okstra 0.140.0 → 0.141.0

package/runtime/skills/okstra-brief-gen/SKILL.md

@@ -577,20 +577,28 @@ Split every such checklist across the two sections using one test:
 
 > **Can an okstra phase satisfy this by changing files in this repository?**
 
-- **Yes → `## Acceptance Criteria`.** Source, tests, config, and deployment
-  *manifest files* all count — editing `values-prod.yaml` is a file change.
+- **Yes → the end-state sections.** A runtime behaviour goes to
+  `## Expected Behavior`, a behaviour that must survive unchanged to
+  `## Preserved Behavior`, and an artifact state the work must leave behind to
+  `## Expected Outcome`. Source, tests, config, and deployment *manifest files*
+  all count — editing `values-prod.yaml` is a file change.
 - **No → `## External Gates`.** A person's approval or sign-off, manual QA,
   validation performed in staging/production, creating a dashboard or alert,
   running a deployment, and ticket status transitions. Record who or what owns
   it (`Brice`, `release manager`, `CI`), so the reader can act on it outside
   okstra.
+- **An item with no observation method is not an end state.** If nothing comes
+  to mind for the `— verify:` half — no command, no observation point — send it
+  to `## External Gates`, or raise it in `## Open Questions` as a `general:`
+  row. Making this call upstream is what stops each downstream phase from
+  reading the same prose its own way.
 
 The distinction is the *action*, not the topic: "add the RSS flag to
 `values-prod.yaml`" is a criterion; "apply that manifest to prod" and "confirm
 the new-app count on the Metabase dashboard with Brice" are gates.
 
 Never drop a gate to make the brief tidier — an omitted release step is worse
-than a correctly-parked one. Never promote a gate into Acceptance Criteria to
+than a correctly-parked one. Never promote a gate into an end-state section to
 look thorough either: an okstra phase cannot satisfy it, so it can only surface
 later as an unmeetable requirement that blocks the run.
 
@@ -644,8 +652,12 @@ Required sections:
 - **Problem / Symptom** — current state. For bugs: repro + observed/expected;
   for greenfield: gap between current and desired.
 - **Desired Outcome** — success shape, not a solution prescription.
-- **Acceptance Criteria** — must-pass points an okstra phase can satisfy by
-  changing repository files. See "Splitting a source checklist" below.
+- **Expected Behavior** — observable runtime behaviours the finished work must
+  exhibit, as `EB-NNN … — verify: …` bullets.
+- **Preserved Behavior** — behaviours this work must NOT change, as `PB-NNN …
+  — verify: …` bullets. The only end-state section a codebase-scan brief carries.
+- **Expected Outcome** — artifact states the finished work must leave behind, as
+  `EO-NNN … — verify: …` bullets. See "Splitting a source checklist" below.
 - **External Gates** — must-pass points owned by a person or by live
   infrastructure. Recorded for the reader; never a requirement for any phase.
 - **Constraints** — deadlines, compatibility, technical/operational limits.
@@ -746,7 +758,9 @@ The installed template `~/.okstra/templates/reports/brief.template.md` is the by
 | `## Problem / Symptom` | Required | Not required — omit | Required |
 | `## Context` | Required | Required | Required |
 | `## Desired Outcome` | Required | Required | Required |
-| `## Acceptance Criteria` | Required — `_(none)_` or one bullet per repo-satisfiable must-pass point | Required — `_(none)_` or bullets | Required — `_(none)_` or bullets |
+| `## Expected Behavior` | Required — `_(none)_` or `EB-NNN … — verify: …` bullets | **Rejected** (scan has not run) | Required — same as reporter-input |
+| `## Preserved Behavior` | Required — `_(none)_` or `PB-NNN … — verify: …` bullets | Required — `PB-NNN` bullets (`_(none)_` rejected) | Required — same as reporter-input |
+| `## Expected Outcome` | Required — `_(none)_` or `EO-NNN … — verify: …` bullets | **Rejected** (scan has not run) | Required — same as reporter-input |
 | `## External Gates` | Required — `_(none)_` or one bullet per person/infra-owned gate | Required — `_(none)_` or bullets | Required — `_(none)_` or bullets |
 | `## Constraints` | Required | Required | Required |
 | `## Related Artifacts` | Required | Required | Required |
@@ -755,6 +769,14 @@ The installed template `~/.okstra/templates/reports/brief.template.md` is the by
 | `## Scan Scope` | Not applicable — omit | Required — one bullet per `scan-scope` path with a short description of what lives there | Not applicable — omit |
 | `## Priority Lenses` | Not applicable — omit | Required — one bullet per priority lens with a short rationale for why that lens applies to this scope | Not applicable — omit |
 
