aw-spec-cli 0.1.13 → 0.1.15

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-slice.orch.yaml

@@ -1,41 +1,84 @@
 # =============================================================================
-# aw-spec-analyze-slice (orchestrator) — the design↔code conformance GATE
+# aw-spec-analyze-slice (orchestrator) — the spec ↔ CODE conformance GATE
 #
 # The second of the two discrete conformance gates on the forward path, and the
 # sibling of analyze-design:
-#   analyze-design  gates spec ↔ design   — STATIC,  before implement
-#   analyze-slice   gates design ↔ slice  — DYNAMIC, after  build
-# "Slice" is the unit under analysis: the aggregate's code, its paired tests, and
-# its OKF knowledge concept. Three passes over it —
+#   analyze-design  gates spec ↔ feature plan  — STATIC,  before implement
+#   analyze-slice   gates spec ↔ CODE          — DYNAMIC, after  build
+#
+# THE SPEC IS THE ORACLE; THE DESIGN IS THE BRIDGE. This gate used to score code
+# against the design, which only ever proved that two documents agreed with each
+# other. The contract is spec.md — its FR-/BR- wording, and the CN-/DC-/IC-/UX- a
+# slice is bound by — and this is the stage that asks whether the code delivers it.
+# The design is how the question is ANSWERABLE: the story's design pass names which
+# elements realise which id, and the feature plan says where those elements live in
+# the architecture. Trace runs spec id → design element → code, and a break at either
+# hop is a different finding with a different route:
+#   the code does not deliver an id the design maps   → the code is wrong (implement)
+#   no design maps an in-scope id at all              → the BRIDGE is broken (story-plan)
+#   the code is right and the spec words it wrongly   → the spec is wrong (sync-spec)
+# The bridge's own integrity is REPORTED, never gated: a documented gap in a design
+# does not make working code fail its contract.
+#
+# SCOPED TO A STORY WHEN ONE IS NAMED. `/appweaver analyze-slice Order-002` judges that
+# story's ids; with no story named the whole feature is judged, MINUS every id that has
+# an open story, because in-flight work is not drift (law 39). And a story narrows the
+# QUESTION, not the file set: the code under analysis is always the slice's whole OKF
+# file list, both lanes, because a requirement can only be judged against everything
+# that could realise it.
+#
+# THE SPEC IS THE WORDING; THE STORY IS THE EXTENT. A story rarely delivers a whole
+# requirement — its "## Requirements delivered" section says which part — so a
+# story-scoped run judges the code against the spec's wording of that part alone. A
+# slice is never failed for the half of a requirement it never claimed.
+#
+# FIVE PASSES over the slice — its code, its paired tests, its OKF concept:
 #   1. BEHAVIOUR   run the tests (paired to the spec's acceptance criteria by the
 #                  design docs); on red, fix up to 3×.
-#   2. CONFORMANCE check the code against the domain gate overlays (validate-only).
-#   3. KNOWLEDGE   refresh + review the slice's OKF concept (advisory).
-# Every fix made here is recorded in that concept, which is also where the slice's
-# file list is READ from (2.3.0 — `aw-xref concept-paths`, replacing the retired
-# `design-paths` scan for ```lang path=… fences that the tech-agnostic design.md no
-# longer carries; the paired `design-reconcile` write-back is retired with it, its job
-# already done by the concept-upsert --merge steps in pass 3).
+#   2. ORACLE      a TECHNICAL story delivers no requirement, so the unchanged test
+#                  suite is the only thing that can say whether behaviour moved: a
+#                  MODIFIED test fails it, red or green (law 32).
+#   3. CONFORMANCE check the code against the domain gate overlays (bounded repair).
+#   4. INTEGRITY   re-run every referring aggregate's tests read-only; a break stops
+#                  the gate and is written up for a human.
+#   5. TRACE       spec ↔ code, through the design. The verdict this gate is about.
+# Then the report + the machine-readable verdict, then the stop. Every fix made along
+# the way is merged into the slice's OKF concept, which is also where the file list is
+# READ from (`aw-xref concept-coverage`, both lanes — `concept-paths` reads only
+# `source_files`, so since implement-ui began writing `ui_source_files` a UI-bearing
+# requirement had no UI code in view to be traced to).
 #
 # TWO POSITIONS, one gate — and in BOTH the master spec.md is the whole truth:
 #   BOOTSTRAP  implement → build → analyze-slice → run
 #   CHANGE     implement-delta → build → finalize-delta → analyze-slice → close-delta
 # On the CHANGE path this gate deliberately runs AFTER finalize-delta, which has already
-# merged the delta into spec.md + design.md — so the master carries the change and needs
+# merged the delta into spec.md + the plans — so the master carries the change and needs
 # no delta-awareness here. It runs BEFORE close-delta, so the change is still OPEN: a red
 # result is recoverable ("fix and re-run"), not a defect on an already-shipped version.
 # The only thing this gate reads the open change for is where to send you next.
 #
-# Launch:  /appweaver analyze-slice [strategy]
+# IT REPAIRS TWO THINGS AND AUTHORS NOTHING. A red test and a domain-overlay violation
+# are mechanical, local and have a named rule, so they are fixed in place and recorded.
+# A missing requirement is not: it is feature work, and writing it here would produce
+# code that no design pass names and no gate ever conformed — a gate becoming an author,
+# which is the same reason analyze-design refuses to scaffold the plan it gates.
+#
+# Launch:  /appweaver analyze-slice [<story-id>]
 # Prereq:  /appweaver build   (compiled code for the active feature).
 # =============================================================================
 
 name: aw-spec-analyze-slice
-description: The design↔code conformance gate — run the slice's tests against its acceptance criteria, check the code against the domain gate overlays, verify the change did not break any referring aggregate (the OKF referrer blast radius) and write a triage report before stopping if it did, refresh + review its OKF concept, and record every fix in it. Sits after finalize-delta on the change path, so the master spec it scores against already carries the change, and before close-delta, so a red gate leaves the change open and recoverable.
-version: 2.3.0
+description: "The spec ↔ code conformance gate — traces every in-scope requirement from spec.md through the design that bridges it to the code that realises it, and fails the slice when the code does not deliver the contract. Scoped to one story when named, to the feature minus its in-flight ids when not. Runs the slice's tests first (fixing red, bounded), holds a technical story to the unchanged-suite oracle, checks the code against the domain gate overlays, verifies the change broke no referring aggregate, refreshes the OKF concept, then writes a traceability report and a machine-readable verdict beside it. Sits after finalize-delta on the change path, so the master spec it scores against already carries the change, and before close-delta, so a red gate leaves the change open and recoverable."
+version: 3.0.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
+inputs:
+  user_input:
+    description: Optional story id to scope the gate to (e.g. "Order-002"). With none, the whole feature is judged minus its in-flight ids.
+    required: false
+    bind: USER_INPUT
+
 scripts:
   actions:
     sh:  .appweaver/scripts/bash/aw-spec-actions.sh
@@ -45,8 +88,8 @@ scripts:
     ps1: .appweaver/scripts/powershell/aw-xref.ps1
 
