fdeops 3.16.0 → 3.17.0

package/README.md

@@ -2,16 +2,9 @@
 
 **Forward deployed engineering skills for AI coding agents.**
 
-Skills encode the workflows, quality gates, and judgment Forward Deployed Engineers use on someone else's site. Packaged so an AI coding agent can run the embed end-to-end: discovery, POC, slice, on-site proof, eval, signed outcome. The workspace still compiles and commits. `@fde` does not leave.
+Skills encode the workflows, quality gates, and judgment Forward Deployed Engineers use on someone else's site. Packaged so an AI coding agent can run the embed end-to-end: discovery, POC, their codebase (greenfield or brownfield), go-live, eval, signed outcome. The workspace still compiles and commits. `@fde` does not leave.
 
-```text
-  LAND              DISCOVER           PLAN              SHIP               PROVE              CLOSE
- ┌────────┐      ┌────────┐      ┌────────┐      ┌────────┐      ┌────────┐      ┌────────┐
- │  Brief │ ───▶ │ Reality│ ───▶ │ Sequence│───▶ │  Live  │ ───▶ │ Signed │ ───▶ │  They  │
- │  Trust │      │ Terrain│      │  Align │      │  slice │      │   off  │      │   run  │
- └────────┘      └────────┘      └────────┘      └────────┘      └────────┘      └────────┘
-  /brief           /discover          /plan             /ship            /outcome           /close
-```
+<img width="1774" height="887" alt="FDEops-githubposter" src="https://github.com/user-attachments/assets/9eb842d2-a356-4995-9057-841f1b2d15d6" />
 
 ---
 
@@ -21,24 +14,24 @@ Each command loads the same `@fde` skill. You never pick from 31 names.
 
 | What you're doing | Command | Key principle |
 |-------------------|---------|-----------|
-| Land the embed | `/brief` | Who signs done |
-| Find the real problem | `/discover` | Brief is a hypothesis |
-| Plan the sequence | `/plan` | Backwards from done |
-| Ship a slice | `/ship` | Live with a rollback |
-| Prove the outcome | `/outcome` | Promised, measured, accepted |
-| Close the embed | `/close` | They run it without you |
+| First week on site | `/brief` | Name who signs done |
+| Find the real problem | `/discover` | Treat the brief as a hypothesis |
+| Sequence the work | `/plan` | Work backwards from done |
+| Ship to their production | `/ship` | One change they can see, then go live with a rollback you have run |
+| Get the number accepted | `/outcome` | Promised, measured, accepted |
+| Hand off so they run it | `/close` | They operate it without you |
 
 Also:
 
 | What you're doing | Command | Key principle |
 |-------------------|---------|-----------|
-| Sponsor went silent | `/trust` | Process or trust |
-| Scope dispute | `/receipts` | Dated, or a gap |
+| Sponsor went quiet | `/trust` | Process gap, or they stopped trusting you |
+| When did we agree? | `/receipts` | A dated line, or it did not happen |
 | After a meeting | `/debrief` | Notes into the record |
-| Walk-in | `/prep` | One page from the record |
-| Friday readout | `/readout` | Promised, measured, accepted |
+| Prep before the meeting | `/prep` | One page from the record |
+| Friday sponsor update | `/readout` | Promised, measured, accepted |
 
-Skills also activate on English: naming a client, running a POC, slicing a feature, asking what was agreed. A throwaway one-liner in an unbound repo can skip `@fde`. A client slice cannot.
+Skills also activate on English: naming a client, running a POC, changing their checkout, going live, asking what was agreed. A throwaway one-liner in an unbound repo can skip `@fde`. Bound client work cannot.
 
 ---
 
@@ -100,9 +93,9 @@ Requires Node.js >= 18. Override: `FDEOPS_ENGAGEMENT`. See [docs/install.md](doc
 
 ---
 
-## All 31 Skills
+## All 30 Skills
 
-The commands above are the entry points. Under the hood, `@fde` activates these 31 skills, each a structured workflow with steps, an artifact, and a checkpoint. You never pick one by name. Full detail: [docs/skills-reference.md](docs/skills-reference.md).
+The commands above are the entry points. Under the hood, `@fde` activates these 30 skills, each a structured workflow with steps, an artifact, and a checkpoint. You never pick one by name. Full detail: [docs/skills-reference.md](docs/skills-reference.md).
 
 ### Land - Brief and trust
 
@@ -118,7 +111,7 @@ The commands above are the entry points. Under the hood, `@fde` activates these
 
 | Skill | What It Does | Use When |
 |--------|--------------|----------|
-| [discover](skills/fde/references/discover.md) | Repo + workaround + the real problem | Brief feels wrong, shadow processes |
+| [discover](skills/fde/references/discover.md) | Question first, then repo + workaround | Brief feels wrong, shadow processes |
 | [test-assumptions](skills/fde/references/test-assumptions.md) | Untested assumptions by blast radius | Brief feels too neat |
 | [score-use-cases](skills/fde/references/score-use-cases.md) | Value × urgency × alignment / complexity | Everything is P0 |
 | [poc](skills/fde/references/poc.md) | Kill the killer assumption in a day | POC, spike, need to de-risk |
@@ -127,23 +120,22 @@ The commands above are the entry points. Under the hood, `@fde` activates these
 
 | Skill | What It Does | Use When |
 |--------|--------------|----------|
-| [plan](skills/fde/references/plan.md) | Backwards from done, PR-sized | What order, what is done |
+| [plan](skills/fde/references/plan.md) | Backwards from done, Kill if on each PR | What order, what is done |
 | [business-case](skills/fde/references/business-case.md) | Cost of nothing → investment → return | Defend budget or timeline |
 | [three-options](skills/fde/references/three-options.md) | Three genuine options | "What should we do?" |
 | [pick-three](skills/fde/references/pick-three.md) | Pick three from twenty urgents | Everything is urgent |
 
-### Ship - Go live
+### Ship - On their repo, then live
 
 | Skill | What It Does | Use When |
 |--------|--------------|----------|
-| [thin-slices](skills/fde/references/thin-slices.md) | Vertical slices, on-site proof | Building on their codebase |
+| [ship](skills/fde/references/ship.md) | One change they can see (greenfield or brownfield), proven on their staging, then go live | Building, updating, or going live |
 | [what-breaks](skills/fde/references/what-breaks.md) | Impact from contained → irreversible | Touching shared infrastructure |
 | [rescue](skills/fde/references/rescue.md) | Production fire or trust fire | Down, or they went quiet |
-| [ship](skills/fde/references/ship.md) | Intent vs diff, pre-flight, rollback | Going live |
 | [review](skills/fde/references/review.md) | Did we only build what we agreed | Before merge, scope creep |
 | [rollback](skills/fde/references/rollback.md) | Test the escape route before 2am | "We can always revert" |
 
