design-playbook 0.21.1 → 0.21.2

package/codex/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated-by design-playbook v0.21.1 -->
+<!-- generated-by design-playbook v0.21.2 -->
 # design-playbook for Codex
 
 ## Install (path of record)

package/commands/ui-review.md

@@ -2,7 +2,7 @@
 description: Dual-track UI review emitting the six-block point-back report (ledger / findings / positives / coverage / limitations / verdict)
 ---
 
-Run skill **ui-evaluator** (pull craft-guard checks when AI slop/motion/loading is in scope). Output issue/source/fix/severity; blocking first.
+Run skill **ui-evaluator** (pull craft-guard checks when AI slop/motion/loading is in scope). Output issue/source/fix/severity/track; blocking first.
 
 Scope:
 $ARGUMENTS

package/examples/dogfood/run/craft-guard.md

@@ -17,3 +17,12 @@ Registry: `skills/design-playbook/references/rules.md`, full catalog (P3 run:
 | I18N-01@1 | not-applicable | 单语控制台（zh-CN），无 i18n 声明（无 i18n.* 契约字段，L1 未声明多语言用户群） | - | - | - | 单语声明成立 | - |
 | PERF-01@1 | applicable | - | clear | 长运行有持续进度感（feed 条目级进度逐 tick 更新；全局暂停 busy 即时反馈） | evidence/L6.2-pause-trace.json 反馈序列 | 反馈相称性未承诺耗时阈值（契约无阈值声明） | - |
 | SEC-01@1 | not-applicable | 声明范围无敏感操作新增（敏感模拟参数默认脱敏沿用；全局暂停非敏感操作） | - | - | - | 无敏感面可查 | - |
+| COPY-01@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档（2026-08-14）；主动语态与动作命名一致性审查所需的全流程文案清单未采集 | - | - | - | - | - |
+| COPY-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；用户侧命名审查所需的界面名词与实现命名对照未采集 | - | - | - | - | - |
+| COPY-03@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；错误信息语气审查所需的错误态文案样本未采集 | - | - | - | - | - |
+| A11Y-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；可见键盘焦点判定所需的聚焦态截图与键盘走查未采集（a11y 树无法证明视觉属性） | - | - | - | - | - |
+| CRAFT-09@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面样式源——filled-ui.md 为声明性产物索引不含样式源，candidates/preview 为一次性原型资产而非填充面源码 | - | - | - | - | - |
+| CRAFT-10@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面源标记与结构装置的视觉捕捉——evidence 仅交互轨迹与 a11y 树 JSON，无填充面标记源归档 | - | - | - | - | - |
+| DECIDE-01@1 | applicable | - | clear | 选中方向为全局 run console 构成重组（candidates/console-region.html 草图 + preview round 1/2 用户确认），非未审视的默认外观收敛 | DD-0001 理由可回溯 l1.scenes（切页续读）与 PERF-01 比较轴及经用户确认的布局段突破；DD-0002 理由可回溯 l6.c4（跨视图状态闭环）与运行中心第一步方向——均引用 brief 具体事实 | 常规方向经比较矩阵沿 brief 轴证成，非未审视默认；无基线默认方向身份声明 | - |
+
+注：2026-08-28 注册批（COPY-01/02/03、A11Y-02、CRAFT-09/10、DECIDE-01）晚于本 run 存档；按三态谓词补记——blocked 行在理由列点名缺失的证据面；DECIDE-01 依归档内可读的决策报告求值为 applicable。

