shapeup-sdlc 3.7.2 → 3.7.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -10,6 +10,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, writing a committed file whose text names a run-trace path or a board id, stopping a run with no receipt (the run's first act writes one).
 - **The tier-direction rule is refused at the write, not argued at L1b.** A committed file cannot carry a `.shapeup/` path or a `TASK-NNN` id — boards renumber per machine and the run trace is gitignored, so either one resolves only where it was written. Spec-lint has always red'd this at Board Review; the same rule now also refuses the write itself, naming the token, because four producers hit it and one of them hit it twice in one session — a worker carries no lesson across a dispatch, and by L1b the phase that wrote the line is over. The knowledge base is outside the rule: those files are instructions, not references anyone resolves.
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
+- **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
 - **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
@@ -34,7 +35,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
-| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe + seesaw ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
+| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
 
@@ -62,7 +63,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
 - **The requirements matrix is a projection, never a verdict** — `REQ → AC → criterion → verdict` is derived from files for one named run (the registry, the board's `covers:` clauses, the run's verdict rows, the T0 citations), never narrated and never passed in. `covers:` is the authoritative join: a criterion anchored to a requirement no AC covers is printed for reconciliation and counted as nothing. L4 reads one line off it, GATE H's census takes the clauses with no evidence, `REPORT.md` freezes the table — and none of that blocks a ship. A clause with no PASS evidence is a fact the baseline comparison weighs, not a veto.
-- **Hill phase is mechanical ✦** — derived only from T0/T1/seesaw artifacts, never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
+- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts (the seesaw arm is declared, not yet wired), never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution
@@ -81,11 +82,11 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
   through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
-- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring the pointer does not orphan what follows: the close leaves a breadcrumb naming the run it ended, so the hook decisions taken in the census and ship phase after it still carry that run's key, marked as taken over a closed run. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
-  `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,
-  GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,
+  `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Leg, Verdict,
+  Trial, GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,
   never authored, so it can be deleted and rebuilt — and a run recorded before it existed backfills
   on first touch. `--subgraph run` is the fast-forward as one bounded query; `--trace <node>` walks
   a verdict back to the objective, the plan, the source, the execution record and the gate that

package/README.md

@@ -47,8 +47,11 @@ hill phase is derived from artifacts rather than from a worker's own account of
 Two limits, stated here because the point of this section is that a claim without a mechanism
 behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
 and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
-nothing in the runtime **re-hashes** the citation the evaluator is instructed to re-hash. Both
-are open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
+the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
+and the cited verdict are checked, the scope, round and run the artifact belongs to are not. A T0
+artifact is also evidence about the machine that produced it: it records the tree and nothing
+about the toolchain or caches the commands resolved through. All three are open items in
+`shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
 → *Prevents: "done" asserted with nothing behind it.*
 
 **3. Parallel work can't corrupt shared state.** Each scope gets a write-whitelist of files
@@ -127,8 +130,8 @@ rest of this README after this table and nothing will be a surprise.
 |---|---|
 | **board** | The round's task list. "Green" means every task is done. GATE L2's hook reads this before an evaluation and warns if it is not green. |
 | **round** | One build → evaluate cycle. A FAIL verdict starts round *r+1*. |
-| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe + the seesaw. Writes an artifact to disk that the evaluator must cite. |
-| **seesaw** | The part of T0 that re-runs *other* scopes' fixtures — so a regression is never mistaken for progress. |
+| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe (the seesaw arm is declared and not yet wired — see §2 above). Writes an artifact to disk that the evaluator must cite. |
+| **seesaw** | The regression arm of T0, meant to re-run *other* scopes' fixtures so a regression is never mistaken for progress. Declared, not yet wired: no run writes its registry, so no run has executed it. |
 | **substrate** | The exact list of files one dispatch is allowed to write, stamped into its work order. A hook blocks anything outside it — and anything the order marks frozen. |
 | **scope contract** | The file defining one vertical slice: its substrate, its fixtures, its affordances. |
 | **affordance** | The thing a user can actually click, type or call. UI is graded on affordances, not on looks. |
@@ -183,7 +186,7 @@ every arm is skipped when its artifact is absent, so older specs are unaffected.
 | QA (post-PASS) | `qa-edge-hunter` | v1.1 | Exploratory edge hunt on the running app through six fixed lenses, charting edges *outside* what the evaluator probed. Findings go to the ledger as `~`; never blocks ship. |
 | Stop (11) | `scope-hammer` | v0.1 | GATE H: must-have census → baseline comparison (never vs. the ideal) → cut list + ship verdict. Handles the normal stop and both circuit-breaker triggers. |
 | Retro (post-L4) | `coach` | — | RLHF for the harness: turns raw PO/TL feedback at Ship Sign-off into per-skill guidelines under committed `shapeup/knowledge-base/<skill>.md`, read back by six coachable workers on their next run and by `tech-lead` at GATE L0 (workflow guidance, never a gate answer). `--scan` seeds the same files from the project on disk before the first run; `--research <stack>` seeds them from the platform's official documentation when the project has nothing to scan, and cross-checks a scan's rules when it has. GATE COACH-1 asks the PO which skill owns each rule — never assumes; mechanism defects are filed to the harness-defect register instead. |
-| Orchestrator | `tech-lead` | v1.0 | Owns the run end-to-end: PLAN once → BUILD all tasks → EVAL once per round, looping on FAIL. Three-level circuit breaker (rounds / T0 attempts / wall clock), T0/seesaw-verified build rounds, mechanical hill derivation. Sole writer of run-state. |
+| Orchestrator | `tech-lead` | v1.0 | Owns the run end-to-end: PLAN once → BUILD all tasks → EVAL once per round, looping on FAIL. Three-level circuit breaker (rounds / T0 attempts / wall clock), T0-verified build rounds, mechanical hill derivation. Sole writer of run-state. |
 
