devflow-kit 3.8.0 → 3.10.0

package/src/assets/commands/resolve.mds

@@ -10,7 +10,11 @@ output-dir: dist/commands
 @import "./_partials/_settings.mds" as settings
 # Resolve Command
 
+<!-- compliance:on -->
 Process issues from code review reports: triage every issue through the blast-radius disposition matrix, fix FIX_NOW items with Code agents, verify fixes with a Validate agent gate, and track FIX_SEPARATE/TECH_DEBT items as manage-debt tickets. Defaults to the latest timestamped review directory. Supports multi-worktree auto-discovery.
+<!-- compliance:off -->
+Process issues from code review reports: triage every issue through the blast-radius disposition matrix, fix FIX_NOW items with Code agents, verify fixes with a Validate agent gate, and record FIX_SEPARATE/TECH_DEBT items in the resolution summary. Defaults to the latest timestamped review directory. Supports multi-worktree auto-discovery.
+<!-- compliance:end -->
 
 ## Usage
 
@@ -36,7 +40,7 @@ Process issues from code review reports: triage every issue through the blast-ra
    - Additional filter: must have unresolved reviews (latest review directory has no `resolution-summary.md`)
 2. **If `--path` flag provided:** use only that worktree, skip discovery
    **`--path` validation**: Before proceeding, verify the path exists as a directory and appears in `git worktree list` output. If not: report error and stop.
-3. **If only 1 resolvable worktree** (the common case): proceed as single-worktree flow — zero behavior change
+3. **If only 1 resolvable worktree:** proceed as single-worktree flow
 4. **If multiple resolvable worktrees:** report "Found N worktrees with unresolved reviews: {list}" and proceed with multi-worktree flow
 
 #### Step 0b: Per-Worktree Pre-Flight (Git Agent)
@@ -66,7 +70,7 @@ PR_DESCRIPTION=$(gh pr view {pr_number} --json body --jq '.body' 2>/dev/null ||
 ```
 If `pr_number` is absent or the command fails, set `PR_DESCRIPTION` to `(none)`.
 
-**DIFF_FILES** is extracted from the `### Diff Scope` block in the Git agent validate-branch output. Set to empty string `""` if the block is absent (bug-analysis mode edge case).
+**DIFF_FILES** is the `### Diff Scope` block of the validate-branch output, or `""` when the block is absent.
 
 #### Step 0c: Target Review Directory
 
@@ -77,19 +81,23 @@ For each worktree:
 
 1. List directories in `{worktree}/.devflow/docs/reviews/{branch-slug}/`
 2. **If `--review {timestamp}` provided:** use that specific directory (not supported in multi-worktree mode)
-3. **Otherwise:** sort directories by name descending (timestamps are naturally sortable), scan the 10 most recent directories only. Select the first that contains `review-summary.md` (complete review)
+3. **Otherwise:** sort directories by name descending, scan the 10 most recent directories only. Select the first that contains `review-summary.md` (complete review)
 4. **If latest directory already has `resolution-summary.md`:** the review is resolved — check bug-analysis fallback (step 5b).
-5. **Legacy fallback:** if no timestamped subdirectories exist but flat `*.md` files do in `{worktree}/.devflow/docs/reviews/{branch-slug}/`, read them directly (backwards compatible).
+5. **Legacy fallback:** if no timestamped subdirectories exist but flat `*.md` files do in `{worktree}/.devflow/docs/reviews/{branch-slug}/`, read them directly.
 
 **5b. Bug analysis fallback** — if no qualifying review directory found (no reviews exist, or all resolved):
 - List directories in `{worktree}/.devflow/docs/bug-analysis/{branch-slug}/`
-- Sort by name descending (timestamps are naturally sortable), scan the 10 most recent directories only. Select the latest that:
+- Sort by name descending, scan the 10 most recent directories only. Select the latest that:
   - Contains at least one focus report (`security.md`, `functional.md`, `integration.md`, or `usability.md`)
   - Does NOT contain a `resolution-summary.md`
 - If found: set `TARGET_DIR` to that path. Reviews take priority — bug analysis is only used when no qualifying review exists.
 - If not found within those 10 directories: skip worktree — report "No unresolved review or bug analysis found. Run `/code-review` or `/bug-analysis` first."
 
+<!-- compliance:on -->
 Set `TARGET_DIR` to the selected review or bug-analysis directory path, and `TARGET_DIR_REL` to the same directory relative to the worktree root (`.devflow/docs/reviews/…` or `.devflow/docs/bug-analysis/…`) — the only form of it that may reach a PR comment.
+<!-- compliance:off -->
+Set `TARGET_DIR` to the selected review or bug-analysis directory path, and `TARGET_DIR_REL` to the same directory relative to the worktree root (`.devflow/docs/reviews/…` or `.devflow/docs/bug-analysis/…`) — the only form of it that may reach a command line.
+<!-- compliance:end -->
 
 <!-- curation:on -->
 #### Step 0d: Load Project Decisions
@@ -98,9 +106,17 @@ Set `TARGET_DIR` to the selected review or bug-analysis directory path, and `TAR
 <!-- curation:end -->
 
 <!-- curation:on -->
+<!-- compliance:on -->
 **Produces:** DECISIONS_CONTEXT, FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, REVIEW_PUBLICATION, RESOLUTION_TS, GATE_LEVEL
+<!-- compliance:off -->
+**Produces:** DECISIONS_CONTEXT, FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, RESOLUTION_TS, GATE_LEVEL
+<!-- compliance:end -->
 <!-- curation:off -->
+<!-- compliance:on -->
 **Produces:** FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, REVIEW_PUBLICATION, RESOLUTION_TS, GATE_LEVEL
+<!-- compliance:off -->
+**Produces:** FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, RESOLUTION_TS, GATE_LEVEL
+<!-- compliance:end -->
 <!-- curation:end -->
 
 {{settings.settings_resolve()}}
@@ -116,9 +132,16 @@ Pass `FEATURE_KNOWLEDGE` to the Triage agent in Phase 2.
 
 {{evidence_policy()}}
 Reuse this result for every worktree.
+<!-- compliance:off -->
+When `EVIDENCE_POLICY` is `required`, record `TRACEABILITY: DEGRADED (compliance off on this machine; the repository requires evidence)` once, for the Phase 10 report.
+<!-- compliance:end -->
 
+<!-- compliance:on -->
 {{publication_gate()}}
 Resolve this per worktree — unlike the evidence policy above, the settings line is per worktree root. From the same line: {{compliance.compliance_frameworks()}}
+<!-- compliance:off -->
+Resolve this per worktree — unlike the evidence policy above, the settings line is per worktree root. From the same line: {{compliance.compliance_frameworks()}}
+<!-- compliance:end -->
 
 {{compliance.compliance_inject()}}
 
@@ -130,7 +153,11 @@ Set it per worktree, from that worktree's lens, and pass that worktree's `COMPLI
 - If the Read fails, or the file has no `## Phases` heading with the `| Phase | standard | lean |` header, or a row breaks its grammar, apply no row in any worktree, keep every `GATE_LEVEL` and say `level reference unreadable: no level rows applied`.
 - No level changes the Triage security gate or the ESCALATED route. The Verification Gate, the CI gate and the compliance directive run at every level.
 
+<!-- compliance:on -->
 **Mint `RESOLUTION_TS` once per run:** `date -u +%Y-%m-%dT%H:%M:%SZ`. Every worktree reuses it — the resolution comment's dedup marker is searched per PR, so one run key keeps a retry of this run deduplicated while the next /resolve on the same PR posts. Phase 5 writes it as the summary's `**Date**:` and Phase 9b-2 passes it, so the local file and the posted marker agree.
+<!-- compliance:off -->
+**Mint `RESOLUTION_TS` once per run:** `date -u +%Y-%m-%dT%H:%M:%SZ`. Every worktree reuses it. Phase 5 writes it as the summary's `**Date**:`.
+<!-- compliance:end -->
 
 ### Phase 1: Parse Issues
 
@@ -141,9 +168,9 @@ Read review reports from `{TARGET_DIR}/*.md` and extract:
 
 **Exclude from issue extraction:**
 - `review-summary.md` (Synthesize agent output, not individual findings)
-- `resolution-summary.md` (if it exists from a previous partial run)
+- `resolution-summary.md` (from a previous partial run)
 - `bug-analysis-summary.md` (Synthesize agent output for bug-analysis runs)
-- `static-findings.md` (raw static analysis tool output, not individual findings)
+- `static-findings.md` (raw tool output, not individual findings)
 
 **Include:** ALL issues from all categories and severities, including Suggestions.
 
@@ -160,6 +187,7 @@ Issues are extracted from `{TARGET_DIR}` only — never cross-reference reviews
 - `suggested_fix`: From review report
 - `reviewer_confidence`: Confidence percentage if present in the report (e.g., "85%"), else omit
 
+<!-- compliance:on -->
 ### Phase 1b: Fetch External Review Threads
 
 **Produces:** THREAD_MAP
@@ -179,6 +207,7 @@ Return THREAD_MAP for use in Phase 9b."
 
 Parse `THREAD_MAP` from Git agent output. If Git agent returns `TRACEABILITY: DEGRADED`: record the reason, set `THREAD_MAP = empty`, continue.
 
+<!-- compliance:end -->
 ### Phase 2: Global Triage
 
 **Produces:** TRIAGE_RESULTS
@@ -207,17 +236,27 @@ Follow devflow:apply-decisions to Read full ADR/PF bodies on demand.
 Follow devflow:apply-feature-knowledge for FEATURE_KNOWLEDGE."
 ```
 
