aw-spec-cli 0.1.16 → 0.1.18

package/assets/.appweaver/scripts/powershell/aw-spec-actions.ps1

@@ -124,8 +124,7 @@ function Invoke-ResolveDomain {
 # wrong corpus is how a Java project ends up being handed C# rules.
 function Invoke-ResolveTech {
     param([string[]]$Rest)
-    $commandName = 'aw-spec-plan'   # inert: every caller passes --command. Kept current
-                                    # so a hand-run defaults to a LIVE command, not a dead one.
+    $commandName = 'aw-spec-design'
     for ($i = 0; $i -lt $Rest.Count; $i++) {
         switch ($Rest[$i]) {
             '--command' { $commandName = $Rest[++$i] }
@@ -388,7 +387,7 @@ function Invoke-CreateChecklist {
     $content = if ($kind -eq 'delta') { @"
 # Delta-Spec Quality Checklist: $featureName — $crId
 
-**Purpose**: Validate the CHANGE's delta-spec before proceeding to design
+**Purpose**: Validate the CHANGE's delta-spec before proceeding to plan
 **Created**: $today
 **Change**: [delta-spec.md](../delta-spec.md)
 
@@ -432,12 +431,12 @@ function Invoke-CreateChecklist {
 
 - This checklist grades the DELTA DOCUMENT only. Accuracy against the master spec
   (id continuity, conflicts with existing requirements) is checked downstream by
-  /appweaver analyze-delta-design.
-- Items marked incomplete require delta-spec updates before /appweaver design
+  /appweaver analyze-plan-delta.
+- Items marked incomplete require delta-spec updates before /appweaver plan
 "@ } else { @"
 # Specification Quality Checklist: $featureName
 
-**Purpose**: Validate specification completeness and quality before proceeding to design
+**Purpose**: Validate specification completeness and quality before proceeding to plan
 **Created**: $today
 **Feature**: [spec.md](../spec.md)
 
@@ -454,8 +453,7 @@ function Invoke-CreateChecklist {
 - [ ] Requirements are testable and unambiguous
 - [ ] Success criteria are measurable
 - [ ] Success criteria are technology-agnostic (no implementation details)
-- [ ] Every requirement carries a stable id, and no retired id has been re-issued
-- [ ] The newest Change History row names every requirement id this version added or changed
+- [ ] All acceptance scenarios are defined
 - [ ] Edge cases are identified
 - [ ] Scope is clearly bounded
 - [ ] Dependencies and assumptions identified
@@ -476,14 +474,14 @@ function Invoke-CreateChecklist {
 
 ## Feature Readiness
 
-- [ ] Every functional requirement is stated in EARS form, which is its acceptance criterion
-- [ ] The requirements cover the aggregate's primary flows, so a story can be sliced from them without inventing behaviour
+- [ ] All functional requirements have clear acceptance criteria
+- [ ] User scenarios cover primary flows
 - [ ] Feature meets measurable outcomes defined in Success Criteria
 - [ ] No implementation details leak into specification
 
 ## Notes
 
-- Items marked incomplete require spec updates before /appweaver design
+- Items marked incomplete require spec updates before /appweaver plan
 "@ }
     Set-Content -Path $checklistFile -Value $content -Encoding UTF8
     Write-Json ([ordered]@{ checklist_file = $checklistFile; kind = $kind; target = $targetFile; created = $created })
@@ -656,6 +654,167 @@ function Invoke-LaneProbe {
 # (case-insensitive) — (1) specs/ sub-folders (already scaffolded/adopted) and
 # (2) the OKF bundle's Aggregate concepts (the brownfield feature map, resolved by
 # the SAME shared python core the bash twin calls). Empty source 2 on greenfield.
+# ─────────────────────── context.json (bounded context) ───────────────────
+# Twin of the bash read_context_json_context_directory / feature_base_rel pair. A
+# bounded context is the container a feature lives in — specs/<Context>/<Feature>/ —
+# and it owns the one domain-model.md every spec inside it references.
+#
+# ABSENCE IS A VALID STATE: a repo that predates bounded contexts keeps its features
+# flat under specs/, and every caller falls back to that layout when no context is
+# active. Both shells resolve it in exactly one place so the two cannot diverge on
+# where a feature lands.
+function Get-ContextDirectory {
+    param([string]$Repo)
+    $cj = Join-Path $Repo '.appweaver/context.json'
+    if (-not (Test-Path $cj)) { return '' }
+    try {
+        $c = Get-Content $cj -Raw | ConvertFrom-Json
+        $v = "$($c.context_directory)"
+        if ($v) { return $v }
+    } catch { return '' }
+    return ''
+}
+
+function Get-FeatureBaseRel {
+    param([string]$Repo)
+    $cd = Get-ContextDirectory -Repo $Repo
+    if ($cd -and (Test-Path (Join-Path $Repo $cd))) { return $cd }
+    return 'specs'
+}
+
+# A BOUNDED CONTEXT directory, not a feature: it holds features instead of being one.
+# Only reachable with no context active — inside a context, a feature carries its own
+# spec.md and never matches. Without this test a repo that has contexts but has not
+# selected one lists them as pickable features, and picking one would scaffold a
+# spec.md on top of a directory that already holds features. Twin of the bash
+# is_context() / set-feature guard.
+function Test-IsContextDir {
+    param([string]$Dir)
+    if (-not (Test-Path $Dir)) { return $false }
+    if (Test-Path (Join-Path $Dir 'spec.md')) { return $false }
+    if (Test-Path (Join-Path $Dir 'domain-model.md')) { return $true }
+    $kids = @(Get-ChildItem -Directory $Dir -ErrorAction SilentlyContinue |
+              Where-Object { Test-Path (Join-Path $_.FullName 'spec.md') })
+    return ($kids.Count -gt 0)
+}
+
+# ─────────────────────────── list-contexts ─────────────────────────────────
+# Twin of bash cmd_list_contexts, written natively (see ACCEPTED_BASH_ONLY in
+# aw-payload-parity.py — this pair is dual-authored by decision and must be reviewed
+# together). A directory under specs/ carrying its OWN spec.md is a feature; one that
+# does not is a bounded context. Pre-context features are reported as legacy_features
+# so an un-migrated repo says so rather than showing an empty list.
+function Invoke-ListContexts {
+    param([string[]]$Rest)
+    $preselect = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        if ($Rest[$i] -in '--preselect','-Preselect') { $preselect = $Rest[++$i] }
+    }
+    $repo = Get-RepoRoot
+    $base = Join-Path $repo 'specs'
+    $sentinel = '+ Create a new bounded context'
+    $activeRel = Get-ContextDirectory -Repo $repo
+    if ($activeRel -and -not (Test-Path (Join-Path $repo $activeRel))) { $activeRel = '' }
+    $active = ''
+    if ($activeRel) { $active = Split-Path $activeRel.TrimEnd('/') -Leaf }
+    $contexts = @(); $names = @(); $legacy = @(); $seen = @{}
+    if (Test-Path $base) {
+        foreach ($d in (Get-ChildItem -Directory $base -ErrorAction SilentlyContinue | Sort-Object Name)) {
+            if (Test-Path (Join-Path $d.FullName 'spec.md')) { $legacy += $d.Name; continue }
+            # EVERY subdirectory is a feature of this context, whether or not specify
+            # has run yet — select-feature creates the directory first and spec.md
+            # arrives later, so counting only specified ones would report a feature the
+            # user just created as absent, and disagree with list-features.
+            $feats = @(Get-ChildItem -Directory $d.FullName -ErrorAction SilentlyContinue |
+                       Sort-Object Name | ForEach-Object { $_.Name })
+            $specified = @($feats | Where-Object { Test-Path (Join-Path $d.FullName (Join-Path $_ 'spec.md')) })
+            $names += $d.Name; $seen[$d.Name.ToLower()] = $true
+            $contexts += [ordered]@{
+                name             = $d.Name
+                dir              = "specs/$($d.Name)"
+                features         = @($feats)
+                feature_count    = $feats.Count
+                specified_count  = $specified.Count
+                has_domain_model = (Test-Path (Join-Path $d.FullName 'domain-model.md'))
+            }
+        }
+    }
+    $opts = @($names)
+    if ($preselect -and (-not $seen.ContainsKey($preselect.ToLower()))) { $opts += $preselect }
+    $opts += $sentinel
+    # scope_ok answers ONE question for select-feature: is it safe to resolve a feature
+    # directory right now? Safe when a context is active, or when the repo has no
+    # contexts at all (the flat pre-context layout). Unsafe when contexts exist and none
+    # is selected — the feature would silently land outside every one of them. The
+    # engine has no compound conditions, so the AND is computed here.
+    $scopeOk = [bool]$active -or ($names.Count -eq 0)
+    $scopeMessage = ''
+    if (-not $scopeOk) {
+        $scopeMessage = "$($names.Count) bounded context(s) exist ($($names -join ', ')) but none is selected. Run /appweaver select-bounded-context first — without it a new feature is created at specs/<Feature>, outside every context and with no domain model to share."
+    }
+    Write-Json ([ordered]@{
+        contexts        = @($contexts)
+        names           = @($names)
+        count           = $names.Count
+        select_options  = @($opts)
+        sentinel        = $sentinel
+        legacy_features = @($legacy)
+        legacy_count    = $legacy.Count
+        active          = $active
+        active_dir      = $activeRel
+        # The specs/ subtree features resolve in — the active context, or plain
+        # 'specs' on a flat repo. Always populated, so a caller can name the location
+        # without branching on whether a context is set.
+        feature_base    = $(if ($activeRel) { $activeRel } else { 'specs' })
+        scope_ok        = $scopeOk
+        scope_message   = $scopeMessage
+    })
+}
+
+# ─────────────────────────── set-context ───────────────────────────────────
+# Twin of bash cmd_set_context. Creates the context directory but NOT
+# domain-model.md — specify is the only writer of the model, and an empty
+# placeholder would read as "the model exists" to every later gate.
+function Invoke-SetContext {
+    param([string[]]$Rest)
+    $raw = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        if ($Rest[$i] -in '--context','-Context') { $raw = $Rest[++$i] }
+    }
+    if (-not $raw) { Write-Error 'set-context: --context is required'; exit 1 }
+
+    # Same PascalCase normalization as set-feature: siblings in one path, so
+    # 'order management' and 'Order Management' cannot produce two directories.
+    $cleaned = ($raw -replace '[^A-Za-z0-9]+', ' ').Trim()
+    $context = ConvertTo-Pascal -In $cleaned
+    if ($context -notmatch '^[A-Za-z][A-Za-z0-9]*$') {
+        Write-Error "set-context: '$raw' is not a valid bounded context name (need a letter-led alphanumeric name, e.g. Sales)"; exit 1
+    }
+
+    $repo = Get-RepoRoot
+    $contextDirRel = "specs/$context"
+    $contextDir = Join-Path $repo $contextDirRel
+    # Refuse to shadow a flat feature: its spec.md already claims that directory.
+    if (Test-Path (Join-Path $contextDir 'spec.md')) {
+        Write-Error "set-context: refusing — 'specs/$context' is a feature (it has its own spec.md), not a bounded context. Pick another name, or move that feature under a context first."; exit 1
+    }
+    $existed = Test-Path $contextDir
+    New-Item -ItemType Directory -Force -Path $contextDir | Out-Null
+    New-Item -ItemType Directory -Force -Path (Join-Path $repo '.appweaver') | Out-Null
+    [ordered]@{ context = $context; context_directory = $contextDirRel } | ConvertTo-Json -Compress |
+        Set-Content -Path (Join-Path $repo '.appweaver/context.json') -Encoding UTF8
+
+    Write-Json ([ordered]@{
+        context             = $context
+        context_dir         = $contextDirRel
+        domain_model        = "$contextDirRel/domain-model.md"
+        existed             = [bool]$existed
+        created             = (-not $existed)
+        domain_model_exists = (Test-Path (Join-Path $contextDir 'domain-model.md'))
+        written             = $true
+    })
+}
+
 function Invoke-ListFeatures {
     param([string[]]$Rest)
     $preselect = ''; $bundle = ''
@@ -664,7 +823,10 @@ function Invoke-ListFeatures {
         elseif ($Rest[$i] -in '--bundle','-Bundle')   { $bundle    = $Rest[++$i] }
     }
     $repo = Get-RepoRoot
-    $base = Join-Path $repo 'specs'
+    # Features come from the ACTIVE BOUNDED CONTEXT's directory when one is set, and
+    # from specs/ itself when none is.
+    $baseRel = Get-FeatureBaseRel -Repo $repo
+    $base = Join-Path $repo $baseRel
     $sentinel = '+ Create a new feature'
     if (-not $bundle) { $bundle = 'knowledge' }
     if (-not [System.IO.Path]::IsPathRooted($bundle)) { $bundle = Join-Path $repo $bundle }
@@ -682,13 +844,14 @@ function Invoke-ListFeatures {
     $features = @(); $names = @(); $seen = @{}
     if (Test-Path $base) {
         foreach ($d in (Get-ChildItem -Directory $base -ErrorAction SilentlyContinue | Sort-Object Name)) {
+            if (Test-IsContextDir -Dir $d.FullName) { continue }
             $ver = ''; $activeChange = ''
             $avf = Join-Path $d.FullName 'active_version.json'
             if (Test-Path $avf) { try { $av = Get-Content $avf -Raw | ConvertFrom-Json; $ver = "$($av.version)"; $activeChange = "$($av.active_change)" } catch { $ver = '' } }
             $names += $d.Name; $seen[$d.Name.ToLower()] = $true
             $features += [ordered]@{
                 name          = $d.Name
-                dir           = "specs/$($d.Name)"
+                dir           = "$baseRel/$($d.Name)"
                 source        = 'spec'
                 has_spec      = (Test-Path (Join-Path $d.FullName 'spec.md'))
                 # 'design*.md', NOT 'design.*.md': the second dot made this miss the single
@@ -712,7 +875,7 @@ function Invoke-ListFeatures {
         $names += $nm; $seen[$nm.ToLower()] = $true
         $features += [ordered]@{
             name          = $nm
-            dir           = "specs/$nm"
+            dir           = "$baseRel/$nm"
             source        = 'okf'
             has_spec      = $false
             adopted       = $false
@@ -752,14 +915,25 @@ function Invoke-SetFeature {
     }
 
     $repo = Get-RepoRoot
-    $featureDirRel = "specs/$feature"
+    # Created inside the ACTIVE BOUNDED CONTEXT when one is set, directly under specs/
+    # when none is. feature.json stores the resulting path, so the nesting is invisible
+    # to every downstream caller.
+    $baseRel = Get-FeatureBaseRel -Repo $repo
+    $featureDirRel = "$baseRel/$feature"
     $featureDir = Join-Path $repo $featureDirRel
+    # Refuse to scaffold a feature on top of a bounded context — the mirror of
+    # set-context's refusal to shadow a feature.
+    if (Test-IsContextDir -Dir $featureDir) {
+        Write-Error "set-feature: refusing — '$featureDirRel' is a bounded context, not a feature. Run /appweaver select-bounded-context $feature first, then select-feature."; exit 1
+    }
     $existed = Test-Path $featureDir
     New-Item -ItemType Directory -Force -Path $featureDir | Out-Null
     New-Item -ItemType Directory -Force -Path (Join-Path $repo '.appweaver') | Out-Null
     @{ feature_directory = $featureDirRel } | ConvertTo-Json -Compress |
         Set-Content -Path (Join-Path $repo '.appweaver/feature.json') -Encoding UTF8
 
+    $context = ''
+    if ($baseRel -ne 'specs') { $context = $baseRel -replace '^specs/', '' }
     Write-Json ([ordered]@{
         feature     = $feature
         feature_dir = $featureDirRel
@@ -767,6 +941,7 @@ function Invoke-SetFeature {
         existed     = [bool]$existed
         created     = (-not $existed)
         spec_exists = (Test-Path (Join-Path $featureDir 'spec.md'))
+        context     = $context
     })
 }
 
@@ -797,7 +972,14 @@ def bump(v):
 
 d, existed = load()
 d.setdefault("feature", feature); d.setdefault("version", "v1.0"); d.setdefault("active_change", "")
+# Migrate pre-parallel state forward on read: a file written when only one change could
+# be open carries active_change and no list. Seed the list from it rather than reporting
+# zero open changes on a feature that has one.
+if "open_changes" not in d:
+    d["open_changes"] = [d["active_change"]] if d.get("active_change") else []
 out = {"feature": d["feature"], "version": d["version"], "active_change": d.get("active_change", ""),
+       "open_changes": list(d.get("open_changes") or []),
+       "open_count": len([c for c in (d.get("open_changes") or []) if c]),
        "exists": existed, "path": "active_version.json", "ok": True}
 if op == "read":
     pass
@@ -805,13 +987,10 @@ elif op == "init":
     # BOOTSTRAP IN PROGRESS, and ONLY when the caller says it is authoring a first draft
     # (--bootstrap). A first run that dies after writing spec.md but before its ledger row
     # leaves a document that looks, to the next FRESH invocation, exactly like a spec
-    # written before the ledger existed — `unstamped`, which passes. specify then took the
-    # EXTEND path and applied the same input a second time, on top of a v1.0 that was never
-    # finished, and bumped it to v1.1. Checkpoint resume was always fine; a fresh invocation
-    # was not, and nothing distinguished the two. This marker does. Only ledger-ids clears
-    # it, and only once the v1.0 row actually names ids read out of the finished document —
-    # so a bootstrap whose row never landed is re-run and REPAIRED rather than being frozen
-    # behind a v1.1 that can never go back and fix it.
+    # written before the ledger existed — which passes. specify then took the EXTEND path
+    # and applied the same input a second time, on top of a v1.0 that was never finished.
+    # Checkpoint resume was always fine; a fresh invocation was not, and nothing
+    # distinguished the two. This marker does.
     #
     # The flag is the CALLER's, not this primitive's: adopt inits the same file after
     # reversing a spec out of existing code, and a marker raised there would tell the next
@@ -820,25 +999,68 @@ elif op == "init":
         d["bootstrap_pending"] = True
     save(d)
     out["created"] = (not existed)
+elif op == "bootstrap-done":
+    # THE ONLY THING THAT CLEARS THE MARKER, called by the phase that raised it once the
+    # first draft is actually finished. It is a separate op, not a side effect of writing
+    # the spec, because "the file exists" is exactly the signal that could not be trusted:
+    # a crashed run leaves one too. Idempotent — clearing a marker that is already down is
+    # the ordinary case on a re-run, and is not an error.
+    was = bool(d.pop("bootstrap_pending", None))
+    save(d)
+    out["cleared"] = was
 elif op == "open":
-    cur = d.get("active_change", "")
-    if cur and cur != cr and force != "1":       # a DIFFERENT change is already open -> refuse
+    # MANY CHANGES MAY BE OPEN AT ONCE. Every specify call on an established feature
+    # opens its own change, so the record is the open_changes LIST; the single-active
+    # guard that used to refuse a second one is gone.
+    #
+    # active_change is still written, and is the MOST RECENTLY OPENED. Every stage
+    # downstream of specify still resolves "the" change through that field, so keeping
+    # it correct is what lets parallel AUTHORING land before those stages learn to take
+    # an explicit --cr-id. Reading open_changes is how a caller sees the rest.
+    opens = [c for c in (d.get("open_changes") or []) if c]
+    if cr and cr not in opens:
+        opens.append(cr)
+    d["open_changes"] = opens
+    d["active_change"] = cr or (opens[-1] if opens else "")
+    save(d)
+    out["active_change"] = d["active_change"]; out["opened"] = cr
+    out["open_changes"] = opens; out["open_count"] = len(opens)
+    if cr in (d.get("open_changes") or [])[:-1]: out["reopened"] = True
+elif op == "activate":
+    # Point active_change at an already-open change. Nothing else moves: no version, no
+    # membership, no dates. This is how a CHOSEN delta reaches the stages that still
+    # resolve "the" change through active_change, without pretending it was just opened.
+    opens = [c for c in (d.get("open_changes") or []) if c]
+    if cr and cr not in opens:
         out["ok"] = False
-        out["error"] = ("change '%s' is already open on this feature; finish it "
-                        "(finalize-delta -> analyze-slice -> close-delta) before opening "
-                        "'%s', or pass --force" % (cur, cr))
-        out["conflict"] = cur; out["requested"] = cr; out["has_change"] = True
-        print(json.dumps(out)); sys.exit(3)
-    d["active_change"] = cr; save(d)
-    out["active_change"] = cr; out["opened"] = cr
-    if cur and cur == cr: out["reopened"] = True   # idempotent re-open of the same CR
+        out["error"] = ("'%s' is not an open change on this feature (open: %s)"
+                        % (cr, ", ".join(opens) or "none"))
+    else:
+        d["active_change"] = cr or d.get("active_change", "")
+        save(d)
+        out["active_change"] = d["active_change"]; out["activated"] = cr
+    out["open_changes"] = opens; out["open_count"] = len(opens)
 elif op == "close":
-    prev = d["version"]; closed = d.get("active_change", "")
-    if closed:                       # a real change was open -> materialized -> bump
+    # Closes ONE change by id (falling back to active_change when none is named, which
+    # is the pre-parallel caller). The version bumps once per change materialized, and
+    # active_change falls back to whatever is still open so the downstream stages keep
+    # resolving a real change while others remain in flight.
+    prev = d["version"]
+    opens = [c for c in (d.get("open_changes") or []) if c]
+    if not opens and d.get("active_change"):
+        opens = [d["active_change"]]          # state written before open_changes existed
+    closed = cr or d.get("active_change", "")
+    if closed and closed in opens:
+        opens.remove(closed)
+        d["version"] = bump(prev)
+    elif closed:                              # not tracked, but a real change was named
         d["version"] = bump(prev)
-    d["active_change"] = ""; save(d)
-    out["version"] = d["version"]; out["active_change"] = ""
+    d["open_changes"] = opens
+    d["active_change"] = opens[-1] if opens else ""
+    save(d)
+    out["version"] = d["version"]; out["active_change"] = d["active_change"]
     out["previous"] = prev; out["closed_change"] = closed
+    out["open_changes"] = opens; out["open_count"] = len(opens)
 out["bootstrap_pending"] = bool(d.get("bootstrap_pending"))
 out["has_change"] = bool(out.get("active_change", ""))   # clean branch signal for design
 # What a close from THIS state would produce. One bump() authority, read by BOTH
@@ -855,15 +1077,17 @@ function Invoke-ActiveVersion {
     $py = Get-Py; if (-not $py) { Write-Error "version-$Op`: python3 required"; exit 1 }
     $env:AW_FD = $FeatureDir; $env:AW_OP = $Op; $env:AW_CR = $CrId; $env:AW_FORCE = $Force
     $env:AW_BOOT = $Boot
-    $PyActiveVersion | & $py -   # sets $LASTEXITCODE=3 when op=open is refused (guard)
+    # CrId names the change on BOTH open and close: many may be open at once, so a close
+    # has to say which one it is closing rather than assuming the only one.
+    $PyActiveVersion | & $py -
 }
 
-function Invoke-VersionState {   # op in read|init (feature-dir, plus --bootstrap on init)
+function Invoke-VersionState {   # op in read|init (feature-dir only)
     param([string]$Op, [string[]]$Rest)
     $fdArg = ''; $boot = ''
     for ($i = 0; $i -lt $Rest.Count; $i++) {
         if ($Rest[$i] -in '--feature-dir','-FeatureDir') { $fdArg = $Rest[++$i] }
-        elseif ($Rest[$i] -in '--bootstrap','-Bootstrap') { $boot = '1' }
+        elseif ($Rest[$i] -eq '--bootstrap') { $boot = '1' }   # init only: this caller is authoring a FIRST draft
     }
     $repo = Get-RepoRoot
     $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
@@ -873,2063 +1097,6 @@ function Invoke-VersionState {   # op in read|init (feature-dir, plus --bootstra
 
 
 
