rcf-lite 0.28.4 → 0.30.0

package/rcf/tacs/tac-4102-feedback-store.json

@@ -17,23 +17,23 @@
   "interfaces": [
     {
       "name": "readEntries",
-      "kind": "function",
-      "description": "Load and fold the JSONL log to current-state entries."
+      "kind": "other",
+      "description": "Load and fold the JSONL log to current-state entries. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "appendEntry",
-      "kind": "function",
-      "description": "Append one entry object as a JSONL line."
+      "kind": "other",
+      "description": "Append one entry object as a JSONL line. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "appendState",
-      "kind": "function",
-      "description": "Append one state-transition line for an existing id."
+      "kind": "other",
+      "description": "Append one state-transition line for an existing id. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "feedbackGitignoreEntry",
-      "kind": "constant",
-      "description": "Managed-gitignore contribution consumed by src/setup/managed-gitignore.js."
+      "kind": "other",
+      "description": "Managed-gitignore contribution consumed by src/setup/managed-gitignore.js. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -46,5 +46,5 @@
   "tradeoffs": "Append-only JSONL is trivial to write correctly and to inspect by eye; the cost is a fold on every read, which is negligible at the entry counts a single project will ever see.",
   "notes": "Gitignored, not committed. Raw entries can hold what redaction removes; committing them would leak on the next push for a public project.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4103-feedback-redact.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "redact",
-      "kind": "function",
-      "description": "Redact one string with the eight rules; return the redacted text and the ledger."
+      "kind": "other",
+      "description": "Redact one string with the eight rules; return the redacted text and the ledger. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "RedactionContext",
-      "kind": "type",
-      "description": "projectRoot, projectName, operatorName, gitRemote, allowHosts."
+      "kind": "recordShape",
+      "description": "projectRoot, projectName, operatorName, gitRemote, allowHosts. [legacy kind: type; mapped to recordShape per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -36,5 +36,5 @@
   "tradeoffs": "Rule-based redaction is testable with a fixture corpus and deterministic under review; the cost is that it will occasionally over-redact (a benign name that matches an entropy rule), which is what the disclosure ledger exists to catch.",
   "notes": "The stored entry is never mutated by redaction; the rendered output is what leaves.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-22T00:00:00Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4104-feedback-fingerprint.json

@@ -15,8 +15,8 @@
   "interfaces": [
     {
       "name": "fingerprint",
-      "kind": "function",
-      "description": "Compute the entry fingerprint from its canonical input."
+      "kind": "other",
+      "description": "Compute the entry fingerprint from its canonical input. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -29,5 +29,5 @@
   "tradeoffs": "A tiny fingerprint (12 hex = 48 bits) risks a collision at very large corpuses; at the scale of a single blueprint tracker it is safe, and issues carry the full-anchor context in the body so a maintainer resolves a rare collision by hand.",
   "notes": "The fingerprint appears twice in the body (visible line and HTML comment) so maintainer edits do not lose it.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4105-feedback-render.json

@@ -16,18 +16,18 @@
   "interfaces": [
     {
       "name": "renderIssue",
-      "kind": "function",
-      "description": "Return { title, body, labels[] } for a create call."
+      "kind": "other",
+      "description": "Return { title, body, labels[] } for a create call. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderComment",
-      "kind": "function",
-      "description": "Return the comment body for a +1 add."
+      "kind": "other",
+      "description": "Return the comment body for a +1 add. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderBundle",
-      "kind": "function",
-      "description": "Return the markdown bundle string for outbox files."
+      "kind": "other",
+      "description": "Return the markdown bundle string for outbox files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -41,5 +41,5 @@
   "tradeoffs": "Static templates keep the shape reviewable by eye and byte-comparable in tests; the cost is that template drift requires golden updates, which is exactly the discipline the tests exist for.",
   "notes": "The docs-site \"submit a blueprint idea\" form reuses these templates verbatim so triage sees one shape from both producers.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4106-feedback-destination.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "resolve",
-      "kind": "function",
-      "description": "Given an entry and the manifest+registry, return the destination shape."
+      "kind": "other",
+      "description": "Given an entry and the manifest+registry, return the destination shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "CORE_REPO",
-      "kind": "constant",
-      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test."
+      "kind": "other",
+      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -36,5 +36,5 @@
   "tradeoffs": "A declared destination on library.json requires library owners to author one field; the cost is a one-time PR per library, in exchange for correctness on every consuming project.",
   "notes": "A library mirrored from a fork would have derivation pointing at the fork; the declared issues field is why derivation is only a fallback.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T13:46:24.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4107-feedback-gh.json

@@ -15,18 +15,18 @@
   "interfaces": [
     {
       "name": "ghIssueCreate",
-      "kind": "function",
-      "description": "Create one issue on a repo with title, body and labels; return { url, number }."
+      "kind": "other",
+      "description": "Create one issue on a repo with title, body and labels; return { url, number }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueSearch",
-      "kind": "function",
-      "description": "Search issues on a repo by body query; return matches."
+      "kind": "other",
+      "description": "Search issues on a repo by body query; return matches. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueComment",
-      "kind": "function",
-      "description": "Comment on an issue; return { url }."
+      "kind": "other",
+      "description": "Comment on an issue; return { url }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -39,5 +39,5 @@
   "tradeoffs": "gh is a dependency the reporter chooses to install; the cost is a fallback bundle path when gh is missing, which the design considers a feature rather than a bug.",
   "notes": "A future MCP-only harness would call the CLI too; a native gh-lib port is not planned for v1.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4108-feedback-hook.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "shouldAsk",
-      "kind": "function",
-      "description": "Pure decision on the quiet rule; unit-tested across the full table."
+      "kind": "other",
+      "description": "Pure decision on the quiet rule; unit-tested across the full table. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "emit",
-      "kind": "function",
-      "description": "Per-harness output; exit code and shape."
+      "kind": "other",
+      "description": "Per-harness output; exit code and shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "installHooks",
-      "kind": "function",
-      "description": "Merge the hook entries into the two harness config files."
