baldart 5.5.0 → 5.6.0

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to BALDART will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.6.0] - 2026-07-04
+
+**Outcome-integrity wave (FEAT-0068 post-mortem — mayo, 72.78M token, DONE falso).** Il
+batch chiuse 6/6 card + epic come "✅ DONE, merged" mentre il goal dell'epic era invisibile
+sul ~90% delle schermate: il root cause era in `/prd` (inventario ISA sui consumer del
+meccanismo invece che sui proprietari della superficie; recipe ancorata su un componente
+`@deprecated`; due gate phantom-stampati), attraversava card che nessun gate poteva salvare
+(coverage passata vacuamente su un inventario sbagliato), e veniva sigillato da `/new`/`new2`
+(chiusura epic al commit dell'ultima card — PRIMA della final review — con predicato
+conta-figli, nessun verdetto PARTIAL, safety-commit che spazzava file non gated su develop,
+commit agent in detour sul main checkout). 28 finding crit/high confermati adversarialmente;
+ogni fix è ancorato a un'evidenza del run.
+
+- **Chiusura epic v2 (`/new` 2.3.0 + `new2` 1.8.0)**: SOLO in merge phase (il gate
+  commit-time v4.99.0 è ritirato — aveva anche un anchor bug `^parent:` che lo rendeva
+  no-op); predicato esteso (figli **e follow-up** DONE + nessun residual bloccante +
+  **AC epic verificati con oracoli**); blocklist JS + guardia post-merge (F-029 twin) +
+  ramo **REOPEN** (il ratchet è bidirezionale); classe finding **closure-invalidating**
+  (un "goal not achieved" è un difetto di STATO — il fix di prosa non chiude).
+- **Verdetto PARTIAL calcolato** (`final-review.md` + `buildReport`): residual HIGH+ /
+  epic aperta / AC epic `[ ]` ⇒ headline `⚠️ PARTIAL` col gap nominato; sezione
+  `## Epic goal`; severity sui residui; "nulla perso" mai come surrogato di "non finito".
+- **Igiene git orchestrata**: `merge-worktree.sh --safety-sweep allowlist:` (worktree-manager
+  1.2.0 — il codice non gated va in quarantena etichettata, mai nel trunk sotto un
+  "[safety]" opaco); isolamento worktree del commit agent esteso ai TOOL con evidenza
+  porcelain + guardia JS (era 7.1M di detour + stash dangling); divieto stash + audit
+  post-run dei commit non-card e degli stash del batch (mai "non miei da droppare").
+- **Review**: relay Codex della final review in foreground `--wait` (il polling veniva
+  ucciso dall'enforcement structured-output a 83s/600s → fallback freddo da 3.68M);
+  esito **refuted** ratificato in `new2-resolve` (premessa falsa = zero edit) + divieto
+  di fix che disattivano verifiche mandate da AC (`verification-posture-change`);
+  suite aggiunte dalla card ESEGUITE targeted pre-commit (`completeness.md` 1b).
+- **Routing**: `hasMockup` semantico (la card COSTRUISCE la UI mockata — un bare
+  `links.design` su card docs va all'owner router; era 6.55M di ui-expert su una card
+  docs+ADR).
+- **`/prd` 1.6.0 (il root cause)**: categoria ISA **UI ROLE FAMILY (registry-first)**
+  (owner della superficie dal registry + flag BLOCK su `@deprecated`); §0 LOAD CONTRACT
+  su `discovery-phase.md` (vista PARTIAL ⇒ offset-Read fino in fondo — la coda persa
+  conteneva il Codex completeness cross-check mai eseguito); `module_read` stamps
+  ESEGUITI + item 0-ii Phase-evidence audit (2 gate phantom-stampati sul run reale);
+  `step_3_mode` enum chiuso + contratto `skipped` (mai design hand-authored fuori
+  `/ui-design`) + Reconciliation-lite senza mockup + trigger di ri-enumerazione ISA;
+  gate quantificatore-universale sugli AC epic (`invariant_owners:`); stamp holistic
+  **evidence-gated** (`stamp-holistic-audit.js --audit-report` → `agents_run`; senza
+  artefatto → `status: skipped` = ASSENTE per `/new`); card-writer 1.2.0
+  (self-validation eseguita, epic `ac_verification` obbligatoria, mai count hardcodato,
+  `links.design` solo su card UI, invariante baseline snapshot); HARD RULE mw-docs
+  (+ guardia `/mw` su `kind: docs`); EDIT CONTRACT dello state file (5 retry ciechi
+  da ~250k); `research-protocol.md` pre-flight libreria in difesa.
+- **Tooling maintainer**: `new-session-audit.mjs` guadagna **EPIC_AC_UNMET** (FAIL —
+  retro-validato: il run FEAT-0068 ora fallisce l'audit invece di passarlo) e
+  **GATE_DISABLED_BY_FIX** (WARN) + fix del digest-writer su id workflow con `/`;
+  `check-new-parity.mjs` esteso a 21 policy (chiusura epic, PARTIAL, mockup semantico —
+  con token FORBIDDEN sui meccanismi ritirati).
+- Deliberatamente rinviati (MED/LOW non verificati dal pass avversariale): digest
+  per-batch dei moduli di riferimento (tassa cache ~3-5M), card shape
+  VERIFY-ONLY/MECHANICAL-MIGRATION, sampling visivo del goal epic in final review,
+  script `update-state.mjs` per `/prd` (mitigato dall'EDIT CONTRACT).
+- Codex parity: **portable** — le policy vivono nei moduli prose SSOT (`/new`, `/prd`)
+  e in script zero-dep/shell; i workflow Claude-only (`new2*`, `new-final-review`)
+  hanno ricevuto le STESSE policy dei twin prose (guardia di parity estesa a 21 regole).
+  Nessuna nuova chiave `baldart.config.yml` → la schema-change propagation rule non si
+  applica.
+
 ## [5.5.0] - 2026-07-03
 
 **Migration deploy chain hardened (FEAT-0067 post-mortem — mayo).** The batch's DB

package/VERSION

@@ -1 +1 @@
-5.5.0
+5.6.0

package/framework/.claude/agents/CHANGELOG.md

@@ -7,6 +7,22 @@ per-item agent merge, the doctor probes, and the discovery hooks — like
 
 Formato: [Keep a Changelog](https://keepachangelog.com/) · per-agent SemVer.
 
