shapeup-sdlc 3.6.0 → 3.7.1

package/kernel/verify/spec.mjs

@@ -235,11 +235,56 @@ export function lintScopes(scopes, repoFiles) {
 }
 
 /** Text forms worth scanning; anything else in a committed tree is not a reference carrier. */
-const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
+export const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
 
 /** A machine-local board id. Strict on purpose: a committed tree has no reason to carry one at all. */
 const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 
+/**
+ * The tier-direction violations one piece of text carries — the whole rule, on a string.
+ *
+ * EXPORTED BECAUSE IT HAS TWO ENFORCEMENT POINTS NOW, and they must not be allowed to drift.
+ * `lintCommittedTier` below walks files at GATE L1b; `hooks/tier-guard.mjs` refuses the same text
+ * at the moment a tool writes it, minutes earlier, while the writer still holds the context needed
+ * to rephrase. Four producers wrote committed files this rule reds and none of them learned from
+ * the lint, because by the time it speaks the dispatch that wrote the line is over. A second
+ * enforcement point is only worth having if it enforces the SAME predicate, so both call this.
+ *
+ * The detail strings are the message the writer reads, so they carry the remedy, not just the
+ * verdict: a board id resolves on the machine that wrote it and nowhere else, and a path into the
+ * gitignored tier dangles on every clone.
+ *
+ * @param {string} text - The file body, or the fragment a tool is about to write.
+ * @returns {Array<{kind:("board-id"|"local-path"), token:string, line:number, detail:string}>}
+ *   One entry per offending line and form, in file order; [] when clean.
+ */
+export function tierLeaks(text) {
+  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
+  const esc = LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  // `\S+` where the walk's own rule is `\S`: the same LINES match either way (a path with one
+  // non-space character after the slash has at least one), and the longer form yields the token to
+  // quote back at the writer. Trailing punctuation the prose wrapped it in is trimmed off the
+  // quote only — never off the test.
+  const localPath = new RegExp(`${esc}/\\S+`);
+  const leaks = [];
+  String(text ?? "").split(/\r?\n/).forEach((line, i) => {
+    const task = line.match(TASK_ID);
+    if (task) {
+      leaks.push({ kind: "board-id", token: task[0], line: i + 1, detail:
+        `names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
+        "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
+        "and nowhere else. Cite the use case or the scope_id, which are stable." });
+    }
+    const path = line.match(localPath);
+    if (path) {
+      leaks.push({ kind: "local-path", token: path[0].replace(/[`)\]},.;:'"]+$/, ""), line: i + 1, detail:
+        `points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
+        "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
+    }
+  });
+  return leaks;
+}
+
 /**
  * Lint the WHOLE committed tree for references into the gitignored tier.
  *
@@ -265,28 +310,15 @@ const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 export function lintCommittedTier({ cwd, slug }) {
   const root = sharedRoot(cwd, slug);
   if (!existsSync(root)) return [];
-  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
-  const localPath = new RegExp(`${LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/\\S`);
   const findings = [];
   for (const rel of walkFiles(root)) {
     if (!SCANNED.test(rel)) continue;
-    let lines;
-    try { lines = readFileSync(join(root, rel), "utf8").split(/\r?\n/); } catch { continue; }
-    lines.forEach((line, i) => {
-      const at = `${relative(cwd, join(root, rel))}:${i + 1}`;
-      const task = line.match(TASK_ID);
-      if (task) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
-          "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
-          "and nowhere else. Cite the use case or the scope_id, which are stable." });
-      }
-      if (localPath.test(line)) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
-          "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
-      }
-    });
+    let text;
+    try { text = readFileSync(join(root, rel), "utf8"); } catch { continue; }
+    for (const leak of tierLeaks(text)) {
+      findings.push({ rule: "TIER-DIRECTION", level: "red",
+        detail: `${relative(cwd, join(root, rel))}:${leak.line} ${leak.detail}` });
+    }
   }
   return findings;
 }

package/kernel/verify/t0.mjs

@@ -79,6 +79,69 @@ function runCommand(cmd, cwd) {
   return { cmd, exit: r.status ?? 1, pass: r.status === 0, stdout, stderr, ...(error ? { error } : {}) };
 }
 