+`## Desired Outcome` and `## Expected Outcome` are different sections. The first
+is prose — the shape of success in the reporter's own words. The second is the
+checkable half: `EO-NNN … — verify: …` bullets, and the only one downstream
+phases map against. Prose written in the second is rejected by the brief
+validator. An `EO-NNN` written in the first is **not** — that section is checked
+only for a non-blank body, so the brief passes and the run then fails with no id
+to map at `endStateCoverage`. Check which section you are in before writing an id.
+
 ### Frontmatter rules
 
 - Every brief starts on line 1 with a YAML frontmatter delimited by `---`.
@@ -880,11 +902,14 @@ labelled-handoff contract — required frontmatter keys, Augmentation labels,
 `intent-inference ↔ intent-check:` auto-mirroring, `parent-id`/`depth`
 consistency, `reporter-confirmations` markers, the variant-required sections
 from "Required sections by variant" (`Source Material` / `Problem / Symptom`
-off-codebase, plus `Context` / `Desired Outcome` / `Acceptance Criteria` /
+off-codebase, plus `Context` / `Desired Outcome` / the end-state sections
+(`Expected Behavior` / `Preserved Behavior` / `Expected Outcome`) /
 `External Gates` / `Constraints` / `Related Artifacts` / `Related Task Graph`
 / `Open Questions` everywhere — each present with a non-blank body, `_(none)_`
-allowed), `Related Task Graph` table shape/relation values, and the
-codebase-scan `scope`/`Scan Scope`/`Priority Lenses` rules.
+allowed), the end-state item format (`EB-NNN` / `PB-NNN` / `EO-NNN` id plus a
+non-empty `— verify:` observation method), `Related Task Graph` table
+shape/relation values, and the codebase-scan `scope`/`Scan Scope`/`Priority
+Lenses` rules.
 
 1. Run the validator over the briefs directory:
 
@@ -904,8 +929,10 @@ codebase-scan `scope`/`Scan Scope`/`Priority Lenses` rules.
    `depth`, `created`, `generator`, `reporter-confirmations`); every
    section the "Required sections by variant" table marks Required for the
    brief's variant is present with a non-blank body (`_(none)_` allowed) —
-   in particular `Desired Outcome`, `Acceptance Criteria`, `External Gates`,
-   `Related Artifacts`, and `Related Task Graph`, the ones authors drop most;
+   in particular `Desired Outcome`, the three end-state sections,
+   `External Gates`, `Related Artifacts`, and `Related Task Graph`, the ones
+   authors drop most; every end-state bullet carries an `EB-NNN` / `PB-NNN` /
+   `EO-NNN` id and a non-empty `— verify:` observation method;
    every Augmentation entry carries one of the four labels; every
    `intent-inference` has a paired `intent-check:` row; `parent-id` is `self`
    at depth 0 and a real parent id below; and for `scope: codebase` briefs,

package/runtime/skills/okstra-rollup/SKILL.md

@@ -41,8 +41,9 @@ okstra rollup --task-group <group> --project-root <projectRoot> --json
 Omit `--task-group` for the whole project. The JSON shape (all durations are **raw milliseconds**):
 
 - `taskGroup` — the scope (`null` = whole project), `taskCount` — number of tasks.
-- `tasks[]` — per task: `taskKey, taskGroup, taskId, taskType, workCategory, workStatus, currentPhase, currentPhaseState, nextRecommendedPhase, latestRunStatus, updatedAt, reportPath, runCount, cpuSumMs, wallClockMs, errorCount`.
-- `totals` — `runs, cpuSumMs, wallClockMs, errors`, plus `byWorkStatus`, `byWorkCategory`, `byCurrentPhase`, `byTaskType` (each a `{value: count}` map).
+- `tasks[]` — per task: `taskKey, taskGroup, taskId, taskType, workCategory, workStatus, currentPhase, currentPhaseState, nextRecommendedPhase, latestRunStatus, updatedAt, reportPath, runCount, cpuSumMs, wallClockMs, errorCount`, plus `criticRuns, criticGapsProposed, criticGapsMerged, criticGapsRejected, criticGapsUnverified`.
+- `totals` — `runs, cpuSumMs, wallClockMs, errors`, plus `byWorkStatus`, `byWorkCategory`, `byCurrentPhase`, `byTaskType` (each a `{value: count}` map), plus `critic` (`runsWithCritic, gapsProposed, gapsMerged, gapsRejected, gapsUnverified`).
+- The coverage critic is opt-in, so `totals.critic.runsWithCritic == 0` means it was never used — report that as "not used", never as a zero-yield result. When it IS non-zero, the merge rate (`gapsMerged / gapsProposed`) is what tells the user whether the pass earns its tokens; state it only when at least one run used it.
 