 ### Commands
 
@@ -304,10 +307,10 @@ These hold across the harness and are the reason it stays predictable:
   of blocking the round. An opt-in third breaker bounds the **wall clock**, because the other two
   count events and neither can notice a single round running for half an hour — tripping it routes
   to GATE H, so a run out of time ships what is green instead of being killed and shipping nothing.
-- **Hill phase is mechanical, never self-reported** — derived only from T0/T1/seesaw facts, closing
-  the self-reported-confidence risk — with one gap on record: a scope with no discovery
-  ledger derives the same phase as one whose unknowns are all closed, so absence still reads
-  as progress on that one arm.
+- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts (the seesaw
+  arm is declared, not yet wired), closing the self-reported-confidence risk. A scope with no
+  discovery ledger derives no phase rather than a solved one, so absence no longer reads as
+  progress on that arm.
 - **One writer per shared file** — every board/ledger/verdict write goes through
   `harness reduce ingest`; workers return data and never touch shared state.
 - **Traceability is oracle-checked, opt-in** — `harness verify trace` verifies covers-closure and

package/SECURITY.md

@@ -45,7 +45,7 @@ test against machines you don't own.
    (override channel fails closed), and every exercised override is logged. The same principle
    covers `.shapeup/active-order`, which `sandbox-guard` reads to find the run whose orders fence
    a worker's writes: it sits outside the run-trace carve-out, so a worker cannot repoint its own
-   sandbox. Every hook resolves that pointer, the decision ledger and the substrate globs against
+   sandbox. The `last-run` breadcrumb a terminal close leaves beside it is read for one purpose — keying a decision row to the run that just ended, marked `run_closed` — and arms nothing: liveness is derived from the order set and the pointer, never from that file. Every hook resolves that pointer, the decision ledger and the substrate globs against
    the project root it finds above the tool call's working directory (a run pointer, the committed
    tier, or a git boundary) — a worker that `cd`s into a sub-folder is fenced exactly as one at the
    top, and its receipts land in the same ledger.
@@ -72,7 +72,7 @@ sitting, and reading them is the recommended review.
 | [`safety-spine.mjs`](hooks/safety-spine.mjs) | PreToolUse (`Bash\|Read\|Write\|Edit\|MultiEdit`) | The proposed command/path; `.shapeup/safety-overrides.json` | Yes — provably destructive ops only: `rm -rf` on unrecoverable targets, `git push --force` / push to main, `git reset --hard`, `git clean -fdx`, `DROP TABLE`/`TRUNCATE`, reads of `.env`/keys/cloud credentials, and any write to its own overrides file | Never blocks an unmatched command; `--force-with-lease` stays allowed |
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
-| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
+| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path, resolved through the filesystem before it is compared — symlinks followed, the unborn tail re-attached to its real ancestor, case folded where the filesystem folds case — so a spelling variant of a frozen file is the frozen file; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
 | [`tier-guard.mjs`](hooks/tier-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the text the call is about to write (`content`, `new_string`, or any edit in a `MultiEdit` batch) | Yes — a write into `shapeup/<slug>/` whose content names a `.shapeup/` path or a `TASK-NNN` board id: the same tier-direction rule spec-lint reds at GATE L1b, refused at the moment of writing, with the offending token quoted back | No-op outside `shapeup/<slug>/`, on file forms the lint does not scan, and on `shapeup/knowledge-base/` (instructions to a worker, not references). Reads nothing off disk and writes only its decision row; it never inspects a file it is not being asked to write |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |

package/hooks/lib/decision.mjs

@@ -49,7 +49,7 @@
 import { appendFileSync, mkdirSync, existsSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { decisions, activeScope, sharedDir } from "../../kernel/lib/paths.mjs";
-import { resolveRunId } from "../../kernel/lib/paths.mjs";
+import { resolveRun } from "../../kernel/lib/paths.mjs";
 
 /**
  * The project root a hook should file under, from wherever the tool call happened to fire.
@@ -221,7 +221,15 @@ export async function runHook(name, fn) {
     // run, and recording that is what lets the export tier partition ambient decisions from run
     // ones. Resolution reads two small files and swallows every error — a receipt must never be
     // able to fail a tool call.
-    run_id: (() => { try { return resolveRunId(projectRoot(d.cwd || process.cwd())); } catch { return null; } })(),
+    // A row written after the run's terminal close still keys to that run — the close leaves a
+    // breadcrumb for exactly this stretch — and says so, because a decision taken over a closed run
+    // is a different fact from one taken inside it.
+    ...(() => {
+      try {
+        const { run_id, source } = resolveRun(projectRoot(d.cwd || process.cwd()));
+        return source === "closed" ? { run_id, run_closed: true } : { run_id };
+      } catch { return { run_id: null }; }
+    })(),
     event: d.event ?? null,
     tool: d.tool ?? null,
     subject: d.subject ?? null,

package/hooks/sandbox-guard.mjs

@@ -85,8 +85,8 @@
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path | edits[].file_path}, cwd }.
 // Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
 
-import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { resolve, join, relative, dirname, sep } from "node:path";
+import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync, statSync, realpathSync, lstatSync, readlinkSync } from "node:fs";
+import { resolve, join, relative, dirname, basename, sep } from "node:path";
 import { isMain } from "../kernel/lib/argv.mjs";
 import { LOCAL, SHARED, activeOrder, ordersDir, resultsDir, metricsShard } from "../kernel/lib/paths.mjs";
 import { runHook, readStdin, settle, projectRoot } from "./lib/decision.mjs";
@@ -115,8 +115,69 @@ export function globToRegExp(glob) {
   return new RegExp(`^${re}$`);
 }
 
