arkgate 4.8.19 → 4.8.21

package/templates/agent-skills/ark-explore/SKILL.md

@@ -53,6 +53,11 @@ one bounded decision needs 2–3 enforceable options.
   `coverage.coverageRoots` on the folder the test runner uses. Fail-closed.
   `testGlobs` alone is not enough. Silent when no invariant is enforced.
   Handoff `/ark-adopt` to write the roots. No new skill.
+- When an invariant declares `coverage.symbol`, read the witness path
+  (`symbolEvidenceFile`) and the discard line on doctor and `--rules-inventory`,
+  including when the run is green. A declaration in a non-test file is not
+  “the tests pass” — ArkGate never runs tests. Depth and byte caps stay
+  internal; the counts are what you read.
 - A doctor green / Healthy line must name a file, config key, or test.
   Uncited green is a lie — treat it as unfinished. No `/ark-cite`.
 - Distinguish **missing** skills vs **stale** catalog. Installed ≠ stale.
@@ -345,12 +350,19 @@ targets as explicit adopter decisions, not residual to re-fight. Keep their mirr
 map. When the user accepts, defers, or rejects a live `reshapePilot.nextPilot`, record the card's
 exact `decisionTarget` with a reason (and optional `reviewBy`) in
 `.ark/reshape-decisions.json`. Never infer or suppress from free-form golden-pattern prose.
+A proposed `to` stays under the source anchor (`concept/`) and is kept only when that path
+stays in the same layer and the same slice id. If no governed destination keeps both,
+`nextPilot` is null — do not invent a folder outside the contract. Success is a smaller
+cluster with the layer and slice id unchanged and the card still proposed; a green gate is
+not success. A cohesion residual (`physical-cohesion-residual`) starts that one reshape
+judgment card as `pilotLoop.nextPilot`. It does not start the pattern-bet apply
+loop. Apply that one card, then re-doctor.
 
 ### C. Coupling & debt (measure, don’t guess)
 Prefer evidence over aesthetics:
 - **Fan-in / importers** of hot modules (who imports the suspect file?).
 - **Export surface** (how many public symbols does the orchestration module re-export?).
-- Import cycles, cross-feature leaks (`peerIsolation` candidates).
+- Import cycles, cross-feature leaks (`peerIsolation` candidates). A shared root that imports a slice is a direct-only bridge; doctor lists it. `sharedImportsSlice: "deny"` closes that one hop. It does not finish the wall.
 - Business rules in UI/hooks (`can*`, `calculate*`, policy constants) → Domain / intents.
 - Dead or aspirational globs; layers with files but no rules; **starter/preset rules weaker than sibling archetypes** (soft green).
 - LOC is a **hint** only — pair it with fan-in or export count before calling something a god module.
@@ -522,5 +534,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/agent-skills/ark-fix/SKILL.md

@@ -82,3 +82,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-autopilot` / `/ark-adopt` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/agent-skills/ark-loop/SKILL.md

@@ -77,3 +77,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-autopilot` / `/ark-explore` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/agent-skills/ark-order/SKILL.md

@@ -196,5 +196,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/agent-skills/ark-place/SKILL.md

@@ -317,5 +317,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/agent-skills/ark-runtime/SKILL.md

@@ -180,5 +180,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/agent-skills/ark-think/SKILL.md

@@ -66,3 +66,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-explore` / `/ark-autopilot` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/agent-skills/ark-upgrade/SKILL.md

@@ -40,6 +40,8 @@ Invoking this skill **is** the approval. Preview, then `--apply` **in this turn*
 Stopping at preview is incomplete unless the probe failed or a conflict needs
 `--accept-conflicts` / `--refresh-skills` consent.
 
+If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+
 For session 0, start with `/ark-adopt` (or `ark-check --recommend`); brownfield
 honesty is `/ark-adopt` before this upgrade flow.
 
