rcf-lite 0.29.0 → 0.31.0

package/rcf/tacs/tac-4105-feedback-render.json

@@ -16,18 +16,18 @@
   "interfaces": [
     {
       "name": "renderIssue",
-      "kind": "function",
-      "description": "Return { title, body, labels[] } for a create call."
+      "kind": "other",
+      "description": "Return { title, body, labels[] } for a create call. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderComment",
-      "kind": "function",
-      "description": "Return the comment body for a +1 add."
+      "kind": "other",
+      "description": "Return the comment body for a +1 add. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderBundle",
-      "kind": "function",
-      "description": "Return the markdown bundle string for outbox files."
+      "kind": "other",
+      "description": "Return the markdown bundle string for outbox files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -41,5 +41,5 @@
   "tradeoffs": "Static templates keep the shape reviewable by eye and byte-comparable in tests; the cost is that template drift requires golden updates, which is exactly the discipline the tests exist for.",
   "notes": "The docs-site \"submit a blueprint idea\" form reuses these templates verbatim so triage sees one shape from both producers.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4106-feedback-destination.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "resolve",
-      "kind": "function",
-      "description": "Given an entry and the manifest+registry, return the destination shape."
+      "kind": "other",
+      "description": "Given an entry and the manifest+registry, return the destination shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "CORE_REPO",
-      "kind": "constant",
-      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test."
+      "kind": "other",
+      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -36,5 +36,5 @@
   "tradeoffs": "A declared destination on library.json requires library owners to author one field; the cost is a one-time PR per library, in exchange for correctness on every consuming project.",
   "notes": "A library mirrored from a fork would have derivation pointing at the fork; the declared issues field is why derivation is only a fallback.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T13:46:24.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4107-feedback-gh.json

@@ -15,18 +15,18 @@
   "interfaces": [
     {
       "name": "ghIssueCreate",
-      "kind": "function",
-      "description": "Create one issue on a repo with title, body and labels; return { url, number }."
+      "kind": "other",
+      "description": "Create one issue on a repo with title, body and labels; return { url, number }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueSearch",
-      "kind": "function",
-      "description": "Search issues on a repo by body query; return matches."
+      "kind": "other",
+      "description": "Search issues on a repo by body query; return matches. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueComment",
-      "kind": "function",
-      "description": "Comment on an issue; return { url }."
+      "kind": "other",
+      "description": "Comment on an issue; return { url }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -39,5 +39,5 @@
   "tradeoffs": "gh is a dependency the reporter chooses to install; the cost is a fallback bundle path when gh is missing, which the design considers a feature rather than a bug.",
   "notes": "A future MCP-only harness would call the CLI too; a native gh-lib port is not planned for v1.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4108-feedback-hook.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "shouldAsk",
-      "kind": "function",
-      "description": "Pure decision on the quiet rule; unit-tested across the full table."
+      "kind": "other",
+      "description": "Pure decision on the quiet rule; unit-tested across the full table. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "emit",
-      "kind": "function",
-      "description": "Per-harness output; exit code and shape."
+      "kind": "other",
+      "description": "Per-harness output; exit code and shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "installHooks",
-      "kind": "function",
-      "description": "Merge the hook entries into the two harness config files."
+      "kind": "other",
+      "description": "Merge the hook entries into the two harness config files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -42,5 +42,5 @@
   "tradeoffs": "Two harness config files to maintain and one handler; the cost is small (one merge pattern per file) and the benefit is one implementation of the quiet rule for both harnesses.",
   "notes": "The asked record is appended before the emit path, so a crash between emit and reply cannot cause a second ask.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4121-define-ledgers.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-24T12:00:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z",
   "tacId": "TAC-4121-define-ledgers",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -16,7 +16,8 @@
     "parseBriefFromFile splits by non-empty lines, strips leading '- ', '* ' or '<n>. ' bullets, defaults kind to 'capability', and threads --source through to every draft.",
     "src/cli/ledger.js: `rcf define ledger <name> <verb>` argv parsing; verbs add / resolve / list; ledger-specific flags for each; renderDecisionsList formats the #241 numbered layout; list --json emits { ledger, <arrayKey>: [...] }.",
     "bin/rcf.js: register GROUPS.define.ledger; src/cli/help.js: import LEDGER_HELP and wire into HELP_MAP.define.ledger + DEFINE_HELP + top-level DEFINE listing so per-verb help stays single-sourced.",
-    "`update <id>` subverb patches named fields and re-runs full-body validation; `resolvedBy` is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2."
+    "`update <id>` subverb patches named fields and re-runs full-body validation; `resolvedBy` is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2.",
+    "concern ledger carries `applied`/`waived` entries keyed by `<REQ>:<concern>` (spec section 4 row 'D5 catalogue', 0.30.0 PR 6): `crosscut:catalogue` reads the concern-ledger body and matches each applicable `(reqShape, concern)` pair against an entry with that key. A `standards:<pack>` key names a waiver for `skeleton:standardsCited`. The ledger schema already carries `{ id, concern, reqId, disposition, reason?, addedAt, status, resolvedAt? }`; the `<REQ>:<concern>` key is composed by the gate from `concern` and `reqId` (no schema change)."
