shapeup-sdlc 3.3.0 → 3.5.0

package/kernel/probe/requirements.mjs

@@ -0,0 +1,296 @@
+#!/usr/bin/env node
+// probe requirements — the way back: a pitch clause, the criterion that graded it, the verdict.
+//
+// WHY THIS IS A QUERY AND NOT A SENTENCE, which is the same reason `probe owner` is one. The
+// requirement matrix is read at GATE L4 and cited by GATE H's census, and both are places where a
+// narrated figure is indistinguishable from a measured one. Measured on the first verdict any run
+// of the spine produced: 85 of 97 criterion rows carried a `traces_to` anchor in the WorkResult and
+// 0 of 97 survived into the projection ingest wrote — so a matrix assembled from memory would have
+// been assembled from an edge that no longer existed on disk. Every figure below is derived from
+// files: the committed registry, the board's `covers:` clauses, the verdict ledger, and the EVAL
+// result's own T0 citations. Nothing is passed in and nothing is written.
+//
+// THE JOIN, and which half is authoritative. A requirement has EVIDENCE when an acceptance
+// criterion covers it (`(covers: REQ-…)` on the AC line — the planning-time edge, reviewed at L1b)
+// AND a criterion that names it passed. `traces_to[]` is the navigation path from the judge's
+// criterion back to the requirement, exactly what the schema already calls it: an anchor, never a
+// grading input. A criterion whose `traces_to` names a REQ that no AC covers is printed as an
+// INCONSISTENCY row and counted as nothing — folding it in would derive one L4 line from two
+// unreconciled sources, which is the failure `probe owner` exists to prevent.
+//
+// IT PROJECTS ONE RUN. `order_id`, round and attempt all repeat across runs of one feature; the
+// run key is the only thing that separates them, so a projection that ignored it would silently mix
+// two runs of one slug. Rows written before the key reached the ledger carry no `run_id`; they are
+// reported as unknown rather than folded into the run being projected.
+//
+// AN EMPTY JOIN READS AS CLEARLY AS A FULL ONE. A tree with no registry, a board with no `covers:`
+// and a run with no verdict are all legitimate states, and each answers "no evidence" rather than
+// failing — that answer is the point of the query, not an error in it.
+//
+// Usage:
+//   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe requirements --slug <slug> [--run-id <id>] [--format json|table] [--cwd <dir>]
+//
+// Exit code: 0 = answered (an empty projection is an answer), 2 = bad argv.
+
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { resolve, join } from "node:path";
+import { runArgs, isMain } from "../lib/argv.mjs";
+import { requirements as requirementsFile, evaluationDir, resultsDir, readRunId } from "../lib/paths.mjs";
+import { parseRequirements, coveredReqIds } from "../verify/trace.mjs";
+import { readBoard } from "../compile.mjs";
+import { reqId } from "../lib/contract.mjs";
+
+/**
+ * Read a file, tolerating absence — every input to this projection is optional by design.
+ * @param {string} p - Absolute path.
+ * @returns {(string|null)} The contents, or null when the file is missing or unreadable.
+ */
+function readIf(p) {
+  try { return existsSync(p) ? readFileSync(p, "utf8") : null; } catch { return null; }
+}
+
+/**
+ * The acceptance criteria on the LOCAL board that cover each requirement.
+ *
+ * The planning-time half of the join, and the authoritative one: a `covers:` clause is written when
+ * the plan is still cheap to change and is reviewed at L1b, whereas `traces_to` is written by the
+ * judge after the fact.
+ *
+ * NOT A SECOND COVERS-CLOSURE. Whether a requirement is covered is still decided by
+ * `coveredReqIds` in the oracle — there is one implementation of that question and this is not it.
