shapeup-sdlc 3.7.0 → 3.7.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -7,7 +7,8 @@ A three-phase Shape Up loop orchestrated by `/tech-lead`. Invariants live in the
 
 Skills and commands are named short throughout this file; every one of them resolves only under the plugin's namespace — `Skill(shapeup-sdlc-plugin:orient)`, `/shapeup-sdlc-plugin:ship`. A bare name is not a typo you get a warning for: an unknown skill name is rejected upstream of the hook layer, so the dispatch fires no hook, leaves no decision row, and is answered by improvisation.
 
-- Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, stopping a run with no receipt (the run's first act writes one).
+- Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, writing a committed file whose text names a run-trace path or a board id, stopping a run with no receipt (the run's first act writes one).
+- **The tier-direction rule is refused at the write, not argued at L1b.** A committed file cannot carry a `.shapeup/` path or a `TASK-NNN` id — boards renumber per machine and the run trace is gitignored, so either one resolves only where it was written. Spec-lint has always red'd this at Board Review; the same rule now also refuses the write itself, naming the token, because four producers hit it and one of them hit it twice in one session — a worker carries no lesson across a dispatch, and by L1b the phase that wrote the line is over. The knowledge base is outside the rule: those files are instructions, not references anyone resolves.
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
@@ -80,7 +81,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
   through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
 - Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,

package/README.md

@@ -210,7 +210,7 @@ the layer that carries it, and the three layers here fail differently:
 | **Runtime** — the kernel and the run script | When the run goes through the harness. A schema rejection or a non-zero exit stops the step. | A lane that never calls the kernel is never checked — which is why the hooks below cover the doors, not the steps. |
 | **Advisory** — a report section | When somebody reads the artifact. | Silently, if nobody does. It is a cleanup list, never a verdict. |
 
-**Four walls.** These are hooks because nothing in the runtime can substitute for them:
+**Five walls.** These are hooks because nothing in the runtime can substitute for them:
 
 - `PreToolUse` (`Skill`) — **`hooks/gate-intake.mjs` denies a `tech-lead` dispatch that carries no
   pitch, no spec folder, and no requirement text.** Observed, not theorized: when the requirement
@@ -227,6 +227,13 @@ the layer that carries it, and the three layers here fail differently:
   checked first and outranks everything, across every live contract — including the carve-out that
   otherwise keeps the active feature's own run trace writable, so a path a live order froze stays
   frozen wherever it lives.
+- `PreToolUse` (`Edit|Write|MultiEdit`) — **`hooks/tier-guard.mjs` refuses a committed-tier write
+  whose content names a path into the local run trace or a board id.** Same rule spec-lint reds at
+  GATE L1b, asked at the moment of writing: four different producers wrote a committed file their
+  own lint then rejected, and one of them did it twice in one session, an hour apart, after fixing
+  the first occurrence itself. A worker carries no lesson across a dispatch, so the remedy is a
+  refusal the writer can act on while it still knows what it meant to say. The knowledge base is
+  outside it — those files are instructions, not references a reader has to resolve.
 - `PreToolUse` (`Bash|Read|Write|Edit|MultiEdit`) — **`hooks/safety-spine.mjs` denies destructive
   commands** (`rm -rf` on unrecoverable targets, force-push/push-to-main, `git reset --hard`,
   `DROP TABLE`) and secret-file reads. A machine guard, not a pipeline guard; the escape hatch is
@@ -265,7 +272,7 @@ the layer that carries it, and the three layers here fail differently:
 | `anti-rationalization` (claims the facts contradict) | The ship report's census, derived from the board and the T0 artifacts | The facts are in an artifact a teammate finds on `git pull`, not in a transcript nobody re-reads. |
 | `slop-cleaner` (TODO/`console.log` leftovers) | The ship report's **Leftovers** section | Same scan, same added-lines-only rule; it lands somewhere checkable. |
 
-**Nothing load-bearing depends on permission mode.** The four walls plus the zero-work gate run
+**Nothing load-bearing depends on permission mode.** The five walls plus the zero-work gate run
 under every mode. The kernel needs a grant to be *invoked* — two Bash lines `npx shapeup-sdlc init`
 writes — but a session that never gets that grant is a session that cannot run the pipeline at all,
 not one that runs it unguarded.
@@ -338,8 +345,8 @@ kernel/{verify,reduce,probe,init,report}/ #   its subcommands, plus compile and
 kernel/lib/           # argv (the typed CLI boundary), paths (+ the run key), contract (shape)
 kernel/schemas/       # the envelope port: WorkOrder, WorkResult, domain registry
 commands/*.md         # slash commands (/ship + the 9 phase commands)
-hooks/                # hooks.json + the four walls: safety-spine, gate-intake, sandbox-guard
-                      #   (PreToolUse) + gate-zerowork (Stop, the one blocking hook)
+hooks/                # hooks.json + the five walls: safety-spine, gate-intake, sandbox-guard,
+                      #   tier-guard (PreToolUse) + gate-zerowork (Stop, the one blocking hook)
                       #   + dispatch-receipt (PostToolUse, denies nothing, attests which skill ran)
                       #   + lib/decision.mjs (every hook records allow / deny / error)
 oracles/              # the evaluation-contract oracle registry (test · snapshot · http · process)

