shapeup-sdlc 3.18.2 → 4.0.0

package/skills/tech-lead/workflows/shapeup-run.js

@@ -1,2187 +0,0 @@
-// shapeup-run — the BUILD-phase pipeline as one script on the native Dynamic Workflow runtime.
-//
-// WHAT THIS FILE OWNS.
-//   ORIENT → GATE L1a → ANALYZE → WIRE → GATE L1a.5 → MAP SCOPES → GATE L1b →
-//   rounds of (BUILD → build gate → GATE L2 → EVAL → GATE L3) bounded by budgets.maxRounds →
-//   QA → GATE H → ship report → RunReturn.
-//
-// THE THREE PLANES THIS FILE RESPECTS, because collapsing them is what the previous version cost:
-//   CONTROL (here)   — sequences phases and branches on structured returns. Owns NO I/O: no shell,
-//                      no filesystem, no stdout parsing. Nothing in this file reads a model's prose.
-//   EXECUTION        — the sub-agents. Each has a real shell and a real filesystem, runs the kernel
-//                      itself, and returns a SCHEMA-VALIDATED object. The runtime enforces the
-//                      shape, so every branch below reads a real typed field.
-//   ARTIFACT         — the kernel. `harness compile` writes the order and `harness reduce ingest`
-//                      applies the result; those remain the only writers of shared state.
-//
-// BOTH LANES ARE THIS CODE. The unattended lane launches it headlessly; the interactive lane pauses
-// at each gate a human answers and relaunches. There is no prose runbook that can drift from what
-// executes.
-//
-// EVERY PHASE HAS A POST-CONDITION. A phase is complete when its ARTIFACT is on disk, never when a
-// result record says so — `requirePhase()` below. A WorkResult may legitimately report `escalated`
-// with an empty artifacts list, which satisfies ingest; without the post-condition the run walks to
-// the next gate as though the phase landed, and every relaunch re-dispatches it.
-//
-// DELIBERATE OMISSIONS, stated rather than hidden:
-//   - No mid-round ESCALATE resolution and no discovered-task reconciliation mid-BUILD. Both stay
-//     on the prose path in references/round-protocol.md and references/delegation.md.
-//   - QA runs once after the first PASS; its findings are a count for GATE H's census, never
-//     re-probed inside this run. Promoting a finding to a fix round is a live PO's decision.
-//   - The `tiny` lane and pre-scope-contract specs are out of scope here; SKILL.md's tiny-lane
-//     reference keeps that path.
-//
-// args — RunArgs (domain.schema.json $defs/RunArgs):
-//   slug, autoLevel (interactive|auto|unattended), answers (preset name or path),
-//   models {exec, eval, qa?}, budgets {maxRounds, attemptBudget}, pluginRoot,
-//   startedAt, and the optional switches noEval / noQa / adversarialVerify /
-//   maxParallelScopes (default 4).
-//
-// return — RunReturn (domain.schema.json $defs/RunReturn), the full union:
-//   { status: "shipped", verdict, rounds_used, dims_not_evaluated, qa_findings, qa, report }
-//   { status: "paused",  paused_at, block, valid_decisions, context }
-//   { status: "aborted", aborted_at, reason }
-//   { status: "gate_h",  breaker: "outer"|"attempt_budget"|"none"|"deadline", hammer_proposals, green_scopes,
-//                        tripped_scopes?, unapplied_results?, census?, cut_list?, l4? }
-//     — returned only when the census said cannot-ship, L4 said hold, or the ship report was
-//       refused; a breaker whose census clears the run ends as `shipped` with `after: "gate_h"`.
-
-// meta must be a PURE LITERAL — the runtime parses it statically, before the body ever runs, and
-// rejects the whole script on anything it has to evaluate. A `+`-joined description is a
-// BinaryExpression, so the concatenation that reads better in source costs the file its ability to
-// load at all. Keep every value here a plain literal, however long the line gets.
-export const meta = {
-  name: "shapeup-run",
-  description: "BUILD-phase pipeline: ORIENT → ANALYZE → WIRE → MAP SCOPES → rounds of BUILD/EVAL → QA → GATE H → ship. Gates resolve by the kernel's exit code; every dispatch is WorkOrder in / WorkResult out; the fast-forward is derived from artifacts on disk.",
-  phases: [
-    { title: "Preflight", detail: "one canary dispatch — can this session resolve a worker skill; then the project's build and launch probes, run once and recorded nowhere" },
-    { title: "Orient" }, { title: "Analyze" }, { title: "Wire" }, { title: "MapScopes" },
-    { title: "Build" }, { title: "Eval" }, { title: "Refute" }, { title: "QA" }, { title: "Ship" },
-  ],
-};
-
-// Some callers hand args as a JSON string.
-if (typeof args === "string") { try { args = JSON.parse(args); } catch { args = {}; } }
-
-// ---------------------------------------------------------------------------------------------
-// ARGS — validated here because nothing validates the C1 boundary for us. A run that starts with a
-// below-floor model or a missing budget produces work nobody can trust, and finding that out at
-// GATE L3 costs the whole run.
-// ---------------------------------------------------------------------------------------------
-// ---- MODEL FLOOR REGION START ------------------------------------------------------------------
-// This used to be an ALLOWLIST — exact spelling against {"sonnet","opus"} — which is backwards
-// from fail-open: every real model id this repo actually ships with (`claude-opus-5`,
-// `claude-sonnet-4-5`, `opusplan`) failed the exact-spelling test and aborted the run before
-// Preflight. Fixed as a DENYLIST of tiers this repo never certifies eval or build with: anything
-// NOT provably below the floor passes, matching this repo's own fail-open rule (an unrecognized
-// string is evidence this repo hasn't seen it, not evidence it's too cheap). Only an empty/absent
-// model string is rejected outright — that is a missing model, not an unrecognized one.
-//
-// The cheap/fast Claude tier is matched by PATTERN, never spelled out as a literal string here —
-// a literal name in this file would trip the structural suite's own floor check, which scans every
-// workflow script for exactly that spelling and is deliberately phrased the same indirect way.
-const BELOW_FLOOR_PATTERNS = [/ha[i1]ku/i, /\binstant\b/i, /\bmini\b/i, /\bnano\b/i, /\blite\b/i, /\bsmall\b/i];
-const belowFloor = (m) => {
-  const s = String(m || "").trim();
-  if (!s) return true; // no model named at all — missing, not merely unrecognized
-  return BELOW_FLOOR_PATTERNS.some((re) => re.test(s));
-};
-// ---- MODEL FLOOR REGION END --------------------------------------------------------------------
-
-function validateArgs(a) {
-  const problems = [];
-  for (const k of ["slug", "autoLevel", "models", "budgets", "pluginRoot"]) {
-    if (a?.[k] === undefined || a[k] === null || a[k] === "") problems.push(`missing args.${k}`);
-  }
-  if (a && !["interactive", "auto", "unattended"].includes(a.autoLevel)) {
-    problems.push(`args.autoLevel="${a.autoLevel}" must be interactive|auto|unattended`);
-  }
-  if (a?.budgets && (!a.budgets.maxRounds || !a.budgets.attemptBudget)) {
-    problems.push("args.budgets must carry maxRounds and attemptBudget");
-  }
-  if (a?.models) {
-    for (const role of ["exec", "eval"]) {
-      if (role === "eval" && a.noEval) continue;
-      if (belowFloor(a.models[role])) problems.push(`args.models.${role} is below the model floor (sonnet or above)`);
-    }
-  }
-  return problems;
-}
-
-const argProblems = validateArgs(args);
-if (argProblems.length) return { status: "aborted", aborted_at: "args", reason: argProblems.join("; ") };
-
-const slug          = args.slug;
-// The report's path, never the ship command's one-line `detail`: that is a sub-agent's sentence, and
-// it reached the RunReturn's `report` field in place of the path the orchestrator opens. The
-// committed root is a fixed name, so the path is known without reading anything.
-const REPORT_PATH = `shapeup/${slug}/REPORT.md`;
-const KERNEL        = `${args.pluginRoot}/kernel/harness.mjs`;
-const execModel     = args.models.exec;
-const evalModel     = args.models.eval;
-const qaModel       = args.models.qa || args.models.exec;
-const maxRounds     = args.budgets.maxRounds;
-const attemptBudget = args.budgets.attemptBudget;
-
-// How many scopes may build at once. A dial rather than a constant because concurrency is a COST
-// question before it is a speed one: every extra leg is another worker's full context. 4 is the
-// default because a feature is rarely cut into more independent slices than that; 1 restores the
-// sequential behaviour for a project whose workers are not safe to run side by side.
-//
-// It is a CAP, not a group size. The window refills the instant any leg settles, so the dial bounds
-// spend without ever quantising the schedule — see the scheduler below for what the difference cost.
-const maxParallelScopes = Math.max(1, Number(args.maxParallelScopes ?? 4) || 1);
-
-// ---- SCHEDULER REGION START ------------------------------------------------------------------
-// BUILD's fan-out, as three separable decisions instead of one list operation:
-//
-//     WAVES ORDER the scopes.   EDGES RELEASE them.   THE DIAL CAPS them.
-//
-// Fusing the three into `waves.flatMap((w) => chunk(w, maxParallelScopes))` cost wall-clock twice
-// over, and both costs are structural rather than incidental:
-//
-//   1. `chunk` turns the dial from a CAP into a QUANTUM. A wave of six at a dial of four runs four,
-//      then idles three workers until the SLOWEST of those four lands, then runs two. Nothing about
-//      the scopes asked for that; it falls out of splitting a list instead of scheduling it.
-//   2. A wave is a LEVEL, and a level says when a scope is definitely safe to start, never when it
-//      BECAME safe. The scope that wires the others to the entry point waits for the slowest command
-//      scope even when the one scope it actually consumes went green minutes earlier.
-//
-// Everything the previous loop bought with blood survives, and each is named at the line that keeps
-// it: a scope never starts beside a scope it consumes; no scope is ever dropped; a dead builder is a
-// spent attempt rather than a dead run; the dial is honoured exactly.
-//
-// This region is self-contained on purpose. The scheduling decision is PURE — no dispatch, no clock,
-// no randomness — so it is the one part of this file that can be executed against a fixture instead
-// of reasoned about, and the round loop below injects the real dispatcher as `launch`.
-
-/**
- * The dependency relation the fan-out releases on, as `scope_id → the scope_ids it waits for`.
- *
- * Three rungs, each a strict non-regression on the next. The edge list is used only when it
- * re-levels to the SAME waves: both fields are projections of one graph the kernel parsed once, so
- * each validates the other, and an edge dropped or invented in transit lands on the wave rung rather
- * than releasing a scope early — which is the one direction this must never fail in.
- *
- * @param {*} rawDeps - `probe resume`'s `scope_deps`: `[dependant, dependency]` path pairs.
- * @param {Array[]} waves - Validated dependency waves, arrays of scope objects.
- * @param {Array} list - Every scope in the round.
- * @returns {Map<string,Set<string>>} One entry per scope; an empty set means "ready immediately".
- */
-function scopeEdges(rawDeps, waves, list) {
-  const known = new Set(list.map((s) => s.scope_id));
-  const idOf = (p) => String(p).split("/").pop().replace(/\.(md|json)$/, "");
-  const blank = () => new Map(list.map((s) => [s.scope_id, new Set()]));
-
-  // Kahn. A CYCLE IS THE ONE INPUT THAT TURNS THIS SCHEDULER INTO A HANG rather than a failure: two
-  // scopes awaiting each other produce no error, no log line and no artifact, which a list-chunking
-  // loop could not do. So an edge set is used only when every node peels.
-  const levelsOf = (m) => {
-    const done = new Set(), out = [];
-    for (;;) {
-      const ready = list.filter((s) => !done.has(s.scope_id) && [...m.get(s.scope_id)].every((d) => done.has(d)));
-      if (!ready.length) break;
-      out.push(ready.map((s) => s.scope_id).sort());
-      for (const s of ready) done.add(s.scope_id);
-    }
-    return done.size === list.length ? out : undefined;
-  };
-  const shape = (levels) => (levels ? JSON.stringify(levels) : "");
-
-  if (Array.isArray(rawDeps) && rawDeps.length) {
-    const m = blank();
-    let edges = 0;
-    for (const pair of rawDeps) {
-      if (!Array.isArray(pair) || pair.length < 2) continue;
-      const to = idOf(pair[0]), from = idOf(pair[1]);
-      if (to === from || !known.has(to) || !known.has(from)) continue;
-      m.get(to).add(from);
-      edges++;
-    }
-    const want = shape(waves.map((w) => w.map((s) => s.scope_id).sort()));
-    if (edges && shape(levelsOf(m)) === want) return m;
-    log(`BUILD order — the dependency edge list does not re-derive the wave order (${edges} usable ` +
-        `edge(s)); releasing per wave instead, which is what a wave-stepped fan-out did.`);
-  }
-
-  // WAVE RUNG. "Everything in wave i waits for everything in wave i-1" — the exact release points a
-  // wave-stepped loop had, and acyclic by construction. An absent or unusable edge list costs the
-  // per-edge release and nothing else; a single wave yields no edges at all, which is the fully
-  // unscheduled fan-out. A scheduler that refuses to run is worse than one that runs unscheduled.
-  const m = blank();
-  for (let i = 1; i < waves.length; i++) {
-    for (const to of waves[i]) for (const from of waves[i - 1]) m.get(to.scope_id).add(from.scope_id);
-  }
-  return m;
-}
-
-/**
- * Forbid two scopes that may write the same path from building at the same time.
- *
- * WHY THIS IS THE SCHEDULER'S JOB AND NOBODY ELSE'S. `shared_substrate` is the declared escape hatch
- * from the disjointness rule: the spec lint passes an overlap both contracts declare, and the
- * sandbox guard permits that path to every live order naming it. Both layers are individually
- * correct and the join is wrong — concurrent writers to one shared entry point lose each other's
- * work, measured in every trial, with every check green. No lint can catch it because nothing is
- * mis-declared; the only place the fact "these two are running RIGHT NOW" exists is here.
- *
- * AN EXCLUSION IS NOT A DEPENDENCY. Neither scope has to go first — they only have to not overlap —
- * so each pair is oriented by BUILD POSITION, later waits for earlier. That orientation is what
- * makes it safe to mix with real dependency edges: every dependency edge already points backwards
- * in this list (it is the waves flattened, so a scope's dependencies are strictly earlier), and an
- * exclusion oriented the same way keeps the whole set pointing backwards, which cannot cycle.
- *
- * DEGRADES LIKE EVERYTHING ELSE HERE, but note which way. Absent or unreadable pairs mean no
- * exclusions and today's scheduling — a scheduler that refuses to run is worse than one that runs
- * unscheduled. What is NOT acceptable is the opposite reading: when the pairs ARE there, the edge is
- * enforced rather than warned about, because a run that quietly loses work is worse than both.
- *
- * @param {Map<string,Set<string>>} edges - Release edges so far; mutated and returned.
- * @param {*} rawPairs - `probe resume`'s `scope_exclusions`: unordered path pairs.
- * @param {Array} order - The build order. Position in it decides which side of a pair waits.
- * @returns {{edges: Map<string,Set<string>>, added: number}} The composed set and how many landed.
- */
-function withExclusions(edges, rawPairs, order) {
-  if (!Array.isArray(rawPairs) || !rawPairs.length) return { edges, added: 0 };
-  const idOf = (p) => String(p).split("/").pop().replace(/\.(md|json)$/, "");
-  const at = new Map(order.map((s, i) => [s.scope_id, i]));
-  let added = 0;
-  for (const pair of rawPairs) {
-    if (!Array.isArray(pair) || pair.length < 2) continue;
-    const a = idOf(pair[0]), b = idOf(pair[1]);
-    if (a === b || !at.has(a) || !at.has(b)) continue;
-    const [first, later] = at.get(a) < at.get(b) ? [a, b] : [b, a];
-    if (edges.get(later)?.has(first)) continue;                 // already ordered by a real edge
-    edges.get(later).add(first);
-    added++;
-  }
-  return { edges, added };
-}
-
-/**
- * The widest set of scopes this release graph can have open at one moment.
- *
- * WHY A RUN NEEDS THIS BEFORE IT DISPATCHES ANYTHING. The dial says how many legs are PAID FOR; this
- * says how many the constraints actually permit, and the two are not the same number. A feature
- * whose entry point sits in five scopes' substrate has a ceiling of ONE however wide the dial is
- * opened — that is a scope-cutting fact, decided at the board review, and without this line it shows
- * up hours later as a slow round that reads exactly like slow workers.
