rcf-lite 0.29.0 → 0.31.0

package/rcf/code-nodes/cn-760.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-760",
+  "path": "src/query/readiness.js",
+  "title": "DEFINE step 3 PR 7: probeRunner seam, parseLitmusFlag and countLitmusReadersAtHash",
+  "description": "src/query/readiness.js accepts an injectable `probeRunner` ({ reqId, tree }) => findings[], default null; when set, computeReadiness calls it once per REQ in scope and merges the returned findings into ledgers.probes.probes[] as open probe entries so consistency:probeCount reports them. With no runner the result equals the 0.29.0 result on the same fixture (AC-17504-2). Also exports parseLitmusFlag (positive-integer validator) and countLitmusReadersAtHash (reads distinct <reader> ids from probe-ledger entries whose finding begins litmus:<reader>: and whose text includes the given hash). Pure.",
+  "implementsAcIds": [
+    "AC-17504-1",
+    "AC-17504-2",
+    "AC-17504-3",
+    "AC-17504-4"
+  ],
+  "dependencies": [
+    "CN-761"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-761.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-761",
+  "path": "src/define/probe-runner.js",
+  "title": "DEFINE step 3 PR 7: probe-runner seam (no shipped runner)",
+  "description": "src/define/probe-runner.js is a seam only: it exports the ProbeRunner typedef, a NO_PROBE_RUNNER sentinel and an isProbeRunner guard. No runner ships. rcf-lite has no LLM at runtime and does not spawn processes or make network calls; the harness is the runner through `rcf define ledger probes add` or a test harness that passes a stub into computeReadiness. Keeps the extension point named rather than monkey-patched (ADR-4131 extended).",
+  "implementsAcIds": [
+    "AC-17504-1",
+    "AC-17504-2",
+    "AC-17504-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-762.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-762",
+  "path": "src/cli/readiness.js",
+  "title": "DEFINE step 3 PR 7: --litmus <n> and D6 in the biting-stages set",
+  "description": "src/cli/readiness.js adds the --litmus <n> flag with usage help, parses it via parseLitmusFlag, counts distinct litmus readers at the current tree hash via countLitmusReadersAtHash, and exits 4 with a stderr warn line naming the shortfall when fewer than n have attested. D6 joins the BITING_STAGES set so --check consistency now exits 4 on an unacknowledged D6 failure and 0 when acked at the current hash. --help documents the new flag. No process is spawned and no network call is made.",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4",
+    "AC-17504-5"
+  ],
+  "dependencies": [
+    "CN-760"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-763.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-763",
+  "path": "src/cli/freeze.js",
+  "title": "DEFINE step 3 PR 7: --litmus <n> on rcf define freeze",
+  "description": "src/cli/freeze.js adds the --litmus <n> flag with usage help, parses it via parseLitmusFlag, and after the gate check (and any --ack folding) refuses (exit 4) and writes nothing when fewer than n distinct litmus readings exist at the current tree hash. --litmus-attested remains the default attestation path and is unchanged.",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4",
+    "AC-17504-5"
+  ],
+  "dependencies": [
+    "CN-760"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-764.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-764",
+  "path": "guidance/define-litmus.md",
+  "title": "DEFINE step 3 PR 7: rcf_define_litmus prompt content",
+  "description": "guidance/define-litmus.md: the argument-free markdown served as the rcf_define_litmus MCP prompt (spec section 6 row). Walks the harness through spawning n fresh-context readers at the current tree hash and landing their readings as probe-ledger entries whose finding begins litmus:<reader>: and whose text includes the hash. Registered through guidance/manifest.json. No new resource URI (the markdown is the prompt content itself, not a doc).",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-765.json

@@ -0,0 +1,23 @@
+{
+  "cnId": "CN-765",
+  "path": "src/cli/build.js",
+  "title": "DEFINE step 3 PR 8: rcf build bundle --next freeze gate, --override write and impacted-FBS skip",
+  "description": "src/cli/build.js grows the `--override <reason>` flag, the pre-emit freeze gate (`enforceBundleNextFreezeGate`) that loads the freeze record and the computed delta, writes `freeze.override { reason, by, at }` through `applyOverrideToFreezeRecord` when a non-empty reason is supplied, refuses with exit 4 naming `rcf define readiness` and the override channel when no freeze record exists and no override is given, and passes `impactedFbsIds` into `selectNext`. The next-item path reports every skipped FBS on stderr; when every actionable FBS is impacted and no override is given, the verb refuses with exit 4 and the same message.",
+  "implementsAcIds": [
+    "AC-17702-1",
+    "AC-17702-2",
+    "AC-17702-3",
+    "AC-17702-4",
+    "AC-17702-5",
+    "AC-17902-2",
+    "AC-17902-3"
+  ],
+  "dependencies": [
+    "CN-720",
+    "CN-721"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-766.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-766",
+  "path": "src/define/freeze-record.js",
+  "title": "DEFINE step 3 PR 8: applyOverrideToFreezeRecord writer",
+  "description": "src/define/freeze-record.js grows `applyOverrideToFreezeRecord({ projectRoot, reason, by, at })` which loads or creates a freeze record (stamped `frozenAt=now`, `treeHash=currentTreeHash` of the live tree, `docHashes` empty when no prior freeze), sets `override: { reason, by, at }` and writes through saveFreezeRecord. Reuses the existing SHA256 schema and canonical-JSON contract so the output is identical in shape to a freeze-verb write.",
