shapeup-sdlc 3.2.0 → 3.4.0

package/kernel/lib/contract.mjs

@@ -172,7 +172,16 @@ export function coerce(raw) {
   // A LIST IS TESTED BEFORE THE QUOTES ARE STRIPPED. `"[a, b]"` is a quoted STRING; stripping first
   // would turn it into a list and change its type on a round-trip.
   if (/^\[.*\]$/.test(trimmed)) return splitList(trimmed.slice(1, -1));
+  // A QUOTED SCALAR IS A STRING, VERBATIM — the same rule the list test above already applies, one
+  // step further in. Unquoting FIRST and then testing the bareword literals meant the quotes bought
+  // nothing: `"false"` unwrapped to `false` and then matched the boolean test, so a cell whose value
+  // is genuinely the word "false" re-read as the boolean. Same for `"true"`, `"123"`, `"~"` and `""`
+  // — a string changed TYPE on a round trip, silently, the first time its contract was rewritten.
+  // Quoting is how an author says "this is text"; honouring that is what makes the round trip total.
+  const quoted = trimmed.length >= 2 && (trimmed[0] === '"' || trimmed[0] === "'")
+    && trimmed[trimmed.length - 1] === trimmed[0];
   const v = unquote(trimmed);
+  if (quoted) return v;
   if (v === "true") return true;
   if (v === "false") return false;
   if (v === "~" || v === "null" || v === "") return null;
@@ -192,10 +201,17 @@ export function uncoerce(v) {
   // side instead of the reader's.
   if (Array.isArray(v)) return `[${v.map((x) => (/[,"]/.test(String(x)) ? JSON.stringify(String(x)) : String(x))).join(", ")}]`;
   const s = String(v);
-  // A scalar that itself begins AND ends with a quote is indistinguishable, once written, from a
-  // quoted scalar — so emit it in the JSON form the reader unwraps exactly. Without this the round
-  // trip loses the value's own outer quotes, which is the same shredding as the reader's half.
-  if (s.length >= 2 && (s[0] === '"' || s[0] === "'") && s[s.length - 1] === s[0]) return JSON.stringify(s);
+  // THE READER IS THE ORACLE. Anything whose plain text would come back as a DIFFERENT VALUE goes
+  // out quoted — and the only honest test of that is to ask `coerce` itself.
+  //
+  // This subsumes the older rule (a scalar that begins AND ends with a quote) and closes the family
+  // it missed: a string whose text is a bareword literal changed TYPE on a round trip. The string
+  // "false" re-read as the boolean false, "123" as the number 123, "[a, b]" as a two-member list,
+  // "~" as null. Each is a value an author can legitimately write in a cell, and each silently
+  // became something else the first time the contract was rewritten. `coerce(s) !== v` catches all
+  // of them at once and leaves every value that already round-trips untouched — a path, a sentence,
+  // a real boolean, a real number.
+  if (coerce(s) !== v) return JSON.stringify(s);
   return s;
 }
 

package/kernel/lib/paths.mjs

@@ -111,7 +111,7 @@ export const requirements = (cwd, slug) => join(sharedRoot(cwd, slug), "requirem
 export const hillDir = (cwd, slug) => join(sharedRoot(cwd, slug), "hill");
 /** The frozen ship report, written once at GATE L4. */
 export const report = (cwd, slug) => join(sharedRoot(cwd, slug), "REPORT.md");
-/** Team-shared coaching rules, read back by the three coachable workers. */
+/** Team-shared coaching rules, read back by the coachable workers and by the tech lead at GATE L0. */
 export const knowledgeBaseDir = (cwd) => join(sharedDir(cwd), "knowledge-base");
 /** One worker's coaching file. */
 export const knowledgeBase = (cwd, skill) => join(knowledgeBaseDir(cwd), `${skill}.md`);
@@ -208,6 +208,16 @@ export const trials = (cwd, slug) => join(t0Dir(cwd, slug), "trials.jsonl");
 export const gates = (cwd, slug) => join(localRoot(cwd, slug), "gates.jsonl");
 /** Finished-scope fixture registry for the seesaw regression check. */
 export const seesawRegistry = (cwd, slug) => join(localRoot(cwd, slug), "seesaw", "registry.json");
+/**
+ * The round build gate's verdicts — one immutable artifact per gate run, `r<N>-t<T>.json`.
+ *
+ * A separate directory from `t0/`, on purpose. A T0 verdict is one scope's fixtures inside that
+ * scope's substrate; this is the FEATURE's build, launched the way the ledger's `run_cmd` and the
+ * profile's probes say a user would, and it belongs to no scope. Written by `harness verify build`,
+ * read by `reduce hill` (a green T0 in a round whose build is red moves no dot) and by
+ * `harness compile` (a red gate is the next round's bug list).
+ */
+export const roundBuildDir = (cwd, slug) => join(localRoot(cwd, slug), "build");
 /** Evaluator output — report, evidence, verdict ledger. */
 export const evaluationDir = (cwd, slug) => join(localRoot(cwd, slug), "evaluation");
 /** The workflow launcher's run directory — `journal.jsonl` and the launch `result.json`. */
@@ -385,7 +395,7 @@ export const globShared = (slug, ...parts) => [SHARED, slug, ...parts].join("/")
 