   ],
   "internalStructure": "The walker never reads under rcf/define/: subdirFor in src/core/store/loader.js returns null for anything that is not a known child kind (requirements, user-stories, tacs, adrs, fbs, test-suites, code-nodes, evals), so a ledger file sitting under rcf/define/ is never enumerated for schema validation. The walker-invisibility invariant is proved by a dedicated test that seeds the four ledger files plus a bug-bait req-shaped file under rcf/define/ and asserts zero walker error paths starting with rcf/define/ and no matching id in tree.byId. Validation is JSON-schema-shaped inline (no ajv, no @stravica-ai/rcf-schemas dependency) because the sidecars ride outside the shared schema until schemas 0.7 (ADR-4121).",
   "interfaces": [

package/rcf/tacs/tac-4122-define-gates.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-05T12:00:00Z",
   "tacId": "TAC-4122-define-gates",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "define stage gates D1..D8",
   "purpose": "src/query/gates.js lands as a new pure module beside delta.js. Every stage has one exported check function that takes (tree, context) and returns the { stage, gate, state, checks[] } shape section 2.4 pins. computeReadiness (TAC-4123) is the composer; every gate function is otherwise consumable in isolation for tests and for future viewers that render one stage. No I/O, no state, no time: the caller supplies ledgers, profile, freeze, delta, validate errors, probe count and coverage rollups.",
@@ -22,7 +22,25 @@
     "ADR-4126 (0.29.0): own the per-check persona and question map; export `CHECK_PERSONA`, `CHECK_QUESTION`, `STAGE_FALLBACK_PERSONA`, `checkPersona(name)`, `checkQuestion(name)` and `parseInterfaceDraft(iface)`. Every entry in `stages[].checks[]` carries `persona` (productOwner | engineer) and a non-empty `question`; the `stage:<D>:scope` placeholder uses `STAGE_FALLBACK_PERSONA`.",
     "ADR-4126 (0.29.0): split `skeleton:reqFields` into `skeleton:reqIntent` (productOwner: description without TODO and domain, evaluated per REQ independently) and `skeleton:reqShape` (engineer: shapeClassification.shapes). Split `decisions:allAnswered` into `decisions:wellFormed` (productOwner: non-empty question + two or more options + a default naming one of them) and `decisions:allAnswered` (engineer: zero open).",
     "ADR-4126 (0.29.0): new D3 check `shapes:draftSettled` fails any interface whose `description` starts with `[draft]` (whitespace tolerated), id `<tacId>:<name>`, over delta, total = interfaces on TACs in scope; `tacHasInterface` counts a draft as present; `kindVocabulary` applies to drafts.",
-    "`shapes:draftSettled` reports `[draft]` on `TAC.purpose`, `coreEntities[].description` and `TAC.interfaces[].description` with ids `<tacId>`, `TAD.entity:<name>` and `<tacId>:<name>` respectively (REQ-188, 0.30.0): `parseInterfaceDraft` reads the marker on all three homes with the same whitespace-tolerant rule; the draft pass enumerates across the three homes; nothing in the draft pass can fail a product-owner check."
+    "`shapes:draftSettled` reports `[draft]` on `TAC.purpose`, `coreEntities[].description` and `TAC.interfaces[].description` with ids `<tacId>`, `TAD.entity:<name>` and `<tacId>:<name>` respectively (REQ-188, 0.30.0): `parseInterfaceDraft` reads the marker on all three homes with the same whitespace-tolerant rule; the draft pass enumerates across the three homes; nothing in the draft pass can fail a product-owner check.",
+    "`shapes:templateMarkers` (per-kind marker presence on `interfaces[].description`) (ADR-4131, 0.30.0 PR 5): engineer, over delta, id `<tacId>:<name>`, `why` names the missing marker; `recordShape` needs `fields:`; `httpRoute` needs `method`, `path`, `request`, `response`, `errors`; `fixture` needs `instances:`; `event` needs `payload:`; `cliCommand` needs `usage:`; `uiRoute` needs `path`; `port` needs `protocol`; `fileFormat` needs `format:`; `other` needs a note. Drafts are included (a `[draft]` recordShape without `fields:` fails exactly as a settled one).",
+    "`shapes:entityJoin` (every `coreEntities[].name` named by exactly one `recordShape`) (ADR-4131, 0.30.0 PR 5): engineer, over tree; match on `name` or an `entity:` line in the template; fail ids `TAD.entity:<name>` with `no record shape` or `N record shapes`.",
+    "`shapes:pathsResolve` (any `path:`-like token in an interface description that looks like a repo path resolves on disk or the description carries `authoredAt: D3`) (ADR-4131, 0.30.0 PR 5): engineer, over delta; gates stay pure, the readiness CLI resolves candidate paths and passes `resolvedPaths` in the stage context; ids `<tacId>:<name>` with the unresolved path in `why`.",
+    "`ackable(stage)` (ADR-4131, 0.30.0 PR 5): exported helper that returns `true` for D3, D5, D6 and `false` for every other stage. `stagePolicy(stage)` is unchanged; `ackable` is the companion that names the three gates that accept a recorded `--ack` override.",
+    "`stories:closedSets` (0.30.0 PR 6, spec section 4 row 'D4 closed-set and ownerRef as findings'): engineer, over delta. An AC whose description contains an enumeration cue (`one of`, `any of`, `the following`, `types of`, `status is`) without an inline bracketed list or an `ownerRef` fails. Honours the shared quoted-cue guard with D6: a cue inside a double-quoted substring does not fire.",
+    "`stories:ownerRefResolves` (0.30.0 PR 6; widened under R11 in PR 9, spec section 17): engineer, over delta plus tree for ownerRef targets. Every ownerRef on an AC with a tacId OR adrId whose field names an existing field path on the owning document (bracket grammar: interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>]; or a bare schema field name -- purpose, decision, internalStructure, etc.) resolves. Dotted grammar is refused. Failing ids name the AC and the unresolved pointer with the why string `ownerRef does not resolve`. Validate reuses this check via `resolveOwnerRefField` (PR 8 adds the finding row, PR 9 generalises both arms).",
+    "`crosscut:catalogue` (0.30.0 PR 6, spec section 4 row 'D5 catalogue'): engineer, over tree. For every REQ in scope, enumerate applicable `(reqShape, concern)` pairs through `src/define/concern-catalogue.js` (eight concerns keyed by REQ shape); each pair needs a concern-ledger entry keyed `<REQ>:<concern>` with disposition `applied` or `waived` (with a reason for waived). Failing ids are `<REQ>:<concern>`. Keys shared with the baseline catalogue where names coincide. D5 is ackable: readiness --check crosscut rides the same --ack fold as D3.",
