shapeup-sdlc 3.7.9 → 3.8.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.9",
+  "version": "3.8.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -35,7 +35,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). The tree is committed and the board is per-machine: a run that finds the tree on disk and no board dispatches `board`, which regenerates the board from the tree without re-deriving it — GATE L2 refuses `proceed` over a board with zero tasks. An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
-| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
+| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
 
@@ -63,7 +63,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
 - **The requirements matrix is a projection, never a verdict** — `REQ → AC → criterion → verdict` is derived from files for one named run (the registry, the board's `covers:` clauses, the run's verdict rows, the T0 citations), never narrated and never passed in. `covers:` is the authoritative join: a criterion anchored to a requirement no AC covers is printed for reconciliation and counted as nothing. L4 reads one line off it, GATE H's census takes the clauses with no evidence, `REPORT.md` freezes the table — and none of that blocks a ship. A clause with no PASS evidence is a fact the baseline comparison weighs, not a veto.
-- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts (the seesaw arm is declared, not yet wired), never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
+- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts, never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution

package/README.md

@@ -45,11 +45,11 @@ its fixtures and its DB probe and writes an artifact to disk — with each comma
 its captured output, and whether it ran at all. The evaluator must cite that artifact, and the
 hill phase is derived from artifacts rather than from a worker's own account of its progress.
 Two limits, stated here because the point of this section is that a claim without a mechanism
-behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
-and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
-the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
-and the cited verdict are checked, the scope, round and run the artifact belongs to are not. Both are
-open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees. A T0 artifact is
+behind it is the thing this harness exists to prevent: a citation is re-hashed from disk, checked
+against the scope, round and run the artifact records, and refused unless it names a file this
+run's own verifier wrote — what that does NOT prove is that a judge with a dishonest hand could
+not have arranged the artifact first, which is why the judge's own substrate freezes the verdicts
+directory. A T0 artifact is
 also evidence about the machine that produced it, and now says so: each verdict carries where it
 ran — the absolute path, the git tree, the resolved toolchain, lockfile digests, declared cache
 directories and a digest over an allowlist of environment values — so a disagreeing re-run can be
@@ -132,8 +132,7 @@ rest of this README after this table and nothing will be a surprise.
 |---|---|
 | **board** | The round's task list. "Green" means every task is done. GATE L2's hook reads this before an evaluation and warns if it is not green. |
 | **round** | One build → evaluate cycle. A FAIL verdict starts round *r+1*. |
-| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe (the seesaw arm is declared and not yet wired — see §2 above). Writes an artifact to disk that the evaluator must cite. |
-| **seesaw** | The regression arm of T0, meant to re-run *other* scopes' fixtures so a regression is never mistaken for progress. Declared, not yet wired: no run writes its registry, so no run has executed it. |
+| **T0** | The smoke test a scope must pass before it counts as built: its fixtures and a DB probe. Writes an artifact to disk that the evaluator must cite. |
 | **substrate** | The exact list of files one dispatch is allowed to write, stamped into its work order. A hook blocks anything outside it — and anything the order marks frozen. |
 | **scope contract** | The file defining one vertical slice: its substrate, its fixtures, its affordances. |
 | **affordance** | The thing a user can actually click, type or call. UI is graded on affordances, not on looks. |
@@ -309,8 +308,8 @@ These hold across the harness and are the reason it stays predictable:
   of blocking the round. An opt-in third breaker bounds the **wall clock**, because the other two
   count events and neither can notice a single round running for half an hour — tripping it routes
   to GATE H, so a run out of time ships what is green instead of being killed and shipping nothing.
-- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts (the seesaw
-  arm is declared, not yet wired), closing the self-reported-confidence risk. A scope with no
+- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts, closing the
+  self-reported-confidence risk. A scope with no
   discovery ledger derives no phase rather than a solved one, so absence no longer reads as
   progress on that arm.
 - **One writer per shared file** — every board/ledger/verdict write goes through

package/hooks/sandbox-guard.mjs

@@ -329,6 +329,11 @@ async function main() {
     allowed: [...(o.substrate.allowed || []), ...(o.substrate.shared || [])],
     appendOnly: o.substrate.append_only || [],
     frozen: o.substrate.frozen || [],
+    // The one exception to "frozen outranks everything", and it is the compiler's to grant, never
+    // the worker's to request: the paths THIS order authors, named from its own identity. A build
+    // leg's substrate freezes the whole run trace, so without this its own WorkResult — its
+    // documented last step — would be denied along with every channel it must not touch.
+    own: o.substrate.own || [],
   })).filter((c) => c.allowed.length || c.appendOnly.length || c.frozen.length);
 
