rcf-lite 0.28.2 → 0.29.0

package/CHANGELOG.md

@@ -6,6 +6,323 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+
+## [0.29.0] - 2026-10-03
+
+0.29.0 lands the viewer UI refresh train (nine PRs that rebuild the shell, add shared components, redesign the Requirements, Architecture, Build and Readiness tabs, ship a Build DAG sub-tab, add fast ID lookup, and prove the embedding contract with a same-origin test-host fixture), the DEFINE readiness persona split (two readiness levels, `--level` and `--persona` on `rcf define readiness`, a Readiness tab as tab 1), and the first three DEFINE step 3 PRs (document intake into the brief ledger with the closed `resolvedBy` grammar, a `rcf define questions` verb with three new MCP tools and two argument-free prompts for the harness loop, and the `[draft]` shapes gate across TAC purpose, interface and core-entity homes with a DISCOVERY prototypes doctrine). The brief said 0.29.0 was never tagged; it is tagged here, and the spec sections that referred to those D2 behaviours as "0.30.0" now read 0.29.0.
+
+Scope note: DEFINE step 3 PR 5 (D3 bite) is still on the cloud at cut time and is NOT included; it rides a later minor. Spec amendment note: `projects/rcf-lite-wsd/specs/2026-10-01_define-step3-po-elicitation-spec.md` section 16 and every "0.30.0" reference to the D2 `skeleton:resolvedBy` tightening, the `rcf define ledger <name> update <id>` subverb and the `resolvedBy` closed grammar should read "0.29.0" at the next amendment pass.
+
+### Added
+
+- **Viewer UI refresh PR 1 of 9: shell, brand tokens, theme contract, embed contract, Router and relative asset refs (`#263` + `#265`; w-2026-10-02-dave-017).** AppShell with a compact header (icon mark, product block, sticky tabstrip, tools well) and a one-line footer carrying version, GitHub, docs links and the live-update pill. Full `--sv-*` Stravica brand token set under `:root[data-theme="light"]` and `:root[data-theme="dark"]` with a `prefers-color-scheme` fallback; pre-PR-1 `--colour-*` names kept as aliases so doc-renderer, Mermaid and Product Map rules get dark theme for free. `theme=light|dark|auto` and `embed=1` on `/`; live theme switch via same-origin `postMessage({ type: "rcf-view-theme", theme })` (origin checked). Router (`#tab=&sub=&entity=`) with bare-id compatibility and query-string preservation on every hash write. Relative asset and stream refs for embedding: `./style.css`, `./mermaid.min.js`, `./page-init.js`, `./live-client.js`, `./events`, `./scope.json`, `./product-map/<group>`. Inline-script-free shell: the former inline IIFE lives in `src/view/page-init.js` served by a new relative route (see "For embedders" below).
+- **Viewer UI refresh PR 2 of 9: shared components layer and shell polish (#266; w-2026-10-02-dave-010).** Six shared component helpers under `src/view/components/` land for the per-tab cutover PRs: `DocRow`, `FilterBar`, `Badge`, `EmptyState`, `Toast`, `SubTabStrip`, with matching `.rcf-*` CSS. Toast container mounted once in the shell outside `#rcf-live-content` so the SSE innerHTML swap cannot blow it away. `/_fixtures/components` route renders every shared component in isolation with sample data. Shell polish per decision 17: `resolveProductHeader()` returns the project name only; no technology chip under any register.
+- **Viewer UI refresh PR 3 of 9: Requirements tab and PRD EntitySelector (#268; w-2026-10-02-dave-025).** Requirements tab under `#tab=requirements` ships a FilterBar (text, Area, Priority, Status, Needs-work toggle), Expand/Collapse all and a live count; FilterBar state mirrors into the hash. DocRow per REQ carries `data-domain`, `data-priority`, `data-status`, `data-needswork`, `data-text`; row body has nested per-US DocRows with the full renderUserStory body, slice diagram and raw-JSON disclosure as collapsed `<details>` so first-paint stays cheap. `#entity=US-304` resolves to REQ-003 and US-304; bare `#entity=<id>` works. Needs-work set sourced from `model.readiness.levels.intentComplete.blockedBy` filtered to the engineer-plain reasons (viewer never re-runs gates). PRD tab (`#tab=overview` for hash backwards compatibility) collapses the five lists into `<details>` with count badges, drops the 109 inline requirement links, and mounts a shared EntitySelector below the article (bold total line, type-ahead jump input, 21 area chips deep-linking into `#tab=requirements&domain=<area>`). Component payload data rides on `data-*` attributes, never inline `<script>` bodies.
+- **Viewer UI refresh PR 4 of 9: Architecture tab with TAD sections and TAC/ADR filters (#269; w-2026-10-02-dave-026).** Six TAD sections (`systemOverview`, `architecturePrinciples`, `integrationArchitecture`, `operationalConcerns`, `dataArchitecture`, `securityArchitecture`) render as shared `DocRow` with a one-line preview, closed by default. Absent sections keep their heading, read "Nothing written yet" with an `empty` badge, and name the exact authoring command `rcf define update TAD-001 --set <section>.<field>="..."`. Components (TAC) and Decisions (ADR) panels each use shared `FilterBar` plus `DocRow` list; TAC rows carry interface and dependency count badges, ADR rows carry a status pill sized against the dogfood vocabulary. Hash scheme extends: `#tab=architecture[&cq=...][&cstatus=...][&dq=...][&dstatus=...][&open=<tad-section-keys>]`. Raw TAD JSON kept as a muted collapsed disclosure at the foot of the tab.
+- **Viewer UI refresh PR 5 of 9: Build tab with Specs and sub-tab strip (#271; w-2026-10-02-dave-027).** SubTabStrip "Specs | DAG" inside the Build tab (DAG is a placeholder empty state at PR 5; PR 6 wires it). BuildStats card with six totals read from `computeQueue({ fbsItems })` (items, verified, complete, in progress, not started, buildable now = `queue.totals.actionable`). Specs FilterBar (text, status, area, size, Buildable-now toggle) over a shared DocRow list. Expanded Spec body: summary, approach, AC and dep links, deliverables, context links (TACs, ADRs, TAD sections), "Show in the DAG" pointer, raw JSON disclosure. Hash scheme extends: `#tab=build[&sub=specs|dag][&q=][&status=][&domain=][&size=][&buildable=1]`.
