create-egregore 0.19.21 → 0.19.23

package/runtime/pi/.codex/skills/ingest/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/ingest/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/ingest-google/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/ingest-google/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/ingest-user-interview/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/ingest-user-interview/SKILL.md`, reproduce the same visi
 
 1. Read `.claude/skills/ingest-user-interview/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/invite/SKILL.md

@@ -21,8 +21,11 @@ and, in connected mode, create the Egregore join link.
    - Parse the response and show invite status, memory access status, and the
      returned invite URL.
    - Best-effort graph record with `bin/graph.sh`.
-   - Best-effort direct notification with `bin/notify.sh send` only if a
-     contact channel exists.
+   - If a contact channel exists, follow
+     `.claude/context/notification-consent.md`: prepare a direct-message plan
+     and show the exact organization, recipient, channel, and message in a
+     separate Send / Edit / Cancel checkpoint. The invite request is not
+     notification consent.
 5. Local mode:
    - Use GitHub API collaborator endpoints for the core repo, memory repo, and
      managed repos.
@@ -38,3 +41,4 @@ and, in connected mode, create the Egregore join link.
 - Only org admins can complete the connected invite flow; report API denial
   clearly and give the manual GitHub access URL.
 - Do not use Claude Code commands.
+- Never fall back from an invite DM to a group or dispatch from detached work.

package/runtime/pi/.codex/skills/issue/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/issue/SKILL.md`, reproduce the same visible UX in Codex:
 
 1. Read `.claude/skills/issue/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/me/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/me/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/meeting/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/meeting/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/meeting/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/minion/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/minion/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/mock/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: mock
+description: 'Fallback Codex adapter for the Egregore mock workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore mock Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/mock/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/note/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/note/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/onboarding/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/onboarding/SKILL.md`, reproduce the same visible UX in C
 
 1. Read `.claude/skills/onboarding/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/pr/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/pr/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/product-voice/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: product-voice
+description: 'How Egregore talks to users during normal work — onboarding messages, tutorial prose, command output, error messages, status confirmations, session greetings, help text. The ''warm colleague'' register. Use when writing or editing in-product copy, or when a skill needs guidance on how to address the user. Triggers on: ''how should this read'', ''onboarding copy'', ''tutorial text'', ''error message'', ''help text'', ''status message'', ''command output prose''. Do NOT use for external writing (use egregore-voice), outreach emails (use alpha-openers), or character encounters (use character-v4).'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore product-voice Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/product-voice/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/project/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/project/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/project/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/pull/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/pull/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/push/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/push/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/quest/SKILL.md

@@ -45,9 +45,12 @@ git -C memory commit -m "quest: $SLUG $ACTION" --quiet
 git -C memory push origin main --quiet
 ```
 
-7. In connected mode only, mirror changes best-effort with `bin/graph.sh` and
-   notify named people with `bin/notify.sh send`. If graph or notification
-   fails, report that the quest was saved to memory and continue.
+7. In connected mode only, mirror changes best-effort with `bin/graph.sh`.
+   For each named person, follow `.claude/context/notification-consent.md`:
+   create a direct-message plan, then show a separate exact Send / Edit /
+   Cancel checkpoint. Selecting quest participants is not notification
+   consent, and approvals cannot be batched across recipients. If planning or
+   dispatch fails, report that the quest was saved to memory and continue.
 
 ## Interaction
 

package/runtime/pi/.codex/skills/quest-suggest/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/quest-suggest/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/reflect/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/reflect/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/reflect/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/review-pr/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/review-pr/SKILL.md`, reproduce the same visible UX in Co
 
 1. Read `.claude/skills/review-pr/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/save/SKILL.md

@@ -15,6 +15,8 @@ which branch, commit, push, pull request, or memory sync steps are required.
 2. Inspect state silently:
 