+/**
+ * How much of each stream the persisted record keeps, per command.
+ *
+ * A bound rather than the whole stream, because one chatty fixture would otherwise make every
+ * reader of the run trace pay for it — and a bound at the END rather than the start, because that
+ * is where a stack trace, an assertion diff and a test summary all land.
+ */
+export const EVIDENCE_TAIL_CHARS = 4000;
+
+/**
+ * The last `limit` characters of a stream, marked when anything was dropped.
+ *
+ * THE MARKER IS NOT DECORATION. A truncated tail that does not say so is a partial stream that
+ * reads as a complete one, which is the same class of defect as the one this whole change fixes:
+ * a record that overstates what it actually holds.
+ *
+ * @param {(string|null|undefined)} text - The captured stream.
+ * @param {number} [limit] - Characters to keep.
+ * @returns {(string|null)} The kept tail, or null when the stream was empty (the field is then
+ *   omitted rather than stored as "", so "nothing was printed" stays visibly different from
+ *   "nothing was kept").
+ */
+export function boundedTail(text, limit = EVIDENCE_TAIL_CHARS) {
+  const s = String(text ?? "");
+  if (!s) return null;
+  if (s.length <= limit) return s;
+  return `[truncated: kept the last ${limit} of ${s.length} characters]\n${s.slice(-limit)}`;
+}
+
+/**
+ * One command's outcome as the verdict artifact stores it — the evidence, not just the score.
+ *
+ * WHAT THIS FIXES. The artifact used to keep `{cmd, exit, pass}`, and `runCommand` maps a command
+ * that never started onto `exit: 1` — the same number a genuine failure returns. So a refused or
+ * timed-out command and a broken build were the SAME RECORD everywhere downstream: the digest, the
+ * hill, the report, the evaluator's citation and anyone reading the trace back afterwards. The
+ * kernel computed the difference (`error`, which the ratchet grades as `crash`) and discarded it
+ * one line later.
+ *
+ * `exit` is deliberately left as it is. Mapping a crash to some other number would change what the
+ * ratchet compares and what every existing reader parses; the distinction travels in `error`, which
+ * is the field that actually means "this never ran", and which the crash branch already reads.
+ *
+ * Output is kept for PASSING commands too, and that direction is not an afterthought: a fixture
+ * that exits 0 having run zero tests is the false green this evidence layer exists to catch, and
+ * its stdout is the only place that shows.
+ *
+ * @param {({cmd:string, exit:number, pass:boolean, stdout?:string, stderr?:string, error?:string}|null)} r
+ *   A `runCommand` result, or null when no command was declared.
+ * @returns {(object|null)} The record to persist; null passes through unchanged.
+ */
+export function commandEvidence(r) {
+  if (!r) return null;
+  const stdout = boundedTail(r.stdout);
+  const stderr = boundedTail(r.stderr);
+  return {
+    cmd: r.cmd, exit: r.exit, pass: r.pass,
+    ...(r.error ? { error: r.error } : {}),
+    ...(stdout ? { stdout_tail: stdout } : {}),
+    ...(stderr ? { stderr_tail: stderr } : {}),
+  };
+}
+
 /**
  * Run every e2e fixture command for a scope.
  * @param {string[]} fixtures - Fixture command lines (null/empty → no commands).
@@ -513,8 +576,10 @@ export async function cli(rawArgv) {
   const { path, sha256: hash, trial } = writeArtifact(outDir, round, attempt, {
     ...(runId ? { run_id: runId } : {}),
     scope_id: contract.scope_id,
-    fixtures: fixtures.results.map(({ cmd, exit, pass }) => ({ cmd, exit, pass })),
-    db_probe: dbProbe && { cmd: dbProbe.cmd, exit: dbProbe.exit, pass: dbProbe.pass },
+    // The evidence, not just the score — see `commandEvidence` for what the three-field record
+    // could not tell apart, and why `exit` still reads the way it always did.
+    fixtures: fixtures.results.map((r) => commandEvidence(r)),
+    db_probe: commandEvidence(dbProbe),
     seesaw,
     ...verdict,
     score: s,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.6.0",
+  "version": "3.7.1",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -121,7 +121,7 @@ covered AC is a requirement the run can be measured against.
 |---|---|---|
 | `reconcile` | Verify `ledger.feature == payload.feature` (mismatch → STOP). Map each `[+]` Keep item → its owning UC; new task continues numbering (never renumber); `~`/Cut → synthesis "Hammered Out" row, no file. A Keep item asserting a new invariant → APPEND `[INV-NN]` + TS-INV row to that UC (append-only sections in your substrate). A new actor/action with no UC → `status: "escalated"` + a `deviations[]` spec-ambiguity entry: spawning a UC mid-cycle is silent re-shaping, the PO decides. Finish with board-derive (appetite overflow → report) + spec-lint | re-run phases 1–5; edit UC Steps; resolve the appetite HAMMER yourself |
 | `retrofit-surface` | Append `## Test Surface` (derived rows only, after Error Cases) to each UC of a pre-surface spec; an all-sources-empty UC gets the explicit empty-sources line | touch anything else — append-only substrate |
-| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
+| `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. **The `source` cell, and any other prose in this file, cites the committed pitch or shaping doc — never the gitignored run-tier path** (`.shapeup/<slug>/intake.md`, or any other `.shapeup/` path): spec-lint's `TIER-DIRECTION` rule reds a committed file naming that path in ANY form, a bare path in a sentence exactly as much as a `[[tasks/...]]` wikilink, because it dangles on every other clone. When the intake has no committed original to name, describe the run tier without a path (`"the pitch staged for this run"`) rather than citing where it actually lives. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |
 ---
 