-export function matchesAny(relPath, globs) {
-  return (globs || []).some((g) => globToRegExp(g).test(relPath));
+/**
+ * Does `relPath` match any of `globs`? With `fold` set, both sides are compared case-folded — the
+ * caller passes it when the filesystem underneath does not distinguish case, so that a glob
+ * declared as `receipts/**` also covers the spelling `Receipts/**`, which on that filesystem is the
+ * same directory.
+ */
+export function matchesAny(relPath, globs, fold = false) {
+  const path = fold ? relPath.toLowerCase() : relPath;
+  return (globs || []).some((g) => globToRegExp(fold ? g.toLowerCase() : g).test(path));
+}
+
+// --- the path a write actually lands on ---------------------------------------------------------
+//
+// A substrate glob is a SPELLING; what it protects is a FILE. Measured against a real compiled
+// order: `.shapeup/<slug>/receipts/dispatch.jsonl` was denied as frozen, `Receipts/dispatch.jsonl`
+// was permitted, and on this machine's case-insensitive filesystem the second spelling overwrote
+// the first file. A symlink was the same hole from another side: `src/x -> ../.shapeup/<slug>/legs.jsonl`
+// sits inside an allowed `src/**` and resolves `..` without following the link, so the write went
+// through. No list of globs can close either — case, links, Unicode forms are all further spellings
+// of one target — so the comparison is made on the resolved real path instead, and case-folded when
+// the filesystem itself folds case. The globs stay exactly as the compiler wrote them.
+
+/**
+ * Resolve `abs` through the filesystem: symlinks in any existing ancestor are followed (a dangling
+ * link is followed by reading it), and the part that does not exist yet is re-attached to the real
+ * path of the deepest ancestor that does. A path nothing on disk can resolve is returned as given.
+ *
+ * @param {string} abs - Absolute path as the tool named it.
+ * @param {number} [depth] - Recursion guard for link chains.
+ * @returns {string} The path the write would actually reach.
+ */
+export function realPathOf(abs, depth = 0) {
+  if (depth > 40) return abs;
+  let cur = abs;
+  const tail = [];
+  for (let i = 0; i < 128; i++) {
+    try { return join(realpathSync.native(cur), ...[...tail].reverse()); } catch { /* not yet resolvable as a whole */ }
+    try {
+      if (lstatSync(cur).isSymbolicLink()) {
+        const target = resolve(dirname(cur), readlinkSync(cur));
+        return realPathOf(join(target, ...[...tail].reverse()), depth + 1);
+      }
+    } catch { /* does not exist at all — climb */ }
+    const parent = dirname(cur);
+    if (parent === cur) return abs;
+    tail.push(basename(cur));
+    cur = parent;
+  }
+  return abs;
+}
+
+/**
+ * Does the filesystem under `dir` fold case? Decided by asking it: the directory's own real path,
+ * with every letter's case swapped, exists and resolves back to the same real path only where the
+ * filesystem does not distinguish case. A path with no letters to swap answers "no".
+ *
+ * @param {string} dir - An existing directory (the project root).
+ * @returns {boolean} True on a case-insensitive filesystem.
+ */
+export function fsFoldsCase(dir) {
+  const swapped = dir.replace(/[a-zA-Z]/g, (c) => (c === c.toLowerCase() ? c.toUpperCase() : c.toLowerCase()));
+  if (swapped === dir) return false;
+  try { return existsSync(swapped) && realpathSync.native(swapped) === realpathSync.native(dir); } catch { return false; }
 }
 
 function readJSON(p) {
@@ -281,9 +342,15 @@ async function main() {
   const blockReasons = [];
   let frozenHits = 0;
 
+  // Compare where the write lands, not how it was spelled (see `realPathOf`). The root is resolved
+  // the same way so a checkout reached through a linked directory still yields a relative path.
+  const realRoot = realPathOf(resolve(root));
+  const fold = fsFoldsCase(realRoot);
+  const under = (rel, prefix) => (fold ? rel.toLowerCase().startsWith(prefix.toLowerCase()) : rel.startsWith(prefix));
+
   for (const raw of targetPaths) {
-    const abs = resolve(cwd, raw);
-    const rel = relative(root, abs);
+    const abs = realPathOf(resolve(cwd, raw));
+    const rel = relative(realRoot, abs);
 
     // Frozen takes absolute precedence, and it is checked across EVERY live contract: a path one
     // scope froze stays frozen while another scope is in flight, which is the whole point of
@@ -296,7 +363,7 @@ async function main() {
     // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
     // the exact state this hook exists to end. A path a live contract freezes is a violation
     // wherever it lives.
-    const freezer = contracts.find((c) => matchesAny(rel, c.frozen));
+    const freezer = contracts.find((c) => matchesAny(rel, c.frozen, fold));
     if (freezer) {
       violations.push(rel);
       frozenHits++;
@@ -304,11 +371,11 @@ async function main() {
       continue;
     }
 
-    if (rel.startsWith(runTracePrefix)) continue;
+    if (under(rel, runTracePrefix)) continue;
 
-    if (contracts.some((c) => matchesAny(rel, c.allowed))) continue;      // inside a live contract
+    if (contracts.some((c) => matchesAny(rel, c.allowed, fold))) continue;      // inside a live contract
 