   if (contracts.length === 0) defer("no live order declares write/append/frozen boundaries", "no-whitelist");
@@ -363,6 +368,10 @@ async function main() {
     // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
     // the exact state this hook exists to end. A path a live contract freezes is a violation
     // wherever it lives.
+    // `own` first, and only against the contract that declared it: another live order's exception
+    // never licenses this write. A path no contract claims as its own falls through to the freeze.
+    if (contracts.some((c) => matchesAny(rel, c.own, fold))) continue;
+
     const freezer = contracts.find((c) => matchesAny(rel, c.frozen, fold));
     if (freezer) {
       violations.push(rel);

package/kernel/compile.mjs

@@ -211,13 +211,37 @@ export const OP_OWNER = {
  * operation, so mode/flag differences are enforced by the sandbox hook reading the order's substrate, not trusted to prose.
  * @param {string} operation - The order's operation (execute|fix|spike|analyze|reconcile|
  *   retrofit-surface|coverage|map-scopes|wire|evaluate|orient|hunt|translate|hammer|coach|scan|research).
- * @param {{slug?:string, specDir?:string, scope?:object}} [ctx] - slug (names LOCAL/SHARED roots),
- *   specDir (overrides the default spec path), scope (contract supplying allowed/shared substrates).
- * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[]}} The
- *   substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
- *   `frozen` globs, and `append_only` globs. An unknown operation returns a LOCAL-only default.
+ * @param {{slug?:string, specDir?:string, scope?:object, ownStem?:string}} [ctx] - slug (names
+ *   LOCAL/SHARED roots), specDir (overrides the default spec path), scope (contract supplying
+ *   allowed/shared substrates), ownStem (this order's own file stem, so a build leg may write its
+ *   own WorkResult and no one else's).
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
+ *   `frozen` globs, `append_only` globs, and `own` — the paths this order may write DESPITE a
+ *   broader freeze, derived by the compiler from the order's own identity and never requested.
+ *   An unknown operation returns a LOCAL-only default.
  */
-export function substrateFor(operation, { slug, specDir, scope } = {}) {
+export function substrateFor(operation, ctx = {}) {
+  // EVERY ORDER NAMES THE RESULT IT ANSWERS WITH. A worker used to infer that path from its order's
+  // own filename — the one thing in the envelope that was convention rather than contract — so the
+  // one file every dispatch must write was the one the order did not mention. It is `own` for every
+  // operation now: the compiler derives it from the order's identity, which is also what keeps a leg
+  // from writing somebody else's.
+  const base = substrateTemplate(operation, ctx);
+  if (!ctx.ownStem) return base;
+  const ownResult = `${globLocal(ctx.slug)}/results/${ctx.ownStem}.json`;
+  return { ...base, own: [...new Set([...(base.own || []), ownResult])] };
+}
+
+/**
+ * The per-operation template {@link substrateFor} builds on.
+ *
+ * @param {string} operation - The order's operation.
+ * @param {object} [ctx] - As {@link substrateFor}: slug, specDir, scope, ownStem.
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The operation's write contract before the result path every order names is merged in.
+ */
+function substrateTemplate(operation, { slug, specDir, scope, ownStem = null } = {}) {
   const local = globLocal(slug);
   const spec = specDir || globShared(slug, "spec");
   const scopesDir = globShared(slug, "scopes");
@@ -266,15 +290,30 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
-      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
-      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
-      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
-      // order is live (no live contract yet — nothing to violate) and `translate` writes the
-      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
+      // THE RUN TRACE IS THE KERNEL'S, EXCEPT WHAT THIS LEG AUTHORS. The freeze used to be a list of
+      // channels a defect had named — the staged pitch, the receipts, the leg ledger, the T0
+      // verdicts, the board index — and each review found more of the same class: the trial ledger,
+      // the gate ledger, the round build gates, the graph, the run args, the run ledger itself. A
+      // list that grows one defect at a time is not a boundary. So the boundary is inverted here:
+      // everything under the run trace is frozen for a build leg, and `own` carries the short,
+      // derived list of what such a leg actually writes. Everything else under there is written by
+      // the kernel in its own process or by the hook layer, and neither goes through this guard —
+      // so freezing it costs no legitimate write. `${local}/**` subsumes FROZEN_INTAKE and
+      // FROZEN_ATTESTATION for this operation, and a check asserts that rather than restating them.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
-        frozen: [...FROZEN_INTAKE, ...FROZEN_ATTESTATION],
+        frozen: [`${local}/**`],
+        own: [
+          // The result this order answers with, and no sibling's: a leg that can write another
+          // leg's WorkResult can report work nobody did, and ingest would have no way to tell.
+          // With no stem the caller is asking about the operation in general, not about one order,
+          // and the honest answer is the whole directory rather than a guess at which file.
+          ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`]),
+          `${local}/tasks/TASK-*.md`,
+          `${local}/discovery/**`,
+          `${local}/spikes/**`,
+        ],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
@@ -315,9 +354,22 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
         frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${scopesDir}/**`, globShared(slug, "project-profile.md")],
       };
     case "evaluate":
-      return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      // THE JUDGE MAY NOT WRITE THE EVIDENCE IT CITES. Its substrate froze the spec, the pitch and
+      // the board — and not `t0/verdicts/**`, so a judge could write a green verdict artifact into
+      // the canonical directory under the run-trace carve-out and then cite it, correctly hashed.
+      // Same inversion as a build leg: the run trace is the kernel's, and `own` names what the
+      // judge authors — its report and the envelope that answers its order.
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/evaluation/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "hunt":
-      return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/qa/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "orient":
       return { allowed: [`${local}/orient/**`], frozen: [`${spec}/**`] };
     case "translate":
@@ -782,7 +834,7 @@ export function compileOrder({
     mode,
     ...(operation ? { operation } : {}),
     ...(interaction ? { interaction } : {}),
-    substrate: substrateFor(operation, { slug, specDir, scope }),
+    substrate: substrateFor(operation, { slug, specDir, scope, ownStem: suffix }),
     payload: {
       ...(scope ? { scope_contract: scope } : {}),
       ...(tasks?.length ? { tasks } : {}),

