baldart 4.16.2 → 4.17.1

package/framework/.claude/workflows/new2.js

@@ -1,12 +1,12 @@
 export const meta = {
   name: 'new2',
   description:
-    "EXPERIMENTAL workflow host for /new (A/B testing). Runs an ENTIRE backlog-card batch autonomously in the background runtime — pre-flight, per-card implement+review pipeline (sequential or team-mode parallel coders), cross-batch final review, and auto-merge — so subagent output never enters the main orchestrator context. Zero AskUserQuestion: each /new gate is a deterministic policy; blocking gates and scope-expanding findings are routed to the new2-resolve self-healing workflow, whose terminal is an auto-materialised follow-up card (nothing silently dropped). Agents Read /new's reference modules for review semantics (args.refModulesBase) so this script encodes only orchestration shape + gate policy. Claude-only.",
+    "EXPERIMENTAL workflow host for /new (A/B testing). Runs an ENTIRE backlog-card batch autonomously in the background runtime — pre-flight, a dependency-gated (DAG) per-card implement+review pipeline with specialized agents, cross-batch final review, and an integrity-gated auto-merge — so subagent output never enters the main orchestrator context. Zero AskUserQuestion: each /new gate is a deterministic policy; blocking gates and scope-expanding findings are routed to the new2-resolve self-healing workflow. Resilient by design: transient API errors are retried, a sustained outage degrades cleanly (durable resume), follow-ups for residuals are reconciled by the skill (offline-safe), and the merge is blocked unless the batch is verifiably complete (no false-DONE, no unreviewed code). Agents Read /new's reference modules for semantics (args.refModulesBase) so this script encodes only orchestration shape + gate policy. Claude-only.",
   phases: [
-    { title: 'Pre-flight', detail: 'deterministic workspace hygiene + worktree + cross-card grounding (Phase 0)' },
-    { title: 'Implement', detail: 'per-card implement+review pipeline; team-mode runs coders in parallel per wave' },
+    { title: 'Pre-flight', detail: 'deterministic workspace hygiene + worktree + dep-graph + cross-card grounding (Phase 0)' },
+    { title: 'Implement', detail: 'dependency-gated per-card implement+review pipeline with owner_agent + specialized review fan-out' },
     { title: 'Final', detail: 'cross-batch final review (delegates to new-final-review)' },
-    { title: 'Merge', detail: 'auto-merge to trunk via git.merge_strategy + cleanup' },
+    { title: 'Merge', detail: 'integrity-gated auto-merge to trunk via git.merge_strategy + cleanup' },
     { title: 'Production', detail: 'post-merge production-readiness checklist (Phase 7, non-blocking)' },
   ],
 }
@@ -21,12 +21,17 @@ export const meta = {
 //   refModulesBase string     dir holding /new reference modules (semantic SSOT)
 //   config         object     parsed baldart.config.yml (paths.*/stack.*/features.*/git.*)
 //   flags          { stats, effort, full }
+//   ts             string     ISO timestamp injected by the skill (Date.now() is unavailable here)
 //
 // return (consumed by the skill at Step 5):
-//   { report, perCardResults, gateLedger, residualFollowups, telemetry }
+//   { report, perCardResults, gateLedger, residualFollowups, telemetry, degraded, degradationReasons, residuals }
+//   `residuals` (materialized:false) is the OFFLINE-SAFE ledger of record — the skill writes
+//   any missing follow-up YAML and, if `degraded`, resumes via Workflow({scriptPath,resumeFromRunId}).
 // ───────────────────────────────────────────────────────────────────────────
 
-const a = args || {}
+// F-001/F-004 — tolerate args delivered as a JSON string (parse-or-default).
+let a = args || {}
+if (typeof a === 'string') { try { a = JSON.parse(a) } catch (_) { a = {} } }
 const cfg = a.config || {}
 const cardIds = Array.isArray(a.cardIds) ? a.cardIds : []
 const cardPaths = Array.isArray(a.cardPaths) ? a.cardPaths : []
@@ -35,29 +40,71 @@ const TRUNK = a.trunk || 'main'
 const METRICS = a.metricsDir || 'docs/metrics'
 const REF = (a.refModulesBase || '.claude/skills/new/references').replace(/\/$/, '')
 const FLAGS = a.flags || {}
+const TS = a.ts || ''
 const features = cfg.features || {}
 const paths = cfg.paths || {}
 const gitCfg = cfg.git || {}
 const highRisk = paths.high_risk_modules || []
 const mergeStrategy = gitCfg.merge_strategy || 'pr'
 
-// Mutable batch state — the workflow's variables ARE the tracker (kept out of the
-// main loop). Agents also write the on-disk /tmp/batch-tracker-<id>.md for recovery.
+// Mutable batch state — the workflow's variables ARE the tracker (kept out of the main loop).
 const firstCard = cardIds[0] || 'BATCH'
-const gateLedger = []       // { card, gate, decision, detail }
-const residualFollowups = []// { card, kind, followupCard, reason }
-const perCardResults = []   // structured per-card outcome
-let batchFatal = false      // set when a resolve() returns 'fatal' (unrecoverable)
-let prodReadiness = null    // Phase 7 result (post-merge, non-blocking)
+const gateLedger = []        // { card, gate, decision, detail }
+const residualFollowups = [] // { card, kind, followupCard, reason }
+const residuals = []         // F-020 OFFLINE-SAFE ledger: { card, kind, evidence, materialized }
+const perCardResults = []
+let batchFatal = false
+let prodReadiness = null
+let degraded = false
+const degradationReasons = []
+
+// F-019/F-032 — agent spawn accounting + cost capture (budget.spent() is the only
+// usage introspection available to the script; Date.now() is not).
+let agentCount = 0
+const tokensAtStart = (typeof budget !== 'undefined' && budget && typeof budget.spent === 'function') ? budget.spent() : null
+
+// F-009/F-028 — run-level dedup + accepted-deferral ledger (deterministic keys; no Date.now/Math.random).
+const resolvedSignatures = new Set()
+const acceptedDeferrals = new Set()
+function sig(card, gate, evidence) {
+  const e = String(evidence || '').toLowerCase().replace(/\s+/g, ' ').replace(/[0-9a-f]{7,40}/g, '#').trim().slice(0, 160)
+  return `${card}::${String(gate || '').toLowerCase()}::${e}`
+}
 
 function ledger(card, gate, decision, detail) {
   gateLedger.push({ card, gate, decision, detail: detail || '' })
   log(`gate[${card}] ${gate} → ${decision}${detail ? ' — ' + detail : ''}`)
 }
+function noteDegraded(reason) { degraded = true; if (!degradationReasons.includes(reason)) degradationReasons.push(reason) }
+
+// F-019 — transient-error classifier + bounded immediate retry. NOTE: there is no
+// reliable sleep/jitter in the workflow runtime, so this is NOT timed backoff — it
+// absorbs only brief blips. Sustained outages are handled by the OUTAGE state +
+// durable resume (F-012/F-020), not by retrying forever.
+const TRANSIENT = /overload|529|429|rate.?limit|5\d\d|econn|etimedout|timeout|temporar|unavailable/i
+function isTransient(e) { return TRANSIENT.test(String((e && e.message) || e || '')) }
+async function agentSafe(prompt, opts, maxAttempts) {
+  const cap = maxAttempts || 3
+  let lastErr = null
+  for (let i = 0; i < cap; i++) {
+    agentCount++
+    try {
+      // vary the label per attempt so retried spawns are individually visible
+      const o = i === 0 ? opts : Object.assign({}, opts, { label: `${(opts && opts.label) || 'agent'}~retry${i}` })
+      return await agent(prompt, o)
+    } catch (e) {
+      lastErr = e
+      if (!isTransient(e)) throw e // permanent error → surface immediately
+    }
+  }
+  const err = new Error('transient-exhausted: ' + String((lastErr && lastErr.message) || lastErr))
+  err.transientExhausted = true
+  throw err
+}
 
 if (!cardIds.length) {
   log('new2: no card IDs supplied — nothing to do.')
-  return emptyReturn('no cards supplied')
+  return emptyReturn('no-cards-supplied')
 }
 