- *
- * It also splits the concurrency shortfall into its two causes, which no single observation can. A
- * peak below the CEILING is a dispatch or runtime limit; a ceiling below the DIAL is the scope cut.
- * One number each, and the repair is different.
- *
- * The measure is the widest level of the release DAG, which is a guarantee rather than an estimate:
- * every member of a level has all its predecessors in earlier levels, so a level's whole width is
- * simultaneously admissible.
- *
- * @param {Map<string,Set<string>>} edges - The composed release set.
- * @param {Array} items - The scopes in the round.
- * @returns {number} Widest simultaneously-admissible set; 1 when nothing may overlap.
- */
-function releaseCeiling(edges, items) {
-  const done = new Set();
-  let widest = 1;
-  for (;;) {
-    const ready = items.filter((s) => !done.has(s.scope_id) && [...(edges.get(s.scope_id) || [])].every((d) => done.has(d)));
-    if (!ready.length) break;
-    widest = Math.max(widest, ready.length);
-    for (const s of ready) done.add(s.scope_id);
-  }
-  return widest;
-}
-
-/**
- * Run `launch` over every item, at most `width` at once, releasing each item as soon as ITS OWN
- * dependencies have settled rather than when its whole wave has.
- *
- * Release is on SETTLED, not on green, which is deliberate and matches what a wave-stepped loop did.
- * Gating on green is strictly stronger and costs more than it buys: a dependency that fails would
- * starve every dependant of any attempt at all, and those scopes would leave the round's census
- * entirely — an outcome class the gate, the hill projection and the ledger have no reading for. What
- * must never happen is a scope building CONCURRENTLY with a scope it consumes, and that is what the
- * dependency await forbids.
- *
- * No race, no timer, no clock — deliberately. `Promise.race` over the in-flight legs would tighten
- * the schedule marginally and is disqualified for the same reason a clock read is: it makes the
- * schedule a function of real time, so a relaunch reschedules differently.
- *
- * @param {Array} items - The scopes, in the order the waves put them.
- * @param {Map<string,Set<string>>} edges - scope_id → the scope_ids it waits for.
- * @param {number} width - Concurrency cap.
- * @param {function(object): Promise<object>} launch - Dispatches one scope. May reject; may not be
- *   trusted to return anything.
- * @returns {Promise<object[]>} Exactly one settled record per item, in input order. Never rejects.
- */
-async function scheduleScopes(items, edges, width, launch) {
-  let free = Math.max(1, Number(width) || 1);
-  const waiting = [];
-  const acquire = () => (free > 0 ? (free--, Promise.resolve()) : new Promise((r) => waiting.push(r)));
-  const release = () => { const next = waiting.shift(); if (next) next(); else free++; };
-
-  // TWO COLLECTIONS, and the split is the difference between "one entry per item" and "one entry per
-  // id". `runs` is POSITIONAL, so two scopes that somehow carry the same id are two legs and two
-  // records; keying the settle by id instead would silently run one of them and report it twice,
-  // which is a dropped scope wearing the right name. `started` is by id because that is how an edge
-  // names its dependency, and it keeps the first promise for an id — a duplicate cannot make a
-  // dependant wait on the wrong one.
-  const runs = [];
-  const started = new Map();
-
-  async function runOne(item) {
-    // THE DEPENDENCY WAIT HAPPENS BEFORE THE SLOT ACQUIRE, and that ordering is the whole reason
-    // the window cannot deadlock against the edges: a waiting scope occupies no capacity, so the
-    // window can never fill with scopes that are all waiting on one another.
-    const deps = [...(edges.get(item.scope_id) || [])].map((d) => started.get(d)).filter(Boolean);
-    if (deps.length) await Promise.all(deps);
-    await acquire();
-    try {
-      const res = await launch(item);
-      // The runtime drops an item whose stage returned no value and leaves an empty slot in the
-      // settled list. Name that by itself: an empty slot and a dead worker are different repairs.
-      return res || { scope_id: item.scope_id, __failed: "the runtime dropped this leg — a pipeline stage returned no value" };
-    } catch (e) {
-      // A DEAD BUILDER IS A SPENT ATTEMPT, NOT A DEAD RUN. Rethrowing would reject every other
-      // scope's promise through the settle below and discard a whole round of green work.
-      return { scope_id: item.scope_id, __failed: `${item.scope_id}: ${(e && e.message) || String(e)}` };
-    } finally {
-      // In `finally`, so a leg that dies before returning does not narrow the window permanently.
-      release();
-    }
-  }
-
-  // TWO PHASES, because one phase is a silently dropped edge. A body reads its dependencies' promises
-  // out of `started` on its first line; built in a single pass, a dependency declared LATER in the
-  // list is not there yet, its edge is discarded as unknown, and the scope that edge was protecting
-  // starts early — the exact failure the edge exists to prevent, with no diagnostic anywhere.
-  const begin = [];
-  for (const item of items) {
-    let open;
-    const gate = new Promise((r) => { open = r; });
-    const leg = gate.then(() => runOne(item));
-    runs.push(leg);
-    if (!started.has(item.scope_id)) started.set(item.scope_id, leg);
-    begin.push(open);
-  }
-  for (const open of begin) open();
-
-  // ONE ENTRY PER ITEM, IN INPUT ORDER, structurally — no edge, no failure, no dial setting and no
-  // repeated id can drop a scope out of the round's census.
-  return Promise.all(runs);
-}
-// ---- SCHEDULER REGION END --------------------------------------------------------------------
-
-// ---------------------------------------------------------------------------------------------
-// SCHEMAS — the only contract between this control script and a sub-agent. The runtime forces the
-// agent's final message to validate against these, which is the entire reason no stdout is parsed
-// anywhere in this file.
-//
-// A SCHEMA HERE IS ONE HALF OF A CONTRACT, and the other half is a kernel subcommand's stdout. The
-// runtime validates the agent's report against the shape declared BELOW, never against the shape the
-// kernel actually prints, so the two can disagree indefinitely: the courier sub-agent sits between
-// them and quietly coerces whatever it was handed into whatever it was asked for. That is not a
-// hypothetical — `scope_files` was declared here as an array of strings against a kernel that emits
-// `{scope_id, path}` objects, and it "worked" for the life of the file. The region markers are the
-// seam the structural suite reads these declarations through, so the two halves can be compared by
-// something other than a reader's eye.
-// ---- SCHEMA REGION START -----------------------------------------------------------------------
-const nullable = (t) => ({ type: [t, "null"] });
-
-/** A kernel subcommand a sub-agent ran in its own shell, reported as data. */
-const CMD = {
-  type: "object",
-  properties: {
-    exit_code: { type: "integer" },
-    ok: { type: "boolean" },
-    detail: { type: "string" },
-    // The machine value, copied CHARACTER FOR CHARACTER out of the command's own JSON. Separate
-    // from `detail` on purpose: `detail` is prose for a human to read, this is a token the control
-    // plane branches on, and collapsing the two is what made every gate comparison silently false.
-    decision: { type: "string" },
-    // A close's own advisory failure (kernel/probe/resume.mjs's `exportOnClose`) — copied verbatim, the same discipline as `decision`, so "the export failed" is a
-    // fact `closeIfTerminal` can act on rather than a line buried inside free-text `detail`.
-    export_warning: { type: "string" },
-  },
-  required: ["exit_code", "ok"],
-};
-
-/** `harness probe resume` — the fast-forward derivation, every field artifact-derived. */
-const RESUME = {
-  type: "object",
-  properties: {
-    intake_path: nullable("string"), spec_folder: nullable("string"), orient_dir: nullable("string"),
-    breadboard_path: nullable("string"), breadboard_source: nullable("string"),
-    project_profile_path: nullable("string"), status: nullable("string"), closed_status: nullable("string"),
-    lens: nullable("string"), stack: nullable("string"),
-    run_cmd: nullable("string"), app_url: nullable("string"),
-    eval_dimensions: { type: "array", items: { type: "string" } },
-    has_orient_artifacts: { type: "boolean" },
-    has_spec_tree: { type: "boolean" },
-    has_board: { type: "boolean" },
-    staged_workflow: {
-      type: "object",
-      properties: {
-        checked: { type: "boolean" },
-        drift: { type: "array", items: { type: "string" } },
-        installed_version: nullable("string"),
-        run_version: nullable("string"),
-        warning: { type: "string" },
-      },
-    },
-    // The requirements registry — a fact, not a phase. See the COVERAGE block below for why it is
-    // guarded on this bare boolean and never asked about through `probe resume --require`.
-    has_requirements: { type: "boolean" },
-    has_wiring_map: { type: "boolean" },
-    has_project_profile: { type: "boolean" },
-    // THE SHAPE THE KERNEL WRITES, not a convenient one. `probe resume` emits `{scope_id, path}` per
-    // contract and `ResumeState` declares exactly that; this declared an array of strings and the
-    // call site below split each entry as a path. Nothing failed and nothing could: the courier
-    // sub-agent sits between the kernel's stdout and this schema, so it coerced the objects into
-    // whatever it was asked for, on every run, for the life of the file. The failure that shape
-    // invites is silent in the other direction — a coercion that DROPS the entries reads as zero
-    // scopes, which this file cannot distinguish from a run whose contracts were never written, so
-    // MAP SCOPES is re-dispatched over contracts already on disk.
-    scope_files: {
-      type: "array",
-      items: {
-        type: "object",
-        properties: { scope_id: { type: "string" }, path: { type: "string" } },
-        required: ["scope_id", "path"],
-      },
-    },
-    // Additive: the same scopes grouped into dependency waves. Absent or unusable → one wave.
-    scope_waves: { type: "array", items: { type: "array", items: { type: "string" } } },
-    // The same relation as edges — `[dependant, dependency]` pairs. A wave says when a scope is
-    // definitely safe to start; an edge says when it BECAME safe. Absent or unusable → the waves'
-    // own release points, which is what a wave-stepped fan-out had.
-    scope_deps: { type: "array", items: { type: "array", items: { type: "string" } } },
-    // Pairs that may write the same declared-shared path, so they may not build at the same time.
-    // Not an ordering — either may go first. Absent or unusable → no exclusion, today's scheduling.
-    scope_exclusions: { type: "array", items: { type: "array", items: { type: "string" } } },
-    eval_rounds_done: { type: "array", items: { type: "integer" } },
-    next_phase: nullable("string"),
-  },
-  required: ["has_orient_artifacts", "has_spec_tree", "has_wiring_map", "scope_files", "eval_rounds_done"],
-};
-// ---- SCHEMA REGION END -------------------------------------------------------------------------
-
-/** `harness reduce graph --subgraph run` — the bounded read model a round opens with. */
-const SUBGRAPH = {
-  type: "object",
-  properties: {
-    run: nullable("string"),
-    scopes: { type: "array", items: { type: "string" } },
-    requirements: { type: "array", items: { type: "string" } },
-    orders: { type: "integer" },
-    pending_orders: { type: "array", items: { type: "string" } },
-    rounds_with_green: { type: "array", items: { type: "integer" } },
-    green_scopes_by_round: { type: "object" },
-    trials: { type: "integer" },
-    edges: { type: "integer" },
-  },
-  required: ["scopes", "rounds_with_green", "green_scopes_by_round"],
-};
-
-/** `harness probe t0` — has this scope already gone green in this round? */
-const T0CHECK = {
-  type: "object",
-  properties: { green: { type: "boolean" }, path: nullable("string") },
-  required: ["green"],
-};
-
-/** `probe leg --order` — did one named order's result reach the single writer? Any phase. */
-const ORDERLEG = {
-  type: "object",
-  properties: {
-    closed: { type: "boolean" },
-    found: { type: "boolean" },
-    order: nullable("string"),
-    has_receipt: { type: "boolean" },
-    has_result: { type: "boolean" },
-    applied: { type: "boolean" },
-  },
-  required: ["closed", "found", "has_result", "applied"],
-};
-
-/** `probe attempts` — the attested census: what was spent, and whether the breaker really tripped. */
-const ATTEMPTS = {
-  type: "object",
-  properties: {
-    scope_id: { type: "string" },
-    spent: { type: "integer" },
-    in_flight: { type: "integer" },
-    green: { type: "boolean" },
-    tripped: { type: "boolean" },
-  },
-  required: ["scope_id", "spent", "tripped"],
-};
-
-/** `probe leg` — did this scope's result reach the board, or is it finished work nothing applied? */
-const LEGCHECK = {
-  type: "object",
-  properties: {
-    closed: { type: "boolean" },
-    orders_total: { type: "integer" },
-    results_total: { type: "integer" },
-    applied_total: { type: "integer" },
-    unapplied: { type: "array", items: { type: "string" } },
-  },
-  required: ["closed"],
-};
-
-const ORIENT = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" }, artifact_written: { type: "boolean" },
-    spiked_area: { type: "string" }, spike_result: { type: "string" },
-    riskiest_unknowns: { type: "array", items: { type: "string" } },
-  },
-  required: ["ok", "artifact_written", "spiked_area", "spike_result"],
-};
-
-/** coverage / analyze / wire — "did the artifact land?" is all a gate needs from them. */
-const PHASE_OK = {
-  type: "object",
-  properties: { ok: { type: "boolean" }, artifact_written: { type: "boolean" }, detail: { type: "string" } },
-  required: ["ok", "artifact_written"],
-};
-
-const MAPSCOPES = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" }, artifact_written: { type: "boolean" },
-    scopes: {
-      type: "array",
-      items: {
-        type: "object",
-        properties: { scope_id: { type: "string" }, path: { type: "string" } },
-        required: ["scope_id", "path"],
-      },
-    },
-  },
-  required: ["ok", "artifact_written", "scopes"],
-};
-
-/** One scope's whole attempt ratchet, run inside the worker leg (see buildScope). */
-const SCOPE_RESULT = {
-  type: "object",
-  properties: {
-    scope_id: { type: "string" },
-    green: { type: "boolean" },
-    t0_artifact: nullable("string"),
-    attempts_used: { type: "integer" },
-    breaker: { type: "string", enum: ["none", "stagnation", "attempt_budget"] },
-    reason: { type: "string" },
-  },
-  required: ["scope_id", "green", "attempts_used", "breaker"],
-};
-
-const EVAL = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" },
-    overall: { type: "string", enum: ["PASS", "FAIL"] },
-    findings: {
-      type: "array",
-      items: {
-        type: "object",
-        properties: { id: { type: "string" }, criterion: { type: "string" }, evidence: { type: "string" } },
-        required: ["id", "criterion", "evidence"],
-      },
-    },
-  },
-  required: ["ok", "overall"],
-};
-
-// The round-loop branch reads THIS, not `EVAL` above, for the pass/fail decision. `EVAL` shapes
-// the dispatching agent's own end-of-turn summary of a 3-step dispatch (compile, dispatch,
-// ingest) — schema-checked for SHAPE only, never re-verified against the WorkResult `reduce
-// ingest` just wrote. Measured live (2026-08-19, todo-cli): that summary reported the round as
-// passing while `results/evaluate-r1.json`'s own `verdict.overall` said `"FAIL"` (2 cited bugs),
-// and the round loop broke straight to QA/GATE H on the strength of the summary alone — the same
-// self-report-instead-of-artifact-read shape this file already fixed once for gate DECISIONS
-// (see the comment above `crossGate`), just never extended to the EVAL verdict itself. `probe
-// eval` is `harness probe eval`'s own output — a narrow, single-purpose "transcribe this JSON
-// verbatim" query over the WorkResult on disk, the same pattern `probe t0`/`probe resume` already
-// use everywhere else a fact has to cross the no-filesystem boundary.
-const EVAL_VERDICT = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" },
-    overall: nullable("string"),
-    bug_count: nullable("integer"),
-    report_path: nullable("string"),
-    round: { type: "integer" },
-    // The dimensions round N's evaluate order named — what "PASS" actually covers.
-    dimensions: { type: ["array", "null"], items: { type: "string" } },
-    // Why the round holds no verdict it may act on — the evaluator's own first deviation when it
-    // refused, or what is structurally wrong with the verdict it returned. Null when `ok`.