-# ═════════════════════════ the spec version ledger ══════════════════════════
-# spec.md's `## Change History` is the sync anchor between the spec and its story
-# backlog: each row names the requirement ids that version touched, and each story
-# records the version it last synced at, so "is this story stale" is one integer
-# comparison rather than a diff. sync-stories reads the rows; specify and
-# update-spec append them.
-#
-# The ledger is hand-writable, which is the point — a spec can be edited by hand —
-# and also its one weakness: a body edited with no row leaves every affected story
-# quietly stale and nothing says so. active_version.json therefore carries a sha256
-# of spec.md as of the last kit-authored write, and three states follow from
-# comparing it against the document:
-#
-#   hash matches                    clean — nothing has been hand-edited since
-#   hash differs, version stands    a hand edit that skipped the ledger -> REFUSE
-#   hash differs, version advanced  a hand edit that wrote its own row  -> accept
-#
-# The middle case is the only silent failure the ledger has, which is why it is the
-# one thing checked before any workflow writes.
-$PySpecLedger = @'
-import json, os, re, hashlib, datetime, sys
-fd = os.environ["AW_FD"]; op = os.environ["AW_OP"]
-ids = os.environ.get("AW_IDS", "").strip(); summary = os.environ.get("AW_SUM", "").strip()
-spec = os.path.join(fd, "spec.md"); avp = os.path.join(fd, "active_version.json")
-feature = os.path.basename(fd.rstrip("/\\"))
-
-def now(): return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-def vtuple(v):
-    m = re.match(r'v?(\d+)(?:\.(\d+))?', (v or "").strip())
-    return (int(m.group(1)), int(m.group(2) or 0)) if m else (0, 0)
-def bump(v):
-    maj, mnr = vtuple(v or "v1.0")
-    return "v%d.%d" % (maj, mnr + 1)
-
-out = {"feature": feature, "op": op, "ok": True, "spec_exists": os.path.isfile(spec)}
-
-# A non-zero exit is reported by the orchestrator from STDERR alone, so anything that
-# stops a run has to say why there as well as in the JSON — otherwise the operator sees
-# "script failed (ledger-append):" and nothing else.
-def bail(msg, code):
-    out.update(ok=False, error=msg)
-    print(json.dumps(out)); sys.stderr.write(msg + "\n"); sys.exit(code)
-
-if not out["spec_exists"]:
-    bail("no spec.md at %s" % fd, 1)
-
-text = open(spec, encoding="utf-8", errors="replace").read()
-
-# The Story Coverage block is a projection of the backlog, not contract, and it is written
-# by the story workflows rather than by whoever owns the spec. Cutting it out before
-# hashing is what lets both be true at once: creating a story rewrites this document
-# without that reading as an unledgered edit of the requirements.
-COV = re.compile(r'<!--\s*AW:COVERAGE:BEGIN\s*-->.*?<!--\s*AW:COVERAGE:END\s*-->', re.S)
-def contract_of(t): return COV.sub("", t)
-actual = hashlib.sha256(contract_of(text).encode("utf-8")).hexdigest()
-av = {}
-if os.path.isfile(avp):
-    try: av = json.load(open(avp, encoding="utf-8"))
-    except Exception: av = {}
-recorded_hash = av.get("spec_sha256", "")
-recorded_ver = av.get("version", "v1.0")
-
-# The document's own header is what a hand edit bumps; active_version.json is what the
-# kit last wrote. They agree except across a hand edit, and the disagreement is the signal.
-m = re.search(r'^\*\*Version\*\*:\s*(v[\d.]+)', text, re.M)
-doc_ver = m.group(1) if m else ""
-
-# THE LEDGER TABLE, located once: its heading, its separator rule, and the data rows under
-# it. Every op that touches a version row works from this, and `check` refuses a document
-# that has none — because ledger-append discovers a missing table only AFTER the spec has
-# been rewritten, and a rewritten spec with no row is exactly the state the next run's
-# tripwire refuses. Finding it at entry turns a wedged feature into a message.
-lines = text.split("\n")
-hi = next((i for i, l in enumerate(lines)
-           if re.match(r'^##\s+Change History\s*$', l.strip())), -1)
-sec_end = (next((i for i in range(hi + 1, len(lines)) if lines[i].startswith("## ")),
-                len(lines)) if hi >= 0 else -1)
-sep = (next((i for i in range(hi + 1, sec_end)
-             if re.match(r'^\|[\s\-:|]+\|$', lines[i].strip())), -1) if hi >= 0 else -1)
-rows = [i for i in range(sep + 1, sec_end) if lines[i].lstrip().startswith("|")] if sep >= 0 else []
-has_ledger = hi >= 0 and sep >= 0
-# THE VERSIONS THE TABLE ACTUALLY CARRIES, read from the rows located above rather than by
-# an unbounded scan, so a version-looking cell in another section's table cannot be counted
-# as history. This is the EVIDENCE that a change was recorded; the document's **Version**
-# header is only the CLAIM, and hand editing parts the two in both directions.
-row_versions = [m.group(1) for m in
-                (re.match(r'^\|\s*(v\d+(?:\.\d+)?)\s*\|', lines[i].lstrip()) for i in rows)
-                if m]
-newest_row = max(row_versions, key=vtuple) if row_versions else ""
-
-def cell(s, limit=160):
-    """One markdown table cell. A newline ENDS a row and a bare pipe STARTS a column, so
-    free text dropped into a cell silently rewrites the row's shape — a summary carrying
-    either one produced a version row whose 'Requirements changed' cell had moved or
-    vanished, which is a change no story can ever be reconciled against."""
-    s = re.sub(r'\s+', ' ', (s or "")).strip().replace("|", "\\|")
-    return (s[:limit - 1] + "\u2026") if len(s) > limit else s
-
-# IS A DELTA ACTUALLY MEASURED AGAINST THIS MASTER. cr-setup scaffolds delta-spec.md AND
-# delta-design.md for EVERY change it opens, so the file existing proves nothing. Since
-# specify lost its delta branch nothing authors a delta-spec at all, and the only changes
-# opened today are design-only ones carrying an untouched copy of the template — for which
-# editing spec.md strands nothing. Authored means the bytes have moved off the template;
-# with no template resolvable, a non-empty file counts.
-cr = av.get("active_change", "")
-dtpl = os.environ.get("AW_DTPL", "")
-dspec = os.path.join(fd, "changes", cr, "delta-spec.md") if cr else ""
-delta_authored = False
-if dspec and os.path.isfile(dspec) and os.path.getsize(dspec) > 0:
-    try:
-        delta_authored = (not (dtpl and os.path.isfile(dtpl))
-                          or open(dspec, "rb").read() != open(dtpl, "rb").read())
-    except Exception:
-        delta_authored = True
-
-out.update(open_change=cr, delta_authored=delta_authored)
-out.update(version=recorded_ver, doc_version=doc_ver, spec_sha256=actual,
-           recorded_sha256=recorded_hash, body_changed=(recorded_hash != actual),
-           has_ledger=has_ledger, ledger_rows=len(rows), newest_row=newest_row,
-           first_stamp=(not recorded_hash))
-
-if op == "check":
-    # An AUTHORED delta-spec was computed against THIS master. Writing the master directly
-    # would leave that delta measured from a baseline that no longer exists, and nothing
-    # downstream re-checks it. The two families overlap only until the delta set is deleted,
-    # so this guard is temporary by design — but while both exist it is the one silent way
-    # they collide. Narrowed to an authored delta on purpose: gating on `active_change`
-    # alone refused every extend for the whole life of a DESIGN-only change, which strands
-    # nothing, and told the operator to finish a chain they may be retiring.
-    if cr and delta_authored:
-        out["state"] = "delta_open"
-        out.update(ok=False, active_change=cr,
-                   error="change '%s' is open on this feature and its delta-spec has been "
-                   "authored, so a delta is measured against this master. Editing spec.md "
-                   "directly would leave that delta computed from a baseline that no longer "
-                   "exists. Either finish the change (finalize-delta -> analyze-slice -> "
-                   "close-delta), or abandon it: "
-                   "`.appweaver/scripts/bash/aw-spec-actions.sh cr-archive --cr-id %s` moves "
-                   "changes/%s/ into changes/archive/ and clears the flag. Abandoning also "
-                   "bumps the minor version, so the number moves even though nothing shipped."
-                   % (cr, cr, cr))
-    elif not has_ledger:
-        out["state"] = "no_ledger"
-        out.update(ok=False,
-                   error="spec.md has no '## Change History' table. That table is where a "
-                   "story learns a requirement it cites has moved, so a spec without one "
-                   "cannot be kept in step with its backlog. Add the section with its "
-                   "header row and separator (see the spec template), then re-run.")
-    elif not recorded_hash:
-        out["state"] = "unstamped"          # pre-ledger spec; stamp adopts it
-    elif recorded_hash == actual:
-        out["state"] = "clean"
-    # THE ROW IS THE EVIDENCE; THE HEADER IS ONLY THE CLAIM. The body has moved since the
-    # kit last stamped, and what makes that edit legible downstream is a version ROW naming
-    # the ids it touched: sync-stories reads rows, story-plan's staleness check reads rows,
-    # and neither ever opens the **Version** header. Taking the header as proof accepted the
-    # commonest hand-edit mistake there is — bump the number, forget the row — and that one
-    # passed every tripwire in the kit, raised no work anywhere, and was then buried for good
-    # by the next run's stamp adopting its hash. So the test is a row ABOVE the version the
-    # kit last recorded, and the header is only asked whether it kept up.
-    elif newest_row and vtuple(newest_row) > vtuple(recorded_ver):
-        out["state"] = ("ledgered_edit" if vtuple(doc_ver) >= vtuple(newest_row)
-                        else "header_behind")   # recorded; stamp reconciles the header
-    elif vtuple(doc_ver) > vtuple(recorded_ver):
-        # The header claims a version the table never recorded. Refused for the same reason
-        # an unrowed edit is: without the row nothing can say WHICH requirements moved, so
-        # every story citing one is stale with nothing able to detect it.
-        out["state"] = "unrowed_edit"
-        out.update(ok=False, error="spec.md's header reads %s but the Change History carries "
-                   "no row above %s — the version was bumped and what it changed was never "
-                   "recorded. The row is what a story reads to learn that a requirement it "
-                   "cites has moved; the header is read by nobody. Add a row naming the ids "
-                   "you changed (keep the header at %s), then re-run."
-                   % (doc_ver or "no version", recorded_ver, doc_ver))
-    elif vtuple(doc_ver) < vtuple(recorded_ver):
-        out["state"] = "rollback"
-        out.update(ok=False, error="spec.md reads %s but the kit last wrote %s — the "
-                   "document is behind its own ledger" % (doc_ver or "no version", recorded_ver))
-    else:
-        out["state"] = "unledgered_edit"
-        # BOTH ROUTES, BECAUSE NOT EVERY EDIT HAS AN ID TO NAME. Law 5 requires a version row
-        # to name at least one id, so an edit to Aggregate Boundary, Experience Scope or any
-        # other load-bearing prose has nothing legal to put in the cell — and being told to
-        # "add a row naming the ids you changed" sent that person round a loop with no exit.
-        # The protocol has always sanctioned re-baselining instead when the diff finds no id
-        # (SPEC-EDIT-PROTOCOL.md, "The short version" step 4 and the PR checklist); it was
-        # simply never named at the one place anybody reads it.
-        out.update(ok=False, error="spec.md has changed since %s but no Change History row "
-                   "was added. Every story citing an edited requirement is now silently "
-                   "stale. Add a row naming the ids you changed, then re-run — or, if this "
-                   "edit touched NO requirement (prose only: scope, boundary, wording that "
-                   "defines no id), re-run spec-stamp to re-baseline instead. Run spec-diff "
-                   "against the snapshot to see which of the two this is."
-                   % recorded_ver)
-elif op == "stamp":
-    # THE VERSION IS THE HIGHEST OF THE THREE PLACES ONE IS WRITTEN, and the document's
-    # header is reconciled up to it. Taking the header alone let a hand edit that DID write
-    # its row — without bumping the header — leave the kit recording a version below the
-    # newest row; the next hand edit then read as a `rollback`, the document behind its own
-    # ledger, when nothing had rolled back. Rewriting the header is the authority
-    # ledger-append already exercises: the kit owns the number, the row is what it is
-    # computed from, and re-hashing after the rewrite is what keeps the baseline honest.
-    stamp_ver = max([recorded_ver or "v1.0", doc_ver or "v1.0"] +
-                    ([newest_row] if newest_row else []), key=vtuple)
-    if doc_ver and vtuple(doc_ver) < vtuple(stamp_ver):
-        text = re.sub(r'^(\*\*Version\*\*:\s*)v[\d.]+', r'\g<1>' + stamp_ver,
-                      text, count=1, flags=re.M)
-        open(spec, "w", encoding="utf-8").write(text)
-        actual = hashlib.sha256(contract_of(text).encode("utf-8")).hexdigest()
-        out.update(header_rewritten=True, doc_version=stamp_ver, spec_sha256=actual)
-    av.setdefault("feature", feature); av.setdefault("active_change", "")
-    av["version"] = stamp_ver
-    av["spec_sha256"] = actual; av["updated"] = now()
-    open(avp, "w", encoding="utf-8").write(json.dumps(av, indent=2) + "\n")
-    out.update(version=av["version"], state="stamped")
-elif op == "append":
-    if not ids:
-        # A version that names no ids is a bump nothing can reconcile against: every
-        # story keeps its old stamp and the gap compounds at the next real change.
-        bail("ledger-append: --ids is required — a version row that names no requirement "
-             "ids leaves sync-stories nothing to act on", 2)
-    # The next number comes from the highest of all three places a version is written —
-    # what the kit last recorded, what the document's header claims, and the newest row
-    # actually in the table. A hand edit routinely moves one and not the others, and
-    # taking the maximum is what stops the ledger re-issuing a number it has already used.
-    row_vers = re.findall(r'^\|\s*(v\d+(?:\.\d+)?)\s*\|', text, re.M)
-    new_ver = bump(max([recorded_ver, doc_ver] + row_vers, key=vtuple))
-    today = datetime.date.today().isoformat()
-    # Both free-text cells go through cell(): the summary is whatever the operator typed on
-    # the command line, and one newline or one pipe in it destroys the row.
-    row = "| %s | %s | %s | %s | — |" % (
-        new_ver, today, cell(summary) or "Requirements updated", cell(ids))
-
-    # Bounded to the Change History section, not "the last table row in the file". Any
-    # section below it — Story Coverage today — carries its own table, and an unbounded
-    # search would file the version row into whichever one happened to come last.
-    if not has_ledger:
-        bail("spec.md has no '## Change History' table to append to — the ledger is "
-             "where a story learns a requirement moved, so a spec without one cannot be "
-             "kept in step with its backlog. spec.md HAS ALREADY BEEN WRITTEN by this run: "
-             "add the section, then re-run to record what it changed", 2)
-    last = rows[-1] if rows else sep
-    # Duplicate version = two writers reached the same number, which is the collision the
-    # integer buys for free. Refuse rather than append a second row nothing can order.
-    if re.search(r'^\|\s*%s\s*\|' % re.escape(new_ver), text, re.M):
-        bail("the ledger already carries a %s row — another write reached this version "
-             "first; re-read spec.md and retry" % new_ver, 3)
-    lines.insert(last + 1, row)
-
-    stamped = re.sub(r'^(\*\*Version\*\*:\s*)v[\d.]+', r'\g<1>' + new_ver,
-                     "\n".join(lines), count=1, flags=re.M)
-    open(spec, "w", encoding="utf-8").write(stamped)
-
-    av.setdefault("feature", feature); av.setdefault("active_change", "")
-    av["version"] = new_ver
-    av["spec_sha256"] = hashlib.sha256(contract_of(stamped).encode("utf-8")).hexdigest()
-    av["updated"] = now()
-    open(avp, "w", encoding="utf-8").write(json.dumps(av, indent=2) + "\n")
-    out.update(version=new_ver, previous=recorded_ver, row=row, ids=ids,
-               spec_sha256=av["spec_sha256"], state="appended")
-elif op == "rowids":
-    # THE FIRST ROW, COMPUTED. Every other version row is derived from a before/after diff,
-    # for the reason the header of this file gives: a row the model DECLARED can omit an id
-    # it moved, and an omitted id is silent. The v1.0 row was the one exception — written by
-    # the author from a template whose placeholder literally reads "FR-001…FR-00n", which
-    # sync-stories then has to be told not to trust. This op closes that gap: the caller
-    # diffs the finished document against nothing and hands the ids in, exactly as the
-    # extend path does, so the first row is observed like all the rest.
-    if not ids:
-        bail("ledger-ids: --ids is required", 2)
-    if not has_ledger:
-        bail("spec.md has no '## Change History' table to write the initial row into", 2)
-    ver = doc_ver if re.match(r'^v\d+(\.\d+)?$', doc_ver or "") else (recorded_ver or "v1.0")
-    today = datetime.date.today().isoformat()
-    if rows:
-        # Rewrite the newest row's cells in place. A cell split has to respect \| , which is
-        # how cell() escapes a pipe the operator typed — splitting on every pipe would treat
-        # an escaped one as a column break and shift every cell after it.
-        parts = re.split(r'(?<!\\)\|', lines[rows[-1]])
-        body = [c.strip() for c in parts[1:-1]] if len(parts) >= 3 else []
-        while len(body) < 5: body.append("")
-        if not re.match(r'^v\d+(\.\d+)?$', body[0]): body[0] = ver
-        if not re.match(r'^\d{4}-\d{2}-\d{2}$', body[1]): body[1] = today
-        if not body[2] or body[2].startswith("["): body[2] = "Initial specification"
-        body[3] = cell(ids)
-        if not body[4]: body[4] = "—"
-        lines[rows[-1]] = "| " + " | ".join(body[:5]) + " |"
-    else:
-        lines.insert(sep + 1, "| %s | %s | Initial specification | %s | — |"
-                     % (ver, today, cell(ids)))
-    stamped = re.sub(r'^(\*\*Version\*\*:\s*)v[\d.]+', r'\g<1>' + ver,
-                     "\n".join(lines), count=1, flags=re.M)
-    open(spec, "w", encoding="utf-8").write(stamped)
-    # The v1.0 row now names ids read out of the finished document, which is the moment the
-    # bootstrap is complete. Clearing the marker here and NOWHERE else is what makes an
-    # incomplete first run re-runnable: spec-stamp still re-baselines the hash on every path,
-    # so gating on the hash would have frozen a placeholder row as clean forever.
-    av.pop("bootstrap_pending", None)
-    av.setdefault("feature", feature); av.setdefault("active_change", "")
-    av["version"] = ver; av["updated"] = now()
-    open(avp, "w", encoding="utf-8").write(json.dumps(av, indent=2) + "\n")
-    out.update(version=ver, ids=ids, row=lines[rows[-1]] if rows else lines[sep + 1],
-               bootstrap_pending=False, state="rowids")
-print(json.dumps(out))
-'@
-
-# What a run CHANGED, observed rather than declared. specify snapshots spec.md before
-# it authors and diffs after the converge loop has finished with it, so the Change
-# History row is computed from the document's own requirement ids. A row the model
-# declares can omit a requirement the converge loop rewrote on its way past — and an
-# omitted id is the silent case the whole ledger exists to prevent.
-$PySpecDiff = @'
-import json, os, re, hashlib, sys
-snap = os.environ.get("AW_SNAP", ""); spec = os.environ["AW_SPEC"]
-# ASKING FOR NO BEFORE-STATE IS NOT THE SAME AS LOSING ONE. An empty --snapshot is the
-# bootstrap path saying "there was nothing before this run", and every id is legitimately
-# added. A path that was given and is not there is the before-state having been LOST, and
-# answering that with "everything is new" is the loudest possible wrong answer: it marks
-# every story in the feature stale for a change that touched none of them.
-if snap and not os.path.isfile(snap):
-    msg = ("spec-diff: the before-state at %s is gone, so this run cannot tell what it "
-           "changed. spec.md HAS been written. Recover by hand: put the ids you changed "
-           "into a new Change History row, then re-run spec-stamp to re-baseline."
-           % snap)
-    print(json.dumps({"ok": False, "error": msg, "had_snapshot": False, "snapshot": snap}))
-    sys.stderr.write(msg + "\n"); sys.exit(2)
-# An id is keyed to the line that DEFINES it, never to a line that merely mentions it.
-# The four shapes are scored, best wins, earliest line breaks a tie:
-#   3  a leading table cell          | DC-001 | … |
-#   3  a bold id opening a bullet    - **FR-001**: THE SYSTEM SHALL …
-#   2  a bold id opening a line      **FR-001** …            (a definition missing its colon)
-#   1  a bold id anywhere            … narrowing **FR-001**. (a cross-reference)
-# Scoring rather than "first bold id on the line, last line wins": a note that OPENS with
-# a cross-reference — "**FR-005** remains in force; **FR-006** narrows it" — re-keyed
-# FR-005 to that note, so a requirement restored character-for-character was reported as
-# MODIFIED. That is the worst possible misreading here, because the additive path exists
-# precisely to leave such a requirement alone, and its own instructions ask the author to
-# name the id in the new requirement's text.
-DEF_CELL = re.compile(r'^\s*\|\s*([A-Z]{2}-\d+)\s*\|')
-DEF_BULL = re.compile(r'^\s*(?:[-*+]\s+)?\*\*([A-Z]{2}-\d+)\*\*\s*[:\u2014\u2013-]')
-DEF_OPEN = re.compile(r'^\s*(?:[-*+]\s+)?\*\*([A-Z]{2}-\d+)\*\*')
-ANY_BOLD = re.compile(r'\*\*([A-Z]{2}-\d+)\*\*')
-# The Story Coverage block lists requirement ids in a table, so it reads exactly like the
-# Data Classification section to DEF_CELL. Left in, every story raised against FR-003 would
-# show up here as FR-003 having CHANGED — a version row, and every story citing it stale,
-# because somebody wrote a story.
-COV = re.compile(r'<!--\s*AW:COVERAGE:BEGIN\s*-->.*?<!--\s*AW:COVERAGE:END\s*-->', re.S)
-# The ledger's own rows name ids in prose cells; they record history, they do not define a
-# requirement, and the table is stripped before the scan for the same reason as coverage.
-HIST = re.compile(r'^##\s+Change History\s*$', re.M)
-def is_def(l):
-    return bool(DEF_CELL.match(l) or DEF_BULL.match(l) or DEF_OPEN.match(l))
-def scan(path):
-    """{id: (score, line_no, hash)} for every id the document mentions."""
-    best = {}
-    if not path or not os.path.isfile(path): return best
-    text = COV.sub("", open(path, encoding="utf-8", errors="replace").read())
-    hm = HIST.search(text)
-    if hm: text = text[:hm.start()]
-    lines = text.split("\n")
-    for n, line in enumerate(lines):
-        hits = []
-        m = DEF_CELL.match(line)
-        if m: hits.append((3, m.group(1)))
-        m = DEF_BULL.match(line)
-        if m: hits.append((3, m.group(1)))
-        else:
-            m = DEF_OPEN.match(line)
-            if m: hits.append((2, m.group(1)))
-        for rid in ANY_BOLD.findall(line):
-            hits.append((1, rid))
-        for score, rid in hits:
-            if rid not in best or score > best[rid][0]:
-                best[rid] = (score, n)
-    # THE WHOLE REQUIREMENT, not the line its id sits on. A requirement that wraps carries
-    # half its meaning on the continuation lines, and hashing only the id's own line made an
-    # edit below the fold invisible: change_count 0, no ledger row appended, and spec-stamp
-    # re-baselining the new body as clean — the ledger's own silent failure, for every story
-    # citing that id. The block runs to the next definition, heading or blank line, and is
-    # whitespace-normalised as ONE string, so a rewrap across lines is still not a change.
-    out = {}
-    for rid, (score, n) in best.items():
-        block = [lines[n]]
-        for m2 in range(n + 1, len(lines)):
-            nxt = lines[m2]
-            if not nxt.strip() or nxt.lstrip().startswith("#") or is_def(nxt): break
-            block.append(nxt)
-        h = hashlib.sha256(" ".join(" ".join(block).split()).encode()).hexdigest()[:16]
-        out[rid] = (score, n, h)
-    return out
-def ids(path):
-    return {k: v[2] for k, v in scan(path).items()}
-# A DEFINITION THE SCAN CANNOT KEY IS A REQUIREMENT THAT CAN CHANGE WITH NO LEDGER RECORD OF
-# IT. The parser keys an id to the line that defines it and hashes the block under it; three
-# authoring forms fall outside that and each one is silent — the edit lands, change_count
-# stays 0, no row is appended, and spec-stamp re-baselines the new body as clean, for every
-# story citing that id. Reported rather than parsed around: widening the parser to accept
-# them would make the ledger's shapes whatever anyone happened to type, and the fix a person
-# wants here is to write the requirement in the form the template uses.
-LOOSE_DEF = re.compile(r'^\s*(?:[-*+]\s+)?([A-Z]{2}-\d+)\s*[:—–-]')
-def unkeyed_warnings(path, keyed):
-    warn = []
-    if not path or not os.path.isfile(path): return warn
-    raw = COV.sub("", open(path, encoding="utf-8", errors="replace").read())
-    hm = HIST.search(raw)
-    above, below = (raw[:hm.start()], raw[hm.end():]) if hm else (raw, "")
-    lines = above.split("\n")
-    plain = []
-    for line in lines:
-        m = LOOSE_DEF.match(line)
-        if m and m.group(1) not in keyed and m.group(1) not in plain: plain.append(m.group(1))
-    if plain:
-        warn.append("written without bold ids (`- %s: …` rather than `- **%s**: …`), so the "
-                    "diff cannot key them to a definition and an edit to one raises no "
-                    "ledger row: %s" % (plain[0], plain[0], ", ".join(sorted(plain))))
-    if hm:
-        low = []
-        for line in below.split("\n"):
-            m = DEF_CELL.match(line) or DEF_BULL.match(line) or LOOSE_DEF.match(line)
-            if m and m.group(1) not in keyed and m.group(1) not in low: low.append(m.group(1))
-        if low:
-            warn.append("defined BELOW the '## Change History' table, where the scan stops "
-                        "— the ledger reads nothing under its own table, so these are "
-                        "invisible to every version comparison: %s" % ", ".join(sorted(low)))
-    orphaned = []
-    for n, line in enumerate(lines):
-        m = DEF_CELL.match(line) or DEF_BULL.match(line) or DEF_OPEN.match(line)
-        if not m: continue
-        j = n + 1
-        while (j < len(lines) and lines[j].strip()
-               and not lines[j].lstrip().startswith("#") and not is_def(lines[j])):
-            j += 1
-        # j is the first line outside the hashed block. A BLANK there, followed by indented
-        # prose that opens no new definition, is a continuation the hash cannot see.
-        if j < len(lines) and not lines[j].strip():
-            k = j + 1
-            if (k < len(lines) and lines[k].strip()
-                    and (lines[k].startswith(" ") or lines[k].startswith("\t"))
-                    and not is_def(lines[k]) and not lines[k].lstrip().startswith("#")
-                    and m.group(1) not in orphaned):
-                orphaned.append(m.group(1))
-    if orphaned:
-        warn.append("carry continuation text below a BLANK line — the hashed block ends at "
-                    "the blank, so anything under it can be rewritten with no diff: %s"
-                    % ", ".join(sorted(orphaned)))
-    return warn
-# Ids the ledger has already spent. An id is PERMANENT: re-issuing one silently re-points
-# stories, designs and code that have already shipped. Read from the SNAPSHOT's history, so
-# it is what the ledger said before this run, and only meaningful when there is a snapshot.
-def spent(path):
-    if not path or not os.path.isfile(path): return set()
-    text = open(path, encoding="utf-8", errors="replace").read()
-    hm = HIST.search(text)
-    if not hm: return set()
-    return set(re.findall(r'[A-Z]{2}-\d+', text[hm.end():]))
-before, after = ids(snap), ids(spec)
-added    = sorted(k for k in after if k not in before)
-removed  = sorted(k for k in before if k not in after)
-modified = sorted(k for k in after if k in before and before[k] != after[k])
-changed  = sorted(set(added) | set(removed) | set(modified))
-reissued = sorted(set(added) & spent(snap))
-# THE STORY-FACING SUBSET. A story cites FR- and BR- ids and nothing else, so those are the
-# only classes the backlog can act on — the same scoping spec-coverage applies, for the same
-# reason. The scan is deliberately class-blind (CN-/DC-/IC-/UX-/SC- all move the contract and
-# all belong in the ledger row), but handing that whole set to sync-stories as "the
-# requirements this run touched" asks it to raise a story for a success criterion.
-STORY_CLASS = ("FR-", "BR-")
-story_ids = [c for c in changed if c.startswith(STORY_CLASS)]
-warnings = unkeyed_warnings(spec, set(after))
-print(json.dumps({
-    "ok": True, "had_snapshot": bool(snap and os.path.isfile(snap)),
-    "added": added, "removed": removed, "modified": modified,
-    "changed": changed, "changed_csv": ", ".join(changed),
-    "change_count": len(changed),
-    "added_csv": ", ".join(added),
-    # removed ids orphan every story citing them (E1) — carried out so the caller can say so
-    "removed_csv": ", ".join(removed),
-    "modified_csv": ", ".join(modified),
-    # What an existing story would feel. An ADDED requirement disturbs nobody: no story
-    # cites an id that did not exist a moment ago. Modifying or removing one moves ground
-    # somebody may already be standing on, which is the set worth asking about.
-    "disturbing": sorted(set(modified) | set(removed)),
-    "disturbing_csv": ", ".join(sorted(set(modified) | set(removed))),
-    # An id this run introduced that the ledger has already spent. Detected, not blocked:
-    # the document is written by the time we can see it, and refusing here would leave a
-    # spec on disk that the next run's entry check would refuse too.
-    "reissued": reissued, "reissued_csv": ", ".join(reissued),
-    "reissued_any": bool(reissued),
-    # changed, narrowed to the classes a story can cite — what sync-stories works from.
-    "story_ids": story_ids, "story_ids_csv": ", ".join(story_ids),
-    "story_id_count": len(story_ids),
-    # Ids the document states in a form the ledger cannot key to a definition. Not a
-    # verdict on this run's changes — a standing property of the document, reported every
-    # time because the requirement it describes can move silently until it is rewritten.
-    "warnings": warnings, "warning_count": len(warnings),
-    "any_warnings": bool(warnings),
-    "warnings_note": "  //  ".join(warnings),
-}))
-'@
-
-# Which requirements have live work against them. A read-only scan of the feature's
-# stories/ directory, reading only frontmatter — which is why §6.1 puts everything the
-# gates need there rather than in the body. Only OPEN stories count: a closed story is
-# history and a cancelled one was abandoned, and neither is disturbed by the contract
-# moving. in_flight is the narrower set — an open story that already has a stories/<ID>/
-# directory, so someone is working from a projection of the requirement as it reads today.
-$PyStoryRefs = @'
-import json, os, re
-fd = os.environ["AW_FD"]; want = os.environ.get("AW_IDS", "")
-sdir = os.path.join(fd, "stories")
-queried = [s.strip() for s in re.split(r'[,\s]+', want) if s.strip()]
-
-def parse_fm(text):
-    """Frontmatter as a flat dict. A value may be inline (`exercises: [FR-001, BR-002]`) or
-    a YAML block list under an empty key — both are valid YAML and a hand edit produces
-    either, so a parser that read only the inline form saw a perfectly good story as citing
-    nothing, and a story citing nothing is invisible to every gate that exists to protect
-    it. Block items are folded into the inline shape so every caller stays regex-simple."""
-    m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-    if not m: return {}
-    fm, key, block = {}, None, set()
-    for line in m.group(1).split("\n"):
-        km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-        if km:
-            key = km.group(1); fm[key] = km.group(2).strip(); continue
-        im = re.match(r'^\s+-\s+(.*)$', line) if key else None
-        if im and (key in block or not fm[key]):
-            block.add(key)
-            fm[key] = (fm[key] + ", " + im.group(1).strip()) if fm[key] else im.group(1).strip()
-    return fm
-
-def read(path):
-    try: return open(path, encoding="utf-8", errors="replace").read()
-    except Exception: return ""
-
-def bound_ids(fm, text):
-    """The constraint ids this story is built to satisfy. Read from the `constraints:`
-    FRONTMATTER field, which story-stamp lifts from the spec — the body's `## Constraints`
-    section is model-authored prose, so an id the model left out of it would be invisible to
-    exactly the scan that exists to notice a bound moving under someone.
-
-    ABSENT IS NOT EMPTY. A story written before the field existed has no key at all and its
-    ids are still only in the body, so that case falls back to the section. An explicitly
-    empty `constraints: []` is an answer — this story is bound by nothing — and is taken as
-    one. The fallback goes when every live backlog has been re-stamped."""
-    if "constraints" in fm:
-        return sorted(set(re.findall(r'\b(?:CN|DC|IC|UX)-\d+', fm["constraints"])))
-    bm = re.search(r'^##\s+Constraints\s*$(.*?)(?=^##\s|\Z)', text, re.M | re.S)
-    return sorted(set(re.findall(r'\b(?:CN|DC|IC|UX)-\d+', bm.group(1)))) if bm else []
-
-stories = []
-if os.path.isdir(sdir):
-    for name in sorted(os.listdir(sdir)):
-        if not name.endswith(".md"): continue
-        path = os.path.join(sdir, name)
-        if not os.path.isfile(path): continue
-        text = read(path); fm = parse_fm(text)
-        sid = fm.get("id") or name[:-3]
-        # An unparseable story is reported as open rather than skipped: a story the scan
-        # cannot read is exactly the one whose requirements must not move unannounced.
-        status = (fm.get("status") or "open").strip().lower()
-        cites = [c.strip() for c in re.findall(r'[A-Z]{2}-\d+', fm.get("exercises", ""))]
-        bounds = bound_ids(fm, text)
-        stories.append({"id": sid, "status": status, "exercises": cites,
-                        "cites_csv": ", ".join(cites),
-                        "constraints": bounds,
-                        "constraints_csv": ", ".join(bounds),
-                        "carried": sorted(set(cites) | set(bounds)),
-                        "title": (fm.get("title") or "").strip().strip("[]"),
-                        "spec_version": (fm.get("spec_version") or "").strip(),
-                        "type": (fm.get("type") or "functional").strip().lower(),
-                        "follows": (fm.get("follows") or "").strip(),
-                        "in_flight": os.path.isdir(os.path.join(sdir, sid))})
-
-open_stories = [s for s in stories if s["status"] == "open"]
-# TWO SETS, DELIBERATELY DIFFERENT. `covered` is the DELIVERY relation — what open stories
-# are delivering — and analyze-slice subtracts it from a feature-scoped run as "these have
-# open stories" (law 39). A constraint is met, never delivered, so folding one in here would
-# drop a bound the code must still satisfy out of the feature gate's scope.
-# `carried` is the wider question specify has to ask: what would an open story FEEL if this
-# ran moved it. That one has to include the bounds, or amending a CN-/DC-/IC-/UX- disturbs
-# stories built against it and nothing anywhere says so (law 15).
-covered = sorted({c for s in open_stories for c in s["exercises"]})
-carried = sorted({c for s in open_stories for c in s["carried"]})
-
-# ASKING ABOUT NOTHING IS NOT ASKING ABOUT EVERYTHING. `--ids ""` is a caller saying "this
-# run disturbed no requirement" — a pure addition — and the answer is an empty set. Only
-# the absence of the flag means "tell me about the whole backlog". Conflating the two made
-# an enhancement that touched nothing existing prompt about every requirement with a story.
-targets = queried if os.environ.get("AW_IDS_GIVEN") else carried
-
-affected, aff_ids, aff_stories, inflight = [], [], [], []
-for rid in targets:
-    hit = [s for s in open_stories if rid in s["carried"]]
-    if not hit: continue
-    aff_ids.append(rid)
-    names = [s["id"] for s in hit]
-    flying = [s["id"] for s in hit if s["in_flight"]]
-    aff_stories += names; inflight += flying
-    affected.append({"id": rid, "stories": names, "in_flight": flying})
-
-# THE COMPLEMENT, NAMED. `affected` is "these ids have live work"; its complement is
-# "these ids have nobody on them", and that is the set sync-stories raises new stories for.
-# Derived here rather than in the caller because the orchestrator binds values and never
-# computes them, and a subtraction done in a prompt is a subtraction nothing can check.
-unlinked = [rid for rid in targets if rid not in aff_ids]
-
-# One line per open story, for a prompt that has to ask about them. A story id on its own
-# is not something an author can answer about: what it cites and whether someone is already
-# implementing it are the whole basis of the decision.
-digest = "\n".join(
-    "  %-16s %-9s %-11s cites %s%s%s" % (
-        s["id"], s["status"], "IN FLIGHT" if s["in_flight"] else "not started",
-        s["cites_csv"] or "nothing",
-        ("  bound by " + s["constraints_csv"]) if s["constraints_csv"] else "",
-        ("  @ " + s["spec_version"]) if s["spec_version"] else "")
-    for s in open_stories) or "  (no open stories)"
-
-print(json.dumps({
-    "ok": True, "stories_dir": sdir, "stories_exist": os.path.isdir(sdir),
-    "story_count": len(stories), "open_count": len(open_stories),
-    "stories": stories, "digest": digest,
-    "queried": queried, "covered": covered, "covered_csv": ", ".join(covered),
-    "carried": carried, "carried_csv": ", ".join(carried),
-    "carried_count": len(carried), "any_carried": bool(carried),
-    "affected": affected, "affected_ids": aff_ids, "affected_csv": ", ".join(aff_ids),
-    "unlinked": unlinked, "unlinked_csv": ", ".join(unlinked),
-    "unlinked_count": len(unlinked), "any_unlinked": bool(unlinked),
-    "story_csv": ", ".join(sorted(set(aff_stories))),
-    "in_flight_csv": ", ".join(sorted(set(inflight))),
-    "any": bool(aff_ids), "any_in_flight": bool(inflight),
-}))
-'@
-
-function Invoke-StoryRefs {
-    param([string[]]$Rest)
-    $fdArg = ''; $ids = ''; $idsGiven = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--feature-dir' { $fdArg = $Rest[++$i] }
-            '--ids'         { $ids = $Rest[++$i]; $idsGiven = '1' }
-        }
-    }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'story-refs: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'story-refs: python3 required'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_IDS = $ids; $env:AW_IDS_GIVEN = $idsGiven
-    $PyStoryRefs | & $py -
-}
-
-# Rewrite the spec's Story Coverage block from the stories/ directory: every FR- and BR-
-# in the document, and the stories that deliver it. The relation is stored ONCE, in each
-# story's `exercises:` frontmatter; this is that relation read the other way round, which
-# is why the block is regenerated wholesale rather than patched.
-#
-# Fenced out of the ledger on purpose — spec-check, spec-diff and ledger-append all cut
-# the block out before they look, so writing it is not a spec edit and a story raised
-# against FR-003 does not read as FR-003 having changed.
-# ─────────────────────────────── ledger-read ───────────────────────────────
-# THE WORK SET: which requirements this sync has to account for. The ledger records what
-# each version touched and every story records the version it last synced at, so the
-# question "what has moved since the backlog was last in step" is answerable by reading
-# rows — no diffing, no hashing, no model.
-#
-# The set is the union of the ids named by every row ABOVE THE LOWEST spec_version across
-# the OPEN stories, not the ids of the newest row alone. Those are the same set whenever
-# the backlog is one version behind, which is the ordinary case; they diverge only when a
-# sync was skipped, and that is exactly the case worth getting right. Two specify runs
-# without a sync between them leave the middle version named by no row anyone reads, and
-# its requirements would get no story with nothing to say so — a silent gap, in the one
-# mechanism built to make gaps loud.
-#
-# THE v1.0 CASE (E42). At v1.0 nothing has moved yet: there is no "since" to read from. So
-# when no open story carries a readable spec version — an empty backlog, or stories written
-# before the field existed — the work set is every FR-/BR- the DOCUMENT declares, and the
-# per-id four-case table does the rest. A second run over the same spec then creates
-# nothing, because by then every id has a story.
-#
-# Scoped to FR-/BR- throughout, the same scoping spec-coverage applies: those are the only
-# classes a story's `exercises:` can name. CN-/DC-/IC-/UX- move the contract and belong in
-# the ledger row, but they are constraints a story CARRIES, not slices of work it delivers.
-$PyLedgerRead = @'
-import json, os, re, sys
-fd = os.environ["AW_FD"]
-spec = os.path.join(fd, "spec.md"); sdir = os.path.join(fd, "stories")
-
-def bail(msg, code=1):
-    print(json.dumps({"ok": False, "error": msg}))
-    sys.stderr.write(msg + "\n"); sys.exit(code)
-
-if not os.path.isfile(spec): bail("no spec.md at %s" % fd)
-text = open(spec, encoding="utf-8", errors="replace").read()
-
-COV = re.compile(r'<!--\s*AW:COVERAGE:BEGIN\s*-->.*?<!--\s*AW:COVERAGE:END\s*-->', re.S)
-
-def vtuple(v):
-    m = re.match(r'v?(\d+)(?:\.(\d+))?', (v or "").strip())
-    return (int(m.group(1)), int(m.group(2) or 0)) if m else (0, 0)
-
-def rids(s):
-    """FR-/BR- ids in order of appearance, deduped, then sorted by class and number so
-    two callers reading the same row always produce the same csv."""
-    seen, out = set(), []
-    for t in re.findall(r'\b(?:FR|BR)-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return sorted(out, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-def nids(s):
-    """The classes a row can name that a STORY cannot be raised for: the bounds a slice is
-    built to satisfy and the outcomes the feature gate scores. Kept apart from rids()
-    rather than widening it, because the work set drives story creation and a story for a
-    success criterion is not a thing — but a row that moved one of these still has to be
-    said out loud, and until now it produced an empty work set and a run that stopped with
-    'the backlog is already in step'."""
-    seen, out = set(), []
-    for t in re.findall(r'\b(?:CN|DC|IC|UX|SC)-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return sorted(out, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-def parse_fm(text):
-    """Frontmatter as a flat dict. A value may be inline (`exercises: [FR-001, BR-002]`) or
-    a YAML block list under an empty key — both are valid YAML and a hand edit produces
-    either, so a parser that read only the inline form saw a perfectly good story as citing
-    nothing, and a story citing nothing is invisible to every gate that exists to protect
-    it. Block items are folded into the inline shape so every caller stays regex-simple."""
-    m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-    if not m: return {}
-    fm, key, block = {}, None, set()
-    for line in m.group(1).split("\n"):
-        km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-        if km:
-            key = km.group(1); fm[key] = km.group(2).strip(); continue
-        im = re.match(r'^\s+-\s+(.*)$', line) if key else None
-        if im and (key in block or not fm[key]):
-            block.add(key)
-            fm[key] = (fm[key] + ", " + im.group(1).strip()) if fm[key] else im.group(1).strip()
-    return fm
-
-# THE LEDGER TABLE, located the same way _spec_ledger locates it — heading, separator rule,
-# then the rows under it, bounded by the next `## `. Any other section carries its own
-# table (Story Coverage does), and an unbounded search would read one of those as history.
-lines = text.split("\n")
-hi = next((i for i, l in enumerate(lines)
-           if re.match(r'^##\s+Change History\s*$', l.strip())), -1)
-sec_end = (next((i for i in range(hi + 1, len(lines)) if lines[i].startswith("## ")),
-                len(lines)) if hi >= 0 else -1)
-sep = (next((i for i in range(hi + 1, sec_end)
-             if re.match(r'^\|[\s\-:|]+\|$', lines[i].strip())), -1) if hi >= 0 else -1)
-row_lines = [i for i in range(sep + 1, sec_end) if lines[i].lstrip().startswith("|")] if sep >= 0 else []
-has_ledger = hi >= 0 and sep >= 0
-
-def cells(line):
-    parts = re.split(r'(?<!\\)\|', line)
-    return [c.strip().replace("\\|", "|") for c in parts[1:-1]] if len(parts) >= 3 else []
-
-rows = []
-for i in row_lines:
-    c = cells(lines[i]); c += [""] * (5 - len(c))
-    # A row whose first cell is not a version is the template's own placeholder line, or a
-    # note somebody left in the table. It records no version, so it orders against nothing.
-    if not re.match(r'^v\d', c[0]): continue
-    rows.append({"version": c[0], "date": c[1], "change": c[2], "ids_cell": c[3],
-                 "stories": c[4], "requirements": rids(c[3]),
-                 "non_story": nids(c[3])})
-rows.sort(key=lambda r: vtuple(r["version"]))
-
-# WHAT THE DOCUMENT STILL DECLARES. Read from the requirement's DEFINING line — the bolded
-# id the template gives every requirement — and with the Change History cut away, so the
-# ids named in a row's own cell are never mistaken for requirements the spec carries.
-body = COV.sub("", text).split("\n## Change History")[0]
-declared = []
-for line in body.split("\n"):
-    m = re.search(r'\*\*((?:FR|BR)-\d+)\*\*', line)
-    if m and m.group(1) not in declared: declared.append(m.group(1))
-declared.sort(key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-stories = []
-if os.path.isdir(sdir):
-    for name in sorted(os.listdir(sdir)):
-        if not name.endswith(".md"): continue
-        p = os.path.join(sdir, name)
-        if not os.path.isfile(p): continue
-        fm = parse_fm(open(p, encoding="utf-8", errors="replace").read())
-        sid = fm.get("id") or name[:-3]
-        stories.append({"id": sid, "status": (fm.get("status") or "open").strip().lower(),
-                        "spec_version": (fm.get("spec_version") or "").strip(),
-                        "follows": (fm.get("follows") or "").strip(),
-                        "in_flight": os.path.isdir(os.path.join(sdir, sid)),
-                        "cites": rids(fm.get("exercises", ""))})
-open_stories = [s for s in stories if s["status"] == "open"]
-
-# THE FLOOR is the oldest version any open story is still sitting at, and everything above
-# it is unsynced. A story whose spec_version is missing or unreadable counts as v0.0 rather
-# than being skipped: it has demonstrably never synced, and putting the whole ledger above
-# it is the same answer enumerating from the document would give.
-floors = [vtuple(s["spec_version"]) for s in open_stories]
-readable = [s for s in open_stories if re.match(r'^v?\d', s["spec_version"] or "")]
-# A BACKLOG THAT IS ENTIRELY CLOSED IS NOT A BACKLOG THAT NEVER SYNCED. Reading the floor
-# from open stories alone made the last story closing look exactly like a feature nobody has
-# ever sliced: no floor took the enumerate-the-whole-document branch below, so one idle
-# re-run after finishing a feature raised a fresh story for every requirement in the spec —
-# each one reported as work the contract had moved on, when nothing had moved at all. A
-# CLOSED story carries a stamp too, and it records which version its work was measured
-# against. CANCELLED ones are excluded: abandoned work delivered nothing and settles nothing,
-# so it establishes no floor and leaves its requirements to be sliced again.
-closed_stories = [s for s in stories if s["status"] == "closed"]
-floor_source = "open" if floors else ("closed" if closed_stories else "none")
-floor = (min(floors) if floors
-         else (min(vtuple(s["spec_version"]) for s in closed_stories) if closed_stories
-               else None))
-
-latest = rows[-1] if rows else None
-out = {"ok": True, "feature_dir": fd, "has_ledger": has_ledger,
-       "row_count": len(rows), "ledger_empty": len(rows) == 0,
-       "rows": rows,
-       "latest_version": latest["version"] if latest else "",
-       "latest_change": latest["change"] if latest else "",
-       "latest_ids_csv": ", ".join(latest["requirements"]) if latest else "",
-       "spec_ids_csv": ", ".join(declared), "spec_id_count": len(declared),
-       "story_count": len(stories), "open_count": len(open_stories),
-       "unversioned_open": len(open_stories) - len(readable)}
-
-if not has_ledger:
-    out.update(ok=False, error="spec.md has no '## Change History' table. That table is "
-               "where a story learns a requirement it cites has moved, so a spec without "
-               "one cannot be kept in step with its backlog.")
-    print(json.dumps(out)); sys.stderr.write(out["error"] + "\n"); sys.exit(2)
-
-if not rows:
-    # An empty ledger is not corruption — it is a spec that has never been versioned, which
-    # means specify has not finished with it. Reported, not raised: the caller warns and
-    # stops, because there is no "since" to sync from and inventing one would raise a
-    # backlog against a document nobody has committed to.
-    out.update(work_csv="", work_count=0, work_source="none", span_versions_csv="",
-               gap=False, removed_csv="",
-               non_story_csv="", non_story_count=0, non_story_any=False,
-               work_kind="none",
-               work_note="the Change History table carries no version row")
-    print(json.dumps(out)); sys.exit(0)
-
-if floor is None:
-    # E42 — nothing has moved because nothing has synced. Enumerate from the document.
-    source, span = "spec", []
-    candidates = list(declared)
-    note = ("nothing has synced against this spec yet — no open story records a version and "
-            "nothing has closed against it — so there is no 'since' to read from: the work "
-            "set is every requirement the document declares, and the per-id rules then "
-            "create only what has no story")
-else:
-    span = [r for r in rows if vtuple(r["version"]) > floor]
-    seen, candidates = set(), []
-    for r in span:
-        for rid in r["requirements"]:
-            if rid not in seen: seen.add(rid); candidates.append(rid)
-    candidates.sort(key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-    source = "ledger"
-    note = ("%d version row(s) above the oldest %s story's v%d.%d: %s"
-            % (len(span), floor_source, floor[0], floor[1],
-               ", ".join(r["version"] for r in span) or "none"))
-
-# THE SPAN IS A PREFILTER; STALENESS IS PER ID. The floor is the oldest version any open
-# story sits at, and a story whose requirements never move sits there forever — Order-001
-# holding v1.0 keeps v1.1 and v1.2 in the span long after everything they named has been
-# synced. Reading the span alone therefore re-offered the same requirements on every run,
-# and each re-offer is a model call rewriting a story that was already in step.
-#
-# So the span says which ids are WORTH CHECKING and this says which have actually moved
-# under someone: an id is stale when it has no open story at all, or when some open story
-# citing it is stamped BELOW the newest version that touched it. An id whose every open
-# story is at or above that version is in step, whatever the floor says.
-moved_at = {}
-for r in rows:
-    for rid in r["requirements"]:
-        v = vtuple(r["version"])
-        if v > moved_at.get(rid, (0, 0)): moved_at[rid] = v
-
-def carried_on(story_id, rid, at):
-    """Has a follow-on already taken this requirement off that story's hands, at or above
-    the version that moved it. The `follows` link is the whole record of that hand-off."""
-    return any(s["follows"] == story_id and rid in s["cites"]
-               and vtuple(s["spec_version"]) >= at for s in open_stories)
-
-work, in_step = [], []
-for rid in candidates:
-    holders = [s for s in open_stories if rid in s["cites"]]
-    at = moved_at.get(rid, (0, 0))
-    behind = []
-    for s in holders:
-        if vtuple(s["spec_version"]) >= at: continue
-        # AN IN-FLIGHT STORY CANNOT BE BROUGHT UP TO DATE, BY DESIGN. It is never rewritten
-        # (§5.5), so its spec_version can never rise, so reading it as a staleness signal
-        # gives a signal that never clears — and a sync that mints a fresh follow-on for the
-        # same requirement on every run. What clears it is the follow-on itself: once one
-        # exists carrying this id at or above the version that moved it, the hand-off has
-        # happened and the original is history in progress, not unfinished business.
-        if s["in_flight"] and carried_on(s["id"], rid, at): continue
-        behind.append(s["id"])
-    # A CLOSED STORY STAMPED AT OR ABOVE THE VERSION THAT LAST MOVED THIS REQUIREMENT
-    # DELIVERED THE WORDING THE SPEC ASKS FOR TODAY, so the requirement is FINISHED rather
-    # than unsliced. Reading "no open story cites it" as work on its own could not tell those
-    # two apart, which is what let a fully delivered feature re-raise its entire backlog.
-    # A closed story stamped BELOW that version is the other case and stays work: the
-    # contract moved after it shipped, so what shipped is no longer what the spec asks for,
-    # and backlog-plan names the closed story it is re-opening against.
-    delivered = any(rid in s["cites"] and vtuple(s["spec_version"]) >= at
-                    for s in closed_stories)
-    (in_step if ((holders and not behind) or (not holders and delivered))
-     else work).append(rid)
-
-# A row names what a version TOUCHED, and that includes ids it REMOVED. A removed
-# requirement has no wording left to write a story from, so it leaves the work set — but it
-# is reported, because every open story citing one is orphaned and that is a decision for a
-# person, not a default (E1).
-removed = [i for i in work if i not in declared]
-work = [i for i in work if i in declared]
-
-# WHAT MOVED THAT NO STORY CAN BE RAISED FOR. Constraints and success criteria travel in
-# the same version rows as requirements and are read by the same downstream gates, but they
-# produce no work set — so a row naming only those left this run stopping at "the backlog is
-# already in step. Nothing was written." about the exact ids story-plan-check had just
-# reported as stale. Carried out separately so the caller can say so without the work gate
-# having to admit ids it must not slice.
-#
-# work_kind IS FOR THE LOG, NOT FOR THE BRANCH. A row naming FR-001 AND CN-001 is
-# `story` — the work set is real — and branching on the enum alone would print the
-# requirement path, sync the stories, and say nothing at all about the constraint. The
-# caller announces on non_story_csv being non-empty, whatever work_any says.
-non_story = sorted({i for r in span for i in r["non_story"]},
-                   key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-work_kind = ("story" if work else ("non_story" if non_story else "none"))
-
-out.update(work_csv=", ".join(work), work_count=len(work), work_source=source,
-           work_note=note, work_any=bool(work),
-           non_story_csv=", ".join(non_story), non_story_count=len(non_story),
-           non_story_any=bool(non_story), work_kind=work_kind,
-           candidates_csv=", ".join(candidates), candidate_count=len(candidates),
-           in_step_csv=", ".join(in_step), in_step_count=len(in_step),
-           floor_source=floor_source,
-           span_versions_csv=", ".join(r["version"] for r in span),
-           span_count=len(span), gap=len(span) > 1,
-           removed_csv=", ".join(removed), removed_count=len(removed),
-           synced_floor=("v%d.%d" % floor) if floor else "")
-print(json.dumps(out))
-'@
-
-function Invoke-LedgerRead {
-    param([string[]]$Rest)
-    $fdArg = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) { '--feature-dir' { $fdArg = $Rest[++$i] } }
-    }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'ledger-read: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'ledger-read: python3 required'; exit 1 }
-    $env:AW_FD = $fd
-    $PyLedgerRead | & $py -
-}
-
-# ─────────────────────────────── slice-mode ────────────────────────────────
-# Which slicing strategy the launch line asked for, and what is left of the input once that
-# word is taken out of it. Its own op rather than a `condition:` in the workflow, because
-# the engine compares a whole rendered value: `{{USER_INPUT}} == single-run` only matches an
-# input carrying the strategy and no guidance at all, and `sync-stories single-run keep the
-# payment rules together` — the form the launch line documents — would silently slice by
-# default while looking as though it had been told not to.
-#
-# ONLY THE FIRST WORD IS A STRATEGY. Guidance is free prose, and "keep the single sign-on
-# requirements in one story" is a slicing instruction with the token sitting in the middle
-# of it. Reading the token anywhere in the string would turn that sentence into the opposite
-# of what it asks, with nothing to say so.
-$PySliceMode = @'
-import json, os, re
-raw = (os.environ.get("AW_INPUT", "") or "").strip()
-
-# `single-run` is the spelling the launch line documents; the others are what people write
-# when they mean it. `auto` is the default and is accepted explicitly so a launch line can
-# say so — a strategy nobody can name is one nobody can turn off.
-TOKENS = {"single-run": "single", "single-story": "single", "single": "single",
-          "one-story": "single", "auto": "auto", "per-slice": "auto", "default": "auto"}
-
-strategy, guidance = "auto", raw
-m = re.match(r'^([A-Za-z][A-Za-z0-9_-]*)\s*[:,]?\s*(.*)$', raw, re.S)
-if m and m.group(1).lower() in TOKENS:
-    strategy = TOKENS[m.group(1).lower()]
-    guidance = m.group(2).strip()
-
-if strategy == "single":
-    note = ("one story was asked for (single-run): the whole work set goes into a single "
-            "slice unless it is too heavy to be picked up as one piece of work, in which "
-            "case it is split along its dependencies and the split is reported")
-else:
-    note = "the slicing is decided from the requirements themselves"
-
-print(json.dumps({"ok": True, "strategy": strategy, "guidance": guidance,
-                  "single": strategy == "single", "note": note,
-                  "raw": raw, "tokens": sorted(TOKENS)}))
-'@
-
-function Invoke-SliceMode {
-    param([string[]]$Rest)
-    $input_ = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--input' { $input_ = $Rest[++$i] }
-        }
-    }
-    $py = Get-Py; if (-not $py) { Write-Error 'slice-mode: python3 required'; exit 1 }
-    $env:AW_INPUT = $input_
-    $PySliceMode | & $py -
-}
-
-# ─────────────────────────────── backlog-plan ──────────────────────────────
-# The grouping is a judgment; everything that follows from it is arithmetic. This op does
-# the arithmetic, in two modes over the same inputs so the two passes cannot disagree about
-# what a group contains:
-#
-#   scan   which OPEN stories already stand in front of a group's requirements — the
-#          candidates the author is asked about, and the wording of that question.
-#   plan   given the author's answer, the flat list of story files to write: one entry per
-#          file, each already carrying its id, its path, and the ids it must end up citing.
-#
-# THE FOUR CASES (§5.4) resolve per group, not per requirement, because a group IS the story:
-#
-#   no open story cites anything in the group        -> create
