shapeup-sdlc 3.6.0 → 3.7.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -11,8 +11,9 @@ Skills and commands are named short throughout this file; every one of them reso
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
-- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round.
+- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
 ### Phase 1 — Shaping (`/shapeup`)
 1. Set Boundaries → `/shapeup shaping`
@@ -80,7 +81,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
 - **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
-- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
+- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,
   GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,

package/kernel/compile.mjs

@@ -31,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "./verify/envelope.mjs";
 import { readTrials } from "./verify/t0.mjs";
 import { runArgs } from "./lib/argv.mjs";
-import { readRunId } from "./lib/paths.mjs";
+import { readRunId, dispatchReceipts, legLedger } from "./lib/paths.mjs";
 // `specDir` is aliased: this module has a local `let specDir` holding the resolved, possibly
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
@@ -41,6 +41,8 @@ import {
 import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
+import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
+import { readLegs } from "./probe/leg.mjs";
 import { latestRoundBuild } from "./verify/build.mjs";
 // The SAME matcher the sandbox hook enforces with. "Is this cited file inside this scope's
 // substrate" has to mean exactly what the guard means, or a bug is addressed to a scope that is
@@ -816,6 +818,40 @@ export async function cli(rawArgv) {
   const round = flag("round");
   const attempt = flag("attempt");
 
+  // AN ATTEMPT MAY NOT OPEN OVER AN UNANSWERED ONE — the write half of the attested-channel rule.
+  //
+  // `--attempt` is a flag: the CALLER picks the number, and nothing here used to check that the
+  // previous one had come back. Measured on a consumer run: attempt 2 was compiled and T0-verified
+  // while attempt 1 was still in flight, so the round graded the tree attempt 1 was still writing,
+  // counted the attempt, and stopped at GATE H with most of its budget and clock unspent. An order
+  // and a T0 verdict are both writable by the very scope being judged; only a dispatch receipt, a
+  // leg row or a WorkResult attests that work actually happened.
+  //
+  // FAILS OPEN, NEVER CLOSED, unless the bad state is positively proven. The proof required is the
+  // receipts ledger EXISTING while carrying no row for the previous attempt: a lane that does not
+  // attest dispatches at all (no ledger on disk) cannot be judged by this rule and is waved
+  // through, so `--tiny`, a prose round loop and a standalone build are untouched.
+  if (scope?.scope_id && round && attempt > 1) {
+    const receiptsPath = dispatchReceipts(cwd, slug);
+    if (existsSync(receiptsPath)) {
+      const prev = attemptEvidence(
+        cwd, slug, scope.scope_id, round, attempt - 1,
+        readReceipts(receiptsPath), readLegs(legLedger(cwd, slug)),
+      );
+      if (prev.state !== "spent") {
+        const why = prev.state === "unattested"
+          ? "no dispatch receipt was ever written for it"
+          : "it was dispatched but has neither a leg-completion row nor a WorkResult";
+        console.error(
+          `compile-order: refusing to open attempt ${attempt} for "${scope.scope_id}" in round ${round} — ` +
+          `attempt ${attempt - 1} (${prev.orderId}) is unanswered: ${why}. Grading a tree the previous ` +
+          `attempt may still be writing counts an attempt that never ran, and spends a budget on work ` +
+          `nobody did. Wait for it to return, or record its outcome, before opening the next one.`);
+        process.exit(3);
+      }
+    }
+  }
+
   // The fix round's inbound evidence. Derived here, from the ledgered verdict, for every lane —
   // the workflow, `--tiny`, the prose round loop and a standalone `/build` all compile through
   // this line, and none of them can pass a payload to a build order (see the banner above).

package/kernel/harness.mjs

@@ -32,7 +32,7 @@
 //   gate                                      An answer file with a source, not a vibe.
 //   probe    resume · t0 · stats · digest ·   Read-only queries over run state. `concurrency`
 //            concurrency · leg · eval ·        answers how many legs ran at once and what the
-//            owner · requirements
+//            owner · requirements · attempts
 //                                              fan-out bought, and refuses a figure the record set
 //                                              cannot support rather than printing a plausible one.
 //                                              `leg` answers whether a scope's work reached the
@@ -50,6 +50,12 @@
 //                                              answers which pitch clause a verdict reached, joined
 //                                              through the plan's own covers: edge — the L4 line and
 //                                              GATE H's census cite it for the same reason.
+//                                              `attempts` answers how many of a scope's attempts are
+//                                              ATTESTED (a dispatch receipt AND a leg row or a
+//                                              WorkResult), never the order set or the T0 verdict
+//                                              set alone — the round loop's inner breaker and
+//                                              scope-hammer's census both cite it, so they cannot
+//                                              disagree about the same exhaustion again.
 //   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
 //                                              writes GATE L0.9b's launch record and echoes it.
 //   report   export                           Projects the run's records as fact tables.
@@ -86,7 +92,7 @@ export const ROUTES = {
     resume: "./probe/resume.mjs", t0: "./probe/t0.mjs", stats: "./probe/stats.mjs",
     digest: "./probe/digest.mjs", concurrency: "./probe/concurrency.mjs",
     leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
-    requirements: "./probe/requirements.mjs",
+    requirements: "./probe/requirements.mjs", attempts: "./probe/attempts.mjs",
   },
   init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
   report: { export: "./report/export.mjs", _default: "export" },

