shapeup-sdlc 3.7.4 → 3.7.6

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.4",
+  "version": "3.7.6",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -13,7 +13,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
-- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
 - The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
@@ -32,7 +32,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Kick-off | ⏸ **L0** — Intake & Config (L0.8 model/budget matrix) + worker roster ✧ | `/translator` if non-English |
 | Orient (Scout) | ⏸ **L1a** — Orient Review | `/orient` |
 | Requirements | — (reviewed at L1b) | `/ba-pitch-analyzer` (`coverage`): the pitch's clauses → committed `requirements.md`, one atomic clause per `REQ-<n>` row naming the pitch clause it came from, ids assigned once and frozen; dispatched once, ahead of Analyze because the acceptance criteria are what cite its ids. A registry already on disk is not re-dispatched |
-| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
+| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). The tree is committed and the board is per-machine: a run that finds the tree on disk and no board dispatches `board`, which regenerates the board from the tree without re-deriving it — GATE L2 refuses `proceed` over a board with zero tasks. An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
@@ -48,7 +48,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 **Q0** Preflight → **Q1** Charter (6 lenses − EVAL-covered) → **Hunt** (repro required, findings `~` → ledger) → report (no verdict, no score). Skip with `--no-qa`.
 
 ### Ship & Triage
-- **SHIP S.0 / GATE H** — `/scope-hammer`: census (QA findings + discovered ledger + attempt-budget proposals ✦; every "no scope owns X" cites `probe owner`, which derives ownership from the contracts) → baseline comparison (never the ideal) → cut list; TL/PO promotes selected items only.
+- **SHIP S.0 / GATE H** — `/scope-hammer`: census (QA findings + discovered ledger + attempt-budget proposals ✦; every "no scope owns X" cites `probe owner`, which derives ownership from the contracts) → baseline comparison (never the ideal) → cut list; TL/PO promotes selected items only. The census is written as data beside the report, and GATE L4 reads that file — and nothing else — before any answer set may say `ship`. A breaker does not end the run: the run itself dispatches the census, crosses GATE H, writes the ship report with the verdict as it is, crosses L4, and only then closes — `shipped` with the cut list when the census clears it, `escalated` naming the census when it does not.
 - ⏸ **L4** — Ship Sign-off (shows QA status ★).
 - **Coach retro** — L4 feedback → `/coach`; GATE COACH-1 asks the PO which skill owns each rule (never assumes) → committed `shapeup/knowledge-base/<skill>.md` (team inherits on pull). Coachable: `/task-executor`, `/ba-pitch-analyzer`, `/qa-edge-hunter`, `/orient`, `/scope-architect`, `/solution-architect`, and `/tech-lead` (workflow guidance read at L0, plus suggested L0 values it confirms before pinning); `/spec-evaluator` is not (single judge) and neither is `/scope-hammer` (its census cites `probe owner`). **Guidance never decides a gate**: a rule may add a question or a check to a gate block, never an answer, a skip or a wider substrate. `/retro --scan` seeds the same files from the project on disk before the first run, and `/retro --research <stack>` from the platform's official documentation when there is nothing on disk yet (a source, never a verification: nothing it reads runs until the tech lead pins it at L0), optional, every rule confirmed at COACH-1. Mechanism defects file to `knowledge-base/harness-defects.md` as Betting Table raw ideas, never worker steering.
 - Post-fix: `eval --single-pass` → remaining `~` + new feedback → new raw idea.

package/kernel/compile.mjs

@@ -175,6 +175,9 @@ export function ledgerDecisions(ledgerText, scopeId) {
  */
 export const OP_OWNER = {
   analyze: "ba-pitch-analyzer", reconcile: "ba-pitch-analyzer",
+  // `board` regenerates the per-machine board from a committed spec tree without re-deriving the
+  // tree — the half of ANALYZE that does not survive a clone. Same worker, narrower write surface.
+  board: "ba-pitch-analyzer",
   "retrofit-surface": "ba-pitch-analyzer", coverage: "ba-pitch-analyzer",
   "map-scopes": "scope-architect",
   wire: "solution-architect", evaluate: "spec-evaluator", orient: "orient",
@@ -243,7 +246,10 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // not cover is a leg forging a SIBLING's result, which is a real hole with a different fix — the
   // glob form here cannot say "every result except this order's own", so closing it needs a
   // mechanism rather than one more entry on this list.
-  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`];
+  // The board index is ingest's projection of the task results, not the doer's bookkeeping — the
+  // task files are. The executor's contract already forbids editing it; the freeze makes that a
+  // denial rather than a rule, on the same terms as the attestation channels.
+  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
       // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
@@ -259,6 +265,14 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
 
+    case "board":
+      // The spec is READ, never written: this operation exists because the tree is already on disk
+      // and the board is not. Task ids renumber per machine by design, so nothing here is committed.
+      return {
+        allowed: [`${local}/tasks/**`, `${working}/**`],
+        frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${spec}/usecases/*.md`, `${spec}/scope-summary.md`],
+      };
+
     case "reconcile":
       return {
         allowed: [`${local}/tasks/**`, `${spec}/scope-summary.md`, `${working}/**`],