+    "`skeleton:standardsCited` (0.30.0 PR 6, spec section 4 row 'Standards-ingestion check'): engineer, over tree. Every standards pack registered through `rcf define standards` (manifest.standards[].slug) is cited in a REQ `rationale` or an ADR, or waived by a concern-ledger entry with key `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and unwaived'.",
+    "`src/define/concern-catalogue.js` (0.30.0 PR 6): the eight-concern applicability map keyed by REQ shape: `auth` to `auth`/`httpApi`; `errorEnvelope` to `httpApi`/`cliCommand`; `loggingAudit` to all shapes but `other`; `retention` to `persistence`; `performance` to `httpApi`/`batch`; `secrets` to `auth`/`externalIntegration`; `timeAndTimezone` to `persistence`/`batch`; `concurrencyIdempotency` to `httpApi`/`persistence`. Exports `applicableConcernsFor(reqShape)` returning the concern keys that apply, plus `CONCERN_KEYS` and `CONCERN_APPLICABILITY` for tests. Pure; no I/O.",
+    "`consistency:contradictions` (0.30.0 PR 7, spec section 4 row 'D6 scans and the injectable probe runner'): engineer, over delta. Two ACs on one story sharing a `when` clause with a negated `then` fail the story; failing ids name the story and both AC ids. The named false-positive guard: a negation inside a double-quoted substring in a `then` does not fail the story (the shared quoted-substring guard with D4).",
+    "`consistency:unsatisfiable` (0.30.0 PR 7): engineer, over delta. A `then` naming a field that no `recordShape` defines fails the AC; a field defined in a `[draft]` recordShape counts as defined. Failing ids `<acId>:<field>`.",
+    "`consistency:duplicates` (0.30.0 PR 7): engineer, over tree. Identical AC descriptions across stories fail both ACs with id `<acId>` and why 'duplicate description'. The comparison trims leading whitespace and the leading `[class]` marker.",
+    "`consistency:orphanInterfaces` (0.30.0 PR 7): engineer, over tree. An interface on a TAC that no AC's `ownerRef` points at and that no REQ's `deliveredBy` reaches fails with id `<tacId>:<name>` and why 'no AC ownerRef and no REQ deliveredBy reaches it'. Shares the `interfaces[<name>]` pointer grammar with D4 `stories:ownerRefResolves`.",
+    "DEFINE step 3 ruling R2 2026-10-05 (w-2026-10-05-dave-001): `shapes:draftSettled` is tree-wide (a `[draft]` anywhere in the tree is unfinished work); the check runs through the shared tree-wide-before-scope helper ADR-4138 lands, so a narrowed D3 scope that excludes every TAC and shaped REQ still reports a `[draft]` core entity. `shapes:templateMarkers`, `shapes:entityJoin` (R5) and `shapes:pathsResolve` keep their spec section 4 `over` labels (delta, tree, delta respectively).",
+    "DEFINE step 3 ruling R5 2026-10-05: `shapes:entityJoin` is tree-wide by definition and runs before any scope-driven `notApplicable` short-circuit (ADR-4138's `evaluateTreeWideChecks` helper). D4, D5 and D6 inherited the same ordering shape in PRs 6 and 7; the helper governs every stage with a tree-wide check (`shapes:draftSettled`, `shapes:entityJoin`, `skeleton:standardsCited`). A narrowed scope that excludes every recordShape still reports an entityJoin finding.",
+    "DEFINE step 3 ruling R6 2026-10-05: `extractInterfacePathTokens` whitelists the usual bare repo names (`Dockerfile`, `Makefile`, `LICENSE`, `Procfile`, `Containerfile`, `Justfile`, `Rakefile`, `Gemfile`, `CODEOWNERS`) so `shapes:pathsResolve` checks a `path: Dockerfile` token. The slash-or-extension rule stays for everything else; the whitelist is exported from `gates.js` for the test.",
+    "DEFINE step 3 ruling R7 2026-10-05: `skeleton:standardsCited` runs tree-wide regardless of the D2 scope's own early-return; the check sits inside D2's `checks[]` under the ADR-4138 helper, so a narrowed D2 scope that excludes every REQ/PRD/TAD/brief statement still reports an uncited pack.",
+    "DEFINE step 3 ruling R8 2026-10-05: for `standards:<pack>` concern-ledger entries, both `applied` and `waived` dispositions satisfy `skeleton:standardsCited` alongside a citation. The CHECK_QUESTION heading reads 'Every registered standards pack is cited, applied or waived' (spec section 4 row 'Standards-ingestion check' amended)."
   ],
   "internalStructure": "Every stage function follows the same shape: 1) decide notApplicable per section 3.2 and return { state: 'notApplicable' } with a single-check summary; 2) build checks[] as a list of { name, ok, over, pass, total, failing: [{ id, why }] }; 3) fold to state: 'passed' if every ok is true; 'failing' otherwise, unless the stage is D3/D5/D6 AND freeze.gates[<gate>].state === 'acknowledged' AND freeze.gates[<gate>].at.hash === currentTreeHash, in which case state is 'acknowledged'. Blocking-vs-warn is a property of the stage, not of the state: D3/D5/D6 use the acknowledged fold, D1/D2/D4/D7/D8 do not. The caller (readiness) folds the array of stage results into freezeable and nextAction.",
   "interfaces": [
@@ -55,6 +73,21 @@
       "name": "parseInterfaceDraft",
       "kind": "other",
       "description": "[draft] True when an interface's `description` carries the leading `[draft]` marker (whitespace tolerated)."
+    },
+    {
+      "name": "parseInterfaceTemplate",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseInterfaceTemplate(iface) returns the per-kind marker presence for an interface: for a recordShape it reports whether `fields:` is present; for an httpRoute it reports whether each of method, path, request, response and errors is present; for fixture it reports `instances:`; for event, cliCommand, uiRoute, port, fileFormat and other it reports the per-kind markers from spec section 4 row 'D3 template parser'. Exported from src/query/gates.js for shapes:templateMarkers and for the validate step 6 notice (0.30.0 PR 5)."
+    },
+    {
+      "name": "ackable",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): ackable(stage) returns true for D3, D5 and D6 and false for every other stage. The CLI readiness and freeze verbs read it to gate --ack as the recorded override for just those three gates (ADR-4131)."
+    },
+    {
+      "name": "applicableConcernsFor",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): applicableConcernsFor(reqShape) returns the concern keys that apply to a REQ shape, per the eight-concern applicability map in src/define/concern-catalogue.js (0.30.0 PR 6). Pure. crosscut:catalogue reads this to decide which (reqShape, concern) pairs each REQ in scope must have a concern-ledger entry for."
     }
   ],
   "notes": "Slice-3 hook (rcf define freeze): reads state to refuse on any 'failing'; --ack <gate> --reason <text> writes freeze.gates[<gate>] = { state: 'acknowledged', at: { hash: <currentTreeHash>, reason: <text>, by: <id> } } and re-runs computeReadiness to check freezeable. Slice-5 hook (viewer): reads the same object end-to-end."