package/examples/export-entry/run/craft-guard.md

@@ -17,3 +17,12 @@ Registry: `skills/design-playbook/references/rules.md`, full catalog (P2 run). S
 | I18N-01@1 | not-applicable | 单语控制台，无 i18n 声明（无 i18n.* 契约字段，L1 未声明多语言用户群） | - | - | - | 单语声明成立 | - |
 | PERF-01@1 | blocked | 性能感知需运行时度量，本 run provider 缺度量面（measurement 层不可采） | - | 导出等待仅观察到 busy 态 | 度量面缺席，无法判定反馈与耗时的相称性 | 无法在不承诺阈值的情况下检查例外 | 补采运行时度量后重评；缺口的证据语义见 point-back 覆盖声明 |
 | SEC-01@1 | not-applicable | 声明范围无敏感操作新增（导出非敏感数据；隐藏敏感列由 column_scope 假设排除） | - | - | - | 无敏感面可查 | - |
+| COPY-01@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档（2026-08-14）；主动语态与动作命名一致性审查所需的全流程文案清单未采集 | - | - | - | - | - |
+| COPY-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；用户侧命名审查所需的界面名词与实现命名对照未采集 | - | - | - | - | - |
+| COPY-03@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；错误信息语气审查所需的错误态文案样本未采集 | - | - | - | - | - |
+| A11Y-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；可见键盘焦点判定所需的聚焦态截图与键盘走查未采集（a11y 树无法证明视觉属性） | - | - | - | - | - |
+| CRAFT-09@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面样式源——filled-ui.md 为静态替身描述，无填充面样式源文件归档 | - | - | - | - | - |
+| CRAFT-10@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面源标记——filled-ui.md 为静态替身描述；既有截图仅覆盖错误态，无结构装置的视觉捕捉 | - | - | - | - | - |
+| DECIDE-01@1 | applicable | - | clear | 选中方向为按周命名模式（compare 档轻量比较），不落入 2026-08 记录的自默认外观样貌；DD-0001 为 record 档，不在本规则范围 | DD-0002 理由可回溯 l1.target_user 比较轴（周频归档场景下检索是主任务）——引用 brief 具体事实而非通用措辞 | 常规方向经比较矩阵沿 brief 轴证成，非未审视默认；无基线默认方向身份声明 | - |
+
+注：2026-08-28 注册批（COPY-01/02/03、A11Y-02、CRAFT-09/10、DECIDE-01）晚于本 run 存档；按三态谓词补记——blocked 行在理由列点名缺失的证据面；DECIDE-01 依归档内可读的决策报告求值为 applicable。

package/examples/export-pointfix-upgrade/run/craft-guard.md

@@ -17,3 +17,12 @@ Registry: `skills/design-playbook/references/rules.md`. Seven-column rows; after
 | I18N-01@1 | not-applicable | 单语控制台，无 i18n 声明（无 i18n.* 契约字段，L1 未声明多语言用户群） | - | - | - | 单语声明成立 | - |
 | PERF-01@1 | blocked | 性能感知需运行时度量，本 run provider 缺度量面（measurement 层不可采） | - | 导出等待仅观察到 busy 态 | 度量面缺席，无法判定反馈与耗时的相称性 | 无法在不承诺阈值的情况下检查例外 | 补采运行时度量后重评；缺口的证据语义见 point-back 覆盖声明 |
 | SEC-01@1 | not-applicable | 声明范围无敏感操作新增（导出非敏感数据；隐藏敏感列由 column_scope 假设排除） | - | - | - | 无敏感面可查 | - |
+| COPY-01@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档（2026-08-14）；主动语态与动作命名一致性审查所需的全流程文案清单未采集 | - | - | - | - | - |
+| COPY-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；用户侧命名审查所需的界面名词与实现命名对照未采集 | - | - | - | - | - |
+| COPY-03@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；错误信息语气审查所需的错误态文案样本未采集 | - | - | - | - | - |
+| A11Y-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；可见键盘焦点判定所需的聚焦态截图与键盘走查未采集（a11y 树无法证明视觉属性） | - | - | - | - | - |
+| CRAFT-09@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；选择器优先级冲突审查所需的样式源走查未执行 | - | - | - | - | - |
+| CRAFT-10@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；结构装置与内容属性对应关系的走查未执行 | - | - | - | - | - |
+| DECIDE-01@1 | not-applicable | 决策报告仅含 record 档 DD-0101，无 compare/explore 档方向决策条目 | - | - | - | - | - |
+
+注：2026-08-28 注册批（COPY-01/02/03、A11Y-02、CRAFT-09/10、DECIDE-01）晚于本 run 存档；按三态谓词补记，blocked 行在理由列记缺失证据面。