-### Prove - Outcome
+### Outcome - Get the number accepted
 
 | Skill | What It Does | Use When |
 |--------|--------------|----------|
@@ -192,7 +184,7 @@ One skill. One reference file per situation. One folder per client.
 ```
 
 - **Process, not prose.** Each reference is a workflow with an artifact and a checkpoint, not a tip sheet.
-- **Ground loop.** Name → characterise → prove where they live → log. The workspace compiles; `@fde` stays.
+- **Ground loop.** Name → characterise → prove where they live → go live → log. The workspace compiles; `@fde` stays.
 - **You confirm.** Nothing is written until you say so.
 - **Progressive disclosure.** `SKILL.md` is the entry point. One `references/*.md` loads when routed.
 - **Local CLI.** Writes and status cost zero model tokens. The AI coding agent runs it.
@@ -207,7 +199,7 @@ Change hosts, install `@fde` on the new one, bind if needed, keep talking. The r
 fdeops/
 ├── skills/fde/                            # the one skill hosts load
 │   ├── SKILL.md                           #   router
-│   └── references/                        #   31 skills + overlays (you never pick)
+│   └── references/                        #   30 skills + overlays (you never pick)
 │       ├── land.md                        #   Land
 │       ├── audit.md
 │       ├── who-decides.md
@@ -221,13 +213,12 @@ fdeops/
 │       ├── business-case.md
 │       ├── three-options.md
 │       ├── pick-three.md
-│       ├── thin-slices.md                 #   Ship
+│       ├── ship.md                        #   Ship
 │       ├── what-breaks.md
 │       ├── rescue.md
-│       ├── ship.md
 │       ├── review.md
 │       ├── rollback.md
-│       ├── readout.md                      #   Prove
+│       ├── readout.md                      #   Outcome
 │       ├── demo-prep.md
 │       ├── debrief.md
 │       ├── board-memo.md
@@ -274,7 +265,7 @@ fdeops/
 
 AI coding agents are built for a repo, not for a client. They forget the sponsor, the promise, who can say yes, and whether anyone accepted the number. Monday morning they start from the ticket again.
 
-FDEOps is what you take on site. One `@fde` skill runs the embed from discovery to signed outcome: POC, slice, on-site proof, eval when a model judges, promised → measured → accepted. A local CLI dates every decision. `.fde/` is markdown on your laptop. You confirm; then it is on the record.
+FDEOps is what you take on site. One `@fde` skill runs the embed from discovery to signed outcome: POC, their codebase, go-live, eval when a model judges, promised → measured → accepted. A local CLI dates every decision. `.fde/` is markdown on your laptop. You confirm; then it is on the record.
 
 ---
 
@@ -314,7 +305,7 @@ Local only - `git` + files, no network, no telemetry. Plain markdown. The model
 ## Principles
 
 - **The artifact is the memory** - producing the work and recording it are one action
-- **Ground loop** - name the slice, characterise their code, prove it where they live, log the outcome
+- **Ground loop** - name the change, characterise their code, prove it on their staging, go live, log the outcome
 - **Skills, not autonomy** - the kit says what to check; judgment stays yours
 - **Brief is a hypothesis** - discover before building the wrong thing
 - **Evidence on every claim** - these files get defended in the room

package/adapters/AGENTS.md

@@ -6,7 +6,7 @@ You are the AI coding agent for a **Forward Deployed Engineer (FDE)** - the huma
 
 When the FDE types **`@fde`**, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load the skill. If `fde resume` says NO ENGAGEMENT: ask the client name once, then **you** run `fde resume --init <slug>`. Never tell them to type it.
 
-Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, slices, characterisation, on-site proof, eval, and go-live.
+Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, small PRs, characterisation, proof on their staging, eval, and go-live.
 
 - Skill (single source of truth): `~/.claude/skills/fde/SKILL.md`
 - **Never ask the FDE to pick a skill.** Read the situation, route silently, do the work.

package/adapters/GEMINI.md

@@ -6,7 +6,7 @@ Context for Gemini CLI when assisting a **Forward Deployed Engineer (FDE)** - th
 
 When the FDE types **`@fde`**, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load the skill. If `fde resume` says NO ENGAGEMENT: ask the client name once, then **you** run `fde resume --init <slug>`. Never tell them to type it.
 
-Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, slices, characterisation, on-site proof, eval, and go-live.
+Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, small PRs, characterisation, proof on their staging, eval, and go-live.
 
 - Skill (single source of truth): `~/.claude/skills/fde/SKILL.md`
 - **Never ask the FDE to pick a skill.** Read the situation, route silently, do the work.

package/adapters/LOCAL-LLM.md

@@ -62,7 +62,7 @@ The model reads SKILL.md, routes to the right skill, and produces artifacts in y
 
 ## Model size recommendations
 
-The methodology is detailed (31 skills, routing logic, evidence format, memory contract). Larger models handle it better:
+The methodology is detailed (30 skills, routing logic, evidence format, memory contract). Larger models handle it better:
 
 | Model class | Experience |
 |-------------|-----------|

package/adapters/README.md

@@ -31,4 +31,4 @@ Defaults to the current directory if no path is given. Existing files are never
 
 ## The principle
 
-The adapter only tells the tool **where the brain is and how to behave**. All 31 skills, the overlays, and the memory contract live once in `skills/fde/SKILL.md`. Update the brain, every platform gets it. That's why fdeops feels native in whatever the FDE already uses, without five things to keep in sync.
+The adapter only tells the tool **where the brain is and how to behave**. All 30 skills, the overlays, and the memory contract live once in `skills/fde/SKILL.md`. Update the brain, every platform gets it. That's why fdeops feels native in whatever the FDE already uses, without five things to keep in sync.

package/adapters/copilot-instructions.md

@@ -6,7 +6,7 @@ You are the AI coding agent for a **Forward Deployed Engineer (FDE)** - the huma
 
 When the FDE types **`@fde`**, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load the skill. If `fde resume` says NO ENGAGEMENT: ask the client name once, then **you** run `fde resume --init <slug>`. Never tell them to type it.
 
-Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, slices, characterisation, on-site proof, eval, and go-live.
+Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, small PRs, characterisation, proof on their staging, eval, and go-live.
 
 - Skill (single source of truth): `~/.claude/skills/fde/SKILL.md`
 - **Never ask the FDE to pick a skill.** Read the situation, route silently, do the work.

package/adapters/cursor.fde.mdc

@@ -11,7 +11,7 @@ You are the AI coding agent for a **Forward Deployed Engineer (FDE)** - the huma
 
 When the FDE types **`@fde`**, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load `@fde`. If `fde resume` says NO ENGAGEMENT: ask the client name once, then **you** run `fde resume --init <slug>`. Never tell them to type it.
 
-Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, slices, characterisation, on-site proof, eval, and go-live.
+Do **not** load `@fde` for a one-line typo in an unbound repo. On a bound client, stay on `@fde` for POC, small PRs, characterisation, proof on their staging, eval, and go-live.
 
 - Skill (single source of truth): `~/.claude/skills/fde/SKILL.md` (or the copy this install placed)
 - **Never ask the FDE to pick a skill.** Read the situation, route silently, do the work.

package/bin/check.js

@@ -203,6 +203,14 @@ ok(`router dispatch (${mentioned.length} reference targets verified) + memory co
   const extra = fs.readdirSync(refDir).filter(f => f.endsWith('.md') && !mentioned.includes(f))
   if (extra.length) fail(`unrouted reference file(s) - dead method: ${extra.join(', ')}`)
   else ok('no unrouted reference files')
+
+  // The on-site change loop lives in ship.md. A sibling method is a split.
+  for (const dead of ['small-prs.md', 'thin-slices.md', 'implement.md']) {
+    if (fs.existsSync(path.join(refDir, dead))) {
+      fail(`${dead} must not exist - that craft lives in ship.md`)
+    }
+  }
+  ok('ship is one method (no implement / small-prs / thin-slices sibling)')
 }
 
 const install = read('bin/install.js')
@@ -221,8 +229,10 @@ if (read('package.json').includes('postinstall')) {
 }
 
 const readme = read('README.md')
-if (/session\.gif|demo\.gif|<img /i.test(readme)) {
-  fail('README must not embed images - front door is text; the recording lives in docs/USAGE.md')
+if (/session\.gif|demo\.gif/i.test(readme)) {
+  fail('README must not embed session.gif or demo.gif - the recording lives in docs/USAGE.md')
+} else if (/<img /i.test(readme) && !/user-attachments\/assets/.test(readme)) {
+  fail('README <img> must be the GitHub poster (user-attachments), not a local gif')
 } else ok('README is text (no gif)')
 
 const usage = read('docs/USAGE.md')
@@ -268,9 +278,11 @@ for (const cmd of ['/brief', '/discover', '/plan', '/ship', '/outcome', '/close'
 if (/(^|[^\w/])\/got\b/.test(readme)) fail('README must use /outcome, not /got')
 ok('README slash commands documented')
 
-// Front-door map is the embed left-to-right (LAND → CLOSE), not a pile of situations.
-if (!readme.slice(0, 4000).includes('LAND') || !readme.slice(0, 4000).includes('/discover')) {
-  fail('README must include the LAND→CLOSE command-map diagram near the top')
+// Front-door map is the embed left-to-right (Land → Close). After the GitHub
+// poster (#68) the table is the map: /brief /discover /plan /ship /outcome /close.
+const front = readme.slice(0, 4000)
+if (!['/brief', '/discover', '/plan', '/ship', '/outcome', '/close'].every(c => front.includes(c))) {
+  fail('README must include the Land→Close command map near the top')
 } else ok('README command-map diagram')
 
 if (readme.includes('your-client-repo')) {

package/bin/fde.js

@@ -408,6 +408,8 @@ const SECRET_PATTERNS = [
   { name: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
   { name: 'PEM private key', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
   { name: 'Bearer token', re: /\bBearer\s+[A-Za-z0-9._\-]{20,}\b/ },
+  { name: 'database URL', re: /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:]+:[^/\s@]+@/i },
+  { name: 'api key assignment', re: /\b(?:api[_-]?key|secret|password)\s*=\s*\S{8,}/i },
 ]
 
 function findSecretHit(text) {
@@ -769,6 +771,89 @@ function firstLine(md, maxLen) {
   return ''
 }
 
+// reality.md is the one panel whose job is "not the brief". If the file does
+// not carry Working theory / Evidence / Differs from brief, do not scrape a
+// first line that might be the inherited brief and label it truth.
+function parseReality(md, maxLen) {
+  const theory = (md.match(/\*\*Working theory:\*\*\s*(.*)/i) || [])[1]
+  const hasSchema = /\*\*(Working theory|Evidence|Differs from brief how):\*\*/i.test(md)
+  const theoryText = (theory || '').trim()
+  if (theoryText) {
+    const line = theoryText.length > maxLen ? theoryText.slice(0, maxLen - 1).trim() + '…' : theoryText
+    return { line, missing: '' }
+  }