package/SECURITY.md

@@ -1,7 +1,7 @@
 # Security
 
-This plugin installs **seven hook entries (six Node scripts + one `echo`)**: four in a
-`PreToolUse` position, **all four of which can deny a tool call**, one `PostToolUse` hook that has no
+This plugin installs **eight hook entries (seven Node scripts + one `echo`)**: five in a
+`PreToolUse` position, **all five of which can deny a tool call**, one `PostToolUse` hook that has no
 deny path at all, and one `Stop`-position hook that can block a session from ending. That is the
 product — and it is also exactly the kind of surface a careful reviewer should want spelled out
 before installing. This page is that spelling-out.
@@ -73,6 +73,7 @@ sitting, and reading them is the recommended review.
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
 | [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
+| [`tier-guard.mjs`](hooks/tier-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the text the call is about to write (`content`, `new_string`, or any edit in a `MultiEdit` batch) | Yes — a write into `shapeup/<slug>/` whose content names a `.shapeup/` path or a `TASK-NNN` board id: the same tier-direction rule spec-lint reds at GATE L1b, refused at the moment of writing, with the offending token quoted back | No-op outside `shapeup/<slug>/`, on file forms the lint does not scan, and on `shapeup/knowledge-base/` (instructions to a worker, not references). Reads nothing off disk and writes only its decision row; it never inspects a file it is not being asked to write |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |
 

package/hooks/hooks.json

@@ -50,6 +50,16 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/tier-guard.mjs\"",
+            "timeout": 10
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/hooks/tier-guard.mjs

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+// Tier guard — PreToolUse hook: the committed tier's write boundary.
+//
+// Refuses an Edit/Write/MultiEdit into `shapeup/<slug>/` whose CONTENT carries a reference the
+// committed tier cannot hold — a path into the gitignored run trace, or a machine-local board id.
+// It is the same rule spec-lint's TIER-DIRECTION already enforces, asked at a different moment.
+//
+// WHY A SECOND ENFORCEMENT POINT FOR A RULE THAT WAS NEVER IN DOUBT. Four different producers wrote
+// committed files this harness's own lint then reds: the requirements registry, the ship report, the
+// project profile, the coverage clauses. The lint was right every time and caught every one of them
+// — at GATE L1b, a whole phase after the sentence was written, addressed to a worker that no longer
+// holds the context needed to rephrase it. The run pays for the round trip, and the fix lands in
+// whatever wording the next reader guesses at.
+//
+// TEACHING DOES NOT CLOSE IT, and that is measured rather than assumed. One of the four recurred
+// INSIDE A SINGLE SESSION, an hour apart, on a different line of the same file, after that same
+// author had fixed the first occurrence and watched its own lint go green. A worker carries no
+// lesson across a dispatch. So the remedy has to be a precondition the model cannot talk past, and
+// it has to speak AT THE WRITE — the one moment the writer still knows what it meant to say.
+//
+// THE PREDICATE IS IMPORTED, NEVER RESTATED. `tierLeaks` is the lint's own scanner
+// (kernel/verify/spec.mjs), so this hook cannot become narrower than the rule it fronts — which
+// would let the defect through to L1b exactly as before — nor wider, which is how a guard earns
+// being switched off. The structural suite executes both over one corpus and requires agreement.
+//
+// Design (deliberately conservative, the shape `sandbox-guard.mjs` argues for):
+//   • Fail-OPEN on everything it cannot positively prove: not a write tool, no resolvable path, a
+//     path outside `shapeup/<slug>/`, a file form the lint does not scan, or a payload carrying no
+//     content to read. A guard that blocks legitimate work gets disabled, and a disabled guard
+//     enforces nothing.
+//   • `shapeup/knowledge-base/` is OUTSIDE by construction, exactly as it is outside the lint's
+//     walk: those files are instructions read by a worker at runtime, not references a reader is
+//     expected to resolve, and the defect register they hold has every reason to quote a local path.
+//   • Fail-CLOSED only on a leak the lint would red, with the file, the line, the offending token,
+//     why it is wrong and what to write instead — all in the denial, because a denial the writer
+//     cannot act on immediately just becomes the L1b round trip with extra steps.
+//
+// WHAT IT DOES NOT COVER, stated because the gap is the same one the substrate fence has: this is a
+// PreToolUse hook, so it sees this assistant's own edit path and nothing else. A kernel subcommand
+// writing a committed file, a shell heredoc, or any other editor writes straight through it. Those
+// producers are answered where they are written; this closes the channel the four measured
+// recurrences actually came through.
+//
+// Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path, content | new_string |
+// edits[]}, cwd }. Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny",
+// permissionDecisionReason } }.
+
+import { resolve, relative, sep } from "node:path";
+import { isMain } from "../kernel/lib/argv.mjs";
+import { SHARED } from "../kernel/lib/paths.mjs";
+import { SCANNED, tierLeaks } from "../kernel/verify/spec.mjs";
+import { runHook, readStdin, settle, projectRoot } from "./lib/decision.mjs";
+
+/** Committed-tier trees that hold instructions rather than references — outside the lint's walk. */
+const NOT_A_SLUG = new Set(["knowledge-base"]);
+
+/**
+ * The (path, content) pairs one write tool call is about to commit to disk.
+ *
+ * THE THREE WRITE TOOLS SPELL CONTENT THREE WAYS, and a guard that reads only `content` is blind to
+ * the Edit that adds the same line — which is the form the measured recurrence took, since the file
+ * already existed by then.
+ *
+ * @param {object} toolInput - The PreToolUse `tool_input` block.
+ * @returns {Array<{path:string, content:string}>} Pairs with a usable path and string content.
+ */
+export function extractWrites(toolInput) {
+  const out = [];
+  const base = toolInput?.file_path;
+  if (typeof toolInput?.content === "string" && base) out.push({ path: base, content: toolInput.content });
+  if (typeof toolInput?.new_string === "string" && base) out.push({ path: base, content: toolInput.new_string });
+  if (Array.isArray(toolInput?.edits)) {
+    for (const e of toolInput.edits) {
+      const p = e?.file_path || base;
+      if (p && typeof e?.new_string === "string") out.push({ path: p, content: e.new_string });
+    }
+  }
+  return out;
+}
+
+/**
+ * Is this path inside the committed tier the lint walks — `shapeup/<slug>/…`, scanned form?
+ *
+ * @param {string} rel - Path relative to the project root, as the lint would name it.
+ * @returns {boolean} True when a leak here is a leak the lint would red.
+ */
+export function inCommittedTier(rel) {
+  if (!rel || rel.startsWith("..") || rel.startsWith(sep)) return false;
+  const parts = rel.split(/[\\/]/);
+  // `shapeup/<slug>/<file>` — the lint walks a slug's tree, so a file at the tier root belongs to
+  // no run and is left alone, and `knowledge-base` is a sibling of the slugs, not one of them.
+  if (parts[0] !== SHARED || parts.length < 3 || NOT_A_SLUG.has(parts[1])) return false;
+  return SCANNED.test(rel);
+}
+
+async function main() {
+  await runHook("tier-guard", async () => {
+    const raw = await readStdin();
+    let p;
+    /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
+    const defer = (reason, rule) => settle({
+      verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, cwd: p?.cwd, reason, rule,
+    });
+    try { p = JSON.parse(raw || "{}"); }
+    catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+    if (!["Edit", "Write", "MultiEdit"].includes(p.tool_name)) {
+      defer(`${p.tool_name ?? "no tool_name"} is not a write tool — out of scope`, "not-write-tool");
+    }
+
+    // The shell's cwd is where the call fired; the tier lives at the project root. Same split the
+    // substrate fence has to make, and for the same reason: a worker that `cd`s into a sub-folder
+    // must not thereby leave the tier unguarded. Raw tool paths still resolve against the shell.
+    const cwd = p.cwd || process.cwd();
+    const root = projectRoot(cwd);
+
+    const writes = extractWrites(p.tool_input);
+    if (writes.length === 0) defer("no readable path+content pair in the tool input", "no-content");
+
+    const inTier = writes
+      .map((w) => ({ ...w, rel: relative(root, resolve(cwd, w.path)) }))
+      .filter((w) => inCommittedTier(w.rel));
+    if (inTier.length === 0) defer(`${writes.length} write(s), none inside ${SHARED}/<slug>/ in a scanned form`, "not-committed-tier");
+
+    const blocked = [];
+    for (const w of inTier) {
+      // THE TOKEN IS QUOTED BACK, which the lint's own message does not do and does not need to —
+      // it reports against a file on disk the reader can open at that line. Here the line does not
+      // exist yet, so "line 1 points into the local tier" leaves the writer hunting through a
+      // fragment it is holding in its head. Naming the exact string is the difference between a
+      // denial that is acted on and one that is retried verbatim.
+      for (const leak of tierLeaks(w.content)) blocked.push(`${w.rel}:${leak.line} — \`${leak.token}\` ${leak.detail}`);
+    }
+
+    if (blocked.length === 0) {
+      defer(`${inTier.length} committed-tier write(s) carry no tier-direction leak — permitted`, "tier-clean");
+    }
+
+    return {
+      verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: inTier[0].rel, cwd: root,
+      rule: "tier-direction",
+      reason: `${blocked.length} tier-direction leak(s) refused at the write boundary: ${blocked.join("; ")}`,
+      payload: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason:
+            "Tier guard (TIER-DIRECTION) — this write would put a reference into the committed tier that " +
+            "cannot survive the trip to another machine:\n" +
+            `${blocked.join("\n")}\n` +
+            `Refused here rather than at GATE L1b, where spec-lint reds the same file after the phase is over. ` +
+            "Rephrase the line now: cite the committed artifact, the use case or the scope_id, or describe the " +
+            "tier without naming a path.",
+        },
+      },
+    };
+  });
+}
+
+if (isMain(import.meta.url)) {
+  main();
+}

