shapeup-sdlc 3.7.1 → 3.7.3

package/kernel/probe/leg.mjs

@@ -59,6 +59,65 @@ export function readLegs(path) {
  *   result exists that was never ingested; a scope with no results at all reports `closed: false`
  *   with an empty `orders` list, so a caller can tell "nothing ran" from "nothing was applied".
  */
+/**
+ * Every order the run compiled, with whether its result landed and whether the single writer
+ * applied it — planning orders (`analyze.json`) and build orders (`alpha-r1-a1.json`) alike.
+ *
+ * Why the generic form exists: the per-scope reading below was the only reader of the leg ledger
+ * in the run loop, and it was asked in one place, behind the checks that decide a scope is green.
+ * Measured on a live run: five dispatches, five results, three leg rows — and the planning phase
+ * whose result nobody applied walked on, because its post-condition checked the artifact the
+ * worker wrote directly and never asked whether the writer ran. This is the question, asked of any
+ * order by name.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null), has_result:boolean, applied:boolean}[]}
+ */
+export function legsOf(cwd, slug) {
+  const oDir = ordersDir(cwd, slug);
+  const rDir = resultsDir(cwd, slug);
+  const ingested = new Set(readLegs(legLedger(cwd, slug))
+    .filter((r) => r.ingested_at)
+    .map((r) => String(r.order_id)));
+  const out = [];
+  for (const f of (existsSync(oDir) ? readdirSync(oDir) : []).filter((x) => x.endsWith(".json")).sort()) {
+    let orderId = null;
+    try { orderId = JSON.parse(readFileSync(join(oDir, f), "utf8")).order_id ?? null; } catch { /* unreadable — reported as unapplied */ }
+    out.push({
+      order: join(oDir, f),
+      name: f.replace(/\.json$/, ""),
+      order_id: orderId,
+      has_result: existsSync(join(rDir, f)),
+      applied: orderId !== null && ingested.has(orderId),
+    });
+  }
+  return out;
+}
+
+/**
+ * One order by its file stem — `analyze`, `wire`, `alpha-r1-a1` — and whether its leg closed.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} name - The order file's stem.
+ * @returns {{closed:boolean, found:boolean, order:(string|null), order_id:(string|null), has_result:boolean, applied:boolean}}
+ */
+export function orderLegState(cwd, slug, name) {
+  const o = legsOf(cwd, slug).find((x) => x.name === name);
+  if (!o) return { closed: false, found: false, order: null, order_id: null, has_result: false, applied: false };
+  return { closed: o.applied, found: true, ...o };
+}
+
+/**
+ * The results on disk that no leg row applied — finished work the board never saw.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null)}[]}
+ */
+export function openLegs(cwd, slug) {
+  return legsOf(cwd, slug).filter((o) => o.has_result && !o.applied);
+}
+
 export function legState(cwd, slug, scopeId, round) {
   const oDir = ordersDir(cwd, slug);
   const rDir = resultsDir(cwd, slug);
@@ -89,11 +148,13 @@ export function legState(cwd, slug, scopeId, round) {
 }
 
 export const ARGV_SPEC = {
-  usage: "harness.mjs probe leg --slug <slug> --scope <scope-id> --round N [--cwd <dir>]",
+  usage: "harness.mjs probe leg --slug <slug> (--scope <scope-id> --round N | --order <stem> | --open) [--cwd <dir>]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str", required: true },
-  scope: { type: "str", required: true },
-  round: { type: "int", min: 1, required: true },
+  scope: { type: "str" },
+  round: { type: "int", min: 1 },
+  order: { type: "str" },
+  open: { type: "flag" },
   cwd: { type: "path" },
 };
 