+  "implementsAcIds": [
+    "AC-17702-2",
+    "AC-17902-3"
+  ],
+  "dependencies": [
+    "CN-721"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-767.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-767",
+  "path": "src/define/validate-findings.js",
+  "title": "DEFINE step 3 PR 8: collectDefineValidateFindings module",
+  "description": "src/define/validate-findings.js exports `collectDefineValidateFindings(tree)`: a pure walker-tree function returning walker-shaped error entries for an interface kind outside INTERFACE_KINDS, an AC description's leading bracketed prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`. Reuses INTERFACE_KINDS and parseAcClass from src/query/gates.js so the vocabularies cannot diverge. Absence of a bracketed prefix is not a finding (decision 10, kept).",
+  "implementsAcIds": [
+    "AC-17802-1",
+    "AC-17802-2",
+    "AC-17802-3",
+    "AC-17802-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-768.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-768",
+  "path": "src/cli/validate.js",
+  "title": "DEFINE step 3 PR 8: rcf define validate folds in the PR 8 finding set",
+  "description": "src/cli/validate.js runs `collectDefineValidateFindings(tree)` after the Code Node resolution pass and the companions check, folds the returned entries into the `errors` array it already exits on (exit 3), and reports them in the same `--json` envelope. The clean-output notice is suppressed when any PR 8 finding fires. The HELP text and the OPTION_SPEC are unchanged (the findings are the shipped surface).",
+  "implementsAcIds": [
+    "AC-17802-1",
+    "AC-17802-2",
+    "AC-17802-3",
+    "AC-17802-4"
+  ],
+  "dependencies": [
+    "CN-767"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-769.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-769",
+  "path": "src/ruleset/ruleset.json",
+  "title": "DEFINE step 3 PR 8: NV-DL-ADM-01..05 added with refuseByDefault:true and overrideChannel:recordedInChain",
+  "description": "packages/rcf-lite/src/ruleset/ruleset.json gains the NV-DL namespace: NV-DL-ADM-01 (bundle refuses without a freeze), NV-DL-ADM-02 (D4 stories floor is a finding), NV-DL-ADM-03 (D3 shapes bite is a finding), NV-DL-ADM-04 (validate finding set is a finding) and NV-DL-ADM-05 (bundle skips impacted FBS). Each carries refuseByDefault:true and overrideChannel:'recordedInChain'. The existing NV-BL rows and ruling-sheet item 1 pattern are untouched.",
+  "implementsAcIds": [
+    "AC-17902-1",
+    "AC-17902-2",
+    "AC-17902-3",
+    "AC-17902-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-770.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-770",
+  "path": "src/query/refuse-on-admissibility.js",
+  "title": "DEFINE step 3 PR 8: NV-DL admissibility wrap recognises freeze.override as recordedInChain",
+  "description": "src/query/refuse-on-admissibility.js grows a thin helper `evaluateDefineAdmissibility({ tree, projectRoot })` that checks the freeze record and the delta for the NV-DL rules: without a freeze record and without `freeze.override` it returns a refusal citing NV-DL-ADM-01; when `freeze.override` is set it returns ok and names the override on the result. The existing enforceAdmissibility path over NV-BL rows is unchanged. readiness and other query-tool callers that pass through runWithAdmissibilityGate see the NV-DL refusal; the compute still runs (ADR-4123) when the refusal is informational.",
+  "implementsAcIds": [
+    "AC-17902-2",
+    "AC-17902-3",
+    "AC-17902-4"
+  ],
+  "dependencies": [
+    "CN-769"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-771.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-771",
+  "path": "src/view/style.css",
+  "title": "SearchButton hover/focus/active + three-state theme control styling (AA contrast in both themes)",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): the FIND SearchButton hover previously fell back to a hard-coded light grey (`var(--sv-surface-hover, #f0f3f8)`) because `--sv-surface-hover` was never declared, which painted dark ink on a light grey in dark mode. The hover + focus-visible + active states now use `--sv-active` with the `--sv-control` border and the `--sv-focus` outline so the pair stays above WCAG AA in both themes (AC-205-9). The three-state theme control (`.rcf-theme`, `.rcf-theme-btn`) sits right of the SearchButton in `.tools`; `aria-pressed=\"true\"` uses `--sv-button` / `--sv-onbutton`, hover and focus-visible use `--sv-active`, and the group is hidden under `html[data-embed=\"1\"]`.",
+  "implementsAcIds": [
+    "AC-205-9"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-772.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-772",
+  "path": "src/view/view-index.js",
+  "title": "renderThemeControl() shell markup for the standalone three-state theme toggle",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): renders the Light|Dark|Auto group (`role=\"group\"`, three `<button>`s with `aria-pressed` and `data-rcf-theme=\"light|dark|auto\"`) stamped with `[data-rcf-theme-control]`. The buttons start with `aria-pressed=\"false\"`; `page-init.js` boots them from the resolved theme choice (query -> stored -> auto) per ADR-4137. Keyboard-operable (`<button type=\"button\">`), screen-reader-labelled (`aria-label` + `title`), server-rendered. Also keeps the existing `renderSearchButton()` and `renderLookupModal()` exports.",
+  "implementsAcIds": [
+    "AC-206-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-773.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-773",
+  "path": "src/view/html-page.js",
