shapeup-sdlc 3.7.8 → 3.7.12

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.8",
+  "version": "3.7.12",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/README.md

@@ -48,10 +48,12 @@ Two limits, stated here because the point of this section is that a claim withou
 behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
 and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
 the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
-and the cited verdict are checked, the scope, round and run the artifact belongs to are not. A T0
-artifact is also evidence about the machine that produced it: it records the tree and nothing
-about the toolchain or caches the commands resolved through. All three are open items in
-`shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
+and the cited verdict are checked, the scope, round and run the artifact belongs to are not. Both are
+open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees. A T0 artifact is
+also evidence about the machine that produced it, and now says so: each verdict carries where it
+ran — the absolute path, the git tree, the resolved toolchain, lockfile digests, declared cache
+directories and a digest over an allowlist of environment values — so a disagreeing re-run can be
+told from a regression. That block measures and judges nothing.
 → *Prevents: "done" asserted with nothing behind it.*
 
 **3. Parallel work can't corrupt shared state.** Each scope gets a write-whitelist of files

package/hooks/sandbox-guard.mjs

@@ -329,6 +329,11 @@ async function main() {
     allowed: [...(o.substrate.allowed || []), ...(o.substrate.shared || [])],
     appendOnly: o.substrate.append_only || [],
     frozen: o.substrate.frozen || [],
+    // The one exception to "frozen outranks everything", and it is the compiler's to grant, never
+    // the worker's to request: the paths THIS order authors, named from its own identity. A build
+    // leg's substrate freezes the whole run trace, so without this its own WorkResult — its
+    // documented last step — would be denied along with every channel it must not touch.
+    own: o.substrate.own || [],
   })).filter((c) => c.allowed.length || c.appendOnly.length || c.frozen.length);
 
   if (contracts.length === 0) defer("no live order declares write/append/frozen boundaries", "no-whitelist");
@@ -363,6 +368,10 @@ async function main() {
     // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
     // the exact state this hook exists to end. A path a live contract freezes is a violation
     // wherever it lives.
+    // `own` first, and only against the contract that declared it: another live order's exception
+    // never licenses this write. A path no contract claims as its own falls through to the freeze.
+    if (contracts.some((c) => matchesAny(rel, c.own, fold))) continue;
+
     const freezer = contracts.find((c) => matchesAny(rel, c.frozen, fold));
     if (freezer) {
       violations.push(rel);

package/kernel/compile.mjs

@@ -211,13 +211,37 @@ export const OP_OWNER = {
  * operation, so mode/flag differences are enforced by the sandbox hook reading the order's substrate, not trusted to prose.
  * @param {string} operation - The order's operation (execute|fix|spike|analyze|reconcile|
  *   retrofit-surface|coverage|map-scopes|wire|evaluate|orient|hunt|translate|hammer|coach|scan|research).
- * @param {{slug?:string, specDir?:string, scope?:object}} [ctx] - slug (names LOCAL/SHARED roots),
- *   specDir (overrides the default spec path), scope (contract supplying allowed/shared substrates).
- * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[]}} The
- *   substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
- *   `frozen` globs, and `append_only` globs. An unknown operation returns a LOCAL-only default.
+ * @param {{slug?:string, specDir?:string, scope?:object, ownStem?:string}} [ctx] - slug (names
+ *   LOCAL/SHARED roots), specDir (overrides the default spec path), scope (contract supplying
+ *   allowed/shared substrates), ownStem (this order's own file stem, so a build leg may write its
+ *   own WorkResult and no one else's).
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
+ *   `frozen` globs, `append_only` globs, and `own` — the paths this order may write DESPITE a
+ *   broader freeze, derived by the compiler from the order's own identity and never requested.
+ *   An unknown operation returns a LOCAL-only default.
  */
-export function substrateFor(operation, { slug, specDir, scope } = {}) {
+export function substrateFor(operation, ctx = {}) {
+  // EVERY ORDER NAMES THE RESULT IT ANSWERS WITH. A worker used to infer that path from its order's
+  // own filename — the one thing in the envelope that was convention rather than contract — so the
+  // one file every dispatch must write was the one the order did not mention. It is `own` for every
+  // operation now: the compiler derives it from the order's identity, which is also what keeps a leg
+  // from writing somebody else's.
+  const base = substrateTemplate(operation, ctx);
+  if (!ctx.ownStem) return base;
+  const ownResult = `${globLocal(ctx.slug)}/results/${ctx.ownStem}.json`;
+  return { ...base, own: [...new Set([...(base.own || []), ownResult])] };
+}
+
+/**
+ * The per-operation template {@link substrateFor} builds on.
+ *
+ * @param {string} operation - The order's operation.
+ * @param {object} [ctx] - As {@link substrateFor}: slug, specDir, scope, ownStem.
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The operation's write contract before the result path every order names is merged in.
+ */
+function substrateTemplate(operation, { slug, specDir, scope, ownStem = null } = {}) {
   const local = globLocal(slug);
   const spec = specDir || globShared(slug, "spec");
   const scopesDir = globShared(slug, "scopes");
@@ -266,15 +290,30 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
-      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
-      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
-      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
-      // order is live (no live contract yet — nothing to violate) and `translate` writes the
-      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
+      // THE RUN TRACE IS THE KERNEL'S, EXCEPT WHAT THIS LEG AUTHORS. The freeze used to be a list of
+      // channels a defect had named — the staged pitch, the receipts, the leg ledger, the T0
+      // verdicts, the board index — and each review found more of the same class: the trial ledger,
+      // the gate ledger, the round build gates, the graph, the run args, the run ledger itself. A
+      // list that grows one defect at a time is not a boundary. So the boundary is inverted here:
+      // everything under the run trace is frozen for a build leg, and `own` carries the short,
+      // derived list of what such a leg actually writes. Everything else under there is written by
+      // the kernel in its own process or by the hook layer, and neither goes through this guard —
+      // so freezing it costs no legitimate write. `${local}/**` subsumes FROZEN_INTAKE and
+      // FROZEN_ATTESTATION for this operation, and a check asserts that rather than restating them.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
-        frozen: [...FROZEN_INTAKE, ...FROZEN_ATTESTATION],
+        frozen: [`${local}/**`],
+        own: [
+          // The result this order answers with, and no sibling's: a leg that can write another
+          // leg's WorkResult can report work nobody did, and ingest would have no way to tell.
+          // With no stem the caller is asking about the operation in general, not about one order,
+          // and the honest answer is the whole directory rather than a guess at which file.
+          ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`]),
+          `${local}/tasks/TASK-*.md`,
+          `${local}/discovery/**`,
+          `${local}/spikes/**`,
+        ],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
@@ -315,9 +354,22 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
         frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${scopesDir}/**`, globShared(slug, "project-profile.md")],
       };
     case "evaluate":
-      return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      // THE JUDGE MAY NOT WRITE THE EVIDENCE IT CITES. Its substrate froze the spec, the pitch and
+      // the board — and not `t0/verdicts/**`, so a judge could write a green verdict artifact into
+      // the canonical directory under the run-trace carve-out and then cite it, correctly hashed.
+      // Same inversion as a build leg: the run trace is the kernel's, and `own` names what the
+      // judge authors — its report and the envelope that answers its order.
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/evaluation/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "hunt":
-      return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/qa/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "orient":
       return { allowed: [`${local}/orient/**`], frozen: [`${spec}/**`] };
     case "translate":
@@ -782,7 +834,7 @@ export function compileOrder({
     mode,
     ...(operation ? { operation } : {}),
     ...(interaction ? { interaction } : {}),
-    substrate: substrateFor(operation, { slug, specDir, scope }),
+    substrate: substrateFor(operation, { slug, specDir, scope, ownStem: suffix }),
     payload: {
       ...(scope ? { scope_contract: scope } : {}),
       ...(tasks?.length ? { tasks } : {}),