@@ -107,6 +168,22 @@ export const ARGV_SPEC = {
 export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
+  // `--open`: every result nothing applied, across the whole run, any phase. Exit 0 when none.
+  if (args.open) {
+    const open = openLegs(cwd, args.slug);
+    console.log(JSON.stringify({ closed: open.length === 0, open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id) }));
+    process.exit(open.length === 0 ? 0 : 1);
+  }
+  // `--order <stem>`: one order by file stem (`analyze`, `alpha-r1-a1`). Exit 0 when its leg closed.
+  if (args.order) {
+    const s = orderLegState(cwd, args.slug, args.order);
+    console.log(JSON.stringify(s));
+    process.exit(s.closed ? 0 : 1);
+  }
+  if (!args.scope || !args.round) {
+    console.error("probe leg: pass --scope <id> --round N, or --order <stem>, or --open");
+    process.exit(2);
+  }
   const s = legState(cwd, args.slug, args.scope, args.round);
   console.log(JSON.stringify({
     closed: s.closed,

package/kernel/probe/resume.mjs

@@ -61,11 +61,7 @@ import { dirname, join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
-import {
-  intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
-  orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements,
-  exportRunDir,
-} from "../lib/paths.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
@@ -709,6 +705,15 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
    */
   const finishClose = (result) => {
     const warning = shouldExport ? exportOnClose(cwd, slug) : null;
+    // The breadcrumb goes down before the pointers come up: the hooks that fire next — the
+    // scope-hammer census, the ship phase — resolve their run through whichever of the two exists,
+    // and there must be no instant in which neither does. Best-effort like the rest of this close.
+    try {
+      mkdirSync(dirname(lastRun(cwd)), { recursive: true });
+      writeFileSync(lastRun(cwd), JSON.stringify({
+        slug, run_id: readRunId(cwd, slug), closed_status: status, closed_at: new Date().toISOString(),
+      }) + "\n");
+    } catch { /* a missing breadcrumb costs the post-close rows their key, never the close */ }
     const stuck = [];
     for (const pointer of [activeOrder(cwd), activeScope(cwd)]) {
       try { rmSync(pointer, { force: true }); } catch { /* fall through to the check below */ }

package/kernel/reduce/graph.mjs

@@ -26,11 +26,11 @@
 // appended again and the LAST line wins on read, so the file is a log and the projection is a fold.
 
 import { existsSync, readdirSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { readLegs } from "../probe/leg.mjs";
 import { join, dirname, basename, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import {
-  localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath,
-  gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath,
+  localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath, gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath, legLedger,
 } from "../lib/paths.mjs";
 import { readAllContracts, readContract, ucId, reqId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
 import { runIdFromReceipt } from "../lib/paths.mjs";
@@ -39,11 +39,11 @@ import { runIdFromReceipt } from "../lib/paths.mjs";
 export const graphPath = (cwd, slug) => join(localRoot(cwd, slug), "graph.jsonl");
 
 /** Node types, by family. A type outside these sets is a bug, not an extension point. */
-export const WORK_NODES = ["Run", "Order", "Result", "Verdict", "Trial", "GateDecision"];
+export const WORK_NODES = ["Run", "Order", "Result", "Leg", "Verdict", "Trial", "GateDecision"];
 export const DOMAIN_NODES = ["Scope", "UseCase", "Requirement", "Seam"];
 
 /** Edge types. Each names a direction that is meaningful to read backwards. */
-export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
+export const EDGES = ["PRODUCED", "INGESTED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
 
 /**
  * Read the graph as a log and fold it into nodes and edges.
@@ -148,6 +148,22 @@ export function project(cwd, slug) {
     }
   }
 