+- **Viewer UI refresh PR 6 of 9: Build/DAG sub-tab (#272; w-2026-10-02-dave-031).** Lands DagCanvas, DagInspector, DagToolbar and the unconnected lane: depth-by-`dependsOnFbsIds` columns, buildOrder rows, node-count critical path (longest chain), hidden unconnected lane with a visible count. Click-to-highlight closure (upstream outlined in link colour, downstream in warning, rest dimmed); inspector lists direct needs and waits-on with Open-in-Specs; `#tab=build&sub=dag&entity=FBS-<n>` deep-links. Inspector payload rides on a `data-rcf-dag-inspector-data` attribute, never an inline `<script>` body. Chain: REQ-002 amended, US-204 new (seven ACs), TAC-4131, ADR-4133.
+- **Viewer UI refresh PR 7 of 9: ID lookup over `./index.json` (#275; REQ-002 / US-205; TAC-4132; ADR-4134).** The viewer serves a new relative route `./index.json` built from `BuiltTreeModel` on every rewalk, one row per document id plus one per AC, carrying `{ id, kind, title, snippet, parent, tab }` (`src/view/view-index.js` + `src/server/routes.js` + `src/server/index.js`). A SearchButton renders to the right of the tabstrip and a LookupModal mounts outside `#rcf-live-content` so the SSE innerHTML swap cannot blow it away; Cmd/Ctrl+F opens the modal from any tab (Cmd/Ctrl+Shift+F stays the browser's in-page find). Type-ahead ranks id matches first (exact > prefix > contains); then every query word must match title or snippet, title above snippet; a single character searches ids only; 20 results; matches marked. The index is fetched lazily on first open and refreshed when the next SSE `tree-update` event lands (`__rcfLookupDirty` is set in `src/view/live-client.js`). A pick writes `#tab=<tab>&entity=<id>` through the existing writeHash so `?embed=` and `?theme=` survive every navigation. Keyboard: up/down/Enter/Esc; the modal is a `role="dialog"` with `aria-modal`, labelled live-region status, and the SearchButton is `aria-label`-ed as `Find any document or AC (Cmd/Ctrl+F)`. The new relative viewer route is `./index.json` (released alongside PR 1's `./page-init.js`; wespa's reverse-proxy allow-list is extended before the version pin bump).
+- **Viewer UI refresh PR 8 of 9: Readiness tab Product Owner redesign (#277; REQ-180 / US-18002 / TAC-4133 / ADR-4135; w-2026-10-02-dave-033).** PO layer with two equal-height VerdictCards (muted chain term on both), QuestionCards grouped by source span, Requirements-that-still-need-work table, and a "For engineers" DocRow at the foot that collapses the pre-PR-8 engineer rendering (never removed from the DOM in any register, per AC-18002-3). Readiness phrasebook ships now. Feature-detected adapter seam consumes DEFINE step 3 PR 2's `computeQuestions` output on the real path and falls back to the blockers path with phrasebook asks when it is absent. `src/view/index.js` folds `computeQuestions(readiness, { tree, ledgers, profileText, persona: 'productOwner' })` onto `readiness.{questions,questionGroups,questionOptional,questionEngineer}` before the view reads it, so the two sources render identical labels on the dogfood tree.
+- **Viewer UI refresh PR 9 of 9: embedding proof via a same-origin test-host fixture (#279; REQ-002 / US-206; TAC-4134; ADR-4136; w-2026-10-02-dave-034).** `src/view/test-host/` (`fixture.js`, `embed-client.js`, `lints.js`) and routes `GET /test-host.html` and `GET /test-host.js` served ONLY behind `--test-host` (CLI) or `RCF_VIEW_TEST_HOST=1` (env), 404 by default so wespa's reverse-proxy allow-list is unaffected. The fixture ships a 56 px header, a resizable sidebar (64 to 400 px) and a toggle posting `rcf-view-theme`. Three in-suite guards pin the embedding contract: framing headers absent (no `X-Frame-Options`, no CSP), zero `target="_top"` across all served responses, and every `src/view` storage key under the `rcf-view:v1:` namespace.
+- **DEFINE viewer: Readiness tab as tab 1 and Overview-to-PRD rename (#262; REQ-180 / REQ-181 / US-18001 / US-18101; TAC-4127; ADR-4127; w-2026-10-01-dave-003 PR C).** `src/view/readiness.js` lands and `src/view/html-page.js` wires it as the first tab of the HTML review surface. The former Overview tab is renamed PRD (label-only; the `data-tab="overview"` identifier and `id="tab-overview"` are preserved so every existing `#tab-overview` hash link still resolves). The tab renders the `computeReadiness` object top-to-bottom in the layout spec section 5 pins: tree line, two verdict pills with `formatVerdictLines` strings as labels, two per-persona next-action lines, D1 to D8 state chips, blockers grouped by persona (register orders the pair; the non-register group collapses with its count visible, never omitted), delta list grouped by REQ ancestor with a document-level `diff` on changed items, per-stage check detail, coverage tree-versus-delta, decisions outstanding, a Freeze now control enabled iff `levels.readyToBuild.ok`, and the loaded freeze record. The renderer is pure: it never recomputes readiness or hits disk. Three shared view components (`src/view/components/{pill,findings-list,diff}.js`) land as additive modules.
+- **DEFINE readiness CLI: `--level` and `--persona` flags, persona-grouped text report (#261; ADR-4126; REQ-175 / US-17503; TAC-4123; w-2026-10-01-dave-003 PR B).** `rcf define readiness` gains `--level intent|build` and `--persona productOwner|engineer`. `--level intent` exits 4 iff `levels.intentComplete.ok === false`, `--level build` exits 4 iff `levels.readyToBuild.ok === false` (stricter than `--check all` on unacknowledged warn-with-ack failures; the `[warn]` line still prints). When both `--check` and `--level` are given, the invocation exits 4 if either policy says 4. With neither flag the exit code stays 0. `--persona` is a display filter only: it never affects the exit code or `--json` content, and is ignored under `--json`. Unknown values exit 2 with a usage line naming the accepted set. The text report prints both verdict lines at the top, then groups blockers into a `Product owner: N question(s)` section and an `Engineer: N check(s) blocking` section ordered by the `profile.md` register (PO first when `register: productOwner` or when the marker is `unstated`/absent; engineer first when `register: engineer`). The JSON gains `_meta.level` reflecting the invocation (`"intent"`, `"build"` or `null`).