 `runCount` counts every timeline run; `cpuSumMs`/`wallClockMs` only reflect runs that reached Phase 7 usage, so they can be `0` while `runCount > 0`. `reportPath` is project-relative and may be empty (task not yet reported).
 

package/runtime/templates/reports/brief.template.md

@@ -73,20 +73,51 @@ between current and desired.>
 
 <!-- Do NOT prescribe a solution — that belongs to implementation-planning. -->
 
-## Acceptance Criteria
+## Expected Behavior
 
-<One bullet per must-pass point that okstra phases can satisfy by changing
-files in this repository. Use _(none)_ if none.>
+<One bullet per observable runtime behaviour the finished work must exhibit.
+Use _(none)_ when this work changes no runtime behaviour (a pure refactor).>
 
-<!-- Admissibility test — a criterion belongs here only if it is satisfied by
-changing repository files (source, tests, config, deployment manifests).
-Anything that needs a person's approval, a ticket status change, or an action
-against live infrastructure goes to `## External Gates` instead. Downstream
-phases treat this section as the requirement set: `implementation-planning`
-builds one Requirement Coverage row per bullet, `final-verification` gates
-acceptance on it. -->
+<!-- Format: `EB-NNN <observable condition> — verify: <command or observation point>`
+The `— verify:` half is mandatory and stays English in every locale, because
+downstream validators parse it. An item you cannot give an observation method
+belongs in `## External Gates`, not here. `## Expected Behavior` and
+`## Expected Outcome` must not both be empty. -->
 
-- <criterion satisfied by a repository file change>
+- <EB-NNN observable condition — verify: command or observation point>
+
+## Preserved Behavior
+
+<One bullet per behaviour this work must NOT change. Use _(none)_ if none.>
+
+<!-- This is the upper bound a refactor or improvement cannot express through
+Expected Behavior alone. Same id and `— verify:` rule, with the `PB-` prefix.
+codebase-scan variant: this is the ONLY end-state section. `## Expected
+Behavior` and `## Expected Outcome` are rejected there, because the scan has
+not run yet. -->
+
+- <PB-NNN behaviour that must survive unchanged — verify: regression observation point>
+
+## Expected Outcome
+
+<One bullet per artifact-state the finished work must leave behind — a module
+moved, a duplicate removed, a record written. Use _(none)_ if none.>
+
+<!-- NOT `## Desired Outcome`. That section is prose: the shape of success, in
+whatever words the reporter thinks in. This one is the checkable half — each
+bullet is an `EO-NNN` id with an observation method, and it is what downstream
+phases map against. Prose written here is rejected outright. An `EO-NNN` id
+written up there is NOT: `## Desired Outcome` is checked only for a non-blank
+body, so a misfiled id passes the brief and then leaves the run with nothing to
+map at `endStateCoverage`. Check which section you are in before writing an id.
+
+Same id and `— verify:` rule as the two sections above, with the `EO-` prefix.
+Downstream phases treat Expected Behavior / Preserved Behavior / Expected
+Outcome as the requirement set: every later phase maps each id to its own
+deliverable, and `implementation-planning` builds one Requirement Coverage row
+per id. -->
+
+- <EO-NNN artifact state that must exist when the work is done — verify: command or observation point>
 
 ## External Gates
 

package/runtime/templates/reports/fan-out-unit.template.md

@@ -19,13 +19,18 @@ recommended-next-phase: {{NEXT_PHASE}}
 ## Requirement Provenance
 