@@ -171,7 +173,11 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
   `--plan-digest <sha256:…>` and applies only that exact candidate. A changed file
   or selection invalidates the digest instead of being overwritten.
 - Missing or conflicted assets previously recorded as managed require explicit
-  `--accept-conflicts`. Stop and obtain user consent before using it.
+  `--accept-conflicts`, unless the missing file is gitignored (`absent-local`,
+  for example a per-machine `.mcp.json` in a fresh worktree). That file is
+  recreated without consent. Stop and obtain user consent before using
+  `--accept-conflicts` on a real deletion or conflict. Every blocked asset
+  carries `reason` and `nextCommand`.
 - Customized files are preserved. Unrelated source files and similar filenames
   are never adopted. The command never writes a Codex home or another global
   directory implicitly.
@@ -184,7 +190,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |---|---|---|
 | `current` | Content identity matches the candidate. | Record/adopt safely; metadata-only stamps may refresh. |
 | `stale` | Recorded managed content still matches its old identity. | Safe candidate replacement. |
-| `missing` | Candidate is absent. | Create if new; require consent if a recorded asset was deleted. |
+| `missing` | Candidate is absent and is not a gitignored local file. | Create if new; require consent if a recorded asset was deleted. Read `reason` and `nextCommand`. |
+| `absent-local` | Recorded file is missing and gitignored (per-machine file in a fresh worktree). | Recreate it. No consent. |
 | `customized` | User content diverged without a competing managed base. | Preserve it. Opt-in rewrite for **skills only**: `--refresh-skills`. |
 | `conflicted` | Both managed base and user content diverged. | Preserve and require explicit consent (`--accept-conflicts`). |
 | `retired` | A recorded asset is no longer selected by the candidate. | Preserve its file and manifest identity; take no action. |
@@ -259,9 +266,11 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
    If already current (`ALREADY_CURRENT`), retain the read-only preview and still read `whatsNew`
    + `skillDrift`.
 
-   For pnpm repositories with `minimumReleaseAge`, use the repository's existing
-   trusted first-party exception mechanism when the new release is still cooling
-   off, and prove `pnpm install --frozen-lockfile` succeeds.
+   For pnpm repositories with `minimumReleaseAge`, put the exception on
+   `minimumReleaseAgeExclude` in pnpm config or `pnpm-workspace.yaml` (a CLI
+   flag is not enough) when the new release is still cooling off, or keep using
+   `npx --package=arkgate@<pin>` until the package is mature. Prove
+   `pnpm install --frozen-lockfile` succeeds after a local add.
 
 4. **Apply only the reviewed candidate.** When there are no blocked assets, run
    the preview's **exact** `nextCommand` as emitted (JSON field / human “Apply the
@@ -283,16 +292,19 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
    (unless more deliberate refreshes remain).
 
 5. **Verify enforcement and architecture (post-upgrade checks).** Read apply JSON
-   `postUpgradeChecks` when present. Also run:
+   `postUpgrade` (`verdict`, `failing`, `behaviorChanges`) and `postUpgradeChecks` when present.
+   Exit 3 means the files were applied and the architecture check is red. Also run:
    `npx arkgate-check --doctor --json` (or the project-local `ark-check`) and
    the same fail-closed architecture command used by managed apply (normally
    `npx arkgate-check --root . --config ark.config.json --strict-merge --json`).
-   Require `completeness: "complete"` and `ok: true`. Confirm `doctor.improvementCompass` and
+   Require `completeness: "complete"` and `ok: true` before calling the upgrade done.
+   If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+   Handoff is `/ark-autopilot` after the report; do not regenerate a baseline without
+   explicit approval. Confirm `doctor.improvementCompass` and
    `doctor.deepModuleCoach` honesty. Run `npx arkgate agents-md --check` and
    `npx arkgate status --json`. If MCP was used, restart MCP after package bump and re-bind
    identity. Treat provider-unavailable CI required-check evidence as `unverified`, never as proof
-   that merges are blocked.    If new violations appear, hand off to `/ark-autopilot`; do not regenerate a baseline without
-   explicit approval.
+   that merges are blocked.
 