-#   an open story does, no stories/<ID>/ yet         -> update in place (asked)
-#   an open story does, a story plan already exists  -> mint a follow-on (asked); the
-#                                                       original is never rewritten (§5.5)
-#   the author declines                              -> that story is left alone AND the ids
-#                                                       it covers leave the group; whatever
-#                                                       remains becomes a new story
-#
-# The last line is the one worth reading twice. Declining does not abandon the group — it
-# withdraws the requirements that story is already carrying and creates a story for the
-# rest. A group of three where one id has a story the author will not touch still delivers
-# the other two.
-#
-# ONE GROUP, ONE ABSORBING STORY. Where the author approves two stories in the same group,
-# the first by id takes the group's unclaimed requirements and the others are refreshed
-# against the current spec without gaining ids. Two stories both claiming the same new
-# requirement is not a state the completeness rule can read.
-#
-# AND THE ORDER. Plan mode also resolves the dependency edges the grouping declared between
-# slices, folds in the `depends_on:` an updated story already carries, breaks any cycle, and
-# lays the result out in WAVES: wave N holds the stories whose every dependency sits below N,
-# so one wave is a set with no ordering between its members — they may be picked up in
-# parallel. The plan comes back sorted by wave, which is also the order the stories are
-# written in, so meeting the cap costs the LAST wave rather than an arbitrary slice of the
-# backlog. See the block above the wave computation for why `follows:` is not an edge.
-$PyBacklogPlan = @'
-import json, os, re, sys
-fd = os.environ["AW_FD"]; mode = os.environ.get("AW_MODE", "scan")
-sdir = os.path.join(fd, "stories")
-feature = os.path.basename(fd.rstrip("/\\"))
-
-def bail(msg, code=2):
-    print(json.dumps({"ok": False, "error": msg}))
-    sys.stderr.write(msg + "\n"); sys.exit(code)
-
-def rids(s):
-    seen, out = set(), []
-    for t in re.findall(r'\b(?:FR|BR)-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return sorted(out, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-def sids(s):
-    """Story ids out of a csv, a JSON list or a YAML inline list. A story id is a feature
-    name and a number; a template placeholder (`[]`, `[STORY-ID]`) is neither, and must
-    never become a dependency edge nobody can resolve."""
-    seen, out = set(), []
-    for t in re.split(r'[,\s\[\]"\']+', s or ""):
-        t = t.strip()
-        if re.match(r'^[A-Za-z][\w.]*-\d+$', t) and t not in seen:
-            seen.add(t); out.append(t)
-    return out
-
-def wave_of(s):
-    """A story's declared wave. Absent — a story written before the field existed — reads
-    as 1, the conservative floor: nothing is KNOWN to have to land before it."""
-    m = re.match(r'^\s*(\d+)\s*$', (s or "").strip())
-    return int(m.group(1)) if m else 1
-
-def names(s):
-    """Story ids out of a csv or a JSON list. A multi-select answer arrives as the engine's
-    JSON rendering of a list, so both spellings have to read the same."""
-    seen, out = set(), []
-    for t in re.split(r'[,\s\[\]"\']+', s or ""):
-        t = t.strip()
-        if t and t not in seen: seen.add(t); out.append(t)
-    return out
-
-def parse_fm(text):
-    """Frontmatter as a flat dict. A value may be inline (`exercises: [FR-001, BR-002]`) or
-    a YAML block list under an empty key — both are valid YAML and a hand edit produces
-    either, so a parser that read only the inline form saw a perfectly good story as citing
-    nothing, and a story citing nothing is invisible to every gate that exists to protect
-    it. Block items are folded into the inline shape so every caller stays regex-simple."""
-    m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-    if not m: return {}
-    fm, key, block = {}, None, set()
-    for line in m.group(1).split("\n"):
-        km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-        if km:
-            key = km.group(1); fm[key] = km.group(2).strip(); continue
-        im = re.match(r'^\s+-\s+(.*)$', line) if key else None
-        if im and (key in block or not fm[key]):
-            block.add(key)
-            fm[key] = (fm[key] + ", " + im.group(1).strip()) if fm[key] else im.group(1).strip()
-    return fm
-
-# ---- the backlog -----------------------------------------------------------------
-stories, used_numbers = [], []
-if os.path.isdir(sdir):
-    for name in sorted(os.listdir(sdir)):
-        if not name.endswith(".md"): continue
-        p = os.path.join(sdir, name)
-        if not os.path.isfile(p): continue
-        fm = parse_fm(open(p, encoding="utf-8", errors="replace").read())
-        sid = fm.get("id") or name[:-3]
-        # Numbers come from the FILENAME as well as the id, and from CLOSED and CANCELLED
-        # stories as well as open ones. An id is permanent once minted: re-issuing the
-        # number of a story that shipped re-points its execution artefacts at new work.
-        for cand in (sid, name[:-3]):
-            m = re.search(r'-(\d+)$', cand)
-            if m: used_numbers.append(int(m.group(1)))
-        stories.append({"id": sid, "status": (fm.get("status") or "open").strip().lower(),
-                        "title": (fm.get("title") or "").strip().strip("[]"),
-                        "spec_version": (fm.get("spec_version") or "").strip(),
-                        "cites": rids(fm.get("exercises", "")),
-                        "wave": wave_of(fm.get("wave", "")),
-                        "deps": sids(fm.get("depends_on", "")),
-                        "in_flight": os.path.isdir(os.path.join(sdir, sid)),
-                        "path": p})
-open_stories = [s for s in stories if s["status"] == "open"]
-# Closed and cancelled stories hold no requirement — completeness is "no OPEN stories" —
-# but they are the reason a create can look like duplicated work, so they are read in
-# order to say so. See the create branch below.
-done_stories = [s for s in stories if s["status"] != "open"]
-by_id = {s["id"]: s for s in stories}
-_next = [max(used_numbers) + 1 if used_numbers else 1]
-
-def mint():
-    n = _next[0]; _next[0] += 1
-    return "%s-%03d" % (feature, n)
-
-# ---- the groups ------------------------------------------------------------------
-raw = (os.environ.get("AW_GROUPS") or "").strip()
-try:
-    parsed = json.loads(raw) if raw else []
-except Exception as e:
-    bail("backlog-plan: --groups is not valid JSON (%s)" % e)
-if isinstance(parsed, dict): parsed = parsed.get("groups") or []
-if not isinstance(parsed, list):
-    bail("backlog-plan: --groups must be a JSON list of groups")
-
-# Ids are read from the group's OWN requirements field, never scraped from its prose. A
-# rationale that mentions FR-004 as the reason two others belong together would otherwise
-# pull a third requirement into the story, and nothing downstream would question it.
-work = rids(os.environ.get("AW_WORK", ""))
-groups, dropped = [], []
-for i, g in enumerate(parsed):
-    if not isinstance(g, dict): continue
-    src = g.get("requirements")
-    if isinstance(src, list): src = ", ".join(str(x) for x in src)
-    ids = rids(src if src is not None else g.get("requirements_csv", ""))
-    if work:
-        outside = [x for x in ids if x not in work]
-        dropped += outside
-        ids = [x for x in ids if x in work]
-    if not ids: continue
-    # `depends_on` names OTHER GROUPS by key, or open stories already in the backlog by
-    # id. Kept as raw tokens: a group key only becomes a story id once the plan has minted
-    # one, so resolving here would have to guess at a name that does not exist yet.
-    dep_src = g.get("depends_on")
-    if dep_src is None: dep_src = g.get("depends_on_csv")
-    if isinstance(dep_src, list): dep_src = ", ".join(str(x) for x in dep_src)
-    deps_raw = [x for x in re.split(r'[,\s\[\]"\']+', str(dep_src or "")) if x.strip()]
-    groups.append({"key": g.get("id") or ("g%d" % (i + 1)),
-                   "title": (g.get("title") or "").strip(),
-                   "rationale": (g.get("rationale") or "").strip(),
-                   "complexity": (g.get("complexity") or "").strip().lower(),
-                   "deps_raw": deps_raw,
-                   "ids": ids, "ids_csv": ", ".join(ids)})
-
-# Every work-set id must land in exactly one group. One the model left out gets no story
-# and nothing says so; one it repeated gets two, each claiming the same requirement.
-placed = [x for g in groups for x in g["ids"]]
-repeated = sorted({x for x in placed if placed.count(x) > 1})
-
-# A REPEATED ID IS RESOLVED HERE, not merely reported. Two groups both claiming one
-# requirement become two stories both claiming it, and "does this requirement still have
-# open stories" — the completeness rule — then answers for work that was never really
-# duplicated. The grouping is a judgment; the arithmetic over it is not. So the id stays in
-# the FIRST group that claimed it and leaves the rest, which is deterministic (the same
-# grouping always yields the same slices) and loses no coverage, because the id still
-# reaches exactly one story. repeated_notice reports what that touched.
-if repeated:
-    seen_ids = set()
-    for g in groups:
-        keep_ids = [x for x in g["ids"] if x not in seen_ids]
-        seen_ids.update(keep_ids)
-        g["ids"], g["ids_csv"] = keep_ids, ", ".join(keep_ids)
-    groups = [g for g in groups if g["ids"]]
-    placed = [x for g in groups for x in g["ids"]]
-
-missed = [x for x in work if x not in placed]
-
-def candidates_of(g):
-    """Open stories standing in front of this group, each with what it already covers OF
-    THIS GROUP — the intersection, not its whole citation list, because that is what the
-    author is being asked to move."""
-    out = []
-    for s in open_stories:
-        shared = [x for x in g["ids"] if x in s["cites"]]
-        if not shared: continue
-        out.append({"story": s["id"], "title": s["title"], "in_flight": s["in_flight"],
-                    "spec_version": s["spec_version"], "cites_csv": ", ".join(s["cites"]),
-                    "shared_csv": ", ".join(shared), "shared": shared,
-                    "group": g["key"], "group_title": g["title"], "group_ids_csv": g["ids_csv"],
-                    "action": "followon" if s["in_flight"] else "update"})
-    return sorted(out, key=lambda c: c["story"])
-
-base = {"ok": True, "feature": feature, "feature_dir": fd, "stories_dir": sdir,
-        "group_count": len(groups), "groups": groups,
-        "work_csv": ", ".join(work),
-        "unplaced_csv": ", ".join(missed), "unplaced_count": len(missed),
-        "repeated_csv": ", ".join(repeated), "repeated_count": len(repeated),
-        "dropped_csv": ", ".join(sorted(set(dropped))),
-        "groups_digest": "\n".join(
-            "  [%s] %s\n      requirements: %s%s%s"
-            % (g["key"], g["title"] or "(untitled)", g["ids_csv"],
-               ("\n      stands behind: " + ", ".join(g["deps_raw"])) if g["deps_raw"] else "",
-               ("\n      " + g["rationale"]) if g["rationale"] else "")
-            for g in groups) or "  (no groups)"}
-
-# THE STRATEGY IS THE AUTHOR'S; THE ARITHMETIC OVER IT IS NOT. `single` asked for one story
-# covering the whole work set, and the grouping may still have returned several — because a
-# slice nobody can pick up is not a story, and splitting it is the honest answer. So the
-# split is REPORTED rather than refused or hidden: quietly handing six stories to someone
-# who asked for one is the kind of silent disobedience that makes an option not worth having.
-strategy = (os.environ.get("AW_STRATEGY") or "").strip().lower() or "auto"
-try:
-    ceiling = int((os.environ.get("AW_CEILING") or "").strip() or 8)
-except ValueError:
-    ceiling = 8
-oversized = [g["key"] for g in groups if len(g["ids"]) > ceiling]
-split_note, split_count = "", 0
-if strategy == "single" and len(groups) > 1:
-    split_count = len(groups)
-    split_note = ("one story was asked for and the work set was too heavy for one: it is "
-                  "split into %d, in dependency order — %s" % (len(groups), "; ".join(
-                      "[%s] %s (%s)" % (g["key"], g["title"] or "untitled", g["ids_csv"])
-                      for g in groups)))
-elif strategy == "single" and len(groups) == 1:
-    split_note = ("one story was asked for and one covers the whole work set: %s"
-                  % groups[0]["ids_csv"])
-base.update(strategy=strategy, ceiling=ceiling, split_count=split_count,
-            split_note=split_note, oversized_csv=", ".join(oversized))
-
-if mode == "scan":
-    cands = [c for g in groups for c in candidates_of(g)]
-    lines = []
-    for c in cands:
-        lines.append(
-            "  %s  (%s)\n"
-            "      group [%s] %s covers %s\n"
-            "      this story already covers %s of it, and cites %s in total\n"
-            "      %s"
-            % (c["story"], c["title"] or "untitled",
-               c["group"], c["group_title"] or "", c["group_ids_csv"],
-               c["shared_csv"], c["cites_csv"],
-               ("ALREADY IN FLIGHT (story plan exists) — picking it mints a FOLLOW-ON "
-                "carrying the change; this story is never rewritten"
-                if c["in_flight"] else
-                "not started (no story plan yet) — picking it rewrites this story to "
-                "cover the whole group")))
-    base.update(candidates=cands, candidate_count=len(cands),
-                candidate_ids=[c["story"] for c in cands],
-                candidate_csv=", ".join(c["story"] for c in cands),
-                any_candidates=bool(cands),
-                ask_digest="\n".join(lines) or "  (no existing story covers any of these)")
-    print(json.dumps(base)); sys.exit(0)
-
-# ---- plan ------------------------------------------------------------------------
-approved = set(names(os.environ.get("AW_OK", "")))
-version = (os.environ.get("AW_VER") or "").strip()
-plan, skipped, notes = [], [], []
-for g in groups:
-    cands = candidates_of(g)
-    declined = [c for c in cands if c["story"] not in approved]
-    # A declined story keeps its requirements: the author said do not disturb it, and
-    # raising a second story over the same ids disturbs it just as thoroughly.
-    held = {x for c in declined for x in c["shared"]}
-    skipped += [c["story"] for c in declined]
-    remaining = [x for x in g["ids"] if x not in held]
-    taken = [c for c in cands if c["story"] in approved]
-
-    if taken:
-        # ONE APPROVED STORY ABSORBS THE GROUP'S UNCLAIMED REQUIREMENTS — the first by id.
-        # Every OTHER approved story keeps exactly the ids it already cites, so those ids
-        # are RESERVED out of what the carrier gains: two open stories both claiming one
-        # requirement is not a state the completeness rule can read, and the run would have
-        # created that state itself rather than merely reporting it.
-        carrier = taken[0]; s = by_id[carrier["story"]]
-        reserved = {x for c in taken[1:] for x in c["shared"]}
-        gained = [x for x in remaining if x not in reserved]
-        if carrier["in_flight"]:
-            # §5.5 — the original stays open and unchanged, and closes having delivered
-            # what it was written to deliver. The follow-on carries the remainder.
-            carry = [x for x in g["ids"] if x in s["cites"] or x in gained]
-            carry = [x for x in carry if x not in held]
-            sid = mint()
-            plan.append({"action": "followon", "story": sid, "follows": carrier["story"],
-                         "path": os.path.join(sdir, sid + ".md"),
-                         "requirements_csv": ", ".join(carry), "existing_csv": "",
-                         "prior_csv": ", ".join(s["cites"]), "prior_title": s["title"],
-                         "prior_path": s["path"],
-                         "group": g["key"], "group_title": g["title"],
-                         "group_ids_csv": g["ids_csv"], "complexity": g["complexity"],
-                         "rationale": g["rationale"], "spec_version": version})
-        else:
-            keep = sorted(set(s["cites"]) | set(gained),
-                          key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-            plan.append({"action": "update", "story": s["id"], "follows": "",
-                         "path": s["path"],
-                         "requirements_csv": ", ".join(keep),
-                         "existing_csv": ", ".join(s["cites"]),
-                         "prior_csv": ", ".join(s["cites"]), "prior_title": s["title"],
-                         "prior_path": s["path"],
-                         "group": g["key"], "group_title": g["title"],
-                         "group_ids_csv": g["ids_csv"], "complexity": g["complexity"],
-                         "rationale": g["rationale"], "spec_version": version})
-        carrier_sid = plan[-1]["story"]
-        for c in taken[1:]:
-            s2 = by_id[c["story"]]
-            if c["in_flight"]:
-                # AN IN-FLIGHT STORY IS NEVER REWRITTEN, whatever position it holds in the
-                # group. Its story plan was derived from this body, and
-                # rewriting the body leaves the three disagreeing with nothing to say so —
-                # which is the whole reason §5.5 exists. Being second in a group is not a
-                # different situation from being first, so it gets the same answer: its own
-                # follow-on, carrying the ids it already covers of this group.
-                #
-                # That link is also what clears its staleness. ledger-read discounts an
-                # in-flight story once an open story whose `follows` names it cites the same
-                # id; skipping it instead would leave it stale forever and re-offered on
-                # every run.
-                carry2 = [x for x in c["shared"] if x not in held]
-                if not carry2:
-                    notes.append("%s was approved and is in flight, but every requirement "
-                                 "it covers of group [%s] is held by a story left "
-                                 "untouched; nothing to carry" % (c["story"], g["key"]))
-                    continue
-                sid2 = mint()
-                notes.append("%s was approved and is IN FLIGHT, so it is not rewritten; "
-                             "%s carries %s forward from it, while %s takes the group's "
-                             "unclaimed requirements"
-                             % (c["story"], sid2, ", ".join(carry2), carrier_sid))
-                plan.append({"action": "followon", "story": sid2, "follows": c["story"],
-                             "path": os.path.join(sdir, sid2 + ".md"),
-                             "requirements_csv": ", ".join(carry2), "existing_csv": "",
-                             "prior_csv": ", ".join(s2["cites"]), "prior_title": s2["title"],
-                             "prior_path": s2["path"],
-                             "group": g["key"], "group_title": g["title"],
-                             "group_ids_csv": g["ids_csv"], "complexity": g["complexity"],
-                             "rationale": g["rationale"], "spec_version": version})
-                continue
-            notes.append("%s was approved but %s takes the group's unclaimed requirements; "
-                         "%s is refreshed against the current spec without gaining ids"
-                         % (c["story"], carrier_sid, c["story"]))
-            plan.append({"action": "update", "story": s2["id"], "follows": "",
-                         "path": s2["path"],
-                         "requirements_csv": ", ".join(s2["cites"]),
-                         "existing_csv": ", ".join(s2["cites"]),
-                         "prior_csv": ", ".join(s2["cites"]), "prior_title": s2["title"],
-                         "prior_path": s2["path"],
-                         "group": g["key"], "group_title": g["title"],
-                         "group_ids_csv": g["ids_csv"], "complexity": g["complexity"],
-                         "rationale": g["rationale"], "spec_version": version})
-    elif remaining:
-        sid = mint()
-        # A REQUIREMENT WHOSE ONLY STORIES ARE CLOSED RE-ENTERS THE WORK SET, and that is
-        # right: a version row above the closed story's stamp means the contract moved
-        # AFTER it shipped, so what shipped is no longer what the spec asks for. It reads
-        # as duplicated work to anyone who remembers delivering it, so the run names the
-        # story it is re-opening against rather than leaving them to find it.
-        shipped = ["%s (%s)" % (d["id"], ", ".join(x for x in remaining if x in d["cites"]))
-                   for d in done_stories if any(x in d["cites"] for x in remaining)]
-        if shipped:
-            notes.append("%s covers requirements already delivered by %s — the spec moved "
-                         "after those closed, so this is the change, not a repeat"
-                         % (sid, "; ".join(shipped)))
-        plan.append({"action": "create", "story": sid, "follows": "",
-                     "path": os.path.join(sdir, sid + ".md"),
-                     "requirements_csv": ", ".join(remaining), "existing_csv": "",
-                     "prior_csv": "", "prior_title": "", "prior_path": "",
-                     "group": g["key"], "group_title": g["title"],
-                     "group_ids_csv": g["ids_csv"], "complexity": g["complexity"],
-                     "rationale": g["rationale"], "spec_version": version})
-    else:
-        notes.append("group [%s] (%s) is entirely covered by stories left untouched; "
-                     "nothing to write" % (g["key"], g["ids_csv"]))
-
-# ---- waves: the order these stories can actually be picked up in -------------------
-# The grouping declared which slices stand behind which; turning that into an order is
-# arithmetic, so it happens here and not in the prompt — the same grouping always yields
-# the same waves.
-#
-# A WAVE IS AN ELIGIBILITY LEVEL, NOT A SCHEDULE. Wave N means every story this one depends
-# on sits in a wave below N. Two stories in the SAME wave therefore have no dependency
-# between them and may be picked up in parallel; it does not say they start together, and
-# nothing waits for a whole wave to finish. That is also why the number is not a priority:
-# wave 1 is "nothing blocks this", not "do this first".
-#
-# THE EDGE SET IS A UNION of what the grouping declared and what an updated story already
-# carries in `depends_on:`. The sync sees one feature's spec; an edge someone added by hand
-# may name work it has no view of, and dropping it would silently un-order real work. Both
-# are claims about CODE ordering, and the union is exactly what the story ends up citing —
-# so the wave and the frontmatter cannot disagree about what stands in front of what.
-#
-# `follows:` is NOT an edge. A follow-on carries the remainder of a story in flight, and the
-# remainder is often buildable alongside it — §5.5 asks the author to say in Notes which
-# half has to land first. Making it an implicit edge would put an ordering in the waves that
-# no frontmatter field explains.
-entries_of, by_story = {}, {}
-for e in plan:
-    entries_of.setdefault(e["group"], []).append(e["story"]); by_story[e["story"]] = e
-preds = {e["story"]: set() for e in plan}
-external, unresolved = {}, []      # stories outside this run, at the wave they declare
-
-for g in groups:
-    tgt = entries_of.get(g["key"], [])
-    if not tgt: continue           # the group wrote nothing; its edges order nothing
-    for tok in g["deps_raw"]:
-        tok = tok.strip()
-        if not tok or tok == g["key"]: continue
-        if tok in entries_of:
-            src = entries_of[tok]
-        elif tok in by_id and by_id[tok]["status"] == "open":
-            external[tok] = by_id[tok]["wave"]; src = [tok]
-        else:
-            unresolved.append("%s (named by group [%s])" % (tok, g["key"])); continue
-        for x in tgt: preds[x].update(s for s in src if s != x)
-
-for e in plan:
-    if e["action"] != "update": continue
-    for d in by_id.get(e["story"], {}).get("deps", []):
-        if d == e["story"] or d in preds[e["story"]]: continue
-        if d not in preds: external[d] = by_id[d]["wave"] if d in by_id else 1
-        preds[e["story"]].add(d)
-
-# A CYCLE IS REJECTED AT AUTHORING TIME (§6.1), and this is where it would be authored.
-# Depth-first over a sorted node order, dropping the one edge that closes each cycle: only
-# edges that actually close one are lost, and the choice is deterministic — the same
-# grouping always breaks the same edge. Reported, because a dropped edge was a real claim
-# about ordering and the cycle it sat in is a fact about the slicing, not a glitch.
-cycles, state = [], {}
-def walk(node):
-    state[node] = 1
-    for m in sorted(preds.get(node, ())):
-        if state.get(m) == 1:
-            preds[node].discard(m); cycles.append("%s -> %s" % (node, m)); continue
-        if state.get(m) != 2 and m in preds: walk(m)
-    state[node] = 2
-for node in sorted(preds):
-    if state.get(node) != 2: walk(node)
-
-# Longest path from a root, relaxed to a fixed point. A story with no dependency is wave 1,
-# which is what puts every independent story in the same wave.
-wave = dict(external)
-for _ in range(len(preds) + 1):
-    moved = False
-    for node in sorted(preds):
-        w = 1 + max([wave.get(m, 1) for m in preds[node]] or [0])
-        if wave.get(node) != w: wave[node] = w; moved = True
-    if not moved: break
-for e in plan:
-    e["wave"] = wave.get(e["story"], 1)
-    e["depends_on_csv"] = ", ".join(sorted(preds.get(e["story"], ())))
-
-# Written in wave order, so a run that meets the cap writes the stories that can be STARTED
-# rather than an arbitrary prefix of them. The story id is not the order — the wave is.
-plan.sort(key=lambda e: (e["wave"], e["story"]))
-for i, e in enumerate(plan): e["seq"] = i + 1
-
-waves = {}
-for e in plan: waves.setdefault(e["wave"], []).append(e["story"])
-wave_digest = "\n".join("  wave %d: %s" % (w, ", ".join(waves[w]))
-                        for w in sorted(waves)) or "  (nothing to write)"
-if unresolved:
-    notes.append("the grouping named dependencies matching no slice and no open story, so "
-                 "they set no order: %s" % "; ".join(sorted(set(unresolved))))
-if cycles:
-    notes.append("slices were declared to depend on each other in a cycle; the edge closing "
-                 "each one is dropped, because a backlog with no order at all is worse than "
-                 "one missing an edge someone can re-add: %s" % ", ".join(cycles))
-
-# THE WRITE LOOP HAS A CEILING AND THE ENGINE DOES NOT SAY WHEN IT HITS IT — `over:` stops
-# at max_iterations with no message, so plan entries past it are simply never written and
-# the run reports success. The caller passes its own ceiling here so the overflow is named
-# while the story ids still exist to name. Nothing is dropped from the plan: the ids are
-# reported and the entries stay, so raising the cap and re-running writes them.
-try:
-    cap = int((os.environ.get("AW_CAP") or "").strip() or 0)
-except ValueError:
-    cap = 0
-overflow = [e["story"] for e in plan[cap:]] if cap > 0 else []
-
-counts = {a: sum(1 for e in plan if e["action"] == a) for a in ("create", "update", "followon")}
-base.update(plan=plan, plan_count=len(plan), any_plan=bool(plan),
-            cap=cap, overflow_csv=", ".join(overflow), overflow_count=len(overflow),
-            create_count=counts["create"], update_count=counts["update"],
-            followon_count=counts["followon"],
-            skipped_csv=", ".join(sorted(set(skipped))),
-            stories_csv=", ".join(e["story"] for e in plan),
-            wave_digest=wave_digest, wave_count=len(waves),
-            max_wave=(max(waves) if waves else 0),
-            cycle_csv=", ".join(cycles),
-            unresolved_deps_csv=", ".join(sorted(set(unresolved))),
-            notes=notes, notes_text="\n".join("  - " + n for n in notes),
-            plan_digest="\n".join(
-                "  w%-3d %-9s %-16s %s%s%s"
-                % (e["wave"], e["action"], e["story"], e["requirements_csv"],
-                   ("  (follows %s)" % e["follows"]) if e["follows"] else "",
-                   ("  [after %s]" % e["depends_on_csv"]) if e["depends_on_csv"] else "")
-                for e in plan) or "  (nothing to write)")
-print(json.dumps(base))
-'@
-
-function Invoke-BacklogPlan {
-    param([string[]]$Rest)
-    $fdArg = ''; $groups = ''; $approved = ''; $work = ''; $version = ''; $mode = 'scan'; $cap = ''
-    $strategy = ''; $ceiling = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--feature-dir' { $fdArg = $Rest[++$i] }
-            '--groups'      { $groups = $Rest[++$i] }
-            '--approved'    { $approved = $Rest[++$i] }
-            '--work'        { $work = $Rest[++$i] }
-            '--version'     { $version = $Rest[++$i] }
-            '--cap'         { $cap = $Rest[++$i] }
-            '--strategy'    { $strategy = $Rest[++$i] }
-            '--ceiling'     { $ceiling = $Rest[++$i] }
-            '--plan'        { $mode = 'plan' }
-        }
-    }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'backlog-plan: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'backlog-plan: python3 required'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_GROUPS = $groups; $env:AW_OK = $approved
-    $env:AW_WORK = $work; $env:AW_VER = $version; $env:AW_MODE = $mode; $env:AW_CAP = $cap
-    $env:AW_STRATEGY = $strategy; $env:AW_CEILING = $ceiling
-    $PyBacklogPlan | & $py -
-}
-
-# ─────────────────────────────── story-stamp ───────────────────────────────
-# The story's frontmatter is the gate surface — `exercises:`, `spec_version:`, `status:`
-# and `follows:` are what spec-coverage, check-stories, analyze-slice and close-story read,
-# and none of them opens the body. So those fields are OBSERVED and written by the kit, not
-# declared by the model that wrote the prose, for the same reason the Change History row is
-# computed rather than announced: a model that drops one id from `exercises:` produces a
-# story that reads perfectly and is invisible to every gate built to protect it. Silent,
-# and in the one field where silence costs the most.
-#
-# Everything else in the block is left exactly as the author wrote it, and a key the file
-# is missing is appended in template order rather than the block being rebuilt — a story
-# carrying a work_item or a depends_on must not lose it to a stamp.
-$PyStoryStamp = @'
-import json, os, re, sys, datetime
-fd = os.environ["AW_FD"]; story = os.environ["AW_STORY"].strip()
-path = os.path.join(fd, "stories", story + ".md")
-
-def bail(msg, code=2):
-    print(json.dumps({"ok": False, "story": story, "path": path, "error": msg}))
-    sys.stderr.write(msg + "\n"); sys.exit(code)
-
-if not os.path.isfile(path):
-    bail("story-stamp: no story file at %s — the authoring step did not write it" % path)
-
-def rids(s):
-    seen, out = set(), []
-    for t in re.findall(r'\b(?:FR|BR)-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return sorted(out, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-def sids(s):
-    """Story ids out of a csv or an inline list. A story id is a feature name and a number;
-    the template's placeholders are neither, and must not become a dependency edge."""
-    seen, out = set(), []
-    for t in re.split(r'[,\s\[\]"\']+', s or ""):
-        t = t.strip()
-        if re.match(r'^[A-Za-z][\w.]*-\d+$', t) and t not in seen:
-            seen.add(t); out.append(t)
-    return out
-
-def cids(s):
-    """Constraint ids, deduped and ordered by class then number so two readers of the same
-    text always produce the same csv. SC- is NOT one of these: a success criterion is a
-    feature-level outcome analyze-slice scores, not a bound a slice is built to satisfy,
-    and putting one here would hand it to the generation prompt as a bound."""
-    seen, out = set(), []
-    for t in re.findall(r'\b(?:CN|DC|IC|UX)-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return sorted(out, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-def lanes(s):
-    """backend / frontend out of a csv or an inline list. Anything else is not a lane."""
-    out = []
-    for t in re.split(r'[,\s\[\]"\']+', (s or "").lower()):
-        if t in ("backend", "frontend") and t not in out: out.append(t)
-    return sorted(out)
-
-COV = re.compile(r'<!--\s*AW:COVERAGE:BEGIN\s*-->.*?<!--\s*AW:COVERAGE:END\s*-->', re.S)
-# An id keyed to the line that DEFINES it, in the two shapes the spec template uses:
-# a leading table cell (Data Classification) and a bold id opening a bullet (everything
-# else). The same two shapes spec-diff scores, for the same reason — a cross-reference
-# inside another requirement's prose defines nothing.
-DEF_CELL = re.compile(r'^\s*\|\s*((?:CN|DC|IC|UX)-\d+)\s*\|')
-DEF_BULL = re.compile(r'^\s*(?:[-*+]\s+)?\*\*((?:CN|DC|IC|UX)-\d+)\*\*')
-
-def spec_constraints():
-    """Every constraint id the spec DEFINES. Spec constraints are declared aggregate-wide —
-    "constraints that must ALWAYS hold for the aggregate, independent of any single
-    operation" — so there is no per-requirement relation to infer and no judgment to make:
-    the feature's whole constraint set binds every slice of it. Change History is cut away
-    first (its rows NAME ids without defining them), and so is the coverage block."""
-    sp = os.path.join(fd, "spec.md")
-    if not os.path.isfile(sp): return []
-    t = COV.sub("", open(sp, encoding="utf-8", errors="replace").read())
-    t = re.split(r'^##\s+Change History\s*$', t, maxsplit=1, flags=re.M)[0]
-    found = []
-    for line in t.split("\n"):
-        m = DEF_CELL.match(line) or DEF_BULL.match(line)
-        if m and m.group(1) not in found: found.append(m.group(1))
-    return sorted(found, key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-text = open(path, encoding="utf-8", errors="replace").read()
-m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-if m:
-    block, body = m.group(1), text[m.end():]
-else:
-    # A model that returned the prose and no frontmatter leaves a story every gate skips.
-    # Synthesised rather than refused: the body is the expensive half and it is already on
-    # disk, and the fields below are exactly the ones this op is authoritative for.
-    block, body = "", text.lstrip("\n")
-
-# The block as an ordered list of (key, rendered line), so an unrecognised key and its
-# continuation lines survive untouched.
-lines = block.split("\n") if block else []
-order, seen_key = [], None
-for line in lines:
-    km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-    if km:
-        seen_key = km.group(1); order.append([seen_key, [line]])
-    elif order and (line.startswith(" ") or line.startswith("\t")):
-        order[-1][1].append(line)          # a block-list item under the key above
-    elif line.strip():
-        order.append([None, [line]])
-
-def put(key, value):
-    """Set a key to a single-line value, collapsing a block list into the inline form."""
-    line = ("%s: %s" % (key, value)) if value != "" else ("%s:" % key)
-    for entry in order:
-        if entry[0] == key:
-            entry[1] = [line]
-            return "set"
-    order.append([key, [line]])
-    return "added"
-
-TEMPLATE_ORDER = ["id", "type", "status", "title", "exercises", "constraints",
-                  "spec_version", "depends_on", "wave", "follows",
-                  "designed_lanes", "dropped_lanes", "work_item", "created"]
-def get(key):
-    for entry in order:
-        if entry[0] == key: return entry[1][0].split(":", 1)[1].strip()
-    return ""
-
-changed = {}
-changed["id"] = put("id", story)
-
-if os.environ.get("AW_IDS_GIVEN"):
-    ids = rids(os.environ.get("AW_IDS", ""))
-    changed["exercises"] = put("exercises", "[" + ", ".join(ids) + "]")
-else:
-    ids = rids(get("exercises"))
-
-# THE BOUNDS THIS SLICE MUST MEET, AS A FRONTMATTER FIELD THE KIT WRITES. Everything a gate
-# reads lives in frontmatter; the story's `## Constraints` section was the one exception,
-# and being model-authored it could omit an id with nothing able to notice — a missing bound
-# in a generation prompt that never opens the spec. Lifted here, so the gate surface is
-# complete by construction and the section keeps its per-slice prose.
-if os.environ.get("AW_CONSTRAINTS_GIVEN"):
-    cons = spec_constraints()
-    changed["constraints"] = put("constraints", "[" + ", ".join(cons) + "]")
-else:
-    cons = cids(get("constraints"))
-
-ver = (os.environ.get("AW_VER") or "").strip()
-if ver: changed["spec_version"] = put("spec_version", ver)
-
-fol = (os.environ.get("AW_FOLLOWS") or "").strip()
-if fol: changed["follows"] = put("follows", fol)
-
-ttl = (os.environ.get("AW_TITLE") or "").strip()
-if ttl and (not get("title") or get("title").startswith("[")):
-    changed["title"] = put("title", ttl)
-
-# Placeholders the template ships. Left alone once a real value is in them, so a story
-# CLOSED between the plan and the write is not quietly re-opened by a stamp.
-if not get("type") or get("type").startswith("["):
-    changed["type"] = put("type", "functional" if ids else "technical")
-if not get("status") or get("status").startswith("["):
-    changed["status"] = put("status", "open")
-# ORDERING IS A UNION, NEVER A REPLACEMENT. The edges passed in are what this run's slicing
-# declared; the ones already in the file may name work outside this feature, which the sync
-# cannot see. Dropping either loses a real claim about what has to land first, and a lost
-# edge is silent — no later stage re-derives it.
-deps = sorted(set(sids(get("depends_on")) + sids(os.environ.get("AW_DEPS", ""))) - {story})
-if deps or not get("depends_on") or get("depends_on").startswith("["):
-    changed["depends_on"] = put("depends_on", "[" + ", ".join(deps) + "]")
-
-# THE WAVE IS AN ELIGIBILITY LEVEL, NOT A PRIORITY: every story this one depends on sits in
-# a lower one, so stories sharing a wave have no ordering between them and may be picked up
-# in parallel. Computed by backlog-plan from `depends_on`, and written here for the same
-# reason `exercises:` is — a field the gates and the listings read is observed, not declared.
-# A story stamped without one floors at 1: nothing is KNOWN to have to land before it.
-wv = (os.environ.get("AW_WAVE") or "").strip()
-if wv.isdigit():
-    changed["wave"] = put("wave", wv)
-elif not get("wave").isdigit():
-    changed["wave"] = put("wave", "1")
-
-# WHICH LANES WERE DESIGNED, AND WHICH WERE DROPPED — two fields, because one of them cannot
-# say the difference. analyze-design STOPS on a lane whose plan is behind; story-plan DROPS
-# it and designs the other, so one command later "this slice has no user-facing surface" and
-# "the UI lane was out of scope when this was designed" are the same state on disk, and a
-# UX--bearing requirement can ship backend-only with a green story-scoped gate.
-# Designed ACCUMULATES across passes (a lane that has a design keeps having one); dropped is
-# whatever has been dropped and not since designed, so the two never both claim a lane.
-if os.environ.get("AW_DESIGNED_GIVEN") or os.environ.get("AW_DROPPED_GIVEN"):
-    designed = sorted(set(lanes(get("designed_lanes")))
-                      | set(lanes(os.environ.get("AW_DESIGNED", ""))))
-    dropped = sorted((set(lanes(get("dropped_lanes")))
-                      | set(lanes(os.environ.get("AW_DROPPED", "")))) - set(designed))
-    changed["designed_lanes"] = put("designed_lanes", "[" + ", ".join(designed) + "]")
-    changed["dropped_lanes"] = put("dropped_lanes", "[" + ", ".join(dropped) + "]")
-
-if not get("created") or get("created").startswith("["):
-    changed["created"] = put("created", datetime.date.today().isoformat())
-for k in ("title", "follows", "work_item"):
-    if not any(e[0] == k for e in order): put(k, "")
-
-# Rendered back in template order, with anything unrecognised kept after it in the order it
-# was written. A story is read by people as well as by gates.
-rank = {k: i for i, k in enumerate(TEMPLATE_ORDER)}
-order.sort(key=lambda e: rank.get(e[0], len(TEMPLATE_ORDER)))
-out_block = "\n".join(l for e in order for l in e[1])
-open(path, "w", encoding="utf-8").write("---\n" + out_block + "\n---\n\n" + body.lstrip("\n"))
-
-# THE STAMP OWNS THE ID SET; THE SECTION KEEPS ITS PROSE. `## Constraints` is not a list of
-# ids — each line says what THIS slice has to do about the bound it names, and that line is
-# the whole reason the section is worth reading. So the body is RECONCILED, never rewritten:
-# an id now in the frontmatter with no line in the section is reported for the caller to
-# announce, and a line naming an id the spec no longer defines is reported the same way.
-# Neither is silently written or silently deleted.
-bm = re.search(r'^##\s+Constraints\s*$(.*?)(?=^##\s|\Z)', body, re.M | re.S)
-body_ids = set(cids(bm.group(1))) if bm else set()
-unlined = [c for c in cons if c not in body_ids]
-orphan_lines = sorted(body_ids - set(cons),
-                      key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-print(json.dumps({"ok": True, "story": story, "path": path,
-                  "exercises": ids, "exercises_csv": ", ".join(ids),
-                  "constraints": cons, "constraints_csv": ", ".join(cons),
-                  "unlined_csv": ", ".join(unlined), "unlined_any": bool(unlined),
-                  "orphan_lines_csv": ", ".join(orphan_lines),
-                  "constraints_reconciled": not (unlined or orphan_lines),
-                  "designed_lanes": get("designed_lanes"),
-                  "dropped_lanes": get("dropped_lanes"),
-                  "spec_version": get("spec_version"), "status": get("status"),
-                  "depends_on": get("depends_on"), "wave": get("wave"),
-                  "follows": get("follows"), "title": get("title"),
-                  "type": get("type"), "had_frontmatter": bool(m),
-                  "fields": sorted(changed)}))
-'@
-
-function Invoke-StoryStamp {
-    param([string[]]$Rest)
-    $fdArg = ''; $story = ''; $ids = ''; $version = ''; $follows = ''; $idsGiven = ''; $title = ''
-    $deps = ''; $wave = ''; $consGiven = ''
-    $designed = ''; $designedGiven = ''; $dropped = ''; $droppedGiven = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--feature-dir' { $fdArg = $Rest[++$i] }
-            '--story'       { $story = $Rest[++$i] }
-            '--ids'         { $ids = $Rest[++$i]; $idsGiven = '1' }
-            '--version'     { $version = $Rest[++$i] }
-            '--follows'     { $follows = $Rest[++$i] }
-            '--title'       { $title = $Rest[++$i] }
-            '--depends-on'  { $deps = $Rest[++$i] }
-            '--wave'        { $wave = $Rest[++$i] }
-            # A BARE FLAG, NOT A CSV: the ids are lifted from the spec this op already has
-            # a --feature-dir for. Nothing upstream has to enumerate them, and the second
-            # caller (story-plan) can write the lane keys without re-lifting constraints
-            # from a spec that may have moved past this story's spec_version.
-            '--constraints' { $consGiven = '1' }
-            '--designed-lanes' { $designed = $Rest[++$i]; $designedGiven = '1' }
-            '--dropped-lanes'  { $dropped  = $Rest[++$i]; $droppedGiven  = '1' }
-        }
-    }
-    if (-not $story) { Write-Error 'story-stamp: --story is required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'story-stamp: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'story-stamp: python3 required'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_STORY = $story; $env:AW_IDS = $ids
-    $env:AW_IDS_GIVEN = $idsGiven; $env:AW_VER = $version
-    $env:AW_FOLLOWS = $follows; $env:AW_TITLE = $title
-    $env:AW_DEPS = $deps; $env:AW_WAVE = $wave
-    $env:AW_CONSTRAINTS_GIVEN = $consGiven
-    $env:AW_DESIGNED = $designed; $env:AW_DESIGNED_GIVEN = $designedGiven
-    $env:AW_DROPPED = $dropped; $env:AW_DROPPED_GIVEN = $droppedGiven
-    $PyStoryStamp | & $py -
-    Remove-Item Env:AW_CONSTRAINTS_GIVEN, Env:AW_DESIGNED, Env:AW_DESIGNED_GIVEN, Env:AW_DROPPED, Env:AW_DROPPED_GIVEN -ErrorAction SilentlyContinue
-}
-
-$PySpecCoverage = @'
-import json, os, re, sys
-fd = os.environ["AW_FD"]
-spec = os.path.join(fd, "spec.md"); sdir = os.path.join(fd, "stories")
-BEGIN, END = "<!-- AW:COVERAGE:BEGIN -->", "<!-- AW:COVERAGE:END -->"
-COV = re.compile(r'<!--\s*AW:COVERAGE:BEGIN\s*-->.*?<!--\s*AW:COVERAGE:END\s*-->', re.S)
-def parse_fm(text):
-    """Frontmatter as a flat dict. A value may be inline (`exercises: [FR-001, BR-002]`) or
-    a YAML block list under an empty key — both are valid YAML and a hand edit produces
-    either, so a parser that read only the inline form saw a perfectly good story as citing
-    nothing, and a story citing nothing is invisible to every gate that exists to protect
-    it. Block items are folded into the inline shape so every caller stays regex-simple."""
-    m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-    if not m: return {}
-    fm, key, block = {}, None, set()
-    for line in m.group(1).split("\n"):
-        km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-        if km:
-            key = km.group(1); fm[key] = km.group(2).strip(); continue
-        im = re.match(r'^\s+-\s+(.*)$', line) if key else None
-        if im and (key in block or not fm[key]):
-            block.add(key)
-            fm[key] = (fm[key] + ", " + im.group(1).strip()) if fm[key] else im.group(1).strip()
-    return fm
-out = {"ok": True, "written": False}
-if not os.path.isfile(spec):
-    out.update(ok=False, error="no spec.md at %s" % fd); print(json.dumps(out)); sys.exit(1)
-text = open(spec, encoding="utf-8", errors="replace").read()
-if not COV.search(text):
-    # A spec from before the block existed, or one whose markers were deleted. Not an
-    # error: the coverage view is an aid, and refusing to run would block the change the
-    # caller actually came to make.
-    out.update(reason="no AW:COVERAGE block in spec.md"); print(json.dumps(out)); sys.exit(0)
-
-body = COV.sub("", text)
-rids = []
-for line in body.split("\n"):
-    m = re.search(r'\*\*((?:FR|BR)-\d+)\*\*', line)
-    if m and m.group(1) not in rids: rids.append(m.group(1))
-rids.sort(key=lambda r: (r.split("-")[0], int(r.split("-")[1])))
-
-stories = []
-if os.path.isdir(sdir):
-    for name in sorted(os.listdir(sdir)):
-        if not name.endswith(".md"): continue
-        p = os.path.join(sdir, name)
-        if not os.path.isfile(p): continue
-        d = parse_fm(open(p, encoding="utf-8", errors="replace").read())
-        sid = d.get("id") or name[:-3]
-        stories.append({"id": sid, "status": (d.get("status") or "open").strip().lower(),
-                        "cites": re.findall(r'[A-Z]{2}-\d+', d.get("exercises", "")),
-                        "flying": os.path.isdir(os.path.join(sdir, sid))})
-
-rows, uncovered, delivered = [], [], []
-for rid in rids:
-    live = [s for s in stories if rid in s["cites"] and s["status"] == "open"]
-    done = [s for s in stories if rid in s["cites"] and s["status"] != "open"]
-    if not live and not done: uncovered.append(rid)
-    # DELIVERED is "no OPEN stories", never "a story closed" — a follow-on can still carry
-    # the remainder, and keying on a closed story would read a half-built requirement as done.
-    elif not live: delivered.append(rid)
-    rows.append("| %s | %s | %s |" % (
-        rid,
-        ", ".join(s["id"] + (" (in flight)" if s["flying"] else "") for s in live) or "—",
-        ", ".join(s["id"] for s in done) or "—"))
-
-table = ["| Requirement | Open stories | Closed / cancelled |",
-         "|-------------|--------------|--------------------|"]
-table += rows or ["| _(no FR- or BR- requirements yet)_ | | |"]
-open(spec, "w", encoding="utf-8").write(COV.sub(BEGIN + "\n" + "\n".join(table) + "\n" + END, text, count=1))
-out.update(written=True, requirements=len(rids), stories=len(stories),
-           uncovered=uncovered, uncovered_csv=", ".join(uncovered),
-           delivered=delivered, delivered_csv=", ".join(delivered))
-print(json.dumps(out))
-'@
-
-# Set subtraction with a purpose: of the requirements this run disturbed, which ones was
-# it NOT given permission to change. The approved list comes from a multi-select ask, so
-# the complement is what the re-author has to restore. Its own subcommand because the
-# orchestrator has no expressions — a workflow can bind a value, never compute one.
-$PySpecPreserve = @'
-import json, os, re
-def ids(s):
-    seen, out = set(), []
-    for t in re.findall(r'[A-Z]{2}-\d+', s or ""):
-        if t not in seen: seen.add(t); out.append(t)
-    return out
-mode = os.environ.get("AW_MODE", "complement")
-dist, ok = ids(os.environ.get("AW_DIST", "")), ids(os.environ.get("AW_OK", ""))
-if mode == "verify":
-    # DID THE RESTORE ACTUALLY HOLD. The re-author is a model asked to put requirements back
-    # to their earlier wording; nothing until now checked that it did. The diff taken after
-    # it is the proof: a requirement the author refused to move must no longer appear in the
-    # disturbing set. One that still does was amended WITHOUT approval — and the run would
-    # otherwise report it, in the same breath, as having been left alone.
-    pre = ids(os.environ.get("AW_PRE", ""))
-    violated = [d for d in pre if d in dist]
-    held = [d for d in pre if d not in dist]
-    print(json.dumps({"ok": not violated, "mode": "verify", "preserved": pre,
-                      "held": held, "held_csv": ", ".join(held), "held_count": len(held),
-                      "violated": violated, "violated_csv": ", ".join(violated),
-                      "violated_count": len(violated), "restore_ok": not violated}))
-else:
-    preserve = [d for d in dist if d not in ok]
-    print(json.dumps({"ok": True, "mode": "complement", "disturbing": dist, "approved": ok,
-                      "preserve": preserve,
-                      "preserve_csv": ", ".join(preserve), "preserve_count": len(preserve),
-                      "approved_csv": ", ".join(ok)}))
-'@
-
-function Invoke-SpecCoverage {
-    param([string[]]$Rest)
-    $fdArg = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { if ($Rest[$i] -eq '--feature-dir') { $fdArg = $Rest[++$i] } }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'spec-coverage: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'spec-coverage: python3 required'; exit 1 }
-    $env:AW_FD = $fd
-    $PySpecCoverage | & $py -
-}
-
-function Invoke-SpecPreserve {
-    param([string[]]$Rest)
-    $dist = ''; $ok = ''; $pre = ''; $mode = 'complement'
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--disturbing' { $dist = $Rest[++$i] }
-            '--approved'   { $ok = $Rest[++$i] }
-            '--preserved'  { $pre = $Rest[++$i] }
-            '--verify'     { $mode = 'verify' }
-        }
-    }
-    $py = Get-Py; if (-not $py) { Write-Error 'spec-preserve: python3 required'; exit 1 }
-    $env:AW_DIST = $dist; $env:AW_OK = $ok; $env:AW_PRE = $pre; $env:AW_MODE = $mode
-    $PySpecPreserve | & $py -
-}
-
-# ────────────────────────────── spec-markers ───────────────────────────────
-# Are there any [NEEDS CLARIFICATION] markers to resolve. Deterministic and free, which is
-# the point: asking a model "are there any markers" costs a full round trip on every run to
-# hear "no" on most of them. The model is still what turns a marker into a question with
-# answerable options — this only decides whether to call it at all.
-$PySpecMarkers = @'
-import json, os, re
-spec = os.environ["AW_SPEC"]
-text = open(spec, encoding="utf-8", errors="replace").read() if os.path.isfile(spec) else ""
-found = [" ".join(f.split()) for f in re.findall(r'\[NEEDS CLARIFICATION:\s*(.*?)\]', text, re.S)]
-print(json.dumps({"ok": True, "spec_exists": bool(text), "markers": found,
-                  "marker_count": len(found), "any": bool(found)}))
-'@
-
-function Invoke-SpecMarkers {
-    param([string[]]$Rest)
-    $fdArg = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { if ($Rest[$i] -eq '--feature-dir') { $fdArg = $Rest[++$i] } }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'spec-markers: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'spec-markers: python3 required'; exit 1 }
-    $env:AW_SPEC = (Join-Path $fd 'spec.md')
-    $PySpecMarkers | & $py -
-}
-
-function Invoke-SpecLedger {   # op in check|stamp|append|rowids
-    param([string]$Op, [string[]]$Rest)
-    $fdArg = ''; $ids = ''; $summary = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--feature-dir' { $fdArg = $Rest[++$i] }
-            '--ids'         { $ids = $Rest[++$i] }
-            '--summary'     { $summary = $Rest[++$i] }
-        }
-    }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error "$Op`: no feature set and no --feature-dir"; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error "$Op`: python3 required"; exit 1 }
-    # The delta-spec template, so `check` can tell an AUTHORED delta from the untouched copy
-    # cr-setup scaffolds for every change it opens.
-    $dtpl = @(Resolve-NamedTemplate -Name 'delta-spec-template' -RepoRoot $repo) | Select-Object -Last 1
-    $env:AW_FD = $fd; $env:AW_OP = $Op; $env:AW_IDS = $ids; $env:AW_SUM = $summary
-    $env:AW_DTPL = if ($dtpl) { [string]$dtpl } else { '' }
-    $PySpecLedger | & $py -
-}
-
-function Invoke-SpecSnapshot {
-    param([string[]]$Rest)
-    $fdArg = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { if ($Rest[$i] -eq '--feature-dir') { $fdArg = $Rest[++$i] } }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'spec-snapshot: no feature set and no --feature-dir'; exit 1 }
-    $spec = Join-Path $fd 'spec.md'
-    $snap = ''
-    if (Test-Path $spec) {
-        # BESIDE THE SPEC, not in the system temp directory. Only the PATH is replay-cached,
-        # and the step is not re-run on resume — so a checkpointed run paused for a human
-        # answer could outlive the temp file. A cleaned temp dir then left spec-diff with no
-        # before-state at all: every id read as ADDED, nothing MODIFIED, so the E38 ask never
-        # fired, the ledger row named every requirement in the document, and every open story
-        # went stale for a change that touched none of them. Beside the spec it shares the
-        # file's lifetime and travels with the repository.
-        #
-        # One snapshot per feature, overwritten each run: a run diffs against it TWICE, once
-        # to see what changed and again after re-authoring a change made additively.
-        $snap = Join-Path $fd '.aw-snapshot.md'
-        Copy-Item $spec $snap -Force
-    }
-    Write-Json ([ordered]@{ snapshot = $snap; taken = [bool]$snap })
-}
-
-function Invoke-SpecDiff {
-    param([string[]]$Rest)
-    $fdArg = ''; $snap = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) {
-        switch ($Rest[$i]) {
-            '--feature-dir' { $fdArg = $Rest[++$i] }
-            '--snapshot'    { $snap = $Rest[++$i] }
-        }
-    }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'spec-diff: no feature set and no --feature-dir'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'spec-diff: python3 required'; exit 1 }
-    $env:AW_SNAP = $snap; $env:AW_SPEC = (Join-Path $fd 'spec.md')
-    $PySpecDiff | & $py -
-}
-
 # ─────────────────────────── feature-paths ─────────────────────────────────
 function Invoke-FeaturePaths {
     param([string[]]$Rest)
@@ -2942,45 +1109,53 @@ function Invoke-FeaturePaths {
     if (-not $fd) { Write-Error 'feature-paths: no feature set (run /appweaver select-feature first)'; exit 1 }
     if (-not [System.IO.Path]::IsPathRooted($fd)) { $fd = Join-Path $repo $fd }
     $feature = Split-Path $fd -Leaf   # the aggregate name (feature = specs/<Feature>)
-    # The master documents of a feature: spec.md (WHAT/WHY) + design.md (the service
-    # lane's HOW) + design.ui.md (the frontend lane's HOW, where the feature has a UI
-    # half). plan.md / tasks.md belonged to the retired /aw-spec-plan + /aw-spec-tasks
-    # phases and had zero consumers.
+    # The master documents of a feature: spec.md (WHAT/WHY) + one LANE PLAN per declared
+    # lane (each lane's HOW) — backend-plan.md for the service lane, frontend-plan.md for
+    # the frontend lane. `plan` writes them; nothing else does.
+    #
+    # LEGACY NAMES RESOLVE TOO. A feature authored before the lane split carries design.md
+    # / design.ui.md, so each lane resolves to its plan document when that exists and to
+    # the legacy name while it does not. Every reader therefore finds the document that is
+    # actually on disk, and plan-scaffold renames it into the plan name on the next `plan`
+    # run — which is what keeps the rename incremental instead of a flag day.
+    # design_file / ui_design_file are kept as ALIASES of the same two resolved paths, so
+    # a stage that has not been repointed yet reads the right document under its old key.
     #
     # ui_design_exists IS THE UI-HALF SIGNAL for the whole CR loop. Every delta stage
     # asks the same question — is there a UI master to keep in sync? — and the master's
     # own presence answers it without re-deriving the lane declaration and the slice's
-    # UI file count at each stage. It is also self-correcting: whatever authors
-    # design.ui.md (adopt today) enrolls the feature in the UI half of the delta loop
-    # by the act of writing the file.
+    # UI file count at each stage. It is also self-correcting: whatever authors the
+    # frontend plan enrolls the feature in the UI half of the delta loop by the act of
+    # writing the file.
     $spec = Join-Path $fd 'spec.md'
-    $design = Join-Path $fd 'design.md'
-    $uiDesign = Join-Path $fd 'design.ui.md'
-    $backendPlan = Join-Path $fd 'backend-plan.md'
-    $frontendPlan = Join-Path $fd 'frontend-plan.md'
+    $design = Join-Path $fd 'backend-plan.md'
+    $uiDesign = Join-Path $fd 'frontend-plan.md'
+    if (-not (Test-Path $design)   -and (Test-Path (Join-Path $fd 'design.md')))    { $design   = Join-Path $fd 'design.md' }
+    if (-not (Test-Path $uiDesign) -and (Test-Path (Join-Path $fd 'design.ui.md'))) { $uiDesign = Join-Path $fd 'design.ui.md' }
     # needs_bootstrap, not spec_exists, is what picks specify's branch. A crashed first run
     # leaves spec.md on disk with the marker still up, and branching on the file alone read
     # that as a spec to EXTEND — re-applying the same input over an unfinished v1.0.
-    $bootstrapPending = $false
     $avFile = Join-Path $fd 'active_version.json'
+    $bootstrapPending = $false
     if (Test-Path $avFile) {
         try { $bootstrapPending = [bool](Get-Content $avFile -Raw | ConvertFrom-Json).bootstrap_pending } catch { $bootstrapPending = $false }
     }
+    $specExists = (Test-Path $spec)
     Write-Json ([ordered]@{
-        feature          = $feature
-        feature_dir      = $fd
-        spec_file        = $spec
-        design_file      = $design
-        ui_design_file   = $uiDesign
-        spec_exists      = (Test-Path $spec)
-        design_exists    = (Test-Path $design)
-        ui_design_exists = (Test-Path $uiDesign)
-        backend_plan_file = $backendPlan
-        frontend_plan_file = $frontendPlan
-        backend_plan_exists = (Test-Path $backendPlan)
-        frontend_plan_exists = (Test-Path $frontendPlan)
+        feature             = $feature
+        feature_dir         = $fd
+        spec_file           = $spec
+        backend_plan        = $design
+        frontend_plan       = $uiDesign
+        backend_plan_exists = (Test-Path $design)
+        frontend_plan_exists = (Test-Path $uiDesign)
+        design_file       = $design
+        ui_design_file    = $uiDesign
+        spec_exists       = $specExists
+        design_exists     = (Test-Path $design)
+        ui_design_exists  = (Test-Path $uiDesign)
         bootstrap_pending = $bootstrapPending
-        needs_bootstrap  = ((-not (Test-Path $spec)) -or $bootstrapPending)
+        needs_bootstrap   = ((-not $specExists) -or $bootstrapPending)
     })
 }
 