package/kernel/lib/argv.mjs

@@ -8,11 +8,11 @@
 //     const SPEC = {
 //       _:           { arity: 1, name: "scope-contract.json" },
 //       round:       { type: "int", min: 1, required: true },
-//       "no-seesaw": { type: "flag" },
+//       "no-ratchet": { type: "flag" },
 //     };
-//     const args = runArgs(SPEC, argv);   // args.round, args.noSeesaw, args._
+//     const args = runArgs(SPEC, argv);   // args.round, args.noRatchet, args._
 //
-// Flag names reach the caller camelCased (`--no-seesaw` → `noSeesaw`). Unknown flags are rejected
+// Flag names reach the caller camelCased (`--no-ratchet` → `noRatchet`). Unknown flags are rejected
 // rather than swallowed as positionals: a typo'd `--rounds 2` landing in `_` is the same defect
 // wearing a different hat. Untyped coercion is the failure this guards — `Number(undefined)` is
 // `NaN`, `??` does not catch `NaN`, and a verdict written to `r NaN-a1.json` with exit 0 is
@@ -35,7 +35,7 @@ export class ArgvError extends Error {
   }
 }
 
-/** `--seesaw-registry` → `seesawRegistry`. */
+/** `--attempt-budget` → `attemptBudget`. */
 function camel(name) {
   return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
 }

package/kernel/lib/paths.mjs

@@ -216,8 +216,6 @@ export const trials = (cwd, slug) => join(t0Dir(cwd, slug), "trials.jsonl");
  * {@link decisions}, one small file with one writer.
  */
 export const gates = (cwd, slug) => join(localRoot(cwd, slug), "gates.jsonl");
-/** Finished-scope fixture registry for the seesaw regression check. */
-export const seesawRegistry = (cwd, slug) => join(localRoot(cwd, slug), "seesaw", "registry.json");
 /**
  * The round build gate's verdicts — one immutable artifact per gate run, `r<N>-t<T>.json`.
  *

package/kernel/probe/eval.mjs

@@ -31,11 +31,11 @@
 // cause as its first deviation. A bare `ok: false` reached the operator as a sub-agent that died
 // after retries, while the one sentence naming the actual cause sat in a file nobody was pointed at.
 
