shapeup-sdlc 3.7.5 → 3.7.6

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.5",
+  "version": "3.7.6",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -13,7 +13,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
-- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
 - The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 

package/kernel/compile.mjs

@@ -246,7 +246,10 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // not cover is a leg forging a SIBLING's result, which is a real hole with a different fix — the
   // glob form here cannot say "every result except this order's own", so closing it needs a
   // mechanism rather than one more entry on this list.
-  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`];
+  // The board index is ingest's projection of the task results, not the doer's bookkeeping — the
+  // task files are. The executor's contract already forbids editing it; the freeze makes that a
+  // denial rather than a rule, on the same terms as the attestation channels.
+  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
       // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the

package/kernel/probe/leg.mjs

@@ -27,7 +27,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { ordersDir, resultsDir, legLedger } from "../lib/paths.mjs";
+import { ordersDir, resultsDir, legLedger, dispatchReceipts, readRunId } from "../lib/paths.mjs";
 
 /** `<scope>-r<round>-a<attempt>.json` — the only address a build order is written under. */
 const BUILD_ORDER = /^(.+)-r(\d+)-a(\d+)\.json$/;
@@ -80,6 +80,12 @@ export function legsOf(cwd, slug) {
   const ingested = new Set(readLegs(legLedger(cwd, slug))
     .filter((r) => r.ingested_at)
     .map((r) => String(r.order_id)));
+  // Dispatch receipts are the hook layer's record that a Skill was invoked against an order —
+  // scoped to this run, since receipts over one slug accumulate across runs and order ids repeat.
+  const runId = readRunId(cwd, slug);
+  const receipted = new Set(readLegs(dispatchReceipts(cwd, slug))
+    .filter((r) => r?.order_id && (!runId || !r.run_id || r.run_id === runId))
+    .map((r) => String(r.order_id)));
   const out = [];
   for (const f of (existsSync(oDir) ? readdirSync(oDir) : []).filter((x) => x.endsWith(".json")).sort()) {
     let orderId = null;
@@ -88,6 +94,7 @@ export function legsOf(cwd, slug) {
       order: join(oDir, f),
       name: f.replace(/\.json$/, ""),
       order_id: orderId,
+      has_receipt: orderId !== null && receipted.has(orderId),
       has_result: existsSync(join(rDir, f)),
       applied: orderId !== null && ingested.has(orderId),
     });
@@ -104,10 +111,25 @@ export function legsOf(cwd, slug) {
  */
 export function orderLegState(cwd, slug, name) {
   const o = legsOf(cwd, slug).find((x) => x.name === name);
-  if (!o) return { closed: false, found: false, order: null, order_id: null, has_result: false, applied: false };
+  if (!o) return { closed: false, found: false, order: null, order_id: null, has_receipt: false, has_result: false, applied: false };
   return { closed: o.applied, found: true, ...o };
 }
 
+/**
+ * Orders that were dispatched — a receipt says a Skill ran against them — and never answered:
+ * no WorkResult on disk. Measured on a live run: the first dispatch wrote its four artifacts and
+ * no envelope, every later phase read the artifacts, and the run closed `shipped` with the order
+ * still open by construction — the export's own dispatch row said `answered: false` and nothing
+ * upstream of it had noticed. Distinct from {@link openLegs}: that is work nobody applied; this is
+ * a leg that never came back.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null)}[]}
+ */
+export function unansweredOrders(cwd, slug) {
+  return legsOf(cwd, slug).filter((o) => o.has_receipt && !o.has_result);
+}
+
 /**
  * The results on disk that no leg row applied — finished work the board never saw.
  * @param {string} cwd - Project root.
@@ -171,8 +193,13 @@ export function cli(rawArgv) {
   // `--open`: every result nothing applied, across the whole run, any phase. Exit 0 when none.
   if (args.open) {
     const open = openLegs(cwd, args.slug);
-    console.log(JSON.stringify({ closed: open.length === 0, open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id) }));
-    process.exit(open.length === 0 ? 0 : 1);
+    const unanswered = unansweredOrders(cwd, args.slug);
+    console.log(JSON.stringify({
+      closed: open.length === 0 && unanswered.length === 0,
+      open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id),
+      unanswered_total: unanswered.length, unanswered: unanswered.map((o) => o.order), unanswered_ids: unanswered.map((o) => o.order_id),
+    }));
+    process.exit(open.length === 0 && unanswered.length === 0 ? 0 : 1);
   }
   // `--order <stem>`: one order by file stem (`analyze`, `alpha-r1-a1`). Exit 0 when its leg closed.
   if (args.order) {