+  "title": "renderPage({ embed }) wires renderThemeControl() into the shell header .tools group; embed path strips the control",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): `renderPage(model, { embed })` renders the three-state theme control from `renderThemeControl()` immediately after the SearchButton inside `<div class=\"tools\">`. When `embed` is true the markup is skipped entirely (ADR-4137 server-side layer) so no `[data-rcf-theme-control]` element is emitted; the production server path never passes `embed`, and the client-side layer in `page-init.js` strips the element on boot when `?embed=1` is present.",
+  "implementsAcIds": [
+    "AC-206-9"
+  ],
+  "dependencies": [
+    "CN-772"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-774.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-774",
+  "path": "src/view/page-init.js",
+  "title": "wireThemeControl + resolveBootTheme + THEME_STORAGE_KEY: boot precedence, non-embed persistence, embed strip",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001), ADR-4137: `wireThemeControl()` wires the three Light|Dark|Auto buttons and, under embed, removes the `[data-rcf-theme-control]` element from the DOM entirely instead of merely hiding it. `resolveBootTheme(query)` picks the effective theme in the pinned precedence (`?theme=` wins; then stored value under `localStorage['rcf-view:v1:theme']` in non-embed mode; then `auto`). `readStoredTheme()` and `writeStoredTheme(v)` check `isEmbedActive()` at the storage boundary and refuse the read/write under embed so the key is zero-touched. The `message` listener still applies live `rcf-view-theme` postMessages in both modes and never writes the stored key. `reflectThemeChoice(mode)` keeps `aria-pressed` in sync across live swaps.",
+  "implementsAcIds": [
+    "AC-206-7",
+    "AC-206-8",
+    "AC-206-9",
+    "AC-206-10"
+  ],
+  "dependencies": [
+    "CN-772",
+    "CN-773"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-775.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-775",
+  "path": "test/view/helpers/contrast.js",
+  "title": "WCAG 2.1 AA contrast audit helpers (token resolver, pair enumerator, luminance math)",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): the audit helper for US-207. `buildTokenMap(css, theme)` resolves the `--sv-*` custom-property blocks (light `:root` and dark `:root[data-theme=\"dark\"]`), chasing `var(--x)` aliases. `extractRules(css)` is a brace-balanced walker that handles `@media (prefers-color-scheme: dark)` scope. `resolveColour(value, tokens)` reduces a CSS colour expression to `{r,g,b,a}` and returns null for gradients/images. `composite()` composites a semi-transparent fg over a bg. `luminance()` + `contrastRatio()` implement the WCAG 2.1 relative-luminance ratio. `stateOf(selector)` tags state variants (default, hover, focus, focus-visible, active, aria-pressed, aria-selected, is-active, disabled). `thresholdFor(selector, decls)` picks 4.5:1 for text, 3:1 for large text or non-text UI boundaries. `enumeratePairs(css)` returns per-theme `PairRecord[]` with `{selector,state,theme,fg,bg,ratio,threshold,kind,pass,approximate,note}` so the test's failure line names selector, state, theme, fg, bg, ratio and threshold.",
+  "implementsAcIds": [
+    "AC-207-1",
+    "AC-207-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-776.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-776",
+  "path": "test/view/contrast-aa.test.js",
+  "title": "WCAG 2.1 AA contrast audit test; exits non-zero on any failing pair with selector/state/theme/fg/bg/ratio/threshold named",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): the test entry point for US-207 (AC-207-1, AC-207-2). Reads `src/view/style.css`, calls `enumeratePairs(css)` from the helper, asserts zero failing pairs across both themes, and when `RCF_WRITE_CONTRAST_REPORT=1` is set writes a BEFORE/AFTER Markdown table to `./output/contrast-report.md` for the lane evidence. On any failure the message names each pair's selector, state, theme, foreground, background, computed ratio and applied threshold (AC-207-2). A second test asserts the pair-record shape so a future refactor cannot drop the structured fields the failure message reads from.",
+  "implementsAcIds": [
+    "AC-207-1",
+    "AC-207-2"
+  ],
+  "dependencies": [
+    "CN-775"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/code-nodes/cn-777.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-777",
+  "path": "test/view/theme-control.test.js",
+  "title": "Standalone theme control behavioural tests (AC-206-7..10 under ADR-4137)",
+  "description": "Baz 2026-10-04 (w-2026-10-04-dave-001): nine node tests pinning the ADR-4137 contract. `renderPage()` emits the control in `.tools` (AC-206-7). `renderPage({ embed: true })` does not emit any `[data-rcf-theme-control]` markup (AC-206-9 server-side layer). A VM-sandboxed boot of `src/view/page-init.js` with a minimal `document`/`window`/`localStorage` shim exercises: click on a theme button updates `data-theme` live and flips `aria-pressed` (AC-206-7); non-embed boot writes `rcf-view:v1:theme` and a stored value re-applies on the next boot (AC-206-8); a `rcf-view-theme` postMessage applies live but writes nothing (AC-206-8); under `?embed=1` the control element is removed from the DOM and the storage key is zero-touched on load, on postMessage and on any user action (AC-206-9); explicit `?theme=` beats the stored value and leaves the stored key as-is (AC-206-10).",
+  "implementsAcIds": [
+    "AC-206-7",
+    "AC-206-8",
+    "AC-206-9",
+    "AC-206-10"
+  ],
+  "dependencies": [
+    "CN-772",
+    "CN-773",
+    "CN-774"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-05T09:59:33Z",
+  "updatedAt": "2026-10-05T09:59:33Z"
+}

package/rcf/fbs/fbs-202.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-02T16:40:00Z",
-  "updatedAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-05T19:00:00Z",
   "acIds": [