package/kernel/probe/eval.mjs

@@ -31,11 +31,11 @@
 // cause as its first deviation. A bare `ok: false` reached the operator as a sub-agent that died
 // after retries, while the one sentence naming the actual cause sat in a file nobody was pointed at.
 
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join, resolve, resolve as resolvePath, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir, readRunId } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId, verdictsDir } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -89,7 +89,7 @@ export function isScoped(cwd, slug) {
  * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
  *   hashes to the cited `sha256`, and its own `overall` reads "green".
  */
-function unresolvedCitation(cwd, citation, { round = null, runId = null } = {}) {
+function unresolvedCitation(cwd, citation, { round = null, runId = null, verdicts = null } = {}) {
   const rel = typeof citation?.path === "string" ? citation.path : "";
   if (!rel) return "names no artifact path";
   let text;
@@ -109,6 +109,19 @@ function unresolvedCitation(cwd, citation, { round = null, runId = null } = {})
   try { body = JSON.parse(text); }
   catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
   if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  // INSIDE THIS RUN'S OWN VERDICTS DIRECTORY, resolved — asked of a file that exists, so "does not
+  // exist" and "resolves somewhere else" stay different answers. Accepted before this check: a
+  // green artifact in the source tree, one outside the project reached by `../`, one by absolute
+  // path, and a symlink in the verdicts directory pointing at a forged file. Every one hashed
+  // correctly, because a digest says the bytes are the file's and nothing about which file it
+  // should have been.
+  if (verdicts) {
+    const real = (() => { try { return realpathSync.native(resolvePath(cwd, rel)); } catch { return resolvePath(cwd, rel); } })();
+    const home = (() => { try { return realpathSync.native(verdicts); } catch { return verdicts; } })();
+    if (!real.startsWith(home.endsWith(sep) ? home : home + sep)) {
+      return `cites ${rel}, which resolves outside this run's own verdicts directory (${home}) — a verdict cites what this run's own verifier wrote, not a file the judge can reach`;
+    }
+  }
   // THE ARTIFACT HAS TO BE THE ONE THE CITATION SAYS IT IS. A re-hash proves the bytes are the
   // file's; it says nothing about whose verdict the file holds. A PASS citing scope alpha's green
   // artifact while declaring scope beta, or a prior round's, or a prior run's over the same slug,
@@ -198,8 +211,9 @@ export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
       "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
   }
   const runId = readRunId(cwd, slug);
+  const verdicts = verdictsDir(cwd, slug);
   for (const citation of verdict.t0_citations) {
-    const reason = unresolvedCitation(cwd, citation, { round, runId });
+    const reason = unresolvedCitation(cwd, citation, { round, runId, verdicts });
     if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
   }
   return null;

package/kernel/probe/resume.mjs

@@ -65,6 +65,7 @@ import { parseBoard } from "../reduce/board.mjs";
 import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir, gates, verdictsDir, roundBuildDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 import { deriveRounds } from "./rounds.mjs";
+import { stagedWorkflowDrift, driftWarning } from "./staged.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
@@ -445,9 +446,11 @@ export function nextPhase(f) {
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
+ * @param {object} [opts] - `pluginRoot`, when the caller knows where the plugin it is running from
+ *   lives: the state then also reports whether the staged orchestrator is the installed one.
  * @returns {object} The ResumeState record (domain.schema.json $defs/ResumeState).
  */
-export function deriveResumeState(cwd, slug) {
+export function deriveResumeState(cwd, slug, { pluginRoot = null } = {}) {
   const hrPath = harnessRun(cwd, slug);
   const hr = existsSync(hrPath) ? parseFrontmatter(readFileSync(hrPath, "utf8")) : {};
 