package/examples/export-upgrade/run/craft-guard.md

@@ -17,3 +17,12 @@ Registry: `skills/design-playbook/references/rules.md`, full catalog (P3 run:
 | I18N-01@1 | not-applicable | 单语控制台，无 i18n 声明（无 i18n.* 契约字段，L1 未声明多语言用户群） | - | - | - | 单语声明成立 | - |
 | PERF-01@1 | applicable | - | clear | 长导出有持续进度感（30s 窗口 5 次采样，条目级进度持续更新） | evidence/L6.1-status-trace.json 进度采样序列 | 反馈相称性未承诺耗时阈值（契约无阈值声明） | - |
 | SEC-01@1 | not-applicable | 声明范围无敏感操作新增（导出非敏感数据；隐藏敏感列由 column_scope 假设排除） | - | - | - | 无敏感面可查 | - |
+| COPY-01@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档（2026-08-14）；主动语态与动作命名一致性审查所需的全流程文案清单未采集 | - | - | - | - | - |
+| COPY-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；用户侧命名审查所需的界面名词与实现命名对照未采集 | - | - | - | - | - |
+| COPY-03@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；错误信息语气审查所需的错误态文案样本未采集 | - | - | - | - | - |
+| A11Y-02@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；可见键盘焦点判定所需的聚焦态截图与键盘走查未采集（a11y 树无法证明视觉属性） | - | - | - | - | - |
+| CRAFT-09@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面样式源——无填充产物源文件归档，candidates/preview 为一次性原型资产而非填充面源码 | - | - | - | - | - |
+| CRAFT-10@1 | blocked | 条目 2026-08-28 注册，晚于本 run 存档；归档缺审计面源标记与结构装置的视觉捕捉——evidence 仅交互轨迹 JSON，无填充产物源文件归档 | - | - | - | - | - |
+| DECIDE-01@1 | applicable | - | clear | 选中方向为启用既有 status region 收纳导出任务（candidates/B.html 草图 + preview round 1/2 用户确认），非未审视的默认外观收敛 | DD-0003 理由可回溯 l1.scenes（导出中切页全局可查）与 PERF-01 比较轴；DD-0004 理由可回溯 l6.c2（跨视图状态闭环）与基线 status region 惯例声明——均引用 brief 具体事实 | 常规方向经比较矩阵沿 brief 轴证成，非未审视默认；基线声明的是 status region 惯例而非默认外观身份 | - |
+
+注：2026-08-28 注册批（COPY-01/02/03、A11Y-02、CRAFT-09/10、DECIDE-01）晚于本 run 存档；按三态谓词补记——blocked 行在理由列点名缺失的证据面；DECIDE-01 依归档内可读的决策报告求值为 applicable。

package/mcp/evidence/capture_runtime.py

@@ -662,7 +662,7 @@ def matrix_viewport(name: str) -> dict[str, Any]:
 def capture_delivery_matrix(
     *,
     url: str,
-    out_dir: Path | None = None,
+    out_dir: Path,
     freeze: dict[str, Any] | None = None,
     browser_adapter: BrowserAdapter | None = None,
 ) -> dict[str, dict[str, Any]]:
@@ -674,19 +674,19 @@ def capture_delivery_matrix(
     can assemble the ``disclosure-review.json`` matrix and the ``/export-zip``
     package from one pass.
 
-    ``out_dir`` defaults to the spec's canonical delivery path
-    ``output/playwright/static-handoff/`` (spec §5). ``browser_adapter`` uses
-    the same ``BrowserAdapter`` seam as ``execute_capture_plan`` (real
-    Playwright by default, injected fake in tests). Production adapters should
-    expose ``capture_and_probe`` so the snapshot and metrics share one page;
-    adapters without that seam remain explicitly ``unmeasured``.
+    ``out_dir`` is required and carries no default: handoff artifacts live
+    under the run tree (``<run_root>/evidence/static-handoff/``, ADR-0034 §5),
+    never the process CWD, so the caller must pass the run-tree destination
+    explicitly. ``browser_adapter`` uses the same ``BrowserAdapter`` seam as
+    ``execute_capture_plan`` (real Playwright by default, injected fake in
+    tests). Production adapters should expose ``capture_and_probe`` so the
+    snapshot and metrics share one page; adapters without that seam remain
+    explicitly ``unmeasured``.
     """
     freeze = freeze or {"enabled": True, "waitFonts": True, "networkIdle": False}
     if browser_adapter is None:
         browser_adapter = PlaywrightBrowserAdapter()
 
-    if out_dir is None:
-        out_dir = Path("output/playwright/static-handoff")
     out_dir = Path(out_dir)
     out_dir.mkdir(parents=True, exist_ok=True)
     results: dict[str, dict[str, Any]] = {}

package/mcp/evidence/disclosure.py

@@ -19,8 +19,10 @@ Two seams keep the contract builder pure and testable without a browser:
   It only normalizes caller-supplied facts into the §4.2 shape.
 