 /**
  * The coaching file a coachable worker reads, as a repo-relative path for the WorkOrder payload.
- * @param {string} skill - Worker name (task-executor | ba-pitch-analyzer | qa-edge-hunter).
+ * @param {string} skill - A coachable worker name (`COACHABLE` in compile.mjs), or `tech-lead`.
  * @returns {string} e.g. `shapeup/knowledge-base/task-executor.md`.
  */
 export const relKnowledgeBase = (skill) => [SHARED, "knowledge-base", `${skill}.md`].join("/");

package/kernel/probe/owner.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// probe owner — which scope owns a path, derived from the contracts and nothing else.
+//
+// WHY THIS IS A QUERY AND NOT A SENTENCE. GATE H's census stated ownership facts without reading
+// the contracts: a ship report said no scope owned the app's page files, while the composition
+// root's committed substrate listed `pages/**` in plain sight. The real gap was elsewhere (a route
+// table naming files nobody had written), and the report pointed the PO at a scope cut that was
+// not the problem. A census that narrates ownership from memory is a census that can be wrong in
+// exactly the way that looks most authoritative.
+//
+// Ownership already has ONE mechanical definition in this plugin — the substrate the sandbox hook
+// enforces, and the election `harness compile` runs to address a cited bug to the scope that may
+// write the file (`electOwner`). This probe exposes that same answer on the command line, so a
+// worker that needs to say "no scope owns X" can cite the query instead of asserting it.
+//
+// With no `--path`, the input set is what a census would ask about anyway: every engine and
+// entry-point call site the wiring map names, plus the profile's entry point. A row with no
+// writers is an UNOWNED SEAM — the one kind of gap the disjointness lint cannot see, since DISJOINT
+// fails two owners and nothing fails zero.
+//
+// Usage:
+//   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe owner --slug <slug> [--path <p>]... [--format json|table] [--cwd <dir>]
+//
+// Exit code: 0 = answered, 2 = bad argv or no readable scope contracts.
+
+import { existsSync } from "node:fs";
+import { resolve, join } from "node:path";
+import { runArgs, isMain } from "../lib/argv.mjs";
+import { wiringMap, projectProfile } from "../lib/paths.mjs";
+import { readContract, WIRING_MAP, PROJECT_PROFILE } from "../lib/contract.mjs";
+import { scopeSubstrates, electOwner, bugLocations } from "../compile.mjs";
+import { matchesAny } from "../../hooks/sandbox-guard.mjs";
+
+/**
+ * Ownership of one repo-relative path under a set of scope substrates.
+ *
+ * @param {string} path - Repo-relative POSIX path.
+ * @param {Array<{scope_id:string, allowed:string[], shared:string[]}>} scopes - From
+ *   {@link scopeSubstrates}.
+ * @param {string} [cwd] - Project root; when given, `exists` says whether the path is on disk.
+ * @returns {{path:string, owner:(string|null), writers:string[], shared_with:string[], exists:(boolean|null)}}
+ *   `owner` is the elected fixer (exclusive first, lowest id among equals); `writers` every scope
+ *   whose substrate admits the path; `shared_with` the writers that declare it shared. Empty
+ *   `writers` means no scope may write the file — an unowned path. `exists` is the other half a
+ *   census needs: a seam that is owned but not on disk is a route to a file nobody wrote.
+ */
+export function ownership(path, scopes, cwd = null) {
+  const rel = String(path).replace(/^\.\//, "");
+  const writers = (scopes || []).filter((s) => matchesAny(rel, s.allowed)).map((s) => s.scope_id).sort();
+  const shared = (scopes || []).filter((s) => matchesAny(rel, s.shared || [])).map((s) => s.scope_id).sort();
+  return { path: rel, owner: electOwner(rel, scopes), writers, shared_with: shared, exists: cwd ? existsSync(join(cwd, rel)) : null };
+}
+
+/**
+ * The paths a census asks about when none are given: the wiring map's engines and entry call