 // ───────────────────────────────────────────────────────────────────────────
@@ -65,23 +112,40 @@ if (!cardIds.length) {
 // ───────────────────────────────────────────────────────────────────────────
 const PREFLIGHT_SCHEMA = {
   type: 'object',
-  required: ['ok', 'worktreePath', 'branch', 'baseline', 'executionMode', 'cards'],
+  required: ['ok', 'worktreePath', 'branch', 'baseline', 'executionMode', 'cards', 'cardGraph'],
   additionalProperties: false,
   properties: {
-    ok: { type: 'boolean', description: 'false only when the workspace cannot be made workable (e.g. baseline irrecoverable)' },
+    ok: { type: 'boolean' },
     worktreePath: { type: 'string' },
     branch: { type: 'string' },
-    port: { type: ['number', 'string'], description: 'dev port or "-"' },
+    port: { type: ['number', 'string'] },
     baseline: { enum: ['pass', 'fail'] },
     baselineLog: { type: 'string' },
     executionMode: { enum: ['sequential', 'team'] },
-    groups: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'team-mode waves: [{ level, cards:[ids] }]' },
-    cards: { type: 'array', items: { type: 'string' }, description: 'card ids cleared to run (invalid/blocked-dep excluded)' },
-    excluded: { type: 'array', items: { type: 'object', additionalProperties: true }, description: '[{ card, reason }] for G4/G5 exclusions' },
-    ownershipMapPath: { type: 'string', description: '/tmp path to the file-ownership map' },
-    crossCard: { type: 'string', description: 'distilled cross-card findings or PASS/SKIPPED/UNAVAILABLE' },
-    workspaceNote: { type: 'string', description: 'G1/G2 distilled (stash label, ff-pull, divergence left + reported)' },
-    archBaselinePaths: { type: 'array', items: { type: 'string' }, description: 'per-card /tmp/arch-baseline-<id>.md (for final-review dedup)' },
+    groups: { type: 'array', items: { type: 'object', additionalProperties: true } },
+    cards: { type: 'array', items: { type: 'string' }, description: 'card ids cleared to run' },
+    // F-021/F-024/F-025/F-016 — the dependency graph + per-card routing facts (the
+    // script cannot read YAML; the pre-flight agent supplies these).
+    cardGraph: {
+      type: 'array',
+      items: {
+        type: 'object', additionalProperties: true,
+        properties: {
+          id: { type: 'string' },
+          dependsOn: { type: 'array', items: { type: 'string' }, description: 'IN-BATCH deps only' },
+          ownerAgent: { type: 'string', description: 'coder|ui-expert|visual-designer|motion-expert (G25: unknown→coder)' },
+          reviewProfile: { enum: ['skip', 'light', 'balanced', 'deep'] },
+          // F-016 — ACs whose only implementation file is outside the card MAY-EDIT,
+          // pre-classified deferred-by-policy (never routed to resolve).
+          policyDeferredACs: { type: 'array', items: { type: 'object', additionalProperties: true } },
+        },
+      },
+    },
+    excluded: { type: 'array', items: { type: 'object', additionalProperties: true } },
+    ownershipMapPath: { type: 'string' },
+    crossCard: { type: 'string' },
+    workspaceNote: { type: 'string' },
+    archBaselinePaths: { type: 'array', items: { type: 'string' } },
   },
 }
 
@@ -91,12 +155,13 @@ const MERGE_SCHEMA = {
     merged: { type: 'boolean' },
     mergeCommit: { type: 'string' },
     mergeTs: { type: 'string' },
-    reconciliation: { type: 'string', description: 'Phase 6b/6c distilled (divergence left+reported, stash restore, sync markers)' },
+    reconciliation: { type: 'string' },
+    forcedDone: { type: 'array', items: { type: 'string' }, description: 'MUST be empty — false-DONE is forbidden (F-029)' },
+    uncommittedLeft: { type: 'boolean', description: 'true if dirty code was left (NOT committed) + reported (F-030)' },
     note: { type: 'string' },
   },
 }
 
-// Shared context fragment every per-card agent gets.
 const projectBrief = [
   `Main repo: ${MAIN}`,
   `Trunk: ${TRUNK}`,
@@ -106,35 +171,34 @@ const projectBrief = [
 ].filter(Boolean).join('\n')
 
 // ───────────────────────────────────────────────────────────────────────────
-// Phase Pre-flight (Phase 0 + Pre-flight) — ONE ops agent runs all the git-heavy,
-// deterministic workspace work (the script itself has no shell). Gate policies:
-//   G1 dirty-tree  → auto-stash (restore at merge); restore-conflict → leave+report
-//   G2 divergence  → behind: ff-pull; ahead/diverged: proceed on isolated worktree + report
-//   G3 cross-card cap unavailable → proceed + log CAPABILITY_UNAVAILABLE
-//   G4 card-field invalid → exclude that card + continue
-//   G5 depends-on (dep outside batch, not DONE) → exclude card + its dependents
-//   E2 baseline build fail → retry once inside the agent; surface baseline:fail
+// Phase Pre-flight — ONE ops agent runs all git-heavy work + returns the dep graph.
 // ───────────────────────────────────────────────────────────────────────────
 phase('Pre-flight')
-const preflight = await agent(
-  `You are the deterministic PRE-FLIGHT for an autonomous /new batch (variant new2). Follow ${REF}/setup.md (Phase 0 + Pre-flight) and ${REF}/implement.md (Phase 1 depends-on gate) for the SEMANTICS, but replace EVERY AskUserQuestion with the deterministic policy below. You run all git/bash yourself (the workflow cannot).\n\n` +
-    `${projectBrief}\n\nCards in batch (Read each YAML):\n${cardPaths.join('\n')}\nCard IDs: ${cardIds.join(' ')}\n\n` +
-    `Create/maintain the recovery tracker at /tmp/batch-tracker-${firstCard}.md (per setup.md § Context Tracking).\n\n` +
-    `DETERMINISTIC GATE POLICIES (NO user prompts):\n` +
-    `• G1 dirty-tree (main repo ${MAIN}): partition framework-managed noise exactly as setup.md step 3 ($METRICS=${METRICS}, .baldart/generated|state.json|skill-conflicts.json — NOT overlays/). If genuine user work remains → auto-stash 'baldart-new2-${firstCard}-<ts>' (main checkout, safe) and record the MESSAGE label for restore at merge. Never commit/abort/prompt.\n` +
-    `• G2 divergence vs origin/${TRUNK}: behind-only AND HEAD==${TRUNK} → ff-pull; ahead-genuine or diverged → DO NOT push/rebase/reset; proceed (the worktree is isolated) and put a one-line note in workspaceNote. Framework-management commits are auto-ignored (setup.md step 4 reclassification).\n` +
-    `• G3 cross-card grounding (setup.md 3d): run the Codex cross-card check with the provenance skip; on CODEX_NOT_FOUND fall back to code-reviewer; if BOTH unavailable → proceed and set crossCard='CAPABILITY_UNAVAILABLE'. Read the audit file ONLY via the [codex]-stripping filter; return DISTILLED findings. CRITICAL — if conflicts are FOUND you MUST APPLY them, not just report: FILE_CONFLICT / ORDER_RISK → force the conflicting cards SEQUENTIAL (encode this in executionMode/groups AND the ownership map); STATE_MUTATION → fold a warning into the affected cards via the ownership map. The returned executionMode/groups MUST already reflect these constraints.\n` +
-    `• G4 card-field validation (setup.md 1b/1c): a card missing requirements/acceptance_criteria/files_likely_touched → EXCLUDE it (add to excluded[] with reason); continue with valid cards. Never HALT the batch for one bad card.\n` +
-    `• G5 depends-on (implement.md Phase 1 step 2): if a card's depends_on names a card that is NOT DONE and is NOT in this batch → exclude that card AND, TRANSITIVELY, every in-batch card that depends on it (excluded[], reason 'depends_on <dep> not DONE'). GUARANTEE: the returned cards[] must contain NO card that transitively depends on an excluded card. If the dep IS in this batch, keep it and order it first.\n` +
-    `• Worktree (setup.md step 4): create ONE code worktree off ${TRUNK} (slug from git_strategy.branch or the parent/lead card title), install deps, assign a port, run the baseline (tsc+lint+build). Use the git-authoritative idempotency pre-check (step 4a2). E2: if baseline FAILS, fix-attempt once (the trunk itself may not build); if still failing return baseline:'fail' with baselineLog (the caller treats it as batch-fatal).\n` +
-    `• Complexity (setup.md 3c): decide executionMode sequential|team and, for team, the groups [{level,cards}]. Build the file-ownership map; write it to /tmp and return ownershipMapPath.\n` +
-    `• Persist per-card architecture baselines you gather to /tmp/arch-baseline-<CARD>.md and return archBaselinePaths (final review reuses them).\n\n` +
-    `Return the structured PREFLIGHT object. ok:false ONLY if the workspace is unworkable (baseline irrecoverable / worktree uncreatable).`,
-  { label: 'preflight', phase: 'Pre-flight', agentType: 'general-purpose', schema: PREFLIGHT_SCHEMA }
-)
+let preflight = null
+try {
+  preflight = await agentSafe(
+    `You are the deterministic PRE-FLIGHT for an autonomous /new batch (variant new2). Follow ${REF}/setup.md (Phase 0 + Pre-flight) and ${REF}/implement.md (Phase 1 depends-on gate) for the SEMANTICS, but replace EVERY AskUserQuestion with the deterministic policy below. You run all git/bash yourself (the workflow cannot).\n\n` +
+      `${projectBrief}\n\nCards in batch (Read each YAML):\n${cardPaths.join('\n')}\nCard IDs: ${cardIds.join(' ')}\n\n` +
+      `Create/maintain the recovery tracker at /tmp/batch-tracker-${firstCard}.md (per setup.md § Context Tracking).\n\n` +
+      `DETERMINISTIC GATE POLICIES (NO user prompts):\n` +
+      `• G1 dirty-tree (main repo ${MAIN}): partition framework-managed noise exactly as setup.md step 3 ($METRICS=${METRICS}, .baldart/generated|state.json|skill-conflicts.json — NOT overlays/). Genuine user work → auto-stash 'baldart-new2-${firstCard}' (main checkout) and record the label. Never commit/abort/prompt.\n` +
+      `• Worktree (setup.md step 4): create ONE code worktree off ${TRUNK}; install deps; assign a port; run the baseline (tsc+lint+build). Copy ONLY the artifacts needed (env/.env.local/.env.example/supabase/.temp) — do NOT bulk-copy untracked files from the main repo (avoids stray backlog cards in the worktree). Use the git-authoritative idempotency pre-check. E2: baseline FAILS → fix once; still failing → baseline:'fail' + baselineLog (batch-fatal).\n` +
+      `• G3 cross-card grounding (setup.md 3d): run the Codex cross-card check (provenance skip; CODEX_NOT_FOUND → code-reviewer; both unavailable → crossCard='CAPABILITY_UNAVAILABLE'). Read the audit ONLY via the [codex]-stripping filter; return DISTILLED findings. If conflicts FOUND you MUST APPLY them: FILE_CONFLICT/ORDER_RISK → force the cards SEQUENTIAL and encode it in dependsOn (the conflicting later card dependsOn the earlier).\n` +
+      `• G4 card-field validation (setup.md 1b/1c): card missing requirements/acceptance_criteria/files_likely_touched → EXCLUDE (excluded[] + reason). Never HALT for one bad card.\n` +
+      `• G5 depends-on: a card whose depends_on names a non-DONE card NOT in this batch → EXCLUDE it AND every in-batch card that transitively depends on it.\n` +
+      `• cardGraph (REQUIRED, F-021): for every runnable card return { id, dependsOn:[IN-BATCH deps only], ownerAgent (the card's owner_agent; G25 unknown→'coder'), reviewProfile (the card's review_profile; default 'balanced'), policyDeferredACs }.\n` +
+      `• F-016 AC↔ownership consistency: for each acceptance_criterion, derive the file(s) it requires editing. If those files are NOT a subset of the card's MAY-EDIT/files_likely_touched → add the AC to policyDeferredACs:[{n,text,owningCard|owningFile,reason}] (it will become ONE follow-up, never a resolve). Do the same for any AC whose remedy is an owner-gated infra action (remote db push / deploy / secret / DNS).\n` +
+      `• Complexity (setup.md 3c): decide executionMode sequential|team (+ groups for team). Build the file-ownership map → /tmp; return ownershipMapPath.\n` +
+      `• Persist per-card architecture baselines to /tmp/arch-baseline-<CARD>.md; return archBaselinePaths.\n\n` +
+      `Return the structured PREFLIGHT object. ok:false ONLY if the workspace is unworkable.`,
+    { label: 'preflight', phase: 'Pre-flight', agentType: 'general-purpose', schema: PREFLIGHT_SCHEMA }
+  )
+} catch (e) {
+  if (e && e.transientExhausted) { noteDegraded('outage'); ledger(firstCard, 'preflight', 'OUTAGE', 'transient API failure during pre-flight') }
+  return finalReturn({ fatal: true, reason: 'pre-flight failed: ' + String(e && e.message) })
+}
 