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join, resolve, resolve as resolvePath, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir, readRunId } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId, verdictsDir } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -89,7 +89,7 @@ export function isScoped(cwd, slug) {
  * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
  *   hashes to the cited `sha256`, and its own `overall` reads "green".
  */
-function unresolvedCitation(cwd, citation, { round = null, runId = null } = {}) {
+function unresolvedCitation(cwd, citation, { round = null, runId = null, verdicts = null } = {}) {
   const rel = typeof citation?.path === "string" ? citation.path : "";
   if (!rel) return "names no artifact path";
   let text;
@@ -109,6 +109,19 @@ function unresolvedCitation(cwd, citation, { round = null, runId = null } = {})
   try { body = JSON.parse(text); }
   catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
   if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  // INSIDE THIS RUN'S OWN VERDICTS DIRECTORY, resolved — asked of a file that exists, so "does not
+  // exist" and "resolves somewhere else" stay different answers. Accepted before this check: a
+  // green artifact in the source tree, one outside the project reached by `../`, one by absolute
+  // path, and a symlink in the verdicts directory pointing at a forged file. Every one hashed
+  // correctly, because a digest says the bytes are the file's and nothing about which file it
+  // should have been.
+  if (verdicts) {
+    const real = (() => { try { return realpathSync.native(resolvePath(cwd, rel)); } catch { return resolvePath(cwd, rel); } })();
+    const home = (() => { try { return realpathSync.native(verdicts); } catch { return verdicts; } })();
+    if (!real.startsWith(home.endsWith(sep) ? home : home + sep)) {
+      return `cites ${rel}, which resolves outside this run's own verdicts directory (${home}) — a verdict cites what this run's own verifier wrote, not a file the judge can reach`;
+    }
+  }
   // THE ARTIFACT HAS TO BE THE ONE THE CITATION SAYS IT IS. A re-hash proves the bytes are the
   // file's; it says nothing about whose verdict the file holds. A PASS citing scope alpha's green
   // artifact while declaring scope beta, or a prior round's, or a prior run's over the same slug,
@@ -198,8 +211,9 @@ export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
       "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
   }
   const runId = readRunId(cwd, slug);
+  const verdicts = verdictsDir(cwd, slug);
   for (const citation of verdict.t0_citations) {
-    const reason = unresolvedCitation(cwd, citation, { round, runId });
+    const reason = unresolvedCitation(cwd, citation, { round, runId, verdicts });
     if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
   }
   return null;

package/kernel/reduce/hill.mjs

@@ -144,8 +144,8 @@ function committedPhase(hDir, id) {
  * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope — and the floor the scope sits
  *   at whenever the ledger has not answered at all, which is where every run legitimately begins
  * - UPHILL_SOLVED: the ledger was read and reports zero open unknowns, no T0-green yet
- * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1/seesaw pending
- * - FINISHED: T1 PASS ∧ seesaw green
+ * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1 pending
+ * - FINISHED: T1 PASS ∧ a T0-green that a red round did not invalidate
  *
  * @param {string} cwd - The project root directory.
  * @param {string} slug - The feature slug being built.
@@ -230,18 +230,16 @@ export function deriveHill(cwd, slug) {
     }
   }
 