+  if (hasSchema) return { line: '', missing: '' }
+  const prose = firstLine(md, maxLen)
+  if (prose) {
+    return {
+      line: '',
+      missing: 'UNREADABLE - reality.md does not match the schema (Working theory / Evidence / Differs from brief). Not showing the brief as truth.',
+    }
+  }
+  return { line: '', missing: '' }
+}
+
+function appendValueLedgerRow(eng, cells) {
+  ensureMemoryGit(eng)
+  const p = path.join(eng, 'delivery.md')
+  let md = readEng(eng, 'delivery.md')
+  if (!md) md = '# Delivery log\n\n## Value ledger\n\n'
+  const date = new Date().toISOString().slice(0, 10)
+  const cols = []
+  for (let i = 0; i < 7; i++) cols.push((cells[i] || '').replace(/\|/g, '\\|').trim() || ' ')
+  const row = `| ${date} | ${cols.join(' | ')} |`
+  const lines = md.split('\n')
+  let inLedger = false
+  let lastTableLine = -1
+  for (let i = 0; i < lines.length; i++) {
+    if (/^##\s+Value ledger\b/i.test(lines[i])) { inLedger = true; continue }
+    if (inLedger && /^##\s+/.test(lines[i])) break
+    if (inLedger && /^\|/.test(lines[i].trim())) lastTableLine = i
+  }
+  if (lastTableLine === -1) md = appendUnderSection(md, 'Value ledger', row)
+  else {
+    lines.splice(lastTableLine + 1, 0, row)
+    md = lines.join('\n')
+  }
+  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+  recordLastWrite(eng, 'delivery.md', row)
+  commitMemory(eng, 'log delivery', { files: ['delivery.md'] })
+}
+
+function retireOpenRisks(eng, needle) {
+  const n = String(needle || '').toLowerCase()
+  if (!n) return 0
+  const p = path.join(eng, 'risks.md')
+  const md = readEng(eng, 'risks.md')
+  if (!md) return 0
+  const retired = []
+  const kept = []
+  let inRetired = false
+  for (const raw of md.split('\n')) {
+    const t = raw.trim()
+    if (/^#{1,6}\s+Retired\b/i.test(t)) { inRetired = true; kept.push(raw); continue }
+    if (!inRetired) {
+      const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
+      if (m && m[1].toLowerCase().includes(n)) {
+        retired.push(raw)
+        continue
+      }
+    }
+    kept.push(raw)
+  }
+  if (!retired.length) return 0
+  let out = kept.join('\n')
+  if (!/^#{1,6}\s+Retired\b/im.test(out)) out = out.replace(/\n*$/, '\n\n## Retired\n')
+  const stamp = new Date().toISOString().slice(0, 10)
+  const block = retired.map(l => {
+    const body = l.trim().replace(/^-\s*/, '')
+    return `- [${stamp}] (retired) ${body}`
+  }).join('\n')
+  out = appendUnderSection(out, 'Retired', block)
+  withFileLock(p, () => { atomicWriteFile(p, out.endsWith('\n') ? out : out + '\n') })
+  return retired.length
+}
+
 // Engagement age from the .fde/ directory's own birth time - hidden (not
 // fabricated as 0) on filesystems that do not report birthtime.
 function daysElapsed(eng) {
@@ -817,6 +902,7 @@ function parseMdTable(md) {
 function colIndex(headers, rx) { return headers.findIndex(h => rx.test(h)) }
 
 const {
+  personFromSignalText,
   signalSubjectKey,
   nextActionLine,
   computeSignals,
@@ -856,6 +942,8 @@ function parseSignalHistoryEntries(eng) {
 }
 
 function displayNameFromSignalText(text) {
+  const person = personFromSignalText(text)
+  if (person) return person
   const t = String(text).trim()
   const proper = t.match(/^([A-Z][a-z]+(?:\s+[A-Z][a-z]+)?)/)
   if (proper) return proper[1]
@@ -885,11 +973,11 @@ function extractStakeholders(eng) {
         const stance = stanceIdx !== -1 ? (cs[stanceIdx] || '').trim() : ''
         const note = notesIdx !== -1 ? (cs[notesIdx] || '').trim() : ''
         const words = name.replace(/\([^)]*\)/g, '').split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
-        const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '')
+        const nameKey = signalSubjectKey(name)
         let signal = null, matchedDate = null
-        if (frag.length >= 3) {
+        if (nameKey) {
           for (const h of history) {
-            if (h.text.trim().toLowerCase().startsWith(frag.toLowerCase()) && (!matchedDate || h.date >= matchedDate)) {
+            if (signalSubjectKey(h.text) === nameKey && (!matchedDate || h.date >= matchedDate)) {
               signal = h.signal; matchedDate = h.date
             }
           }
@@ -1317,6 +1405,9 @@ function cmdLog(args) {
     if (!['red', 'amber', 'green'].includes(signal)) { console.error('usage: fde log contact <text> --signal red|amber|green'); process.exit(1) }
     args.splice(sigIdx, 2)
   }
+  let retire = false
+  const retireIdx = args.indexOf('--retire')
+  if (retireIdx !== -1) { retire = true; args.splice(retireIdx, 1) }
   const type = args[0]; const text = args.slice(1).join(' ')
   const eng = resolveEngagement({ forWrite: true })
   if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
@@ -1333,11 +1424,26 @@ function cmdLog(args) {
     return
   }
 
-  if (!LOG_FILES[type] || !text) { console.error(`usage: fde log <decision|risk|delivery|contact> <text> [--signal red|amber|green] [--force]\n       fde log phase <${PHASES.join('|')}>\n       fde log --undo`); process.exit(1) }
+  if (!LOG_FILES[type] || !text) { console.error(`usage: fde log <decision|risk|delivery|contact> <text> [--signal red|amber|green] [--force]\n       fde log risk --retire <text>\n       fde log phase <${PHASES.join('|')}>\n       fde log --undo`); process.exit(1) }
   if (signal && type !== 'contact') { console.error('--signal only applies to: fde log contact'); process.exit(1) }
+  if (retire && type !== 'risk') { console.error('--retire only applies to: fde log risk'); process.exit(1) }
   const hit = findSecretHit(text)
   if (hit && !force) { refuseSecret('log text', hit); process.exit(1) }
   if (hit && force) console.error(`warning: logging possible ${hit} (--force)`)
+  if (retire) {
+    const n = retireOpenRisks(eng, text)
+    if (!n) { console.error(`no open risk matched ${JSON.stringify(text)}`); process.exit(1) }
+    const hash = commitMemory(eng, 'retire risk', { files: ['risks.md'] })
+    console.log(`retired ${n} risk(s) → risks.md${hash ? ` @${hash}` : ''}`)
+    return
+  }
+  if (type === 'delivery' && text.includes('|')) {
+    const cells = text.split('|').map(s => s.trim())
+    appendValueLedgerRow(eng, cells)
+    const hash = memoryHead(eng)
+    console.log(`logged → delivery.md (value ledger)${hash ? ` @${hash}` : ''}`)
+    return
+  }
   const date = new Date().toISOString().slice(0, 10)
   const entry = datedEntry(eng, date, text, signal || '')
   appendLogEntry(eng, type, entry)
@@ -1651,9 +1757,11 @@ function cmdDebrief(args) {
     input = readDebriefInput(args)
   }
 
-  if (smart) {
+    if (smart) {
     const { proposePath, clean, blocks } = writeProposal(eng, smartProposeText(input))
     console.log('SMART PROPOSE (heuristic - review before apply; no new facts invented beyond line rewrites)\n')
+    console.log('Prefix vocabulary (lines that route): decision:  risk:  delivery:  contact:  next:')
+    console.log('Everything else → context.md. Keep the prefixes; the preview gate stays.\n')
     routeDebriefInput(eng, clean, { dry: true, force, sealed: blocks })
     if (!apply) {
       console.log(`\nproposal saved → ${proposePath}`)
@@ -2182,6 +2290,8 @@ function collectDoctorIssues(eng) {
       `${aliases.length} stakeholder identity cluster(s) (e.g. "${sample}") - same person under different names? consolidate in stakeholders.md`
     )
   }
+  const reality = parseReality(readClean(eng, 'reality.md'), 220)
+  if (reality.missing) issues.push(reality.missing)
   return issues
 }
 
@@ -2484,7 +2594,7 @@ function cmdRedact(args) {
     console.log('nothing changed')
     return
   }
-  const hash = commitMemory(eng, `redact ${term.slice(0, 40)}`, { files: touched })
+  const hash = commitMemory(eng, `redact ${hits.length} line(s)`, { files: touched })
   console.log(`redacted ${hits.length} line(s) in ${touched.join(', ')}${hash ? ` @${hash}` : ''}`)
   console.log('rotate the real credential if this was a secret - history may still contain it')
 }
@@ -2585,6 +2695,15 @@ function cmdGarden(args) {
       sessionBlocks,
     })
   }
+  const dirty = memoryDirtyManual(eng)
+  if (dirty.length) {
+    proposals.push({
+      id: 'bless-manual',
+      kind: 'apply',
+      text: `Bless ${dirty.length} hand-written file(s) into the ledger: ${dirty.slice(0, 5).join(', ')}${dirty.length > 5 ? '…' : ''}`,
+      files: dirty,
+    })
+  }
   if (!proposals.length) {
     console.log('\nNothing to tidy.')
     return
@@ -2613,6 +2732,12 @@ function cmdGarden(args) {
       }
       continue
     }
+    if (p.id === 'bless-manual') {
+      applied++
+      for (const f of p.files) touched.add(f)
+      console.log(`applied: bless ${p.files.join(', ')}`)
+      continue
+    }
     if (p.id !== 'archive-sessions') continue
     const cutDates = new Set(p.sessionBlocks.map(b => b.date))
     const keep = []
@@ -2744,6 +2869,10 @@ function cmdStatus(args) {
     }
   }
   if (!all) console.log('\n(current engagement only - pass --all for the full portfolio)')
+  if (!all) {
+    const current = resolveEngagement()
+    if (current) for (const line of hygieneTriageLines(current)) console.log(line)
+  }
   console.log('\ntrust: worst active [signal:x] across stakeholders (latest per person) - a green from B cannot clear an amber/red on A; keyword heuristic only when none exists.')
 }
 
@@ -2801,7 +2930,9 @@ function cmdDashboard(args) {
     // line instead of sharing one, a shorter cap just meant more sentences
     // cut off mid-thought for no reason.
     e.brief = firstLine(readClean(e.dir, 'brief.md'), 220)
-    e.reality = firstLine(readClean(e.dir, 'reality.md'), 220)
+    const reality = parseReality(readClean(e.dir, 'reality.md'), 220)
+    e.reality = reality.line
+    e.realityMissing = reality.missing
     e.overlay = detectOverlay(e.dir)
     e.days = daysElapsed(e.dir)
     e.phaseLabel = phaseLabel(e.signals.phase)
@@ -2839,6 +2970,10 @@ function cmdDashboard(args) {
   }
   console.log(`fieldbook → ${outPath}`)
   console.log(`${engagements.length} engagement(s) rendered · ${counts.RED} red / ${counts.amber} amber / ${counts.green} green · 0 tokens (pure render)`)
+  if (!all) {
+    const current = resolveEngagement()
+    if (current) for (const line of hygieneTriageLines(current)) console.log(line)
+  }
   if (args.includes('--open')) {
     // arg-array form: the path is never interpolated into a shell string.
     const [bin, pre] = process.platform === 'darwin' ? ['open', []]
@@ -2985,7 +3120,8 @@ function cmdVault(args) {
     const ctx = readClean(e.dir, 'context.md')
     e.next = (sectionBody(ctx, 'Next action', { lastNonEmpty: true }).split('\n').find(l => l.trim()) || '').trim()
     e.brief = firstLine(readClean(e.dir, 'brief.md'), 400)
-    e.reality = firstLine(readClean(e.dir, 'reality.md'), 400)
+    const reality = parseReality(readClean(e.dir, 'reality.md'), 400)
+    e.reality = reality.line || reality.missing
     e.overlay = detectOverlay(e.dir)
     e.days = daysElapsed(e.dir)
     e.stakeholders = extractStakeholders(e.dir)
@@ -3186,19 +3322,20 @@ function printUsage() {
   fde resume --init <name> create + bind engagement for this workspace (rebind replaces)
   fde resume --bind        show what this workspace is bound to, and what resolves
   fde triage               TRIAGE block only (hooks / Cursor session entry)