package/kernel/probe/attempts.mjs

@@ -0,0 +1,135 @@
+// probe attempts — "how many of this scope's attempts are ATTESTED work, not writable artifacts?"
+//
+// CONTRACT. A bounded, read-only query over one scope's attested channels for one round: dispatch
+// receipts (`receipts/dispatch.jsonl`), leg-completion rows (`legs.jsonl`) and WorkResults
+// (`results/`). Prints `{scope_id, round, attempt_budget, spent, in_flight, unattested, green,
+// tripped, attempts}` on stdout; exits 0 when the breaker holds, 1 when it has tripped, 2 on a bad
+// argv. Writes nothing.
+//
+// WHY IT EXISTS. Measured on a real run: attempt 2 of a scope was compiled and T0-verified
+// several minutes BEFORE attempt 1 ingested — while attempt 1 was still in flight. No worker was
+// ever dispatched for attempt 2:
+// `receipts/dispatch.jsonl`, `legs.jsonl` and `results/` carried no row for it. A derivation keyed
+// off the order set (`orders/`) or the T0 verdict set (`t0/verdicts/`) alone counts a compiled
+// order or a green trial as a spent attempt regardless of whether a worker ever ran — both are
+// WRITABLE by the very leg whose exhaustion is being judged. This module counts an attempt as
+// SPENT only when a dispatch receipt attests it started AND either a leg-completion row or a
+// WorkResult on disk attests it closed. Neither channel alone is enough: a receipt with no result
+// is a leg still in flight (open, not spent — the breaker must not trip on unanswered work), and a
+// result or verdict with no receipt is unattested — no worker ran, which is the shape that
+// produced this module.
+//
+// WHY THE SAME FUNCTION SERVES THE BREAKER AND THE CENSUS. Before this module, the round loop's
+// inner breaker and `scope-hammer`'s GATE H0 census read different evidence for the same question
+// — the loop trusted the worker's own self-reported `attempts_used`/`breaker` (schema-shaped, not
+// re-verified), the census read `t0/verdicts/*.json` directly — and disagreed on the measured run.
+// One shared, attested derivation is what makes "the census and the breaker agree" true by
+// construction rather than by coincidence: `skills/scope-hammer/SKILL.md` cites this same probe
+// the way it already cites `probe owner` for ownership claims.
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { runArgs } from "../lib/argv.mjs";
+import { dispatchReceipts, legLedger, resultsDir } from "../lib/paths.mjs";
+import { readLegs } from "./leg.mjs";
+import { greenVerdict } from "./t0.mjs";
+
+/**
+ * Every dispatch-receipt row on disk, tolerant of a torn last line (mirrors {@link readLegs}).
+ * @param {string} path - `receipts/dispatch.jsonl`.
+ * @returns {object[]} Parsed rows; an unparsable line is skipped rather than fatal.
+ */
+export function readReceipts(path) {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, "utf8").split("\n").filter(Boolean)
+    .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+    .filter(Boolean);
+}
+
+/**
+ * One attempt's evidence across the three attested channels, and the state it derives to.
+ *
+ * `unattested` (no receipt at all) counts as though the attempt never happened — the order and any
+ * T0 verdict may still be sitting on disk, written by something other than a dispatched worker, and
+ * neither is asked here. `in-flight` (a receipt, but no leg row and no result) is a real dispatch
+ * whose leg has not yet closed: open, not spent. `spent` is closed either way a leg closes — via
+ * `reduce ingest`'s own leg-completion row, or a WorkResult already on disk pending ingest.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} scopeId - Scope contract id (the order id's own address, e.g. `shell-r1-a2`).
+ * @param {number} round - Build round.
+ * @param {number} attempt - Attempt number within the round.
+ * @param {object[]} receipts - Pre-read `receipts/dispatch.jsonl` rows (avoids re-reading per attempt).
+ * @param {object[]} legs - Pre-read `legs.jsonl` rows.
+ * @returns {{orderId:string, hasReceipt:boolean, hasResult:boolean, hasLeg:boolean, state:("unattested"|"in-flight"|"spent")}}
+ */
+export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, legs) {
+  const orderId = `${slug}/${scopeId}-r${round}-a${attempt}`;
+  const hasReceipt = receipts.some((r) => r?.order_id === orderId);
+  const hasLeg = legs.some((r) => r?.order_id === orderId);
+  const hasResult = existsSync(join(resultsDir(cwd, slug), `${scopeId}-r${round}-a${attempt}.json`));
+  const state = !hasReceipt ? "unattested" : (hasResult || hasLeg) ? "spent" : "in-flight";
+  return { orderId, hasReceipt, hasResult, hasLeg, state };
+}
+
+/**
+ * A scope's attempt census for one round, derived ONLY from attested channels — the function both
+ * the round loop's inner breaker and scope-hammer's GATE H0 census call, so they cannot drift apart
+ * again the way a measured run found them.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} scopeId - Scope contract id.
+ * @param {number} round - Build round.
+ * @param {number} attemptBudget - The scope's configured `attempt_budget`.
+ * @returns {{scope_id:string, round:number, attempt_budget:number, spent:number, in_flight:number,
+ *   unattested:number, green:boolean, tripped:boolean, attempts:object[]}} `tripped` is true only
+ *   when every attempt within budget is genuinely SPENT and none produced a green T0 — an attempt
+ *   still in flight holds the breaker open regardless of how many slots are nominally used.
+ */
+export function scopeAttempts(cwd, slug, scopeId, round, attemptBudget) {
+  const receipts = readReceipts(dispatchReceipts(cwd, slug));
+  const legs = readLegs(legLedger(cwd, slug));
+  const attempts = [];
+  let spent = 0, inFlight = 0, unattested = 0;
+  for (let a = 1; a <= attemptBudget; a++) {
+    const ev = attemptEvidence(cwd, slug, scopeId, round, a, receipts, legs);
+    if (ev.state === "spent") spent++;
+    else if (ev.state === "in-flight") inFlight++;
+    else unattested++;
+    attempts.push({ attempt: a, ...ev });
+  }
+  const { green } = greenVerdict(cwd, slug, scopeId, round);
+  return {
+    scope_id: scopeId, round, attempt_budget: attemptBudget,
+    spent, in_flight: inFlight, unattested, green,
+    tripped: !green && spent >= attemptBudget,
+    attempts,
+  };
+}
+
+export const ARGV_SPEC = {
+  usage: "harness.mjs probe attempts --slug <slug> --scope <scope-id> --round N --attempt-budget N [--cwd <dir>]",
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  slug: { type: "str", required: true },
+  scope: { type: "str", required: true },
+  round: { type: "int", min: 1, required: true },
+  "attempt-budget": { type: "int", min: 1, required: true },
+  cwd: { type: "path" },
+};
+
+/**
+ * Report one scope's attested attempt census for one round.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {void} Exits 0 when the breaker holds, 1 when it has tripped — the shape a caller (or a
+ *   census citing this row) can branch on without parsing prose.
+ */
+export function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = resolve(args.cwd || process.cwd());
+  const r = scopeAttempts(cwd, args.slug, args.scope, args.round, args.attemptBudget);
+  console.log(JSON.stringify(r));
+  process.exit(r.tripped ? 1 : 0);
+}

