projectstore-claude 0.30.14 → 0.30.16

package/node_modules/projectstore/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "projectstore",
       "displayName": "projectstore",
       "description": "📚 Your agent runs the project through a verified loop: task → artifact (ADR · spec · epic · story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in an Obsidian-friendly vault, every write approved by you — and any model can pick the project up tomorrow.",
-      "version": "0.30.14",
+      "version": "0.30.16",
       "author": {
         "name": "Evgenii Konev",
         "email": "ekonev@smartandpoint.com",

package/node_modules/projectstore/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "projectstore",
   "displayName": "projectstore",
-  "version": "0.30.14",
+  "version": "0.30.16",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "author": {
     "name": "Evgenii Konev @ SmartAndPoint",

package/node_modules/projectstore/README.md

@@ -242,6 +242,11 @@ Each setting has exactly one writer, and the plan says which file it changes:
 - **The agents' models and efforts** live in `.projectstore/harness/<harness>.json`. That file is committed, so a change there is a team change.
 - **The status line, the band, the language and the other binding keys** live in `.projectstore/projectstore.json`, which stays on this machine.
 - **The spec policy and the lifecycle gates** live in the vault's `.projectstore.json`, which commits with the vault. Setting `spec_policy=required` records when it took effect; stories closed before then are exempt. A story whose work needs no spec can say why in `no_spec`, and `doctor --vault --policy required` shows what the policy would report before you switch it on. A spec's contracts can carry WHEN/THEN scenarios, and a test can cite a contract, so doctor can report the contracts no test covers: see [`docs/contracts-and-tests.md`](./docs/contracts-and-tests.md).
+- **The flow policy** lives there too, under `flow`: each person's time on the project and so their WIP limit, how long work may sit in a status, and the windows for throughput and capacity. No key has a default, so a check whose key is not set does not run. People are named as stories write their assignee, never by email address, and their names, time shares and leave dates commit with the vault. These keys are set with `--set` only; the view names each form. For example:
+
+```bash
+npx projectstore configure --set flow.wip.full=3 --set 'flow.people[First Last].time=part'
+```
 
 The vault itself is changed by `bind --rebind`, which configure names when asked. In a Claude Code session, `/projectstore:statusline` and `/projectstore:agents configure` run the same writers.
 

package/node_modules/projectstore/agents/planner.md

@@ -44,7 +44,10 @@ spec, say so FIRST — under spec-first the spec must exist and be `active`
 before implementation starts (suggest `/projectstore:spec`). Routing rule:
 spec contracts = durable how; the story's `## Implementation Plan` = per-story
 route (your output feeds it via `/projectstore:story plan`); `## Technical
-Notes` = incidental constraints discovered during work.
+Notes` = incidental constraints discovered during work. When the story changes
+a covering spec's contracts, name each contract it will amend and the marker's
+kind (`ADDED`, `MODIFIED` or `REMOVED`, in a `> amended YYYY-MM-DD by <ref>: …`
+block under the contract; `guide spec` has the rules).
 
 **Spec or no spec.** When the story has no covering spec, say whether it
 needs one, and why. Work whose "how" is non-trivial, or that will touch three

package/node_modules/projectstore/agents/reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: reviewer
-description: Opus (max-effort) STORY-CONFORMANCE reviewer for projectstore-bound projects — a narrow, vault-aware role, NOT a general code reviewer. Invoke AFTER writing code, BEFORE committing or marking a story done. Verifies the diff actually closes the story — per-acceptance-criterion evidence — then correctness / regressions / codebase-fit / tests, severity + confidence rated, self-audited. Proposes the story's code_refs update. Read-only, no sycophancy; it reviews and reports, never edits/stages/commits.
+description: Opus (max-effort) STORY-CONFORMANCE reviewer for projectstore-bound projects — a narrow, vault-aware role, NOT a general code reviewer. Invoke AFTER writing code, BEFORE committing or marking a story done. Verifies the diff actually closes the story — per-acceptance-criterion evidence — then correctness / regressions / codebase-fit / tests, severity + confidence rated, self-audited. Proposes the story's code_refs update. Asked for spec drift on a named active spec, it checks that spec's contracts against its covered stories' code_refs instead and reports, per contract, holds / drifted / cannot tell. Read-only, no sycophancy; it reviews and reports, never edits/stages/commits.
 model: opus
 effort: max
 tools: Read, Grep, Glob, Bash, WebFetch
@@ -11,6 +11,11 @@ context, separate from the author — so a false "looks good" can't slip through
 self-approval. A false approval costs far more than a false rejection: a story
 marked done that isn't closed is exactly the vault-rot this role exists to stop.
 