+## [prd-card-writer v1.2.0] — 2026-07-04 (framework v5.6.0 — FEAT-0068 post-mortem)
+
+- **Epic AC rules**: mai count di figli hardcodato ("le 6 sub-card"); AC con
+  quantificatore universale su una superficie ⇒ `invariant_owners:` dal census
+  registry/ISA; `ac_verification` OBBLIGATORIA sull'epic (≥1 oracolo per goal AC —
+  consumata dal gate di chiusura epic).
+- **`links.design` FORBIDDEN su card che non costruiscono UI mockata** (docs/test/
+  meta-only ⇒ owner coder, riferimenti di contesto in `canonical_docs.additional_refs`)
+  — un pointer vagante clampava la build a ui-expert (6.55M su una card docs).
+- **Invariante snapshot-suite**: una card che CREA una suite visual-regression dichiara
+  il lifecycle delle baseline (generate+committate in-card, o assertion-based) — pena
+  BLOCKER di authoring.
+- **Self-validation**: il writer ESEGUE `validate-card-baseline.js --prd` sul proprio
+  output e ritorna solo su exit 0 (token EARS sempre inglesi verbatim) — mai asserire
+  "YAML-valid" senza aver eseguito il validator.
+
 ## [prd-card-writer v1.1.0] — 2026-07-03 (framework v5.4.0)
 
 - **Proportionality lower-bound** in Card Atomicity Rules: a Tier-Gate TRIVIAL/LIGHT

package/framework/.claude/agents/prd-card-writer.md

@@ -1,6 +1,6 @@
 ---
 name: prd-card-writer
-version: 1.1.0
+version: 1.2.0
 description: "Generates atomic backlog cards from an approved PRD. Handles card YAML writing, dependency graph computation, parallel group assignment, and traceability matrices (FR/NFR, ISA, UI). Invoked by the /prd skill at Step 5 to offload the heaviest mechanical phase from the main context. Also runs in Standalone Single-Card Mode to author ONE baseline-conformant follow-up/CHORE/BUG/issue card (no epic+children) — invoked by /new (AC-deferral), new2/new2-resolve, and /issue-review. The canonical card writer: every card-creation path delegates here rather than hand-writing a partial stub."
 model: opus
 effort: high
@@ -335,7 +335,18 @@ applies even when N=1.
   - `business_rationale` (extended — full strategic context)
   - `scope.summary` + `scope_boundaries` (in_scope summary + out_of_scope deferrals)
   - `acceptance_criteria` as `[ ] [AC-EPIC-N]` items rolling up the PRD ACs (NOT
-    duplicating child ACs — track end-to-end outcomes only)
+    duplicating child ACs — track end-to-end outcomes only). **v5.6.0 (FEAT-0068)
+    epic-AC rules:** (1) NEVER hardcode a child count ("all 6 sub-cards DONE" broke the
+    moment follow-ups appeared — write "all child cards **including any added later**");
+    (2) an AC with a universal quantifier over a surface ("every screen", "tutte le
+    route") MUST list its surface owners in `invariant_owners:` (from the ISA UI ROLE
+    FAMILY census) so the closure gate can re-verify them.
+  - `ac_verification` — **REQUIRED on the epic (v5.6.0)**: ≥1 executable oracle per
+    top-level goal AC (same grounding rule as child cards — only verified commands/greps;
+    else `manual:`). The `/new`/`new2` epic-closure gate RUNS these before flipping the
+    epic DONE — an epic with no oracle can only close via manual evidence, which is
+    slower. (FEAT-0068's goal was greppable at authoring time: "every top-edge family
+    member consumes `--safe-area-inset-top`".)
   - `definition_of_done`: epic-level (e.g. "all sub-card DONE", "PRD test scenarios
     executed", "ssot-registry entry added")
   - `execution_strategy` block with `recommended_mode`, `groups[]` (each with
@@ -505,6 +516,14 @@ Every card MUST include ALL fields from the template:
   `manual: <what a human checks>`. Genuinely undecidable → `[NEEDS CLARIFICATION: …]`.
   Non-manual oracles SHOULD also appear in `validation_commands` (the validator warns on
   drift). Consumed by `/new` Phase 2.5, which EXECUTES them.
+- **Snapshot-suite lifecycle invariant (v5.6.0 — FEAT-0068):** a card whose scope CREATES a
+  visual-regression / snapshot / screenshot-diff suite MUST declare the baseline lifecycle in
+  its requirements + DoD: EITHER "baselines generated (`--update-snapshots` or equivalent) and
+  committed IN THIS CARD" (the generate command listed in `validation_commands`/MAY-EDIT
+  covering the baseline dir) OR "assertion-based checks with screenshots advisory-only". A
+  suite whose baselines "arrive later" with no declared bootstrap is a card-authoring BLOCKER
+  — on the real run it detonated as a merge-blocker and the 4.73M repair "fixed" it by
+  flag-gating the epic's only visual verification.
 - `definition_of_done` (checklist including doc invariants). **When `features.has_i18n: true`** AND the
   card introduces user-facing strings, the DoD MUST carry an i18n-completeness line — NOT merely "strings
   via `t()` + registered", but: *"new keys authored in the source locale + the i18n context registry (by
@@ -519,7 +538,12 @@ Every card MUST include ALL fields from the template:
 - `review_profile` (`skip`|`light`|`balanced`|`deep` — computed via Rule C, or honored if pre-set)
 - `files_likely_touched` (exact paths with NEW/MODIFY)
 - `links.prd` (path to PRD)
-- `links.design` (REQUIRED for any card with UI scope) — the card's screen design
+- `links.design` (REQUIRED for any card with UI scope; **FORBIDDEN on cards that build no
+  mocked UI — v5.6.0**: a docs/test/meta-only card, or one whose `files_likely_touched` has
+  no component/style path, must NOT carry `links.design` even "for context" — downstream the
+  `/new` mockup-first router treats it as a build target and clamps the card to `ui-expert`;
+  on FEAT-0068 the epic explainer stamped on a docs+ADR card cost 6.55M. Point context-only
+  references in `canonical_docs.additional_refs` instead) — the card's screen design
   reference, resolved to a path **that exists on disk in the worktree**:
   - **design.html when one was generated** for this screen (Step 3 produced it).
   - **ELSE the screen's canonical mockup PNG** under `${paths.prd_dir}/<slug>/mockups/`
@@ -732,6 +756,16 @@ The consumer (`new/SKILL.md`) reads `execution_strategy.groups[].level` and
 
 ## Output Format
 
+**Self-validation BEFORE returning (v5.6.0 — you own your domain's deterministic hygiene).**
+Run `node .framework/framework/scripts/validate-card-baseline.js --prd <your card files>` (or
+the `VALIDATOR` path the caller passed) on your own output and fix every deterministic failure
+(enum values, EARS keyword language — the tokens are ALWAYS English verbatim, only the clause
+body follows `identity.language` —, forbidden patterns, missing required fields) IN THIS
+CONTEXT before returning. Return only on exit 0, and state `validator: exit 0 (N cards)` in
+the summary. NEVER assert "YAML-valid / pattern-clean" without having executed the validator —
+on a real session that unexecuted claim cost a full orchestrator round-trip when Step 6
+bounced all 6 children on Italian EARS tokens. Step 6 still re-runs it as the independent gate.
+
 Return to the caller a structured summary:
 
 1. **Card list** — IDs and titles of all cards created

package/framework/.claude/skills/new/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 Formato: [Keep a Changelog](https://keepachangelog.com/) · [SemVer](https://semver.org/).
 