+      "kind": "other",
+      "description": "Merge the hook entries into the two harness config files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -42,5 +42,5 @@
   "tradeoffs": "Two harness config files to maintain and one handler; the cost is small (one merge pattern per file) and the benefit is one implementation of the quiet rule for both harnesses.",
   "notes": "The asked record is appended before the emit path, so a crash between emit and reply cannot cause a second ask.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4121-define-ledgers.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-24T12:00:00Z",
-  "updatedAt": "2026-09-24T12:00:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z",
   "tacId": "TAC-4121-define-ledgers",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -15,9 +15,22 @@
     "resolveEntry flips status to resolved, stamps resolvedAt, throws LedgerError code 'usage' when the id is unknown, is idempotent-ish (resolving twice refreshes resolvedAt).",
     "parseBriefFromFile splits by non-empty lines, strips leading '- ', '* ' or '<n>. ' bullets, defaults kind to 'capability', and threads --source through to every draft.",
     "src/cli/ledger.js: `rcf define ledger <name> <verb>` argv parsing; verbs add / resolve / list; ledger-specific flags for each; renderDecisionsList formats the #241 numbered layout; list --json emits { ledger, <arrayKey>: [...] }.",
-    "bin/rcf.js: register GROUPS.define.ledger; src/cli/help.js: import LEDGER_HELP and wire into HELP_MAP.define.ledger + DEFINE_HELP + top-level DEFINE listing so per-verb help stays single-sourced."
+    "bin/rcf.js: register GROUPS.define.ledger; src/cli/help.js: import LEDGER_HELP and wire into HELP_MAP.define.ledger + DEFINE_HELP + top-level DEFINE listing so per-verb help stays single-sourced.",
+    "`update <id>` subverb patches named fields and re-runs full-body validation; `resolvedBy` is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2.",
+    "concern ledger carries `applied`/`waived` entries keyed by `<REQ>:<concern>` (spec section 4 row 'D5 catalogue', 0.30.0 PR 6): `crosscut:catalogue` reads the concern-ledger body and matches each applicable `(reqShape, concern)` pair against an entry with that key. A `standards:<pack>` key names a waiver for `skeleton:standardsCited`. The ledger schema already carries `{ id, concern, reqId, disposition, reason?, addedAt, status, resolvedAt? }`; the `<REQ>:<concern>` key is composed by the gate from `concern` and `reqId` (no schema change)."
   ],
   "internalStructure": "The walker never reads under rcf/define/: subdirFor in src/core/store/loader.js returns null for anything that is not a known child kind (requirements, user-stories, tacs, adrs, fbs, test-suites, code-nodes, evals), so a ledger file sitting under rcf/define/ is never enumerated for schema validation. The walker-invisibility invariant is proved by a dedicated test that seeds the four ledger files plus a bug-bait req-shaped file under rcf/define/ and asserts zero walker error paths starting with rcf/define/ and no matching id in tree.byId. Validation is JSON-schema-shaped inline (no ajv, no @stravica-ai/rcf-schemas dependency) because the sidecars ride outside the shared schema until schemas 0.7 (ADR-4121).",
-  "interfaces": [],
+  "interfaces": [
+    {
+      "name": "rcf define ledger <name> update <id>",
+      "kind": "cliCommand",
+      "description": "Patch named fields on an existing ledger entry (brief, decisions, concerns or probes); full-body validation runs as `add` validates. On brief, `--resolved-by` must match the closed pointer grammar."
+    },
+    {
+      "name": "parseResolvedBy",
+      "kind": "other",
+      "description": "Parse a resolvedBy pointer against the tree; returns { ok, kind, target } on a resolved form (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) and { ok: false, why } otherwise."
+    }
+  ],
   "notes": "The intake-scan-against-frozen-statements hook on brief add --from is a named seam this slice leaves for a later one: 'rcf discover intake' is the intended caller in slice 2's D1 gate check, and this slice ensures the CLI has one place to inject that seam without a second refactor. `list --json` is a keep-alive for slice 5's viewer, which will render the same object over http."
 }

package/rcf/tacs/tac-4122-define-gates.json

@@ -1,25 +1,89 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T15:48:40Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
   "tacId": "TAC-4122-define-gates",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "define stage gates D1..D8",
   "purpose": "src/query/gates.js lands as a new pure module beside delta.js. Every stage has one exported check function that takes (tree, context) and returns the { stage, gate, state, checks[] } shape section 2.4 pins. computeReadiness (TAC-4123) is the composer; every gate function is otherwise consumable in isolation for tests and for future viewers that render one stage. No I/O, no state, no time: the caller supplies ledgers, profile, freeze, delta, validate errors, probe count and coverage rollups.",
   "responsibilities": [
     "src/query/gates.js: STAGE_ORDER = ['D1','D2','D3','D4','D5','D6','D7','D8']; STAGE_GATES map (D1 -> 'define.brief' etc.); INTERFACE_KINDS closed set matching proposal section 5.2; STAGE_SHORT_NAMES map (D1 -> 'brief' etc.).",
     "checkD1Brief: intake acknowledged (brief-ledger has at least one statement since the freeze high-water mark), every statement kinded from BRIEF_KINDS, every openQuestion statement resolved or promoted to a decisions-ledger entry, profile.md carries surface (viewer | runningApp | prDiff) and register (productOwner | engineer | unstated) markers.",
-    "checkD2Skeleton: every 'capability' and 'constraint' statement in scope resolves to a REQ (via a REQ id in the statement's resolvedBy field OR by name-match against a REQ title, cheap check); every REQ in scope has non-TODO description, shapeClassification and domain; TAD dataStores and coreEntities non-empty when any persistence REQ exists; exactly one deploy or deferral ADR tree-wide (title prefix 'Deploy target:' or 'Deploy deferral:').",
+    "checkD2Skeleton: every 'capability' and 'constraint' statement in scope resolves to a REQ (via a REQ id in the statement's resolvedBy field OR by name-match against a REQ title, cheap check); every REQ in scope has non-TODO description, shapeClassification and domain; TAD.dataArchitecture.dataStores and TAD.dataArchitecture.coreEntities non-empty when any persistence REQ exists (per rcf-schemas 0.6.3 tad.schema.json; the top-level path was a slice-2 drift corrected under w-2026-09-25-dave-004); exactly one deploy or deferral ADR tree-wide (title prefix 'Deploy target:' or 'Deploy deferral:').",
     "checkD3Shapes: every TAC in scope has at least one interface; every interface's kind is in INTERFACE_KINDS. Template markers, entity join, ownerRef resolution and path resolution are seams (0.30).",
     "checkD4Stories: every REQ in scope has at least one US (fbsByAcId inversion via reqByUs is enough); every US in scope has a testable AC (ac.testable !== false and description non-empty), a failure AC or a project-scoped or req-scoped opt-out with baselineKey 'defineD4:failure', a must-not AC or an opt-out with baselineKey 'defineD4:mustNot', tacIds non-empty and every id resolving to a walker-known TAC, and no AC description containing the scaffold TODO placeholder pattern (case-sensitive uppercase 'TODO:' with a colon -- the literal shape src/core/store/init.js writes; incidental prose mentioning 'todo' does NOT trip the gate, and the validate CLI's broader whole-word notice stays separate).",
     "checkD5Crosscut: TAD.securityArchitecture non-empty when tree carries any REQ with shape 'auth' or 'httpApi'; TAD.operationalConcerns non-empty when any AC description carries the '[deployed]' marker; every concern-ledger entry on a REQ in scope has disposition applied or waived (no status 'open').",
     "checkD6Consistency: caller-supplied validateErrors is empty (tree-wide); caller-supplied probeOpenCount is zero.",
     "checkD7Decisions: no decisions-ledger entry with status 'open'.",
-    "checkD8Freeze: prior stages passed | acknowledged at the current tree hash; every AC id owned by exactly one FBS (walker.fbsByAcId length 1); computeQueue.nextActionable is not null (queue head actionable) and the head's title is not 'TODO' or empty; validateErrors empty."