 ```bash
+BASE=$(bash -c 'SCRIPT_DIR="$PWD"; CONFIG="$PWD/egregore.json"; . "$PWD/bin/lib/config.sh" && _get_base_branch') ||
+  { echo "Could not resolve the configured base branch; stopping before Git changes." >&2; exit 1; }
 git status --short
 git status --short memory 2>/dev/null || true
 BRANCH=$(git branch --show-current)
@@ -22,10 +24,10 @@ AHEAD=0
 OPEN_PR=""
 case "$BRANCH" in
   dev/*|feature/*|bugfix/*)
-    git fetch origin develop --quiet 2>/dev/null || true
-    AHEAD=$(git rev-list --count "origin/develop..HEAD" 2>/dev/null || echo 0)
+    git fetch origin "$BASE" --quiet 2>/dev/null || true
+    AHEAD=$(git rev-list --count "origin/$BASE..HEAD" 2>/dev/null || echo 0)
     if command -v gh >/dev/null 2>&1; then
-      OPEN_PR=$(gh pr list --head "$BRANCH" --base develop --state open \
+      OPEN_PR=$(gh pr list --head "$BRANCH" --base "$BASE" --state open \
         --json url --jq '.[0].url // empty' 2>/dev/null || true)
     fi
     ;;
@@ -34,7 +36,7 @@ esac
 
 3. A clean working tree alone does **not** mean the work is fully saved:
    - If there are repo or memory changes, continue.
-   - If the task branch is ahead of `origin/develop` and `OPEN_PR` is empty,
+   - If the task branch is ahead of `origin/$BASE` and `OPEN_PR` is empty,
      continue even when the tree is clean. The bridge must push any committed
      work and create the missing PR.
    - Stop with "everything is already saved" only when there are no repo or

package/runtime/pi/.codex/skills/scroll/SKILL.md

@@ -45,32 +45,60 @@ or Loom delegation.
    into `/*__MERIDIAN_CSS__*/`. If the packages tree is unavailable, extract the
    same path from `egregore-artifacts@latest` rather than freezing tokens.
 5. Fill every placeholder and replace the `__FACE__` and `__HARVEST__` slot
-   comments using the grammar documented in the shell.
+   comments using the shell's syntax reference and the composition rules below.
 
 ### Write the face
 
-Create a light paper, not a transcript dump:
+Create a light paper that reads as if freshly written by someone who knows
+every absorbed decision, not a transcript with updates appended.
 
 - A paper header with kicker, title, italic subtitle, grounds, date, and
   `Version vN — updates in place at this URL`.
-- The setting: current reality, load-bearing verified numbers, the gap, and a
-  thesis reframe.
-- Two to four genuinely different mental models that stress-test the design.
-- The machine: concrete anatomy and protocol, using layers, steps, and
-  tokenized SVG figures. Mark illustrative charts `shapes, not measurements`.
-- Consequences for product or practice.
-- Honest costs as cards. Every cost must call `goFork('<fork-id>')` and link to
-  the harvest decision that prices it.
+- **Setting** is mandatory: orient the reader in current reality, the question
+  or gap, and the thesis; include verified numbers when they carry the claim.
+- **Honest costs** is mandatory: name real tradeoffs, uncertainty, and
+  operational burden. A cost that an open fork can price calls
+  `goFork('<fork-id>')`; settled costs become accepted, mitigated, or residual.
+- Choose every other module by fit: evidence or claims; a concrete machine,
+  anatomy, or protocol; examples or cases; stress tests; consequences;
+  boundaries or alternatives; decision history. For each plausible optional
+  module, be able to say why it is in or out. Never include one because this
+  list names it. A stress test must be able to fail the design.
+- Use tokenized SVG figures where a visual materially helps. Mark illustrative
+  charts `shapes, not measurements`.
 