-  fde log <type> <text>    append decision|risk|delivery|contact (contact takes --signal red|amber|green; --force to allow secret-like text)
+  fde log <type> <text>    append decision|risk|delivery|contact (contact takes --signal red|amber|green; delivery "a|b|c" writes the value ledger; --force to allow secret-like text)
+  fde log risk --retire    move matching open-risk bullets to ## Retired
   fde log phase <phase>    set engagement phase (land|discover|plan|ship|prove|close)
   fde log --undo           remove the last CLI log/debrief entry from memory
   fde debrief [file]       meeting notes → memory (prefixed lines; --dry-run; --force)
-  fde debrief --smart      heuristic propose (prefix + light keywords); agent routes, CLI gates → --apply
+  fde debrief --smart      heuristic propose (prints decision:/risk:/delivery:/contact:/next:); --apply after confirm
   fde ingest stage …       stage raw pull into <engagement>/.inbox/ (not .fde/)
   fde ingest list          list staged inbox items
   fde ingest propose <id>  smart-propose a staged item → .debrief-propose (confirm before apply)
   fde ingest apply         same as: fde debrief --apply
   fde prep [label]         grounded walk-in brief from existing .fde/ only
-  fde doctor               lint engagement memory (stale signals, gaps)
-  fde redact <term>        preview/remove lines containing a buried term (pass --apply to commit)
-  fde tidy [--apply]       propose safe consolidations (contract: no new facts; git-reversible)
+  fde doctor               lint engagement memory (stale signals, gaps). status/dashboard/resume print the same issues
+  fde redact <term>        preview/remove lines containing a buried term (pass --apply to commit; subject never repeats the term)
+  fde tidy [--apply]       propose consolidations; blesses hand-written dirty files when you apply
   fde owner [set email]    who keeps this engagement record
   fde receipts <term>      "what did we agree?" with dates
   fde status [--all]       value ledger, then trust (pass --all for full portfolio)

package/bin/lib/render.js

@@ -467,10 +467,10 @@ ${e.lastSession ? `<div class="fb-now-session">${inlineMd(e.lastSession)}</div>`
   // needed vs what's actually true. Squeezed onto one truncated line, that
   // contrast disappears. Each gets its own line, its own room to finish a
   // thought, not a race to fit before an ellipsis.
-  const whyBlock = (e.brief || e.reality) ? `<div class="fb-block">
+  const whyBlock = (e.brief || e.reality || e.realityMissing) ? `<div class="fb-block">
 <div class="fb-sec">Why</div>
 ${e.brief ? `<p class="fb-why"><span class="t-faint">What they asked for:</span> ${inlineMd(e.brief)}</p>` : ''}
-${e.reality ? `<p class="fb-why fb-why-reality"><span class="fb-accent-label">What's actually true:</span> ${inlineMd(e.reality)}</p>` : ''}
+${e.realityMissing ? `<p class="fb-why fb-why-missing"><span class="fb-accent-label">What's actually true:</span> ${escapeHtml(e.realityMissing)}</p>` : e.reality ? `<p class="fb-why fb-why-reality"><span class="fb-accent-label">What's actually true:</span> ${inlineMd(e.reality)}</p>` : ''}
 </div>` : ''
 
   // Vitals: a fixed field-facing gut-check panel, not a Movement block that

package/bin/lib/trust.js

@@ -48,12 +48,46 @@ function createTrustApi(deps) {
     return { ok: true, warn: '' }
   }
 
-  // Subject key for a signal-history line - first real name word (same spirit as
-  // extractStakeholders). A green about Randy must not clear an amber about Denise.
+  // Event labels are not people. "INCIDENT: … Marcus escalated" must key on
+  // Marcus, or a recovered engagement stays RED in front of the sponsor.
+  const SIGNAL_EVENT_KEYS = new Set([
+    'incident', 'recovery', 'alert', 'update', 'note', 'status', 'escalation',
+    'blocker', 'outage', 'fire', 'issue', 'sev', 'sev1', 'sev2', 'p1', 'p2', 'p3',
+    'resolved', 'risk', 'decision', 'delivery', 'contact',
+  ])
+
+  function personFromSignalText(text) {
+    let cleaned = String(text || '')
+      .replace(/\[@[^\]]+\]/g, '')
+      .replace(/\([^)]*\)/g, '')
+      .replace(/\[signal:[^\]]+\]/gi, '')
+      .replace(/\[\d{4}-\d{2}-\d{2}\]/g, '')
+      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):?\s+/, '')
+      .trim()
+    const names = cleaned.match(/\b[A-Z][a-z]{1,20}(?:\s+[A-Z][a-z]{1,20})?\b/g) || []
+    for (const name of names) {
+      const first = name.split(/\s+/)[0].toLowerCase()
+      if (SIGNAL_EVENT_KEYS.has(first)) continue
+      return name
+    }
+    return ''
+  }
+
+  // Subject key for a signal-history line. Prefer a proper name in the bullet.
+  // A green about Randy must not clear an amber about Denise.
   // Strip author tags [@email-local] so attribution never becomes the subject key.
   function signalSubjectKey(text) {
+    const person = personFromSignalText(text)
+    if (person) {
+      const frag = person.split(/\s+/)[0].replace(/[^a-z0-9]/gi, '').toLowerCase()
+      if (frag.length >= 3) return frag
+    }
     const cleaned = String(text).replace(/\[@[^\]]+\]/g, '').replace(/\([^)]*\)/g, '')
-    const words = cleaned.split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):?\s+/, '')
+    const words = cleaned.split(/\s+/).filter(w => {
+      const n = w.replace(/[^a-z0-9]/gi, '').toLowerCase()
+      return n.length >= 3 && !SIGNAL_EVENT_KEYS.has(n) && !/^(dr|mr|mrs|ms)$/i.test(w)
+    })
     const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
     return frag.length >= 3 ? frag : ('anon:' + cleaned.slice(0, 48).toLowerCase())
   }
@@ -196,6 +230,7 @@ function createTrustApi(deps) {
 
   return {
     stakeholdersMemoryHealth,
+    personFromSignalText,
     signalSubjectKey,
     parsePhase,
     countOpenRisks,

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Forward deployed engineering skills for AI coding agents. Your agent forgets the client every morning - the sponsor, the promise, who signed off. FDEOps keeps that as dated markdown on your laptop: one @fde skill, a deterministic local CLI, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Forward deployed engineering skills for AI coding agents: per-client memory in local .fde/ files, one @fde skill. Local-only, no network.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fde
-description: Keeps the engagement record for client work. Use when they name a client or stakeholder. Use when they debrief a meeting or paste notes. Use when they ask what was agreed. Use when they run a POC, slice a feature on the client's codebase, prove it on their staging, or need evals before a model acts. Use when they prep a readout, when trust shifts, or they say @fde. Route and run the local fde CLI (or npx --yes fdeops). Never ask them to type commands. Not for ordinary code edits in an unbound repo.
+description: Keeps the engagement record for client work. Use when they name a client or stakeholder. Use when they debrief a meeting or paste notes. Use when they ask what was agreed. Use when they run a POC, change the client's codebase, prove it on their staging, go live, or need evals before a model acts. Use when they prep a readout, when trust shifts, or they say @fde. Route and run the local fde CLI (or npx --yes fdeops). Never ask them to type commands. Not for ordinary code edits in an unbound repo.
 ---
 
 # @fde
@@ -17,7 +17,7 @@ The **engagement record** for one client, from first meeting to signed outcome.
 
 ## When NOT to use
 
-A one-line typo or compile error in a file that will not ship. On a bound client: stay here for POC, slice, characterisation, eval, go-live, rollback, and acceptance.
+A one-line typo or compile error in a file that will not ship. On a bound client: stay here for POC, characterisation, the change on their repo, eval, go-live, rollback, and acceptance.
 
 ## Use these first
 
@@ -32,15 +32,15 @@ After a meeting: `fde debrief --smart` → confirm → `--apply`. Walk-in: `fde
 
 ## Ground loop
 
-On someone else's site the work is not "write code, remember later." Every slice stays on `@fde`:
+On someone else's site the work is not "write code, remember later." Every change on a bound client stays on `@fde`:
 
 1. **Name it** in `decisions.md` (plan) or kill it in a day (poc).
-2. **Characterise their code** before you change it (thin-slices). Their tests, their runner.
-3. **Prove it where they live.** Staging they operate, a screen the signer in `success.md` can reject.
-4. **If a model judges:** `evals.md` Verdict SHIP before the slice is done (eval-pack).
-5. **Log delivery.** Outcome is promised → measured → accepted, not a green CI.
+2. **Characterise their code** before you change it. Brownfield: their tests, their runner. Greenfield: the empty tree, first path they can click.
+3. **Prove it on their staging.** Staging they operate, a screen the signer in `success.md` can reject.
+4. **If a model judges:** `evals.md` Verdict SHIP before that change is done (eval-pack).
+5. **Log delivery.** Outcome is promised → measured → accepted, not a green CI. Then go live with a rollback you have run (`ship`).
 
-A throwaway file can skip the loop. A client slice cannot.
+A throwaway file can skip the loop. Bound client work cannot.
 
 ## Human surface vs agent plumbing
 
@@ -147,10 +147,9 @@ Read **one** reference and follow it. Do not improvise from memory.
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
-| Large feature, need visible progress every 2-3 days, slice it, characterise their tests, POC follow-through | thin-slices | `references/thin-slices.md` |
 | What could go wrong, touching shared infrastructure, need to assess impact | what-breaks | `references/what-breaks.md` |
 | Production down, urgent - OR stakeholder gone quiet, trust slipping | rescue | `references/rescue.md` |
-| Ready to deploy, going live, pre-flight check | ship | `references/ship.md` |
+| Start building, update their checkout, first module, visible progress, their tests, POC follow-through, ready to deploy, going live, pre-flight | ship | `references/ship.md` |
 | Review this change, is it safe, does it match what we agreed | review | `references/review.md` |
 | Diff grew / scope creep in the PR / "did we only build what we said" / KEEP JUSTIFY SPLIT DROP | review (+ ship if going live) | `references/review.md` Stage 1 · `references/ship.md` Intent vs diff |
 | Wrap the session / share the thinking / catch teammates up / before I open the PR | (memory contract - session digest) | SKILL.md **On exit** - write TL;DR + decisions/why into `.fde/`; no transcript sync |
@@ -196,7 +195,7 @@ Ready to build with no `terrain.md` / plan: discover or plan first. Takeover wit
 ## Principles
 
 - Never ask the FDE to pick a phase. That's your job.
-- Ground loop on a bound client: name → characterise → prove where they live → log. Do not hand the slice to a generic coding pack.
+- Ground loop on a bound client: name → characterise → prove on their staging → go live → log. Do not hand their repo to a generic coding pack.
 - Read `context.md` before speaking. One sharp question - never a barrage.
 - Never invent people, meetings, or numbers - `unknown - ask:` beats a polished lie.
 - Every phase ends with its artifact written. No artifact, no "done."

package/skills/fde/references/discover.md

@@ -31,15 +31,28 @@ Q: <one question that changes where you dig>
 GUESS: <your answer, so they can correct it>
 ```
 
