b2c-app-builder 0.221.39

package/catalog/generated/firstparty/knowledge/process/cascade-edges.yaml

@@ -0,0 +1,217 @@
+# cascade-edges.yaml — the Change Cascade Map as data.
+#
+# knowledge/process/change-cascade.md renders this same map as a table for humans.
+# This file is what check:change-cascade reads, so "check and update or
+# justify" stops being an honour system.
+#
+# Trust boundary, same as laneDependencies in tooling/lib/launch-state.ts:
+# this file ships WITH THE SKILL and is never copied into a business repo. A
+# launch run records touched surfaces through the reducer in state/business-state.json
+# at `lanes.post_launch_ops.changeCascade`; it cannot edit the edge set that grades it.
+#
+# When change-cascade.md's table changes, change this file in the same edit.
+# Every surface id used below must exist in `surfaces`.
+
+schema_version: "2"
+
+# The surface inventory a B2C mobile launch maintains
+# (change-cascade.md "Surface Inventory").
+surfaces:
+  app_in_app:
+    label: "App (in-app)"
+    covers: "onboarding copy/flow, core feature UI + copy, paywall copy + plan labels, settings, empty/error states, push/notification copy"
+  asc_listing:
+    label: "App Store Connect listing"
+    covers: "name, subtitle, promotional text, description, keyword field, What's New, screenshots + caption overlays, App Preview, App Icon, in-app events, custom product pages, and every localization of all of the above"
+  google_play_listing:
+    label: "Google Play listing"
+    covers: "name, short and full descriptions, screenshots, feature graphic, promo video, custom store listings, promotional content, and localizations"
+  asc_products:
+    label: "App Store Connect products"
+    covers: "IAP/subscription display names + descriptions, promoted-IAP promotional images, pricing, intro/trial offers, App Review Information notes"
+    evidence_dimensions: [product]
+  google_play_products:
+    label: "Google Play products"
+    covers: "one-time products and subscriptions, base plans, offers, localized names and descriptions, prices, tags, and review notes"
+    evidence_dimensions: [product, locale]
+  revenuecat_billing:
+    label: "RevenueCat / billing"
+    covers: "offering/package/product display names, paywall configuration, entitlement identifiers, Stripe/web-funnel product copy and prices"
+  landing_web:
+    label: "Landing / web"
+    covers: "hero, method/how-it-works, optional web onboarding, FAQ, pricing, footer, app screenshots, metadata, Open Graph, JSON-LD, robots.txt, llms.txt, and sitemap.xml"
+    evidence_dimensions: [locale]
+  landing_onboarding:
+    label: "Landing onboarding"
+    covers: "web qualification/onboarding steps, questions, branching, consent, completion state, and handoff into install, waitlist, or purchase"
+  seo_geo:
+    label: "SEO / GEO"
+    covers: "target keywords, citability content, brand-entity signals"
+  lifecycle_email:
+    label: "Lifecycle email"
+    covers: "transactional + lifecycle templates, brand tokens, plan/price/feature mentions"
+  analytics:
+    label: "Analytics"
+    covers: "event names, funnel/dashboard definitions, attribution sources"
+  legal:
+    label: "Legal"
+    covers: "privacy policy, terms, App Privacy answers, Data safety"
+  content_ugc_ads:
+    label: "Content / UGC / ads"
+    covers: "ad creative, demo videos, screenshots reused in ads, creator scripts"
+    evidence_dimensions: [asset]
+
+# Change type -> surfaces that must be updated or explicitly justified as
+# unaffected. Mirrors the change-cascade.md "Change Cascade Map" rows; the
+# `mirrors` field names the row so drift between the two is visible.
+change_types:
+  design_contract_lock:
+    label: "Design contract accepted"
+    mirrors: "Design contract accepted"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - revenuecat_billing
+      - landing_web
+      - landing_onboarding
+      - seo_geo
+      - lifecycle_email
+      - analytics
+      - legal
+      - content_ugc_ads
+    notes: "create the baseline as soon as DESIGN.md is accepted; build the local landing site while app implementation runs; mark price and product surfaces unaffected or blocked when they do not apply yet"
+
+  feature_change:
+    label: "Feature added / changed / removed"
+    mirrors: "Feature added / changed / removed"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - landing_web
+      - landing_onboarding
+      - seo_geo
+      - lifecycle_email
+      - analytics
+      - legal
+      - content_ugc_ads
+    notes: "legal only when the change introduces new data collection or a new SDK — justify it as unaffected otherwise"
+
+  lexicon_change:
+    label: "Core copy / feature name / brand vocabulary change"
+    mirrors: "Core copy / feature name / brand vocabulary change (lexicon)"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - revenuecat_billing
+      - landing_web
+      - landing_onboarding
+      - lifecycle_email
+      - content_ugc_ads
+    notes: "run the Lexicon Lock sweep from flow-traceability.md — grep every surface that names the term and update them together, including landing component files, <meta> description, and JSON-LD description/FAQ blocks"
+
+  onboarding_change:
+    label: "Onboarding flow change"
+    mirrors: "Onboarding flow change"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - analytics
+      - landing_web
+      - landing_onboarding
+    notes: "asc_listing covers the screenshot set and App Preview when they show onboarding; analytics covers activation events/funnels and review-prompt timing"
+
+  pricing_change:
+    label: "Paywall / pricing / plan / trial change"
+    mirrors: "Paywall / pricing / plan / trial change"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - revenuecat_billing
+      - landing_web
+      - legal
+      - lifecycle_email
+      - analytics
+    notes: "legal covers auto-renew and price disclosure in terms; lifecycle_email covers trial/renewal/win-back"
+
+  visual_change:
+    label: "Visual / UI / design-token change"
+    mirrors: "Visual / UI / design-token change"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - landing_web
+      - lifecycle_email
+      - content_ugc_ads
+    notes: "app_in_app is the change itself, not a downstream effect — the in-app UI updates first, everything else re-renders or re-describes it; store screenshots and App Preview need a re-render, not a doc edit; App Icon too when the brand mark changed"
+
+  iap_product_change:
+    label: "New / renamed IAP or subscription product"
+    mirrors: "New / renamed IAP or subscription product"
+    cascade_to:
+      - revenuecat_billing
+      - asc_products
+      - google_play_products
+      - asc_listing
+      - google_play_listing
+      - app_in_app
+      - legal
+      - analytics
+    notes: "asc_products carries the promoted-IAP promotional image (unique per product, never the app icon) and the App Review Information notes; asc_listing is check-and-justify because the app description, keyword field, or in-app-event copy sometimes names the plan/tier — usually unaffected, but the product name change makes it worth a look rather than an assumption"
+
+  privacy_change:
+    label: "Privacy / data / SDK change"
+    mirrors: "Privacy / data / SDK change"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - legal
+      - analytics
+      - landing_web
+      - lifecycle_email
+      - content_ugc_ads
+    notes: 'app_in_app covers PrivacyInfo.xcprivacy and required-reason APIs; legal covers App Privacy answers, Play Data safety, privacy policy and terms; asc_products covers App Review notes for external services; asc_listing is check-and-justify because the app description or keyword field can carry a privacy claim (e.g. "no ads", "no tracking") that a new SDK invalidates'
+
+  domain_brand_change:
+    label: "Domain / brand / company-name change"
+    mirrors: "Domain / brand / company-name change"
+    cascade_to:
+      - app_in_app
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - revenuecat_billing
+      - landing_web
+      - seo_geo
+      - lifecycle_email
+      - content_ugc_ads
+      - legal
+    notes: "everything in lexicon_change plus email sender domains, legal entity references, landing footer, and App Store seller/marketing URLs"
+
+  generated_asset_change:
+    label: "Change affecting generated assets"
+    mirrors: "Design token / feature / copy / pricing change affecting generated assets"
+    cascade_to:
+      - content_ugc_ads
+      - asc_listing
+      - google_play_listing
+      - asc_products
+      - google_play_products
+      - lifecycle_email
+      - landing_web
+    notes: "generated assets embed tokens, feature names, copy, and pricing at generation time — regenerate per the Generated-Asset Regeneration table in change-cascade.md, record each new asset in CONTENT_ASSETS.md, and mark prior entries status:superseded. Generated output is supporting art only and never substitutes for truthful real app UI"

package/catalog/generated/firstparty/knowledge/process/change-cascade.md

@@ -0,0 +1,102 @@
+# Change Cascade
+
+A B2C app change rarely affects only one surface. A feature rename can make store, landing, paywall, billing, and screenshot content stale.