 ### Write the harvest
 
 Create two to four bands of decision cards. Each card needs:
 
 - a stable fork id, grounded framing, and a reference back into the face;
-- two to four real options, each with one credible advantage and disadvantage;
+- an explicit answer `mode` for new forks; omit it only when preserving a legacy
+  single fork, give every `multi` fork an integer `max`, and give every
+  `spectrum` fork exactly two `ends`;
+- two to four real options for single/multi, each with one credible advantage
+  and disadvantage; 2–5 labeled items for rank, each with the same honest
+  tradeoff pair; or 5–7 fully labeled discrete stops for spectrum;
 - at most one starred lean, presented as a position to challenge;
 - a why textarea whose note returns with the pick.
 
+An option with no credible disadvantage is propaganda. A fork is one open
+question carried across versions by its lineage; it renders as a decision card
+and returns as a `Q<n>` line. A turn is one person's answers to one version.
+Accepted means approved; absorbed means published in a new version.
+
+Read `.codex/skills/harvest/QUESTION_PALETTE.md` for the canonical
+intent-to-shape rules. A multi card uses matching `data-mode="multi"` and
+`data-max="N"` attributes; the runtime exposes checkboxes and enforces the cap.
+A spectrum card uses `data-mode="spectrum"`, matching `data-left`/`data-right`
+poles, and 5–7 native `.sstop` buttons with normalized `data-pos` values and
+non-blank `data-label` values. Do not author a slider or a selected stop.
+Untouched, an explicitly selected midpoint, and UNDECIDED are distinct.
+A rank card uses `data-mode="rank"` and a `.rank-list` of 2–5 `.rank-item`
+candidates. Each candidate has a unique `data-opt`, a non-blank `data-label`,
+one native `.rank-toggle`, and one honest `.otrade`. The runtime supports
+partial top-k, tier reordering, and ties. Use best-worst dialogue for a longer
+list.
+
 Add open prompts for material that is not a fork. Prefer questions grounded in
 the work over meta-prompts asking what to ask next. The copydock must emit:
 