 ## Active host vs deferred hosts
 
@@ -330,5 +342,8 @@ End with exactly this structure:
 - **Handoff:** `/ark-…`, CLI action, or `none`
 - **Incomplete?** `no` or `yes — <missing work>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a required verification did not run or a conflict remains blocked, report the
-task incomplete. Deferred hosts (including Codex when inactive) never make Incomplete? yes.
+task incomplete. If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+Deferred hosts (including Codex when inactive) never make Incomplete? yes.

package/templates/skills/ark-adopt.md

@@ -63,6 +63,11 @@ has honest houses. Skills never enforce — CLI / hooks / CI do.
   `coverage.coverageRoots` to the folder the test runner uses. Fail-closed
   until that path exists. `coverage.testGlobs` alone is not enough. Silent
   when no invariant is enforced. No new skill.
+- `coverage.symbol` means a declaration of that identifier in a non-test file.
+  Doctor and `--rules-inventory` print `symbolEvidenceFile` and the discard
+  counts even when uncovered is 0. Read that path. Imports and calls in tests
+  do not count. That declaration text is not “the tests pass” — ArkGate never
+  runs tests. No new config key.
 - CLI-first: if `arkgate-check` already resolved the root, do not wait on MCP.
 - Do not add `arkRun` or `arkOrder` unless the user wants that extra. When they do, write
   **advisory** extra in this turn (`arkRun` schema `1.2+`; `arkOrder` schema `1.3+`).
@@ -353,8 +358,18 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    The denial names its reason. `unclassifiable path` in bulk means shared code lives outside
    the slice folders — declare those roots (`sharedRoots`) on the rule instead of treating
    thousands of shared files as violations; `cross-slice edge a → b` is the real one, and a
-   deliberate directed edge goes in `allowedCrossSlice`. Promoting the shared slice to its own
+   deliberate directed edge goes in `allowedCrossSlice`. Shared roots are a sink: a slice may
+   import them, and they may import a slice. Doctor lists that shared-root → slice hop even
+   when the check stays green, so the wall is direct-only. `sharedImportsSlice: "deny"` closes
+   that one hop; it does not finish the wall. Promoting the shared slice to its own
    layer is still the preferred fix.
+   `sliceFolders`: a bare name stays an unanchored one-segment match (`features` on
+   `src/lib/features/projects/rfi/x.ts` is `features/projects`); a filename is never the
+   child segment. A starred prefix (`lib/features/*/*`) is anchored like `sharedRoots`
+   (offset 0 or 1). The slice id includes the literal prefix plus the directories
+   the stars bind (`lib/features/projects/rfi`), so parallel trees get different ids
+   (tracked in #308). Before trusting green, add one deliberate
+   feature-to-feature import and expect `cross-slice`.
    If one edge dominates residual debt: **STOP — do not continue this skill as complete.** **STOP — concentrated edge:** rewrite `ark.config.json` **in this turn** with source evidence (do not freeze a wrong config or grind N freezes).
    Empty Domain/Persistence + I/O under Application → false-green.
    **STOP — do not continue this skill as complete.** **STOP — false-green:** fix the config **in this turn** before claiming ENFORCE. Do not claim goal.met / ENFORCE from type-only cleanup while doctor reports `contract-false-green-io-under-application`.
@@ -423,5 +438,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-architect.md

@@ -59,3 +59,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-adopt` / `/ark-place` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/skills/ark-autopilot.md

@@ -110,8 +110,10 @@ decision-grade explore pass **and** without opening violating files.
    layout — no pilot”; never reconstruct that dead card from `findings`. When the user accepts,
    defers, or rejects a live card, persist its exact `decisionTarget` with a non-empty reason and
    optional `reviewBy` in `.ark/reshape-decisions.json`; never infer a verdict from golden prose.
-
-
+   A cohesion residual starts **one** reshape judgment card on `pilotLoop.nextPilot`
+   (one pilot, then re-doctor). The loop is active when a pilot candidate exists,
+   including that reshape card when the tree is not design-weak. It does not start
+   a pattern-bet batch.
 
