shapeup-sdlc 3.5.0 → 3.7.0

package/kernel/reduce/ingest.mjs

@@ -8,6 +8,13 @@
 //   task_results[]      → tick AC boxes, flip task frontmatter status, append Execution Log,
 //                         update tasks/_index.md row, propagate unblocks (old P3.1–P3.6)
 //   discoveries[]       → append to .shapeup/<slug>/discovery/ledger.md (old P3.7 / QA H.3)
+//   deviations[] (when  → append to the SAME discovery ledger, tagged distinctly. A worker's
+//     status:"escalated")  protocol names deviations[] as the only channel a blocked worker has —
+//                         there is no escalates[] field — and until now nothing routed it anywhere:
+//                         a worker that correctly stopped rather than guessed produced a number and
+//                         silence. Landing here reaches a reader that already exists — the census
+//                         reads this ledger's open entries, and the ship report's own "Discovered,
+//                         not built" section is generated from it.
 //   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0), every
 //                         row keyed by run_id and carrying the judge's traces_to[] anchor back to
 //                         the requirement — see step 4 for why neither may be dropped here
@@ -33,7 +40,7 @@ import { tasksDir, localRoot, dispatchReceipts, legLedger, readRunId } from "../
 import { citationProblem } from "../probe/eval.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../../skills/tech-lead/schemas/work-result.schema.json"), "utf8"));
+const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
 
 /**
  * @returns {string} Today's date as an ISO `YYYY-MM-DD` string (UTC), for log/frontmatter stamps.
@@ -195,7 +202,7 @@ export function updateBoardRow(indexBody, taskId, done) {
  *   verdict{criteria[],refuted[]}).
  * @param {{cwd:string}} opts - cwd: working-directory root every LOCAL path resolves against.
  * @returns {{slug:string, tasks_updated:string[], acs_ticked:number, unblocked:string[],
- *   discoveries_appended:number, refuted_unticked:number, verdict_lines:number}} A summary of every write performed.
+ *   discoveries_appended:number, escalations_appended:number, refuted_unticked:number, verdict_lines:number}} A summary of every write performed.
  * @throws {Error} If a task/board/ledger file it must write is not writable (fs error propagates).
  *   `evaluation/.verdicts-*.jsonl` under `.shapeup/<slug>/`.
  */
@@ -213,7 +220,7 @@ export function applyResult(result, { cwd }) {
  */
 function applyResultLocked(result, { cwd, slug }) {
   const local = localRoot(cwd, slug);
-  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, refuted_unticked: 0, verdict_lines: 0 };
+  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, escalations_appended: 0, refuted_unticked: 0, verdict_lines: 0 };
 
   // 1. Task results → task files + board (old task-executor P3.1/P3.2/P3.6).
   const boardIndex = join(local, "tasks", "_index.md");
@@ -273,18 +280,52 @@ function applyResultLocked(result, { cwd, slug }) {
     }
   }
 