+
+This reference is the impact checklist. List each affected surface. Update it or record why the change does not affect it.
+
+Use this reference when `DESIGN.md` is first accepted. This first run creates the public-surface baseline.
+
+Use it again after each app, product, brand, copy, price, product, or data change. Do not wait for public assets to exist.
+
+Run the affected work while the next app slice continues. Use the Lexicon Lock in [`flow-traceability.md`](./flow-traceability.md).
+
+## Surface Inventory
+
+The full set of surfaces a B2C mobile launch maintains. A cascade check walks the relevant rows of this list.
+
+- **App (in-app):** onboarding copy/flow, core feature UI + copy, paywall copy + plan labels, settings, empty/error states, push/notification copy.
+- **App Store Connect listing:** name, subtitle, promotional text, description, keywords, What's New, screenshots, App Preview, App Icon, events, custom product pages, and localizations.
+- **Google Play listing:** name, short and full descriptions, screenshots, feature graphic, promo video, custom store listings, events, and localizations.
+- **App Store Connect products:** IAP/subscription **display names + descriptions**, **promoted-IAP promotional images** (unique per product, never the app icon — see `app-store-connect-cli.md`), pricing, intro/trial offers, **App Review Information notes**.
+- **Google Play products:** one-time products, subscriptions, base plans, offers, localized names and descriptions, prices, tags, and review notes.
+- **RevenueCat / billing:** offering/package/product display names, paywall configuration, entitlement identifiers, Stripe/web-funnel product copy and prices.
+- **Landing / web:** hero, method, optional web onboarding, FAQ, prices, footer, metadata, Open Graph, JSON-LD, crawler files, and app screenshots.
+- **Landing onboarding:** qualification questions, branches, consent, completion state, and install, waitlist, or purchase handoff when applicable.
+- **SEO / GEO:** target keywords, citability content, brand-entity signals.
+- **Lifecycle email:** transactional + lifecycle templates, brand tokens, plan/price/feature mentions.
+- **Analytics:** event names, funnel/dashboard definitions, attribution sources.
+- **Legal:** privacy policy, terms, App Privacy answers, Data safety — when data collection, third-party SDKs, or account behavior changes.
+- **Content / UGC / ads:** ad creative, demo videos, screenshots reused in ads, creator scripts.
+
+## Change Cascade Map
+
+For each change type, the surfaces most likely to need an update. Treat these as "check and update or justify," not "always edit."
+
+This table has a machine-readable twin: [`cascade-edges.yaml`](./cascade-edges.yaml) carries the same surface inventory and the same change-type edges as data, and `check:change-cascade` grades recorded cascades against it. **Change both in the same edit** — the YAML's `mirrors` field names the row each change type comes from, so drift is visible.
+
+Record each change in `state/business-state.json` at
+`lanes.post_launch_ops.changeCascade`. Each record has `id`, all applicable
+`types`, `recorded_at`, and `surfaces`. A surface records its status and evidence
+or reason. For example, a lexicon change can record `app_in_app` as updated with
+`product/ONBOARDING.md` evidence and `content_ugc_ads` as unaffected because no
+ad creative uses the term. Add per-locale or per-product `variants` when those
+dimensions apply. Write through the reducer; do not add a top-level duplicate.
+
+Every surface in the union of all recorded change types must be accounted for: `updated` needs `evidence`, `unaffected` needs a `reason`, and `blocked` needs a `blocker`. Surfaces with locale, product, device, product-page, or asset dimensions need one `variants` evidence row for each applicable value. A surface left out by omission fails the gate as `change_cascade.<id>.<surface>.unaccounted` — which is the `change-cascade-incomplete` failure card, caught mechanically instead of at review time. The edge set ships with the skill and is never copied into a business repo, so a launch run records against the map but cannot edit it.
+
+| Change type                                                                   | Cascade to                                                                                                                                                                                                                                                                                             |
+| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Design contract accepted**                                                  | app → landing and optional web onboarding → Apple and Google Play product pages → screenshot plans → marketing assets → lifecycle email → prices and products when applicable                                                                                                                          |
+| **Feature added / changed / removed**                                         | app → Apple and Google Play descriptions, keywords, release notes, screenshots, previews, events, and custom pages → landing → GEO/SEO → email → analytics → legal when needed → ads                                                                                                                   |
+| **Core copy / feature name / brand vocabulary change** (lexicon)              | every surface that uses the term: app, onboarding, paywall, both stores, landing, schema, billing products, email, and ads                                                                                                                                                                             |
+| **Onboarding flow change**                                                    | app onboarding → Apple and Google Play screenshot sets → previews → activation analytics → review timing → landing method and web onboarding                                                                                                                                                           |
+| **Paywall / pricing / plan / trial change**                                   | paywall → store screenshots and products → billing → web funnel → landing prices → terms → lifecycle email → revenue analytics                                                                                                                                                                         |
+| **Visual / UI / design-token change**                                         | app → Apple and Google Play screenshots and previews → icons and feature graphics → landing → email tokens → ads → `DESIGN.md`                                                                                                                                                                         |
+| **New / renamed IAP or subscription product**                                 | RevenueCat product+entitlement+offering → App Store product display name/description/**promo image** → App Store listing (check whether the app description, keyword field, or in-app-event copy names the plan/tier) → paywall copy → pricing/terms → analytics product IDs → review notes            |
+| **Privacy / data / SDK change**                                               | `PrivacyInfo.xcprivacy` + required-reason APIs → App Privacy answers → Play Data safety → privacy policy + terms → App Review notes (external services) → App Store listing (check for an invalidated claim, e.g. "no ads"/"no tracking", in the description or keyword field) → analytics/attribution |
+| **Domain / brand / company-name change**                                      | everything in "lexicon" + email sender domains + legal entity references + landing footer + App Store seller/marketing URLs                                                                                                                                                                            |
+| **Design token / feature / copy / pricing change affecting generated assets** | all Higgsfield-generated surfaces that carry the changed token → see **Generated-Asset Regeneration** below                                                                                                                                                                                            |
+
+## Generated-Asset Regeneration
+
+Higgsfield-generated assets embed design tokens, feature names, copy, and pricing at generation time. When any locked token changes, every previously-generated asset that carries it is **stale** and must be regenerated before the change is considered done.