     "AC-17302-1",
     "AC-17302-2",
@@ -46,15 +46,71 @@
     "AC-18202-1",
     "AC-18202-2",
     "AC-18202-3",
-    "AC-18202-4"
+    "AC-18202-4",
+    "AC-17404-1",
+    "AC-17404-2",
+    "AC-17404-3",
+    "AC-17404-4",
+    "AC-17404-5",
+    "AC-17404-6",
+    "AC-17405-1",
+    "AC-17405-2",
+    "AC-17405-3",
+    "AC-17405-4",
+    "AC-17405-5",
+    "AC-17405-6",
+    "AC-17406-1",
+    "AC-17406-2",
+    "AC-17406-3",
+    "AC-17406-4",
+    "AC-17406-5",
+    "AC-17406-6",
+    "AC-17504-1",
+    "AC-17504-2",
+    "AC-17504-3",
+    "AC-17504-4",
+    "AC-17504-5",
+    "AC-17702-1",
+    "AC-17702-2",
+    "AC-17702-3",
+    "AC-17702-4",
+    "AC-17702-5",
+    "AC-17802-1",
+    "AC-17802-2",
+    "AC-17802-3",
+    "AC-17802-4",
+    "AC-17902-1",
+    "AC-17902-2",
+    "AC-17902-3",
+    "AC-17902-4",
+    "AC-17405-7",
+    "AC-17405-8",
+    "AC-17702-6",
+    "AC-17902-5",
+    "AC-17302-7",
+    "AC-17302-8",
+    "AC-17302-9",
+    "AC-17403-9",
+    "AC-17404-7",
+    "AC-17404-8",
+    "AC-17405-9",
+    "AC-17302-10",
+    "AC-17401-11",
+    "AC-17401-12",
+    "AC-17402-8",
+    "AC-17403-10",
+    "AC-17404-9",
+    "AC-17302-11",
+    "AC-17302-12",
+    "AC-17302-13"
   ],
   "fbsId": "FBS-202",
   "prdId": "PRD-001",
   "bsId": "BS-001",
   "buildOrder": 202,
   "executionStatus": "notStarted",
-  "title": "DEFINE step 3 PRs 1-3: intake markers, ledger update, resolvedBy grammar (PR 1); computeQuestions, questions verb and MCP tools (PR 2); draft-shape marker extension, DISCOVERY prototypes guidance and prompts (PR 3)",
-  "summary": "Carry the ACs for PRs 1, 2 and 3 of the DEFINE step 3 spec (2026-10-01). PR 1: statement-file markers in parseBriefFromFile ([kind] and (source: ...)), the brief add --scan / --no-scan / --findings / --dry-run / --json wiring, the new ledger <name> update <id> subverb, and the resolvedBy closed pointer grammar validated by D2 (title-hit fallback dropped). PR 2: computeQuestions pure compute over readiness per persona; `rcf define questions` verb; three MCP tools (rcf_define_questions, rcf_define_readiness, rcf_define_ledger); the define-intent guidance file and the rcf_define_intent + rcf_define_intake prompts; two new managed-block rules. PR 3: parseInterfaceDraft extended to TAC.purpose and coreEntities[].description, shapes:draftSettled reports all three id forms (<tacId>:<name>, <tacId>, TAD.entity:<name>); the two new argument-free prompts rcf_define_draft_shapes and rcf_discover_prototype plus guidance/discovery-prototypes.md (REQ-188 + REQ-182 amended, ADR-4132). Chain-first commits landed before the code in each PR. FBS stays notStarted until the CN axis mints Code Nodes against the ACs across the PRs. PR 1 tests ride TS-215; PR 2 tests ride TS-226; PR 3 tests ride TS-228 (renumbered from the cloud build's TS-227 after viewer PR 8 claimed TS-227 for US-18002).",
+  "title": "DEFINE step 3 PRs 1-3, PR 5, PR 6, PR 7 and PR 8: intake markers, ledger update, resolvedBy grammar (PR 1); computeQuestions, questions verb and MCP tools (PR 2); draft-shape marker extension, DISCOVERY prototypes guidance and prompts (PR 3); D3 bite checks, ackable, --check exit 4 policy (PR 5); D4 closed-set and ownerRef findings, D5 concern catalogue, standards citation (PR 6); D6 consistency scans, probe seam, --litmus and rcf_define_litmus (PR 7); bundle refuse/override/skip, validate findings and NV-DL enforced (PR 8)",
+  "summary": "Carry the ACs for PRs 1, 2, 3, 5 and 6 of the DEFINE step 3 spec (2026-10-01). PR 1: statement-file markers in parseBriefFromFile ([kind] and (source: ...)), the brief add --scan / --no-scan / --findings / --dry-run / --json wiring, the new ledger <name> update <id> subverb, and the resolvedBy closed pointer grammar validated by D2 (title-hit fallback dropped). PR 2: computeQuestions pure compute over readiness per persona; `rcf define questions` verb; three MCP tools (rcf_define_questions, rcf_define_readiness, rcf_define_ledger); the define-intent guidance file and the rcf_define_intent + rcf_define_intake prompts; two new managed-block rules. PR 3: parseInterfaceDraft extended to TAC.purpose and coreEntities[].description, shapes:draftSettled reports all three id forms (<tacId>:<name>, <tacId>, TAD.entity:<name>); the two new argument-free prompts rcf_define_draft_shapes and rcf_discover_prototype plus guidance/discovery-prototypes.md (REQ-188 + REQ-182 amended, ADR-4132). PR 5: the three D3 bite checks shapes:templateMarkers, shapes:entityJoin and shapes:pathsResolve on src/query/gates.js (parseInterfaceTemplate exported for validate); ackable(stage) companion to stagePolicy returning true for D3, D5, D6; readiness CLI --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash; cli-readiness.js resolves candidate paths on disk and passes resolvedPaths in the stage context so gates stay pure (REQ-174 amended, US-17404, TAC-4122 and TAC-4123 amended, ADR-4131). Chain-first commits landed before the code in each PR. FBS stays notStarted until the CN axis mints Code Nodes against the ACs across the PRs. PR 1 tests ride TS-215; PR 2 tests ride TS-226; PR 3 tests ride TS-228 (renumbered from the cloud build's TS-227 after viewer PR 8 claimed TS-227 for US-18002); PR 5 tests ride TS-230 (next free when expecting the viewer PR 9 to land TS-229; brief predicted TS-230). PR 6 tests ride TS-231 and anchor CN-756, CN-757 and CN-758.",
   "dependsOnFbsIds": [
     "FBS-195",
     "FBS-201"
@@ -66,12 +122,14 @@
       "TAC-4130-define-intake-brief",
       "TAC-4129-define-questions",
       "TAC-4128-define-guidance",
-      "TAC-4122-define-gates"
+      "TAC-4122-define-gates",
+      "TAC-4123-define-readiness"
     ],
     "adrIds": [
       "ADR-4129-questions-harness-driven-loop",
       "ADR-4130-intake-harness-split-tool-scanned",