package/kernel/compile.mjs

@@ -1007,7 +1007,21 @@ export async function cli(rawArgv) {
   // than the flailing it detects. It advises; the orchestrator queues the GATE H proposal.
   if (scope?.scope_id) {
     const k = Number(scope.no_progress_k ?? payloadExtra.no_progress_k ?? 2);
-    const st = stagnation(allTrials.filter((t) => t.scope_id === scope.scope_id), k);
+    // SCOPED TO THIS RUN, for the same reason the attempt census is. `t0/trials.jsonl` is per-slug
+    // and append-only, so a streak survives the run that produced it. Measured on a consumer: two
+    // non-kept trials from earlier runs — one of them graded against an order no worker was ever
+    // dispatched for — read as a stagnation streak that every later run of that scope tripped on,
+    // seven hours after the tree they graded had been fixed. The breaker escalated on evidence that
+    // predated its own fix, and no attempt of the tripping run had been dispatched at all.
+    //
+    // A trial with no run key counts for no run; an unresolvable current run matches nothing. Both
+    // leave the breaker un-tripped, which is the fail-open direction this repo's guards take when
+    // the bad state cannot be positively proven.
+    const myRunId = readRunId(cwd, slug);
+    const st = stagnation(
+      allTrials.filter((t) => t.scope_id === scope.scope_id && myRunId != null && t.run_id === myRunId),
+      k,
+    );
     if (st.stagnant) {
       console.error(JSON.stringify({
         breaker: "stagnation", scope_id: scope.scope_id, streak: st.streak, no_progress_k: st.k,