+
+**Stale-trigger changes:** locked design token (palette, typography, illustration style), feature addition/removal/rename, brand vocabulary or copy change, pricing/offer change.
+
+**Surfaces that go stale:**
+
+| Surface                                                                                             | Regeneration path                                                                                                                                                                       |
+| --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Ad creative** (UGC video, DTC static, Marketing Studio)                                           | See the **App Store URL → UGC Ad Batch (Click-to-Ad)** and **Soul-Once Founder-Face Ads** recipes in `tool-recipes/visual-and-motion-production.md`                                     |
+| **Screenshot supporting art** (backgrounds, mascots, illustration overlays — not the real-UI layer) | See the **Cheap-First Direction** recipe in `tool-recipes/visual-and-motion-production.md`; real-UI screenshot layer is re-rendered separately per the Visual/UI row in the cascade map |
+| **App Preview B-roll** (motion backdrops, intro/outro art — NOT the real app footage layer)         | See the **Master → All Platforms** recipe in `tool-recipes/visual-and-motion-production.md`; real app footage source must remain unchanged                                              |
+| **Promoted-IAP promotional images**                                                                 | See the **Cheap-First Direction** recipe in `tool-recipes/visual-and-motion-production.md`; re-upload via `app-store-connect-cli.md` after founder approval                             |
+| **CPP and in-app-event art**                                                                        | See the **Seasonal restyle Refresh** recipe in `tool-recipes/visual-and-motion-production.md` as a model; re-upload via `app-store-connect-cli.md` after founder approval               |
+| **Viral share cards**                                                                               | See the **Cheap-First Direction** recipe in `tool-recipes/visual-and-motion-production.md`; update `CONTENT_ASSETS.md` and linked `viral-growth-loops.md` surfaces                      |
+| **Lifecycle-email header art**                                                                      | See the **Cheap-First Direction** recipe in `tool-recipes/visual-and-motion-production.md`; update `resend-email-ops.md` template references                                            |
+
+**Guardrails that apply to every regeneration:**
+
+- Higgsfield output is supporting art only. It must **never substitute** for truthful real app UI in store screenshots or App Preview footage.
+- Every generation prompt must carry current `DESIGN.md` tokens. Regenerating without an updated brief defeats the purpose of a cascade.
+- Confirm spend with the founder per [`paid-tool-routing.md`](../operations/paid-tool-routing.md) before each generation run. Surface current credit balance (`mcp__claude_ai_Higgsfield__balance`) at the confirmation prompt.
+- Record every new asset in `CONTENT_ASSETS.md` with updated `prompt_brief`, `source_job_id`, and `virality_score` fields, and mark prior entries `status:superseded`.
+- Store uploads, ad launches, and public posting remain **founder-gated** regardless of regeneration trigger.
+
+## Process
+
+1. Classify the change with `types`. Use every applicable type and the union of their edges; never choose a convenient primary type to reduce the work.
+2. Start a read-only surface audit before the changed app slice merges.
+3. List each affected surface. Include each Tier 1 locale and each required store device size.
+4. Assign update tasks with disjoint file paths. Run them while the next app slice continues.
+5. Update each surface or record why it is not affected. Record a blocker when the source does not exist yet.
+6. Re-render derived assets. Do not use a document edit as proof of a screenshot or video update.
+7. Check canonical terms across the app, both stores, landing, schema, billing, and email.
+8. Record the cascade in `state/LAUNCH_TRACE.md` and `state/business-state.json`. Report the changed evidence and next action.
+9. Keep public deployment, store changes, prices, legal changes, and paid generation behind founder approval.
+
+## Done Definition
+
+A change is done only when each affected surface has a recorded result. Re-render each affected asset. Keep terms consistent across all surfaces.
+
+Record the cascade in state and trace files. Obtain founder approval before each protected public action.

package/catalog/generated/firstparty/knowledge/process/current-truth.md

@@ -0,0 +1,45 @@
+# Current Truth
+
+Use this after a provider or store action returns an authoritative read-back.
+Use this when reported status and readiness status must match reducer state.
+
+The engine keeps one current-truth document. The reducer is the only writer.
+The document is `state/current-truth.json`. Do not create it by hand.
+Run `reconcile` after a successful provider or store action.
+Do not change current-truth with a commit patch.
+
+## Rules
+
+A successful action with an authoritative read-back replaces the matching older blocker.
+The replace happens in one reducer transaction. Historical evidence stays on file.
+
+Expired evidence reopens the matching blocker. Missing evidence is not success.
+An unrelated action cannot clear a blocker outside its affected graph.
+
+A second reconcile with the same receipt and the same input hash is a no-op.
+The input hash covers every persisted evidence field, including summary.
+A later clock that expires a claim writes a new revision. It keeps the same receipt id.
+Export views refresh expired claims from the clock. They do not write the document.
+
+A reused evidence id must match the complete stored record. A different field is a conflict.
+
+## Claim status
+
+Founder-facing views name four statuses:
+
+- Active
+- Superseded
+- Expired
+- Unresolved
+
+Do not use internal words in founder-facing copy.
+
+Authority rank is provider read-back, then store receipt, then operator attestation, then derived projection.
+Same authority, same time, and a different payload hash is a conflict. Fail closed.
+An unparseable timestamp is unorderable. Fail closed.
+
+## Checks
+
+`check:agent-operations` compares the latest successful risky action with current truth.
+A later observe, blocked, or failed entry does not hide that risky action.
+It also compares every generated status view. Drift is a failure, not a warning.

