fingerprint), ADR-101 (oversight-basis).
+# Driver: P474. Test: migrate-story-status-mirror.bats.
+
+set -euo pipefail
+
+LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" 2>/dev/null && pwd)" || {
+  echo "migrate-story-status-mirror: cannot locate lib dir" >&2; exit 2; }
+# shellcheck source=/dev/null
+source "$LIB/story-oversight.sh"
+
+dirs=("$@")
+[ "${#dirs[@]}" -eq 0 ] && dirs=("docs/stories")
+
+# Octal mode of a file, portably. Three traps here, all of them hit in practice:
+#   1. `chmod --reference` is GNU-only, so BSD hosts silently fell through to a
+#      hardcoded 644 while the call site claimed to preserve the mode.
+#   2. The two `stat` flavours spell the mode differently — GNU `-c %a`, BSD
+#      `-f %Lp` — and a mac with coreutils on PATH has the GNU one.
+#   3. Crucially, the wrong flavour does not fail cleanly. GNU `stat -f` means
+#      "filesystem information" and prints a multi-line block about the volume
+#      with exit 0, so a plain `A || B` chain accepts that blob as a mode.
+# Hence: validate the shape rather than trusting the exit status, and only then
+# accept the answer. Falls back to 644, the correct mode for these files.
+file_mode() {
+  local m
+  for m in "$(stat -c %a "$1" 2>/dev/null)" "$(stat -f %Lp "$1" 2>/dev/null)"; do
+    case "$m" in
+      [0-7][0-7][0-7] | [0-7][0-7][0-7][0-7]) printf '%s' "$m"; return 0 ;;
+    esac
+  done
+  printf '644'
+}
+
+frontmatter_status() {
+  awk '/^---$/{c++; next} c==1 && /^status:/{ sub(/^status:[[:space:]]*/, ""); gsub(/"/, ""); print; exit }' "$1"
+}
+body_status() {
+  # `|| true` is load-bearing: no match makes grep exit 1, which under
+  # `set -euo pipefail` would kill the script on the second (no-op) run and
+  # silently destroy idempotence.
+  grep -m1 -E '^\*\*Status\*\*:' "$1" 2>/dev/null | sed -E 's/^\*\*Status\*\*:[[:space:]]*//' || true
+}
+
+removed=0 refingerprinted=0 skipped=0 untouched=0
+
+for d in "${dirs[@]}"; do
+  [ -d "$d" ] || continue
+  # Story artefacts live one level down in per-state subdirs.
+  while IFS= read -r f; do
+    [ -f "$f" ] || continue
+    body="$(body_status "$f")"
+    if [ -z "$body" ]; then
+      untouched=$((untouched + 1))
+      continue
+    fi
+    fm="$(frontmatter_status "$f")"
+    if [ "$fm" != "$body" ]; then
+      printf 'SKIP  %s — body Status disagrees with frontmatter (body=%s frontmatter=%s); it carries information the frontmatter does not, so resolve by hand before removing\n' \
+        "$f" "$body" "${fm:-<none>}" >&2
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    # Was this artefact ratified-and-valid BEFORE we touch it? Decide now: once
+    # the line is gone the pre-migration hash is unreproducible.
+    was_valid=0
+    if is_story_map_ratified "$f"; then was_valid=1; fi
+
+    # Drop the FIRST matching mirror line and nothing else — surrounding blank
+    # lines are left exactly as they are. The template puts the mirror in a run
+    # of adjacent `**Field**:` lines, so removing it leaves no double blank to
+    # collapse; a later prose line that merely starts with the same token is not
+    # reached, because `done` latches on the first match.
+    tmp="$(mktemp)"
+    awk '!(/^\*\*Status\*\*:/ && !done) { print; next } { done=1 }' "$f" > "$tmp"
+    # Preserve the original mode — mktemp creates 0600, which would otherwise
+    # strip the group/other read bit from every migrated story.
+    chmod "$(file_mode "$f")" "$tmp"
+    mv "$tmp" "$f"
+    removed=$((removed + 1))
+
+    if [ "$was_valid" -eq 1 ]; then
+      # Re-point the fingerprint at the same ratified substance. Never touches
+      # human-oversight, and never adds an oversight-basis it did not have.
+      new_hash="$(oversight_content_hash "$f")"
+      tmp="$(mktemp)"
+      sed -E "s/^oversight-hash:[[:space:]]*[a-f0-9]{64}.*$/oversight-hash: ${new_hash}/" "$f" > "$tmp"
+      chmod "$(file_mode "$f")" "$tmp"
+      mv "$tmp" "$f"
+      refingerprinted=$((refingerprinted + 1))
+      printf 'MIGRATE %s — mirror removed, fingerprint re-pointed (ratification preserved)\n' "$f"
+    else
+      printf 'MIGRATE %s — mirror removed (was not ratified-and-valid; left unratified)\n' "$f"
+    fi
+    # STORY-*.md only. `README.md` documents the template and legitimately
+    # contains a `**Status**: <status>` example; scanning it would report a
+    # spurious disagreement and, worse, a laxer matcher would rewrite the doc.
+  done < <(find "$d" -mindepth 1 -maxdepth 2 -name 'STORY-*.md' -type f 2>/dev/null | sort)
+done
+
+printf '\nmigrate-story-status-mirror: %d mirror(s) removed, %d re-fingerprinted, %d skipped (disagreement), %d already clean\n' \
+  "$removed" "$refingerprinted" "$skipped" "$untouched"
+exit 0

package/scripts/test/migrate-story-status-mirror.bats

@@ -0,0 +1,167 @@
+#!/usr/bin/env bats
+# Behavioural tests for migrate-story-status-mirror.sh — the P474 one-time
+# migration that removes the redundant `**Status**:` body mirror from story
+# artefacts and carries their existing ratification forward.
+#
+# Why the mirror goes rather than getting normalised out of the hash: the body
+# line only repeats the frontmatter `status:` the fingerprint already excludes,
+# and every mirror discovered otherwise costs another normaliser rule (this was
+# the fourth in a family of three). Maintainer direction 2026-07-29 — kill the
+# class, not the instance.
+#
+# The load-bearing safety property is that this RE-FINGERPRINTS, never
+# RE-RATIFIES. `human-oversight: confirmed` records that a human confirmed
+# something and is never written here; `oversight-hash` only identifies WHICH
+# content that confirmation covered. Recomputing it over content whose only
+# delta is an excluded mechanical mirror removes zero ratified substance. The
+# `stored == hash(before)` gate is what makes that provable per artefact — drop
+# the gate and this becomes a blanket re-bless, i.e. the P348 hollow-marker
+# class.
+#
+# @problem P474  @adr ADR-090 ADR-101
+
+setup() {
+  SCRIPTS="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  MIGRATE="$SCRIPTS/migrate-story-status-mirror.sh"
+  # shellcheck source=/dev/null
+  source "$SCRIPTS/../lib/story-oversight.sh"
+  TMPD="$(mktemp -d)"; cd "$TMPD"
+  mkdir -p docs/stories/draft docs/stories/accepted
+}
+teardown() { cd /; rm -rf "$TMPD"; }
+
+# Independent mode probe for assertions. Shape-validated for the same reason the
+# script's own helper is: GNU `stat -f` prints a filesystem blob with exit 0, so
+# an exit-status-only chain silently accepts garbage as a mode.
+mode_of() {
+  local m
+  for m in "$(stat -c %a "$1" 2>/dev/null)" "$(stat -f %Lp "$1" 2>/dev/null)"; do
+    case "$m" in [0-7][0-7][0-7] | [0-7][0-7][0-7][0-7]) printf '%s' "$m"; return 0 ;; esac
+  done
+  printf 'UNKNOWN'
+}
+
+# Write a story whose stored hash is valid for its current content.
+seed_ratified() {
+  local path="$1" fm_status="$2" body_status="$3"
+  printf -- '---\nstatus: %s\nstory-id: x\nhuman-oversight: confirmed\noversight-hash: PLACEHOLDER\n---\n\n# STORY-901: a story\n\n**Status**: %s\n**Reported**: 2026-07-29\n\n## User value\n\nvalue prose.\n\n## Acceptance criteria\n\n- [ ] a criterion\n' \
+    "$fm_status" "$body_status" > "$path"
+  local h; h="$(oversight_content_hash "$path")"
+  sed -i.bak "s/oversight-hash: PLACEHOLDER/oversight-hash: $h/" "$path" && rm -f "$path.bak"
+}
+
+@test "removes the body Status mirror when it agrees with frontmatter" {
+  seed_ratified docs/stories/draft/STORY-901-x.md draft draft
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  ! grep -qE '^\*\*Status\*\*:' docs/stories/draft/STORY-901-x.md
+  # Everything else survives.
+  grep -q '^\*\*Reported\*\*: 2026-07-29' docs/stories/draft/STORY-901-x.md
+  grep -q 'value prose.' docs/stories/draft/STORY-901-x.md
+}
+
+@test "a currently-ratified story is still ratified after migration" {
+  seed_ratified docs/stories/draft/STORY-901-x.md draft draft
+  run is_story_map_ratified docs/stories/draft/STORY-901-x.md
+  [ "$status" -eq 0 ]
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  run is_story_map_ratified docs/stories/draft/STORY-901-x.md
+  [ "$status" -eq 0 ]
+}
+
+# The whole point: after migration, the accept transition must stop drifting.
+@test "after migration an accept transition does NOT drift the hash" {
+  seed_ratified docs/stories/draft/STORY-901-x.md draft draft
+  bash "$MIGRATE" docs/stories
+  # Advance status the way manage-story does: frontmatter + a criterion tick.
+  sed -i.bak 's/^status: draft/status: accepted/; s/- \[ \] a criterion/- [x] a criterion/' \
+    docs/stories/draft/STORY-901-x.md && rm -f docs/stories/draft/STORY-901-x.md.bak
+  run is_story_map_ratified docs/stories/draft/STORY-901-x.md
+  [ "$status" -eq 0 ]
+}
+
+@test "SKIPS and REPORTS a story whose body Status carries extra information" {
+  # `superseded (was: draft)` and `in-progress (2026-07-23)` both exist in the
+  # real corpus — the line is carrying provenance the frontmatter does not, so
+  # deleting it would lose content rather than de-duplicate it.
+  seed_ratified docs/stories/draft/STORY-902-y.md superseded 'superseded (was: draft)'
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  grep -qE '^\*\*Status\*\*: superseded \(was: draft\)' docs/stories/draft/STORY-902-y.md
+  [[ "$output" == *"STORY-902"* ]]
+  [[ "$output" == *"disagree"* ]] || [[ "$output" == *"SKIP"* ]]
+}
+
+@test "does NOT revive an already-drifted story" {
+  seed_ratified docs/stories/draft/STORY-903-z.md draft draft
+  # Real substance edit after ratification → drifted before migration runs.
+  printf '\nAn edit made after ratification.\n' >> docs/stories/draft/STORY-903-z.md
+  run is_story_map_ratified docs/stories/draft/STORY-903-z.md
+  [ "$status" -ne 0 ]
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  run is_story_map_ratified docs/stories/draft/STORY-903-z.md
+  [ "$status" -ne 0 ]
+}
+
+@test "never writes human-oversight — an unconfirmed story stays unconfirmed" {
+  printf -- '---\nstatus: draft\nhuman-oversight: unconfirmed\n---\n\n# STORY-904\n\n**Status**: draft\n\n## User value\n\nv.\n' \
+    > docs/stories/draft/STORY-904-w.md
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  grep -q '^human-oversight: unconfirmed' docs/stories/draft/STORY-904-w.md
+  ! grep -q '^human-oversight: confirmed' docs/stories/draft/STORY-904-w.md
+}
+
+# ADR-101: the post-hoc drain finds AFK-accepted stories via oversight-basis.
+# Migration must not strip it, or those stories stop surfacing for review.
+@test "preserves oversight-basis so the ADR-101 post-hoc drain still finds it" {
+  seed_ratified docs/stories/accepted/STORY-905-v.md accepted accepted
+  printf -- '%s\n' "$(sed 's/^human-oversight: confirmed/human-oversight: confirmed\noversight-basis: pure-decomposition/' docs/stories/accepted/STORY-905-v.md)" \
+    > docs/stories/accepted/STORY-905-v.md
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  grep -q '^oversight-basis: pure-decomposition' docs/stories/accepted/STORY-905-v.md
+}
+
+@test "is idempotent — a second run changes nothing" {
+  seed_ratified docs/stories/draft/STORY-901-x.md draft draft
+  bash "$MIGRATE" docs/stories
+  cp docs/stories/draft/STORY-901-x.md /tmp/after-first-$$.md
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  diff /tmp/after-first-$$.md docs/stories/draft/STORY-901-x.md
+  rm -f /tmp/after-first-$$.md
+}
+
+@test "leaves README.md alone — it documents the template, it is not a story" {
+  printf -- '# Stories\n\n**Status**: <status>\n\nTemplate docs.\n' > docs/stories/README.md
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  grep -qE '^\*\*Status\*\*: <status>' docs/stories/README.md
+  [[ "$output" != *"README.md"* ]]
+}
+
+@test "reports the touched set so the re-fingerprint is auditable" {
+  seed_ratified docs/stories/draft/STORY-901-x.md draft draft
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"STORY-901"* ]]
+}
+
+# The migration writes via mktemp+mv, and mktemp creates 0600. Without an
+# explicit mode carry-over every migrated story loses its group/other read bit.
+# `chmod --reference` is GNU-only, so the portable stat read is what makes this
+# hold on darwin — where the earlier --reference form silently fell through to a
+# hardcoded 644 while the call site claimed to preserve the mode.
+@test "preserves the story file's mode across the rewrite" {
+  seed_ratified docs/stories/draft/STORY-906-mode.md draft draft
+  chmod 640 docs/stories/draft/STORY-906-mode.md
+  before="$(mode_of docs/stories/draft/STORY-906-mode.md)"
+  [ "$before" = "640" ]
+  run bash "$MIGRATE" docs/stories
+  [ "$status" -eq 0 ]
+  after="$(mode_of docs/stories/draft/STORY-906-mode.md)"
+  [ "$after" = "640" ]
+}

package/skills/capture-story/SKILL.md

@@ -209,9 +209,17 @@ estimated-effort: <S|M|L|XL — derived at capture per ADR-067 (real best-effort
 human-oversight: unconfirmed
 ---
 
+<!-- Frontmatter `status:` is the ONLY place a story's lifecycle state lives.
+     Do NOT add a `**Status**:` body line here. It used to mirror the
+     frontmatter, and because the oversight fingerprint excludes the frontmatter
+     key but hashed the body copy, every accept transition drifted the story's
+     own hash — so a story the maintainer had just ratified read as unratified
+     and the no-implement gate denied its own implementing commit. Maintainer
+     direction 2026-07-29 removed the mirror rather than adding a fourth
+     normaliser rule for it (P474 / ADR-090 amendment). -->
+
 # STORY-<NNN>: <Title>
 
-**Status**: draft
 **Reported**: <YYYY-MM-DD>
 **Problems**: <P<NNN> [, P<NNN>, ...]>
 **JTBD**: <JTBD-<NNN> [, ...]>

package/skills/capture-story/test/capture-story-behavioural.bats

@@ -246,3 +246,72 @@ EOF
   [ ! -f docs/stories/in-progress/STORY-001-test.md ]
   [ ! -f docs/stories/done/STORY-001-test.md ]
 }
+
+# --- P474 / STORY-054: the lifecycle mirror must stay gone ---------------------
+# A `**Status**:` body line duplicating the frontmatter `status:` used to sit in
+# this template. The oversight fingerprint excludes the frontmatter key but
+# hashed the body copy, so advancing a story un-ratified it and the no-implement
+# gate then denied its own implementing commit. This was the FOURTH such
+# lifecycle mirror in a family of three, so the removal needs a lock: without
+# one, the next template edit reintroduces it and nothing fails.
+
+@test "P474: the capture-story template emits no **Status** body mirror" {
+  # Behavioural on the artefact the skill prescribes, not on prose ABOUT it:
+  # extract the template's own story scaffold and assert the shape it produces.
+  # The SKILL may still MENTION the forbidden line in its do-not-reintroduce
+  # note, so match only a line-start emission inside a fenced block.
+  run bash -c "awk '/^# STORY-<NNN>/,/^## Dependencies/' '$SKILL_FILE' | grep -cE '^\*\*Status\*\*:'"
+  [ "$output" = "0" ]
+  # Anti-vacuity: if a heading rename ever empties the awk range, the grep -c
+  # above returns 0 and passes while the mirror is present. Assert the range
+  # actually contains the sibling field that DID survive.
+  run bash -c "awk '/^# STORY-<NNN>/,/^## Dependencies/' '$SKILL_FILE' | grep -cE '^\*\*Reported\*\*:'"
+  [ "$output" -ge 1 ]
+}
+
+@test "P474: the documented story body shape emits no **Status** body mirror" {
+  # The second carrier. docs/stories/README.md is the ADOPTER-facing one —
+  # reconcile-stories.sh reads the adopter's own copy — so a stale shape here
+  # has them hand-author the mirror straight back in.
+  local readme="${REPO_ROOT}/docs/stories/README.md"
+  [ -f "$readme" ]
+  run bash -c "awk '/^# STORY-<NNN>/,/^## /' '$readme' | grep -cE '^\*\*Status\*\*:'"
+  [ "$output" = "0" ]
+  # Same anti-vacuity guard as the template carrier above.
+  run bash -c "awk '/^# STORY-<NNN>/,/^## /' '$readme' | grep -cE '^\*\*Reported\*\*:'"
+  [ "$output" -ge 1 ]
+}
+
+@test "P474: a template-shaped story keeps its ratification across an accept transition" {
+  # The invariant the prose serves. Seeds a story in the shape the template now
+  # produces, ratifies it, advances status + ticks a criterion, and asserts the
+  # fingerprint still matches — the exact sequence that used to drift.
+  # shellcheck source=/dev/null
+  source "${REPO_ROOT}/packages/itil/lib/story-oversight.sh"
+  mkdir -p docs/stories/draft
+  local f=docs/stories/draft/STORY-902-shape.md
+  printf -- '---\nstatus: draft\nstory-id: shape\nhuman-oversight: confirmed\noversight-hash: P\n---\n\n# STORY-902: a story\n\n**Reported**: 2026-07-30\n\n## User value\n\nvalue.\n\n## Acceptance criteria\n\n- [ ] a criterion\n' > "$f"
+  local h; h="$(oversight_content_hash "$f")"
+  sed -i.bak "s/oversight-hash: P/oversight-hash: $h/" "$f" && rm -f "$f.bak"
+  run is_story_map_ratified "$f"
+  [ "$status" -eq 0 ]
+
+  sed -i.bak 's/^status: draft/status: accepted/; s/- \[ \] a criterion/- [x] a criterion/' "$f" && rm -f "$f.bak"
+  run is_story_map_ratified "$f"
+  [ "$status" -eq 0 ]
+}
+
+@test "P474: reintroducing the mirror DOES drift a ratified story (the lock has teeth)" {
+  # Proves the invariant test above is not vacuous: put the mirror back and the
+  # accept transition drifts again, which is the defect.
+  # shellcheck source=/dev/null
+  source "${REPO_ROOT}/packages/itil/lib/story-oversight.sh"
+  mkdir -p docs/stories/draft
+  local f=docs/stories/draft/STORY-903-regress.md
+  printf -- '---\nstatus: draft\nstory-id: regress\nhuman-oversight: confirmed\noversight-hash: P\n---\n\n# STORY-903: a story\n\n**Status**: draft\n**Reported**: 2026-07-30\n\n## User value\n\nvalue.\n' > "$f"
+  local h; h="$(oversight_content_hash "$f")"
+  sed -i.bak "s/oversight-hash: P/oversight-hash: $h/" "$f" && rm -f "$f.bak"
+  sed -i.bak 's/^status: draft/status: accepted/; s/^\*\*Status\*\*: draft/**Status**: accepted/' "$f" && rm -f "$f.bak"
+  run is_story_map_ratified "$f"
+  [ "$status" -ne 0 ]
+}

package/skills/work-problems/SKILL.md

@@ -582,6 +582,16 @@ export WR_SUPPRESS_PENDING_QUESTIONS=1
 # pending-questions guard above (JTBD-006 friction guard).
 export WR_SUPPRESS_OVERSIGHT_NUDGE=1
 
+# AFK-iter correction-signal suppression (P430 / JTBD-006): the iteration prompt
+# this loop writes is machine-authored, so an ordinary imperative in it ("DO NOT
+# skip the gate") is not a user correcting anything, and no user is present to
+# act on the capture nudge. itil-correction-detect.sh self-suppresses when this
+# env var is set. A real correction is typed into the ORCHESTRATOR session,
+# where this is unset, so P078 is preserved. Distinct guard class from the
+# oversight nudge above — that one means "cannot ratify", this one means
+# "nobody authored a correction".
+export WR_SUPPRESS_CORRECTION_DETECT=1
+
 # Project-scoped governance plugins are NOT loaded by headless `claude -p`
 # (P382): it activates only USER-scoped enabledPlugins, and project activation
 # is trust-gated (headless skips trust), so `--setting-sources user,project`