-    if (contracts.some((c) => matchesAny(rel, c.appendOnly))) {
+    if (contracts.some((c) => matchesAny(rel, c.appendOnly, fold))) {
       if (p.tool_name === "Write") {
         violations.push(rel);
         blockReasons.push(`${rel} is append-only (Write overwrites, use Edit)`);
@@ -332,7 +399,7 @@ async function main() {
   // spec artifacts, so widening a substrate to reach one is the wrong move in a plausible-looking
   // direction. Those files belong to the orchestrator, whose write window is a phase boundary —
   // no dispatch in flight — and never the middle of somebody else's dispatch.
-  const committed = violations.filter((v) => v.split(/[\\/]/)[0] === SHARED);
+  const committed = violations.filter((v) => (fold ? v.split(/[\\/]/)[0].toLowerCase() === SHARED.toLowerCase() : v.split(/[\\/]/)[0] === SHARED));
   const hint = committed.length === violations.length
     ? `${SHARED}/ is committed tier: these belong to the orchestrator, not to a worker substrate. `
       + "Write them at a phase boundary, with no dispatch in flight — do not widen an order to reach one."

package/kernel/lib/paths.mjs

@@ -293,6 +293,19 @@ export const activeScope = (cwd) => join(localDir(cwd), "active-scope");
  */
 export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
 
+/**
+ * The run a terminal close just ended — `{slug, run_id, closed_at, closed_status}`, written by the
+ * close in the same act that retires the run pointers, and superseded by the next close.
+ *
+ * Why it exists: retiring the pointers is right (a finished run must stop fencing the checkout),
+ * but the close lands BEFORE the stretch that decides the most — the scope-hammer census, the ship
+ * phase, the export — and every hook decision in that stretch resolved its run through the pointer
+ * that was just removed. Measured on a live run: every decision row after `closed_at` carried
+ * `run_id: null`, the census dispatch included. The breadcrumb keeps that join without keeping the
+ * fence: it names a run, it never arms anything, and a row keyed through it says so.
+ */
+export const lastRun = (cwd) => join(localDir(cwd), "last-run");
+
 /**
  * Where the run scripts are staged for launch, inside the project.
  *
@@ -531,9 +544,31 @@ export function readRunId(cwd, slug) {
  * @returns {(string|null)} The run key, or null when no run is active or readable.
  */
 export function resolveRunId(cwd, slug = null) {
-  if (slug) return readRunId(cwd, slug);
+  return resolveRun(cwd, slug).run_id;
+}
+
+/**
+ * The run key AND where it came from — the shape a ledger row needs when the distinction matters.
+ *
+ * Resolution order: the slug the caller knows (`slug`); else the `active-scope` pointer a live run
+ * publishes (`pointer`); else the breadcrumb the last terminal close left (`closed`), so the census
+ * and ship phase that follow a close still key to the run they belong to; else `null`, which is
+ * "no run" and a real answer. A key resolved through the breadcrumb is a key to a run that is
+ * OVER: the caller records that alongside it rather than presenting the two the same way.
+ *
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} [slug=null] - Feature slug when the caller already knows it.
+ * @returns {{run_id:(string|null), source:("slug"|"pointer"|"closed"|null)}}
+ */
+export function resolveRun(cwd, slug = null) {
+  if (slug) return { run_id: readRunId(cwd, slug), source: "slug" };
   try {
     const ptr = JSON.parse(readFileSync(activeScope(cwd), "utf8"));
-    return ptr?.slug ? readRunId(cwd, ptr.slug) : null;
-  } catch { return null; }
+    if (ptr?.slug) return { run_id: readRunId(cwd, ptr.slug), source: "pointer" };
+  } catch { /* no live run — fall through to the breadcrumb */ }
+  try {
+    const crumb = JSON.parse(readFileSync(lastRun(cwd), "utf8"));
+    if (typeof crumb?.run_id === "string" && crumb.run_id) return { run_id: crumb.run_id, source: "closed" };
+  } catch { /* no close on record either */ }
+  return { run_id: null, source: null };
 }

package/kernel/probe/leg.mjs

@@ -59,6 +59,65 @@ export function readLegs(path) {
  *   result exists that was never ingested; a scope with no results at all reports `closed: false`
  *   with an empty `orders` list, so a caller can tell "nothing ran" from "nothing was applied".
  */
+/**
+ * Every order the run compiled, with whether its result landed and whether the single writer
+ * applied it — planning orders (`analyze.json`) and build orders (`alpha-r1-a1.json`) alike.
+ *
+ * Why the generic form exists: the per-scope reading below was the only reader of the leg ledger
+ * in the run loop, and it was asked in one place, behind the checks that decide a scope is green.
+ * Measured on a live run: five dispatches, five results, three leg rows — and the planning phase
+ * whose result nobody applied walked on, because its post-condition checked the artifact the
+ * worker wrote directly and never asked whether the writer ran. This is the question, asked of any
+ * order by name.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null), has_result:boolean, applied:boolean}[]}
+ */
+export function legsOf(cwd, slug) {
+  const oDir = ordersDir(cwd, slug);
+  const rDir = resultsDir(cwd, slug);
+  const ingested = new Set(readLegs(legLedger(cwd, slug))
+    .filter((r) => r.ingested_at)
+    .map((r) => String(r.order_id)));
+  const out = [];
+  for (const f of (existsSync(oDir) ? readdirSync(oDir) : []).filter((x) => x.endsWith(".json")).sort()) {
+    let orderId = null;
+    try { orderId = JSON.parse(readFileSync(join(oDir, f), "utf8")).order_id ?? null; } catch { /* unreadable — reported as unapplied */ }
+    out.push({
+      order: join(oDir, f),
+      name: f.replace(/\.json$/, ""),
+      order_id: orderId,
+      has_result: existsSync(join(rDir, f)),
+      applied: orderId !== null && ingested.has(orderId),
+    });
+  }
+  return out;
+}
+
+/**
+ * One order by its file stem — `analyze`, `wire`, `alpha-r1-a1` — and whether its leg closed.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} name - The order file's stem.
+ * @returns {{closed:boolean, found:boolean, order:(string|null), order_id:(string|null), has_result:boolean, applied:boolean}}
+ */
+export function orderLegState(cwd, slug, name) {
+  const o = legsOf(cwd, slug).find((x) => x.name === name);
+  if (!o) return { closed: false, found: false, order: null, order_id: null, has_result: false, applied: false };
+  return { closed: o.applied, found: true, ...o };
+}
+
+/**
+ * The results on disk that no leg row applied — finished work the board never saw.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null)}[]}
+ */
+export function openLegs(cwd, slug) {
+  return legsOf(cwd, slug).filter((o) => o.has_result && !o.applied);
+}
+
 export function legState(cwd, slug, scopeId, round) {
   const oDir = ordersDir(cwd, slug);
   const rDir = resultsDir(cwd, slug);
@@ -89,11 +148,13 @@ export function legState(cwd, slug, scopeId, round) {
 }
 