+    "checkD8Freeze: prior stages passed | acknowledged at the current tree hash; every AC id owned by exactly one FBS (walker.fbsByAcId length 1); computeQueue.nextActionable is not null (queue head actionable) and the head's title is not 'TODO' or empty; validateErrors empty.",
+    "src/setup/identity-seed.js IDENTITY_TEMPLATE seeds a '## Surface' section carrying one of 'viewer' | 'runningApp' | 'prDiff' (default 'prDiff') so a fresh 'rcf init' project satisfies checkD1Brief's profile:surface marker without the operator editing profile.md first.",
+    "ADR-4126 (0.29.0): own the per-check persona and question map; export `CHECK_PERSONA`, `CHECK_QUESTION`, `STAGE_FALLBACK_PERSONA`, `checkPersona(name)`, `checkQuestion(name)` and `parseInterfaceDraft(iface)`. Every entry in `stages[].checks[]` carries `persona` (productOwner | engineer) and a non-empty `question`; the `stage:<D>:scope` placeholder uses `STAGE_FALLBACK_PERSONA`.",
+    "ADR-4126 (0.29.0): split `skeleton:reqFields` into `skeleton:reqIntent` (productOwner: description without TODO and domain, evaluated per REQ independently) and `skeleton:reqShape` (engineer: shapeClassification.shapes). Split `decisions:allAnswered` into `decisions:wellFormed` (productOwner: non-empty question + two or more options + a default naming one of them) and `decisions:allAnswered` (engineer: zero open).",
+    "ADR-4126 (0.29.0): new D3 check `shapes:draftSettled` fails any interface whose `description` starts with `[draft]` (whitespace tolerated), id `<tacId>:<name>`, over delta, total = interfaces on TACs in scope; `tacHasInterface` counts a draft as present; `kindVocabulary` applies to drafts.",
+    "`shapes:draftSettled` reports `[draft]` on `TAC.purpose`, `coreEntities[].description` and `TAC.interfaces[].description` with ids `<tacId>`, `TAD.entity:<name>` and `<tacId>:<name>` respectively (REQ-188, 0.30.0): `parseInterfaceDraft` reads the marker on all three homes with the same whitespace-tolerant rule; the draft pass enumerates across the three homes; nothing in the draft pass can fail a product-owner check.",
+    "`shapes:templateMarkers` (per-kind marker presence on `interfaces[].description`) (ADR-4131, 0.30.0 PR 5): engineer, over delta, id `<tacId>:<name>`, `why` names the missing marker; `recordShape` needs `fields:`; `httpRoute` needs `method`, `path`, `request`, `response`, `errors`; `fixture` needs `instances:`; `event` needs `payload:`; `cliCommand` needs `usage:`; `uiRoute` needs `path`; `port` needs `protocol`; `fileFormat` needs `format:`; `other` needs a note. Drafts are included (a `[draft]` recordShape without `fields:` fails exactly as a settled one).",
+    "`shapes:entityJoin` (every `coreEntities[].name` named by exactly one `recordShape`) (ADR-4131, 0.30.0 PR 5): engineer, over tree; match on `name` or an `entity:` line in the template; fail ids `TAD.entity:<name>` with `no record shape` or `N record shapes`.",
+    "`shapes:pathsResolve` (any `path:`-like token in an interface description that looks like a repo path resolves on disk or the description carries `authoredAt: D3`) (ADR-4131, 0.30.0 PR 5): engineer, over delta; gates stay pure, the readiness CLI resolves candidate paths and passes `resolvedPaths` in the stage context; ids `<tacId>:<name>` with the unresolved path in `why`.",
+    "`ackable(stage)` (ADR-4131, 0.30.0 PR 5): exported helper that returns `true` for D3, D5, D6 and `false` for every other stage. `stagePolicy(stage)` is unchanged; `ackable` is the companion that names the three gates that accept a recorded `--ack` override.",
+    "`stories:closedSets` (0.30.0 PR 6, spec section 4 row 'D4 closed-set and ownerRef as findings'): engineer, over delta. An AC whose description contains an enumeration cue (`one of`, `any of`, `the following`, `types of`, `status is`) without an inline bracketed list or an `ownerRef` fails. Honours the shared quoted-cue guard with D6: a cue inside a double-quoted substring does not fire.",
+    "`stories:ownerRefResolves` (0.30.0 PR 6; widened under R11 in PR 9, spec section 17): engineer, over delta plus tree for ownerRef targets. Every ownerRef on an AC with a tacId OR adrId whose field names an existing field path on the owning document (bracket grammar: interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>]; or a bare schema field name -- purpose, decision, internalStructure, etc.) resolves. Dotted grammar is refused. Failing ids name the AC and the unresolved pointer with the why string `ownerRef does not resolve`. Validate reuses this check via `resolveOwnerRefField` (PR 8 adds the finding row, PR 9 generalises both arms).",
+    "`crosscut:catalogue` (0.30.0 PR 6, spec section 4 row 'D5 catalogue'): engineer, over tree. For every REQ in scope, enumerate applicable `(reqShape, concern)` pairs through `src/define/concern-catalogue.js` (eight concerns keyed by REQ shape); each pair needs a concern-ledger entry keyed `<REQ>:<concern>` with disposition `applied` or `waived` (with a reason for waived). Failing ids are `<REQ>:<concern>`. Keys shared with the baseline catalogue where names coincide. D5 is ackable: readiness --check crosscut rides the same --ack fold as D3.",
+    "`skeleton:standardsCited` (0.30.0 PR 6, spec section 4 row 'Standards-ingestion check'): engineer, over tree. Every standards pack registered through `rcf define standards` (manifest.standards[].slug) is cited in a REQ `rationale` or an ADR, or waived by a concern-ledger entry with key `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and unwaived'.",