+**Which job.** Given a diff or a story, you check story conformance:
+everything in this file except the Spec-drift mode section. Asked for spec
+drift on a named spec, you run the Spec-drift mode section instead; its own
+report replaces the Output section's verdict and acceptance matrix.
+
 Inspect everything yourself: `git status`, `git diff`, `git diff --staged`, and
 read the changed files in FULL context (not just the hunks). Locate the bound
 vault (`.projectstore/projectstore.json` → `vault_path`) and read the target story —
@@ -37,7 +42,10 @@ covering spec: its Acceptance items attributed to this story (`— stories:
 verify them exactly like the story's own criteria. A story closes only when
 both sets are green and every covering spec is `active`. Report a covering
 spec still in `draft` as a blocker under `spec_policy: required` (vault's
-`.projectstore.json`).
+`.projectstore.json`). When the story edited a spec's contracts, check that
+each edit carries an amendment marker (`> amended YYYY-MM-DD by <ref>: <KIND> —
+<why>` under the contract): from the vault's git history when the vault has
+one, else from the story's own account; an unmarked edit is a finding.
 
 **A declared opt-out, at close.** A story with `no_spec: "<reason>"` has no
 covering spec on purpose. Compute its files (Output 4). If it touches three
@@ -57,6 +65,73 @@ which). With neither, that is a 🟡 should-fix, never a 🔴: the line is a hin
 not a gate, and it never holds a story open. With no line, or only its
 placeholder, say nothing about it.
 
+## Spec-drift mode
+Only when the caller asks for spec drift on a named spec. You check that spec
+against the code, one spec per run. Phases 0 to 2 and the Output section are
+the story-conformance job and do not apply; "Discovery ≠ filtering" and the
+Self-audit do.
+
+1. **Input.** Run
+   `node "${CLAUDE_PLUGIN_ROOT}/scripts/spec-drift.mjs" <spec id, alias or file stem>`,
+   with `--since <date>` when the caller names one (it overrides every
+   anchor). It prints facts as JSON: the contracts with their markers (each
+   with its story's status), removed state and anchor (the date of the
+   contract's last valid marker, else the spec's `date:`); the covered
+   stories with their status and `code_refs`, empty and missing refs listed;
+   the refs expanded to files classed `source`, `tests` or `surface`, with
+   line counts and the commits since each anchor (`changed_since`: a count
+   and the last three); the files citing each contract (`cited_by`, tests
+   normally); and the
+   scan status, `ok`, `no-git` or `unknown`. A null is unknown, not empty. A
+   spec that is not `active` is refused with exit 1: report its status and
+   stop. History is a hint: an empty one is no evidence that a contract holds.
+2. **Budget.** The report states the input size: files and lines by class,
+   and the number of contracts. When the spec has more contracts that are not
+   removed (`totals.contracts_open`) than the caller's budget, 8 when none is
+   named, return the size and the contract list (number and heading), ask
+   your caller for contract numbers and give no verdict. Given numbers (up to
+   the budget), judge those and list the rest as `not checked`.
+3. **Reading.** Pre-commit to the two or three contracts whose covered files
+   changed most since their anchor (`files_changed`, `changed_since`) and hunt
+   those first. Read by symbol: search for the function, flag, command, path
+   or token a contract names, in `source` and `surface` files alike, and read
+   around each hit; a whole file only when the contract is about all of it.
+4. **Verdicts**, one per contract judged:
+   - `holds`: a line of code, quoted verbatim with its file:line, produces the
+     contract's outcome. A line outside the bundle's files is marked
+     `(outside the bundle)`. A `holds` without a quoted line is `cannot tell`.
+   - `drifted`: the code contradicts the contract as written, a named file,
+     command or token that is gone included. Cite the contradicting line or,
+     for something missing, the search that found nothing.
+   - `cannot tell`, with its reason, such as: no covered code, a rule about
+     people or prose, a `(verified: live|manual)` contract no line can show
+     (`verified` in the bundle), a scan status of `unknown`, or code read that
+     settles nothing. When the code a contract asks for is not found and the
+     story behind its last marker has not reached `review`, the verdict is
+     `cannot tell (pending)`. A contract amended by a story in `review` or
+     `done` is judged as usual.
+   - A removed contract is listed as `removed` and not judged.
+5. **Proposals.** Each `drifted` comes with a proposal and a lean: a marker
+   carried by an open story, a new story that brings the spec to the code, or
+   a follow-up story that brings the code back; never a closed story. Each
+   goes through the normal approval-gated commands, run by the caller.
+6. **Facts, not drift.** Empty or missing `code_refs` (`refs.empty`,
+   `refs.missing`, `refs.unresolved`) and uncited contracts (`cited_by: []`)
+   are listed as facts, not drift; so are doctor's `code-refs` and
+   `contract-coverage` findings.
+7. **Report**, your last message, in place of the Output section:
+   1. **Input** — the spec (title, id, status), the bundle's `checkout`, the scan status, files and
+      lines by class, contracts judged, `not checked` and removed, and
+      `--since` when given.
+   2. **Contracts** — one row per contract: number, heading, verdict and its
+      evidence (the quoted line with file:line, the contradicting line or the
+      empty search, or the reason).
+   3. **Drift proposals** — for each `drifted`: the proposal, the lean and why.
+   4. **Facts** — empty and missing refs, uncited contracts, unknown history.
+   5. **Open Questions** — low-confidence verdicts, surfaced not blocking.
+
+   You write nothing in this mode: no vault file, no code, no story.
+
 ## Phase 0 — Pre-commitment
 From the story + file list, predict the 3-5 most likely gaps ("AC #3 needs an
 error path the diff doesn't touch"; "touches a cache — invalidation risk"). Write