-  // 2. T0 facts per scope: has it achieved a green overall verdict? was seesaw also green?
+  // 2. T0 facts per scope: has it achieved a green overall verdict this run?
   //
-  // MINUS THE ROUNDS WHOSE BUILD GATE IS RED. A T0 verdict is one scope's fixtures inside its own
-  // substrate; the round build gate (`verify build`) is the feature's build and launch. Measured on
-  // a live run, all fourteen committed shards read DOWNHILL_EXECUTION off T0 verdicts from rounds in
-  // which the app never compiled and never launched — the dashboard showed a feature going downhill
-  // that had not started. A green fixture in a round the gate failed is not evidence the scope
-  // works; it is evidence the fixture does not test the build. No gate artifact at all leaves every
-  // verdict counting exactly as before.
+  // FINISHED USED TO WAIT ON AN ARM THAT NEVER RAN. The phase required `seesaw.ran && seesaw.pass`,
+  // nothing in the codebase ever wrote the registry that arm read, and so no scope in any recorded
+  // run reached FINISHED — 38 committed shards on the live consumer, not one of them. The arm was
+  // removed in 3.8.0 by decision; the precondition goes with it, and the top phase is reachable
+  // again on the evidence that does exist: T1 passed, and a T0 green from a round the build gate
+  // did not red.
   const redRounds = redBuildRounds(cwd, slug);
   const t0Facts = {};
-  // This run's verdicts only — a prior run's green over the same slug moved this run's dot.
   const hillRunId = readRunId(cwd, slug);
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir)) {
@@ -249,41 +247,21 @@ export function deriveHill(cwd, slug) {
       try {
         const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
         if (hillRunId && b.run_id && b.run_id !== hillRunId) continue;
-        if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
-        if (b.overall === "green" && !redRounds.has(Number(b.round))) {
-          t0Facts[b.scope_id].hasGreen = true;
-          // Read the REAL seesaw result off the verdict artifact (`t0.mjs`'s `writeArtifact()`
-          // already persists the full `{ran, pass, scopes_checked, failing}` object), rather than
-          // inferring it from a false `regression` flag. That inference was vacuously true on every
-          // green T0 whether or not a seesaw check ever ran: nothing in this codebase currently
-          // passes `--seesaw-registry` to `verify t0`, so `seesaw.ran` is always `false` today and
-          // `regression` is always `false` too — "not asked" was being read as "clean," letting a
-          // scope reach FINISHED on a regression check that had never executed.
-          //
-          // Betting Table decision (Phase 3.5 / S4): wiring the seesaw registry for real is a
-          // genuine feature with a real running cost (re-running every finished scope's fixtures
-          // on every later attempt) and is out of proportion to a certification-gap fix. Deferred,
-          // not silently dropped — a scope with no registry wired simply cannot reach FINISHED via
-          // this path today, which is the honest state of the system: this check was never really
-          // gating FINISHED before either.
-          if (b.seesaw?.ran && b.seesaw?.pass) {
-            t0Facts[b.scope_id].seesawGreen = true;
-          }
-        }
-      } catch (e) {
-        // ignore parse errors
+        if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false };
+        if (b.overall === "green" && !redRounds.has(Number(b.round))) t0Facts[b.scope_id].hasGreen = true;
+      } catch {
+        // A torn or unreadable verdict proves nothing about the scope — skip it rather than let it
+        // decide a phase.
       }
     }
   }
-  
-  // 3. Ledger unknowns per scope — `null` for every scope when the ledger itself was not readable
-  //    or nothing in it named a scope (see `ledgerUnknowns`). Only a real count can promote.
+
   const scopeUnknowns = ledgerUnknowns(ledgerPath, scopes);
 
   const report = [];
   for (const s of scopes) {
     const id = s.scope_id;
-    const t0 = t0Facts[id] || { hasGreen: false, seesawGreen: false };
+    const t0 = t0Facts[id] || { hasGreen: false };
     // `null` = the ledger did not answer; a number = it did. `|| 0` collapsed the two.
     const unknowns = scopeUnknowns === null ? null : (scopeUnknowns[id] || 0);
 
@@ -291,7 +269,7 @@ export function deriveHill(cwd, slug) {
     // it — including before Orient has filed anything, which is where every run legitimately
     // starts. Only an ANSWERED count of zero promotes to UPHILL_SOLVED; `null` never does.
     let phase = "UPHILL_UNKNOWN";
-    if (t1Pass && t0.hasGreen && t0.seesawGreen) {
+    if (t1Pass && t0.hasGreen) {
       phase = "FINISHED";
     } else if (t0.hasGreen) {
       phase = "DOWNHILL_EXECUTION";

package/kernel/report/export.mjs

@@ -129,7 +129,6 @@ function t0Row(a, runId) {
     regression: a?.regression ?? null,
     fixtures_green: a?.fixtures_green ?? null,
     db_probe_green: a?.db_probe_green ?? null,
-    seesaw_green: a?.seesaw_green ?? null,
     // One field a reader compares, and the block itself stays in the artifact for a human to diff:
     // two rows with the same tree and different env digests are two machines, not a regression.
     env_sha256: a?.env?.env_sha256 ?? null,
@@ -137,8 +136,6 @@ function t0Row(a, runId) {
     tree_dirty: a?.env?.tree?.dirty ?? null,
     fixtures_total: fixtures.length,
     fixtures_passed: fixtures.filter((f) => f?.pass === true).length,
-    seesaw_ran: a?.seesaw?.ran ?? null,
-    seesaw_failing: Array.isArray(a?.seesaw?.failing) ? a.seesaw.failing.length : null,
     discovered_tasks: Array.isArray(a?.discovered_tasks) ? a.discovered_tasks.length : 0,
   };
 }