+    "`src/define/concern-catalogue.js` (0.30.0 PR 6): the eight-concern applicability map keyed by REQ shape: `auth` to `auth`/`httpApi`; `errorEnvelope` to `httpApi`/`cliCommand`; `loggingAudit` to all shapes but `other`; `retention` to `persistence`; `performance` to `httpApi`/`batch`; `secrets` to `auth`/`externalIntegration`; `timeAndTimezone` to `persistence`/`batch`; `concurrencyIdempotency` to `httpApi`/`persistence`. Exports `applicableConcernsFor(reqShape)` returning the concern keys that apply, plus `CONCERN_KEYS` and `CONCERN_APPLICABILITY` for tests. Pure; no I/O.",
+    "`consistency:contradictions` (0.30.0 PR 7, spec section 4 row 'D6 scans and the injectable probe runner'): engineer, over delta. Two ACs on one story sharing a `when` clause with a negated `then` fail the story; failing ids name the story and both AC ids. The named false-positive guard: a negation inside a double-quoted substring in a `then` does not fail the story (the shared quoted-substring guard with D4).",
+    "`consistency:unsatisfiable` (0.30.0 PR 7): engineer, over delta. A `then` naming a field that no `recordShape` defines fails the AC; a field defined in a `[draft]` recordShape counts as defined. Failing ids `<acId>:<field>`.",
+    "`consistency:duplicates` (0.30.0 PR 7): engineer, over tree. Identical AC descriptions across stories fail both ACs with id `<acId>` and why 'duplicate description'. The comparison trims leading whitespace and the leading `[class]` marker.",
+    "`consistency:orphanInterfaces` (0.30.0 PR 7): engineer, over tree. An interface on a TAC that no AC's `ownerRef` points at and that no REQ's `deliveredBy` reaches fails with id `<tacId>:<name>` and why 'no AC ownerRef and no REQ deliveredBy reaches it'. Shares the `interfaces[<name>]` pointer grammar with D4 `stories:ownerRefResolves`."
   ],
   "internalStructure": "Every stage function follows the same shape: 1) decide notApplicable per section 3.2 and return { state: 'notApplicable' } with a single-check summary; 2) build checks[] as a list of { name, ok, over, pass, total, failing: [{ id, why }] }; 3) fold to state: 'passed' if every ok is true; 'failing' otherwise, unless the stage is D3/D5/D6 AND freeze.gates[<gate>].state === 'acknowledged' AND freeze.gates[<gate>].at.hash === currentTreeHash, in which case state is 'acknowledged'. Blocking-vs-warn is a property of the stage, not of the state: D3/D5/D6 use the acknowledged fold, D1/D2/D4/D7/D8 do not. The caller (readiness) folds the array of stage results into freezeable and nextAction.",
-  "interfaces": [],
+  "interfaces": [
+    {
+      "name": "CHECK_PERSONA",
+      "kind": "other",
+      "description": "[draft] Owning persona map (productOwner | engineer) for every stage-gate check in 0.29.0 (ADR-4126)."
+    },
+    {
+      "name": "CHECK_QUESTION",
+      "kind": "other",
+      "description": "[draft] Per-check heading question in the owning persona's register; the report and the Readiness tab print it as the heading of each check's findings list."
+    },
+    {
+      "name": "STAGE_FALLBACK_PERSONA",
+      "kind": "other",
+      "description": "[draft] Per-stage fallback persona for the `stage:<D>:scope` placeholder check that `notApplicable` envelopes carry."
+    },
+    {
+      "name": "checkPersona",
+      "kind": "other",
+      "description": "[draft] Look up the owning persona for a check name; returns 'productOwner' | 'engineer' | null."
+    },
+    {
+      "name": "checkQuestion",
+      "kind": "other",
+      "description": "[draft] Look up the question heading for a check name; returns the empty string when no question is registered."
+    },
+    {
+      "name": "parseInterfaceDraft",
+      "kind": "other",
+      "description": "[draft] True when an interface's `description` carries the leading `[draft]` marker (whitespace tolerated)."
+    },
+    {
+      "name": "parseInterfaceTemplate",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseInterfaceTemplate(iface) returns the per-kind marker presence for an interface: for a recordShape it reports whether `fields:` is present; for an httpRoute it reports whether each of method, path, request, response and errors is present; for fixture it reports `instances:`; for event, cliCommand, uiRoute, port, fileFormat and other it reports the per-kind markers from spec section 4 row 'D3 template parser'. Exported from src/query/gates.js for shapes:templateMarkers and for the validate step 6 notice (0.30.0 PR 5)."
+    },
+    {
+      "name": "ackable",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): ackable(stage) returns true for D3, D5 and D6 and false for every other stage. The CLI readiness and freeze verbs read it to gate --ack as the recorded override for just those three gates (ADR-4131)."
+    },
+    {
+      "name": "applicableConcernsFor",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): applicableConcernsFor(reqShape) returns the concern keys that apply to a REQ shape, per the eight-concern applicability map in src/define/concern-catalogue.js (0.30.0 PR 6). Pure. crosscut:catalogue reads this to decide which (reqShape, concern) pairs each REQ in scope must have a concern-ledger entry for."
+    }
+  ],
   "notes": "Slice-3 hook (rcf define freeze): reads state to refuse on any 'failing'; --ack <gate> --reason <text> writes freeze.gates[<gate>] = { state: 'acknowledged', at: { hash: <currentTreeHash>, reason: <text>, by: <id> } } and re-runs computeReadiness to check freezeable. Slice-5 hook (viewer): reads the same object end-to-end."