+ * sites, and the profile's entry point. Only tokens that look like files are kept — an entry call
+ * site is prose around a path (`src/server.ts — POST /checkout route`), and the path is what the
+ * substrate can answer for.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {Array<{path:string, cited_by:string}>} Distinct paths with where each was named.
+ */
+export function seamPaths(cwd, slug) {
+  const out = [];
+  const seen = new Set();
+  const add = (p, by) => { if (p && !seen.has(p)) { seen.add(p); out.push({ path: p, cited_by: by }); } };
+  const wm = wiringMap(cwd, slug);
+  if (existsSync(wm)) {
+    const entries = readContract(wm, WIRING_MAP)?.contract?.entries || [];
+    for (const e of entries) {
+      for (const p of bugLocations({ location: e.engine })) add(p, `${e.use_case || "?"} engine`);
+      for (const p of bugLocations({ location: e.entry_call_site })) add(p, `${e.use_case || "?"} entry_call_site`);
+    }
+  }
+  const pp = projectProfile(cwd, slug);
+  if (existsSync(pp)) {
+    const ep = readContract(pp, PROJECT_PROFILE)?.contract?.entry_point;
+    for (const p of bugLocations({ location: ep })) add(p, "project-profile entry_point");
+  }
+  return out;
+}
+
+/**
+ * Render the report as a fixed-width table for a human reading a gate block.
+ * @param {object} r - The report {@link cli} prints.
+ * @returns {string} One header line and one row per path.
+ */
+export function renderTable(r) {
+  const rows = r.paths.map((p) => [p.path, p.owner || "—", p.writers.join(",") || "UNOWNED", p.exists === null ? "?" : p.exists ? "yes" : "MISSING", p.cited_by || ""]);
+  const head = ["path", "owner", "writers", "on disk", "cited by"];
+  const w = head.map((h, i) => Math.max(h.length, ...rows.map((row) => String(row[i]).length)));
+  const line = (row) => row.map((c, i) => String(c).padEnd(w[i])).join("  ").trimEnd();
+  return [line(head), line(w.map((n) => "-".repeat(n))), ...rows.map(line),
+    "", `${r.scopes} scope(s) read · ${r.unowned.length} unowned path(s)${r.unowned.length ? `: ${r.unowned.join(", ")}` : ""}` +
+    ` · ${r.missing.length} not on disk${r.missing.length ? `: ${r.missing.join(", ")}` : ""}`].join("\n");
+}
+
+export const ARGV_SPEC = {
+  usage: "harness.mjs probe owner --slug <slug> [--path <p>]... [--format json|table] [--cwd <dir>]",
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  slug: { type: "str", required: true },
+  path: { type: "str", multiple: true },
+  format: { type: "enum", values: ["json", "table"], default: "json" },
+  cwd: { type: "path" },
+};
+
+/**
+ * Answer "which scope owns this path" from the committed contracts.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {Promise<void>} Exits 0 with the report, 2 when no scope contract can be read.
+ */
+export async function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = resolve(args.cwd || process.cwd());
+  const scopes = scopeSubstrates(cwd, args.slug);
+  if (!scopes.length) {
+    console.error(`probe owner: no readable scope contract for ${args.slug} — ownership is a property of the contracts, and there are none to read`);
+    process.exit(2);
+  }
+  const asked = (args.path || []).map((p) => ({ path: p, cited_by: "--path" }));
+  const inputs = asked.length ? asked : seamPaths(cwd, args.slug);
+  const paths = inputs.map((i) => ({ ...ownership(i.path, scopes, cwd), cited_by: i.cited_by }));
+  const report = {
+    slug: args.slug,
+    scopes: scopes.length,
+    source: asked.length ? "--path" : "wiring-map + project-profile",
+    paths,
+    unowned: paths.filter((p) => p.writers.length === 0).map((p) => p.path),
+    // Owned but absent: the wiring names a file nobody wrote — the gap a census reads as
+    // "unowned" when it does not check the disk.
+    missing: paths.filter((p) => p.exists === false).map((p) => p.path),
+  };
+  console.log(args.format === "table" ? renderTable(report) : JSON.stringify(report, null, 2));
+  process.exit(0);
+}
+
+if (isMain(import.meta.url)) cli(process.argv.slice(2));