-  // 3. Discoveries → the ledger (old P3.7 / QA H.3). Single writer: this script.
-  if (result.discoveries?.length) {
+  // 3. Discoveries → the ledger (old P3.7 / QA H.3), plus an ESCALATE's deviations, tagged the same
+  //    way and landed under the same heading. Single writer: this script. A worker's protocol names
+  //    `deviations[]` as the only channel a blocked worker has — there is no `escalates[]` field —
+  //    and routing it into THIS ledger is what makes it reach a reader that already exists: the
+  //    ship report's own "Discovered, not built" section, and the census a scope's own worker reads
+  //    before proposing a cut, both read this file's unresolved `+`/`~` entries.
+  const escalations = result.status === "escalated" ? (result.deviations || []) : [];
+  if (result.discoveries?.length || escalations.length) {
     const ledgerDir = join(local, "discovery");
     mkdirSync(ledgerDir, { recursive: true });
     const ledger = join(ledgerDir, "ledger.md");
     if (!existsSync(ledger)) writeFileSync(ledger, `---\nfeature: ${slug}\n---\n# Discovery Ledger — ${slug}\n`);
-    const lines = result.discoveries.map((d) => {
-      const tags = [d.lens ? `[lens:${d.lens}]` : "", d.severity_hint ? `severity-hint: ${d.severity_hint}` : "", d.test_gap ? `test-gap: ${d.test_gap}` : "", d.contradicts ? `contradicts: ${d.contradicts}` : "", d.traces_to?.length ? `traces_to: ${d.traces_to.join(", ")}` : ""].filter(Boolean);
-      return `${d.marker} ${d.lens ? tags[0] + " " : ""}${d.line}${d.repro ? `\n    repro: ${d.repro}` : ""}${tags.slice(d.lens ? 1 : 0).map((t) => `\n    ${t}`).join("")}`;
-    }).join("\n");
-    appendFileSync(ledger, `\n## Discovered — ${result.order_id} (${today()})\n${lines}\n`);
-    summary.discoveries_appended = result.discoveries.length;
+    // IDEMPOTENT ON THE ORDER, not merely append-only. `reduce ingest` is the single writer, but
+    // nothing stops the SAME order/result pair from being applied twice — a replayed ingest over an
+    // already-applied result, never a fresh attempt (a real re-attempt earns its own order_id,
+    // `r<N>-a<N+1>`). Measured: replaying one identical escalated WorkResult doubled its
+    // `[ESCALATE]` line in this ledger, and both GATE H's census and the ship report's "Discovered,
+    // not built" section count this file's open entries — so a replay silently inflated the count
+    // for a WorkResult that ran exactly once. A block heading names its order verbatim, so a second
+    // ingest of the same order recognises its own prior write and skips the append rather than
+    // duplicating it.
+    const existingLedger = readFileSync(ledger, "utf8");
+    /**
+     * The ledger heading one order's block is filed under — the idempotency key: a second ingest
+     * of the SAME order recognises its own prior write by this string, verbatim.
+     * @param {string} oid - `result.order_id` this block belongs to.
+     * @returns {string} The heading prefix (open-ended — the date suffix varies, the order id does not).
+     */
+    const headingFor = (oid) => `## Discovered — ${oid} (`;
+    const alreadyLogged = existingLedger.includes(headingFor(result.order_id));
+    if (alreadyLogged) {
+      summary.discoveries_appended = 0;
+      summary.escalations_appended = 0;
+    } else {
+      const discoveryLines = (result.discoveries || []).map((d) => {
+        const tags = [d.lens ? `[lens:${d.lens}]` : "", d.severity_hint ? `severity-hint: ${d.severity_hint}` : "", d.test_gap ? `test-gap: ${d.test_gap}` : "", d.contradicts ? `contradicts: ${d.contradicts}` : "", d.traces_to?.length ? `traces_to: ${d.traces_to.join(", ")}` : ""].filter(Boolean);
+        return `${d.marker} ${d.lens ? tags[0] + " " : ""}${d.line}${d.repro ? `\n    repro: ${d.repro}` : ""}${tags.slice(d.lens ? 1 : 0).map((t) => `\n    ${t}`).join("")}`;
+      });
+      // `+` (candidate work), matching the schema's own reading of that marker — an ESCALATE is
+      // exactly that: work a worker could not safely do without a decision only the census can make.
+      const escalateLines = escalations.map((d) => `+ [ESCALATE] ${d}`);
+      const lines = [...discoveryLines, ...escalateLines].join("\n");
+      appendFileSync(ledger, `\n${headingFor(result.order_id)}${today()})\n${lines}\n`);
+      summary.discoveries_appended = (result.discoveries || []).length;
+      summary.escalations_appended = escalations.length;
+    }
   }
 
   // 4. Verdict bookkeeping (old evaluator B.0/B.2/B.2b) — judge returns data, ingest writes.
@@ -657,5 +698,5 @@ export async function cli(rawArgv) {
     }
   }
 
-  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked}`);
+  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · escalations: ${s.escalations_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked}`);
 }

package/kernel/reduce/ship.mjs

@@ -31,12 +31,13 @@ import { join, dirname } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
-  roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared, resultsDir,
+  roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
   activeOrder,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
 import { projectRequirements, summaryLine } from "../probe/requirements.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 import { collectDiff, scanDiff, summarize } from "./leftovers.mjs";
 
 /** @returns {string} Today as `YYYY-MM-DD` (UTC). */
@@ -167,13 +168,13 @@ export function section(md, heading) {
  */
 export function buildReport(facts) {
   const {
-    slug, at, verdict, qa, rounds, board, t0, artifacts, ratchet,
+    slug, at, verdict, qa, rounds, roundsJudged, board, t0, artifacts, ratchet,
     evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers, requirements,
   } = facts;
 
   const L = [];
   L.push("---", "type: ship-report", `feature: ${slug}`, `date: ${at}`,
-    `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `qa: ${qa}`,
+    `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `rounds_judged: ${roundsJudged ?? "~"}`, `qa: ${qa}`,
     `intake_sha256: ${intakeSha ?? "~"}`, "---", "");
   L.push(`# ${slug} — ship report`, "");
   L.push("Frozen at GATE L4. Every figure below is derived from run artifacts on disk — the trial",
@@ -183,6 +184,10 @@ export function buildReport(facts) {
   L.push("| | |", "|---|---|");
   L.push(`| Verdict | **${verdict}** |`);
   L.push(`| Rounds used | ${rounds ?? "—"} |`);
+  // A round built and a round judged are different facts — a round can die before EVAL ever sees
+  // it, so this row is its own line rather than folded into "Rounds used" above. Omitted when EVAL
+  // never ran at all, the same way the sections below it are.
+  if (roundsJudged != null) L.push(`| Rounds judged | ${roundsJudged} |`);
   L.push(`| Board | ${board.done}/${board.total} tasks done |`);
   L.push(`| T0 artifacts | ${artifacts} |`);
   L.push(`| QA | ${qa} |`);
@@ -291,32 +296,6 @@ export function buildReport(facts) {
   return L.join("\n");
 }
 