package/rcf/tacs/tac-4123-define-readiness.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-01T16:00:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
   "tacId": "TAC-4123-define-readiness",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "computeReadiness compute and rcf define readiness CLI",
   "purpose": "src/query/readiness.js and src/cli/readiness.js land as a matched pair. The pure module composes computeDelta, computeImpact, the eight gate check functions from TAC-4122, computeCoverage, and the decisions ledger into the single-object contract section 2.4 pins; the CLI is its twin. Text output for readable status; --json for machine consumers and the viewer slice; --check <stage>|all for targeted inspection with the same 0-green / 4-red exit shape rcf audit coverage uses.",
@@ -22,7 +22,13 @@
     "ADR-4126 (0.29.0): `deriveNextAction(stages, persona?)` gains an optional persona argument. With no persona it behaves exactly as 0.28.4. With a persona it picks the first stage in D1..D8 order holding a failing check of that persona, then the check with the largest failing list; the command carries `--level intent` on the productOwner variant. `formatVerdictLines(result)` builds the two strings (`Intent-complete: yes/no...` and `Ready-to-build: yes/no...`) shared by the CLI (PR B) and the Readiness tab (PR C) so they cannot disagree.",
     "ADR-4126 (0.29.0): the levels and personas folds are additive; every 0.28.4 top-level field (tree, delta, stages, nextAction, coverage, decisions, freezeable) is present with its 0.28.4 type. No file under rcf/ is created or modified by any `rcf define readiness` invocation. The CLI flags (`--level`, `--persona`) and the viewer tab are PR B and PR C respectively; the compute lands first (PR A).",
     "ADR-4126 PR B (0.29.0): src/cli/readiness.js owns the --level intent|build and --persona productOwner|engineer dispatch. --level drives the exit code against levels.<which>.ok per spec section 3.2 (stricter than --check all on warn-with-ack failures per decision 4); --persona is a display filter that never affects the exit code or JSON content. parseLevelFlag and parsePersonaFlag share the usage-line shape with --check. Unknown values exit 2 with a usage line naming the accepted set. The CLI passes the resolved level into computeReadiness via the readiness context so _meta.level reflects the invocation (null when the flag was absent).",
-    "ADR-4126 PR B (0.29.0): the text report prints both verdict lines (shared via formatVerdictLines) at the top; regroups blockers into one 'Product owner: N question(s)' and one 'Engineer: N check(s) blocking' section ordered by the profile register (productOwner-first or engineer-first; unstated and absent profile default to PO first); and renders the per-check line in the per-stage detail block with the persona inside the parenthesis after `over`. --persona X collapses the opposite-persona block to one 'hidden; run without --persona' line and restricts the per-stage detail to matching-persona checks."
+    "ADR-4126 PR B (0.29.0): the text report prints both verdict lines (shared via formatVerdictLines) at the top; regroups blockers into one 'Product owner: N question(s)' and one 'Engineer: N check(s) blocking' section ordered by the profile register (productOwner-first or engineer-first; unstated and absent profile default to PO first); and renders the per-check line in the per-stage detail block with the persona inside the parenthesis after `over`. --persona X collapses the opposite-persona block to one 'hidden; run without --persona' line and restricts the per-stage detail to matching-persona checks.",
+    "ADR-4131 (0.30.0 PR 5): collects candidate paths; the CLI resolves them on disk and passes `resolvedPaths` in the stage context so the `shapes:pathsResolve` check can decide a path:-like token against the real filesystem without turning the gates module into an I/O module. The compute remains pure: readiness.js owns the collection seam; cli/readiness.js owns the resolve-on-disk step before invoking the gate functions.",
+    "ADR-4131 (0.30.0 PR 5): the readiness CLI --check policy becomes bite-aware for D3. --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash (same recorded-override channel ADR-4124 pins). --check on D4, D5 and D6 keeps the 0.29.0 behaviour until their own PRs (6 and 7) bite. --level intent and --level build exits are unchanged.",
+    "ADR-4131 extended (0.30.0 PR 7, spec section 11.6): computeReadiness accepts an injectable `probeRunner` ({ reqId, tree }) => findings[], default null; findings land as probe-ledger entries in the result (merged into `ledgers.probes.probes[]` the gate reads) and count toward consistency:probeCount. With no probeRunner the result equals the 0.29.0 result on the same fixture. src/define/probe-runner.js lands as the seam only; no shipped runner (the harness is the runner through `ledger probes add`). The CLI never passes a probeRunner today; the seam is for test harnesses and for a later harness-driven call site.",
+    "ADR-4131 extended (0.30.0 PR 7; R9 amended 2026-10-03, w-2026-10-03-dave-011): --litmus <n> on readiness and freeze requires n distinct litmus readings at the current LITMUS HASH. A litmus reading is a probe-ledger entry whose `finding` begins `litmus:<reader>:` and whose text includes a `hash` matching `tree.litmusHash`. The litmus hash is the tree hash computed with the probes ledger excluded (new computeLitmusHash helper in src/query/readiness.js); the probes ledger is inside `tree.currentTreeHash` by ADR-4120, so a reader writing a probe-ledger entry that referenced `currentTreeHash` would shift the hash it just attested to. The litmus hash is the content-stable hash readers pin to: writes to the probes ledger do not shift it, so n readers can land `litmus:<reader>:` entries at the same hash; writes to the brief, decisions or concerns ledgers do shift it (the content under review has changed). One reader exits 4 naming the shortfall; n distinct readers at the hash pass. No process is spawned and no network call is made; the harness is the runner. `--litmus-attested` remains the default attestation path. Trade-off: litmus readings do not attest to probe findings written after them, which is acceptable because probe entries are themselves readings.",
+    "ADR-4131 extended (0.30.0 PR 7): the readiness CLI --check policy becomes bite-aware for D6. --check consistency exits 4 on an unacknowledged D6 failure and 0 when acked at the current hash (the one-line change: D6 joins the BITING_STAGES set in src/cli/readiness.js; the --ack channel D3/D5/D6 already share stays unchanged).",
+    "PR 9 (REQ-179 enforcement locus): the CLI computes readiness BEFORE calling `runWithAdmissibilityGate`, passing the computed `stages[]` and the validate-errors array via `defineStages` and `defineValidateErrors`; the wrap evaluates NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors), honouring --ack-at-current-hash as the recordedInChain override for ADM-02/03. The compute still runs and prints under refusal (AC-17902-4)."
   ],
   "internalStructure": "readiness.js is a linear composer: 1) compute delta and its docHashes; 2) fan-out impacted / impactedFbs; 3) build stage context (freeze, delta, scope, ledgers, profile, validateErrors, probeOpenCount, coverageTree); 4) call the eight check functions; 5) fold freezeable and nextAction. The CLI parses flags, loads the tree once, loads the four ledgers and the freeze record once, computes the readiness, then routes to the text or JSON emitter. --check maps its argument to the STAGE_SHORT_NAMES map (brief -> D1 ... freeze -> D8) or accepts D1..D8 directly. The runWithAdmissibilityGate wrap sits inside main so refusals ride the same exit path as coverage's admissibility refusals.",
   "interfaces": [
@@ -55,6 +61,26 @@
       "name": "parsePersonaFlag",
       "kind": "other",
       "description": "[draft] Validate --persona against the closed value set (productOwner | engineer); return the value or null (flag absent) or throw a usage error for an unknown value."