package/kernel/schemas/domain.schema.json

@@ -236,7 +236,7 @@
         "to": "HillShard",
         "cardinality": "1:0..1",
         "via": "scope_id",
-        "note": "phase derived from T0/T1/seesaw facts, never authored"
+        "note": "phase derived from T0/T1 facts, never authored"
       },
       {
         "from": "ScopeContract",
@@ -252,13 +252,6 @@
         "via": "fixtures[] + db_probe",
         "note": "produced by actually running the commands — no agent can fabricate them"
       },
-      {
-        "from": "T0Artifact",
-        "to": "SeesawCheck",
-        "cardinality": "1:1",
-        "via": "seesaw",
-        "note": "the regression half of T0 — every FINISHED scope's fixtures re-run"
-      },
       {
         "from": "T0Artifact",
         "to": "AegisTriple",
@@ -287,13 +280,6 @@
         "via": "payload.trial_history[]",
         "note": "inspect(): the loop reads its own recent history, across the round boundary"
       },
-      {
-        "from": "SeesawRegistry",
-        "to": "ScopeContract",
-        "cardinality": "1:N",
-        "via": "scopes[].scope_id",
-        "note": "every FINISHED scope's fixtures re-run on each later attempt"
-      },
       {
         "from": "UseCase",
         "to": "Seam",
@@ -528,7 +514,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Globs ≥2 scopes both touch — every write here forces a full seesaw run at the next gate."
+          "description": "Globs ≥2 scopes both touch — an edit here is read-modify-write, so two scopes that both declare one never build at the same time."
         },
         "append_only": {
           "type": "array",
@@ -542,7 +528,14 @@
           "items": {
             "type": "string"
           },
-          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior)."
+          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior). A build leg's order freezes the whole run trace here and carves out what it authors through `own`: a freeze that lists the channels a defect happened to name grows one defect at a time and is not a boundary."
+        },
+        "own": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Paths this order may write DESPITE a broader freeze — the compiler's grant, derived from the order's own identity and never requested by a worker. For a build leg: its own WorkResult (no sibling's — a leg that can write another's can report work nobody did), its task files, the discovery ledger, its spikes. Checked BEFORE `frozen`, and only against the contract that declared it, so another live order's exception never licenses this write."
         }
       }
     },
@@ -837,7 +830,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Files ≥2 scopes both touch — must be declared in BOTH scopes' lists (spec-lint DISJOINT) and every write forces a full seesaw run."
+          "description": "Files ≥2 scopes both touch — must be declared in BOTH scopes' lists (spec-lint DISJOINT); declaring one costs concurrency, since two scopes that share a path build one at a time."
         },
         "affordance_manifest": {
           "type": "array",
@@ -865,7 +858,7 @@
             "DOWNHILL_EXECUTION",
             "FINISHED"
           ],
-          "description": "ALWAYS authored as UPHILL_UNKNOWN — self-reported confidence is the risk this closes. The live phase is DERIVED from T0/T1/seesaw facts into hill/<scope-id>.yml — facts move dots, not authors."
+          "description": "ALWAYS authored as UPHILL_UNKNOWN — self-reported confidence is the risk this closes. The live phase is DERIVED from T0/T1 facts into hill/<scope-id>.yml — facts move dots, not authors."
         },
         "superseded_by": {
           "type": "array",
@@ -1247,35 +1240,8 @@
         }
       }
     },
-    "SeesawCheck": {
-      "description": "The regression half of T0: every FINISHED scope's fixtures re-run from the SeesawRegistry. fixtures/db green + seesaw red = a REGRESSION (the new scope broke a finished one) → git stash rollback + retry, not 'fix the new scope's bug'.",
-      "x-tier": "EMBEDDED",
-      "type": "object",
-      "properties": {
-        "ran": {
-          "type": "boolean",
-          "description": "false when no registry was passed or the attempt was already red (don't seesaw a red attempt)."
-        },
-        "pass": {
-          "type": "boolean"
-        },
-        "scopes_checked": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "failing": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "scope_ids whose fixtures broke."
-        }
-      }
-    },
-    "T0Artifact": {
-      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
+"T0Artifact": {