package/kernel/gate.mjs

@@ -51,9 +51,10 @@
 //   2  usage / validation error
 
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
+import { parseBoard } from "./reduce/board.mjs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -110,7 +111,7 @@ export const PRESETS = {
       "L1a": { decision: "proceed", note: "Orient review — advisory read." },
       "L1a.5": { decision: "proceed", note: "Wiring review — checked by trace-lint." },
       "L1b": { decision: "ask", note: "Board review is where scope is actually decided. Not pre-approvable." },
-      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. Note there is no board check behind this: the L2 hook was retired into the gate block in v2.0." },
+      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. A board with zero tasks is refused here regardless of the answer — the resolver narrows `proceed` to `ask` over an empty board." },
       "L3": { decision: "loop", max_rounds: 3, note: "Loop on FAIL; the breaker ends it." },
       "QA": { decision: "run" },
       "H": { decision: "ask", note: "The cut list changes what ships." },
@@ -186,6 +187,17 @@ export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
  */
 export function censusVerdict(cwd, slug) {
   if (!slug) return null;
+  // The census artifact — written by the hammer at a path its order's substrate permits. The
+  // WorkResult fallback below is kept for a lane that wrote one the old way; a WorkResult may not
+  // carry a verdict under the schema, so in practice the artifact is the only source.
+  try {
+    const c = hammerCensus(cwd, slug);
+    if (existsSync(c)) {
+      const r = JSON.parse(readFileSync(c, "utf8"));
+      const v = r?.verdict ?? null;
+      if (HAMMER_VERDICTS.includes(v)) return v;
+    }
+  } catch { /* unreadable census proves nothing — fall through */ }
   try {
     const p = join(resultsDir(cwd, slug), "hammer.json");
     if (!existsSync(p)) return null;
@@ -218,6 +230,26 @@ export function censusVerdict(cwd, slug) {
  * @returns {object} The result, or an `ask` carrying why `ship` was not available.
  */
 export function narrowToEvidence(r, cwd, slug) {
+  // GATE L2's question is "is the board done", and a preset used to answer it over a board with
+  // zero tasks — 100% of nothing. Measured on a consumer: a committed spec fast-forwarded ANALYZE,
+  // the per-machine board was never regenerated, L2 crossed `proceed` from the `ci` preset and the
+  // frozen report printed `Board 0/0 tasks done`. Same rule as L4 below: an answer set chooses
+  // among allowed answers and cannot supply the evidence that makes one allowed.
+  if (r?.gate === "L2" && r?.status === "ok" && r?.decision === "proceed" && slug) {
+    let tasks = 0;
+    try { tasks = parseBoard(tasksDir(cwd, slug)).length; } catch { tasks = 0; }
+    if (tasks === 0) {
+      return {
+        gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+        refused: "proceed", board_tasks: 0,
+        reason: `GATE L2 cannot be answered "proceed": the board has no tasks, so "board 100%" is a ` +
+                `hundred percent of nothing. A committed spec with no per-machine board needs the board ` +
+                `regenerated (operation \`board\`) before this gate means anything. Put the block to ` +
+                `the PO, or regenerate the board first.`,
+      };
+    }
+    return r;
+  }
   if (r?.gate !== "L4" || r?.status !== "ok" || r?.decision !== "ship") return r;
   const verdict = censusVerdict(cwd, slug);
   if (verdict === "ship-now" || verdict === "ship-after-fixes") return r;

package/kernel/lib/paths.mjs

@@ -306,6 +306,16 @@ export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
  */
 export const lastRun = (cwd) => join(localDir(cwd), "last-run");
 
+/**
+ * Scope-hammer's census as DATA — `{verdict, cut_list, …}` — the one artifact GATE L4's resolver
+ * reads before it lets an answer set say `ship`. The hammer's WorkResult may not carry a verdict
+ * (its census is a proposal, never envelope data ingest acts on), and its printed H0/H1/H2 blocks
+ * are prose; this file is the same proposal, written by the same hand, in a shape a gate can read.
+ * Measured before it existed: a green census returned as the worker's report, and L4 could only
+ * record `ask`, because nothing on disk said so.
+ */
+export const hammerCensus = (cwd, slug) => join(localRoot(cwd, slug), "reports", "hammer-census.json");
+
 /**
  * Where the run scripts are staged for launch, inside the project.
  *

package/kernel/probe/leg.mjs

@@ -27,7 +27,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { ordersDir, resultsDir, legLedger } from "../lib/paths.mjs";
+import { ordersDir, resultsDir, legLedger, dispatchReceipts, readRunId } from "../lib/paths.mjs";
 
 /** `<scope>-r<round>-a<attempt>.json` — the only address a build order is written under. */
 const BUILD_ORDER = /^(.+)-r(\d+)-a(\d+)\.json$/;
@@ -80,6 +80,12 @@ export function legsOf(cwd, slug) {
   const ingested = new Set(readLegs(legLedger(cwd, slug))
     .filter((r) => r.ingested_at)
     .map((r) => String(r.order_id)));
+  // Dispatch receipts are the hook layer's record that a Skill was invoked against an order —
+  // scoped to this run, since receipts over one slug accumulate across runs and order ids repeat.
+  const runId = readRunId(cwd, slug);
+  const receipted = new Set(readLegs(dispatchReceipts(cwd, slug))
+    .filter((r) => r?.order_id && (!runId || !r.run_id || r.run_id === runId))
+    .map((r) => String(r.order_id)));
   const out = [];
   for (const f of (existsSync(oDir) ? readdirSync(oDir) : []).filter((x) => x.endsWith(".json")).sort()) {
     let orderId = null;
@@ -88,6 +94,7 @@ export function legsOf(cwd, slug) {
       order: join(oDir, f),
       name: f.replace(/\.json$/, ""),
       order_id: orderId,
+      has_receipt: orderId !== null && receipted.has(orderId),
       has_result: existsSync(join(rDir, f)),
       applied: orderId !== null && ingested.has(orderId),
     });
@@ -104,10 +111,25 @@ export function legsOf(cwd, slug) {
  */
 export function orderLegState(cwd, slug, name) {
   const o = legsOf(cwd, slug).find((x) => x.name === name);
-  if (!o) return { closed: false, found: false, order: null, order_id: null, has_result: false, applied: false };
+  if (!o) return { closed: false, found: false, order: null, order_id: null, has_receipt: false, has_result: false, applied: false };
   return { closed: o.applied, found: true, ...o };
 }
 
+/**
+ * Orders that were dispatched — a receipt says a Skill ran against them — and never answered:
+ * no WorkResult on disk. Measured on a live run: the first dispatch wrote its four artifacts and
+ * no envelope, every later phase read the artifacts, and the run closed `shipped` with the order
+ * still open by construction — the export's own dispatch row said `answered: false` and nothing
+ * upstream of it had noticed. Distinct from {@link openLegs}: that is work nobody applied; this is
+ * a leg that never came back.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null)}[]}
+ */
+export function unansweredOrders(cwd, slug) {
+  return legsOf(cwd, slug).filter((o) => o.has_receipt && !o.has_result);
+}
+
 /**
  * The results on disk that no leg row applied — finished work the board never saw.
  * @param {string} cwd - Project root.
@@ -171,8 +193,13 @@ export function cli(rawArgv) {
   // `--open`: every result nothing applied, across the whole run, any phase. Exit 0 when none.
   if (args.open) {
     const open = openLegs(cwd, args.slug);
-    console.log(JSON.stringify({ closed: open.length === 0, open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id) }));
-    process.exit(open.length === 0 ? 0 : 1);
+    const unanswered = unansweredOrders(cwd, args.slug);
+    console.log(JSON.stringify({
+      closed: open.length === 0 && unanswered.length === 0,
+      open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id),
+      unanswered_total: unanswered.length, unanswered: unanswered.map((o) => o.order), unanswered_ids: unanswered.map((o) => o.order_id),
+    }));
+    process.exit(open.length === 0 && unanswered.length === 0 ? 0 : 1);
   }
   // `--order <stem>`: one order by file stem (`analyze`, `alpha-r1-a1`). Exit 0 when its leg closed.
   if (args.order) {