@@ -3026,15 +1201,15 @@ function Invoke-ChecklistApply {
     for ($i = 0; $i -lt $Rest.Count; $i++) {
         switch ($Rest[$i]) { '--file' { $file = $Rest[++$i] } '--results' { $resultsRaw = $Rest[++$i] } '--all-pass' { $allPassRaw = $Rest[++$i] } }
     }
-    # The per-item map is the model's, and a model that judged the document to pass routinely
-    # returns only the items it looked hard at — or none at all. Scoring that map alone then
-    # reported "0/25 items passing" for a spec the same call had just passed, which is the one
-    # quality signal this phase emits and the fastest way to teach people to ignore it.
-    $allPass = @('true', '1', 'yes') -contains $allPassRaw.Trim().ToLower()
     if (-not $file) { Write-Error 'checklist-apply: --file required'; exit 1 }
     if (-not (Test-Path $file)) { Write-Json ([ordered]@{ exists = $false; before_checked = 0; after_checked = 0; total = 0; newly_passing = @(); regressions = @() }); return }
     $results = @{}
     try { (ConvertFrom-Json $resultsRaw).PSObject.Properties | ForEach-Object { $results[[int]$_.Name] = [bool]$_.Value } } catch {}
+    # The per-item map is the model's, and a model that judged the document to pass routinely
+    # returns only the items it looked hard at — or none at all. Scoring that map alone then
+    # reported "0/25 items passing" for a spec the same call had just passed, which is the one
+    # quality signal this phase emits and the fastest way to teach people to ignore it.
+    $allPass = $allPassRaw.Trim().ToLower() -in @('true', '1', 'yes')
     $lines = Get-Content $file
     $items = Get-CheckboxLines -Lines $lines
     $before = @($items | Where-Object { $_.checked }).Count
@@ -3094,17 +1269,17 @@ function Get-ProjectMarkers {
 # lane's ecosystem is what turns that hit back into a miss.
 function Get-MarkerEcosystem {
     param([string]$Marker)
-    switch -Wildcard (Split-Path -Leaf $Marker) {
-        '*.sln'             { return 'dotnet' }
-        '*.csproj'          { return 'dotnet' }
-        'package.json'      { return 'node' }
-        'pom.xml'           { return 'java' }
-        'build.gradle'      { return 'java' }
-        'build.gradle.kts'  { return 'java' }
-        'go.mod'            { return 'go' }
-        'Cargo.toml'        { return 'rust' }
-        'pyproject.toml'    { return 'python' }
-        default             { return '' }
+    switch -Wildcard (($Marker -split '/')[-1]) {
+        '*.sln'            { return 'dotnet' }
+        '*.csproj'         { return 'dotnet' }
+        'package.json'     { return 'node' }
+        'pom.xml'          { return 'java' }
+        'build.gradle'     { return 'java' }
+        'build.gradle.kts' { return 'java' }
+        'go.mod'           { return 'go' }
+        'Cargo.toml'       { return 'rust' }
+        'pyproject.toml'   { return 'python' }
+        default            { return '' }
     }
 }
 