package/kernel/probe/resume.mjs

@@ -62,8 +62,9 @@ import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
 import { parseBoard } from "../reduce/board.mjs";
-import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir } from "../lib/paths.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir, gates, verdictsDir, roundBuildDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
+import { deriveRounds } from "./rounds.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
@@ -560,7 +561,83 @@ export function setRunStatus(cwd, slug, status) {
  *   already normalized prose (newlines collapsed, truncated) — this function only `uncoerce`s it.
  * @returns {string} The rewritten text.
  */
-function writeCloseLines(body, { status, closedAt, cause }) {
+/**
+ * What the ledger's front matter and tables should say at a close, derived from the run's own
+ * records — the same ones the export reads. The counters (`final_verdict`, `rounds_used`) and the
+ * Rounds/Decisions tables used to be hand-shaped placeholders nothing filled: a run closed
+ * `shipped` beside `final_verdict: ~`, `rounds_used: 0`, an empty Decisions table and seven rows in
+ * `gates.jsonl`. A reader who trusted the counters concluded no round ran. Measured live.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{final_verdict:string, rounds_used:(number|null), decisions:object[], roundRows:string[]}}
+ */
+export function deriveLedgerFacts(cwd, slug) {
+  const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+  const evalRows = [];
+  const rDir = resultsDir(cwd, slug);
+  if (existsSync(rDir)) {
+    for (const f of readdirSync(rDir)) {
+      const m = f.match(/^evaluate-r(\d+)\.json$/);
+      if (!m) continue;
+      const r = readJson(join(rDir, f));
+      const overall = r?.verdict?.overall;
+      if (overall) evalRows.push({ round: Number(m[1]), overall: String(overall), criteria: Array.isArray(r.verdict.criteria) ? r.verdict.criteria : [] });
+    }
+  }
+  evalRows.sort((a, b) => a.round - b.round);
+  const finalVerdict = evalRows.length ? evalRows[evalRows.length - 1].overall : "not-evaluated";
+  const decisions = [];
+  const gp = gates(cwd, slug);
+  if (existsSync(gp)) {
+    for (const line of readFileSync(gp, "utf8").split("\n")) {
+      if (!line.trim()) continue;
+      try { decisions.push(JSON.parse(line)); } catch { /* a torn line proves nothing */ }
+    }
+  }
+  const t0ByRound = {};
+  const vDir = verdictsDir(cwd, slug);
+  if (existsSync(vDir)) {
+    for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json")).sort()) {
+      const v = readJson(join(vDir, f));
+      if (typeof v?.round !== "number") continue;
+      const t = (t0ByRound[v.round] ||= { green: 0, red: 0 });
+      if (v.overall === "green") t.green++; else t.red++;
+    }
+  }
+  const gateByRound = {};
+  const bDir = roundBuildDir(cwd, slug);
+  if (existsSync(bDir)) {
+    for (const f of readdirSync(bDir).sort()) {
+      const m = f.match(/^r(\d+)-t\d+\.json$/);
+      if (m) gateByRound[Number(m[1])] = readJson(join(bDir, f))?.overall ?? "?";