+## 2.3.0 — 2026-07-04 (FEAT-0068 post-mortem: integrità dell'esito)
+
+- **Chiusura epic: solo in merge phase, predicato esteso** — `commit.md` c-bis RITIRATO
+  (timing: chiudeva PRIMA che la final review potesse smentire il goal; anchor bug:
+  `^parent:` non matchava il `parent:` annidato sotto `group:` → gate no-op).
+  `merge-cleanup.md` 5e ora richiede: figli **e follow-up** DONE + nessun residual
+  bloccante/finding closure-invalidating + **AC epic verificati con evidenza**
+  (oracoli `ac_verification`); ramo **REOPEN** per un'epic DONE con scope aperto.
+- **Classe finding "closure-invalidating"** (`final-review.md` F.4): un finding
+  "goal/AC epic non raggiunto" è un difetto di STATO — il fix testuale non basta,
+  l'epic non chiude (o riapre) nello stesso repair commit.
+- **Verdetto PARTIAL calcolato** (`final-review.md` § Report verdict): residual HIGH+ /
+  epic aperta / AC epic `[ ]` ⇒ prima riga `⚠️ PARTIAL` col gap nominato; ✅ riservato.
+- **Routing mockup semantico** (`implement.md` 6a): `HAS_MOCKUP` = la card COSTRUISCE
+  la UI mockata (design_src, o design + bindings/file UI) — un bare `links.design` su
+  card docs/meta va all'owner router (era: clamp a ui-expert, 6.55M su una card docs).
+- **Stamp holistic evidence-gated** (`implement.md` step 4 P1): uno stamp senza
+  `agents_run` non vuoto = ASSENTE → il plan-auditor gira (phantom stamp FEAT-0068).
+- **Suite aggiunte dalla card: eseguite, non solo parse** (`completeness.md` 1b): uno
+  spec ADDED va RUN targeted pre-commit; suite snapshot senza lifecycle baseline
+  dichiarato = `Partial` → gap-fix subito (era: merge-blocker + repair da 4.73M che
+  flag-gatava la verifica dell'epic).
+
 ## 2.2.1 — 2026-07-03 (FEAT-0067 post-mortem: migration vocabulary aliases)
 
 - Il gate di delega `-auto` (condizione 4) e il Migration Gate Phase 0 1b (setup.md

package/framework/.claude/skills/new/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: new
 effort: medium
-version: 2.2.1
+version: 2.3.0
 description: >
   Orchestrate a team of specialized agents to implement one or more backlog cards
   end-to-end inside a dedicated worktree, with code review, doc review, QA, and

package/framework/.claude/skills/new/references/commit.md

@@ -33,14 +33,18 @@
     a. Edit the backlog YAML (`${paths.backlog_dir}/<CARD-ID>.yml`): set `status: DONE`, add `completed_date: <today>`, and add `provenance.implementation_session: <SESSION-ID>` (this run's session UUID — get it with `Bash(echo "${CLAUDE_CODE_SESSION_ID:-}")`; if empty, omit the field). Merge into any existing `provenance:` block written by `/prd` — do NOT overwrite `planning_session`. This makes an implementation bug traceable back to the session that produced it (`~/.claude/projects/*/<id>.jsonl`).
     b. Add implementation notes summarizing what was built.
     c. **Update `${paths.references_dir}/ssot-registry.md`** — add/update the entry for this card's feature area. The pre-commit doc-freshness hook BLOCKS commits that touch `${paths.backlog_dir}/` without a corresponding ssot-registry update. Always include ssot-registry.md in the same commit as the backlog YAML.
-    c-bis. **Epic-closure gate (deterministic — since v4.99.0)**: if the card YAML declares a parent epic (`parent:` field), check — AFTER step a set this card DONE — whether it was the LAST open child. Deterministic count, no judgement:
-       ```bash
-       PARENT=$(awk '/^parent:/ {print $2; exit}' ${paths.backlog_dir}/<CARD-ID>.yml)
-       if [ -n "$PARENT" ]; then
-         PENDING=$(grep -l "^parent: ${PARENT}" ${paths.backlog_dir}/*.yml | xargs grep -L "^status: DONE" | wc -l)
-       fi
-       ```
-       When `PENDING` is `0`: flip the PARENT epic's status in its ssot-registry.md entry to DONE **in the SAME commit**, and if the parent epic has its own backlog YAML, set its `status: DONE` + `completed_date` too. Non-triggers (do nothing, idempotent): the card has no `parent:`; siblings still pending (`PENDING > 0`); the parent entry is already DONE. This closes a recurring consumer gap: step 28c alone updates the CARD's feature-area entry, so epics stayed `IN_PROGRESS` after their last child closed and were only caught by the nightly doc routine (3 confirmed occurrences across two audit windows).
+    c-bis. **Epic closure does NOT happen here (v5.6.0 — the v4.99.0 commit-time gate is RETIRED).**
+       Two proven defects (FEAT-0068 post-mortem): (1) **timing** — closing at the last card's
+       commit runs structurally BEFORE the final review can disprove the epic goal (the FEAT-0068
+       epic closed DONE 13 minutes before the review proved the goal unmet on ~90% of screens),
+       and the commit context cannot see follow-up cards materialized later in the batch;
+       (2) **anchor bug** — the retired gate grepped `^parent:` but the card schema nests
+       `parent:` indented under `group:`, so it was a silent no-op on schema-conformant cards.
+       Epic closure now lives ONLY in the merge phase (`merge-cleanup.md` Phase 6b step 5e,
+       extended predicate: children **and follow-ups** DONE + no blocking residual + **epic ACs
+       verified**), which runs AFTER the final review. At commit time the parent epic and every
+       sibling card YAML are READ-ONLY. The epic-staleness safety net the v4.99.0 gate closed
+       stays closed by Phase 6b 5e + the nightly doc routine.
     d. **Verify the write**: re-read the YAML file and confirm `status: DONE` is present. If not, retry the edit.
     e. Stage BOTH the updated YAML AND ssot-registry.md, then commit (or as an immediate follow-up commit if the Phase 4 implementation commit already happened). When this produces a SECOND commit for the card, record BOTH hashes in the tracker (`commit: <impl-hash> + <done-hash>`) so traceability/bisect is unambiguous.
 29. **Update tracker**: move card to `## Completed Cards` with commit hash(es), summary, flags, **and `card_status: DONE (verified)`** — the tracker is the only state surface (§ "State surface — the tracker only"); do not also emit a TaskUpdate or Progress-Bar turn for the transition. If you surface the card completion to the user at all, do it as a short prose line folded into the commit turn, never a dedicated turn.

package/framework/.claude/skills/new/references/completeness.md

@@ -36,6 +36,16 @@ Before triggering any review, you MUST verify that the coder agent implemented *
    `conditional_items` section → flag as `Missing` (the coder must document the branch taken).
 