-/**
- * How many BUILD/EVAL rounds this run actually completed.
- *
- * `harness-run.md`'s `rounds_used` frontmatter field is written ONCE, at GATE L0.1 (`init run`),
- * as `0` — nothing in the round loop ever rewrites it as rounds complete. The orchestrator's own
- * `RunReturn` carries the real count (`shapeup-run.js`'s `rounds_used: round`), but that value
- * never reaches `reduce ship`, so every real run's report printed "Rounds used | 0" beside its own
- * `results/evaluate-r1.json` — a claim the frontmatter makes about the run, contradicted by the
- * artifact sitting next to it. Derived instead, the same way `probe resume`'s `eval_rounds_done`
- * already does: the highest `evaluate-r<N>.json` result on disk. Falls back to the frontmatter
- * value only when no EVAL round ever ran (the `--tiny` lane has no round concept at all), so a
- * bare or tiny run's reporting is unchanged.
- * @param {string} cwd - Project root.
- * @param {string} slug - Feature slug.
- * @param {(string|undefined)} fallback - `run.rounds_used` from the frontmatter.
- * @returns {(number|string|undefined)} The derived round count, or the fallback.
- */
-function roundsUsed(cwd, slug, fallback) {
-  const dir = resultsDir(cwd, slug);
-  const done = (existsSync(dir) ? readdirSync(dir) : [])
-    .map((f) => f.match(/^evaluate-r(\d+)\.json$/))
-    .filter(Boolean)
-    .map((m) => Number(m[1]));
-  return done.length ? Math.max(...done) : fallback;
-}
-
 /**
  * Gather every fact from disk and render the report.
  * @param {{cwd:string, slug:string, verdict?:string, qa?:string}} opts - Inputs.
@@ -331,12 +310,18 @@ export function generate({ cwd, slug, verdict, qa }) {
   const ledger = readIf(roundLedger(cwd, slug));
   const discovery = readIf(discoveryLedger(cwd, slug));
 
+  // Two numbers, not one: `rounds` (built — an order, a T0 verdict, a build-gate artifact or an
+  // EVAL result) and `roundsJudged` (EVAL actually returned a verdict for), kept separate so a run
+  // whose later rounds never reached EVAL still reports the rounds it built.
+  const derivedRounds = deriveRounds(cwd, slug, run.rounds_used);
+
   const facts = {
     slug,
     at: today(),
     verdict: verdict || run.final_verdict || "not-evaluated",
     qa: qa || (huntReport ? "run" : "skipped"),
-    rounds: roundsUsed(cwd, slug, run.rounds_used),
+    rounds: derivedRounds.rounds_used,
+    roundsJudged: derivedRounds.rounds_judged,
     intakeSha: receipt.intake_sha256,
     board: boardCensus(cwd, slug),
     t0: t0Summary(cwd, slug),