@@ -80,11 +108,40 @@ surface: <surface-id>
 harvest: <harvest-id>
 date: <date>
 
-Q1 <fork-id>: <key>  ("<label>")   | UNDECIDED
-   note: <why, verbatim>
+Q1 <fork-id>: <key>  ("<label>")
+   note: |
+      <verbatim line>
+      <blank or verbatim line>
+Q2 <fork-id>: [<key-a>, <key-b>]  ("<Label A>" + "<Label B>")
+Q3 <fork-id>: <key-b> > <key-a> = <key-c>
+Q4 <fork-id>: <position>  (<left pole>→<right pole>)
+Q5 <fork-id>: UNDECIDED
 O1 <prompt-id>: <text | UNDECIDED>
 ```
 
+Emit a `Q<n>` line only after the respondent chooses an option or activates
+**Leave this open**. Omit untouched forks; Leave this open emits `UNDECIDED`,
+looks distinct from untouched state, and comes back at most once in a different
+form. Keep `n` as the fork's surface ordinal, so omissions may leave gaps. A
+non-blank why-note on an otherwise untouched fork activates Leave this open.
+Multi turns store
+`{mode:"multi", picks:[...], labels:[...]}` rather than a singular `pick`;
+the bracketed return line is comma-separated and its labels are joined with
+` + `. Leave-this-open on a multi fork stores
+`{mode:"multi", picks:["UNDECIDED"]}` with no labels. Missing fork mode remains
+`single` for backward compatibility. A chosen spectrum stop stores
+`{mode:"spectrum", position:<number>, label:"<stop label>"}`; activating it
+again clears to untouched. Leave-this-open stores
+`{mode:"spectrum", position:"UNDECIDED"}` with no label.
+Rank return lines use `>` between ordered tiers and `=` inside a tie; omitted
+items form a valid partial top-k. Rank turns store
+`{mode:"rank", ranks:[["B"],["A","C"]]}`. Leave-this-open stores
+`{mode:"rank", ranks:[["UNDECIDED"]]}`.
+Decision notes use a block scalar: indent `note: |` exactly three spaces and
+every content line exactly six spaces. Removing those six spaces must reproduce
+the NFC+LF-normalized textarea value verbatim, including blank lines and a
+trailing newline.
+
 ## Theme and asset constraints
 
 Choose the default theme pair from the primary reader's recorded preference
@@ -145,19 +202,26 @@ If the paster is not the creator and not in `trusted:`, the return is **gated**:
    digest = FNV-1a 32-bit hex over the UTF-8 bytes of
    `JSON.stringify([respondent, String(base_version), date, sortedAnswers,
    sortedOpens])` where `sortedAnswers` = answers sorted by fork id, each
-   mapped to the tuple `[fork, pick-or-UNDECIDED, note-or-empty]` (labels are
-   excluded), and `sortedOpens` = opens sorted by prompt id, each mapped to
+   mapped to `[fork, pick-or-UNDECIDED, note-or-empty]` for single,
+   `[fork, sorted-picks-array, note-or-empty]` for multi, or
+   `[fork, ordered-rank-tiers-with-each-tie-sorted, note-or-empty]` for rank,
+   or `[fork, position-or-UNDECIDED, note-or-empty]` for spectrum (labels are excluded),
+   and `sortedOpens` = opens sorted by prompt id, each mapped to
    `[prompt, text-or-UNDECIDED]`; every string is NFC-normalized and
-   CRLF→LF-normalized before hashing. Record `submitted_by: <paster>` on the
+   CRLF→LF-normalized before hashing. Legacy single turn ids remain unchanged.
+   Record `submitted_by: <paster>` on the
    event (event-log metadata only — never projected into a published ledger)
    and `merged_into: "pending"`.
 2. Do NOT absorb: no `memory/knowledge/decisions/` writes, no spec/plan edits,
    no face rewrite, no version bump, no republish of new content. Republishing
    the unchanged current version to acknowledge the turn is allowed and appends
    no version event.
-3. Notify the creator — connected: `bash bin/notify.sh send <creator>
-   "<paster> answered your scroll <slug> (vN): <digest> — pending your review"`;
-   local: write an addressed handoff in `memory/handoffs/` naming the scroll,
+3. In connected mode, follow `.claude/context/notification-consent.md` and
+   prepare a direct notification to the creator without sending:
+   `bash bin/notify.sh plan send <creator> "<paster> answered your scroll
+   <slug> (vN): <digest> — pending your review"`. Show a separate exact Send /
+   Edit / Cancel checkpoint. In local mode, write an addressed handoff in
+   `memory/handoffs/` naming the scroll,
    paster, base version, digest, and the dispositions below. The contributor
    may also send the artifact link directly.
 4. Report the gated state and stop.
@@ -186,15 +250,20 @@ On a returned block (creator or trusted paster — gated returns stop above):
    valid answer.
 2. **Rewrite the face.** Weave settled answers and reasoning into fresh prose,
    mark them `decided v<N> · <date>`, and update linked cost cards to accepted,
-   mitigated, or remaining residuals.
+   mitigated, or remaining residuals. Re-evaluate every optional face module by
+   the fit rule above.
 3. **Regenerate the harvest.** Retire answered cards. Carry an undecided fork
    once at most; after two undecided returns, reframe it or demote it to an open
    prompt. If its note actually resolves it, absorb the note as the decision.
    Mint new forks from newly unlocked consequences, respondent requests, and
-   new ground truth.
+   new ground truth. Treat an answer outside the listed options as a candidate
+   option at review, never as the nearest pick.
 4. **Show, then ask.** When abstract forks run dry or the respondent asks for
-   something concrete, place the draft under discussion directly in the
-   harvest view with in-place reaction prompts.
+   something concrete, place only the relevant draft or excerpt in the
+   decisions view and ask grounded open prompts beside selected material. This
+   is a selective authoring move, not a standing interaction mode: never make
+   every face section reactable, add question controls to the readable face,
+   or ask generic ready/not-ready verdicts.
 5. **Version.** Bump every version marker, update the copydock, and append a
    one-line changelog with absorbed and newly opened forks.
 6. **Republish.** Publish to the same stable id, update the quest record, open