shapeup-sdlc 3.7.12 → 3.9.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.12",
+  "version": "3.9.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -35,7 +35,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). The tree is committed and the board is per-machine: a run that finds the tree on disk and no board dispatches `board`, which regenerates the board from the tree without re-deriving it — GATE L2 refuses `proceed` over a board with zero tasks. An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
-| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
+| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
 
@@ -63,7 +63,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
 - **The requirements matrix is a projection, never a verdict** — `REQ → AC → criterion → verdict` is derived from files for one named run (the registry, the board's `covers:` clauses, the run's verdict rows, the T0 citations), never narrated and never passed in. `covers:` is the authoritative join: a criterion anchored to a requirement no AC covers is printed for reconciliation and counted as nothing. L4 reads one line off it, GATE H's census takes the clauses with no evidence, `REPORT.md` freezes the table — and none of that blocks a ship. A clause with no PASS evidence is a fact the baseline comparison weighs, not a veto.
-- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts (the seesaw arm is declared, not yet wired), never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
+- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts, never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution

package/README.md

@@ -45,11 +45,11 @@ its fixtures and its DB probe and writes an artifact to disk — with each comma
 its captured output, and whether it ran at all. The evaluator must cite that artifact, and the
 hill phase is derived from artifacts rather than from a worker's own account of its progress.
 Two limits, stated here because the point of this section is that a claim without a mechanism
-behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
-and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
-the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
-and the cited verdict are checked, the scope, round and run the artifact belongs to are not. Both are
-open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees. A T0 artifact is
+behind it is the thing this harness exists to prevent: a citation is re-hashed from disk, checked
+against the scope, round and run the artifact records, and refused unless it names a file this
+run's own verifier wrote — what that does NOT prove is that a judge with a dishonest hand could
+not have arranged the artifact first, which is why the judge's own substrate freezes the verdicts
+directory. A T0 artifact is
 also evidence about the machine that produced it, and now says so: each verdict carries where it
 ran — the absolute path, the git tree, the resolved toolchain, lockfile digests, declared cache
 directories and a digest over an allowlist of environment values — so a disagreeing re-run can be
@@ -132,15 +132,14 @@ rest of this README after this table and nothing will be a surprise.
 |---|---|
 | **board** | The round's task list. "Green" means every task is done. GATE L2's hook reads this before an evaluation and warns if it is not green. |
 | **round** | One build → evaluate cycle. A FAIL verdict starts round *r+1*. |
-| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe (the seesaw arm is declared and not yet wired — see §2 above). Writes an artifact to disk that the evaluator must cite. |
-| **seesaw** | The regression arm of T0, meant to re-run *other* scopes' fixtures so a regression is never mistaken for progress. Declared, not yet wired: no run writes its registry, so no run has executed it. |
+| **T0** | The smoke test a scope must pass before it counts as built: its fixtures and a DB probe. Writes an artifact to disk that the evaluator must cite. |
 | **substrate** | The exact list of files one dispatch is allowed to write, stamped into its work order. A hook blocks anything outside it — and anything the order marks frozen. |
 | **scope contract** | The file defining one vertical slice: its substrate, its fixtures, its affordances. |
 | **affordance** | The thing a user can actually click, type or call. UI is graded on affordances, not on looks. |
 | **hill / hill phase** | How much of a scope is still *unknown* versus merely *unfinished*. Derived from T0 facts — never self-reported. |
 | **gate (L0–L4)** | A numbered checkpoint in a run. Most pause for you; GATE L2 is the one a hook observes and reports on. |
 | **covers-closure** | Every requirement clause has at least one task claiming to cover it. Nothing silently drops. |
-| **wiring reachability** | Every engine has a call site reachable from the app's real entry point. Catches "built, but never wired up". |
+| **wiring reachability** | Every engine has a call site reachable from the app's real entry point. Catches "built, but never wired up". Reports itself unchecked, with a reason, when the import walk cannot be rooted — an unfollowable import, or no reachable engine to control it. |
 | **discovery ledger** | The one file everything found mid-run gets written to, so nothing is lost between rounds. |
 