-    status: nullable("string"),
-    reason: nullable("string"),
-  },
-  required: ["ok", "round"],
-};
-
-const REFUTATION = {
-  type: "object",
-  properties: { id: { type: "string" }, refuted: { type: "boolean" }, why: { type: "string" } },
-  required: ["id", "refuted"],
-};
-
-const QA_REPORT = {
-  type: "object",
-  properties: { ok: { type: "boolean" }, findings_count: { type: "integer" } },
-  required: ["ok", "findings_count"],
-};
-
-const BOARD_CHECK = {
-  type: "object",
-  properties: { ok: { type: "boolean" }, reason: { type: ["string", "null"] } },
-  required: ["ok"],
-};
-
-const HUNT_OUTCOME = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" }, status: { type: ["string", "null"] },
-    qa: { type: "string", enum: ["run", "not-hunted", "missing"] },
-    charters_run: { type: ["integer", "null"] }, findings: { type: "integer" }, reason: { type: ["string", "null"] },
-  },
-  required: ["ok", "qa"],
-};
-
-const HAMMER = {
-  type: "object",
-  properties: {
-    ok: { type: "boolean" },
-    verdict: { type: "string", enum: ["ship-now", "ship-after-fixes", "cannot-ship"] },
-    cut_list: { type: "array", items: { type: "string" } },
-  },
-  required: ["ok", "verdict", "cut_list"],
-};
-
-/** What every hammer dispatch is told, on the PASS path and the breaker path alike. */
-const HAMMER_EXTRA =
-  "Run the census, compare against the BASELINE and never the ideal, and produce the cut list. " +
-  "Write the census as data to `reports/hammer-census.json` under the run's local root — the " +
-  "`reports/**` entry in your order's substrate names the directory — with schema_version 1, " +
-  "order_id, verdict (ship-now | ship-after-fixes | cannot-ship), cut_list, ship_blocking, breaker, " +
-  "baseline — beside the human-readable report. GATE L4's resolver reads that file and nothing " +
-  "else before it lets any answer set say `ship`; a census that lives only in your printed blocks " +
-  "cannot be read by a gate.";
-
-/**
- * A breaker routed the run to GATE H. This used to be a terminal return: the loop handed back
- * `{status: "gate_h"}`, the close-out stamped the ledger `escalated` and retired the pointers, and
- * the census, GATE H, the ship report and GATE L4 all happened AFTER the close, in the tech
- * lead's prose — so the census reached no artifact, `gates.jsonl` held no H and no L4, and a later
- * `--close shipped` was refused over the `escalated` fact already on the ledger. Measured on three
- * consumer runs. AGENTS.md has always said what a breaker means: "ship what's green, never kill the
- * run from outside". So the run does that itself, in this launch: the hammer census (an artifact),
- * GATE H (a row), the ship report (with the verdict as it is, FAIL or not-evaluated included), and
- * GATE L4 (a row) — and only then a close, `shipped` or `escalated`, that names the census.
- *
- * QA never ran on this path (it sits after a PASS), so the census is told so plainly. `qaFindings`
- * is declared after the round loop and must not be read from here.
- *
- * @param {object} ret - The gate_h return the round loop built.
- * @returns {Promise<object>} The RunReturn that actually ends the run.
- */
-async function settleAtGateH(ret) {
-  phase("Ship");
-  const h = await worker({
-    skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
-    payload: { feature: slug, qa_findings: 0, hammer_proposals: ret.hammer_proposals || [], breaker: ret.breaker ?? null },
-    extra: HAMMER_EXTRA,
-  });
-  if (h.__failed) return await withWarnings(diedAt("H", h));
-  {
-    const g = await crossGate("H", "Ship", ["accept-cut-list", "ship-all", "ask"],
-      { verdict: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null, green_scopes: ret.green_scopes, hammer_proposals: ret.hammer_proposals });
-    if (g.stop) return await withWarnings(g.stop);
-  }
-  if (h.verdict === "cannot-ship") {
-    return await withWarnings({ ...ret, census: "cannot-ship", cut_list: h.cut_list });
-  }
-  const hVerdict = verdict === "pass" ? "PASS" : verdict === "fail" ? "FAIL" : "not-evaluated";
-  const ship = await cmd(`reduce ship --slug ${slug} --verdict ${hVerdict} --qa skipped`, "Ship", "ship-report");
-  if (!ship.ok) {
-    return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, ship_report: `refused: ${ship.detail || `exit ${ship.exit_code}`}` });
-  }
-  {
-    const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: hVerdict, census: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null });
-    if (g.stop) return await withWarnings(g.stop);
-    if (g.decision === "hold") return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, l4: "hold" });
-  }
-  await advisory(`report export --slug ${slug}`, "Ship", "export-run");
-  await setRunStatus("shipped", "Ship");
-  return await withWarnings({
-    status: "shipped", verdict, rounds_used: round, after: "gate_h", breaker: ret.breaker ?? null,
-    census: h.verdict, cut_list: h.cut_list, green_scopes: ret.green_scopes,
-    unapplied_results: ret.unapplied_results || [], qa_findings: 0,
-    report: REPORT_PATH,
-  });
-}
-
-// ---------------------------------------------------------------------------------------------
-// DISPATCH — three shapes, and none of them parses text.
-//
-// A sub-agent can be skipped by the operator or die on a terminal API error, in which case the
-// runtime hands back `null`. A null is a NAMED failure here, never a crash: `status: "failed"` is
-// not a member of the RunReturn union, so every call site converts it to one that is.
-// ---------------------------------------------------------------------------------------------
-const nullFail = (label) => ({ __failed: `${label}: sub-agent skipped, blocked, or died after retries` });
-
-/**
- * Run one kernel subcommand in a sub-agent's own shell and get its outcome as data.
- *
- * @param {string} verbs - Kernel verb words plus flags, e.g. `reduce hill --slug x`.
- * @param {string} phaseName - Progress group.
- * @param {string} label - Display label.
- * @returns {Promise<{exit_code:number, ok:boolean, detail?:string}>} Never rejects.
- */
-async function cmd(verbs, phaseName, label) {
-  const r = await agent(
-    `Run exactly this command and nothing else:\n\n  node "${KERNEL}" ${verbs}\n\n` +
-    `Report its exit code as exit_code, ok=true if and only if exit_code is 0, and one line of ` +
-    `detail. If the command printed JSON carrying a top-level "decision" key, copy that value into ` +
-    `decision EXACTLY as it appears — one bare token, no sentence, no quotes, no rephrasing. ` +
-    `Otherwise omit decision. If the command printed JSON carrying a top-level "export_warning" ` +
-    `key with a non-empty string value, copy that string into export_warning verbatim. Otherwise ` +
-    `omit export_warning. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
-    `If the tool call itself is refused or blocked before the command ever runs — a permission or ` +
-    `policy denial, not the command's own exit — that is NOT an exit code, and you must never invent ` +
-    `one to fill the field: report exit_code as -1 and put the denial's own wording verbatim in ` +
-    `detail. -1 is not a real process exit and this file treats it as "the check could not run", never ` +
-    `as evidence about what the command would have said.`,
-    { model: "sonnet", effort: "low", phase: phaseName, label, schema: CMD },
-  );
-  return (r && typeof r === "object") ? r : { exit_code: -1, ok: false, detail: `${label}: no result` };
-}
-
-/**
- * Run a kernel subcommand whose outcome is advisory — a projection or a lint that informs but does
- * not stop the run.
- *
- * It still LOOKS at the exit code. A command whose result nobody reads is a command whose failure
- * is indistinguishable from its success, which is the defect class this whole file is arranged
- * against; "advisory" means the run continues, not that nothing is recorded.
- *
- * @param {string} verbs - Kernel verb words plus flags.
- * @param {string} phaseName - Progress group.
- * @param {string} label - Display label.
- * @returns {Promise<void>} Settles when the command has run.
- */
-async function advisory(verbs, phaseName, label) {
-  const r = await cmd(verbs, phaseName, label);
-  if (!r.ok) log(`${label} — did not complete (${r.detail || `exit ${r.exit_code}`}). The run continues; this output is a projection, not a gate.`);
-}
-
-/**
- * Run a kernel subcommand whose stdout is a JSON document this script needs the fields of.
- *
- * The sub-agent re-reports the document against `schema`, so what reaches this file is validated by
- * the runtime rather than parsed here.
- *
- * @param {string} verbs - Kernel verb words plus flags.
- * @param {object} schema - The shape the caller branches on.
- * @param {string} phaseName - Progress group.
- * @param {string} label - Display label.
- * @returns {Promise<(object|null)>} The validated document, or null when the agent produced none.
- */
-async function query(verbs, schema, phaseName, label) {
-  const r = await agent(
-    `Run exactly this command and nothing else:\n\n  node "${KERNEL}" ${verbs}\n\n` +
-    `It prints one JSON document on stdout. Return that document's fields as the schema names ` +
-    `them, verbatim — do not add, rename, summarise or infer any value.`,
-    { model: "sonnet", effort: "low", phase: phaseName, label, schema },
-  );
-  return (r && typeof r === "object") ? r : null;
-}
-
-// A payload field that is not known yet is ABSENT, never `null`.
-//
-// The two contracts either side of this line disagree about how to say "unknown", and the
-// disagreement is load-bearing: `probe resume` declares `stack`, `lens`, `run_cmd` and `app_url`
-// nullable — null is its legitimate answer on a fresh run — while `WorkOrderPayload` types them
-// `string` and marks every one of them OPTIONAL. So the contract already models unknown as an
-// absent key, and forwarding the probe's `null` into it produces an order that fails its own schema
-// before a worker ever sees it. Four of the seven operations this file dispatches — orient, analyze,
-// evaluate, hunt — carry such a field, ORIENT among them, so the first dispatch of every fresh run
-// was refused at compile. The three that carry none (wire, map-scopes, hammer) always compiled,
-// which is why the fault looked intermittent rather than total.
-//
-// Dropping the key is the correct direction. Widening the schema to accept null would make
-// `"stack": null` a valid order and push the null downstream into every worker's prompt, where each
-// one would have to re-decide what a null stack means.
-const compact = (payload) =>
-  Object.fromEntries(Object.entries(payload).filter(([, v]) => v !== null && v !== undefined));
-
-/**
- * Dispatch one worker through the envelope port and get back the fields a gate needs.
- *
- * The sub-agent compiles its own WorkOrder with `harness compile`, calls the Skill against it, and
- * applies its WorkResult with `harness reduce ingest` — all in its own shell. This script never
- * couriers those commands, and the `verify envelope` hook still denies a dispatch whose order is
- * missing or schema-invalid, because that hook fires on the Skill call the sub-agent makes.
- *
- * @param {object} spec - `{skill, operation, payload, schema, phase, label, model, extra}`.
- * @returns {Promise<object>} The validated worker report, or a `__failed` marker.
- */
-async function worker({ skill, operation, payload, schema, phase: phaseName, label, model = execModel, extra = "", compile, round }) {
-  // The compile line is overridable because not every dispatch can be addressed the same way.
-  // `--operation <op> --slug <slug>` resolves its worker from `compile`'s OP_OWNER table, which
-  // covers the planner/judge/QA operations and NOT `execute`: a build order is addressed by scope,
-  // round and attempt, so the generic form exits 2 ("could not resolve --worker/--operation") for
-  // exactly the leg that runs most often. It used to be emitted for build legs anyway, contradicted
-  // one line later by `extra`'s correct `--scope …` instruction — a prompt arguing with itself.
-  // `--round` when the dispatch belongs to one. `compile` already suffixes the order id with it
-  // (`evaluate-r2`), and `probe resume` already reads `evaluate-r<N>.json` back to learn which EVAL
-  // rounds are done — writer and reader agreed all along and only this caller omitted the flag. The
-  // cost of that omission is two facts, both silent: every relaunch restarted the round counter at
-  // 1, because `eval_rounds_done` could never match `evaluate.json`; and round 2's evaluate result
-  // OVERWROTE round 1's, so a run kept only its last round's envelope.
-  const roundFlag = round ? ` --round ${round}` : "";
-  // A CALLER-SUPPLIED PAYLOAD ONLY REACHES THE ORDER ON THE GENERIC LINE. Overriding `compile`
-  // replaces the whole command, `--payload` included, so a caller that passes both is writing a
-  // field nobody will ever read — which is exactly how `payload.bugs` came to be built, filtered,
-  // and discarded on every fix round for the life of this file. Loud rather than fatal: the order
-  // is still valid, and killing a build leg over a discarded field would cost more than it saves.
-  if (compile && payload && Object.keys(compact(payload)).length) {
-    log(`DISPATCH — ${label}: payload dropped (${Object.keys(compact(payload)).join(", ")}). This ` +
-        `dispatch overrides its compile line, so --payload is not emitted; the order must derive ` +
-        `those fields itself (see harness compile).`);
-  }
-  const compileCmd = compile
-    || `compile --operation ${operation} --slug ${slug}${roundFlag} --payload '${JSON.stringify(compact(payload))}'`;
-  const r = await agent(
-    `You are running one step of an orchestrated build over feature slug "${slug}".\n\n` +
-    `1. Compile the WorkOrder:\n` +
-    `     node "${KERNEL}" ${compileCmd}\n` +
-    `   It prints the order path on stdout.\n` +
-    `2. Dispatch the worker against that order:\n` +
-    `     Skill(shapeup-sdlc-plugin:${skill}) --order "<the path from step 1>"\n` +
-    `   If the Skill dispatch fails or returns an error, STOP and report the error. Never work ` +
-    `around a failed dispatch by doing the craft yourself — the run has a receipt gate and an ` +
-    `improvised result is refused at step 3 anyway.\n` +
-    `   ${extra}\n` +
-    `3. Apply its WorkResult, naming the ORDER from step 1 — not any path the worker reports:\n` +
-    `     node "${KERNEL}" reduce ingest --order <the path from step 1>\n\n` +
-    `Then report ONLY the fields the schema names. Nothing else crosses this boundary — no ` +
-    `narration, no file contents, no summary of the work.`,
-    { model, phase: phaseName, label, schema, effort: "medium" },
-  );
-  return (r && typeof r === "object") ? r : nullFail(label);
-}
-
-/**
- * Dispatch a worker, check its result mechanically, and send it back ONCE with the refusal.
- *
- * A worker's result can be well-formed and still not what the run asked for — a verdict that grades
- * the surface as a group, a hunt that reached the app and ran no charter. The kernel says so; this
- * turns that into one more dispatch carrying the kernel's own reason, and only a second refusal
- * stands. Measured: a rule in the skill made the judge grade row by row on its first dispatch, and
- * the refusal is what holds when the model takes the loose path anyway.
- *
- * @param {function(string): Promise<object>} dispatch - Dispatches the worker; takes a note to append.
- * @param {function(string): Promise<(object|null)>} check - Runs the kernel's check; takes a label suffix.
- * @param {function(object): boolean} refused - Whether a check's answer is a correctable refusal.
- * @param {string} what - What is being checked, for the log line.
- * @returns {Promise<{r: object, v: (object|null)}>} The last dispatch and the last check.
- */
-async function sendBackOnce(dispatch, check, refused, what) {
-  let r = await dispatch("");
-  if (r.__failed) return { r, v: null };
-  let v = await check("");
-  if (v && refused(v)) {
-    log(`${what} — refused (${v.reason}); sent back once`);
-    r = await dispatch(` Your previous result was refused: ${v.reason}. Correct that and return again.`);
-    if (r.__failed) return { r, v: null };
-    v = await check(":again");
-  }
-  return { r, v };
-}
-
-/**
- * Dispatch a board writer (analyze, or the board-only regeneration) and send it back once when the
- * board carries no `covers:` clause while a requirements registry exists.
- *
- * Advisory past the second dispatch: the requirements matrix never blocks a ship, so a board that
- * still carries none continues with a state warning naming what the matrix will read, rather than
- * aborting a run whose plan is otherwise sound.
- *
- * @param {function(string): Promise<object>} dispatch - The board writer's dispatch; takes a note.
- * @param {string} what - The operation, for the log and the warning.
- * @returns {Promise<{r: object, v: (object|null)}>} The last dispatch and the last check.
- */
-async function boardSentBack(dispatch, what) {
-  const out = await sendBackOnce(dispatch,
-    (suffix) => query(`probe requirements --slug ${slug} --board-check`, BOARD_CHECK, "Analyze", `board-covers${suffix}`),
-    (v) => !v.ok && !!v.reason, `ANALYZE ${what}`);
-  if (!out.r.__failed && out.v && !out.v.ok && out.v.reason) {
-    const msg = `ANALYZE ${what}: ${out.v.reason} (after one send-back; the requirements matrix will read no evidence)`;
-    log(msg);
-    stateWarnings.push(msg);
-  }
-  return out;
-}
-
-// ---------------------------------------------------------------------------------------------
-// GATES — the kernel's exit-code convention, unchanged: 0 cross · 4 pause · 5 abort. The resolved
-// decision travels in `decision`, copied verbatim out of the kernel's own JSON.