package/node_modules/projectstore/commands/doctor.md

@@ -194,6 +194,17 @@ You are running projectstore diagnostics (ADR-005: umbrella doctor).
   gates that have no date, `review-by` names an ADR due for review, and
   `dry-run` heads a `--policy` report. None of them is repairable by `--fix`:
   each is a judgement, or a `configure` step its message names.
+- The amendment checks read the markers under a spec's contracts
+  (`> amended YYYY-MM-DD by <ref>: ADDED|MODIFIED|REMOVED — <why>`) in every
+  spec, under every policy: `amendment-form` (a marker that is not the grammar,
+  comes before the first contract or after a `REMOVED`; it counts for
+  nothing), `amendment-story` (an issue: the ref names no single story),
+  `amendment-link` (neither the story nor the spec lists the other) and
+  `amendment-date` (not a date, before the spec's `date:`, after tomorrow, or
+  before the previous marker under that contract). `citation-removed` is a
+  token in the project that cites a removed contract or step, with the why of
+  its marker. None of them is repairable by `--fix`: the marker and the test
+  are the author's text.
 - The guide checks read the vault's `guides/` folder, the per-kind overrides
   of the authoring guides: `guide-shape` (an override that does not parse, so
   readers fall back to the package default), `guide-unknown` (a guide for a

package/node_modules/projectstore/commands/graph.md

@@ -51,6 +51,10 @@ vault-link-graph-derived-view-and-shared-link-resolver).
   artifact's full typed neighborhood — outgoing AND incoming edges — in one
   call. Node keys are full vault-relative paths, never short names.
 - Edge kinds: wikilink, mdlink, supersedes, spec-covers, spec-implements-adr,
-  epic-contains, dead, ambiguous, out-of-scope. Nothing resolves silently.
+  epic-contains, amends, dead, ambiguous, out-of-scope. Nothing resolves
+  silently. `amends` runs from a story to a spec one of its amendment markers
+  (`> amended YYYY-MM-DD by <ref>: <KIND> — <why>` under a contract) changes:
+  one edge per pair; a marker whose ref resolves to no story is a `dead` edge
+  from the spec.
 - Hand-edits to graph.md never stick: doctor flags staleness, reconcile
   repairs. Fix the source artifact, then regenerate.

package/node_modules/projectstore/commands/story.md

@@ -118,7 +118,10 @@ the two cannot collide).
    today's date, then one bullet per question with its answer; a later plan
    run appends its own dated line to the same subsection. An answer that changes a
    contract of the covering spec says which one, and the spec is amended
-   the way it records its other amendments before the code is written.
+   before the code is written: that contract's body is rewritten to the text
+   in force, with a marker under it,
+   `> amended YYYY-MM-DD by <EPIC-ID>/<story-id>: ADDED|MODIFIED|REMOVED — <why>`
+   (see `guide spec`).
 