-Stop when you can write the decision sentence under **Frame the decision first**. If a name, quote, or metric is still missing, write `unknown - ask:` - never invent ops folklore to make the map look complete.
+Stop when you can write the four lines under **Frame the decision first**. If a name, quote, or metric is still missing, write `unknown - ask:` - never invent ops folklore to make the map look complete.
 
 ## Frame the decision first
 
-Before any scanning, write one sentence at the top of your working notes:
+Same SCQA spine as readout (`S → C → Q → A`), aimed at the floor, not a deck. Write it **before** any scan. Confirm with the FDE, then dig.
 
-> "What will the sponsor do differently because of this discovery?"
+| Line | What it is | Fail if |
+|------|------------|---------|
+| **Situation** | What they already treat as true - the workaround, the sheet, the owner who left | It could be copied from the RFP |
+| **Complication** | What broke, so they cannot stay here | No tension, or three problems joined by "and" |
+| **Question** | One decision the named signer must make | It smuggles the solution ("how do we add alerting") |
+| **Answer-space** | Shape of a satisfying answer: confirm brief / descope / rescope / pause | A novel, or "insights" |
 
-If you can't name the decision this informs (descope? rescope? pick use case A over B? touch module X first?), you're collecting trivia, not discovering. Every output of this phase is aimed at that decision.
+Tests on **Question** - rewrite until all five hold:
+
+1. **Decision-shaped** - answering it changes what someone does.
+2. **Single** - one thing, not three.
+3. **Scoped** - who, where, by when.
+4. **Answerable** - evidence could settle it in this engagement.
+5. **Neutral** - does not assume the fix.
+
+Cannot write the Question → keep interrogating. Do not `fde scan`. Every later output of this phase aims at that Question. Sub-questions go to the operating map or `assumptions.md`, not into the Question.
 
 ## Method - part 1: the codebase (you do this work)
 
@@ -147,13 +160,18 @@ Score every candidate use case before anything gets prototyped:
 
 ## Artifact (this IS the memory - write it as you work)
 
-**`reality.md`** - the readout the FDE takes into the sponsor meeting:
+**`reality.md`** - the readout the FDE takes into the sponsor meeting. Keep the three schema lines the dashboard reads (`Working theory` / `Evidence` / `Differs from brief how`). Then the decision frame:
+
 ```markdown
 # Reality (actual problem)
-**Decision this informs:** <one line>
-**Confirmed:** <real problem> (evidence: <workaround/data/quote, source, day>)
-**Stated brief was wrong/right because:** <delta, with evidence>
-**Implication for build:** <thin-slice direction>
+**Working theory:** <the real problem, one sentence>
+**Evidence:** <workaround/data/quote, source, day>
+**Differs from brief how:** <delta, with evidence>
+**Situation:** <what the floor already treats as true>
+**Complication:** <what forces a decision now>
+**Question:** <one decision-shaped sentence>
+**Answer-space:** confirm brief / descope / rescope / pause - and what a yes looks like
+**Implication for build:** <first small PR>
 **Validated with:** <who, when>
 ```
 
@@ -180,11 +198,11 @@ Every line carries its evidence. `(churn: 47/90d)` `(ops lead, Day 5)` `(stated,
 ## Checkpoint (before any build)
 
 Present to the FDE, five things, one paragraph each - no padding:
-1. The real problem, with the two strongest pieces of evidence.
+1. The Question, then the real problem, with the two strongest pieces of evidence.
 2. The top 3 risk areas of the codebase, one line of why each.
 3. What must not be touched without characterisation tests.
 4. The exception-led operating map: the two breaks that matter most, who owns the workaround, and where shadow systems live.
-5. The recommendation: confirm brief / descope / rescope - and the decision it puts in front of the sponsor.
+5. The Answer-space: confirm brief / descope / rescope - and the decision it puts in front of the sponsor.
 
 If discovery revealed the problem is 3× the brief: the FDE tells the customer **before** telling themselves it's manageable. Lead with evidence, offer three paths (descope / rescope / pause-and-plan), confirm any reset in writing - update `success.md` and `brief.md` before continuing.
 
@@ -198,13 +216,14 @@ Acme's brief blamed missing monitoring. Discovery goes to the workaround first.
 
 `git log` shows the reconciliation module at 47 commits/90d with no tests, all from one author who left in February. Marco (ops lead) turns out to keep a spreadsheet: every morning he re-runs the job manually and eyeballs the totals - a habit nobody mentioned because to him it is just the job. That spreadsheet is the system of record when the job fails, which is the actual finding.
 
-`reality.md`: **Confirmed:** the job has no owner, and the manual re-run masks failures for a day (evidence: Marco's sheet, Day 5; two silent failures since March, finance escalation Mar 14). **Stated brief was wrong because:** alerting existed last year and was disabled - adding it again without an owner reproduces the same outcome. `terrain.md` gets the hotspot row and an operating-map row: `job fails silently → Marco notices next morning → re-runs by hand → spreadsheet is truth → LOAD-BEARING (Marco, Day 5)`.
+`reality.md` keeps the schema, then the frame. **Working theory:** the job has no owner, and the manual re-run masks failures for a day. **Evidence:** Marco's sheet, Day 5; two silent failures since March, finance escalation Mar 14. **Differs from brief how:** alerting existed last year and was disabled - adding it again without an owner reproduces the same outcome. **Situation:** Marco re-runs the job every morning and the spreadsheet is truth when it fails. **Complication:** two silent failures since March already hit finance, and the author of the module left in February. **Question:** should Priya fund a named owner on the failure path, or fund alerting and accept the same miss in six months? **Answer-space:** fund ownership / fund alerting-as-theatre / pause until she names who acks. `terrain.md` gets the hotspot row and an operating-map row: `job fails silently → Marco notices next morning → re-runs by hand → spreadsheet is truth → LOAD-BEARING (Marco, Day 5)`.
 
-Checkpoint to the FDE names the sponsor decision this creates: fund ownership, or fund alerting and accept the same failure in six months.
+Checkpoint to the FDE leads with that Question, not a tour of the repo.
 