 <!-- Where this unit's scope came from. One bullet per source. Every bullet must be
-     `brief:<heading>` (a heading that literally exists in the task brief) or
-     `contract:<rule>` (an okstra-mandated artifact). A unit you cannot source this
-     way is not a work item — raise it as a clarification instead of inventing it.
+     `brief:EB-001` / `brief:PB-001` / `brief:EO-001` — an end-state id the brief
+     declares — or `contract:<rule>` (an okstra-mandated artifact). Citing a heading
+     is rejected when the brief pins ids: every brief carries the same generic
+     headings, so a heading cannot say WHICH reporter line demanded this unit. Only a
+     brief authored before the end-state sections existed still takes the older
+     `brief:<heading>` form, and there the heading must literally exist in it.
+     A unit you cannot source this way is not a work item — raise it as a
+     clarification instead of inventing it.
      Unlike a planning report, `derived:<parent> — <reason>` is NOT accepted here: a
      packet is validated on its own, so the parent it names cannot be resolved. -->
 
-- brief:
+- brief:EB-001
 
 ## Evidence
 

package/runtime/templates/reports/final-report.template.md

@@ -153,6 +153,24 @@ Carried-forward plan items retain their prior verdicts verbatim; each such item
 {% endfor %}
 {%- endif %}
 
+{% if header.taskType in ('requirements-discovery', 'error-analysis', 'implementation-planning') %}
+
+### 2.3 End State Coverage{% if t("sectionAside.endStateCoverage") != "End State Coverage" %} ({{ t("sectionAside.endStateCoverage") }}){%- endif %}
+
+{% if endStateCoverage | length == 0 -%}
+{{ t("emptyState.endStateCoverage") }}
+{%- else %}
+{{ t("sectionIntro.endStateCoverage") }}
+
+| ID | {{ t("columns.disposition") }} | {{ t("columns.coveredBy") }} | {{ t("columns.evidence") }} | {{ t("columns.rationale") }} |
+|----|---------------|-----------|----------|-----------|
+{% for row in endStateCoverage -%}
+| {{ row.id | mdcell }} | `{{ row.disposition | mdcell }}` | {{ row.coveredBy | mdcell }} | {{ (row.evidence | join(", ")) | mdcell }} | {{ row.rationale | mdcell }} |
+{% endfor %}
+{%- endif %}
+
+{% endif %}
+
 ## 3. Recommended Next Steps
 
 {% if recommendedNextSteps | length == 0 -%}
@@ -358,6 +376,8 @@ Carried-forward plan items retain their prior verdicts verbatim; each such item
 
 - **Round count**: `{{ implementationPlanning.planBodyVerification.roundCount }}`
 - **Gate result**: `{{ implementationPlanning.planBodyVerification.gateResult }}`
+{% if implementationPlanning.planBodyVerification.participatingAnalysers %}- **Participating analysers**: `{{ implementationPlanning.planBodyVerification.participatingAnalysers.voting }}` / `{{ implementationPlanning.planBodyVerification.participatingAnalysers.rostered }}`
+{% endif %}
 {% if implementationPlanning.planBodyVerification.gateBlockedBy %}- **Blocked by**: {% for cause in implementationPlanning.planBodyVerification.gateBlockedBy %}`{{ cause }}`{% if not loop.last %}, {% endif %}{% endfor %}
 {% endif %}
 > {{ t("implementationPlanning.planBodyGateLegend") }}

package/runtime/templates/reports/final-verification-input.template.md

@@ -45,11 +45,11 @@ taskType: "{{FM_TASK_TYPE}}"
 ## Requirement Coverage Source
 
 - Approved implementation-planning report path:
-- Requirement source used for coverage (plan section / brief Acceptance Criteria):
+- Requirement source used for coverage (plan section / brief end-state items):
 - Requirement IDs / acceptance IDs to verify:
 - Requirements intentionally excluded from this verification:
 
-> final-verification MUST cite an artifact in Validation Evidence for each requirement / acceptance id in the source above. If the source is empty, use the brief's `## Acceptance Criteria` as the default source.
+> final-verification MUST cite an artifact in Validation Evidence for each requirement / acceptance id in the source above. If the source is empty, use the brief's `## Expected Behavior` / `## Expected Outcome` items as the default source.
 