+    }
+  }
+  const roundNums = [...new Set([...Object.keys(t0ByRound), ...Object.keys(gateByRound), ...evalRows.map((e) => e.round)].map(Number))].sort((a, b) => a - b);
+  const roundRows = [];
+  for (const r of roundNums) {
+    const t0 = t0ByRound[r], bg = gateByRound[r], ev = evalRows.find((e) => e.round === r);
+    roundRows.push(`| Build | ${r} | ${t0 ? `T0 ${t0.green} green / ${t0.red} red` : "no T0 verdict"} | — | round build gate: ${bg ?? "not run"} |`);
+    if (ev) {
+      const p = ev.criteria.filter((c) => c?.verdict === "PASS").length, f = ev.criteria.filter((c) => c?.verdict === "FAIL").length;
+      roundRows.push(`| Eval | ${r} | ${ev.overall} | — | ${p} PASS / ${f} FAIL criteria |`);
+    }
+  }
+  let roundsUsed = null;
+  try { roundsUsed = deriveRounds(cwd, slug, null)?.rounds_used ?? null; } catch { roundsUsed = null; }
+  if (roundsUsed == null && roundNums.length) roundsUsed = roundNums[roundNums.length - 1];
+  return { final_verdict: finalVerdict, rounds_used: roundsUsed, decisions, roundRows };
+}
+
+/** Replace the rows of one markdown table (identified by its header line) with `rows`, keeping the header, the separator and any row the caller marks as kept. */
+function rewriteTable(body, headerRe, rows, keepRow = null) {
+  return body.replace(headerRe, (m, header, sep, oldRows) => {
+    const kept = keepRow && oldRows ? oldRows.split("\n").filter((l) => l.startsWith(keepRow)) : [];
+    return header + sep + [...kept, ...rows].map((l) => `${l}\n`).join("");
+  });
+}
+
+function writeCloseLines(body, { status, closedAt, cause, derived = null }) {
   const causeLine = `close_cause: ${uncoerce(cause || null)}`;
   const closedStatusLine = `closed_status: ${status}`;
   let out = body
@@ -574,6 +651,15 @@ function writeCloseLines(body, { status, closedAt, cause }) {
   out = /^close_cause:.*$/m.test(out)
     ? out.replace(/^close_cause:.*$/m, causeLine)
     : out.replace(/^closed_at:.*$/m, (m) => `${m}\n${causeLine}`);
+  if (derived) {
+    // THE COUNTERS AND TABLES ARE DERIVED, IN THE SAME PASS AS THE CLOSE LINE. Written from the
+    // run's own records so they cannot disagree with the export that reads the same records.
+    if (/^final_verdict:.*$/m.test(out)) out = out.replace(/^final_verdict:.*$/m, `final_verdict: ${derived.final_verdict}`);
+    if (typeof derived.rounds_used === "number" && /^rounds_used:.*$/m.test(out)) out = out.replace(/^rounds_used:.*$/m, `rounds_used: ${derived.rounds_used}`);
+    out = rewriteTable(out, /(\| Phase \| Round \| Result \| Duration \| Notes \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, derived.roundRows, "| Init");
+    const decisionRows = derived.decisions.map((g) => `| ${g.gate ?? "?"} | ${g.decision ?? g.status ?? "?"} | ${g.source ?? "?"} | ${String(g.note ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").slice(0, 160)} |`);
+    out = rewriteTable(out, /(\| Gate \| Decision \| Source \| Note \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, decisionRows);
+  }
   return out;
 }
 