 export const ARGV_SPEC = {
-  usage: "harness.mjs probe leg --slug <slug> --scope <scope-id> --round N [--cwd <dir>]",
+  usage: "harness.mjs probe leg --slug <slug> (--scope <scope-id> --round N | --order <stem> | --open) [--cwd <dir>]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str", required: true },
-  scope: { type: "str", required: true },
-  round: { type: "int", min: 1, required: true },
+  scope: { type: "str" },
+  round: { type: "int", min: 1 },
+  order: { type: "str" },
+  open: { type: "flag" },
   cwd: { type: "path" },
 };
 
@@ -107,6 +168,22 @@ export const ARGV_SPEC = {
 export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
+  // `--open`: every result nothing applied, across the whole run, any phase. Exit 0 when none.
+  if (args.open) {
+    const open = openLegs(cwd, args.slug);
+    console.log(JSON.stringify({ closed: open.length === 0, open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id) }));
+    process.exit(open.length === 0 ? 0 : 1);
+  }
+  // `--order <stem>`: one order by file stem (`analyze`, `alpha-r1-a1`). Exit 0 when its leg closed.
+  if (args.order) {
+    const s = orderLegState(cwd, args.slug, args.order);
+    console.log(JSON.stringify(s));
+    process.exit(s.closed ? 0 : 1);
+  }
+  if (!args.scope || !args.round) {
+    console.error("probe leg: pass --scope <id> --round N, or --order <stem>, or --open");
+    process.exit(2);
+  }
   const s = legState(cwd, args.slug, args.scope, args.round);
   console.log(JSON.stringify({
     closed: s.closed,

package/kernel/probe/resume.mjs

@@ -61,11 +61,7 @@ import { dirname, join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
-import {
-  intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
-  orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements,
-  exportRunDir,
-} from "../lib/paths.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
@@ -709,6 +705,15 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
    */
   const finishClose = (result) => {
     const warning = shouldExport ? exportOnClose(cwd, slug) : null;
+    // The breadcrumb goes down before the pointers come up: the hooks that fire next — the
+    // scope-hammer census, the ship phase — resolve their run through whichever of the two exists,
+    // and there must be no instant in which neither does. Best-effort like the rest of this close.
+    try {
+      mkdirSync(dirname(lastRun(cwd)), { recursive: true });
+      writeFileSync(lastRun(cwd), JSON.stringify({
+        slug, run_id: readRunId(cwd, slug), closed_status: status, closed_at: new Date().toISOString(),
+      }) + "\n");
+    } catch { /* a missing breadcrumb costs the post-close rows their key, never the close */ }
     const stuck = [];
     for (const pointer of [activeOrder(cwd), activeScope(cwd)]) {
       try { rmSync(pointer, { force: true }); } catch { /* fall through to the check below */ }

package/kernel/reduce/graph.mjs

@@ -26,11 +26,11 @@
 // appended again and the LAST line wins on read, so the file is a log and the projection is a fold.
 
 import { existsSync, readdirSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { readLegs } from "../probe/leg.mjs";
 import { join, dirname, basename, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import {
-  localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath,
-  gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath,
+  localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath, gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath, legLedger,
 } from "../lib/paths.mjs";
 import { readAllContracts, readContract, ucId, reqId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
 import { runIdFromReceipt } from "../lib/paths.mjs";
@@ -39,11 +39,11 @@ import { runIdFromReceipt } from "../lib/paths.mjs";
 export const graphPath = (cwd, slug) => join(localRoot(cwd, slug), "graph.jsonl");
 
 /** Node types, by family. A type outside these sets is a bug, not an extension point. */
-export const WORK_NODES = ["Run", "Order", "Result", "Verdict", "Trial", "GateDecision"];
+export const WORK_NODES = ["Run", "Order", "Result", "Leg", "Verdict", "Trial", "GateDecision"];
 export const DOMAIN_NODES = ["Scope", "UseCase", "Requirement", "Seam"];
 
 /** Edge types. Each names a direction that is meaningful to read backwards. */
-export const EDGES = ["PRODUCED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
+export const EDGES = ["PRODUCED", "INGESTED", "EVALUATES", "SUPERSEDES", "COVERS", "DEPENDS_ON", "DERIVED_FROM", "IMPLEMENTS"];
 
 /**
  * Read the graph as a log and fold it into nodes and edges.
@@ -148,6 +148,22 @@ export function project(cwd, slug) {
     }
   }
 