package/kernel/probe/resume.mjs

@@ -64,8 +64,10 @@ import { globToRegExp } from "../verify/spec.mjs";
 import {
   intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
   orientDir, activeOrder, usecasesDir, breadboard, receipt, readReceipt, requirements,
+  exportRunDir,
 } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
+import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
  *  not a write — the whole point of this file is that a write nobody validates is a write nobody
@@ -81,6 +83,66 @@ export const RUN_STATUSES = ["orienting", "mapping", "building", "evaluating", "
  */
 export const TERMINAL_STATUSES = ["shipped", "aborted", "escalated"];
 
+/**
+ * The RunReturn union (`kernel/schemas/domain.schema.json` `$defs/RunReturn.properties.status.enum`)
+ * mapped to what closing the run means for each arm — the derivation `closeIfTerminal`
+ * (`skills/tech-lead/workflows/shapeup-run.js`) now reads instead of a hand-typed
+ * `status !== "aborted" && status !== "shipped"` pair that referenced {@link TERMINAL_STATUSES}
+ * zero times and so could not see when a new arm went unhandled.
+ *
+ * A lookup answers one of three ways, and the distinction is load-bearing for what this map must
+ * catch: an arm ABSENT from this object (never listed as a key) returns `undefined` — an arm the
+ * schema carries that nobody has mapped, which a caller must treat as a defect, never as "fine to
+ * skip". An arm mapped to a terminal status closes the run as that status. An arm mapped to `null`
+ * is EXPLICITLY non-terminal — `paused` resumes on relaunch and `ok` is one inner round finishing,
+ * not the run — so it is a key with a falsy value, not an omission a reader could mistake for "not
+ * decided yet".
+ *
+ * `gate_h` → `escalated`: the breaker that tripped (`outer`/`inner`/`deadline`) travels in
+ * `close_cause`, never as a new member of {@link TERMINAL_STATUSES} or {@link RUN_STATUSES} — a
+ * circuit breaker tripping is not a new way a run ends, it is the reason an existing one
+ * (`escalated`) fires this time.
+ *
+ * @type {Object<string, (string|null)>}
+ */
+export const RUN_RETURN_CLOSE = {
+  shipped: "shipped",
+  aborted: "aborted",
+  gate_h: "escalated",
+  paused: null,
+  ok: null,
+};
+
+/**
+ * Resolve one RunReturn arm to a close outcome and, when the arm is terminal, perform the close —
+ * the single call `closeIfTerminal` makes instead of deciding locally which arms are terminal.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} arm - A `RunReturn.status` value.
+ * @param {(string|null)} [cause] - Why the run ended there; only used when `arm` is terminal.
+ * @param {boolean} [withExport] - Forwarded to {@link closeRun} — defaults true. The one caller
+ *   that ever passes `false` is a test fixture proving the export assertion is real — a check that
+ *   cannot fail did not happen; production call sites never set this.
+ * @returns {({ok:true, arm:string, terminal:false, reason:string} |
+ *   {ok:false, arm:string, reason:string} |
+ *   ({ok:boolean, arm:string, terminal:true} & ReturnType<typeof closeRun>))} `terminal:false` when
+ *   `arm` maps to `null` (nothing closed, not an error). `ok:false` with no `terminal` field when
+ *   `arm` is not a key of {@link RUN_RETURN_CLOSE} at all — a schema arm this map has not been
+ *   taught, which must never be silently treated as non-terminal. Otherwise the {@link closeRun}
+ *   outcome, tagged with the arm that produced it.
+ */
+export function closeArm(cwd, slug, arm, cause = null, withExport = true) {
+  if (!Object.hasOwn(RUN_RETURN_CLOSE, arm)) {
+    return { ok: false, arm, reason: `closeArm: "${arm}" is not a RunReturn arm this kernel maps — known arms: ${Object.keys(RUN_RETURN_CLOSE).join(", ")}` };
+  }
+  const status = RUN_RETURN_CLOSE[arm];
+  if (!status) {
+    return { ok: true, arm, terminal: false, reason: `"${arm}" is explicitly non-terminal — no close` };
+  }
+  return { ...closeRun(cwd, slug, { status, cause, withExport }), arm, terminal: true };
+}
+
 /** ORIENT's four artifacts (skills/orient/SKILL.md §Outputs): three by exact name, plus a spike
  *  whose filename carries the area it spiked (`spike-<area>.md`, or `spike-not-needed.md` when
  *  the risk scan came back rank 0 — both count, because both are ORIENT having finished). */
@@ -498,6 +560,40 @@ function writeCloseLines(body, { status, closedAt, cause }) {
   return out;
 }
 