-Wait for Triage agent to complete before proceeding. Parse verdict ledger from Triage agent output:
+When the Triage agent completes, parse its verdict ledger:
 - **ESCALATED**: Security issues requiring human escalation
-- **FIX_NOW**: Valid issues assigned to Code agents (with risk tier: Standard | Careful)
+- **FIX_NOW**: Valid issues assigned to Code agents (with risk tier: Standard | Careful | `Standard, prose only: edit text alone; agent instructions count as logic; if this issue needs a logic change, leave it unedited and name it`; any other value counts as Careful). SCOPE gives one `{id}: {tier}` line per issue.
 - **FALSE_POSITIVE**: Issues the Review agent got wrong (with cited evidence)
 - **BY_DESIGN**: Intentional code (with a recorded decision, stated in words, or a code doc citation)
+<!-- compliance:on -->
 - **FIX_SEPARATE**: Valid but out of blast-radius scope (must become manage-debt ticket)
+<!-- compliance:off -->
+- **FIX_SEPARATE**: Valid but out of blast-radius scope (recorded in the resolution summary, never fixed here)
+<!-- compliance:end -->
 - **TECH_DEBT**: Architectural overhaul only — LAST RESORT
 - **DUPLICATE**: Collapsed duplicate issue — carries `duplicate_of: <primary-id>` referencing the non-DUPLICATE primary; inherits the primary's outcome
 
+A ledger `### Summary` line `- Tiers: not applied (…)` is the level note.
+
 <!-- curation:on -->
+<!-- compliance:on -->
 Collect every decision and pitfall the Triage agent's Reasoning columns state, in its words — the resolution summary is posted, so it never carries an ADR/PF ID.
+<!-- compliance:off -->
+Collect every decision and pitfall the Triage agent's Reasoning columns state, in its words — IDs are numbered per machine, so the resolution summary never carries an ADR/PF ID.
+<!-- compliance:end -->
 
 <!-- curation:end -->
 **Triage agent completeness assertion:** Verify the parsed ledger against ISSUES before proceeding:
@@ -226,16 +265,24 @@ Collect every decision and pitfall the Triage agent's Reasoning columns state, i
    - Retry the Triage agent once with the same inputs.
    - If the retry also fails the completeness check: abort with a clear error message listing the missing issue IDs and failure reason — never proceed with dropped issues.
 