+  // Leg-completion rows — the record that separates "the result landed" from "the single writer
+  // applied it". It was in neither this graph nor the export, so a run could show five orders
+  // producing five results and nobody could see that only three were ever read. A Result with no
+  // INGESTED edge leaving it is finished work the board never saw, and `--subgraph run` names it.
+  for (const l of readLegs(legLedger(cwd, slug))) {
+    if (!l?.order_id) continue;
+    const id = `leg:${l.order_id}`;
+    node(id, "Leg", {
+      order_id: l.order_id, worker: l.worker ?? null, operation: l.operation ?? null,
+      scope_id: l.scope_id ?? null, round: l.round ?? null, attempt: l.attempt ?? null,
+      dispatched_at: l.dispatched_at ?? null, ingested_at: l.ingested_at ?? null,
+      attested: l.attested ?? null, run_id: l.run_id ?? runId ?? null,
+    });
+    edge(`result:${l.order_id}`, "INGESTED", id);
+  }
+
   // T0 verdicts — the artifact the evaluator is required to cite, and the reason the lineage half
   // of this graph is worth having: a verdict node is the anchor of every "show me the evidence".
   const vDir = verdictsDir(cwd, slug);
@@ -370,6 +386,7 @@ export function runSubgraph(cwd, slug) {
   const of = (t) => [...nodes.values()].filter((n) => n.t === t);
   const orders = of("Order"), results = of("Result"), verdicts = of("Verdict");
   const resultIds = new Set(results.map((r) => r.order_id));
+  const ingestedFrom = new Set([...edges.values()].filter((e) => e.t === "INGESTED").map((e) => e.from));
   const greenByRound = {};
   for (const v of verdicts) {
     if (v.overall !== "green" || v.round == null || !v.scope_id) continue;
@@ -384,6 +401,8 @@ export function runSubgraph(cwd, slug) {
     seams: of("Seam").map((s) => s.seam).sort(),
     orders: orders.length,
     pending_orders: orders.filter((o) => !resultIds.has(o.order_id)).map((o) => o.order_id).sort(),
+    // Results the single writer never applied — a leg that came back and was not read.
+    unapplied_results: results.filter((r) => !ingestedFrom.has(`result:${r.order_id}`)).map((r) => r.order_id).sort(),
     rounds_with_green: Object.keys(greenByRound).map(Number).sort((a, b) => a - b),
     green_scopes_by_round: Object.fromEntries(Object.entries(greenByRound).map(([r, s]) => [r, [...s].sort()])),
     trials: of("Trial").length,

package/kernel/reduce/hill.mjs

@@ -6,24 +6,158 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger } from "../lib/paths.mjs";
+import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, localRoot } from "../lib/paths.mjs";
 import { readAllContracts, SCOPE_CONTRACT } from "../lib/contract.mjs";
 import { evalVerdict } from "../probe/eval.mjs";
 import { redBuildRounds } from "../verify/build.mjs";
 