+  // Leg-completion rows — the record that separates "the result landed" from "the single writer
+  // applied it". It was in neither this graph nor the export, so a run could show five orders
+  // producing five results and nobody could see that only three were ever read. A Result with no
+  // INGESTED edge leaving it is finished work the board never saw, and `--subgraph run` names it.
+  for (const l of readLegs(legLedger(cwd, slug))) {
+    if (!l?.order_id) continue;
+    const id = `leg:${l.order_id}`;
+    node(id, "Leg", {
+      order_id: l.order_id, worker: l.worker ?? null, operation: l.operation ?? null,
+      scope_id: l.scope_id ?? null, round: l.round ?? null, attempt: l.attempt ?? null,
+      dispatched_at: l.dispatched_at ?? null, ingested_at: l.ingested_at ?? null,
+      attested: l.attested ?? null, run_id: l.run_id ?? runId ?? null,
+    });
+    edge(`result:${l.order_id}`, "INGESTED", id);
+  }
+
   // T0 verdicts — the artifact the evaluator is required to cite, and the reason the lineage half
   // of this graph is worth having: a verdict node is the anchor of every "show me the evidence".
   const vDir = verdictsDir(cwd, slug);
@@ -370,6 +386,7 @@ export function runSubgraph(cwd, slug) {
   const of = (t) => [...nodes.values()].filter((n) => n.t === t);
   const orders = of("Order"), results = of("Result"), verdicts = of("Verdict");
   const resultIds = new Set(results.map((r) => r.order_id));
+  const ingestedFrom = new Set([...edges.values()].filter((e) => e.t === "INGESTED").map((e) => e.from));
   const greenByRound = {};
   for (const v of verdicts) {
     if (v.overall !== "green" || v.round == null || !v.scope_id) continue;
@@ -384,6 +401,8 @@ export function runSubgraph(cwd, slug) {
     seams: of("Seam").map((s) => s.seam).sort(),
     orders: orders.length,
     pending_orders: orders.filter((o) => !resultIds.has(o.order_id)).map((o) => o.order_id).sort(),
+    // Results the single writer never applied — a leg that came back and was not read.
+    unapplied_results: results.filter((r) => !ingestedFrom.has(`result:${r.order_id}`)).map((r) => r.order_id).sort(),
     rounds_with_green: Object.keys(greenByRound).map(Number).sort((a, b) => a - b),
     green_scopes_by_round: Object.fromEntries(Object.entries(greenByRound).map(([r, s]) => [r, [...s].sort()])),
     trials: of("Trial").length,

package/kernel/report/export.mjs

@@ -45,7 +45,9 @@ import { readFileSync, writeFileSync, readdirSync, mkdirSync, existsSync, statSy
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter } from "../lib/contract.mjs";
-import { runIdFromReceipt, readReceipt } from "../lib/paths.mjs";
+import {
+  runIdFromReceipt, readReceipt, legLedger,
+} from "../lib/paths.mjs";
 import { TABLES, runRow, dispatchFacts } from "./facts.mjs";
 import { deriveRounds } from "../probe/rounds.mjs";
 import {
@@ -260,6 +262,9 @@ export function collectRun(cwd, slug) {
       // The decision that crossed each gate, and the round build gate's own artifact.
       gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
       build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
+      leg: readJsonl(legLedger(cwd, slug), t)
+        .filter((r) => !runId || !r?.run_id || r.run_id === runId)
+        .map((r) => ({ ...r, run_id: r.run_id ?? runId ?? null })),
     },
     defects: { records_skipped: t.skipped },
   };

package/kernel/report/facts.mjs

@@ -32,6 +32,9 @@ export const TABLES = [
   // has to. `build_gate` is the round build gate's own artifact (kernel/verify/build.mjs), on the
   // same terms: it ends a round exactly as EVAL does, and had no table either.
   "gate_decision", "build_gate",
+  // The leg-completion ledger — one row per order the single writer applied. Without it the
+  // warehouse could join an order to its result and never say whether anyone read the result.
+  "leg",
 ];
 
 /** Coerce anything to a finite number, or null. Keeps `0` and rejects `NaN`/`""`/undefined. */

package/kernel/schemas/domain.schema.json

@@ -33,6 +33,10 @@
           "type": null,
           "gap": "a gate decision row — emitted by reduce graph, never typed here"
         },
+        "Leg": {
+          "type": null,
+          "gap": "a leg-completion row (reduce ingest's record that a result was applied) — emitted by reduce graph, never typed here"
+        },
         "Scope": {
           "type": "ScopeContract"
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/tech-lead/workflows/shapeup-run.js

@@ -41,7 +41,8 @@
 //   { status: "shipped", verdict, rounds_used, dims_not_evaluated, qa_findings, report }
 //   { status: "paused",  paused_at, block, valid_decisions, context }
 //   { status: "aborted", aborted_at, reason }
-//   { status: "gate_h",  breaker: "outer"|"inner"|"deadline", hammer_proposals, green_scopes }
+//   { status: "gate_h",  breaker: "outer"|"attempt_budget"|"none"|"deadline", hammer_proposals, green_scopes,
+//                        tripped_scopes?, unapplied_results? }
 
 // meta must be a PURE LITERAL — the runtime parses it statically, before the body ever runs, and
 // rejects the whole script on anything it has to evaluate. A `+`-joined description is a
@@ -471,6 +472,32 @@ const T0CHECK = {
   required: ["green"],
 };
 
+/** `probe leg --order` — did one named order's result reach the single writer? Any phase. */
+const ORDERLEG = {
+  type: "object",
+  properties: {
+    closed: { type: "boolean" },
+    found: { type: "boolean" },
+    order: nullable("string"),
+    has_result: { type: "boolean" },
+    applied: { type: "boolean" },
+  },
+  required: ["closed", "found", "has_result", "applied"],
+};
+
+/** `probe attempts` — the attested census: what was spent, and whether the breaker really tripped. */
+const ATTEMPTS = {
+  type: "object",
+  properties: {
+    scope_id: { type: "string" },
+    spent: { type: "integer" },
+    in_flight: { type: "integer" },
+    green: { type: "boolean" },
+    tripped: { type: "boolean" },
+  },
+  required: ["scope_id", "spent", "tripped"],
+};
+
 /** `probe leg` — did this scope's result reach the board, or is it finished work nothing applied? */
 const LEGCHECK = {
   type: "object",
@@ -817,6 +844,42 @@ async function crossGate(gateId, phaseName, validDecisions, ctx) {
 const attest = (phaseKey, phaseName, label) =>
   cmd(`probe resume --slug ${slug} --require ${phaseKey}`, phaseName, label);
 