+ * This walk exists only to keep the AC the closure discards, so the matrix can print WHICH
+ * criterion covers the clause instead of only that one does.
+ *
+ * @param {Array<object>} board - Task entries from `readBoard` (the only parser that carries
+ *   `acceptance_criteria`; the scheduling view does not).
+ * @returns {Map<string, Array<{task_id:string, ac:string}>>} REQ-id → the ACs naming it, in board
+ *   order. A requirement no AC covers is simply absent.
+ */
+export function coveringAcs(board) {
+  const out = new Map();
+  for (const task of board || []) {
+    for (const ac of task.acceptance_criteria || []) {
+      if (typeof ac !== "object" || !Array.isArray(ac.covers)) continue;
+      for (const raw of ac.covers) {
+        const id = reqId(raw).toUpperCase();
+        if (!out.has(id)) out.set(id, []);
+        out.get(id).push({ task_id: task.id, ac: ac.text });
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Every criterion row ingest projected, tagged with the EVAL target its ledger belongs to.
+ *
+ * The target is read off the FILE NAME rather than the row: `.verdicts-<target>.jsonl` is written
+ * per order, so the file is what says which dispatch produced the rows, and the same file is what
+ * locates the WorkResult carrying that dispatch's T0 citations.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {Array<object>} One entry per ledger line, each the stored row plus `target`. Malformed
+ *   lines are skipped; a missing evaluation directory yields [].
+ */
+export function readVerdictRows(cwd, slug) {
+  const dir = evaluationDir(cwd, slug);
+  let files = [];
+  try { files = readdirSync(dir).filter((f) => /^\.verdicts-.+\.jsonl$/.test(f)).sort(); } catch { return []; }
+  const rows = [];
+  for (const f of files) {
+    const target = f.replace(/^\.verdicts-/, "").replace(/\.jsonl$/, "");
+    for (const line of (readIf(join(dir, f)) || "").split(/\r?\n/)) {
+      if (!line.trim()) continue;
+      try { rows.push({ ...JSON.parse(line), target }); } catch { /* a truncated line is not a verdict */ }
+    }
+  }
+  return rows;
+}
+
+/**
+ * The T0 artifacts an EVAL dispatch re-hashed, read from the WorkResult it wrote.
+ *
+ * The verdict ledger records criteria, not citations, so the machine fact a generator cannot
+ * fabricate lives one file over — in `results/<target>.json`. Read here rather than recomputed: the
+ * evaluator's own citation is what the round was accepted on.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} target - The EVAL order suffix (`evaluate-r1`), from the ledger's file name.
+ * @returns {Array<{scope_id:(string|null), path:(string|null), sha256:(string|null)}>} The cited
+ *   artifacts; [] when the result is absent, unreadable or cites none.
+ */
+export function t0Citations(cwd, slug, target) {
+  const body = readIf(join(resultsDir(cwd, slug), `${target}.json`));
+  if (!body) return [];
+  try {
+    const cites = JSON.parse(body)?.verdict?.t0_citations;
+    if (!Array.isArray(cites)) return [];
+    return cites.map((c) => ({ scope_id: c?.scope_id ?? null, path: c?.path ?? null, sha256: c?.sha256 ?? null }));
+  } catch { return []; }
+}
+
+/**
+ * Project one run's requirement matrix from the artifacts on disk.
+ *
+ * @param {{cwd:string, slug:string, runId?:(string|null)}} opts - Project root, feature slug, and
+ *   the run to project; omitted, it is resolved from the run's own receipt.
+ * @returns {{slug:string, run_id:(string|null), registry:boolean, totals:object,
+ *   rows:Array<object>, inconsistencies:Array<object>, ledger:object}} `rows` is one entry per
+ *   registered clause — its source, status, covering ACs, the criteria that named it and their