 1. **Enter Phase 2.5 (completeness)** — **no standalone tracker write** for phase entry (§ "Context Tracking" allowlist; the tracker records only `2.5-completeness DONE` at step 6, co-emitted). Proceed directly to the next step.
+1b. **Card-added test suites must RUN, not just parse (v5.6.0 — FEAT-0068).** If the card's diff
+   ADDS or modifies a test/spec file, the completeness evidence for that item is a targeted
+   EXECUTION of exactly that file (`npx vitest run <file>` / `npx playwright test <file>` / the
+   toolchain equivalent), in the worktree, before commit — a `--list`/parse check only proves the
+   file compiles, not that the suite can pass. A suite that cannot run yet by design (e.g. a
+   visual-regression suite whose baselines are generated later) is only `Done` if the card
+   EXPLICITLY declares that lifecycle (see `card-schema.md` § snapshot-suite invariant) AND the
+   declared bootstrap command is exercised; otherwise classify `Partial` and route to the
+   gap-fix loop NOW — the FEAT-0068 card shipped a baseline-less suite that detonated as a
+   merge-blocker and was "fixed" by flag-gating the epic's only visual verification (4.73M).
 2. Re-read the backlog card (`requirements`, `acceptance_criteria`, `unknowns`, and `definition_of_done` fields).
 3. Build a checklist — one row per item:
 

package/framework/.claude/skills/new/references/final-review.md

@@ -334,6 +334,16 @@ that is a **gate violation**: log it as
    - **Each domain specialist OWNS its lane end-to-end** — it runs its OWN false-positive check in the finding pass (doc-reviewer for doc, api-perf-cost-auditor for api/perf/data, and the Codex/`code-reviewer`-fallback engine for code), so its surviving findings are **already validated**. Do **NOT** cross-validate a doc or api finding by spawning `code-reviewer` (that is the WRONG specialist judging another domain), and do **NOT** re-run the same specialist over its own findings (self-judge — no model diversity). Codex findings are likewise already FP-validated (Step F.3 protocol includes it).
    - **Residual only:** a finding the originating specialist explicitly leaves UNRESOLVED (`confidence < 80`) is routed to the finding's **domain specialist** (by `domain`: doc→doc-reviewer, api/perf→api-perf-cost-auditor, security/migration→security-reviewer, test→qa-sentinel, else code-reviewer) over the cited file:line. If that domain specialist **is** the originating finder (it already had its pass), classify `NEEDS_MANUAL_CONFIRMATION` instead of re-spawning it — never self-judge, never silently drop.
    - Classify: `VERIFIED` | `FALSE_POSITIVE` | `NEEDS_MANUAL_CONFIRMATION`.
+   - **Closure-invalidating findings (v5.6.0 — FEAT-0068 post-mortem).** A VERIFIED finding (any
+     severity) asserting that an **epic goal or epic AC is NOT met** while state says otherwise —
+     overclaim in the SSOT/registry, "DONE but unmet", "goal not achieved" — is a **STATE defect,
+     not a prose defect**. Tag it `closure_invalidating: true`. Its fix has TWO mandatory parts:
+     (1) the text correction (the doc fixer's job as usual), AND (2) the **state reversal** — the
+     named epic must NOT be closed in Phase 6b, or, if already `DONE` on disk, must be REOPENED to
+     `IN_PROGRESS` in the same repair commit (`merge-cleanup.md` 5e step a). Accepting the text
+     fix alone as resolution merges a registry that says "goal not achieved" alongside an epic
+     YAML that says DONE — the exact FEAT-0068 contradiction. The batch verdict becomes PARTIAL
+     (§ Report verdict below) whenever one of these stands.
    - `VERIFIED` findings proceed to fixes — **EXCEPT no-action ones** (`requires_action:false`, or a "no fix required" / "acceptable as-is" / "verified non-issue" direction; MEDIUM/LOW only). A no-action finding is TRUE but needs no change: record it (`decision=skipped | reason=no-action`) and do NOT route it to a writer. (The delegated `new-final-review` workflow returns these separately as `noActionFindings` + `summary.noAction`; the inline path classifies them here.) **`NEEDS_MANUAL_CONFIRMATION` findings are NOT discarded** — list them in `## Issues & Flags` and surface them to the user via `AskUserQuestion` (treat as VERIFIED, treat as FALSE_POSITIVE, or hand off) before merge. **When AUTONOMOUS, apply § "AUTONOMOUS RESOLUTION RULE" (SKILL.md): category=blocker; recommended=treat NEEDS_MANUAL_CONFIRMATION as VERIFIED (never as a false positive), else materialize a follow-up card.** Only `FALSE_POSITIVE` are dropped.
 
 ### Step F.5 — Apply fixes and final build
@@ -403,6 +413,19 @@ that is a **gate violation**: log it as
 4. Emit the **minimal end-of-batch result block** (per § "orchestrator is near-silent" in the core SKILL.md — this is NOT a per-phase report). ONE line per card and nothing more of the process telemetry:
    - `<CARD-ID>: merged @<sha> | failed: <one clause> | deferred → <followup-id>`
 
+   **Report verdict (v5.6.0 — HARD headline rule, FEAT-0068 post-mortem).** The FIRST line of the
+   result block is a verdict, and it is computed, not felt:
+   - `⚠️ PARTIAL — obiettivo epic NON raggiunto: <one clause naming the gap>` whenever ANY of:
+     a HIGH/BLOCKER residual or follow-up carrying substantive scope work exists; the parent epic
+     was left open (or reopened) by Phase 6b 5e; a closure-invalidating finding stands; any epic
+     AC is still `[ ]`. Name the gap and its follow-up card in the first three lines.
+   - `✅ COMPLETO` is RESERVED for: every card merged, no HIGH+ residual, epic (when present)
+     closed with ACs verified.
+   A run that ships 6/6 cards but leaves the epic goal on 10% of its surface is PARTIAL — the
+   FEAT-0068 report headlined "✅ batch completo" over a disclosed-but-buried HIGH gap, and the
+   user discovered it only by asking. "Nulla perso" (tracking) is never a substitute for "non
+   finito" (truth): a follow-up that holds the epic's remaining work is REMAINING WORK.
+
    Then, **only if non-empty**, the **actionable residue**: issues needing user attention (anything unresolved, partially wired, or flagged — terse, with `path:line` / `CARD-ID` exact). All process telemetry — files changed, test/build/lint status, fix cycles, review-finding counts, UX/QA verdicts, commit + merge hashes, card-status reconciliation, worktree cleanup, knowledge-corpus sync — is **NOT rendered**: it lives in the tracker and `$METRICS/skill-runs.jsonl`. (The Next Steps & Launch Command in 4b below and any Production Readiness manual steps ARE part of the actionable residue — keep them.)
 