 3. **Fill the section content** in the returned `content` before preview:
    - `plan` — write the Implementation Plan. When the story's `specs:` names a

package/node_modules/projectstore/docs/contracts-and-tests.md

@@ -7,7 +7,9 @@ policy, revised: contract scenarios and test citations that doctor counts,
 and a declared per-story opt-out from a spec*, and decisions 6 and 7 of the
 ADR *One authoring guide per artifact kind, read by the author before the
 draft and by the critic after, overridable from the vault* (edge and failure
-marks, and test stories).
+marks, and test stories), and the ADR *An active spec is amended by a marked
+block under the contract, naming the story, the date and the kind, which
+doctor checks and the graph draws* (amendment markers).
 
 All of it is optional. A spec without scenarios, and a test without a
 citation, stay valid.
@@ -171,6 +173,91 @@ Two specs may not share an alias, and an alias may not be another spec's id.
 A citation is a claim: the reviewer checks that a cited test asserts the
 contract's outcome. An empty test with a token is a review finding.
 
+## Amending a contract
+
+A later story that changes a contract of an active spec rewrites the
+contract's body to the text in force and puts a marker under it: a
+blockquote after the contract and before the next one, whose first paragraph
+reads
+
+```markdown
+4. **Exports.** The export runs nightly and keeps seven copies.
+
+   > amended 2026-11-10 by example/story-keep-seven: MODIFIED — seven copies, not three.
+   >
+   > Replaced:
+   >
+   > > keeps three copies
+```
+
+- `amended`, `by`, the kind and `Removed, see below.` stay English in every
+  locale. The ref is any form a spec's `stories:` entry takes
+  (`EPIC-ID/<story-id>`, the story part a short id or the full slug; a ref
+  without `EPIC-ID/` resolves to no story). The colon may be `:` or `：`, the
+  dash `—`, `–` or `-`. A marker may wrap: its first paragraph is read with
+  its lines joined.
+- `MODIFIED`: the body holds the new text; the block quotes what it replaced
+  and why. A step keeps its number: a removed step stays as
+  `2. Removed, see below.`, a new step takes the list's next number.
+- `ADDED`: a new contract takes the highest number in the file, removed ones
+  included, plus one. A number is never reused.
+- `REMOVED`: the contract keeps its number and its heading, and its body
+  becomes `Removed, see below.` This is a tombstone. Nothing follows a
+  `REMOVED` marker; a rule that comes back is `ADDED` under a new number.
+- The story and the spec list each other: the story in the spec's
+  `stories:`, the spec in the story's `specs:`. The amending story is a
+  covered story.
+- Markers inside a fence or an HTML comment do not count, and neither does a
+  marker whose ref starts with `example/` (it is documentation, like the one
+  above). Older `> *Amended …` blocks are not read; the first marker under a
+  contract folds them into the body and quotes them inside its own block.
+
+A tombstone stays forever, so a citation keeps its meaning: a test that
+still cites `[example#4]` after contract 4 was removed is reported as
+`citation-removed`, with the marker's why, and the removed contract leaves
+the coverage count. Evidence in a closed story that names it is not
+reported. `graph.md` and `lineage` show an `amends` edge from the story to
+the spec.
+
+## Checking a spec against the code
+
+A spec can drift from the code after its stories close: a later story
+changes the behaviour without a marker, or the code changes outside any
+story. Ask the reviewer for spec drift on a named spec, and it checks that
+spec against the code at its covered stories' `code_refs`. Run it when the
+covered code changed since the contracts' last markers, not before every
+release.
+
+The reviewer reads a bundle of facts first:
+
+```bash
+node scripts/spec-drift.mjs example --since 2026-11-01
+```
+
+It prints JSON: each contract with its markers, removed state and anchor
+(the date of its last marker, else the spec's `date:`; `--since` overrides
+it), the tests that cite it as `[example#2]`, the covered stories and their
+`code_refs` (empty and missing ones listed), the files those refs name with
+their class (`source`, `tests` or `surface`), line counts and commits since
+each anchor, and a scan status: `ok`, `no-git` or `unknown`. A spec that is
+not `active` exits 1.
+
+The reviewer judges up to eight contracts per run unless you name another
+budget. A spec with more asks you for contract numbers first. Each contract
+judged gets one verdict:
+
+| Verdict | Means |
+|---|---|
+| `holds` | A line of code, quoted with its file:line, produces the contract's outcome |
+| `drifted` | The code contradicts the contract, or a file, command or token it names is gone; the report cites the line, or the search that found nothing |
+| `cannot tell` | With a reason: no covered code, a rule about people, a live or manual contract, an unknown scan; `cannot tell (pending)` when the code is missing and the story behind the last marker has not reached review |
+
+Each drift comes with a proposal: a marker carried by an open story, a new
+story that brings the spec to the code, or a follow-up story that brings the
+code back. Empty `code_refs` and uncited contracts are listed as facts, not
+drift. The reviewer writes nothing; every change goes through the usual
+approval-gated commands.
+
 ## What doctor reports
 