+    },
+    {
+      "name": "parseLitmusFlag",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseLitmusFlag(raw) parses --litmus <n> as a positive integer; returns null (flag absent) or throws a usage error for a non-integer or non-positive value (0.30.0 PR 7, ADR-4131 extended)."
+    },
+    {
+      "name": "countLitmusReadersAtHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): countLitmusReadersAtHash(ledgers, hash) returns the set of distinct reader ids extracted from probe-ledger entries whose `finding` begins `litmus:<reader>:` and whose text includes `hash` (0.30.0 PR 7). Pure. The CLI exits 4 when the set size is below --litmus <n>. `hash` is `tree.litmusHash` (ADR-4131 extended R9, w-2026-10-03-dave-011), not `tree.currentTreeHash`: the probes ledger is inside currentTreeHash by ADR-4120, so a reader writing a probe-ledger entry that referenced currentTreeHash would shift the hash it just attested to."
+    },
+    {
+      "name": "computeLitmusHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): computeLitmusHash(tree, ledgers) returns the tree hash (`sha256:<hex>`) recomputed with the probes ledger excluded (ADR-4131 extended R9, w-2026-10-03-dave-011). Reuses hashDocument and computeTreeHash from src/query/delta.js. Pure. The result is stable under writes to the probes ledger (so n readers can pin litmus entries to the same hash) and shifts the same way currentTreeHash shifts under writes to the brief, decisions or concerns ledgers (which do change what the readers were attesting to)."
+    },
+    {
+      "name": "probeRunner",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): injectable runner shape `({ reqId, tree }) => findings[]`, default null. computeReadiness calls the runner (when set) over every REQ in scope and merges the returned findings into ledgers.probes.probes[] so the gate reads them (0.30.0 PR 7). No runner ships; src/define/probe-runner.js carries the seam only. Pure over its inputs; must not do I/O or spawn a process."
     }
   ],
   "notes": "Slice-3 hook (rcf define freeze) reads freezeable and stages[].state; --ack <gate> writes into freeze.gates[<gate>] and re-computes readiness. Slice-5 hook (viewer) fetches the same JSON object over the existing tab wire and renders the pill vocabulary + findings-list + diff components. Performance seam: computeImpact per id on a whole-tree delta (before freeze) may be quadratic on very large trees; the compute stays fast on the dogfood chain (~700 documents, sub-second) but the CLI notes the wall time in text mode so an operator can spot regression."

package/rcf/tacs/tac-4125-build-bundle-refuse-override-skip.json

@@ -0,0 +1,43 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
+  "tacId": "TAC-4125-build-bundle-refuse-override-skip",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.1",
+  "status": "draft",
+  "name": "build bundle --next refusal, override and impacted-FBS skip",
+  "purpose": "0.30.0 PR 8 (spec section 4 bundle row, section 11.7 US-17702). `rcf build bundle --next` is tightened against the detection-model freeze record: without a freeze record the verb refuses with exit 4 naming `rcf define readiness`; `--override \"<reason>\"` writes `freeze.override { reason, by, at }` through saveFreezeRecord and proceeds; on a non-empty delta against the current tree, the next-item compute skips re-execute FBS impacted by the delta with the reason text in a line and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb refuses with exit 4 with the same message. On a frozen tree with an empty delta the verb's 0.29.0 shape is unchanged (AC-17702-5).",
+  "responsibilities": [
+    "refusal: on `bundle --next` with no freeze record, exit 4 with a usage line naming `rcf define readiness` (and `--override \"<reason>\"` as the override channel); the next-item compute does not run.",
+    "override: `--override \"<reason>\"` on `bundle --next` writes `freeze.override { reason, by, at }` through saveFreezeRecord before the next-item compute runs; `--override` without a non-empty reason is a usage refusal (exit 2); when a freeze record exists the override is still written and the override reason is named in the output.",
+    "skip: on a non-empty delta against the current tree hash, next-item selection filters re-execute FBS impacted by the delta out of the actionable queue with a stderr line naming each skipped FBS and the reason; the next unimpacted actionable FBS is handed out.",
+    "all-impacted refusal: when every actionable FBS is impacted by the delta and no override is given, the verb refuses with exit 4 and the same message pointing at `--override \"<reason>\"`.",
+    "unchanged on empty delta: on a frozen tree with an empty delta the verb's output and exit code are byte-for-byte unchanged from 0.29.0 (AC-17702-5).",
+    "override.by identity (PR 9, AC-17702-6): freeze.override.by is resolved by `resolveOverrideBy({projectRoot})` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`. Each failing arm falls through silently to the next; the write path cannot blow up on a stripped-down container."
+  ],
+  "internalStructure": "The next-item path in `src/cli/build.js` grows a pre-emit guard (`enforceBundleNextFreezeGate`) that loads the freeze record and the computed delta via loadFreezeRecord and computeDelta, applies the `--override` write (if given) before the next-item compute, and emits a refusal when the record is absent and no override is given. The impacted-FBS skip extends `selectNext` to accept an `impactedFbsIds` set and skip them with a stderr reason; the all-impacted case falls through to a refusal rather than an empty envelope. `freeze.override` records come through `saveFreezeRecord` so the existing schema and canonical-JSON contract are reused; a short writer `applyOverrideToFreezeRecord` writes `freeze.override` on the live freeze record (creating a minimal record stamped with `frozenAt=now`, `treeHash=currentTreeHash`, `docHashes=whole-tree`, `briefStatements=0` when none exists).",
+  "interfaces": [
+    {
+      "name": "enforceBundleNextFreezeGate",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ tree, projectRoot, overrideReason, by }) -> { ok: boolean, exitCode?: 2|4, message?: string, impactedFbsIds?: Set<string>, override?: { reason, by, at } }. Reads the freeze record and `computeDelta(tree, { freeze })`, applies the override write when `overrideReason` is set, and either returns ok with the impacted-FBS set, or a refusal with exit 4 and the usage message. authoredAt: D3."
+    },
+    {
+      "name": "applyOverrideToFreezeRecord",
+      "kind": "other",
+      "description": "`moduleApi` (`src/define/freeze-record.js`). Signature: ({ projectRoot, reason, by, at }) -> { filePath }. Loads or creates a freeze record, sets its override to { reason, by, at }, writes through saveFreezeRecord. authoredAt: D3."
+    },
+    {
+      "name": "selectNext",
+      "kind": "other",
+      "description": "`moduleApi` (`src/build/queue.js`). Extended to accept an optional `{ impactedFbsIds, io }` parameter: when supplied, re-execute FBS whose id is in `impactedFbsIds` are skipped with a stderr line naming the FBS and the reason, and the next unimpacted FBS is returned; when every actionable FBS is impacted, returns `null` and the caller treats that as the all-impacted refusal."