@@ -517,7 +520,22 @@ export function deriveResumeState(cwd, slug) {
       .map((f) => Number(f.match(/\d+/)[0]))
       .filter((n) => evalVerdict(cwd, slug, n).found),
   };
-  return { ...facts, next_phase: nextPhase(facts) };
+  // WHICH ORCHESTRATOR THIS LAUNCH WILL RUN. A run keeps the workflow copy it opened with — right,
+  // and invisible: a relaunch after an upgrade executes the old one and reports normally, so every
+  // observation is of the previous release. Reported, never enforced (see probe/staged.mjs).
+  const staged = stagedWorkflowDrift(cwd, pluginRoot, slug);
+  const warning = driftWarning(staged);
+  return {
+    ...facts,
+    staged_workflow: {
+      checked: staged.checked,
+      drift: staged.drift.map((d) => d.file),
+      installed_version: staged.installed_version,
+      run_version: staged.run_version,
+      ...(warning ? { warning } : {}),
+    },
+    next_phase: nextPhase(facts),
+  };
 }
 
 /**
@@ -933,6 +951,9 @@ export const ARGV_SPEC = {
   // Not `--close`: the caller (shapeup-run.js's closeIfTerminal) hands over a RunReturn arm, never
   // a status it decided was terminal itself — RUN_RETURN_CLOSE/closeArm above make that call.
   "close-arm": { type: "str" },
+  // The launch hands its own plugin root so the state probe can say whether the orchestrator about
+  // to run is the installed one. Optional: a caller that does not know it gets `checked: false`.
+  "plugin-root": { type: "path" },
   cause: { type: "str" },
 };
 
@@ -1001,7 +1022,7 @@ export function cli(rawArgv) {
     process.exit(r.ok ? 0 : 3);
   }
 
-  console.log(JSON.stringify(deriveResumeState(cwd, args.slug)));
+  console.log(JSON.stringify(deriveResumeState(cwd, args.slug, { pluginRoot: args.pluginRoot ?? null })));
   process.exit(0);
 }
 

package/kernel/probe/staged.mjs

@@ -0,0 +1,83 @@
+// staged — is the orchestrator this launch will execute the one that is installed?
+//
+// A run stages its own copy of the workflow scripts into the local tier when it is OPENED, and
+// keeps that copy for the run's life. That is deliberate and right: an upgrade must not swap the
+// orchestrator under a run in flight. The consequence is not obvious from anywhere a person about
+// to soak an upgrade would look — relaunching an existing run after installing a new version
+// executes the OLD orchestrator, reports normally, closes normally, and every observation made of
+// it is an observation of the previous release. That is worse than a failed soak: it is confident
+// evidence about the wrong artifact.
+//
+// So the launch compares, and says so. A warning, never a block — the run keeping its copy is the
+// correct behaviour, and the operator is the one who decides whether this run is the one they
+// meant to measure.
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { workflowsStage, receipt, readReceipt } from "../lib/paths.mjs";
+
+const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+/** A file's digest, or null when it cannot be read. */
+function digestOf(path) {
+  try { return sha256(readFileSync(path)); } catch { return null; }
+}
+
+/** The version the plugin at `pluginRoot` declares, or null. */
+export function installedPluginVersion(pluginRoot) {
+  if (!pluginRoot) return null;
+  try { return JSON.parse(readFileSync(join(pluginRoot, ".claude-plugin", "plugin.json"), "utf8")).version ?? null; }
+  catch { return null; }
+}
+
+/**
+ * How the orchestrator this launch will run compares with the one installed.
+ *
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} pluginRoot - The installed plugin's root, as the launch knows it.
+ * @param {(string|null)} [slug] - The run, when the caller knows it — for the version the run opened under.
+ * @returns {object} `{checked, drift, staged_dir, plugin_root, installed_version, run_version}`.
+ *   `drift` lists each script whose staged copy differs from the installed one; `checked: false`
+ *   means the comparison could not be made (no plugin root, or nothing staged), which is not the
+ *   same fact as "they agree" and is reported as itself.
+ */
+export function stagedWorkflowDrift(cwd, pluginRoot, slug = null) {
+  const stagedDir = workflowsStage(cwd);
+  const srcDir = pluginRoot ? join(pluginRoot, "skills", "tech-lead", "workflows") : null;
+  const out = {
+    checked: false,
+    drift: [],
+    staged_dir: stagedDir,
+    plugin_root: pluginRoot ?? null,
+    installed_version: installedPluginVersion(pluginRoot),
+    run_version: slug ? (readReceipt(receipt(cwd, slug))?.plugin?.version ?? null) : null,
+  };
+  if (!srcDir || !existsSync(srcDir) || !existsSync(stagedDir)) return out;
+  let names;
+  try { names = readdirSync(stagedDir).filter((f) => f.endsWith(".js")).sort(); } catch { return out; }
+  if (!names.length) return out;
+  out.checked = true;
+  for (const f of names) {
+    const staged = digestOf(join(stagedDir, f));
+    const installed = digestOf(join(srcDir, f));
+    // A script the installed plugin no longer carries is drift too — the staged copy is running
+    // something that has no counterpart in what is installed.
+    if (staged !== installed) out.drift.push({ file: f, staged_sha256: staged, installed_sha256: installed });
+  }
+  return out;
+}
+
+/**
+ * The one-line warning a launch prints, or null when there is nothing to say.
+ * @param {object} d - A {@link stagedWorkflowDrift} result.
+ * @returns {(string|null)} Operator-facing text naming both versions.
+ */
+export function driftWarning(d) {
+  if (!d?.checked || !d.drift.length) return null;
+  const versions = d.run_version && d.installed_version && d.run_version !== d.installed_version
+    ? ` The run opened under plugin ${d.run_version}; ${d.installed_version} is installed.`
+    : d.installed_version ? ` Installed plugin: ${d.installed_version}.` : "";
+  return `the orchestrator this launch runs is NOT the installed one — ${d.drift.length} staged script(s) differ `
+    + `(${d.drift.map((x) => x.file).join(", ")}).${versions} A run keeps the copy it opened with, by design, so this `
+    + `launch measures the release the run was opened under. Open a NEW run to soak an upgrade.`;
+}