 ## MCP workspace binding (mandatory)
 
@@ -306,5 +308,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-contract.md

@@ -64,3 +64,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-adopt` / `/ark-autopilot` / `/ark-order` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/skills/ark-coverage.md

@@ -96,7 +96,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 3. Absence of `arkRules` is **valid** — do not force ArkRules unless the user wants them or residual inventory clearly wants a pilot.
 4. Editing `arkrules/*` or promoting modes is **`/ark-adopt`**; fixing code under a structure sensor is **`/ark-autopilot`** (judgment, never invent mechanical-safe).
 5. CLI helpers: `ark-check --rules-inventory --json`, doctor JSON `rulesUnderContract`, sensors emit `ARKRULE_*` / `INVARIANT_UNCOVERED` / `INVARIANT_CATALOG_EMPTY` with `evidence.arkruleId`.
-5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. Never report `INVARIANT_UNCOVERED: 0` as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run. Adopted + catalogued invariants without `coverage.testGlobs` or `coverage.coverageRoots` fails closed (`INVARIANT_TESTS_PATH_MISSING`) — write the path (`/ark-adopt`). When any invariant is enforced, missing `coverage.coverageRoots` fails closed (`INVARIANT_COVERAGE_ROOTS_MISSING`) — write the runner roots (`/ark-adopt`). `testGlobs` alone is not enough.
+5b. Invariant coverage is a **text match, never an execution**: a file walk plus the invariant id in a `describe`/`it` title. `coverage.symbol` means a declaration of that identifier in a non-test file (`symbolEvidenceFile`); imports and test calls do not count. Doctor and `--rules-inventory` print that witness path and the scan discard counts on a green run too. Never report `INVARIANT_UNCOVERED: 0`, a witness path, or a discard line as “the tests pass” or “the tests run” — ArkGate does not run tests and reads no runner config. Declaration text is not “the tests pass.” When the project declares `coverage.coverageRoots`, a covering test found outside them raises the advisory `INVARIANT_COVERAGE_OUTSIDE_ROOTS`; without that declaration ArkGate makes no claim about where tests run. Adopted + catalogued invariants without `coverage.testGlobs` or `coverage.coverageRoots` fails closed (`INVARIANT_TESTS_PATH_MISSING`) — write the path (`/ark-adopt`). When any invariant is enforced, missing `coverage.coverageRoots` fails closed (`INVARIANT_COVERAGE_ROOTS_MISSING`) — write the runner roots (`/ark-adopt`). `testGlobs` alone is not enough.
 6. Extras silent when off. Doctor `arkRun` / `arkOrder` is `notAScore`. Do not force extras. Wire one kernel candidate via `/ark-runtime`; one order-plane candidate via `/ark-order`. Do not invent `/ark-run`.
 
 
@@ -200,5 +200,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-explain.md

@@ -188,7 +188,7 @@ else is judgment/deferred and must not be auto-applied.
 **Type-edge honesty:** type-only denied edges are **placement debt** (`typeOnly` +
 `failsStrict: false`) — prefer SharedTypes / owning layer; they do not fail merge like value
 edges. Doctor `productHonesty` and `violations.typeEdgePolicy` must not be sold as “all done”
-when residual signals remain.
+when residual signals remain (`physical-cohesion-residual` included).
 
 ## Spoken / written explanation
 
@@ -244,6 +244,8 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 Prefer **Incomplete?** `yes` if the showcase report was generated but the browser-open step was
 skipped without CI/headless/user-opt-out reason.
 