 # No hardcoded technical standards seed. The technical rule files the code/conformance
-# passes check against (testing + coding-standards) are now CONFIGURATION, loaded per-
-# command from guardrails/projects/<project>/tech-rule-bindings.md under "## /aw-spec-analyze-slice"
+# passes check against (testing + coding-standards) are CONFIGURATION, loaded per-command
+# from guardrails/projects/<project>/tech-rule-bindings.md under "## /aw-spec-analyze-slice"
 # by the tech-select module (see the tech_select step below). The DOMAIN gate overlays are
 # still loaded separately, as before (resolve_gate_overlays → load_gate_overlays). This gate
 # does not reference constitution.technical.md. The seed below is behaviour-only — the kit's
@@ -56,24 +99,99 @@ standards:
   - { path: .appweaver/ai-rules.md }   # kit-resident: the universal operating rules, every flow
 
 vars:
+  # --- the feature and its documents --------------------------------------
+  feature_dir: ""
+  spec_file: ""
+  spec_exists: "false"
+  be_plan: ""
+  be_plan_exists: "false"
+  fe_plan: ""
+  fe_plan_exists: "false"
+  # --- scope --------------------------------------------------------------
+  # Defaults describe the FEATURE-scoped run, which is what happens when no story is
+  # named — including on brownfield, where adopt emits an empty backlog by design.
+  scope: "feature"
+  story: ""
+  story_path: ""
+  story_title: ""
+  story_type: ""
+  story_status: ""
+  story_dir: ""
+  story_resolved: "false"
+  is_technical: "false"
+  exercises_csv: ""
+  constraints_csv: ""
+  current_version: ""
+  stale_csv: ""
+  stale_note: ""
+  inflight_csv: ""
+  backlog_digest: ""
+  # Non-empty only when the caller said SOMETHING and no story came back from it — the
+  # one case where widening to feature scope is more likely a typo than a choice.
+  unresolved_input: ""
+  scope_brief: "SCOPE — the WHOLE FEATURE. No story was named, so every FR- and BR- in spec.md is in scope and each is judged in FULL. EXTENT: the whole of each id."
+  story_be_doc: ""
+  story_be_exists: "false"
+  story_be_pass: "0"
+  story_fe_doc: ""
+  story_fe_exists: "false"
+  story_fe_pass: "0"
+  bridge_note: "BRIDGE — the FEATURE PLANS (backend-plan.md, and frontend-plan.md where a frontend lane is declared). No story design is in scope this run, so the plans are the only map from a spec id to the elements that realise it."
+  # --- the code under analysis (OKF) --------------------------------------
+  coverage_digest: ""
+  be_count: "0"
+  fe_count: "0"
+  paths_missing: ""
+  okf_concept: ""
+  # --- pass 1: behaviour ---------------------------------------------------
   test_ok: "false"
+  no_test_edit_rule: ""
+  fixed_files: ""
+  # --- pass 2: the technical-story oracle ----------------------------------
+  # Named per case rather than derived, because "the suite is clean" and "the suite
+  # could not be read" must never collapse into one another: a gate that treats "could
+  # not look" as "nothing found" is the false green the kit refuses everywhere else.
+  oracle: "clean"
+  oracle_case: ""
+  tests_changed_csv: ""
+  tests_changed_count: "0"
+  tdiff_digest: ""
+  tdiff_base: ""
+  tdiff_base_kind: ""
+  tech_gate_ok: "true"
+  tech_note: "Not a technical story — the unchanged-suite oracle does not apply."
+  # --- pass 3: domain conformance ------------------------------------------
   conformance_ok: "false"
-  # NAVIGATION ONLY. Whether a change is open decides where this gate sends you next
-  # (close-delta vs run) — nothing else in this workflow reads them. On the CHANGE path
-  # finalize-delta has already merged the delta into the master docs, so the delta files
-  # are redundant here and are deliberately NOT loaded into any context.
-  active_change: ""
-  has_change: "false"
-  # Integrity pass (referrer blast radius) defaults — safe values if xref/test-run is
-  # skipped or errors, so the gate reads a real verdict rather than an empty var.
+  conformance_violations: ""
+  conformance_fixes: ""
+  # --- pass 4: integrity (referrer blast radius) ---------------------------
+  # Defaults are safe values if xref/test-run is skipped or errors, so the gate reads a
+  # real verdict rather than an empty var.
   integrity_ok: "false"
   referrer_csv: ""
   referrer_count: "0"
   referrer_names: ""
-  # Pass-3 (OKF) reporting defaults — the knowledge pass is advisory, so these stay
-  # readable in the outputs even when a step is skipped or errors out.
+  integrity_log: ""
+  # --- pass 5: trace (the verdict) -----------------------------------------
+  trace_ok: "false"
+  bridge_ok: "true"
+  trace_gaps: ""
+  trace_gap_count: "0"
+  trace_gap_refs: ""
+  trace_coverage: ""
+  bridge_gaps: ""
+  # --- OKF knowledge (advisory) --------------------------------------------
   okf_ok: "unknown"
   okf_orphans: "0"
+  # --- reporting ------------------------------------------------------------
+  report_path: ""
+  result_file: ""
+  # NAVIGATION ONLY. Whether a change is open decides where this gate sends you next
+  # (close-delta vs run) — nothing else in this workflow reads them. On the CHANGE path
+  # finalize-delta has already merged the delta into the master docs, so the delta files
+  # are redundant here and are deliberately NOT loaded into any context.
+  active_change: ""
+  has_change: "false"
 
 workflow:
 
@@ -94,8 +212,13 @@ workflow:
     script: { ref: actions }
     subcommand: feature-paths
     outputs:
-      - { name: feature_dir, from: "$.feature_dir" }
-      - { name: spec_file,   from: "$.spec_file" }
+      - { name: feature_dir,    from: "$.feature_dir" }
+      - { name: spec_file,      from: "$.spec_file" }
+      - { name: spec_exists,    from: "$.spec_exists" }
+      - { name: be_plan,        from: "$.backend_plan_file" }
+      - { name: be_plan_exists, from: "$.backend_plan_exists" }
+      - { name: fe_plan,        from: "$.frontend_plan_file" }
+      - { name: fe_plan_exists, from: "$.frontend_plan_exists" }
 
   - id: require_feature
     action: verify_context
@@ -103,6 +226,138 @@ workflow:
     on_empty: stop
     on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run analyze-slice."
 