-//
-// IT USED TO BE READ OUT OF `detail`, which is free prose a sub-agent writes. What came back was a
-// sentence — "Command exited 0; gate QA resolved decision=run from …" — and every comparison
-// downstream is against a token, so `decision === "run"` and `decision === "stop"` were false on
-// every run that has ever executed. The observable effect was a documented phase that silently
-// never ran and a PO answer at L3 that did nothing, with no error and no artifact to notice the
-// absence by. This file's own header says nothing here reads a model's prose; this was the one
-// place that did, and every gate decision passed through it.
-//
-// An unreadable decision now ABORTS rather than defaulting. A default is what made the original
-// defect invisible: "proceed" is a plausible answer at four of these gates, so the run continued
-// and read as healthy. Stopping converts a silent skip into a first-run error.
-// ---------------------------------------------------------------------------------------------
-const PRESETS = new Set(["ci", "guarded", "interactive"]);
-// The non-preset branch is an operator-supplied PATH, so it is quoted: every kernel call in this file
-// is spelled into a sub-agent's prompt, and the PreToolUse envelope gate scans that prompt as well as
-// a `Skill` call's args. A bare path is read together with the trailing quote of the literal around
-// it, and the whole dispatch is denied.
-const answersFlag = (a) => (!a ? "" : PRESETS.has(a) ? `--preset ${a}` : `--file "${a}"`);
-
-const TITLES = {
-  L1a: "Orient Review", "L1a.5": "Wiring Review", L1b: "Board Review",
-  L2: "Build Round Complete", L3: "Verdict & Loop", QA: "QA Edge Hunt", H: "Decide When to Stop",
-};
-const gateBlock = (g, ctx) =>
-  [`⏸ GATE ${g} — ${TITLES[g] || g}`, ...Object.entries(ctx).map(([k, v]) => `${k}: ${JSON.stringify(v)}`)].join("\n");
-const paused  = (g, valid, ctx) => ({ status: "paused", paused_at: g, block: gateBlock(g, ctx), valid_decisions: valid, context: ctx });
-const aborted = (g, why) => ({ status: "aborted", aborted_at: g, reason: why });
-const diedAt  = (g, r) => ({ status: "aborted", aborted_at: g, reason: r.__failed });
-
-/**
- * Resolve one gate: cross, pause, or abort.
- *
- * @param {string} gateId - Gate id (L1a, L2, …).
- * @param {string} phaseName - Progress group.
- * @param {string[]} validDecisions - What a human may answer if this pauses.
- * @param {object} ctx - The facts the gate block shows.
- * @returns {Promise<{stop?: object, decision?: string}>} `stop` carries a terminal RunReturn.
- */
-async function crossGate(gateId, phaseName, validDecisions, ctx) {
-  // The gate ledger keys a per-round crossing (L2, L3) on gate id + round, so it needs the round
-  // whenever the caller already has one to show in the block — the same value `ctx.round` carries
-  // for display, threaded through rather than re-derived.
-  const roundFlag = (ctx?.round != null ? ` --round ${ctx.round}` : "") + (ctx?.verdict ? ` --verdict ${ctx.verdict}` : "");
-  const g = await cmd(`gate --resolve ${gateId} --slug ${slug}${roundFlag} ${answersFlag(args.answers)}`.trim(), phaseName, `gate:${gateId}`);
-  if (g.exit_code === 4) return { stop: paused(gateId, validDecisions, ctx) };
-  if (g.exit_code === 5) return { stop: aborted(gateId, g.detail || `GATE ${gateId} aborted`) };
-  const decision = String(g.decision ?? "").trim();
-  if (!validDecisions.includes(decision)) {
-    return {
-      stop: aborted(gateId,
-        `GATE ${gateId} exited 0 but its decision did not come back as one of ` +
-        `${validDecisions.join(" | ")} — got ${JSON.stringify(g.decision ?? null)}. The kernel prints ` +
-        `the decision as a top-level JSON key; a run must not guess it. Re-run this gate, or answer ` +
-        `it directly with --answers.`),
-    };
-  }
-  return { decision };
-}
-
-// Ask the completion oracle about ONE phase, as a leg in that phase's progress group. Declared
-// ahead of both callers rather than between them: a `const` is not hoisted, and this file has paid
-// for a temporal-dead-zone binding once already (see `findings` at the round loop).
-const attest = (phaseKey, phaseName, label) =>
-  cmd(`probe resume --slug ${slug} --require ${phaseKey}`, phaseName, label);
-
-/**
- * The other half of a phase post-condition: the single writer ran.
- *
- * The artifact check asks whether the worker wrote its product. It cannot ask whether the
- * WorkResult was applied — the leg row, the discoveries, the board — because the product is written
- * by the worker directly and the envelope is applied by `reduce ingest`, a separate act the leg's
- * script names as its last step. Measured on a live run: a planning phase landed a result naming
- * seventeen artifacts and no leg row, the artifact check passed, and the run walked on with the
- * result's discoveries never reaching the ledger. So this asks the leg ledger by order name. A
- * result on disk that nothing applied is ingested here — the same repair the build round makes,
- * for the same reason: the single writer is the invariant, not which step invokes it — and if it
- * still is not applied after that, the run stops with a cause naming the writer that did not run,
- * rather than folding the gap into a phase that "completed".
- *
- * @param {string} gate - The gate name to report the abort under.
- * @param {string} phaseKey - The phase.
- * @param {string} phaseName - Progress group.
- * @param {string} [orderStem=phaseKey] - The order's file stem, when the phase was dispatched
- *   under a different operation (a board-only ANALYZE compiles `board.json`).
- * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the leg closed (or the
- *   question could not be asked — a probe that did not run proves nothing, and is logged as such).
- */
-async function requireLeg(gate, phaseKey, phaseName, orderStem = phaseKey, again = null) {
-  const ask = () => query(`probe leg --slug ${slug} --order "${orderStem}"`, ORDERLEG, phaseName, `legcheck:${orderStem}`);
-  let leg = await ask();
-  if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
-  // SENT BACK ONCE FOR THE ENVELOPE. A dispatched leg that wrote its artifacts and no WorkResult has
-  // done the craft and skipped the last step, and it recurs on the same phase run after run. The
-  // worker is dispatched again with the reason, told its artifacts stand; only a second miss is named
-  // at the close.
-  if (!leg.has_result && leg.has_receipt && again) {
-    log(`${gate} — "${phaseKey}" was dispatched and returned no WorkResult; sending it back once for the envelope.`);
-    await again(` Your previous dispatch of this order wrote the phase's artifacts and returned NO WorkResult. ` +
-      `The artifacts are on disk and stand: do not redo them. Write the WorkResult the order names ` +
-      `(its substrate's own results path), then ingest it as the steps above say.`);
-    leg = await ask();
-    if (!leg || !leg.found) return null;
-  }
-  if (!leg.has_result) {
-    // The artifact is on disk and the envelope never came back. Measured live: the first dispatch of
-    // a run wrote its four artifacts and no WorkResult, every later phase read the artifacts, and
-    // the run closed `shipped` over an order still open by construction. The phase stands on its
-    // artifact — that is what the post-condition checks — but the order is named at the close, and
-    // the next run over this slug will find it unanswered rather than be surprised by it.
-    log(`${gate} — "${phaseKey}" ${leg.has_receipt ? "was dispatched (receipt on disk) and" : "has an order but no receipt, and"} never answered: no WorkResult at all. ` +
-        `Its artifacts are on disk and the phase proceeds on them; the order stays unanswered and is named at the close.`);
-    if (leg.order && !unansweredOrders.includes(leg.order)) unansweredOrders.push(leg.order);
-    return null;
-  }
-  if (leg.applied) return null;
-  log(`${gate} — "${phaseKey}" came back with a result nothing applied (no leg row). Ingesting it here: ${leg.order}.`);
-  await advisory(`reduce ingest --order "${leg.order}"`, phaseName, `late-ingest:${phaseKey}`);
-  leg = await ask();
-  if (leg?.applied) return null;
-  return aborted(gate,
-    `${gate}: the single writer did not run for "${phaseKey}" — its WorkResult is on disk and no leg row ` +
-    `records it being applied, and a late \`reduce ingest\` did not take either. The phase's product exists; ` +
-    `what it discovered and reported never reached the ledger or the board. Read the result, run ` +
-    `\`reduce ingest --order "${leg?.order ?? "<its order>"}"\` by hand to see why it refuses, then relaunch.`);
-}
-
-/**
- * The phase post-condition: the artifact is on disk, or the run stops here.
- *
- * Deliberately the SAME derivation the fast-forward uses, asked about one phase. Two readings of
- * "is this phase done" that can disagree is the defect class, not a safeguard against it.
- *
- * @param {string} gate - The gate name to report the abort under.
- * @param {string} phaseKey - The phase `probe resume --require` knows.
- * @param {string} phaseName - Progress group.
- * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the artifact is there.
- */
-async function requirePhase(gate, phaseKey, phaseName, orderStem = phaseKey, again = null) {
-  const r = await attest(phaseKey, phaseName, `require:${phaseKey}`);
-  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName, orderStem, again);
-  // Exit 6 is `probe resume --require`'s OWN documented code for "the artifact really is not on
-  // disk" (kernel/probe/resume.mjs banner). Any other value — including -1, the courier's sentinel
-  // for a tool call that never ran — is not that predicate answering "no"; it is the predicate never
-  // being asked. Collapsing both into one message manufactured a false "worker escalated" diagnosis
-  // the one time this was measured live: the artifacts existed, and the check itself had been denied
-  // by a layer above this plugin (workspace trust, or Claude Code's own auto-mode classifier —
-  // neither leaves a row in decisions.jsonl, because neither is this plugin's hook).
-  if (r.exit_code === 6) {
-    return aborted(gate,
-      `${gate} produced no artifact: the ${phaseKey} artifact is not on disk after the phase ran and its ` +
-      `result was ingested. The phase did not complete — its worker most likely escalated (a WorkResult ` +
-      `may report "escalated" with an empty artifacts list) — and because completion is derived from the ` +
-      `artifact, every relaunch would re-dispatch this phase and escalate again. Read the phase's result ` +
-      `to see what it could not complete, resolve it, then relaunch.`);
-  }
-  return aborted(gate,
-    `${gate}'s completion check for "${phaseKey}" did not run to a verdict — exit_code ${r.exit_code}, ` +
-    `not the 0 (satisfied) or 6 (artifact absent) \`probe resume --require\` documents.` +
-    `${r.detail ? ` Courier reported: ${r.detail}.` : ""} This is NOT evidence the phase failed — it means ` +
-    `the check itself could not run, most often a Bash call denied above this plugin's own hooks and ` +
-    `permission grant (an untrusted workspace, or Claude Code's auto-mode classifier). Verify the ` +
-    `${phaseKey} artifact by hand before assuming it is missing, then either relaunch or drive the ` +
-    `remaining phase's kernel commands directly.`);
-}
-
-/**
- * A phase this launch did not run, said where the run is actually watched — and proved.
- *
- * A GATE PAUSE IS A RETURN, so the PO's answer is followed by a fresh launch of this file, and the
- * runtime's progress panel is rebuilt from THAT launch's dispatches: this repo resumes off the
- * artifacts under `.shapeup/`, deliberately, rather than off the runtime's own `resumeFromRunId`.
- * A phase that fast-forwards used to dispatch nothing, so its box rendered `0 agents · Not started
- * yet` — identical to a phase that never ran, on the one screen an operator has to decide whether a
- * paused run came back correctly. Measured on a relaunch: ORIENT, WIRE and MAP SCOPES looked right
- * only by accident, because a gate leg lands in each of their progress groups and earns them a tick,
- * while ANALYZE — reviewed at L1b, in another group — showed as never started with its spec tree
- * sitting on disk. There is no runtime call for "mark this phase complete"; a leg is the only thing
- * that puts a phase in the record, so the skip has to cost one.
- *
- * WHICH MAKES THE LEG WORTH SPENDING ON THE ONE QUESTION THE SKIP NEVER ASKED. Every fast-forward
- * decision in this file branches on a SINGLE `probe resume` snapshot taken at the top of the run,
- * before ORIENT dispatches. Re-asking `--require` at the phase itself is the same oracle the
- * post-condition uses, one phase over, and it converts "the state probe said so a few legs ago" into
- * an attestation made where it is acted on.
- *
- * @param {string} gate - The gate name to report an abort under.
- * @param {string} phaseKey - The phase `probe resume --require` knows.
- * @param {string} phaseName - Progress group.
- * @param {string} what - What is already on disk, for the narrator line.
- * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the artifact is really there.
- */
-async function fastForward(gate, phaseKey, phaseName, what) {
-  log(`${gate} — ${what}, fast-forwarding past it`);
-  const r = await attest(phaseKey, phaseName, `ff:${phaseKey}`);
-  if (r.exit_code === 0) return null;
-  // Same distinction as requirePhase: only exit 6 is the predicate genuinely answering "not there".
-  // Anything else means this re-attestation call itself never executed, most likely denied above
-  // this plugin's hooks and permission grant — not a real disagreement between the two probes.
-  if (r.exit_code === 6) {
-    return aborted(gate,
-      `${gate} was fast-forwarded on a state probe that reported its artifact present, and re-asking ` +
-      `\`probe resume --require ${phaseKey}\` at the phase itself says it is not on disk. Two readings ` +
-      `of "is this done" disagree, and the one taken AT the phase is the later of the two — so the run ` +
-      `stops here rather than building on a phase nothing can attest. Check whether the ${phaseKey} ` +
-      `artifact was moved or removed since this run last touched it, then relaunch.`);
-  }
-  return aborted(gate,
-    `${gate}'s re-attestation of "${phaseKey}" did not run to a verdict — exit_code ${r.exit_code}, not ` +
-    `the 0 (satisfied) or 6 (artifact absent) \`probe resume --require\` documents.` +
-    `${r.detail ? ` Courier reported: ${r.detail}.` : ""} The two probes are not actually in disagreement — ` +
-    `this one never executed, most often a Bash call denied above this plugin's own hooks and ` +
-    `permission grant (an untrusted workspace, or Claude Code's auto-mode classifier). Verify the ` +
-    `${phaseKey} artifact by hand before assuming it regressed, then relaunch.`);
-}
-
-/**
- * The positive enforcer for GATE L0.9b's launch record: the RunArgs object this run was
- * configured with, kernel-written to the run's own local root, is on disk before this file
- * dispatches anything past Preflight.
- *
- * Nothing upstream of this call can be trusted to have written it. `SKILL.md` Step 2 tells the
- * orchestrating session to run `harness init run-args` right before `Workflow(...)` is invoked, but
- * that is prose the session reads, not a check anything runs — and a session that launches this
- * script without having done it left no trace anywhere else: the receipt, `intake.md` and
- * `harness-run.md` all exist regardless, and `dialFrom()` (`kernel/probe/concurrency.mjs`) answers
- * every reader with a silent default rather than an error. So the record's existence would depend
- * entirely on whether a prior step of prose was followed — exactly the shape this file's own header
- * exists to retire (no rule with no enforcer). `probe concurrency --require-run-args` is a presence
- * check, not a measurement: it shares `dialFrom()`'s run-root resolution and file path so there is
- * one definition of where the record lives, not two.
- *
- * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the record is there.
- */
-async function requireLaunchRecord() {
-  const r = await cmd(`probe concurrency --slug ${slug} --require-run-args`, "Preflight", "launch-record");
-  if (r.exit_code === 0) return null;
-  // Same distinction requirePhase/fastForward draw: only exit 6 is the predicate genuinely
-  // answering "not there". Anything else means the check itself did not run.