 4b. **Next Steps & Launch Command** (MANDATORY section — always present):

package/framework/.claude/skills/new/references/implement.md

@@ -11,10 +11,10 @@
 2b. **Claim** — only now set the card status to `IN_PROGRESS` (in the backlog YAML / tracker) and assign yourself. This is a state write, not a visibility emission — do not also spend a TaskUpdate / Progress-Bar turn (§ "State surface — the tracker only").
 2c. **Trivial-card classification (BLOCKING gate for steps 3–4)** — evaluate `IS_TRIVIAL(card)` per § "Trivial-card fast-lane". Note: condition 3 (non-source diff) cannot be fully evaluated until the coder has produced the diff, so at this point compute the **provisional** trivial flag from conditions 1+2 only (`review_profile == skip` AND no Step-A trigger sourced from the card YAML text + `files_likely_touched` extensions — if EVERY path in `files_likely_touched` is non-source, condition 3 is provisionally satisfied). If provisionally trivial → **SKIP steps 3, 3a, and 4** (architecture grounding); log `trivial: architecture grounding skipped (review_profile=skip + non-source files_likely_touched + 0 triggers)` and jump to Phase 2. Re-confirm `IS_TRIVIAL` on the ACTUAL committed diff at the review gates (Phase 2.55/3.5/3.7); if the coder unexpectedly touched a source file, the guard flips the card back onto the normal review path there. If NOT provisionally trivial → run steps 3, 3a, 4 as normal.
 2d. **Light-lane inline grounding (since v5.4.0 — BLOCKING gate for steps 3–4, after 2c)** — when the card is NOT provisionally trivial AND `review_profile == light`: **SKIP step 3 (the dedicated codebase-architect spawn) and step 4** — the OWNER agent grounds INLINE instead, per **AGENTS.md § Change Tiers, orchestrated-pipeline exception** (a light card is ≤3 files with no logic-risk signal by Rule C; a dedicated retriever at that scale costs more than the exploration it isolates). The understanding obligation is UNCHANGED — only the delegation is waived: the owner briefing (step 6/7) MUST carry the line "Ground INLINE before coding: read the files in scope + their immediate integration points; scoped exploration only". Step 3a still runs (write Active Code Context from the card YAML, noting `grounding: inline-light`). Log `phase1: INLINE-LIGHT (review_profile=light — no retriever spawn, owner grounds inline)`. `balanced`/`deep` cards run steps 3, 3a, 4 as written — this lane never applies to them.
-3. **(skip when provisionally trivial — see 2c — or on the light lane — see 2d)** Invoke the **codebase-architect** agent (MUST per AGENTS.md) to understand the relevant codebase area, existing patterns, and architecture before any implementation. When `features.has_lsp_layer: true`, the architect uses LSP find-references for identifier-shaped lookups — this needs NO handoff from the orchestrator: the architect reads `features.has_lsp_layer` from `baldart.config.yml` directly (the flag is ambient) per `agents/code-search-protocol.md`. Likewise, when `features.has_code_graph: true`, the architect uses the Graphify code graph for structural/relational lookups (ambient flag) per `agents/code-graph-protocol.md`. The orchestrator does NOT propagate either flag. (Earlier doc versions numbered this step 4; the step that read project-status BEFORE the architect was removed because it persisted pre-analysis context — see step 3a.) **Pass `OUTPUT=terse` in the architect prompt (since v4.49.0)** — this is grounding for the coder/reviewer, not an explanation, so the architect returns its structured contract (reuse table + canonical evidence + `path:line — symbol` rows + `totals:`) without narrative prose. **Pass the analysis profile too (since v4.94.0)**: `PROFILE=ui` when the card has a non-empty `links.design` OR `links.design_src` (the same mockup bit that drives step 6a), else `PROFILE=feature` — contract and per-profile scoping in `agents/analysis-profiles.md` (its § 3 caller routing table is normative). The profile is deterministic from the card YAML; never leave the architect to infer it. The verbatim baseline persisted at step 5b keeps all the substance a lean `/codexreview` needs (paths, signatures, patterns, high-risk paths) while staying small in the orchestrator's context and on disk. **Baseline content contract (MANDATORY — since v4.56.0):** the architect prompt is grounding INPUT only — pass the card scope, `files_likely_touched`, and the question to map. NEVER put line-level fix directives ("remove lines 90-91", "Fix: use X"), the words "implement/fix/apply", or acceptance-criteria framed as a task into the architect prompt. The architect produces a read-only MAP (file/symbol locations, patterns, type signatures, integration points, high-risk paths); it does NOT implement and has no `Task`/Agent tool to delegate (see `codebase-architect.md` § Role boundary). The coder is a separate spawn the orchestrator owns.