 Doctor (`--vault`) scans the bound project with `git grep --untracked`, so a
@@ -182,11 +269,16 @@ skipped. Tests outside the bound project, or in a submodule, are not seen.
 |---|---|---|
 | `contract-coverage` | info | One line per active spec. With no citation: "N contracts, 0 cited". Once a spec has a citation, or sets `coverage: report` in its frontmatter: the contracts no test cites |
 | `citation-unknown` | warn | A token whose key is no spec's id or alias, or whose number is not a contract of that spec |
+| `citation-removed` | warn | A token that cites a removed contract, or a step that reads `Removed, see below.`; the message quotes the marker's why |
 | `citation-superseded` | info | A token that cites a superseded spec |
 | `scenario-shape` | info | A scenario without a WHEN/GIVEN or a THEN |
 | `contract-happy-path-only` | info | One line per active spec: the contracts that carry scenarios and have none marked `(edge)` or `(failure)` |
 | `spec-alias` | issue | A duplicate alias, an alias equal to another spec's id, or the reserved `example` |
-| `evidence-citation` | warn | Under `lifecycle_gates: on`: a story's evidence names a token that no file in the project carries |
+| `evidence-citation` | warn | Under `lifecycle_gates: on`: a story's evidence names a token that no file in the project carries (a removed contract is skipped) |
+| `amendment-form` | warn | A blockquote under the contracts that starts `amended <date> by` but is not the grammar, comes before the first contract, or follows a `REMOVED`; it counts for nothing |
+| `amendment-story` | issue | A marker's ref names no story, or more than one |
+| `amendment-link` | warn | Neither the marker's story nor the spec lists the other (one side only is `spec-links`) |
+| `amendment-date` | warn | A marker's date is not a date, is before the spec's `date:`, after tomorrow, or before the previous marker under the same contract |
 
 Each report names the checkout it read. A worktree on an old branch, or a
 second project bound to the same vault, can see different coverage.

package/node_modules/projectstore/docs/extending.md

@@ -222,6 +222,16 @@ each key activates.
     warn.
 - `doctor --vault --policy required[@<date>]` shows what `required` would
   report, without writing anything.
+- `flow` holds the team's flow policy: `wip.full` and `wip.part`, a
+  `people` map from each assignee's name to `time` (`full` or `part`), an
+  optional own `wip`, `git_names` and `left`, ages in days under `age_days`,
+  and `idle_days`, `window_weeks`, `capacity_weeks` (`[low, high]`),
+  `active_epics_max` and `grooming_days`. `groomed_at` is a stamp. No key has
+  a default in code, and a value of the wrong type counts as absent. A
+  person's WIP limit is their own `wip`, else `wip.<time>`, else none
+  (`wipLimitOf` in `scripts/flow-policy.mjs`). `configure --set` writes these
+  keys and merges them into the block, keeping the rest. Names are the
+  assignee as stories write it, never an email address.
 