package/kernel/report/export.mjs

@@ -130,6 +130,11 @@ function t0Row(a, runId) {
     fixtures_green: a?.fixtures_green ?? null,
     db_probe_green: a?.db_probe_green ?? null,
     seesaw_green: a?.seesaw_green ?? null,
+    // One field a reader compares, and the block itself stays in the artifact for a human to diff:
+    // two rows with the same tree and different env digests are two machines, not a regression.
+    env_sha256: a?.env?.env_sha256 ?? null,
+    tree_head: a?.env?.tree?.head ?? null,
+    tree_dirty: a?.env?.tree?.dirty ?? null,
     fixtures_total: fixtures.length,
     fixtures_passed: fixtures.filter((f) => f?.pass === true).length,
     seesaw_ran: a?.seesaw?.ran ?? null,

package/kernel/schemas/domain.schema.json

@@ -542,7 +542,14 @@
           "items": {
             "type": "string"
           },
-          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior)."
+          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior). A build leg's order freezes the whole run trace here and carves out what it authors through `own`: a freeze that lists the channels a defect happened to name grows one defect at a time and is not a boundary."
+        },
+        "own": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Paths this order may write DESPITE a broader freeze — the compiler's grant, derived from the order's own identity and never requested by a worker. For a build leg: its own WorkResult (no sibling's — a leg that can write another's can report work nobody did), its task files, the discovery ledger, its spikes. Checked BEFORE `frozen`, and only against the contract that declared it, so another live order's exception never licenses this write."
         }
       }
     },
@@ -1354,6 +1361,21 @@
             "$ref": "#/$defs/AegisTriple"
           },
           "description": "Populated only on red; feeds the next order."
+        },
+        "env": {
+          "type": "object",
+          "description": "Where the fixtures ran — host, cwd, git tree, resolved toolchain paths, lockfile digests, profile-declared cache dirs, and a digest over an allowlist of environment variable VALUES (names in the clear, values never stored). `env_sha256` digests the whole block, so a reader compares one field and a human diffs the rest: two verdicts with the same tree and different digests were measured on different machines, which is a fact about portability rather than a regression. Written by kernel/verify/env.mjs, which judges nothing — no field here makes a verdict green or red.",
+          "properties": {
+            "schema_version": { "const": 1 },
+            "env_sha256": { "type": "string" },
+            "host": { "type": "object", "description": "platform, arch, os_release, node, hostname_sha256 (hashed — equality is all a reader needs)." },
+            "cwd": { "type": "string", "description": "Absolute: a path-keyed toolchain cache is identified by this." },
+            "tree": { "type": "object", "description": "git head, branch, and a dirty flag — which says something differs, never what." },
+            "toolchain": { "type": "array", "description": "Each invoked binary as written, and where it resolved on this machine (null when nothing resolved it)." },
+            "lockfiles": { "type": "array", "description": "Digest per lockfile present at the root. Says what was declared, never what is installed." },
+            "caches": { "type": ["array", "null"], "description": "Cache dirs the project profile declares, resolved. null means the profile declared none — NOT that there are none." },
+            "env": { "type": "object", "description": "The allowlist of variable names, and one digest over their values." }
+          }
         }
       }
     },
@@ -2652,6 +2674,17 @@
           "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
         },
         "has_board": { "type": "boolean", "description": "The per-machine board (tasks/TASK-*.md) holds at least one task. ANALYZE is complete only with both the committed spec tree and this; a committed tree with no board resumes at analyze, where the board-only operation regenerates it." },
+        "staged_workflow": {
+          "type": "object",
+          "description": "Whether the orchestrator this launch will execute is the installed one. A run stages its own copy of the workflow scripts when it is OPENED and keeps them for its life — right for a run in flight, and silent: relaunching after an upgrade executes the OLD orchestrator, reports normally, and every observation is of the previous release. `checked: false` means the comparison could not be made (no plugin root, nothing staged), which is not the same fact as agreement. A warning, never a block: opening a new run is how an upgrade is soaked.",
+          "properties": {
+            "checked": { "type": "boolean" },
+            "drift": { "type": "array", "items": { "type": "string" }, "description": "Staged scripts whose bytes differ from the installed plugin's." },
+            "installed_version": { "type": ["string", "null"] },
+            "run_version": { "type": ["string", "null"], "description": "The plugin version the run's receipt records — what this run actually opened under." },
+            "warning": { "type": "string" }
+          }
+        },
         "has_requirements": {
           "type": "boolean",
           "description": "The requirements registry is on disk: shapeup/<slug>/requirements.md exists. A PLAIN FACT, not a phase — the orchestrator guards its single `coverage` dispatch on this boolean, and it is deliberately absent from kernel/probe/resume.mjs's PHASE_ARTIFACT map, which doubles as nextPhase()'s ordered list: an entry there would fast-forward every run recorded before the registry existed to the registry instead of to build."