 ## Verification Evidence
 
@@ -69,6 +69,8 @@ taskType: "{{FM_TASK_TYPE}}"
 
 ## Acceptance Criteria
 
+<!-- This is the verification run's own acceptance input, not the brief's end-state sections. Seed it from the brief's `EB-NNN` / `EO-NNN` items. -->
+
 - Must-pass acceptance points:
 - Optional quality improvements:
 - Conditions that should block release:

package/runtime/templates/reports/i18n/en.json

@@ -18,7 +18,8 @@
     "discrepancy": "- None.",
     "lingeringRisks": "- No tracked lingering risks.",
     "noClarification": "- No additional information requested. The Section 7 verdict stands as-is.",
-    "noFollowUp": "- No follow-up tasks. The next phase for this run is in §3 (Recommended Next Steps)."
+    "noFollowUp": "- No follow-up tasks. The next phase for this run is in §3 (Recommended Next Steps).",
+    "endStateCoverage": "No end-state coverage recorded for this phase."
   },
   "columns": {
     "recordMeta": "Record",
@@ -28,7 +29,11 @@
     "billableTokens": "Billable tokens",
     "billableTokensInputEquiv": "Billable tokens (input-equiv.)",
     "cost": "Cost (USD)",
-    "checkMethod": "How to check"
+    "checkMethod": "How to check",
+    "disposition": "Disposition",
+    "coveredBy": "Covered by",
+    "evidence": "Evidence",
+    "rationale": "Rationale"
   },
   "sectionAside": {
     "crossProjectDependencies": "Cross-Project Dependencies",
@@ -40,7 +45,8 @@
     "recommendedOption": "Recommended Option",
     "optionCandidates": "Option Candidates",
     "tradeOffMatrix": "Trade-off Matrix",
-    "stepwiseExecutionOrder": "Stepwise Execution Order"
+    "stepwiseExecutionOrder": "Stepwise Execution Order",
+    "endStateCoverage": "End State Coverage"
   },
   "sectionIntro": {
     "verdictCard": "At-a-glance verdict card — a summary that mirrors the values in `## 7. Final Verdict` and `## 3. Recommended Next Steps`.",
@@ -50,7 +56,8 @@
       "sourceItemsRule": "The `Source items` column shows which worker items each consensus row was synthesised from, as `<worker>:<item-id>` pairs.",
       "planBodyVerification": "Per-item cross-verification of each plan-body item (option, stage, step, dependency, validation, rollback, requirement coverage) for whether it is executable as written and internally consistent. Whether each option actually *solves* the problem (requirement satisfaction) is judged separately under Requirement Coverage, not here.",
       "clarificationItems": "Items that need your answer or supporting material before the next step.",
-      "readerSummary": "The shortest reader path: what was decided, what a human must do next, and which audit details can wait until a deeper review."
+      "readerSummary": "The shortest reader path: what was decided, what a human must do next, and which audit details can wait until a deeper review.",
+      "endStateCoverage": "One row per end-state id the brief pinned, and how this phase accounted for it. A row that is not `addressed` must say why."
     },
   "tokenSummary": {
     "heading": "Token Usage Summary",

package/runtime/templates/reports/i18n/ko.json

@@ -18,7 +18,8 @@
     "discrepancy": "- 없음.",
     "lingeringRisks": "- 추적 대상 잔존 위험 없음.",
     "noClarification": "- 추가 정보 요청 없음. Section 7 의 최종 판단이 그대로 유효합니다.",
-    "noFollowUp": "- 후속 작업 없음. 본 run 의 다음 phase 는 §3 (Recommended Next Steps) 참고."
+    "noFollowUp": "- 후속 작업 없음. 본 run 의 다음 phase 는 §3 (Recommended Next Steps) 참고.",
+    "endStateCoverage": "이번 phase 에 기록된 종료 상태 처리가 없습니다."
   },
   "columns": {
     "recordMeta": "항목",
@@ -28,7 +29,11 @@
     "billableTokens": "환산 토큰",
     "billableTokensInputEquiv": "환산 토큰 (input 기준)",
     "cost": "비용 (USD)",
-    "checkMethod": "확인 방법"
+    "checkMethod": "확인 방법",
+    "disposition": "처리",
+    "coveredBy": "처리 위치",
+    "evidence": "근거",
+    "rationale": "사유"
   },
   "sectionAside": {
     "crossProjectDependencies": "프로젝트 간 의존성",
@@ -40,7 +45,8 @@
     "recommendedOption": "권장 옵션",
     "optionCandidates": "옵션 후보",
     "tradeOffMatrix": "트레이드오프 매트릭스",
-    "stepwiseExecutionOrder": "단계별 실행 순서"
+    "stepwiseExecutionOrder": "단계별 실행 순서",
+    "endStateCoverage": "종료 상태 처리"
   },
   "sectionIntro": {
     "verdictCard": "한눈에 보는 결과 카드 — `## 7. Final Verdict` 와 `## 3. Recommended Next Steps` 의 값을 그대로 옮긴 요약입니다.",
@@ -50,7 +56,8 @@
       "sourceItemsRule": "`Source items` 열은 이 합의 항목이 어느 워커의 어느 항목에서 합성됐는지를 `<worker>:<item-id>` 형식으로 표기합니다.",
       "planBodyVerification": "계획 본문의 각 항목(옵션·스테이지·스텝·의존성·검증·롤백·요구사항 커버리지)이 적힌 대로 실행 가능하고 서로 모순이 없는지 워커들이 항목별로 교차 검증한 결과입니다. 각 옵션이 '문제를 실제로 푸는지'(요구사항 충족)는 여기가 아니라 Requirement Coverage 에서 별도로 판정합니다.",
       "clarificationItems": "다음 진행 전에 사용자의 답변이나 자료 첨부가 필요한 항목입니다.",
-      "readerSummary": "가장 짧은 읽기 경로입니다. 무엇이 결정됐는지, 사람이 다음에 무엇을 해야 하는지, 어떤 감사 세부사항은 나중에 봐도 되는지 먼저 보여줍니다."
+      "readerSummary": "가장 짧은 읽기 경로입니다. 무엇이 결정됐는지, 사람이 다음에 무엇을 해야 하는지, 어떤 감사 세부사항은 나중에 봐도 되는지 먼저 보여줍니다.",
+      "endStateCoverage": "브리프가 고정한 종료 상태 id 별로 이번 phase 가 어떻게 처리했는지 기록합니다. `addressed` 가 아닌 행은 사유가 있어야 합니다."
     },
   "tokenSummary": {
     "heading": "토큰 사용량 요약",