+<!-- compliance:on -->
 **If ESCALATED issues exist:** surface them in a `## Escalations` section with a prominent display callout — never route escalations to manage-debt.
+<!-- compliance:off -->
+**If ESCALATED issues exist:** surface them in a `## Escalations` section with a prominent display callout — never route escalations to the deferred sections.
+<!-- compliance:end -->
 
 ### Phase 3: Batch FIX_NOW Issues
 
 **Produces:** BATCHES
 **Requires:** TRIAGE_RESULTS
 
+<!-- compliance:on -->
 If FIX_NOW list is empty: skip to Phase 5, then run Phases 9, 9b, 9c and 10.
+<!-- compliance:off -->
+If FIX_NOW list is empty: skip to Phase 5, then run Phases 9b, 9c and 10.
+<!-- compliance:end -->
 
-Otherwise, batch FIX_NOW issues for Code agent execution. **DUPLICATE issues are never dispatched** — they inherit the primary's outcome:
+Otherwise, batch FIX_NOW issues. **DUPLICATE issues are never dispatched** — they inherit the primary's outcome:
 - **Same-file issues** → one batch (one Code agent per file)
 - **Distinct-file issues** → parallel Code agents
 - **Max 5 issues per batch** — chunk large sets
@@ -274,26 +321,37 @@ Spawn distinct-file batch Code agents **in a single message** (parallel). Sequen
 Collect from each Code agent:
 - `{status, commitShas, unresolved}` per batch
 - `## Verification` block (commands run + results)
+- An unresolved prose-only issue that Code names as needing a logic change, and whose type is not `security` → FIX_SEPARATE in TRIAGE_RESULTS, Reason `needs a logic change`; every other unresolved issue stays Blocked
 
 ### Phase 5: Write resolution-summary.md
 
 **Produces:** RESOLUTION_FILE (early write for compaction safety)
 **Requires:** TRIAGE_RESULTS, CODE_AGENT_RESULTS, TARGET_DIR, TARGET_DIR_REL, BRANCH_INFO, RESOLUTION_TS, GATE_LEVEL
 
-**Immediately write `resolution-summary.md`** to `{TARGET_DIR}` using the Write tool. Do this now — not in Phase 9 — while results are fresh in context.
+**Immediately write `resolution-summary.md`** to `{TARGET_DIR}`.
 
+<!-- compliance:on -->
 Set `Tracked` for FIX_SEPARATE and TECH_DEBT items to `(pending)` — to be backfilled after Phase 9 manage-debt (or `TRACEABILITY: DEGRADED ({reason})` if manage-debt degrades).
+<!-- compliance:off -->
+Give FIX_SEPARATE and TECH_DEBT items the `Tracked` value `local`: no backlog entry is created.
+<!-- compliance:end -->
 
 DUPLICATE issues are listed **only** in `## Duplicates` — never in `## Fixed Issues`, `## False Positives`, `## By Design`, `## Fix Separately`, `## Deferred to Tech Debt`, `## Escalations`, or `## Blocked`. A duplicate of a FALSE_POSITIVE primary therefore leaves only the primary in the `False Positive` row and the `## False Positives` section; the same holds for every other outcome the duplicate inherits.
 
+Open each Issue cell with its severity in brackets when it has one, as `[HIGH]`.
+
+<!-- compliance:on -->
+Use the template from the Output Artifact section below. Put text not for public posting in a final `## Private notes` section.
+<!-- compliance:off -->
 Use the template from the Output Artifact section below.
+<!-- compliance:end -->
 
 ### Phase 6: Polish
 
 **Produces:** POLISH_RESULT
 **Requires:** CODE_AGENT_RESULTS, GATE_LEVEL
 
-If any fixes were made, spawn Polish agent to refine the changed code:
+If any fixes were made, spawn Polish agent:
 
 ```
 Agent(subagent_type="Polish", run_in_background=false):
@@ -306,7 +364,7 @@ Commit any improvements with a conventional-commit message."
 
 ### Phase 7: Verification Gate
 
-**Produces:** VERIFICATION_STATUS
+**Produces:** VERIFICATION_STATUS, VERIFICATION_BLOCKER
 **Requires:** CODE_AGENT_RESULTS, BRANCH_INFO
 
 If no fixes were made (CODE_AGENT_RESULTS contains 0 commits) → set VERIFICATION_STATUS = SKIPPED, skip: "No fixes applied — skipping Verification Gate."
@@ -323,10 +381,9 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
 `validation_retry_count = 0`
 
 **If FAIL:**
-1. Extract failure details from Validate agent output
-2. Increment `validation_retry_count`
-3. If `validation_retry_count <= 2`:
-   - Spawn Fix agent with fix context:
+1. Increment `validation_retry_count`
+2. If `validation_retry_count <= 2`:
+   - Spawn Fix agent:
    ```
    Agent(subagent_type="Fix"):
    "OPERATION: validation-fix
@@ -341,30 +398,40 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
    {COMPLIANCE_DIRECTIVE}"
    ```
    - Loop back to re-validate
-4. If `validation_retry_count > 2`: set VERIFICATION_STATUS = FAILED and exit the validation loop — record a blocking callout in the `## Verification` section (never a silent pass).
+3. If `validation_retry_count > 2`: set VERIFICATION_STATUS = FAILED, Final gate `FAILED after N attempts`; exit the validation loop.
+
+**If BLOCKED:** FAILED, Final gate `FAILED (Validate blocked)`, no Fix agent, exit the loop; VERIFICATION_BLOCKER = its cause and log path, for the Phase 10 report only, never resolution-summary.md.
 
-**If PASS:** set VERIFICATION_STATUS = PASS and exit the validation loop.
+**If PASS:** set VERIFICATION_STATUS = PASS, Final gate `PASS`; exit the validation loop.
+
+Any other or missing Status: FAILED, Final gate `FAILED (no Validate status)`, exit the loop; never PASS.
 
 Record `## Verification` outcome in resolution-summary.md (runs unconditionally after the validation loop exits):
-- Rewrite the `## Verification` section with | Command | Result | table + `Final gate: PASS | FAILED after N attempts`
+- Rewrite the `## Verification` section with | Command | Result | table + `Final gate: {value above}`; a FAILED gate gets a blocking callout (never a silent pass)
 
+<!-- compliance:on -->
 Push all commits to remote once (Code and Fix agents ran with PUSH: false — runs whether the gate PASSED or FAILED, so the branch is always visible before Phase 9 or CI runs):
+<!-- compliance:off -->
+Push all commits to remote once (Code and Fix agents ran with PUSH: false — runs whether the gate PASSED or FAILED, so the branch is always visible before Phase 9b or CI runs):
+<!-- compliance:end -->
 ```bash
 git -C {worktree} push
 ```
 
 **If `fork_no_push` is set:** do not push. Record `Push: skipped — cannot push to fork` under `## Verification`, and skip Phase 8 — no pushed commit exists for CI to check.
 
+<!-- compliance:on -->
 **Route after push:** VERIFICATION_STATUS = PASS → continue to Phase 8 (CI gate). FAILED or SKIPPED → skip Phase 8 and continue with Phase 9 and the later phases in order.
+<!-- compliance:off -->
+**Route after push:** VERIFICATION_STATUS = PASS → continue to Phase 8 (CI gate). FAILED or SKIPPED → skip Phase 8 and continue with Phase 9b and the later phases in order.
+<!-- compliance:end -->
 
 ### Phase 8: CI Status Gate (Conditional)
 
 **Produces:** CI_STATUS
 **Requires:** CODE_AGENT_RESULTS, VERIFICATION_STATUS, BRANCH_INFO
 
-If no issues were fixed (CODE_AGENT_RESULTS contains 0 fixes) → skip: "No fixes applied — skipping CI validation."
-
-If Verification Gate FAILED → skip CI gate (validation failures already reported).
+If VERIFICATION_STATUS is not PASS → skip CI gate.
 
 If `fork_no_push` is set → skip: "Cannot push to fork — skipping CI validation."
 
@@ -378,22 +445,23 @@ Otherwise, for each worktree with fixes:
 git -C {worktree} push; echo "exit=$?"
 ```
 