 ## Principles
 
 - The brief is a hypothesis until evidence confirms it.
+- No scan until the Question is one decision the signer must make.
 - The workaround is more honest than the requirements document.
 - Churn data + the human's "don't touch that" pointing at the same module = the map is true.
 - Never modify code before the terrain map exists.

package/skills/fde/references/eval-pack.md

@@ -1,6 +1,6 @@
 # eval-pack - prove the system before it acts
 
-**Enter when:** the work touches AI/LLM/agents/RAG, or they need to POC a model, or ship/close is blocked because there is no evidence the non-deterministic path is safe. Activate alongside `ai.md`, `poc`, `thin-slices`, or `ship` - not instead of them.
+**Enter when:** the work touches AI/LLM/agents/RAG, or they need to POC a model, or ship/close is blocked because there is no evidence the non-deterministic path is safe. Activate alongside `ai.md`, `poc`, or `ship` - not instead of them.
 
 **Read first:** `trust-profile.md` (AI policy + HITL), `terrain.md` (operating map), `delivery.md`. Create or extend `evals.md`.
 

package/skills/fde/references/plan.md

@@ -22,13 +22,13 @@ An FDE plan is not a sprint backlog. The technical sequence is the easy part. Th
 
 ## Method (you do this work)
 
-**0. Lock scope first.** Read `success.md` and `assumptions.md`. If out-of-scope is undefined, define it now with the FDE - a plan on undefined scope accumulates silent commitments. If any CRITICAL assumption is still `OPEN`, stop and run test-assumptions / discover before sequencing work.
+**0. Lock scope first.** Read `success.md`, `assumptions.md`, and the **Question** on `reality.md`. If out-of-scope is undefined, define it now with the FDE - a plan on undefined scope accumulates silent commitments. If any CRITICAL assumption is still `OPEN`, stop and run test-assumptions / discover before sequencing work. If `reality.md` has no Question, stop and finish discover - you are sequencing trivia.
 
 **1. Work backwards from success.** What's the last thing that must be true before done? And before that? That's the dependency chain - not a wish list.
 
 **2. Front-load the fragile.** Check `terrain.md` hotspots. Risky modules go early - fail fast, not in week three.
 
-**3. Slice vertically.** Each task delivers something visible and testable end to end ("user submits form, sees it saved"), never a horizontal layer ("build the database layer").
+**3. One user action per change.** Each task delivers something visible and testable ("user submits form, sees it saved"), never a layer ("build the database layer"). See `ship`.
 
 **4. Size to 30-90 minutes, PR-sized.** Longer = two tasks. Each task implementable, testable, reviewable without a thousand-line diff.
 
@@ -36,7 +36,7 @@ An FDE plan is not a sprint backlog. The technical sequence is the easy part. Th
 
 **6. Stakeholder touchpoints every 2-3 tasks.** "Show progress to <name from stakeholders.md>." Not ceremony: a customer who sees small wins stays bought in; silence gets filled with doubt.
 
-**7. End with a kill list.** Every plan names what you will **not** do this phase. If everything is "later," you have no plan - you have a wish list. Cap **Now** at 3 slices (same discipline as pick-three).
+**7. End with a kill list.** Every plan names what you will **not** do this phase. If everything is "later," you have no plan - you have a wish list. Cap **Now** at 3 PRs (same discipline as pick-three).
 
 **Acceptance criteria gate:** no task moves to build without written happy-path AND unhappy-path criteria. Can't write them = the task isn't understood; the open question goes to the customer **before** the task starts. Vague criteria surface later as scope creep and rework.
 
@@ -54,6 +54,7 @@ Delivers: <what someone can see/test>
 Accepts: <happy path> / <unhappy path>
 Touches: <files/systems - blast radius declared upfront>
 Risk: <what could go wrong + fallback>
+Kill if: <the observation that voids this slice - copy from assumptions.md How we test, or the check that means stop>
 Verify: <specific check>
 Value promised: <business unit change this slice claims>
 
@@ -72,7 +73,7 @@ Value promised: <business unit change this slice claims>
 No kill list → not a finished plan. Reopen with the FDE until the deferrals are written.
 ## Checkpoint
 
-Walk the FDE through: sequence + why this order, where the fragile work sits, where the touchpoints land, the acceptance gate on task 1, and the kill list. One question: "Which stakeholder sees the first visible slice, and when?" Second: "Who accepted what we are not doing?"
+Walk the FDE through: sequence + why this order, where the fragile work sits, where the touchpoints land, the acceptance gate and **Kill if** on task 1, and the kill list. One question: "Which stakeholder sees the first visible slice, and when?" Second: "Who accepted what we are not doing?" Third: "What observation stops task 1 this week?"
 
 ## Method - estimation (when the sponsor asks "how long, how much?")
 
@@ -96,6 +97,7 @@ Every FDE gets asked this in week one. The honest answer is a range, not a numbe
 - Add 30% buffer for integration work (it always takes longer).
 - Add 50% buffer for AI/ML work (eval cycles are unpredictable).
 - Name assumptions explicitly: "assumes API docs are accurate", "assumes staging environment exists."
+- Each named assumption needs a **kill observation**: the result that voids the estimate. Copy it from `assumptions.md` → How we test. No kill observation = it is not an assumption, it is hope.
 - Revisit estimates every 2 weeks. An estimate that never updates is fiction.
 
 Write estimates to `decisions.md` under `## Sizing`. Include the assumptions - when they break, the estimate changes and the FDE has evidence for the conversation.
@@ -135,7 +137,7 @@ Never quietly update tasks. Name the reset: update `reality.md` and `success.md`
 
 Acme, after discover: the reconciliation job is unowned, Marco's spreadsheet is the real fallback.
 
-**Now** is three tasks, not eight. Task 1 is *failures reach a named human* - delivers a page to a rota, accepts "kill the job mid-run → the on-call is paged within 15 min", touches the job wrapper and the alert config, rollback is re-disable the route, verify by killing it in staging. Value promised: `risk-mitigation - a silent failure becomes a 15-minute one`.
+**Now** is three tasks, not eight. Task 1 is *failures reach a named human* - delivers a page to a rota, accepts "kill the job mid-run → the on-call is paged within 15 min", touches the job wrapper and the alert config, rollback is re-disable the route, **Kill if:** a real failure page is acked by nobody on the rota (the *finance would act* assumption, DISPROVED if Marco is the only name that answers), verify by killing it in staging. Value promised: `risk-mitigation - a silent failure becomes a 15-minute one`.
 
 The kill list in `decisions.md` is where the plan earns its keep: the rewrite of the reconciliation service that Tom keeps proposing goes there - *deferred, the failure mode is ownership not architecture (Priya accepted, Jun 12)* - along with the finance dashboard finance asked for directly. Both stay visible so the same argument is not re-litigated in week 4 without a receipt.
 
@@ -148,5 +150,6 @@ First visible slice goes to Marco, not Priya: he is the one whose morning change
 - Every 2-3 tasks, a stakeholder touchpoint. Trust decays without visibility.
 - No written acceptance criteria, no build.
 - No kill list, no finished plan.
-- Estimates are ranges, not promises. Name the assumptions.
+- No **Kill if** on a Now PR, that PR is hope.
+- Estimates are ranges, not promises. Name the assumptions and the observation that voids them.
 - Migrations: leaf nodes first, core last. Rollback before cutover.

package/skills/fde/references/ship.md

@@ -1,10 +1,102 @@
-# ship - production without surprises
+# ship - on their site, then live
 
-**Enter when:** a slice is built, reviewed, and ready to deploy.
+**Enter when:** you are writing or updating on their codebase, they need to see something real, or you are going live.
 
-**Read first:** `context.md`, `delivery.md`, `success.md`. Load `trust-profile.md` if the deploy touches regulated data or needs an approval chain. Load `evals.md` when the deploy touches AI/ML/LLM/RAG/agents.
+**Read first:** `context.md`, `decisions.md`, `delivery.md`, `success.md`. Load `terrain.md` before you touch their code. Load `trust-profile.md` if the deploy touches regulated data or needs an approval chain. Load `evals.md` when the work touches AI/ML/LLM/RAG/agents.
 