package/catalog/generated/firstparty/knowledge/process/failure-cards.md

@@ -0,0 +1,114 @@
+# Failure Cards
+
+Use failure cards when a blocker or recurring launch risk needs to survive the current conversation. They are small, explicit, and testable.
+
+## Card Shape
+
+```yaml
+id: "posthog-person-property-missing"
+severity: "high"
+owner: "engineering-leader"
+status: "open"
+detected_at: "YYYY-MM-DD"
+evidence:
+  - "analytics/ANALYTICS.md"
+impact: "Attribution cannot be used in cohorts, dashboards, or lifecycle messaging."
+next_action: "Persist self_reported_source to PostHog person properties and backend profile, then verify."
+validator: "npm run check:attribution -- --root ."
+```
+
+Store detailed cards in `operations/FAILURE_CARDS.md`. Link them from the affected lane's evidence and blockers in `state/business-state.json`; do not duplicate the cards in state.
+
+## Provider Failure Cards
+
+Use these as defaults and specialize them to the current app.
+
+- **`doppler-config-name-and-credential-routing`** — (a) `doppler run --config` uses a name not confirmed from `SECRETS.md` or `doppler configs`; (b) `source` used on a non-POSIX env or credential file; (c) JavaScript template literals nested inside a double-quoted bash heredoc passed to `doppler run -- bash -lc`; (d) committed markdown contains awk/grep extraction snippet that prints a raw credential. Action: (a) Read `SECRETS.md` config map or run `doppler configs --project <name>` before any `doppler run` command — never guess; (b) replace `source` with `awk -F= '/^KEY=/{print $2}'` for single-value extraction; (c) use `doppler run -- node --input-type=module <<'NODE' ... NODE` (single-quoted heredoc) for JS that contains template literals; (d) remove extraction snippets from committed docs and replace with `doppler run --` command references; run `npm run check:secrets -- --root .`.
+- **`doppler-docs-stale`** — Doppler setup or service-token instructions rely on memory. Action: Refresh official docs and local CLI help, then update `SECRETS.md` with docs/version basis.
+- **`secret-routing-missing`** — new env var/key/webhook secret appears without `SECRETS.md` update. Action: classify public/server-only, provider location, command wrapper, CI injection, and rotation note.
+- **`security-release-lane-missing`** — launch-ready claim exists without `trust/SECURITY.md`, threat model, scanner/review route, platform hardening, incident response, and accepted-risk proof. Action: create `trust/SECURITY.md`, render `trust/security-review.html`, route paid/free security tools, run `check:security`, attach scanner/review proof or founder-approved blocked route.
+- **`security-tool-fallback-unapproved`** — Claude Security, Codex Security, GitHub Advanced Security, Snyk/Semgrep/Socket, MobSF Cloud, or commercial app-integrity route is replaced by a free route without approval. Action: stop, record route in `strategy/TOOL_DECISIONS.md` and `state/business-state.json`, ask for access/approval, then run the approved route.
+- **`posthog-person-property-missing`** — attribution only emits event. Action: set person property, backend/profile persistence, anonymous-to-identified reconciliation, and proof.
+- **`revenuecat-entitlement-unproven`** — products/offering exist but app access is not validated. Action: sandbox purchase/restore proves entitlement in app, RevenueCat, and backend/profile.
+- **`app-price-vs-iap-confusion`** — store pricing work begins and no explicit confirmation exists that the app container price is Free and any Lifetime offer uses a NON_CONSUMABLE IAP SKU. Action: surface the distinction before pricing work; verify app container price is Free; verify a NON_CONSUMABLE IAP product exists for each Lifetime offer in `revenue/REVENUE_OPS.md`/`store/STORE_CONSOLE.md`; run `npm run check:store-console -- --root .`.
+- **`stripe-webhook-unproven`** — Stripe checkout exists without webhook/idempotency proof. Action: verify webhook signature, idempotency, entitlement projection, and failure recovery.
+- **`resend-template-unbranded`** — email templates ignore `DESIGN.md` or legal footer. Action: map brand tokens, sender, support reply-to, unsubscribe, idempotency, and provider log proof.
+- **`sentry-unverified`** — SDK configured but no non-production event or alert proof. Action: send test event, verify release/environment tags, PII scrubbing, and alert routing.
+- **`asc-name-fallback-unapproved`** — ASC CLI proposes fallback app name. Action: stop, record collision, ask founder, update brand/store/screenshots/revenue docs if approved.
+- **`asc-command-guidance-stale`** — upstream ASC CLI or skill pack changes but references keep stale command families. Action: refresh Rork skill pack, local `asc --help`, official Apple docs, then update references/business/evals.
+- **`motion-contract-prose-only`** — UI work ships celebration/gesture/shared-element/press surfaces while the motion acceptance criteria in `premium-mobile-craft.md` and `motion-craft-benchmarks.md` were cited but never applied — default eases on earned moments, no Reduce Motion fallbacks, one-sided navigation transitions, no Animation Hitches profile. Action: load both references before building governed surfaces; apply the two-family spring canon and the recipe checklists as checkable items; wire shared-element transitions on both sides or decline to a deliberate fade; verify Reduce Motion on device; record an Instruments Animation Hitches pass on the oldest supported device; run `npm run check:motion-contract -- --workspace-root /path/to/business-workspace` from the skill source checkout or installed runtime package for contract and active-workspace consistency.
+- **`store-screenshots-raw-only`** — raw app captures are treated as final App Store screenshots. Action: create `SCREENSHOTS.md`, compose iPhone/iPad/App Store assets with copy overlays and design-system frames, validate dimensions/alpha/color space, attach visual QA, and keep upload founder-approved.
+- **`app-preview-hook-missing-or-generic`** — an iOS listing has no app preview video (the autoplay-muted hook that precedes screenshots), or the hook/screenshots are generic — not built from the Asset Knowledge Brief (target user/problem, magical moment, Emotional North Star + Experience Card) or not produced through the screenshot ASO skill. Action: in `SCREENSHOTS.md`, fill the Asset Knowledge Brief and App Preview Video (Autoplay Hook) sections; storyboard the first 3–5s muted hook to show the defining product moment first with a poster frame that sells; route screenshots + preview through `ParthJadhav/app-store-screenshots` / `ios-screenshots` / `app-preview-video` with real footage and `reframe` for resolutions; verify truthfulness; run `npm run check:store-screenshots -- --root .`.
+- **`apple-privacy-manifest-unproven`** — iOS App Store upload readiness is claimed without `store/APPLE_APP_STORE_REQUIREMENTS.md`, bundled `PrivacyInfo.xcprivacy`, required reason API audit, SDK manifest/signature inventory, Xcode privacy report, purpose strings, ATT decision, account deletion, review notes, and upload-warning status. Action: create the packet, reconcile official Apple docs with code/SDKs/App Privacy answers, add/verify `PrivacyInfo.xcprivacy`, run `npm run check:apple-requirements -- --root .`, and block ASC upload until resolved.