+- **DEFINE readiness: persona tags on every gate check, two readiness levels (#260; ADR-4126; REQ-174 / US-17402 / US-17403 and REQ-175 / US-17502; TAC-4122 and TAC-4123; w-2026-10-01-dave-003 PR A).** Every entry in `stages[].checks[]` carries `persona` (`productOwner` | `engineer`) and a one-sentence `question` heading, declared in `CHECK_PERSONA` / `CHECK_QUESTION` maps in `src/query/gates.js`. The `notApplicable` placeholder (`stage:<D>:scope`) carries the `STAGE_FALLBACK_PERSONA` for its stage so the per-check vocabulary is total. `skeleton:reqFields` splits into `skeleton:reqIntent` (productOwner: description without TODO + domain) and `skeleton:reqShape` (engineer: shapeClassification.shapes), each evaluating every REQ independently. `decisions:allAnswered` splits into `decisions:wellFormed` (productOwner) and `decisions:allAnswered` (engineer). A new D3 check `shapes:draftSettled` fails any interface whose `description` starts with `[draft]` (leading whitespace tolerated). `computeReadiness` folds `levels.intentComplete`, `levels.readyToBuild`, `personas.productOwner.blockers` and `personas.engineer.blockers` on every read. `deriveNextAction(stages, persona?)` gains an optional persona filter. New shared helper `formatVerdictLines(result)` builds the two verdict strings. All additions are strictly additive; `rcf define freeze` is untouched and remains L2-only.
+- **DEFINE step 3 PR 1: document intake into the brief ledger, `rcf define ledger <name> update <id>` subverb, closed `resolvedBy` grammar (#270; REQ-187 / US-18701 / US-18702; REQ-173 amended / US-17302; TAC-4121 amended, TAC-4130 new).** `rcf define ledger brief add` grows `--from <statement-file>`, `--scan` / `--no-scan`, `--findings <path>`, `--dry-run` and `--json`; the parser recognises `[kind]` and `(source: ...)` text markers (with `--kind` and `--source` defaults) and promotes `?` / `TBC` / `TBD` / `Open:` / `Question:` to `openQuestion`; unknown `[kind]` exits 2 before any write. The mechanical intake scans run over new statements against existing ones and append `openQuestion` statements per finding (`--no-scan` with `--findings` exits 2). A new `rcf define ledger <name> update <id>` subverb lands on every ledger with the add-side validation; `brief --resolved-by` validates the closed pointer grammar before any write. The D2 `skeleton:resolvedBy` check now parses the pointer against the closed grammar (`REQ-nnn`, `TAD.entity:<name>`, `PRD.user:<name>`, `TAD.system:<name>`, `TAC-nnnn`, `omitted:<reason>`); see Changed for the dropped title-hit fallback. Chain: FBS-202 new (holds the new ACs with `executionStatus: notStarted`; the CN axis is deferred); `docs/capability-tags.md` grows a `define-intake` slug.
+- **DEFINE step 3 PR 2: `rcf define questions` verb, three MCP tools and two argument-free prompts (#274; REQ-186 / US-18601 / US-18602 / US-18603; TAC-4128, TAC-4129; ADR-4129, ADR-4130).** `rcf define questions` turns every failing product-owner check into one plain question carrying its exact write-back (real three-step `create req; define update <REQ-id> --set description=... --set domain=...; ledger brief update ... --resolved-by <REQ-id>` for new REQ; real `create us --parent --title`, `define update <US-id> --json --set story='{...}'` and `create ac --parent --description "[happy] ..."` sequence for new US; `decisions add ...; ledger brief resolve <N> --answer "decision <id>"` for `brief:openQuestions`). Three new MCP tools expose the same compute: `rcf_define_questions`, `rcf_define_readiness`, `rcf_define_ledger`; two argument-free prompts (`rcf_define_intent`, `rcf_define_intake`) steer the harness through the loop. The question extractor reads the full `readiness.stages[].checks[].failing[]` so a check with 25 failing items yields 25 questions (not 20). Termination under `--stage` is `result.ok` alone (not `result.ok || result.remaining === 0`). Stable sort of questions by `(stageIndex, sourceSpan, originalIndex)`.
+- **DEFINE step 3 PR 3: `[draft]` shapes across TAC purpose, interface and core-entity homes; DISCOVERY prototypes doctrine; two new argument-free prompts (#278; REQ-188 / US-18801; REQ-182 / US-18202; ADR-4132).** `parseInterfaceDraft` becomes a thin wrapper over a shared `hasDraftMarker` string test; two sibling readers `parseTacPurposeDraft` and `parseCoreEntityDraft` cover the new homes. `checkD3Shapes` enumerates all three draft homes and emits `shapes:draftSettled` findings with ids `<tacId>:<name>`, `<tacId>` and `TAD.entity:<name>`. D3 `notApplicable` widens to include any tree-wide `[draft]` core entity so a draft-only tree reports under D3 rather than being skipped. `guidance/discovery-prototypes.md` (slug `discovery-prototypes`, `rcf://docs/discovery-prototypes`) lands the doctrine (prototype as elicitation instrument; outputs as `prototype:<name>:<observation>` statements; code burned by a single `constraint`; salvage by re-derivation only). `guidance/discover-prototype.md` wraps it as the argument-free `rcf_discover_prototype` prompt. `guidance/define-draft-shapes.md` lands the argument-free `rcf_define_draft_shapes` prompt. `guidance/manifest.json` registers the slug and the two prompts; the managed block gains the "Prototypes in DISCOVERY (ADR-4132)" rule beside the existing "Prototype rule". `docs/capability-tags.md` grows a `define-drafts` slug.
+
+### Changed
+
+- **DEFINE D2 `skeleton:resolvedBy` tightens to the closed pointer grammar (PR #270, breaking under the pre-1.0 convention; spec amendment: this behaviour was previously named "0.30.0" in the DEFINE step 3 spec section 16 and now ships at 0.29.0).** The 0.28.4 title-hit fallback (a brief statement with `resolvedBy` left as free-form title text was quietly accepted if the title matched any downstream document) is dropped. A pointer that does not parse against the closed grammar (`REQ-nnn`, `TAD.entity:<name>`, `PRD.user:<name>`, `TAD.system:<name>`, `TAC-nnnn`, `omitted:<reason>`) now fails `skeleton:resolvedBy` on D2. Operators with brief ledgers written against 0.28.4 must rewrite non-conforming `resolvedBy` values to the closed grammar; `rcf define ledger brief update <id> --resolved-by <pointer>` validates before write.