package/kernel/probe/resume.mjs

@@ -61,8 +61,10 @@ import { dirname, join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
-import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId } from "../lib/paths.mjs";
+import { parseBoard } from "../reduce/board.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir, gates, verdictsDir, roundBuildDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
+import { deriveRounds } from "./rounds.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
@@ -371,6 +373,21 @@ export function usecasesPath(cwd, slug, specFolder) {
  * @param {string|null} specFolder - The ledger's `spec_folder`, if it names one.
  * @returns {boolean} True when at least one use case (not the index) is on disk.
  */
+/**
+ * Is the per-machine board on disk with at least one task? ANALYZE writes two artifacts in two
+ * tiers — the spec tree, committed, and the board, gitignored — and a fast-forward that asked only
+ * about the committed half walked every later run on a machine, and every run in a fresh checkout,
+ * into a build with a spec and no board: GATE L2 crossed over 0/0 tasks, the evaluator could read no
+ * `covers:` clause, and the requirements projection printed "no evidence" on a round whose static
+ * criteria all passed. Measured on a live consumer, fourth run of one pitch.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {boolean} True when the board directory holds at least one task file.
+ */
+export function hasBoard(cwd, slug) {
+  try { return parseBoard(tasksDir(cwd, slug)).length > 0; } catch { return false; }
+}
+
 export function hasSpecTree(cwd, slug, specFolder) {
   const dir = usecasesPath(cwd, slug, specFolder);
   if (!existsSync(dir)) return false;
@@ -385,7 +402,10 @@ export function hasSpecTree(cwd, slug, specFolder) {
  */
 export const PHASE_ARTIFACT = {
   orient: { fact: "has_orient_artifacts", artifact: "orient/{code-surface,discovered-seed,hill-signal}.md + spike-*.md" },
-  analyze: { fact: "has_spec_tree", artifact: "spec/usecases/*.md" },
+  // BOTH HALVES. The spec tree is committed and survives a clone; the board is per-machine and does
+  // not. A phase is complete only when both are on disk — a committed spec with no board resumes AT
+  // analyze, where the workflow dispatches the board-only operation rather than the whole phase.
+  analyze: { fact: "has_spec_tree", also: "has_board", artifact: "spec/usecases/*.md + tasks/TASK-*.md" },
   wire: { fact: "has_wiring_map", artifact: "wiring-map.md" },
   "map-scopes": { fact: "scope_files", artifact: "scopes/*.md" },
 };
@@ -399,8 +419,9 @@ export const PHASES = Object.keys(PHASE_ARTIFACT);
  * @returns {boolean} True when the phase's artifact exists.
  */
 export function phaseSatisfied(state, phase) {
-  const v = state[PHASE_ARTIFACT[phase].fact];
-  return Array.isArray(v) ? v.length > 0 : Boolean(v);
+  const present = (k) => { const v = state[k]; return Array.isArray(v) ? v.length > 0 : Boolean(v); };
+  const p = PHASE_ARTIFACT[phase];
+  return present(p.fact) && (!p.also || present(p.also));
 }
 
 /**
@@ -461,6 +482,7 @@ export function deriveResumeState(cwd, slug) {
     orient_dir: `.shapeup/${slug}/orient/`,
     has_orient_artifacts: hasOrientArtifacts(cwd, slug),
     has_spec_tree: hasSpecTree(cwd, slug, hr.spec_folder || null),
+    has_board: hasBoard(cwd, slug),
     // A PLAIN FACT, DELIBERATELY NOT A PHASE. The requirements registry is dispatched once, before
     // ANALYZE, and the orchestrator guards that one dispatch on this boolean. It is NOT an entry in
     // PHASE_ARTIFACT, and adding it there would be a migration hazard rather than a tidier shape:
@@ -539,7 +561,83 @@ export function setRunStatus(cwd, slug, status) {
  *   already normalized prose (newlines collapsed, truncated) — this function only `uncoerce`s it.
  * @returns {string} The rewritten text.
  */
-function writeCloseLines(body, { status, closedAt, cause }) {
+/**
+ * What the ledger's front matter and tables should say at a close, derived from the run's own
+ * records — the same ones the export reads. The counters (`final_verdict`, `rounds_used`) and the
+ * Rounds/Decisions tables used to be hand-shaped placeholders nothing filled: a run closed
+ * `shipped` beside `final_verdict: ~`, `rounds_used: 0`, an empty Decisions table and seven rows in
+ * `gates.jsonl`. A reader who trusted the counters concluded no round ran. Measured live.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{final_verdict:string, rounds_used:(number|null), decisions:object[], roundRows:string[]}}
+ */
+export function deriveLedgerFacts(cwd, slug) {
+  const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+  const evalRows = [];
+  const rDir = resultsDir(cwd, slug);
+  if (existsSync(rDir)) {
+    for (const f of readdirSync(rDir)) {
+      const m = f.match(/^evaluate-r(\d+)\.json$/);
+      if (!m) continue;
+      const r = readJson(join(rDir, f));
+      const overall = r?.verdict?.overall;
+      if (overall) evalRows.push({ round: Number(m[1]), overall: String(overall), criteria: Array.isArray(r.verdict.criteria) ? r.verdict.criteria : [] });
+    }
+  }
+  evalRows.sort((a, b) => a.round - b.round);
+  const finalVerdict = evalRows.length ? evalRows[evalRows.length - 1].overall : "not-evaluated";
+  const decisions = [];
+  const gp = gates(cwd, slug);
+  if (existsSync(gp)) {
+    for (const line of readFileSync(gp, "utf8").split("\n")) {
+      if (!line.trim()) continue;
+      try { decisions.push(JSON.parse(line)); } catch { /* a torn line proves nothing */ }
+    }
+  }
+  const t0ByRound = {};
+  const vDir = verdictsDir(cwd, slug);
+  if (existsSync(vDir)) {
+    for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json")).sort()) {
+      const v = readJson(join(vDir, f));
+      if (typeof v?.round !== "number") continue;
+      const t = (t0ByRound[v.round] ||= { green: 0, red: 0 });
+      if (v.overall === "green") t.green++; else t.red++;
+    }
+  }
+  const gateByRound = {};
+  const bDir = roundBuildDir(cwd, slug);
+  if (existsSync(bDir)) {
+    for (const f of readdirSync(bDir).sort()) {
+      const m = f.match(/^r(\d+)-t\d+\.json$/);
+      if (m) gateByRound[Number(m[1])] = readJson(join(bDir, f))?.overall ?? "?";
+    }
+  }
+  const roundNums = [...new Set([...Object.keys(t0ByRound), ...Object.keys(gateByRound), ...evalRows.map((e) => e.round)].map(Number))].sort((a, b) => a - b);
+  const roundRows = [];
+  for (const r of roundNums) {
+    const t0 = t0ByRound[r], bg = gateByRound[r], ev = evalRows.find((e) => e.round === r);
+    roundRows.push(`| Build | ${r} | ${t0 ? `T0 ${t0.green} green / ${t0.red} red` : "no T0 verdict"} | — | round build gate: ${bg ?? "not run"} |`);
+    if (ev) {
+      const p = ev.criteria.filter((c) => c?.verdict === "PASS").length, f = ev.criteria.filter((c) => c?.verdict === "FAIL").length;
+      roundRows.push(`| Eval | ${r} | ${ev.overall} | — | ${p} PASS / ${f} FAIL criteria |`);
+    }
+  }
+  let roundsUsed = null;
+  try { roundsUsed = deriveRounds(cwd, slug, null)?.rounds_used ?? null; } catch { roundsUsed = null; }
+  if (roundsUsed == null && roundNums.length) roundsUsed = roundNums[roundNums.length - 1];
+  return { final_verdict: finalVerdict, rounds_used: roundsUsed, decisions, roundRows };
+}
+
+/** Replace the rows of one markdown table (identified by its header line) with `rows`, keeping the header, the separator and any row the caller marks as kept. */
+function rewriteTable(body, headerRe, rows, keepRow = null) {
+  return body.replace(headerRe, (m, header, sep, oldRows) => {
+    const kept = keepRow && oldRows ? oldRows.split("\n").filter((l) => l.startsWith(keepRow)) : [];
+    return header + sep + [...kept, ...rows].map((l) => `${l}\n`).join("");
+  });
+}
+
+function writeCloseLines(body, { status, closedAt, cause, derived = null }) {
   const causeLine = `close_cause: ${uncoerce(cause || null)}`;
   const closedStatusLine = `closed_status: ${status}`;
   let out = body
@@ -553,6 +651,15 @@ function writeCloseLines(body, { status, closedAt, cause }) {
   out = /^close_cause:.*$/m.test(out)
     ? out.replace(/^close_cause:.*$/m, causeLine)
     : out.replace(/^closed_at:.*$/m, (m) => `${m}\n${causeLine}`);
+  if (derived) {
+    // THE COUNTERS AND TABLES ARE DERIVED, IN THE SAME PASS AS THE CLOSE LINE. Written from the
+    // run's own records so they cannot disagree with the export that reads the same records.
+    if (/^final_verdict:.*$/m.test(out)) out = out.replace(/^final_verdict:.*$/m, `final_verdict: ${derived.final_verdict}`);
+    if (typeof derived.rounds_used === "number" && /^rounds_used:.*$/m.test(out)) out = out.replace(/^rounds_used:.*$/m, `rounds_used: ${derived.rounds_used}`);
+    out = rewriteTable(out, /(\| Phase \| Round \| Result \| Duration \| Notes \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, derived.roundRows, "| Init");
+    const decisionRows = derived.decisions.map((g) => `| ${g.gate ?? "?"} | ${g.decision ?? g.status ?? "?"} | ${g.source ?? "?"} | ${String(g.note ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").slice(0, 160)} |`);
+    out = rewriteTable(out, /(\| Gate \| Decision \| Source \| Note \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, decisionRows);
+  }
   return out;
 }
 