+3. **(skip when provisionally trivial — see 2c — or on the light lane — see 2d)** Invoke the **codebase-architect** agent (MUST per AGENTS.md) to understand the relevant codebase area, existing patterns, and architecture before any implementation. When `features.has_lsp_layer: true`, the architect uses LSP find-references for identifier-shaped lookups — this needs NO handoff from the orchestrator: the architect reads `features.has_lsp_layer` from `baldart.config.yml` directly (the flag is ambient) per `agents/code-search-protocol.md`. Likewise, when `features.has_code_graph: true`, the architect uses the Graphify code graph for structural/relational lookups (ambient flag) per `agents/code-graph-protocol.md`. The orchestrator does NOT propagate either flag. (Earlier doc versions numbered this step 4; the step that read project-status BEFORE the architect was removed because it persisted pre-analysis context — see step 3a.) **Pass `OUTPUT=terse` in the architect prompt (since v4.49.0)** — this is grounding for the coder/reviewer, not an explanation, so the architect returns its structured contract (reuse table + canonical evidence + `path:line — symbol` rows + `totals:`) without narrative prose. **Pass the analysis profile too (since v4.94.0)**: `PROFILE=ui` when the card's `HAS_MOCKUP` bit is true (the same semantic mockup test that drives step 6a — v5.6.0: a bare `links.design` pointer on a docs/meta card does NOT make it a UI card), else `PROFILE=feature` — contract and per-profile scoping in `agents/analysis-profiles.md` (its § 3 caller routing table is normative). The profile is deterministic from the card YAML; never leave the architect to infer it. The verbatim baseline persisted at step 5b keeps all the substance a lean `/codexreview` needs (paths, signatures, patterns, high-risk paths) while staying small in the orchestrator's context and on disk. **Baseline content contract (MANDATORY — since v4.56.0):** the architect prompt is grounding INPUT only — pass the card scope, `files_likely_touched`, and the question to map. NEVER put line-level fix directives ("remove lines 90-91", "Fix: use X"), the words "implement/fix/apply", or acceptance-criteria framed as a task into the architect prompt. The architect produces a read-only MAP (file/symbol locations, patterns, type signatures, integration points, high-risk paths); it does NOT implement and has no `Task`/Agent tool to delegate (see `codebase-architect.md` § Role boundary). The coder is a separate spawn the orchestrator owns.
 3a. Update `${paths.references_dir}/project-status.md` Active Code Context (skip when the file does not exist in the project) — do this AFTER the codebase-architect run (step 3) so the "Active Code Context" reflects the architect's findings (which files are actually in scope), not just the card YAML's `files_likely_touched`. Writing it before the architect run would persist pre-analysis claims that downstream agents (e.g. a parallel card) would then read as truth.
 4. **Plan-auditor grounding check** — but first, a **provenance skip (since v4.7.0 — mirror of Step 3d)**: the `/prd` Step 6.6 holistic audit already ran a per-card grounding pass when the card was authored. Re-grounding here is only worth a plan-auditor spawn if something changed since. **This skip is the NORMAL path for a card implemented right after `/prd`, not an occasional optimization** — `/prd` now guarantees the `metadata.holistic_audit` stamp lands on every audited card (deterministic backstop at `validation-phase.md` Step 7 item 5b, since the v4.88.2 provenance-reliability fix), so P1 below holds whenever the batch is freshly authored. Skip the plan-auditor when **BOTH** hold:
-   - **P1 — provenance present**: the card has `metadata.holistic_audit` with non-empty `audited_at`, `audited_commit`, `audited_set`.
+   - **P1 — provenance present AND evidence-backed (v5.6.0)**: the card has `metadata.holistic_audit` with non-empty `audited_at`, `audited_commit`, `audited_set`, **and a non-empty `agents_run` list** (the v5.6.0 evidence field the stamper writes only when it received a real audit report). A stamp with `status: skipped` or WITHOUT `agents_run` is treated as **ABSENT** — the FEAT-0068 `/prd` session stamped all 6 cards while the Step 6.2–6.6 audit team never spawned (phantom stamp), and P1∧P2 would have suppressed the plan-auditor on a false premise. Pre-v5.6.0 stamps (no `agents_run` field at all) therefore fall through to RUN the plan-auditor — deliberate fail-safe, not a bug.
    - **P2 — no drift on this card's claimed paths** since the audit baseline. With `$AC` = `metadata.holistic_audit.audited_commit`, `$MAIN`/`$TRUNK` from the tracker, and this card's `files_likely_touched`/claimed paths (`$CARD_PATHS`):
      ```bash
      # empty AC, AC not in history, or any git error → treat as drift (do NOT skip)
@@ -57,7 +57,17 @@
    If card is an epic (id ends "-00" OR filename ends "-epic.yml" OR review_profile == "skip"
        with no requirements): SKIP — log "[ROUTER] card <ID> is an epic (tracker) — skipped,
        not implemented" and move to the next card.
-   If card has links.design OR links.design_src (a mockup exists):
+   # v5.6.0 (FEAT-0068): "has a mockup" is SEMANTIC, not a bare-field test. The /prd epic
+   # explainer html stamped on 5/6 cards clamped a docs+ADR card to ui-expert (6.55M, the
+   # run's costliest agent) and put a meta-only card through the fidelity lane.
+   HAS_MOCKUP := links.design_src is non-empty
+                 OR ( links.design is non-empty
+                      AND ( component_bindings is non-empty
+                            OR files_likely_touched intersects component/style/UI source paths ) )
+   # A bare links.design on a docs/test/meta-only card is a POINTER to the epic's design
+   # explainer, not a build target → route by owner_agent (step 6b). Log the demotion:
+   # "[ROUTER] card <ID> carries links.design but builds no mocked UI → owner_agent router".
+   If HAS_MOCKUP:
        IF the /ui-implement skill is available:
            DELEGATE this card's mockup→code implement + fidelity verify to /ui-implement
            in programmatic mode (contract: ui-implement/references/integration.md).
@@ -82,7 +92,7 @@
    ```
 