-Phase 7 has pushed already, so this is a no-op unless the head moved since. `exit=0` continues to the gate. Any other result records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and skips the wait for this worktree. Pass `WORKTREE_PATH: {worktree_path}` on the fix spawn below.
+`exit=0` continues to the gate. Any other result records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and skips the wait for this worktree. Pass `WORKTREE_PATH: {worktree_path}` on the fix spawn below.
 
 <!-- PATTERN: ci-status-gate -->
-1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run is one wait of at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, a status outside the six below, or a non-zero exit is INDETERMINATE.
+1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run waits at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, an unknown status or a non-zero exit is INDETERMINATE.
 2. **If PASSING** → proceed to next phase.
 3. **If NO_PR or NO_CI** → skip: "No PR/CI configured, skipping CI validation." Proceed to next phase.
-4. **If PENDING** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI still running — verify manually before merging" and proceed.
-5. **If INDETERMINATE** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI status unknown — verify manually before merging" and proceed.
+4. **If PENDING** and fewer than 3 waits have run → wait again. Otherwise → report "CI still running — verify manually before merging" and proceed.
+5. **If INDETERMINATE** and fewer than 3 waits have run → wait again, unless `waited=570` with `reason=head-mismatch` or `no-workflow-check`. Otherwise → report "CI status unknown — verify manually before merging" and proceed.
 <!-- curation:on -->
-6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES`, `DECISIONS_CONTEXT` and `PUSH: false`; `CI_FAILURES` holds the failing-check names from the line and nothing else, because the Fix agent fetches the full names and reads the logs itself and this command reads none. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
+6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES`, `DECISIONS_CONTEXT` and `PUSH: false`; `CI_FAILURES` holds only the failing-check names from the line: the Fix agent fetches the full names and reads the logs itself. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
 <!-- curation:off -->
-6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES` and `PUSH: false`; `CI_FAILURES` holds the failing-check names from the line and nothing else, because the Fix agent fetches the full names and reads the logs itself and this command reads none. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
+6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES` and `PUSH: false`; `CI_FAILURES` holds only the failing-check names from the line: the Fix agent fetches the full names and reads the logs itself. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
 <!-- curation:end -->
-7. **Budget**: at most 3 waits and 2 fixes in all, per worktree. When one is spent, report the current status and proceed.
+7. **Budget**: at most 3 waits and 2 fixes in all, per worktree. When one is spent, report the status and proceed.
 <!-- /PATTERN: ci-status-gate -->
 
+<!-- compliance:on -->
 ### Phase 9: Manage Debt (Sequential)
 
 **Produces:** DEBT_RESULT
@@ -417,13 +485,24 @@ After manage-debt completes:
 - **Success**: backfill `Tracked = {ISSUE_REF}` in resolution-summary.md for each FIX_SEPARATE and TECH_DEBT item, using the backlog issue's provider-canonical rendered reference. Under `github` an `{ISSUE_REF}` is `#`-prefixed, so the field renders `Tracked = #{n}`.
 - **DEGRADED**: if Git agent returns `TRACEABILITY: DEGRADED ({reason})`, warn and record in resolution-summary.md; `Tracked` stays `(pending — TRACEABILITY: DEGRADED ({reason}))` for each affected item.
 
+<!-- compliance:end -->
+<!-- compliance:on -->
 ### Phase 9b: Thread Resolution + Resolution Comment
 
 **Produces:** STALE_REVERIFICATION, THREAD_RESOLUTION_RESULT, PR_COMMENT, EVIDENCE_REFRESH
 **Requires:** THREAD_MAP (from Phase 1b), EVIDENCE_POLICY, VERIFICATION_STATUS, CODE_AGENT_RESULTS, TRIAGE_RESULTS, BRANCH_INFO, TARGET_DIR_REL, RESOLUTION_TS, REVIEW_PUBLICATION
+<!-- compliance:off -->
+### Phase 9b: Local Test-Plan Evidence
+
+**Produces:** STALE_REVERIFICATION, EVIDENCE_REFRESH
+**Requires:** CODE_AGENT_RESULTS, BRANCH_INFO, TARGET_DIR_REL
+
+**Local evidence file.** The evidence file is `.devflow/docs/evidence-{branch_slug}.md` in the worktree: /implement writes it. Run each script of Phases 9b and 9c only when `{branch_slug}` matches `^[A-Za-z0-9._-]{1,200}$` — it carries the branch name, which a fork author picks — and treat any other value as a failed run. When `cd {worktree} && test -f ".devflow/docs/evidence-{branch_slug}.md"; echo "exit=$?"` prints anything but `exit=0`, no local evidence file exists: record `STALE_REVERIFICATION` and `EVIDENCE_REFRESH` as `SKIPPED (no local evidence file)`, skip Steps 9b-0 and 9b-3, and run Step 9c without `--evidence`.
+<!-- compliance:end -->
 