 }

package/rcf/tacs/tac-4123-define-readiness.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T15:48:40Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
   "tacId": "TAC-4123-define-readiness",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "computeReadiness compute and rcf define readiness CLI",
   "purpose": "src/query/readiness.js and src/cli/readiness.js land as a matched pair. The pure module composes computeDelta, computeImpact, the eight gate check functions from TAC-4122, computeCoverage, and the decisions ledger into the single-object contract section 2.4 pins; the CLI is its twin. Text output for readable status; --json for machine consumers and the viewer slice; --check <stage>|all for targeted inspection with the same 0-green / 4-red exit shape rcf audit coverage uses.",
@@ -17,9 +17,71 @@
     "src/cli/readiness.js: text output = tree line, next-action line, chip line (D1..D8 with state color words), stage-by-stage failing items (checks with failing ids); --check exits 4 for a blocking stage that is failing, 0 with a stderr [warn] for a warn-with-ack stage that is failing but not acknowledged, 0 otherwise.",
     "src/define/ledgers.js (P3 resolution): loadAllLedgers checks each ledger file's existence with statPath and omits missing files from the returned bundle; loadLedger keeps returning an empty ledger on ENOENT so single-ledger callers retain the ergonomic default.",
     "bin/rcf.js: register GROUPS.define.readiness -> readinessMain; src/cli/help.js: import READINESS_HELP and wire into HELP_MAP.define.readiness + DEFINE_HELP + top-level DEFINE listing.",
-    "src/query/index.js: export computeReadiness (plus its subhelpers where useful for tests) so downstream consumers (slice 3 freeze, slice 5 viewer) import through the same seam every other query verb does."
+    "src/query/index.js: export computeReadiness (plus its subhelpers where useful for tests) so downstream consumers (slice 3 freeze, slice 5 viewer) import through the same seam every other query verb does.",
+    "ADR-4126 (0.29.0): fold `levels` and `personas` from `stages[].checks[]` after the eight stage functions run. `levels.intentComplete.ok` is \"every productOwner check ok\" across every stage (stage state ignored); `levels.intentComplete.blockedBy` lists every failing PO check with ids capped at 20. `levels.readyToBuild.ok` equals freezeable; `levels.readyToBuild.blockedBy` lists every failing check in a stage whose state is `failing` (checks inside an `acknowledged` stage are not blockers). `personas.productOwner.blockers` deep-equals `levels.intentComplete.blockedBy`; `personas.engineer.blockers` is the failing engineer checks in failing stages. `levels.readyToBuild.nextAction` deep-equals the top-level `nextAction`.",
+    "ADR-4126 (0.29.0): `deriveNextAction(stages, persona?)` gains an optional persona argument. With no persona it behaves exactly as 0.28.4. With a persona it picks the first stage in D1..D8 order holding a failing check of that persona, then the check with the largest failing list; the command carries `--level intent` on the productOwner variant. `formatVerdictLines(result)` builds the two strings (`Intent-complete: yes/no...` and `Ready-to-build: yes/no...`) shared by the CLI (PR B) and the Readiness tab (PR C) so they cannot disagree.",
+    "ADR-4126 (0.29.0): the levels and personas folds are additive; every 0.28.4 top-level field (tree, delta, stages, nextAction, coverage, decisions, freezeable) is present with its 0.28.4 type. No file under rcf/ is created or modified by any `rcf define readiness` invocation. The CLI flags (`--level`, `--persona`) and the viewer tab are PR B and PR C respectively; the compute lands first (PR A).",
+    "ADR-4126 PR B (0.29.0): src/cli/readiness.js owns the --level intent|build and --persona productOwner|engineer dispatch. --level drives the exit code against levels.<which>.ok per spec section 3.2 (stricter than --check all on warn-with-ack failures per decision 4); --persona is a display filter that never affects the exit code or JSON content. parseLevelFlag and parsePersonaFlag share the usage-line shape with --check. Unknown values exit 2 with a usage line naming the accepted set. The CLI passes the resolved level into computeReadiness via the readiness context so _meta.level reflects the invocation (null when the flag was absent).",
+    "ADR-4126 PR B (0.29.0): the text report prints both verdict lines (shared via formatVerdictLines) at the top; regroups blockers into one 'Product owner: N question(s)' and one 'Engineer: N check(s) blocking' section ordered by the profile register (productOwner-first or engineer-first; unstated and absent profile default to PO first); and renders the per-check line in the per-stage detail block with the persona inside the parenthesis after `over`. --persona X collapses the opposite-persona block to one 'hidden; run without --persona' line and restricts the per-stage detail to matching-persona checks.",
+    "ADR-4131 (0.30.0 PR 5): collects candidate paths; the CLI resolves them on disk and passes `resolvedPaths` in the stage context so the `shapes:pathsResolve` check can decide a path:-like token against the real filesystem without turning the gates module into an I/O module. The compute remains pure: readiness.js owns the collection seam; cli/readiness.js owns the resolve-on-disk step before invoking the gate functions.",
+    "ADR-4131 (0.30.0 PR 5): the readiness CLI --check policy becomes bite-aware for D3. --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash (same recorded-override channel ADR-4124 pins). --check on D4, D5 and D6 keeps the 0.29.0 behaviour until their own PRs (6 and 7) bite. --level intent and --level build exits are unchanged.",
+    "ADR-4131 extended (0.30.0 PR 7, spec section 11.6): computeReadiness accepts an injectable `probeRunner` ({ reqId, tree }) => findings[], default null; findings land as probe-ledger entries in the result (merged into `ledgers.probes.probes[]` the gate reads) and count toward consistency:probeCount. With no probeRunner the result equals the 0.29.0 result on the same fixture. src/define/probe-runner.js lands as the seam only; no shipped runner (the harness is the runner through `ledger probes add`). The CLI never passes a probeRunner today; the seam is for test harnesses and for a later harness-driven call site.",
+    "ADR-4131 extended (0.30.0 PR 7; R9 amended 2026-10-03, w-2026-10-03-dave-011): --litmus <n> on readiness and freeze requires n distinct litmus readings at the current LITMUS HASH. A litmus reading is a probe-ledger entry whose `finding` begins `litmus:<reader>:` and whose text includes a `hash` matching `tree.litmusHash`. The litmus hash is the tree hash computed with the probes ledger excluded (new computeLitmusHash helper in src/query/readiness.js); the probes ledger is inside `tree.currentTreeHash` by ADR-4120, so a reader writing a probe-ledger entry that referenced `currentTreeHash` would shift the hash it just attested to. The litmus hash is the content-stable hash readers pin to: writes to the probes ledger do not shift it, so n readers can land `litmus:<reader>:` entries at the same hash; writes to the brief, decisions or concerns ledgers do shift it (the content under review has changed). One reader exits 4 naming the shortfall; n distinct readers at the hash pass. No process is spawned and no network call is made; the harness is the runner. `--litmus-attested` remains the default attestation path. Trade-off: litmus readings do not attest to probe findings written after them, which is acceptable because probe entries are themselves readings.",
+    "ADR-4131 extended (0.30.0 PR 7): the readiness CLI --check policy becomes bite-aware for D6. --check consistency exits 4 on an unacknowledged D6 failure and 0 when acked at the current hash (the one-line change: D6 joins the BITING_STAGES set in src/cli/readiness.js; the --ack channel D3/D5/D6 already share stays unchanged).",
+    "PR 9 (REQ-179 enforcement locus): the CLI computes readiness BEFORE calling `runWithAdmissibilityGate`, passing the computed `stages[]` and the validate-errors array via `defineStages` and `defineValidateErrors`; the wrap evaluates NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors), honouring --ack-at-current-hash as the recordedInChain override for ADM-02/03. The compute still runs and prints under refusal (AC-17902-4)."