package/kernel/verify/env.mjs

@@ -0,0 +1,197 @@
+// env — the machine a T0 verdict was measured on.
+//
+// A T0 artifact records `exit 0`, `pass: true` and a captured tail, and the harness treats that as
+// the fact a generator cannot fabricate. What it did not record is that the command's outcome
+// depended on state outside the tree. Measured on a consumer whose toolchain resolves its build
+// plugins through a cache keyed by the project's ABSOLUTE PATH: the working tree built green; a
+// clone of the same commit at a different path failed on a registry 404; a clone with a
+// hand-seeded cache compiled a different plugin set and produced two errors the original never
+// saw. Three environments, three outcomes, one tree — and three byte-identical verdicts apart from
+// their captured output.
+//
+// The consequence is not that such a project is badly configured; that is its own problem. It is
+// that a green verdict is portable evidence in appearance only, and nothing in it said so. This
+// module records enough about where a command ran that two machines disagreeing can be told from a
+// regression. It measures and never judges: no field here makes a verdict green or red.
+//
+// WHAT IS DELIBERATELY NOT HERE. No wall clock — a duration is not an environment fact and invites
+// comparing speeds across machines. No dependency-tree manifest — the lockfile digest plus the
+// cache paths answer the decision this record exists for, and a manifest is unbounded. No raw
+// environment values: variables are hashed, never stored, and only from a declared allowlist.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { platform, arch, release, hostname } from "node:os";
+import { splitFrontmatter } from "../lib/contract.mjs";
+
+const sha256 = (t) => createHash("sha256").update(t).digest("hex");
+
+/** Lockfiles worth digesting, by ecosystem. Bounded on purpose — a glob would walk the tree. */
+export const LOCKFILES = [
+  "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb",
+  "oh-package-lock.json5", "Podfile.lock", "Gemfile.lock", "Cargo.lock", "go.sum",
+  "poetry.lock", "Pipfile.lock", "composer.lock", "gradle.lockfile", "pubspec.lock",
+];
+
+/**
+ * Environment variables whose VALUES are hashed into the fingerprint. Names are recorded in the
+ * clear; values never are. Kept short and reviewed — a wide allowlist is how a token ends up
+ * hashed into a record somebody later publishes.
+ */
+export const ENV_ALLOWLIST = ["PATH", "NODE_ENV", "CI", "LANG", "TZ"];
+
+/** What an unset variable hashes as — distinct from a variable set to the empty string. */
+const UNSET = "<unset>";
+
+/**
+ * The tokens a shell command actually invokes — one per `&&`/`;`/`||` segment, with `cd`, `env` and
+ * `VAR=value` prefixes stripped. Returns the token AS WRITTEN (`./scripts/t0-assemble.sh`,
+ * `/Applications/…/hvigorw`), because the resolved path is the signal a basename loses.
+ *
+ * @param {string} cmd - A shell command line.
+ * @returns {string[]} Invoked tokens, in order, without duplicates.
+ */
+export function cdTargets(cmd) {
+  const out = [];
+  for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
+    const m = seg.match(/^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
+    const dir = m && (m[1] || m[2] || m[3]);
+    if (dir && !dir.startsWith("-") && !out.includes(dir)) out.push(dir);
+  }
+  return out;
+}
+
+export function invokedTokens(cmd) {
+  const out = [];
+  for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
+    if (seg.startsWith("cd ")) continue;
+    const tokens = seg.split(/\s+/).filter((t) => t && !/^[A-Za-z_][A-Za-z0-9_]*=/.test(t) && t !== "env" && t !== "cd");
+    if (tokens.length && !out.includes(tokens[0])) out.push(tokens[0]);
+  }
+  return out;
+}
+
+/** Where a token resolves on this machine, or null when nothing resolves it. */
+function resolveBin(token, cwd) {
+  try {
+    const r = spawnSync(`command -v ${JSON.stringify(token)}`, { shell: true, cwd, encoding: "utf8", timeout: 10_000 });
+    const p = (r.stdout || "").trim().split("\n")[0];
+    return p || null;
+  } catch { return null; }
+}
+
+/** `git rev-parse HEAD` plus whether the tree is dirty. All null outside a repository. */
+function treeState(cwd) {
+  const git = (args) => {
+    try {
+      const r = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 20_000 });
+      return r.status === 0 ? (r.stdout || "").trim() : null;
+    } catch { return null; }
+  };
+  const head = git(["rev-parse", "HEAD"]);
+  if (head === null) return { head: null, dirty: null, branch: null };
+  const porcelain = git(["status", "--porcelain"]);
+  return {
+    head,