@@ -3115,9 +1290,9 @@ function Invoke-DetectProject {
         switch ($Rest[$i]) {
             { $_ -in '--root','--source-path','-Root' } { $scopeRoot = $Rest[++$i] }
             # The lane's ecosystem, passed in by the caller that already resolved it.
-            # NOT re-derived here: lane-gate binds it from stacks.json before this op runs,
-            # and a second guess is a second thing to keep in step with that file.
-            { $_ -in '--ecosystem','-Ecosystem' } { $ecosystem = $Rest[++$i] }
+            # NOT re-derived here: the caller binds it from stacks.json before this op
+            # runs, and a second guess is a second thing to keep in step with that file.
+            '--ecosystem' { $ecosystem = $Rest[++$i] }
         }
     }
     $repo = Get-RepoRoot
@@ -3135,8 +1310,8 @@ function Invoke-DetectProject {
         $markers = @(Get-ProjectMarkers -Repo $repo -Start $repo)
     }
     $scaffolded = ($markers.Count -gt 0)
-    # UNASKED IS NOT UNMATCHED. With no --ecosystem the caller has told us nothing to judge
-    # against, and answering false there would fail every existing call site.
+    # UNASKED IS NOT UNMATCHED. With no --ecosystem the caller has told us nothing to
+    # judge against, and answering false there would fail every existing call site.
     $match = $true
     if ($ecosystem -and $scaffolded) {
         $match = $false
@@ -3927,17 +2102,17 @@ function Invoke-DesignScaffold {
     # --lane. In a brownfield repo onboard GENERATES a code-derived override for both
     # names, so the defaults already yield the as-built structure.
     for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--lane','-Lane' } { $lane = $Rest[++$i] } { $_ -in '--template','-Template' } { $tplName = $Rest[++$i] } } }
-    # backend/frontend are the PLAN-phase pairs: the same templates, the plan document
-    # names, and a MIGRATION — a legacy design.md / design.ui.md is RENAMED into the
-    # plan name so a feature never carries both spellings of the same master.
-    # service/ui stay byte-identical for their existing callers (adopt, the delta chain).
+    # backend / frontend are the PLAN-phase pairs: the same templates, the plan document
+    # names, and a MIGRATION — a legacy design.md / design.ui.md is RENAMED into the plan
+    # name, so a feature never carries two spellings of one master. service / ui stay
+    # byte-identical for the callers that still write the legacy names.
     $legacyName = ''
     switch ($lane) {
         'service'  { $docName = 'design.md';        if (-not $tplName) { $tplName = 'design-template' } }
         'ui'       { $docName = 'design.ui.md';     if (-not $tplName) { $tplName = 'ui-design-template' } }
         'backend'  { $docName = 'backend-plan.md';  $legacyName = 'design.md';    if (-not $tplName) { $tplName = 'design-template' } }
         'frontend' { $docName = 'frontend-plan.md'; $legacyName = 'design.ui.md'; if (-not $tplName) { $tplName = 'ui-design-template' } }
-        default    { Write-Error ("design-scaffold: unknown --lane '" + $lane + "' (service|ui|backend|frontend)"); exit 1 }
+        default    { Write-Error ("design-scaffold: unknown --lane '" + $lane + "' (backend|frontend|service|ui)"); exit 1 }
     }
     $repo = Get-RepoRoot
     $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
@@ -3945,6 +2120,9 @@ function Invoke-DesignScaffold {
     New-Item -ItemType Directory -Force -Path $fd | Out-Null
     $target = Join-Path $fd $docName
     $migrated = $false
+    # A feature that predates the lane split carries the legacy name. Rename it rather than
+    # scaffolding an empty plan beside it: the content IS this lane's plan, and two files
+    # would leave every reader guessing which one is current.
     if ((-not (Test-Path $target)) -and $legacyName -and (Test-Path (Join-Path $fd $legacyName))) {
         Move-Item (Join-Path $fd $legacyName) $target; $migrated = $true
     }
@@ -3961,1040 +2139,56 @@ function Invoke-DesignScaffold {
     $overrideActive = Test-Path (Join-Path $repo (".appweaver/templates/overrides/" + $tplName + ".md"))
     $templateSource = Resolve-NamedTemplate -Name $tplName -RepoRoot $repo
     $tsOut = if ($templateSource) { $templateSource } else { '' }
-    Write-Json ([ordered]@{ feature_dir = $fd; design_doc = $target; lane = $lane; created = $created; migrated = $migrated; override_active = $overrideActive; template = $tplName; template_source = $tsOut })
-}
-
-
-# ─────────────────────────────── test-diff ─────────────────────────────────
-# The TECHNICAL-STORY ORACLE — twin of the bash action; the python payload is
-# byte-identical by contract.
-$PyTestDiff = @'
-import json, os, re, subprocess
-root = os.environ.get("AW_ROOT") or "."
-fd   = os.environ.get("AW_FD", "")
-want = (os.environ.get("AW_BASE") or "").strip()
-agg  = os.path.basename(fd.rstrip("/\\"))
-
-def git(*a):
-    """A git read that never raises. A working copy this command cannot interrogate is a
-    FACT TO REPORT — the caller decides what an unreadable oracle means — never a crash
-    that takes the gate down with it."""
-    try:
-        p = subprocess.run(["git", "-C", root] + list(a), capture_output=True, text=True)
-    except Exception:
-        return 1, ""
-    return p.returncode, (p.stdout or "").strip()
-
-DIR_RE = re.compile(r'(^|/)(tests?|specs?|__tests__|testing|test-suite)(/|$)', re.I)
-
-# The kit's OWN trees, which hold documents and configuration and never tests. The spec
-# tree is derived rather than assumed: `specs/` matches the RSpec directory convention
-# exactly, so without this every requirement document — and this gate's own verdict file,
-# written before the diff is taken — counted as a modified test.
-SKIP = [".appweaver/"]
-if fd:
-    _rel = os.path.relpath(fd, root).replace("\\", "/")
-    SKIP.append((_rel.rsplit("/", 1)[0] if "/" in _rel else _rel).rstrip("/") + "/")
-
-def is_test(path):
-    """A path is a TEST when a directory on it says so, or its own filename does — the
-    four conventions every shipped stack uses between them: a tests/ directory, a
-    Name.Tests.cs / NameTest.java suffix, a test_name.py / name_test.go affix, and a
-    name.test.ts / name.spec.ts infix. Deliberately GENEROUS: over-calling a file a test
-    costs a louder message, under-calling one costs a technical story that changed
-    behaviour and passed its own oracle."""
-    p = path.replace("\\", "/")
-    if any(p.startswith(s) for s in SKIP):
-        return False
-    stem, ext = os.path.splitext(os.path.basename(p))
-    # Prose is never a test, wherever it sits. A tests/ directory holds its own README
-    # and a docs tree holds files named for testing; counting either would fail a
-    # technical story over a paragraph.
-    if ext.lower() in (".md", ".markdown", ".txt", ".rst", ".adoc"):
-        return False
-    if DIR_RE.search(os.path.dirname(p)):
-        return True
-    stem = stem.lower()
-    if stem.startswith(("test", "spec")) or stem.endswith(("test", "tests", "spec", "specs")):
-        return True
-    return any(k in stem for k in (".test", ".spec", "_test", "_spec", "-test", "-spec"))
-
-out = {"ok": True, "aggregate": agg, "git": False, "checked": False,
-       "base": "", "base_ref": "", "base_kind": "none", "files_changed": 0,
-       "tests_changed": [], "tests_changed_csv": "", "tests_changed_count": 0,
-       "tests_deleted": [], "tests_deleted_csv": "",
-       "tests_added": [], "tests_added_csv": "", "tests_added_count": 0,
-       "slice_tests_changed": [], "slice_tests_changed_csv": "", "slice_tests_changed_count": 0,
-       "any_test_changed": False, "clean": True, "oracle": "clean",
-       "note": "", "digest": ""}
-
-if git("rev-parse", "--is-inside-work-tree")[1] != "true":
-    out["oracle"] = "unverified"
-    out["note"] = ("Not a git working copy, so the test suite's history cannot be read. The "
-                   "unchanged-suite oracle is UNVERIFIED for this run — not passed.")
-    out["digest"] = out["note"]
-    print(json.dumps(out)); raise SystemExit(0)
-out["git"] = out["checked"] = True
-
-# WHICH BASELINE. An explicit --base wins. Otherwise the fork point from the integration
-# branch, which is what a story's work sits on top of; falling back to HEAD, which sees
-# the working tree alone. The kind is reported because it changes what the answer MEANS:
-# a `head` baseline cannot see a test modified in a commit this branch already made.
-head = git("rev-parse", "HEAD")[1]
-if want and git("rev-parse", "--verify", want + "^{commit}")[0] == 0:
-    out["base"], out["base_ref"], out["base_kind"] = git("rev-parse", want)[1], want, "given"
-if not out["base"]:
-    cands = []
-    rc, ref = git("symbolic-ref", "--quiet", "refs/remotes/origin/HEAD")
-    if rc == 0 and ref:
-        cands.append(ref.split("refs/remotes/", 1)[-1])
-    cands += ["origin/main", "origin/master", "main", "master"]
-    seen = set()
-    for c in cands:
-        if c in seen:
-            continue
-        seen.add(c)
-        if git("rev-parse", "--verify", c + "^{commit}")[0] != 0:
-            continue
-        rc, mb = git("merge-base", "HEAD", c)
-        if rc != 0 or not mb:
-            continue
-        out["base"], out["base_ref"] = mb, c
-        out["base_kind"] = "head" if mb == head else "merge-base"
-        break
-if not out["base"]:
-    out["base"], out["base_kind"] = head or "HEAD", "head"
-
-rc, diff = git("diff", "--name-status", "--find-renames", out["base"])
-changed, added, deleted, files = [], [], [], 0
-for line in diff.splitlines():
-    parts = line.split("\t")
-    if len(parts) < 2:
-        continue
-    code, paths = parts[0].strip(), parts[1:]
-    files += 1
-    hits = [p for p in paths if is_test(p)]
-    if not hits:
-        continue
-    p = hits[-1]
-    if code.startswith("A") or code.startswith("C"):
-        # A NEW test is not a changed one. A refactor that adds characterisation tests is
-        # exactly the work a technical story exists to do.
-        added.append(p)
-    elif code.startswith("R"):
-        # A pure rename moves a test without changing what it asserts; anything less than
-        # a 100% match carries an edit inside it.
-        (added if code == "R100" else changed).append(p)
-    elif code.startswith("D"):
-        deleted.append(p); changed.append(p)
-    else:
-        changed.append(p)
-
-# Untracked files are ADDITIONS the diff cannot see — reported as such so a new test
-# written in the working tree is not mistaken for a missing one.
-for p in git("ls-files", "--others", "--exclude-standard")[1].splitlines():
-    p = p.strip()
-    if p and is_test(p) and p not in added:
-        added.append(p); files += 1
-
-changed = sorted(set(changed)); added = sorted(set(added)); deleted = sorted(set(deleted))
-low = agg.lower()
-slice_changed = [p for p in changed if low and low in p.lower()]
-out.update(files_changed=files,
-           tests_changed=changed, tests_changed_csv=", ".join(changed),
-           tests_changed_count=len(changed),
-           tests_deleted=deleted, tests_deleted_csv=", ".join(deleted),
-           tests_added=added, tests_added_csv=", ".join(added), tests_added_count=len(added),
-           slice_tests_changed=slice_changed, slice_tests_changed_csv=", ".join(slice_changed),
-           slice_tests_changed_count=len(slice_changed),
-           any_test_changed=bool(changed), clean=not changed,
-           # The DIFF's state in one word — clean | changed | unverified — so a caller can
-           # branch on it without recombining a boolean with a "could I even look" flag.
-           # It says what the suite did, never what that means for a story.
-           oracle="changed" if changed else "clean")
-
-kindnote = {"given": "the ref given on the command line",
-            "merge-base": "the fork point from %s — every commit this branch added is in view" % out["base_ref"],
-            "head": "HEAD — only uncommitted work is in view, so a test modified in a commit "
-                    "already made on this branch is NOT counted"}[out["base_kind"]]
-lines = ["Test-suite diff against %s (%s): %s" % (out["base"][:12], out["base_kind"], kindnote),
-         "  files changed: %d" % files,
-         "  tests MODIFIED or DELETED (%d): %s" % (len(changed), ", ".join(changed) or "none"),
-         "  tests ADDED (%d): %s" % (len(added), ", ".join(added) or "none")]
-if slice_changed:
-    lines.append("  of those, on this aggregate (%s): %s" % (agg, ", ".join(slice_changed)))
-out["note"] = kindnote
-out["digest"] = "\n".join(lines)
-print(json.dumps(out))
-'@
-
-function Invoke-TestDiff {
-    param([string[]]$Rest)
-    $fdArg = ''; $base = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--base','-Base' } { $base = $Rest[++$i] } } }
-    $py = Get-Py; if (-not $py) { Write-Error 'test-diff: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { $fd = '' }
-    $env:AW_ROOT = $repo; $env:AW_FD = $fd; $env:AW_BASE = $base
-    $PyTestDiff | & $py -
-    Remove-Item Env:AW_ROOT, Env:AW_FD, Env:AW_BASE -ErrorAction SilentlyContinue
-}
-
-# ─────────────────────────── plan-check / plan-stamp ────────────────────────
-# The plan documents' derivation tracking — twin of the bash implementation; the
-# python payloads are IDENTICAL, so the two shells cannot drift. Each plan doc
-# derives from ONE spec version and carries its OWN track file beside the spec
-# (.aw-plan-track.backend-plan.json / .aw-plan-track.frontend-plan.json) recording
-# {spec_version, sha256}, so the two lanes' stamps never share a write. plan-check
-# reads the record back against the spec's Change History ledger; plan-stamp is the
-# only writer. Both always exit 0 with an ok/state field — the workflow's
-# verify_context owns the stop.
-$PyPlanCheck = @'
-import json, os, re, sys, hashlib
-doc = os.environ["AW_DOC"]; fd = os.environ["AW_FD"]
-spec = os.path.join(fd, "spec.md")
-# One track file per plan document (.aw-plan-track.backend-plan.json /
-# .aw-plan-track.frontend-plan.json) — parallel lane stamps never contend on a shared file.
-stem = os.path.splitext(os.path.basename(doc))[0]
-track_path = os.path.join(fd, ".aw-plan-track.%s.json" % stem)
-def vtuple(v):
-    try: return tuple(int(x) for x in v.lstrip("vV").split("."))
-    except Exception: return (0,)
-out = {"doc": doc, "doc_exists": os.path.isfile(doc), "state": "", "derived_version": "",
-       "current_version": "", "changed_csv": "", "changed_summary": "",
-       "body_changed": False, "body_sha256": ""}
-# Current version = the widest of the ledger's rows and the **Version** header — the
-# same widest-wins rule ledger-append uses, so a hand-moved header cannot hide a row.
-rows = []; cur = ""; idcol = -1
-if os.path.isfile(spec):
-    text = open(spec, encoding="utf-8", errors="replace").read()
-    m = re.search(r'^##\s+Change History\s*$', text, re.M)
-    if m:
-        for line in text[m.end():].splitlines():
-            if idcol < 0 and line.lstrip().startswith("|") and "requirements changed" in line.lower():
-                hdr = [c.strip().lower() for c in line.strip().strip("|").split("|")]
-                idcol = next((i for i, c in enumerate(hdr) if "requirements changed" in c), -1)
-            rm = re.match(r'^\|\s*(v\d+(?:\.\d+)?)\s*\|', line)
-            if rm: rows.append((rm.group(1), line))
-    hv = re.search(r'^\*\*Version\*\*:\s*(v[\d.]+)', text, re.M)
-    cands = [r[0] for r in rows] + ([hv.group(1)] if hv else [])
-    if cands: cur = max(cands, key=vtuple)
-out["current_version"] = cur
-if not out["doc_exists"]:
-    out["state"] = "fresh"; print(json.dumps(out)); sys.exit(0)
-# THE HASH ITSELF, not only the boolean it was reduced to. "Has this document moved since it
-# was stamped" answers the freshness question; WHICH shape it is now is what a gate verdict
-# has to record and a story pass has to name, or approved-then-changed-then-never-re-approved
-# has nothing to compare against. Taken before the untracked exit so a document with no
-# derivation record still reports what it is.
-body = open(doc, encoding="utf-8", errors="replace").read()
-out["body_sha256"] = hashlib.sha256(body.encode("utf-8")).hexdigest()
-try: track = json.load(open(track_path, encoding="utf-8"))
-except Exception: track = {}
-entry = track.get(os.path.basename(doc))
-if not entry:
-    # A document with no derivation record — a migrated legacy master, or a baseline
-    # lost by hand. There is no stamp to diff against, so the caller reconciles the
-    # WHOLE document once and plan-stamp baselines it.
-    out["state"] = "untracked"; print(json.dumps(out)); sys.exit(0)
-derived = entry.get("spec_version", "")
-out["derived_version"] = derived
-out["body_changed"] = out["body_sha256"] != entry.get("sha256", "")
-moved = [r for r in rows if vtuple(r[0]) > vtuple(derived)]
-# Scrape ONLY the ledger's "Requirements changed" cell when it names one. The
-# Stories cell holds ids of the form <Aggregate>-nnn, which read as requirement ids
-# whenever the aggregate is spelled in caps (EDI-001, HR-002) — those would arrive
-# as requirements for the plan to conform, and there is no such requirement.
-def _scope(line):
-    if idcol >= 0:
-        cells = [c.strip() for c in line.strip().strip("|").split("|")]
-        if idcol < len(cells): return cells[idcol]
-    return line
-ids = sorted({i for _v, line in moved for i in re.findall(r'[A-Z]{2}-\d+', _scope(line))})
-out["changed_csv"] = ", ".join(ids)
-out["changed_summary"] = "  //  ".join(line.strip() for _v, line in moved)
-behind = bool(moved) or bool(cur and vtuple(cur) > vtuple(derived))
-if out["body_changed"] and behind: out["state"] = "edited_behind"
-elif out["body_changed"]:          out["state"] = "edited"
-elif behind:                       out["state"] = "behind"
-else:                              out["state"] = "clean"
-print(json.dumps(out))
-'@
-
-$PyPlanStamp = @'
-import json, os, re, sys, hashlib, datetime
-doc = os.environ["AW_DOC"]; fd = os.environ["AW_FD"]
-ids = os.environ.get("AW_IDS", "").strip(); note = os.environ.get("AW_NOTE", "").strip()
-no_row = os.environ.get("AW_NOROW", "false") == "true"
-spec = os.path.join(fd, "spec.md")
-# One track file per plan document (.aw-plan-track.backend-plan.json /
-# .aw-plan-track.frontend-plan.json) — parallel lane stamps never contend on a shared file.
-stem = os.path.splitext(os.path.basename(doc))[0]
-track_path = os.path.join(fd, ".aw-plan-track.%s.json" % stem)
-def vtuple(v):
-    try: return tuple(int(x) for x in v.lstrip("vV").split("."))
-    except Exception: return (0,)
-if not os.path.isfile(doc):
-    print(json.dumps({"ok": False, "error": "plan document %s does not exist" % doc, "version": ""})); sys.exit(0)
-cur = ""
-if os.path.isfile(spec):
-    st = open(spec, encoding="utf-8", errors="replace").read()
-    m = re.search(r'^##\s+Change History\s*$', st, re.M)
-    rows = re.findall(r'^\|\s*(v\d+(?:\.\d+)?)\s*\|', st[m.end():] if m else "", re.M)
-    hv = re.search(r'^\*\*Version\*\*:\s*(v[\d.]+)', st, re.M)
-    cands = rows + ([hv.group(1)] if hv else [])
-    if cands: cur = max(cands, key=vtuple)
-text = open(doc, encoding="utf-8", errors="replace").read()
-# The ledger-survival fence: a plan whose update dropped the Change History section is
-# NOT baselined — a lost ledger silently baselined over could never be noticed again.
-hist = re.search(r'^##+\s*(?:\d+\.\s*)?Change History\s*$', text, re.M)
-if not hist:
-    print(json.dumps({"ok": False, "version": cur,
-        "error": "the plan document has no 'Change History' section — the write dropped the ledger; nothing was baselined"}))
-    sys.exit(0)
-warnings = []
-if not re.search(r'^##+.*Assumptions', text, re.M):
-    warnings.append("no 'Assumptions' section found")
-if not re.search(r'^##+.*(Workarounds|Deviations)', text, re.M):
-    warnings.append("no 'Workarounds/Deviations' section found")
-row_txt = ""
-if not no_row:
-    # Bounded to the Change History section; the row's cell count follows the section's
-    # own table so the append fits the greenfield, UI and onboard-generated shapes alike.
-    lines = text.split("\n")
-    hline = text[:hist.start()].count("\n")
-    end = len(lines)
-    for i in range(hline + 1, len(lines)):
-        if re.match(r'^##', lines[i]): end = i; break
-    tbl = [i for i in range(hline + 1, end) if lines[i].lstrip().startswith("|")]
-    ncells = 5
-    if tbl: ncells = max(3, lines[tbl[0]].strip().strip("|").count("|") + 1)
-    change = note or ("Conformed to spec %s" % (cur or "(unversioned)"))
-    if ids: change = "%s — %s" % (change, ids)
-    change = change.replace("|", "/").replace("\n", " ")
-    cells = [cur or "v?", datetime.date.today().isoformat(), change] + ["—"] * (ncells - 3)
-    row_txt = "| " + " | ".join(cells[:ncells]) + " |"
-    lines.insert((tbl[-1] + 1) if tbl else end, row_txt)
-    text = "\n".join(lines)
-if cur:
-    text = re.sub(r'^(\*\*Version\*\*:\s*)v[\d.]+', r'\g<1>' + cur, text, count=1, flags=re.M)
-open(doc, "w", encoding="utf-8").write(text)
-try: track = json.load(open(track_path, encoding="utf-8"))
-except Exception: track = {}
-track[os.path.basename(doc)] = {
-    "spec_version": cur,
-    "sha256": hashlib.sha256(text.encode("utf-8")).hexdigest(),
-    "updated": datetime.datetime.now().isoformat(timespec="seconds")}
-open(track_path, "w", encoding="utf-8").write(json.dumps(track, indent=2) + "\n")
-print(json.dumps({"ok": True, "version": cur, "row": row_txt, "warnings": warnings}))
-'@
-
-function Invoke-PlanCheck {
-    param([string[]]$Rest)
-    $fdArg = ''; $doc = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--doc','-Doc' } { $doc = $Rest[++$i] } } }
-    if (-not $doc) { Write-Error 'plan-check: --doc required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'plan-check: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'plan-check: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_DOC = $doc; $env:AW_FD = $fd
-    $PyPlanCheck | & $py -
-    Remove-Item Env:AW_DOC, Env:AW_FD -ErrorAction SilentlyContinue
-}
-
-function Invoke-PlanStamp {
-    param([string[]]$Rest)
-    $fdArg = ''; $doc = ''; $ids = ''; $note = ''; $noRow = 'false'
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--doc','-Doc' } { $doc = $Rest[++$i] } { $_ -in '--ids','-Ids' } { $ids = $Rest[++$i] } { $_ -in '--note','-Note' } { $note = $Rest[++$i] } { $_ -in '--no-row','-NoRow' } { $noRow = 'true' } } }
-    if (-not $doc) { Write-Error 'plan-stamp: --doc required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'plan-stamp: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'plan-stamp: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_DOC = $doc; $env:AW_FD = $fd; $env:AW_IDS = $ids; $env:AW_NOTE = $note; $env:AW_NOROW = $noRow
-    $PyPlanStamp | & $py -
-    Remove-Item Env:AW_DOC, Env:AW_FD, Env:AW_IDS, Env:AW_NOTE, Env:AW_NOROW -ErrorAction SilentlyContinue
-}
-
-# ───────────────────────────────── gate-result ──────────────────────────────
-# The machine-readable verdict every analyze gate writes beside its markdown
-# report. CI cannot branch on prose, and a verdict is exactly the kind of dated,
-# derived record the model must never write — so the script writes it.
-#
-# Shared by design: analyze-design writes one per feature, and analyze-slice /
-# analyze-code will write one per story and per run. The CORE keys are fixed
-# (gate, status, feature, spec_version, story, gap_count, gap_refs, report,
-# generated_at) so a pipeline can read any gate's result with one expression;
-# everything gate-specific arrives through repeatable --field k=v and lands under
-# "fields", where it cannot destabilise that core.
-#
-# NOTE the returned `ok` means THE FILE WAS WRITTEN. The pass/fail verdict is
-# `status` — binding a workflow gate to `ok` would pass on every run.
-$PyGateResult = @'
-import json, os, sys, datetime
-gate   = (os.environ.get("AW_GATE", "") or "").strip() or "gate"
-fd     = os.environ.get("AW_FD", "")
-report = (os.environ.get("AW_REPORT", "") or "").strip()
-out    = (os.environ.get("AW_OUT", "") or "").strip()
-# "pass" only on an explicit affirmative. An absent or unreadable verdict is a FAIL,
-# because a result that defaults green turns every broken run into a passing one.
-ok = (os.environ.get("AW_OK", "") or "").strip().lower() in ("true", "1", "yes", "pass", "ok")
-# Written BESIDE the markdown report and named after it, so a job holding either path
-# holds the other. --out overrides; with no report named at all it falls back to a
-# dotfile in the feature directory under the gate's own name.
-if not out:
-    out = (os.path.splitext(report)[0] + ".json") if report else os.path.join(fd, ".aw-gate-%s.json" % gate)
-try: gap_count = int((os.environ.get("AW_GAPS", "") or "").strip() or 0)
-except ValueError: gap_count = 0
-refs = [r.strip() for r in (os.environ.get("AW_REFS", "") or "").replace(";", ",").split(",") if r.strip()]
-# A fail reporting zero findings reads as green to anything that sums the number
-# rather than reading the status, so a red verdict always carries at least one.
-if not ok and gap_count < 1: gap_count = max(1, len(refs))
-# --field k=v, repeatable, arriving newline-separated. Keeps the CORE schema below
-# fixed for every gate while each one carries its own detail underneath.
-fields = {}
-for line in (os.environ.get("AW_FIELDS", "") or "").splitlines():
-    k, sep, v = line.partition("=")
-    if sep and k.strip(): fields[k.strip()] = v.strip()
-res = {"gate": gate,
-       "status": "pass" if ok else "fail",
-       "feature": os.path.basename(fd.rstrip("/\\")),
-       "feature_dir": fd,
-       "spec_version": (os.environ.get("AW_VERSION", "") or "").strip(),
-       "story": (os.environ.get("AW_STORY", "") or "").strip(),
-       "gap_count": gap_count,
-       "gap_refs": refs,
-       "report": report,
-       "note": (os.environ.get("AW_NOTE", "") or "").strip(),
-       "fields": fields,
-       "generated_at": datetime.datetime.now().isoformat(timespec="seconds")}
-d = os.path.dirname(out)
-if d and not os.path.isdir(d): os.makedirs(d, exist_ok=True)
-open(out, "w", encoding="utf-8").write(json.dumps(res, indent=2) + "\n")
-print(json.dumps({"ok": True, "result_file": out, "status": res["status"], "gap_count": gap_count}))
-'@
-
-function Invoke-GateResult {
-    param([string[]]$Rest)
-    $fdArg = ''; $gate = ''; $ok = ''; $version = ''; $story = ''; $report = ''; $out = ''; $gaps = ''; $refs = ''; $note = ''; $fields = @()
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--gate','-Gate' } { $gate = $Rest[++$i] } { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--ok','-Ok' } { $ok = $Rest[++$i] } { $_ -in '--spec-version','-SpecVersion' } { $version = $Rest[++$i] } { $_ -in '--story','-Story' } { $story = $Rest[++$i] } { $_ -in '--report','-Report' } { $report = $Rest[++$i] } { $_ -in '--out','-Out' } { $out = $Rest[++$i] } { $_ -in '--gap-count','-GapCount' } { $gaps = $Rest[++$i] } { $_ -in '--gap-refs','-GapRefs' } { $refs = $Rest[++$i] } { $_ -in '--note','-Note' } { $note = $Rest[++$i] } { $_ -in '--field','-Field' } { $fields += $Rest[++$i] } } }
-    if (-not $gate) { Write-Error 'gate-result: --gate required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'gate-result: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'gate-result: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_GATE = $gate; $env:AW_FD = $fd; $env:AW_OK = $ok; $env:AW_VERSION = $version; $env:AW_STORY = $story
-    $env:AW_REPORT = $report; $env:AW_OUT = $out; $env:AW_GAPS = $gaps; $env:AW_REFS = $refs; $env:AW_NOTE = $note
-    $env:AW_FIELDS = ($fields -join "`n")
-    $PyGateResult | & $py -
-    Remove-Item Env:AW_GATE, Env:AW_FD, Env:AW_OK, Env:AW_VERSION, Env:AW_STORY, Env:AW_REPORT, Env:AW_OUT, Env:AW_GAPS, Env:AW_REFS, Env:AW_NOTE, Env:AW_FIELDS -ErrorAction SilentlyContinue
-}
-
-# ──────────────────────────────── gate-read ────────────────────────────────
-# THE OTHER HALF OF gate-result. Twin of the bash action; the python payload is
-# byte-identical by contract.
-$PyGateRead = @'
-import json, os
-gate = (os.environ.get("AW_GATE", "") or "").strip()
-fd = os.environ.get("AW_FD", "")
-report = (os.environ.get("AW_REPORT", "") or "").strip()
-path = (os.environ.get("AW_FILE", "") or "").strip()
-# Resolved the same way gate-result names it, so the writer and the reader cannot drift:
-# beside the markdown report and named after it. The per-gate defaults are the report paths
-# those two workflows set; the dotfile is gate-result's own fallback.
-DEFAULT = {"analyze-design": "plan-analyze-report.json",
-           "analyze-slice": "slice-analyze-report.json"}
-if not path:
-    if report: path = os.path.splitext(report)[0] + ".json"
-    elif gate in DEFAULT: path = os.path.join(fd, DEFAULT[gate])
-    else: path = os.path.join(fd, ".aw-gate-%s.json" % gate)
-
-out = {"ok": True, "gate": gate, "result_file": path, "exists": os.path.isfile(path),
-       "status": "", "certified": False, "aborted": False, "note": "",
-       "spec_version": "", "story": "", "report": "", "generated_at": "",
-       "gap_count": 0, "gap_refs_csv": "",
-       "backend_sha256": "", "frontend_sha256": "",
-       "backend_in_scope": "", "frontend_in_scope": "", "fields": {}}
-res = {}
-if out["exists"]:
-    try: res = json.load(open(path, encoding="utf-8"))
-    except Exception: res = {}
-if not isinstance(res, dict) or not res:
-    out["note"] = ("no readable verdict at %s — this gate has not certified anything here"
-                   % path)
-    print(json.dumps(out)); raise SystemExit(0)
-
-fields = res.get("fields") or {}
-if not isinstance(fields, dict): fields = {}
-out.update(status=(res.get("status") or "").strip(),
-           note=(res.get("note") or "").strip(),
-           spec_version=(res.get("spec_version") or "").strip(),
-           story=(res.get("story") or "").strip(),
-           report=(res.get("report") or "").strip(),
-           generated_at=(res.get("generated_at") or "").strip(),
-           gap_count=res.get("gap_count") or 0,
-           gap_refs_csv=", ".join(res.get("gap_refs") or []),
-           fields=fields,
-           backend_sha256=(fields.get("backend_sha256") or "").strip(),
-           frontend_sha256=(fields.get("frontend_sha256") or "").strip(),
-           backend_in_scope=(fields.get("backend_in_scope") or "").strip(),
-           frontend_in_scope=(fields.get("frontend_in_scope") or "").strip())
-# A verdict written before any analysis ran carries no spec version, because the workflow
-# has not read one yet. That, and not the note's wording, is what separates the aborted red
-# from a real one — the note is prose and prose gets edited.
-out["aborted"] = out["status"] != "pass" and not out["spec_version"]
-out["certified"] = out["status"] == "pass"
-print(json.dumps(out))
-'@
-
-function Invoke-GateRead {
-    param([string[]]$Rest)
-    $fdArg = ''; $gate = ''; $report = ''; $file = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--gate','-Gate' } { $gate = $Rest[++$i] } { $_ -in '--report','-Report' } { $report = $Rest[++$i] } { $_ -in '--file','-File' } { $file = $Rest[++$i] } } }
-    if (-not $gate) { Write-Error 'gate-read: --gate required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'gate-read: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'gate-read: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_GATE = $gate; $env:AW_FD = $fd; $env:AW_REPORT = $report; $env:AW_FILE = $file
-    $PyGateRead | & $py -
-    Remove-Item Env:AW_GATE, Env:AW_FD, Env:AW_REPORT, Env:AW_FILE -ErrorAction SilentlyContinue
-}
-
-# ─────────────── story-plan-check / story-plan-doc / log-append ───────────────
-# The per-story execution design ("story design", one document per lane) + the
-# feature's append-only logs. Twins of the bash actions; the python payloads are
-# byte-identical by contract.
-$PyStoryPlanCheck = @'
-import json, os, re, sys
-fd = os.environ["AW_FD"]
-sdir = os.path.join(fd, "stories")
-spec = os.path.join(fd, "spec.md")
-
-def parse_fm(text):
-    """Frontmatter as a flat dict — inline and block-list values both fold to the
-    inline shape (same reader story-refs uses, for the same reason)."""
-    m = re.match(r'^---\s*\n(.*?)\n---\s*\n', text, re.S)
-    if not m: return {}
-    fm, key, block = {}, None, set()
-    for line in m.group(1).split("\n"):
-        km = re.match(r'^([A-Za-z_]+):\s*(.*)$', line)
-        if km:
-            key = km.group(1); fm[key] = km.group(2).strip(); continue
-        im = re.match(r'^\s+-\s+(.*)$', line) if key else None
-        if im and (key in block or not fm[key]):
-            block.add(key)
-            fm[key] = (fm[key] + ", " + im.group(1).strip()) if fm[key] else im.group(1).strip()
-    return fm
-
-def vtuple(v):
-    try: return tuple(int(x) for x in v.lstrip("vV").split("."))
-    except Exception: return (0,)
-
-# ---- the backlog ------------------------------------------------------------
-stories = []
-if os.path.isdir(sdir):
-    for name in sorted(os.listdir(sdir)):
-        # stories.md is the GENERATED index beside the stories, not a story
-        if not name.endswith(".md") or name == "stories.md": continue
-        p = os.path.join(sdir, name)
-        if not os.path.isfile(p): continue
-        text = open(p, encoding="utf-8", errors="replace").read()
-        fm = parse_fm(text)
-        sid = fm.get("id") or name[:-3]
-        stories.append({"id": sid, "file_id": name[:-3],
-                        "status": (fm.get("status") or "open").strip().lower(),
-                        "type": (fm.get("type") or "functional").strip().lower(),
-                        "title": (fm.get("title") or "").strip().strip("[]"),
-                        "spec_version": (fm.get("spec_version") or "").strip(),
-                        "cites": re.findall(r'\b(?:FR|BR)-\d+', fm.get("exercises", "")),
-                        "wave": (fm.get("wave") or "").strip(),
-                        "deps": [d for d in re.split(r'[,\s\[\]"\']+',
-                                                     fm.get("depends_on", "") or "")
-                                 if re.match(r'^[A-Za-z][\w.]*-\d+$', d)],
-                        "fm": fm, "path": p, "text": text})
-
-def lanes(s):
-    """backend / frontend out of a csv or an inline list; anything else is not a lane."""
-    out = []
-    for tok in re.split(r'[,\s\[\]"\']+', (s or "").lower()):
-        if tok in ("backend", "frontend") and tok not in out: out.append(tok)
-    return sorted(out)
-open_stories = [s for s in stories if s["status"] == "open"]
-open_ids = [s["id"] for s in open_stories]
-digest = "\n".join("  %-16s %s%s" % (s["id"], s["title"] or "(untitled)",
-                                     ("  cites " + ", ".join(s["cites"])) if s["cites"] else "")
-                   for s in open_stories) or "  (no open stories)"
-
-# ---- which story ------------------------------------------------------------
-want = (os.environ.get("AW_STORY") or "").strip()
-free = os.environ.get("AW_INPUT") or ""
-target, reason = None, ""
-if want:
-    hit = [s for s in stories if s["id"] == want or s["file_id"] == want]
-    target = hit[0] if hit else None
-    if not target: reason = "not-found"
-else:
-    # every known story id appearing as a whole token in the free text; one match
-    # resolves, several is a question, none is a question
-    named = [s for s in stories
-             if re.search(r'(?<![\w-])' + re.escape(s["id"]) + r'(?![\w-])', free)]
-    if len(named) == 1: target = named[0]
-    else: reason = "ambiguous" if named else "none-given"
-
-out = {"ok": True, "stories_dir": sdir, "stories_exist": os.path.isdir(sdir),
-       "open_count": len(open_stories), "any_open": bool(open_stories),
-       "open_ids": open_ids, "open_ids_csv": ", ".join(open_ids), "digest": digest,
-       "resolved": bool(target), "needs_pick": not target, "pick_reason": reason,
-       "story": "", "story_path": "", "story_status": "", "story_open": False,
-       "story_type": "", "is_technical": False,
-       "status_msg": "", "story_title": "", "exercises_csv": "", "constraints_csv": "",
-       "story_spec_version": "", "current_version": "", "stale_csv": "", "stale_note": "",
-       "story_wave": "", "depends_on_csv": "", "open_deps_csv": "",
-       "unresolved_deps_csv": "", "deps_note": "", "deps_clear": True,
-       "designed_lanes_csv": "", "dropped_lanes_csv": "", "lane_keys_present": False,
-       "be_lane_designed": False, "fe_lane_designed": False,
-       "be_lane_dropped": False, "fe_lane_dropped": False,
-       "story_dir": "", "if_tmp": "", "legacy_doc": "", "legacy_doc_exists": False,
-       "be_doc_path": "", "be_doc_exists": False, "be_next_pass": 1, "be_pass_tmp": "",
-       "be_last_pass": 0, "be_doc_spec_version": "", "be_doc_stale": False,
-       "be_pass_plan_hash": "",
-       "fe_doc_path": "", "fe_doc_exists": False, "fe_next_pass": 1, "fe_pass_tmp": "",
-       "fe_last_pass": 0, "fe_doc_spec_version": "", "fe_doc_stale": False,
-       "fe_pass_plan_hash": "",
-       "adr_path": os.path.join(fd, "adr.md"), "adr_exists": os.path.isfile(os.path.join(fd, "adr.md")),
-       "if_path": os.path.join(fd, "interfaces.md"), "if_exists": os.path.isfile(os.path.join(fd, "interfaces.md")),
-       "spec_exists": os.path.isfile(spec)}
-
-# ---- the ledger (widest-wins current version, same rule ledger-append uses) --
-rows, cur = [], ""
-if os.path.isfile(spec):
-    stext = open(spec, encoding="utf-8", errors="replace").read()
-    m = re.search(r'^##\s+Change History\s*$', stext, re.M)
-    if m:
-        for line in stext[m.end():].splitlines():
-            rm = re.match(r'^\|\s*(v\d+(?:\.\d+)?)\s*\|', line)
-            if rm: rows.append((rm.group(1), line))
-    hv = re.search(r'^\*\*Version\*\*:\s*(v[\d.]+)', stext, re.M)
-    cands = [r[0] for r in rows] + ([hv.group(1)] if hv else [])
-    if cands: cur = max(cands, key=vtuple)
-out["current_version"] = cur
-
-if not target:
-    print(json.dumps(out)); sys.exit(0)
-
-# ---- the resolved story -----------------------------------------------------
-status = target["status"]
-out.update(story=target["id"], story_path=target["path"], story_status=status,
-           story_open=(status == "open"), story_title=target["title"],
-           story_type=target["type"], is_technical=(target["type"] == "technical"),
-           exercises_csv=", ".join(target["cites"]),
-           story_spec_version=target["spec_version"])
-if status != "open":
-    verb = {"closed": "was closed — its plan is history. Remaining work needs its own story "
-                      "(sync-stories mints a follow-on when the spec moves)",
-            "cancelled": "was cancelled — cancelled work is not planned; open a new story if the need returns",
-            "draft": "is a draft proposal — run /appweaver sync-spec to merge it into the contract first; "
-                     "story-plan designs only against merged requirements"}
-    out["status_msg"] = "Story %s %s." % (
-        target["id"], verb.get(status, "has status '%s', not open" % status))
-
-# THE BOUNDS COME FROM FRONTMATTER, which story-stamp lifts from the spec. They are barred
-# from exercises: by design — a constraint is met, not delivered — and they were read out of
-# the BODY's ## Constraints section until that section turned out to be the one gate surface
-# the kit did not write: a model that omitted an id dropped a bound out of the generation
-# prompt with nothing able to contradict it.
-#
-# ABSENT IS NOT EMPTY. A story stamped before the field existed carries its ids only in the
-# body, so a missing key falls back to the section; an explicit `constraints: []` is an
-# answer and is taken as one. The fallback goes once every live backlog is re-stamped.
-if "constraints" in target["fm"]:
-    cons = sorted(set(re.findall(r'\b(?:CN|DC|IC|UX)-\d+', target["fm"]["constraints"])))
-else:
-    cm = re.search(r'^##\s+Constraints\s*$(.*?)(?=^##\s|\Z)', target["text"], re.M | re.S)
-    cons = sorted(set(re.findall(r'\b(?:CN|DC|IC|UX)-\d+', cm.group(1)))) if cm else []
-out["constraints_csv"] = ", ".join(cons)
-
-# WHAT HAS TO LAND FIRST. sync-stories computes depends_on: and wave: and stamps both, and
-# until now nothing downstream read either — the ordering was recorded and never enforced.
-# Two different misses, kept apart: a dependency whose story is still OPEN here is work in
-# progress, and one with no story file in this feature is UNRESOLVED, which is the ordinary
-# shape of a cross-feature edge (Payment-004 from Order) and not the same as satisfied.
-#
-# The wave is surfaced and NOT gated. A story becomes startable when its own dependencies
-# land, not when the whole previous wave finishes, so warning on "an open story in a lower
-# wave" would serialise a wave that exists precisely to be unordered.
-# WHICH LANES THIS STORY WAS DESIGNED FOR, AND WHICH WERE DROPPED. story-plan stamps both,
-# because one of them cannot say the difference: a story with no UI design either has no
-# user-facing surface or had its UI lane dropped when it was designed, and those two states
-# are the same absence on disk. `lane_keys_present` is what keeps the distinction honest for
-# a story stamped before the fields existed — it has NEITHER key, and absent must never be
-# read as "no surface".
-des = lanes(target["fm"].get("designed_lanes", ""))
-drp = lanes(target["fm"].get("dropped_lanes", ""))
-out.update(designed_lanes_csv=", ".join(des), dropped_lanes_csv=", ".join(drp),
-           lane_keys_present=("designed_lanes" in target["fm"]
-                              or "dropped_lanes" in target["fm"]),
-           be_lane_designed=("backend" in des), fe_lane_designed=("frontend" in des),
-           be_lane_dropped=("backend" in drp), fe_lane_dropped=("frontend" in drp))
-
-deps = target["deps"]
-by_id = {s["id"]: s for s in stories}
-open_deps = [d for d in deps if d in by_id and by_id[d]["status"] == "open"]
-unresolved = [d for d in deps if d not in by_id]
-out.update(story_wave=target["wave"], depends_on_csv=", ".join(deps),
-           open_deps_csv=", ".join(open_deps),
-           unresolved_deps_csv=", ".join(unresolved),
-           deps_clear=not (open_deps or unresolved))
-if open_deps or unresolved:
-    parts = []
-    if open_deps:
-        parts.append("still open in this feature: %s" % ", ".join(open_deps))
-    if unresolved:
-        parts.append("no story file here — check the feature that owns them: %s"
-                     % ", ".join(unresolved))
-    out["deps_note"] = (
-        "ORDERING: %s declares depends_on: %s, and %s. This is a notice, not a refusal — "
-        "the dependency is about CODE ordering, and calling into work that has not landed "
-        "is where it starts to cost something."
-        % (target["id"], ", ".join(deps), "; ".join(parts)))
-
-# staleness: ledger rows ABOVE the story's stamp naming an id the story carries —
-# exercises: AND the Constraints section, so a moved bound is announced too
-sv = target["spec_version"]
-if sv:
-    carried = set(target["cites"]) | set(cons)
-    moved = [r for r in rows if vtuple(r[0]) > vtuple(sv)]
-    stale = sorted({i for _v, l in moved for i in re.findall(r'[A-Z]{2}-\d+', l) if i in carried})
-    out["stale_csv"] = ", ".join(stale)
-    if stale:
-        out["stale_note"] = (
-            "CAUTION: the spec moved above this story's stamp (%s -> %s) on ids this story "
-            "carries: %s. Design against the CURRENT spec text, record the divergence under "
-            "Risks, and consider /appweaver sync-stories to bring the backlog back in step."
-            % (sv, cur or "?", ", ".join(stale)))
-
-# doc / pass state + the temp paths the workflow writes through. ONE DOCUMENT PER
-# LANE: the service design and the UI design are authored by different steps, under
-# different rule sets, from different code, and are read by different implement
-# commands — folded into one file, every one of those becomes a section boundary the
-# next reader has to trust. Pass numbers are per file, so a run that designs only the
-# backend leaves the frontend's count exactly where it was.
-#
-# legacy_doc is the pre-split story-plan.md. It is REPORTED, never read and never
-# written: a design nobody consumes must not sit silently beside two that are.
-stdir = os.path.join(sdir, target["id"])
-legacy = os.path.join(stdir, "story-plan.md")
-out.update(story_dir=stdir, if_tmp=os.path.join(stdir, ".if-entries.tmp.md"),
-           legacy_doc=legacy, legacy_doc_exists=os.path.isfile(legacy))
-for lane, stem in (("be", "backend"), ("fe", "frontend")):
-    doc = os.path.join(stdir, "story-%s-plan.md" % stem)
-    out[lane + "_doc_path"] = doc
-    out[lane + "_doc_exists"] = os.path.isfile(doc)
-    out[lane + "_pass_tmp"] = os.path.join(stdir, ".%s-pass.tmp.md" % stem)
-    if out[lane + "_doc_exists"]:
-        d = open(doc, encoding="utf-8", errors="replace").read()
-        nums = [int(n) for n in re.findall(r'^##\s+Design pass\s+(\d+)', d, re.M)]
-        out[lane + "_next_pass"] = (max(nums) + 1) if nums else 1
-        # What implement needs on top of the path: WHICH pass it builds from (the last
-        # one — earlier passes are superseded history) and the spec version that pass was
-        # designed against. A design behind the current spec is ANNOUNCED at implement,
-        # never refused: the story is legitimately in flight, and the spec may well have
-        # moved on ids this story does not carry. stale_csv is the sharper signal and it
-        # is already computed above.
-        out[lane + "_last_pass"] = max(nums) if nums else 0
-        dv = (parse_fm(d).get("spec_version") or "").strip().strip('"')
-        out[lane + "_doc_spec_version"] = dv
-        out[lane + "_doc_stale"] = bool(dv and cur and vtuple(dv) < vtuple(cur))
-        # THE FEATURE PLAN THIS PASS WAS DESIGNED AGAINST, as analyze-design certified it.
-        # A story pass is written once and read forever, so comparing only the CURRENT plan
-        # against the CURRENT verdict leaves the case law 40 is actually about: a pass
-        # designed against plan H1 still generating after the plan was edited to H2 and
-        # re-gated. The hash is script-written into the pass header by story-plan-doc; the
-        # LAST pass is the one implement builds from, so it is the last one read here.
-        hs = re.findall(r'^##\s+Design pass\s+\d+\b[^\n]*?\(plan\s+([0-9a-f]{8,64})\)',
-                        d, re.M)
-        out[lane + "_pass_plan_hash"] = hs[-1] if hs else ""
-print(json.dumps(out))
-'@
-
-$PyStoryPlanDoc = @'
-import json, os, re, sys, datetime
-fd = os.environ["AW_FD"]; story = os.environ["AW_STORY"].strip()
-pf = os.environ["AW_PASS"]; ver = (os.environ.get("AW_VER") or "").strip()
-lane = (os.environ.get("AW_LANE") or "backend").strip().lower()
-phash = re.sub(r'[^0-9a-f]', '', (os.environ.get("AW_PLAN_HASH") or "").strip().lower())
-sdir = os.path.join(fd, "stories", story)
-doc = os.path.join(sdir, "story-%s-plan.md" % lane)
-
-def bail(msg, code=2):
-    print(json.dumps({"ok": False, "doc": doc, "error": msg}))
-    sys.stderr.write(msg + "\n"); sys.exit(code)
-
-if lane not in ("backend", "frontend"):
-    bail("story-plan-doc: --lane must be backend or frontend, not '%s'" % lane)
-if not os.path.isfile(os.path.join(fd, "stories", story + ".md")):
-    bail("story-plan-doc: no story file for '%s' — the plan lives beside a story that exists" % story)
-if not os.path.isfile(pf):
-    bail("story-plan-doc: pass file missing at %s — the authoring step wrote nothing" % pf)
-content = open(pf, encoding="utf-8", errors="replace").read().strip()
-if not content:
-    bail("story-plan-doc: the authored pass is empty — nothing appended")
-# the pass header is SCRIPT-written; strip one the model wrote anyway rather than
-# letting the doc double-number
-content = re.sub(r'^##\s+Design pass\b[^\n]*\n+', '', content, count=1)
-
-LANE_WORD = "SERVICE" if lane == "backend" else "UI"
-LANE_READER = "/appweaver implement" if lane == "backend" else "/appweaver implement-ui"
-os.makedirs(sdir, exist_ok=True)
-today = datetime.date.today().isoformat()
-created = not os.path.isfile(doc)
-if created:
-    open(doc, "w", encoding="utf-8").write("""---
-created: %s
-updated: %s
-passes: 0
-spec_version: ""
----
-
-<!--
-  STORY DESIGN (%s LANE) — the ephemeral execution design for ONE story, read by
-  %s.
-
-  Identity is positional: the file lives in the story's directory and carries no
-  story id in its text. Every /appweaver story-plan run APPENDS a "## Design pass N"
-  section to THIS lane's file — nothing is edited in place, so a manual edit to an
-  earlier pass survives a re-run. THE LATEST PASS WINS; earlier passes are the
-  iteration history.
-
-  EDIT IT BEFORE YOU IMPLEMENT. This is the document a design is corrected in by
-  hand: change the latest pass and implement builds what you changed. Re-running
-  story-plan instead appends a fresh pass that supersedes it, so hand-edit to
-  adjust, re-run to redesign.
-
-  It is scaffolding for confirming the implementation strategy — archived with the
-  story at close, never maintained afterwards. Durable decisions do not live here:
-  the latest pass PROPOSES ADRs (ratified into the feature's adr.md at close), and
-  published-surface changes are appended to the feature's interfaces.md as proposed
-  entries at design time. spec_version below is the spec the LATEST pass was
-  designed against. The other lane's design, where the project has one, sits beside
-  this file — the two are written apart on purpose and neither restates the other.
--->
-""" % (today, today, LANE_WORD, LANE_READER))
-text = open(doc, encoding="utf-8", errors="replace").read()
-nums = [int(n) for n in re.findall(r'^##\s+Design pass\s+(\d+)', text, re.M)]
-n = (max(nums) + 1) if nums else 1
-header = "## Design pass %d — %s%s%s" % (
-    n, today, (" (spec %s)" % ver) if ver else "",
-    (" (plan %s)" % phash) if phash else "")
-text = text.rstrip("\n") + "\n\n" + header + "\n\n" + content + "\n"
-# frontmatter stamps — first match only, which is the frontmatter by position
-text = re.sub(r'^(updated:).*$', r'\g<1> ' + today, text, count=1, flags=re.M)
-text = re.sub(r'^(passes:).*$', r'\g<1> %d' % n, text, count=1, flags=re.M)
-if ver:
-    text = re.sub(r'^(spec_version:).*$', r'\g<1> %s' % ver, text, count=1, flags=re.M)
-open(doc, "w", encoding="utf-8").write(text)
-os.remove(pf)
-print(json.dumps({"ok": True, "doc": doc, "lane": lane, "pass": n, "created": created,
-                  "spec_version": ver, "plan_hash": phash, "story_dir": sdir}))
-'@
-
-$PyLogAppend = @'
-import json, os, re, sys, time, errno, datetime
-fd = os.environ["AW_FD"]; log = os.environ["AW_LOG"]
-ef = os.environ["AW_ENTRIES"]; status = (os.environ.get("AW_STATUS") or "").strip()
-fname, prefix, default_status, title = {
-    "interfaces": ("interfaces.md", "IF", "proposed", "Interface Log"),
-    "adr":        ("adr.md", "ADR", "accepted", "Architecture Decision Log")}[log]
-status = status or default_status
-path = os.path.join(fd, fname)
-
-def bail(msg, code=2):
-    print(json.dumps({"ok": False, "log": path, "error": msg}))
-    sys.stderr.write(msg + "\n"); sys.exit(code)
-
-if not os.path.isfile(ef):
-    bail("log-append: entries file missing at %s — the authoring step wrote nothing" % ef)
-raw = open(ef, encoding="utf-8", errors="replace").read().strip()
-if not raw or raw.lower().rstrip(".") == "none":
-    os.remove(ef)
-    print(json.dumps({"ok": True, "log": path, "appended": 0, "ids_csv": "",
-                      "unknown_ids_csv": "", "bad_supersedes_csv": "", "none": True}))
-    sys.exit(0)
-
-# every entry must arrive as '## <PREFIX>-NEW — <title>': the script is the only id
-# authority, so a model-numbered entry is refused rather than trusted
-blocks = [b.strip() for b in re.split(r'(?=^##\s)', raw, flags=re.M) if b.strip()]
-bad = [b.splitlines()[0] for b in blocks
-       if not re.match(r'^##\s+%s-NEW\s+[—-]+\s+\S' % prefix, b)]
-if bad:
-    bail("log-append: every entry must start '## %s-NEW — <title>' (the script assigns "
-         "ids); got: %s" % (prefix, " | ".join(bad[:3])))
-
-SCAFFOLD = {
-    "interfaces": """<!--
-  INTERFACE LOG — this feature's published-surface contract. APPEND-ONLY.
-
-  WHO WRITES: /appweaver plan publishes this feature's surface whenever it authors or
-  conforms backend-plan.md; a BE story plan appends an entry only where its slice
-  changes that surface. Both land as status: proposed, and story close verifies each
-  against the as-built and flips it to live.
-  WHO READS: /appweaver plan-ui and the FE story designs — this log is the BE-to-FE
-  contract anchor, and the plan documents CITE these ids rather than restating them.
-  The current surface per interface is the LATEST entry — one that names an earlier
-  id in `supersedes:` replaces it. Never edit an existing entry; publish a
-  superseding one. status: proposed -> live -> superseded | retired.
-  `serves:` cites the FR-/BR- ids the interface exists for, so a spec change to
-  those ids flags the contract for review.
--->
-
-# Interface Log
-""",
-    "adr": """<!--
-  ADR LOG — this feature's durable decisions. APPEND-ONLY.
-
-  A story plan PROPOSES ADRs in its latest design pass; they are ratified into this
-  log at story close, or the architect appends directly. Never rewrite an entry —
-  supersede it with a new one naming `supersedes:`. An ADR records ONLY what neither
-  the code nor the rules can say: a deliberate choice among rule-compliant
-  alternatives, a rejected alternative and why, or a trade-off with its revisit
-  trigger. It never restates what code shows or a rule mandates.
--->
-
-# Architecture Decision Log
-"""}
-# THE ID ASSIGNMENT AND THE WRITE ARE ONE OPERATION. `nxt = max(existing) + 1` is computed
-# from a whole-file read and the file is then written back truncating — so two runs that
-# read before either wrote both compute the same next id, and the second write drops the
-# first's entry entirely. The wave model exists to have same-wave stories designed in
-# parallel, and this is the artefact §0.3 calls the cross-lane contract anchor, so the race
-# is not hypothetical: two story-plan runs, or plan and story-plan, is the ordinary case.
-# Git catches a lost entry across branches and never within one working tree.
-#
-# The lock is named for the FILE, so every writer of interfaces.md contends on one lock
-# whichever op or shell it came from — aw-xref.py names its own the same way for the same
-# reason. A lock older than the timeout belonged to a run that died holding it; breaking it
-# is right, because the alternative is a wedged feature nobody can append to again.
-LOCK_TIMEOUT = 30.0
-def take_lock(target):
-    lp = target + ".aw-lock"
-    start = time.time()
-    while True:
-        try:
-            h = os.open(lp, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
-            os.write(h, ("%d\n" % os.getpid()).encode("utf-8")); os.close(h)
-            return lp
-        except OSError as e:
-            if e.errno != errno.EEXIST: raise
-            try: age = time.time() - os.path.getmtime(lp)
-            except OSError: age = 0.0
-            if age > LOCK_TIMEOUT:
-                try: os.unlink(lp)
-                except OSError: pass
-                continue
-            if time.time() - start > LOCK_TIMEOUT:
-                bail("log-append: %s has been locked by another run for over %ds. If no "
-                     "other /appweaver command is running, delete %s and re-run."
-                     % (os.path.basename(target), int(LOCK_TIMEOUT), lp))
-            time.sleep(0.05)
-
-def drop_lock(lp):
-    try: os.unlink(lp)
-    except OSError: pass
-
-lock = take_lock(path)
-created = not os.path.isfile(path)
-if created:
-    open(path, "w", encoding="utf-8").write(SCAFFOLD[log])
-text = open(path, encoding="utf-8", errors="replace").read()
-existing = set(re.findall(r'^##\s+(%s-\d+)' % prefix, text, re.M))
-nums = [int(i.split("-")[1]) for i in existing]
-nxt = (max(nums) + 1) if nums else 1
-today = datetime.date.today().isoformat()
-
-spec = os.path.join(fd, "spec.md")
-known = set(re.findall(r'\b[A-Z]{2}-\d+\b',
-                       open(spec, encoding="utf-8", errors="replace").read())) \
-        if os.path.isfile(spec) else set()
-
-assigned, unknown, badsup, out_blocks = [], [], [], []
-for b in blocks:
-    bid = "%s-%03d" % (prefix, nxt); nxt += 1
-    lines = b.splitlines()
-    lines[0] = lines[0].replace("%s-NEW" % prefix, bid, 1)
-    body = "\n".join(lines[1:]).strip("\n")
-    # status and date are script-stamped, whatever the model wrote
-    body = re.sub(r'^status:.*\n?', '', body, flags=re.M)
-    body = re.sub(r'^date:.*\n?', '', body, flags=re.M)
-    body = ("status: %s\ndate: %s" % (status, today)) + ("\n" + body if body else "")
-    for line in body.splitlines():
-        if line.startswith("serves:"):
-            unknown += [i for i in re.findall(r'\b[A-Z]{2}-\d+\b', line)
-                        if known and i not in known]
-        if line.startswith("supersedes:"):
-            badsup += [i for i in re.findall(r'\b%s-\d+\b' % prefix, line)
-                       if i not in existing]
-    out_blocks.append(lines[0] + "\n\n" + body)
-    assigned.append(bid)
-
-text = text.rstrip("\n") + "\n\n" + "\n\n".join(out_blocks) + "\n"
-open(path, "w", encoding="utf-8").write(text)
-drop_lock(lock)
-os.remove(ef)
-print(json.dumps({"ok": True, "log": path, "appended": len(assigned),
-                  "ids_csv": ", ".join(assigned),
-                  "unknown_ids_csv": ", ".join(sorted(set(unknown))),
-                  "bad_supersedes_csv": ", ".join(sorted(set(badsup))),
-                  "none": False, "created_log": created}))
-'@
-
-function Invoke-StoryPlanCheck {
-    param([string[]]$Rest)
-    $fdArg = ''; $inp = ''; $story = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--input','-InputText' } { $inp = $Rest[++$i] } { $_ -in '--story','-Story' } { $story = $Rest[++$i] } } }
-    $py = Get-Py; if (-not $py) { Write-Error 'story-plan-check: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'story-plan-check: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_INPUT = $inp; $env:AW_STORY = $story
-    $PyStoryPlanCheck | & $py -
-    Remove-Item Env:AW_FD, Env:AW_INPUT, Env:AW_STORY -ErrorAction SilentlyContinue
-}
-
-function Invoke-StoryPlanDoc {
+    Write-Json ([ordered]@{ feature_dir = $fd; design_doc = $target; plan_doc = $target; lane = $lane; created = $created; migrated = $migrated; override_active = $overrideActive; template = $tplName; template_source = $tsOut })
+}
+
+# ─────────────────────────── delta-plan-scaffold ───────────────────────────
+# One change's LANE PLAN, inside the change directory beside its delta-spec:
+#   changes/<cr-id>/delta-backend-plan.md   (service lane)
+#   changes/<cr-id>/delta-frontend-plan.md  (frontend lane)
+# The plan phase calls this per DECLARED lane, so a backend-only project never grows an
+# orphan frontend delta plan. Not cr-setup's job: that runs in the spec phase, which knows
+# nothing about lanes. Same MIGRATION as the master — a change opened before the lane
+# split carries delta-design.md, renamed into the backend name rather than duplicated.
+function Invoke-DeltaPlanScaffold {
     param([string[]]$Rest)
-    $fdArg = ''; $story = ''; $passFile = ''; $specVersion = ''; $lane = 'backend'; $planHash = ''
-    # --plan-hash is the CERTIFIED feature-plan hash — the one analyze-design recorded in
-    # its verdict, never a fresh one taken here. Stamped into the pass header so a pass
-    # keeps saying which plan shape it was designed against long after the plan moved.
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--story','-Story' } { $story = $Rest[++$i] } { $_ -in '--lane','-Lane' } { $lane = $Rest[++$i] } { $_ -in '--pass-file','-PassFile' } { $passFile = $Rest[++$i] } { $_ -in '--spec-version','-SpecVersion' } { $specVersion = $Rest[++$i] } { $_ -in '--plan-hash','-PlanHash' } { $planHash = $Rest[++$i] } } }
-    if (-not $story) { Write-Error 'story-plan-doc: --story is required'; exit 1 }
-    if (-not $passFile) { Write-Error 'story-plan-doc: --pass-file is required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'story-plan-doc: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'story-plan-doc: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_STORY = $story; $env:AW_LANE = $lane; $env:AW_PASS = $passFile; $env:AW_VER = $specVersion
-    $env:AW_PLAN_HASH = $planHash
-    $PyStoryPlanDoc | & $py -
-    Remove-Item Env:AW_FD, Env:AW_STORY, Env:AW_LANE, Env:AW_PASS, Env:AW_VER, Env:AW_PLAN_HASH -ErrorAction SilentlyContinue
-}
-
-function Invoke-LogAppend {
-    param([string[]]$Rest)
-    $fdArg = ''; $log = ''; $entriesFile = ''; $status = ''
-    for ($i = 0; $i -lt $Rest.Count; $i++) { switch ($Rest[$i]) { { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] } { $_ -in '--log','-Log' } { $log = $Rest[++$i] } { $_ -in '--entries-file','-EntriesFile' } { $entriesFile = $Rest[++$i] } { $_ -in '--status','-Status' } { $status = $Rest[++$i] } } }
-    if ($log -notin 'adr','interfaces') { Write-Error 'log-append: --log must be adr or interfaces'; exit 1 }
-    if (-not $entriesFile) { Write-Error 'log-append: --entries-file is required'; exit 1 }
-    $py = Get-Py; if (-not $py) { Write-Error 'log-append: python3 required'; exit 1 }
-    $repo = Get-RepoRoot
-    $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
-    if (-not $fd) { Write-Error 'log-append: no feature set and no --feature-dir'; exit 1 }
-    $env:AW_FD = $fd; $env:AW_LOG = $log; $env:AW_ENTRIES = $entriesFile; $env:AW_STATUS = $status
-    $PyLogAppend | & $py -
-    Remove-Item Env:AW_FD, Env:AW_LOG, Env:AW_ENTRIES, Env:AW_STATUS -ErrorAction SilentlyContinue
+    $crId = ''; $fdArg = ''; $lane = 'backend'; $tplName = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+            { $_ -in '--lane','-Lane' } { $lane = $Rest[++$i] }
+            { $_ -in '--template','-Template' } { $tplName = $Rest[++$i] }
+        }
+    }
+    $crId = Get-CrIdToken -Raw $crId
+    if (-not $crId) { Write-Error 'delta-plan-scaffold: --cr-id is required'; exit 1 }
+    switch ($lane) {
+        'backend'  { $docName = 'delta-backend-plan.md';  $legacyName = 'delta-design.md'
+                     if (-not $tplName) { $tplName = 'delta-design-template' } }
+        'frontend' { $docName = 'delta-frontend-plan.md'; $legacyName = 'delta-design.ui.md'
+                     if (-not $tplName) { $tplName = 'ui-delta-design-template' } }
+        default    { Write-Error ("delta-plan-scaffold: unknown --lane '" + $lane + "' (backend|frontend)"); exit 1 }
+    }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'delta-plan-scaffold: no feature set and no --feature-dir'; exit 1 }
+    $crDir = Join-Path $fd "changes/$crId"
+    if (-not (Test-Path $crDir)) { Write-Error ("delta-plan-scaffold: no such open change '" + $crId + "' (looked in " + $crDir + ")"); exit 1 }
+    $target = Join-Path $crDir $docName
+    $created = $false; $migrated = $false
+    if ((-not (Test-Path $target)) -and (Test-Path (Join-Path $crDir $legacyName))) {
+        Move-Item (Join-Path $crDir $legacyName) $target; $migrated = $true
+    }
+    if (-not (Test-Path $target)) {
+        $tpl = Resolve-NamedTemplate -Name $tplName -RepoRoot $repo
+        if ($tpl -and (Test-Path $tpl)) { Copy-Item $tpl $target } else { New-Item -ItemType File -Force -Path $target | Out-Null }
+        $created = $true
+    }
+    Set-HeaderStamp -Path $target -Name 'Wave' -Value (Get-WaveOf -FeatureDir $fd -CrId $crId -Repo $repo)
+    $overrideActive = Test-Path (Join-Path $repo (".appweaver/templates/overrides/" + $tplName + ".md"))
+    $templateSource = Resolve-NamedTemplate -Name $tplName -RepoRoot $repo
+    $tsOut = if ($templateSource) { $templateSource } else { '' }
+    Write-Json ([ordered]@{ cr_id = $crId; cr_dir = $crDir; lane = $lane; delta_plan = $target; created = $created; migrated = $migrated; override_active = $overrideActive; template = $tplName; template_source = $tsOut })
 }
 