+// ---------------------------------------------------------------------------------------------
+// THE DISCOVERY LEDGER, AND WHY ITS ABSENCE IS NOT A ZERO.
+//
+// The ledger arm is the only thing that promotes a scope from UPHILL_UNKNOWN to UPHILL_SOLVED —
+// "the open questions are closed". It used to be read as `scopeUnknowns[id] || 0`, which made
+// "nobody has filed a ledger yet" and "every unknown is closed" the same value, and that value
+// selects the FLATTERING phase. An absent value and a real one must not share a signature; when
+// they do, the run reports progress it has no evidence for. So the count is `null` — not `0` —
+// whenever the ledger could not actually be read and understood, and `null` promotes nothing.
+//
+// THE HEADING IS THE ATTRIBUTION KEY, and it has to match what the ingest step really writes:
+// `## Discovered — <order_id> (<date>)`, where `order_id` is `<slug>/<suffix>`. Two ways that
+// parse used to fail silently, both ending in the same false zero:
+//   * It required a COLON between the slug and the suffix. The order-envelope schema pins
+//     `order_id` to a slug, a SLASH, and a suffix drawn from `[a-z0-9.-]` — a colon cannot appear
+//     in a schema-valid order id at all, so the scope was never captured from any real ledger and
+//     every scope on every project read zero unknowns regardless of what was open.
+//   * It matched the em dash only, so a heading typed with a plain hyphen contributed nothing.
+// Both are fixed by matching the dash as a class and splitting the order id on its "/", and by
+// resolving the scope against the CONTRACTS ON DISK rather than guessing at the suffix's shape: a
+// build suffix is `<scope>-r<N>-a<M>` and a scoped operation's is `<operation>-<scope>[-r<N>]`, so
+// a pattern that tried to carve the scope out positionally captured the round suffix along with it.
+// ---------------------------------------------------------------------------------------------
+
+/** A ledger block heading, naming the order it files: `## Discovered — <slug>/<suffix> (<date>)`. */
+const LEDGER_HEADING = /^##\s+Discovered\s+[—–-]\s+(\S+)/;
+
+/**
+ * Index the scopes by the filename-safe form `harness compile` puts in an order suffix, so a
+ * heading is matched against ids that actually exist rather than parsed speculatively.
+ *
+ * @param {Array<object>} scopes - Parsed scope contracts.
+ * @returns {Map<string,string>} Compile's suffix form → the contract's own `scope_id`.
+ */
+function scopeSuffixIndex(scopes) {
+  const ix = new Map();
+  for (const s of scopes) {
+    const id = String(s?.scope_id || "");
+    if (!id) continue;
+    // Mirrors `harness compile`'s own normalisation of a scope id into an order suffix.
+    const key = id.toLowerCase().replace(/[^a-z0-9.-]/g, "-").replace(/^[^a-z0-9]+/, "");
+    if (key) ix.set(key, id);
+  }
+  return ix;
+}
+
+/**
+ * The scope a ledger heading's order belongs to, or `null` when it belongs to none.
+ *
+ * Operation-level dispatches (orient, analyze, wire, evaluate, hunt, hammer) carry no scope in
+ * their order id by construction, so "no scope" is a real and common answer here, not a parse
+ * failure — their rows are feature-wide and are deliberately credited to nobody.
+ *
+ * @param {string} orderId - The order id as the heading names it (`<slug>/<suffix>`).
+ * @param {Map<string,string>} ix - The index from `scopeSuffixIndex`.
+ * @returns {string|null} The owning contract's `scope_id`, or null.
+ */
+function scopeOfHeading(orderId, ix) {
+  const slash = orderId.indexOf("/");
+  const suffix = slash === -1 ? orderId : orderId.slice(slash + 1);
+  const core = suffix.replace(/-r\d+(?:-a\d+)?$/, "");
+  // Longest match wins, so a project holding both `pages` and `pages-admin` attributes each
+  // heading to the scope it actually names rather than to whichever was indexed first.
+  let best = null;
+  let bestLen = -1;
+  for (const [key, id] of ix) {
+    if ((core === key || core.endsWith(`-${key}`)) && key.length > bestLen) { best = id; bestLen = key.length; }
+  }
+  return best;
+}
+
+/**
+ * Open unknowns (`~` rows) per scope, read from the discovery ledger.
+ *
+ * @param {string} ledgerPath - Path to the run's discovery ledger.
+ * @param {Array<object>} scopes - Parsed scope contracts, used to attribute each block.
+ * @returns {Object<string,number>|null} Counts per `scope_id` — a scope with a block and no open
+ *   row is a genuine `0`. `null` means the ledger was NOT read: it is absent, unreadable, or
+ *   nothing in it could be attributed to a scope. `null` is never treated as zero, because "we
+ *   understood none of this file" is not evidence that nothing is open.
+ */
+function ledgerUnknowns(ledgerPath, scopes) {
+  if (!existsSync(ledgerPath)) return null;
+  let text;
+  try { text = readFileSync(ledgerPath, "utf8"); } catch { return null; }
+
+  const ix = scopeSuffixIndex(scopes);
+  const counts = {};
+  let headings = 0;
+  let attributed = 0;
+  let current = null;
+
+  for (const line of text.split("\n")) {
+    if (line.startsWith("## ")) {
+      // Reset on EVERY heading, matched or not. Carrying the previous block's scope across an
+      // unrecognised heading would credit one scope's open rows to another.
+      current = null;
+      const m = line.match(LEDGER_HEADING);
+      if (!m) continue;
+      headings++;
+      const id = scopeOfHeading(m[1], ix);
+      if (id) { attributed++; current = id; counts[id] = counts[id] || 0; }
+      continue;
+    }
+    if (current && line.startsWith("~ ")) counts[current]++;
+  }
+
+  // A ledger whose blocks we could not attribute to a single scope tells us nothing per scope.
+  // Reporting that as all-zero is the same false signature the colon-vs-slash bug produced.
+  if (headings === 0 || attributed === 0) return null;
+  return counts;
+}
+
+/**
+ * The phase currently recorded in a committed hill shard.
+ *
+ * @param {string} hDir - The committed hill directory.
+ * @param {string} id - Scope id.
+ * @returns {string|null} The recorded phase, or null when no shard exists for that scope.
+ */
+function committedPhase(hDir, id) {
+  const p = join(hDir, `${id}.yml`);
+  if (!existsSync(p)) return null;
+  try { return readFileSync(p, "utf8").match(/^phase:\s*(\S+)/m)?.[1] ?? null; } catch { return null; }
+}
+
 /**
  * Derive and write the hill phase for all scopes mechanically based on T0, T1, and ledger facts.
  * 
  * The derived phase follows these progression rules (facts move dots, not authors):
- * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope
- * - UPHILL_SOLVED: unknowns 0, no T0-green yet
+ * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope — and the floor the scope sits
+ *   at whenever the ledger has not answered at all, which is where every run legitimately begins
+ * - UPHILL_SOLVED: the ledger was read and reports zero open unknowns, no T0-green yet
  * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1/seesaw pending
  * - FINISHED: T1 PASS ∧ seesaw green
  *
  * @param {string} cwd - The project root directory.
  * @param {string} slug - The feature slug being built.
- * @returns {Array<{scope_id: string, phase: string, changed: boolean}>} A report of all scopes processed, their derived phase, and whether the hill shard on disk was modified.
- *   Side effects: writes to `shapeup/<slug>/hill/<scope-id>.yml` for each scope.
+ * @returns {Array<{scope_id: string, phase: (string|null), changed: boolean, derived: boolean,
+ *   unknowns: (number|null), reason?: string}>} A report of all scopes processed. `derived` says
+ *   whether the phase was computed from run evidence at all: when it is false the phase is
+ *   whatever the committed shard already records (or null when there is none), nothing was
+ *   written, and `reason` names why. `unknowns` is the ledger count behind the phase, or null
+ *   when the ledger could not be read — the two are deliberately distinguishable in the output as
+ *   well as in the derivation.
+ *   Side effects: writes to `shapeup/<slug>/hill/<scope-id>.yml` for each scope, EXCEPT on the
+ *   refusal path below, which writes nothing at all.
  */
 export function deriveHill(cwd, slug) {
   const scopes = readAllContracts(scopesDir(cwd, slug), SCOPE_CONTRACT).map((x) => x.contract);
@@ -31,6 +165,44 @@ export function deriveHill(cwd, slug) {
   const ledgerPath = discoveryLedger(cwd, slug);
   const hDir = hillDir(cwd, slug);
 