-      "ADR-4132-prototypes-in-discovery-as-evidence"
+      "ADR-4132-prototypes-in-discovery-as-evidence",
+      "ADR-4131-gates-bite-ack-recorded-override"
     ]
   },
   "deliverables": [
@@ -100,11 +158,29 @@
     "src/query/gates.js: parseInterfaceDraft extended to TAC.purpose and coreEntities[].description; checkD3Shapes shapes:draftSettled enumerates all three homes (PR 3)",
     "guidance/define-draft-shapes.md, guidance/discover-prototype.md, guidance/discovery-prototypes.md and guidance/manifest.json entries for the two prompts and the two slugs (PR 3)",
     "guidance/managed/agent-instructions-block.md: the prototype rule from ADR-4132 (PR 3)",
-    "test/query/gates.test.js: extended for the three draft homes; test/guidance/manifest.test.js and test/guidance/register-scan.test.js: new slugs and five prompts, em-dash scan (PR 3)"
+    "test/query/gates.test.js: extended for the three draft homes; test/guidance/manifest.test.js and test/guidance/register-scan.test.js: new slugs and five prompts, em-dash scan (PR 3)",
+    "rcf/requirements/req-174.json (amended), rcf/user-stories/us-17404.json, rcf/tacs/tac-4122-define-gates.json (amended with the three D3 bite responsibilities, parseInterfaceTemplate and ackable interfaces), rcf/tacs/tac-4123-define-readiness.json (amended with the resolvedPaths context seam and the --check shapes exit 4 policy), rcf/adrs/adr-4131-gates-bite-ack-recorded-override.json, rcf/test-suites/ts-230.json (PR 5 chain)",
+    "src/query/gates.js: parseInterfaceTemplate(iface) exported; shapes:templateMarkers, shapes:entityJoin, shapes:pathsResolve added to checkD3Shapes; ackable(stage) exported (PR 5)",
+    "src/query/readiness.js: resolvedPaths threaded through the stage context when the caller supplies it (PR 5)",
+    "src/cli/readiness.js: resolve candidate paths on disk before computeReadiness and pass resolvedPaths in; --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash (PR 5)",
+    "test/query/gates.test.js: AC-17404-1..4 D3 bite cases; test/cli/readiness.test.js: AC-17404-5 exit 4/0 cases; test/cli/freeze.test.js: AC-17404-6 --ack-on-D1/D2/D4/D7/D8 exit 2 case (PR 5)",
+    "rcf/user-stories/us-17405.json, rcf/tacs/tac-4121-define-ledgers.json (amended with the concern-ledger applied/waived responsibility), rcf/tacs/tac-4122-define-gates.json (amended with the four new PR 6 responsibilities and the applicableConcernsFor interface), rcf/test-suites/ts-231.json, rcf/code-nodes/cn-756.json, cn-757.json, cn-758.json (PR 6 chain)",
+    "src/define/concern-catalogue.js: CONCERN_KEYS, CONCERN_APPLICABILITY and applicableConcernsFor exported (PR 6)",
+    "src/query/gates.js: stories:closedSets, stories:ownerRefResolves, crosscut:catalogue, skeleton:standardsCited; CHECK_PERSONA / CHECK_QUESTION extended (PR 6)",
+    "src/cli/readiness.js: --check crosscut and --check D5 ride the same --ack fold as D3 (PR 6)",
+    "test/query/gates.test.js, test/define/concern-catalogue.test.js, test/cli/readiness.test.js, test/cli/validate.test.js, test/query/questions-loop.test.js: PR 6 cases for AC-17405-1..6 and the loop-convergence row (PR 6)",
+    "rcf/requirements/req-175.json (amended with the probeRunner + --litmus paragraph), rcf/user-stories/us-17406.json (D6 bites), rcf/user-stories/us-17504.json (probe seam and litmus), rcf/tacs/tac-4122-define-gates.json (amended with the four D6 scan responsibilities), rcf/tacs/tac-4123-define-readiness.json (amended with the probeRunner, --litmus and D6 biting-stage responsibilities and four moduleApi interfaces), rcf/tacs/tac-4128-define-guidance.json (amended with the rcf_define_litmus responsibility and interface), rcf/test-suites/ts-232.json, rcf/code-nodes/cn-759.json..cn-764.json (PR 7 chain)",
+    "src/query/gates.js: consistency:contradictions, consistency:unsatisfiable, consistency:duplicates, consistency:orphanInterfaces added to checkD6Consistency; CHECK_PERSONA / CHECK_QUESTION extended (PR 7)",
+    "src/query/readiness.js: probeRunner seam merged into ledgers.probes.probes[]; parseLitmusFlag and countLitmusReadersAtHash exported (PR 7)",
+    "src/define/probe-runner.js: new seam-only module (ProbeRunner typedef, NO_PROBE_RUNNER, isProbeRunner); no shipped runner (PR 7)",
+    "src/cli/readiness.js: --litmus <n> flag with usage; D6 joins the BITING_STAGES set; --help carries the new flag (PR 7)",
+    "src/cli/freeze.js: --litmus <n> flag with usage; refuses (exit 4) and writes nothing on a shortfall (PR 7)",
+    "guidance/define-litmus.md and guidance/manifest.json entry for rcf_define_litmus (PR 7)",
+    "test/query/gates.test.js: AC-17406-1..6 D6 bite cases; test/query/readiness.test.js: AC-17504-1/2/5 probe-seam and litmus unit cases; test/cli/readiness.test.js: AC-17504-3/4 --litmus exit cases (PR 7)"
   ],
   "riskLevel": "low",
   "domain": "defineLedgers",
   "estimatedSize": "medium",
   "estimatedHours": 4,
-  "notes": "FBS-202 was reserved as 'next free' in the dispatch brief and allocated here to keep the dogfood no-orphan-AC invariant. executionStatus is 'notStarted' so the CN axis stays legitimately deferred for this PR (test additions ride existing test suites, no new CN per brief). Later DEFINE PRs promote this FBS to inProgress / complete as their deliveries land."
-}
+  "notes": "FBS-202 was reserved as 'next free' in the dispatch brief and allocated here to keep the dogfood no-orphan-AC invariant. executionStatus is 'notStarted' so the CN axis stays legitimately deferred for this PR (test additions ride existing test suites). PR 6 anchors three new CNs (CN-756, CN-757, CN-758) against src/define/concern-catalogue.js, src/query/gates.js and src/cli/readiness.js. Later DEFINE PRs promote this FBS to inProgress / complete as their deliveries land."