package/kernel/reduce/snapshot.mjs

@@ -25,6 +25,7 @@ import { resolve, join } from "node:path";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { localDir, localRoot, relLocal, globLocal, runSnapshot as runSnapshotPath } from "../lib/paths.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 
 /**
  * Read a JSON file, tolerating absence/parse errors.
@@ -126,8 +127,28 @@ export function deriveSnapshot(cwd) {
   if (existsSync(runPath)) {
     try {
       const fm = frontmatter(readFileSync(runPath, "utf8"));
-      if (MID_RUN.has(fm.status) || ["shipped", "escalated"].includes(fm.status)) snapshot.status = fm.status;
-      if (/^\d+$/.test(fm.rounds_used || "")) snapshot.rounds_used = Number(fm.rounds_used);
+      // The terminal allowlist mirrors kernel/probe/resume.mjs's TERMINAL_STATUSES, not just the two
+      // members it used to carry — a schema/allowlist that disagrees with RUN_STATUSES is silent on
+      // both sides here (findRun only ever surfaces a MID_RUN run today, so this whole branch is
+      // unreachable in practice), but is exactly the divergence class this file's own imports exist
+      // to close elsewhere (deriveRounds, above). "aborted" is a real RUN_STATUSES member.
+      if (MID_RUN.has(fm.status) || ["shipped", "escalated", "aborted"].includes(fm.status)) snapshot.status = fm.status;
+      // MIGRATED to the same mechanical derivation `reduce ship` and `report export` already use
+      // (kernel/probe/rounds.mjs), rather than reading `harness-run.md`'s `rounds_used` literally.
+      // That frontmatter line is written ONCE, as 0, by `init run`, and nothing in the round loop
+      // ever rewrites it — so the third mechanical reader of "how many rounds did this run build"
+      // was the one still reporting the pre-fix number. Measured on a two-round, no-EVAL fixture:
+      // this line alone reported `rounds_used: 0` beside its own `round: 2` a few lines below,
+      // the exact disagreement `deriveRounds` exists to close. `fm.rounds_used` still travels in as
+      // the fallback for a run neither this fix nor deriveRounds can see evidence for (a `--tiny`
+      // lane, or a run from before any of these artifacts existed).
+      const derivedRounds = deriveRounds(cwd, run.slug, fm.rounds_used);
+      if (Number.isFinite(Number(derivedRounds.rounds_used))) snapshot.rounds_used = Number(derivedRounds.rounds_used);
+      // Kept as its OWN field, never folded into rounds_used — a round built is not a round judged,
+      // and collapsing the two into one number is exactly the ambiguity this migration removes.
+      // null (no EVAL result on disk yet) is a real answer and is not written at all, the same
+      // optional-field discipline every other snapshot field here follows.
+      if (Number.isFinite(derivedRounds.rounds_judged)) snapshot.rounds_judged = derivedRounds.rounds_judged;
       if (/^\d+$/.test(fm.max_rounds || "")) snapshot.max_rounds = Number(fm.max_rounds);
       if (fm.auto_level) snapshot.auto_level = fm.auto_level;
       if (fm.spec_folder) snapshot.spec_folder = fm.spec_folder;

package/kernel/report/export.mjs

@@ -47,10 +47,11 @@ import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter } from "../lib/contract.mjs";
 import { runIdFromReceipt, readReceipt } from "../lib/paths.mjs";
 import { TABLES, runRow, dispatchFacts } from "./facts.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 import {
   localDir, activeScope, receipt as receiptPath, harnessRun, ordersDir, resultsDir,
   trials as trialsPath, verdictsDir, evaluationDir, decisions as decisionsPath,
-  exportsDir, exportRunDir,
+  gates as gatesPath, roundBuildDir, exportsDir, exportRunDir,
 } from "../lib/paths.mjs";
 
 export const EXPORT_SCHEMA_VERSION = 1;
@@ -164,6 +165,51 @@ function criterionRows(dir, runId, t) {
   return out;
 }
 
+/**
+ * Flatten one gate-crossing ledger row (`gates.jsonl`, `kernel/gate.mjs`'s sole writer) into a
+ * flat `gate_decision` fact row. The row on disk already carries exactly these fields
+ * (see `appendGateLedger`), so this is a pass-through with a stamped `run_id` fallback rather than
+ * a re-derivation: two readers of "what did this gate decide" must not compute the answer twice.
+ * @param {object} g - One parsed line of `gates.jsonl`.
+ * @param {(string|null)} runId - Run key for a row written before it carried its own.
+ * @returns {object} A flat `gate_decision` row.
+ */
+function gateDecisionRow(g, runId) {
+  return {
+    run_id: g?.run_id ?? runId ?? null,
+    gate: g?.gate ?? null,
+    decision: g?.decision ?? null,
+    status: g?.status ?? null,
+    source: g?.source ?? null,
+    round: g?.round ?? null,
+    has_note: !!(g?.note && String(g.note).trim()),
+  };
+}
+
+/**
+ * Flatten one round build-gate artifact (`kernel/verify/build.mjs`'s `writeRoundBuild`) into a flat
+ * `build_gate` fact row. The gate ends a round exactly as EVAL does (AGENTS.md's round
+ * build gate ⚙), and until now had no fact table at all.
+ * @param {object} a - A parsed round-build artifact.
+ * @param {(string|null)} runId - Run key for an artifact written before it carried its own.
+ * @returns {object} A flat `build_gate` row.
+ */
+function buildGateRow(a, runId) {
+  const steps = Array.isArray(a?.steps) ? a.steps : [];
+  return {
+    run_id: a?.run_id ?? runId ?? null,
+    round: a?.round ?? null,
+    trial: a?.trial ?? null,
+    at: a?.at ?? null,
+    overall: a?.overall ?? null,
+    archetype: a?.archetype ?? null,
+    steps_total: steps.length,
+    steps_failed: steps.filter((s) => !s?.skipped && s?.pass === false).length,
+    warnings: Array.isArray(a?.warnings) ? a.warnings.length : 0,
+    discovered_tasks: Array.isArray(a?.discovered_tasks) ? a.discovered_tasks.length : 0,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // The export itself
 // ---------------------------------------------------------------------------
@@ -190,7 +236,10 @@ export function collectRun(cwd, slug) {
   const results = readJsonDir(resultsDir(cwd, slug), t);
 
   const { dispatch, ac_result, discovery, file_touched } = dispatchFacts({ orders, results, runId });
-  const run = runRow({ receipt: rec, ledger, runId });
+  // Computed here, once, from the same trace this whole function reads, and handed to
+  // runRow rather than re-derived by it: runRow stays pure (no I/O), this function already has cwd.
+  const rounds = deriveRounds(cwd, slug, ledger.rounds_used);
+  const run = runRow({ receipt: rec, ledger, runId, rounds });
 