+    // A dirty flag says "something differs", never what — the honest limit of one boolean, and the
+    // reason `head` alone cannot call two measurements the same measurement.
+    dirty: porcelain === null ? null : porcelain.length > 0,
+    branch: git(["rev-parse", "--abbrev-ref", "HEAD"]),
+  };
+}
+
+/**
+ * Cache directories the project profile declares, resolved. A path-keyed cache is identified by its
+ * path, which is exactly the mechanism that made one tree build three ways.
+ *
+ * `null` means the profile declared nothing — NOT that there are none. "Not asked" and "none" are
+ * different facts, and collapsing them is the mistake the seesaw arm already makes elsewhere.
+ *
+ * @param {(string|null)} profilePath - `shapeup/<slug>/project-profile.md`, when the caller knows it.
+ * @returns {(object[]|null)} One entry per declared cache, or null when none is declared.
+ */
+export function declaredCaches(profilePath) {
+  if (!profilePath || !existsSync(profilePath)) return null;
+  let meta;
+  try { meta = splitFrontmatter(readFileSync(profilePath, "utf8")).meta || {}; } catch { return null; }
+  const raw = meta.cache_dirs ?? meta.caches ?? null;
+  const list = Array.isArray(raw)
+    ? raw
+    : typeof raw === "string" && raw.trim() && raw.trim() !== "~"
+      ? raw.replace(/^\[|\]$/g, "").split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean)
+      : null;
+  if (!list || !list.length) return null;
+  return list.map((p) => {
+    const path = p.startsWith("~") ? join(process.env.HOME || "", p.slice(1)) : p;
+    let mtime = null;
+    try { mtime = statSync(path).mtime.toISOString(); } catch { /* absent is a fact, not an error */ }
+    return { declared: p, path, exists: existsSync(path), mtime };
+  });
+}
+
+/**
+ * Stable JSON: object keys sorted at every depth, so a digest does not depend on insertion order.
+ * @param {*} value - Anything JSON-representable.
+ * @returns {string} The canonical form.
+ */
+export function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value ?? null);
+}
+
+/**
+ * The environment block a T0 verdict carries.
+ *
+ * @param {string} rawCwd - The directory the fixtures ran in; resolved to an absolute path here.
+ * @param {object} [opts] - `commands` (the fixture command lines) and `profilePath`.
+ * @returns {object} `{schema_version, host, cwd, tree, toolchain, lockfiles, caches, env, env_sha256}`.
+ *   `env_sha256` digests the block itself, so a reader compares one field and a human diffs the
+ *   rest. Without the digest every consumer re-implements the comparison and they disagree, which
+ *   is three key spaces for one id waiting to happen on a new record.
+ */
+export function environmentFingerprint(rawCwd, { commands = [], profilePath = null } = {}) {
+  // ABSOLUTE, always. A caller that ran with `--cwd .` would otherwise record "." as the place —
+  // and the place is the whole point: the cache that made one tree build three ways is keyed by
+  // the project's absolute path.
+  const cwd = resolve(rawCwd || process.cwd());
+  const tokens = [...new Set(commands.flatMap((c) => invokedTokens(c)))];
+  const block = {
+    schema_version: 1,
+    host: {
+      platform: platform(),
+      arch: arch(),
+      os_release: release(),
+      node: process.version,
+      // Hashed: equality is all a reader needs, and a hostname names a person's laptop.
+      hostname_sha256: sha256(hostname()),
+    },
+    cwd,
+    tree: treeState(cwd),
+    toolchain: tokens.map((bin) => ({ bin, path: resolveBin(bin, cwd) })),
+    // The root AND wherever the commands actually run. Measured on a consumer whose fixtures are
+    // `cd app && …`: the lockfile that decides what the build resolves lives in `app/`, and a scan
+    // of the project root alone recorded an empty list beside a build whose dependencies were the
+    // whole question.
+    lockfiles: [...new Set(["", ...commands.flatMap((c) => cdTargets(c))])]
+      .flatMap((sub) => LOCKFILES
+        .map((f) => (sub ? `${sub.replace(/\/+$/, "")}/${f}` : f))
+        .filter((rel) => existsSync(join(cwd, rel)))
+        .map((rel) => {
+          try { return { file: rel, sha256: sha256(readFileSync(join(cwd, rel))) }; }
+          catch { return { file: rel, sha256: null }; }
+        }))
+      .filter((l, i, all) => all.findIndex((x) => x.file === l.file) === i),
+    caches: declaredCaches(profilePath),
+    env: {
+      allowlist: ENV_ALLOWLIST,
+      // One digest over the allowlisted names AND values: a PATH that changed shows up, and no
+      // value is stored.
+      sha256: sha256(ENV_ALLOWLIST.map((k) => `${k}=${process.env[k] ?? UNSET}`).join("\n")),
+    },
+  };
+  return { ...block, env_sha256: sha256(canonical(block)) };
+}