 # Read one field out of the lane model. Twin of the bash inline python readers: the
@@ -5262,35 +2456,528 @@ function Invoke-DeployDispatch {
     Write-Json ([ordered]@{ ok = $ok; configured = $configured; ran = $ran; cmd = $cmd; log_tail = $tail })
 }
 
+# ────────────── domain model — context-level helpers (bash twins) ───────────
+# The bounded context that owns a feature's domain model. specs/<Ctx>/<Feat> puts the
+# model one level up; a flat specs/<Feat> falls back to specs/ as the implicit single
+# context, so a pre-context repo resolves exactly one model rather than none.
+function Get-ContextDirForFeature {
+    param([string]$FeatureDir, [string]$Repo)
+    $parent = Split-Path $FeatureDir -Parent
+    $specs  = Join-Path $Repo 'specs'
+    if (($parent -eq $specs) -or ($parent -eq $Repo)) { return $specs }
+    return $parent
+}
+
+# Four random hex characters, so two changes opened in the same second cannot collide.
+function Get-RandSuffix {
+    return -join ((1..4) | ForEach-Object { '{0:x}' -f (Get-Random -Minimum 0 -Maximum 16) })
+}
+
+# Set or insert a '**<Name>**: <value>' header line. Scripts own ids, dates, versions and
+# the wave. Idempotent: an existing line is replaced in place, a missing one is inserted
+# after the title so the header block stays together. Twin of bash _stamp_header.
+function Set-HeaderStamp {
+    param([string]$Path, [string]$Name, [string]$Value)
+    if (-not (Test-Path $Path)) { return }
+    $text = Get-Content $Path -Raw
+    $line = "**$Name**: $Value"
+    $pat  = "(?m)^\*\*$([regex]::Escape($Name))\*\*:.*$"
+    if ($text -match $pat) {
+        $text = [regex]::Replace($text, $pat, { param($m) $line }, 1)
+    } else {
+        $lines = @($text -split "`n")
+        $at = 0
+        for ($i = 0; $i -lt $lines.Count; $i++) { if ($lines[$i].StartsWith('# ')) { $at = $i + 1; break } }
+        $out = @(); $out += $lines[0..$at]; $out += ''; $out += $line
+        if ($at + 1 -lt $lines.Count) { $out += $lines[($at + 1)..($lines.Count - 1)] }
+        $text = ($out -join "`n")
+    }
+    Set-Content -Path $Path -Value $text -Encoding UTF8 -NoNewline
+}
+
+# The highest wave among the delta models open in a context, or 1 when none is. This is
+# the DEFAULT for a new delta: parallel with whatever is in flight, never implicitly
+# sequenced behind it.
+# The change id out of whatever the caller passed. A user_select hands back the whole
+# option LABEL ("CR-… · wave 2 · Add discount tiers"), and a change id never contains
+# whitespace — so the first token is the id either way. Twin of bash _cr_id_token.
+function Get-CrIdToken {
+    param([string]$Raw)
+    if (-not $Raw) { return '' }
+    return ($Raw -split '\s+')[0]
+}
+
+# One change's wave, read from the documents that carry it: the delta-spec first, then the
+# model delta. Both are stamped together, so either answers; 1 is the floor for a change
+# opened before waves existed. Twin of bash _wave_of.
+function Get-WaveOf {
+    param([string]$FeatureDir, [string]$CrId, [string]$Repo)
+    $ctx = Get-ContextDirForFeature -FeatureDir $FeatureDir -Repo $Repo
+    foreach ($f in @((Join-Path $FeatureDir "changes/$CrId/delta-spec.md"), (Join-Path $ctx "domain-model.$CrId.delta.md"))) {
+        if (-not (Test-Path $f)) { continue }
+        $t = Get-Content $f -Raw -ErrorAction SilentlyContinue
+        if ($t -match '(?m)^\*\*Wave\*\*:\s*(\d+)') { return "$([int]$Matches[1])" }
+    }
+    return '1'
+}
+
+function Get-MaxOpenWave {
+    param([string]$ContextDir)
+    $best = 0
+    foreach ($f in @(Get-ChildItem -Path $ContextDir -Filter 'domain-model.*.delta.md' -File -ErrorAction SilentlyContinue)) {
+        $t = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
+        if ($t -match '(?m)^\*\*Wave\*\*:\s*(\d+)') { $w = [int]$Matches[1]; if ($w -gt $best) { $best = $w } }
+    }
+    if ($best -lt 1) { return 1 }
+    return $best
+}
+
+# ─────────────────────────── context-paths ─────────────────────────────────
+# Everything specify needs about the domain model of the context it works in: where the
+# master is, whether it exists, and EVERY open delta model beside it. The pending list is
+# the point — specify authors against the master PLUS what other open deltas propose, so
+# an overlap is designed around rather than discovered at merge time.
+function Invoke-ContextPaths {
+    param([string[]]$Rest)
+    $fdArg = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        if ($Rest[$i] -in '--feature-dir','-FeatureDir') { $fdArg = $Rest[++$i] }
+    }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'context-paths: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $ctxRel = ConvertTo-RepoRelative -Path $ctx -RepoRoot $repo
+    # specs/ itself is the implicit single context of a pre-context repo — it has a model
+    # but no context NAME, and saying so is what keeps the flat layout honest.
+    $context = if ($ctxRel -eq 'specs') { '' } else { Split-Path $ctxRel -Leaf }
+    $master = Join-Path $ctx 'domain-model.md'
+    $pending = @(); $files = @(); $waves = @()
+    foreach ($f in @(Get-ChildItem -Path $ctx -Filter 'domain-model.*.delta.md' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
+        $cr = $f.Name.Substring('domain-model.'.Length)
+        $cr = $cr.Substring(0, $cr.Length - '.delta.md'.Length)
+        $wave = 1
+        $t = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
+        if ($t -match '(?m)^\*\*Wave\*\*:\s*(\d+)') { $wave = [int]$Matches[1] }
+        $rel = ConvertTo-RepoRelative -Path $f.FullName -RepoRoot $repo
+        $pending += [ordered]@{ cr_id = $cr; file = $rel; wave = $wave }
+        $files += $rel; $waves += $wave
+    }
+    $maxWave = if ($waves.Count) { ($waves | Measure-Object -Maximum).Maximum } else { 0 }
+    Write-Json ([ordered]@{
+        context             = $context
+        context_dir         = $ctxRel
+        domain_model        = ConvertTo-RepoRelative -Path $master -RepoRoot $repo
+        domain_model_exists = (Test-Path $master)
+        pending             = @($pending)
+        pending_files       = @($files)
+        pending_count       = $pending.Count
+        max_wave            = $maxWave
+        # What a new delta opened right now would be stamped with: alongside whatever is
+        # already in flight, never implicitly behind it.
+        next_wave           = $(if ($waves.Count) { $maxWave } else { 1 })
+    })
+}
+
+# ─────────────────────────── model-scaffold ────────────────────────────────
+# Copy the domain-model template into the context on the BOOTSTRAP path. Idempotent and
+# non-destructive: after the first specify the model is amended by delta and merge, never
+# re-scaffolded.
+function Invoke-ModelScaffold {
+    param([string[]]$Rest)
+    $fdArg = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        if ($Rest[$i] -in '--feature-dir','-FeatureDir') { $fdArg = $Rest[++$i] }
+    }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'model-scaffold: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    New-Item -ItemType Directory -Force -Path $ctx | Out-Null
+    $model = Join-Path $ctx 'domain-model.md'; $tpl = ''; $created = $false
+    if (-not (Test-Path $model)) {
+        $tpl = Resolve-NamedTemplate -Name 'domain-model-template' -RepoRoot $repo
+        if ($tpl) { Copy-Item $tpl $model } else { New-Item -ItemType File -Force -Path $model | Out-Null }
+        $created = $true
+    }
+    Write-Json ([ordered]@{
+        context_dir  = ConvertTo-RepoRelative -Path $ctx -RepoRoot $repo
+        domain_model = ConvertTo-RepoRelative -Path $model -RepoRoot $repo
+        template     = "$tpl"
+        created      = $created
+        exists       = $true
+    })
+}
+
+# ─────────────────────────── cr-list ───────────────────────────────────────
+# The changes currently OPEN on a feature, in wave order. This is what lets a delta stage
+# ASK which change it is working on instead of inferring one: many may be open at once,
+# and "the most recently opened" is a guess that is wrong as soon as two people work in
+# parallel. THE EVIDENCE IS THE DIRECTORY — changes/<cr-id>/ exists while the change is
+# open and moves to changes/archive/ when it closes; active_version.json is read alongside
+# and reported as `tracked`, so a disagreement is visible rather than silently resolved.
+#
+# TWO SYNTHETIC OPTIONS, off by default. A caller that offers more than "which open
+# change" asks for them by flag, and gets each one's exact label back so it can test the
+# selection against it (the engine compares rendered strings; there is no prefix match):
+#   --include-main  prepends MAIN — "not a change at all, the feature's own master".
+#                   `--preselect main` (or `master`) resolves to it.
+#   --include-new   appends NEW — "open a change that has no spec delta". `--preselect
+#                   new` resolves to it.
+# `count` and `has_changes` keep counting REAL open changes, so a caller that gates on
+# them is unaffected by either flag.
+function Invoke-CrList {
+    param([string[]]$Rest)
+    $fdArg = ''; $pre = ''; $incMain = $false; $incNew = $false
+    $mainLabel = "main · the feature's own spec — re-plan the master (not a change)"
+    $newLabel = 'new · open a plan-only change — a refactor or architectural decision, no spec delta'
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+            { $_ -in '--preselect','-Preselect' } { $pre = $Rest[++$i] }
+            { $_ -in '--include-main','-IncludeMain' } { $incMain = $true }
+            { $_ -in '--include-new','-IncludeNew' } { $incNew = $true }
+        }
+    }
+    # The WHOLE argument, kept alongside the token. A cr id is matched on the token
+    # because a selection label starts with one; the synthetic words are matched on the
+    # whole string so that guidance prose like "new caching layer" — which plan passes
+    # here verbatim — cannot silently resolve to the NEW option.
+    $preRaw = "$pre".Trim().ToLower()
+    $pre = Get-CrIdToken -Raw $pre
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'cr-list: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $tracked = @(); $active = ''
+    $avp = Join-Path $fd 'active_version.json'
+    if (Test-Path $avp) {
+        try {
+            $av = Get-Content $avp -Raw | ConvertFrom-Json
+            $active = "$($av.active_change)"
+            $tracked = @($av.open_changes | Where-Object { $_ })
+            if (-not $tracked.Count -and $active) { $tracked = @($active) }
+        } catch { }
+    }
+    $rows = @()
+    $changesDir = Join-Path $fd 'changes'
+    if (Test-Path $changesDir) {
+        foreach ($d in @(Get-ChildItem -Path $changesDir -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) {
+            if ($d.Name -eq 'archive') { continue }
+            $dspec  = Join-Path $d.FullName 'delta-spec.md'
+            $dmodel = Join-Path $ctx ("domain-model." + $d.Name + ".delta.md")
+            $be     = Join-Path $d.FullName 'delta-backend-plan.md'
+            $fe     = Join-Path $d.FullName 'delta-frontend-plan.md'
+            $legacy = Join-Path $d.FullName 'delta-design.md'
+            $wave = [int](Get-WaveOf -FeatureDir $fd -CrId $d.Name -Repo $repo)
+            # "# Delta Spec — CR-…: Add discount tiers" -> the part after the id. An
+            # unfilled template still carries the placeholder, reported as such rather
+            # than offered to the user as a title.
+            $title = ''
+            if (Test-Path $dspec) {
+                $first = (Get-Content $dspec -TotalCount 1 -ErrorAction SilentlyContinue)
+                if ("$first" -match '^#\s+.*?:\s*(.+)$') { $t = $Matches[1].Trim(); if ($t -and -not $t.StartsWith('[')) { $title = $t } }
+            }
+            $rows += [ordered]@{
+                cr_id = $d.Name; cr_dir = (ConvertTo-RepoRelative -Path $d.FullName -RepoRoot $repo); wave = $wave
+                title = $title
+                delta_spec = (ConvertTo-RepoRelative -Path $dspec -RepoRoot $repo); delta_spec_exists = (Test-Path $dspec)
+                delta_model = (ConvertTo-RepoRelative -Path $dmodel -RepoRoot $repo); delta_model_exists = (Test-Path $dmodel)
+                delta_backend_plan = (ConvertTo-RepoRelative -Path $be -RepoRoot $repo); delta_backend_plan_exists = (Test-Path $be)
+                delta_frontend_plan = (ConvertTo-RepoRelative -Path $fe -RepoRoot $repo); delta_frontend_plan_exists = (Test-Path $fe)
+                legacy_delta_design = (Test-Path $legacy)
+                tracked = ($tracked -contains $d.Name)
+                active = ($d.Name -eq $active)
+            }
+        }
+    }
+    $rows = @($rows | Sort-Object @{ Expression = { $_.wave } }, @{ Expression = { $_.cr_id } })
+    $crOpts = @(); foreach ($r in $rows) {
+        $bits = @($r.cr_id, ("wave " + $r.wave))
+        if ($r.title) { $bits += $r.title } else { $bits += '(delta-spec not authored yet)' }
+        $planned = @(); if ($r.delta_backend_plan_exists) { $planned += 'backend' }; if ($r.delta_frontend_plan_exists) { $planned += 'frontend' }
+        if ($planned.Count) { $bits += ('planned: ' + ($planned -join '+')) }
+        $crOpts += ($bits -join ' · ')
+    }
+    $matched = ''
+    if ($pre) {
+        for ($i = 0; $i -lt $rows.Count; $i++) { if ($rows[$i].cr_id -eq $pre) { $matched = $crOpts[$i]; break } }
+        if (-not $matched) {
+            $hits = @(); for ($i = 0; $i -lt $rows.Count; $i++) { if ($rows[$i].cr_id -like "*$pre*") { $hits += $crOpts[$i] } }
+            if ($hits.Count -eq 1) { $matched = $hits[0] }
+        }
+    }
+    # The synthetic options bracket the real ones: MAIN first (it is the default reading
+    # of "plan this feature"), NEW last (it CREATES something, so it sits away from the
+    # choices that only select). Their words are also accepted as a --preselect, which is
+    # how a bare `plan main` on the command line skips the prompt.
+    $opts = @()
+    if ($incMain) { $opts += $mainLabel }
+    $opts += $crOpts
+    if ($incNew) { $opts += $newLabel }
+    if (-not $matched -and $preRaw) {
+        if ($incMain -and $preRaw -in @('main','master')) { $matched = $mainLabel }
+        elseif ($incNew -and $preRaw -eq 'new') { $matched = $newLabel }
+    }
+    Write-Json ([ordered]@{
+        changes = @($rows); ids = @($rows | ForEach-Object { $_.cr_id }); count = $rows.Count
+        select_options = @($opts); matched_label = $matched
+        main_label = $(if ($incMain) { $mainLabel } else { '' })
+        new_label = $(if ($incNew) { $newLabel } else { '' })
+        active_change = $active; tracked = @($tracked)
+        has_changes = ($rows.Count -gt 0)
+        only_id = $(if ($rows.Count -eq 1) { $rows[0].cr_id } else { '' })
+    })
+}
+
+# ─────────────────────────── cr-paths ──────────────────────────────────────
+# Everything one change needs to be PLANNED: its own documents, its wave, and the model
+# deltas that come BEFORE it. PREDECESSORS ARE THE LOWER WAVES — a wave is a dependency
+# level, so the deltas a plan may build on are exactly the open ones committed to landing
+# first. Same-wave deltas are reported as siblings: visible, so an overlap is designed
+# around, never assumed, because nothing orders them against each other.
+function Invoke-CrPaths {
+    param([string[]]$Rest)
+    $crId = ''; $fdArg = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+        }
+    }
+    $crId = Get-CrIdToken -Raw $crId
+    if (-not $crId) { Write-Error 'cr-paths: --cr-id is required'; exit 1 }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'cr-paths: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $crDir  = Join-Path $fd "changes/$crId"
+    $dspec  = Join-Path $crDir 'delta-spec.md'
+    $dmodel = Join-Path $ctx "domain-model.$crId.delta.md"
+    $be     = Join-Path $crDir 'delta-backend-plan.md'
+    $fe     = Join-Path $crDir 'delta-frontend-plan.md'
+    $master = Join-Path $ctx 'domain-model.md'
+    $wave = [int](Get-WaveOf -FeatureDir $fd -CrId $crId -Repo $repo)
+    $pred = @(); $sib = @(); $predRows = @(); $sibRows = @(); $predSpecs = @()
+    foreach ($f in @(Get-ChildItem -Path $ctx -Filter 'domain-model.*.delta.md' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
+        $other = $f.Name.Substring('domain-model.'.Length)
+        $other = $other.Substring(0, $other.Length - '.delta.md'.Length)
+        if ($other -eq $crId) { continue }
+        $w = 1
+        $t = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
+        if ($t -match '(?m)^\*\*Wave\*\*:\s*(\d+)') { $w = [int]$Matches[1] }
+        $rel = ConvertTo-RepoRelative -Path $f.FullName -RepoRoot $repo
+        # A change's model delta sits at CONTEXT level and its delta-spec at FEATURE level,
+        # so the spec of another open change is found by walking the context's features
+        # rather than assuming it belongs to this one.
+        $sRel = ''
+        $sHit = @(Get-ChildItem -Path (Join-Path $ctx ('*/changes/{0}/delta-spec.md' -f $other)) -File -ErrorAction SilentlyContinue | Sort-Object FullName)
+        if ($sHit.Count -gt 0) { $sRel = ConvertTo-RepoRelative -Path $sHit[0].FullName -RepoRoot $repo }
+        $row = [ordered]@{ cr_id = $other; file = $rel; wave = $w; delta_spec = $sRel }
+        if ($w -lt $wave) {
+            $pred += $rel; $predRows += $row
+            if ($sRel) { $predSpecs += $sRel }
+        } else { $sib += $rel; $sibRows += $row }
+    }
+    Write-Json ([ordered]@{
+        cr_id = $crId; cr_dir = (ConvertTo-RepoRelative -Path $crDir -RepoRoot $repo); exists = (Test-Path $crDir)
+        delta_spec = (ConvertTo-RepoRelative -Path $dspec -RepoRoot $repo); delta_spec_exists = (Test-Path $dspec)
+        delta_model = (ConvertTo-RepoRelative -Path $dmodel -RepoRoot $repo); delta_model_exists = (Test-Path $dmodel)
+        delta_backend_plan = (ConvertTo-RepoRelative -Path $be -RepoRoot $repo); delta_backend_plan_exists = (Test-Path $be)
+        delta_frontend_plan = (ConvertTo-RepoRelative -Path $fe -RepoRoot $repo); delta_frontend_plan_exists = (Test-Path $fe)
+        wave = $wave
+        context_dir = (ConvertTo-RepoRelative -Path $ctx -RepoRoot $repo)
+        domain_model = (ConvertTo-RepoRelative -Path $master -RepoRoot $repo); domain_model_exists = (Test-Path $master)
+        # Lower wave = committed to landing first, so this delta may plan on top of it.
+        predecessor_files = @($pred); predecessors = @($predRows); predecessor_count = $pred.Count
+        # Each predecessor's SPEC half. The model delta says what the domain becomes; the
+        # delta-spec says what behaviour asked for it, and a gate that checks one without
+        # the other cannot tell a realisation of a predecessor from an invention.
+        predecessor_specs = @($predSpecs)
+        # Both halves in one list, for a build_context `context_from:` (which takes one var).
+        predecessor_docs = @($pred + $predSpecs)
+        # Same or higher wave = nothing orders it against this one. Visible, never assumed.
+        sibling_files = @($sib); siblings = @($sibRows); sibling_count = $sib.Count
+    })
+}
+
+# ─────────────────────────── cr-overlap ────────────────────────────────────
+# Which OTHER open changes touch the same aggregates as this one — read off the
+# `## Aggregate: <Name>` headers of the pending model deltas, which is the merge unit
+# domain-model.md is organised by. Deterministic on purpose: two deltas collide when they
+# change the same aggregate, and that is a fact about two files' headings, so a regex
+# answers it exactly and the same way every run. Early warning, not enforcement — an
+# overlap is ordinary, and what matters is that the second change is PLANNED knowing about
+# the first. The relation follows the wave: a LOWER wave is a predecessor (a dependency to
+# declare), the SAME wave a sibling (a conflict to design around), a HIGHER wave a
+# successor (it plans on top of this change — information, not an obligation). Twin of
+# bash cmd_cr_overlap.
+#
+# The aggregate names one model delta declares, in the order it declares them. A
+# placeholder heading left by the template names no aggregate, so an unfilled model delta
+# reports none rather than colliding with every other change on "<Name>".
+function Get-DeltaAggregates {
+    param([string]$Text)
+    $out = @()
+    if (-not $Text) { return $out }
+    foreach ($m in [regex]::Matches($Text, '(?m)^##\s*Aggregate:\s*(.+?)\s*$')) {
+        $name = $m.Groups[1].Value.Trim().Trim('`')
+        if (-not $name -or $name.StartsWith('<') -or $name.StartsWith('[')) { continue }
+        if ($out -notcontains $name) { $out += $name }
+    }
+    return $out
+}
+
+function Invoke-CrOverlap {
+    param([string[]]$Rest)
+    $crId = ''; $fdArg = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+        }
+    }
+    $crId = Get-CrIdToken -Raw $crId
+    if (-not $crId) { Write-Error 'cr-overlap: --cr-id is required'; exit 1 }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'cr-overlap: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $mineTxt = Get-Content (Join-Path $ctx "domain-model.$crId.delta.md") -Raw -ErrorAction SilentlyContinue
+    $wave = [int](Get-WaveOf -FeatureDir $fd -CrId $crId -Repo $repo)
+    $mine = @(Get-DeltaAggregates -Text $mineTxt)
+    $rows = @(); $parts = @(); $npred = 0; $nsib = 0; $nsucc = 0
+    foreach ($f in @(Get-ChildItem -Path $ctx -Filter 'domain-model.*.delta.md' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
+        $other = $f.Name.Substring('domain-model.'.Length)
+        $other = $other.Substring(0, $other.Length - '.delta.md'.Length)
+        if ($other -eq $crId) { continue }
+        $t = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
+        $w = 1
+        if ($t -match '(?m)^\*\*Wave\*\*:\s*(\d+)') { $w = [int]$Matches[1] }
+        $shared = @(Get-DeltaAggregates -Text $t | Where-Object { $mine -contains $_ })
+        if ($shared.Count -eq 0) { continue }
+        if     ($w -lt $wave) { $relation = 'predecessor'; $npred++ }
+        elseif ($w -eq $wave) { $relation = 'sibling';     $nsib++  }
+        else                  { $relation = 'successor';   $nsucc++ }
+        $rows += [ordered]@{
+            cr_id = $other; wave = $w; relation = $relation
+            file = (ConvertTo-RepoRelative -Path $f.FullName -RepoRoot $repo)
+            aggregates = @($shared)
+        }
+        $parts += ('{0} (wave {1}, {2}): {3}' -f $other, $w, $relation, ($shared -join ', '))
+    }
+    Write-Json ([ordered]@{
+        cr_id = $crId; wave = $wave; aggregates = @($mine)
+        overlaps = @($rows); overlap_count = $rows.Count
+        predecessor_overlaps = $npred; sibling_overlaps = $nsib
+        successor_overlaps = $nsucc
+        # One line for a prompt: the model is told the fact, never asked to derive it.
+        overlap_report = $(if ($parts.Count -gt 0) { $parts -join '; ' }
+                           else { 'none — no other open change touches these aggregates' })
+    })
+}
+
+# ─────────────────────────── cr-activate ───────────────────────────────────
+# Point active_version.json.active_change at an OPEN change, changing nothing else — no
+# version bump, no wave restamp, no scaffold. Every delta stage after the plan phase still
+# resolves "the" change through active_change, so a CHOSEN delta has to reach them or they
+# would act on a different change than the one just planned.
+function Invoke-CrActivate {
+    param([string[]]$Rest)
+    $crId = ''; $fdArg = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+        }
+    }
+    $crId = Get-CrIdToken -Raw $crId
+    if (-not $crId) { Write-Error 'cr-activate: --cr-id is required'; exit 1 }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'cr-activate: no feature set and no --feature-dir'; exit 1 }
+    Invoke-ActiveVersion -FeatureDir $fd -Op 'activate' -CrId $crId
+}
+
+# ─────────────────────────── cr-wave ───────────────────────────────────────
+# Change a delta's wave after the fact — the ONLY supported way to move one, because the
+# wave is stamped into two documents that must agree.
+function Invoke-CrWave {
+    param([string[]]$Rest)
+    $crId = ''; $fdArg = ''; $wave = ''
+    for ($i = 0; $i -lt $Rest.Count; $i++) {
+        switch ($Rest[$i]) {
+            { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
+            { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
+            { $_ -in '--wave','-Wave' } { $wave = $Rest[++$i] }
+        }
+    }
+    if (-not $crId) { Write-Error 'cr-wave: --cr-id is required'; exit 1 }
+    if ($wave -notmatch '^\d+$') { Write-Error 'cr-wave: --wave must be a positive integer'; exit 1 }
+    $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
+    if (-not $fd) { Write-Error 'cr-wave: no feature set and no --feature-dir'; exit 1 }
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $dspec = Join-Path $fd "changes/$crId/delta-spec.md"
+    $dmodel = Join-Path $ctx "domain-model.$crId.delta.md"
+    $stamped = 0
+    if (Test-Path $dspec)  { Set-HeaderStamp -Path $dspec  -Name 'Wave' -Value $wave; $stamped++ }
+    if (Test-Path $dmodel) { Set-HeaderStamp -Path $dmodel -Name 'Wave' -Value $wave; $stamped++ }
+    if ($stamped -eq 0) { Write-Error "cr-wave: no delta documents found for '$crId'"; exit 1 }
+    Write-Json ([ordered]@{ cr_id = $crId; wave = [int]$wave; stamped = $stamped; delta_spec = $dspec; delta_model = $dmodel })
+}
+
 function Invoke-CrSetup {
     param([string[]]$Rest)
-    $crId = ''; $fdArg = ''; $title = ''; $force = ''
+    $crId = ''; $fdArg = ''; $title = ''; $force = ''; $wave = ''
     for ($i = 0; $i -lt $Rest.Count; $i++) {
         switch ($Rest[$i]) {
             { $_ -in '--cr-id','-CrId' } { $crId = $Rest[++$i] }
             { $_ -in '--feature-dir','-FeatureDir' } { $fdArg = $Rest[++$i] }
             { $_ -in '--title','-Title' } { $title = $Rest[++$i] }
+            { $_ -in '--wave','-Wave' } { $wave = $Rest[++$i] }
             { $_ -in '--force','-Force' } { $force = '1' }
         }
     }
-    if (-not $crId) { $crId = 'CR-' + (Get-Date -Format 'yyyyMMdd-HHmmss') }
+    # A random suffix, not the bare timestamp: two changes opened in the same second
+    # would otherwise collide on one id, and with parallel deltas that is reachable.
+    if (-not $crId) { $crId = 'CR-' + ((Get-Date).ToUniversalTime().ToString('yyyyMMdd-HHmmss')) + '-' + (Get-RandSuffix) }
     $repo = Get-RepoRoot; $fd = Resolve-FeatureDir -Arg $fdArg -RepoRoot $repo
     if (-not $fd) { Write-Error 'cr-setup: no feature set and no --feature-dir'; exit 1 }
-    # Single-active-change guard: open the change FIRST so a second concurrent CR on the
-    # same aggregate is refused BEFORE any changes/<cr>/ dir is scaffolded (no orphan
-    # left behind). Re-opening the same cr_id is a no-op. --force overrides.
+
+    # The context that owns the domain model — one level up from a nested feature, specs/
+    # itself for a flat one.
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    # Wave default = the highest wave already open, so a new delta is parallel with what
+    # is in flight unless it says otherwise.
+    if (-not $wave) { $wave = "$(Get-MaxOpenWave -ContextDir $ctx)" }
+    if ($wave -notmatch '^\d+$') { Write-Error 'cr-setup: --wave must be a positive integer'; exit 1 }
+    if ([int]$wave -lt 1) { $wave = '1' }
+
+    # MANY CHANGES MAY BE OPEN — the single-active guard is gone; open appends to the list.
     $avOpen = Invoke-ActiveVersion -FeatureDir $fd -Op 'open' -CrId $crId -Force $force
-    if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) {
-        Write-Error "cr-setup: refusing to open '$crId' — a change is already open on this feature; finish it (finalize-delta -> analyze-slice -> close-delta) first, or pass --force."
-        $avOpen
-        exit 1
-    }
+    $openCount = 1
+    try { $openCount = [int]((($avOpen | ConvertFrom-Json).open_count)) } catch { $openCount = 1 }
+
     $crDir = Join-Path $fd "changes/$crId"
     New-Item -ItemType Directory -Force -Path $crDir | Out-Null
-    $dspec = Join-Path $crDir 'delta-spec.md'; $ddesign = Join-Path $crDir 'delta-design.md'; $created = $false
+    # The SPEC half. The change's LANE PLANS are not scaffolded here: cr-setup runs in the
+    # spec phase, which knows nothing about which lanes are declared, and a plan document
+    # created for an undeclared lane would sit empty for the rest of its life. `plan`
+    # scaffolds them per declared lane (delta-plan-scaffold).
+    $dspec = Join-Path $crDir 'delta-spec.md'; $created = $false
     if (-not (Test-Path $dspec)) { $t = Resolve-NamedTemplate -Name 'delta-spec-template' -RepoRoot $repo; if ($t) { Copy-Item $t $dspec } else { New-Item -ItemType File -Force -Path $dspec | Out-Null }; $created = $true }
-    if (-not (Test-Path $ddesign)) { $t = Resolve-NamedTemplate -Name 'delta-design-template' -RepoRoot $repo; if ($t) { Copy-Item $t $ddesign } else { New-Item -ItemType File -Force -Path $ddesign | Out-Null }; $created = $true }
-    Write-Json ([ordered]@{ cr_id = $crId; cr_dir = $crDir; delta_spec = $dspec; delta_design = $ddesign; title = $title; created = $created })
+    # The model half, BESIDE the master model rather than inside the change directory, so
+    # every other open delta can see it while planning.
+    $dmodel = Join-Path $ctx "domain-model.$crId.delta.md"
+    if (-not (Test-Path $dmodel)) {
+        New-Item -ItemType Directory -Force -Path $ctx | Out-Null
+        $t = Resolve-NamedTemplate -Name 'delta-domain-model-template' -RepoRoot $repo
+        if ($t) { Copy-Item $t $dmodel } else { New-Item -ItemType File -Force -Path $dmodel | Out-Null }
+        $created = $true
+    }
+    # Scripts stamp ids, dates and the wave — the model never writes them.
+    Set-HeaderStamp -Path $dspec  -Name 'Wave' -Value $wave
+    Set-HeaderStamp -Path $dmodel -Name 'Wave' -Value $wave
+
+    Write-Json ([ordered]@{
+        cr_id = $crId; cr_dir = $crDir; delta_spec = $dspec
+        delta_model = $dmodel; context_dir = (ConvertTo-RepoRelative -Path $ctx -RepoRoot $repo)
+        wave = [int]$wave; open_count = $openCount; title = $title; created = $created
+    })
 }
 