+/**
+ * Export a just-closed run's own records into fact tables, best-effort
+ * (`report export`, `kernel/report/export.mjs`). {@link closeRun} calls this for every terminal
+ * status except `"shipped"`: the Ship phase (`skills/tech-lead/workflows/shapeup-run.js`) already
+ * calls `report export` itself, several lines before this file's own close-out runs, and that call
+ * site is left untouched on purpose — the shipped path's export stays byte-comparable to what it
+ * wrote before Stage 2. `aborted`, `escalated` and `gate_h` (which closes as `escalated`, see
+ * {@link RUN_RETURN_CLOSE}) never reached that call site at all, because it sits inside a phase
+ * those endings never enter — so a run ending any of them left its whole trace (orders, results,
+ * T0 verdicts, hook decisions, `graph.jsonl`) in the gitignored LOCAL tier with nothing durable
+ * surviving the next `init run`'s wipe. This is the read that was missing for those endings, run at
+ * the one point every one of them passes through: the close itself.
+ *
+ * FAIL-OPEN, the hook discipline (CLAUDE.md) extended to a write that is not a hook: an export that
+ * cannot write — a blocked or missing exports directory, a full disk — must never turn a close that
+ * DID take into one that looks like it did not. The three facts {@link closeRun} just wrote
+ * (`closed_status`/`close_cause`/`closed_at`) are never touched by this function; a failure here is
+ * handed back to the caller as a warning string, never thrown.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {(string|null)} A one-line warning when the export did not complete; `null` on success.
+ */
+function exportOnClose(cwd, slug) {
+  try {
+    const collected = collectRun(cwd, slug);
+    if (!collected) return `export on close: no readable receipt for "${slug}" — nothing to export`;
+    writeRun(collected, exportRunDir(cwd, collected.run_id ?? slug));
+    return null;
+  } catch (e) {
+    return `export on close: ${e.message}`;
+  }
+}
+
 /**
  * Close the run: a terminal status, its cause, and a close timestamp, written together in ONE
  * pass.
@@ -548,20 +644,26 @@ function writeCloseLines(body, { status, closedAt, cause }) {
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
- * @param {{status:string, cause:(string|null)}} o - The terminal status (one of
- *   {@link TERMINAL_STATUSES}) and why the run ended there. `cause` travels through `uncoerce` (the
- *   one dialect `harness-run.md`'s frontmatter is read and written in), so free prose — quotes and
- *   colons included — round-trips as one frontmatter line; an embedded newline is collapsed to a
- *   space first, because this dialect is line-based and could not carry one either way.
+ * @param {{status:string, cause:(string|null), withExport?:boolean}} o - The terminal status (one
+ *   of {@link TERMINAL_STATUSES}) and why the run ended there. `cause` travels through `uncoerce`
+ *   (the one dialect `harness-run.md`'s frontmatter is read and written in), so free prose — quotes
+ *   and colons included — round-trips as one frontmatter line; an embedded newline is collapsed to
+ *   a space first, because this dialect is line-based and could not carry one either way.
+ *   `withExport` (default true) gates {@link exportOnClose} — every status except `"shipped"` runs
+ *   it on a successful close; `false` exists only for a test fixture proving the export assertion
+ *   is real, never for a production call site.
  * @returns {{ok:boolean, path:string, status:string, closed_at?:string, cause?:(string|null),
  *   reason?:string, closed_status?:string, superseded?:boolean, decision?:string,
- *   prior_cause?:(string|null), prior_closed_at?:string}} Outcome. A refused overwrite (already
- *   closed with a DIFFERENT terminal status) carries `closed_status`/`closed_at`/`cause` naming what