+ *   verdicts, and each criterion's T0 citations — with `evidence` one of `PASS`, `no evidence` or
+ *   `cut`. `inconsistencies` holds criteria tracing to a REQ no AC covers. `ledger` says how many
+ *   rows were read, projected, skipped as another run's, and left unkeyed. No registry ⇒ `rows` is
+ *   empty and `registry` is false: an empty projection, not an error.
+ */
+export function projectRequirements({ cwd, slug, runId = undefined }) {
+  const regText = readIf(requirementsFile(cwd, slug));
+  const clauses = regText === null ? [] : parseRequirements(regText);
+  const board = readBoard(cwd, slug);
+  // `covered` decides; `acs` only says which criterion did the covering.
+  const covered = coveredReqIds(board);
+  const acs = coveringAcs(board);
+  const run = runId === undefined ? readRunId(cwd, slug) : runId;
+
+  const all = readVerdictRows(cwd, slug);
+  const ledger = { rows_read: all.length, rows_projected: 0, rows_other_run: 0, rows_unknown_run: 0 };
+  const mine = [];
+  for (const r of all) {
+    if (r.run_id === undefined || r.run_id === null || r.run_id === "") { ledger.rows_unknown_run++; continue; }
+    if (run !== null && r.run_id === run) { ledger.rows_projected++; mine.push(r); continue; }
+    ledger.rows_other_run++;
+  }
+
+  // The criteria that name each requirement, and the T0 artifacts the round that graded them cited.
+  const t0Cache = new Map();
+  /**
+   * The cited T0 artifacts for one EVAL target, read once per target.
+   * @param {string} target - The EVAL order suffix.
+   * @returns {Array<object>} The citation rows.
+   */
+  const t0For = (target) => {
+    if (!t0Cache.has(target)) t0Cache.set(target, t0Citations(cwd, slug, target));
+    return t0Cache.get(target);
+  };
+
+  const byReq = new Map();
+  const inconsistencies = [];
+  for (const r of mine) {
+    const anchors = Array.isArray(r.traces_to) ? r.traces_to : [];
+    for (const raw of anchors) {
+      const id = reqId(raw).toUpperCase();
+      const entry = {
+        criterion: r.criterion ?? "", dimension: r.dimension ?? "", verdict: r.verdict ?? "",
+        confidence: r.confidence ?? null, evidence: r.evidence ?? "", target: r.target,
+        run: r.run ?? null, run_id: r.run_id ?? null, t0: t0For(r.target),
+      };
+      // THE AUTHORITATIVE HALF DECIDES. An anchor pointing at a requirement no acceptance criterion
+      // covers is a claim the plan never made; it is printed so somebody can reconcile it, and
+      // counted as nothing.
+      if (!covered.has(id)) { inconsistencies.push({ requirement: id, ...entry, why: "no acceptance criterion covers this requirement — the anchor resolves to nothing the plan claimed" }); continue; }
+      if (!byReq.has(id)) byReq.set(id, []);
+      byReq.get(id).push(entry);
+    }
+  }
+
+  const rows = clauses.map((c) => {
+    const id = c.id.toUpperCase();
+    const covering = acs.get(id) || [];
+    const criteria = byReq.get(id) || [];
+    const cut = c.status !== "covered";
+    const passed = criteria.some((x) => String(x.verdict).toUpperCase() === "PASS");
+    return {
+      id: c.id,
+      source: c.source || "",
+      clause: c.clause || "",
+      status: c.status,
+      covering_acs: covering,
+      criteria,
+      t0: [...new Set(criteria.flatMap((x) => x.t0.map((t) => t.sha256).filter(Boolean)))],
+      evidence: cut ? "cut" : passed ? "PASS" : "no evidence",
+    };
+  });
+
+  const totals = {
+    total: rows.length,
+    pass: rows.filter((r) => r.evidence === "PASS").length,
+    cut: rows.filter((r) => r.evidence === "cut").length,
+    no_evidence: rows.filter((r) => r.evidence === "no evidence").length,
+    inconsistencies: inconsistencies.length,
+  };
+  return { slug, run_id: run, registry: regText !== null, totals, rows, inconsistencies, ledger };
+}
+