@@ -675,6 +782,9 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   // The Ship phase (`shapeup-run.js`) already exports a shipped run itself, before this call ever
   // runs — Stage 2 adds the endings that wrote nothing, and leaves that path untouched.
   const shouldExport = withExport && status !== "shipped";
+  // Derived once, from the run's own records, and written with the close line (see deriveLedgerFacts).
+  let derived = null;
+  try { derived = deriveLedgerFacts(cwd, slug); } catch { derived = null; }
 
   /**
    * Everything a close owes the checkout once the ledger line is written: export the run's
@@ -757,7 +867,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
     // new line rather than lost, and the return says so explicitly.
     const closedAt = new Date().toISOString();
     const foldedCause = `${normCause || "no reason recorded"} — supersedes an earlier close recorded ${priorClosedAt} (cause: ${JSON.stringify(priorCause)})`.slice(0, 4000);
-    body = writeCloseLines(body, { status, closedAt, cause: foldedCause });
+    body = writeCloseLines(body, { status, closedAt, cause: foldedCause, derived });
     try { writeFileSync(p, body); } catch (e) {
       return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
     }
@@ -772,7 +882,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   }
 
   const closedAt = new Date().toISOString();
-  body = writeCloseLines(body, { status, closedAt, cause: normCause });
+  body = writeCloseLines(body, { status, closedAt, cause: normCause, derived });
   try { writeFileSync(p, body); } catch (e) {
     return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
   }

package/kernel/reduce/ingest.mjs

@@ -187,11 +187,48 @@ export function setCheckbox(body, ac, checked) {
  * @param {boolean} done - When true, rewrite the row's status emoji/word to done; false is a no-op.
  * @returns {string} The board text with the matching row updated (unchanged when no row matches).
  */
-export function updateBoardRow(indexBody, taskId, done) {
+/**
+ * Is this index line the row FOR `taskId` — its first cell — rather than a row that merely
+ * mentions it? A task id appears in other rows' `Depends On` column, and matching by substring
+ * anywhere in the line flipped every dependent of a finished task to done along with it. Measured
+ * on a live run: the executor reported one task `skipped`, its task file still said `ready`, and
+ * the index showed it ✅ because the task it depended on had just been ticked. The census read the
+ * index.
+ * @param {string} line - One line of `tasks/_index.md`.
+ * @param {string} taskId - `TASK-NNN`.
+ * @returns {boolean}
+ */
+export function rowIs(line, taskId) {
+  const id = taskId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^\\|\\s*(?:\\[\\[)?${id}(?:\\\\\\|${id}\\]\\])?\\s*\\|`).test(line);
+}
+
+/**
+ * The status cell for one TaskResult status, or null when the index should not change.
+ * @param {(string|boolean)} status - A TaskResult status (`true` is accepted as `done` for callers written before skipped existed).
+ * @returns {({icon:string, word:string}|null)} The icon and word the index row should carry.
+ */
+export function boardCell(status) {
+  if (status === true || status === "done") return { icon: "✅", word: "done" };
+  if (status === "skipped") return { icon: "⏭", word: "skipped" };
+  if (status === "partial" || status === "failed") return { icon: "🔄", word: "in-progress" };
+  return null;
+}
+
+/**
+ * Rewrite one task's status cell in `tasks/_index.md` — the row whose id cell is `taskId`, never a
+ * row that merely mentions it in `Depends On`.
+ * @param {string} indexBody - The index file's text.
+ * @param {string} taskId - `TASK-NNN`.
+ * @param {(string|boolean)} status - A TaskResult status; statuses the index does not render leave it unchanged.
+ * @returns {string} The rewritten index text.
+ */
+export function updateBoardRow(indexBody, taskId, status) {
+  const cell = boardCell(status);
+  if (!cell) return indexBody;
   return indexBody.split(/\r?\n/).map((line) => {
-    if (!line.includes(taskId) || !line.includes("|")) return line;
-    if (done) return line.replace(/⬜|🔄|⏳|🚫/g, "✅").replace(/\b(ready|in-progress|blocked)\b/gi, "done");
-    return line;
+    if (!rowIs(line, taskId)) return line;
+    return line.replace(/⬜|🔄|⏳|🚫|✅|⏭/g, cell.icon).replace(/\b(ready|in-progress|blocked|done|skipped)\b/gi, cell.word);
   }).join("\n");
 }
 