 ## Contributing back
 

package/node_modules/projectstore/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projectstore",
-  "version": "0.30.14",
+  "version": "0.30.16",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "keywords": [
     "project-management",

package/node_modules/projectstore/scaffold/guides/spec.md

@@ -1,6 +1,6 @@
 ---
 guide_for: spec
-guide_version: 1
+guide_version: 2
 default_review: true
 ---
 
@@ -18,6 +18,10 @@ The systems analyst who writes the contract a test can be written from before th
 - Mandatory sections present (How we solve / Behavioral contracts / Acceptance); Modules-on-disk and Testing may be omitted only for research spikes.
 - For a spike spec: contracts read as questions-to-answer plus exit criteria.
 - No TODOs, no '...', no empty bullets in the final body.
+- A change to an active spec's contract carries a marker under it, `> amended YYYY-MM-DD by <EPIC-ID>/<story-id>: ADDED|MODIFIED|REMOVED — <why>`; no new block is written in the older `> *Amended …` form.
+- No contract or step number is reused: ADDED takes the highest number in the file, removed contracts included, plus one; REMOVED keeps the number and heading with the body `Removed, see below.`, and a removed step stays as `N. Removed, see below.`
+- Under MODIFIED the body is rewritten to the text in force, and the block quotes the text it replaced; a change written only in the block, over an unchanged body, fails.
+- The first marker under a contract folds that contract's older blocks into the body without changing their meaning, and quotes them inside its own block.
 
 ## Common mistakes
 
@@ -36,4 +40,4 @@ The systems analyst who writes the contract a test can be written from before th
 
 ## Length
 
-A contract is one paragraph and at most six scenario items. A spec past twelve contracts or 400 lines covers two subsystems: split it.
+A contract is one paragraph and at most six scenario items. A spec past twelve contracts or 400 lines covers two subsystems: split it. Blocks under contracts (amendment markers and the text they quote) do not count toward this length.

package/node_modules/projectstore/scripts/configure-menu.mjs

@@ -174,6 +174,10 @@ export function menuGroups(f, settings, catalogs, { menu, now = Date.now, caps:
           "The vault's own rules, shared by everyone who uses the vault: whether a story needs a spec, and whether doctor checks a story's plan and close. Kept in the vault's .projectstore.json; commit the vault after a change.",
         items: list.map((s) => plainItem(f, s, null)),
       });
+    // The flow policy is `--set` only (the configure spec, contract 2 as
+    // amended 2026-11-10): the menu has no widget for a keyed list, and the
+    // view names each key's form. Skipped here on purpose, not forgotten.
+    else if (g === "flow") continue;
   }
   return groups;
 }

package/node_modules/projectstore/scripts/configure.mjs

@@ -31,7 +31,8 @@ import {
   fromTerminalIn,
   commandForm,
 } from "./lib.mjs";
-import { planBindingKeys, applyBindingKeys, languageNames } from "./binding.mjs";
+import { planBindingKeys, applyBindingKeys, languageNames, shellQuote } from "./binding.mjs";
+import { isFlowSet, parseFlowSet, flowRows, flowForm, blockedAt, flowAt } from "./flow-policy.mjs";
 import { bandKeys, epicIds, planBand, applyBand } from "./band.mjs";
 import { planAgentsChange, applyAgentsChange } from "./agents-change.mjs";
 import { plan as planInstall, apply as applyInstall, planOptions, isInteractive } from "./install-harness.mjs";
@@ -63,7 +64,13 @@ const parseBool = (v) => {
 };
 const onOff = (b) => (b === true ? "on" : b === false ? "off" : "not set");
 const shown = (v) =>
-  v === null || v === undefined || v === "" ? "—" : Array.isArray(v) ? v.join(", ") || "—" : String(v);
+  v === null || v === undefined || v === ""
+    ? "—"
+    : Array.isArray(v)
+      ? v.join(", ") || "—"
+      : typeof v === "object"
+        ? JSON.stringify(v)
+        : String(v);
 const tildeOf = (p, home) =>
   home && (p === home || String(p).startsWith(home + "/")) ? "~" + String(p).slice(home.length) : String(p);
 