+/**
+ * The one-line summary GATE L4 prints and GATE H's census cites.
+ *
+ * @param {object} r - A report from {@link projectRequirements}.
+ * @returns {string} `15/17 PASS · 1 CUT (PO) · 1 no evidence (REQ-12 ← R12)`, or the empty-run
+ *   phrasing when there is no registry to project.
+ */
+export function summaryLine(r) {
+  if (!r.registry) return "n/a (no registry)";
+  if (!r.totals.total) return "0 requirements registered";
+  const gaps = r.rows.filter((x) => x.evidence === "no evidence");
+  const named = gaps.slice(0, 3).map((x) => (x.source ? `${x.id} ← ${x.source}` : x.id)).join(", ");
+  const parts = [`${r.totals.pass}/${r.totals.total} PASS`];
+  if (r.totals.cut) parts.push(`${r.totals.cut} CUT (PO)`);
+  if (r.totals.no_evidence) parts.push(`${r.totals.no_evidence} no evidence (${named}${gaps.length > 3 ? ", …" : ""})`);
+  if (r.totals.inconsistencies) parts.push(`${r.totals.inconsistencies} inconsistency ${r.totals.inconsistencies === 1 ? "row" : "rows"}`);
+  return parts.join(" · ");
+}
+
+/**
+ * Render the matrix as a fixed-width table for a human reading a gate block.
+ * @param {object} r - A report from {@link projectRequirements}.
+ * @returns {string} The header, one row per requirement, the summary line and any inconsistencies.
+ */
+export function renderTable(r) {
+  const out = [];
+  const head = ["REQ", "source", "status", "covering AC", "criterion", "verdict", "T0"];
+  const rows = r.rows.map((x) => [
+    x.id, x.source || "—", x.evidence,
+    x.covering_acs.length ? `${x.covering_acs[0].task_id}: ${x.covering_acs[0].ac.slice(0, 40)}${x.covering_acs.length > 1 ? ` (+${x.covering_acs.length - 1})` : ""}` : "—",
+    x.criteria.length ? `${x.criteria[0].criterion.slice(0, 40)}${x.criteria.length > 1 ? ` (+${x.criteria.length - 1})` : ""}` : "—",
+    x.criteria.length ? x.criteria.map((c) => c.verdict).join(",") : "—",
+    x.t0.length ? x.t0.map((h) => String(h).slice(0, 12)).join(",") : "—",
+  ]);
+  if (rows.length) {
+    const w = head.map((h, i) => Math.max(h.length, ...rows.map((row) => String(row[i]).length)));
+    const line = (row) => row.map((c, i) => String(c).padEnd(w[i])).join("  ").trimEnd();
+    out.push(line(head), line(w.map((n) => "-".repeat(n))), ...rows.map(line), "");
+  }
+  out.push(`Requirements: ${summaryLine(r)}`);
+  out.push(`run_id: ${r.run_id ?? "unknown"} · ledger rows read ${r.ledger.rows_read}, projected ${r.ledger.rows_projected}, other run ${r.ledger.rows_other_run}, unkeyed (run_id: unknown) ${r.ledger.rows_unknown_run}`);
+  for (const i of r.inconsistencies) {
+    out.push(`  ⚠ ${i.requirement}: "${String(i.criterion).slice(0, 60)}" ${i.verdict} — ${i.why}`);
+  }
+  return out.join("\n");
+}
+
+export const ARGV_SPEC = {
+  usage: "harness.mjs probe requirements --slug <slug> [--run-id <id>] [--format json|table] [--cwd <dir>]",
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  slug: { type: "str", required: true },
+  "run-id": { type: "str" },
+  format: { type: "enum", values: ["json", "table"], default: "json" },
+  cwd: { type: "path" },
+};
+
+/**
+ * Answer "which requirement has evidence, and from which criterion" from the artifacts on disk.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {Promise<void>} Exits 0 with the projection — an absent run, an absent registry and an
+ *   absent verdict are all answers, never errors.
+ */
+export async function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = resolve(args.cwd || process.cwd());
+  const report = projectRequirements({ cwd, slug: args.slug, runId: args.runId ?? undefined });
+  console.log(args.format === "table" ? renderTable(report) : JSON.stringify(report, null, 2));
+  process.exit(0);
+}
+
+if (isMain(import.meta.url)) cli(process.argv.slice(2));