+- **`source-registry-url-untracked`** — new external docs/tool URL appears without `source-registry.yaml` entry. Action: run `check:source-freshness -- --write-discovered`, review candidate source, and commit registry update.
+- **`weekly-source-refresh-unreviewed`** — weekly bot treats discovered or changed sources as accepted policy without review. Action: keep PR blocked until capability analysis, reference/template updates, and LaunchBench pass.
+- **`eleven-star-experience-missing`** — product/design/build work starts without `11_STAR_EXPERIENCE.md`, visual ladder, line of feasibility, and complete product experience. Action: create the experience contract, render `11-star-experience.html`, update `PRODUCT.md`, `state/LAUNCH_TRACE.md`, `DESIGN.md`, `product/ONBOARDING.md`, and `engineering/TECH_SPEC.md`.
+- **`paid-user-acquisition-system-missing`** — paid growth is marked ready without `PAID_UA.md`, one-channel focus, creative cadence, baseline/blended report, RevenueCat LTV/CPA review, stop/scale rules, and founder spend approval. Action: create `PAID_UA.md`, select or defer one channel, define creative production, baseline and blended reporting, RevenueCat economics, store destination, founder gates, then run `npm run check:paid-ua -- --root .`.
+- **`viral-growth-loop-missing`** — social growth is marked ready from UGC ideas, views, or TikTok hooks without a product-led loop contract. Action: create `VIRAL_GROWTH.md`, define referral/share mechanics, abuse controls, format lab, monetization timing, analytics proof, and stop/scale rules.
+- **`orchestration-preflight-missing`** — broad launch, multi-lane build, or subagent-assisted work starts without `operations/ORCHESTRATION.md` and its recorded execution plan. Action: write the preflight, critical-path split, candidate units, strategy, serialized resources, and validator plan before dispatch or readiness claims.
+- **`parallel-file-overlap-unsafe`** — two parallel units edit the same file or shared resource without worktree isolation and serial integration. Action: serialize the units or isolate them in worktrees, then run actual file collision checks before integration.
+- **`subagent-forbidden-action-gap`** — a subagent is allowed to stage, commit, push, mutate providers, control devices, run full suites, submit builds, post publicly, or make founder-only decisions. Action: revise prompts, keep those actions orchestrator-owned, and record forbidden actions in `operations/ORCHESTRATION.md` and `state/business-state.json`.
+- **`subagent-findings-unintegrated`** — specialists return findings but state, failure cards, readiness docs, or validators are not updated. Action: accept/reject each finding, update source docs and failure cards, then run focused validators plus the full suite.
+- **`apple-signing-simulator-only`** — simulator build is treated as release readiness. Action: prove Team ID, signing, bundle ID/App ID, app record, certificate/profile, archive/export/upload/TestFlight.
+- **`apple-pre-upload-preflight-skipped`** — build archived and uploaded without running the pre-archive/export/upload preflight checklist — SDK keys not verified in Info.plist, `plutil -lint` not run on `PrivacyInfo.xcprivacy`, `NSPrivacyAccessedAPITypes` not scanned against UserDefaults/required-reason usage, exportArchive session-auth flags absent, or screenshot capture dimensions not verified before upload. Action: run the preflight checklist in `apple-signing-release.md` section "Pre-Archive/Export/Upload Preflight Checklist", record all five sign-off lines in `store/APPLE_SIGNING.md`, re-archive and re-upload only after all items pass.
+- **`aso-metadata-appkittie-unvalidated`** — keyword field is locked without AppKittie batch_keyword_difficulty / get_keyword_difficulty evidence, description field is < 2500 chars with no brevity rationale, or APP_STORE_LISTING.md artifact is missing after a metadata work session. Action: invoke AppKittie on the full keyword set, record difficulty/volume scores and selection rationale in `APP_STORE_LISTING.md`, expand description to ≥ 2500 chars with keyword-rich body copy and conversion paragraphs (or record a founder-approved brevity note), create `APP_STORE_LISTING.md`.
+- **`aso-metadata-stale-log-source`** — live ASC metadata audit reads a `build/*.log` file instead of running `asc metadata pull` while the ASC CLI is available. Action: run `asc metadata pull` (or the asc-metadata-sync read route), record the output path and diff timestamp in `APP_STORE_LISTING.md` or `store/STORE_CONSOLE.md`, then re-run the audit from live data.
+- **`google-play-data-safety-untraced`** — Data safety answers do not trace to actual SDK/data behavior. Action: map SDKs, data types, purposes, sharing, deletion, security, and Play Console fields.
+- **`cloudflare-routing-unverified`** — domain/email routing exists without DNS/HTTP/email proof. Action: verify HTTPS, DNS, security headers, routes, MX/TXT, and external email delivery.
+- **`landing-funnel-deploy-gates`** — landing page deployed with uncommitted git changes; browser-rendered form smoke test not done; Alpine CSP/x-model incompatibility not pre-checked; wrangler major version not current; Cloudflare API token scope not verified before first deploy. Action: satisfy all five pre-deploy gates (git clean, wrangler version, `wrangler whoami`, fresh build, deploy confirmed); run browser-rendered form smoke test to visible success state; audit Alpine event bindings for CSP compatibility before first deploy; then run `npm run check:landing-funnel -- --root .`.
+- **`paid-tool-routing-bypassed`** — any primary paid tool/tier (AppKittie, XPOZ, Higgsfield, Refero, MobAI Plus/Pro) was skipped or replaced without: (a) a ToolSearch check confirming the MCP path is absent, (b) founder confirmation when spend or coverage changes, and (c) a strategy/TOOL_DECISIONS.md entry with access status, tier, confirmation, route, and fallback limitation. Action: run ToolSearch for `mcp__<TOOLNAME>__*` to confirm absence, separate MobAI Free from Plus/Pro needs, ask the founder only for spend/coverage decisions, record the route, label fallback limits.
+- **`mobai-fallback-unapproved`** — MobAI missing and the agent uses XcodeBuildMCP or the in-app iOS Simulator without recording the dropped Android/repeatable-suite/CI/physical-device coverage; or the agent asks for spend approval even though MobAI Free — or the free built-in in-app simulator — covers the lane. Action: identify Free versus Plus/Pro requirements, name the rung actually used, record the coverage decision and Apple-only/simulator-only fallback limits before continuing.
+- **`mobai-v25-proof-conflated-or-unsafe`** — desktop/MCP/CLI versions are copied from one tag; Android proof is absent; an AI-healed flow skips diff review/rerun; or repeat/host-script actions are unbounded or secret-bearing. Action: refresh each component independently, run existing `.mob` flows on every supported platform, review healing diffs and rerun, cap loops, keep secrets outside compiled flows, record provider correlation, then run `npm run check:mobai-proof -- --root .`.