   // Hook decisions are checkout-wide, so they are FILTERED to this run rather than read from a
   // per-run file. Rows with a null key belong to no run (a hook that fired outside one) and are
@@ -208,6 +257,9 @@ export function collectRun(cwd, slug) {
       t0_verdict: readJsonDir(verdictsDir(cwd, slug), t).map((a) => t0Row(a, runId)),
       criterion_verdict: criterionRows(evaluationDir(cwd, slug), runId, t),
       hook_decision,
+      // The decision that crossed each gate, and the round build gate's own artifact.
+      gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
+      build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
     },
     defects: { records_skipped: t.skipped },
   };

package/kernel/report/facts.mjs

@@ -27,6 +27,11 @@
 export const TABLES = [
   "run", "dispatch", "ac_result", "discovery", "file_touched",
   "trial", "t0_verdict", "criterion_verdict", "hook_decision",
+  // The decision that shipped a run (or any other gate) had a ledger row (`gates.jsonl`)
+  // and no table — a reader had to open the LOCAL trace itself, which the export exists so nobody
+  // has to. `build_gate` is the round build gate's own artifact (kernel/verify/build.mjs), on the
+  // same terms: it ends a round exactly as EVAL does, and had no table either.
+  "gate_decision", "build_gate",
 ];
 
 /** Coerce anything to a finite number, or null. Keeps `0` and rejects `NaN`/`""`/undefined. */
@@ -76,9 +81,14 @@ export function parseOrderStem(orderId) {
  * @param {(object|null)} o.receipt - Parsed `receipt.json`.
  * @param {(object|null)} [o.ledger] - Parsed `harness-run.md` frontmatter (a flat scalar map).
  * @param {(string|null)} [o.runId] - The run key, when already resolved.
+ * @param {({rounds_used:*, rounds_judged:(number|null)}|null)} [o.rounds] - The two-number
+ *   derivation (`probe/rounds.mjs`'s `deriveRounds`), computed by the caller because it needs the
+ *   filesystem and this function stays pure. Falls back to the ledger's own (unreliable — see
+ *   `deriveRounds`) `rounds_used` line when the caller has not derived one, so an existing caller
+ *   is unaffected rather than broken.
  * @returns {(object|null)} The run row, or null when there is no receipt to describe.
  */
-export function runRow({ receipt, ledger = null, runId = null }) {
+export function runRow({ receipt, ledger = null, runId = null, rounds = null }) {
   if (!receipt) return null;
   const c = receipt.config || {};
   const fm = ledger || {};
@@ -87,6 +97,9 @@ export function runRow({ receipt, ledger = null, runId = null }) {
     slug: receipt.slug ?? null,
     started_at: receipt.started_at ?? null,
     closed_at: fm.closed_at && fm.closed_at !== "~" ? fm.closed_at : null,
+    // Why the run ended at a terminal status, written by `probe resume --close` alongside
+    // `closed_at` — the two facts a trace needs to tell a live run from a dead one apart.
+    close_cause: fm.close_cause && fm.close_cause !== "~" ? fm.close_cause : null,
     intake_sha256: receipt.intake_sha256 ?? null,
     intake_chars: num(receipt.intake_chars),
     intake_lines: num(receipt.intake_lines),
@@ -101,8 +114,17 @@ export function runRow({ receipt, ledger = null, runId = null }) {
     // Copied from the ledger, never re-derived: the run's own status line is the harness's answer,
     // and a read plane that recomputed it would be asserting a second one.
     status: fm.status ?? null,
+    // The terminal status `closeRun` alone writes, carried BESIDE `status` rather than instead of
+    // it. `status:` is ordinary phase traffic and a later phase may move it, so an export that
+    // carried only that line could show a run wearing another close's cause. These two disagreeing
+    // is itself the fact worth exporting: it says the ledger was written after the close.
+    closed_status: fm.closed_status && fm.closed_status !== "~" ? fm.closed_status : null,
     final_verdict: fm.final_verdict && fm.final_verdict !== "~" ? fm.final_verdict : null,
-    rounds_used: num(Number(fm.rounds_used)),
+    // Two fields, not one: `rounds_used` is the highest round carrying ANY build evidence,
+    // `rounds_judged` the highest round EVAL actually returned a verdict for. A caller that has not
+    // derived `rounds` falls back to the ledger's own (pre-fix, unreliable) line, non-regression.
+    rounds_used: rounds ? num(Number(rounds.rounds_used)) : num(Number(fm.rounds_used)),
+    rounds_judged: rounds ? num(rounds.rounds_judged) : null,
   };
 }
 