+}

package/rcf/fbs/fbs-203.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-02T19:00:00Z",
-  "updatedAt": "2026-10-03T09:55:00Z",
+  "updatedAt": "2026-10-04T14:00:00Z",
   "acIds": [
     "AC-204-1",
     "AC-204-2",
@@ -25,7 +25,14 @@
     "AC-206-3",
     "AC-206-4",
     "AC-206-5",
-    "AC-206-6"
+    "AC-206-6",
+    "AC-206-7",
+    "AC-206-8",
+    "AC-206-9",
+    "AC-206-10",
+    "AC-205-9",
+    "AC-207-1",
+    "AC-207-2"
   ],
   "fbsId": "FBS-203",
   "prdId": "PRD-001",
@@ -45,7 +52,8 @@
     "adrIds": [
       "ADR-4133-dag-dependency-depth-layout",
       "ADR-4134-index-json-route",
-      "ADR-4136-embedding-host-fixture"
+      "ADR-4136-embedding-host-fixture",
+      "ADR-4137-standalone-theme-persistence"
     ]
   },
   "deliverables": [
@@ -96,5 +104,5 @@
   "riskLevel": "low",
   "domain": "reviewSurface",
   "estimatedSize": "large",
-  "notes": "Single FBS for the whole viewer UI refresh build stream (ruling 2026-10-02): keeping one FBS avoids a sprawl of near-duplicate FBS entries for the same renderer family. PRs 7 to 9 extended the acIds list under this file as AC-205-*, AC-18002-* and AC-206-* arrived. Status stays `inProgress` after PR 9 lands because every TC on this stream's TS docs is still `pending` (not yet flipped to `passing`); flip to `verified` is a separate housekeeping pass once each TC's status is advanced to `passing` against the green suite."
+  "notes": "Single FBS for the whole viewer UI refresh build stream (ruling 2026-10-02): keeping one FBS avoids a sprawl of near-duplicate FBS entries for the same renderer family. PRs 7 to 9 extended the acIds list under this file as AC-205-*, AC-18002-* and AC-206-* arrived; the 2026-10-04 amendment (`w-2026-10-04-dave-001`) adds AC-205-9 (SearchButton hover/focus contrast), AC-206-7..10 (standalone theme control + storage ruling per ADR-4137) and AC-207-1..2 (WCAG 2.1 AA contrast audit) under this file. Status stays `inProgress` while the amendment ships. The amendment also adds `packages/rcf-lite/test/view/contrast-aa.test.js` (static WCAG AA audit over `src/view/style.css`), extends `renderPage` in `html-page.js` with `renderThemeControl()` right of the SearchButton (gated on `data-embed=\"1\"`), extends `page-init.js` with `wireThemeControl()` (persistence under `rcf-view:v1:theme`, embed-mode absent, boot precedence `?theme=` -> stored -> auto) and fixes the dark-mode SearchButton hover and focus states plus every AA failure the audit surfaces in `src/view/style.css`."
 }

package/rcf/requirements/req-002.json

@@ -2,7 +2,7 @@
   "reqId": "REQ-002",
   "prdId": "PRD-001",
   "title": "Visual review surface",
-  "description": "Build Lite renders the whole RCF tree as a diagram and as a browsable static page, so a non-coding owner can see the documents and their links without reading any JSON. The view is read-only and generated from the on-disk tree on demand. Build/DAG sub-tab lays FBS by `dependsOnFbsIds` depth with click-to-highlight closure, dependency inspector, filters, unconnected lane and `#tab=build&sub=dag&entity=` deep links, per viewer UI refresh design section 7. ID lookup over a server-built `./index.json` of every document id and AC, opened by the SearchButton or Cmd/Ctrl+F, navigates to `#tab=<tab>&entity=<id>` preserving `embed` and `theme`, per viewer UI refresh design section 6. Embedding proof: a same-origin test-host fixture mounts the viewer with `embed=1` and `theme=` and the three lints keep framing headers, `target='_top'` and localStorage namespace in place, per viewer UI refresh design section 9 and Dex's wespa requirements of 2026-10-02.",
+  "description": "Build Lite renders the whole RCF tree as a diagram and as a browsable static page, so a non-coding owner can see the documents and their links without reading any JSON. The view is read-only and generated from the on-disk tree on demand. Build/DAG sub-tab lays FBS by `dependsOnFbsIds` depth with click-to-highlight closure, dependency inspector, filters, unconnected lane and `#tab=build&sub=dag&entity=` deep links, per viewer UI refresh design section 7. ID lookup over a server-built `./index.json` of every document id and AC, opened by the SearchButton or Cmd/Ctrl+F, navigates to `#tab=<tab>&entity=<id>` preserving `embed` and `theme`, per viewer UI refresh design section 6. Embedding proof: a same-origin test-host fixture mounts the viewer with `embed=1` and `theme=` and the three lints keep framing headers, `target='_top'` and localStorage namespace in place, per viewer UI refresh design section 9 and Dex's wespa requirements of 2026-10-02. Standalone viewer carries a visible three-state theme control (Light|Dark|Auto) in the header right of the SearchButton that persists its setting under `rcf-view:v1:theme` in non-embed mode only (ADR-4137); under `embed=1` the control is absent from the DOM and the key is never read or written. Every text and control colour pair meets WCAG 2.1 AA (>= 4.5:1 for text, >= 3:1 for large text and non-text UI boundaries) in both themes, pinned by a static CSS-contrast audit test (US-207) that enumerates every rule and state in `src/view/style.css` and fails the suite on any below-threshold pair.",
   "category": "functional",
   "domain": "view",
   "priority": "must",
@@ -16,5 +16,5 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-06-25T00:00:00Z",
-  "updatedAt": "2026-10-02T20:00:00.000Z"
+  "updatedAt": "2026-10-04T14:00:00.000Z"
 }

package/rcf/requirements/req-173.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T12:00:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-05T18:00:00Z",
   "reqId": "REQ-173",
   "prdId": "PRD-001",
   "title": "Sidecar ledgers under rcf/define/ and the rcf define ledger verb",