@@ -696,6 +782,9 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   // The Ship phase (`shapeup-run.js`) already exports a shipped run itself, before this call ever
   // runs — Stage 2 adds the endings that wrote nothing, and leaves that path untouched.
   const shouldExport = withExport && status !== "shipped";
+  // Derived once, from the run's own records, and written with the close line (see deriveLedgerFacts).
+  let derived = null;
+  try { derived = deriveLedgerFacts(cwd, slug); } catch { derived = null; }
 
   /**
    * Everything a close owes the checkout once the ledger line is written: export the run's
@@ -778,7 +867,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
     // new line rather than lost, and the return says so explicitly.
     const closedAt = new Date().toISOString();
     const foldedCause = `${normCause || "no reason recorded"} — supersedes an earlier close recorded ${priorClosedAt} (cause: ${JSON.stringify(priorCause)})`.slice(0, 4000);
-    body = writeCloseLines(body, { status, closedAt, cause: foldedCause });
+    body = writeCloseLines(body, { status, closedAt, cause: foldedCause, derived });
     try { writeFileSync(p, body); } catch (e) {
       return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
     }
@@ -793,7 +882,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   }
 
   const closedAt = new Date().toISOString();
-  body = writeCloseLines(body, { status, closedAt, cause: normCause });
+  body = writeCloseLines(body, { status, closedAt, cause: normCause, derived });
   try { writeFileSync(p, body); } catch (e) {
     return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
   }

package/kernel/reduce/ingest.mjs

@@ -187,11 +187,48 @@ export function setCheckbox(body, ac, checked) {
  * @param {boolean} done - When true, rewrite the row's status emoji/word to done; false is a no-op.
  * @returns {string} The board text with the matching row updated (unchanged when no row matches).
  */
-export function updateBoardRow(indexBody, taskId, done) {
+/**
+ * Is this index line the row FOR `taskId` — its first cell — rather than a row that merely
+ * mentions it? A task id appears in other rows' `Depends On` column, and matching by substring
+ * anywhere in the line flipped every dependent of a finished task to done along with it. Measured
+ * on a live run: the executor reported one task `skipped`, its task file still said `ready`, and
+ * the index showed it ✅ because the task it depended on had just been ticked. The census read the
+ * index.
+ * @param {string} line - One line of `tasks/_index.md`.
+ * @param {string} taskId - `TASK-NNN`.
+ * @returns {boolean}
+ */
+export function rowIs(line, taskId) {
+  const id = taskId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^\\|\\s*(?:\\[\\[)?${id}(?:\\\\\\|${id}\\]\\])?\\s*\\|`).test(line);
+}
+
+/**
+ * The status cell for one TaskResult status, or null when the index should not change.
+ * @param {(string|boolean)} status - A TaskResult status (`true` is accepted as `done` for callers written before skipped existed).
+ * @returns {({icon:string, word:string}|null)} The icon and word the index row should carry.
+ */
+export function boardCell(status) {
+  if (status === true || status === "done") return { icon: "✅", word: "done" };
+  if (status === "skipped") return { icon: "⏭", word: "skipped" };
+  if (status === "partial" || status === "failed") return { icon: "🔄", word: "in-progress" };
+  return null;
+}
+
+/**
+ * Rewrite one task's status cell in `tasks/_index.md` — the row whose id cell is `taskId`, never a
+ * row that merely mentions it in `Depends On`.
+ * @param {string} indexBody - The index file's text.
+ * @param {string} taskId - `TASK-NNN`.
+ * @param {(string|boolean)} status - A TaskResult status; statuses the index does not render leave it unchanged.
+ * @returns {string} The rewritten index text.
+ */
+export function updateBoardRow(indexBody, taskId, status) {
+  const cell = boardCell(status);
+  if (!cell) return indexBody;
   return indexBody.split(/\r?\n/).map((line) => {
-    if (!line.includes(taskId) || !line.includes("|")) return line;
-    if (done) return line.replace(/⬜|🔄|⏳|🚫/g, "✅").replace(/\b(ready|in-progress|blocked)\b/gi, "done");
-    return line;
+    if (!rowIs(line, taskId)) return line;
+    return line.replace(/⬜|🔄|⏳|🚫|✅|⏭/g, cell.icon).replace(/\b(ready|in-progress|blocked|done|skipped)\b/gi, cell.word);
   }).join("\n");
 }
 
@@ -240,14 +277,18 @@ function applyResultLocked(result, { cwd, slug }) {
       body = setFrontmatter(body, "completed_at", today());
     } else if (tr.status === "partial" || tr.status === "failed") {
       body = setFrontmatter(body, "status", "in-progress");
+    } else if (tr.status === "skipped") {
+      // Rendered as what it is. A skipped task used to leave its file at `ready` and, through the
+      // substring match above, could show ✅ on the index — the census read the index.
+      body = setFrontmatter(body, "status", "skipped");
     }
     // Execution Log (append; the checkbox list must never disagree with it).
     const logLines = (tr.ac_results || []).map((a) => `- ${a.ac}: ${a.result}${a.evidence ? ` (${a.evidence})` : ""}`).join("\n");
     body += `\n\n## Execution Log — ${today()} (${result.order_id})\n- executor: ${result.worker || "task-executor"} via ingest-result\n- status: ${tr.status}\n${logLines}${tr.notes ? `\n- notes: ${tr.notes}` : ""}\n`;
     writeFileSync(path, body);
     summary.tasks_updated.push(tr.task_id);
-    if (tr.status === "done" && existsSync(boardIndex)) {
-      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, true));
+    if (existsSync(boardIndex) && boardCell(tr.status)) {
+      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, tr.status));
     }
   }
 