    `owner_agent` is still honored for **review/ownership semantics** (AC-closure ownership, `security-reviewer` relevance, the mixed-card review cluster) — it simply no longer decides the BUILD agent when a mockup is present.
-6b. **Agent dispatch (router — cards WITHOUT a mockup only).** Reached only when step 6a did not fire (the card has no `links.design`/`links.design_src`). Read `owner_agent` from the card YAML and resolve the spawn target per the table in § Agent Routing above:
+6b. **Agent dispatch (router — cards WITHOUT a mockup only).** Reached only when step 6a did not fire (`HAS_MOCKUP` false — no mockup, or a bare `links.design` pointer on a card that builds no mocked UI). Read `owner_agent` from the card YAML and resolve the spawn target per the table in § Agent Routing above:
 
    ```
    Let raw = card.owner_agent (string, may be missing).

package/framework/.claude/skills/new/references/merge-cleanup.md

@@ -93,24 +93,45 @@ The most common failure mode is leaving cards IN_PROGRESS after merge. This crea
 
    For each **distinct parent epic** referenced by the batch — the set of `group.parent`
    values across the batch cards, PLUS any card in the batch that is itself an epic
-   (`group.is_epic: true`) — do:
-   a. Read the epic parent card `${paths.backlog_dir}/<EPIC-ID>.yml`. If `status: DONE`
-      already → skip (idempotent).
-   b. Check that **every** child is DONE (not just the batch's subset — children
-      implemented in earlier sessions count too):
+   (`group.is_epic: true`) — close ONLY when the FULL predicate (a)–(d) holds
+   (v5.6.0, FEAT-0068 post-mortem: the old children-count-only predicate closed an epic whose
+   goal was unmet on ~90% of screens — the count was true and the DoD was false):
+   a. Read the epic parent card `${paths.backlog_dir}/<EPIC-ID>.yml`.
+      - `status: DONE` already **and** the checks below still hold → skip (idempotent).
+      - `status: DONE` already **but** (b)/(c)/(d) now FAIL (an open follow-up child appeared, a
+        closure-invalidating finding stands) → **REOPEN** it: set `status: IN_PROGRESS`, annotate
+        `completed_date`, add note `"REOPENED — closed against open scope (v5.6.0 guard)"`, fold
+        into the reconciliation commit. The ratchet is two-way: a false DONE never survives a
+        reconciliation pass.
+   b. Check that **every** child is DONE (not just the batch's subset — children implemented in
+      earlier sessions count too, and **follow-up cards count as children**: a
+      `<card>-followup-*.yml` carrying `parent: <EPIC-ID>` is an OPEN child until implemented):
       ```bash
       # Lists children of <EPIC-ID> that are NOT yet DONE. Empty output ⇒ all DONE.
+      # No ^ anchor — the schema nests `parent:` indented under `group:` (the v4.99.0
+      # commit-time gate anchored it and was a silent no-op; do not re-introduce that).
       grep -l "parent: <EPIC-ID>" ${paths.backlog_dir}/*.yml | xargs grep -L "status: DONE"
       ```
-   c. **Only if** that command prints nothing (all children DONE) → force-update the epic
-      parent: set `status: DONE`, add `completed_date: <today>`, add note
-      `"Marked DONE by epic-closure gate (Phase 6b) — all children DONE"`. Stage it and
-      **fold into the SAME reconciliation commit** as step 5 (or, if step 5 didn't run
-      because all children were already DONE, make a dedicated
-      `[BATCH] Close epic <EPIC-ID> — all children DONE` commit, honoring the same
-      COMMIT_LOCK / doc-freshness precautions as step 5a–5d).
-   d. **If any child is still open** → leave the epic untouched: it is genuinely still in
-      progress, and step-4b's "Card rimanenti nell'epic" table already reports the gap.
+   c. **No blocking open work attached to the epic**: scan the tracker's `## Issues & Flags` +
+      residual/follow-up ledger for this batch — any open `scope-expansion` / `unresolved` /
+      `ac-unmet` item on a child of this epic, or any **closure-invalidating** final-review
+      finding (`final-review.md` § Closure-invalidating findings) naming this epic's goal →
+      leave the epic OPEN (a text fix to the overclaiming doc does NOT clear this).
+   d. **Epic ACs verified**: read the epic YAML's own `acceptance_criteria`. For each `[ ]`
+      item, verify it with concrete evidence — run its `ac_verification` oracle when present,
+      else a targeted check — and flip to `[x]` ONLY with evidence recorded in the tracker. An
+      AC you cannot verify stays `[ ]` and the epic stays OPEN (report which AC and why).
+      Never close an epic whose own checklist still has `[ ]` items.
+   e. **Only if (b)+(c)+(d) all pass** → update the epic parent: set `status: DONE`, add
+      `completed_date: <today>`, add note `"Marked DONE by epic-closure gate (Phase 6b) —
+      children+follow-ups DONE, ACs verified"`. Stage it and **fold into the SAME reconciliation
+      commit** as step 5 (or, if step 5 didn't run because all children were already DONE, make a
+      dedicated `[BATCH] Close epic <EPIC-ID>` commit, honoring the same COMMIT_LOCK /
+      doc-freshness precautions as step 5a–5d).
+   f. **If any check fails** → leave the epic untouched (or REOPEN per step a) and report the
+      concrete reason: step-4b's "Card rimanenti nell'epic" table + the final report's epic-goal
+      line must show it — the batch verdict is **PARTIAL**, never ✅, while the epic is open
+      (`final-review.md` § Report verdict).
 6. **Update tracker** with reconciliation results:
    ```
    ## Phase 6b — Status Reconciliation

package/framework/.claude/skills/new2/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 Formato: [Keep a Changelog](https://keepachangelog.com/) · [SemVer](https://semver.org/).
 
+## 1.8.0 — 2026-07-04 (FEAT-0068 post-mortem: integrità dell'esito + igiene git)
+
+- **`new2.js`**: step 4b (chiusura epic) RIMOSSO dal commit agent — la chiusura vive
+  SOLO nella merge phase 5e col predicato v5.6.0 (blocklist JS `closureBlockedEpics`
+  da residual/follow-up/finding closure-invalidating + figli/follow-up DONE + AC epic
+  verificati, `epicsLeftOpen` con motivi); **guardia post-merge** gemella di F-029
+  (`epic-closure-guard` VIOLATION + residual `false-epic-closure` HIGH → la skill
+  riapre); detection **closure-invalidating** sui finding della final review.
+- **`buildReport`**: verdetto calcolato `⚠️ PARTIAL`/`✅ COMPLETO` come PRIMA sezione,
+  sezione `## Epic goal` per-epic, `severity` sui residui (`residualSeverity`),
+  "nulla perso" consentito solo senza HIGH.
+- **Commit agent**: clausola WORKTREE ISOLATION estesa ai TOOL (Read/Edit/Write path
+  assoluti — il cwd HARD RULE v5.3.0 copriva solo Bash), path del card YAML del
+  worktree passato esplicito, sibling/epic READ-ONLY, evidenza porcelain
+  before/after sul main + **isolation-guard JS** (main sporcato = VIOLATION +
+  residual HIGH). Era: 79 turni/4.30M di detour + stash dangling.
+- **Merge**: `merge-worktree.sh --safety-sweep allowlist:` (solo bookkeeping del
+  batch; codice non gated mai spazzato nel trunk — F-030 per costruzione); divieto
+  esplicito di `git stash` ovunque (ff-pull bloccato = leave+report).
+- **`new2-resolve.js`**: esito **`refuted`** ratificato avversarialmente (premessa
+  falsa = zero edit — era: 4.73M per "fixare" un blocker falso disattivando la suite
+  visual-regression) + `terminalReason: verification-posture-change` (un fix che
+  skippa/flag-gata una verifica mandata da un AC è FORBIDDEN).
+- **`new-final-review.js`**: relay Codex in **foreground `--wait`** (una sola Bash,
+  timeout 600000) — l'enforcement structured-output forzava un TIMEOUT a 83s/600s e
+  il processo moriva col relay → fallback freddo da 3.68M; reap dell'orfano scoped
+  al worktree su timeout reale.
+- **Routing**: `hasMockup` semantico nel cardGraph (BUILDS the mocked UI) +
+  `parentEpic` per blocklist/report.
+- **SKILL.md**: Step 2 predicato di chiusura completo + **ramo REOPEN** (ratchet
+  bidirezionale); Step 4 presenta il verdetto verbatim (mai ri-headline un PARTIAL);
+  **Step 4b audit igiene git** (commit non-card ispezionati con `git show --stat` —
+  mai attribuire provenienza senza check; stash del batch riconciliati, mai "non
+  miei"; residual `main-repo-contamination` ripristinati); pre-sha del trunk
+  registrato al kickoff.
+
 ## 1.7.0 — 2026-07-03 (FEAT-0067 post-mortem: migration mai deployata)
 