-Opening question, calm tech lead voice: **has anyone actually *run* the rollback, or is it still a slide?** If only planned, that's today's work - say so plainly.
+Do not ask them to pick a mode. Name where you are, then start at the matching section:
+
+- Nothing on their staging yet → **one change they can see**
+- On staging, the signer in `success.md` can reject it → **go-live**
+- Prod is the question → **go-live**. Do not start a second change.
+
+If going live, opening question: **has anyone actually *run* the rollback, or is it still a slide?** If only planned, that's today's work - say so plainly.
+
+A same-day throwaway that kills an assumption is `poc`. This method is the real change on a repo they will own, then production.
+
+## Field (name it once, then the same loop)
+
+| | Brownfield | Greenfield |
+|--|------------|------------|
+| What you touch | Code they already run | A new path or empty tree they will own |
+| First move | Characterise their tests, their runner, the workaround in `terrain.md` | First path a user can click. Not the whole product. |
+| Proof | Their staging, a screen they already use | Their staging, or the environment they will operate. Local demo is not delivery. |
+| Undo | Revert this change on its own | Same. If you cannot undo it, the design is coupled. |
+
+Skip POC only when the killer assumption already lives in the repo (typical brownfield). If the bet is unproven, `poc` first.
+
+## Method - one change they can see
+
+One change = one thing a user can do, with a test, that you can revert on its own. Not "all the APIs, then all the UI." Not a 2,000-line dump. A PR is how this often lands. It is not the job. The job is the change they can see.
+
+```
+BAD (layers):
+  1: all database models
+  2: all API endpoints
+  3: all UI components
+  4: wire everything together (and pray)
+
+GOOD (one user action each):
+  1: User can create a payment (schema + endpoint + minimal UI) - testable
+  2: User can view payment status (query + endpoint + UI) - testable
+  3: Payment retry on failure (logic + endpoint + UI feedback) - testable
+  4: Admin can void a payment (auth + logic + UI) - testable
+```
+
+Each change is independently revertible.
+
+**Before you start this change:**
+
+- [ ] It is in `decisions.md` with acceptance criteria (happy + unhappy path)
+- [ ] Blast radius declared: which files, which systems, which users affected
+- [ ] Rollback named: revert this change, or something more specific
+- [ ] No dependency on an unmerged change (if dependent, state it and land in order)
+- [ ] `Kill if` is written - the observation that stops this change
+
+**The loop.** In this order:
+
+```
+Read existing code in the area (search before creating)
+  → Characterise what is already there (their tests, their runner; greenfield: the empty tree)
+    → Implement the smallest path that works
+      → Prove it on their staging (below)
+        → Cleanup pass (dedupe, simplify - behaviour unchanged)
+          → Self-review against acceptance criteria
+            → Commit with a message the client's team can read
+              → Update decisions.md + delivery.md
+```
+
+**Prove it on their staging.** A green check on your laptop is not delivery.
+
+- Run **their** test command, typecheck, or smallest proving path. Write the command and the result in `delivery.md`.
+- If the signer in `success.md` cannot reject this on a screen they already use, it is not proven.
+- Staging they operate beats a local demo. If you have no staging: `unknown - ask:` who owns an environment, then stop pretending it shipped.
+- Model in the path: `eval-pack` until `evals.md` says SHIP. Do not skip because "it looked right in chat."
+
+The proof is whatever this client already believes, plus one new receipt they can replay.
+
+**Size.** Each change targets:
+
+| Metric | Target | Why |
+|--------|--------|-----|
+| Lines changed | 100-300 | Reviewable in one sitting |
+| Time to implement | 30-90 minutes | Testable before context decays |
+| Files touched | 1-5 | Blast radius stays containable |
+| Tests added | ≥1 per new behaviour | Proves this change; guards against regression |
+
+Larger than 300 lines → split first. "It's all connected" means the design needs work, not a bigger dump.
+
+**Show it.** Every 2-3 changes, something the customer can see: an endpoint they can hit, a UI they can click, a metric that moved, a risk that was retired. Technical progress invisible to stakeholders is trust decay. `delivery.md` gets updated after every visible change.
+
+**The scope trap.** Mid-change discoveries ("this module also needs updating," "I should refactor this while I'm here"):
+
+- If it's in `decisions.md`: do it as a separate change.
+- If it's NOT in `decisions.md`: log it as a scope receipt (see `hold-scope.md`), don't touch it.
+- Ugly code outside this change stays ugly. That is discipline, not laziness.
+
+After each change: tests pass (state the command and result), acceptance criteria met, blast radius as declared, `Kill if` still false. After every 2-3: what did they see, and what's their signal? Then, when the signer can reject it on their staging, go-live below.
+
+---
 
 ## Deployment readiness gate (confirm the target before building the runway)
 
@@ -24,7 +116,7 @@ Before scoring readiness, confirm WHERE this is going. State it in 2-3 lines - b
 | **Compliance** | Region constraints? Data residency? Encryption requirements? CAB/change window? | |
 | **Infra-as-code** | Terraform/Pulumi/CDK/manual? State file location? | |
 
-**If anything is blank:** ask now. Discovering deployment constraints AFTER build is where timelines slip. If the client hasn't defined these yet, that's a conversation before you write the runbook - not after.
+**If anything is blank:** ask now. Discovering deployment constraints after the change is where timelines slip. If the client hasn't defined these yet, that's a conversation before you write the runbook - not after.
 
 Write confirmed deployment context to `delivery.md` under a `## Deployment target` section.
 
@@ -46,9 +138,9 @@ Score each dimension green/amber/red. This is the gate, not a suggestion:
 
 | Dimension | Green | Amber | Red |
 |-----------|-------|-------|-----|
-| **Value bucket** | `success.md` names primary bucket (`cost-save` \| `risk-mitigation` \| `revenue-uplift`) and a baseline→target metric; this slice’s value-ledger row has **Bucket** + **Promised** | Bucket named; **Measured** still `pending` with a pulse date | No bucket, or Promised empty / ticket-theater only |
-| **Audit receipt** | Dated line in `delivery.md` (`## Ship receipts` or ledger Evidence) proving exceptions/operating path were walked - cite `terrain.md` / `reality.md` / `audit.md` | Path described, not verified this ship | No audit receipt for this slice |
-| **Eval receipt** | **n/a** (no AI on this slice) **or** `evals.md` Verdict SHIP with dated golden run + HITL gate named | Eval pack exists; known fails open with owner + date | AI in scope and no eval receipt |
+| **Value bucket** | `success.md` names primary bucket (`cost-save` \| `risk-mitigation` \| `revenue-uplift`) and a baseline→target metric; this change's value-ledger row has **Bucket** + **Promised** | Bucket named; **Measured** still `pending` with a pulse date | No bucket, or Promised empty / ticket-theater only |
+| **Audit receipt** | Dated line in `delivery.md` (`## Ship receipts` or ledger Evidence) proving exceptions/operating path were walked - cite `terrain.md` / `reality.md` / `audit.md` | Path described, not verified this ship | No audit receipt for this change |
+| **Eval receipt** | **n/a** (no AI on this change) **or** `evals.md` Verdict SHIP with dated golden run + HITL gate named | Eval pack exists; known fails open with owner + date | AI in scope and no eval receipt |
 | **AI eval pack** | `.fde/evals.md` Verdict SHIP; goldens run this change; critical fails 0; HITL filled if policy requires | Pack exists; run stale vs change log | AI-touching deploy and pack missing / NO-SHIP / HITL required but empty |
 
 **Any RED = stop. Do not deploy. Fix the red dimension first.**
@@ -65,7 +157,7 @@ Write the readiness score (including value + receipts) to `delivery.md` before d
 