+    },
+    {
+      "name": "resolveOverrideBy",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ projectRoot }) -> Promise<string>. Resolves the identity for `freeze.override.by` under the R11 preference order (git config user.email, GITHUB_ACTOR, USER, USERNAME, operator). Pure of side effects beyond one bounded `git config --get user.email`. authoredAt: D3."
+    }
+  ],
+  "notes": "Spec amendment 2026-10-03 R9 does not alter this TAC: delta semantics are unchanged, the litmus hash is a readiness concern only. `freeze.override` writes do not shift `tree.currentTreeHash` or `tree.litmusHash` (the probes ledger is excluded from the litmus hash by R9; the override lives in the freeze record, not in a tree document). The brief named this TAC as `tac-4125*.json`; the file name follows the dash-prefixed naming convention of neighbouring TACs."
+}

package/rcf/tacs/tac-4126-define-validate-findings.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
+  "tacId": "TAC-4126-define-validate-findings",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.1",
+  "status": "draft",
+  "name": "rcf define validate findings for interface kind, AC class prefix, tacIds and ownerRef or deliveredBy",
+  "purpose": "0.30.0 PR 8 (spec section 4 validate row, section 11.7 US-17802). `rcf define validate` reports a finding and exits non-zero for an interface kind outside the closed vocabulary (`INTERFACE_KINDS`), a bracketed AC prefix on an AC `description` outside the known classes (`AC_CLASS_RE`), a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`. The absence of a class marker on an AC is NOT a validate finding (decision 10, kept): absence is D4's floor; a validate finding here would fail the dogfood tree and every legacy tree's CI.",
+  "responsibilities": [
+    "interface kind outside vocabulary: for every TAC in the tree, each `interfaces[].kind` that is not in `INTERFACE_KINDS` is reported as a finding `defineValidate:interfaceKind` naming the TAC id, interface name and the unknown kind.",
+    "bracketed AC class prefix outside known classes: for every AC in the tree whose description's leading bracketed prefix is not one of {happy, edge, failure, must-not, non-functional}, report `defineValidate:acClassPrefix` with the US id, AC id and the unknown prefix. An AC description with NO leading bracketed prefix is NOT reported (decision 10).",
+    "tacIds naming a non-TAC: for every US in the tree, each `tacIds[]` entry that does not resolve to a TAC in `tree.byId` is reported as `defineValidate:tacIdsResolves` with the US id and the unresolved id.",
+    "unresolving ownerRef or deliveredBy (R11 grammar, spec section 17, PR 9): for every AC with ownerRef `{ tacId | adrId, field }` whose field does NOT resolve on the owning TAC/ADR under R11 (`interfaces[<name>]`, `responsibilities[<n>]`, `dependencies[<name>]`, `alternativesConsidered[<n>]`, or a bare schema field name), and for every REQ whose deliveredBy is the OBJECT form `{ tacId | adrId, field }` with a dotted or dead field, report `defineValidate:ownerRefResolves` or `defineValidate:deliveredByResolves` with the owning id and the dangling pointer. String-form deliveredBy (pre-DEFINE back-compat) still resolves against `tree.byId`. The object-form `deliveredBy` was silently skipped before PR 9 (review 2026-10-03).",
+    "clean on the dogfood tree: every finding is scoped so the rcf-lite dogfood tree passes with exit 0; where the dogfood tree surfaces a real defect in a chain document, the fix is made in the chain document, not in the finding."
+  ],
+  "internalStructure": "A new module `src/define/validate-findings.js` exports `collectDefineValidateFindings(tree)` returning an array of walker-shaped error entries ({ kind, rule, documentId, filePath, field, message }). `src/cli/validate.js` runs the module after the Code Node resolution pass and the companions check, folds the findings into the `errors` array it already exits on (exit 3), and reports them in the same `--json` envelope. Each finding reuses the walker error shape so `formatErrors` prints them exactly as a schema or broken-reference error. Interface kinds reuse `INTERFACE_KINDS` from `src/query/gates.js`; AC class classification reuses `parseAcClass`; `ownerRef` resolution reuses the existing D4 helper (`AC_OWNER_REF_FIELD_RE`) so the two code paths cannot diverge.",
+  "interfaces": [
+    {
+      "name": "collectDefineValidateFindings",
+      "kind": "other",
+      "description": "`moduleApi` (`src/define/validate-findings.js`). Signature: (tree) -> Array<{ kind: 'defineValidate', rule: string, documentId: string|null, filePath: string|null, field: string|null, message: string }>. Pure over the walker tree model; no filesystem I/O. authoredAt: D3."
+    },
+    {
+      "name": "rcf define validate",
+      "kind": "cliCommand",
+      "description": "`cliCommand` (`rcf define validate`). Usage unchanged from 0.29.0; the exit path now also exits 3 on any finding returned by `collectDefineValidateFindings`. authoredAt: D3."
+    }
+  ],
+  "notes": "Decision 10 is binding: the dogfood tree and every legacy tree would fail CI if the absence-of-class-marker became a validate finding. The dogfood tree is checked clean by the AC-17802-3 test; a mechanical correction of a chain document is recorded in report.md's dogfood section when PR 8 fires. The brief named this TAC as `tac-4126*.json`; the file name follows the dash-prefixed naming convention of neighbouring TACs."
+}

package/rcf/tacs/tac-4128-define-guidance.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-02T18:00:00Z",
-  "updatedAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z",
   "tacId": "TAC-4128-define-guidance",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -14,7 +14,8 @@
     "guidance/managed/agent-instructions-block.md: the two rules of spec section 6 last row - the PO-session rule and the prototype rule. The managed block regeneration never removes an existing rule.",
     "guidance/manifest.json: register the new slug `define-intent`, the `rcf://docs/define-intent` resource, and the two new argument-free prompts `rcf_define_intent` and `rcf_define_intake`.",
     "serves `rcf_define_intent` and `rcf_define_intake` prompts and the two managed-block rules of REQ-186 and REQ-187.",
-    "serves `rcf_define_draft_shapes` and `rcf_discover_prototype` prompts and `guidance/discovery-prototypes.md` (REQ-188, REQ-182 amended): the draft-shapes prompt walks the agent through pre-populating `[draft]` core entities, TAC stubs and interfaces after L1; the discovery-prototype prompt walks the agent through recording a prototype in DISCOVERY as evidence; `guidance/discovery-prototypes.md` carries the doctrine and the ledger conventions and is also served as `rcf://docs/discovery-prototypes`; the managed block gains one prototype rule (ADR-4132) stating that a statement sourced to `prototype:` is evidence and a document citing prototype code as its implementation is a D2 finding the engineer resolves by re-deriving."