 A longer version, including the internals, is in [docs/glossary.md](docs/glossary.md).
@@ -309,15 +308,18 @@ These hold across the harness and are the reason it stays predictable:
   of blocking the round. An opt-in third breaker bounds the **wall clock**, because the other two
   count events and neither can notice a single round running for half an hour — tripping it routes
   to GATE H, so a run out of time ships what is green instead of being killed and shipping nothing.
-- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts (the seesaw
-  arm is declared, not yet wired), closing the self-reported-confidence risk. A scope with no
+- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts, closing the
+  self-reported-confidence risk. A scope with no
   discovery ledger derives no phase rather than a solved one, so absence no longer reads as
   progress on that arm.
 - **One writer per shared file** — every board/ledger/verdict write goes through
   `harness reduce ingest`; workers return data and never touch shared state.
 - **Traceability is oracle-checked, opt-in** — `harness verify trace` verifies covers-closure and
   wiring reachability from the committed spine artifacts; it ships advisory (warn-only) and every
-  arm is skipped when its artifact is absent, so older specs are non-regressed.
+  arm is skipped when its artifact is absent, so older specs are non-regressed. Reachability also
+  skips when it cannot root its walk — an import it cannot follow, or no reachable engine to
+  control the result — because "every engine is orphaned" and "this is the wrong entry point" are
+  the same evidence, and a check that cannot tell them apart must say so rather than pick.
 
 ## Known rough edges
 

package/kernel/lib/argv.mjs

@@ -8,11 +8,11 @@
 //     const SPEC = {
 //       _:           { arity: 1, name: "scope-contract.json" },
 //       round:       { type: "int", min: 1, required: true },
-//       "no-seesaw": { type: "flag" },
+//       "no-ratchet": { type: "flag" },
 //     };
-//     const args = runArgs(SPEC, argv);   // args.round, args.noSeesaw, args._
+//     const args = runArgs(SPEC, argv);   // args.round, args.noRatchet, args._
 //
-// Flag names reach the caller camelCased (`--no-seesaw` → `noSeesaw`). Unknown flags are rejected
+// Flag names reach the caller camelCased (`--no-ratchet` → `noRatchet`). Unknown flags are rejected
 // rather than swallowed as positionals: a typo'd `--rounds 2` landing in `_` is the same defect
 // wearing a different hat. Untyped coercion is the failure this guards — `Number(undefined)` is
 // `NaN`, `??` does not catch `NaN`, and a verdict written to `r NaN-a1.json` with exit 0 is
@@ -35,7 +35,7 @@ export class ArgvError extends Error {
   }
 }
 
-/** `--seesaw-registry` → `seesawRegistry`. */
+/** `--attempt-budget` → `attemptBudget`. */
 function camel(name) {
   return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
 }

package/kernel/lib/paths.mjs

@@ -216,8 +216,6 @@ export const trials = (cwd, slug) => join(t0Dir(cwd, slug), "trials.jsonl");
  * {@link decisions}, one small file with one writer.
  */
 export const gates = (cwd, slug) => join(localRoot(cwd, slug), "gates.jsonl");
-/** Finished-scope fixture registry for the seesaw regression check. */
-export const seesawRegistry = (cwd, slug) => join(localRoot(cwd, slug), "seesaw", "registry.json");
 /**
  * The round build gate's verdicts — one immutable artifact per gate run, `r<N>-t<T>.json`.
  *

package/kernel/reduce/hill.mjs

@@ -144,8 +144,8 @@ function committedPhase(hDir, id) {
  * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope — and the floor the scope sits
  *   at whenever the ledger has not answered at all, which is where every run legitimately begins
  * - UPHILL_SOLVED: the ledger was read and reports zero open unknowns, no T0-green yet
- * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1/seesaw pending
- * - FINISHED: T1 PASS ∧ seesaw green
+ * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1 pending
+ * - FINISHED: T1 PASS ∧ a T0-green that a red round did not invalidate
  *
  * @param {string} cwd - The project root directory.
  * @param {string} slug - The feature slug being built.
@@ -230,18 +230,16 @@ export function deriveHill(cwd, slug) {
     }
   }
 