+- **Managed agent-instructions block regenerated: adds the "Prototypes in DISCOVERY (ADR-4132)" rule and registers the four argument-free DEFINE/DISCOVERY prompts (PRs #274 and #278).** `scripts/gen-managed-artefacts.mjs` reran on PR 2 and PR 3 of DEFINE step 3; the block hash changed. Agents update their copy of the managed block by rerunning `rcf init` (`minAgentAction: rerun-init`).
+
+### Removed
+
+- **Viewer Build tab: the "FBS slots" ordered list and the "Test suites" section are gone (PR #271).** The Build tab's "Specs" sub-tab replaces both. Suites stay reachable via AC links and PR 7's ID lookup (Cmd/Ctrl+F). Consumers that embedded a deep link into the old Build-tab FBS-slots list need to update to `#tab=build&sub=specs&entity=FBS-<n>` or to the DAG sub-tab `#tab=build&sub=dag&entity=FBS-<n>`.
+
+### Fixed
+
+- **DEFINE D2 skeleton gate reads TAD at the schema-authorised path (#259; w-2026-09-25-dave-004 defect A, REQ-174 / US-17401 / TAC-4122).** `checkD2Skeleton` in `src/query/gates.js` now reads `tad.dataArchitecture.dataStores` and `tad.dataArchitecture.coreEntities` instead of the top-level `tad.dataStores` / `tad.coreEntities` that slice-2 drifted onto. The authority is rcf-schemas 0.6.3 (`tad.schema.json` requires both arrays under `dataArchitecture`), so the previous top-level reads failed `skeleton:tadPersistence` on every valid tree carrying a persistence REQ. The `failing` entry ids tracked the move to `TAD.dataArchitecture.dataStores` and `TAD.dataArchitecture.coreEntities`.
+- **DEFINE D1 brief gate: a fresh `rcf init` tree now satisfies the review-surface marker without operator edits (#259; w-2026-09-25-dave-004 defect B, REQ-174 / US-17401 / TAC-4122).** `src/setup/identity-seed.js` IDENTITY_TEMPLATE now carries a `## Surface` section between `## Register` and `## Project-scoped notes`, mirroring the Register section's shape: a short italicised explanation, one bullet each for `viewer` / `runningApp` / `prDiff`, and a bare `prDiff` line as the default. `checkD1Brief`'s `profile:surface` check now passes on a clean post-init tree. The slice-1 idempotency contract (an existing profile.md is left byte-identical) is preserved.
+
+### For embedders (wespa reverse-proxy)
+
+- **New relative routes shipped since 0.28.4.** `GET /page-init.js` (PR 1), `GET ./index.json` (PR 7). Both must be allow-listed on the wespa reverse-proxy for `/rcf-viewer/*` before the version pin bump, or the proxy returns 404 for `/rcf-viewer/page-init.js` (losing tab wiring, Mermaid lazy render, product-map interactivity, theme boot, embed stamp, origin-checked `postMessage` listener and the hash router) and `/rcf-viewer/index.json` (losing the Cmd/Ctrl+F ID lookup).
+- **No new allow-list routes from PR 9.** `GET /test-host.html` and `GET /test-host.js` are served ONLY when `--test-host` (CLI) or `RCF_VIEW_TEST_HOST=1` (env) is set, and return 404 otherwise. Production wespa does not set the flag, so the allow-list is unchanged by PR 9.
+- **Removed inline script in the viewer shell (PR 1).** CSP hash pin for the inline shell IIFE is no longer needed; the IIFE lives in `src/view/page-init.js` (served by `GET /page-init.js`). Wespa's CSP for `/rcf-viewer/*` should allow the external script in place of the previous inline hash pin.
+- **Live update pill in the footer (PR 1).** Carries connection state (connecting, open, retrying, closed); styled through the `--sv-*` tokens so it tracks the theme.
+- **`embed=1` and `theme=light|dark|auto` query params (PR 1).** `embed=1` stamps `data-embed="1"` on `<html>`, suppresses the title block and footer, and left-aligns the tabstrip; the icon mark and project name remain. `theme` on `/` either stamps `data-theme` (explicit value), clears it (`auto`), or leaves the default light (absent).
+- **Live theme switch via `postMessage({ type: "rcf-view-theme", theme })` (PR 1).** Same-origin only; the viewer's listener checks `event.origin`.
+- **Hash contract (PR 1, extended by PRs 3 to 9).** `#tab=<name>&sub=<name>&entity=<id>` is the canonical hash form; bare `#<id>` and `#entity=<id>` keep working. `?embed=` and `?theme=` and unknown query params survive every in-viewer navigation.
+- **`./index.json` (PR 7).** Lazy JSON index served from the viewer root; refreshed on every SSE `tree-update`.
+
+## [0.28.4] - 2026-09-30
+
+Note: 0.28.3 (2026-09-22 below) was never tagged or published; its entries ship in 0.28.4 together with the ones here.
+### Added
+
+- **DEFINE workflow: `rcf define freeze` CLI verb (REQ-176, first slice of the 0.29.0 train; slices 1 and 2 shipped in 0.28.4 on 2026-09-30).** New module `src/cli/freeze.js` is the only
+  writer of `rcf/define/freeze.json` in the shipped product. It runs
+  `computeReadiness` once (REQ-175) over the live tree, freeze record
+  and four ledgers; refuses (exit 4) on any stage state `failing`
+  after applying any `--ack` acknowledgements; and, on success, writes
+  the freeze record via `saveFreezeRecord` (REQ-172) plus the
+  proposal 2026-09-22 v3 §2.5 summary line the operator signs off.