+  # The anchor. Every judgement below resolves an id's meaning from this document, so a
+  # feature without one has nothing for the code to be measured against.
+  - id: require_spec
+    action: verify_context
+    require_true: spec_exists
+    on_false: stop
+    on_false_message: "No spec.md for the current feature. Run /appweaver specify first — the spec is this gate's oracle, and code cannot be conformed to a contract that does not exist."
+
+  # 1. WHICH STORY, if any. An id in the input scopes the gate to that story; anything
+  #    else widens it to the feature. Deliberately NO ask: this gate has to be runnable
+  #    unattended, and a gate that stops to ask cannot run in CI. Naming a story narrows
+  #    it, naming none widens it, and both are legitimate runs.
+  - id: story_scan
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: story-plan-check
+    args: ["--feature-dir", "{{feature_dir}}", "--input", "{{USER_INPUT}}"]
+    outputs:
+      - { name: story_resolved,  from: "$.resolved" }
+      - { name: story,           from: "$.story" }
+      - { name: story_path,      from: "$.story_path" }
+      - { name: story_title,     from: "$.story_title" }
+      - { name: story_type,      from: "$.story_type" }
+      - { name: story_status,    from: "$.story_status" }
+      - { name: story_dir,       from: "$.story_dir" }
+      - { name: is_technical,    from: "$.is_technical" }
+      - { name: exercises_csv,   from: "$.exercises_csv" }
+      - { name: constraints_csv, from: "$.constraints_csv" }
+      - { name: current_version, from: "$.current_version" }
+      - { name: stale_csv,       from: "$.stale_csv" }
+      - { name: stale_note,      from: "$.stale_note" }
+      - { name: backlog_digest,  from: "$.digest" }
+      - { name: story_be_doc,    from: "$.be_doc_path" }
+      - { name: story_be_exists, from: "$.be_doc_exists" }
+      - { name: story_be_pass,   from: "$.be_last_pass" }
+      - { name: story_fe_doc,    from: "$.fe_doc_path" }
+      - { name: story_fe_exists, from: "$.fe_doc_exists" }
+      - { name: story_fe_pass,   from: "$.fe_last_pass" }
+
+  # WHICH IDS ARE IN FLIGHT. On a feature-scoped run these are subtracted from the
+  # question: a requirement with an OPEN story is work someone is doing, and reporting
+  # it as missing code turns every partially-built feature red (law 39). Story-scoped
+  # runs subtract nothing — the story under analysis IS the work in flight.
+  - id: inflight_ids
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: story-refs
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: inflight_csv, from: "$.covered_csv" }
+
+  # 2. SCOPE + BRIDGE, stated once as the two sentences the trace pass reads. Both vars
+  #    default to the feature-scoped wording (see `vars:`) and are overwritten only when
+  #    a story actually resolved, so nothing here can half-apply.
+  - id: scope_story
+    condition: "{{story_resolved}} == true"
+    action: set
+    vars:
+      scope: "story"
+      scope_brief: "SCOPE — story {{story}} ({{story_title}}), type {{story_type}}, status {{story_status}}. In scope: {{exercises_csv}} (delivered by this story) and {{constraints_csv}} (bounds it must meet). EXTENT — the story's '## Requirements delivered' section says which PART of each id this slice delivers; judge the code against the spec's wording of THAT PART alone. A slice is never failed for the half of a requirement it never claimed, and an id no story has claimed yet is not this run's business."
+  # A technical story delivers no requirement, so `exercises:` is empty BY DESIGN and there
+  # is nothing to trace forward. Its real check already ran — the unchanged-suite oracle —
+  # and what is left for trace is the bounds it is still held to. Without this the pass
+  # would be handed "in scope: (nothing)" and would go looking for something to report.
+  - id: scope_story_technical
+    condition: "{{is_technical}} == true"
+    action: set
+    vars:
+      scope_brief: "SCOPE — story {{story}} ({{story_title}}) is a TECHNICAL story: a refactor, dependency upgrade or performance fix that delivers NO requirement. `exercises:` is empty by design, so there is no FR-/BR- to trace forward and NONE is expected. Judge only this: the code still meets the bounds this story is held to ({{constraints_csv}}), and nothing it changed has quietly altered behaviour the spec fixes. Its real oracle is the UNCHANGED test suite, which has already been checked this run. Report NO gap for a requirement — an unimplemented requirement is some other story's business, and a technical story that had to change behaviour was already caught upstream."
+
+  - id: scope_feature_note
+    condition: "{{story_resolved}} == false"
+    action: set
+    vars:
+      scope_brief: "SCOPE — the WHOLE FEATURE, because no story was named. In scope: every FR- and BR- you can see in spec.md EXCEPT these, which have OPEN stories and are work in flight rather than drift: {{inflight_csv}}. EXTENT — the whole of each in-scope id. Also in scope are the CN-/DC-/IC-/UX- the spec binds this feature by."
+  - id: bridge_story
+    condition: "{{story_be_exists}} == true"
+    action: set
+    vars:
+      bridge_note: "BRIDGE — the STORY DESIGN, service lane: design pass {{story_be_pass}} of {{story_be_doc}} (the LAST pass; earlier ones are superseded history). Its '### Changes' section is the map from this slice's ids to the files that realise them. The feature plans are in context underneath it as ARCHITECTURE — where those elements live — not as a second contract."
+  - id: bridge_story_ui
+    condition: "{{story_fe_exists}} == true"
+    action: set
+    vars:
+      bridge_note: "BRIDGE — the STORY DESIGN, both lanes: service pass {{story_be_pass}} of {{story_be_doc}} and UI pass {{story_fe_pass}} of {{story_fe_doc}} (the LAST pass of each; earlier ones are superseded history). Their '### Changes' sections are the map from this slice's ids to the files that realise them. A requirement with a user-facing surface is realised in BOTH lanes and needs a home in each. The feature plans are in context underneath as ARCHITECTURE, not as a second contract."
+
+  # 3. WHERE THE VERDICT GOES. A story-scoped verdict written at feature level would be
+  #    overwritten by the next story's run and then read as the feature's, so each scope
+  #    keeps its own file. gate-result writes the JSON beside the markdown and names it
+  #    after it, so a job holding either path holds the other.
+  # A named story that matched nothing would otherwise widen the run to feature scope in
+  # silence, which is a different gate than the one that was asked for. Announced, never
+  # refused: the input may equally have been guidance that names no story at all.
+  - id: mark_unresolved_input
+    condition: "{{story_resolved}} == false"
+    action: set
+    vars: { unresolved_input: "{{USER_INPUT}}" }
+  - id: unresolved_input_notice
+    action: verify_context
+    require_value: unresolved_input
+    equals: ""
+    on_mismatch: continue
+    on_mismatch_message: |
+      No story matched "{{unresolved_input}}", so this run is FEATURE-SCOPED — every FR- and
+      BR- in the spec except the ids with open stories. If you meant to gate one story, re-run
+      naming it exactly as its file does. The open backlog:
+      {{backlog_digest}}
+
+  - id: report_paths
+    action: set
+    vars: { report_path: "{{feature_dir}}/slice-analyze-report.md" }
+  - id: report_paths_story
+    condition: "{{story_resolved}} == true"
+    action: set
+    vars: { report_path: "{{story_dir}}/slice-analyze-report.md" }
+
+  # 3a. INVALIDATE any previous verdict, before anything downstream can stop. A gate that
+  #     writes its result only on completion leaves the LAST run's verdict on disk for
+  #     every run that aborts — a red test loop, a broken referrer — and a pipeline
+  #     reading that file would act on a certification this run never made. Every exit
+  #     from here on therefore leaves at least a red; the real verdict overwrites it.
+  - id: gate_result_open
+    action: execute_script
+    script: { ref: actions }
+    subcommand: gate-result
+    # The lenient loader needs a flow sequence on ONE line.
+    args: ["--gate", "analyze-slice", "--feature-dir", "{{feature_dir}}", "--ok", "false", "--report", "{{report_path}}", "--story", "{{story}}", "--note", "analyze-slice started and has not reached a verdict; a run that stops before certifying leaves this red on purpose"]
+    outputs:
+      - { name: result_file, from: "$.result_file" }
+
   # Is a change OPEN on this feature? Read for NAVIGATION only — see the vars note. Safe
   # on the bootstrap path: with no active_version.json, version-read returns
   # active_change="" / has_change=false and exits 0, so nothing here is conditional on it.
@@ -115,21 +370,27 @@ workflow:
       - { name: active_change, from: "$.active_change" }
       - { name: has_change,    from: "$.has_change" }
 