package/kernel/probe/stats.mjs

@@ -20,7 +20,7 @@
 // Usage: node `harness probe stats` [--cwd <dir>] [--metrics-dir <dir>] [--slug <slug>] [--format json|table]
 
 import { readFileSync, readdirSync, existsSync } from "node:fs";
-import { resolve, join } from "node:path";
+import { resolve, join, relative, sep } from "node:path";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { localDir, decisions as decisionsPath, metricsDir as metricsDirPath, SHARED } from "../lib/paths.mjs";
@@ -283,6 +283,49 @@ export function readDecisions(cwd) {
   } catch { return []; }
 }
 
+/**
+ * Decision ledgers that landed OUTSIDE the project root — the trace a hook left when it filed
+ * under the shell's working directory instead of the project's.
+ *
+ * The hooks now resolve the root themselves, so a stray is either history from before that fix or
+ * evidence the resolver missed a layout; either way the rows in it are missing from the ledger
+ * `--hooks` reads, and a count that silently omits them is the inert-layer signature this report
+ * exists to expose. Bounded walk: depth-limited, skipping dependency and VCS directories.
+ *
+ * @param {string} cwd - Project root.
+ * @param {number} [maxDepth=8] - How deep to look.
+ * @returns {Array<{path:string, rows:number}>} Each stray ledger and its row count.
+ */
+export function strayLedgers(cwd, maxDepth = 8) {
+  const SKIP = new Set(["node_modules", ".git", ".hg", ".svn", ".hvigor", ".idea", "dist", "build", "target", ".next", ".cache"]);
+  const out = [];
+  const home = decisionsPath(cwd);
+  /**
+   * Visit one directory level.
+   * @param {string} dir - Directory to scan.
+   * @param {number} depth - Its depth below `cwd`.
+   * @returns {void}
+   */
+  const walk = (dir, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (!e.isDirectory() || SKIP.has(e.name)) continue;
+      const sub = join(dir, e.name);
+      const candidate = decisionsPath(sub);
+      if (candidate !== home && existsSync(candidate)) {
+        let rows = 0;
+        try { rows = readFileSync(candidate, "utf8").split("\n").filter((l) => l.trim()).length; } catch { /* unreadable */ }
+        out.push({ path: relative(cwd, candidate).split(sep).join("/"), rows });
+      }
+      walk(sub, depth + 1);
+    }
+  };
+  walk(cwd, 1);
+  return out;
+}
+
 /**
  * Render a StatsReport as a human-readable fixed-width table.
  * @param {object} report - A validated StatsReport (see {@link aggregate}).
@@ -382,6 +425,10 @@ function renderHooks(r) {
     lines.push("", "(zero rows: either no hook has run in this checkout, or the enforcement layer is inert —");
     lines.push(" and that distinction is exactly what this ledger exists to make.)");
   }
+  if (Array.isArray(r.stray_ledgers) && r.stray_ledgers.length) {
+    lines.push("", `stray ledgers: ${r.stray_ledgers.length} decisions.jsonl outside the project root — rows not counted above:`);
+    for (const s of r.stray_ledgers) lines.push(`  ${s.path}  (${s.rows} row(s))`);
+  }
   return lines.join("\n");
 }
 
@@ -403,7 +450,7 @@ export async function cli(rawArgv) {
   if (args.ratchet || args.hooks) {
     const out = {};
     if (args.ratchet) out.ratchet = ratchetReport(readAllTrials(cwd, args.slug ?? null));
-    if (args.hooks) out.hooks = hooksReport(readDecisions(cwd));
+    if (args.hooks) out.hooks = { ...hooksReport(readDecisions(cwd)), stray_ledgers: strayLedgers(cwd) };
     if (format === "table") {
       const parts = [];
       if (out.ratchet) parts.push(renderRatchet(out.ratchet));