-  "description": "Four sidecars live under rcf/define/, each one JSON file, each with one numbered sequence for the life of the project (proposal 2026-09-22 v3 section 2.5, 3.2, 8.2). Names and shapes: brief-ledger.json (statements[] kinded from a closed set), decisions-ledger.json (decisions[] in the numbered #241 format), concern-ledger.json (concerns[] with disposition applied or waived), probe-ledger.json (probes[] with severity low, medium, high). A local schema in rcf-lite validates every write until schemas 0.7. Reading a missing ledger file returns an empty ledger so callers can compose without a per-file null check; a malformed file raises a clear error. The rcf define ledger name verb pattern (brief, decisions, concerns, probes; add, resolve, list) is the operator surface. brief add --from <file> splits statements one per non-empty line, mints sequential ids and writes; the intake-scan-against-frozen-statements hook is a named seam this slice leaves for a later one. decisions list prints the #241 numbered format (one decision per item, options with letters, the default, what it blocks). The walker never reads under rcf/define/ so the sidecars stay invisible to every existing tree consumer. Every ledger supports `update <id>` with field patches validated as `add` validates; `resolvedBy` on a brief statement is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2.",
+  "description": "Four sidecars live under rcf/define/, each one JSON file, each with one numbered sequence for the life of the project (proposal 2026-09-22 v3 section 2.5, 3.2, 8.2). Names and shapes: brief-ledger.json (statements[] kinded from a closed set), decisions-ledger.json (decisions[] in the numbered #241 format), concern-ledger.json (concerns[] with disposition applied or waived), probe-ledger.json (probes[] with severity low, medium, high). A local schema in rcf-lite validates every write until schemas 0.7. Reading a missing ledger file returns an empty ledger so callers can compose without a per-file null check; a malformed file raises a clear error. The rcf define ledger name verb pattern (brief, decisions, concerns, probes; add, resolve, list, update) is the operator surface. brief add --from <file> splits statements one per non-empty line, mints sequential ids and writes; the intake-scan-against-frozen-statements hook is a named seam this slice leaves for a later one. decisions list prints the #241 numbered format (one decision per item, options with letters, the default, what it blocks). The walker never reads under rcf/define/ so the sidecars stay invisible to every existing tree consumer. Every ledger supports `update <id>` with field patches validated as `add` validates; `resolvedBy` on a brief statement is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2. Ruling R1 2026-10-05 (write-back idempotency): the question-set write-back verbs (`rcf define ledger <name> add`, in particular `brief add`, and `rcf define create`) are idempotent by id. Both `add` and `create` take an optional `--id <n>` the harness can carry when it replays a turn; a repeat whose id already exists with identical content exits 0, prints `<ledger>-ledger: unchanged <id>` or `<kind>: unchanged <id>` on stdout and emits `{\"status\":\"unchanged\",\"id\":<n>,...}` under `--json`; a repeat whose id already exists with different content refuses with exit 3 and a message naming the id and the differing field keys (never silently overwrite; `update` is the verb for that). When the write-back payload carries no id (nothing recorded from the earlier turn), the add / create path mints the next id as before; the harness is responsible for threading `--id` back into the replayed verb for idempotency. The create path extends ruling R1 under the PR 292 follow-up (w-2026-10-05-dave-013): pre-follow-up `create --id` always refused on collision with exit 2 and `[error] usage create <kind>: id ${id} is already taken`; post-follow-up the writer compares the proposed body to the on-disk entry (per-kind own-id field, parent linkage, timestamps and the fields the walker loads) and returns the unchanged-vs-conflict split per the same identity rule the add path uses.",
   "category": "functional",
   "domain": "defineLedgers",
   "priority": "must",

package/rcf/requirements/req-174.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-01T14:13:27Z",
+  "updatedAt": "2026-10-05T18:00:00Z",
   "reqId": "REQ-174",
   "prdId": "PRD-001",
   "title": "DEFINE stage gates D1..D8 as pure check functions",
-  "description": "rcf-lite gains src/query/gates.js with one check function per stage D1..D8. Each function takes (tree, ledgers, profile, scope) and returns { stage, gate, state, checks[] } where every check is { name, ok, over: 'delta'|'tree', pass, total, failing: [{ id, why }] }. Stage state is 'passed' | 'failing' | 'acknowledged' (only for D3, D5, D6 and only when the freeze record acknowledges that gate at the current hash) | 'notApplicable' (the stage decides that itself from the scope per the proposal 2026-09-22 v3 section 3.2 rules and the summary table in section 2.7). Blocking in 0.29.0: D1 brief, D2 skeleton, D4 floors (every REQ in scope has a US; every US in scope has a testable AC, a failure AC and a must-not AC, or a reasoned opt-out per class; tacIds non-empty and resolving; no scaffold placeholder), D7 decisions, D8 freeze (prior gates passed or acknowledged at the current hash, every AC owned by exactly one FBS, queue head actionable and not a placeholder, validate clean; preflight and ui-baseline presence as the section 3.2 rules specify). Warn-with-ack in 0.29.0: D3, D5, D6 build only the cheap data-backed checks (D3: every TAC in scope has at least one interface and each interface kind is in the closed vocabulary of section 5.2; D5: TAD securityArchitecture present when any auth or httpApi REQ exists, operationalConcerns present when deployed-scope ACs exist, concern-ledger entries applied or waived where they exist; D6: validate clean tree-wide plus open probe-ledger count). The D3 template parser, entity join, D5 catalogue, D6 contradiction and unsatisfiable scans, and the probe runner are 0.30 and left as named seams. AC class is a bracketed prefix on AC description ('[failure] ...', '[must-not] ...', '[happy]', '[edge]', '[non-functional]', decision 6); opt-out per class reuses the existing manifest.baselineAcOptOuts[] array with a baselineKey of the shape 'defineD4:failure' or 'defineD4:mustNot' (recorded in ADR-4122). No storage state, no 'stale' state. ADR-4126 (0.29.0) amendment: every gate check declares an owning persona, `productOwner` or `engineer`, and a one-sentence `question` in that persona’s register. A check that would need both personas is split so every check is homogeneous: `skeleton:reqFields` becomes `skeleton:reqIntent` (productOwner: description + domain) + `skeleton:reqShape` (engineer: shapeClassification.shapes); `decisions:allAnswered` becomes `decisions:wellFormed` (productOwner: enumerated per #241 format) + `decisions:allAnswered` (engineer: zero open). A new D3 check `shapes:draftSettled` fails every interface whose description still carries the leading `[draft]` marker so an L1-pre-populated interface stays distinguishable from one the engineer has settled.",