-  # The slice's source files, from its OKF concept — the context all three passes below
-  # work over (test fix loop, integrity triage, conformance). Replaces the retired
-  # `design-paths` fence scan: design.md is tech-agnostic prose with no ```lang path=…
-  # code blocks, so that scan returned nothing and every pass ran on an EMPTY file list.
-  # Read-only, exits 0 with paths=[] when there is no concept yet; on_error: continue so
-  # a missing bundle degrades the gate to its pre-existing (empty) behaviour, never blocks.
-  - id: concept_paths
+  # 4. THE CODE UNDER ANALYSIS, from the slice's OKF concept — BOTH LANES. Every pass
+  #    below works over this list. `concept-paths` reads `source_files` alone, so from
+  #    the moment implement-ui started writing `ui_source_files` a UI-bearing requirement
+  #    had no UI code in view to be traced to; `all_paths` is the union of the two.
+  #    A story narrows the QUESTION, not the file set: a requirement can only be judged
+  #    against everything that could realise it, and the concept records no per-story
+  #    split. Read-only, exits 0 with empty lists when there is no concept yet;
+  #    on_error: continue so a missing bundle degrades the gate rather than blocking it.
+  - id: concept_coverage
     action: execute_script
     on_error: continue
     script: { ref: xref }
-    subcommand: concept-paths
-    args: ["--feature-dir", "{{feature_dir}}"]
+    subcommand: concept-coverage
+    args: ["--feature-dir", "{{feature_dir}}", "--ids", "{{exercises_csv}}"]
     outputs:
-      - { name: all_paths,     from: "$.paths" }
-      - { name: paths_missing, from: "$.missing" }
+      - { name: all_paths,       from: "$.all_paths" }
+      - { name: paths_missing,   from: "$.all_missing_csv" }
+      - { name: coverage_digest, from: "$.digest" }
+      - { name: be_count,        from: "$.backend_count" }
+      - { name: fe_count,        from: "$.frontend_count" }
+      - { name: okf_concept,     from: "$.concept" }
 
   - id: resolve_pre_hooks
     action: execute_script
@@ -144,6 +405,15 @@ workflow:
 
   # ═══════ PASS 1 — BEHAVIOUR: the slice's tests vs the spec's acceptance criteria ═══════
   # Run tests → (if red) fix → re-run, up to 3×.
+  #
+  # For a TECHNICAL story the fix loop is told not to touch a test, because a test it
+  # edited to reach green is itself the behaviour change pass 2 exists to catch — and
+  # pass 2 counts this loop's edits, so the rule and the oracle agree.
+  - id: arm_no_test_edit
+    condition: "{{is_technical}} == true"
+    action: set
+    vars:
+      no_test_edit_rule: "THIS IS A TECHNICAL STORY. Do NOT modify, weaken, delete or rename a single test — the existing suite is this story's only oracle, and a test that has to change means behaviour changed and the work was a functional story citing a requirement. Fix the CODE until the tests as written pass. If a test genuinely cannot pass without changing it, STOP and say so rather than editing it: that finding is the point of the story, not an obstacle to it."
   - id: test_loop
     action: loop
     while: "{{test_ok}} != true"
@@ -172,6 +442,7 @@ workflow:
         action: build_context
         vars:
           test_log: "{{test_log}}"
+          no_test_edit_rule: "{{no_test_edit_rule}}"
         context:
           - { path: "{{spec_file}}" }
         context_from: all_paths
@@ -182,7 +453,7 @@ workflow:
         task: |
           Tests failed. Make them pass by fixing the code (or a genuinely wrong
           test) in the files in context, keeping behaviour aligned with the spec's
-          acceptance criteria (spec in context). Test log:
+          acceptance criteria (spec in context). {{no_test_edit_rule}} Test log:
           {{test_log}}
         outputs:
           - { name: fixed_files, from: "$.files" }
@@ -201,7 +472,87 @@ workflow:
       ones this feature did not cause; matched is not meaningful in that case. Last log:
       {{test_log}}
 