 ``build_handoff_zip()`` packages the disclosure credential plus any caller-
-supplied snapshot artifacts into a single ZIP for the local ``/export-zip``
-endpoint (Stage 9 delivery mount). It never reads outside the caller-provided
+supplied snapshot artifacts into a single ZIP. The Evidence-side builder
+(``handoff.py``) writes it to disk as ``static-handoff.zip`` next to the
+delivery page under ``<run_root>/evidence/static-handoff/`` (ADR-0034); no
+HTTP delivery endpoint exists. It never reads outside the caller-provided
 file list.
 """
 

package/mcp/evidence/handoff.py

@@ -59,6 +59,7 @@ class StaticHandoffResult:
     json_path: Path
     zip_path: Path
     index_html: Path
+    deliverable_html: Path
 
 
 def _iso_now() -> str:
@@ -691,7 +692,8 @@ def build_static_handoff(
     output (``filled-ui.html``) - the page the five-viewport matrix and the
     layout probe actually target (ADR-0034 §4). Everything is written under
     ``<run_root>/evidence/static-handoff/``: snapshots, the disclosure JSON,
-    the ZIP package, and a self-contained index page.
+    the ZIP package, a same-directory ``deliverable.html`` copy (the page's
+    relative link target, spec A5), and a self-contained index page.
     """
     run_root = Path(run_root)
     deliverable = Path(deliverable)
@@ -707,6 +709,14 @@ def build_static_handoff(
     if gate_runner is None:
         gate_runner = _run_gate_validation
 
+    # Read the deliverable source up front and fail fast: its bytes are the
+    # run identity (hash), the ZIP's prototype member, and the on-disk copy
+    # the delivery page links relatively (#107). A missing or undecodable
+    # source aborts before any capture launches or artifact is written, so a
+    # delivery page can never exist without its link target.
+    deliverable_bytes = deliverable.read_bytes()
+    deliverable_text = deliverable_bytes.decode("utf-8")
+
     # Sample conditional-gate preconditions BEFORE writing anything: this
     # builder's own output lives under evidence/, and a precondition sampled
     # afterwards would be one this run manufactured for itself.
@@ -769,7 +779,6 @@ def build_static_handoff(
     else:
         verdict = "Pending"
 
-    deliverable_bytes = deliverable.read_bytes()
     run_id = (
         f"static-handoff-{round_n}-{hashlib.sha256(deliverable_bytes).hexdigest()[:12]}"
     )
@@ -808,6 +817,13 @@ def build_static_handoff(
     json_path = out_dir / "disclosure-review.json"
     json_path.write_text(disclosure_json(payload), encoding="utf-8")
 
+    # The delivery page links "deliverable.html" as a same-directory relative
+    # anchor (spec A5: disk artifacts, same-directory relative links); the copy
+    # must exist beside index.html, byte-identical to the ZIP member, or the
+    # delivery surface ships a dead link (#107).
+    deliverable_copy = out_dir / "deliverable.html"
+    deliverable_copy.write_bytes(deliverable_bytes)
+
     artifacts: dict[str, str] = {}
     if snap_dir.is_dir():
         for vp in VIEWPORT_ORDER:
@@ -820,7 +836,7 @@ def build_static_handoff(
         artifact_files=artifacts,
         # spec §4.1: the handoff ships "snapshots and prototype code". PNGs
         # alone do not let the recipient rebuild the reviewed page.
-        text_members={"deliverable.html": deliverable_bytes.decode("utf-8")},
+        text_members={"deliverable.html": deliverable_text},
         zip_target=str(zip_path),
     )
 