package/kernel/reduce/board.mjs

@@ -68,7 +68,11 @@ const listField = (fm, key) => {
  */
 export function parseBoard(tasksDir) {
   if (!existsSync(tasksDir)) return [];
-  return readdirSync(tasksDir)
+  // SORTED, because `criticalPath` breaks ties on strict `>` and therefore keeps the FIRST chain it
+  // meets among equal-hours chains. Directory order is a filesystem detail (APFS happens to return
+  // sorted; ext4's hash order does not, and neither does a rename), so an unsorted read made a
+  // derived value depend on which machine ran it. Every sibling reader in the kernel already sorts.
+  return readdirSync(tasksDir).sort()
     .filter((f) => /^TASK-[\w.-]+\.md$/i.test(f))
     .map((f) => {
       const body = readFileSync(join(tasksDir, f), "utf8");
@@ -130,10 +134,30 @@ export function criticalPath(tasks) {
     }
     return (memo[id] = { hours: best.hours + t.hours, chain: [...best.chain, id] });
   };
+  // TIES BREAK ON CONTENT, NOT ON ARRIVAL. `>` alone keeps whichever equal-hours chain is MET
+  // FIRST, which is input order — so this function returned a different critical path for the same
+  // board depending only on how its task list happened to be ordered. Measured: two disjoint
+  // 5-hour chains, five permutations of one list, two different answers.
+  //
+  // Sorting the reader that feeds it (`parseBoard`) makes the input stable and therefore hides this
+  // on any one machine, but it leaves the ORDER-DEPENDENCE in place one call up — a caller with its
+  // own ordering, or a future second reader, re-opens it. A derived value has to be a function of
+  // the board, not of the walk that produced it, so the tie is resolved here: same hours, then the
+  // lexicographically smaller chain. Deterministic on every machine and for every caller.
+  /**
+   * Is chain `c` a better critical path than the incumbent `b`?
+   * @param {{hours:number, chain:string[]}} c - The candidate chain.
+   * @param {{hours:number, chain:string[]}} b - The incumbent best.
+   * @returns {boolean} True when `c` has more hours, or ties on hours and sorts first by chain
+   *   content — so the answer is a function of the board rather than of the iteration order.
+   */
+  const better = (c, b) => c.hours > b.hours
+    || (c.hours === b.hours && c.chain.length > 0
+        && (b.chain.length === 0 || c.chain.join("\u0000") < b.chain.join("\u0000")));
   let best = { hours: 0, chain: [] };
   for (const t of tasks) {
     const c = longest(t.id);
-    if (c.hours > best.hours) best = c;
+    if (better(c, best)) best = c;
   }
   return best;
 }

package/kernel/reduce/graph.mjs

@@ -43,7 +43,7 @@ export const WORK_NODES = ["Run", "Order", "Result", "Verdict", "Trial", "GateDe
 export const DOMAIN_NODES = ["Scope", "UseCase", "Requirement", "Seam"];
 
 /** Edge types. Each names a direction that is meaningful to read backwards. */
-export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM"];
+export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
 
 /**
  * Read the graph as a log and fold it into nodes and edges.
@@ -63,7 +63,10 @@ export function readGraph(cwd, slug) {
     let row;
     try { row = JSON.parse(line); } catch { continue; }   // a torn line proves nothing; skip it
     lines++;
-    if (row.k === "node" && row.id) nodes.set(row.id, { ...(nodes.get(row.id) || {}), ...row });
+    // LAST LINE WINS, as the banner says — a REPLACE, not a merge. Merging kept attributes from
+    // superseded lines alive forever, so an attribute removed from an artifact survived in the
+    // projection and a rebuilt graph stopped matching the maintained one.
+    if (row.k === "node" && row.id) nodes.set(row.id, row);
     else if (row.k === "edge" && row.from && row.to && row.t) edges.set(`${row.from}|${row.t}|${row.to}`, row);
   }
   return { nodes, edges, lines };
@@ -194,16 +197,19 @@ export function project(cwd, slug) {
         source: g.source ?? null, note: g.note ?? null, round: g.round ?? null,
         run_id: g.run_id ?? runId ?? null,
       });
-      // A round-scoped gate's decision depends on that round's T0 verdict(s) — the most honest
-      // shape, since that is the evidence the decision was made against. Every other gate (and a
-      // round-scoped one with no verdict yet on disk) depends on the Run instead, so no
-      // `GateDecision` node is ever orphaned.
+      // EVERY gate depends on the Run, UNCONDITIONALLY — and a round-scoped one ALSO depends on that
+      // round's T0 verdict(s), the evidence it was decided against.
+      //
+      // The Run edge used to be an `else` FALLBACK, and a conditional edge TARGET cannot survive an
+      // append-only log. Gates are crossed BEFORE the round's verdict artifact lands, so the first
+      // projection minted `DEPENDS_ON run` and a later one added the verdict edges beside it —
+      // and `appendGraph` has no tombstone, so the fallback became permanent. The incremental graph
+      // then carried an edge a rebuild does not imply, breaking the one property this file exists to
+      // promise: that it can be deleted and rebuilt identically. Unconditional is also truer — a gate
+      // does depend on its run. The fix is not a guard; it is removing the condition.
+      if (runNode) edge(id, "DEPENDS_ON", runNode);
       const roundVerdicts = (g.gate === "L2" || g.gate === "L3") ? verdictIdsByRound.get(g.round) : null;
-      if (roundVerdicts?.length) {
-        for (const vid of roundVerdicts) edge(id, "DEPENDS_ON", vid);
-      } else if (runNode) {
-        edge(id, "DEPENDS_ON", runNode);
-      }
+      for (const vid of roundVerdicts || []) edge(id, "DEPENDS_ON", vid);
     }
   }
 