-  # ═══════ PASS 2 — DOMAIN CONFORMANCE: code vs the gate overlay checklist (validation) ═══════
+  # ═══════ PASS 2 — THE TECHNICAL-STORY ORACLE: the suite must be UNCHANGED ═══════
+  # A technical story (a refactor, a dependency upgrade, a performance fix) delivers no
+  # requirement, so `exercises:` is empty and there is no FR- to trace it to. The
+  # existing test suite is its whole oracle, and the rule is stronger than "the tests are
+  # green": a test that had to be MODIFIED means behaviour moved, and the work was a
+  # functional story citing a requirement (law 32). Run AFTER pass 1 on purpose, so the
+  # fix loop's own edits are counted — a gate that had to rewrite a test to reach green
+  # has proved the same thing.
+  #
+  # A new test is not a changed one: adding characterisation tests around a refactor is
+  # exactly the work a technical story exists to do. Deletions count as changes.
+  - id: test_diff
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: test-diff
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: oracle,             from: "$.oracle" }
+      - { name: tests_changed_csv,  from: "$.tests_changed_csv" }
+      - { name: tests_changed_count, from: "$.tests_changed_count" }
+      - { name: tdiff_digest,       from: "$.digest" }
+      - { name: tdiff_base,         from: "$.base" }
+      - { name: tdiff_base_kind,    from: "$.base_kind" }
+
+  # The story's type and the diff's state, combined into ONE string so each case is a
+  # single comparison the evaluator can make. Both halves are strings, so this needs no
+  # boolean gymnastics — a bool rendered by {{ }} and a bool read by require_value never
+  # compare equal (law 43), which is why the type arrives as a word rather than a flag.
+  - id: oracle_case_set
+    action: set
+    vars: { oracle_case: "{{story_type}}/{{oracle}}" }
+  - id: oracle_fail
+    condition: "{{oracle_case}} == technical/changed"
+    action: set
+    vars:
+      tech_gate_ok: "false"
+      tech_note: "FAILED — {{tests_changed_count}} test(s) modified or deleted: {{tests_changed_csv}}"
+  - id: oracle_unverified
+    condition: "{{oracle_case}} == technical/unverified"
+    action: set
+    vars:
+      tech_note: "UNVERIFIED — this is not a git working copy, so the suite's history cannot be read. The oracle did not pass; it could not run."
+  - id: oracle_clean
+    condition: "{{oracle_case}} == technical/clean"
+    action: set
+    vars:
+      tech_note: "PASSED — no test was modified or deleted against {{tdiff_base_kind}} baseline {{tdiff_base}}."
+
+  # An oracle that could not be read never fails the gate — it announces. Refusing on the
+  # strength of a check that did not run is the mirror image of passing on one.
+  - id: oracle_unverified_notice
+    condition: "{{oracle_case}} == technical/unverified"
+    action: verify_context
+    require_value: oracle
+    equals: "clean"
+    on_mismatch: continue
+    on_mismatch_message: |
+      TECHNICAL-STORY ORACLE UNVERIFIED for story {{story}}. A technical story delivers no
+      requirement, so the unchanged test suite is the only thing that can say whether its
+      behaviour moved — and that history is not readable here (this is not a git working
+      copy). Everything else in this gate ran; this one check did not, and it is recorded
+      as unverified rather than as a pass in {{result_file}}.
+
+  - id: oracle_gate
+    action: verify_context
+    require_true: tech_gate_ok
+    on_false: stop
+    on_false_message: |
+      TECHNICAL-STORY ORACLE FAILED — story {{story}} is type `technical`, and a technical
+      story's oracle is the UNCHANGED test suite. These tests were modified or deleted:
+      {{tests_changed_csv}}
+      {{tdiff_digest}}
+      A test that had to change means behaviour changed, and behaviour that changes belongs
+      to a FUNCTIONAL story citing the requirement it moves. Two ways out, and they are not
+      interchangeable: restore the tests and make the refactor behaviour-preserving, or
+      accept that this work changes behaviour — close this story as cancelled, raise a
+      functional story for the change through /appweaver sync-spec (if the contract moves)
+      or /appweaver add-story, and build it there where an FR- can be traced to it.
+
+  # ═══════ PASS 3 — DOMAIN CONFORMANCE: code vs the gate overlay checklist ═══════
   # With tests green, scan the feature's CODE against the domain gate overlays (the
   # forbidden-patterns / refusal conditions / CI gates). The overlays load as the
   # checklist — VALIDATION only, never an authoring input to feature code. No-op for a
@@ -225,6 +576,8 @@ workflow:
     steps:
       - id: ctx_conformance
         action: build_context
+        vars:
+          no_test_edit_rule: "{{no_test_edit_rule}}"
         context:
           - { path: "{{spec_file}}" }
         context_from: all_paths
@@ -259,7 +612,8 @@ workflow:
           Fix these domain-conformance violations in the feature's code (in context),
           following the gate checklist rules (in the standards) and keeping the design's
           behaviour intact. Do NOT weaken or delete a test to hide a violation — fix the
-          code. After fixing, re-run the tests (Bash) to confirm they stay green.
+          code. {{no_test_edit_rule}} After fixing, re-run the tests (Bash) to confirm
+          they stay green.
           Violations: {{conformance_violations}}
         outputs:
           - { name: conformance_fixes, from: "$.files" }
@@ -268,9 +622,9 @@ workflow:
     action: verify_context
     require_true: conformance_ok
     on_false: stop
-    on_false_message: "Code violates the domain gate checklist after 2 fix attempts (violations: {{conformance_violations}}). These are the domain constraints design/implement must satisfy — fix the code, or if the constraint itself is wrong, correct it upstream (/appweaver specify → design)."
+    on_false_message: "Code violates the domain gate checklist after 2 fix attempts (violations: {{conformance_violations}}). These are the domain constraints design/implement must satisfy — fix the code, or if the constraint itself is wrong, correct it upstream (/appweaver specify → plan)."
 