@@ -265,6 +272,22 @@ export function settingsOf(f) {
       pol("spec_policy", v.spec_policy || "optional", "policy"),
       pol("lifecycle_gates", Object.hasOwn(v, "lifecycle_gates") ? String(v.lifecycle_gates) : "not set", "bool"),
     );
+    // The flow policy (contract 3 as amended 2026-11-10): its own group,
+    // listed only while a key is set, so a vault with no `flow` prints what it
+    // printed before. `--set` only: the menu shows none of these rows.
+    for (const r of f.vaultCfg && !f.vaultCfg.corrupt ? flowRows(v.flow) : [])
+      out.push({
+        group: "flow",
+        key: r.key,
+        value: r.value,
+        source: "vault_config",
+        file,
+        class: "changeable",
+        team: true,
+        writer: "vault",
+        rail: null,
+        person: r.person,
+      });
   }
   for (const s of out) s.set = setForm(s, f);
   return out;
@@ -273,6 +296,11 @@ export function settingsOf(f) {
 // The --set form a key is changed with, for the view and the envelope.
 function setForm(s, f) {
   if (s.class !== "changeable") return null;
+  if (s.group === "flow") {
+    const form = flowForm(s.key);
+    // A person's name may hold a space or a dot, and `[`…`]` globs in zsh.
+    return form && s.person !== null ? `--set ${shellQuote(form.slice("--set ".length))}` : form;
+  }
   const value =
     s.rail === "bool"
       ? "on|off"
@@ -301,6 +329,19 @@ export function resolveSets(f, sets, { harness = null, nearest = null } = {}) {
   const known = [...new Set(keys.map((s) => s.key))];
   const harnessesNamed = f.used.map((h) => h.display_name || h.id).join(", ") || "none";
   for (const raw of sets) {
+    // A flow key is parsed whole, before the split at the first `=`: a
+    // person's name may hold a dot (contract 2 as amended 2026-11-10).
+    if (isFlowSet(raw)) {
+      const vcfg = f.vaultCfg && !f.vaultCfg.corrupt ? f.vaultCfg.cfg : {};
+      const r = parseFlowSet(raw, { nearest, flow: vcfg.flow });
+      if (r.usage) return { usage: r.usage };
+      const { key, path, value } = r.change;
+      if (!f.vault) return { usage: `${key} lives in the vault's config, and this binding names no vault` };
+      if (seen.has(key)) return { usage: `${key} is named twice` };
+      seen.add(key);
+      out.push({ key, writer: "vault", path: ["flow", ...path], value });
+      continue;
+    }
     const at = String(raw).indexOf("=");
     if (at < 1) return { usage: `--set takes <key>=<value>, got ${raw}` };
     let key = String(raw).slice(0, at).trim();
@@ -464,20 +505,39 @@ export function planChanges(f, changes, { env = process.env, home = homedir(), r
       );
     const strict = readVaultConfigStrict(f.vault);
     if (strict.corrupt) return refuse(`${strict.path} is not valid JSON — fix or remove it first`);
-    const patch = Object.fromEntries(policy.map((c) => [c.key, c.value]));
+    // A flow change carries a path into the `flow` object; a node on it that
+    // exists and is not an object is never replaced (contract 11).
+    for (const c of policy.filter((c) => c.path)) {
+      const at = blockedAt(strict.cfg, c.path.slice(1));
+      if (at) return refuse(`${c.key}: ${at} is not an object — fix or remove it first`);
+    }
+    const patch = {};
+    for (const c of policy) {
+      const path = c.path || [c.key];
+      let node = patch;
+      for (const step of path.slice(0, -1)) node = Object.hasOwn(node, step) ? node[step] : (node[step] = {});
+      node[path[path.length - 1]] = c.value;
+    }
     const next = nextVaultConfig(strict.cfg, patch, new Date().toISOString());
+    const flowBefore = (c) => flowAt(strict.cfg.flow, c.path.slice(1)) ?? null;
     const inEffect = (k) => strict.cfg[k] ?? (k === "spec_policy" ? "optional" : undefined);
     // `lifecycle_gates=on` on a vault already on but with no gates_since is a
     // change: it stamps the date the gates count from (the configure spec,
     // contract 7 as amended 2026-11-08).
     const stampsGates = (c) => c.key === "lifecycle_gates" && c.value === "on" && !strict.cfg.gates_since;
-    const changed = policy.filter((c) => inEffect(c.key) !== c.value || stampsGates(c));
+    const changed = policy.filter((c) =>
+      c.path
+        ? JSON.stringify(flowBefore(c)) !== JSON.stringify(c.value)
+        : inEffect(c.key) !== c.value || stampsGates(c),
+    );
     for (const c of changed)
       items.push({
         key: c.key,
         file: tildeOf(strict.path, f.home),
-        before: shown(strict.cfg[c.key] ?? (c.key === "spec_policy" ? "optional" : "not set")),
-        after: shown(c.value),
+        before: c.path
+          ? shown(flowBefore(c) ?? "not set")
+          : shown(strict.cfg[c.key] ?? (c.key === "spec_policy" ? "optional" : "not set")),
+        after: shown(c.value ?? "not set"),
         team: true,
         note:
           c.key === "spec_policy" && next.spec_policy_since !== strict.cfg.spec_policy_since
@@ -486,7 +546,13 @@ export function planChanges(f, changes, { env = process.env, home = homedir(), r
               ? GATES_NOTE
               : null,
       });
-    if (changed.length) steps.push({ writer: "vault", patch, keys: changed.map((c) => c.key) });
+    if (changed.length)
+      steps.push({
+        writer: "vault",
+        patch,
+        keys: changed.map((c) => c.key),
+        flowPaths: policy.filter((c) => c.path).map((c) => c.path.slice(1)),
+      });
   }
 