@@ -240,14 +277,18 @@ function applyResultLocked(result, { cwd, slug }) {
       body = setFrontmatter(body, "completed_at", today());
     } else if (tr.status === "partial" || tr.status === "failed") {
       body = setFrontmatter(body, "status", "in-progress");
+    } else if (tr.status === "skipped") {
+      // Rendered as what it is. A skipped task used to leave its file at `ready` and, through the
+      // substring match above, could show ✅ on the index — the census read the index.
+      body = setFrontmatter(body, "status", "skipped");
     }
     // Execution Log (append; the checkbox list must never disagree with it).
     const logLines = (tr.ac_results || []).map((a) => `- ${a.ac}: ${a.result}${a.evidence ? ` (${a.evidence})` : ""}`).join("\n");
     body += `\n\n## Execution Log — ${today()} (${result.order_id})\n- executor: ${result.worker || "task-executor"} via ingest-result\n- status: ${tr.status}\n${logLines}${tr.notes ? `\n- notes: ${tr.notes}` : ""}\n`;
     writeFileSync(path, body);
     summary.tasks_updated.push(tr.task_id);
-    if (tr.status === "done" && existsSync(boardIndex)) {
-      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, true));
+    if (existsSync(boardIndex) && boardCell(tr.status)) {
+      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, tr.status));
     }
   }
 
@@ -271,7 +312,7 @@ function applyResultLocked(result, { cwd, slug }) {
         summary.unblocked.push(t.id);
         if (existsSync(boardIndex)) {
           const idx = readFileSync(boardIndex, "utf8").split(/\r?\n/).map((line) =>
-            line.includes(t.id) && line.includes("|")
+            rowIs(line, t.id)
               ? line.replace(/🚫|⏳/g, "⬜").replace(/\bblocked\b/gi, "ready")
               : line).join("\n");
           writeFileSync(boardIndex, idx);

package/kernel/schemas/domain.schema.json

@@ -494,7 +494,7 @@
         "execute",
         "fix",
         "spike",
-        "analyze",
+        "analyze", "board",
         "reconcile",
         "retrofit-surface",
         "coverage",
@@ -2537,6 +2537,22 @@
         }
       }
     },
+    "HammerCensus": {
+      "description": "Scope-hammer's census as data — the proposal GATE L4's resolver reads before it lets an answer set say `ship`. Written by the hammer at `.shapeup/<slug>/reports/hammer-census.json`, the only path its order's substrate permits besides the committed report. A proposal, never a decision: promotion and shipping stay the PO's call, and ingest never acts on it.",
+      "x-tier": "LOCAL",
+      "x-location": ".shapeup/<slug>/reports/hammer-census.json",
+      "type": "object",
+      "required": ["schema_version", "verdict", "cut_list"],
+      "properties": {
+        "schema_version": { "const": 1 },
+        "order_id": { "type": "string" },
+        "verdict": { "type": "string", "enum": ["ship-now", "ship-after-fixes", "cannot-ship"] },
+        "cut_list": { "type": "array", "items": { "type": "string" } },
+        "ship_blocking": { "type": "array", "items": { "type": "string" }, "description": "Must-have items that failed the baseline comparison — non-empty exactly when the verdict is cannot-ship." },
+        "breaker": { "type": ["string", "null"] },
+        "baseline": { "type": ["string", "null"], "description": "The baseline the comparison ran against, or null when the pitch's problem statement stood in for it." }
+      }
+    },
     "ResumeState": {
       "description": "The fast-forward derivation: which phase a launch resumes at, derived from artifacts on disk and NEVER from stored state or conversation memory. Produced by kernel/probe/resume.mjs on stdout and consumed by shapeup-run.js's preamble on every launch, fresh or relaunch alike. Every phase predicate is an artifact test — `has_orient_artifacts` exists because the ORIENT branch was once gated on the ledger's stored `status` instead, which a silent courier failure left stale, and a completed ORIENT phase was re-dispatched on resume. `next_phase` is a convenience derived from the same booleans, which all travel too: a caller is never forced to trust a summary it cannot re-derive.",
       "x-tier": "EMBEDDED",
@@ -2635,6 +2651,7 @@
           "type": "boolean",
           "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
         },
+        "has_board": { "type": "boolean", "description": "The per-machine board (tasks/TASK-*.md) holds at least one task. ANALYZE is complete only with both the committed spec tree and this; a committed tree with no board resumes at analyze, where the board-only operation regenerates it." },
         "has_requirements": {
           "type": "boolean",
           "description": "The requirements registry is on disk: shapeup/<slug>/requirements.md exists. A PLAIN FACT, not a phase — the orchestrator guards its single `coverage` dispatch on this boolean, and it is deliberately absent from kernel/probe/resume.mjs's PHASE_ARTIFACT map, which doubles as nextPhase()'s ordered list: an entry there would fast-forward every run recorded before the registry existed to the registry instead of to build."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.4",
+  "version": "3.7.6",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -24,7 +24,7 @@ Invoked as `--order <path>`. Fields you may rely on (absent = unknown; surface i
 
 | Field | What it is |
 |---|---|
-| `operation` | `analyze` (pitch → full spec tree + board) · `reconcile` (fold discovered-ledger items into the board + UC invariants) · `retrofit-surface` (append `## Test Surface` to a pre-surface spec) · `coverage` (extract atomic requirement clauses → the SHARED `requirements.md` registry) |
+| `operation` | `analyze` (pitch → full spec tree + board) · `board` (committed spec tree → the per-machine board only; the tree is frozen) · `reconcile` (fold discovered-ledger items into the board + UC invariants) · `retrofit-surface` (append `## Test Surface` to a pre-surface spec) · `coverage` (extract atomic requirement clauses → the SHARED `requirements.md` registry) |
 | `payload.pitch` | The pitch/PRD path (analyze) |
 | `payload.breadboard` | The breadboard (analyze): its Places are your screens; its U# and N# are the affordances you place and cite. Absent = none separate; never inferred |
 | `payload.requirements` | (coverage) the REQ source to extract atomic clauses from — pitch / a customer-requirements doc / the use-case bodies. Absent → default to the pitch and record the choice in `assumptions[]` |
@@ -115,10 +115,11 @@ covered AC is a requirement the run can be measured against.
 