 ## Anti-rationalization table

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -275,6 +275,16 @@ Always use wikilinks (double brackets), never relative paths like `../domain-mod
   `.shapeup/` is gitignored, so a committed task link dangles on every fresh clone.
   spec-lint flags it as a red `TIER-DIRECTION` finding. Coverage views (synthesis
   traceability) record derived counts/status, not task ids.
+- **The rule is not only about wikilinks.** `TIER-DIRECTION` reds *any* line in a SHARED
+  doc that names a `.shapeup/` path — a bare path cited in a sentence or a table cell,
+  not only a `[[tasks/...]]` link. A provenance sentence that names its real source
+  (`"extracted from .shapeup/<slug>/intake.md"`) reds for the same reason a task
+  wikilink does: the path dangles on every other clone. Cite the committed pitch or
+  shaping doc instead, or describe the run tier without a path.
+- **You will be stopped at the write, not at the gate.** The same rule is enforced as a
+  refusal on the Write/Edit itself, quoting the offending token back. There is nothing to
+  appeal: rephrase the line and write it again. Waiting for spec-lint to tell you at Board
+  Review costs the whole phase, which is what it used to cost every time.
 - `[[tasks/...]]` wikilinks are valid only inside LOCAL documents (task files, the board,
   EVAL reports), where they resolve against the LOCAL root (`.shapeup/<slug>/`);
   every wikilink in a SHARED doc stays `spec_folder`-relative.