-  // 2. T0 facts per scope: has it achieved a green overall verdict? was seesaw also green?
+  // 2. T0 facts per scope: has it achieved a green overall verdict this run?
   //
-  // MINUS THE ROUNDS WHOSE BUILD GATE IS RED. A T0 verdict is one scope's fixtures inside its own
-  // substrate; the round build gate (`verify build`) is the feature's build and launch. Measured on
-  // a live run, all fourteen committed shards read DOWNHILL_EXECUTION off T0 verdicts from rounds in
-  // which the app never compiled and never launched — the dashboard showed a feature going downhill
-  // that had not started. A green fixture in a round the gate failed is not evidence the scope
-  // works; it is evidence the fixture does not test the build. No gate artifact at all leaves every
-  // verdict counting exactly as before.
+  // FINISHED USED TO WAIT ON AN ARM THAT NEVER RAN. The phase required `seesaw.ran && seesaw.pass`,
+  // nothing in the codebase ever wrote the registry that arm read, and so no scope in any recorded
+  // run reached FINISHED — 38 committed shards on the live consumer, not one of them. The arm was
+  // removed in 3.8.0 by decision; the precondition goes with it, and the top phase is reachable
+  // again on the evidence that does exist: T1 passed, and a T0 green from a round the build gate
+  // did not red.
   const redRounds = redBuildRounds(cwd, slug);
   const t0Facts = {};
-  // This run's verdicts only — a prior run's green over the same slug moved this run's dot.
   const hillRunId = readRunId(cwd, slug);
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir)) {
@@ -249,41 +247,21 @@ export function deriveHill(cwd, slug) {
       try {
         const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
         if (hillRunId && b.run_id && b.run_id !== hillRunId) continue;
-        if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
-        if (b.overall === "green" && !redRounds.has(Number(b.round))) {
-          t0Facts[b.scope_id].hasGreen = true;
-          // Read the REAL seesaw result off the verdict artifact (`t0.mjs`'s `writeArtifact()`
-          // already persists the full `{ran, pass, scopes_checked, failing}` object), rather than
-          // inferring it from a false `regression` flag. That inference was vacuously true on every
-          // green T0 whether or not a seesaw check ever ran: nothing in this codebase currently
-          // passes `--seesaw-registry` to `verify t0`, so `seesaw.ran` is always `false` today and
-          // `regression` is always `false` too — "not asked" was being read as "clean," letting a
-          // scope reach FINISHED on a regression check that had never executed.
-          //
-          // Betting Table decision (Phase 3.5 / S4): wiring the seesaw registry for real is a
-          // genuine feature with a real running cost (re-running every finished scope's fixtures
-          // on every later attempt) and is out of proportion to a certification-gap fix. Deferred,
-          // not silently dropped — a scope with no registry wired simply cannot reach FINISHED via
-          // this path today, which is the honest state of the system: this check was never really
-          // gating FINISHED before either.
-          if (b.seesaw?.ran && b.seesaw?.pass) {
-            t0Facts[b.scope_id].seesawGreen = true;
-          }
-        }
-      } catch (e) {
-        // ignore parse errors
+        if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false };
+        if (b.overall === "green" && !redRounds.has(Number(b.round))) t0Facts[b.scope_id].hasGreen = true;
+      } catch {
+        // A torn or unreadable verdict proves nothing about the scope — skip it rather than let it
+        // decide a phase.
       }
     }
   }
-  
-  // 3. Ledger unknowns per scope — `null` for every scope when the ledger itself was not readable
-  //    or nothing in it named a scope (see `ledgerUnknowns`). Only a real count can promote.
+
   const scopeUnknowns = ledgerUnknowns(ledgerPath, scopes);
 
   const report = [];
   for (const s of scopes) {
     const id = s.scope_id;
-    const t0 = t0Facts[id] || { hasGreen: false, seesawGreen: false };
+    const t0 = t0Facts[id] || { hasGreen: false };
     // `null` = the ledger did not answer; a number = it did. `|| 0` collapsed the two.
     const unknowns = scopeUnknowns === null ? null : (scopeUnknowns[id] || 0);
 
@@ -291,7 +269,7 @@ export function deriveHill(cwd, slug) {
     // it — including before Orient has filed anything, which is where every run legitimately
     // starts. Only an ANSWERED count of zero promotes to UPHILL_SOLVED; `null` never does.
     let phase = "UPHILL_UNKNOWN";
-    if (t1Pass && t0.hasGreen && t0.seesawGreen) {
+    if (t1Pass && t0.hasGreen) {
       phase = "FINISHED";
     } else if (t0.hasGreen) {
       phase = "DOWNHILL_EXECUTION";

package/kernel/report/export.mjs

@@ -129,7 +129,6 @@ function t0Row(a, runId) {
     regression: a?.regression ?? null,
     fixtures_green: a?.fixtures_green ?? null,
     db_probe_green: a?.db_probe_green ?? null,
-    seesaw_green: a?.seesaw_green ?? null,
     // One field a reader compares, and the block itself stays in the artifact for a human to diff:
     // two rows with the same tree and different env digests are two machines, not a regression.
     env_sha256: a?.env?.env_sha256 ?? null,
@@ -137,8 +136,6 @@ function t0Row(a, runId) {
     tree_dirty: a?.env?.tree?.dirty ?? null,
     fixtures_total: fixtures.length,
     fixtures_passed: fixtures.filter((f) => f?.pass === true).length,
-    seesaw_ran: a?.seesaw?.ran ?? null,
-    seesaw_failing: Array.isArray(a?.seesaw?.failing) ? a.seesaw.failing.length : null,
     discovered_tasks: Array.isArray(a?.discovered_tasks) ? a.discovered_tasks.length : 0,
   };
 }