 if (!preflight || preflight.ok === false || preflight.baseline === 'fail') {
-  // E2 terminal — the only batch-fatal case: no workable tree.
   ledger(firstCard, 'E2-baseline', 'BATCH-FATAL', (preflight && preflight.baselineLog) || 'workspace unworkable')
   return finalReturn({ fatal: true, reason: 'baseline build irrecoverable — see baselineLog' })
 }
@@ -144,6 +208,9 @@ if (preflight.workspaceNote) ledger(firstCard, 'G1/G2-workspace', 'AUTO', prefli
 if (preflight.crossCard) ledger(firstCard, 'G3-cross-card', 'INFO', preflight.crossCard)
 
 const runnableCards = preflight.cards || []
+const cardGraph = preflight.cardGraph || []
+const graphById = {}
+for (const n of cardGraph) graphById[n.id] = n
 const sharedCtx = {
   worktreePath: preflight.worktreePath,
   branch: preflight.branch,
@@ -151,262 +218,394 @@ const sharedCtx = {
   archBaselinePaths: preflight.archBaselinePaths || [],
 }
 
+// F-016/F-010 — materialise ONE follow-up per policy-deferred AC up front; never resolve.
+for (const n of cardGraph) {
+  for (const ac of (n.policyDeferredACs || [])) {
+    residuals.push({ card: n.id, kind: 'policy-deferred-ac', evidence: `AC-${ac.n}: ${ac.text} (${ac.reason || 'out-of-ownership / owner-gated'})`, materialized: false })
+    acceptedDeferrals.add(sig(n.id, 'ac-unmet', `AC-${ac.n}: ${ac.text}`))
+    ledger(n.id, 'F016-policy-defer', 'DEFERRED-BY-POLICY', `AC-${ac.n} → follow-up (owner: ${ac.owningCard || ac.owningFile || '?'})`)
+  }
+}
+
+const pathById = {}
+cardIds.forEach((id, i) => { pathById[id] = cardPaths[i] || `${paths.backlog_dir || ''}/${id}.yml` })
+
 // ───────────────────────────────────────────────────────────────────────────
-// new2-resolve bridge — every blocking gate and every scope-expanding finding
-// goes here (Asse 1/2/3). Returns 'resolved' | 'followup' | 'fatal'.
+// new2-resolve bridge — dedup (F-009) + accepted-deferral skip (F-028) + group batching (F-007).
+// `findings` is a list; a single residual is a list of 1 (retro-compat). Returns 'resolved'|'followup'|'fatal'.
 // ───────────────────────────────────────────────────────────────────────────
+// F-038 — doc-domain findings are fixed in the doc tree, NOT the card's code MAY-EDIT.
+// Passing code-only ownership made the doc fixer edit docs/ "out of scope" and the JS
+// fabrication cross-check reject a correct, judge-approved fix → a wasted Tier-2 fan-out
+// (~150k tok) and a risk of a bogus follow-up for an already-resolved finding. Give doc
+// findings their real owner territory.
+function isDocDomain(d) { return /doc|wiki|ssot|readme/i.test(String(d || '')) }
+function domainMayEdit(dom, codeScope) {
+  if (!isDocDomain(dom)) return codeScope
+  const docPaths = [paths.docs_dir, paths.references_dir, paths.wiki_dir, paths.prd_dir].filter(Boolean)
+  return docPaths.length ? docPaths : codeScope // doc-only ownership; fall back to code scope if no doc paths configured
+}
+
 async function resolve(kind, card, evidence, extra) {
-  const res = await workflow('new2-resolve', {
-    kind,
-    cardId: card,
-    evidence,
-    worktreePath: sharedCtx.worktreePath,
-    mayEditPaths: (extra && extra.mayEditPaths) || [],
-    scopeFiles: (extra && extra.scopeFiles) || [],
-    domain: (extra && extra.domain) || 'code',
-    refModulesBase: REF,
-    config: cfg,
-  }).catch((e) => ({ status: 'followup', reason: 'resolve workflow error: ' + (e && e.message) }))
+  const s = sig(card, kind, evidence)
+  if (resolvedSignatures.has(s) || acceptedDeferrals.has(s)) {
+    ledger(card, 'resolve:' + kind, 'DEDUP-SKIP', 'already resolved/deferred this run')
+    return 'resolved'
+  }
+  resolvedSignatures.add(s)
+  const dom = (extra && extra.domain) || 'code'
+  let res
+  try {
+    res = await workflow('new2-resolve', {
+      kind, cardId: card, evidence,
+      findings: (extra && extra.findings) || [{ kind, evidence, domain: dom }],
+      worktreePath: sharedCtx.worktreePath,
+      mayEditPaths: domainMayEdit(dom, (extra && extra.mayEditPaths) || []),
+      scopeFiles: (extra && extra.scopeFiles) || [],
+      domain: dom,
+      refModulesBase: REF, config: cfg, ts: TS,
+    })
+  } catch (e) {
+    if (e && (e.transientExhausted || isTransient(e))) noteDegraded('outage')
+    res = { status: 'followup', reason: 'resolve workflow error: ' + String(e && e.message) }
+  }
   const status = (res && res.status) || 'followup'
   if (status === 'fatal') { batchFatal = true; ledger(card, 'resolve:' + kind, 'FATAL', (res && res.reason) || ''); return status }
-  if (status === 'followup' && res && res.followupCard) {
-    residualFollowups.push({ card, kind, followupCard: res.followupCard, reason: res.reason || '' })
+  if (status === 'followup') {
+    acceptedDeferrals.add(s) // F-028 — a deferred residual must not be re-routed by a later gate.
+    const fc = (res && res.followupCard) || null
+    residualFollowups.push({ card, kind, followupCard: fc || '(pending)', reason: (res && res.reason) || '' })
+    residuals.push({ card, kind, evidence, materialized: !!fc })
+  }
+  // F-022 — route out-of-scope findings the resolve surfaced.
+  for (const osf of (res && res.outOfScopeFindings) || []) {
+    residuals.push({ card, kind: 'out-of-scope', evidence: `${osf.file || ''}:${osf.line || ''} ${osf.evidence || ''}`, materialized: false })
   }
   ledger(card, 'resolve:' + kind, status, (res && (res.followupCard || res.reason)) || '')
   return status
 }
 