+  `--ack <gate> --reason <text>` is accepted only for the three
+  warn-with-ack gates (`define.shapes` / D3 / shapes,
+  `define.crosscut` / D5 / crosscut, `define.consistency` / D6 /
+  consistency); `--ack` on any other gate is a usage refusal
+  (exit 2) with a stderr message naming the accepted set. Ack pairs
+  are folded in-memory at the current tree hash and the readiness
+  compute runs with a synthesised freeze context so D8's
+  `priorGates` check sees the acked stages as `acknowledged`. On
+  success the record carries `frozenAt` (ISO UTC now), `treeHash`
+  (from `computeDelta`), `docHashes`, `briefStatements`,
+  `gates` (per-stage envelope including acked entries),
+  `counts` (`req` / `us` / `ac` / `acByClass` / `tac` /
+  `interfaces` by kind / `adr` / `fbs`), `litmus`
+  (`{ attestedAt: [], readers: 0 }` default; `--litmus-attested
+  D3,D6` records the agent's attestation per proposal §9 decision
+  7), `versions` (`rcfLite` / `ruleset` / `schemas` read from
+  package.json, `src/ruleset/ruleset.json` and the installed
+  `@stravica-ai/rcf-schemas`), `note` and `override: null`. The
+  producer is wrapped with `runWithAdmissibilityGate` per ADR-4124;
+  refused admissibility is informational (a stderr `[warn]` line)
+  and never a freeze refusal (ADR-4123 carried). `--status` prints
+  the current record and the live delta summary without running any
+  gates and without writing; `--status --json` emits
+  `{ record, delta }`. `--json` on a freeze success emits
+  `{ record, summary, delta }`. The `--litmus <n>` real-dispatch
+  runner is a named 0.30 seam.
+
+### Changed
+
+- **Freeze record `override` is now a required-nullable field
+  (slice 3, resolves the slice-1 P3).** `validateFreezeRecord` in
+  `src/define/freeze-record.js` throws `FreezeRecordError` with
+  `field: 'override'` when the key is missing; `saveFreezeRecord`
+  refuses to write a body that omits override. `loadFreezeRecord`
+  defaults a missing key to `null` on read so pre-slice-3
+  freeze.json records survive without a migration step. Every
+  fresh freeze written by the new CLI stamps `override: null`, so
+  the on-disk shape converges on the current schema the next time
+  a project freezes.
+
+### Fixed
+
+- **DEFINE hygiene: the ` -- ` double-dash is gone from the
+  readiness CLI stage header and the CHANGELOG's TODO-regex line
+  (slice 3).** The readiness `rcf define readiness` stage block
+  now uses `: ` between the stage id / gate and the state label
+  (`D1 (define.brief): failing`); the CHANGELOG's `The regex is
+  now /\bTODO:/` line likewise uses a colon.
+
+- **Product Map tab on the review surface (#238).** Merged on `main` at
+  `ab35dd7d`; grouped by shape, component, trace coverage, capability,
+  blueprint. This entry backfills the changelog now that the following
+  DEFINE-train slice rides on top of it.
+- **DEFINE workflow: delta detection foundation (REQ-172, slice 1 of
+  the 0.29.0 train).** New pure module `src/query/delta.js` exports
+  `hashDocument`, `computeTreeHash` and `computeDelta`. `hashDocument`
+  is SHA-256 over the canonical JSON of the parsed document (keys
+  sorted recursively, no whitespace), so a hand reformat is not a
+  change; the tree hash is over the sorted `(id, docHash)` pairs.
+  `computeDelta(tree, freeze, ledgers)` returns the exact
+  `frozen / frozenAt / treeHash / currentTreeHash / changed / added /
+  removed / briefSince / unchanged` shape proposal 2026-09-22 v3
+  section 2.2 pins. Before the first freeze the delta is the whole
+  tree (`frozen: false`, everything in `added`). Reused unchanged:
+  `computeImpact`, `computeTrace`, `computeCoverage`.
+- **DEFINE workflow: freeze record I/O (REQ-172, slice 1).** New
+  module `src/define/freeze-record.js` owns `rcf/define/freeze.json`
+  with a small local schema (until schemas 0.7 promotes it to
+  `manifest.freeze` per ADR-4121). `loadFreezeRecord` returns `null`
+  on a missing file; a malformed body raises `FreezeRecordError` with
+  a coded reason (`parseFailure | schemaFailure | ioFailure`) and a
+  named field. `saveFreezeRecord` validates first, so a bad
+  in-memory record never lands on disk; extension fields survive a
+  save / load round trip. The `rcf define freeze` verb is a
+  later-slice consumer; this slice ships the writer so the verb can
+  be built without a second refactor.
+- **DEFINE workflow: four sidecar ledgers and `rcf define ledger`
+  (REQ-173, slice 1).** Four ledgers live under `rcf/define/`, one
+  JSON file each, each with one numbered sequence per project:
+  `brief-ledger.json` (D1 statements, kinded from the closed set
+  `capability | constraint | actor | entity | externalSystem |
+  surface | outOfScope | openQuestion | amendment`),
+  `decisions-ledger.json` (D7, printed in the numbered #241 format),
+  `concern-ledger.json` (D5, `applied | waived`),
+  `probe-ledger.json` (D6, `low | medium | high`).
+  `rcf define ledger <name> <verb>` covers `add`, `resolve` and
+  `list`; `brief add --from <file>` splits statements one per
+  non-empty line and mints sequential ids (the
+  intake-scan-against-frozen-statements hook is a named seam this
+  slice leaves for slice 2). `decisions list` prints the #241
+  numbered format. `list --json` emits `{ ledger, <arrayKey>: [...] }`.
+  A dedicated test proves the walker never surfaces any `rcf/define/`
+  path in `walkTree` errors or `tree.byId`.
+- **DEFINE workflow: stage gates D1..D8 (REQ-174, slice 2 of the
+  0.29.0 train).** New pure module `src/query/gates.js` exports one
+  check function per stage (`checkD1Brief`..`checkD8Freeze`) plus
+  the `STAGE_ORDER`, `STAGE_GATES`, `STAGE_SHORT_NAMES` and
+  `INTERFACE_KINDS` constants. Every function returns the exact
+  `{ stage, gate, state, checks[] }` shape proposal 2026-09-22 v3
+  section 2.4 specifies, with `checks[i]` in the `{ name, ok, over,
+  pass, total, failing }` form. Blocking in 0.29.0: D1 (define.brief),
+  D2 (define.skeleton), D4 floors (define.stories), D7
+  (define.decisions), D8 (define.freeze). Warn-with-ack in 0.29.0:
+  D3 (define.shapes), D5 (define.crosscut), D6 (define.consistency)
+  \- the state folds to `acknowledged` when the freeze record's
+  `gates[<gate>]` entry names `acknowledged` at the current tree
+  hash (ADR-4122). D4 per-class opt-outs reuse the existing
+  `manifest.baselineAcOptOuts[]` array with a baselineKey of
+  `'defineD4:failure'` or `'defineD4:mustNot'`; no new sidecar is
+  introduced. The template parser, entity join, D5 catalogue, D6
+  contradiction / unsatisfiable scans and probe runner remain as
+  named seams for 0.30.
+- **DEFINE workflow: readiness compute and `rcf define readiness`
+  CLI (REQ-175, slice 2).** New pure module `src/query/readiness.js`
+  exports `computeReadiness(tree, { freeze, ledgers, profile,
+  testPointers })` returning the section 2.4 object exactly:
+  `{ tree, delta, stages, nextAction, coverage, decisions,
+  freezeable }`. The composer runs `computeDelta` once, calls
+  `computeImpact` per id in the union of changed and added (skipping
+  the fan-out on the unfrozen whole-tree case where the delta IS the
+  tree), runs the eight gate check functions over
+  `scope = changed union added union impacted`, calls
+  `computeCoverage` tree-wide plus once per REQ ancestor of the
+  delta, lists open decisions, and folds to `freezeable` and
+  `nextAction`. New verb `rcf define readiness [--json] [--check
+  <stage>|all]` (stage accepts D1..D8 or the short names
+  `brief | skeleton | shapes | stories | crosscut | consistency |
+  decisions | freeze`); text output = tree line, next action, chip
+  line, delta list, failing items; `--check` exits 4 on a
+  blocking-stage failure, exits 0 with a visible `[warn]` line on an
+  unacknowledged warn-with-ack failure. The producer is wrapped with
+  `runWithAdmissibilityGate` per the NV-BL-SR-03 addendum; on
+  admissibility refusal the CLI prints a `[warn]` note and still
+  runs the compute, because readiness is a diagnostic and refusing
+  to render is the opposite of what it exists to say (ADR-4123).
+  Slice 3's `rcf define freeze` will read `freezeable` and refuse
+  on any failing stage.
+
+### Fixed
+
+- **US auto-mint extends flat legacy sequences instead of jumping to
+  the encoded slot (#256).** `nextIdForKind(tree, 'userStory', ...)`
+  in `src/core/store/writer.js` assumed every US id encodes
+  `US-<reqNum><localTwoDigit>`. On a legacy tree whose USes carry
+  flat sequential ids (`US-1`, ..., `US-163`, migrated in from a
+  WESPA v1 project) that decode failed and the allocator fell back
+  to `US-<reqNumLabel>01`, minting shapes like `US-5301` under
+  `REQ-053` next to the existing `US-163`. Classification now runs
+  before allocation: every US id is labelled ENCODED (id decomposes
+  as `<declaredReqNum><local in 01..99>`) or FLAT. An all-flat tree
+  extends past the tree-wide high-water mark (`US-164`), an
+  all-encoded tree preserves the historical rule, and a mixed tree
+  refuses with a message that names both example ids and asks the
+  operator to normalise one shape before retrying. AC auto-mint is
+  unchanged.
+- **Slice-1 P3: `loadAllLedgers` omits absent ledger files
+  (AC-17501-6).** The `LedgerBundle` typedef on `computeDelta` said
+  "if a project has not authored any decisions, the caller passes
+  no `decisions` key and the delta records no `ledger:decisions`
+  docHash"; the previous implementation always returned the four
+  empty bodies. `loadAllLedgers` now `stat`s each ledger file first
+  and omits the key on ENOENT, so a project with no ledgers gets
+  zero `ledger:<name>` docHashes in the delta and a project with
+  only a brief ledger gets exactly one. `loadLedger` still returns
+  an empty ledger on ENOENT so single-ledger callers keep the
+  ergonomic default.
+- **Slice-2 P3: D2 / D4 scaffold-TODO matcher narrowed to the literal
+  `TODO:` placeholder.** `src/query/gates.js`'s `TODO_RE` used to be
+  the whole-word `/\btodo\b/i`, which false-positived on prose
+  mentioning the word ("no AC description contains the scaffold TODO
+  placeholder" on US-17401 / AC-17401-4 tripped D4 against itself).
+  The regex is now `/\bTODO:/`: case-sensitive uppercase `TODO`
+  followed by a colon, matching every scaffold string
+  `src/core/store/init.js` and `src/core/store/writer.js` write for a
+  fresh `rcf init` / `rcf define create`. `src/cli/validate.js` keeps
+  its broader `\btodo\b/i` matcher for the informational tree-wide
+  notice, so incidental prose still surfaces there without failing
+  the D2 / D4 gates.
+
+## [0.28.3] - 2026-09-22
+
+Batched fix release for the residuals Dex's 0.28.2 round-trip surfaced
+and one HQ-side viewer bug caught the same day. Ships one chain
+amendment (three design amendments on the same redactor AC) and four
+build diffs behind it, plus one viewer-side snapshot fix.
+
+### Fixed
+
+- **Feedback redactor no longer folds the git protocol sentinel
+  `git@<host>` inside git+ssh, ssh or git URLs as an email (#243).**
+  A `--evidence` pointer copied verbatim from a git remote or a clone
+  URL survives verbatim, so the operator can re-run the exact command
+  they hit. The bare-remote shape `git@<host>:<owner>/<repo>` is
+  covered by the same guard. Real emails in surrounding prose still
+  fold to `<email>`. The URL rule 4 also now handles git+ssh, ssh and
+  git schemes with optional userinfo, so a non-allowlisted host inside
+  a clone URL still folds to `<host>` while the sentinel is preserved.
+- **Feedback redactor now treats single-letter trailing labels as
+  filename fragments, not hostnames (#247, Codex P1-5 deferred from
+  PR #242).** Tokens like `a.b.c` survive verbatim. Single-letter TLDs
+  are not registrable domains in normal prose; folding them yields
+  more false positives on short identifiers and abbreviated references
+  than legitimate redactions.
+- **Feedback redactor emits a visible stderr warning when identity
+  folding is disabled (#246).** When `rcf/.identity/profile.md` is
+  missing, has no `## Name` heading, has a blank or placeholder Name
+  line, or the Name contains only reserved-noun tokens, one line on
+  stderr names the file and states that folding is disabled. The
+  operator is no longer left thinking their identity is in force when
+  it silently is not. Folding still skips per AC-15601-5.