+- **`native-ios-proof-route-skipped`** — an iOS build/readiness/screenshot claim skips the in-app iOS Simulator (rung 0) when the session is on a local Mac and instead installs or asks for a heavier route, or ignores exposed native tools, or CLI proof skips SnapshotPreviews/serve-sim while still claiming native proof, or preview/simulator proof is treated as provider/signing/distribution readiness. Action: load `xcodebuildmcp-testing.md` and pick the lowest rung on the Route Ladder that produces the evidence; in Claude Code Desktop state the goal and use the simulator pane; in Codex call `session_show_defaults` then use exposed build/run/test/capture tools; for CLI proof record SnapshotPreviews `TEST_RUNNER_SNAPSHOTS_EXPORT_DIR` PNG/JSON outputs or serve-sim booted simulator URL/port when used; pair proof with `operations/PROVIDER_PROOF.md`; state preview/simulator/signing limits; run `npm run check:native-ios -- --root .`.
+- **`in-app-simulator-real-account-signin`** — an agent-driven simulator was signed into a real founder, customer, store, bank, or provider account — the agent's device screenshots are sent to the model provider and kept under normal conversation retention, so the credentials and account data left the machine. Action: stop the run; treat the exposed account as compromised and rotate its credentials; reset or delete the simulator device; re-run the flow on a fixture or sandbox account; record the fixture-account decision in `engineering/PRODUCTION_READINESS.md` and the incident in `trust/SECURITY.md`.
+- **`in-app-simulator-run-unreachable`** — a cloud, SSH, or container session claimed an in-app simulator run, but the agent is not on the Mac that owns the simulators, so the run could not have happened. Action: state the constraint plainly, mark the device proof blocked or route it to a local-Mac session, and never write simulator evidence paths that were not produced; run `npm run check:native-ios -- --root .`.
+- **`in-app-simulator-device-stale`** — a simulator reference was reused after the runtime shut the device down — devices the agent booted stop on app quit, session archive, or ~10 minutes after detach — and the agent retried against a device that no longer exists. Action: re-attach or relaunch the app to get a live device rather than retrying a stale reference; treat a shutdown between turns as expected, not as an app failure; re-capture any evidence taken from the dead session.
+- **`mobai-bridge-dropped`** — a build_run_sim or simulator relaunch invalidated the device registry and the agent retried stale UUIDs or skipped list_devices. Action: call list_devices after every build/relaunch; call start_bridge if device absent; never reuse a pre-build UUID.
+- **`mobai-onboarding-chain-unverified`** — 6+ onboarding steps were chained in a single DSL block without per-step screen verification, causing navigation to get stuck on the wrong screen. Action: follow the Onboarding-Flow Navigation Pattern in mobai-toolbelt.md: verify screen label before each step, do not pre-choreograph without a clean dry-run.
+- **`design-canonical-conflict`** — `design.md` or `DESIGN.md` labels a Higgsfield or other generated asset as "canonical visual target" while a locked native production component (SwiftUI, Flutter, React Native, etc.) is the founder's true canonical source, OR `CONTENT_ASSETS.md` manifest marks a generated asset `production`/`approved` when the native implementation is locked. Action: correct all "canonical visual target" labels to "concept" or "direction" in `design.md`; add a `visual_lock` block to `DESIGN.md`; update manifest `status` fields to `concept` or `direction`; keep the locked native component as the canonical source.
+- **`design-proof-missing`** — visual work exists without rendered HTML using tokens. Action: render `design/design-room.html`, retain any dedicated screenshot proofs, and update `state/business-state.json` evidence.
+- **`review-prompt-teardown-race`** — StoreKit/Play In-App Review request is triggered on an acceptance tap or any navigation action that dismisses the current screen, creating a view-teardown race. Action: move the trigger to fire automatically once a later, stable screen mounts and stays visible (1-2s async delay) -- eligibility may be earned during onboarding, but the request itself must wait for a later natural success in normal product use, outside first-run onboarding, never bound to any tap or navigation action that dismisses or navigates away from that screen; verify with a build run in the in-app iOS Simulator (rung 0), or MobAI/XcodeBuildMCP when the lane already owns one.
+- **`analytics-event-invented-without-catalog`** — new onboarding, coach, or tutorial event names are proposed or implemented without first cross-referencing `analytics/ANALYTICS.md`. Action: add the event to `analytics/ANALYTICS.md` explicitly before referencing it in implementation code or docs; verify no new snake_case event names appear in code that are absent from `analytics/ANALYTICS.md`.
+- **`copy-ip-sweep-altered-owned-brand-vocabulary`** — a copy rewrite targeting third-party IP risk also replaced or removed phrases owned by the product's brand voice (phrases in `DESIGN.md` §7 calibration set or `strategy/BRAND.md` owned-words list). Action: revert the brand-vocabulary changes; scope IP scanning to third-party names only; require founder approval for any changes to owned brand phrases.
+- **`landing-copy-compliance-failed`** — landing copy contains ranked-cohort claims, unshipped-feature promises, unverifiable authority/clinical endorsements, lifetime-access promises not in `revenue/REVENUE_OPS.md`, or scarcity claims without live enforcement — shipped or near-shipped without a pre-edit scan. Action: load `knowledge/growth/geo-seo.md` section 4 before the next edit, remove or evidence-back each claim, run `npm run check:landing-funnel -- --root .`, and block deploy until clean.
+- **`legal-contact-email-mx-unverified`** — privacy/legal/support email addresses were written into public pages or legal documents before MX records existed for that domain, resulting in non-operational inboxes at deploy time. Action: run `dig MX yourdomain.com +short` before writing contact addresses; if no MX records, use a tested fallback; update pages after MX is live; see `knowledge/growth/geo-seo.md` section 4a and `knowledge/trust/privacy-terms.md` section 5.
+- **`asc-review-information-missing`** — a build is submitted for App Review without the App Store Connect App Review Information Notes field populated, OR a no-login app is submitted without an explicit "no account / no demo needed" confirmation, causing a Guideline 2.1 "Information Needed" rejection and a lost review cycle. Action: populate the App Review Information Notes with purpose+audience, setup/access instructions, demo credentials (or an explicit no-login confirmation that also clears the demo-account-required flag), test devices+OS, external services, regional differences, and regulated-material proof; record the notes in `APP_STORE_LISTING.md`; set them via the ASC review-details route (refresh `asc <cmd> --help`); run `npm run check:store-console -- --root .`.
+- **`asc-promoted-iap-image-duplicate`** — a promoted in-app purchase or subscription uses a promotional image that is identical to the app icon, or the same image is reused across multiple promoted products, causing a Guideline 2.3.2 "Accurate Metadata" rejection. Action: give each promoted IAP/subscription a unique 1024×1024 promotional image that depicts that specific product (not the app icon and not a duplicate of another product's image); generate distinct on-brand images (Higgsfield, tied to `DESIGN.md`), replace each via the ASC IAP/subscription image route, or delete the promotional image if the product will not be promoted; re-verify in App Store Connect before resubmission.