   ],
   "internalStructure": "readiness.js is a linear composer: 1) compute delta and its docHashes; 2) fan-out impacted / impactedFbs; 3) build stage context (freeze, delta, scope, ledgers, profile, validateErrors, probeOpenCount, coverageTree); 4) call the eight check functions; 5) fold freezeable and nextAction. The CLI parses flags, loads the tree once, loads the four ledgers and the freeze record once, computes the readiness, then routes to the text or JSON emitter. --check maps its argument to the STAGE_SHORT_NAMES map (brief -> D1 ... freeze -> D8) or accepts D1..D8 directly. The runWithAdmissibilityGate wrap sits inside main so refusals ride the same exit path as coverage's admissibility refusals.",
-  "interfaces": [],
+  "interfaces": [
+    {
+      "name": "deriveLevels",
+      "kind": "other",
+      "description": "[draft] Fold the two levels (intentComplete, readyToBuild) from `stages[].checks[]` (ADR-4126, proposal section 2.1)."
+    },
+    {
+      "name": "derivePersonas",
+      "kind": "other",
+      "description": "[draft] Fold the `personas` block; productOwner.blockers deep-equals levels.intentComplete.blockedBy; engineer.blockers is the failing engineer checks in failing stages."
+    },
+    {
+      "name": "deriveNextAction",
+      "kind": "other",
+      "description": "[draft] Pick the first failing stage (optionally persona-filtered); carries `--level intent` on the productOwner variant."
+    },
+    {
+      "name": "formatVerdictLines",
+      "kind": "other",
+      "description": "[draft] Build the two verdict strings (Intent-complete and Ready-to-build) shared by the CLI and the Readiness tab so the two surfaces cannot disagree."
+    },
+    {
+      "name": "parseLevelFlag",
+      "kind": "other",
+      "description": "[draft] Validate --level against the closed value set (intent | build); return 'intent' | 'build' | null (flag absent) or throw a usage error for an unknown value (CLI maps the throw to exit 2 with a stderr usage line)."
+    },
+    {
+      "name": "parsePersonaFlag",
+      "kind": "other",
+      "description": "[draft] Validate --persona against the closed value set (productOwner | engineer); return the value or null (flag absent) or throw a usage error for an unknown value."
+    },
+    {
+      "name": "parseLitmusFlag",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseLitmusFlag(raw) parses --litmus <n> as a positive integer; returns null (flag absent) or throws a usage error for a non-integer or non-positive value (0.30.0 PR 7, ADR-4131 extended)."
+    },
+    {
+      "name": "countLitmusReadersAtHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): countLitmusReadersAtHash(ledgers, hash) returns the set of distinct reader ids extracted from probe-ledger entries whose `finding` begins `litmus:<reader>:` and whose text includes `hash` (0.30.0 PR 7). Pure. The CLI exits 4 when the set size is below --litmus <n>. `hash` is `tree.litmusHash` (ADR-4131 extended R9, w-2026-10-03-dave-011), not `tree.currentTreeHash`: the probes ledger is inside currentTreeHash by ADR-4120, so a reader writing a probe-ledger entry that referenced currentTreeHash would shift the hash it just attested to."
+    },
+    {
+      "name": "computeLitmusHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): computeLitmusHash(tree, ledgers) returns the tree hash (`sha256:<hex>`) recomputed with the probes ledger excluded (ADR-4131 extended R9, w-2026-10-03-dave-011). Reuses hashDocument and computeTreeHash from src/query/delta.js. Pure. The result is stable under writes to the probes ledger (so n readers can pin litmus entries to the same hash) and shifts the same way currentTreeHash shifts under writes to the brief, decisions or concerns ledgers (which do change what the readers were attesting to)."
+    },
+    {
+      "name": "probeRunner",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): injectable runner shape `({ reqId, tree }) => findings[]`, default null. computeReadiness calls the runner (when set) over every REQ in scope and merges the returned findings into ledgers.probes.probes[] so the gate reads them (0.30.0 PR 7). No runner ships; src/define/probe-runner.js carries the seam only. Pure over its inputs; must not do I/O or spawn a process."
+    }
+  ],
   "notes": "Slice-3 hook (rcf define freeze) reads freezeable and stages[].state; --ack <gate> writes into freeze.gates[<gate>] and re-computes readiness. Slice-5 hook (viewer) fetches the same JSON object over the existing tab wire and renders the pill vocabulary + findings-list + diff components. Performance seam: computeImpact per id on a whole-tree delta (before freeze) may be quadratic on very large trees; the compute stays fast on the dogfood chain (~700 documents, sub-second) but the CLI notes the wall time in text mode so an operator can spot regression."