-  # ═══════ INTEGRITY — did this feature's change break any aggregate that USES it? ═══════
+  # ═══════ PASS 4 — INTEGRITY: did this change break any aggregate that USES it? ═══════
   # The slice is green + domain-conformant on its own. But a change to a feature can break
   # any OTHER aggregate that references it. Ask the OKF Cross-References index "who refers to
   # me?" (the transitive referrer closure — C→B→A all count), then RE-RUN the feature's tests
@@ -288,7 +642,7 @@ workflow:
     outputs:
       - { name: referrer_csv,   from: "$.referrer_closure_csv" }
       - { name: referrer_count, from: "$.referrer_closure_count" }
-      - { name: referrer_names, from: "$.referrer_closure" }
+      - { name: referrer_names, from: "$.referrer_closure_csv" }
 
   - id: run_integrity
     action: execute_script
@@ -359,7 +713,123 @@ workflow:
     on_false: stop
     on_false_message: "Integrity check failed — this feature's change breaks a test in an aggregate that REFERS to it. Referrer blast radius ({{referrer_count}}): {{referrer_names}}. Triage written to {{feature_dir}}/broken-referrers.md — resolve each in the referrer's own slice (or reconsider this feature's contract change), then re-run. Last log: {{integrity_log}}"
 
-  # ═══════ PASS 3 — OKF KNOWLEDGE: keep the slice's concept true to what now exists ═══════
+  # ═══════ PASS 5 — TRACE: spec ↔ code, through the design ═══════════════════
+  # The question this gate exists to answer, asked last because everything before it is a
+  # precondition: the code runs, it changed no oracle it should not have, it violates no
+  # domain constraint, and it broke nobody. What is left is the only thing that matters —
+  # is this the thing the contract asked for?
+  #
+  # READ-ONLY. It reports and never repairs: a missing requirement is feature work, and
+  # writing it here would produce code no design pass names and no gate ever conformed.
+  # Nothing between this step and the report can stop the run, so the verdict always
+  # reaches both the markdown and the JSON.
+  - id: ctx_trace
+    action: build_context
+    vars:
+      scope_brief: "{{scope_brief}}"
+      bridge_note: "{{bridge_note}}"
+      coverage_digest: "{{coverage_digest}}"
+      stale_note: "{{stale_note}}"
+    context:
+      - { path: "{{spec_file}}" }                       # THE ORACLE — the contract's own wording
+      - { path: "{{story_path}}", optional: true }      # the extent: what this slice claims of each id
+      - { path: "{{story_be_doc}}", optional: true }    # the BRIDGE, service lane — the latest pass
+      - { path: "{{story_fe_doc}}", optional: true }    # the BRIDGE, UI lane — the latest pass
+      - { path: "{{be_plan}}", optional: true }         # architecture: where those elements live
+      - { path: "{{fe_plan}}", optional: true }
+      - { path: "{{feature_dir}}/interfaces.md", optional: true }   # the published surface, cited by IF- id
+      - { path: "{{feature_dir}}/adr.md", optional: true }          # ratified decisions
+    context_from: all_paths                             # the CODE — both lanes, from the OKF concept
+  - id: trace
+    action: agent_query
+    tools: Read                          # follow a call out of the listed files when a trace needs it
+    include_standards: false             # the contract is the spec, not a rule corpus
+    schema: { ok: true, bridge_ok: true, gap_count: 0, gap_refs: "<comma-separated spec ids the gaps touch>", coverage: "<one line per in-scope id — id | what the spec requires | the design element that maps it | the code that realises it | DELIVERED or GAP>", gaps: [ { severity: "high", spec_ref: "<FR/BR/CN/DC/IC/UX id>", kind: "code-missing|code-wrong|bridge-missing|spec-wrong", where: "<file:symbol, or the document>", gap: "<what the spec requires and what is actually there>", route: "<the command that fixes it>" } ], bridge_gaps: "<one line per in-scope id no design maps, or empty>" }
+    mock: { ok: true, bridge_ok: true, gap_count: 0, gap_refs: "", coverage: "", gaps: [], bridge_gaps: "" }
+    task: |
+      spec.md is the ORACLE. Judge the CODE against it and report every id it fails to
+      deliver. The design is the BRIDGE that makes the question answerable — it says
+      which elements realise which id — and it is never the standard: where the design
+      and the spec disagree about an in-scope id, the SPEC is what the code is measured
+      against, and the disagreement is itself a finding.
+
+      {{scope_brief}}
+
+      {{bridge_note}}
+
+      The code in context is this slice's whole OKF file list, both lanes. Use Read to
+      follow anything it calls that a trace needs. Do NOT modify a single file — this
+      step is read-only by contract.
+
+      {{coverage_digest}}
+
+      HOW TO TRACE each in-scope id, in this order:
+      (1) Resolve the id's wording from spec.md. That wording — not the design's
+          restatement of it — is the standard.
+      (2) Find the DESIGN element that maps it (the story pass's "### Changes" and
+          "### Approach", or the feature plan's traceability section). If nothing maps
+          it, that is a BRIDGE gap: record it in `bridge_gaps` with kind
+          "bridge-missing". Then keep going — code may well deliver the id anyway, and
+          an undocumented realisation is a documentation defect, not a broken contract.
+      (3) Find the CODE that realises the element, and read it. Judge whether it
+          delivers what the spec words, to the extent this scope claims.
+      (4) Where the id has a user-facing surface, it is realised in BOTH lanes and needs
+          a home in each. A UX- lives only in the UI lane; a BR- only in the service
+          lane. Do not report a UI gap for a slice that has no UI lane in scope.
+