package/skills/scope-hammer/SKILL.md

@@ -67,8 +67,16 @@ H0.0  Ownership is DERIVED, never stated. Before the census says "no scope owns
 H0.1  Unresolved scopes (breaker cases only):
         - uphill/downhill scopes when round_budget hit 0 → CARRY candidates (their own hill
           phase + open unknowns, from hill/<scope-id>.yml)
-        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates, tagged
-          with the T0 failure that stalled them (from the last red t0/verdicts/*.json)
+        - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates. Exhaustion
+          is DERIVED, never read off `t0/verdicts/*.json` directly — a compiled order or a T0
+          verdict is writable by the very scope being judged and proves nothing on its own. Run
+            node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe attempts --slug <slug> \
+              --scope <scope-id> --round <n> --attempt-budget <n>
+          and cite its `spent`/`tripped` fields (exit 1 = tripped) — an attempt counts only when a
+          dispatch receipt AND either a leg-completion row or a WorkResult attest it, so a leg still
+          in flight holds it open rather than reading as exhausted. This is the SAME derivation the
+          round loop's own inner breaker reads, so the census and the breaker cannot disagree about
+          the same exhaustion the way a live run once measured.
 H0.2  QA findings (qa-edge-hunter's hunt-report.md, when present) — all `~` by default.
 H0.3  Discovered-task ledger entries still open (discovery/ledger.md, `[+]`/`~` unresolved).
 H0.4  Attempt-budget hammer proposals (scopes that exhausted their T0 attempts during BUILD).

package/skills/tech-lead/references/tiny-lane.md

@@ -26,7 +26,8 @@ scales down, its *verification floor* does not.
   ingest-result dispatch. Tiny never means "just edit the file inline".
 - **T0 verification.** A tiny change still proves itself by running — never by claim. If there
   is no runnable check at all, that is a fit-check failure, not a reason to skip T0.
-- **The safety-spine and sandbox hooks.** Machine guards do not scale down.
+- **The machine guards — safety spine, substrate sandbox, tier guard.** They do not scale down,
+  and a tiny lane is where a committed file is most likely to be written by hand.
 - **The discovery ledger.** `lane: tiny` is recorded, so a later reader knows exactly what was
   NOT checked (no EVAL verdict, no QA charter, no wiring assertion).
 

package/skills/tech-lead/workflows/shapeup-run.js

@@ -391,6 +391,9 @@ const CMD = {
     // from `detail` on purpose: `detail` is prose for a human to read, this is a token the control
     // plane branches on, and collapsing the two is what made every gate comparison silently false.
     decision: { type: "string" },
+    // A close's own advisory failure (kernel/probe/resume.mjs's `exportOnClose`) — copied verbatim, the same discipline as `decision`, so "the export failed" is a
+    // fact `closeIfTerminal` can act on rather than a line buried inside free-text `detail`.
+    export_warning: { type: "string" },
   },
   required: ["exit_code", "ok"],
 };
@@ -617,7 +620,9 @@ async function cmd(verbs, phaseName, label) {
     `Report its exit code as exit_code, ok=true if and only if exit_code is 0, and one line of ` +
     `detail. If the command printed JSON carrying a top-level "decision" key, copy that value into ` +
     `decision EXACTLY as it appears — one bare token, no sentence, no quotes, no rephrasing. ` +
-    `Otherwise omit decision. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
+    `Otherwise omit decision. If the command printed JSON carrying a top-level "export_warning" ` +
+    `key with a non-empty string value, copy that string into export_warning verbatim. Otherwise ` +
+    `omit export_warning. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
     `If the tool call itself is refused or blocked before the command ever runs — a permission or ` +
     `policy denial, not the command's own exit — that is NOT an exit code, and you must never invent ` +
     `one to fill the field: report exit_code as -1 and put the denial's own wording verbatim in ` +
@@ -968,11 +973,18 @@ async function setRunStatus(status, phaseName) {
 const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300) || "no reason recorded");
 