-// A crashed runCard (E1) routes through new2-resolve(agent-crash) for a specialist
-// retry, then ALWAYS lands as a tracked followup — never a silent drop.
-async function crashFollowup(id, e) {
-  const msg = String(e && e.message)
-  const s = await resolve('agent-crash', id, 'runCard crashed: ' + msg, { mayEditPaths: [], scopeFiles: [] })
-  if (s !== 'followup') residualFollowups.push({ card: id, kind: 'agent-crash', followupCard: '(specialist retry attempted — manual check)', reason: msg })
-  return { card: id, status: 'followup', gates: [{ gate: 'runCard', decision: 'ERROR', detail: msg }], commit: '-', telemetry: {} }
-}
-
 // ───────────────────────────────────────────────────────────────────────────
-// Per-card pipeline — sequences /new Phases 1→4 via agents that Read the modules.
-// Each phase agent returns a structured verdict; this function applies the
-// deterministic gate policy and routes blocks to new2-resolve.
+// Per-card pipeline. Returns a status the scheduler keys on:
+//   'committed' | 'followup' | 'epic-skipped' | 'pending'(transient, re-queue)
+// On any non-committed exit the worktree is restored clean (F-018 saga compensation).
 // ───────────────────────────────────────────────────────────────────────────
+async function rollbackCard(cardId, mayEdit) {
+  // F-018 — restore the card's files to HEAD so a failed card never poisons the next.
+  // Safe at file granularity because the DAG guarantees all deps are already committed
+  // (HEAD contains their work); this removes only THIS card's uncommitted changes.
+  try {
+    await agentSafe(
+      `In the worktree ${sharedCtx.worktreePath}, restore the working tree to a CLEAN state for a FAILED card: \`git restore --source=HEAD --worktree --staged -- ${(mayEdit || []).map((p) => `'${p}'`).join(' ') || '.'}\` then \`git clean -fd\` ONLY within the card MAY-EDIT paths. Do NOT touch other cards' committed work. Confirm \`git status --porcelain\` is empty for those paths.`,
+      { label: `rollback:${cardId}`, phase: 'Implement', agentType: 'general-purpose', model: 'haiku',
+        schema: { type: 'object', required: ['clean'], additionalProperties: true, properties: { clean: { type: 'boolean' }, note: { type: 'string' } } } }
+    )
+  } catch (_) { /* best-effort; OUTAGE path already flagged by caller */ }
+}
+
 async function runCard(cardId, cardPath, lessons) {
   const gates = []
   const tele = {}
+  const node = graphById[cardId] || {}
+  const ownerAgent = node.ownerAgent || 'coder'
+  const reviewProfile = node.reviewProfile || 'balanced'
   function g(name, decision, detail) { gates.push({ gate: name, decision, detail: detail || '' }); ledger(cardId, name, decision, detail) }
 
-  const cardBrief = `${projectBrief}\n\nCard: ${cardId}\nCard YAML: ${cardPath}\nWorktree: ${sharedCtx.worktreePath} (cd into it)\nFile-ownership map: ${sharedCtx.ownershipMapPath}\nBatch lessons so far: ${lessons.length ? lessons.join(' | ') : '(none)'}\nArch baseline (write to /tmp/arch-baseline-${cardId}.md): reuse if present.`
-
-  // --- Phase 1+2: claim, ground, implement (coder), completeness; returns the
-  //     completion verdict + the AC ledger + the file diff. Self-heals build gates
-  //     (G26) up to the module's retry cap before reporting unresolved. ---
-  const impl = await agent(
-    `Implement card ${cardId} per ${REF}/implement.md (Phase 1 claim+architect+plan-auditor, Phase 2 coder dispatch via owner_agent — G25: unknown owner_agent → default to coder, never HALT) and ${REF}/completeness.md (Phase 2.5 completeness + 2.5b AC-closure ledger). Run all gates/bash yourself.\n\n${cardBrief}\n\n` +
-      `POLICIES: G25 unknown owner_agent → coder + log. G26 Phase-2 lint/tsc/test/build failing after the module's retry cap (or stuck-loop) → return buildBlocked:true with the failing gate. Do NOT prompt. Build the AC Closure Ledger (one row per acceptance_criteria: implemented | unmet) — DO NOT silently defer; just report unmet rows. Persist the architecture baseline to /tmp/arch-baseline-${cardId}.md and the diff to /tmp/diff-${cardId}.txt.\n\n` +
-      `Return: { epic:boolean, buildBlocked:boolean, blockedGate:string, unmetACs:[{n,text}], scopeFiles:[...], mayEditPaths:[...], fileDiffViolation:boolean (already auto-reverted per 11b), note }`,
-    { label: `implement:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
-      schema: { type: 'object', required: ['epic', 'buildBlocked', 'unmetACs', 'scopeFiles'], additionalProperties: true,
-        properties: { epic: { type: 'boolean' }, buildBlocked: { type: 'boolean' }, blockedGate: { type: 'string' }, unmetACs: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeFiles: { type: 'array', items: { type: 'string' } }, mayEditPaths: { type: 'array', items: { type: 'string' } }, fileDiffViolation: { type: 'boolean' }, note: { type: 'string' } } } }
-  )
+  // F-026 — skip-completed: only if committed AND gates green for that sha AND no open follow-up.
+  // Keyed on the receipt, NOT the (unreliable) DONE flag.
+  try {
+    const probe = await agentSafe(
+      `Idempotency probe for card ${cardId} in worktree ${sharedCtx.worktreePath}. Return done:true ONLY if ALL hold: (a) a commit referencing ${cardId} exists in ${TRUNK}..HEAD; (b) the card's validation_commands re-run GREEN right now (tsc/lint/card greps); (c) NO open follow-up card for ${cardId} exists in ${paths.backlog_dir || 'backlog'}. Otherwise done:false. Do not edit anything.`,
+      { label: `probe:${cardId}`, phase: 'Implement', agentType: 'general-purpose', model: 'haiku',
+        schema: { type: 'object', required: ['done'], additionalProperties: true, properties: { done: { type: 'boolean' }, commit: { type: 'string' }, note: { type: 'string' } } } }
+    )
+    if (probe && probe.done) {
+      g('skip-completed', 'CACHED', probe.commit || 'already committed + green')
+      return { card: cardId, status: 'committed', commit: probe.commit || '-', filesChanged: [], scopeFiles: [], archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, gates, telemetry: tele }
+    }
+  } catch (e) { if (e && e.transientExhausted) { noteDegraded('outage'); return { card: cardId, status: 'pending', gates, telemetry: tele } } }
+
+  const cardBrief = `${projectBrief}\n\nCard: ${cardId}\nCard YAML: ${cardPath}\nOwner agent: ${ownerAgent} · Review profile: ${reviewProfile}\nWorktree: ${sharedCtx.worktreePath} (cd into it)\nFile-ownership map: ${sharedCtx.ownershipMapPath}\nBatch lessons so far: ${lessons.length ? lessons.join(' | ') : '(none)'}\nArch baseline (write to /tmp/arch-baseline-${cardId}.md): reuse if present.\nNOTE: ACs already pre-classified as policy-deferred MUST NOT be implemented or routed — they are tracked as follow-ups.`
+
+  // --- Phase 1+2: dispatch the card's OWNER_AGENT (F-024), not general-purpose. ---
+  let impl
+  try {
+    impl = await agentSafe(
+      `Implement card ${cardId} per ${REF}/implement.md (Phase 1 claim+architect+plan-auditor, Phase 2 you ARE the owner_agent '${ownerAgent}') and ${REF}/completeness.md (Phase 2.5 + 2.5b AC-closure ledger). Run all gates/bash yourself.\n\n${cardBrief}\n\n` +
+        `POLICIES: G26 Phase-2 lint/tsc/test/build failing after the module's retry cap → buildBlocked:true + blockedGate. Build the AC Closure Ledger (one row per AC: implemented|unmet|policy-deferred). DO NOT silently defer; report unmet rows (excluding policy-deferred). Persist arch baseline to /tmp/arch-baseline-${cardId}.md and the diff to /tmp/diff-${cardId}.txt.\n\n` +
+        `Return: { epic, buildBlocked, blockedGate, unmetACs:[{n,text}], scopeFiles, mayEditPaths, fileDiffViolation, note }`,
+      { label: `implement:${cardId}`, phase: 'Implement', agentType: ownerAgent,
+        schema: { type: 'object', required: ['epic', 'buildBlocked', 'unmetACs', 'scopeFiles'], additionalProperties: true,
+          properties: { epic: { type: 'boolean' }, buildBlocked: { type: 'boolean' }, blockedGate: { type: 'string' }, unmetACs: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeFiles: { type: 'array', items: { type: 'string' } }, mayEditPaths: { type: 'array', items: { type: 'string' } }, fileDiffViolation: { type: 'boolean' }, note: { type: 'string' } } } }
+    )
+  } catch (e) {
+    if (e && e.transientExhausted) { noteDegraded('outage'); return { card: cardId, status: 'pending', gates, telemetry: tele } }
+    throw e
+  }
 
-  if (impl && impl.epic) { g('router', 'EPIC-SKIPPED', 'epic card — not implemented'); return { card: cardId, status: 'epic-skipped', gates, commit: '-', telemetry: tele } }
+  if (impl && impl.epic) { g('router', 'EPIC-SKIPPED', 'epic card'); return { card: cardId, status: 'epic-skipped', gates, commit: '-', telemetry: tele } }
 
   const mayEdit = (impl && impl.mayEditPaths) || []
   const scopeFiles = (impl && impl.scopeFiles) || []
-  if (impl && impl.fileDiffViolation) g('E4-file-diff', 'AUTO-REVERTED', 'coder touched files outside ownership — reverted per implement.md 11b')
+  if (impl && impl.fileDiffViolation) g('E4-file-diff', 'AUTO-REVERTED', 'coder touched files outside ownership')
 
-  // G26 — build gates not converging → self-heal.
   if (impl && impl.buildBlocked) {
     const s = await resolve('blocker', cardId, `Phase-2 gate failing: ${impl.blockedGate}`, { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
     g('G26-build', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', impl.blockedGate)
-    if (s !== 'resolved') return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, telemetry: tele }
+    if (s !== 'resolved') { await rollbackCard(cardId, mayEdit); return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, telemetry: tele } }
   }
 
-  // G6+G7 — AC-Closure: every unmet AC must be implemented (never silently deferred).
+  // F-010/F-016 — unmet ACs that are policy-deferred are skipped (already tracked).
   for (const ac of (impl && impl.unmetACs) || []) {
+    if (acceptedDeferrals.has(sig(cardId, 'ac-unmet', `AC-${ac.n}: ${ac.text}`))) { g('G7-ac-closure', 'DEFERRED-BY-POLICY', `AC-${ac.n}`); continue }
     const s = await resolve('ac-unmet', cardId, `AC-${ac.n}: ${ac.text}`, { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
     g('G7-ac-closure', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', `AC-${ac.n}`)
   }
 