@@ -835,4 +851,5 @@ def build_static_handoff(
         json_path=json_path,
         zip_path=zip_path,
         index_html=index_html,
+        deliverable_html=deliverable_copy,
     )

package/mcp/evidence/test_handoff.py

@@ -195,8 +195,16 @@ class BuildStaticHandoffTests(unittest.TestCase):
             result = self._build(tmp, run_root)
             base = run_root / "evidence" / "static-handoff"
             self.assertEqual(result.out_dir, base)
-            for path in (result.json_path, result.zip_path, result.index_html):
+            for path in (
+                result.json_path,
+                result.zip_path,
+                result.index_html,
+                result.deliverable_html,
+            ):
                 self.assertTrue(path.is_file(), path)
+            # #107: the page's relative "deliverable.html" anchor must resolve
+            # in the same directory as index.html (spec A5).
+            self.assertEqual(result.deliverable_html, base / "deliverable.html")
             self.assertTrue((base / "snapshots" / "viewport-1280x900.png").is_file())
             # nothing outside the run tree
             self.assertFalse((tmp / "output").exists())
@@ -390,6 +398,30 @@ class BuildStaticHandoffTests(unittest.TestCase):
             result = self._build(tmp, run_root)
             self.assertEqual(result.payload["profile"], "unknown")
 
+    def test_missing_deliverable_fails_before_any_artifact_is_written(self) -> None:
+        """#107 coherence: a delivery page must never exist without its link
+        target. A missing Stage 7 source aborts the build up front, so nothing
+        lands under evidence/static-handoff/ - no page, no dead link."""
+        import tempfile
+
+        with tempfile.TemporaryDirectory() as tmp_s:
+            tmp = Path(tmp_s)
+            run_root = _make_run(tmp)
+            missing = tmp / "filled-ui.html"  # never written
+            with self.assertRaises(OSError):
+                handoff.build_static_handoff(
+                    run_root,
+                    missing,
+                    round_n=1,
+                    summary="s",
+                    capture_runner=_fake_capture_runner,
+                    gate_runner=_passing_gate_runner,
+                )
+            self.assertFalse(
+                (run_root / "evidence" / "static-handoff").exists(),
+                "missing source must fail before any artifact is written",
+            )
+
 
 class HandoffPageTests(unittest.TestCase):
     def test_page_template_is_own_content_with_no_cdn(self) -> None:
@@ -430,6 +462,38 @@ class HandoffPageTests(unittest.TestCase):
             # No unsanitized injection from run-controlled text.
             self.assertNotIn("<script>", html[start:end])
 
+    def test_page_deliverable_link_target_exists_beside_the_page(self) -> None:
+        """#107: "Everything below sits next to it on disk" must be true.
+
+        The page links ``deliverable.html`` as a same-directory relative
+        anchor (spec A5), so the builder must write that copy beside
+        index.html, byte-identical to the ZIP member and the Stage 7 source.
+        """
+        import tempfile
+
+        with tempfile.TemporaryDirectory() as tmp_s:
+            tmp = Path(tmp_s)
+            run_root = _make_run(tmp)
+            deliverable = tmp / "filled-ui.html"
+            deliverable.write_text(DELIVERABLE_HTML, encoding="utf-8")
+            result = handoff.build_static_handoff(
+                run_root, deliverable, round_n=1, summary="s",
+                capture_runner=_fake_capture_runner,
+                gate_runner=_passing_gate_runner,
+            )
+            html = result.index_html.read_text(encoding="utf-8")
+            self.assertIn('href="deliverable.html"', html)
+            on_disk = result.index_html.parent / "deliverable.html"
+            self.assertTrue(
+                on_disk.is_file(),
+                "the page's relative deliverable.html link must not dangle",
+            )
+            self.assertEqual(result.deliverable_html, on_disk)
+            with zipfile.ZipFile(result.zip_path) as zf:
+                member = zf.read("deliverable.html")
+            self.assertEqual(on_disk.read_bytes(), member)
+            self.assertEqual(on_disk.read_bytes(), deliverable.read_bytes())
+
 
 class GateNormalizationTests(unittest.TestCase):
     """Ported from the review-session surface; the logic now lives in handoff."""