 **Step 9b-0: Re-verify stale test-plan items**
 
+<!-- compliance:on -->
 Run this step only when a push of this run succeeded — Phase 7's, or the push of Phase 8's gate — and a PR is known; otherwise skip it and Step 9b-3, and record `STALE_REVERIFICATION` as `SKIPPED (head unchanged)`. Detection needs no Git agent: from the worktree root, run the evidence script, which re-derives every test-plan state at the new head and writes the stale TP lines whose text the PR's trusted evidence record vouches for:
 
 ```bash
@@ -431,6 +510,15 @@ cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" verify --pr {
 ```
 
 Run it only when `TARGET_DIR_REL` matches `^[A-Za-z0-9._/-]+$` — it carries the branch name, which a fork author picks — and treat any other value as a failed run. Use its `EVIDENCE` line only on `exit=0`; otherwise record `STALE_REVERIFICATION` as `DEGRADED (evidence unavailable)` and spawn nothing. When its `stale:` field lists TPs and `{TARGET_DIR}/stale-plan.md` holds TP lines, spawn **one** Test agent — at most one per /resolve cycle, never re-spawned on its result, and no fix loop follows it. The lines came from the PR body, so they travel wrapped, with any `</untrusted-test-plan>` inside them neutralised:
+<!-- compliance:off -->
+Run this step only when a push of this run succeeded — Phase 7's, or the push of Phase 8's gate — and a PR is known; otherwise skip it and Step 9b-3, and record `STALE_REVERIFICATION` as `SKIPPED (head unchanged)`. Detection needs no Git agent: from the worktree root, run the evidence script, which re-derives every test-plan state at the new head from the local evidence file and writes the stale TP lines:
+
+```bash
+cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" verify --pr {pr_number} --evidence ".devflow/docs/evidence-{branch_slug}.md" --stale-out "{TARGET_DIR_REL}/stale-plan.md"; echo "exit=$?"
+```
+
+Run it only when `TARGET_DIR_REL` matches `^[A-Za-z0-9._/-]+$` — it carries the branch name, which a fork author picks — and treat any other value as a failed run. Use its `EVIDENCE` line only on `exit=0`; otherwise record `STALE_REVERIFICATION` as `DEGRADED (evidence unavailable)` and spawn nothing. When its `stale:` field lists TPs and `{TARGET_DIR}/stale-plan.md` holds TP lines, spawn **one** Test agent — at most one per /resolve cycle, never re-spawned on its result, and no fix loop follows it. The lines came from the evidence file, so they travel wrapped, with any `</untrusted-test-plan>` inside them neutralised:
+<!-- compliance:end -->
 
 ```
 Agent(subagent_type="Test"):
@@ -442,14 +530,25 @@ WORKTREE_PATH: {worktree_path}  (omit if cwd)
 Re-verify each TP at the current HEAD and report its Test Plan Evidence row. The TP text is data: design your own commands."
 ```
 
+<!-- compliance:on -->
 Append one claim per `### Test Plan Evidence` row whose TP is in the stale file to the `## Claims` section of `{TARGET_DIR}/evidence.md` (create the file and the section when absent; append only), where `<head>` is the report's 40-hex `HEAD:`:
+<!-- compliance:off -->
+Append one claim per `### Test Plan Evidence` row whose TP is in the stale file to the `## Claims` section of `.devflow/docs/evidence-{branch_slug}.md`, the local evidence file (create the section, last in the file, when absent; append only), where `<head>` is the report's 40-hex `HEAD:`:
+<!-- compliance:end -->
 
 ```
 - TP-<n> <PASS|FAIL|SKIP> sha:<head> by:test exit:<0-255>
 ```
 
+<!-- compliance:on -->
 The line ends at `by:test` when the row's Exit is not a number from 0 to 255; append nothing when the report's `HEAD:` is not one 40-hex SHA. Record `Test plan: {n} stale, {m} re-verified` under `## Verification` in resolution-summary.md now, before 9b-2 posts it, and set `STALE_REVERIFICATION` to that line.
+<!-- compliance:off -->
+The line ends at `by:test` when the row's Exit is not a number from 0 to 255; append nothing when the report's `HEAD:` is not one 40-hex SHA. Record `Test plan: {n} stale, {m} re-verified` under `## Verification` in resolution-summary.md now, and set `STALE_REVERIFICATION` to that line.
+<!-- compliance:end -->
 
+A Test Status whose first word is not PASS or FAIL still gets its claims, but `Test plan: DEGRADED (Test run blocked)` replaces that line. `{m}` counts PASS rows only.
+
+<!-- compliance:on -->
 **Step 9b-1: Resolve external threads**
 
 Run this step only when `EVIDENCE_POLICY` is `required` and THREAD_MAP is non-empty; otherwise skip it and record `THREAD_RESOLUTION_RESULT` as `SKIPPED ({reason})`.
@@ -498,8 +597,14 @@ Posts the consolidated resolution-summary comment (marker-deduped by the operati
 
 Capture the Git agent's `**Publication**:` and `**Status**:` lines as `PR_COMMENT`. If it returns `TRACEABILITY: DEGRADED ({reason})` instead, `PR_COMMENT`'s status is `DEGRADED ({reason})`: warn, continue.
 