+  "description": "rcf-lite gains src/query/gates.js with one check function per stage D1..D8. Each function takes (tree, ledgers, profile, scope) and returns { stage, gate, state, checks[] } where every check is { name, ok, over: 'delta'|'tree', pass, total, failing: [{ id, why }] }. Stage state is 'passed' | 'failing' | 'acknowledged' (only for D3, D5, D6 and only when the freeze record acknowledges that gate at the current hash) | 'notApplicable' (the stage decides that itself from the scope per the proposal 2026-09-22 v3 section 3.2 rules and the summary table in section 2.7). Blocking in 0.29.0: D1 brief, D2 skeleton, D4 floors (every REQ in scope has a US; every US in scope has a testable AC, a failure AC and a must-not AC, or a reasoned opt-out per class; tacIds non-empty and resolving; no scaffold placeholder), D7 decisions, D8 freeze (prior gates passed or acknowledged at the current hash, every AC owned by exactly one FBS, queue head actionable and not a placeholder, validate clean; preflight and ui-baseline presence as the section 3.2 rules specify). Warn-with-ack in 0.29.0: D3, D5, D6 build only the cheap data-backed checks (D3: every TAC in scope has at least one interface and each interface kind is in the closed vocabulary of section 5.2; D5: TAD securityArchitecture present when any auth or httpApi REQ exists, operationalConcerns present when deployed-scope ACs exist, concern-ledger entries applied or waived where they exist; D6: validate clean tree-wide plus open probe-ledger count). The D3 template parser, entity join, D5 catalogue, D6 contradiction and unsatisfiable scans, and the probe runner are 0.30 and left as named seams. AC class is a bracketed prefix on AC description ('[failure] ...', '[must-not] ...', '[happy]', '[edge]', '[non-functional]', decision 6); opt-out per class reuses the existing manifest.baselineAcOptOuts[] array with a baselineKey of the shape 'defineD4:failure' or 'defineD4:mustNot' (recorded in ADR-4122). No storage state, no 'stale' state. ADR-4126 (0.29.0) amendment: every gate check declares an owning persona, `productOwner` or `engineer`, and a one-sentence `question` in that persona’s register. A check that would need both personas is split so every check is homogeneous: `skeleton:reqFields` becomes `skeleton:reqIntent` (productOwner: description + domain) + `skeleton:reqShape` (engineer: shapeClassification.shapes); `decisions:allAnswered` becomes `decisions:wellFormed` (productOwner: enumerated per #241 format) + `decisions:allAnswered` (engineer: zero open). A new D3 check `shapes:draftSettled` fails every interface whose description still carries the leading `[draft]` marker so an L1-pre-populated interface stays distinguishable from one the engineer has settled. 0.30.0 PR 5 (ADR-4131) amendment: D3, D5 and D6 run the substantive checks of proposal 3.2 and exit 4 under `--check`; `--ack` remains their recorded override. D4 reports closed sets and `ownerRef` resolution as findings. D2 validates `resolvedBy` pointers and the standards citation. The three D3 bite checks land in this PR: `shapes:templateMarkers` (per-kind marker presence on `interfaces[].description`, over delta, ids `<tacId>:<name>`, why names the missing marker, drafts included), `shapes:entityJoin` (every `coreEntities[].name` named by exactly one `recordShape` tree-wide, ids `TAD.entity:<name>` with 'no record shape' or 'N record shapes'), `shapes:pathsResolve` (any `path:`-like token in an interface description resolves against `resolvedPaths` in the stage context or the description carries `authoredAt: D3`, over delta). The CLI readiness `--check shapes` exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash; `ackable(stage)` returns true for D3, D5, D6 and false for D1, D2, D4, D7, D8; `--ack` on D1, D2, D4, D7 or D8 exits 2 unchanged. DEFINE step 3 rulings R2, R5, R6, R7, R8 2026-10-05 (w-2026-10-05-dave-001): `shapes:draftSettled` is a tree-wide check that runs regardless of the D3 scope's own early-return (R2); `shapes:entityJoin` is tree-wide by definition and runs before any `notApplicable` short-circuit via the shared helper ADR-4138 lands (R5); `extractInterfacePathTokens` honours a short whitelist of known bare repo names so `Dockerfile`, `Makefile`, `LICENSE`, `Procfile`, `Containerfile`, `Justfile`, `Rakefile`, `Gemfile` and `CODEOWNERS` are checked by `shapes:pathsResolve` (R6; the slash-or-extension rule stays for everything else, and the whitelist is exported for tests); `skeleton:standardsCited` runs tree-wide regardless of the D2 scope's own early-return and shares the ADR-4138 helper (R7); and for `standards:<pack>` concern-ledger entries both `applied` and `waived` dispositions satisfy `skeleton:standardsCited` alongside a citation (R8; the check question reads 'Every registered standards pack is cited, applied or waived'). DEFINE step 3 ruling R13 2026-10-05 (w-2026-10-05-dave-013, PR 292 follow-up): the tree-wide-before-scope principle covers every tree-wide check, not only the three R2/R5/R7 named. The ADR-4138 helper is extended to govern D2 `skeleton:deployAdr` (exactly one Deploy target or Deploy deferral ADR exists; a title-prefix scan over the whole `tree.adrs`), D5 `crosscut:securityArchitecture` (TAD.securityArchitecture non-empty when any REQ carries shape `auth` or `httpApi` tree-wide) and D5 `crosscut:operationalConcerns` (TAD.operationalConcerns non-empty when any AC carries `[deployed]` tree-wide). D4 and D6 are unchanged. The `treeWideFailureEnvelope` helper now folds its warn-with-ack acknowledgement through `foldState` so one implementation owns the ack rule and the failing envelope carries no stale `notApplicable` reason text.",
   "category": "functional",
   "domain": "defineDetection",
   "priority": "must",