package/templates/skills/ark-explore.md

@@ -53,6 +53,11 @@ one bounded decision needs 2–3 enforceable options.
   `coverage.coverageRoots` on the folder the test runner uses. Fail-closed.
   `testGlobs` alone is not enough. Silent when no invariant is enforced.
   Handoff `/ark-adopt` to write the roots. No new skill.
+- When an invariant declares `coverage.symbol`, read the witness path
+  (`symbolEvidenceFile`) and the discard line on doctor and `--rules-inventory`,
+  including when the run is green. A declaration in a non-test file is not
+  “the tests pass” — ArkGate never runs tests. Depth and byte caps stay
+  internal; the counts are what you read.
 - A doctor green / Healthy line must name a file, config key, or test.
   Uncited green is a lie — treat it as unfinished. No `/ark-cite`.
 - Distinguish **missing** skills vs **stale** catalog. Installed ≠ stale.
@@ -345,12 +350,19 @@ targets as explicit adopter decisions, not residual to re-fight. Keep their mirr
 map. When the user accepts, defers, or rejects a live `reshapePilot.nextPilot`, record the card's
 exact `decisionTarget` with a reason (and optional `reviewBy`) in
 `.ark/reshape-decisions.json`. Never infer or suppress from free-form golden-pattern prose.
+A proposed `to` stays under the source anchor (`concept/`) and is kept only when that path
+stays in the same layer and the same slice id. If no governed destination keeps both,
+`nextPilot` is null — do not invent a folder outside the contract. Success is a smaller
+cluster with the layer and slice id unchanged and the card still proposed; a green gate is
+not success. A cohesion residual (`physical-cohesion-residual`) starts that one reshape
+judgment card as `pilotLoop.nextPilot`. It does not start the pattern-bet apply
+loop. Apply that one card, then re-doctor.
 
 ### C. Coupling & debt (measure, don’t guess)
 Prefer evidence over aesthetics:
 - **Fan-in / importers** of hot modules (who imports the suspect file?).
 - **Export surface** (how many public symbols does the orchestration module re-export?).
-- Import cycles, cross-feature leaks (`peerIsolation` candidates).
+- Import cycles, cross-feature leaks (`peerIsolation` candidates). A shared root that imports a slice is a direct-only bridge; doctor lists it. `sharedImportsSlice: "deny"` closes that one hop. It does not finish the wall.
 - Business rules in UI/hooks (`can*`, `calculate*`, policy constants) → Domain / intents.
 - Dead or aspirational globs; layers with files but no rules; **starter/preset rules weaker than sibling archetypes** (soft green).
 - LOC is a **hint** only — pair it with fan-in or export count before calling something a god module.
@@ -522,5 +534,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-fix.md

@@ -82,3 +82,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-autopilot` / `/ark-adopt` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/skills/ark-loop.md

@@ -77,3 +77,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-autopilot` / `/ark-explore` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/skills/ark-order.md

@@ -196,5 +196,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-place.md

@@ -317,5 +317,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-runtime.md

@@ -180,5 +180,7 @@ End with **exactly** these headings (markdown `###`):
 - **Handoff:** `/ark-…` / CLI / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a **STOP** handoff applies and you continued as if done, set **Incomplete?** to `yes`.
 **Skill incomplete if missing** any of the bullets above.

package/templates/skills/ark-think.md

@@ -66,3 +66,5 @@ Skill incomplete if missing any field below.
 - **Compass:** top residual lenses | `n/a`
 - **Handoff:** `/ark-explore` / `/ark-autopilot` / `none`
 - **Incomplete?** `no` | `yes — <what is missing>`
+
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.

package/templates/skills/ark-upgrade.md

@@ -40,6 +40,8 @@ Invoking this skill **is** the approval. Preview, then `--apply` **in this turn*
 Stopping at preview is incomplete unless the probe failed or a conflict needs
 `--accept-conflicts` / `--refresh-skills` consent.
 
+If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+
 For session 0, start with `/ark-adopt` (or `ark-check --recommend`); brownfield
 honesty is `/ark-adopt` before this upgrade flow.
 