package/kernel/gate.mjs

@@ -53,7 +53,7 @@
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -168,6 +168,71 @@ export function validate(set) {
  * Returns { gate, decision, source, note, status } where status ∈ ok | ask | abort.
  * Pure: the CLI turns `status` into the exit code, nothing here exits.
  */
+/** The three verdicts `scope-hammer` may return (shapeup-run.js's HAMMER schema). */
+export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
+
+/**
+ * The census verdict on disk for one run, or null when no census has run.
+ *
+ * Derived from the hammer's own WorkResult rather than taken from a caller: the verdict is the
+ * product of a dispatch, and a gate that accepts it as an argument accepts whatever the caller
+ * believes. `null` is a real answer here — "scope-hammer has not run" — and is the state a run that
+ * returned `gate_h` from a circuit breaker is in, because the breaker returns long before the
+ * hammer is dispatched.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {(string|null)} The verdict, or null when there is no readable census.
+ */
+export function censusVerdict(cwd, slug) {
+  if (!slug) return null;
+  try {
+    const p = join(resultsDir(cwd, slug), "hammer.json");
+    if (!existsSync(p)) return null;
+    const r = JSON.parse(readFileSync(p, "utf8"));
+    const v = r?.payload?.verdict ?? r?.verdict ?? null;
+    return HAMMER_VERDICTS.includes(v) ? v : null;
+  } catch { return null; }
+}
+
+/**
+ * Narrow a resolved gate answer to what the run's own evidence supports.
+ *
+ * THE RULE, and it is about answers rather than callers. An answer set chooses among the answers a
+ * gate ALLOWS; it can never supply the evidence that makes one allowed. `ship` at L4 asserts the
+ * census cleared the run, so `ship` is only on the menu when a census exists and did clear it.
+ *
+ * Measured on a consumer: a run whose dispatch receipts carried `orient` and `task-executor` and
+ * nothing else — `scope-hammer` never dispatched — recorded `H → accept-cut-list` and `L4 → ship`
+ * from the `ci` preset, while its own ledger read `status: escalated`, `final_verdict: ~`, every
+ * requirement at `no evidence`. `shapeup-run.js` does guard this, but only after the hammer
+ * dispatch, so a run that returns `gate_h` from a breaker reaches L4 by a route the guard does not
+ * cover. A check on one call site is not a property.
+ *
+ * Absence of a census disqualifies `ship` on its own: "no one looked" and "someone looked and it
+ * was fine" are different facts, and only the second warrants a ship.
+ *
+ * @param {object} r - A resolved gate result from {@link resolve}.
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} slug - Feature slug, when the gate is being resolved inside a run.
+ * @returns {object} The result, or an `ask` carrying why `ship` was not available.
+ */
+export function narrowToEvidence(r, cwd, slug) {
+  if (r?.gate !== "L4" || r?.status !== "ok" || r?.decision !== "ship") return r;
+  const verdict = censusVerdict(cwd, slug);
+  if (verdict === "ship-now" || verdict === "ship-after-fixes") return r;
+  const why = verdict === "cannot-ship"
+    ? "scope-hammer's census returned CANNOT SHIP"
+    : "scope-hammer has not run, so no census exists";
+  return {
+    gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+    refused: "ship", census: verdict,
+    reason: `GATE L4 cannot be answered "ship": ${why}. An answer set chooses among the answers a ` +
+            `gate allows; it cannot supply the evidence that makes one allowed. Put the block to the ` +
+            `PO, or run the census first.`,
+  };
+}
+
 export function resolve(set, gate, source) {
   if (!GATE_IDS.includes(gate)) {
     return { gate, status: "error", reason: `unknown gate "${gate}" — known: ${GATE_IDS.join(", ")}` };
@@ -362,7 +427,7 @@ export function cli(rawArgv) {
   const gate = args.resolve ?? null;
   if (!gate) die("nothing to do — pass --init, --list, --verify, or --resolve <gate-id>");
 
-  const r = resolve(found.set, gate, found.source);
+  const r = narrowToEvidence(resolve(found.set, gate, found.source), cwd, args.slug ?? null);
   if (r.status === "error") die(r.reason);
   // A gate with no `--slug` (e.g. `--file` used ad hoc, outside any run) has nowhere to file a
   // per-run ledger row — the same reasoning `resolveRunId` uses for "no run is active": absence is

package/kernel/probe/attempts.mjs

@@ -30,7 +30,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { dispatchReceipts, legLedger, resultsDir } from "../lib/paths.mjs";
+import { dispatchReceipts, legLedger, resultsDir, readRunId } from "../lib/paths.mjs";
 import { readLegs } from "./leg.mjs";
 import { greenVerdict } from "./t0.mjs";
 
@@ -64,10 +64,26 @@ export function readReceipts(path) {
  * @param {object[]} legs - Pre-read `legs.jsonl` rows.
  * @returns {{orderId:string, hasReceipt:boolean, hasResult:boolean, hasLeg:boolean, state:("unattested"|"in-flight"|"spent")}}
  */
-export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, legs) {
+export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, legs, runId = null) {
   const orderId = `${slug}/${scopeId}-r${round}-a${attempt}`;
-  const hasReceipt = receipts.some((r) => r?.order_id === orderId);
-  const hasLeg = legs.some((r) => r?.order_id === orderId);
+  // SCOPED TO THIS RUN, and that qualifier is the whole correction. `receipts/dispatch.jsonl` and
+  // `legs.jsonl` are per-slug and append-only, so they accumulate across every run of a pitch,
+  // while `order_id` repeats — the run key is the only thing that separates two runs of one
+  // feature. Matching on `order_id` alone answered "was this attempt spent?" with a PREVIOUS run's
+  // receipt: measured on a consumer, a run that dispatched nothing was told its first attempt was
+  // spent, complete with leg and result, by rows two launches old.
+  //
+  // A row carrying no run key belongs to NO run rather than to this one, and an unresolvable
+  // current run (no receipt on disk) matches nothing. Both directions under-count rather than
+  // over-count, which is the safe way to be wrong here: an under-count leaves a breaker un-tripped
+  // and the round continues, where an over-count stops work that was never done.
+  const mine = (r) => r?.order_id === orderId && runId != null && r?.run_id === runId;
+  const hasReceipt = receipts.some(mine);
+  const hasLeg = legs.some(mine);
+  // A WorkResult carries no run key and reaches one only through its `order_id`, which repeats —
+  // so this stays a file check and is deliberately NOT sufficient on its own. It can only turn an
+  // already run-scoped receipt into `spent`; a result left behind by an earlier run cannot attest
+  // an attempt this run never dispatched.
   const hasResult = existsSync(join(resultsDir(cwd, slug), `${scopeId}-r${round}-a${attempt}.json`));
   const state = !hasReceipt ? "unattested" : (hasResult || hasLeg) ? "spent" : "in-flight";
   return { orderId, hasReceipt, hasResult, hasLeg, state };
@@ -91,10 +107,11 @@ export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, le
 export function scopeAttempts(cwd, slug, scopeId, round, attemptBudget) {
   const receipts = readReceipts(dispatchReceipts(cwd, slug));
   const legs = readLegs(legLedger(cwd, slug));
+  const runId = readRunId(cwd, slug);
   const attempts = [];
   let spent = 0, inFlight = 0, unattested = 0;
   for (let a = 1; a <= attemptBudget; a++) {
-    const ev = attemptEvidence(cwd, slug, scopeId, round, a, receipts, legs);
+    const ev = attemptEvidence(cwd, slug, scopeId, round, a, receipts, legs, runId);
     if (ev.state === "spent") spent++;
     else if (ev.state === "in-flight") inFlight++;
     else unattested++;