-  if (r.exit_code === 6) {
-    return aborted("preflight",
-      `the run's launch record does not exist — GATE L0.9b's RunArgs (the model matrix, budgets and ` +
-      `every operator switch this run was typed with) was never written to disk before this launch, ` +
-      `so nothing downstream can be attested against what the operator actually configured. Run ` +
-      `\`harness init run-args\` (references/gates.md L0.9b names every flag it resolves — \`SKILL.md\` ` +
-      `Step 2 runs it right before this workflow launches) and relaunch.`);
-  }
-  return aborted("preflight",
-    `the launch-record check did not run to a verdict — exit_code ${r.exit_code}, not the 0 (present) ` +
-    `or 6 (absent) \`probe concurrency --require-run-args\` documents.` +
-    `${r.detail ? ` Courier reported: ${r.detail}.` : ""} This is NOT evidence the record is missing — ` +
-    `most often a Bash call denied above this plugin's own hooks and permission grant (an untrusted ` +
-    `workspace, or Claude Code's auto-mode classifier). Verify the run's launch record by hand — ` +
-    `\`harness probe concurrency --slug ${slug} --require-run-args\` — before assuming it is absent, ` +
-    `then relaunch.`);
-}
-
-// The ledger's `status` field is bookkeeping, not this file's resume oracle — the fast-forward reads
-// artifacts. It survives because `reduce snapshot` and the the ship report's census hook read it to tell
-// a run in flight from a finished one. A lost write is a degraded digest, not a corrupted build, so
-// it warns and continues — and the warning travels in the RunReturn, because a headless stdout
-// carries only the final message and a diagnostic on a channel nobody reads is not a diagnostic.
-const stateWarnings = [];
-// Orders a receipt says were dispatched and no WorkResult ever answered — a leg that did its craft
-// and never came back. Named at every close, whatever the close; never folded into "complete".
-const unansweredOrders = [];
-async function setRunStatus(status, phaseName) {
-  const r = await cmd(`probe resume --slug ${slug} --set-status ${status}`, phaseName, `status:${status}`);
-  if (!r.ok) {
-    const why = (r.detail || `exit ${r.exit_code}`).trim();
-    log(`RUN STATE — status="${status}" did not take: ${why}. The run continues (resume is derived from ` +
-        `artifacts, not from this field), but the snapshot and the the ship report's census hook will read ` +
-        `this run as unfinished.`);
-    stateWarnings.push(`status="${status}" did not take: ${why}`);
-  } else if (r.decision === "reopened") {
-    // The ledger now carries the earlier close under `prior_closes`; say so where a reader of the
-    // run's own log will see it, because resuming a closed run changes what its close will say.
-    log(`RUN STATE — this run had been closed; moving it to "${status}" reopened it. The earlier close is ` +
-        `kept in the ledger under prior_closes, and the run's next terminal close is recorded as its own.`);
-  }
-}
-
-// A free-text reason, made safe to spell into a sub-agent's shell instruction: no quotes, no
-// newlines, no backticks or `$` — every one of those risks breaking the command the sub-agent
-// itself constructs from this file's own instruction text (see `cmd()`'s banner: every kernel call
-// in this script is spelled into a prompt, not spawned directly). Truncated, not elided: the exit
-// code and the ledger's own close_cause line are still the source of record — this is only what
-// crosses the prompt boundary.
-const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300) || "no reason recorded");
-
-// A terminal RunReturn closes the run's own ledger — a terminal status, its cause, and a close
-// timestamp, in one write. WHICH arms are terminal, and what status each closes as, is no longer
-// decided here: `probe resume --close-arm <ret.status>` hands the kernel the RunReturn arm itself
-// and it answers from `RUN_RETURN_CLOSE` (kernel/probe/resume.mjs), derived from the schema's own
-// enum rather than a pair of statuses this file used to compare `ret.status` against by hand — a
-// literal comparison that could not see a new arm go unhandled, because it never consulted the
-// kernel's own list of terminal statuses at all. `gate_h` now closes the run as `escalated` — the
-// breaker that tripped travels in the close's cause text, never as a status of its own; the
-// tech-lead skill's own GATE H → L4 orchestration still runs the census and the ship decision, it
-// just no longer finds the ledger's close fields unset when it gets there. `paused` and `ok` remain
-// explicitly non-terminal — the kernel says so, this call site no longer needs to know why.
-// Best-effort, the same discipline as `setRunStatus` above: a lost write degrades the trace's own
-// record of why the run ended, it does not change what this return reports.
-//
-// A close can also come back `ok:true` and still be a degraded outcome: `closeRun`
-// (kernel/probe/resume.mjs) refuses a DIFFERENT terminal status outright (that failure already hits
-// the `!r.ok` branch below, exit 3), but the SAME status with a DIFFERENT cause — a run_id closed
-// more than once across relaunches, e.g. `aborted` at Preflight then `aborted` again for a different
-// reason after a later relaunch — is *superseded* rather than refused: `ok:true`, the new cause
-// folded together with the old one on disk, and `decision:"superseded"` (the one bare token `cmd()`
-// relays verbatim across the courier boundary — see its own banner) naming that outcome. Reporting
-// that as a clean, silent success would be a state fact the trace needs with nothing surfacing it —
-// the same shape as leaving a run's ledger open after it ended. It costs nothing this return itself
-// reports — the ledger already folded the prior cause in — but the run's own RunReturn must say the
-// trace is degraded.
-async function closeIfTerminal(ret) {
-  const cause = ret.status === "aborted"
-    ? `${ret.aborted_at || "?"}: ${ret.reason || "no reason recorded"}`
-    : ret.status === "gate_h"
-    ? (ret.stalled ? `stalled=${ret.stalled} ` : "")
-      + `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
-      + (Array.isArray(ret.tripped_scopes) ? ` tripped_scopes=${ret.tripped_scopes.length}` : "")
-      // A result the single writer never applied is named at the close, not folded into "not green".
-      + (Array.isArray(ret.unapplied_results) && ret.unapplied_results.length ? ` unapplied_results=${ret.unapplied_results.length}` : "")
-      + (ret.census ? ` census=${ret.census}` : "") + (ret.l4 ? ` l4=${ret.l4}` : "") + (ret.ship_report ? ` ship_report=${ret.ship_report}` : "")
-    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}` + (ret.qa ? ` qa=${ret.qa}` : "")
-      + (ret.after ? ` after=${ret.after} breaker=${ret.breaker ?? "?"} census=${ret.census ?? "?"} cut_list=${Array.isArray(ret.cut_list) ? ret.cut_list.length : "?"}` : "");
-  // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
-  // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
-  // stay silent for it exactly as they did when this file's own guard returned early.
-  const unanswered = unansweredOrders.length ? ` unanswered_orders=${unansweredOrders.length}` : "";
-  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause + unanswered)}"`, "Ship", `close:${ret.status}`);
-  if (!r.ok) {
-    const why = (r.detail || `exit ${r.exit_code}`).trim();
-    log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +
-        `stand; only the ledger's own closed_at/close_cause record is degraded.`);
-    stateWarnings.push(`close(${ret.status}) did not take: ${why}`);
-    return;
-  }
-  if (String(r.decision ?? "").trim() === "superseded") {
-    log(`RUN STATE — close(${ret.status}) superseded an earlier close recorded under the same status ` +
-        `but a different cause — this run_id was closed more than once. Both causes are on the ledger's ` +
-        `own close_cause line; this return's trace is degraded, not corrupted.`);
-    stateWarnings.push(`close(${ret.status}) superseded an earlier close of this run_id — see harness-run.md's close_cause for both reasons`);
-  }
-  // The close itself took (r.ok above) — an export_warning here is `exportOnClose`
-  // (kernel/probe/resume.mjs) reporting it could not project this run's
-  // fact tables. Advisory, same as every other line in this function: the close stands, the run's
-  // own return says the trace is short one export rather than swallowing the fact.
-  if (r.export_warning) {
-    log(`RUN STATE — close(${ret.status}) took, but its export did not: ${r.export_warning}`);
-    stateWarnings.push(`close(${ret.status}): ${r.export_warning}`);
-  }
-}
-const withWarnings = async (ret) => {
-  await closeIfTerminal(ret);
-  return stateWarnings.length ? { ...ret, state_warnings: stateWarnings } : ret;
-};
-
-// =============================================================================================
-// THE RUN
-// =============================================================================================
-phase("Preflight");
-
-// CANARY — can THIS SESSION resolve a worker skill at all?
-//
-// `init run` already refused if the SKILL.md files are not on disk. That is the cheap half and it
-// is not the failure: in the session that produced this defect the files were sitting right there
-// in the repo, and the dispatch still returned "Unknown skill" because the plugin was not loaded.
-// A file check passes green on both states that actually happen — installed-but-disabled, and a
-// different version loaded — because those copies have all ten SKILL.md files too.
-//
-// So one real dispatch, before any worker is paid for. Deliberately with NO `--order`: this is
-// testing name resolution, not doing work, and an order would leave a compiled order with no result
-// in `orders/` that every reader of that directory would then have to know about. A canary that
-// perturbs the run it is clearing is not a preflight.
-//
-// The evidence is not the sub-agent's report — it is the hook layer's. A Skill call whose name does
-// not resolve fires no hook at all, so a decision row naming the skill is proof the name resolved,
-// and `verify dispatch` reads that row. The sub-agent cannot write it, so it cannot fake it.
-const canarySkill = "orient";
-await agent(
-  `Make exactly ONE tool call and nothing else: Skill(shapeup-sdlc-plugin:${canarySkill}).\n\n` +
-  `Pass no arguments. Do NOT act on anything the skill returns — this is a preflight that checks ` +
-  `the skill can be reached, not a request to do its work. Do not use any other tool.\n\n` +
-  `Then report whether the call returned or errored, in one line.`,
-  { model: "sonnet", effort: "low", phase: "Preflight", label: `canary:${canarySkill}` },
-);
-const canary = await cmd(`verify dispatch --skill ${canarySkill} --within 900`, "Preflight", "canary-evidence");
-if (!canary.ok) {
-  return await withWarnings(aborted("preflight",
-    `the ${canarySkill} skill did not resolve in this session — no dispatch reached the hook layer. ` +
-    `A run would report phases completing while the sub-agents improvised every worker's craft. ` +
-    `Load the plugin (\`claude --plugin-dir <repo>\`, or install and enable it) and relaunch. ` +
-    `(${canary.detail || `exit ${canary.exit_code}`})`));
-}
-
-// ENVIRONMENT CANARY — do the project's own build and launch probes run in THIS session?
-//
-// The skill canary proves the workers resolve; it says nothing about whether the commands the round
-// gate will run can. A missing package install or local SDK pointer fails the build in a second, a
-// probe outside the grant is refused, a device that is not attached leaves every `[ui]` row
-// ungraded — and each used to surface only at the first round gate, after planning was paid for.
-// `verify build --preflight` runs the same declared steps from a sub-agent, through the same grant,
-// and writes nothing. It WARNS rather than aborts: a baseline can be red for a reason the feature is
-// meant to fix, and an unattended run should still say so up front rather than stop.
-//
-// The evidence is this command's exit code. Whether a grant "looks present" in a settings file is
-// not evidence of anything: a grant can arrive by other routes, and one in the file can still be
-// refused above it.
-const envCanary = await cmd(`verify build --slug ${slug} --preflight`, "Preflight", "canary-env");
-if (envCanary.exit_code === 1 || envCanary.exit_code === 4) {
-  const kind = envCanary.exit_code === 4 ? "a probe could not run (exit 2 — typically no device attached, or a missing artifact)" : "a declared step is red";
-  const msg = `ENVIRONMENT — preflight: ${kind}${envCanary.detail ? `: ${envCanary.detail}` : ""}. The same step runs in every ` +
-    `round's build gate, so fix the environment now if it is not the feature's to fix.`;
-  log(msg);
-  stateWarnings.push(msg);
-} else if (envCanary.exit_code !== 0 && envCanary.exit_code !== 3) {
-  const msg = `ENVIRONMENT — preflight did not run (exit ${envCanary.exit_code}${envCanary.detail ? `: ${envCanary.detail}` : ""}); ` +
-    `nothing is known about the build or launch probes until the first round gate.`;
-  log(msg);
-  stateWarnings.push(msg);
-}
-
-// GATE L0.9b's launch record must exist before anything past Preflight dispatches; see
-// requireLaunchRecord()'s own banner for why this cannot be left to Step 2's prose alone.
-const launchRecordAbort = await requireLaunchRecord();
-if (launchRecordAbort) return await withWarnings(launchRecordAbort);
-
-phase("Orient");
-
-const rs = await query(`probe resume --slug ${slug} --plugin-root "${args.pluginRoot}"`, RESUME, "Orient", "resume-state");
-// WHICH ORCHESTRATOR IS RUNNING. A run keeps the workflow copy it opened with — correct for a run
-// in flight, and silent: a relaunch after an upgrade executes the old script, reports normally and
-// closes normally, so every observation is of the previous release. Said out loud, never enforced.
-if (rs.staged_workflow?.warning) {
-  log(`RUN STATE — ${rs.staged_workflow.warning}`);
-  stateWarnings.push(rs.staged_workflow.warning);
-}
-// A probe that produced nothing is not an EMPTY run — it is an unknown one. Treating it as empty
-// would re-dispatch every phase from the top, over a run that may be in progress.
-if (!rs) {
-  return await withWarnings(aborted("probe", "the fast-forward derivation returned no state — refusing to re-dispatch a run that may already be in progress"));
-}
-
-// A RELAUNCH OVER A CLOSED RUN REOPENS IT FIRST. The first status write is what takes a close back,
-// and a launch that fast-forwards every planning phase made that write only at BUILD, so the gates
-// it crossed on the way were recorded against a run whose ledger still read closed. Bookkeeping,
-// not a phase decision: the phases below still branch on artifacts alone.
-if (rs.closed_status) await setRunStatus("orienting", "Orient");
-
-const specFolder = rs.spec_folder || `shapeup/${slug}/spec/`;
-// A set the PO named at L0.5, or null: `harness compile` then resolves it from the spec for each
-// evaluate order. A fixed fallback here would travel as an explicit list and switch off the judge's
-// own auto-enable, which is how every run once graded spec-conformance alone.
-const evalDims = rs.eval_dimensions?.length ? rs.eval_dimensions : null;
-// What the judge was actually asked to grade, read back off the newest evaluate order.
-let gradedDims = evalDims || [];
-
-// ---- ORIENT + GATE L1a ----------------------------------------------------------------------
-let spikedArea = "~", spikeResult = "~", riskiest = [];
-if (!rs.has_orient_artifacts) {
-  log(`ORIENT — dispatching (slug ${slug})`);
-  await setRunStatus("orienting", "Orient");
-  const dispatchOrient = (note = "") => worker({
-    skill: "orient", operation: "orient", schema: ORIENT, phase: "Orient", label: note ? "orient:again" : "orient",
-    payload: { pitch: rs.intake_path, breadboard: rs.breadboard_path, spec_folder: specFolder, feature: slug, stack: rs.stack },
-    // NAME THE FILES. "write the orient/ artifacts" was the whole instruction, while completion is
-    // decided by four exact filenames — so a leg that did the work and called its output
-    // `code-surface-map.md` and `discovered-tasks.md` aborted the run at the post-condition, having
-    // spiked real code and written four genuinely useful files. The skill doc states these names
-    // four times over; the dispatch prose stated them zero. Cheap to say, and the phase's completion
-    // contract belongs where the worker reads it, not only where it is enforced.
-    extra:
-      "Read and spike real code before any board exists. The phase is COMPLETE only when the run's " +
-      "orient directory — the one this order's substrate permits — contains all four of these, " +
-      "named exactly: `code-surface.md`, " +
-      "`discovered-seed.md`, `hill-signal.md`, and one `spike-<area>.md` (or `spike-not-needed.md` " +
-      "when the risk scan came back rank 0). Any other filename leaves the phase incomplete and " +
-      "the run aborts, however good the contents are." + note,
-  });
-  const o = await dispatchOrient();
-  if (o.__failed) return await withWarnings(diedAt("ORIENT", o));
-  const post = await requirePhase("ORIENT", "orient", "Orient", "orient", dispatchOrient);
-  if (post) return await withWarnings(post);
-  await advisory(`reduce graph --slug ${slug}`, "Orient", "graph:orient");
-  spikedArea = o.spiked_area; spikeResult = o.spike_result; riskiest = o.riskiest_unknowns || [];
-} else {
-  const post = await fastForward("ORIENT", "orient", "Orient", "artifacts already on disk");
-  if (post) return await withWarnings(post);
-}
-
-{
-  // `breadboard` travels in the block because a missing one is invisible anywhere later: every
-  // downstream artifact reads the same whether or not the pitch's second half reached the run.