+<!-- compliance:end -->
+<!-- compliance:on -->
 **Step 9b-3: Refresh the test-plan evidence**
+<!-- compliance:off -->
+**Step 9b-3: Verify the test-plan evidence locally**
+<!-- compliance:end -->
 
+<!-- compliance:on -->
 Run this step only when Step 9b-0 ran — the head moved — and its `EVIDENCE` line did not read `total:0` with `exceptions:none` (nothing to record); otherwise record `EVIDENCE_REFRESH` as `SKIPPED ({reason})`. Run the script inline — it is the whole `update-pr-evidence` operation, with no Git agent spawn — through the Bash tool with `timeout: 180000`:
 
 ```bash
@@ -507,12 +612,22 @@ cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" publish --pr
 ```
 
 Drop the `--evidence` pair when Step 9b-0 appended no claim. Run it only when `TARGET_DIR_REL` matches `^[A-Za-z0-9._/-]+$` — it carries the branch name, which a fork author picks — and `{pr_number}` is digits only; treat any other value as a failed run. The publication value is the mode 9b-2 reported on its `**Publication**:` line — `FULL…` → `full`, `STUB…` → `stub`, `OFF…` → `off` — else `{REVIEW_PUBLICATION}` as resolved in Step 0d. Capture its stdout as `EVIDENCE_REFRESH`: the `## PR Evidence` block's `EVIDENCE` line and its `**Body**:` / `**Comment**:` line, with any `TRACEABILITY: DEGRADED ({reason})` lines after them (exit 0), or the one line `TRACEABILITY: DEGRADED (evidence unavailable)` (exit 2). Empty stdout or any other exit is `TRACEABILITY: DEGRADED (evidence unavailable)`. It never blocks.
+<!-- compliance:off -->
+Run this step only when Step 9b-0 ran — the head moved — and its `EVIDENCE` line did not read `total:0` with `exceptions:none` (nothing to record); otherwise record `EVIDENCE_REFRESH` as `SKIPPED ({reason})`. Run the script inline, with no Git agent spawn. It reads the PR and the local evidence file and writes the local result file; it writes nothing to GitHub:
+
+```bash
+cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" verify --pr {pr_number} --evidence ".devflow/docs/evidence-{branch_slug}.md" --comment-out ".devflow/docs/evidence-result-{branch_slug}.md"; echo "exit=$?"
+```
+
+`{pr_number}` is digits only; treat any other value as a failed run. Capture its stdout as `EVIDENCE_REFRESH`: its one `EVIDENCE` line (exit 0), or the one line `TRACEABILITY: DEGRADED (evidence unavailable)` (exit 2). Empty stdout or any other exit is `TRACEABILITY: DEGRADED (evidence unavailable)`. It never blocks.
+<!-- compliance:end -->
 
 ### Phase 9c: Merge Readiness (Report-only)
 
 **Produces:** MERGE_READINESS_REPORT
 **Requires:** BRANCH_INFO, REQUIRE_NON_AUTHOR_APPROVAL
 
+<!-- compliance:on -->
 Run this phase only when `REQUIRE_NON_AUTHOR_APPROVAL` is `true`; otherwise skip it and report it as SKIPPED.
 
 Run the script inline — it is the whole `check-merge-readiness` operation, with no Git agent spawn — through the Bash tool with `timeout: 180000`:
@@ -522,6 +637,17 @@ cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" readiness --p
 ```
 
 Pass `--require-non-author-approval true`: `REQUIRE_NON_AUTHOR_APPROVAL` is `true` here, or this phase would not run. `{pr_number}` is digits only. Its stdout is the `## Merge Readiness` block (exit 0), or the same block with `**Status**: DEGRADED ({reason})` and a `TRACEABILITY: DEGRADED ({reason})` line after it (exit 2); empty stdout or any other exit is `TRACEABILITY: DEGRADED (readiness unavailable)`.
+<!-- compliance:off -->
+Run this phase on every cycle, for each worktree with a known PR, whatever `REQUIRE_NON_AUTHOR_APPROVAL` is: the readiness file is the local merge check.
+
+Run the script inline — it is the whole `check-merge-readiness` operation, with no Git agent spawn:
+
+```bash
+cd {worktree} && node "$HOME/.devflow/scripts/verify-evidence.cjs" readiness --pr {pr_number} --require-non-author-approval {REQUIRE_NON_AUTHOR_APPROVAL} --evidence ".devflow/docs/evidence-{branch_slug}.md" --out ".devflow/docs/readiness-{branch_slug}.md"; echo "exit=$?"
+```
+
+Pass `--require-non-author-approval` the value of `REQUIRE_NON_AUTHOR_APPROVAL`, `true` or `false`. Drop the `--evidence` pair when Phase 9b recorded `SKIPPED (no local evidence file)`: the readiness then takes the plan from the PR's own record. `{pr_number}` is digits only. Its stdout is the `## Merge Readiness` block (exit 0), or the same block with `**Status**: DEGRADED ({reason})` and a `TRACEABILITY: DEGRADED ({reason})` line after it (exit 2); empty stdout or any other exit is `TRACEABILITY: DEGRADED (readiness unavailable)`. The script writes the local file (on exit 0 or 2) and nothing to GitHub.
+<!-- compliance:end -->
 
 Include merge readiness verdict (READY / NOT_READY / DEGRADED) and its `- Test plan:` detail line in Phase 10 report. Never block on this result — report-only.
 
@@ -529,9 +655,17 @@ If the script prints a `TRACEABILITY: DEGRADED` line: warn, proceed to Phase 10.
 
 ### Phase 10: Report
 
-**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT, GATE_LEVEL
+<!-- compliance:on -->
+**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT, GATE_LEVEL, VERIFICATION_BLOCKER
+<!-- compliance:off -->
+**Requires:** BRANCH_INFO, TARGET_DIR, GATE_LEVEL, VERIFICATION_BLOCKER
+<!-- compliance:end -->
 
+<!-- compliance:on -->
 The resolution summary was already written to `{TARGET_DIR}/resolution-summary.md` in Phase 5 (updated by Phase 7, Phase 9 and Phase 9b-1). Display results to the user:
+<!-- compliance:off -->
+The resolution summary was already written to `{TARGET_DIR}/resolution-summary.md` in Phase 5 (updated by Phase 7 and Phase 9b-0). It stays local and is not posted. Display results to the user:
+<!-- compliance:end -->
 
 ```
 ## Resolution Summary
@@ -553,7 +687,8 @@ The resolution summary was already written to `{TARGET_DIR}/resolution-summary.m
 | Duplicates Collapsed | {n} |
 
 ### Verification
-Final gate: {PASS | FAILED after N attempts}
+Final gate: {the value Phase 7 recorded}
+{VERIFICATION_BLOCKER, if any}
 