-  // --- Phases 2.55 / 2.6 / 3 / 3.5 / 3.7 — review fan-out. One agent runs the
-  //     review pipeline per the modules and returns each gate's verdict + any
-  //     scope-expanding findings. Auto-revert gates (G9/G12) are handled inside. ---
-  const review = await agent(
-    `Run the per-card review pipeline for ${cardId} per ${REF}/review-cycle.md (Phase 2.55 Simplify, 2.6 E2E, 3 doc, 3.5 QA) and ${REF}/codex-gate.md (Phase 3.7 Codex). Run all agents/gates yourself.\n\n${cardBrief}\nDiff: /tmp/diff-${cardId}.txt\n\n` +
-      `POLICIES (NO prompts): G9 simplify-regression after retries → AUTO-REVERT the simplify fixes, proceed. G12 doc-phase regression after retries → AUTO-REVERT the doc edits that broke the build. G11 E2E 'error' (tooling) → proceed with e2eStatus:'ERROR' (flag only). For BLOCKING failures that survive the module's retry cap, report them so the caller routes them to new2-resolve: G10 E2E 'blocked', G13 QA fail, G14 Codex BLOCKER/HIGH, G8 alias-mutation un-guarded, G15 Codex crash (security domain: never inline-bypass). Also report scopeExpansion findings (legitimate findings BEYOND this card's AC: from Simplify/Codex/doc-drift→bug).\n\n` +
-      `Return: { simplify:'clean|reverted|applied', e2eStatus:'passed|skipped|blocked|error|overridden', qa:'pass|fail|skip', codex:'pass|blocker|crash', blocks:[{gate,domain,evidence}], scopeExpansion:[{evidence,domain,withinOwnership:boolean,newAC:boolean}], docGaps:{found,fixed}, qaFirstAttempt:'pass|fail|n/a' }`,
-    { label: `review:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
-      schema: { type: 'object', required: ['blocks', 'scopeExpansion'], additionalProperties: true,
-        properties: { simplify: { type: 'string' }, e2eStatus: { type: 'string' }, qa: { type: 'string' }, codex: { type: 'string' }, blocks: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeExpansion: { type: 'array', items: { type: 'object', additionalProperties: true } }, docGaps: { type: 'object', additionalProperties: true }, qaFirstAttempt: { type: 'string' } } } }
-  )
-
-  if (review) {
-    if (review.simplify) g('G9-simplify', review.simplify === 'reverted' ? 'AUTO-REVERT' : 'OK', review.simplify)
-    if (review.e2eStatus) g('G10/G11-e2e', review.e2eStatus === 'error' ? 'FLAG' : review.e2eStatus.toUpperCase())
-    if (review.qaFirstAttempt) tele.qa_first_attempt = review.qaFirstAttempt
-    if (review.docGaps) tele.doc_gaps = review.docGaps
-  }
-
-  // Route blocking review failures (G8/G10/G13/G14/G15) to new2-resolve.
+  // --- Review fan-out (F-024/F-025): specialized agents, trimmed by review_profile. ---
+  const reviewers = reviewProfile === 'skip' ? []
+    : reviewProfile === 'light' ? ['code-reviewer']
+    : ['code-reviewer', 'doc-reviewer', 'qa-sentinel', 'api-perf-cost-auditor'].concat(
+        (highRisk.length || /auth|security|secret|migration|rls/i.test(scopeFiles.join(' '))) ? ['security-reviewer'] : [])
+  let reviewResults = []
+  try {
+    reviewResults = (await parallel(reviewers.map((ra) => () => agentSafe(
+      `You are ${ra}. Review card ${cardId} per ${REF}/review-cycle.md + ${REF}/codex-gate.md (your domain only). Run your gates on the COMMITTED-or-working state.\n\n${cardBrief}\nDiff: /tmp/diff-${cardId}.txt\n\n` +
+        `Report ONLY blocking failures that survive your retry cap as blocks:[{gate,domain,evidence}] (each MUST have non-empty gate AND evidence — F-014). Report legitimate findings BEYOND this card's AC as scopeExpansion:[{evidence,domain,withinOwnership,newAC}].\n\n` +
+        `Return: { blocks:[...], scopeExpansion:[...], note }`,
+      { label: `review:${cardId}:${ra}`, phase: 'Implement', agentType: ra,
+        schema: { type: 'object', required: ['blocks', 'scopeExpansion'], additionalProperties: true,
+          properties: { blocks: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeExpansion: { type: 'array', items: { type: 'object', additionalProperties: true } }, note: { type: 'string' } } } }
+    ).catch((e) => { if (e && e.transientExhausted) noteDegraded('outage'); return null }))) ).filter(Boolean)
+  } catch (_) { /* parallel never rejects; nulls filtered */ }
+
+  // F-014 — only route well-formed blocks (non-empty gate+evidence).
+  const blocks = reviewResults.flatMap((r) => (r.blocks || [])).filter((b) => b && b.gate && b.evidence)
+  const scopeExp = reviewResults.flatMap((r) => (r.scopeExpansion || []))
   let cardBlocked = false
-  for (const b of (review && review.blocks) || []) {
-    const kind = b.gate && /e2e/i.test(b.gate) ? 'e2e-blocked' : (b.gate && /qa/i.test(b.gate) ? 'qa-fail' : 'blocker')
-    const s = await resolve(kind, cardId, `${b.gate}: ${b.evidence || ''}`, { mayEditPaths: mayEdit, scopeFiles, domain: b.domain || 'code' })
-    g(b.gate || 'review-block', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', b.evidence || '')
+  for (const b of blocks) {
+    const kind = /e2e/i.test(b.gate) ? 'e2e-blocked' : /qa/i.test(b.gate) ? 'qa-fail' : 'blocker'
+    const s = await resolve(kind, cardId, `${b.gate}: ${b.evidence}`, { mayEditPaths: mayEdit, scopeFiles, domain: b.domain || 'code' })
+    g(b.gate, s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', b.evidence)
     if (s !== 'resolved') cardBlocked = true
   }
-
-  // Scope-expansion findings (Asse 2) — deterministic boundary inside new2-resolve.
-  for (const sx of (review && review.scopeExpansion) || []) {
+  for (const sx of scopeExp) {
     const s = await resolve('scope-expansion', cardId, sx.evidence || '', { mayEditPaths: mayEdit, scopeFiles, domain: sx.domain || 'code' })
     g('scope-expansion', s === 'resolved' ? 'INTEGRATED' : 'FOLLOWUP', sx.evidence || '')
   }
 
-  if (cardBlocked) return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele }
-
-  // --- Phase 4 — commit (G16: auto-clear COMMIT_LOCK + retry; persistent → resolve). ---
-  const commitRes = await agent(
-    `Commit card ${cardId} in the worktree per ${REF}/commit.md (Phase 4 explicit-staging — NEVER git add -A, NEVER git stash in a worktree — + Phase 5 context clean; mark the card DONE + ssot-registry). Run git yourself.\n\n${cardBrief}\n\n` +
-      `POLICY G16: on commit failure auto-clear stale COMMIT_LOCK and retry (module cap). 'nothing to commit' = already committed (record HEAD). If still locked after the cap → return committed:false (caller routes to new2-resolve).\n\n` +
-      `Return: { committed:boolean, commit:string, filesChanged:[...] }`,
-    { label: `commit:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
-      schema: { type: 'object', required: ['committed'], additionalProperties: true, properties: { committed: { type: 'boolean' }, commit: { type: 'string' }, filesChanged: { type: 'array', items: { type: 'string' } } } } }
-  )
+  if (cardBlocked) { await rollbackCard(cardId, mayEdit); return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele } }
+
+  // --- Phase 4 — commit (F-023: Haiku + git-status reconcile, never git add -A). ---
+  let commitRes
+  try {
+    commitRes = await agentSafe(
+      `Commit card ${cardId} in worktree ${sharedCtx.worktreePath}. MECHANICAL — do NOT re-read reference modules.\n` +
+        `Steps: (1) \`git status --porcelain\`; (2) stage = MAY-EDIT (${JSON.stringify(mayEdit)}) ∩ dirty — NEVER \`git add -A\`, NEVER \`git stash\`; if dirty has files OUTSIDE MAY-EDIT, do NOT stage them and set reconcileNote; (3) commit message \`[${cardId}] <concise>\`; (4) mark the card DONE in its YAML + add the ssot-registry row; (5) 'nothing to commit' = already committed (record HEAD).\n` +
+        `On COMMIT_LOCK: clear stale lock + retry once. Still locked → committed:false.\n\n` +
+        `Return: { committed, commit, filesChanged, reconcileNote }`,
+      { label: `commit:${cardId}`, phase: 'Implement', agentType: 'general-purpose', model: 'haiku',
+        schema: { type: 'object', required: ['committed'], additionalProperties: true, properties: { committed: { type: 'boolean' }, commit: { type: 'string' }, filesChanged: { type: 'array', items: { type: 'string' } }, reconcileNote: { type: 'string' } } } }
+    )
+  } catch (e) {
+    if (e && e.transientExhausted) { noteDegraded('outage'); await rollbackCard(cardId, mayEdit); return { card: cardId, status: 'pending', gates, telemetry: tele } }
+    throw e
+  }
 
   if (!commitRes || !commitRes.committed) {
     const s = await resolve('blocker', cardId, 'commit blocked after retries', { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
     g('G16-commit', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP')
-    if (s !== 'resolved') return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele }
+    if (s !== 'resolved') { await rollbackCard(cardId, mayEdit); return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele } }
   }
+  if (commitRes && commitRes.reconcileNote) g('commit-reconcile', 'NOTE', commitRes.reconcileNote)
 
   g('commit', 'COMMITTED', (commitRes && commitRes.commit) || '')
   return {
     card: cardId, status: 'committed',
     commit: (commitRes && commitRes.commit) || '-',
     filesChanged: (commitRes && commitRes.filesChanged) || [],
-    scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`,
-    gates, telemetry: tele,
+    scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, gates, telemetry: tele,
   }
 }
 