package/{skills/tech-lead → kernel}/schemas/domain.schema.json

@@ -668,14 +668,14 @@
             "string",
             "null"
           ],
-          "description": "Source file of the failure; null/absent when the log line carried no location (raw triple — never invented)."
+          "description": "Source file of the failure; null/absent when the log line named no file at all (raw triple — never invented)."
         },
         "line": {
           "type": [
             "integer",
             "null"
           ],
-          "description": "Line of the failure; null/absent when the log line carried no location. Paired with `file` — a triple has both or neither, and neither is ever invented to satisfy a shape."
+          "description": "Line of the failure; null/absent when the diagnostic carried no line number — independently of `file`, since a diagnostic can name a file with no line (a resource-compiler error, for example). Never invented to satisfy a shape."
         },
         "core_message": {
           "type": "string",
@@ -1891,9 +1891,10 @@
             "building",
             "evaluating",
             "shipped",
-            "escalated"
+            "escalated",
+            "aborted"
           ],
-          "description": "Mirrors harness-run.md frontmatter status."
+          "description": "Mirrors harness-run.md frontmatter status — kernel/probe/resume.mjs's RUN_STATUSES is the source enum this one must not drift from."
         },
         "round": {
           "type": "integer",
@@ -1904,7 +1905,12 @@
           "description": "From the latest t0/verdicts/r<N>-a<M>.json filename."
         },
         "rounds_used": {
-          "type": "integer"
+          "type": "integer",
+          "description": "Highest round carrying any build evidence (an order, a T0 verdict, a round build-gate artifact, or an EVAL result) — kernel/probe/rounds.mjs's deriveRounds(), the same derivation the ship report and the export use. Falls back to harness-run.md's literal frontmatter value only when no such evidence exists on disk."
+        },
+        "rounds_judged": {
+          "type": "integer",
+          "description": "Highest round EVAL actually returned a verdict for (an evaluate-r<N>.json result on disk) — its own field, never folded into rounds_used: a round built is not a round judged. Omitted when no round has been judged yet."
         },
         "max_rounds": {
           "type": "integer"
@@ -2704,10 +2710,10 @@
       }
     },
     "RunArgs": {
-      "description": "C1 — the launch half of the workflow's only conversation. Compiled ONCE by tech-lead at GATE L0 from harness init run output + the L0.8 model matrix + budgets, written to .shapeup/<slug>/run-args.json and handed to the harness run launch as one JSON literal — the workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script and the tech-lead skill both read as the one true shape.",
+      "description": "C1 — the launch half of the workflow's only conversation. Resolved ONCE at GATE L0 from harness init run output + the L0.8 model matrix + budgets, then built by `harness init run-args`, which writes it to .shapeup/<slug>/run-args.json AND prints it — tech-lead passes that printed value to the harness run launch as one JSON literal, never a second, hand-typed copy of it. The workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script, `harness init run-args` and the tech-lead skill all read as the one true shape.",
       "x-tier": "EMBEDDED",
-      "x-location": ".shapeup/<slug>/run-args.json — written fresh by tech-lead on every launch and relaunch; the workflow receives it as its args and never reads other config",
-      "x-writer": "tech-lead (GATE L0, on every launch AND every relaunch after a paused gate)",
+      "x-location": ".shapeup/<slug>/run-args.json — written fresh on every launch and relaunch by `harness init run-args`; the workflow receives it as its args and never reads other config",
+      "x-writer": "harness init run-args (kernel), invoked by tech-lead at GATE L0 on every launch AND every relaunch after a paused gate",
       "x-readers": "the Workflow runtime (shapeup-run, and shapeup-run's own inner round dispatch)",
       "x-not-here": "Run config the LEDGER already carries does NOT get a second home in RunArgs — eval_dimensions, lens, spec_folder, stack, run_cmd, app_url are read off harness-run.md frontmatter by resume-state on every launch AND every relaunch, so a copy here would be a second source that can disagree with the first. RunArgs carries what a workflow cannot derive from disk (identity, budgets, the model matrix, pluginRoot, startedAt) plus noEval, which no frontmatter line holds.",
       "type": "object",
@@ -2759,16 +2765,13 @@
         },
         "budgets": {
           "type": "object",
-          "description": "The three-level circuit breaker's own limits (AGENTS.md) — outer round_budget, inner attempt_budget, and the opt-in wall-clock breaker.",
+          "description": "The two RunArgs-level circuit breakers (AGENTS.md) — outer round_budget, inner attempt_budget. The third, opt-in DEADLINE breaker (the wall-clock budget) is NOT a RunArgs field: it is typed once, at `harness init run --wall-clock-budget`, and lands in the run receipt's `wall_clock_budget_s` — `harness verify budget` reads that receipt field directly and never sees this launch's RunArgs at all, so it has no member here to declare.",
           "properties": {
             "maxRounds": {
               "type": "integer"
             },
             "attemptBudget": {
               "type": "integer"
-            },
-            "wallClockS": {
-              "type": "integer"
             }
           }
         },