package/runtime/templates/reports/improvement-discovery-input.template.md

@@ -62,8 +62,8 @@ Workers MUST read the resolved values from the log the lead points to via the
 
 ## Improvement Candidates (workers populate this)
 
-| Cand ID | Lens | Title | Scope | Severity | Effort | Consensus | Source workers | Recommended next-phase | Evidence |
-|---------|------|-------|-------|----------|--------|-----------|----------------|------------------------|----------|
+| Cand ID | Lens | Title | Scope | Severity | Effort | Consensus | Source workers | Recommended next-phase | Expected behavior after | Evidence |
+|---------|------|-------|-------|----------|--------|-----------|----------------|------------------------|-------------------------|----------|
 
 ## Questions for Analysers
 

package/runtime/validators/validate-brief.py

@@ -37,6 +37,11 @@ Checks performed per brief file:
     columns and relation/direction values from the okstra-brief-gen contract.
 13. The requirement/objective section `## Desired Outcome` (required in every
     brief variant) exists and its body is not blank. `_(none)_` stays valid.
+14. The end-state sections `## Expected Behavior` (EB-NNN) / `## Preserved
+    Behavior` (PB-NNN) / `## Expected Outcome` (EO-NNN): each item carries a
+    3-digit id and an `— verify: <how>` observation method, EB/EO are rejected
+    in the codebase-scan variant, and `## External Gates` — the destination for
+    an item with no observation method — is required in every variant.
 
 Exit code 0 on PASS, 1 on FAIL.
 """
@@ -426,42 +431,182 @@ def check_requirement_section(text: str, errors: list[str]) -> None:
         )
 
 
-# Splitting the source checklist across these two sections is what keeps a
-# person-owned gate ("validated in staging by <name>") out of the requirement
-# set. Both must exist even when empty, because a missing heading is
-# indistinguishable from "the reporter listed no gates" — and the silent
-# version of that mistake is what puts an unmeetable requirement into
-# Requirement Coverage.
-SCOPE_SPLIT_SECTIONS = ("Acceptance Criteria", "External Gates")
+# The brief pins the end state once; every later phase maps to it by id rather
+# than restating a goal of its own. Splitting behavior from outcome is what lets
+# a refactor say "nothing observable changes" without leaving the upper bound
+# blank — `Preserved Behavior` carries the bound that `Expected Behavior` can't.
+_END_STATE_SECTIONS = (
+    ("Expected Behavior", "EB"),
+    ("Preserved Behavior", "PB"),
+    ("Expected Outcome", "EO"),
+)
+# The destination for a must-pass point nobody can hand an observation method.
+# It is enforced here rather than in ALWAYS_REQUIRED_SECTIONS so the failure can
+# still say WHY the section exists: a generic "required section missing" gives
+# the reporter no way to tell a gate apart from an end state.
+_GATE_SECTION = "External Gates"
+_END_STATE_ID_RE = re.compile(r"^(?P<id>(?:EB|PB|EO)-\d{3})\b")
+# Mirrors the `[—-]` tolerance in scripts/okstra_ctl/scope_provenance.py so a
+# reporter who cannot type an em dash is not silently rejected.
+_VERIFY_RE = re.compile(r"[—-]{1,2}\s*verify:\s*(?P<how>\S.*)$")
+_SCAN_ONLY_PREFIXES = frozenset({"EB", "EO"})
+
+
+def _has_bullet(body: str) -> bool:
+    return any(line.strip().startswith("- ") for line in body.splitlines())
+
+
+def _declares_nothing(body: str) -> bool:
+    """True when the body is the contract's explicit empty marker and nothing else.
+
+    `_(none)_` is written bare in every other brief section — `is_placeholder`
+    accepts both the bare and the `- ` form, and the template tells the reporter
+    to "use _(none)_ if none". Demanding a dash here alone would reject the house
+    form, and the message that fires would tell the author to write the very
+    thing they wrote.
+    """
+    lines = [line.strip() for line in body.splitlines() if line.strip()]
+    return bool(lines) and all(is_placeholder(line) for line in lines)
 