@@ -221,7 +227,15 @@ export function project(cwd, slug) {
       // projected to two nodes. `--trace` is supposed to reach "the execution record"; it reached
       // whichever scope happened to be written last. `baseline_trial` is chosen from the same
       // scope's prior rows, so the SUPERSEDES edge resolves inside the same partition.
-      const trialKey = (n) => `trial:${slug}:${t.scope_id ? `${t.scope_id}:` : ""}${n}`;
+      //
+      // AND THE RUN IS PART OF THE KEY TOO, for the same reason one step out. A trial ordinal
+      // restarts at 1 in the next run while `trials.jsonl` is APPEND-ONLY, so both runs' rows live
+      // on disk together and `trial:<slug>:<scope>:1` named two of them — the second run silently
+      // overwrote the first run's execution record, which is the identical defect the paragraph
+      // above records fixing once already, one key component short. `baseline_trial` is chosen from
+      // the same run's rows, so SUPERSEDES still resolves inside the partition.
+      const trialRun = t.run_id ?? runId ?? "norun";
+      const trialKey = (n) => `trial:${slug}:${trialRun}:${t.scope_id ? `${t.scope_id}:` : ""}${n}`;
       const id = trialKey(t.trial);
       node(id, "Trial", {
         trial: t.trial, round: t.round ?? null, attempt: t.attempt ?? null,

package/kernel/reduce/hill.mjs

@@ -9,6 +9,7 @@ import { runArgs } from "../lib/argv.mjs";
 import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger } from "../lib/paths.mjs";
 import { readAllContracts, SCOPE_CONTRACT } from "../lib/contract.mjs";
 import { evalVerdict } from "../probe/eval.mjs";
+import { redBuildRounds } from "../verify/build.mjs";
 
 /**
  * Derive and write the hill phase for all scopes mechanically based on T0, T1, and ledger facts.
@@ -16,7 +17,7 @@ import { evalVerdict } from "../probe/eval.mjs";
  * The derived phase follows these progression rules (facts move dots, not authors):
  * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope
  * - UPHILL_SOLVED: unknowns 0, no T0-green yet
- * - DOWNHILL_EXECUTION: ≥1 T0-green; T1/seesaw pending
+ * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1/seesaw pending
  * - FINISHED: T1 PASS ∧ seesaw green
  *
  * @param {string} cwd - The project root directory.
@@ -52,6 +53,15 @@ export function deriveHill(cwd, slug) {
   }
 
   // 2. T0 facts per scope: has it achieved a green overall verdict? was seesaw also green?
+  //
+  // MINUS THE ROUNDS WHOSE BUILD GATE IS RED. A T0 verdict is one scope's fixtures inside its own
+  // substrate; the round build gate (`verify build`) is the feature's build and launch. Measured on
+  // a live run, all fourteen committed shards read DOWNHILL_EXECUTION off T0 verdicts from rounds in
+  // which the app never compiled and never launched — the dashboard showed a feature going downhill
+  // that had not started. A green fixture in a round the gate failed is not evidence the scope
+  // works; it is evidence the fixture does not test the build. No gate artifact at all leaves every
+  // verdict counting exactly as before.
+  const redRounds = redBuildRounds(cwd, slug);
   const t0Facts = {};
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir)) {
@@ -59,7 +69,7 @@ export function deriveHill(cwd, slug) {
       try {
         const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
         if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
-        if (b.overall === "green") {
+        if (b.overall === "green" && !redRounds.has(Number(b.round))) {
           t0Facts[b.scope_id].hasGreen = true;
           // Read the REAL seesaw result off the verdict artifact (`t0.mjs`'s `writeArtifact()`
           // already persists the full `{ran, pass, scopes_checked, failing}` object), rather than