package/kernel/probe/resume.mjs

@@ -56,14 +56,14 @@
 // Exit: 0 ok · 2 malformed argv (nothing ran) · 3 the target the operation needs is not on disk ·
 //       6 the required phase's artifact is NOT on disk (the phase did not complete).
 
-import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
 import {
   intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
-  orientDir, activeOrder, usecasesDir, breadboard, receipt, readReceipt, requirements,
+  orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements,
   exportRunDir,
 } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
@@ -679,10 +679,46 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   // The Ship phase (`shapeup-run.js`) already exports a shipped run itself, before this call ever
   // runs — Stage 2 adds the endings that wrote nothing, and leaves that path untouched.
   const shouldExport = withExport && status !== "shipped";
-  const withExportWarning = (result) => {
-    if (!shouldExport) return result;
-    const warning = exportOnClose(cwd, slug);
-    return warning ? { ...result, export_warning: warning } : result;
+
+  /**
+   * Everything a close owes the checkout once the ledger line is written: export the run's
+   * records, then retire its pointers.
+   *
+   * The export runs FIRST, but not because it has to: `exportOnClose` is handed the slug and keys
+   * its output by the receipt's `run_id`, so it never reads the pointers this retires. (The bare
+   * `reduce export` CLI does read `active-scope` — only to work out which run the operator meant
+   * when they named none.) Reporting before teardown is a defensive default, not a correctness
+   * requirement, and it is recorded as such so the next reader does not defend an ordering that
+   * carries nothing. Measured: swapping the two leaves every check green.
+   *
+   * WHY RETIRE AT ALL. The substrate fence is enforced while an order is compiled and unanswered,
+   * and a run that ends any way other than shipping leaves exactly that by construction. Until this
+   * ran, the fence outlived the run: after a close that exited 0 and recorded everything, an
+   * ordinary write anywhere in the project was still denied, with no dispatch in flight. The
+   * operator's obvious remedy did not help either — `init run --force` is documented as "abandon
+   * the open run and start over", never as "release a stuck fence".
+   *
+   * AND RETIRING IS NOT ANSWERING. The pointer says "a run is in flight"; the order's missing
+   * result says "nobody came back". Only the first is untrue after a close. The abandoned order
+   * stays unanswered, the attempt census still sees nothing spent on it, and `init run --force`
+   * remains the one thing that writes a synthetic result — because a close that quietly claimed the
+   * work was answered would spend an attempt budget on work nobody did.
+   *
+   * Best-effort, like the export: a pointer that cannot be removed degrades the close and is
+   * reported in its return, but never turns a close into a non-close.
+   */
+  const finishClose = (result) => {
+    const warning = shouldExport ? exportOnClose(cwd, slug) : null;
+    const stuck = [];
+    for (const pointer of [activeOrder(cwd), activeScope(cwd)]) {
+      try { rmSync(pointer, { force: true }); } catch { /* fall through to the check below */ }
+      if (existsSync(pointer)) stuck.push(pointer);
+    }
+    return {
+      ...result,
+      ...(warning ? { export_warning: warning } : {}),
+      ...(stuck.length ? { pointer_warning: `could not retire ${stuck.join(", ")} — the substrate fence may still deny writes until it is removed by hand` } : {}),
+    };
   };
 
   // Truncated, not elided: a cause this long has already done its job in the run's own log — the
@@ -699,7 +735,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   if (priorClosedStatus && priorClosedAt) {
     if (priorClosedStatus === status && normCause === priorCause) {
       // The identical fact, restated — a retried or duplicated call costs nothing.
-      return withExportWarning({ ok: true, path: p, status, closed_at: priorClosedAt, cause: priorCause, decision: "idempotent", reason: `already closed as "${status}" at ${priorClosedAt} — idempotent no-op` });
+      return finishClose({ ok: true, path: p, status, closed_at: priorClosedAt, cause: priorCause, decision: "idempotent", reason: `already closed as "${status}" at ${priorClosedAt} — idempotent no-op` });
     }
     if (priorClosedStatus !== status) {
       // A DIFFERENT terminal status over an already-closed run — refused outright, the original
@@ -724,7 +760,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
     if (afterSup.status !== status || !afterSup.closed_at || afterSup.closed_at === "~") {
       return { ok: false, path: p, status, reason: `wrote the superseding close but the ledger reads back status="${afterSup.status}" closed_at="${afterSup.closed_at}" — the write did not take` };
     }
-    return withExportWarning({
+    return finishClose({
       ok: true, path: p, status, closed_at: afterSup.closed_at, cause: afterSup.close_cause ?? null,
       superseded: true, decision: "superseded", prior_cause: priorCause, prior_closed_at: priorClosedAt,
     });
@@ -739,7 +775,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   if (after.status !== status || !after.closed_at || after.closed_at === "~") {
     return { ok: false, path: p, status, reason: `wrote the close but the ledger reads back status="${after.status}" closed_at="${after.closed_at}" — the write did not take` };
   }
-  return withExportWarning({ ok: true, path: p, status, closed_at: after.closed_at, cause: after.close_cause ?? null, decision: "closed" });
+  return finishClose({ ok: true, path: p, status, closed_at: after.closed_at, cause: after.close_cause ?? null, decision: "closed" });
 }
 