 function Invoke-CrArchive {
@@ -5312,8 +2999,20 @@ function Invoke-CrArchive {
         if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
         Move-Item $crDir $dest; $archived = $dest
     }
-    # Close the change in active_version.json (single version source): bump + clear.
-    $av = Invoke-ActiveVersion -FeatureDir $fd -Op 'close' | ConvertFrom-Json
+    # The delta's model half lives beside the context's master model, not inside the
+    # change directory, so archiving the directory does not carry it along. Move it into
+    # the same archive: its changes are in domain-model.md by now, and leaving the pending
+    # file behind would keep showing a landed change as in-flight to every other delta.
+    $ctx = Get-ContextDirForFeature -FeatureDir $fd -Repo $repo
+    $dmodel = Join-Path $ctx "domain-model.$crId.delta.md"
+    if (Test-Path $dmodel) {
+        $destDir = Join-Path $archRoot $crId
+        New-Item -ItemType Directory -Force -Path $destDir | Out-Null
+        Move-Item -Force $dmodel (Join-Path $destDir 'domain-model.delta.md')
+    }
+    # Close THIS change in active_version.json (single version source): bump minor + drop
+    # it from open_changes. Other changes on the feature stay open.
+    $av = Invoke-ActiveVersion -FeatureDir $fd -Op 'close' -CrId $crId | ConvertFrom-Json
     Write-Json ([ordered]@{ ok = $true; archived_dir = $archived; version = $av.version; previous = $av.previous; closed_change = $av.closed_change })
 }
 