- *   is actually on disk. A successful supersede (same status, different cause) carries
- *   `superseded:true`, `decision:"superseded"` (the one-token signal the courier boundary in
- *   `shapeup-run.js` relays verbatim — see its own `cmd()` banner) and the prior close it folded in.
+ *   prior_cause?:(string|null), prior_closed_at?:string, export_warning?:string}} Outcome. A refused
+ *   overwrite (already closed with a DIFFERENT terminal status) carries
+ *   `closed_status`/`closed_at`/`cause` naming what is actually on disk. A successful supersede
+ *   (same status, different cause) carries `superseded:true`, `decision:"superseded"` (the
+ *   one-token signal the courier boundary in `shapeup-run.js` relays verbatim — see its own
+ *   `cmd()` banner) and the prior close it folded in. Any successful, non-`"shipped"` close carries
+ *   `export_warning` when {@link exportOnClose} could not write the run's fact tables — the close
+ *   itself still stands; this is advisory only.
  */
-export function closeRun(cwd, slug, { status, cause = null } = {}) {
+export function closeRun(cwd, slug, { status, cause = null, withExport = true } = {}) {
   const p = harnessRun(cwd, slug);
   if (!TERMINAL_STATUSES.includes(status)) {
     return { ok: false, path: p, status, reason: `closeRun: "${status}" is not terminal — expected one of ${TERMINAL_STATUSES.join(" | ")}` };
@@ -574,6 +676,15 @@ export function closeRun(cwd, slug, { status, cause = null } = {}) {
     return { ok: false, path: p, status, reason: `harness-run.md carries no "status:"/"closed_at:" line to replace — the ledger's frontmatter is malformed (references/protocol.md)` };
   }
 
+  // The Ship phase (`shapeup-run.js`) already exports a shipped run itself, before this call ever
+  // runs — Stage 2 adds the endings that wrote nothing, and leaves that path untouched.
+  const shouldExport = withExport && status !== "shipped";
+  const withExportWarning = (result) => {
+    if (!shouldExport) return result;
+    const warning = exportOnClose(cwd, slug);
+    return warning ? { ...result, export_warning: warning } : result;
+  };
+
   // Truncated, not elided: a cause this long has already done its job in the run's own log — the
   // ledger line is a pointer back to it, not the full transcript. Newlines are collapsed to spaces
   // FIRST — this dialect is line-based, so a raw embedded newline would split one field into a value
@@ -588,7 +699,7 @@ export function closeRun(cwd, slug, { status, cause = null } = {}) {
   if (priorClosedStatus && priorClosedAt) {
     if (priorClosedStatus === status && normCause === priorCause) {
       // The identical fact, restated — a retried or duplicated call costs nothing.
-      return { ok: true, path: p, status, closed_at: priorClosedAt, cause: priorCause, decision: "idempotent", reason: `already closed as "${status}" at ${priorClosedAt} — idempotent no-op` };
+      return withExportWarning({ ok: true, path: p, status, closed_at: priorClosedAt, cause: priorCause, decision: "idempotent", reason: `already closed as "${status}" at ${priorClosedAt} — idempotent no-op` });
     }
     if (priorClosedStatus !== status) {
       // A DIFFERENT terminal status over an already-closed run — refused outright, the original
@@ -613,10 +724,10 @@ export function closeRun(cwd, slug, { status, cause = null } = {}) {
     if (afterSup.status !== status || !afterSup.closed_at || afterSup.closed_at === "~") {
       return { ok: false, path: p, status, reason: `wrote the superseding close but the ledger reads back status="${afterSup.status}" closed_at="${afterSup.closed_at}" — the write did not take` };
     }
-    return {
+    return withExportWarning({
       ok: true, path: p, status, closed_at: afterSup.closed_at, cause: afterSup.close_cause ?? null,
       superseded: true, decision: "superseded", prior_cause: priorCause, prior_closed_at: priorClosedAt,
-    };
+    });
   }
 