package/mcp/preview/integrity.py

@@ -308,18 +308,21 @@ def inspect_preview(preview_dir: Path) -> PreviewSnapshot:
     current_records: list[ConfirmRecord] = []
     for path, data, record_round in parsed:
         valid = _is_confirmed_valid(data)
-        if (
+        is_canonical = (
             current_round is not None
             and path == preview_dir / confirm_name(current_round)
-        ):
-            canonical_current_confirm = ConfirmRecord(
-                path=path,
-                data=data,
-                round=record_round,
-                valid=valid,
-                prototype_status="unchecked",
-            )
+        )
         if current_round is not None and record_round != current_round:
+            if is_canonical:
+                # The canonical filename exists but its JSON round disagrees,
+                # so no prototype check runs for it: status stays unchecked.
+                canonical_current_confirm = ConfirmRecord(
+                    path=path,
+                    data=data,
+                    round=record_round,
+                    valid=valid,
+                    prototype_status="unchecked",
+                )
             continue
         prototype_status = "unchecked"
         expected_digest = ""
@@ -375,17 +378,22 @@ def inspect_preview(preview_dir: Path) -> PreviewSnapshot:
                                 actual=actual_digest,
                             )
                         )
-        current_records.append(
-            ConfirmRecord(
-                path=path,
-                data=data,
-                round=record_round,
-                valid=valid,
-                prototype_status=prototype_status,
-                expected_digest=expected_digest,
-                actual_digest=actual_digest,
-            )
+        record = ConfirmRecord(
+            path=path,
+            data=data,
+            round=record_round,
+            valid=valid,
+            prototype_status=prototype_status,
+            expected_digest=expected_digest,
+            actual_digest=actual_digest,
         )
+        current_records.append(record)
+        if is_canonical:
+            # The canonical confirm carries the owner-computed prototype
+            # status (match/mismatch/missing_*): ``valid`` stays flags-only,
+            # but projections must never upgrade a hash mismatch to a
+            # confirmed state (ADR-0013; run-snapshot parity section 2).
+            canonical_current_confirm = record
 
     return PreviewSnapshot(
         preview_dir=preview_dir,

package/mcp/preview/review_session.py

@@ -48,9 +48,10 @@ __all__ = [
     "collect_review",
 ]
 
-# Stage 9 static-handoff disclosure contract (imported lazily inside the
-# /export-zip + /disclosure-review.json handlers so the stdio server does not
-# pay the import cost and tests can stub it).
+# Stage 9 static handoff is Evidence-owned (ADR-0034): the builder in
+# mcp/evidence/handoff.py writes its artifacts to disk under the run tree
+# (<run_root>/evidence/static-handoff/). This preview server serves only
+# the review page at "/" and hosts no delivery route.
 
 
 def _generate_decision_token() -> str:

package/mcp/preview/test_integrity.py

@@ -126,6 +126,35 @@ class PreviewIntegritySnapshotTests(unittest.TestCase):
             self.assertEqual(snapshot.current_confirms[0].prototype_status, "mismatch")
             self.assertEqual([fact.code for fact in snapshot.facts], ["hash_mismatch"])
             self.assertNotIn("G5", snapshot.facts[0].detail)
+
+    def test_canonical_confirm_carries_owner_prototype_status(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            preview = Path(tmp)
+            (preview / "round-1.html").write_text("changed", encoding="utf-8")
+            (preview / "confirm-round-1.json").write_text(
+                json.dumps(
+                    {
+                        "round": 1,
+                        "confirmed": True,
+                        "floor_pass": True,
+                        "prototype_html_hash": prototype_html_digest(b"original"),
+                    }
+                ),
+                encoding="utf-8",
+            )
+
+            snapshot = inspect_preview(preview)
+
+            canonical = snapshot.canonical_current_confirm
+            self.assertIsNotNone(canonical)
+            # ``valid`` stays flags-only (ADR-0008 confirm/floor flags); the
+            # integrity outcome surfaces as the owner-computed prototype
+            # status on the same canonical current-round record, so a
+            # projection can never upgrade a hash mismatch to confirmed.
+            self.assertTrue(canonical.valid)
+            self.assertEqual(canonical.prototype_status, "mismatch")
+            self.assertEqual(snapshot.current_confirms, (canonical,))
+
     def test_malformed_confirm_becomes_fact_without_aborting_snapshot(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             preview = Path(tmp)

package/mcp/run_console/actions.py

@@ -26,12 +26,17 @@ from .session import (
     RunConsoleSessionError,
 )
 