package/kernel/probe/resume.mjs

@@ -63,7 +63,7 @@ import { splitFrontmatter } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
 import {
   intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
-  orientDir, activeOrder, usecasesDir, breadboard, receipt, readReceipt,
+  orientDir, activeOrder, usecasesDir, breadboard, receipt, readReceipt, requirements,
 } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 
@@ -394,6 +394,12 @@ export function deriveResumeState(cwd, slug) {
     orient_dir: `.shapeup/${slug}/orient/`,
     has_orient_artifacts: hasOrientArtifacts(cwd, slug),
     has_spec_tree: hasSpecTree(cwd, slug, hr.spec_folder || null),
+    // A PLAIN FACT, DELIBERATELY NOT A PHASE. The requirements registry is dispatched once, before
+    // ANALYZE, and the orchestrator guards that one dispatch on this boolean. It is NOT an entry in
+    // PHASE_ARTIFACT, and adding it there would be a migration hazard rather than a tidier shape:
+    // that map is also `nextPhase()`'s ordered list, so every run recorded before the registry
+    // existed would fast-forward to the registry instead of to `build` on its next relaunch.
+    has_requirements: existsSync(requirements(cwd, slug)),
     has_wiring_map: existsSync(wiringMap(cwd, slug)),
     project_profile_path: projectProfile(cwd, slug),
     has_project_profile: existsSync(projectProfile(cwd, slug)),

package/kernel/reduce/board.mjs

@@ -68,7 +68,11 @@ const listField = (fm, key) => {
  */
 export function parseBoard(tasksDir) {
   if (!existsSync(tasksDir)) return [];
-  return readdirSync(tasksDir)
+  // SORTED, because `criticalPath` breaks ties on strict `>` and therefore keeps the FIRST chain it
+  // meets among equal-hours chains. Directory order is a filesystem detail (APFS happens to return
+  // sorted; ext4's hash order does not, and neither does a rename), so an unsorted read made a
+  // derived value depend on which machine ran it. Every sibling reader in the kernel already sorts.
+  return readdirSync(tasksDir).sort()
     .filter((f) => /^TASK-[\w.-]+\.md$/i.test(f))
     .map((f) => {
       const body = readFileSync(join(tasksDir, f), "utf8");
@@ -130,10 +134,30 @@ export function criticalPath(tasks) {
     }
     return (memo[id] = { hours: best.hours + t.hours, chain: [...best.chain, id] });
   };
+  // TIES BREAK ON CONTENT, NOT ON ARRIVAL. `>` alone keeps whichever equal-hours chain is MET
+  // FIRST, which is input order — so this function returned a different critical path for the same
+  // board depending only on how its task list happened to be ordered. Measured: two disjoint
+  // 5-hour chains, five permutations of one list, two different answers.
+  //
+  // Sorting the reader that feeds it (`parseBoard`) makes the input stable and therefore hides this
+  // on any one machine, but it leaves the ORDER-DEPENDENCE in place one call up — a caller with its
+  // own ordering, or a future second reader, re-opens it. A derived value has to be a function of
+  // the board, not of the walk that produced it, so the tie is resolved here: same hours, then the
+  // lexicographically smaller chain. Deterministic on every machine and for every caller.
+  /**
+   * Is chain `c` a better critical path than the incumbent `b`?
+   * @param {{hours:number, chain:string[]}} c - The candidate chain.
+   * @param {{hours:number, chain:string[]}} b - The incumbent best.
+   * @returns {boolean} True when `c` has more hours, or ties on hours and sorts first by chain
+   *   content — so the answer is a function of the board rather than of the iteration order.
+   */
+  const better = (c, b) => c.hours > b.hours
+    || (c.hours === b.hours && c.chain.length > 0
+        && (b.chain.length === 0 || c.chain.join("\u0000") < b.chain.join("\u0000")));
   let best = { hours: 0, chain: [] };
   for (const t of tasks) {
     const c = longest(t.id);
-    if (c.hours > best.hours) best = c;
+    if (better(c, best)) best = c;
   }
   return best;
 }

package/kernel/reduce/graph.mjs

@@ -32,7 +32,7 @@ import {
   localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath,
   gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath,
 } from "../lib/paths.mjs";
-import { readAllContracts, readContract, ucId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
+import { readAllContracts, readContract, ucId, reqId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
 import { runIdFromReceipt } from "../lib/paths.mjs";
 
 /** The graph's home — one file per feature, beside the run trace it projects. */
@@ -43,7 +43,7 @@ export const WORK_NODES = ["Run", "Order", "Result", "Verdict", "Trial", "GateDe
 export const DOMAIN_NODES = ["Scope", "UseCase", "Requirement", "Seam"];
 