-  const g = await crossGate("L1a", "Orient", ["proceed", "ask", "abort"],
-    { breadboard: rs.breadboard_source ?? "none", spiked_area: spikedArea, spike_result: spikeResult, riskiest_unknowns: riskiest });
-  if (g.stop) return await withWarnings(g.stop);
-}
-
-// ---- COVERAGE (the requirements registry) — ahead of ANALYZE, whose ACs cite its ids ----------
-//
-// WHY IT RUNS AT ALL, and why here. The pitch's own requirement list is the one statement of what
-// the run was asked for, and until it is extracted into `shapeup/<slug>/requirements.md` there is
-// no stable key an acceptance criterion, a scope contract or a verdict can point back to. Measured
-// on a full run: the planner produced the requirement edge on the board and the judge never saw
-// it, because nothing on either side shared a key space. So the registry is written BEFORE the
-// board, not beside it — ANALYZE's acceptance criteria cite `REQ-<n>` ids, which have to exist
-// before they can be cited.
-//
-// IT IS NOT A PHASE, AND THAT IS THE WHOLE DESIGN OF THIS BLOCK.
-//   · No `phase("Coverage")`: the dispatch belongs to the planning stretch the Analyze group
-//     already covers (`setRunStatus("mapping")` spans it), so it never renders as an empty group
-//     on a relaunch — the failure a per-phase progress box would otherwise have to pay a leg to
-//     avoid, and there is no leg to spend here (see the next point).
-//   · No `requirePhase()` / no `fastForward()`: both route to `probe resume --require`, whose
-//     `--require` is an ENUM over `PHASE_ARTIFACT`'s keys. `coverage` is not one, so the call exits
-//     2, and this file reads any exit other than 6 as "the predicate was never asked" — a dispatch
-//     that worked would abort the run. The skip is therefore narrated, and guarded on the bare
-//     `has_requirements` boolean the resume state carries.
-//   · Not in `PHASE_ARTIFACT` either: that map is also `nextPhase()`'s ordered list, so adding it
-//     would fast-forward every pre-registry run to the registry instead of to `build`.
-phase("Analyze");
-if (!rs.has_requirements) {
-  log(`COVERAGE — dispatching (slug ${slug})`);
-  await setRunStatus("mapping", "Analyze");
-  const c = await worker({
-    skill: "ba-pitch-analyzer", operation: "coverage", schema: PHASE_OK, phase: "Analyze", label: "coverage",
-    payload: { requirements: rs.intake_path, feature: slug },
-    extra:
-      "Extract the pitch's requirement clauses into the SHARED requirements registry, one atomic " +
-      "clause per row. A clause carrying an R-id keeps its number as REQ-<n> and records the R-id " +
-      "verbatim in its source cell; ids are assigned once and never renumbered.",
-  });
-  if (c.__failed) return await withWarnings(diedAt("COVERAGE", c));
-  await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:coverage");
-} else {
-  log(`COVERAGE — a requirements registry is already on disk; not re-dispatching it`);
-}
-
-// ---- ANALYZE (spec tree + board) — ahead of WIRE, which reads its use cases -------------------
-if (!rs.has_spec_tree) {
-  log(`ANALYZE — dispatching (slug ${slug})`);
-  // "mapping", not "analyzing": the kernel's RUN_STATUSES enum is deliberately COARSER than this
-  // file's phases — one value covers ANALYZE through MAP SCOPES, the stretch where the run is
-  // working out the shape. `analyzing` is not a member and never was, so this call failed on every
-  // single run since the cutover. It is advisory, so nothing stopped; the ledger simply stayed on
-  // the previous phase and the snapshot under-reported where the run had got to.
-  await setRunStatus("mapping", "Analyze");
-  const { r: a } = await boardSentBack((note) => worker({
-    skill: "ba-pitch-analyzer", operation: "analyze", schema: PHASE_OK, phase: "Analyze", label: note ? "analyze:again" : "analyze",
-    payload: { pitch: rs.intake_path, breadboard: rs.breadboard_path, spec_folder: specFolder, feature: slug, lens: rs.lens, orient_dir: rs.orient_dir },
-    extra: "Write the spec tree and the board from the orient artifacts — do not re-scan the code." + note,
-  }), "analyze");
-  if (a.__failed) return await withWarnings(diedAt("ANALYZE", a));
-  const post = await requirePhase("ANALYZE", "analyze", "Analyze");
-  if (post) return await withWarnings(post);
-  await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:analyze");
-} else if (!rs.has_board) {
-  // THE HALF THAT DOES NOT SURVIVE. The spec tree is committed; the board is per-machine and
-  // gitignored, and ANALYZE writes both. A run after the first on a machine — and every run in a
-  // fresh checkout — used to fast-forward on the committed half alone and build over no board:
-  // GATE L2 crossed 0/0 tasks, the evaluator could read no `covers:` clause, and the requirements
-  // projection said "no evidence" for a round whose static criteria all passed. The board-only
-  // operation regenerates it from the tree without re-deriving the tree.
-  log(`ANALYZE — spec tree on disk, no board: dispatching the board-only operation (slug ${slug})`);
-  await setRunStatus("mapping", "Analyze");
-  const { r: b } = await boardSentBack((note) => worker({
-    skill: "ba-pitch-analyzer", operation: "board", schema: PHASE_OK, phase: "Analyze", label: note ? "board:again" : "board",
-    payload: { spec_folder: specFolder, feature: slug, lens: rs.lens },
-    extra: "The spec tree is committed and FROZEN for this dispatch. Regenerate the per-machine board " +
-           "under the run's tasks/ directory from the use cases on disk — every acceptance criterion " +
-           "carrying its `(covers: REQ-…)` clause — and write nothing under the spec folder." + note,
-  }), "board");
-  if (b.__failed) return await withWarnings(diedAt("ANALYZE", b));
-  // The board a worker writes carries `depends_on`; its inverse (`unlocks`) and a new task's
-  // `status: todo` are mechanical, so the kernel writes them rather than trusting every regeneration
-  // to remember — a board that came back without both failed spec-lint on every task at L1b.
-  await advisory(`reduce board --slug ${slug} --write`, "Analyze", "board:derive");
-  const post = await requirePhase("ANALYZE", "analyze", "Analyze", "board");
-  if (post) return await withWarnings(post);
-  await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:board");
-} else {
-  const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree and board already on disk");
-  if (post) return await withWarnings(post);
-}
-
-// ---- WIRE + GATE L1a.5 ------------------------------------------------------------------------
-phase("Wire");
-if (!rs.has_wiring_map) {
-  // FAIL FAST, at the orchestrator: `rs` already carries has_project_profile from the resume
-  // snapshot taken before ORIENT — the SAME fact solution-architect would have to discover for
-  // itself. Dispatching without it spends a full worker turn only for the worker to hit its own
-  // documented rule ("profile absent ⇒ ESCALATE, do not invent an entry point" — solution-
-  // architect/SKILL.md) and escalate; an escalation writes no wiring-map.md, so `has_wiring_map`
-  // stays false and every relaunch re-dispatches and re-escalates identically. The orchestrator
-  // holds the state a gate needs; it should not hand the check to the LLM it is about to pay for.
-  if (!rs.has_project_profile) {
-    return await withWarnings(aborted("WIRE",
-      `missing SHARED project-profile.md at ${rs.project_profile_path} — GATE L0 writes it ` +
-      `({schema_version:1, archetype, entry_point}; references/gates.md GATE L0 §PROFILE) before ` +
-      `this workflow launches. WIRE cannot resolve an entry_call_site without an entry_point to ` +
-      `resolve against. Write the profile, then relaunch.`));
-  }
-  log(`WIRE — dispatching (slug ${slug})`);
-  const dispatchWire = (note = "") => worker({
-    skill: "solution-architect", operation: "wire", schema: PHASE_OK, phase: "Wire", label: note ? "wire:again" : "wire",
-    payload: { feature: slug, spec_folder: specFolder, project_profile: rs.project_profile_path, breadboard: rs.breadboard_path },
-    extra: "Write the wiring map: per use case, engine → seam → entry-point call site → affordance." + note,
-  });
-  const w = await dispatchWire();
-  if (w.__failed) return await withWarnings(diedAt("WIRE", w));
-  const post = await requirePhase("WIRE", "wire", "Wire", "wire", dispatchWire);
-  if (post) return await withWarnings(post);
-  await advisory(`reduce graph --slug ${slug}`, "Wire", "graph:wire");
-} else {
-  const post = await fastForward("WIRE", "wire", "Wire", "wiring map already on disk");
-  if (post) return await withWarnings(post);
-}
-
-{
-  const g = await crossGate("L1a.5", "Wire", ["proceed", "ask", "abort"], { wiring_map: "written" });
-  if (g.stop) return await withWarnings(g.stop);
-}
-
-// ---- MAP SCOPES + GATE L1b --------------------------------------------------------------------
-phase("MapScopes");
-// Both ways this list is produced now carry the same shape: `probe resume`'s `scope_files` and
-// `MAPSCOPES.scopes` are each `{scope_id, path}`, so nothing downstream has to know which branch
-// filled it. An entry missing either half is dropped rather than turned into a scope whose path is
-// `undefined` — `compile --scope undefined` exits 2, and the attempt loop reads a non-zero exit as
-// the stagnation breaker, which is a dead scope reported as a hard one.
-let scopes = (rs.scope_files || []).filter((s) => s?.scope_id && s?.path)
-  .map((s) => ({ path: s.path, scope_id: s.scope_id }));
-const mappedThisRun = scopes.length === 0;
-if (scopes.length === 0) {
-  log(`MAP SCOPES — dispatching (slug ${slug})`);
-  const m = await worker({
-    skill: "scope-architect", operation: "map-scopes", schema: MAPSCOPES, phase: "MapScopes", label: "map-scopes",
-    payload: { feature: slug, breadboard: rs.breadboard_path },
-    // SAY THE PASS RULE, for the same reason ORIENT's filenames are named above: the rule lives in
-    // `verify t0` (a fixture passes iff it exits 0) and the architect never saw it. Given a contract
-    // that said only "commands that drive this scope end-to-end", it wrote the scope's error paths
-    // as bare invocations — `todo done abc  # E_INVALID_INDEX, exit 1` — which cannot pass by
-    // construction, so four of six scopes could never go T0-green however correct their code was.
-    // The two that did go green were the two whose fixtures happened to be `node --test …`.
-    extra:
-      "Write the scope contracts (substrate whitelists, verification fixtures) and report the " +
-      "riskiest-first sequence. EVERY e2e_verification_fixture MUST EXIT 0 when the scope is " +
-      "correct — T0 scores any non-zero exit as a failure, so a fixture written as a bare " +
-      "error-path invocation can never pass and its scope can never go green. Put expected " +
-      "non-zero exits INSIDE a test file that itself exits 0, and name that test file as the " +
-      "fixture. Write `e2e_verification_fixtures` as a FRONTMATTER key holding bare command " +
-      "strings — a `## e2e_verification_fixtures` markdown section is not parsed, and a command " +
-      "with prose appended to it is not runnable. A scope whose fixtures do not parse has nothing " +
-      "to verify it and is refused at the board review.",
-  });
-  if (m.__failed) return await withWarnings(diedAt("MAP SCOPES", m));
-  const post = await requirePhase("MAP SCOPES", "map-scopes", "MapScopes");
-  if (post) return await withWarnings(post);
-  await advisory(`reduce graph --slug ${slug}`, "MapScopes", "graph:map-scopes");
-  scopes = m.scopes;
-} else {
-  const post = await fastForward("MAP SCOPES", "map-scopes", "MapScopes",
-    `${scopes.length} scope contract(s) already on disk`);
-  if (post) return await withWarnings(post);
-}
-
-// DEPENDENCY ORDER — a scope is never built beside a scope it consumes.
-//
-// The fan-out used to chunk scopes by a fixed width over the directory's alphabetical order. On the
-// criterion-1 run that scheduled `cli-integration` — the scope that wires every other scope's module
-// to the entry point — SECOND, beside the very scopes it consumes. It failed both rounds, and its
-// failure was the whole of the run's failure: five of six scopes went green, `bin/todo.js` stayed a
-// placeholder, and four individually T0-green command modules were unreachable.
-//
-// All three facts below are derived by the kernel from the contracts, so nothing here declares any
-// of them. The waves fix the ORDER scopes are considered in; the dependency edges fix when each one
-// is RELEASED; the exclusions forbid two scopes that may write the same declared-shared path from
-// running at the same time. Everything else fans out.
-const wavesFrom = (raw, list) => {
-  const byId = new Map(list.map((s) => [s.scope_id, s]));
-  const idOf = (p) => String(p).split("/").pop().replace(/\.(md|json)$/, "");
-  const w = (raw || []).map((g) => g.map((p) => byId.get(idOf(p))).filter(Boolean)).filter((g) => g.length);
-  // Every scope must appear exactly once, or the grouping is not trustworthy and one wave — today's
-  // behavior — is the safe answer. A scheduler that drops a scope is worse than an unscheduled one.
-  return w.length && w.reduce((a, g) => a + g.length, 0) === list.length ? w : [list];
-};
-let waves = wavesFrom(rs.scope_waves, scopes);
-let rawDeps = rs.scope_deps;
-let rawExclusions = rs.scope_exclusions;
-if (mappedThisRun && scopes.length > 1) {
-  // The contracts were written THIS run, so the state probed before MAP SCOPES could not have seen
-  // them. One cheap re-derivation, on the fresh-run path only.
-  const rs2 = await query(`probe resume --slug ${slug}`, RESUME, "MapScopes", "scope-waves");
-  if (rs2?.scope_waves?.length) {
-    waves = wavesFrom(rs2.scope_waves, scopes);
-    rawDeps = rs2.scope_deps;
-    rawExclusions = rs2.scope_exclusions;
-  }
-}
-// The waves flattened ARE the build order: dependencies first, input order within a level. At a dial
-// of 1 the window degrades to exactly this sequence, which is the sequential lane unchanged.
-const buildOrder = waves.flat();
-const excluded = withExclusions(scopeEdges(rawDeps, waves, scopes), rawExclusions, buildOrder);
-const scopeReleases = excluded.edges;
-if (excluded.added) {
-  log(`BUILD order — ${excluded.added} pair(s) of scopes may write the same declared-shared path and are ` +
-      `serialised against each other. Concurrent writers to one shared file lose each other's work, and ` +
-      `nothing downstream reports it: every fixture, lint and hook stays green over the surviving copy.`);
-}
-// THE CEILING IS REPORTED WHETHER OR NOT IT IS THE DIAL, and it is reported BEFORE anything is
-// dispatched. A ceiling under the dial is a scope-cutting fact — the substrate the contracts declared
-// does not admit the concurrency the run is paying for — and it is fixed by re-cutting scopes at the
-// board review, not by anything BUILD can do. Said here, it costs a line; found later, it is a slow
-// round indistinguishable from slow workers.
-const ceiling = Math.min(releaseCeiling(scopeReleases, buildOrder), maxParallelScopes);
-if (waves.length > 1 || excluded.added || ceiling < maxParallelScopes) {
-  const edgeCount = [...scopeReleases.values()].reduce((a, s) => a + s.size, 0);
-  log(`BUILD order — ${waves.length} dependency wave(s): ${waves.map((w) => w.map((s) => s.scope_id).join("+")).join(" → ")}` +
-      ` · ${edgeCount} release edge(s) · at most ${ceiling} scope(s) can be open at once` +
-      `${ceiling < maxParallelScopes ? ` (the window is ${maxParallelScopes}; the substrate the contracts declared is what caps it, not the dial)` : ""}`);
-}
-
-// Advisory lints at L1b. spec-lint is hard — a substrate overlap makes parallel builds unsafe, and
-// a breadboard Place with no screen builds the wrong thing; trace-lint stays advisory until
-// `covers:` is populated; hill-derive is a projection. The abort names no cause of its own: spec-lint
-// has more than one kind of red, and the detail says which.
-const specLint = await cmd(`verify spec --slug ${slug}`, "MapScopes", "spec-lint");
-if (!specLint.ok) {
-  return await withWarnings(aborted("L1b", `spec-lint reported red findings before BUILD: ${specLint.detail || `exit ${specLint.exit_code}`}`));
-}
-await advisory(`verify trace --slug ${slug} --quiet`, "MapScopes", "trace-lint");
-await advisory(`reduce hill --slug ${slug}`, "MapScopes", "hill-derive");
-
-{
-  const g = await crossGate("L1b", "MapScopes", ["proceed", "ask", "abort"], { scopes: scopes.map((s) => s.scope_id) });
-  if (g.stop) return await withWarnings(g.stop);
-}
-
-// =============================================================================================
-// ROUNDS of BUILD → GATE L2 → EVAL → GATE L3, bounded by maxRounds.