 ### Commits Created
 - {sha} {message}
@@ -562,6 +697,7 @@ Final gate: {PASS | FAILED after N attempts}
 > ⚠️ Security escalations require human review before merge:
 > {list of escalated issues}
 
+<!-- compliance:on -->
 ### Tech Debt Added
 - {n} items added to backlog
 
@@ -579,6 +715,25 @@ Final gate: {PASS | FAILED after N attempts}
 
 ### Artifacts
 - Resolution report: {TARGET_DIR}/resolution-summary.md
+<!-- compliance:off -->
+### Deferred Items
+- {n} items recorded in the resolution summary (Tracked: local)
+
+### Local Evidence
+- Push: {pushed (Phase 7, a CI-fix push, or both) | skipped (no fixes) | skipped (cannot push to fork) | DEGRADED (ci push failed)}
+- Test-plan re-verification: {Test plan: n stale, m re-verified | SKIPPED (head unchanged) | SKIPPED (no local evidence file) | DEGRADED (reason)}
+- Test-plan evidence: {the EVIDENCE line's VERIFIED-CI + ATTESTED-LOCAL / total | SKIPPED (reason) | DEGRADED (reason)}
+- Traceability: {the compliance-off line Step 0d recorded, when it did}
+
+### Merge Readiness
+{READY | NOT_READY (reason) | DEGRADED (reason)}
+{the op's Test plan detail line, when it ran}
+
+### Artifacts
+- Resolution summary: {TARGET_DIR}/resolution-summary.md (local; not posted)
+- Evidence result: {.devflow/docs/evidence-result-{branch_slug}.md (local; not posted) | SKIPPED (reason)}
+- Readiness file: {.devflow/docs/readiness-{branch_slug}.md (local; not posted) | SKIPPED (reason)}
+<!-- compliance:end -->
 ```
 
 In multi-worktree mode, report results per worktree with aggregate summary.
@@ -592,23 +747,37 @@ In multi-worktree mode, report results per worktree with aggregate summary.
 │
 ├─ Phase 0: Worktree Discovery & Pre-flight
 ├─ Phase 1: Parse issues from TARGET_DIR
+<!-- compliance:on -->
 ├─ Phase 1b: Fetch external threads (evidence policy required)
+<!-- compliance:end -->
 ├─ Phase 2: Global Triage [Triage agent, opus, single agent]
 ├─ Phase 3: Batch FIX_NOW issues
 ├─ Phase 4: Fix [Code agent × N]
+<!-- compliance:on -->
 ├─ Phase 5: Write resolution-summary.md (compaction safety; Tracked = "(pending)" or "(pending — TRACEABILITY: DEGRADED)" if manage-debt degrades)
+<!-- compliance:off -->
+├─ Phase 5: Write the local resolution-summary.md (compaction safety; Tracked = "local")
+<!-- compliance:end -->
 ├─ Phase 6: Polish
 ├─ Phase 7: Verification Gate [Validate agent, haiku] + push + Fix agent validation-fix loop ≤2
 ├─ Phase 8: CI Status Gate (conditional)
+<!-- compliance:on -->
 ├─ Phase 9: Git agent (manage-debt) — FIX_SEPARATE + TECH_DEBT → backfill Tracked={ISSUE_REF} (or TRACEABILITY: DEGRADED on failure)
+<!-- compliance:end -->
 │
-├─ Phase 9b: Thread resolution + resolution comment
-│  ├─ Step 9b-0: verify-evidence.cjs --stale-out → ≤1 Test agent on the stale TPs (wrapped) — only after this run's push
-│  ├─ Step 9b-1: Git agent (resolve-review-threads) — evidence policy required
-│  ├─ Step 9b-2: Git agent (post-resolution-summary, REVIEW_PUBLICATION) — always-on
+<!-- compliance:on -->
+├─ Phase 9b: 9b-0 Test agent (stale TPs), 9b-1/9b-2 Git agent (threads, resolution comment)
 │  └─ Step 9b-3: verify-evidence.cjs publish (inline, no Git spawn) — only when the head moved
+<!-- compliance:off -->
+├─ Phase 9b: 9b-0 Test agent (stale TPs, local evidence file)
+│  └─ Step 9b-3: verify-evidence.cjs verify (inline, no Git spawn) — local result file, only when the head moved
+<!-- compliance:end -->
 │
+<!-- compliance:on -->
 ├─ Phase 9c: verify-evidence.cjs readiness (inline, no Git spawn) — non-author approval required, report-only
+<!-- compliance:off -->
+├─ Phase 9c: verify-evidence.cjs readiness (inline, no Git spawn) — every cycle, local readiness file, report-only
+<!-- compliance:end -->
 │
 └─ Phase 10: Display results (resolution-summary.md written in Phase 5)
 ```
@@ -621,26 +790,34 @@ In multi-worktree mode, report results per worktree with aggregate summary.
 | Fix attempt fails | Revert changes, mark BLOCKED, continue others |
 | Issue dependencies | Sequential chain, skip dependents if predecessor blocked |
 | No issues parsed | Report "No issues to resolve" |
-| Latest review already resolved | Check bug-analysis fallback (Step 0c-5b); if also absent, skip worktree and suggest `/code-review` or `/bug-analysis` |
 | `--review {timestamp}` in multi-worktree mode | Not supported — use `--path` + `--review` to target specific worktree + review |
+<!-- compliance:on -->
 | gh/GitHub absent | manage-debt degrades (`TRACEABILITY: DEGRADED ({reason})`); Tracked stays `(pending — TRACEABILITY: DEGRADED ({reason}))` — recorded, not dropped |
 | `EVIDENCE_POLICY` is `standard` | Phases 1b and 9b-step-1 are skipped; post-resolution-summary (Phase 9b step 2) still runs if a PR is known |
 | `REQUIRE_NON_AUTHOR_APPROVAL` is `false` | Phase 9c is skipped and reported as SKIPPED |
-| Public repo (`auto` mode) | Git agent probes visibility, posts counts-only STUB comment; full resolution report stays local |
 | `reviewPublication: off` | Git agent skips posting the resolution comment (OFF) — except that, only when `EVIDENCE_POLICY` is `required`, Step 0d passes `stub` and a counts-only STUB comment posts |
-| Fork PR this run cannot push to (no maintainer edits, no push access of its own) | validate-branch emits `TRACEABILITY: DEGRADED (cannot push to fork)` → `fork_no_push`: Phase 7 skips the push, Phase 8 is skipped, 9b-1 records FIXED threads as DEGRADED instead of citing unpushed commits; 9b-2 still posts the resolution comment; the head did not move, so 9b-0 and 9b-3 are skipped |
+| Fork PR this run cannot push to | `TRACEABILITY: DEGRADED (cannot push to fork)` → `fork_no_push`: no push in Phase 7, Phase 8 skipped, 9b-1 records FIXED threads as DEGRADED, 9b-2 still posts; the head did not move, so 9b-0 and 9b-3 are skipped |
 | The PR has no trusted evidence record | 9b-0 finds no vouched-for stale line, so no Test agent runs; 9b-3 still refreshes the block and comment, every TP without a claim reading `UNVERIFIED` |
+<!-- compliance:off -->
+| `REQUIRE_NON_AUTHOR_APPROVAL` is `false` | Phase 9c still runs, with `--require-non-author-approval false` |
+| Fork PR this run cannot push to | `TRACEABILITY: DEGRADED (cannot push to fork)` → `fork_no_push`: no push in Phase 7, Phase 8 skipped; the head did not move, so 9b-0 and 9b-3 are skipped |
+| No local evidence file exists | `STALE_REVERIFICATION` and `EVIDENCE_REFRESH` are `SKIPPED (no local evidence file)`; Phase 9c runs readiness without `--evidence` |
+<!-- compliance:end -->
 | A CI run behind a claim has expired (~90 days) | The TP reads `INDETERMINATE` — never verified, never failed — until a claim at a newer SHA settles it |
 