package/kernel/verify/spec.mjs

@@ -422,6 +422,9 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
   return findings;
 }
 
+/** Registry sources that name the pitch's own out-of-scope section, in the spellings pitches use. */
+const NOGO_SOURCE = /\bno[-\s]?gos?\b|\bnon[-\s]?goals?\b|\bout[-\s]of[-\s]scope\b|\bwill not build\b/i;
+
 /**
  * REQ-UNCOVERED — a live requirement that nothing in the plan reaches.
  *
@@ -451,6 +454,57 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
  * @returns {Array<{rule:string, level:("red"|"warn"), scope:string, detail:string}>} One red per
  *   uncovered live requirement; [] when every one is graded, claimed or cut.
  */
+/**
+ * REQ-NARRATED — a committed spec file stating the requirement-coverage verdict as fact.
+ *
+ * The Health Dashboard's `Coverage` row is about USE CASES and tasks, derived by inverting each
+ * task's `use_case_refs` over the local board. Measured on a consumer, a worker filled its Signal
+ * cell with a different claim entirely — *"every registered non-CUT REQ-id (REQ-1 … REQ-7) reaches
+ * an AC carrying `(covers: REQ-…)`"*, with a 🟢 beside it — while a grep for `covers:` across the
+ * whole spec folder returned that sentence and nothing else. Not one acceptance criterion carried
+ * the clause, and the run's own derived report said `0/11 PASS`.
+ *
+ * `AGENTS.md` names the invariant this breaks: the requirements matrix is a projection, never a
+ * verdict, derived from files for one named run and never narrated. The rule is the narrow,
+ * checkable form of it — a dashboard Coverage row in a committed file may not name a REQ id — and
+ * it cannot fire on the legitimate signal, which counts use cases and tasks.
+ *
+ * @param {{cwd:string, slug:string}} opts - Working root and feature slug.
+ * @returns {object[]} Findings, one per offending line.
+ */
+export function lintNarratedCoverage({ cwd, slug }) {
+  const findings = [];
+  const dir = join(sharedRoot(cwd, slug), "spec");
+  let files;
+  try { files = readdirSync(dir).filter((f) => f.endsWith(".md")); } catch { return findings; }
+  for (const f of files) {
+    let lines;
+    try { lines = readFileSync(join(dir, f), "utf8").split(/\r?\n/); } catch { continue; }
+    lines.forEach((line, i) => {
+      if (!/^\|\s*Coverage\s*\|/i.test(line.trim())) return;
+      const named = [...line.matchAll(/\bREQ-\d+/g)].map((m) => m[0]);
+      if (!named.length) return;
+      findings.push({ rule: "REQ-NARRATED", level: "red", scope: `${f}:${i + 1}`, detail:
+        `${f}:${i + 1} states the requirement-coverage verdict in a committed file, naming ${named.slice(0, 3).join(", ")}` +
+        `${named.length > 3 ? ` (+${named.length - 3})` : ""}. That row is the UC × Task indicator; the ` +
+        "REQ → AC → criterion → verdict state is a projection derived per run (probe requirements), " +
+        "never a claim a committed artifact may make — a reader who checks the file finds corroboration " +
+        "for something no run measured. Say what the use cases and tasks show, and leave the requirement " +
+        "matrix to the run that derives it." });
+    });
+  }
+  return findings;
+}
+
+/**
+ * REQ-UNCOVERED and REQ-NOGO — the registry's two ways of being wrong about what ships.
+ *
+ * @param {{clauses:object[], board:object[], scopes:object[]}} opts - The parsed registry, the
+ *   board `readBoard` produced (its acceptance criteria carry the covers clauses), and the scope
+ *   contracts.
+ * @returns {object[]} Findings, most specific first: a no-go registered as covered is reported as
+ *   itself rather than as the coverage gap it inevitably becomes.
+ */
 export function lintRequirementCoverage({ clauses = [], board = [], scopes = [] }) {
   const findings = [];
   const graded = coveredReqIds(board);
@@ -459,6 +513,21 @@ export function lintRequirementCoverage({ clauses = [], board = [], scopes = []
   const claimed = new Set();
   for (const s of scopes) for (const r of s.covers || []) claimed.add(reqId(r).toUpperCase());
   for (const c of clauses) {
+    // A NO-GO IS A CONSTRAINT, NOT A DELIVERABLE, and marking one `covered` asserts something that
+    // cannot be true: nothing grades "do not build a settings screen". Measured on a consumer — a
+    // coverage dispatch lifted seven clauses out of the pitch's No-gos section, registered each as
+    // covered, and L1b then refused the run with seven REQ-UNCOVERED findings, correctly and
+    // unavoidably. Reported here as itself, so the operator reads one cause instead of seven
+    // symptoms, and named before REQ-UNCOVERED can fire on the same row.
+    if (c.status === "covered" && NOGO_SOURCE.test(c.source || "")) {
+      findings.push({ rule: "REQ-NOGO", level: "red", scope: c.id, detail:
+        `${c.id} ← ${c.source} registers a NO-GO as a covered requirement — "${(c.clause || "").slice(0, 60)}". ` +
+        "A no-go is a constraint the shape deliberately does not build, so no acceptance criterion can " +
+        "grade it and nothing downstream can ever turn it green. Mark it CUT (PO-approved) in " +
+        "requirements.md — the family that already means deliberately-not-built — or drop the row and give " +
+        "the breach a Test Surface row (TS-NOGO-NN) instead, which is the channel that does grade one." });
+      continue;
+    }
     if (c.status !== "covered") continue; // CUT (PO-approved) — an answer on the record, not a gap
     const id = c.id.toUpperCase();
     if (graded.has(c.id) || claimed.has(id)) continue;
@@ -851,6 +920,7 @@ export function lint({ cwd, slug }) {
     // `readBoard`, not the `tasks` above: only the compile-order parser carries acceptance_criteria.
     ...lintRequirementCoverage({ clauses: reqClauses, board: readBoard(cwd, slug), scopes }),
     ...lintCommittedTier({ cwd, slug }),
+    ...lintNarratedCoverage({ cwd, slug }),
     ...lintStructure({ specDir: specRoot, tasks, intakeContent }),
     ...(() => {
       const bbText = runBreadboard(cwd, slug, intakeContent);

package/kernel/verify/t0.mjs

@@ -40,10 +40,11 @@ import { join, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { digest } from "../probe/digest.mjs";
+import { environmentFingerprint } from "./env.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { snapshot, restore, keptRef } from "./ratchet-tree.mjs";
 import { readContract, SCOPE_CONTRACT } from "../lib/contract.mjs";
-import { runIdFromRoot, localRoot, SHARED } from "../lib/paths.mjs";
+import { runIdFromRoot, localRoot, SHARED, projectProfile } from "../lib/paths.mjs";
 