 }

package/rcf/tacs/tac-4124-define-freeze.json

@@ -0,0 +1,28 @@
+{
+  "createdAt": "2026-09-24T16:33:15Z",
+  "updatedAt": "2026-09-24T16:33:15Z",
+  "tacId": "TAC-4124-define-freeze",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "rcf define freeze CLI verb",
+  "purpose": "src/cli/freeze.js is the only writer of rcf/define/freeze.json in the shipped product. It composes readiness (REQ-175) with the freeze-record writer (REQ-172): one call to computeReadiness, one conditional call to saveFreezeRecord, one section 2.5 summary line, one exit code. The verb is the visible contract slice 4's bundle --next and slice 5's viewer read against; no other verb writes the freeze record.",
+  "responsibilities": [
+    "src/cli/freeze.js: parseArgs contract with --ack (multiple), --reason (multiple), --note, --litmus-attested (comma-separated D-names), --status, --json, --help; exit codes 0 success / 2 usage / 4 refused-on-failing.",
+    "src/cli/freeze.js: --ack argument validation runs before any tree load and refuses unknown gates and mismatched --ack/--reason pair counts with exit 2 and a stderr message naming the accepted set (define.shapes | define.crosscut | define.consistency with their short-name aliases).",
+    "src/cli/freeze.js: build tree + freeze + ledgers + testPointers concurrently (Promise.all mirroring readiness), then runWithAdmissibilityGate around computeReadiness, then apply --ack acknowledgements into an in-memory freeze.gates map keyed by gate id and recompute state per WARN_WITH_ACK stage.",
+    "src/cli/freeze.js: on any remaining 'failing' stage after acks, print the failing-stage block on stderr and exit 4 without writing.",
+    "src/cli/freeze.js: on freezeable, assemble the record body: reuse delta.js currentHashes generator (recompute matching what computeDelta uses so treeHash and docHashes agree with computeReadiness's currentTreeHash), derive counts, write the record via saveFreezeRecord, and print the section 2.5 summary (or --json envelope).",
+    "src/cli/freeze.js: --status branch runs no gates and never writes; it loads the record and computeDelta (unfrozen path when record absent) and prints the summary block, or emits { record, delta } on --json.",
+    "src/define/freeze-record.js: validateFreezeRecord requires override as a nullable field (throws FreezeRecordError field 'override' when the key is missing); loadFreezeRecord defaults a missing key to null so older records load; saveFreezeRecord's own validate step catches a caller that forgets to write override.",
+    "src/cli/readiness.js and CHANGELOG.md: replace ' -- ' with a colon in the two spots the brief calls out.",
+    "bin/rcf.js and src/cli/help.js: register the freeze verb (GROUPS.define.freeze, HELP_MAP.define.freeze, DEFINE_HELP listing).",
+    "Version reading: rcfLite from packages/rcf-lite/package.json (read once, cached via ESM import), ruleset from src/ruleset/ruleset.json's rulesetVersion or the umbrella version depending on the ruleset shape, schemas from node_modules/@stravica-ai/rcf-schemas/package.json (fall back to the manifest.schemasVersion when the package cannot be read)."
+  ],
+  "internalStructure": "One CLI module, three top-level branches by flag: --help early exit; --status branch (readRecord, computeDelta, format); default freeze branch (loadEverything, runReadiness, applyAcks, decideExit, writeRecord, formatSummary). Ack parsing is a small helper that walks the multi-valued --ack and --reason arrays in parallel, matching each ack gate to the next reason; a mismatch is a UsageError the caller catches. Counts derivation reuses tree.kindById to bucket ids into { req, us, ac, tac, adr, fbs }; the AC bucket walks every US and every US's acceptanceCriteria[]; acByClass parses the leading '[<class>]' marker using gates.js parseAcClass; interfaces bucketing walks every TAC's interfaces[] and buckets by kind. The 'first freeze' path is decided by (loadFreezeRecord() === null) BEFORE the freeze runs; branch is not re-derived from delta shape.",
+  "interfaces": [
+    { "kind": "cliCommand", "name": "rcf define freeze", "description": "The freeze CLI verb; the single interface this TAC ships." }
+  ],
+  "notes": "Slice-4 hook (bundle --next): reads freeze.gates and freeze.frozenAt to decide the impacted-FBS printout; the impactedFbs field is not on the record yet (it is a computed shape). Slice-5 hook (viewer): renders the section-2.5 summary from the record + a fresh computeDelta call over the live tree. Litmus attestation seam (proposal section 9 decision 7): the --litmus-attested flag records the operator's per-decision attestation; the --litmus <n> real-dispatch runner is a named 0.30 seam (slice 6)."
+}

package/rcf/tacs/tac-4125-build-bundle-refuse-override-skip.json

@@ -0,0 +1,43 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
+  "tacId": "TAC-4125-build-bundle-refuse-override-skip",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.1",
+  "status": "draft",
+  "name": "build bundle --next refusal, override and impacted-FBS skip",
+  "purpose": "0.30.0 PR 8 (spec section 4 bundle row, section 11.7 US-17702). `rcf build bundle --next` is tightened against the detection-model freeze record: without a freeze record the verb refuses with exit 4 naming `rcf define readiness`; `--override \"<reason>\"` writes `freeze.override { reason, by, at }` through saveFreezeRecord and proceeds; on a non-empty delta against the current tree, the next-item compute skips re-execute FBS impacted by the delta with the reason text in a line and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb refuses with exit 4 with the same message. On a frozen tree with an empty delta the verb's 0.29.0 shape is unchanged (AC-17702-5).",
+  "responsibilities": [
+    "refusal: on `bundle --next` with no freeze record, exit 4 with a usage line naming `rcf define readiness` (and `--override \"<reason>\"` as the override channel); the next-item compute does not run.",
+    "override: `--override \"<reason>\"` on `bundle --next` writes `freeze.override { reason, by, at }` through saveFreezeRecord before the next-item compute runs; `--override` without a non-empty reason is a usage refusal (exit 2); when a freeze record exists the override is still written and the override reason is named in the output.",
+    "skip: on a non-empty delta against the current tree hash, next-item selection filters re-execute FBS impacted by the delta out of the actionable queue with a stderr line naming each skipped FBS and the reason; the next unimpacted actionable FBS is handed out.",
+    "all-impacted refusal: when every actionable FBS is impacted by the delta and no override is given, the verb refuses with exit 4 and the same message pointing at `--override \"<reason>\"`.",
+    "unchanged on empty delta: on a frozen tree with an empty delta the verb's output and exit code are byte-for-byte unchanged from 0.29.0 (AC-17702-5).",
+    "override.by identity (PR 9, AC-17702-6): freeze.override.by is resolved by `resolveOverrideBy({projectRoot})` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`. Each failing arm falls through silently to the next; the write path cannot blow up on a stripped-down container."
+  ],
+  "internalStructure": "The next-item path in `src/cli/build.js` grows a pre-emit guard (`enforceBundleNextFreezeGate`) that loads the freeze record and the computed delta via loadFreezeRecord and computeDelta, applies the `--override` write (if given) before the next-item compute, and emits a refusal when the record is absent and no override is given. The impacted-FBS skip extends `selectNext` to accept an `impactedFbsIds` set and skip them with a stderr reason; the all-impacted case falls through to a refusal rather than an empty envelope. `freeze.override` records come through `saveFreezeRecord` so the existing schema and canonical-JSON contract are reused; a short writer `applyOverrideToFreezeRecord` writes `freeze.override` on the live freeze record (creating a minimal record stamped with `frozenAt=now`, `treeHash=currentTreeHash`, `docHashes=whole-tree`, `briefStatements=0` when none exists).",
+  "interfaces": [
+    {
+      "name": "enforceBundleNextFreezeGate",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ tree, projectRoot, overrideReason, by }) -> { ok: boolean, exitCode?: 2|4, message?: string, impactedFbsIds?: Set<string>, override?: { reason, by, at } }. Reads the freeze record and `computeDelta(tree, { freeze })`, applies the override write when `overrideReason` is set, and either returns ok with the impacted-FBS set, or a refusal with exit 4 and the usage message. authoredAt: D3."