+- **`rcf feedback status --json` and text now expose the destination
+  resolution `source` field, matching preview (#244).** Programmatic
+  verifiers can now assert which resolver path picked the destination
+  (`library-manifest`, `package-bugs-url`, `derived`,
+  `sourceRef-derivation`, `library-slug-inference`) without parsing
+  preview text. The field is null when the resolver did not attach
+  one, e.g. for an unresolved library.
+- **`rcf feedback add --evidence` pointers now render with the label
+  matching their shape, not always `(command)` (#245).** The help
+  text promises three labels (`command / path:line / id`); the
+  classifier now recognises `path:line` and bare paths ending in a
+  known file extension as `file`, canonical RCF ids
+  (`AC-15601-6`, `REQ-155`, `FBS-181`, `US-15701`) as `id`, and
+  everything else as `command`. Whitespace anywhere in the pointer
+  is a hard signal for `command`.
+- **`rcf audit view` snapshots its shipped static assets at server
+  startup (#248).** The live-view server rendered the HTML body from
+  a tree walk captured at startup, but `/style.css`, `/mermaid.min.js`
+  and `/live-client.js` were `readFile`-d per request against the
+  on-disk file. A checkout branch switch during the server's lifetime
+  silently changed what got served; the 2026-09-22 Product Map
+  preview rendered unstyled for exactly this reason. All three
+  assets are now read once at startup into memory and served from
+  there. The tree walker remains the only path that re-reads disk on
+  `rcf/` change.
+
+### Chain
+
+- AC-15601-6 amended with design amendments R5e (single-letter TLDs
+  are filename fragments), R5f (git protocol sentinel protection on
+  rule 3, extended URL rule 4 for git+ssh/ssh/git schemes) and R5g
+  (visible stderr warning when identity folding is disabled). All
+  three land on the same story so operators see one AC that names
+  the redactor's full posture.
+- `rcf define validate`: clean. `rcf audit coverage --strict`: clean
+  (103 requirements, 0 uncovered).
+
+### Release mechanics
+
+- Version bumped: `packages/rcf-lite/package.json` 0.28.2 -> 0.28.3.
+- Changelog entry under `## [0.28.3]` (this section).
+- Feed entry added under `releases/releases.yaml`; `latest` set to
+  0.28.3.
+- Tag / publish: Dave (not this PR).
+
 ## [0.28.2] - 2026-09-22
 
 Batched fix release for the seven defects Barry's WSD-lens dogfood on

package/bin/rcf.js

@@ -51,6 +51,10 @@ import { main as reqClassifyMain } from '../src/cli/req-classify.js';
 import { main as reqBaselineMain } from '../src/cli/req-baseline.js';
 import { main as intakeMain } from '../src/cli/intake.js';
 import { main as evalMain } from '../src/cli/eval.js';
+import { main as ledgerMain } from '../src/cli/ledger.js';
+import { main as readinessMain } from '../src/cli/readiness.js';
+import { main as questionsMain } from '../src/cli/questions.js';
+import { main as freezeMain } from '../src/cli/freeze.js';
 
 // Verify group members are handled by the verify-suite dispatch tree.
 import { main as verifyRunMain } from '../src/verify/cli/run.js';
@@ -95,6 +99,10 @@ export const GROUPS = {
     design: designMain,
     blueprint: blueprintMain,
     standards: standardsMain,
+    ledger: ledgerMain,
+    readiness: readinessMain,
+    questions: questionsMain,
+    freeze: freezeMain,
   },
   build: {
     // build sub-verbs are dispatched by build.js internally (queue |

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-22-001",
-      "createdAt": "2026-09-22T08:35:47.450Z",
-      "buildVersion": "0.28.2-mockdriver",
+      "id": "rc-2026-10-03-001",
+      "createdAt": "2026-10-03T12:16:10.630Z",
+      "buildVersion": "0.29.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-22-002",
-      "createdAt": "2026-09-22T08:35:47.451Z",
-      "buildVersion": "0.28.2-mockdriver",
+      "id": "rc-2026-10-03-002",
+      "createdAt": "2026-10-03T12:16:10.631Z",
+      "buildVersion": "0.29.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-22-003",
-      "createdAt": "2026-09-22T08:35:47.451Z",
-      "buildVersion": "0.28.2-mockdriver",
+      "id": "rc-2026-10-03-003",
+      "createdAt": "2026-10-03T12:16:10.631Z",
+      "buildVersion": "0.29.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/guidance/define-draft-shapes.md

@@ -0,0 +1,89 @@
+# Drafting the engineer's entry shapes
+
+This document is the content of the `rcf_define_draft_shapes` MCP
+prompt served argument-free by the server. The agent reads it once
+per session and runs the draft pass after L1 is green. The product
+owner is not in the room; the agent populates `[draft]`-marked
+entities, components and interfaces so the engineer walks into a tree
+whose shape is honest about what is still owed.
+
+## When to run
+
+Run this pass once `rcf define readiness --level intent` prints
+`levels.intentComplete.ok === true` and the product owner has stepped
+back. Not before. The draft pass reads only the brief ledger, the
+decisions ledger and the current tree; it writes only `[draft]`-marked
+content. `shapes:draftSettled` then lists exactly what the engineer
+has yet to own.
+
+Nothing in the draft pass can fail a product-owner check. That is the
+property that keeps L1 and the draft pass independent. If an edit
+would fail any check in the `productOwner` persona, stop and raise it
+back to the intent loop (it was not an engineer-only question).
+
+## The three homes
+
+The `[draft]` marker lives on three homes in 0.30.0. The agent writes
+to all three; `shapes:draftSettled` reads back from all three.
+
+- `TAD.dataArchitecture.coreEntities[].description` begins `[draft]`
+  for every entity minted from an `entity` statement. The marker
+  reports under id `TAD.entity:<name>`.
+- `TAC.purpose` begins `[draft]` for every TAC stub minted from a
+  `surface` or `externalSystem` cluster. The marker reports under id
+  `<tacId>`.
+- `TAC.interfaces[].description` begins `[draft]` for every interface
+  pre-populated inside a draft stub. The marker reports under id
+  `<tacId>:<name>`.
+
+Each marker is `[draft]` followed by a space and the one-sentence
+seed body. Leading whitespace is tolerated by the reader; keep the
+marker at the start of the string regardless.