   // The overlays: one agents change per harness, through the core
@@ -741,6 +807,12 @@ export function applyChanges(f, steps, { env = process.env, home = homedir(), ro
         // by every checkout, and a change made while the question waited is kept.
         const now = readVaultConfigStrict(f.vault);
         if (now.corrupt) throw new Error(`${now.path} stopped being valid JSON after the plan`);
+        // A flow path whose node stopped being an object since the PLAN is
+        // refused here too, never replaced (contract 11 as amended 2026-11-10).
+        for (const path of s.flowPaths || []) {
+          const at = blockedAt(now.cfg, path);
+          if (at) throw new Error(`${at} stopped being an object after the plan — fix or remove it first`);
+        }
         writeVaultConfig(f.vault, nextVaultConfig(now.cfg, s.patch, new Date().toISOString()));
         wrote.push(vaultConfigPath(f.vault));
       } else if (s.writer === "overlay") {
@@ -793,6 +865,7 @@ const GROUP_TITLES = (f) => ({
   surfaces: "Status line and band",
   vault: "Vault and templates",
   policy: "Policy",
+  flow: "Flow policy",
   ...Object.fromEntries(f.used.map((h) => [`agents:${h.id}`, `Agents · ${h.display_name || h.id}`])),
 });
 

package/node_modules/projectstore/scripts/diff-refs.mjs

@@ -103,6 +103,20 @@ export function grepProjectLines(cwd, pattern, { exclude = [], timeout = 10000,
   return { status: "ok", lines };
 }
 
+// The `--since` window git is given, shared with spec-drift.mjs.
+//
+// A bare YYYY-MM-DD gets midnight appended, and it is not cosmetic. Git's
+// approxidate reads a date with no time as THAT DATE AT THE CURRENT TIME OF
+// DAY, so `--since=2026-09-08` run at 17:46 silently excludes everything
+// committed earlier the same day. `started_at` is written as a bare date,
+// so a story started and finished in one day proposed `files: []` and the
+// caller had no way to tell that from "nothing was committed" (measured
+// 2026-09-08: --since=2026-09-08 returned nothing while
+// --since="2026-09-08 00:00" returned the day's commit).
+export function sinceWindow(since) {
+  return /^\d{4}-\d{2}-\d{2}$/.test(since) ? `${since} 00:00:00` : since;
+}
+
 function filterFiles(list) {
   return [...new Set(list)]
     .map((f) => f.trim())
@@ -128,16 +142,7 @@ function main() {
   } else if (since) {
     // committer-date window; work committed before the story went in-progress
     // is invisible by design (story-scoped attribution).
-    //
-    // A bare YYYY-MM-DD gets midnight appended, and it is not cosmetic. Git's
-    // approxidate reads a date with no time as THAT DATE AT THE CURRENT TIME OF
-    // DAY, so `--since=2026-09-08` run at 17:46 silently excludes everything
-    // committed earlier the same day. `started_at` is written as a bare date,
-    // so a story started and finished in one day proposed `files: []` and the
-    // caller had no way to tell that from "nothing was committed" (measured
-    // 2026-09-08: --since=2026-09-08 returned nothing while
-    // --since="2026-09-08 00:00" returned the day's commit).
-    const window = /^\d{4}-\d{2}-\d{2}$/.test(since) ? `${since} 00:00:00` : since;
+    const window = sinceWindow(since);
     const out = git(["log", `--since=${window}`, "--name-only", "--pretty=format:"]);
     committed = out ? out.split("\n") : [];
     usedRange = `--since=${window}`;