@@ -271,7 +312,7 @@ function applyResultLocked(result, { cwd, slug }) {
         summary.unblocked.push(t.id);
         if (existsSync(boardIndex)) {
           const idx = readFileSync(boardIndex, "utf8").split(/\r?\n/).map((line) =>
-            line.includes(t.id) && line.includes("|")
+            rowIs(line, t.id)
               ? line.replace(/🚫|⏳/g, "⬜").replace(/\bblocked\b/gi, "ready")
               : line).join("\n");
           writeFileSync(boardIndex, idx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.5",
+  "version": "3.7.6",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/tech-lead/workflows/shapeup-run.js

@@ -482,6 +482,7 @@ const ORDERLEG = {
     closed: { type: "boolean" },
     found: { type: "boolean" },
     order: nullable("string"),
+    has_receipt: { type: "boolean" },
     has_result: { type: "boolean" },
     applied: { type: "boolean" },
   },
@@ -936,7 +937,18 @@ async function requireLeg(gate, phaseKey, phaseName, orderStem = phaseKey) {
   const ask = () => query(`probe leg --slug ${slug} --order "${orderStem}"`, ORDERLEG, phaseName, `legcheck:${orderStem}`);
   let leg = await ask();
   if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
-  if (!leg.has_result || leg.applied) return null;
+  if (!leg.has_result) {
+    // The artifact is on disk and the envelope never came back. Measured live: the first dispatch of
+    // a run wrote its four artifacts and no WorkResult, every later phase read the artifacts, and
+    // the run closed `shipped` over an order still open by construction. The phase stands on its
+    // artifact — that is what the post-condition checks — but the order is named at the close, and
+    // the next run over this slug will find it unanswered rather than be surprised by it.
+    log(`${gate} — "${phaseKey}" ${leg.has_receipt ? "was dispatched (receipt on disk) and" : "has an order but no receipt, and"} never answered: no WorkResult at all. ` +
+        `Its artifacts are on disk and the phase proceeds on them; the order stays unanswered and is named at the close.`);
+    if (leg.order && !unansweredOrders.includes(leg.order)) unansweredOrders.push(leg.order);
+    return null;
+  }
+  if (leg.applied) return null;
   log(`${gate} — "${phaseKey}" came back with a result nothing applied (no leg row). Ingesting it here: ${leg.order}.`);
   await advisory(`reduce ingest --order "${leg.order}"`, phaseName, `late-ingest:${phaseKey}`);
   leg = await ask();
@@ -1084,6 +1096,9 @@ async function requireLaunchRecord() {
 // it warns and continues — and the warning travels in the RunReturn, because a headless stdout
 // carries only the final message and a diagnostic on a channel nobody reads is not a diagnostic.
 const stateWarnings = [];
+// Orders a receipt says were dispatched and no WorkResult ever answered — a leg that did its craft
+// and never came back. Named at every close, whatever the close; never folded into "complete".
+const unansweredOrders = [];
 async function setRunStatus(status, phaseName) {
   const r = await cmd(`probe resume --slug ${slug} --set-status ${status}`, phaseName, `status:${status}`);
   if (!r.ok) {
@@ -1143,7 +1158,8 @@ async function closeIfTerminal(ret) {
   // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
   // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
   // stay silent for it exactly as they did when this file's own guard returned early.
-  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  const unanswered = unansweredOrders.length ? ` unanswered_orders=${unansweredOrders.length}` : "";
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause + unanswered)}"`, "Ship", `close:${ret.status}`);
   if (!r.ok) {
     const why = (r.detail || `exit ${r.exit_code}`).trim();
     log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +