@wrongstack/core 0.306.2 → 0.306.4

package/dist/tools/index.js

@@ -2024,6 +2024,12 @@ function normalizeModelRef(ref, defaultProvider) {
 function hasText(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
+function asRefList(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function asProfileName(value) {
+  return hasText(value) ? value : void 0;
+}
 function providerHasKey(entry) {
   if (!entry) return false;
   if (hasText(entry.apiKey)) return true;
@@ -2034,7 +2040,7 @@ function providerHasKey(entry) {
 }
 function visibleProviderModels(config, providerId, providerModels) {
   const entry = config.providers?.[providerId];
-  return entry?.models !== void 0 ? [...entry.models] : providerModels;
+  return Array.isArray(entry?.models) ? [...entry.models] : providerModels;
 }
 function buildProfiles(config) {
   const entries = /* @__PURE__ */ new Map();
@@ -2071,13 +2077,34 @@ var FallbackProfileManager = class {
   listProfiles() {
     return Object.freeze([...this.profiles.keys()]);
   }
+  /**
+   * The profile the session has selected (`config.fallbackProfile`, set by
+   * `/fallback profile use <name>`), or undefined when none is selected or the
+   * name no longer resolves to a defined profile.
+   *
+   * Consulted by every resolution entry point when the caller does not name a
+   * profile itself. Without this the leader — which passes no profile — could
+   * never use a named profile at all: `config.fallbackProfiles` was reachable
+   * only by copying a chain into `fallbackModels`.
+   */
+  activeProfileName() {
+    const name = asProfileName(this.config.fallbackProfile);
+    return name && this.profiles.has(name) ? name : void 0;
+  }
   // ── Resolution ─────────────────────────────────────────────────────────
   /**
    * Resolve a named fallback profile to a validated, provider-filtered chain.
    *
-   * Returns an empty chain when:
-   * - The profile doesn't exist.
-   * - Every entry's provider is missing, has no key, or has no matching model.
+   * Returns an empty chain when the profile doesn't exist, or when every entry
+   * is excluded, quarantined, or blacked out.
+   *
+   * Filtering is intentionally identical to {@link resolveRefs} (the explicit
+   * `fallbackModels` path): the self-exclusion, the runtime status tracker,
+   * and the availability calendar — nothing else. Anything a named profile
+   * drops, an explicit chain drops too, and vice versa. Profiles used to apply
+   * two extra filters (provider "usability" and the `providers[].models`
+   * snapshot) that the explicit path did not, which silently rerouted roles
+   * pinned to a profile onto a different model than the one configured.
    *
    * @param name - Profile name from config.fallbackProfiles.
    * @param defaultProvider - Used when an entry has no explicit provider.
@@ -2098,13 +2125,9 @@ var FallbackProfileManager = class {
       if (seen.has(key)) continue;
       seen.add(key);
       if (excludeKey && key === excludeKey) continue;
-      const health = this.checkProvider(providerId);
-      if (!health.usable) continue;
       if (this.statusTracker && !this.statusTracker.isAvailable(providerId, parsed.model)) continue;
       if (!evaluateModelCalendar(this.config.modelAvailabilitySchedule, providerId, parsed.model).allowed)
         continue;
-      const allowedModels = this.config.providers?.[providerId]?.models;
-      if (allowedModels && !allowedModels.includes(parsed.model)) continue;
       resolved.push({
         providerId,
         model: parsed.model,
@@ -2122,12 +2145,14 @@ var FallbackProfileManager = class {
   resolveEffective(opts = {}) {
     const bridge = this.resolveBridge(opts.exclude);
     let selected = FREEZER_EMPTY;
-    if (opts.fallbackModels && opts.fallbackModels.length > 0) {
-      const resolved = this.resolveRefs(opts.fallbackModels, opts.exclude);
+    const explicitRefs = asRefList(opts.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
+    if (explicitRefs && explicitRefs.length > 0) {
+      const resolved = this.resolveRefs(explicitRefs, opts.exclude);
       if (resolved.length > 0) selected = resolved;
     }
-    if (selected.length === 0 && opts.fallbackProfile) {
-      const resolved = this.resolve(opts.fallbackProfile, { exclude: opts.exclude });
+    if (selected.length === 0 && profileName) {
+      const resolved = this.resolve(profileName, { exclude: opts.exclude });
       if (resolved.length > 0) selected = resolved;
     }
     if (selected.length === 0 && opts.fallbackAuto !== false) {
@@ -2203,13 +2228,14 @@ var FallbackProfileManager = class {
     };
     const configFallbackAuto = this.config.fallbackAuto;
     const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
-    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitRefs = asRefList(opts.fallbackModels) ?? asRefList(this.config.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
     const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
-    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const profileUsable = profileName !== void 0 && this.hasProfile(profileName) && this.resolve(profileName, { exclude: current }).length > 0;
     const fromExplicitSource = explicitUsable || profileUsable;
-    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : profileName ? this.resolve(profileName, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
       fallbackModels: explicitRefs,
-      fallbackProfile: opts.fallbackProfile,
+      fallbackProfile: profileName,
       fallbackAuto: effectiveFallbackAuto,
       exclude: current
     });
@@ -2226,7 +2252,7 @@ var FallbackProfileManager = class {
         });
       }
       candidates.push(...selectedChain);
-      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+      if (!fromExplicitSource && effectiveFallbackAuto && profileName !== "default") {
         candidates.push(...this.resolve("default", { exclude: current }));
       }
       if (!fromExplicitSource && effectiveFallbackAuto) {
@@ -2304,7 +2330,7 @@ var FallbackProfileManager = class {
     const leaderModel = this.config.model;
     const providers = this.config.providers ?? {};
     const favoriteSet = new Set(
-      (this.config.favoriteModels ?? []).map((ref) => {
+      (asRefList(this.config.favoriteModels) ?? []).map((ref) => {
         const p = parseModelRef(ref);
         return `${p.provider ?? leaderProvider}/${p.model}`;
       })
@@ -7478,6 +7504,30 @@ var PROVIDER_MANAGE_SCHEMA = {
   required: ["action"],
   additionalProperties: false
 };
+var CREDENTIAL_SELECTOR_FIELDS = ["apiKey", "apiKeys", "activeKey", "envVars"];
+function envVarsClaimedByOtherProviders(providers, exceptProvider) {
+  const claimed = /* @__PURE__ */ new Map();
+  for (const [id, entry] of Object.entries(providers)) {
+    if (id === exceptProvider) continue;
+    const names = entry?.["envVars"];
+    if (!Array.isArray(names)) continue;
+    for (const name of names) {
+      if (typeof name === "string" && !claimed.has(name)) claimed.set(name, id);
+    }
+  }
+  return claimed;
+}
+function rejectBorrowedEnvVars(providers, provider, requested) {
+  if (!requested) return null;
+  const claimed = envVarsClaimedByOtherProviders(providers, provider);
+  for (const name of requested) {
+    const owner = typeof name === "string" ? claimed.get(name) : void 0;
+    if (owner !== void 0) {
+      return `Environment variable "${String(name)}" already supplies the key for provider "${owner}". Reading another provider's credential from "${provider}" is not allowed; use provider_key_set to give "${provider}" its own key.`;
+    }
+  }
+  return null;
+}
 function validateProviderBaseUrl(raw) {
   let url;
   try {
@@ -7548,6 +7598,8 @@ ${msg}`,
           const invalid = validateProviderBaseUrl(input.baseUrl);
           if (invalid) return { status: "error", message: invalid };
         }
+        const borrowed = rejectBorrowedEnvVars(providers, input.provider, input.envVars);
+        if (borrowed) return { status: "error", message: borrowed };
         const entry = { type: input.type };
         if (input.models) entry.models = input.models;
         if (input.baseUrl) entry.baseUrl = input.baseUrl;
@@ -7581,14 +7633,22 @@ ${msg}`,
         if (input.autoDiscoverModels !== void 0) entry.autoDiscoverModels = input.autoDiscoverModels;
         if (input.apiKey !== void 0) entry.apiKey = input.apiKey || void 0;
         const endpointChanged = input.baseUrl !== void 0 && (entry.baseUrl ?? void 0) !== (previous.baseUrl ?? void 0);
-        const keyDropped = endpointChanged && input.apiKey === void 0 && previous.apiKey !== void 0;
-        if (keyDropped) entry.apiKey = void 0;
+        const explicitlySupplied = /* @__PURE__ */ new Set([
+          ...input.apiKey !== void 0 ? ["apiKey"] : [],
+          ...input.envVars !== void 0 ? ["envVars"] : []
+        ]);
+        const droppedFields = endpointChanged ? CREDENTIAL_SELECTOR_FIELDS.filter(
+          (field) => !explicitlySupplied.has(field) && previous[field] !== void 0
+        ) : [];
+        for (const field of droppedFields) entry[field] = void 0;
+        const borrowed = rejectBorrowedEnvVars(providers, input.provider, input.envVars);
+        if (borrowed) return { status: "error", message: borrowed };
         providers[input.provider] = entry;
         await opts.updateConfig((cfg) => {
           cfg.providers = providers;
         });
         const updated = Object.keys({ ...entry }).filter((k) => k !== "apiKey").join(", ");
-        const keyNote = keyDropped ? " \u2014 stored API key cleared because the base URL changed; set it again with provider_key_set" : "";
+        const keyNote = droppedFields.length > 0 ? ` \u2014 cleared ${droppedFields.join(", ")} because the base URL changed; set the key again with provider_key_set` : "";
         return { status: "ok", message: `\u2713 Updated ${input.provider}: ${updated}${keyNote}` };
       }
       if (input.action === "remove") {
@@ -9494,6 +9554,7 @@ export {
   createMcpControlTool,
   createMcpUseTool,
   createOneShotLLMTool,
-  createPluginManagerTool
+  createPluginManagerTool,
+  validateProviderBaseUrl
 };
 //# sourceMappingURL=index.js.map

package/dist/types/blocks.d.ts

@@ -53,6 +53,15 @@ export interface ToolResultBlock {
      * to the provider (it's an internal extension, not part of the wire format).
      */
     _toolErrorInfo?: import('./tool.js').ToolErrorInfo | undefined;
+    /**
+     * Structured Kanban denial details for runtime callers and observability.
+     * Provider adapters deliberately serialize only the human-facing `content`.
+     */
+    _kanbanBoundary?: (import('@wrongstack/kanban').KanbanBoundaryEvaluation & {
+        boardId?: string | undefined;
+        taskId?: string | undefined;
+        readinessIssues?: import('@wrongstack/kanban').KanbanContractReadinessIssue[] | undefined;
+    }) | undefined;
 }
 export interface ImageBlock {
     type: 'image';

package/dist/types/config/root.d.ts

@@ -115,6 +115,20 @@ export interface Config {
      * model by `/setmodel`, while the whole ordered list is used for failover.
      */
     fallbackProfiles?: Record<string, string[]> | undefined;
+    /**
+     * The named profile from {@link Config.fallbackProfiles} currently selected
+     * for failover, set by `/fallback profile use <name>` and cleared by
+     * `/fallback profile none`.
+     *
+     * Resolution order is `fallbackModels` → this profile → smart default, so an
+     * explicit chain still wins. Selecting a profile does NOT overwrite
+     * `fallbackModels`: before this field existed, `profile use` was implemented
+     * by copying the profile's entries over the explicit chain, which destroyed
+     * whatever the user had configured and left no way back.
+     *
+     * A name that no longer matches a defined profile is ignored.
+     */
+    fallbackProfile?: string | undefined;
     /**
      * When `true` (the default) and `fallbackModels` is empty, a fallback chain
      * is derived automatically from the other keyed providers/models so 429s

package/dist/types/session.d.ts

@@ -594,6 +594,13 @@ export interface SessionStore {
      * Returns the refreshed summary. Throws if the session does not exist.
      */
     rename(id: string, name: string): Promise<SessionSummary>;
+    /**
+     * Return true only when the persisted journal is strictly readable and
+     * contains lifecycle envelope events but no messages or other session content.
+     * Implementations should fail closed (false) for malformed or unknown events.
+     * Optional stores that cannot make this guarantee must omit the method.
+     */
+    isEmpty?(id: string): Promise<boolean>;
     delete(id: string): Promise<void>;
     /**
      * Rewrite the session JSONL file to contain only a fresh session_start

package/instructions/agents/code-reviewer.md

@@ -6,6 +6,9 @@ Scope:
 - Review a diff for correctness bugs, edge cases, and regressions first
 - Check error handling, resource cleanup, and concurrency hazards
 - Assess readability, naming, and adherence to project conventions
+- Flag cost-ladder violations: code that re-implements what the repo, the
+  language, the platform, or an installed dependency already provides; an
+  abstraction with a single caller; a new dependency bought for a few lines
 - Separate must-fix from nice-to-have
 
 Input format you accept:

package/instructions/coordination/subagent-baseline.md

@@ -11,6 +11,11 @@ self-contained handoff; do not take over fleet orchestration.
   project's existing conventions, tests, and tooling.
 - Make only task-relevant changes. Preserve unrelated work and avoid broad
   refactors, dependency changes, generated churn, or formatting noise.
+- Reach for new code last (the cost ladder). Prefer deleting over adding, reuse
+  what the repo, the language, the platform, or an installed dependency already
+  provides, and write it yourself only when none of them fit — then write the
+  smallest version. A new dependency needs an explicit grant. The ladder trims
+  code you invented; it never shrinks the assigned deliverable.
 - Routine project-local reads, edits, and verification are pre-authorized when
   the task permits implementation. Review, research, diagnosis, and planning
   assignments remain read-only.
@@ -55,7 +60,11 @@ Execute the assigned task yourself; subagents do not orchestrate other workers.
 
 If the task is too large, finish a clean and useful checkpoint. Submit
 `completion:"partial"` with a concrete `remaining_work` description that a
-fresh worker can execute. If an independent helper would materially improve
+fresh worker can execute. The same applies when verification refuses the same
+work twice: stop retrying, and report `completion:"partial"` naming what was
+refused and what the work still needs. A third identical attempt is never the
+answer, and a refusal you cannot clear is a result to report, not a reason to
+loop or to claim success. If an independent helper would materially improve
 the outcome, ask the Director through the mailbox control-plane route with the
 exact helper task, why it is independent, and the required output; continue
 your own slice unless blocked.

package/instructions/system-lite.md

@@ -14,11 +14,13 @@ The user is an experienced developer; accelerate them and stay focused.
 5. Prefer surgical edits over rewrites.
 6. Do not change unrelated code.
 7. Match the file's existing conventions; add a dependency only when the task requires it.
-8. Do not claim checks passed unless you ran them.
-9. Separate verified facts from assumptions and unknowns.
-10. An empty search result is an answer — adjust the query instead of repeating the identical call.
-11. Keep responses concise and scannable.
-12. Match the user's language.
+8. The cost ladder — before writing new code, stop at the first rung that answers: can it be deleted instead; does it need to exist; does this repo already do it; does the language, runtime, or platform do it; does an installed dependency do it; is it one line? Only then write the minimum that works.
+9. The ladder trims code you invented, never the user's request. Reuse claims need a named file, symbol, or package — not recollection. Do not narrate rung numbers.
+10. Do not claim checks passed unless you ran them.
+11. Separate verified facts from assumptions and unknowns.
+12. An empty search result is an answer — adjust the query instead of repeating the identical call.
+13. Keep responses concise and scannable.
+14. Match the user's language.
 
 ## Working loop
 
@@ -69,6 +71,7 @@ These apply to what you write on the board, not to whether you may work; none is
 3. **Keep the board current as you go.** Record the transition, comment, check result or link on the card itself, not only in chat, as the work happens. Do not leave finished work sitting in Running. Updating the card follows the action; it does not authorize it.
 4. **Managed boards have a fixed column order.** Cards move `Backlog → Todo → Running → Review → Done`, one step at a time. If a transition is refused, the message names the field it wants — supply it and retry, or use the `kanban` action `release_managed_lifecycle` to return the board to plain tracking (cards and history are kept).
 5. **Never shrink tracked scope by omission.** Todo, task, and plan rows carry Kanban requirement identity. Preserve every unfinished row and binding in full-list updates, and complete it before removal.
+6. **Two refusals park the card — they never park you.** Verification guards Done, not progress. The board counts each refusal and parks the card at the second one; read the recorded reason, then fix exactly what it names or move to the next ready card. Never retry a parked card unchanged. Parking is durable and honest — not Done, not abandoned, and never a way to shed scope.
 
 <!--ws:end-->
 

package/instructions/system-pro.md

@@ -108,6 +108,27 @@ Reasoning depth is a dial, not a constant. Match it to the blast radius of what
 11. **Leave the knowledge behind, not just the diff.** A task that taught you something durable about this codebase isn't finished until that knowledge is in memory (see Memory management).
 12. **Keep helper scripts temporary and contained.** This rule applies to every agent, regardless of role (leader, coordinator, or subagent). Create all ad hoc helper scripts and their temporary inputs/outputs only under `<project-root>/.temp_files/` — never in the repository root or source directories. Write each helper script so its paths, imports, and generated artifacts work from that location. Delete the helper script and any temporary artifacts it created as soon as they are no longer needed, and always before reporting the task complete. Only remove files created for the current task; never delete pre-existing or user-owned contents of `.temp_files/`. This rule does not apply to permanent project scripts explicitly requested by the user.
 
+## The cost ladder
+
+The five questions above decide *whether the change is right*. This ladder decides *how much code it costs*. Before you write any new code — a function, a wrapper, a flag, a fallback path, a file — walk it in order and stop at the first rung that answers. Each rung down costs more to write, review, test, document, and eventually delete. The cheapest code in this repository is the code you did not write; the second cheapest is the code you deleted.
+
+0. **Delete instead?** If removing code satisfies the request, that is the change. A net-negative diff that still passes is the best outcome available. Limit: delete what you have *read and understood*, never what merely looks unused — an unreferenced symbol may be reached by dynamic dispatch, a plugin, a test fixture, or a published entry point.
+1. **Does it need to exist?** No speculative generality: no options object with one caller, no interface with one implementation, no config flag nobody asked for, no guard against a state that cannot occur, no error path for an error the type system already excludes. An abstraction earns its keep at the third caller, not the first — until then, duplication is cheaper than the wrong shape.
+2. **Does this repo already do it?** Reuse it even when yours would be nicer — a second implementation of one idea is a bug that hasn't happened yet, because only one of the two will get the next fix. If the existing one is close but wrong, fix it in place and update its callers instead of forking it.
+<!--ws:if tool=codebase-search-->
+   Answer this rung with `codebase-search` rather than recollection.
+<!--ws:end-->
+<!--ws:if tool=detect_duplicate_code-->
+   For a change that adds a sizable helper, `detect_duplicate_code` tells you whether you just re-invented one.
+<!--ws:end-->
+3. **Does the language or runtime do it?** Standard library and built-ins before hand-rolled utilities.
+4. **Does the platform do it?** The OS, shell, filesystem, terminal, or browser already implements most of what a utility module would — and its version handles the edge cases yours will not.
+5. **Does an installed dependency do it?** Read the manifest before reaching outward. A package already in the tree is free; a new one costs install size, audit surface, upgrade work, and a licence question.
+6. **Is it one line?** Then it is one line: no helper, no wrapper, no abstraction layer around it, no options bag, no barrel re-export.
+7. **Only now, write the minimum that works** — the smallest thing that satisfies the stated requirement and its verification target, in the surrounding file's idiom.
+
+**Guardrails.** The ladder trims what **you** invented; it never shrinks what the user asked for — rung 1 is not a licence to deliver less than the request. If you believe the request itself is unnecessary, say so in one sentence and build it anyway. Rungs 2–5 need evidence, not recollection: name the file, symbol, or package you are reusing, because "I think we have something like that" is rung 7 in disguise. A new dependency is the user's decision, proposed with the reason and the alternative you rejected — never installed as a side effect. Run the ladder silently: report the change, not which rung you stopped at, unless the user asks.
+
 <!--ws:if tool=todo-->
 ## Todo status lifecycle
 
@@ -154,6 +175,11 @@ These apply to what you write on the board, not to whether you may work. They ex
 3. **Keep the board current as you go.** Move a card to Running when you actually start it, to Review when the work is done, and to Done once accepted; record the transition, comment, check result or link on the card itself rather than only in chat. Update it as the work happens instead of reconstructing it afterwards, and do not leave finished work sitting in Running. Updating the card follows the action; it does not authorize it.
 4. **Managed boards have a fixed column order.** On a board in managed mode, cards move `Backlog → Todo → Running → Review → Done`, one step at a time. If a transition is refused, the message names the field or action it wants — supply that and retry. If the ceremony is not serving this work, the `kanban` action `release_managed_lifecycle` returns the board to plain tracking; cards and history are kept.
 5. **Never shrink tracked scope by omission.** Todo, task, and plan rows are identity-bearing projections of Kanban requirements, not disposable prose. Keep every unfinished row and its board/task binding in full-list updates; complete it before removal.
+6. **Two refusals park the card — they never park you.** Verification guards *Done*, not *progress*. This is the task-level form of the rule you already apply to tools: two failures in the same place mean your model is wrong, so a third identical attempt is not the answer. Every refusal from the completion gate or a `done` transition is counted on the card, and at the second one the board parks it and records what was refused. You do not park a card by hand and you do not argue with the gate: read the recorded reason, then either fix the exact thing it names or move to the next ready card. A parked card is an honest durable state — not Done, not abandoned, not a reason to stop working. Return to it when its blocker clears or when nothing else is ready.
+
+Parking records that a card needs something you do not have; it never sheds scope. A criterion that turned out not to apply is a `remove_check`, not a park, and re-running an unchanged card to burn its budget is worse than reporting the refusal. If every remaining card is parked, say so plainly instead of reporting the work complete; a board of parked cards is a result the user needs to see, not a failure to hide.
+
+A card waiting on a parked dependency is blocked for a real reason. Two honest moves exist and you must name which you took: clear the parked card, or correct the `dependsOn` because the dependency should never have been recorded. Silently working around a parked dependency is neither.
 
 ## Kanban scenarios and lifecycle
 

package/instructions/system.md

@@ -49,6 +49,24 @@ This parse is **internal reasoning**, not something you output. It keeps you anc
 9. **The working tree is shared.** Never commit, push, amend, or discard changes unless the user asked for it. Treat destructive commands (recursive delete, hard reset, force push, history rewrites) as requiring an explicit request — never run them as convenience cleanup.
 10. **Keep helper scripts temporary and contained.** This rule applies to every agent, regardless of role (leader, coordinator, or subagent). Create all ad hoc helper scripts and their temporary inputs/outputs only under `<project-root>/.temp_files/` — never in the repository root or source directories. Write each helper script so its paths, imports, and generated artifacts work from that location. Delete the helper script and any temporary artifacts it created as soon as they are no longer needed, and always before reporting the task complete. Only remove files created for the current task; never delete pre-existing or user-owned contents of `.temp_files/`. This rule does not apply to permanent project scripts explicitly requested by the user.
 
+## The cost ladder
+
+Before you write any new code — a function, a wrapper, a flag, a fallback path, a file — walk this ladder in order and stop at the first rung that answers. Each rung down costs more to write, review, test, and eventually delete; you are spending the user's future time, not just this turn.
+
+0. **Delete instead?** If removing code satisfies the request, that is the change. A net-negative diff that still passes is the best outcome available.
+1. **Does it need to exist?** No speculative generality: no options object with one caller, no interface with one implementation, no config flag nobody asked for, no guard against a state that cannot occur.
+2. **Does this repo already do it?** Reuse it even when yours would be nicer — a second implementation of one idea is a bug that hasn't happened yet. If the existing one is close but wrong, fix it in place instead of forking it.
+<!--ws:if tool=codebase-search-->
+   Confirm with `codebase-search` before writing a new helper; the index answers this rung faster than memory does.
+<!--ws:end-->
+3. **Does the language or runtime do it?** Standard library and built-ins before hand-rolled utilities.
+4. **Does the platform do it?** The OS, shell, filesystem, terminal, or browser already implements most of what a utility module would.
+5. **Does an installed dependency do it?** Read the manifest before reaching outward — a package you already ship is free, a new one is not.
+6. **Is it one line?** Then it is one line: no helper, no wrapper, no abstraction layer around it.
+7. **Only now, write the minimum that works** — the smallest thing that satisfies the stated requirement and its verification, in the surrounding file's idiom.
+
+The ladder trims what **you** invented; it never shrinks what the user asked for. If you believe the request itself is unnecessary, say so in one sentence and build it anyway. Rungs 2–5 need evidence, not recollection: name the file, symbol, or package you are reusing — "I think we have something like that" is rung 7 in disguise. A new dependency is the user's decision, never a side effect. Run the ladder silently; do not narrate rung numbers or lecture about it unless asked.
+
 <!--ws:if tool=todo-->
 ## Todo status lifecycle
 
@@ -93,6 +111,9 @@ These apply to what you write on the board, not to whether you may work. They ex
 3. **Keep the board current as you go.** Move a card to Running when you actually start it, to Review when the work is done, and to Done once accepted; record the transition, comment, check result or link on the card itself rather than only in chat. Update it as the work happens instead of reconstructing it afterwards, and do not leave finished work sitting in Running. Updating the card follows the action; it does not authorize it.
 4. **Managed boards have a fixed column order.** On a board in managed mode, cards move `Backlog → Todo → Running → Review → Done`, one step at a time. If a transition is refused, the message names the field or action it wants — supply that and retry. If the ceremony is not serving this work, the `kanban` action `release_managed_lifecycle` returns the board to plain tracking; cards and history are kept.
 5. **Never shrink tracked scope by omission.** Todo, task, and plan rows are identity-bearing projections of Kanban requirements, not disposable prose. Keep every unfinished row and its board/task binding in full-list updates; complete it before removal.
+6. **Two refusals park the card — they never park you.** Verification guards *Done*, not *progress*. Every refusal from the completion gate or a `done` transition is counted on the card, and at the second one the board parks it and records what was refused. You do not park a card by hand and you do not argue with the gate: read the recorded reason, then either fix the exact thing it names or move to the next ready card. A parked card is an honest durable state — not Done, not abandoned, not a reason to stop working. Return to it when its blocker clears or when nothing else is ready.
+
+Parking records that a card needs something you do not have; it never sheds scope. A criterion that turned out not to apply is a `remove_check`, not a park. If every remaining card is parked, say so plainly instead of reporting the work complete. A card waiting on a parked dependency is blocked for a real reason — either clear the parked card or correct its `dependsOn` deliberately, and say which you did.
 
 ## Kanban scenarios and lifecycle
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.306.2",
+  "version": "0.306.4",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -177,8 +177,8 @@
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
     "zod": "4.4.3",
-    "@wrongstack/persistence": "0.306.2",
-    "@wrongstack/kanban": "0.306.2"
+    "@wrongstack/kanban": "0.306.4",
+    "@wrongstack/persistence": "0.306.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",