 ## Intent vs diff (before pre-blast)
 
-Ship the change you intended - not the drift that snuck in. Run this on the deploy branch against the **one-line intent** from `decisions.md` / `success.md` (the slice you said you were building).
+Ship the change you intended - not the drift that snuck in. Run this on the deploy branch against the **one-line intent** from `decisions.md` / `success.md` (the change you said you were building).
 
 ```bash
 git diff <base>...HEAD --stat
@@ -78,7 +170,7 @@ Score every touched path (or logical hunk):
 |---------------|---------|------|
 | | **KEEP** | Directly required for the stated intent |
 | | **JUSTIFY** | Adjacent but load-bearing - one sentence why it must ship *now*, or split |
-| | **SPLIT** | Real work, wrong PR - park in `decisions.md` kill/Next; do not deploy with this slice |
+| | **SPLIT** | Real work, wrong change - park in `decisions.md` kill/Next; do not deploy with this one |
 | | **DROP** | Noise (format-only, drive-by rename, unrelated tidy) - revert before ship |
 
 **Any SPLIT or DROP still in the tree = fix-first.** JUSTIFY without a written sentence = treat as SPLIT. Log a one-line receipt in `delivery.md`: `intent vs diff: KEEP n · JUSTIFY n · SPLIT n · DROP n - <intent>`.
@@ -164,12 +256,12 @@ Never skip a step. The sponsor always wants to skip from pilot to standard - tha
 
 ## Method - progressive adoption (built it, now people need to use it)
 
-Adoption isn't a handoff-stage problem - it starts during build. Software that launches to silence is software that gets decommissioned.
+Adoption isn't a handoff-stage problem - it starts while you are still writing the change. Software that launches to silence is software that gets decommissioned.
 
-**During build:**
+**During the change:**
 - **Feature flags from day one.** Every new capability behind a flag. Ship to 5% of users first. Watch behavior before opening to 100%.
 - **Feedback loops built in.** A thumbs-up/down, a "was this helpful?", a usage counter. Instrument adoption, don't assume it.
-- **Resistance signals.** Watch for: workaround creation (they built a spreadsheet instead of using the tool), drop-off after day 3 (onboarding fails), vocal detractors (one influential skeptic can kill adoption). Address these DURING build, not after launch.
+- **Resistance signals.** Watch for: workaround creation (they built a spreadsheet instead of using the tool), drop-off after day 3 (onboarding fails), vocal detractors (one influential skeptic can kill adoption). Address these before launch, not after.
 
 **At launch:**
 - **Champion network.** Identify 2-3 power users per team who adopt early. Support them intensely - they become your multiplier.
@@ -180,24 +272,35 @@ Adoption isn't a handoff-stage problem - it starts during build. Software that l
 
 ## Artifact
 
-**`delivery.md`** - deployment record: what shipped, when, what it delivers in business terms, rollback procedure, pulse definition, **scale-readiness assessment, and adoption metrics**. Written for whoever inherits the system.
+**`decisions.md`** - each change: what was implemented, what was tested, what was deferred, `Kill if`.
+
+**`delivery.md`** - each visible change in business language; then the deployment record: what shipped, when, rollback procedure, pulse definition, **scale-readiness assessment, and adoption metrics**. Written for whoever inherits the system.
 
 ## Checkpoint
 
-Before 100%: canary clean, business metric verified, pulse written into `delivery.md`. Also green: value bucket named, audit receipt dated, eval receipt **n/a or pass**, **intent vs diff clean** (no unresolved SPLIT/DROP). Missing any of those → not green. For enterprise-scale: scale-readiness gate passed before broad rollout.
+After each change: tests pass, acceptance criteria met, blast radius as declared, `Kill if` still false, proven on staging they operate.
+
+Before 100% live: canary clean, business metric verified, pulse written into `delivery.md`. Also green: value bucket named, audit receipt dated, eval receipt **n/a or pass**, **intent vs diff clean** (no unresolved SPLIT/DROP). Missing any of those → not green. For enterprise-scale: scale-readiness gate passed before broad rollout.
 
 ## Worked example
 
-Acme, shipping the failure-routing slice into a payments environment on a Thursday.
+Acme, brownfield. Plan Now has three changes, not "the payments rewrite."
 
-Readiness scoring catches two things the diff does not. The audit receipt is missing: the operating map says Marco's manual re-run is the fallback, and nobody has checked whether the new page fires *before* his morning run or after - if after, the alert changes nothing. That gets walked and cited before deploy. Second, the intent-vs-diff read shows the PR also touches the settlement retry that was deferred in build; it comes out.
+Change 1 is *user sees retry status on a failed payment* - schema + endpoint + the existing ops screen, 180 lines, their `pytest -k payments` green, revert is this change. `Kill if:` the signer cannot reject it on the screen they already use. Ugly retry-queue code two files over stays ugly. `decisions.md` logs the change; `delivery.md` says ops can see a retry without opening the spreadsheet. Marco sees it on staging they operate. That is the proof. Local green was not.
+
+Then Thursday go-live of the failure-routing change. Readiness scoring catches two things the diff does not. The audit receipt is missing: the operating map says Marco's manual re-run is the fallback, and nobody has checked whether the new page fires *before* his morning run or after - if after, the alert changes nothing. That gets walked and cited before deploy. Second, the intent-vs-diff read shows the PR also touches the settlement retry that was deferred; it comes out.
 
 Pre-blast challenge: "what does this break if it fires at 3am and nobody acks?" Answer: nothing breaks, but the rota is not yet agreed - so the deploy waits on a name, not on code. That is a one-day slip that prevents a fake green.
 
 After deploy: `delivery.md` ship receipt with the audit cite, the kill test evidence, and the rollback line. Eval receipt: n/a, no AI in this path.
 
+Greenfield is the same loop with an empty tree: first path a user can click, on an environment they will operate, then this go-live. Not the whole product in one dump.
+
 ## Principles
 
+- One user action per change. Layers are untestable until assembled.
+- On their staging, and you can undo it. Local green is not delivery.
+- The ugly code outside this change stays ugly. That's discipline, not laziness.
 - A deployment without a tested rollback is reckless.
 - Roll back on any canary anomaly; investigate safely.
 - Verify the business metric, not just the technical one.

package/skills/fde/references/test-assumptions.md

@@ -40,7 +40,7 @@ CONVENIENCE - if wrong, a task changes but the approach holds
 | "The team will adopt the new tool" | Ask three team members individually: "Show me how you'd use this" | 1h | 2 of 3 can describe a use case without prompting |
 | "The data is clean enough for ML" | Sample 200 records, count nulls/duplicates/format errors | 1h | <5% error rate on the fields the model needs |
 
-**4. Run the killer test first.** The assumption with the highest blast radius AND the cheapest validation gets tested immediately. This single principle saves more engagement time than any other: if the killer assumption is wrong, you've saved weeks; if it holds, you've bought confidence.
+**4. Run the killer test first.** The assumption with the highest blast radius AND the cheapest validation gets tested immediately. This single principle saves more engagement time than any other: if the killer assumption is wrong, you've saved weeks; if it holds, you've bought confidence. Write the kill observation in `How we test` as the result that would **stop** the plan - plan copies that line onto each Now PR as `Kill if`.
 
 **5. Present findings as a fact base, not a challenge.**
 

package/templates/.fde/assumptions.md

@@ -8,4 +8,4 @@
 **Blast radius:** `CRITICAL` · `LOAD-BEARING` · `CONVENIENCE`  
 **Status:** `OPEN` · `TESTING` · `CONFIRMED` · `DISPROVED` · `PARKED`
 
-**Rule:** a CRITICAL assumption still OPEN blocks plan. DISPROVED → update `reality.md` / `success.md` and log the reset in `decisions.md` the same day.
+**Rule:** a CRITICAL assumption still OPEN blocks plan. `How we test` is the kill observation (the result that stops the work) - plan copies it as `Kill if`. DISPROVED → update `reality.md` / `success.md` and log the reset in `decisions.md` the same day.

package/templates/.fde/reality.md

@@ -1,7 +1,12 @@
 # Reality (actual problem)
 
-<!-- Hypothesis until the discover phase confirms with evidence. -->
+<!-- Hypothesis until the discover phase confirms with evidence. Dashboard reads Working theory / Evidence / Differs from brief how. -->
 
 **Working theory:**
 **Evidence:**
 **Differs from brief how:**
+
+**Situation:**
+**Complication:**
+**Question:**
+**Answer-space:**

package/skills/fde/references/thin-slices.md

@@ -1,100 +0,0 @@
-# thin-slices - thin slices on someone else's codebase
-
-**Enter when:** the build task is larger than a single PR, multiple files or systems are involved, or the FDE needs to show visible progress to a stakeholder every 2-3 days.
-
-**Read first:** `decisions.md` (the plan), `terrain.md` (the danger zones), `context.md`. This skill works *inside* the build phase - it's the execution discipline that makes large features safe on codebases you don't own.
-
-The FDE who builds a 2,000-line feature in one PR gets it rejected. The FDE who ships five 200-line PRs - each reviewable, testable, and revertible - earns the team's trust. On someone else's codebase, small and visible beats clever and large.
-
-## Method (you do this work)
-
-**1. Slice vertically, never horizontally.**
-
-```
-BAD (horizontal):
-  PR 1: Build all database models
-  PR 2: Build all API endpoints
-  PR 3: Build all UI components
-  PR 4: Wire everything together (and pray)
-
-GOOD (vertical):
-  PR 1: User can create a payment (schema + endpoint + minimal UI) - testable
-  PR 2: User can view payment status (query + endpoint + UI) - testable
-  PR 3: Payment retry on failure (logic + endpoint + UI feedback) - testable
-  PR 4: Admin can void a payment (auth + logic + UI) - testable
-```
-
-Each vertical slice delivers working functionality the customer can see. Each slice is independently revertible.
-
-**2. The slice checklist.** Before starting any slice:
-
-- [ ] Slice is in `decisions.md` with acceptance criteria (happy + unhappy path)
-- [ ] Blast radius declared: which files, which systems, which users affected
-- [ ] Rollback path identified: "revert this PR" or something more specific
-- [ ] No dependency on an unmerged slice (if dependent, state it and merge in order)
-
-**3. The implementation loop.** For each slice, in this order:
-
-```
-Read existing code in the area (search before creating)
-  → Characterise what is already there (their tests, their runner)
-    → Implement the minimal working path
-      → On-site proof (below)
-        → Cleanup pass (dedupe, simplify - behaviour unchanged)
-          → Self-review against acceptance criteria
-            → Commit with a message the client's team can read
-              → Update decisions.md + delivery.md
-```
-
-**On-site proof.** A green check on your laptop is not delivery. Before the slice is done:
-
-- Run **their** test command, typecheck, or smallest proving path. Write the command and the result in `delivery.md`.
-- If the signer in `success.md` cannot reject this slice on a screen they already use, it is not proven.
-- Staging they operate beats a local demo. If you have no staging: `unknown - ask:` who owns an environment, then stop pretending it shipped.
-- Model in the path: `eval-pack` until `evals.md` says SHIP. Do not skip because "it looked right in chat."
-
-Do not prove it with a textbook ritual. The proof is whatever this client already believes, plus one new receipt they can replay.
-
-**4. Size discipline.** Each slice targets:
-
-| Metric | Target | Why |
-|--------|--------|-----|
-| Lines changed | 100-300 | Reviewable in one sitting |
-| Time to implement | 30-90 minutes | Testable before context decays |
-| Files touched | 1-5 | Blast radius stays containable |
-| Tests added | ≥1 per new behaviour | Proves the slice works; guards against regression |
-
-A slice larger than 300 lines → split before implementing. "It's all connected" means the design needs work, not the slice limit.
-
-**5. Stakeholder visibility rhythm.** Every 2-3 slices, something the customer can see:
-
-- A working endpoint they can hit
-- A UI change they can click
-- A metric that moved
-- A risk that was retired
-
-Technical progress invisible to stakeholders is trust decay. `delivery.md` gets updated after every visible slice.
-
-**6. The scope trap.** Mid-slice discoveries - "this module also needs updating," "I should refactor this while I'm here":
-
-- If it's in `decisions.md`: do it as a separate slice.
-- If it's NOT in `decisions.md`: log it as a scope receipt (see `hold-scope.md`), don't touch it.
-- The hardest discipline: leaving ugly code alone when it's not in your slice.
-
-## Artifact
-
-**`decisions.md`** - each slice logged with: what was implemented, what was tested, what was deferred.
-
-**`delivery.md`** - each visible slice with business-language description of what it delivers.
-
-## Checkpoint
-
-After each slice: tests pass (state the command and result), acceptance criteria met, blast radius as declared. After every 2-3 slices: stakeholder visibility confirmed - what did they see, and what's their signal?
-
-## Principles
-
-- Vertical slices, always. Horizontal layers are untestable until assembled.
-- 100-300 lines per slice. Larger means split first.
-- Every slice is independently revertible. If it isn't, the design is coupled.
-- Visible progress every 2-3 slices. Technical progress alone is trust decay.
-- The ugly code outside your slice stays ugly. That's discipline, not laziness.