 /** Edge types. Each names a direction that is meaningful to read backwards. */
-export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM"];
+export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
 
 /**
  * Read the graph as a log and fold it into nodes and edges.
@@ -63,7 +63,10 @@ export function readGraph(cwd, slug) {
     let row;
     try { row = JSON.parse(line); } catch { continue; }   // a torn line proves nothing; skip it
     lines++;
-    if (row.k === "node" && row.id) nodes.set(row.id, { ...(nodes.get(row.id) || {}), ...row });
+    // LAST LINE WINS, as the banner says — a REPLACE, not a merge. Merging kept attributes from
+    // superseded lines alive forever, so an attribute removed from an artifact survived in the
+    // projection and a rebuilt graph stopped matching the maintained one.
+    if (row.k === "node" && row.id) nodes.set(row.id, row);
     else if (row.k === "edge" && row.from && row.to && row.t) edges.set(`${row.from}|${row.t}|${row.to}`, row);
   }
   return { nodes, edges, lines };
@@ -194,16 +197,19 @@ export function project(cwd, slug) {
         source: g.source ?? null, note: g.note ?? null, round: g.round ?? null,
         run_id: g.run_id ?? runId ?? null,
       });
-      // A round-scoped gate's decision depends on that round's T0 verdict(s) — the most honest
-      // shape, since that is the evidence the decision was made against. Every other gate (and a
-      // round-scoped one with no verdict yet on disk) depends on the Run instead, so no
-      // `GateDecision` node is ever orphaned.
+      // EVERY gate depends on the Run, UNCONDITIONALLY — and a round-scoped one ALSO depends on that
+      // round's T0 verdict(s), the evidence it was decided against.
+      //
+      // The Run edge used to be an `else` FALLBACK, and a conditional edge TARGET cannot survive an
+      // append-only log. Gates are crossed BEFORE the round's verdict artifact lands, so the first
+      // projection minted `DEPENDS_ON run` and a later one added the verdict edges beside it —
+      // and `appendGraph` has no tombstone, so the fallback became permanent. The incremental graph
+      // then carried an edge a rebuild does not imply, breaking the one property this file exists to
+      // promise: that it can be deleted and rebuilt identically. Unconditional is also truer — a gate
+      // does depend on its run. The fix is not a guard; it is removing the condition.
+      if (runNode) edge(id, "DEPENDS_ON", runNode);
       const roundVerdicts = (g.gate === "L2" || g.gate === "L3") ? verdictIdsByRound.get(g.round) : null;
-      if (roundVerdicts?.length) {
-        for (const vid of roundVerdicts) edge(id, "DEPENDS_ON", vid);
-      } else if (runNode) {
-        edge(id, "DEPENDS_ON", runNode);
-      }
+      for (const vid of roundVerdicts || []) edge(id, "DEPENDS_ON", vid);
     }
   }
 
@@ -221,7 +227,15 @@ export function project(cwd, slug) {
       // projected to two nodes. `--trace` is supposed to reach "the execution record"; it reached
       // whichever scope happened to be written last. `baseline_trial` is chosen from the same
       // scope's prior rows, so the SUPERSEDES edge resolves inside the same partition.
-      const trialKey = (n) => `trial:${slug}:${t.scope_id ? `${t.scope_id}:` : ""}${n}`;
+      //
+      // AND THE RUN IS PART OF THE KEY TOO, for the same reason one step out. A trial ordinal
+      // restarts at 1 in the next run while `trials.jsonl` is APPEND-ONLY, so both runs' rows live
+      // on disk together and `trial:<slug>:<scope>:1` named two of them — the second run silently
+      // overwrote the first run's execution record, which is the identical defect the paragraph
+      // above records fixing once already, one key component short. `baseline_trial` is chosen from
+      // the same run's rows, so SUPERSEDES still resolves inside the partition.
+      const trialRun = t.run_id ?? runId ?? "norun";
+      const trialKey = (n) => `trial:${slug}:${trialRun}:${t.scope_id ? `${t.scope_id}:` : ""}${n}`;
       const id = trialKey(t.trial);
       node(id, "Trial", {
         trial: t.trial, round: t.round ?? null, attempt: t.attempt ?? null,
@@ -249,7 +263,10 @@ export function project(cwd, slug) {
       // UseCase nodes it was built from and `--trace` stopped there instead of reaching the
       // objective. The contract now names both, so both are projectable.
       for (const uc of contract.use_cases || []) edge(id, "IMPLEMENTS", `uc:${slug}:${ucId(uc)}`);
-      for (const req of contract.covers || []) edge(id, "COVERS", `req:${slug}:${req}`);
+      // Normalised to the registry's key space on the way in, the same mapping spec-lint applies:
+      // a contract citing the pitch's `R<n>` and a Requirement node keyed `REQ-<n>` are one node,
+      // and an edge drawn to the other spelling is an edge to a node the graph does not hold.
+      for (const req of contract.covers || []) edge(id, "COVERS", `req:${slug}:${reqId(req)}`);
       for (const dep of contract.depends_on || []) edge(id, "DEPENDS_ON", `scope:${slug}:${dep}`);
     }
   }