 /**
  * The feature slug a scope contract belongs to, from its path.
@@ -193,13 +194,17 @@ export function runDbProbe(dbProbeCmd, cwd) {
  */
 export function seesawCheck(registryPath, cwd) {
   if (!registryPath || !existsSync(registryPath)) {
-    return { ran: false, pass: true, scopes_checked: [], failing: [] };
+    // `pass: null`, not `pass: true`: a check that did not run has no result, and recording one as
+    // clean is how "not asked" came to read as "nothing regressed". The verdict below still treats
+    // an absent seesaw as non-blocking — that part is deliberate while the arm is unwired — but the
+    // artifact now says which of the two it was.
+    return { ran: false, pass: null, scopes_checked: [], failing: [] };
   }
   let registry;
   try {
     registry = JSON.parse(readFileSync(registryPath, "utf8"));
   } catch {
-    return { ran: false, pass: true, scopes_checked: [], failing: [], error: "registry unparsable" };
+    return { ran: false, pass: null, scopes_checked: [], failing: [], error: "registry unparsable" };
   }
   const scopes = registry.scopes || [];
   const failing = [];
@@ -221,7 +226,12 @@ export function seesawCheck(registryPath, cwd) {
 export function computeVerdict({ fixtures, dbProbe, seesaw }) {
   const fixturesGreen = fixtures.pass;
   const dbGreen = dbProbe === null || dbProbe.pass;
-  const seesawGreen = !seesaw.ran || seesaw.pass;
+  // A seesaw that did not run does not hold the verdict red — the arm is declared and unwired, and
+  // blocking every build on it would be a different defect. It does not make it green either: the
+  // hill requires `ran && pass` before a scope may reach FINISHED, and `seesaw_green` here means
+  // "nothing this check found is wrong", which is true of a check that found nothing because it
+  // never looked.
+  const seesawGreen = seesaw.ran ? seesaw.pass === true : true;
   return {
     fixtures_green: fixturesGreen,
     db_probe_green: dbGreen,
@@ -576,6 +586,14 @@ export async function cli(rawArgv) {
   const { path, sha256: hash, trial } = writeArtifact(outDir, round, attempt, {
     ...(runId ? { run_id: runId } : {}),
     scope_id: contract.scope_id,
+    // WHERE IT RAN, beside what it measured. A verdict that records only the tree is portable
+    // evidence in appearance only: the same commit built three ways on three machines because the
+    // toolchain resolved through a path-keyed cache. This block does not judge — it is what lets a
+    // disagreeing re-run be told from a regression (see verify/env.mjs).
+    env: environmentFingerprint(cwd, {
+      commands: [...fixtures.results.map((r) => r.cmd), ...(dbProbe?.cmd ? [dbProbe.cmd] : [])],
+      profilePath: projectProfile(cwd, slugFromContractPath(contractPath)),
+    }),
     // The evidence, not just the score — see `commandEvidence` for what the three-field record
     // could not tell apart, and why `exit` still reads the way it always did.
     fixtures: fixtures.results.map((r) => commandEvidence(r)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.8",
+  "version": "3.7.12",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/assets/templates/synthesis.tmpl.md

@@ -26,6 +26,11 @@ depends_on:
 
 | Indicator | Status | Signal |
 |-----------|--------|--------|
+<!-- Coverage here is USE CASES × TASKS, derived by inverting each task's use_case_refs over the
+     local board. It is NOT requirement coverage: whether every REQ-id reaches an acceptance
+     criterion that a judge graded is a projection derived per run (`probe requirements`), and a
+     committed file that states it is corroborating something no run measured. Name REQ ids in this
+     row and spec-lint reds it (REQ-NARRATED). Count use cases and tasks; say nothing about REQ. -->
 | Coverage | COVERAGE_STATUS | COVERAGE_SIGNAL |
 | Risk | RISK_STATUS | RISK_SIGNAL |
 | Dependency | DEPENDENCY_STATUS | DEPENDENCY_SIGNAL |

package/skills/tech-lead/workflows/shapeup-run.js

@@ -414,6 +414,16 @@ const RESUME = {
     has_orient_artifacts: { type: "boolean" },
     has_spec_tree: { type: "boolean" },
     has_board: { type: "boolean" },
+    staged_workflow: {
+      type: "object",
+      properties: {
+        checked: { type: "boolean" },
+        drift: { type: "array", items: { type: "string" } },
+        installed_version: nullable("string"),
+        run_version: nullable("string"),
+        warning: { type: "string" },
+      },
+    },
     // The requirements registry — a fact, not a phase. See the COVERAGE block below for why it is
     // guarded on this bare boolean and never asked about through `probe resume --require`.
     has_requirements: { type: "boolean" },
@@ -1232,7 +1242,14 @@ if (launchRecordAbort) return await withWarnings(launchRecordAbort);
 
 phase("Orient");
 
-const rs = await query(`probe resume --slug ${slug}`, RESUME, "Orient", "resume-state");
+const rs = await query(`probe resume --slug ${slug} --plugin-root "${args.pluginRoot}"`, RESUME, "Orient", "resume-state");
+// WHICH ORCHESTRATOR IS RUNNING. A run keeps the workflow copy it opened with — correct for a run
+// in flight, and silent: a relaunch after an upgrade executes the old script, reports normally and
+// closes normally, so every observation is of the previous release. Said out loud, never enforced.
+if (rs.staged_workflow?.warning) {
+  log(`RUN STATE — ${rs.staged_workflow.warning}`);
+  stateWarnings.push(rs.staged_workflow.warning);
+}
 // A probe that produced nothing is not an EMPTY run — it is an unknown one. Treating it as empty
 // would re-dispatch every phase from the top, over a run that may be in progress.
 if (!rs) {