 /**

package/kernel/reduce/ship.mjs

@@ -78,7 +78,7 @@ export function frontmatter(text) {
  */
 export function boardCensus(cwd, slug) {
   const dir = tasksDir(cwd, slug);
-  const out = { total: 0, done: 0, unfinished: [] };
+  const out = { total: 0, done: 0, unfinished: [], anchors: {} };
   if (!existsSync(dir)) return out;
   for (const f of readdirSync(dir)) {
     if (!/^TASK-[\w.-]+\.md$/i.test(f)) continue;
@@ -86,6 +86,12 @@ export function boardCensus(cwd, slug) {
     const fm = frontmatter(body);
     const id = fm.id || f.replace(/\.md$/, "");
     out.total++;
+    // The COMMITTED anchor for this board id. `use_case_refs` is the tier-direction rule's own
+    // sanctioned direction (LOCAL names SHARED), and it is what the frozen report cites instead of
+    // the id — boards renumber per machine, use cases do not.
+    const ucs = String(fm.use_case_refs ?? "").replace(/^\[|\]$/g, "")
+      .split(",").map((x) => x.trim()).filter(Boolean);
+    out.anchors[id] = ucs;
     if (fm.status === "done") out.done++;
     else out.unfinished.push(id);
   }
@@ -93,6 +99,31 @@ export function boardCensus(cwd, slug) {
   return out;
 }
 
+/**
+ * Replace every board id in free prose with its committed anchor.
+ *
+ * THE WRITE BOUNDARY, not the column, and that is the whole point. Board ids reached the frozen
+ * report three different ways — the unfinished-task callout, the covering-AC column's own prefix,
+ * and INSIDE acceptance-criterion prose a planner wrote ("given the seeded todos (TASK-006)"). The
+ * third is upstream free text, so a fix that only changes what the columns interpolate still
+ * commits a file the next run's spec-lint reds. Everything written into the committed report passes
+ * through here.
+ *
+ * An id with no resolvable use case becomes a neutral phrase rather than the id: the report loses a
+ * pointer that never resolved off this machine anyway, and keeps the sentence around it.
+ *
+ * @param {*} text - Any value destined for the committed report.
+ * @param {Record<string, string[]>} anchors - Board id → its `use_case_refs`.
+ * @returns {string} The text with every `TASK-…` replaced by a stable anchor.
+ */
+export function deboard(text, anchors = {}) {
+  return String(text ?? "").replace(/\bTASK-[A-Za-z0-9][\w.-]*/g, (id) => {
+    const ucs = anchors[id];
+    if (ucs && ucs.length) return ucs.join("/");
+    return "a board task";
+  });
+}
+
 /**
  * Per-scope T0 outcome, reduced from the trial ledger.
  *
@@ -194,7 +225,10 @@ export function buildReport(facts) {
   L.push("");
 
   if (board.unfinished.length) {
-    L.push(`> **${board.unfinished.length} task(s) did not finish:** ${board.unfinished.join(", ")}.`,
+    // Anchored, never enumerated by board id: the ids renumber per machine, and a committed file
+    // carrying one reds the NEXT run of this pitch at L1b.
+    const unfinishedAnchors = [...new Set(board.unfinished.flatMap((id) => board.anchors?.[id] ?? []))];
+    L.push(`> **${board.unfinished.length} task(s) did not finish**${unfinishedAnchors.length ? ` — use cases: ${unfinishedAnchors.join(", ")}` : ""}.`,
       "> The verdict above grades what was built, not what was planned.", "");
   }
 
@@ -241,7 +275,9 @@ export function buildReport(facts) {
     const cell = (s) => String(s).replace(/\|/g, "\\|");
     L.push("| REQ | source | evidence | covering AC | criterion | T0 |", "|---|---|---|---|---|---|");
     for (const r of requirements.rows) {
-      const ac = r.covering_acs.length ? `${r.covering_acs[0].task_id}: ${r.covering_acs[0].ac}${r.covering_acs.length > 1 ? ` (+${r.covering_acs.length - 1})` : ""}` : "—";
+      const ac = r.covering_acs.length
+        ? `${deboard(r.covering_acs[0].task_id, facts.board?.anchors)}: ${deboard(r.covering_acs[0].ac, facts.board?.anchors)}${r.covering_acs.length > 1 ? ` (+${r.covering_acs.length - 1})` : ""}`
+        : "—";
       const crit = r.criteria.length ? `${r.criteria[0].criterion}${r.criteria.length > 1 ? ` (+${r.criteria.length - 1})` : ""} → ${r.criteria.map((c) => c.verdict).join(",")}` : "—";
       const t0h = r.t0.length ? r.t0.map((h) => String(h).slice(0, 12)).join(", ") : "—";
       L.push(`| ${r.id} | ${cell(r.source || "—")} | ${r.evidence} | ${cell(ac)} | ${cell(crit)} | ${t0h} |`);