package/kernel/schemas/domain.schema.json

@@ -236,7 +236,7 @@
         "to": "HillShard",
         "cardinality": "1:0..1",
         "via": "scope_id",
-        "note": "phase derived from T0/T1/seesaw facts, never authored"
+        "note": "phase derived from T0/T1 facts, never authored"
       },
       {
         "from": "ScopeContract",
@@ -252,13 +252,6 @@
         "via": "fixtures[] + db_probe",
         "note": "produced by actually running the commands — no agent can fabricate them"
       },
-      {
-        "from": "T0Artifact",
-        "to": "SeesawCheck",
-        "cardinality": "1:1",
-        "via": "seesaw",
-        "note": "the regression half of T0 — every FINISHED scope's fixtures re-run"
-      },
       {
         "from": "T0Artifact",
         "to": "AegisTriple",
@@ -287,13 +280,6 @@
         "via": "payload.trial_history[]",
         "note": "inspect(): the loop reads its own recent history, across the round boundary"
       },
-      {
-        "from": "SeesawRegistry",
-        "to": "ScopeContract",
-        "cardinality": "1:N",
-        "via": "scopes[].scope_id",
-        "note": "every FINISHED scope's fixtures re-run on each later attempt"
-      },
       {
         "from": "UseCase",
         "to": "Seam",
@@ -528,7 +514,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Globs ≥2 scopes both touch — every write here forces a full seesaw run at the next gate."
+          "description": "Globs ≥2 scopes both touch — an edit here is read-modify-write, so two scopes that both declare one never build at the same time."
         },
         "append_only": {
           "type": "array",
@@ -844,7 +830,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Files ≥2 scopes both touch — must be declared in BOTH scopes' lists (spec-lint DISJOINT) and every write forces a full seesaw run."
+          "description": "Files ≥2 scopes both touch — must be declared in BOTH scopes' lists (spec-lint DISJOINT); declaring one costs concurrency, since two scopes that share a path build one at a time."
         },
         "affordance_manifest": {
           "type": "array",
@@ -872,7 +858,7 @@
             "DOWNHILL_EXECUTION",
             "FINISHED"
           ],
-          "description": "ALWAYS authored as UPHILL_UNKNOWN — self-reported confidence is the risk this closes. The live phase is DERIVED from T0/T1/seesaw facts into hill/<scope-id>.yml — facts move dots, not authors."
+          "description": "ALWAYS authored as UPHILL_UNKNOWN — self-reported confidence is the risk this closes. The live phase is DERIVED from T0/T1 facts into hill/<scope-id>.yml — facts move dots, not authors."
         },
         "superseded_by": {
           "type": "array",
@@ -1254,35 +1240,8 @@
         }
       }
     },
-    "SeesawCheck": {
-      "description": "The regression half of T0: every FINISHED scope's fixtures re-run from the SeesawRegistry. fixtures/db green + seesaw red = a REGRESSION (the new scope broke a finished one) → git stash rollback + retry, not 'fix the new scope's bug'.",
-      "x-tier": "EMBEDDED",
-      "type": "object",
-      "properties": {
-        "ran": {
-          "type": "boolean",
-          "description": "false when no registry was passed or the attempt was already red (don't seesaw a red attempt)."
-        },
-        "pass": {
-          "type": "boolean"
-        },
-        "scopes_checked": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "failing": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "scope_ids whose fixtures broke."
-        }
-      }
-    },
-    "T0Artifact": {
-      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
+"T0Artifact": {
+      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures and DB probe; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/verdicts/r<N>-a<M>-t<T>.json (schema_version 2; the unsuffixed r<N>-a<M>.json of schema_version 1 is still readable)",
       "x-writer": "harness verify t0",
@@ -1327,9 +1286,6 @@
         "db_probe": {
           "$ref": "#/$defs/CommandResult"
         },
-        "seesaw": {
-          "$ref": "#/$defs/SeesawCheck"
-        },
         "fixtures_green": {
           "type": "boolean"
         },
@@ -1337,9 +1293,6 @@
           "type": "boolean",
           "description": "true when no probe declared (null probe never counts as failure)."
         },
-        "seesaw_green": {
-          "type": "boolean"
-        },
         "overall": {
           "type": "string",
           "enum": [
@@ -1347,10 +1300,6 @@
             "red"
           ]
         },
-        "regression": {
-          "type": "boolean",
-          "description": "fixtures+db green but seesaw red — the rollback+retry case."
-        },
         "score": {
           "$ref": "#/$defs/T0Score",
           "description": "schema_version 2+: the comparable outcome vector better() ranks. A reduce over fixtures[] — no new measurement."
@@ -1384,11 +1333,6 @@
       "x-tier": "EMBEDDED",
       "type": "object",
       "properties": {