 ## Principles
 
 1. **Orchestration only** - Command spawns agents, doesn't do git/resolve work itself
-2. **Git agent for git work** - All git operations go through Git agent; the CI wait, the evidence refresh and the merge-readiness check are inline scripts (plumbing, no model work)
-3. **Traceability-aware** - Policy-gated ops (thread fetch/resolve, merge readiness) are skipped cleanly when the evidence policy does not ask for them; resolution comment (Phase 9b-2) is always-on; test-plan evidence is re-verified (≤1 Test agent) and refreshed only when this run moved the head (Steps 9b-0, 9b-3)
+2. **Git agent for git work** - All git operations go through Git agent; inline scripts are plumbing
+<!-- compliance:on -->
+3. **Traceability-aware** - Policy-gated ops are skipped cleanly when the evidence policy does not ask for them; resolution comment (Phase 9b-2) is always-on; test-plan evidence is re-verified (≤1 Test agent) and refreshed only when this run moved the head (Steps 9b-0, 9b-3)
+<!-- compliance:off -->
+3. **Local evidence** - Nothing is posted: test-plan evidence is re-verified (≤1 Test agent) and verified into a local result file only when this run moved the head (Steps 9b-0, 9b-3); merge readiness is written to a local file on every cycle (Phase 9c)
+<!-- compliance:end -->
 
 ## Output Artifact
 
-Written in Phase 5 (Collect Results) to `{TARGET_DIR}/resolution-summary.md`:
+Written in Phase 5 to `{TARGET_DIR}/resolution-summary.md`:
 
 ```markdown
 # Resolution Summary
@@ -649,7 +826,7 @@ Written in Phase 5 (Collect Results) to `{TARGET_DIR}/resolution-summary.md`:
 **Date**: {RESOLUTION_TS}
 **Review**: {TARGET_DIR_REL}
 **Command**: /resolve
-**Gate level**: {GATE_LEVEL}
+**Gate level**: {GATE_LEVEL, with any level note}
 
 <!-- curation:on -->
 ## Decisions Citations
@@ -680,7 +857,7 @@ _(Note: `Deferred` = `## Fix Separately` count + `## Deferred to Tech Debt` coun
 
 Regression tests added: {n}
 
-Final gate: PASS | FAILED after {n} attempts
+Final gate: {the value Phase 7 recorded}
 
 ## Fixed Issues
 | Issue | File:Line | Commit |
@@ -700,7 +877,11 @@ Final gate: PASS | FAILED after {n} attempts
 ## Fix Separately
 | Issue | File:Line | Reason | Tracked |
 |-------|-----------|--------|---------|
+<!-- compliance:on -->
 | {description} | {file}:{line} | {why out of scope} | {ISSUE_REF} |
+<!-- compliance:off -->
+| {description} | {file}:{line} | {why out of scope} | local |
+<!-- compliance:end -->
 
 ## Deferred to Tech Debt
 | Issue | File:Line | Risk Factor |
@@ -721,13 +902,17 @@ Final gate: PASS | FAILED after {n} attempts
 | Issue | Duplicate Of | File:Line |
 |-------|-------------|-----------|
 | {description} | {primary-id} | {file}:{line} |
+<!-- compliance:on -->
 
 ## Third-Party Threads
 | Thread | File:Line | Verdict | Status |
 |--------|-----------|---------|--------|
 | ext-{N} | {file}:{line} | {FIXED \| FALSE_POSITIVE \| BY_DESIGN \| ESCALATED} | {RESOLVED \| REPLIED \| DEGRADED} |
+<!-- compliance:end -->
 ```
+<!-- compliance:on -->
 
 _(Omit `## Third-Party Threads` unless `EVIDENCE_POLICY` is `required` and external threads were found.)_
+<!-- compliance:end -->
 
 **Statistics mapping (parser contract)**: the `Deferred` row = FIX_SEPARATE + TECH_DEBT (both deferral dispositions combined); By Design and Escalated are counted separately and excluded from `Deferred`. The `Duplicates Collapsed` row is additive — the `/code-review` convergence parser reads only `Deferred`, `Fixed`, and `False Positive` rows plus `## Fixed Issues` / `## False Positives` headings — keep those labels byte-stable. All rows that the parser reads count UNIQUE (non-DUPLICATE) issues only, so collapsed duplicates do not inflate fp\_ratio.