+- **`asc-flag-drift`** — an agent uses an ASC CLI flag or subcommand form not confirmed by `asc <cmd> --help` or the Verified Command Cookbook (e.g. the nonexistent `asc validate app-store-version` form or another guessed flag), or retries a failed mutating command without consulting `--help`. Action: stop; run `asc <cmd> --help`; use the confirmed flag form (or the cookbook in `app-store-connect-cli.md`); never retry a mutating command more than once without confirmed flags; record the confirmed command in `store/STORE_CONSOLE.md`. Distinct from `asc-command-guidance-stale`, which covers upstream skill-pack changes.
+- **`native-sandbox-devserver-unreachable`** — Claude Code's native sandbox is active and a local dev server (Wrangler, Vite, Expo, serve-sim) fails with a listen EPERM error, or starts but stays unreachable. Action: set `sandbox.network.allowLocalBinding` to `true` in `.claude/settings.json` (macOS only), then restart the dev server; the failure message never names the sandbox, so check this setting before debugging the dev server itself.
+- **`revenuecat-missing-metadata-unresolved`** — an App Store subscription product exists but stays in MISSING_METADATA, so RevenueCat returns an empty offering while a build is marked paywall-ready. Action: create a subscription-group localization (display name + description) for each product, wait for Apple status to clear MISSING_METADATA, resubmit for review with founder approval, and block RevenueCat catalog mapping and paywall-ready claims until status is cleared.
+- **`revenuecat-product-type-mismatch`** — a lifetime/one-time unlock is mapped in RevenueCat as `non_renewing_subscription` instead of `non_consumable` (it may silently expire), or an RC product type does not match its App Store counterpart. Action: recreate the RC product with the correct type (App Store non-consumable → RC `non_consumable`; auto-renewable → RC `auto_renewable_subscription`), re-attach to the entitlement and offering, and prove a sandbox purchase grants the expected access.
+- **`revenuecat-debug-preview-masking`** — a debug build seeds paywall packages when RevenueCat returns empty, hiding a broken production paywall (zero packages / "Purchases unavailable") from developer testing. Action: audit the Release scheme for any code path that populates packages when the RC fetch returns nil/empty; run a Release-build paywall smoke check against sandbox — the in-app iOS Simulator (rung 0) is sufficient and fastest for this one-screen check; MobAI or XcodeBuildMCP when the lane already owns one — confirming `currentOffering?.packages` is non-empty before any TestFlight upload is marked paywall-ready.
+- **`doppler-auth-missing`** — Doppler is the selected secret provider but the shell is not authenticated (`doppler me` non-zero / `DOPPLER_TOKEN_MISSING`), so secret-bearing commands silently skip injection for an entire session. Action: run `doppler login` (founder/operator action), set up a service token for CI/non-interactive use, re-run `check:secrets`, and record auth proof in `SECRETS.md`; block secret-bearing work until `doppler me` exits 0.
+- **`founder-zero-operator-skipped`** — the agent assumes business-tool expertise, dumps a multi-platform checklist, asks the founder to choose the next lane, or stops at instructions even though it can operate. Action: load `founder-zero-operator.md`; create `operations/BUSINESS_ACCESS.md` plus its ledger; explain one founder action, record the immediate agent action, execute everything else, and run `check:founder-operator`.
+- **`founder-gate-jargon-no-choice`** — the agent names internal roles such as compensation, recruitment, moderator, retention, or qualified reviewer without definitions; presents a free-text blocker instead of selectable choices; omits the phase/outcome, consequences, or safe defer route; or defends a stale gate after a direct founder instruction. Action: re-present the decision through the Founder Question Contract: phase/outcome, plain-language definitions, AskUserQuestion with two or three choices and one recommendation, per-choice consequence/agent/evidence effect, safe skip/fallback/defer plus revisit trigger, and lifecycle reconciliation; run `check:founder-operator`.
+- **`doppler-browser-password-confusion`** — Doppler is described as browser password/passkey storage, or the founder is asked to paste a token, password, 2FA, or recovery code into chat. Action: stop; use secure Doppler login/value entry for automation secrets and platform delegation/OAuth/password manager/founder-authenticated sessions for browser login; preserve founder recovery/2FA and scan artifacts.
+- **`social-delegation-skipped`** — personal social credentials are shared or 2FA is weakened even though X Delegate, Meta task/business access, TikTok Business Center roles, YouTube permissions, or OAuth is available. Action: restore 2FA, revoke unsafe access, grant the narrowest revocable role/scope, verify exact account and role, and keep publish/spend under Agent Operations approval envelopes.
+- **`operator-stopped-after-access`** — account access was explained or configured but the agent did not verify it, update state, or continue into profile/content/research/support/analytics work. Action: read back exact access, update business/agent operations ledgers and state, then execute the recorded next business operation.
+- **`wrangler-toml-credentials-committed`** — `wrangler.toml`/`wrangler.json` `[vars]` (or another committed config) contains a real credential value (Supabase URL/key, API key) instead of a routed secret. Action: move the value to Cloudflare secrets (`wrangler secret put`) or Doppler-injected env vars, remove it from `[vars]`, audit git history for exposure, then run `npm run check:secrets -- --root .`.
+- **`project-state-stale-after-upload`** — a build is uploaded, a store-ops event occurs (custom product page, in-app event, iPad target, TestFlight group, app record), or an audit produces evidence, but `state/business-state.json` (`updated_at`, lane status/evidence, build fields) and `engineering/PRODUCTION_READINESS.md` are not updated to match. Action: update `state/business-state.json` `updated_at` and the affected lane status/evidence/build fields, write any stated `engineering/PRODUCTION_READINESS.md` evidence to the file, then commit; `npm run validate:launch-state -- --root .` is a partial structural check only and does not detect session-relative staleness.
+- **`test-suite-green-contracts-unproven`** — a unit/UI test suite shows all-pass and is cited as proof that paywall, RevenueCat offerings, or attribution work while those provider contracts are acknowledged broken or untested. Action: pair the green suite with backend/provider proof: RevenueCat returns ≥1 package and entitlement grants in app + dashboard, `self_reported_source` appears in PostHog person properties; attach the proof to `engineering/PRODUCTION_READINESS.md` before any paywall/attribution-ready claim.