package/kernel/reduce/ingest.mjs

@@ -8,7 +8,9 @@
 //   task_results[]      → tick AC boxes, flip task frontmatter status, append Execution Log,
 //                         update tasks/_index.md row, propagate unblocks (old P3.1–P3.6)
 //   discoveries[]       → append to .shapeup/<slug>/discovery/ledger.md (old P3.7 / QA H.3)
-//   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0)
+//   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0), every
+//                         row keyed by run_id and carrying the judge's traces_to[] anchor back to
+//                         the requirement — see step 4 for why neither may be dropped here
 //   verdict.refuted[]   → un-tick refuted AC boxes + set eval_verdict frontmatter (old B.2/B.2b)
 //   (the leg itself)    → append one leg-completion row to .shapeup/<slug>/legs.jsonl
 //
@@ -286,21 +288,32 @@ function applyResultLocked(result, { cwd, slug }) {
   }
 
   // 4. Verdict bookkeeping (old evaluator B.0/B.2/B.2b) — judge returns data, ingest writes.
+  //
+  // THE PROJECTION KEEPS THE TWO KEYS A LATER READER CANNOT RE-DERIVE. Measured on the first real
+  // verdict of a spined run: 85 of 97 criteria carried `traces_to` in the WorkResult and 0 of 97
+  // survived into this file, so the anchor from a criterion back to the requirement it grades was
+  // written by the judge and discarded one step later. And the row carried only the monotonic `run`
+  // counter, which restarts per ledger file and repeats across runs of one slug — `run_id` is the
+  // only key that separates them, so a projection over this file silently mixed two runs without
+  // it. A WorkResult carries no run key; it is read off the run's own receipt, the same derivation
+  // every other writer here uses.
   if (result.verdict) {
     const evalDir = join(local, "evaluation");
     mkdirSync(evalDir, { recursive: true });
     if (result.verdict.criteria?.length) {
       const target = result.order_id.split("/")[1] || "run";
       const ledger = join(evalDir, `.verdicts-${target}.jsonl`);
+      const runId = readRunId(cwd, slug);
       let run = 1;
       if (existsSync(ledger)) {
         const prior = readFileSync(ledger, "utf8").trim().split(/\n/).filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
         run = prior.reduce((mx, r) => Math.max(mx, r.run || 0), 0) + 1;
       }
       const lines = result.verdict.criteria.map((c) => JSON.stringify({
-        run, dimension: c.dimension || "spec-conformance", criterion: c.criterion,
+        run, run_id: runId, dimension: c.dimension || "spec-conformance", criterion: c.criterion,
         verdict: c.verdict, confidence: c.confidence, reprobed: !!c.reprobed,
-        evidence: c.evidence || "", at: new Date().toISOString(),
+        evidence: c.evidence || "", traces_to: Array.isArray(c.traces_to) ? c.traces_to : [],
+        at: new Date().toISOString(),
       })).join("\n");
       appendFileSync(ledger, lines + "\n");
       summary.verdict_lines = result.verdict.criteria.length;

package/kernel/reduce/ship.mjs

@@ -36,6 +36,7 @@ import {
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
+import { projectRequirements, summaryLine } from "../probe/requirements.mjs";
 import { collectDiff, scanDiff, summarize } from "./leftovers.mjs";
 