+  // -------------------------------------------------------------------------------------------
+  // A DERIVATION THAT CANNOT SEE THE RUN TRACE MUST NOT WRITE THE DELIVERABLE.
+  //
+  // This function reads one tier and writes the other. Every input below — T0 verdicts, the EVAL
+  // results, the round build gates, the discovery ledger — lives in the gitignored run trace,
+  // while the shards it writes are committed and outlive it: after a ship the run trace is cleaned
+  // up and the shards are the ONLY surviving record of where the work got to. So when the run
+  // trace for this slug is not on disk, every input is provably absent, and anything derived from
+  // that is derived from nothing.
+  //
+  // This is not a hypothetical. Pulling a branch mid-run is a supported state: the puller gets the
+  // committed spec, scopes and shards and no run trace of their own. Their first launch used to
+  // re-derive every scope from the empty set and overwrite the shards with the result — losing
+  // committed history rather than misreporting it.
+  //
+  // WHY REFUSE RATHER THAN WRITE AN "UNKNOWN" PHASE. Writing anything here destroys the record
+  // just as thoroughly; a shard that says "I could not look" has still replaced the one that said
+  // FINISHED, and the phase enum is a committed data format that a reader parses as current
+  // status. Not writing already expresses "no opinion" exactly, and it needs no new enum value.
+  //
+  // WHY THE CONDITION IS THE TIER'S EXISTENCE AND NOT "the phase would go down". Moving a dot
+  // backwards is correct and must stay possible — this is a pure function of the artifacts present
+  // and reports what they currently support, in both directions. A guard phrased as "never lower a
+  // phase" would quietly turn a derived value into a high-water mark, which is a different defect
+  // wearing this one's clothes. The condition is the narrowest one that is positively provable:
+  // the tier holding every input is not there.
+  // -------------------------------------------------------------------------------------------
+  if (!existsSync(localRoot(cwd, slug))) {
+    return scopes.map((s) => ({
+      scope_id: s.scope_id,
+      phase: committedPhase(hDir, s.scope_id),
+      changed: false,
+      derived: false,
+      unknowns: null,
+      reason: "local-run-trace-absent",
+    }));
+  }
+
   if (!existsSync(hDir)) mkdirSync(hDir, { recursive: true });
 