-# A code owned here (request_security.py is frozen outside this change):
+# Codes owned here (request_security.py is frozen outside this change):
 # a non-JSON content type on the one action route is a 415, not a 400.
 CONTENT_TYPE_UNSUPPORTED = "CONTENT_TYPE_UNSUPPORTED"
 CONTENT_TYPE_UNSUPPORTED_MESSAGE = (
     "The typed action requires an application/json request body."
 )
+# Spec section 13 keeps a body that does not decode as JSON at all
+# distinct from valid JSON with the wrong fields: MALFORMED_JSON is the
+# pre-dispatch decode rejection, ACTION_PAYLOAD_INVALID stays field-level.
+MALFORMED_JSON = "MALFORMED_JSON"
+MALFORMED_JSON_MESSAGE = "The request body is not well-formed JSON."
 
 JSON_CONTENT_TYPE = "application/json"
 ACTION_REFRESH = "refresh"
@@ -64,6 +69,21 @@ class ActionPayloadError(ValueError):
         self.code = ACTION_PAYLOAD_INVALID
 
 
+class MalformedJSONError(ValueError):
+    """A typed rejection of a body that does not decode as JSON at all.
+
+    A deliberate sibling of :class:`ActionPayloadError`, never a subclass:
+    spec section 13 keeps ``MALFORMED_JSON`` (rejected before action
+    dispatch) distinct from the field-level ``ACTION_PAYLOAD_INVALID``,
+    and a subclass would let one ``except ActionPayloadError`` fold the
+    two codes back together.
+    """
+
+    def __init__(self, message: str = MALFORMED_JSON_MESSAGE) -> None:
+        super().__init__(message)
+        self.code = MALFORMED_JSON
+
+
 def content_type_is_json(value: object) -> bool:
     """True only for an ``application/json`` Content-Type value.
 
@@ -78,13 +98,20 @@ def content_type_is_json(value: object) -> bool:
 
 
 def parse_json_action_body(raw: object) -> object:
-    """Decode one UTF-8 JSON request body or raise the typed rejection."""
+    """Decode one UTF-8 JSON request body or raise the typed rejection.
+
+    Every decode failure — a body that is not a byte sequence, not
+    UTF-8, or not one well-formed JSON document — is the pre-dispatch
+    ``MALFORMED_JSON`` rejection. Valid JSON that is not the closed
+    payload is judged later by :func:`validate_refresh_payload` and
+    keeps ``ACTION_PAYLOAD_INVALID``.
+    """
     if not isinstance(raw, (bytes, bytearray)):
-        raise ActionPayloadError() from None
+        raise MalformedJSONError() from None
     try:
         return json.loads(bytes(raw).decode("utf-8"))
     except (UnicodeDecodeError, ValueError):
-        raise ActionPayloadError() from None
+        raise MalformedJSONError() from None
 
 
 def validate_refresh_payload(payload: object) -> None:

package/mcp/run_console/http_server.py

@@ -26,9 +26,12 @@ from urllib.parse import parse_qsl, urlsplit
 from .actions import (
     CONTENT_TYPE_UNSUPPORTED,
     CONTENT_TYPE_UNSUPPORTED_MESSAGE,
+    MALFORMED_JSON,
+    MALFORMED_JSON_MESSAGE,
     REFRESH_ALLOWED_METHODS,
     REFRESH_ROUTE,
     ActionPayloadError,
+    MalformedJSONError,
     content_type_is_json,
     parse_json_action_body,
     perform_refresh,
@@ -91,6 +94,7 @@ _LOCATOR_PATTERN = re.compile(r"^src_[A-Za-z0-9_-]{16,}$")
 _DUPLICATED = object()
 
 _STATUS_BY_CODE = {
+    MALFORMED_JSON: 400,
     ACTION_PAYLOAD_INVALID: 400,
     SESSION_TOKEN_INVALID: 401,
     ORIGIN_INVALID: 403,
@@ -416,6 +420,12 @@ class RunConsoleRequestHandler(http.server.BaseHTTPRequestHandler):
             return
         try:
             payload = parse_json_action_body(body)
+        except MalformedJSONError:
+            # Not one well-formed JSON document: rejected before action
+            # dispatch, distinct from the field-level payload code (s13).
+            self._send_error(MALFORMED_JSON, message=MALFORMED_JSON_MESSAGE)
+            return
+        try:
             validate_refresh_payload(payload)
         except ActionPayloadError:
             self._send_error(ACTION_PAYLOAD_INVALID)