+
+## The four writes
+
+Walk the brief in this order; each step writes `[draft]` content only.
+
+1. One `TAD.dataArchitecture.coreEntities[]` entry per `entity`
+   statement. `description` begins `[draft]` and quotes the
+   statement's source so the engineer can trace it. Use the statement
+   text to pick a name in UpperCamel; the engineer renames when the
+   entity is owned.
+2. One TAC stub per `surface` or `externalSystem` cluster when no
+   TAC exists for it. `purpose` begins `[draft]`; `responsibilities`
+   lists the statements the surface or external system serves (one
+   bullet per statement, in the brief's words). Pick a `tacId` of the
+   next free number and a descriptive slug; the engineer renames when
+   the TAC is owned.
+3. On each draft TAC, `[draft]` interfaces with real kinds from the
+   closed vocabulary (`recordShape`, `httpRoute`, `event`,
+   `cliCommand`, `uiRoute`, `port`, `fileFormat`, `fixture`,
+   `other`). Draft one of each kind the surface uses:
+   - a `recordShape` per entity the surface owns, with `fields:`
+     guessed from the brief;
+   - a `uiRoute` per surface;
+   - an `httpRoute` per exchange with an external system.
+   `description` begins `[draft]` with the one-line what-this-is.
+4. `rcf discover req-classify` over every REQ created in the loop, so
+   `skeleton:reqShape` passes where the classifier is confident and
+   the engineer sees only the rest. The classifier is already
+   available under `src/review/` or `src/discover/`; this prompt only
+   invokes it.
+
+## The read-back
+
+After the pass, run `rcf define readiness --json` and read
+`stages[].checks[]`. `shapes:draftSettled` is the engineer's entry
+list: every id it names is a shape the agent pre-populated and the
+engineer still has to settle. `shapes:tacHasInterface` and
+`shapes:kindVocabulary` have already applied to drafts, so an empty
+`shapes:tacHasInterface` finding means every stub carries at least
+one interface and an empty `shapes:kindVocabulary` finding means
+every interface's kind is in the closed vocabulary. The template
+marker check and the entity join arrive in a later PR; the draft
+pass does not need them to be honest about what is drafted.
+
+Hand over by naming the three id forms the engineer will see
+(`<tacId>:<name>`, `<tacId>`, `TAD.entity:<name>`) and the one verb
+they will run to walk them (`rcf define readiness`). Nothing further
+is said; the engineer owns the ladder from here.

package/guidance/define-intake.md

@@ -0,0 +1,97 @@
+# Document intake into the brief ledger
+
+This document is the content of the `rcf_define_intake` MCP prompt
+served argument-free by the server. It walks the harness through
+intake and lands every finding as an open-question statement the
+intent loop then asks.
+
+## What intake is
+
+The owner hands over a folder. One file is the brief (short, prose,
+the "what we are building" document); the rest are supporting
+documents (ADRs, spec sketches, old READMEs, OpenAPI YAML, meeting
+notes). The split that reaches the brief ledger is the harness's
+work; the mechanical scans and the follow-up questions are
+rcf-lite's.
+
+Intake is harness-split and tool-scanned. The harness writes
+`<source>.statements.md` beside each source; rcf-lite mints the
+statements, runs the three mechanical scans against the existing
+body, and appends one `openQuestion` statement per finding. The loop
+then reads one check (`brief:openQuestions`) and the owner answers
+in one place (ADR-4130).
+
+## The walk
+
+Walk the folder brief-first. For each source, in this order:
+
+1. Open the source.
+2. Split it into one statement per line. A statement is a sentence
+   that stands on its own: a capability (something the product must
+   do), a constraint (a rule it must obey), an actor (a person or
+   role), an entity (a thing it keeps track of), an externalSystem
+   (another system), a surface (a screen or channel), outOfScope
+   (something explicitly not in), an openQuestion (a question still
+   to answer), or an amendment (a correction to an earlier
+   statement).
+3. Write `<source>.statements.md` next to the source. Each line is
+   one statement with a leading `[kind]` marker and a trailing
+   `(source: <path>:<line-span>)` marker.
+4. Show the file to the owner in one message. Correct based on their
+   reply.
+5. Run `rcf define ledger brief add --from <path>` (or the
+   `rcf_define_ledger` MCP tool with `verb: add`, `from: <path>`).
+   The mechanical scans run by default; findings are appended as
+   openQuestion statements. Report the scan findings as plain
+   questions.
+6. Move to the next source.
+
+Never add two sources through one `brief add --from`. Each `add`
+scans the new ids against the existing body, and the scan source
+marker `scan:<name>:<ids>` names the ids from both sides.
+
+## The line grammar
+
+Each line of a statement file is a statement. The grammar:
+
+```
+[<kind>] <text> (source: <path>:<line-span>)
+```
+
+- `[<kind>]` is one of the nine kinds above. When absent, the kind
+  defaults to the harness's `--kind` flag (default `capability`), or
+  to `openQuestion` when the line ends with `?` or begins with
+  `TBC`, `TBD`, `Open:` or `Question:`.
+- `(source: ...)` names the file and the line range in the source.
+  When absent, the harness's `--source` flag or the file path itself
+  is used.
+- Everything between the two markers is the statement text,
+  verbatim.
+
+## What the owner sees
+
+A statement file is operator prose. The owner reads it; the harness
+corrects based on their reply. Example:
+
+```
+[capability] Officers can put a loan on hold for up to 30 days. (source: briefs/loans.md:12-14)
+[constraint] A loan on hold must not accrue late fees. (source: briefs/loans.md:15)
+[openQuestion] Who approves a hold longer than 30 days? (source: briefs/loans.md:16)
+```
+
+After `brief add --from` runs, the loop will ask about each of these
+through `rcf define questions --persona productOwner`.
+
+## After intake
+
+Run `rcf define questions --persona productOwner`. The next set is
+the `resolvedBy` questions for every capability, constraint, entity,
+actor, externalSystem and surface statement, suggesting existing
+REQ titles that share two or more words of 4+ characters. The owner
+decides which become new REQs, which point at existing REQs, and
+which are omitted.
+
+At L1 (`levels.intentComplete.ok === true`) the agent pre-populates
+`[draft]` entities, components and interfaces as engineer entry
+material. These are drafts the engineer refines; they are never a
+product-owner blocker.