 ---
 
-## The other three operations — same craft, different payload + whitelist
+## The other four operations — same craft, different payload + whitelist
 
 | Operation | Essence | Never |
 |---|---|---|
+| `board` | The spec tree is already on disk and committed; the board is per-machine and is not. Regenerate `tasks/` from the use cases as they are — same task derivation as `analyze`, every AC carrying its `(covers: REQ-…)` clause, ids numbered fresh for this machine | touch the spec folder (frozen), re-derive or "improve" a use case, invent a task no UC step or Test Surface row sources |
 | `reconcile` | Verify `ledger.feature == payload.feature` (mismatch → STOP). Map each `[+]` Keep item → its owning UC; new task continues numbering (never renumber); `~`/Cut → synthesis "Hammered Out" row, no file. A Keep item asserting a new invariant → APPEND `[INV-NN]` + TS-INV row to that UC (append-only sections in your substrate). A new actor/action with no UC → `status: "escalated"` + a `deviations[]` spec-ambiguity entry: spawning a UC mid-cycle is silent re-shaping, the PO decides. Finish with board-derive (appetite overflow → report) + spec-lint | re-run phases 1–5; edit UC Steps; resolve the appetite HAMMER yourself |
 | `retrofit-surface` | Append `## Test Surface` (derived rows only, after Error Cases) to each UC of a pre-surface spec; an all-sources-empty UC gets the explicit empty-sources line | touch anything else — append-only substrate |
 | `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. **The `source` cell, and any other prose in this file, cites the committed pitch or shaping doc — never the gitignored run-tier path** (`.shapeup/<slug>/intake.md`, or any other `.shapeup/` path): spec-lint's `TIER-DIRECTION` rule reds a committed file naming that path in ANY form, a bare path in a sentence exactly as much as a `[[tasks/...]]` wikilink, because it dangles on every other clone. When the intake has no committed original to name, describe the run tier without a path (`"the pitch staged for this run"`) rather than citing where it actually lives. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |

package/skills/scope-hammer/SKILL.md

@@ -171,6 +171,19 @@ The WorkResult may carry only `files_touched`, `artifacts`, `assumptions`, `devi
 (`x-result-by-worker`): the census, cut list, and ship verdict live in the report artifact as a
 **proposal** — promotion and shipping stay a human call, never envelope data ingest acts on.
 
+**The census is also written as data**, at `.shapeup/<slug>/reports/hammer-census.json` (inside
+this operation's substrate), shape `HammerCensus` in the domain registry:
+
+```json
+{ "schema_version": 1, "order_id": "<the order>", "verdict": "ship-now | ship-after-fixes | cannot-ship",
+  "cut_list": ["…"], "ship_blocking": ["…"], "breaker": "outer | inner | deadline | null", "baseline": "<path or null>" }
+```
+
+GATE L4's resolver reads this file — and nothing else — before it lets any answer set say `ship`.
+It is the same proposal as the H2 block, written by the same hand, in a shape a gate can read:
+a census that lives only in printed blocks cannot be read by a gate, and a run that reached L4
+with a green census could only be recorded as `ask`. Still a proposal: the file grants nothing.
+
 ---
 
 ## Invocation

package/skills/tech-lead/references/gates.md

@@ -560,9 +560,12 @@ and without it the trace holds no record of that decision at all: `node
 "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve L4 --slug <slug>
 [--file <path>|--preset <name>]`. Exit 0 (`decision=ship|hold`) — render the block above and close
 the run: `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe resume --slug <slug> --close shipped
---cause "verdict=<verdict> rounds=<r> decision=<ship|hold>"`. Always issue this call — a `gate_h`
-close is the ordinary case where `shapeup-run.js` handed off without closing the run, and the
-GATE H → L4 path (scope-hammer's census, then this gate) is the one this instruction exists for.
+--cause "verdict=<verdict> rounds=<r> decision=<ship|hold>"`. **This applies to the prose lane
+only.** A launched run (`shapeup-run.js`) resolves L4 itself, on both the PASS path and a breaker
+path: it dispatches the census, crosses GATE H, writes the ship report with the verdict as it is,
+crosses L4, and only then closes — `shipped` when the census and L4 clear it, `escalated` naming
+the census when they do not. A run that returned `{status: "shipped"}` or `{status: "gate_h"}` is
+already closed; do not close it again, and do not run the census by hand after it.
 The close itself is a once-only fact IN THE KERNEL (`closeRun`'s own guard reads a `closed_status:`
 line that only `closeRun` ever writes — never the mutable `status:` line every phase rewrites, this
 call included), not a conditional this instruction has to get right: if this run_id was NOT already

package/skills/tech-lead/workflows/shapeup-run.js

@@ -42,7 +42,9 @@
 //   { status: "paused",  paused_at, block, valid_decisions, context }
 //   { status: "aborted", aborted_at, reason }
 //   { status: "gate_h",  breaker: "outer"|"attempt_budget"|"none"|"deadline", hammer_proposals, green_scopes,
-//                        tripped_scopes?, unapplied_results? }
+//                        tripped_scopes?, unapplied_results?, census?, cut_list?, l4? }
+//     — returned only when the census said cannot-ship, L4 said hold, or the ship report was
+//       refused; a breaker whose census clears the run ends as `shipped` with `after: "gate_h"`.
 
 // meta must be a PURE LITERAL — the runtime parses it statically, before the body ever runs, and
 // rejects the whole script on anything it has to evaluate. A `+`-joined description is a
@@ -411,6 +413,7 @@ const RESUME = {
     eval_dimensions: { type: "array", items: { type: "string" } },
     has_orient_artifacts: { type: "boolean" },
     has_spec_tree: { type: "boolean" },
+    has_board: { type: "boolean" },
     // The requirements registry — a fact, not a phase. See the COVERAGE block below for why it is
     // guarded on this bare boolean and never asked about through `probe resume --require`.
     has_requirements: { type: "boolean" },
@@ -479,6 +482,7 @@ const ORDERLEG = {
     closed: { type: "boolean" },
     found: { type: "boolean" },
     order: nullable("string"),
+    has_receipt: { type: "boolean" },
     has_result: { type: "boolean" },
     applied: { type: "boolean" },
   },
@@ -624,6 +628,69 @@ const HAMMER = {
   required: ["ok", "verdict", "cut_list"],
 };
 