package/kernel/verify/envelope.mjs

@@ -12,7 +12,7 @@
 //   #/$defs/Name                       — a definition in the SAME schema document
 //   domain.schema.json#/$defs/Name     — a definition in a SIBLING file (the central domain
 //                                        registry; resolved against the schema's own dir,
-//                                        falling back to skills/tech-lead/schemas/)
+//                                        falling back to kernel/schemas/)
 //
 // Usage (CLI):    node kernel/harness.mjs verify envelope <envelope.json> <schema.json>
 //                 exit 0 = valid, 1 = invalid (errors printed one per line)
@@ -28,7 +28,7 @@ import { runArgs } from "../lib/argv.mjs";
 import { runHook, readStdin, settle } from "../../hooks/lib/decision.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-export const SCHEMAS_DIR = resolve(HERE, "../../skills/tech-lead/schemas");
+export const SCHEMAS_DIR = resolve(HERE, "../schemas");
 
 /**
  * Validate a value against the JSON-Schema subset the envelope schemas use (type, required,

package/kernel/verify/skills.mjs

@@ -45,7 +45,7 @@ export const PLUGIN_ROOT = resolve(HERE, "../..");
  *   its own domain registry has a broken installation, which is the very thing being checked.
  */
 export function roster(root = PLUGIN_ROOT) {
-  const schemaPath = join(root, "skills/tech-lead/schemas/domain.schema.json");
+  const schemaPath = join(root, "kernel/schemas/domain.schema.json");
   const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
   const names = schema?.$defs?.WorkerName?.enum;
   if (!Array.isArray(names) || !names.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -121,7 +121,7 @@ covered AC is a requirement the run can be measured against.
 |---|---|---|
 | `reconcile` | Verify `ledger.feature == payload.feature` (mismatch → STOP). Map each `[+]` Keep item → its owning UC; new task continues numbering (never renumber); `~`/Cut → synthesis "Hammered Out" row, no file. A Keep item asserting a new invariant → APPEND `[INV-NN]` + TS-INV row to that UC (append-only sections in your substrate). A new actor/action with no UC → `status: "escalated"` + a `deviations[]` spec-ambiguity entry: spawning a UC mid-cycle is silent re-shaping, the PO decides. Finish with board-derive (appetite overflow → report) + spec-lint | re-run phases 1–5; edit UC Steps; resolve the appetite HAMMER yourself |
 | `retrofit-surface` | Append `## Test Surface` (derived rows only, after Error Cases) to each UC of a pre-surface spec; an all-sources-empty UC gets the explicit empty-sources line | touch anything else — append-only substrate |
-| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
+| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. **The `source` cell, and any other prose in this file, cites the committed pitch or shaping doc — never the gitignored run-tier path** (`.shapeup/<slug>/intake.md`, or any other `.shapeup/` path): spec-lint's `TIER-DIRECTION` rule reds a committed file naming that path in ANY form, a bare path in a sentence exactly as much as a `[[tasks/...]]` wikilink, because it dangles on every other clone. When the intake has no committed original to name, describe the run tier without a path (`"the pitch staged for this run"`) rather than citing where it actually lives. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
 ---
 
 ## Anti-rationalization table

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -275,6 +275,12 @@ Always use wikilinks (double brackets), never relative paths like `../domain-mod
   `.shapeup/` is gitignored, so a committed task link dangles on every fresh clone.
   spec-lint flags it as a red `TIER-DIRECTION` finding. Coverage views (synthesis
   traceability) record derived counts/status, not task ids.
+- **The rule is not only about wikilinks.** `TIER-DIRECTION` reds *any* line in a SHARED
+  doc that names a `.shapeup/` path — a bare path cited in a sentence or a table cell,
+  not only a `[[tasks/...]]` link. A provenance sentence that names its real source
+  (`"extracted from .shapeup/<slug>/intake.md"`) reds for the same reason a task
+  wikilink does: the path dangles on every other clone. Cite the committed pitch or
+  shaping doc instead, or describe the run tier without a path.
 - `[[tasks/...]]` wikilinks are valid only inside LOCAL documents (task files, the board,
   EVAL reports), where they resolve against the LOCAL root (`.shapeup/<slug>/`);
   every wikilink in a SHARED doc stays `spec_folder`-relative.

package/skills/coach/SKILL.md

@@ -93,7 +93,7 @@ never lands in any worker's KB.
 Orchestrated, this skill is dispatched like every worker: a **WorkOrder** in (`--order <path>`,
 operation `coach` or `scan`), a **WorkResult** out. Standalone, the raw feedback is passed
 directly; it maps onto the one payload field registered for this worker in the central domain
-registry (`skills/tech-lead/schemas/domain.schema.json`, `x-payload-by-worker`):
+registry (`kernel/schemas/domain.schema.json`, `x-payload-by-worker`):
 
 | Payload field | Standalone form | Meaning |
 |---|---|---|
@@ -117,7 +117,13 @@ fields nobody used" → "Prefer the minimum DTO that satisfies the AC; don't add
 fields"). Keep the originating why — a rule without its reason gets ignored or misapplied.
 