+    "serves `rcf_define_draft_shapes` and `rcf_discover_prototype` prompts and `guidance/discovery-prototypes.md` (REQ-188, REQ-182 amended): the draft-shapes prompt walks the agent through pre-populating `[draft]` core entities, TAC stubs and interfaces after L1; the discovery-prototype prompt walks the agent through recording a prototype in DISCOVERY as evidence; `guidance/discovery-prototypes.md` carries the doctrine and the ledger conventions and is also served as `rcf://docs/discovery-prototypes`; the managed block gains one prototype rule (ADR-4132) stating that a statement sourced to `prototype:` is evidence and a document citing prototype code as its implementation is a D2 finding the engineer resolves by re-deriving.",
+    "serves `rcf_define_litmus` prompt (0.30.0 PR 7, spec section 6 row): the argument-free markdown walks the harness through spawning n fresh-context readers and landing their readings as probe-ledger entries whose `finding` begins `litmus:<reader>:` and whose text includes the current `hash`. Registered through `guidance/manifest.json` and served through the existing MCP prompt plumbing. No new resource URI."
   ],
   "internalStructure": "The MCP prompt and resource plumbing (src/mcp/prompts.js, src/mcp/resources.js) already serves manifest-registered entries byte-faithfully; this TAC only adds entries and markdown files. The managed block is regenerated by `rcf doctor` from the fragment in guidance/harness-template.md; the two new rules append to that fragment, and the regeneration pass preserves rules the project authored outside the managed markers.",
   "interfaces": [
@@ -47,6 +48,11 @@
       "name": "rcf://docs/discovery-prototypes",
       "kind": "other",
       "description": "Resource URI backed by guidance/discovery-prototypes.md: the doctrine and the ledger conventions for prototypes in DISCOVERY (ADR-4132)."
+    },
+    {
+      "name": "rcf_define_litmus",
+      "kind": "other",
+      "description": "Argument-free MCP prompt served from guidance/define-litmus.md: walks the harness through spawning n fresh-context readers at the current tree hash and landing their readings as probe-ledger entries whose `finding` begins `litmus:<reader>:` and whose text includes the hash (0.30.0 PR 7)."
     }
   ],
   "notes": "This TAC was authored by PR 2 after the guidance slice did not land on origin/main under its reserved id ADR-4128 / TAC-4128; the shift is recorded in the PR 2 report. Later DEFINE PRs may expand it with further prompts and managed rules."

package/rcf/tacs/tac-4129-define-questions.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-02T18:00:00Z",
-  "updatedAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
   "tacId": "TAC-4129-define-questions",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -17,8 +17,8 @@
   "interfaces": [
     {
       "name": "computeQuestions",
-      "kind": "moduleApi",
-      "description": "Compute the persona question set from a readiness result, a tree, the four ledgers and the profile text. Returns an object with treeHash, persona, level, ok, remaining, groups[], questions[], optional[] and engineer (collapsed count on the PO return)."
+      "kind": "other",
+      "description": "Compute the persona question set from a readiness result, a tree, the four ledgers and the profile text. Returns an object with treeHash, persona, level, ok, remaining, groups[], questions[], optional[] and engineer (collapsed count on the PO return). [legacy kind: moduleApi; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf define questions",

package/rcf/tacs/tac-4134-wespa-host-fixture.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-02T20:00:00Z",
-  "updatedAt": "2026-10-02T20:00:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
   "tacId": "TAC-4134-wespa-host-fixture",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -31,23 +31,23 @@
     },
     {
       "name": "assertFramingHeaders",
-      "kind": "moduleApi",
-      "description": "[draft] `assertFramingHeaders(response)` on a `GET /` response. Refuses if `X-Frame-Options` is present, if a CSP `frame-ancestors` directive forbids `self`, or if `X-Content-Type-Options: nosniff` is set in a way that breaks the fixture (today it does not; the lint still records absence). Returns `{ ok: true }` or throws with the first failure."
+      "kind": "other",
+      "description": "[draft] `assertFramingHeaders(response)` on a `GET /` response. Refuses if `X-Frame-Options` is present, if a CSP `frame-ancestors` directive forbids `self`, or if `X-Content-Type-Options: nosniff` is set in a way that breaks the fixture (today it does not; the lint still records absence). Returns `{ ok: true }` or throws with the first failure. [legacy kind: moduleApi; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "assertNoTargetTop",
-      "kind": "moduleApi",
-      "description": "[draft] `assertNoTargetTop(renderedHtml)` greps the server-rendered HTML for `target=\"_top\"` and `target='_top'` and refuses on any match. Returns `{ ok: true, count: 0 }` or `{ ok: false, count: n, matches: [...] }`."
+      "kind": "other",
+      "description": "[draft] `assertNoTargetTop(renderedHtml)` greps the server-rendered HTML for `target=\"_top\"` and `target='_top'` and refuses on any match. Returns `{ ok: true, count: 0 }` or `{ ok: false, count: n, matches: [...] }`. [legacy kind: moduleApi; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "assertLocalStorageNamespace",
-      "kind": "moduleApi",
-      "description": "[draft] `assertLocalStorageNamespace(sourceTreeRoot)` walks every `.js` file under `src/view/**` (excluding vendored and `.min.js`), finds every `localStorage.(setItem|getItem|removeItem)(KEY)` and `storage.(setItem|getItem|removeItem)(KEY)` call site, and asserts that the key literal starts with `rcf-view:v1:` (or references `STORAGE_NS` which equals `rcf-view:v1:`). Returns `{ ok: true, scanned: n }` or `{ ok: false, violations: [...] }`."
+      "kind": "other",
+      "description": "[draft] `assertLocalStorageNamespace(sourceTreeRoot)` walks every `.js` file under `src/view/**` (excluding vendored and `.min.js`), finds every `localStorage.(setItem|getItem|removeItem)(KEY)` and `storage.(setItem|getItem|removeItem)(KEY)` call site, and asserts that the key literal starts with `rcf-view:v1:` (or references `STORAGE_NS` which equals `rcf-view:v1:`). Returns `{ ok: true, scanned: n }` or `{ ok: false, violations: [...] }`. [legacy kind: moduleApi; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderTestHostPage",
-      "kind": "moduleApi",
-      "description": "[draft] Pure function that emits the fixture HTML (56px header, resizable 64/200-400px sidebar, iframe content pane). No inline script; references `./test-host.js` as the single client-side JS."