+/** What every hammer dispatch is told, on the PASS path and the breaker path alike. */
+const HAMMER_EXTRA =
+  "Run the census, compare against the BASELINE and never the ideal, and produce the cut list. " +
+  "Write the census as data to `reports/hammer-census.json` under the run's local root — the " +
+  "`reports/**` entry in your order's substrate names the directory — with schema_version 1, " +
+  "order_id, verdict (ship-now | ship-after-fixes | cannot-ship), cut_list, ship_blocking, breaker, " +
+  "baseline — beside the human-readable report. GATE L4's resolver reads that file and nothing " +
+  "else before it lets any answer set say `ship`; a census that lives only in your printed blocks " +
+  "cannot be read by a gate.";
+
+/**
+ * A breaker routed the run to GATE H. This used to be a terminal return: the loop handed back
+ * `{status: "gate_h"}`, the close-out stamped the ledger `escalated` and retired the pointers, and
+ * the census, GATE H, the ship report and GATE L4 all happened AFTER the close, in the tech
+ * lead's prose — so the census reached no artifact, `gates.jsonl` held no H and no L4, and a later
+ * `--close shipped` was refused over the `escalated` fact already on the ledger. Measured on three
+ * consumer runs. AGENTS.md has always said what a breaker means: "ship what's green, never kill the
+ * run from outside". So the run does that itself, in this launch: the hammer census (an artifact),
+ * GATE H (a row), the ship report (with the verdict as it is, FAIL or not-evaluated included), and
+ * GATE L4 (a row) — and only then a close, `shipped` or `escalated`, that names the census.
+ *
+ * QA never ran on this path (it sits after a PASS), so the census is told so plainly. `qaFindings`
+ * is declared after the round loop and must not be read from here.
+ *
+ * @param {object} ret - The gate_h return the round loop built.
+ * @returns {Promise<object>} The RunReturn that actually ends the run.
+ */
+async function settleAtGateH(ret) {
+  phase("Ship");
+  const h = await worker({
+    skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
+    payload: { feature: slug, qa_findings: 0, hammer_proposals: ret.hammer_proposals || [], breaker: ret.breaker ?? null },
+    extra: HAMMER_EXTRA,
+  });
+  if (h.__failed) return await withWarnings(diedAt("H", h));
+  {
+    const g = await crossGate("H", "Ship", ["accept-cut-list", "ship-all", "ask"],
+      { verdict: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null, green_scopes: ret.green_scopes, hammer_proposals: ret.hammer_proposals });
+    if (g.stop) return await withWarnings(g.stop);
+  }
+  if (h.verdict === "cannot-ship") {
+    return await withWarnings({ ...ret, census: "cannot-ship", cut_list: h.cut_list });
+  }
+  const hVerdict = verdict === "pass" ? "PASS" : verdict === "fail" ? "FAIL" : "not-evaluated";
+  const ship = await cmd(`reduce ship --slug ${slug} --verdict ${hVerdict} --qa skipped`, "Ship", "ship-report");
+  if (!ship.ok) {
+    return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, ship_report: `refused: ${ship.detail || `exit ${ship.exit_code}`}` });
+  }
+  {
+    const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: hVerdict, census: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null });
+    if (g.stop) return await withWarnings(g.stop);
+    if (g.decision === "hold") return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, l4: "hold" });
+  }
+  await advisory(`report export --slug ${slug}`, "Ship", "export-run");
+  await setRunStatus("shipped", "Ship");
+  return await withWarnings({
+    status: "shipped", verdict, rounds_used: round, after: "gate_h", breaker: ret.breaker ?? null,
+    census: h.verdict, cut_list: h.cut_list, green_scopes: ret.green_scopes,
+    unapplied_results: ret.unapplied_results || [], qa_findings: 0,
+    report: ship.detail || `shapeup/${slug}/REPORT.md`,
+  });
+}
+
 // ---------------------------------------------------------------------------------------------
 // DISPATCH — three shapes, and none of them parses text.
 //
@@ -859,16 +926,29 @@ const attest = (phaseKey, phaseName, label) =>
  * rather than folding the gap into a phase that "completed".
  *
  * @param {string} gate - The gate name to report the abort under.
- * @param {string} phaseKey - The phase, which is also its order's file stem.
+ * @param {string} phaseKey - The phase.
  * @param {string} phaseName - Progress group.
+ * @param {string} [orderStem=phaseKey] - The order's file stem, when the phase was dispatched
+ *   under a different operation (a board-only ANALYZE compiles `board.json`).
  * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the leg closed (or the
  *   question could not be asked — a probe that did not run proves nothing, and is logged as such).
  */
-async function requireLeg(gate, phaseKey, phaseName) {
-  const ask = () => query(`probe leg --slug ${slug} --order "${phaseKey}"`, ORDERLEG, phaseName, `legcheck:${phaseKey}`);
+async function requireLeg(gate, phaseKey, phaseName, orderStem = phaseKey) {
+  const ask = () => query(`probe leg --slug ${slug} --order "${orderStem}"`, ORDERLEG, phaseName, `legcheck:${orderStem}`);
   let leg = await ask();
   if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
-  if (!leg.has_result || leg.applied) return null;
+  if (!leg.has_result) {
+    // The artifact is on disk and the envelope never came back. Measured live: the first dispatch of
+    // a run wrote its four artifacts and no WorkResult, every later phase read the artifacts, and
+    // the run closed `shipped` over an order still open by construction. The phase stands on its
+    // artifact — that is what the post-condition checks — but the order is named at the close, and
+    // the next run over this slug will find it unanswered rather than be surprised by it.
+    log(`${gate} — "${phaseKey}" ${leg.has_receipt ? "was dispatched (receipt on disk) and" : "has an order but no receipt, and"} never answered: no WorkResult at all. ` +
+        `Its artifacts are on disk and the phase proceeds on them; the order stays unanswered and is named at the close.`);
+    if (leg.order && !unansweredOrders.includes(leg.order)) unansweredOrders.push(leg.order);
+    return null;
+  }
+  if (leg.applied) return null;
   log(`${gate} — "${phaseKey}" came back with a result nothing applied (no leg row). Ingesting it here: ${leg.order}.`);
   await advisory(`reduce ingest --order "${leg.order}"`, phaseName, `late-ingest:${phaseKey}`);
   leg = await ask();
@@ -891,9 +971,9 @@ async function requireLeg(gate, phaseKey, phaseName) {
  * @param {string} phaseName - Progress group.
  * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the artifact is there.
  */
-async function requirePhase(gate, phaseKey, phaseName) {
+async function requirePhase(gate, phaseKey, phaseName, orderStem = phaseKey) {
   const r = await attest(phaseKey, phaseName, `require:${phaseKey}`);
-  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName);
+  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName, orderStem);
   // Exit 6 is `probe resume --require`'s OWN documented code for "the artifact really is not on
   // disk" (kernel/probe/resume.mjs banner). Any other value — including -1, the courier's sentinel
   // for a tool call that never ran — is not that predicate answering "no"; it is the predicate never
@@ -1016,6 +1096,9 @@ async function requireLaunchRecord() {
 // it warns and continues — and the warning travels in the RunReturn, because a headless stdout
 // carries only the final message and a diagnostic on a channel nobody reads is not a diagnostic.
 const stateWarnings = [];
+// Orders a receipt says were dispatched and no WorkResult ever answered — a leg that did its craft
+// and never came back. Named at every close, whatever the close; never folded into "complete".
+const unansweredOrders = [];
 async function setRunStatus(status, phaseName) {
   const r = await cmd(`probe resume --slug ${slug} --set-status ${status}`, phaseName, `status:${status}`);
   if (!r.ok) {
@@ -1069,11 +1152,14 @@ async function closeIfTerminal(ret) {
       + (Array.isArray(ret.tripped_scopes) ? ` tripped_scopes=${ret.tripped_scopes.length}` : "")
       // A result the single writer never applied is named at the close, not folded into "not green".
       + (Array.isArray(ret.unapplied_results) && ret.unapplied_results.length ? ` unapplied_results=${ret.unapplied_results.length}` : "")
-    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
+      + (ret.census ? ` census=${ret.census}` : "") + (ret.l4 ? ` l4=${ret.l4}` : "") + (ret.ship_report ? ` ship_report=${ret.ship_report}` : "")
+    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`
+      + (ret.after ? ` after=${ret.after} breaker=${ret.breaker ?? "?"} census=${ret.census ?? "?"} cut_list=${Array.isArray(ret.cut_list) ? ret.cut_list.length : "?"}` : "");
   // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
   // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
   // stay silent for it exactly as they did when this file's own guard returned early.
-  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  const unanswered = unansweredOrders.length ? ` unanswered_orders=${unansweredOrders.length}` : "";
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause + unanswered)}"`, "Ship", `close:${ret.status}`);
   if (!r.ok) {
     const why = (r.detail || `exit ${r.exit_code}`).trim();
     log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +
@@ -1254,8 +1340,28 @@ if (!rs.has_spec_tree) {
   const post = await requirePhase("ANALYZE", "analyze", "Analyze");
   if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:analyze");
+} else if (!rs.has_board) {
+  // THE HALF THAT DOES NOT SURVIVE. The spec tree is committed; the board is per-machine and
+  // gitignored, and ANALYZE writes both. A run after the first on a machine — and every run in a
+  // fresh checkout — used to fast-forward on the committed half alone and build over no board:
+  // GATE L2 crossed 0/0 tasks, the evaluator could read no `covers:` clause, and the requirements
+  // projection said "no evidence" for a round whose static criteria all passed. The board-only
+  // operation regenerates it from the tree without re-deriving the tree.
+  log(`ANALYZE — spec tree on disk, no board: dispatching the board-only operation (slug ${slug})`);
+  await setRunStatus("mapping", "Analyze");
+  const b = await worker({
+    skill: "ba-pitch-analyzer", operation: "board", schema: PHASE_OK, phase: "Analyze", label: "board",
+    payload: { spec_folder: specFolder, feature: slug, lens: rs.lens },
+    extra: "The spec tree is committed and FROZEN for this dispatch. Regenerate the per-machine board " +
+           "under the run's tasks/ directory from the use cases on disk — every acceptance criterion " +
+           "carrying its `(covers: REQ-…)` clause — and write nothing under the spec folder.",
+  });
+  if (b.__failed) return await withWarnings(diedAt("ANALYZE", b));
+  const post = await requirePhase("ANALYZE", "analyze", "Analyze", "board");
+  if (post) return await withWarnings(post);
+  await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:board");
 } else {
-  const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree already on disk");
+  const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree and board already on disk");
   if (post) return await withWarnings(post);
 }
 