   const closedAt = new Date().toISOString();
@@ -628,7 +739,7 @@ export function closeRun(cwd, slug, { status, cause = null } = {}) {
   if (after.status !== status || !after.closed_at || after.closed_at === "~") {
     return { ok: false, path: p, status, reason: `wrote the close but the ledger reads back status="${after.status}" closed_at="${after.closed_at}" — the write did not take` };
   }
-  return { ok: true, path: p, status, closed_at: after.closed_at, cause: after.close_cause ?? null, decision: "closed" };
+  return withExportWarning({ ok: true, path: p, status, closed_at: after.closed_at, cause: after.close_cause ?? null, decision: "closed" });
 }
 
 /**
@@ -658,7 +769,8 @@ export function writeActiveOrder(cwd, slug, orderPath) {
 /** The typed argv contract (see `./lib/argv.mjs`). */
 export const ARGV_SPEC = {
   usage: "harness.mjs probe resume --slug <slug> [--cwd <dir>] " +
-         "[--require <phase> | --set-status <status> | --set-active-order <path> | --close <status> [--cause <text>]]",
+         "[--require <phase> | --set-status <status> | --set-active-order <path> | " +
+         "--close <status> | --close-arm <RunReturn.status> [--cause <text>]]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str", required: true },
   cwd: { type: "path" },
@@ -667,6 +779,9 @@ export const ARGV_SPEC = {
   "set-active-order": { type: "str" },
   // The one call site that stamps a terminal status, its cause and closed_at together.
   close: { type: "enum", values: TERMINAL_STATUSES },
+  // Not `--close`: the caller (shapeup-run.js's closeIfTerminal) hands over a RunReturn arm, never
+  // a status it decided was terminal itself — RUN_RETURN_CLOSE/closeArm above make that call.
+  "close-arm": { type: "str" },
   cause: { type: "str" },
 };
 
@@ -681,13 +796,13 @@ export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = args.cwd || process.cwd();
 
-  const ops = [args.require && "--require", args.setStatus && "--set-status", args.setActiveOrder && "--set-active-order", args.close && "--close"].filter(Boolean);
+  const ops = [args.require && "--require", args.setStatus && "--set-status", args.setActiveOrder && "--set-active-order", args.close && "--close", args.closeArm && "--close-arm"].filter(Boolean);
   if (ops.length > 1) {
     process.stderr.write(JSON.stringify({ error: "conflicting_flags", flags: ops, expected: "one operation per invocation" }) + "\n");
     process.exit(2);
   }
-  if (args.cause !== undefined && !args.close) {
-    process.stderr.write(JSON.stringify({ error: "conflicting_flags", flags: ["--cause"], expected: "--cause is only meaningful with --close" }) + "\n");
+  if (args.cause !== undefined && !args.close && !args.closeArm) {
+    process.stderr.write(JSON.stringify({ error: "conflicting_flags", flags: ["--cause"], expected: "--cause is only meaningful with --close or --close-arm" }) + "\n");
     process.exit(2);
   }
 
@@ -724,6 +839,17 @@ export function cli(rawArgv) {
     process.exit(r.ok ? 0 : 3);
   }
 
+  // The arm-derived close: the caller hands a RunReturn arm and this kernel decides — via
+  // RUN_RETURN_CLOSE/closeArm above — whether it is terminal and, if so, what status it closes as.
+  // Exit 0 for both a real close AND a correctly-declined non-terminal arm (`terminal:false`) —
+  // neither is an error the caller (shapeup-run.js's closeIfTerminal) should treat as failed; only
+  // an arm this map does not recognize at all, or a close `closeRun` itself refuses, exits non-zero.
+  if (args.closeArm) {
+    const r = closeArm(cwd, args.slug, args.closeArm, args.cause ?? null);
+    console.log(JSON.stringify(r));
+    process.exit(r.ok ? 0 : 3);
+  }
+
   console.log(JSON.stringify(deriveResumeState(cwd, args.slug)));
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -121,7 +121,7 @@ covered AC is a requirement the run can be measured against.
 |---|---|---|
 | `reconcile` | Verify `ledger.feature == payload.feature` (mismatch → STOP). Map each `[+]` Keep item → its owning UC; new task continues numbering (never renumber); `~`/Cut → synthesis "Hammered Out" row, no file. A Keep item asserting a new invariant → APPEND `[INV-NN]` + TS-INV row to that UC (append-only sections in your substrate). A new actor/action with no UC → `status: "escalated"` + a `deviations[]` spec-ambiguity entry: spawning a UC mid-cycle is silent re-shaping, the PO decides. Finish with board-derive (appetite overflow → report) + spec-lint | re-run phases 1–5; edit UC Steps; resolve the appetite HAMMER yourself |
 | `retrofit-surface` | Append `## Test Surface` (derived rows only, after Error Cases) to each UC of a pre-surface spec; an all-sources-empty UC gets the explicit empty-sources line | touch anything else — append-only substrate |
-| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
+| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. **The `source` cell, and any other prose in this file, cites the committed pitch or shaping doc — never the gitignored run-tier path** (`.shapeup/<slug>/intake.md`, or any other `.shapeup/` path): spec-lint's `TIER-DIRECTION` rule reds a committed file naming that path in ANY form, a bare path in a sentence exactly as much as a `[[tasks/...]]` wikilink, because it dangles on every other clone. When the intake has no committed original to name, describe the run tier without a path (`"the pitch staged for this run"`) rather than citing where it actually lives. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
 ---
 