   // 1. Check if T1 Evaluation passed — the LATEST evaluate round's verdict, read the same way
@@ -95,28 +267,20 @@ export function deriveHill(cwd, slug) {
     }
   }
   
-  // 3. Ledger unknowns per scope
-  const scopeUnknowns = {};
-  if (existsSync(ledgerPath)) {
-    const lines = readFileSync(ledgerPath, "utf8").split("\n");
-    let currentScope = null;
-    for (const line of lines) {
-      const m = line.match(/^## Discovered — .*?:([\w.-]+)-a\d+/);
-      if (m) {
-        currentScope = m[1];
-      }
-      if (currentScope && line.startsWith("~ ")) {
-        scopeUnknowns[currentScope] = (scopeUnknowns[currentScope] || 0) + 1;
-      }
-    }
-  }
-  
+  // 3. Ledger unknowns per scope — `null` for every scope when the ledger itself was not readable
+  //    or nothing in it named a scope (see `ledgerUnknowns`). Only a real count can promote.
+  const scopeUnknowns = ledgerUnknowns(ledgerPath, scopes);
+
   const report = [];
   for (const s of scopes) {
     const id = s.scope_id;
     const t0 = t0Facts[id] || { hasGreen: false, seesawGreen: false };
-    const unknowns = scopeUnknowns[id] || 0;
-    
+    // `null` = the ledger did not answer; a number = it did. `|| 0` collapsed the two.
+    const unknowns = scopeUnknowns === null ? null : (scopeUnknowns[id] || 0);
+
+    // UPHILL_UNKNOWN is the floor, and the honest answer whenever nothing has promoted a scope off
+    // it — including before Orient has filed anything, which is where every run legitimately
+    // starts. Only an ANSWERED count of zero promotes to UPHILL_SOLVED; `null` never does.
     let phase = "UPHILL_UNKNOWN";
     if (t1Pass && t0.hasGreen && t0.seesawGreen) {
       phase = "FINISHED";
@@ -125,7 +289,7 @@ export function deriveHill(cwd, slug) {
     } else if (unknowns === 0) {
       phase = "UPHILL_SOLVED";
     }
-    
+
     const yaml = `scope_id: ${id}\nphase: ${phase}\n`;
     const out = join(hDir, `${id}.yml`);
     let changed = false;
@@ -133,7 +297,7 @@ export function deriveHill(cwd, slug) {
       writeFileSync(out, yaml);
       changed = true;
     }
-    report.push({ scope_id: id, phase, changed });
+    report.push({ scope_id: id, phase, changed, derived: true, unknowns });
   }
   return report;
 }
@@ -156,5 +320,16 @@ export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
   const report = deriveHill(cwd, args.slug);
+  // A refusal that is visible only as a missing write reads exactly like a derivation that
+  // happened to agree with what was already on disk, so say it out loud. It is not an error —
+  // the caller runs this advisorily several times a run, and declining to derive from nothing is
+  // the correct outcome, not a failure — so the exit code stays 0 and the warning goes to stderr.
+  const underived = report.filter((r) => r.derived === false);
+  if (underived.length) {
+    console.error(
+      `hill: derived nothing for ${underived.length} scope(s) (${underived[0].reason}) — ` +
+      `the run trace this phase is derived from is not on disk, so the committed shards were left as they are.`,
+    );
+  }
   console.log(JSON.stringify(report, null, 2));
 }