 // ───────────────────────────────────────────────────────────────────────────
-// Phase Implement — driver: sequential or team-mode (parallel coders per wave).
+// Phase Implement — DAG scheduler (F-021/F-017/F-018). Single-worktree semantics:
+// a card runs only when ALL its in-batch deps are 'committed'; a failed/deferred
+// card blocks its transitive dependents (no doomed resolve); transient failure →
+// re-queue with a cap; sustained outage → stop cleanly + degraded return.
 // ───────────────────────────────────────────────────────────────────────────
 phase('Implement')
 const lessons = []
-const pathById = {}
-cardIds.forEach((id, i) => { pathById[id] = cardPaths[i] || `${paths.backlog_dir || ''}/${id}.yml` })
+const state = {}            // cardId → 'pending'|'committed'|'followup'|'epic-skipped'|'blocked'|'failed'
+const attempts = {}         // cardId → retry count (transient)
+const RETRY_CAP = 2
+const MAX_CONSECUTIVE_OUTAGE = 3
+for (const id of runnableCards) { state[id] = 'pending'; attempts[id] = 0 }
+
+function depsSatisfied(id) {
+  const deps = ((graphById[id] || {}).dependsOn || []).filter((d) => runnableCards.includes(d))
+  return deps.every((d) => state[d] === 'committed' || state[d] === 'epic-skipped')
+}
+function depFailed(id) {
+  const deps = ((graphById[id] || {}).dependsOn || []).filter((d) => runnableCards.includes(d))
+  return deps.some((d) => state[d] === 'followup' || state[d] === 'blocked' || state[d] === 'failed')
+}
 
-if (preflight.executionMode === 'team' && Array.isArray(preflight.groups) && preflight.groups.length) {
-  // Waves run in order (a higher level waits for lower levels); cards within a wave
-  // run concurrently — parallel() keeps every coder's bloat inside the runtime.
-  const sortedGroups = preflight.groups.slice().sort((x, y) => (x.level || 0) - (y.level || 0))
-  for (const grp of sortedGroups) {
-    const ids = (grp.cards || []).filter((id) => runnableCards.includes(id))
-    if (!ids.length) continue
-    log(`Team wave level=${grp.level}: ${ids.length} card(s) in parallel.`)
-    const waveResults = await parallel(ids.map((id) => () => runCard(id, pathById[id], lessons).catch((e) => crashFollowup(id, e))))
-    for (const r of waveResults.filter(Boolean)) { perCardResults.push(r); if (r.note) lessons.push(`${r.card}: ${r.note}`) }
-  }
-} else {
-  // Sequential — cards share one worktree and run one at a time.
+let consecutiveOutage = 0
+let guard = runnableCards.length * (RETRY_CAP + 2) + 5
+while (guard-- > 0) {
+  // Mark cards whose deps failed as blocked (F-017 — never route them to resolve).
   for (const id of runnableCards) {
-    const r = await runCard(id, pathById[id], lessons).catch((e) => crashFollowup(id, e))
-    perCardResults.push(r)
-    if (r && r.note) lessons.push(`${r.card}: ${r.note}`)
+    if (state[id] === 'pending' && depFailed(id)) {
+      state[id] = 'blocked'
+      residuals.push({ card: id, kind: 'blocked-by-dep', evidence: `blocked: a dependency failed/deferred`, materialized: false })
+      ledger(id, 'dep-barrier', 'BLOCKED', 'dependency failed/deferred')
+    }
   }
+  const next = runnableCards.find((id) => state[id] === 'pending' && depsSatisfied(id))
+  if (!next) break // nothing runnable (all done/blocked, or a cycle/stall)
+
+  const r = await runCard(next, pathById[next], lessons).catch((e) => crashResult(next, e))
+  if (r.status === 'pending') {
+    attempts[next]++
+    consecutiveOutage++
+    if (attempts[next] > RETRY_CAP || consecutiveOutage >= MAX_CONSECUTIVE_OUTAGE) {
+      noteDegraded('outage')
+      ledger(next, 'outage', 'PAUSED', `transient failures (attempt ${attempts[next]}) — batch paused for durable resume`)
+      break // OUTAGE — stop cleanly; the skill resumes (skip-completed makes it idempotent).
+    }
+    ledger(next, 'retry', 'REQUEUE', `transient — attempt ${attempts[next]}/${RETRY_CAP}`)
+    continue // re-queue (state stays 'pending')
+  }
+  consecutiveOutage = 0
+  state[next] = r.status
+  perCardResults.push(r)
+  if (r.note) lessons.push(`${next}: ${r.note}`)
+}
+
+// Any still-pending card after the loop (outage) is recorded as a residual.
+for (const id of runnableCards) {
+  if (state[id] === 'pending') residuals.push({ card: id, kind: 'not-reached', evidence: 'batch paused before this card ran', materialized: false })
+}
+
+function crashResult(id, e) {
+  if (e && (e.transientExhausted || isTransient(e))) { return { card: id, status: 'pending', gates: [], telemetry: {} } }
+  residuals.push({ card: id, kind: 'agent-crash', evidence: String(e && e.message), materialized: false })
+  ledger(id, 'runCard', 'ERROR', String(e && e.message))
+  return { card: id, status: 'failed', gates: [{ gate: 'runCard', decision: 'ERROR', detail: String(e && e.message) }], commit: '-', telemetry: {} }
 }
 
 const committed = perCardResults.filter((r) => r.status === 'committed')
 
 // ───────────────────────────────────────────────────────────────────────────
-// Phase Final — cross-batch final review (reuse new-final-review). F.5 user gates
-// become deterministic: G17 needs-manual → treat as VERIFIED (the workflow already
-// drops only FALSE_POSITIVE); G18 unresolved BLOCKER/HIGH → new2-resolve, else
-// block the merge.
+// Phase Final — cross-batch final review (new-final-review). Findings batched per
+// area (F-007/F-035/F-037); merge-artifact doc findings skipped (resolved-by-merge).
 // ───────────────────────────────────────────────────────────────────────────
 phase('Final')
 let finalSummary = null
-let mergeBlocked = batchFatal
-if (committed.length && !batchFatal) {
+let mergeBlocked = batchFatal || degraded
+if (committed.length && !batchFatal && !degraded) {
   const reviewScopeFiles = dedupe(committed.flatMap((r) => r.scopeFiles || []))
   const archPaths = committed.map((r) => r.archBaselinePath).filter(Boolean)
   const allArch = archPaths.length === committed.length ? archPaths : null
   const hasApiDataFiles = reviewScopeFiles.some((f) => /api\/|data-model|\.sql$|migrations?\//i.test(f))
 
-  const final = await workflow('new-final-review', {
-    firstCardId: firstCard,
-    worktreePath: sharedCtx.worktreePath,
-    baseBranch: TRUNK,
-    cardPaths: committed.map((r) => pathById[r.card]).filter(Boolean),
-    reviewScopeFiles,
-    archBaselinePaths: allArch,
-    hasApiDataFiles,
-    config: cfg,
-  }).catch(() => null)
+  let final = null
+  try {
+    final = await workflow('new-final-review', {
+      firstCardId: firstCard, worktreePath: sharedCtx.worktreePath, baseBranch: TRUNK,
+      cardPaths: committed.map((r) => pathById[r.card]).filter(Boolean),
+      reviewScopeFiles, archBaselinePaths: allArch, hasApiDataFiles, config: cfg,
+      // F-041 — single-card batch: doc-reviewer + api-perf already ran per-card and there is
+      // NO cross-card conflict to find. Keep only the cross-model Codex pass + qa gates.
+      singleCard: committed.length === 1,
+    })
+  } catch (e) { if (e && isTransient(e)) noteDegraded('outage'); final = null }
 