 ## Anti-rationalization table

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -275,6 +275,12 @@ Always use wikilinks (double brackets), never relative paths like `../domain-mod
   `.shapeup/` is gitignored, so a committed task link dangles on every fresh clone.
   spec-lint flags it as a red `TIER-DIRECTION` finding. Coverage views (synthesis
   traceability) record derived counts/status, not task ids.
+- **The rule is not only about wikilinks.** `TIER-DIRECTION` reds *any* line in a SHARED
+  doc that names a `.shapeup/` path — a bare path cited in a sentence or a table cell,
+  not only a `[[tasks/...]]` link. A provenance sentence that names its real source
+  (`"extracted from .shapeup/<slug>/intake.md"`) reds for the same reason a task
+  wikilink does: the path dangles on every other clone. Cite the committed pitch or
+  shaping doc instead, or describe the run tier without a path.
 - `[[tasks/...]]` wikilinks are valid only inside LOCAL documents (task files, the board,
   EVAL reports), where they resolve against the LOCAL root (`.shapeup/<slug>/`);
   every wikilink in a SHARED doc stays `spec_folder`-relative.

package/skills/scope-hammer/SKILL.md

@@ -67,8 +67,16 @@ H0.0  Ownership is DERIVED, never stated. Before the census says "no scope owns
 H0.1  Unresolved scopes (breaker cases only):
         - uphill/downhill scopes when round_budget hit 0 → CARRY candidates (their own hill
           phase + open unknowns, from hill/<scope-id>.yml)
-        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates, tagged
-          with the T0 failure that stalled them (from the last red t0/verdicts/*.json)
+        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates. Exhaustion
+          is DERIVED, never read off `t0/verdicts/*.json` directly — a compiled order or a T0
+          verdict is writable by the very scope being judged and proves nothing on its own. Run
+            node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe attempts --slug <slug> \
+              --scope <scope-id> --round <n> --attempt-budget <n>
+          and cite its `spent`/`tripped` fields (exit 1 = tripped) — an attempt counts only when a
+          dispatch receipt AND either a leg-completion row or a WorkResult attest it, so a leg still
+          in flight holds it open rather than reading as exhausted. This is the SAME derivation the
+          round loop's own inner breaker reads, so the census and the breaker cannot disagree about
+          the same exhaustion the way a live run once measured.
 H0.2  QA findings (qa-edge-hunter's hunt-report.md, when present) — all `~` by default.
 H0.3  Discovered-task ledger entries still open (discovery/ledger.md, `[+]`/`~` unresolved).
 H0.4  Attempt-budget hammer proposals (scopes that exhausted their T0 attempts during BUILD).

package/skills/tech-lead/workflows/shapeup-run.js

@@ -391,6 +391,9 @@ const CMD = {
     // from `detail` on purpose: `detail` is prose for a human to read, this is a token the control
     // plane branches on, and collapsing the two is what made every gate comparison silently false.
     decision: { type: "string" },
+    // A close's own advisory failure (kernel/probe/resume.mjs's `exportOnClose`) — copied verbatim, the same discipline as `decision`, so "the export failed" is a
+    // fact `closeIfTerminal` can act on rather than a line buried inside free-text `detail`.
+    export_warning: { type: "string" },
   },
   required: ["exit_code", "ok"],
 };
@@ -617,7 +620,9 @@ async function cmd(verbs, phaseName, label) {
     `Report its exit code as exit_code, ok=true if and only if exit_code is 0, and one line of ` +
     `detail. If the command printed JSON carrying a top-level "decision" key, copy that value into ` +
     `decision EXACTLY as it appears — one bare token, no sentence, no quotes, no rephrasing. ` +
-    `Otherwise omit decision. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
+    `Otherwise omit decision. If the command printed JSON carrying a top-level "export_warning" ` +
+    `key with a non-empty string value, copy that string into export_warning verbatim. Otherwise ` +
+    `omit export_warning. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
     `If the tool call itself is refused or blocked before the command ever runs — a permission or ` +
     `policy denial, not the command's own exit — that is NOT an exit code, and you must never invent ` +
     `one to fill the field: report exit_code as -1 and put the denial's own wording verbatim in ` +
@@ -968,11 +973,18 @@ async function setRunStatus(status, phaseName) {
 const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300) || "no reason recorded");
 