package/kernel/schemas/domain.schema.json

@@ -1215,7 +1215,7 @@
       }
     },
     "CommandResult": {
-      "description": "One executed command's outcome inside a T0 artifact — produced by actually running the command; no agent can fabricate it.",
+      "description": "One executed command's outcome inside a T0 artifact — produced by actually running the command; no agent can fabricate it. It carries the EVIDENCE, not only the score: `exit` maps a command that never started onto the same 1 a real failure returns, so without `error` a refused or timed-out command and a broken build are the same record everywhere downstream, and without the output a verdict asserting `exit 1` is an assertion nobody can check.",
       "x-tier": "EMBEDDED",
       "type": "object",
       "properties": {
@@ -1223,10 +1223,23 @@
           "type": "string"
         },
         "exit": {
-          "type": "integer"
+          "type": "integer",
+          "description": "The process exit code, or 1 when the command never produced one. Not a discriminator on its own — read `error` to tell a crash from a failure."
         },
         "pass": {
           "type": "boolean"
+        },
+        "error": {
+          "type": "string",
+          "description": "Present ONLY when the command did not run to completion — a spawn failure, a maxBuffer overflow, or the 10-minute timeout. Its presence is the fact the ratchet grades as `crash` (tree restored, never counted as a reverted attempt); its absence means the command ran and the exit code is its own."
+        },
+        "stdout_tail": {
+          "type": "string",
+          "description": "The last 4000 characters of stdout, omitted when nothing was printed. Kept for passing commands too: a fixture that exits 0 having run zero tests is the false green this layer exists to catch. A truncated tail carries a leading `[truncated: kept the last N of M characters]` line, so a partial stream never reads as a complete one."
+        },
+        "stderr_tail": {
+          "type": "string",
+          "description": "The last 4000 characters of stderr, same bound and same truncation marker as `stdout_tail`."
         }
       }
     },

package/kernel/verify/spec.mjs

@@ -235,11 +235,56 @@ export function lintScopes(scopes, repoFiles) {
 }
 
 /** Text forms worth scanning; anything else in a committed tree is not a reference carrier. */
-const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
+export const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
 
 /** A machine-local board id. Strict on purpose: a committed tree has no reason to carry one at all. */
 const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 
+/**
+ * The tier-direction violations one piece of text carries — the whole rule, on a string.
+ *
+ * EXPORTED BECAUSE IT HAS TWO ENFORCEMENT POINTS NOW, and they must not be allowed to drift.
+ * `lintCommittedTier` below walks files at GATE L1b; `hooks/tier-guard.mjs` refuses the same text
+ * at the moment a tool writes it, minutes earlier, while the writer still holds the context needed
+ * to rephrase. Four producers wrote committed files this rule reds and none of them learned from
+ * the lint, because by the time it speaks the dispatch that wrote the line is over. A second
+ * enforcement point is only worth having if it enforces the SAME predicate, so both call this.
+ *
+ * The detail strings are the message the writer reads, so they carry the remedy, not just the
+ * verdict: a board id resolves on the machine that wrote it and nowhere else, and a path into the
+ * gitignored tier dangles on every clone.
+ *
+ * @param {string} text - The file body, or the fragment a tool is about to write.
+ * @returns {Array<{kind:("board-id"|"local-path"), token:string, line:number, detail:string}>}
+ *   One entry per offending line and form, in file order; [] when clean.
+ */
+export function tierLeaks(text) {
+  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
+  const esc = LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  // `\S+` where the walk's own rule is `\S`: the same LINES match either way (a path with one
+  // non-space character after the slash has at least one), and the longer form yields the token to
+  // quote back at the writer. Trailing punctuation the prose wrapped it in is trimmed off the
+  // quote only — never off the test.
+  const localPath = new RegExp(`${esc}/\\S+`);
+  const leaks = [];
+  String(text ?? "").split(/\r?\n/).forEach((line, i) => {
+    const task = line.match(TASK_ID);
+    if (task) {
+      leaks.push({ kind: "board-id", token: task[0], line: i + 1, detail:
+        `names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
+        "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
+        "and nowhere else. Cite the use case or the scope_id, which are stable." });
+    }
+    const path = line.match(localPath);
+    if (path) {
+      leaks.push({ kind: "local-path", token: path[0].replace(/[`)\]},.;:'"]+$/, ""), line: i + 1, detail:
+        `points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
+        "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
+    }
+  });
+  return leaks;
+}
+
 /**
  * Lint the WHOLE committed tree for references into the gitignored tier.
  *
@@ -265,28 +310,15 @@ const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 export function lintCommittedTier({ cwd, slug }) {
   const root = sharedRoot(cwd, slug);
   if (!existsSync(root)) return [];
-  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
-  const localPath = new RegExp(`${LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/\\S`);
   const findings = [];
   for (const rel of walkFiles(root)) {
     if (!SCANNED.test(rel)) continue;
-    let lines;
-    try { lines = readFileSync(join(root, rel), "utf8").split(/\r?\n/); } catch { continue; }
-    lines.forEach((line, i) => {
-      const at = `${relative(cwd, join(root, rel))}:${i + 1}`;
-      const task = line.match(TASK_ID);
-      if (task) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
-          "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
-          "and nowhere else. Cite the use case or the scope_id, which are stable." });
-      }
-      if (localPath.test(line)) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
-          "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
-      }
-    });
+    let text;
+    try { text = readFileSync(join(root, rel), "utf8"); } catch { continue; }
+    for (const leak of tierLeaks(text)) {
+      findings.push({ rule: "TIER-DIRECTION", level: "red",
+        detail: `${relative(cwd, join(root, rel))}:${leak.line} ${leak.detail}` });
+    }
   }
   return findings;
 }

package/kernel/verify/t0.mjs

@@ -79,6 +79,69 @@ function runCommand(cmd, cwd) {
   return { cmd, exit: r.status ?? 1, pass: r.status === 0, stdout, stderr, ...(error ? { error } : {}) };
 }
 