   if (final) {
     finalSummary = final.summary || null
     ledger(firstCard, 'final-review', 'DONE', `engine=${final.codexEngine}; verified=${final.summary ? final.summary.verified : '?'}`)
-    // G18 — apply BLOCKER/HIGH fixes; unresolved → block merge. G17: a workflow
-    // cannot ask the user, so NEEDS_MANUAL_CONFIRMATION is treated as VERIFIED
-    // (attempt the fix) — never silently ignored (the count-only path was the bug).
-    const blockers = (final.findings || []).filter((f) => (f.classification === 'VERIFIED' || f.classification === 'NEEDS_MANUAL_CONFIRMATION') && (f.severity === 'BLOCKER' || f.severity === 'HIGH'))
-    for (const f of blockers) {
-      const s = await resolve('merge-blocker', f.finding_id || firstCard, `${f.classification} ${f.severity} ${f.title}: ${f.evidence}`, { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: f.domain || 'code' })
+    const all = (final.findings || []).filter((f) => (f.classification === 'VERIFIED' || f.classification === 'NEEDS_MANUAL_CONFIRMATION') && (f.severity === 'BLOCKER' || f.severity === 'HIGH'))
+    // F-035 — drop merge-artifact doc findings (content exists in worktree, the merge carries it).
+    const actionable = all.filter((f) => !/in (the )?main repo|not (in|on) (the )?main|merge[- ]?time|worktree.*(not|missing).*main/i.test(`${f.title} ${f.evidence}`))
+    for (const f of all) if (!actionable.includes(f)) ledger(f.finding_id || firstCard, 'final-merge-artifact', 'SKIP', 'resolved-by-merge')
+    // F-007/F-037 — group actionable findings by fix-area (file) → one resolve per area.
+    const byArea = {}
+    for (const f of actionable) {
+      const area = (Array.isArray(f.files) && f.files[0]) || (f.file) || (f.domain || 'misc')
+      ;(byArea[area] = byArea[area] || []).push(f)
+    }
+    for (const area of Object.keys(byArea)) {
+      const group = byArea[area]
+      const s = await resolve('merge-blocker', group[0].finding_id || firstCard,
+        group.map((f) => `${f.severity} ${f.title}: ${f.evidence}`).join(' || '),
+        { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: group[0].domain || 'code',
+          findings: group.map((f) => ({ kind: 'merge-blocker', evidence: `${f.title}: ${f.evidence}`, domain: f.domain || 'code' })) })
       if (s !== 'resolved') mergeBlocked = true
     }
-    if ((final.summary && final.summary.failingGates && final.summary.failingGates.length)) {
-      const s = await resolve('qa-fail', firstCard, `final gates failing: ${final.summary.failingGates.join(', ')}`, { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: 'code' })
+    if (finalSummary && finalSummary.failingGates && finalSummary.failingGates.length) {
+      const s = await resolve('qa-fail', firstCard, `final gates failing: ${finalSummary.failingGates.join(', ')}`, { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: 'code' })
       if (s !== 'resolved') mergeBlocked = true
     }
   } else {
-    ledger(firstCard, 'final-review', 'SKIPPED', 'workflow returned null')
+    ledger(firstCard, 'final-review', 'SKIPPED', degraded ? 'degraded' : 'workflow returned null')
+    mergeBlocked = true
   }
 } else {
-  ledger(firstCard, 'final-review', 'SKIPPED', batchFatal ? 'batch fatal — review/merge halted' : 'no committed cards')
+  ledger(firstCard, 'final-review', 'SKIPPED', batchFatal ? 'batch fatal' : degraded ? 'degraded (outage)' : 'no committed cards')
 }
 
 // ───────────────────────────────────────────────────────────────────────────
-// Phase Merge — auto-merge to trunk (G24) + Phase 6b/6c reconciliation (conservative
-// git policies: G19–G23). Skipped when a final BLOCKER/HIGH is unresolved.
+// Phase Merge — INTEGRITY-GATED (F-029/F-030/F-031). Merge ONLY if the batch is
+// verifiably complete: every runnable card committed OR deferred with a real
+// follow-up; no open BLOCKER; no degraded; no uncommitted code. NEVER force-DONE,
+// NEVER git-add unreviewed code.
 // ───────────────────────────────────────────────────────────────────────────
 phase('Merge')
 let mergeResult = null
+const incomplete = runnableCards.filter((id) => state[id] !== 'committed' && state[id] !== 'epic-skipped')
+const integrityOK = committed.length > 0 && !mergeBlocked && !batchFatal && !degraded && incomplete.length === 0
 if (!committed.length) {
   ledger(firstCard, 'merge', 'SKIPPED', 'no committed cards')
-} else if (mergeBlocked) {
-  ledger(firstCard, 'merge', 'BLOCKED', 'unresolved final BLOCKER/HIGH — worktree left intact for review')
+} else if (!integrityOK) {
+  const why = degraded ? 'degraded (outage)' : mergeBlocked ? 'unresolved final BLOCKER/HIGH' : incomplete.length ? `incomplete cards: ${incomplete.join(' ')}` : 'integrity gate'
+  ledger(firstCard, 'merge', 'BLOCKED', `${why} — worktree left intact, NOT merged`)
 } else {
-  mergeResult = await agent(
-    `Auto-merge the batch worktree to ${TRUNK} per ${REF}/merge-cleanup.md (Phase 6 via /mw programmatic with checksAlreadyPassed:true, Phase 6b status reconciliation, Phase 6c workspace hygiene). Run git yourself.\n\n${projectBrief}\nWorktree: ${sharedCtx.worktreePath}\nBranch: ${sharedCtx.branch}\nmerge_strategy: ${mergeStrategy}\nCommitted cards: ${committed.map((r) => r.card).join(' ')}\nPhase-0 stash to restore (if any): see /tmp/batch-tracker-${firstCard}.md ## Workspace Snapshot.\n\n` +
-      `DETERMINISTIC POLICIES (NO prompts): G24 → auto-merge via merge_strategy. G19 sync-deferred → if HEAD==${TRUNK} ff-pull, else leave+report. G20 sync-needs-decision → leave+report (never touch foreign files). G21 post-batch dirty (no stash) → partition-ignore framework artifacts; leave the rest + report. G22 divergence → behind: ff-pull; ahead/both: leave+report; NEVER reset --hard / force-push. G23 stash restore conflict → leave the stash intact + report (never drop). Phase 6b: force any non-DONE batch card to DONE.\n\n` +
-      `Return: { merged:boolean, mergeCommit, mergeTs, reconciliation, note }`,
-    { label: 'merge', phase: 'Merge', agentType: 'general-purpose', schema: MERGE_SCHEMA }
-  )
+  try {
+    mergeResult = await agentSafe(
+      `Auto-merge the batch worktree to ${TRUNK} per ${REF}/merge-cleanup.md (Phase 6 via /mw programmatic checksAlreadyPassed:true, Phase 6b status reconciliation, Phase 6c hygiene). Run git yourself.\n\n${projectBrief}\nWorktree: ${sharedCtx.worktreePath}\nBranch: ${sharedCtx.branch}\nmerge_strategy: ${mergeStrategy}\nCommitted cards: ${committed.map((r) => r.card).join(' ')}\nPhase-0 stash to restore (if any): see /tmp/batch-tracker-${firstCard}.md.\n\n` +
+        `DETERMINISTIC POLICIES (NO prompts):\n` +
+        `• G24 → auto-merge via merge_strategy.\n` +
+        `• F-030 HARD RULE: NEVER \`git add\`/commit code that did not pass the per-card gates. If the worktree is dirty with uncommitted code → DO NOT commit it; leave it, set uncommittedLeft:true, and report. NO "safety commit". Security/migration code is NEVER swept in.\n` +
+        `• F-029 HARD RULE: Phase 6b reconciliation marks a card DONE ONLY if it has a real commit in ${TRUNK}..HEAD AND its gates are green. NEVER force a non-implemented card to DONE. Return forcedDone:[] (must be empty).\n` +
+        `• G19 sync-deferred → HEAD==${TRUNK} ff-pull, else leave+report. G20 → leave+report. G21 post-batch dirty → partition-ignore framework artifacts; leave the rest + report (do NOT commit). G22 divergence → behind: ff-pull; ahead/both: leave+report; NEVER reset --hard/force-push. G23 stash restore conflict → leave intact + report.\n\n` +
+        `Return: { merged, mergeCommit, mergeTs, reconciliation, forcedDone:[], uncommittedLeft, note }`,
+      { label: 'merge', phase: 'Merge', agentType: 'general-purpose', schema: MERGE_SCHEMA }
+    )
+  } catch (e) { if (e && e.transientExhausted) noteDegraded('outage'); mergeResult = null }
+  if (mergeResult && (mergeResult.forcedDone || []).length) { noteDegraded('false_done'); ledger(firstCard, 'F029-guard', 'VIOLATION', `forcedDone: ${mergeResult.forcedDone.join(' ')}`) }
+  if (mergeResult && mergeResult.uncommittedLeft) ledger(firstCard, 'F030-guard', 'LEFT-UNCOMMITTED', 'dirty code left (not swept) + reported')
   ledger(firstCard, 'G24-merge', (mergeResult && mergeResult.merged) ? 'MERGED' : 'INCOMPLETE', (mergeResult && (mergeResult.mergeCommit || mergeResult.note)) || '')
   if (mergeResult && mergeResult.reconciliation) ledger(firstCard, 'G19-23-reconcile', 'AUTO', mergeResult.reconciliation)
 }
 