+    },
+    {
+      "name": "applyOverrideToFreezeRecord",
+      "kind": "other",
+      "description": "`moduleApi` (`src/define/freeze-record.js`). Signature: ({ projectRoot, reason, by, at }) -> { filePath }. Loads or creates a freeze record, sets its override to { reason, by, at }, writes through saveFreezeRecord. authoredAt: D3."
+    },
+    {
+      "name": "selectNext",
+      "kind": "other",
+      "description": "`moduleApi` (`src/build/queue.js`). Extended to accept an optional `{ impactedFbsIds, io }` parameter: when supplied, re-execute FBS whose id is in `impactedFbsIds` are skipped with a stderr line naming the FBS and the reason, and the next unimpacted FBS is returned; when every actionable FBS is impacted, returns `null` and the caller treats that as the all-impacted refusal."
+    },
+    {
+      "name": "resolveOverrideBy",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ projectRoot }) -> Promise<string>. Resolves the identity for `freeze.override.by` under the R11 preference order (git config user.email, GITHUB_ACTOR, USER, USERNAME, operator). Pure of side effects beyond one bounded `git config --get user.email`. authoredAt: D3."
+    }
+  ],
+  "notes": "Spec amendment 2026-10-03 R9 does not alter this TAC: delta semantics are unchanged, the litmus hash is a readiness concern only. `freeze.override` writes do not shift `tree.currentTreeHash` or `tree.litmusHash` (the probes ledger is excluded from the litmus hash by R9; the override lives in the freeze record, not in a tree document). The brief named this TAC as `tac-4125*.json`; the file name follows the dash-prefixed naming convention of neighbouring TACs."
+}

package/rcf/tacs/tac-4126-define-validate-findings.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
+  "tacId": "TAC-4126-define-validate-findings",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.1",
+  "status": "draft",
+  "name": "rcf define validate findings for interface kind, AC class prefix, tacIds and ownerRef or deliveredBy",
+  "purpose": "0.30.0 PR 8 (spec section 4 validate row, section 11.7 US-17802). `rcf define validate` reports a finding and exits non-zero for an interface kind outside the closed vocabulary (`INTERFACE_KINDS`), a bracketed AC prefix on an AC `description` outside the known classes (`AC_CLASS_RE`), a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`. The absence of a class marker on an AC is NOT a validate finding (decision 10, kept): absence is D4's floor; a validate finding here would fail the dogfood tree and every legacy tree's CI.",
+  "responsibilities": [
+    "interface kind outside vocabulary: for every TAC in the tree, each `interfaces[].kind` that is not in `INTERFACE_KINDS` is reported as a finding `defineValidate:interfaceKind` naming the TAC id, interface name and the unknown kind.",
+    "bracketed AC class prefix outside known classes: for every AC in the tree whose description's leading bracketed prefix is not one of {happy, edge, failure, must-not, non-functional}, report `defineValidate:acClassPrefix` with the US id, AC id and the unknown prefix. An AC description with NO leading bracketed prefix is NOT reported (decision 10).",
+    "tacIds naming a non-TAC: for every US in the tree, each `tacIds[]` entry that does not resolve to a TAC in `tree.byId` is reported as `defineValidate:tacIdsResolves` with the US id and the unresolved id.",
+    "unresolving ownerRef or deliveredBy (R11 grammar, spec section 17, PR 9): for every AC with ownerRef `{ tacId | adrId, field }` whose field does NOT resolve on the owning TAC/ADR under R11 (`interfaces[<name>]`, `responsibilities[<n>]`, `dependencies[<name>]`, `alternativesConsidered[<n>]`, or a bare schema field name), and for every REQ whose deliveredBy is the OBJECT form `{ tacId | adrId, field }` with a dotted or dead field, report `defineValidate:ownerRefResolves` or `defineValidate:deliveredByResolves` with the owning id and the dangling pointer. String-form deliveredBy (pre-DEFINE back-compat) still resolves against `tree.byId`. The object-form `deliveredBy` was silently skipped before PR 9 (review 2026-10-03).",
+    "clean on the dogfood tree: every finding is scoped so the rcf-lite dogfood tree passes with exit 0; where the dogfood tree surfaces a real defect in a chain document, the fix is made in the chain document, not in the finding."
+  ],
+  "internalStructure": "A new module `src/define/validate-findings.js` exports `collectDefineValidateFindings(tree)` returning an array of walker-shaped error entries ({ kind, rule, documentId, filePath, field, message }). `src/cli/validate.js` runs the module after the Code Node resolution pass and the companions check, folds the findings into the `errors` array it already exits on (exit 3), and reports them in the same `--json` envelope. Each finding reuses the walker error shape so `formatErrors` prints them exactly as a schema or broken-reference error. Interface kinds reuse `INTERFACE_KINDS` from `src/query/gates.js`; AC class classification reuses `parseAcClass`; `ownerRef` resolution reuses the existing D4 helper (`AC_OWNER_REF_FIELD_RE`) so the two code paths cannot diverge.",
+  "interfaces": [
+    {
+      "name": "collectDefineValidateFindings",
+      "kind": "other",
+      "description": "`moduleApi` (`src/define/validate-findings.js`). Signature: (tree) -> Array<{ kind: 'defineValidate', rule: string, documentId: string|null, filePath: string|null, field: string|null, message: string }>. Pure over the walker tree model; no filesystem I/O. authoredAt: D3."
+    },
+    {
+      "name": "rcf define validate",
+      "kind": "cliCommand",
+      "description": "`cliCommand` (`rcf define validate`). Usage unchanged from 0.29.0; the exit path now also exits 3 on any finding returned by `collectDefineValidateFindings`. authoredAt: D3."
+    }
+  ],
+  "notes": "Decision 10 is binding: the dogfood tree and every legacy tree would fail CI if the absence-of-class-marker became a validate finding. The dogfood tree is checked clean by the AC-17802-3 test; a mechanical correction of a chain document is recorded in report.md's dogfood section when PR 8 fires. The brief named this TAC as `tac-4126*.json`; the file name follows the dash-prefixed naming convention of neighbouring TACs."
+}