 - **Step 3.5 vocabulary aliases**: il Migration Gate ora riconosce, oltre a

package/framework/.claude/skills/new2/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: new2
 effort: high
-version: 1.7.0
+version: 1.8.0
 description: >
   Workflow-hosted batch engine for /new. Implements one or
   more backlog cards end-to-end by delegating the WHOLE batch to a background
@@ -202,7 +202,9 @@ Workflow({ name: 'new2', args: {
 ```
 
 Record the kickoff time (`ts`) before the call — Step 5 uses it to stamp the
-real wall-clock duration (the workflow cannot read a clock).
+real wall-clock duration (the workflow cannot read a clock). Also record the
+pre-batch trunk sha (`git -C $MAIN rev-parse ${trunk}`) — Step 5.4b audits every
+non-card commit the batch introduced against it (v5.6.0).
 
 Capture `sessionId` the same way, in THIS skill's own context (not a subagent):
 `Bash(echo "${CLAUDE_CODE_SESSION_ID:-}")`. The workflow stamps it as
@@ -254,6 +256,10 @@ returns when the batch is done. It returns:
    step-1b HALT fields — the `/new` pre-flight back-fill (step 1b-ii) then normalizes its
    `review_profile`/`owner_agent` on first ingestion, so even the crisis stub self-heals. This
    main-repo, **disk-verified** write is the SSOT — nothing is dropped even on a non-merged batch.
+   **Exception (v5.6.0):** residuals of kind `false-epic-closure` and `main-repo-contamination` are
+   **reconciliation ACTIONS, not backlog work** — do NOT mint follow-up cards for them. The former
+   is handled by step 2's REOPEN branch; the latter by step 4b's hygiene audit (inspect + restore
+   the named main-repo paths).
 1b. **Migration Sync Tail (post-merge "branch B" — the interactive owner-gated deploy the
    autonomous batch could not run).** The workflow has returned and merged; you are the skill
    main loop, in `$MAIN`, typically on `$TRUNK` — exactly the precondition of the project's
@@ -310,11 +316,25 @@ returns when the batch is done. It returns:
    **Then re-run the epic-closure check for the cards just marked DONE.** The merge agent's
    epic-closure (Phase 6b step 5e) ran BEFORE this step, when the deferred cards were still
    NON-DONE — so an epic whose last open child was a deferred card is still TODO and nothing
-   else will ever close it. For each distinct `group.parent` of the cards marked DONE here: if
-   `grep -l "parent: <EPIC-ID>" ${paths.backlog_dir}/*.yml | xargs grep -L "status: DONE"`
-   prints nothing, set the epic card `status: DONE` + `completed_date` + note
-   `"epic-closure gate — all children DONE (post-run, new2 skill)"`, folded into the SAME
-   reconciliation commit. If any child is still open, leave the epic untouched.
+   else will ever close it. For each distinct `group.parent` of the cards marked DONE here,
+   close ONLY when the FULL v5.6.0 predicate holds (the same one the merge agent runs —
+   `merge-cleanup.md` § epic closure): (a) `grep -l "parent: <EPIC-ID>" ${paths.backlog_dir}/*.yml
+   | xargs grep -L "status: DONE"` prints nothing — **follow-up cards count as children** (step 1
+   just materialised them here in the main repo, so this grep now sees them); (b) no `residuals[]`
+   entry of a blocking class (`scope-expansion`/`unresolved`/`ac-unmet`/`out-of-ownership`) maps to
+   a child of this epic; (c) the epic YAML's own `acceptance_criteria` are all `[x]` — verify any
+   still-`[ ]` item with its `ac_verification` oracle (or a targeted check) and flip it ONLY with
+   evidence; an unverifiable AC leaves the epic OPEN. When all three hold, set the epic
+   `status: DONE` + `completed_date` + note `"epic-closure gate — children DONE + epic ACs
+   verified (post-run, new2 skill)"`, folded into the SAME reconciliation commit. Otherwise leave
+   the epic untouched and say why in the presentation.
+   **REOPEN branch (v5.6.0 — the ratchet is two-way now).** For every `false-epic-closure`
+   residual, AND for any epic found `status: DONE` on disk while the grep above still prints an
+   open child (follow-ups included) or a closure-invalidating finding stands: flip the epic back
+   to `status: IN_PROGRESS`, remove/annotate its `completed_date`, add note `"REOPENED — closed
+   against open scope (false DONE, v5.6.0 guard)"`, and fold into the same reconciliation commit.
+   An epic whose registry/ADR text says "goal not achieved" while its YAML says DONE is exactly
+   the FEAT-0068 contradiction this branch exists to prevent — the STATE wins, not the prose.
 3. **Resume if degraded — HARD-BOUNDED (v4.92.0).** If `degraded` is true, re-invoke
    the workflow with `Workflow({ scriptPath, resumeFromRunId })` (same `args` + the
    new `ts`). The per-card **skip-completed** guard makes the resume idempotent —
@@ -377,11 +397,31 @@ returns when the batch is done. It returns:
      (out of scope by design — the workflow is autonomous).
    - Record `escape_hatch: { eligible: N, offered: <bool>, ran_new: <bool>, followups: [...] }`
      in telemetry (step 5 below) so the A/B stays honest about when the hatch was used.
-4. **Present.** Print `report` verbatim. Surface `residuals` prominently
-   ("questi residui sono tracciati come follow-up: …") — the post-run review that
-   replaced the ~25 mid-run questions. If `degraded`, say so plainly (the run was
-   incomplete and resumed). If the escape hatch ran `/new` (step 3b), fold its outcome
-   into the presentation (which follow-ups were closed by `/new`).
+4. **Present.** Print `report` verbatim — **including its verdict headline** (`⚠️ PARTIAL` /
+   `✅ COMPLETO`, v5.6.0): NEVER re-headline a PARTIAL run as a success in your own framing, and
+   never bury an epic-goal gap under a completion table (the FEAT-0068 report said "✅ 6/6 DONE"
+   over a disclosed-but-buried HIGH gap — the user discovered it only by asking). Surface
+   `residuals` prominently ("questi residui sono tracciati come follow-up: …") — the post-run
+   review that replaced the ~25 mid-run questions; a HIGH residual is REMAINING WORK, present it
+   as such. If `degraded`, say so plainly (the run was incomplete and resumed). If the escape
+   hatch ran `/new` (step 3b), fold its outcome into the presentation (which follow-ups were
+   closed by `/new`).
+4b. **Batch git hygiene audit (v5.6.0 — never assert provenance without checking).** From the
+   kickoff you know the trunk's pre-batch sha (record `git -C $MAIN rev-parse ${trunk}` at Step 4
+   BEFORE launching the workflow). Now:
+   - `git -C $MAIN log --oneline <pre-sha>..HEAD` — for every commit whose subject does NOT
+     reference a batch card id (e.g. `[safety]`, unexpected chores), run `git show --stat <sha>`
+     and LIST it in the presentation with its files. Never attribute a commit to "a previous run"
+     without this check (the FEAT-0068 orchestrator asserted exactly that, and it was false).
+     A safety/sweep commit whose files are outside the batch's bookkeeping is a finding to
+     surface, not to normalize.
+   - `git -C $MAIN stash list` — any stash created during this batch (grep the batch/card ids and
+     the `baldart-new2-` label) MUST be reconciled NOW: inspect (`git stash show -p`), then apply
+     or drop with the user's standing policy — in AUTONOMOUS mode leave it but list it as a
+     PROMINENT pending item, never as a footnote and never "not mine to drop" (if this batch's
+     machinery created it, it IS yours to reconcile).
+   - Every `main-repo-contamination` residual: inspect the named paths in `$MAIN` and restore
+     them (they are the commit-agent detour's droppings), reporting what was restored.
 5. **Record truthful telemetry — reconciled against disk (F-040).** Before appending `telemetry`
    to `${metricsDir}/skill-runs.jsonl`, fill the fields the workflow could not compute and
    **reconcile the report against the real disk state** (agent `reason` strings can over-claim — a