package/kernel/reduce/ship.mjs

@@ -32,7 +32,7 @@ import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
-  activeOrder,
+  activeOrder, runArgsPath, readReceipt, runIdFromReceipt,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -398,9 +398,51 @@ export const ARGV_SPEC = {
  * @returns {(Promise<void>|void)} Settles when the subcommand has written its output; most paths
  *   call `process.exit()` with the subcommand's documented code rather than returning.
  */
+/**
+ * Did THIS run skip evaluation? Read from the run's own recorded arguments, and believed only when
+ * the record can be shown to belong to this run.
+ *
+ * WHY THE KERNEL ASKS AT ALL. A run launched with `--no-eval` verified nothing, and the protocol
+ * has always said such a run ships as `not-evaluated`, "recorded plainly — never silently
+ * upgraded". That promise lived entirely inside the orchestrator's control flow, where one
+ * assignment downstream of the branch restores the old behaviour with every check still green —
+ * measured, not supposed. The gate block tells the human the truth either way; the committed report
+ * a teammate inherits on `git pull` is the artifact that was lying, so the refusal belongs at the
+ * writer of that artifact, where a future orchestrator edit cannot reach it.
+ *
+ * POSITIVELY PROVEN OR NOT AT ALL. The record is written at launch, later than the receipt that
+ * mints the run key, so a freshly opened run can still find the PREVIOUS run's record on disk. A
+ * stale flag would refuse a ship that verified everything — a worse failure than the one this
+ * closes. The flag therefore counts only when the record names the same run the receipt does;
+ * a missing, unreadable or differently-keyed record proves nothing and permits.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {boolean} True only when this run's own record says evaluation was skipped.
+ */
+function evalWasSkipped(cwd, slug) {
+  try {
+    const record = JSON.parse(readFileSync(runArgsPath(cwd, slug), "utf8"));
+    if (record?.noEval !== true) return false;
+    const mine = runIdFromReceipt(readReceipt(receiptPath(cwd, slug)));
+    return Boolean(mine) && record.runId === mine;
+  } catch { return false; }
+}
+
+/** The verdict values that assert the feature was graded and passed. */
+const PASSING = new Set(["PASS", "pass"]);
+
 export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = args.cwd || process.cwd();
+  if (PASSING.has(String(args.verdict ?? "")) && evalWasSkipped(cwd, args.slug)) {
+    console.error(
+      "✋ reduce ship: this run was launched with --no-eval, so nothing graded it — refusing to freeze a report " +
+      `that says ${args.verdict}. Ship it as --verdict not-evaluated, which the report, the ledger and the ` +
+      "sign-off block all carry.",
+    );
+    process.exit(3);
+  }
   const { markdown, path } = generate({ cwd, slug: args.slug, verdict: args.verdict, qa: args.qa });
   if (args.stdout) {
     process.stdout.write(markdown);

package/kernel/report/export.mjs

@@ -45,7 +45,9 @@ import { readFileSync, writeFileSync, readdirSync, mkdirSync, existsSync, statSy
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter } from "../lib/contract.mjs";
-import { runIdFromReceipt, readReceipt } from "../lib/paths.mjs";
+import {
+  runIdFromReceipt, readReceipt, legLedger,
+} from "../lib/paths.mjs";
 import { TABLES, runRow, dispatchFacts } from "./facts.mjs";
 import { deriveRounds } from "../probe/rounds.mjs";
 import {
@@ -260,6 +262,9 @@ export function collectRun(cwd, slug) {
       // The decision that crossed each gate, and the round build gate's own artifact.
       gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
       build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
+      leg: readJsonl(legLedger(cwd, slug), t)
+        .filter((r) => !runId || !r?.run_id || r.run_id === runId)
+        .map((r) => ({ ...r, run_id: r.run_id ?? runId ?? null })),
     },
     defects: { records_skipped: t.skipped },
   };