 /** @returns {string} Today as `YYYY-MM-DD` (UTC). */
@@ -167,7 +168,7 @@ export function section(md, heading) {
 export function buildReport(facts) {
   const {
     slug, at, verdict, qa, rounds, board, t0, artifacts, ratchet,
-    evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers,
+    evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers, requirements,
   } = facts;
 
   const L = [];
@@ -214,6 +215,40 @@ export function buildReport(facts) {
     L.push("");
   }
 
+  // The requirement matrix — the way back from a verdict to the clause the pitch asked for, frozen
+  // at the one moment the run's local evidence still exists. Omitted entirely when the run has no
+  // registry: a table of nothing reads as "no requirements", which is a different claim from "this
+  // run predates the registry". Derived like every other figure here, by the same probe the L4 line
+  // and GATE H's census read, so the three cannot disagree.
+  if (requirements?.registry && requirements.rows.length) {
+    L.push("## Requirements", "");
+    L.push("One row per registered clause. A requirement has evidence when an acceptance criterion",
+      "covers it AND a criterion grading it passed — `covers:` is the join, the judge's anchor is the",
+      "path back. This is a projection, never a verdict: it never blocked this ship.", "");
+    L.push(`**${summaryLine(requirements)}** · run \`${requirements.run_id ?? "unknown"}\``, "");
+    // A clause, an AC and a criterion are all free prose, and a literal pipe in any of them breaks
+    // the row into columns nobody wrote — a frozen report that misrenders its own evidence.
+    /**
+     * Escape a free-prose value for a Markdown table cell.
+     * @param {string} s - The value.
+     * @returns {string} The value with every literal pipe escaped.
+     */
+    const cell = (s) => String(s).replace(/\|/g, "\\|");
+    L.push("| REQ | source | evidence | covering AC | criterion | T0 |", "|---|---|---|---|---|---|");
+    for (const r of requirements.rows) {
+      const ac = r.covering_acs.length ? `${r.covering_acs[0].task_id}: ${r.covering_acs[0].ac}${r.covering_acs.length > 1 ? ` (+${r.covering_acs.length - 1})` : ""}` : "—";
+      const crit = r.criteria.length ? `${r.criteria[0].criterion}${r.criteria.length > 1 ? ` (+${r.criteria.length - 1})` : ""} → ${r.criteria.map((c) => c.verdict).join(",")}` : "—";
+      const t0h = r.t0.length ? r.t0.map((h) => String(h).slice(0, 12)).join(", ") : "—";
+      L.push(`| ${r.id} | ${cell(r.source || "—")} | ${r.evidence} | ${cell(ac)} | ${cell(crit)} | ${t0h} |`);
+    }
+    L.push("");
+    if (requirements.inconsistencies.length) {
+      L.push("Anchored to a requirement no acceptance criterion covers — reconcile, do not count as evidence:", "");
+      for (const i of requirements.inconsistencies) L.push(`- ${i.requirement} ← "${i.criterion}" (${i.verdict})`);
+      L.push("");
+    }
+  }
+
   // The ratchet aggregate is derived, ~10 scalars that do not grow with the run, which is why it
   // can live in the committed tier while `metrics/` correctly stays gitignored (ADR-0001: a
   // committed shard keyed on $HOSTNAME only grows). Without this the instrument existed and was
@@ -306,6 +341,7 @@ export function generate({ cwd, slug, verdict, qa }) {
     board: boardCensus(cwd, slug),
     t0: t0Summary(cwd, slug),
     ratchet: ratchetReport(readTrials(trials(cwd, slug))),
+    requirements: projectRequirements({ cwd, slug }),
     artifacts: verdictArtifactCount(cwd, slug),
     evalCriteria: section(evalReport, /^#+\s.*criteria/i) || section(evalReport, /^#+\s*spec-conformance/i),
     evalBugs: section(evalReport, /^#+\s*Bugs?\b/i),