+/**
+ * How much of each stream the persisted record keeps, per command.
+ *
+ * A bound rather than the whole stream, because one chatty fixture would otherwise make every
+ * reader of the run trace pay for it — and a bound at the END rather than the start, because that
+ * is where a stack trace, an assertion diff and a test summary all land.
+ */
+export const EVIDENCE_TAIL_CHARS = 4000;
+
+/**
+ * The last `limit` characters of a stream, marked when anything was dropped.
+ *
+ * THE MARKER IS NOT DECORATION. A truncated tail that does not say so is a partial stream that
+ * reads as a complete one, which is the same class of defect as the one this whole change fixes:
+ * a record that overstates what it actually holds.
+ *
+ * @param {(string|null|undefined)} text - The captured stream.
+ * @param {number} [limit] - Characters to keep.
+ * @returns {(string|null)} The kept tail, or null when the stream was empty (the field is then
+ *   omitted rather than stored as "", so "nothing was printed" stays visibly different from
+ *   "nothing was kept").
+ */
+export function boundedTail(text, limit = EVIDENCE_TAIL_CHARS) {
+  const s = String(text ?? "");
+  if (!s) return null;
+  if (s.length <= limit) return s;
+  return `[truncated: kept the last ${limit} of ${s.length} characters]\n${s.slice(-limit)}`;
+}
+
+/**
+ * One command's outcome as the verdict artifact stores it — the evidence, not just the score.
+ *
+ * WHAT THIS FIXES. The artifact used to keep `{cmd, exit, pass}`, and `runCommand` maps a command
+ * that never started onto `exit: 1` — the same number a genuine failure returns. So a refused or
+ * timed-out command and a broken build were the SAME RECORD everywhere downstream: the digest, the
+ * hill, the report, the evaluator's citation and anyone reading the trace back afterwards. The
+ * kernel computed the difference (`error`, which the ratchet grades as `crash`) and discarded it
+ * one line later.
+ *
+ * `exit` is deliberately left as it is. Mapping a crash to some other number would change what the
+ * ratchet compares and what every existing reader parses; the distinction travels in `error`, which
+ * is the field that actually means "this never ran", and which the crash branch already reads.
+ *
+ * Output is kept for PASSING commands too, and that direction is not an afterthought: a fixture
+ * that exits 0 having run zero tests is the false green this evidence layer exists to catch, and
+ * its stdout is the only place that shows.
+ *
+ * @param {({cmd:string, exit:number, pass:boolean, stdout?:string, stderr?:string, error?:string}|null)} r
+ *   A `runCommand` result, or null when no command was declared.
+ * @returns {(object|null)} The record to persist; null passes through unchanged.
+ */
+export function commandEvidence(r) {
+  if (!r) return null;
+  const stdout = boundedTail(r.stdout);
+  const stderr = boundedTail(r.stderr);
+  return {
+    cmd: r.cmd, exit: r.exit, pass: r.pass,
+    ...(r.error ? { error: r.error } : {}),
+    ...(stdout ? { stdout_tail: stdout } : {}),
+    ...(stderr ? { stderr_tail: stderr } : {}),
+  };
+}
+
 /**
  * Run every e2e fixture command for a scope.
  * @param {string[]} fixtures - Fixture command lines (null/empty → no commands).
@@ -513,8 +576,10 @@ export async function cli(rawArgv) {
   const { path, sha256: hash, trial } = writeArtifact(outDir, round, attempt, {
     ...(runId ? { run_id: runId } : {}),
     scope_id: contract.scope_id,
-    fixtures: fixtures.results.map(({ cmd, exit, pass }) => ({ cmd, exit, pass })),
-    db_probe: dbProbe && { cmd: dbProbe.cmd, exit: dbProbe.exit, pass: dbProbe.pass },
+    // The evidence, not just the score — see `commandEvidence` for what the three-field record
+    // could not tell apart, and why `exit` still reads the way it always did.
+    fixtures: fixtures.results.map((r) => commandEvidence(r)),
+    db_probe: commandEvidence(dbProbe),
     seesaw,
     ...verdict,
     score: s,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -281,6 +281,10 @@ Always use wikilinks (double brackets), never relative paths like `../domain-mod
   (`"extracted from .shapeup/<slug>/intake.md"`) reds for the same reason a task
   wikilink does: the path dangles on every other clone. Cite the committed pitch or
   shaping doc instead, or describe the run tier without a path.
+- **You will be stopped at the write, not at the gate.** The same rule is enforced as a
+  refusal on the Write/Edit itself, quoting the offending token back. There is nothing to
+  appeal: rephrase the line and write it again. Waiting for spec-lint to tell you at Board
+  Review costs the whole phase, which is what it used to cost every time.
 - `[[tasks/...]]` wikilinks are valid only inside LOCAL documents (task files, the board,
   EVAL reports), where they resolve against the LOCAL root (`.shapeup/<slug>/`);
   every wikilink in a SHARED doc stays `spec_folder`-relative.

package/skills/tech-lead/references/tiny-lane.md

@@ -26,7 +26,8 @@ scales down, its *verification floor* does not.
   ingest-result dispatch. Tiny never means "just edit the file inline".
 - **T0 verification.** A tiny change still proves itself by running — never by claim. If there
   is no runnable check at all, that is a fit-check failure, not a reason to skip T0.
-- **The safety-spine and sandbox hooks.** Machine guards do not scale down.
+- **The machine guards — safety spine, substrate sandbox, tier guard.** They do not scale down,
+  and a tiny lane is where a committed file is most likely to be written by hand.
 - **The discovery ledger.** `lane: tiny` is recorded, so a later reader knows exactly what was
   NOT checked (no EVAL verdict, no QA charter, no wiring assertion).