+      CLASSIFY every gap by `kind`, because the four routes are different commands:
+        code-missing   the design maps the id and no code realises it   → /appweaver implement
+        code-wrong     code exists and does something else              → /appweaver implement
+        bridge-missing no design maps the id at all                     → /appweaver story-plan
+        spec-wrong     the code is right and the SPEC words it wrongly  → /appweaver sync-spec
+      Use `spec-wrong` sparingly and only with a reason: the spec is the oracle, and
+      "the code disagrees" is evidence about the code first.
+
+      THESE ARE NOT GAPS, and reporting them is noise that hides the real ones:
+      - an id that is out of scope for this run — another story's work, or one nobody
+        has claimed yet;
+      - the part of a requirement this scope explicitly does not claim;
+      - style, naming, structure, layering or test-coverage opinions — other gates own
+        every one of those;
+      - anything a design pass deliberately deferred and named under its risks;
+      - a missing element you inferred from the design alone with no spec basis. The
+        design is the bridge, not the contract.
+
+      Fill `coverage` with ONE LINE PER IN-SCOPE ID, delivered or not — that table is the
+      traceability record this gate exists to leave behind, and it is written on a green
+      run too. Set gap_count and gap_refs from `gaps`. Set ok=true ONLY when every
+      in-scope id is delivered as the spec words it. Set bridge_ok=false when any
+      in-scope id has no design mapping it, INDEPENDENTLY of ok — working code with a
+      documentation gap is a true state and must be reportable as one.
+      {{stale_note}}
+    outputs:
+      - { name: trace_ok,        from: "$.ok" }
+      - { name: bridge_ok,       from: "$.bridge_ok" }
+      - { name: trace_gaps,      from: "$.gaps" }
+      - { name: trace_gap_count, from: "$.gap_count" }
+      - { name: trace_gap_refs,  from: "$.gap_refs" }
+      - { name: trace_coverage,  from: "$.coverage" }
+      - { name: bridge_gaps,     from: "$.bridge_gaps" }
+
+  # The bridge's integrity is ANNOUNCED, not gated. An id the design never mapped, whose
+  # code nonetheless delivers the spec, is a documentation defect — failing the slice for
+  # it would refuse working, contract-satisfying code over a missing row in a document
+  # the next story-plan pass rewrites anyway.
+  - id: bridge_notice
+    condition: "{{bridge_ok}} == false"
+    action: verify_context
+    require_value: bridge_ok
+    equals: "true"
+    on_mismatch: continue
+    on_mismatch_message: |
+      BRIDGE INCOMPLETE — in-scope ids that no design maps:
+      {{bridge_gaps}}
+      The code may well deliver them; what is missing is the record of WHERE. Nothing was
+      failed for this. Append a pass that maps them — /appweaver story-plan for the story
+      that owns the id, or /appweaver plan when the gap is feature-level — so the next run
+      of this gate can trace them instead of inferring them.
+
+  # ═══════ OKF KNOWLEDGE — keep the slice's concept true to what now exists ═══════
   # analyze-slice is the LAST stage that changes a greenfield slice's files: both fix loops
   # above run with Write/Edit, and the conformance loop is explicitly asked to ADD missing
   # constraint tests. Those files did not exist when implement wrote the OKF concept, so its
@@ -367,20 +837,18 @@ workflow:
   # the concept holds the full set implement recorded, these two vars hold only what the fix
   # loops touched), then report cross-reference drift.
   #
-  # These two steps are now the WHOLE write-back: the former `design-reconcile` step that
-  # preceded them was deleted (it copied on-disk file bodies into path-tagged design fences
-  # — meaningless once design.md became tech-agnostic prose, and it read the same
-  # fixed_files/paths these steps already own). Recording the files in the concept IS the
-  # current reconcile.
+  # --lane backend: both fix loops repair the code that failed a test or an overlay rule,
+  # and that is service-lane code. A UI file edited here would land in the service list —
+  # the same defect --lane was added to close — so if that ever becomes possible the fix
+  # is a second, lane-split merge, not a wider default.
   #
   # Deliberately NOT re-running `record`: the Depends-On/Cross-References edges derive from
-  # design.md §1 + its External integrations table, and no step in this stage edits
-  # design.md — the edge sources
-  # cannot have moved here. `--origin` is likewise omitted: concept-upsert setdefaults it,
-  # so an adopted (brownfield) slice keeps its `reverse-engineered` provenance instead of
-  # being restamped greenfield.
+  # the feature plan's §1 + its External integrations table, and no step in this stage edits
+  # that plan — the edge sources cannot have moved here. `--origin` is likewise omitted:
+  # concept-upsert setdefaults it, so an adopted (brownfield) slice keeps its
+  # `reverse-engineered` provenance instead of being restamped greenfield.
   #
-  # Advisory by design (on_error: continue, no gate): a green, domain-conformant slice is
+  # Advisory by design (on_error: continue, no gate): a green, contract-satisfying slice is
   # never failed over its knowledge index — drift is reported in the outputs and fixed by
   # `aw-xref validate --prune` / re-running the owning slice's `record`.
   - id: okf_merge_test_fixes
@@ -389,7 +857,7 @@ workflow:
     on_error: continue
     script: { ref: xref }
     subcommand: concept-upsert
-    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{fixed_files}}", "--merge"]
+    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{fixed_files}}", "--merge", "--lane", "backend"]
     outputs:
       - { name: okf_concept, from: "$.concept" }
 