 // A terminal RunReturn closes the run's own ledger — a terminal status, its cause, and a close
-// timestamp, in one write (`probe resume --close`). `aborted` and `shipped` are the two statuses
-// this script itself ends a run on; `paused` resumes on relaunch and `gate_h` hands the rest of the
-// run to the tech-lead skill's own orchestration (GATE H's census, then Ship) — neither is this
-// script's close to make. Best-effort, the same discipline as `setRunStatus` above: a lost write
-// degrades the trace's own record of why the run ended, it does not change what this return reports.
+// timestamp, in one write. WHICH arms are terminal, and what status each closes as, is no longer
+// decided here: `probe resume --close-arm <ret.status>` hands the kernel the RunReturn arm itself
+// and it answers from `RUN_RETURN_CLOSE` (kernel/probe/resume.mjs), derived from the schema's own
+// enum rather than a pair of statuses this file used to compare `ret.status` against by hand — a
+// literal comparison that could not see a new arm go unhandled, because it never consulted the
+// kernel's own list of terminal statuses at all. `gate_h` now closes the run as `escalated` — the
+// breaker that tripped travels in the close's cause text, never as a status of its own; the
+// tech-lead skill's own GATE H → L4 orchestration still runs the census and the ship decision, it
+// just no longer finds the ledger's close fields unset when it gets there. `paused` and `ok` remain
+// explicitly non-terminal — the kernel says so, this call site no longer needs to know why.
+// Best-effort, the same discipline as `setRunStatus` above: a lost write degrades the trace's own
+// record of why the run ended, it does not change what this return reports.
 //
 // A close can also come back `ok:true` and still be a degraded outcome: `closeRun`
 // (kernel/probe/resume.mjs) refuses a DIFFERENT terminal status outright (that failure already hits
@@ -986,11 +998,15 @@ const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/
 // reports — the ledger already folded the prior cause in — but the run's own RunReturn must say the
 // trace is degraded.
 async function closeIfTerminal(ret) {
-  if (ret.status !== "aborted" && ret.status !== "shipped") return;
   const cause = ret.status === "aborted"
     ? `${ret.aborted_at || "?"}: ${ret.reason || "no reason recorded"}`
+    : ret.status === "gate_h"
+    ? `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
     : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
-  const r = await cmd(`probe resume --slug ${slug} --close ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
+  // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
+  // stay silent for it exactly as they did when this file's own guard returned early.
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
   if (!r.ok) {
     const why = (r.detail || `exit ${r.exit_code}`).trim();
     log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +
@@ -1004,6 +1020,14 @@ async function closeIfTerminal(ret) {
         `own close_cause line; this return's trace is degraded, not corrupted.`);
     stateWarnings.push(`close(${ret.status}) superseded an earlier close of this run_id — see harness-run.md's close_cause for both reasons`);
   }
+  // The close itself took (r.ok above) — an export_warning here is `exportOnClose`
+  // (kernel/probe/resume.mjs) reporting it could not project this run's
+  // fact tables. Advisory, same as every other line in this function: the close stands, the run's
+  // own return says the trace is short one export rather than swallowing the fact.
+  if (r.export_warning) {
+    log(`RUN STATE — close(${ret.status}) took, but its export did not: ${r.export_warning}`);
+    stateWarnings.push(`close(${ret.status}): ${r.export_warning}`);
+  }
 }
 const withWarnings = async (ret) => {
   await closeIfTerminal(ret);
@@ -1739,11 +1763,15 @@ async function buildScope(scope, roundNo) {
           `and keep T0 green. An entry marked \`unowned\` cites no file any scope owns — fix it only ` +
           `if it falls inside your substrate. `
         : "") +
-      `Re-compile the order for every attempt after the first, with --attempt <n>. ` +
+      `Re-compile the order for every attempt after the first, with --attempt <n>. An attempt will ` +
+      `be REFUSED (exit 3) while the previous one is unanswered — dispatched with no leg row and no ` +
+      `WorkResult — because grading a tree the previous attempt may still be writing counts an ` +
+      `attempt nobody ran. Let it come back rather than opening the next one. ` +
       `Run the attempt ratchet for THIS scope only: up to ${attemptBudget} attempts of implement → ` +
       `\`node "${KERNEL}" verify t0 "${scope.path}" --round ${roundNo} --attempt <n>\`, each scored against ` +
       `the last kept trial. Stop on the first green T0, or when the attempt budget or the stagnation ` +
       `breaker trips. Write only inside this scope's substrate whitelist — the sandbox hook enforces it. ` +
-      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path.`,
+      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path — ` +
+      `attempts_used is what the attested channels carry, not a count of the orders you compiled.`,
   });
 }