@@ -171,7 +173,11 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
   `--plan-digest <sha256:…>` and applies only that exact candidate. A changed file
   or selection invalidates the digest instead of being overwritten.
 - Missing or conflicted assets previously recorded as managed require explicit
-  `--accept-conflicts`. Stop and obtain user consent before using it.
+  `--accept-conflicts`, unless the missing file is gitignored (`absent-local`,
+  for example a per-machine `.mcp.json` in a fresh worktree). That file is
+  recreated without consent. Stop and obtain user consent before using
+  `--accept-conflicts` on a real deletion or conflict. Every blocked asset
+  carries `reason` and `nextCommand`.
 - Customized files are preserved. Unrelated source files and similar filenames
   are never adopted. The command never writes a Codex home or another global
   directory implicitly.
@@ -184,7 +190,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |---|---|---|
 | `current` | Content identity matches the candidate. | Record/adopt safely; metadata-only stamps may refresh. |
 | `stale` | Recorded managed content still matches its old identity. | Safe candidate replacement. |
-| `missing` | Candidate is absent. | Create if new; require consent if a recorded asset was deleted. |
+| `missing` | Candidate is absent and is not a gitignored local file. | Create if new; require consent if a recorded asset was deleted. Read `reason` and `nextCommand`. |
+| `absent-local` | Recorded file is missing and gitignored (per-machine file in a fresh worktree). | Recreate it. No consent. |
 | `customized` | User content diverged without a competing managed base. | Preserve it. Opt-in rewrite for **skills only**: `--refresh-skills`. |
 | `conflicted` | Both managed base and user content diverged. | Preserve and require explicit consent (`--accept-conflicts`). |
 | `retired` | A recorded asset is no longer selected by the candidate. | Preserve its file and manifest identity; take no action. |
@@ -259,9 +266,11 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
    If already current (`ALREADY_CURRENT`), retain the read-only preview and still read `whatsNew`
    + `skillDrift`.
 
-   For pnpm repositories with `minimumReleaseAge`, use the repository's existing
-   trusted first-party exception mechanism when the new release is still cooling
-   off, and prove `pnpm install --frozen-lockfile` succeeds.
+   For pnpm repositories with `minimumReleaseAge`, put the exception on
+   `minimumReleaseAgeExclude` in pnpm config or `pnpm-workspace.yaml` (a CLI
+   flag is not enough) when the new release is still cooling off, or keep using
+   `npx --package=arkgate@<pin>` until the package is mature. Prove
+   `pnpm install --frozen-lockfile` succeeds after a local add.
 
 4. **Apply only the reviewed candidate.** When there are no blocked assets, run
    the preview's **exact** `nextCommand` as emitted (JSON field / human “Apply the
@@ -283,16 +292,19 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
    (unless more deliberate refreshes remain).
 
 5. **Verify enforcement and architecture (post-upgrade checks).** Read apply JSON
-   `postUpgradeChecks` when present. Also run:
+   `postUpgrade` (`verdict`, `failing`, `behaviorChanges`) and `postUpgradeChecks` when present.
+   Exit 3 means the files were applied and the architecture check is red. Also run:
    `npx arkgate-check --doctor --json` (or the project-local `ark-check`) and
    the same fail-closed architecture command used by managed apply (normally
    `npx arkgate-check --root . --config ark.config.json --strict-merge --json`).
-   Require `completeness: "complete"` and `ok: true`. Confirm `doctor.improvementCompass` and
+   Require `completeness: "complete"` and `ok: true` before calling the upgrade done.
+   If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+   Handoff is `/ark-autopilot` after the report; do not regenerate a baseline without
+   explicit approval. Confirm `doctor.improvementCompass` and
    `doctor.deepModuleCoach` honesty. Run `npx arkgate agents-md --check` and
    `npx arkgate status --json`. If MCP was used, restart MCP after package bump and re-bind
    identity. Treat provider-unavailable CI required-check evidence as `unverified`, never as proof
-   that merges are blocked.    If new violations appear, hand off to `/ark-autopilot`; do not regenerate a baseline without
-   explicit approval.
+   that merges are blocked.
 
 ## Active host vs deferred hosts
 
@@ -330,5 +342,8 @@ End with exactly this structure:
 - **Handoff:** `/ark-…`, CLI action, or `none`
 - **Incomplete?** `no` or `yes — <missing work>`
 
+When `doctor.productHonesty.finished` is `false`, **Incomplete? no** is disallowed. Write `yes — <pilotLoop.extractionCard.move or residual>`.
+
 If a required verification did not run or a conflict remains blocked, report the
-task incomplete. Deferred hosts (including Codex when inactive) never make Incomplete? yes.
+task incomplete. If post-upgrade verification is red: **STOP**. Do not edit tests, titles, or config in the upgrade turn. Report `failing[]` and `behaviorChanges[]` and hand off. Incomplete? yes.
+Deferred hosts (including Codex when inactive) never make Incomplete? yes.