 // A terminal RunReturn closes the run's own ledger — a terminal status, its cause, and a close
-// timestamp, in one write (`probe resume --close`). `aborted` and `shipped` are the two statuses
-// this script itself ends a run on; `paused` resumes on relaunch and `gate_h` hands the rest of the
-// run to the tech-lead skill's own orchestration (GATE H's census, then Ship) — neither is this
-// script's close to make. Best-effort, the same discipline as `setRunStatus` above: a lost write
-// degrades the trace's own record of why the run ended, it does not change what this return reports.
+// timestamp, in one write. WHICH arms are terminal, and what status each closes as, is no longer
+// decided here: `probe resume --close-arm <ret.status>` hands the kernel the RunReturn arm itself
+// and it answers from `RUN_RETURN_CLOSE` (kernel/probe/resume.mjs), derived from the schema's own
+// enum rather than a pair of statuses this file used to compare `ret.status` against by hand — a
+// literal comparison that could not see a new arm go unhandled, because it never consulted the
+// kernel's own list of terminal statuses at all. `gate_h` now closes the run as `escalated` — the
+// breaker that tripped travels in the close's cause text, never as a status of its own; the
+// tech-lead skill's own GATE H → L4 orchestration still runs the census and the ship decision, it
+// just no longer finds the ledger's close fields unset when it gets there. `paused` and `ok` remain
+// explicitly non-terminal — the kernel says so, this call site no longer needs to know why.
+// Best-effort, the same discipline as `setRunStatus` above: a lost write degrades the trace's own
+// record of why the run ended, it does not change what this return reports.
 //
 // A close can also come back `ok:true` and still be a degraded outcome: `closeRun`
 // (kernel/probe/resume.mjs) refuses a DIFFERENT terminal status outright (that failure already hits
@@ -986,11 +998,15 @@ const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/
 // reports — the ledger already folded the prior cause in — but the run's own RunReturn must say the
 // trace is degraded.
 async function closeIfTerminal(ret) {
-  if (ret.status !== "aborted" && ret.status !== "shipped") return;
   const cause = ret.status === "aborted"
     ? `${ret.aborted_at || "?"}: ${ret.reason || "no reason recorded"}`
+    : ret.status === "gate_h"
+    ? `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
     : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
-  const r = await cmd(`probe resume --slug ${slug} --close ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
+  // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
+  // stay silent for it exactly as they did when this file's own guard returned early.
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
   if (!r.ok) {
     const why = (r.detail || `exit ${r.exit_code}`).trim();
     log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +
@@ -1004,6 +1020,14 @@ async function closeIfTerminal(ret) {
         `own close_cause line; this return's trace is degraded, not corrupted.`);
     stateWarnings.push(`close(${ret.status}) superseded an earlier close of this run_id — see harness-run.md's close_cause for both reasons`);
   }
+  // The close itself took (r.ok above) — an export_warning here is `exportOnClose`
+  // (kernel/probe/resume.mjs) reporting it could not project this run's
+  // fact tables. Advisory, same as every other line in this function: the close stands, the run's
+  // own return says the trace is short one export rather than swallowing the fact.
+  if (r.export_warning) {
+    log(`RUN STATE — close(${ret.status}) took, but its export did not: ${r.export_warning}`);
+    stateWarnings.push(`close(${ret.status}): ${r.export_warning}`);
+  }
 }
 const withWarnings = async (ret) => {
   await closeIfTerminal(ret);
@@ -1739,11 +1763,15 @@ async function buildScope(scope, roundNo) {
           `and keep T0 green. An entry marked \`unowned\` cites no file any scope owns — fix it only ` +
           `if it falls inside your substrate. `
         : "") +
-      `Re-compile the order for every attempt after the first, with --attempt <n>. ` +
+      `Re-compile the order for every attempt after the first, with --attempt <n>. An attempt will ` +
+      `be REFUSED (exit 3) while the previous one is unanswered — dispatched with no leg row and no ` +
+      `WorkResult — because grading a tree the previous attempt may still be writing counts an ` +
+      `attempt nobody ran. Let it come back rather than opening the next one. ` +
       `Run the attempt ratchet for THIS scope only: up to ${attemptBudget} attempts of implement → ` +
       `\`node "${KERNEL}" verify t0 "${scope.path}" --round ${roundNo} --attempt <n>\`, each scored against ` +
       `the last kept trial. Stop on the first green T0, or when the attempt budget or the stagnation ` +
       `breaker trips. Write only inside this scope's substrate whitelist — the sandbox hook enforces it. ` +
-      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path.`,
+      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path — ` +
+      `attempts_used is what the attested channels carry, not a count of the orders you compiled.`,
   });
 }