+      "kind": "other",
+      "description": "[draft] Pure function that emits the fixture HTML (56px header, resizable 64/200-400px sidebar, iframe content pane). No inline script; references `./test-host.js` as the single client-side JS. [legacy kind: moduleApi; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "notes": "Depends on PR 1's `embed` and `theme` contract (page-init.js stamping `<html data-embed=\"1\">` and `<html data-theme>`, origin-checked `rcf-view-theme` listener, hash navigation preserving the host query string), on PR 1's relative-script policy (no inline script, no leading-slash references) and on live-client.js's existing `STORAGE_NS = 'rcf-view:v1:'` namespace. The test-host route surface is behind `--test-host` / `RCF_VIEW_TEST_HOST=1`; the release notes mark it as a test-suite fixture, not a shipped UI, so wespa's proxy allow-list is unaffected. The three lints are called from the viewer's test suite; wespa smoke on the live wespa shell is Dex's side."

package/rcf/test-suites/ts-007.json

@@ -15,7 +15,7 @@
       "acId": "AC-302-2",
       "description": "create with a conflicting id returns a clear conflict error and writes nothing",
       "status": "pending",
-      "testPointer": "test/core/store/writer.test.js::createDocument refuses on id collision (exit 2) and writes nothing (AC-302-2)"
+      "testPointer": "test/core/store/writer.test.js::createDocument refuses on id collision with different content (exit 3 conflict) and writes nothing (AC-302-2 / R1 extension 2026-10-05)"
     },
     {
       "id": "TC-007-create-writes-validating-child",

package/rcf/test-suites/ts-215.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-24T12:00:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-05T19:00:00Z",
   "purpose": "Cover the four sidecar ledgers, the rcf define ledger CLI (add / resolve / list with --json) and the walker-invisibility invariant on rcf/define/ (AC-17301-1..4 on US-17301), the update subverb and the closed resolvedBy pointer grammar (AC-17302-1..6 on US-17302), the statement-file markers (AC-18701-1..6 on US-18701) and the scan wiring (AC-18702-1..6 on US-18702).",
   "testLevel": "integration",
   "acIds": [
@@ -14,6 +14,13 @@
     "AC-17302-4",
     "AC-17302-5",
     "AC-17302-6",
+    "AC-17302-7",
+    "AC-17302-8",
+    "AC-17302-9",
+    "AC-17302-10",
+    "AC-17302-11",
+    "AC-17302-12",
+    "AC-17302-13",
     "AC-18701-1",
     "AC-18701-2",
     "AC-18701-3",
@@ -205,6 +212,62 @@
       "description": "brief add --text runs no scan and appends no openQuestion statement.",
       "status": "pending",
       "testPointer": "test/cli/ledger.test.js::ledger CLI (AC-18702-6): --text runs no scan and appends no openQuestion"
+    },
+    {
+      "id": "TC-215-r1-add-same-id-same-content-unchanged",
+      "acId": "AC-17302-7",
+      "description": "brief add --id 3 with identical content on a ledger whose entry 3 already matches exits 0 and prints 'unchanged'; --json emits {status:unchanged,id:3}; the ledger is not rewritten.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI (R1, AC-17302-7): add --id on same-content is unchanged exit 0"
+    },
+    {
+      "id": "TC-215-r1-add-same-id-diff-content-exit-3",
+      "acId": "AC-17302-8",
+      "description": "brief add --id 3 with different content exits 3; stderr names the id and the differing fields; the ledger is not rewritten.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI (R1, AC-17302-8): add --id on different-content exits 3 naming fields"
+    },
+    {
+      "id": "TC-215-r1-add-no-id-mints-next",
+      "acId": "AC-17302-9",
+      "description": "brief add --text with no --id mints the next id (idempotency opt-in is id-carried; the harness threads --id back on replay).",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI (R1, AC-17302-9): add without --id mints next id"
+    },
+    {
+      "id": "TC-215-r1-create-ac-id-unchanged-and-conflict",
+      "acId": "AC-17302-10",
+      "description": "rcf define create ac --parent US-101 --id AC-101-1 replayed with identical content exits 0 printing 'AC-101-1: unchanged (rcf/user-stories/us-101.json)' and leaves the US file byte-identical; the same verb with a different --description exits 3 naming AC-101-1 and description and leaves the file byte-identical.",
+      "status": "pending",
+      "testPointer": "test/cli/create.test.js::create CLI (R1 extension, AC-17302-10): create ac --id replay is unchanged exit 0, different content exits 3"
+    },
+    {
+      "id": "TC-215-r1-create-tc-id-unchanged-and-conflict",
+      "acId": "AC-17302-11",
+      "description": "rcf define create tc --id replayed with identical content exits 0 printing the unchanged line and leaves the TS file byte-identical; a different --description exits 3 naming description; a derived-slug collision without --id still exits 2.",
+      "status": "pending",
+      "testPointer": "test/cli/create.test.js::create CLI (R1 extension, AC-17302-11): create tc --id replay is unchanged exit 0, different content exits 3"
+    },
+    {
+      "id": "TC-215-r1-create-cn-id-unchanged-and-conflict",
+      "acId": "AC-17302-12",
+      "description": "rcf define create cn --id replayed with identical content exits 0 printing the unchanged line and leaves the CN file byte-identical; a different --path exits 3 naming path.",
+      "status": "pending",
+      "testPointer": "test/cli/create.test.js::create CLI (R1 extension, AC-17302-12): create cn --id replay is unchanged exit 0, different content exits 3"
+    },
+    {
+      "id": "TC-215-r1-create-req-verbatim-replay-unchanged",
+      "acId": "AC-17302-13",
+      "description": "rcf define create req --id REQ-050 replayed verbatim after the classifier stamped shapeClassification exits 0 printing the unchanged line; a different --description exits 3 naming description.",
+      "status": "pending",
+      "testPointer": "test/cli/create.test.js::create CLI (R1 extension, AC-17302-13): create req --id verbatim replay is unchanged despite classifier stamp"
+    },
+    {
+      "id": "TC-215-r1-create-tac-id-unchanged-and-conflict",
+      "acId": "AC-17302-13",
+      "description": "rcf define create tac --id replayed with identical content exits 0 printing the unchanged line; a different --purpose exits 3 naming purpose (document-kind path, no post-create side effect).",
+      "status": "pending",
+      "testPointer": "test/cli/create.test.js::create CLI (R1 extension, AC-17302-13): create tac --id replay is unchanged exit 0, different content exits 3"
     }
   ],
   "status": "draft"