 ### Step 2 — ⏸ GATE COACH-1: Categorize (ASK, never assume)
-This is the load-bearing gate. **Do not infer which skill a rule belongs to** — a
+This is the load-bearing gate. **Resolve it first** — `node
+"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve COACH-1 --slug <slug>
+[--file <path>|--preset <name>]` — so the ledger carries a row for the decision this gate makes,
+same as every other gate in the run. Exit 0 (`decision=skip`) — an unattended lane with no live PO;
+record nothing and stop here, the same outcome the CI preset's own note already documents. Exit 4
+(`ask`) — proceed with the categorization below, which IS the PO conversation this decision opens.
+**Do not infer which skill a rule belongs to** — a
 miscategorized rule lands in a file the wrong worker reads (or no worker reads). Present every
 candidate rule and ask the PO to assign each one. Emit this block, then stop and wait:
 

package/skills/hill-chart/SKILL.md

@@ -10,7 +10,7 @@ re-runs a computation that would erase true history.**
 
 You are not a worker: no WorkOrder, no WorkResult, invoked directly by the user (or by `/hill`)
 exactly like `shapeup` is. There is nothing to declare in
-`skills/tech-lead/schemas/domain.schema.json` and nothing to teach `harness compile` or
+`kernel/schemas/domain.schema.json` and nothing to teach `harness compile` or
 `harness reduce ingest` — those steps exist only for dispatched workers.
 
 ## What you read
@@ -71,9 +71,8 @@ Build one `{ scope_id, phase }` object per file.
 ## Rendering — the injection contract
 
 The engine ships at `assets/dashboard.template.html` — a complete, self-contained HTML page
-(inline CSS/JS, no external fetch beyond Google Fonts, no build step — the same convention as
-this repo's own `docs/visualize/*.html`). Do not rewrite it from a text description; read it,
-fill in real data, and write the result.
+(inline CSS/JS, no external fetch beyond Google Fonts, no build step). Do not rewrite it from a
+text description; read it, fill in real data, and write the result.
 
 1. For each discovered slug, build one entry:
 

package/skills/scope-hammer/SKILL.md

@@ -67,8 +67,16 @@ H0.0  Ownership is DERIVED, never stated. Before the census says "no scope owns
 H0.1  Unresolved scopes (breaker cases only):
         - uphill/downhill scopes when round_budget hit 0 → CARRY candidates (their own hill
           phase + open unknowns, from hill/<scope-id>.yml)
-        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates, tagged
-          with the T0 failure that stalled them (from the last red t0/verdicts/*.json)
+        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates. Exhaustion
+          is DERIVED, never read off `t0/verdicts/*.json` directly — a compiled order or a T0
+          verdict is writable by the very scope being judged and proves nothing on its own. Run
+            node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe attempts --slug <slug> \
+              --scope <scope-id> --round <n> --attempt-budget <n>
+          and cite its `spent`/`tripped` fields (exit 1 = tripped) — an attempt counts only when a
+          dispatch receipt AND either a leg-completion row or a WorkResult attest it, so a leg still
+          in flight holds it open rather than reading as exhausted. This is the SAME derivation the
+          round loop's own inner breaker reads, so the census and the breaker cannot disagree about
+          the same exhaustion the way a live run once measured.
 H0.2  QA findings (qa-edge-hunter's hunt-report.md, when present) — all `~` by default.
 H0.3  Discovered-task ledger entries still open (discovery/ledger.md, `[+]`/`~` unresolved).
 H0.4  Attempt-budget hammer proposals (scopes that exhausted their T0 attempts during BUILD).
@@ -150,7 +158,7 @@ the harness (this is neither the generator nor the evaluator).
 Orchestrated, this skill is dispatched like every worker: a **WorkOrder** in (`--order <path>`,
 operation `hammer`), a **WorkResult** out. The standalone flags below map 1:1 onto the payload
 fields registered for this worker in the central domain registry
-(`skills/tech-lead/schemas/domain.schema.json`, `x-payload-by-worker`):
+(`kernel/schemas/domain.schema.json`, `x-payload-by-worker`):
 
 | Payload field | Standalone flag | Meaning |
 |---|---|---|