-        "regressions": {
-          "type": "integer",
-          "minimum": 0,
-          "description": "Previously-FINISHED scopes now failing (seesaw). Dominates: breaking a shipped scope is never an improvement."
-        },
         "fixtures_passed": {
           "type": "integer",
           "minimum": 0
@@ -1412,7 +1356,6 @@
         }
       },
       "required": [
-        "regressions",
         "fixtures_passed",
         "fixtures_total"
       ]
@@ -1619,34 +1562,7 @@
         }
       }
     },
-    "SeesawRegistry": {
-      "description": "The fixture registry of every FINISHED scope — what seesawCheck re-runs on each later attempt so a new scope cannot silently break a shipped one — a regression mistaken for progress is the pathology the seesaw exists for.",
-      "x-tier": "LOCAL",
-      "x-location": ".shapeup/<slug>/seesaw/registry.json",
-      "x-writer": "tech-lead (when a scope reaches FINISHED)",
-      "x-readers": "harness verify t0",
-      "type": "object",
-      "properties": {
-        "scopes": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "scope_id": {
-                "type": "string"
-              },
-              "fixtures": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "VerdictLedgerLine": {
+"VerdictLedgerLine": {
       "description": "One appended line of judge history (JSONL). Never rewritten — flips across runs are detected here and force confidence low. run auto-increments per append batch.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/evaluation/.verdicts-<target>.jsonl",
@@ -1690,7 +1606,7 @@
       }
     },
     "HillShard": {
-      "description": "One scope's hill position — DERIVED, never self-reported: UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green; T1/seesaw pending) → FINISHED (T1 PASS ∧ seesaw green ∧ merged). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
+      "description": "One scope's hill position — DERIVED, never self-reported: UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green from a round that built; T1 pending) → FINISHED (T1 PASS ∧ that T0-green). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/hill/<scope-id>.yml",
       "x-writer": "tech-lead (GATE L2 derivation)",
@@ -2371,6 +2287,11 @@
           "type": "string",
           "description": "Optional context on the archetype/entry-point choice."
         },
+        "source_extensions": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "OPTIONAL — the file extensions this project's modules use, for the import walk that reachability runs. Absent means the JS/TS family plus the entry point's own suffix, which is right for most stacks and wrong for any stack whose engines end in something the entry point does not. Declare it when they differ (e.g. [\".ets\"] for ArkTS, [\".vue\", \".ts\"] for a Vue app): a walk that cannot follow an edge reports itself unchecked rather than reporting every engine orphaned, so the cost of leaving this absent is a skipped arm, never a false red."
+        },
         "build_probe": {
           "type": "string",
           "description": "OPTIONAL — a command that asserts the BUILT ARTIFACT, not the build's exit code, and exits 0 only when it holds. Exists because a green build is not proof the feature compiled: some toolchains compile only the files reachable from an entry point, so a scope's new files can sit outside the compiled set while the build stays green (measured: an app package holding 3 compiled files, 58 errors once the rest became reachable). Archetype-specific by construction — e.g. 'the compiled source map lists every file under each scope's substrate'. Run by harness verify build after run_cmd, once per round before EVAL; absent = no such step, never a failure."

package/kernel/verify/env.mjs

@@ -106,7 +106,8 @@ function treeState(cwd) {
  * path, which is exactly the mechanism that made one tree build three ways.
  *
  * `null` means the profile declared nothing — NOT that there are none. "Not asked" and "none" are
- * different facts, and collapsing them is the mistake the seesaw arm already makes elsewhere.
+ * different facts, and collapsing them is the mistake that kept the hill's top phase shut for the
+ * life of the seesaw arm: "not asked" was recorded the same way as "nothing wrong".
  *
  * @param {(string|null)} profilePath - `shapeup/<slug>/project-profile.md`, when the caller knows it.
  * @returns {(object[]|null)} One entry per declared cache, or null when none is declared.

package/kernel/verify/ratchet-tree.mjs

@@ -4,7 +4,7 @@
 //
 // The attempt loop branched a red T0 two ways, and only one of them reverted anything:
 //
-//   • a SEESAW regression (a previously-finished scope broke) → `git stash push -u`;
+//   • a trial that scored worse than the incumbent → `git stash push -u`;
 //   • a red on the scope's OWN fixtures → "loop to the next attempt", and no revert at all.
 //
 // So the failing tree stayed on the branch, and attempt N+1's fresh, zero-memory subagent began