 // ───────────────────────────────────────────────────────────────────────────
-// Phase Production (Phase 7) — post-merge readiness checklist (non-blocking, full
-// parity with /new). Auto-executes stack-matched deploys; reports the manual items.
+// Phase Production (Phase 7) — non-blocking; report-not-execute (F-011 infra-deferred).
 // ───────────────────────────────────────────────────────────────────────────
 phase('Production')
 if (mergeResult && mergeResult.merged) {
-  prodReadiness = await agent(
-    `Run the post-merge Production Readiness checklist per ${REF}/production-readiness.md (Phase 7) over the batch's changed files. Auto-EXECUTE only stack-matched index / access-rule / cron deploys; REPORT (do not execute) env vars, feature flags, DB migrations, third-party secrets, DNS changes. NON-BLOCKING — never fail the batch.\n\n${projectBrief}\nChanged files: ${dedupe(committed.flatMap((r) => r.filesChanged || [])).join(', ') || '(derive from git)'}\n\nReturn: { autoExecuted:[...], manualItems:[...], note }`,
-    { label: 'production-readiness', phase: 'Production', agentType: 'general-purpose',
-      schema: { type: 'object', required: ['manualItems'], additionalProperties: true, properties: { autoExecuted: { type: 'array', items: { type: 'string' } }, manualItems: { type: 'array', items: { type: 'string' } }, note: { type: 'string' } } } }
-  )
-  ledger(firstCard, 'phase7-production', 'DONE', `auto=${((prodReadiness && prodReadiness.autoExecuted) || []).length} manual=${((prodReadiness && prodReadiness.manualItems) || []).length}`)
+  try {
+    prodReadiness = await agentSafe(
+      `Run the post-merge Production Readiness checklist per ${REF}/production-readiness.md (Phase 7) over the batch's changed files. Auto-EXECUTE only stack-matched index/access-rule/cron deploys; REPORT (do not execute) env vars, feature flags, DB migrations, secrets, DNS. NON-BLOCKING.\n\n${projectBrief}\nChanged files: ${dedupe(committed.flatMap((r) => r.filesChanged || [])).join(', ') || '(derive from git)'}\n\nReturn: { autoExecuted:[...], manualItems:[...], note }`,
+      { label: 'production-readiness', phase: 'Production', agentType: 'general-purpose',
+        schema: { type: 'object', required: ['manualItems'], additionalProperties: true, properties: { autoExecuted: { type: 'array', items: { type: 'string' } }, manualItems: { type: 'array', items: { type: 'string' } }, note: { type: 'string' } } } }
+    )
+    ledger(firstCard, 'phase7-production', 'DONE', `auto=${((prodReadiness && prodReadiness.autoExecuted) || []).length} manual=${((prodReadiness && prodReadiness.manualItems) || []).length}`)
+  } catch (_) { ledger(firstCard, 'phase7-production', 'SKIPPED', 'agent failed (non-blocking)') }
 } else {
   ledger(firstCard, 'phase7-production', 'SKIPPED', 'not merged')
 }
 
-// ───────────────────────────────────────────────────────────────────────────
-// Return — assemble the report + Phase-8 telemetry (variant new2).
-// ───────────────────────────────────────────────────────────────────────────
 return finalReturn({ fatal: false })
 
 // ───────────────────────────────────────────────────────────────────────────
@@ -414,25 +613,36 @@ function finalReturn(opts) {
   const fatal = opts && opts.fatal
   const telemetry = buildTelemetry()
   const report = buildReport({ fatal, reason: opts && opts.reason, finalSummary, mergeResult })
-  return { report, perCardResults, gateLedger, residualFollowups, telemetry }
+  // residuals (materialized:false) is the offline-safe ledger; the skill writes the YAML.
+  return { report, perCardResults, gateLedger, residualFollowups, residuals, degraded, degradationReasons, telemetry }
 }
 
 function buildTelemetry() {
-  const total = cardIds.length
-  const done = perCardResults.filter((r) => r.status === 'committed').length
-  const fixCycles = gateLedger.filter((x) => /resolve:/.test(x.gate)).length
+  const tokensNow = (typeof budget !== 'undefined' && budget && typeof budget.spent === 'function') ? budget.spent() : null
+  const totalTokens = (tokensAtStart != null && tokensNow != null) ? (tokensNow - tokensAtStart) : null
   return {
     variant: 'new2',
     batch: cardIds,
     first_card: firstCard,
-    cards_total: total,
-    cards_committed: done,
+    ts: TS || null,
+    cards_total: cardIds.length,
+    cards_real_done: perCardResults.filter((r) => r.status === 'committed').length,
+    cards_force_done: 0, // F-029 — force-DONE forbidden; always 0.
     cards_followup: perCardResults.filter((r) => r.status === 'followup').length,
-    followups_created: residualFollowups.length,
-    resolve_invocations: fixCycles,
+    cards_blocked: runnableCards.filter((id) => state[id] === 'blocked').length,
+    cards_deferred: residuals.filter((x) => x.kind === 'policy-deferred-ac').length,
+    residuals_total: residuals.length,
+    // followups_on_disk is filled by the SKILL after it materialises pending residuals.
+    followups_materialized_in_workflow: residuals.filter((x) => x.materialized).length,
+    resolve_invocations: resolvedSignatures.size,
     final_review: finalSummary || null,
     merged: !!(mergeResult && mergeResult.merged),
+    degraded,
+    degradation_reasons: degradationReasons,
     execution_mode: preflight ? preflight.executionMode : 'sequential',
+    // cost — total_tokens via budget.spent() delta; agent_count via counter; wall_clock_s stamped by the SKILL.
+    total_tokens: totalTokens,
+    agent_count: agentCount,
     per_card: perCardResults.map((r) => ({ card: r.card, status: r.status, telemetry: r.telemetry || {} })),
     stats_requested: !!FLAGS.stats,
   }
@@ -441,40 +651,37 @@ function buildTelemetry() {
 function buildReport(o) {
   const L = []
   L.push(`# new2 batch — ${cardIds.join(' ')}`)
-  L.push(`Variant: **new2** (workflow-hosted) · Mode: ${preflight ? preflight.executionMode : '?'} · Trunk: ${TRUNK}`)
+  L.push(`Variant: **new2** · Mode: ${preflight ? preflight.executionMode : '?'} · Trunk: ${TRUNK}${degraded ? ' · ⚠️ DEGRADED (' + degradationReasons.join(',') + ')' : ''}`)
   if (o.fatal) { L.push(``, `## ⛔ BATCH FATAL`, o.reason || 'workspace unworkable'); return L.join('\n') }
   L.push(``, `## Esito card`)
   L.push(`| Card | Status | Commit | File |`)
   L.push(`|------|--------|--------|------|`)
   for (const r of perCardResults) L.push(`| ${r.card} | ${r.status} | ${r.commit || '-'} | ${(r.filesChanged || []).length} |`)
+  const blockedIds = runnableCards.filter((id) => state[id] === 'blocked' || state[id] === 'pending')
+  for (const id of blockedIds) L.push(`| ${id} | ${state[id]} | - | 0 |`)
   if (finalSummary) {
     L.push(``, `## Final review`)
-    L.push(`Verified: ${finalSummary.verified} (BLOCKER ${finalSummary.blockers} / HIGH ${finalSummary.highs}) · needs-manual ${finalSummary.needsManual} · failing gates: ${(finalSummary.failingGates || []).join(', ') || 'none'}`)
+    L.push(`Verified: ${finalSummary.verified} (BLOCKER ${finalSummary.blockers} / HIGH ${finalSummary.highs}) · failing gates: ${(finalSummary.failingGates || []).join(', ') || 'none'}`)
   }
   L.push(``, `## Merge`)
   if (mergeResult && mergeResult.merged) L.push(`Merged → ${TRUNK} @ ${mergeResult.mergeCommit || '?'}${mergeResult.reconciliation ? ' · ' + mergeResult.reconciliation : ''}`)
-  else if (mergeBlocked) L.push(`Merge BLOCKED — ${batchFatal ? 'batch fatal (new2-resolve)' : 'unresolved final BLOCKER/HIGH'}. Worktree left intact at ${sharedCtx.worktreePath}.`)
-  else L.push(`Not merged (no committed cards or incomplete).`)
+  else L.push(`**NOT merged** — ${degraded ? 'batch degraded (outage); resume to finish' : mergeBlocked ? 'unresolved final BLOCKER/HIGH or incomplete cards' : 'no committed cards'}. Worktree left intact at ${sharedCtx ? sharedCtx.worktreePath : '?'}.`)
   if (prodReadiness) {
     const man = prodReadiness.manualItems || []
-    L.push(``, `## Production readiness (Phase 7)`)
-    L.push(`Auto-eseguiti: ${(prodReadiness.autoExecuted || []).length} · Da fare a mano: ${man.length}`)
+    L.push(``, `## Production readiness (Phase 7)`, `Auto: ${(prodReadiness.autoExecuted || []).length} · Manuali: ${man.length}`)
     for (const m of man) L.push(`- [ ] ${m}`)
   }
-  if (residualFollowups.length) {
-    L.push(``, `## ⚠️ Follow-up auto-creati (residui non risolti autonomamente — nulla perso)`)
-    for (const f of residualFollowups) L.push(`- **${f.followupCard}** ← ${f.card} (${f.kind})${f.reason ? ': ' + f.reason : ''}`)
+  if (residuals.length) {
+    L.push(``, `## ⚠️ Residui (il skill materializza le follow-up mancanti — nulla perso)`)
+    for (const f of residuals) L.push(`- ${f.card} (${f.kind})${f.materialized ? ' ✓' : ' — DA MATERIALIZZARE'}: ${f.evidence}`)
   }
   const excluded = gateLedger.filter((x) => x.decision === 'EXCLUDED')
-  if (excluded.length) {
-    L.push(``, `## Card escluse in pre-flight`)
-    for (const e of excluded) L.push(`- ${e.card}: ${e.detail}`)
-  }
-  L.push(``, `_Gate ledger: ${gateLedger.length} decisioni deterministiche, 0 AskUserQuestion._`)
+  if (excluded.length) { L.push(``, `## Card escluse in pre-flight`); for (const e of excluded) L.push(`- ${e.card}: ${e.detail}`) }
+  L.push(``, `_Gate ledger: ${gateLedger.length} decisioni deterministiche, 0 AskUserQuestion. Token: ${buildTelemetry().total_tokens ?? '?'} · agent: ${agentCount}._`)
   return L.join('\n')
 }
 
 function dedupe(arr) { return Array.from(new Set(arr)) }
 function emptyReturn(reason) {
-  return { report: `# new2 — no-op\n${reason}`, perCardResults: [], gateLedger: [], residualFollowups: [], telemetry: { variant: 'new2', cards_total: 0, reason } }
+  return { report: `# new2 — no-op\n${reason}`, perCardResults: [], gateLedger: [], residualFollowups: [], residuals: [], degraded: false, degradationReasons: [], telemetry: { variant: 'new2', cards_total: 0, reason } }
 }