package/kernel/report/facts.mjs

@@ -32,6 +32,9 @@ export const TABLES = [
   // has to. `build_gate` is the round build gate's own artifact (kernel/verify/build.mjs), on the
   // same terms: it ends a round exactly as EVAL does, and had no table either.
   "gate_decision", "build_gate",
+  // The leg-completion ledger — one row per order the single writer applied. Without it the
+  // warehouse could join an order to its result and never say whether anyone read the result.
+  "leg",
 ];
 
 /** Coerce anything to a finite number, or null. Keeps `0` and rejects `NaN`/`""`/undefined. */

package/kernel/schemas/domain.schema.json

@@ -33,6 +33,10 @@
           "type": null,
           "gap": "a gate decision row — emitted by reduce graph, never typed here"
         },
+        "Leg": {
+          "type": null,
+          "gap": "a leg-completion row (reduce ingest's record that a result was applied) — emitted by reduce graph, never typed here"
+        },
         "Scope": {
           "type": "ScopeContract"
         },
@@ -2846,9 +2850,10 @@
           "type": "string",
           "enum": [
             "pass",
-            "fail"
+            "fail",
+            "not-evaluated"
           ],
-          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL."
+          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL — or `not-evaluated` when a `shipped` return closed a `--no-eval` run, which reaches SHIP without ever dispatching the judge. Recorded plainly, never upgraded to `pass` (references/protocol.md)."
         },
         "rounds_used": {
           "type": "integer"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.1",
+  "version": "3.7.3",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/hill-chart/SKILL.md

@@ -48,12 +48,16 @@ node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce graph --slug <slug>
 ```
 
 **For a committed-only slug (`hasCommitted && !hasLocal`), NEVER call `reduce hill`.**
-`deriveHill()` folds whatever T0 verdicts currently exist on disk; a committed-only pitch has
-none (the local trace was cleaned up after shipping), so re-running it would silently regress a
-true historical `FINISHED` down to a fabricated `UPHILL_SOLVED` — reading absence of evidence as
-evidence of absence. Read `shapeup/<slug>/hill/*.yml` for those slugs exactly as committed, and
-render them with the archived state the template already implements (see below). Same reasoning
-applies to `reduce graph` — there is no local trace to append from.
+`deriveHill()` folds whatever T0 verdicts, evaluation results and ledger rows exist in the LOCAL
+run trace; a committed-only pitch has none, because that trace was cleaned up after shipping.
+
+The runtime no longer takes that silence for an answer: a derivation whose run trace is absent
+declines to write anything and reports every scope as underived (`derived: false`), so the
+committed shards survive a call made in error. Treat that as a backstop, not a licence — an
+underived report is not a refresh, and rendering it as one would show a pitch's true `FINISHED`
+as freshly confirmed when nothing confirmed it. Read `shapeup/<slug>/hill/*.yml` for those slugs
+exactly as committed, and render them with the archived state the template already implements
+(see below). Same reasoning applies to `reduce graph` — there is no local trace to append from.
 
 ## Reading the hill shards
 

package/skills/tech-lead/references/gates.md

@@ -389,7 +389,7 @@ feature) and the failing step is compiled into round r+1's orders as `payload.bu
 means L0 pinned no run command and the profile names no probe — the round proceeds over an
 unproven build, and the block says so.
 
-Under `--interactive` / `--auto`, the hook warns if the board is not truly green (advisory) and requires explicit PO approval to proceed. Under `--unattended`, it automatically aborts on a red board or proceeds on a green one.
+Under `--interactive` / `--auto`, the gate block carries the board facts — `green_scopes`, `hammer_proposals` — and requires explicit PO approval to proceed. Under `--unattended` the answer set resolves it. **There is no hook behind this gate**: the `PreToolUse` warning it used to carry was retired into the block in v2.0, so what an unfinished board costs you here is a human reading the numbers, not a machine refusing the call.
 
 ---