+/**
+ * The other half of a phase post-condition: the single writer ran.
+ *
+ * The artifact check asks whether the worker wrote its product. It cannot ask whether the
+ * WorkResult was applied — the leg row, the discoveries, the board — because the product is written
+ * by the worker directly and the envelope is applied by `reduce ingest`, a separate act the leg's
+ * script names as its last step. Measured on a live run: a planning phase landed a result naming
+ * seventeen artifacts and no leg row, the artifact check passed, and the run walked on with the
+ * result's discoveries never reaching the ledger. So this asks the leg ledger by order name. A
+ * result on disk that nothing applied is ingested here — the same repair the build round makes,
+ * for the same reason: the single writer is the invariant, not which step invokes it — and if it
+ * still is not applied after that, the run stops with a cause naming the writer that did not run,
+ * rather than folding the gap into a phase that "completed".
+ *
+ * @param {string} gate - The gate name to report the abort under.
+ * @param {string} phaseKey - The phase, which is also its order's file stem.
+ * @param {string} phaseName - Progress group.
+ * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the leg closed (or the
+ *   question could not be asked — a probe that did not run proves nothing, and is logged as such).
+ */
+async function requireLeg(gate, phaseKey, phaseName) {
+  const ask = () => query(`probe leg --slug ${slug} --order "${phaseKey}"`, ORDERLEG, phaseName, `legcheck:${phaseKey}`);
+  let leg = await ask();
+  if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
+  if (!leg.has_result || leg.applied) return null;
+  log(`${gate} — "${phaseKey}" came back with a result nothing applied (no leg row). Ingesting it here: ${leg.order}.`);
+  await advisory(`reduce ingest --order "${leg.order}"`, phaseName, `late-ingest:${phaseKey}`);
+  leg = await ask();
+  if (leg?.applied) return null;
+  return aborted(gate,
+    `${gate}: the single writer did not run for "${phaseKey}" — its WorkResult is on disk and no leg row ` +
+    `records it being applied, and a late \`reduce ingest\` did not take either. The phase's product exists; ` +
+    `what it discovered and reported never reached the ledger or the board. Read the result, run ` +
+    `\`reduce ingest --order "${leg?.order ?? "<its order>"}"\` by hand to see why it refuses, then relaunch.`);
+}
+
 /**
  * The phase post-condition: the artifact is on disk, or the run stops here.
  *
@@ -830,7 +893,7 @@ const attest = (phaseKey, phaseName, label) =>
  */
 async function requirePhase(gate, phaseKey, phaseName) {
   const r = await attest(phaseKey, phaseName, `require:${phaseKey}`);
-  if (r.exit_code === 0) return null;
+  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName);
   // Exit 6 is `probe resume --require`'s OWN documented code for "the artifact really is not on
   // disk" (kernel/probe/resume.mjs banner). Any other value — including -1, the courier's sentinel
   // for a tool call that never ran — is not that predicate answering "no"; it is the predicate never
@@ -1001,7 +1064,11 @@ async function closeIfTerminal(ret) {
   const cause = ret.status === "aborted"
     ? `${ret.aborted_at || "?"}: ${ret.reason || "no reason recorded"}`
     : ret.status === "gate_h"
-    ? `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
+    ? (ret.stalled ? `stalled=${ret.stalled} ` : "")
+      + `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
+      + (Array.isArray(ret.tripped_scopes) ? ` tripped_scopes=${ret.tripped_scopes.length}` : "")
+      // A result the single writer never applied is named at the close, not folded into "not green".
+      + (Array.isArray(ret.unapplied_results) && ret.unapplied_results.length ? ` unapplied_results=${ret.unapplied_results.length}` : "")
     : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
   // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
   // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
@@ -1368,6 +1435,7 @@ let verdict = null;
 // other two. The cure is the same each time and it is not a bigger variable: re-derive the fact.
 const allGreen = [];
 const allHammer = [];
+const allUnapplied = [];   // results on disk the single writer never applied, run-wide
 // OUTSIDE the loop, because its whole purpose is to cross a round boundary: round r's verdict is
 // what round r+1 has to act on. Declared inside, it was in the temporal dead zone at the BUILD that
 // needed it — a runtime error no static check can see, since nothing but a real second round ever
@@ -1408,7 +1476,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   const budget = await cmd(`verify budget --slug ${slug} --strict`, "Build", `budget:r${round}`);
   if (budget.exit_code === 6) {
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({ status: "gate_h", breaker: "deadline", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
 