-//
-// The round loop is inlined here rather than dispatched round-by-round because a round dispatched
-// once can attempt every scope from attempt 1, while an outer loop must survive a mid-BUILD kill
-// and resume without re-work. So before opening a scope's attempt loop this file asks whether THIS
-// ROUND already has a green T0 verdict for it on disk, and skips the scope entirely when it does.
-// =============================================================================================
-const lastEval = rs.eval_rounds_done?.length ? Math.max(...rs.eval_rounds_done) : 0;
-let round = lastEval + 1;
-let verdict = null;
-// DERIVED FROM DISK AT EVERY LAUNCH, never accumulated only in memory. These two lists ARE GATE H's
-// census: `scope-hammer` is dispatched with `hammer_proposals`, and AGENTS.md makes a scope that
-// exhausted its attempt budget a queued GATE H proposal. As bare `const []` they were emptied by the
-// one event that most needs them intact — a gate PAUSE is a `return`, so the PO's answer is followed
-// by a FRESH LAUNCH whose accumulators start empty and whose round loop is then fast-forwarded past
-// the rounds that filled them. The PO was handed an empty cut list for a run that had genuinely
-// exhausted scopes. Unattended (`ci`) runs never pause, which is why no archived trace shows it.
-//
-// This file has now paid for the same class three times — `findings` in the temporal dead zone and
-// `payload.bugs` "lived in a variable, which a relaunch between two rounds resets to empty" are the
-// other two. The cure is the same each time and it is not a bigger variable: re-derive the fact.
-const allGreen = [];
-const allHammer = [];
-const allUnapplied = [];   // results on disk the single writer never applied, run-wide
-// OUTSIDE the loop, because its whole purpose is to cross a round boundary: round r's verdict is
-// what round r+1 has to act on. Declared inside, it was in the temporal dead zone at the BUILD that
-// needed it — a runtime error no static check can see, since nothing but a real second round ever
-// reaches that line.
-let findings = [];
-
-// THE ROUND THE RELAUNCH IS RESUMING INTO MAY ALREADY HAVE PASSED, and until this leg existed the
-// run had no way to find out. `round` above opens at the round AFTER the last EVAL — correct when
-// that EVAL returned FAIL, and the only reading available. But a pause at GATE L3, at QA or at
-// GATE H happens strictly AFTER `results/evaluate-r<N>.json` is written, so the relaunch opened
-// round N+1, asked the graph which scopes were green IN ROUND N+1, was told none, and re-dispatched
-// every scope through the attempt ratchet before running a second EVAL — over a verdict of PASS
-// sitting on disk. It cost a round of `maxRounds`, a full build fan-out, and a second judgement free
-// to return FAIL where the first passed. The PO answered a gate and the run went backwards.
-//
-// The verdict is an ARTIFACT, and `probe eval` reads it out of the WorkResult `reduce ingest` wrote
-// — the same probe, and deliberately not the dispatching agent's account of it, that L3 branches on
-// below. This is the fast-forward the planning phases have always had, applied to the one phase that
-// did not have it: a completed EVAL is skipped exactly like a completed ANALYZE.
-if (lastEval) {
-  phase("Eval");
-  const prior = await query(`probe eval --slug ${slug} --round ${lastEval}`, EVAL_VERDICT, "Eval", `ff:eval-r${lastEval}`);
-  if (prior?.ok && prior.overall === "PASS") {
-    verdict = "pass";
-    if (Array.isArray(prior.dimensions) && prior.dimensions.length) gradedDims = prior.dimensions;
-    round = lastEval;
-    log(`EVAL — round ${lastEval} already returned PASS on disk, fast-forwarding past the build/eval loop`);
-  }
-}
-
-// `verdict !== "pass"` is the same exit the `break` below takes when a round passes — stated here as
-// well so a RESUMED run reaches it, since the break belongs to a loop iteration a relaunch never ran.
-while (verdict !== "pass" && round <= maxRounds) {
-  phase("Build");
-  await setRunStatus("building", "Build");
-
-  // The wall-clock breaker, opt-in, checked at each round boundary. Exit 6 is "tripped": route to
-  // GATE H and ship what is green, never kill the run from outside.
-  const budget = await cmd(`verify budget --slug ${slug} --strict`, "Build", `budget:r${round}`);
-  if (budget.exit_code === 6) {
-    await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await settleAtGateH({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
-  }
-
-  log(`BUILD round ${round} — ${scopes.length} scope(s), up to ${maxParallelScopes} at once, attempt budget ${attemptBudget}`);
-  const roundGreen = [], roundHammer = [];
-
-  // ONE bounded query opens the round, instead of one probe per scope. The graph is a projection of
-  // the same verdict artifacts `probe t0` reads, so this is the identical fact asked once — which is
-  // the difference between a read model and a directory walk.
-  const g = await query(`reduce graph --slug ${slug} --subgraph run`, SUBGRAPH, "Build", `graph:r${round}`);
-  const alreadyGreen = new Set(g?.green_scopes_by_round?.[String(round)] || []);
-  if (alreadyGreen.size) log(`BUILD r${round} — ${alreadyGreen.size} scope(s) already green in the graph, skipping them`);
-
-  // REBUILD THE CENSUS FROM THE GRAPH THIS QUERY JUST RETURNED. Everything a prior launch learned is
-  // already on disk: a scope green in ANY round is green work, and a scope the run has touched but
-  // never got green is what GATE H has to be shown. One query, already made, re-read — so a relaunch
-  // after a paused gate carries the same census the launch that paused it would have.
-  const greenEver = new Set(Object.values(g?.green_scopes_by_round || {}).flat());
-  for (const sid of greenEver) if (!allGreen.includes(sid)) allGreen.push(sid);
-  for (const sid of (g?.scopes || [])) {
-    if (!greenEver.has(sid) && !allHammer.includes(sid) && scopes.some((x) => x.scope_id === sid)) allHammer.push(sid);
-  }
-
-  // SCOPES FAN OUT. A scope contract is the definition of an independent subtask — disjoint
-  // substrate, own fixtures, own ratchet — so the loop that ran them one at a time was leaving the
-  // whole point of the contract on the floor. `pipeline()` has NO barrier between its stages: a
-  // fast scope is being confirmed while a slow one is still on attempt 3. One pipeline per scope,
-  // so that property is now GLOBAL rather than per group — nothing waits on a group boundary, and
-  // the window refills the instant any leg settles.
-  //
-  // Three stages, because each answers a different question about the same scope:
-  //   check   — is it already green on disk from a killed round? (resume, no re-work)
-  //   build   — the attempt ratchet, inside the worker's own shell
-  //   confirm — MEASURED, NOT CLAIMED: the worker says green; the T0 artifact has to agree.
-  //             A green with no artifact on disk is a claim, and the evaluator that must cite that
-  //             artifact would find nothing.
-  // NEVER RETURN `null` FROM A STAGE TO MEAN "carry on". The runtime reads a null stage result as
-  // DROP THIS ITEM and skips its remaining stages — measured directly, not inferred:
-  //
-  //     stage1 → null    ⇒ stage2 ran 0/3 times, settled = [NULL, NULL, NULL]
-  //     stage1 → {…}     ⇒ stage2 ran 3/3 times
-  //
-  // This stage used to return `null` for "not green yet — stage 2, please build it", which meant
-  // every scope that was not ALREADY green was dropped before `buildScope` could run. On a fresh
-  // run that is every scope, so the round ended with 0 green and 6 queued, the inner breaker tripped
-  // and the run returned `gate_h` having dispatched no builder at all. BUILD could never dispatch;
-  // the failure looked exactly like six genuinely hard scopes.
-  const settled = await scheduleScopes(buildOrder, scopeReleases, maxParallelScopes, async (scope) => {
-    const done = await pipeline(
-      [scope],
-      async (s) => (alreadyGreen.has(s.scope_id)
-        ? { scope_id: s.scope_id, green: true, resumed: true }
-        : { scope_id: s.scope_id, pending: true }),   // not green yet → stage 2 builds it
-      async (pre, s) => (pre?.pending ? buildScope(s, round) : pre),
-      async (res, s) => {
-        if (!res) return res;
-        // THE SINGLE WRITER IS ASKED FIRST, WHATEVER THE LEG SAID. This question used to sit behind
-        // the green checks below, and the state it exists to catch — a result on disk that nothing
-        // applied — was reachable only for a scope that was already fully green. Measured live: a
-        // leg reported green with no T0 verdict at all, the T0 re-read correctly returned "not
-        // green", the round returned before this line, and the result — six tasks, two discoveries
-        // — was never read by anyone. A dead leg (`__failed`) can have left a result too. So every
-        // settled scope is asked, and what it answers travels on the result to the close, where an
-        // unapplied result is named rather than folded into "not green". Application stays gated
-        // on the green checks: ingest ticks acceptance boxes, and a result T0 never measured must
-        // not mark work green — the repair below is for a scope that IS green.
-        const applied = await query(`probe leg --slug ${slug} --scope ${s.scope_id} --round ${round}`,
-          LEGCHECK, "Build", `legcheck:${s.scope_id}-r${round}`);
-        const unapplied = applied?.closed ? [] : (applied?.unapplied || []);
-        if (res.__failed) return unapplied.length ? { ...res, unapplied } : res;
-        if (!res.green) return unapplied.length ? { ...res, unapplied } : res;
-        // THE T0 RE-READ IS SKIPPED FOR A RESUMED SCOPE; THE LEG CHECK BELOW IS NOT.
-        //
-        // `resumed` means the graph already reported this scope green for this round, so re-reading
-        // its T0 artifact would only confirm what the resume derivation just read. But these two
-        // stages answer DIFFERENT questions, and the second one is precisely the question a resumed
-        // scope is most likely to fail: a relaunch happens because the previous launch DIED, and a
-        // leg that died between writing its result and running `reduce ingest` leaves exactly this
-        // state — green T0 on disk, result never applied, board still `pending`. The short-circuit
-        // used to cover both stages, so the one scope class known to be at risk was the one class
-        // nobody asked, and the late-ingest repair nine lines below could never fire for it.
-        if (!res.resumed) {
-          const confirmed = await query(`probe t0 --slug ${slug} --scope ${s.scope_id} --round ${round}`,
-            T0CHECK, "Build", `t0confirm:${s.scope_id}-r${round}`);
-          if (!confirmed?.green) {
-            log(`BUILD r${round} — ${s.scope_id} reported green but no T0 verdict is on disk for this ` +
-                `round; treating it as not green (the evaluator cites that artifact, and it is not there).`);
-            return { ...res, green: false, reason: "reported green with no T0 verdict artifact on disk", ...(unapplied.length ? { unapplied } : {}) };
-          }
-        }
-        // AND ITS RESULT HAS TO HAVE REACHED THE BOARD. A green T0 says the worker's fixtures ran and
-        // passed; it says nothing about whether the WorkResult was applied, and this stage used to ask
-        // only the first question. Measured on a live run: a leg wrote its code, a green verdict, a
-        // kept trial row and its WorkResult, then skipped step 3 of its own script. It reported green,
-        // this stage re-verified the T0 artifact, agreed, and the round walked on with the scope's task
-        // still `pending` and zero acceptance criteria ticked — the board GATE L2 reads as 100%
-        // disagreeing with a scope that was genuinely finished.
-        //
-        // The evidence is the leg-completion row, because `reduce ingest` writes it: its presence
-        // proves the writer ran, and it is not something the leg can assert about itself.
-        for (const orderPath of unapplied) {
-          // INGESTED HERE RATHER THAN FAILED. The result is on disk and valid — re-running the leg
-          // would pay a whole attempt again for work already done. Only the single writer writes
-          // shared state, and that writer is this command; which step invokes it is not the invariant.
-          log(`BUILD r${round} — ${s.scope_id} finished without applying its own result. Ingesting it ` +
-              `here: ${orderPath}. The leg skipped its ingest step, so the board did not see work that ` +
-              `is on disk and T0-green.`);
-          // QUOTED, and that is not cosmetic. The PreToolUse envelope gate scans the `Agent` prompt as
-          // well as `Skill` args, so a bare order path interpolated into a sub-agent's prompt is read
-          // together with the trailing quote of the surrounding literal and the whole dispatch is
-          // denied — measured once already, on a path threaded through a prompt exactly like this one.
-          await advisory(`reduce ingest --order "${orderPath}"`, "Build", `late-ingest:${s.scope_id}-r${round}`);
-        }
-        if (applied && !applied.closed && !(applied.unapplied || []).length && applied.results_total === 0) {
-          // Green T0, no result envelope at all: the two records disagree about whether a leg ran, and
-          // the round must not resolve that by preferring the one that says yes.
-          log(`BUILD r${round} — ${s.scope_id} has a green T0 verdict and no WorkResult on disk for ` +
-              `this round; treating it as not green.`);
-          return { ...res, green: false, reason: "green T0 verdict with no WorkResult envelope" };
-        }
-        return res;
-      },
-    );
-    return done[0];
-  });
-
-  for (const [i, res] of settled.entries()) {
-    const scopeId = buildOrder[i].scope_id;
-    for (const p of (res?.unapplied || [])) {
-      if (!allUnapplied.includes(p)) allUnapplied.push(p);
-      log(`BUILD r${round} — ${scopeId} has a result on disk nothing applied: ${p}`);
-    }
-    // A dead builder is a SPENT ATTEMPT, not a dead run: the scope goes to GATE H's census and
-    // the round continues. Killing the run here would discard every other scope's green work.
-    if (!res || res.__failed) {
-      log(`BUILD r${round} — ${scopeId} lost its worker: ${res?.__failed || "no result"}`);
-      roundHammer.push(scopeId);
-    } else if (res.green) {
-      roundGreen.push(res.scope_id || scopeId);
-    } else {
-      roundHammer.push(res.scope_id || scopeId);
-    }
-  }
-
-  for (const sid of roundGreen) if (!allGreen.includes(sid)) allGreen.push(sid);
-  // A scope that went green this round is no longer a cut candidate, however it was queued earlier.
-  for (const sid of roundGreen) { const i = allHammer.indexOf(sid); if (i !== -1) allHammer.splice(i, 1); }
-  for (const sid of roundHammer) if (!allHammer.includes(sid) && !allGreen.includes(sid)) allHammer.push(sid);
-
-  // NOTHING GREEN AND SOMETHING QUEUED → GATE H. This used to return the literal `inner` as its breaker, and the
-  // protocol's INNER breaker is the per-scope attempt budget, which "queues a proposal, never blocks
-  // the round" — so the close named a breaker the attested census flatly denied (one attempt spent
-  // of five, `tripped: false`), and the operator was told a scope had exhausted its attempts after
-  // it used one. The word is now earned: `probe attempts` — the one derivation built so the census
-  // and the breaker cannot disagree — is asked for every queued scope, and the return names
-  // `attempt_budget` only for the scopes it says tripped, `none` when the round simply stalled.
-  if (roundGreen.length === 0 && roundHammer.length > 0) {
-    const tripped = [];
-    for (const sid of roundHammer) {
-      const census = await query(`probe attempts --slug ${slug} --scope "${sid}" --round ${round} --attempt-budget ${attemptBudget}`,
-        ATTEMPTS, "Build", `census:${sid}-r${round}`);
-      if (census?.tripped) tripped.push(sid);
-    }
-    await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await settleAtGateH({
-      status: "gate_h", breaker: tripped.length ? "attempt_budget" : "none", stalled: "no_green",
-      tripped_scopes: tripped, unapplied_results: allUnapplied,
-      hammer_proposals: allHammer, green_scopes: allGreen,
-    });
-  }
-
-  // ---- ROUND BUILD GATE — the feature builds and launches, measured before anyone is asked --------
-  //
-  // T0 is per scope and inside the scope's substrate; nothing in it proves the FEATURE compiles or
-  // starts. Measured on a live mobile run: 30/30 T0 trials green on the first try (TypeScript
-  // stand-ins, structural greps, a suite wrapper that never compiled its sources) while the
-  // ledger's own `run_cmd` failed, and three rounds of EVAL then graded a blank screen because
-  // nothing in the loop had ever installed or launched the app. `verify build` runs the ledger's
-  // `run_cmd`, then the profile's `build_probe` and `launch_probe`, and writes one artifact
-  // `reduce hill` and `harness compile` both read — so a red gate moves no dot downhill and becomes
-  // the next round's bug list without this script carrying anything across the round boundary.