+- **`asc-auth-not-set-up`** — an agent reports it "cannot access App Store Connect" (or marks an ASC lane blocked) when the `asc` CLI is installed and read access is healthy, but auth/app-record/cert is simply not set up yet — e.g. it gave up after `source <profile>.env` threw a shell error, or never checked for an existing keychain profile. Action: run the ASC Auth Setup And Recovery ladder in `app-store-connect-cli.md`: `asc auth doctor`; try an existing keychain profile (`asc --profile <Name>` — a team key reaches the apps its role permits, so verify with `apps list` rather than assuming); or set `ASC_KEY_ID`/`ASC_ISSUER_ID`/`ASC_PRIVATE_KEY_PATH` / `asc auth init`/`login`; treat a missing app record/cert as a founder-gated setup step with the exact next command, never as "cannot access ASC". A `403` is authorization, not setup — report the key scope, do not loop the ladder. The card applies only where the ladder can actually be run: from a knowledge-only connection with no shell, "not verified from this connection" is the correct report and is not this failure.
+- **`lane-done-on-unlocked-dependency`** — a lane is marked `done` while an upstream lane it depends on is still `not_started`, `partial`, or `blocked` — design signed off against a spec that is still moving, ASO metadata locked before the name, content assets rendered from unlocked design tokens, engineering called ready without a locked `engineering/TECH_SPEC.md`. Action: run `npm run check:lane-coverage -- --root .`; either advance the upstream lane to `done`/`not_needed`/`deferred`, or record a dated `lanes.<lane>.dependency_override` explaining why this lane is genuinely independent of the open upstream work. An override still present weeks later means the upstream never locked and the downstream evidence rests on a moving input — revisit rather than re-date. Edge set: `laneDependencies` in `tooling/lib/launch-state.ts`; contract: `knowledge/orchestration/project-state.md`.
+- **`change-cascade-incomplete`** — an app feature, copy, brand-term, pricing, or product change shipped without checking the surfaces it impacts (App Store listing/keywords/screenshots/captions, App Preview, in-app events, custom product pages, IAP/subscription display names + promo images, all localizations, landing page + meta/JSON-LD, SEO/GEO, lifecycle email, ASC review notes, RevenueCat product names, analytics event names). Action: run the Change Cascade Map in `knowledge/process/change-cascade.md`: enumerate the impacted surfaces for the change type, update each (or record why it is unaffected), re-render screenshots/listings where copy or UI changed, and reconcile the lexicon across surfaces before calling the change done. Record the result in `state/business-state.json` `lanes.post_launch_ops.changeCascade` and run `npm run check:change-cascade -- --root .`, which grades the entry against `knowledge/process/cascade-edges.yaml` and fails on any surface left unaccounted.
+- **`ethics-guardrail-violation`** — any applied Experience Card (Commitment, Variable Reward, Perceived Effort Delay, Intent Mirroring), streak, scarcity, social-proof, or rating-prompt mechanism is shipped without a complete Guardrail Contract attestation block — or a forbidden phrase (fake scarcity, confirmshaming, fabricated social proof, fake effort, spend prompt inside a grief screen) is found in a live artifact. Action: run `npm run check:emotional-design -- --root .`; fix every error before claiming any emotionally persuasive mechanism is launch-ready; see `knowledge/experience/ethics-guardrail.md` Guardrail Contract and Non-Negotiable Prohibitions.
+- **`zombie-app-no-kill-decision`** — the weekly ops rhythm runs indefinitely on a flat or declining app — MRR immaterial, cohorts deteriorating, founder hours out of proportion — and no day-30/day-90 checkpoint ever recorded a Kill, Hold, Or Scale verdict or put the continue-or-move-on question in front of the founder. Action: run the Kill-Or-Scale Review in `knowledge/operations/post-launch-operations.md` §9 at the day-30/day-90 retro checkpoints: assemble the evidence pack (MRR trend, cohort trend, CAC:LTV/payback, founder hours), present the verdict bands, record the founder's decision in `operations/LAUNCH_RETRO.md` and `lanes.post_launch_ops.kill_or_scale_decision`; `npm run check:post-launch -- --root .` fails a done lane whose retro has no verdict section.
+- **`ethics-dark-pattern-in-artifact`** — a live artifact doc contains a non-negotiable prohibited pattern: countdown that resets on reload, fabricated user counts, fake loading spinner, paywall inside a streak-break screen, confirmshaming opt-out label, pre-ticked subscription box, or hidden subscription terms. Action: remove or redesign the pattern; add the appropriate card attestation block with `dark_line` and `guardrail` fields; run `npm run check:emotional-design -- --root .`; block ship until zero errors.
+- **`emotional-design-system-missing`** — product, onboarding, core-loop, or paywall work proceeds toward build handoff while the 11-star target is 6-star or higher but no `EMOTIONAL_DESIGN.md` + `emotional-design.html` exist, so the experience has no engineered emotional layer and no card application map. Action: create `EMOTIONAL_DESIGN.md` from `business/product/experience/emotional-design/` and render `emotional-design.html`; map each magical moment to an Experience Card with a measurement event and bright-line guardrail; set `lanes.emotional_design`; run `npm run check:emotional-design -- --root .`; see `knowledge/experience/emotional-design-system.md`.
+- **`variable-reward-without-ethics-guardrail`** — a Variable Reward, Streak, Scarcity, Urgency, or Social Proof card is applied without the full HIGH-tier attestation: `ethics_attestation`, `user_control_escape_hatch`, `counter_metric`, and the mechanism-specific truthfulness proof (`reward_variation_proof` / `streak_recovery_mechanism` / `scarcity_enforcement_proof` / `social_proof_truthfulness_proof`). Action: complete the attestation block for the card in `EMOTIONAL_DESIGN.md`; wire the counter-metric into the PostHog Dark-Pattern Watch dashboard; prove real variation/recovery in `engineering/PRODUCTION_READINESS.md`; run `npm run check:emotional-design -- --root .` until zero errors — this is a compliance veto, not a polish item.
+- **`emotional-audit-prose-without-card-mapping`** — an emotional/UX audit returns narrative findings with no per-journey card mapping, no star-level, no counter-metric summary, and no concrete pathway-to-better-state, so findings cannot be integrated into the experience contract. Action: rebuild the audit in `EMOTIONAL_AUDIT.md`: enumerate every journey (Journey Discovery step), score each step through the six-lens review, map present/missing/misused cards (all four named cards or `experience_card:` blocks), and give each finding a sequenced pathway; run `npm run check:emotional-design -- --root .`.
+
+## Closing A Card
+
+A card can move to `resolved` only when:
+
+- the fix is implemented or the lane is explicitly deferred/not needed
+- evidence path or command proof is attached
+- downstream docs and `state/business-state.json` are updated
+- any founder approval is recorded
+
+Do not close a card by saying the issue is "noted."
+
+## Refresh
+
+Give each card a `last_reviewed` date next to `detected_at`. Flag a card unresolved after 180 days as an ejection candidate. Retire a card once a deterministic validator catches the failure automatically. Move a retired card to a dated archive section below; never delete a card outright.