@@ -399,7 +867,7 @@ workflow:
     on_error: continue
     script: { ref: xref }
     subcommand: concept-upsert
-    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{conformance_fixes}}", "--merge"]
+    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{conformance_fixes}}", "--merge", "--lane", "backend"]
     outputs:
       - { name: okf_concept, from: "$.concept" }
 
@@ -412,6 +880,86 @@ workflow:
       - { name: okf_ok,      from: "$.ok" }
       - { name: okf_orphans, from: "$.orphan_count" }
 
+  # ═══════ THE RECORD — written on EVERY run that gets here, green or red ═══════
+  # A gate that leaves nothing behind when it passes gives a reviewer no evidence that it
+  # ran at all, and the spec→design→code table is the whole point of tracing rather than
+  # merely testing.
+  - id: ctx_report
+    action: build_context
+    vars:
+      scope_brief: "{{scope_brief}}"
+      trace_coverage: "{{trace_coverage}}"
+      trace_gaps: "{{trace_gaps}}"
+      bridge_gaps: "{{bridge_gaps}}"
+      tech_note: "{{tech_note}}"
+      tdiff_digest: "{{tdiff_digest}}"
+  - id: write_report
+    action: agent_author
+    include_standards: false
+    output_target: { type: file, path: "{{report_path}}" }
+    task: |
+      Write the Slice Analyze Report to the output. It records what this gate found
+      tracing spec.md through the design to the code.
+
+      Verdict: contract satisfied={{trace_ok}}, bridge complete={{bridge_ok}}.
+      Gaps: {{trace_gap_count}} on {{trace_gap_refs}}.
+      Scope: {{scope}}-scoped, story "{{story}}" (empty on a feature-scoped run) ·
+      spec version {{current_version}}.
+      {{scope_brief}}
+      Passes: tests green={{test_ok}} (tool {{test_tool}}); technical oracle —
+      {{tech_note}}; domain conformance={{conformance_ok}}; integrity fence={{integrity_ok}}
+      over {{referrer_count}} referrer(s) ({{referrer_names}}). Code analysed:
+      {{be_count}} service file(s) + {{fe_count}} UI file(s) from the OKF concept
+      {{okf_concept}}; declared but absent from disk: {{paths_missing}}.
+      Coverage rows:
+      {{trace_coverage}}
+      Gaps:
+      {{trace_gaps}}
+      Bridge gaps:
+      {{bridge_gaps}}
+
+      Markdown format:
+      - `# Slice Analyze Report — <aggregate>` and, under it, a line naming the scope
+        (story id or "whole feature"), the spec version, and when this ran.
+      - A verdict line: "verdict: DELIVERS ✓" or "verdict: GAPS ✗ · <n> open". Add a
+        second line for the bridge when it is incomplete.
+      - `## Traceability (spec → design → code)`: a table
+        | spec id | what the spec requires | design element | code | status |
+        one row per in-scope id, from the coverage rows above. This is the reason the
+        report exists — write it on a green run too. If a row's design cell is empty the
+        id is unbridged; say so in the cell rather than leaving it blank.
+      - `## Gaps`: a table | # | severity | spec ref | kind | where | gap | route |.
+        Omit the section when there were none.
+      - `## Passes`: one line each for behaviour, the technical-story oracle, domain
+        conformance and integrity, with the result given above. Say plainly when the
+        oracle was UNVERIFIED rather than passed.
+      - `## How to resolve`: group the gaps by route and give the exact command for
+        each — code-missing/code-wrong go to /appweaver implement (correct the design
+        pass first if the pass is what is wrong), bridge-missing to /appweaver story-plan,
+        spec-wrong to /appweaver sync-spec. Omit on a clean run.
+      Do not invent ids, versions, dates or findings beyond the values given above.
+      Return the complete report markdown only.
+
+  # The machine-readable verdict, written beside the report by the SCRIPT — CI cannot
+  # branch on prose, and a verdict is exactly the kind of dated, derived record the model
+  # never writes. `ok` from this step means the file was written; the pass/fail verdict is
+  # `status` inside it.
+  - id: gate_result
+    action: execute_script
+    script: { ref: actions }
+    subcommand: gate-result
+    # The lenient loader needs a flow sequence on ONE line.
+    args: ["--gate", "analyze-slice", "--feature-dir", "{{feature_dir}}", "--ok", "{{trace_ok}}", "--spec-version", "{{current_version}}", "--story", "{{story}}", "--report", "{{report_path}}", "--gap-count", "{{trace_gap_count}}", "--gap-refs", "{{trace_gap_refs}}", "--field", "scope={{scope}}", "--field", "story_type={{story_type}}", "--field", "bridge_ok={{bridge_ok}}", "--field", "tests_green={{test_ok}}", "--field", "test_suite_diff={{oracle}}", "--field", "technical_oracle={{tech_note}}", "--field", "tests_changed={{tests_changed_csv}}", "--field", "domain_conformance={{conformance_ok}}", "--field", "integrity={{integrity_ok}}", "--field", "referrers={{referrer_names}}", "--field", "okf_concept={{okf_concept}}", "--field", "okf_index_ok={{okf_ok}}", "--field", "stale_ids={{stale_csv}}"]
+    outputs:
+      - { name: result_file, from: "$.result_file" }
+
+  # THE GATE. Last, so the report and the verdict are on disk whichever way it goes.
+  - id: trace_gate
+    action: verify_context
+    require_true: trace_ok
+    on_false: stop
+    on_false_message: "The code does not deliver the contract — {{trace_gap_count}} gap(s) on {{trace_gap_refs}}. The traceability report is at {{report_path}} and the machine-readable verdict at {{result_file}}. Nothing was repaired: a missing requirement is feature work, and writing it inside a gate would produce code no design pass names and no gate ever conformed. Route by each gap's `kind` — code-missing / code-wrong: correct the design pass if it is what is wrong (/appweaver story-plan), then /appweaver implement; bridge-missing: /appweaver story-plan, which appends a pass that maps the id; spec-wrong: /appweaver sync-spec, which is the ONLY way the contract moves. Then re-run /appweaver analyze-slice."
+
   - id: resolve_post_hooks
     action: execute_script
     script: { ref: actions }
@@ -425,13 +973,24 @@ workflow:
 
 outputs:
   feature_dir: "{{feature_dir}}"
-  test_tool: "{{test_tool}}"
+  scope: "{{scope}} — story {{story}} ({{story_type}}), spec {{current_version}}"
+  delivers_contract: "{{trace_ok}}"
+  bridge_complete: "{{bridge_ok}}"
+  gaps: "{{trace_gap_count}} on {{trace_gap_refs}}"
+  gap_detail: "{{trace_gaps}}"
+  bridge_gaps: "{{bridge_gaps}}"
+  report: "{{report_path}}"
+  result_json: "{{result_file}}"
+  tests: "green={{test_ok}} (tool {{test_tool}})"
+  technical_oracle: "{{tech_note}}"
+  domain_conformance: "{{conformance_ok}}"
   referrer_count: "{{referrer_count}}"
   referrer_blast_radius: "{{referrer_names}}"
-  okf_concept: "{{okf_concept}}"
-  okf_index_ok: "{{okf_ok}}"
-  okf_orphans: "{{okf_orphans}}"
+  code_analysed: "{{be_count}} service + {{fe_count}} UI file(s) from {{okf_concept}}"
   # Declared in the concept but absent on disk — advisory index drift, never gated.
   stale_source_files: "{{paths_missing}}"
+  okf_index_ok: "{{okf_ok}}"
+  okf_orphans: "{{okf_orphans}}"
+  stale_ids: "{{stale_csv}}"
   active_change: "{{active_change}}"
-  next: "CHANGE OPEN ({{active_change}}): /appweaver close-delta — the slice is green, domain-conformant and did not break a referrer, and its delta is already merged into the master docs, so the change may now be archived and the version bumped. NO OPEN CHANGE: /appweaver run."
+  next: "CHANGE OPEN ({{active_change}}): /appweaver close-delta — the slice delivers the contract, is domain-conformant and broke no referrer, and its delta is already merged into the master docs, so the change may now be archived and the version bumped. NO OPEN CHANGE: /appweaver close-story {{story}} to ratify its ADRs, flip its interface entries live and archive its design passes — then /appweaver run."