-  //
-  // Exit 3 is "nothing declared" — the honest state of a run whose L0 pinned no run command and
-  // whose profile names no probe — and it is logged, not treated as green. Any other non-0/1 exit
-  // means the gate itself did not run, and the run says so rather than inferring a verdict.
-  const gate = await cmd(`verify build --slug ${slug} --round ${round}`, "Build", `build-gate:r${round}`);
-  let buildGate = "green";
-  if (gate.exit_code === 1) {
-    buildGate = "red";
-    log(`BUILD GATE r${round} — RED${gate.detail ? `: ${gate.detail}` : ""}. EVAL will not run over a feature ` +
-        `that does not build or launch; the failing step is compiled into round ${round + 1}'s orders as bugs.`);
-  } else if (gate.exit_code === 3) {
-    buildGate = "undeclared";
-    log(`BUILD GATE r${round} — nothing declared: no run_cmd in the run ledger and no build_probe or ` +
-        `launch_probe in project-profile.md. EVAL runs over an unproven build; pin them at GATE L0.`);
-  } else if (gate.exit_code !== 0) {
-    buildGate = "unknown";
-    log(`BUILD GATE r${round} — the gate itself did not run (exit ${gate.exit_code}` +
-        `${gate.detail ? `: ${gate.detail}` : ""}). Treated as undeclared, not as green.`);
-  }
-
-  // Trace-lint runs a SECOND time here, and this is the pass that can see anything. At L1b the
-  // scopes' files do not exist yet, so per-scope reachability measures an empty set and its warning
-  // cannot fire. After the round's build gate the code is on disk, which is exactly when "this
-  // scope's fixture is green and none of its code is in the compiled set" becomes a checkable fact
-  // — the shape that once left three scopes green while their files never compiled. Advisory, like
-  // the L1b pass: it overwrites the same projection with a later and better-informed one.
-  await advisory(`verify trace --slug ${slug} --quiet`, "Build", `trace-lint:r${round}`);
-  await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-  {
-    const g = await crossGate("L2", "Build", ["proceed", "ask", "abort"],
-      { round, green_scopes: roundGreen, hammer_proposals: roundHammer, build_gate: buildGate });
-    if (g.stop) return await withWarnings(g.stop);
-  }
-
-  // ---- EVAL — exactly one feature-level pass per round (the single-judge invariant) ------------
-  phase("Eval");
-  await setRunStatus("evaluating", "Eval");
-  if (buildGate === "red") {
-    // A red gate outranks --no-eval: skipping the judge is the operator's call, but the build failing
-    // is a measured fact, and a round that does not compile has nothing for anyone to pass.
-    verdict = "fail";
-    findings = [];
-    log(`EVAL r${round} — not dispatched: the round build gate is red. The judge grades a running ` +
-        `feature; this one does not build or launch. Round ${round + 1} fixes the gate's failing step.`);
-  } else if (args.noEval) {
-    log("EVAL — skipped (--no-eval)");
-    // references/protocol.md's own words for this, twice: a run --no-eval ships records
-    // `not-evaluated` — "recorded plainly — never silently upgraded [to `pass`]". Nothing verified
-    // the feature beyond task-executor's own per-AC evidence checks, and the report this run
-    // freezes at GATE L4 has to say that as plainly as the gate block already does.
-    verdict = "not-evaluated";
-  } else {
-    const { r: e, v: ev } = await sendBackOnce(
-      (note) => worker({
-        skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval",
-        label: note ? `eval:r${round}:again` : `eval:r${round}`, model: evalModel, round,
-        // No `t0_artifacts` here, deliberately: `harness compile` derives them from the round's green
-        // T0 verdicts on disk, for every lane — this script could only name paths it was told about.
-        // The same goes for `build_gate` and `launch_cmd`: compile reads them off the round's gate
-        // artifact and the project profile, so the judge gets the launch evidence without this script
-        // having to carry it.
-        payload: { ...(evalDims ? { dimensions: evalDims } : {}), run_cmd: rs.run_cmd, round },
-        extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself." + note,
-      }),
-      // The pass/fail branch is decided from the WorkResult on disk, not from the dispatching
-      // agent's own summary of it (`e.overall`) — see EVAL_VERDICT's comment for why.
-      (suffix) => query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}${suffix}`),
-      // A verdict the kernel refused — grouped rows, a missing citation — is correctable, not a dead judge.
-      (v) => !v.ok && !!v.overall && !!v.reason,
-      `EVAL r${round}`,
-    );
-    if (e.__failed) return await withWarnings(diedAt("L3", e));
-    if (!ev) return await withWarnings(diedAt("L3", nullFail(`verdict:r${round}`)));
-    // A round with no verdict to act on is NOT a dead worker. An evaluator that refused the round
-    // wrote a result saying why, and `probe eval` carries it as `reason`; reported as "died after
-    // retries", the one sentence naming the cause stayed in a file nobody was pointed at.
-    if (!ev.ok || !ev.overall) {
-      return await withWarnings(diedAt("L3", { __failed: `verdict:r${round}: no verdict this round can act on — ${ev.reason || `status ${ev.status || "unknown"}`}` }));
-    }
-    verdict = ev.overall === "PASS" ? "pass" : "fail";
-    if (Array.isArray(ev.dimensions) && ev.dimensions.length) gradedDims = ev.dimensions;
-    findings = e.findings || [];
-  }
-
-  // ---- REFUTE WAVE (opt-in) — one independent skeptic per FAIL finding, BEFORE it costs a whole
-  // fix round. Perspective-diverse by prompt: the refuter is told to try to refute and to default to
-  // "real" when it cannot. A pure addition; off unless args.adversarialVerify.
-  if (verdict === "fail" && args.adversarialVerify && findings.length) {
-    phase("Refute");
-    const checks = await parallel(findings.map((f) => () =>
-      agent(
-        `A single judge marked this acceptance criterion FAILED for slug "${slug}":\n` +
-        `  criterion: ${f.criterion}\n  evidence: ${f.evidence}\n\n` +
-        `Independently try to REFUTE the failure by exercising the running feature yourself. ` +
-        `Return refuted=true ONLY if you can show it actually passes; otherwise refuted=false.`,
-        { model: evalModel, phase: "Refute", label: `refute:${f.id}`, schema: REFUTATION },
-      )));
-    const overturned = new Set(checks.filter(Boolean).filter((c) => c.refuted).map((c) => c.id));
-    if (overturned.size) log(`REFUTE — ${overturned.size}/${findings.length} FAIL finding(s) overturned by an independent skeptic`);
-    if (overturned.size === findings.length) {
-      verdict = "pass";
-      log("REFUTE — every finding was overturned; treating this round as PASS");
-    }
-  }
-
-  await advisory(`reduce graph --slug ${slug}`, "Eval", `graph:eval-r${round}`);
-  await advisory(`reduce hill --slug ${slug}`, "Eval", "hill-derive");
-  const g3 = await crossGate("L3", "Eval", ["loop", "stop", "ask"], { round, verdict, build_gate: buildGate });
-  if (g3.stop) return await withWarnings(g3.stop);
-
-  // "not-evaluated" (--no-eval) ships exactly like "pass" — protocol.md: the run "goes straight to
-  // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
-  if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
-  if (g3.decision === "stop" || round >= maxRounds) {
-    return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
-  }
-  round += 1;
-}
-
-if (verdict !== "pass" && verdict !== "not-evaluated") {
-  return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
-}
-
-// ---- QA (post-PASS, pre-ship) — a level-up, never a gate. `--no-qa` answers it "skip". --------
-phase("QA");
-let qaFindings = 0;
-const qaG = await crossGate("QA", "QA", ["run", "skip", "ask"], { round, verdict });
-if (qaG.stop) return await withWarnings(qaG.stop);
-const qaRan = !args.noQa && qaG.decision === "run";
-// What QA amounted to, from the hunt's own record: `run` only when a charter ran. The QA gate's `run`
-// is the decision to dispatch, and a dispatched hunt that drove nothing is `not-hunted`.
-let qaState = "skipped";
-if (qaRan) {
-  const { r: q, v: hv } = await sendBackOnce(
-    (note) => worker({
-      skill: "qa-edge-hunter", operation: "hunt", schema: QA_REPORT, phase: "QA", label: note ? "hunt:again" : "hunt", model: qaModel,
-      payload: { feature: slug, spec_folder: specFolder, app_url: rs.app_url, round },
-      extra: "Exploratory hunt over the shipped feature. No verdict and no score — findings only, each with a repro." + note,
-    }),
-    (suffix) => query(`probe hunt --slug ${slug}`, HUNT_OUTCOME, "QA", `hunt-outcome${suffix}`),
-    (v) => !v.ok && v.status === "done" && !!v.reason,
-    "QA hunt",
-  );
-  // QA is a level-up: losing its worker costs the findings, not the run.
-  if (q.__failed) log(`QA — the hunt lost its worker: ${q.__failed}. Shipping without QA findings.`);
-  else {
-    qaFindings = hv && Number.isInteger(hv.findings) ? hv.findings : q.findings_count;
-    qaState = hv?.qa === "run" ? "run" : "not-hunted";
-  }
-}
-
-// ---- GATE H — delegated to scope-hammer (census, baseline comparison, cut list) ----------------
-phase("Ship");
-const h = await worker({
-  skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
-  payload: { feature: slug, qa_findings: qaFindings, hammer_proposals: allHammer },
-  extra: HAMMER_EXTRA,
-});
-if (h.__failed) return await withWarnings(diedAt("H", h));
-if (h.verdict === "cannot-ship") {
-  return await withWarnings(aborted("H", `scope-hammer: CANNOT SHIP — ${h.cut_list.join(", ") || "a must-have failed"}`));
-}
-
-{
-  const g = await crossGate("H", "Ship", ["accept-cut-list", "ship-all", "ask"], { verdict: h.verdict, cut_list: h.cut_list });
-  if (g.stop) return await withWarnings(g.stop);
-}
-
-// The frozen report's own verdict line has to say what actually happened — a `--no-eval` run
-// verified nothing beyond task-executor's per-AC checks, and `reduce ship` already accepts
-// "not-evaluated" as a real verdict (its own usage string, and `generate()`'s no-artifact
-// default). Hardcoding PASS here is exactly the silent upgrade protocol.md's Rules forbid.
-const shipVerdict = verdict === "not-evaluated" ? "not-evaluated" : "PASS";
-const ship = await cmd(`reduce ship --slug ${slug} --verdict ${shipVerdict} --qa ${qaState}`, "Ship", "ship-report");
-// GATE L4 HAS A CALL SITE. It used to be a line of prose in the tech lead's references — "resolve
-// the gate itself before any of the above" — and a run reached its ship decision with no ledger row
-// for it. The resolver narrows `ship` on the census artifact the hammer just wrote.
-{
-  const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: shipVerdict, census: h.verdict, cut_list: h.cut_list });
-  if (g.stop) return await withWarnings(g.stop);
-  if (g.decision === "hold") return await withWarnings({ status: "aborted", aborted_at: "L4", reason: `GATE L4 answered "hold" (census ${h.verdict}, verdict ${shipVerdict})` });
-}
-await advisory(`report export --slug ${slug}`, "Ship", "export-run");
-// The run's own concurrency, printed once where the records are complete and before the next run
-// supersedes the trace. It is a projection over `receipts/dispatch.jsonl` and `legs.jsonl`, so it
-// asserts nothing and gates nothing — and when those records cannot support a figure it says so
-// rather than printing a plausible one.
-await advisory(`probe concurrency --slug ${slug} --format table`, "Ship", "concurrency");
-await setRunStatus("shipped", "Ship");
-
-// The dimensions this run did NOT evaluate, so GATE L4 can say what "shipped" does not cover.
-const ALL_DIMS = ["spec-conformance", "tdd-surface", "integration", "completeness",
-                  "test-surface-conformance", "security", "performance"];
-
-return await withWarnings({
-  status: "shipped",
-  // The real verdict this run reached — "pass" or, over a --no-eval run, "not-evaluated". GATE L4's
-  // own sign-off block reads this field verbatim (SKILL.md Step 4); hardcoding "pass" here told a
-  // human answering that gate the run was graded when it never was.
-  verdict,
-  rounds_used: round,
-  dims_evaluated: gradedDims,
-  dims_not_evaluated: ALL_DIMS.filter((d) => !gradedDims.includes(d)),
-  qa_findings: qaFindings,
-  qa: qaState,
-  report: REPORT_PATH,
-});
-
-// =============================================================================================
-// buildScope — one scope's full attempt ratchet, as a single worker leg.
-//
-// The ratchet lives inside the worker's own shell rather than in this control script because each
-// attempt is implement → `harness verify t0`, and both halves need a real filesystem and a real
-// git. The worker reports only the outcome the round loop branches on.
-// =============================================================================================
-async function buildScope(scope, roundNo) {
-  // THE VERDICT'S BUGS REACH THIS LEG THROUGH ITS ORDER, NOT THROUGH THIS FUNCTION.
-  //
-  // `WorkOrderPayload.bugs` is "the EVAL report's bug entries for this task — touch nothing else",
-  // and AGENTS.md states the regression rule as "bugs + full Test Surface of touched UC". Nothing
-  // populated it, so a round r+1 leg was dispatched with no idea the judge had cited anything: it
-  // re-ran T0, found the scope still green, and reported done. Measured — EVAL returned FAIL naming
-  // five defects at file:line; round 2 kept all six trees and changed none of them, and every bug
-  // re-probed identically.
-  //
-  // Threading them from here was tried first and cannot work, twice over: a build order overrides
-  // the compile line (below), and only the GENERIC line serialises `--payload`, so the field was
-  // built and dropped; and the value lived in a variable, which a relaunch between two rounds
-  // resets to empty. `harness compile` reads them off the ledgered verdict instead — see
-  // `verdictBugs` — so a fresh round and a resumed one take the identical path.
-  //
-  // `digested_errors` could not cover this: it carries AEGIS triples from a RED T0, and a scope
-  // whose fixtures pass while its behaviour contradicts the spec has no red trial to digest. That
-  // gap is why EVAL is a separate layer, so the channel out of it has to be separate too.
-  return worker({
-    // No `operation` either, and for the same reason as the payload: the compile override below
-    // replaces the whole command, so a declared operation here would be discarded — and it would
-    // now be WRONG as well as dead. `harness compile` derives it: a round carrying cited defects
-    // compiles as `fix`, which is the operation task-executor's own contract binds `payload.bugs`
-    // to, and a round with nothing cited stays `execute`.
-    skill: "task-executor", schema: SCOPE_RESULT, phase: "Build",
-    label: `build:${scope.scope_id}-r${roundNo}`,
-    // A build order is addressed by scope + round + attempt, never by operation: the attempt number
-    // is part of its identity, so there is one order per attempt and the generic slug form cannot
-    // express it. NOTE this override is why no `payload` is passed — it would be discarded.
-    compile: `compile --scope "${scope.path}" --round ${roundNo} --attempt 1`,
-    extra:
-      (roundNo > 1
-        ? `THIS MAY BE A FIX ROUND. If your compiled order carries \`payload.bugs\`, the evaluator ` +
-          `returned FAIL last round and those are the defects it cited against files you own — each ` +
-          `with the criterion it broke and a file:line. Fix exactly those and touch nothing else. ` +
-          `They are spec-conformance defects, so T0 already passes and will keep passing whether or ` +
-          `not you fix them: a green T0 is NOT evidence you are done this round, and re-running the ` +
-          `fixtures cannot tell you. Read the cited lines against the committed spec, change them, ` +
-          `and keep T0 green. An entry marked \`unowned\` cites no file any scope owns — fix it only ` +
-          `if it falls inside your substrate. `
-        : "") +
-      `Re-compile the order for every attempt after the first, with --attempt <n>. An attempt will ` +
-      `be REFUSED (exit 3) while the previous one is unanswered — dispatched with no leg row and no ` +
-      `WorkResult — because grading a tree the previous attempt may still be writing counts an ` +
-      `attempt nobody ran. Let it come back rather than opening the next one. ` +
-      `Run the attempt ratchet for THIS scope only: up to ${attemptBudget} attempts of implement → ` +
-      `\`node "${KERNEL}" verify t0 "${scope.path}" --round ${roundNo} --attempt <n>\`, each scored against ` +
-      `the last kept trial. Stop on the first green T0, or when the attempt budget or the stagnation ` +
-      `breaker trips. Write only inside this scope's substrate whitelist — the sandbox hook enforces it. ` +
-      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path — ` +
-      `attempts_used is what the attested channels carry, not a count of the orders you compiled.`,
-  });
-}