   log(`BUILD round ${round} — ${scopes.length} scope(s), up to ${maxParallelScopes} at once, attempt budget ${attemptBudget}`);
@@ -1463,8 +1531,22 @@ while (verdict !== "pass" && round <= maxRounds) {
         : { scope_id: s.scope_id, pending: true }),   // not green yet → stage 2 builds it
       async (pre, s) => (pre?.pending ? buildScope(s, round) : pre),
       async (res, s) => {
-        if (!res || res.__failed) return res;
-        if (!res.green) return res;
+        if (!res) return res;
+        // THE SINGLE WRITER IS ASKED FIRST, WHATEVER THE LEG SAID. This question used to sit behind
+        // the green checks below, and the state it exists to catch — a result on disk that nothing
+        // applied — was reachable only for a scope that was already fully green. Measured live: a
+        // leg reported green with no T0 verdict at all, the T0 re-read correctly returned "not
+        // green", the round returned before this line, and the result — six tasks, two discoveries
+        // — was never read by anyone. A dead leg (`__failed`) can have left a result too. So every
+        // settled scope is asked, and what it answers travels on the result to the close, where an
+        // unapplied result is named rather than folded into "not green". Application stays gated
+        // on the green checks: ingest ticks acceptance boxes, and a result T0 never measured must
+        // not mark work green — the repair below is for a scope that IS green.
+        const applied = await query(`probe leg --slug ${slug} --scope ${s.scope_id} --round ${round}`,
+          LEGCHECK, "Build", `legcheck:${s.scope_id}-r${round}`);
+        const unapplied = applied?.closed ? [] : (applied?.unapplied || []);
+        if (res.__failed) return unapplied.length ? { ...res, unapplied } : res;
+        if (!res.green) return unapplied.length ? { ...res, unapplied } : res;
         // THE T0 RE-READ IS SKIPPED FOR A RESUMED SCOPE; THE LEG CHECK BELOW IS NOT.
         //
         // `resumed` means the graph already reported this scope green for this round, so re-reading
@@ -1481,7 +1563,7 @@ while (verdict !== "pass" && round <= maxRounds) {
           if (!confirmed?.green) {
             log(`BUILD r${round} — ${s.scope_id} reported green but no T0 verdict is on disk for this ` +
                 `round; treating it as not green (the evaluator cites that artifact, and it is not there).`);
-            return { ...res, green: false, reason: "reported green with no T0 verdict artifact on disk" };
+            return { ...res, green: false, reason: "reported green with no T0 verdict artifact on disk", ...(unapplied.length ? { unapplied } : {}) };
           }
         }
         // AND ITS RESULT HAS TO HAVE REACHED THE BOARD. A green T0 says the worker's fixtures ran and
@@ -1494,9 +1576,7 @@ while (verdict !== "pass" && round <= maxRounds) {
         //
         // The evidence is the leg-completion row, because `reduce ingest` writes it: its presence
         // proves the writer ran, and it is not something the leg can assert about itself.
-        const applied = await query(`probe leg --slug ${slug} --scope ${s.scope_id} --round ${round}`,
-          LEGCHECK, "Build", `legcheck:${s.scope_id}-r${round}`);
-        for (const orderPath of (applied?.closed ? [] : applied?.unapplied || [])) {
+        for (const orderPath of unapplied) {
           // INGESTED HERE RATHER THAN FAILED. The result is on disk and valid — re-running the leg
           // would pay a whole attempt again for work already done. Only the single writer writes
           // shared state, and that writer is this command; which step invokes it is not the invariant.
@@ -1524,6 +1604,10 @@ while (verdict !== "pass" && round <= maxRounds) {
 
   for (const [i, res] of settled.entries()) {
     const scopeId = buildOrder[i].scope_id;
+    for (const p of (res?.unapplied || [])) {
+      if (!allUnapplied.includes(p)) allUnapplied.push(p);
+      log(`BUILD r${round} — ${scopeId} has a result on disk nothing applied: ${p}`);
+    }
     // A dead builder is a SPENT ATTEMPT, not a dead run: the scope goes to GATE H's census and
     // the round continues. Killing the run here would discard every other scope's green work.
     if (!res || res.__failed) {
@@ -1541,10 +1625,26 @@ while (verdict !== "pass" && round <= maxRounds) {
   for (const sid of roundGreen) { const i = allHammer.indexOf(sid); if (i !== -1) allHammer.splice(i, 1); }
   for (const sid of roundHammer) if (!allHammer.includes(sid) && !allGreen.includes(sid)) allHammer.push(sid);
 
-  // INNER breaker: nothing green and something queued → GATE H. The census is scope-hammer's job.
+  // NOTHING GREEN AND SOMETHING QUEUED → GATE H. This used to return the literal `inner` as its breaker, and the
+  // protocol's INNER breaker is the per-scope attempt budget, which "queues a proposal, never blocks
+  // the round" — so the close named a breaker the attested census flatly denied (one attempt spent
+  // of five, `tripped: false`), and the operator was told a scope had exhausted its attempts after
+  // it used one. The word is now earned: `probe attempts` — the one derivation built so the census
+  // and the breaker cannot disagree — is asked for every queued scope, and the return names
+  // `attempt_budget` only for the scopes it says tripped, `none` when the round simply stalled.
   if (roundGreen.length === 0 && roundHammer.length > 0) {
+    const tripped = [];
+    for (const sid of roundHammer) {
+      const census = await query(`probe attempts --slug ${slug} --scope "${sid}" --round ${round} --attempt-budget ${attemptBudget}`,
+        ATTEMPTS, "Build", `census:${sid}-r${round}`);
+      if (census?.tripped) tripped.push(sid);
+    }
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({ status: "gate_h", breaker: "inner", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({
+      status: "gate_h", breaker: tripped.length ? "attempt_budget" : "none", stalled: "no_green",
+      tripped_scopes: tripped, unapplied_results: allUnapplied,
+      hammer_proposals: allHammer, green_scopes: allGreen,
+    });
   }
 
   // ---- ROUND BUILD GATE — the feature builds and launches, measured before anyone is asked --------
@@ -1655,13 +1755,13 @@ while (verdict !== "pass" && round <= maxRounds) {
   // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
   if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
-    return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
 if (verdict !== "pass" && verdict !== "not-evaluated") {
-  return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
+  return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
 // ---- QA (post-PASS, pre-ship) — a level-up, never a gate. `--no-qa` answers it "skip". --------