package/mcp/run_console/projection.py

@@ -17,8 +17,11 @@ the bound source:
   (raw bytes for artifacts, normalized decoded text for text sources)
   and compared with the hash bound into the locator: a changed source is
   ``SOURCE_HASH_MISMATCH`` and never returns a newer excerpt;
-- the excerpt is HTML-escaped and hard-truncated, so source content can
-  never carry executable markup or an unbounded payload across the seam.
+- the excerpt is stripped of control characters and ANSI escape
+  sequences, HTML-escaped, and hard-truncated, so source content can
+  never carry executable markup, terminal control bytes, or an
+  unbounded payload across the seam (spec section 10: plain text with
+  control characters removed).
 
 The resolver writes nothing, opens no socket, and runs no process.
 """
@@ -26,6 +29,7 @@ from __future__ import annotations
 
 import hashlib
 import html
+import re
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -46,6 +50,16 @@ _ERROR_MESSAGES = {
 _DEFAULT_MAX_CHARS = 4000
 _MAX_CHARS_LIMIT = 8192
 
+# A complete ANSI CSI sequence: ESC ``[``, parameter bytes (0x30-0x3F),
+# intermediate bytes (0x20-0x2F), and one final byte (0x40-0x7E). The
+# final byte is optional so a sequence cut off at end-of-source is still
+# removed whole instead of leaving ``[31m``-style residue.
+_ANSI_CSI = re.compile(r"\x1b\[[0-?]*[ -/]*[@-~]?")
+# Control characters forbidden in a plain-text excerpt (spec section
+# 10): C0 except tab (0x09) and newline (0x0A), DEL (0x7F), and the C1
+# range (0x80-0x9F). Any ESC left after CSI removal is caught here.
+_CONTROL_CHARS = re.compile(r"[\x00-\x08\x0b-\x1f\x7f-\x9f]")
+
 
 class SourceViewError(ValueError):
     """Stable, path-free rejection at the source-view seam.
@@ -110,9 +124,11 @@ def resolve_source_excerpt(
     return SourceExcerpt(
         source_ref=binding.source_ref,
         content_hash=digest,
-        # Escape first, then hard-truncate: the output is always plain
-        # text and never longer than the requested bound.
-        text=html.escape(decoded, quote=False)[:limit],
+        # Reduce to plain text, then escape, then hard-truncate: the
+        # output is always plain text and never longer than the
+        # requested bound. Stripping runs after the hash check so the
+        # Snapshot hash parity above stays byte-exact.
+        text=html.escape(_plain_text(decoded), quote=False)[:limit],
     )
 
 
@@ -129,6 +145,20 @@ def _normalize_newlines(text: str) -> str:
     return text.replace("\r\n", "\n").replace("\r", "\n")
 
 
+def _plain_text(text: str) -> str:
+    """Reduce decoded content to the spec section-10 excerpt plain text.
+
+    Newlines are normalized first (``\\r\\n``/``\\r`` to ``\\n``), then
+    complete ANSI CSI escape sequences are removed whole, and finally
+    every remaining control character other than tab and newline --
+    C0, DEL (0x7F), and C1 (0x80-0x9F), including any lone ESC -- is
+    removed.
+    """
+    text = _normalize_newlines(text)
+    text = _ANSI_CSI.sub("", text)
+    return _CONTROL_CHARS.sub("", text)
+
+
 def _read_bound_source(
     registry: SourceRegistry, package_root: Path, binding: LocatorBinding
 ) -> bytes | None:

package/mcp/run_console/snapshot_builder.py

@@ -476,7 +476,14 @@ class _Builder:
                 and confirm.data.get("aborted") is True
             ):
                 preview_state = "aborted"
-            elif confirm is not None and confirm.valid:
+            elif (
+                confirm is not None
+                and confirm.valid
+                # Parity spec section 2 (execution.preview): a prototype
+                # hash mismatch reported by the integrity owner can never
+                # be upgraded to a confirmed state.
+                and confirm.prototype_status != "mismatch"
+            ):
                 preview_state = "confirmed"
             elif confirm is not None:
                 preview_state = "invalid"