@@ -1476,7 +1582,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   const budget = await cmd(`verify budget --slug ${slug} --strict`, "Build", `budget:r${round}`);
   if (budget.exit_code === 6) {
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+    return await settleAtGateH({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
 
   log(`BUILD round ${round} — ${scopes.length} scope(s), up to ${maxParallelScopes} at once, attempt budget ${attemptBudget}`);
@@ -1640,7 +1746,7 @@ while (verdict !== "pass" && round <= maxRounds) {
       if (census?.tripped) tripped.push(sid);
     }
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({
+    return await settleAtGateH({
       status: "gate_h", breaker: tripped.length ? "attempt_budget" : "none", stalled: "no_green",
       tripped_scopes: tripped, unapplied_results: allUnapplied,
       hammer_proposals: allHammer, green_scopes: allGreen,
@@ -1755,13 +1861,13 @@ while (verdict !== "pass" && round <= maxRounds) {
   // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
   if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
-    return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+    return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
 if (verdict !== "pass" && verdict !== "not-evaluated") {
-  return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+  return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
 // ---- QA (post-PASS, pre-ship) — a level-up, never a gate. `--no-qa` answers it "skip". --------
@@ -1786,7 +1892,7 @@ phase("Ship");
 const h = await worker({
   skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
   payload: { feature: slug, qa_findings: qaFindings, hammer_proposals: allHammer },
-  extra: "Run the census, compare against the BASELINE and never the ideal, and produce the cut list.",
+  extra: HAMMER_EXTRA,
 });
 if (h.__failed) return await withWarnings(diedAt("H", h));
 if (h.verdict === "cannot-ship") {
@@ -1804,6 +1910,14 @@ if (h.verdict === "cannot-ship") {
 // default). Hardcoding PASS here is exactly the silent upgrade protocol.md's Rules forbid.
 const shipVerdict = verdict === "not-evaluated" ? "not-evaluated" : "PASS";
 const ship = await cmd(`reduce ship --slug ${slug} --verdict ${shipVerdict} --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
+// GATE L4 HAS A CALL SITE. It used to be a line of prose in the tech lead's references — "resolve
+// the gate itself before any of the above" — and a run reached its ship decision with no ledger row
+// for it. The resolver narrows `ship` on the census artifact the hammer just wrote.
+{
+  const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: shipVerdict, census: h.verdict, cut_list: h.cut_list });
+  if (g.stop) return await withWarnings(g.stop);
+  if (g.decision === "hold") return await withWarnings({ status: "aborted", aborted_at: "L4", reason: `GATE L4 answered "hold" (census ${h.verdict}, verdict ${shipVerdict})` });
+}
 await advisory(`report export --slug ${slug}`, "Ship", "export-run");
 // The run's own concurrency, printed once where the records are complete and before the next run
 // supersedes the trace. It is a projection over `receipts/dispatch.jsonl` and `legs.jsonl`, so it