 
-def check_scope_split_sections(text: str, errors: list[str]) -> None:
-    """Both halves of the requirement/gate split must exist with a body.
+def _check_gate_section(text: str, errors: list[str]) -> None:
+    if not has_section_heading(text, _GATE_SECTION):
+        errors.append(
+            f"required section '## {_GATE_SECTION}' is missing — it is where a "
+            "must-pass point that a person or live infrastructure owns goes. "
+            "Without it, an item okstra cannot satisfy has nowhere to land but "
+            "the end-state sections, and the plan is then forced to build a "
+            "stage for work no phase can do"
+        )
+        return
+    if not section_body(text, _GATE_SECTION).strip():
+        errors.append(
+            f"required section '## {_GATE_SECTION}' has an empty body "
+            "(use _(none)_ only for a deliberately-empty section)"
+        )
+
 
-    `## Acceptance Criteria` holds must-pass points an okstra phase can satisfy
-    by changing repository files; `## External Gates` holds the ones a person or
-    live infrastructure owns (okstra-brief-gen SKILL.md §"Splitting a source
-    checklist"). `_(none)_` stays valid — it is the contract's explicit
-    placeholder for a deliberately-empty section.
-    """
-    for heading in SCOPE_SPLIT_SECTIONS:
-        if not has_section_heading(text, heading):
+def _check_end_state_items(
+    text: str, heading: str, prefix: str, seen: set[str], errors: list[str]
+) -> None:
+    for bullet in meaningful_bullets(text, heading):
+        match = _END_STATE_ID_RE.match(bullet)
+        if match is None or not match.group("id").startswith(f"{prefix}-"):
             errors.append(
-                f"required section '## {heading}' is missing (a brief must split "
-                "must-pass points into repo-satisfiable criteria and "
-                "person/infrastructure-owned gates)"
+                f"'## {heading}' item {bullet!r} must start with a `{prefix}-NNN` id "
+                "(3 digits) — later phases map to the brief by id, not by heading"
             )
             continue
-        if not section_body(text, heading).strip():
+        item_id = match.group("id")
+        if item_id in seen:
+            errors.append(f"duplicate end-state id {item_id!r}")
+        seen.add(item_id)
+        if not _VERIFY_RE.search(bullet):
             errors.append(
-                f"required section '## {heading}' has an empty body "
-                "(use _(none)_ only for a deliberately-empty section)"
+                f"end-state item {item_id!r} has no observation method — append "
+                "`— verify: <command or observation point>`. An item nobody can "
+                "observe is not an end state. It has two destinations, both of "
+                f"which keep it in the brief: '## {_GATE_SECTION}' when a person "
+                "or live infrastructure owns it, or '## Open Questions' as a "
+                "`general:` row when the observation method is what is still "
+                "unknown. Deleting it is not one of them."
+            )
+
+
+def _check_one_end_state_section(
+    text: str, heading: str, prefix: str, scope: str, seen: set[str], errors: list[str]
+) -> None:
+    """One end-state section: whether it may exist here, its body shape, its items.
+
+    A codebase-scan brief is authored before anything has been found, so it can
+    only pin what must NOT change. Declaring an expected behavior there would be
+    an invented requirement, which is why EB/EO are rejected rather than treated
+    as optional — and why `_(none)_` is rejected for the one section that
+    survives there: it is the whole upper bound of that variant.
+    """
+    if scope == "codebase" and prefix in _SCAN_ONLY_PREFIXES:
+        if has_section_heading(text, heading):
+            errors.append(
+                f"section '## {heading}' is not allowed in a codebase-scan brief "
+                "(the scan has not run yet, so its outcome cannot be declared) — "
+                "use '## Preserved Behavior' for what must not change"
+            )
+        return
+    if not has_section_heading(text, heading):
+        errors.append(
+            f"required section '## {heading}' is missing (the brief pins the "