@@ -5343,10 +3042,13 @@ function Invoke-VersionStamp {
     [string[]]$stamped = @(); [string[]]$unchanged = @(); [string[]]$missing = @(); [string[]]$noHeader = @()
     # First `**Version**: <value>` line only — that is the header. The Change History
     # table's `| Version |` column head does not match this pattern.
-    # design.ui.md joins the spine where the feature has a UI half: the masters move in
+    # Each declared lane's plan joins the spine beside the spec: the masters move in
     # LOCKSTEP, so a document left behind at the old number is the one lie the version
-    # spine cannot tolerate. A feature without one reports it `missing` and nothing fails.
-    foreach ($name in @('spec.md', 'design.md', 'design.ui.md')) {
+    # spine cannot tolerate. A lane the feature does not have reports `missing` and nothing
+    # fails, which is also how the legacy names are carried — a feature not yet migrated to
+    # the plan names still gets stamped, and one that has been migrated reports the legacy
+    # pair missing.
+    foreach ($name in @('spec.md', 'backend-plan.md', 'frontend-plan.md', 'design.md', 'design.ui.md')) {
         $p = Join-Path $fd $name
         if (-not (Test-Path $p)) { $missing += $name; continue }
         $src = Get-Content -Raw -Encoding UTF8 $p
@@ -5381,40 +3083,32 @@ switch ($sub) {
     'lane-resolve'     { Invoke-LaneResolve      -Rest $rest }
     'lane-verify'      { Invoke-LaneVerify       -Rest $rest }
     'lane-probe'       { Invoke-LaneProbe        -Rest $rest }
+    'list-contexts'    { Invoke-ListContexts     -Rest $rest }
+    'set-context'      { Invoke-SetContext       -Rest $rest }
     'list-features'    { Invoke-ListFeatures     -Rest $rest }
     'set-feature'      { Invoke-SetFeature       -Rest $rest }
     'version-read'     { Invoke-VersionState 'read'  $rest }
     'version-init'     { Invoke-VersionState 'init'  $rest }
-    'spec-check'       { Invoke-SpecLedger 'check'  $rest }
-    'spec-stamp'       { Invoke-SpecLedger 'stamp'  $rest }
-    'ledger-append'    { Invoke-SpecLedger 'append' $rest }
-    'ledger-ids'       { Invoke-SpecLedger 'rowids' $rest }
-    'spec-snapshot'    { Invoke-SpecSnapshot    -Rest $rest }
-    'spec-diff'        { Invoke-SpecDiff        -Rest $rest }
-    'story-refs'       { Invoke-StoryRefs       -Rest $rest }
-    'slice-mode'       { Invoke-SliceMode       -Rest $rest }
-    'backlog-plan'     { Invoke-BacklogPlan     -Rest $rest }
-    'story-stamp'      { Invoke-StoryStamp      -Rest $rest }
-    'story-plan-check' { Invoke-StoryPlanCheck  -Rest $rest }
-    'story-plan-doc'   { Invoke-StoryPlanDoc    -Rest $rest }
-    'log-append'       { Invoke-LogAppend       -Rest $rest }
-    'ledger-read'      { Invoke-LedgerRead      -Rest $rest }
-    'spec-coverage'    { Invoke-SpecCoverage    -Rest $rest }
-    'spec-preserve'    { Invoke-SpecPreserve    -Rest $rest }
-    'spec-markers'     { Invoke-SpecMarkers     -Rest $rest }
+    'version-bootstrap-done' { Invoke-VersionState 'bootstrap-done' $rest }
     'feature-paths'    { Invoke-FeaturePaths     -Rest $rest }
     'design-scaffold'  { Invoke-DesignScaffold   -Rest $rest }
-    'plan-check'       { Invoke-PlanCheck        -Rest $rest }
-    'plan-stamp'       { Invoke-PlanStamp        -Rest $rest }
-    'gate-result'      { Invoke-GateResult      -Rest $rest }
-    'gate-read'        { Invoke-GateRead        -Rest $rest }
+    # The plan phase's name for the same op. Both spellings reach one implementation:
+    # --lane backend|frontend writes the plan documents, --lane service|ui the legacy names.
+    'plan-scaffold'    { Invoke-DesignScaffold   -Rest $rest }
+    'delta-plan-scaffold' { Invoke-DeltaPlanScaffold -Rest $rest }
     'build-compile'    { Invoke-BuildCompile     -Rest $rest }
     'test-run'         { Invoke-TestRun          -Rest $rest }
-    'test-diff'        { Invoke-TestDiff        -Rest $rest }
     'run-migrate'      { Invoke-RunMigrate       -Rest $rest }
     'deploy-dispatch'  { Invoke-DeployDispatch   -Rest $rest }
     'cr-setup'         { Invoke-CrSetup          -Rest $rest }
+    'cr-list'          { Invoke-CrList           -Rest $rest }
+    'cr-paths'         { Invoke-CrPaths          -Rest $rest }
+    'cr-overlap'       { Invoke-CrOverlap        -Rest $rest }
+    'cr-activate'      { Invoke-CrActivate       -Rest $rest }
+    'cr-wave'          { Invoke-CrWave           -Rest $rest }
     'cr-archive'       { Invoke-CrArchive        -Rest $rest }
+    'context-paths'    { Invoke-ContextPaths     -Rest $rest }
+    'model-scaffold'   { Invoke-ModelScaffold    -Rest $rest }
     'version-stamp'    { Invoke-VersionStamp     -Rest $rest }
     'checklist-read'   { Invoke-ChecklistRead    -Rest $rest }
     'checklist-apply'  { Invoke-ChecklistApply   -Rest $rest }