+            "end state that every later phase maps to)"
+        )
+        return
+    body = section_body(text, heading)
+    if not body.strip():
+        errors.append(
+            f"required section '## {heading}' has an empty body "
+            "(use _(none)_ only for a deliberately-empty section)"
+        )
+        return
+    if _declares_nothing(body):
+        # In a scan this is the only section left, so an empty marker here is
+        # not "deliberately empty" — it is a brief with no upper bound at all,
+        # which is what improvement-discovery reads as its bound.
+        if scope == "codebase":
+            errors.append(
+                f"'## {heading}' is _(none)_ in a codebase-scan brief. It is the "
+                "only end-state section this variant carries, and "
+                "improvement-discovery treats it as the bound on what a "
+                "candidate may change — an empty one bounds nothing. State at "
+                "least one behaviour no candidate from this scan may break"
             )
+        return
+    # Only `- ` lines are read as items, so prose here is silently dropped
+    # rather than rejected — the reporter believes they pinned an end state
+    # and every downstream phase sees a section that declared nothing.
+    if not _has_bullet(body):
+        errors.append(
+            f"'## {heading}' has a body but no `- ` item — prose in this "
+            "section is dropped, not read. Every end state is a "
+            f"`- {prefix}-NNN <condition> — verify: <how>` bullet; write "
+            "_(none)_ on its own line if the section is deliberately empty"
+        )
+        return
+    _check_end_state_items(text, heading, prefix, seen, errors)
+
+
+def _check_end_state_declared(text: str, errors: list[str]) -> None:
+    """A reporter-input brief declares at least one observable end state."""
+    if meaningful_bullets(text, "Expected Behavior") or meaningful_bullets(
+        text, "Expected Outcome"
+    ):
+        return
+    errors.append(
+        "'## Expected Behavior' and '## Expected Outcome' are both empty — a brief "
+        "must declare at least one observable end state. A pure bugfix may leave "
+        "Expected Outcome as _(none)_ and a pure refactor may leave Expected "
+        "Behavior as _(none)_, but not both. If every must-pass point you have is "
+        f"owned by a person ('## {_GATE_SECTION}') or still lacks an observation "
+        "method ('## Open Questions'), this brief is not ready to start a run — "
+        "answer the open question first rather than emptying the end state"
+    )
+
+
+def check_end_state_sections(text: str, scope: str, errors: list[str]) -> None:
+    """The brief's end state: expected behavior, preserved behavior, expected outcome.
+
+    `## External Gates` is checked here too, in every variant: it is where an
+    item with no observation method goes, so the admissible set and its overflow
+    have to be required by the same check or the overflow silently disappears.
+    """
+    _check_gate_section(text, errors)
+    seen: set[str] = set()
+    for heading, prefix in _END_STATE_SECTIONS:
+        _check_one_end_state_section(text, heading, prefix, scope, seen, errors)
+    if scope != "codebase":
+        _check_end_state_declared(text, errors)
 
 
 # The variant-independent rows of the skill's "Required sections by variant"
-# table (okstra-brief-gen SKILL.md). Desired Outcome and the Acceptance
-# Criteria / External Gates split have dedicated checks with richer messages;
+# table (okstra-brief-gen SKILL.md). Desired Outcome and the end-state
+# sections / External Gates have dedicated checks with richer messages;
 # Scan Scope / Priority Lenses are codebase-only (check_codebase_scope);
 # Source Material / Problem / Symptom are omitted by the codebase variant, so
 # they are enforced only off it.
@@ -563,7 +708,7 @@ def validate_brief(path: Path, briefs_root: Path) -> list[str]:
     check_related_task_graph(text, errors)
 
     check_requirement_section(text, errors)
-    check_scope_split_sections(text, errors)
+    check_end_state_sections(text, scope, errors)
     check_variant_required_sections(text, scope, errors)
 
     # 2. brief-id matches filename stem