+      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures and DB probe; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/verdicts/r<N>-a<M>-t<T>.json (schema_version 2; the unsuffixed r<N>-a<M>.json of schema_version 1 is still readable)",
       "x-writer": "harness verify t0",
@@ -1320,9 +1286,6 @@
         "db_probe": {
           "$ref": "#/$defs/CommandResult"
         },
-        "seesaw": {
-          "$ref": "#/$defs/SeesawCheck"
-        },
         "fixtures_green": {
           "type": "boolean"
         },
@@ -1330,9 +1293,6 @@
           "type": "boolean",
           "description": "true when no probe declared (null probe never counts as failure)."
         },
-        "seesaw_green": {
-          "type": "boolean"
-        },
         "overall": {
           "type": "string",
           "enum": [
@@ -1340,10 +1300,6 @@
             "red"
           ]
         },
-        "regression": {
-          "type": "boolean",
-          "description": "fixtures+db green but seesaw red — the rollback+retry case."
-        },
         "score": {
           "$ref": "#/$defs/T0Score",
           "description": "schema_version 2+: the comparable outcome vector better() ranks. A reduce over fixtures[] — no new measurement."
@@ -1377,11 +1333,6 @@
       "x-tier": "EMBEDDED",
       "type": "object",
       "properties": {
-        "regressions": {
-          "type": "integer",
-          "minimum": 0,
-          "description": "Previously-FINISHED scopes now failing (seesaw). Dominates: breaking a shipped scope is never an improvement."
-        },
         "fixtures_passed": {
           "type": "integer",
           "minimum": 0
@@ -1405,7 +1356,6 @@
         }
       },
       "required": [
-        "regressions",
         "fixtures_passed",
         "fixtures_total"
       ]
@@ -1612,34 +1562,7 @@
         }
       }
     },
-    "SeesawRegistry": {
-      "description": "The fixture registry of every FINISHED scope — what seesawCheck re-runs on each later attempt so a new scope cannot silently break a shipped one — a regression mistaken for progress is the pathology the seesaw exists for.",
-      "x-tier": "LOCAL",
-      "x-location": ".shapeup/<slug>/seesaw/registry.json",
-      "x-writer": "tech-lead (when a scope reaches FINISHED)",
-      "x-readers": "harness verify t0",
-      "type": "object",
-      "properties": {
-        "scopes": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "scope_id": {
-                "type": "string"
-              },
-              "fixtures": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "VerdictLedgerLine": {
+"VerdictLedgerLine": {
       "description": "One appended line of judge history (JSONL). Never rewritten — flips across runs are detected here and force confidence low. run auto-increments per append batch.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/evaluation/.verdicts-<target>.jsonl",
@@ -1683,7 +1606,7 @@
       }
     },
     "HillShard": {
-      "description": "One scope's hill position — DERIVED, never self-reported: UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green; T1/seesaw pending) → FINISHED (T1 PASS ∧ seesaw green ∧ merged). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
+      "description": "One scope's hill position — DERIVED, never self-reported: UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green from a round that built; T1 pending) → FINISHED (T1 PASS ∧ that T0-green). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/hill/<scope-id>.yml",
       "x-writer": "tech-lead (GATE L2 derivation)",

package/kernel/verify/env.mjs

@@ -52,6 +52,16 @@ const UNSET = "<unset>";
  * @param {string} cmd - A shell command line.
  * @returns {string[]} Invoked tokens, in order, without duplicates.
  */
+export function cdTargets(cmd) {
+  const out = [];
+  for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
+    const m = seg.match(/^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
+    const dir = m && (m[1] || m[2] || m[3]);
+    if (dir && !dir.startsWith("-") && !out.includes(dir)) out.push(dir);
+  }
+  return out;
+}
+
 export function invokedTokens(cmd) {
   const out = [];
   for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
@@ -96,7 +106,8 @@ function treeState(cwd) {
  * path, which is exactly the mechanism that made one tree build three ways.
  *
  * `null` means the profile declared nothing — NOT that there are none. "Not asked" and "none" are
- * different facts, and collapsing them is the mistake the seesaw arm already makes elsewhere.
+ * different facts, and collapsing them is the mistake that kept the hill's top phase shut for the
+ * life of the seesaw arm: "not asked" was recorded the same way as "nothing wrong".
  *
  * @param {(string|null)} profilePath - `shapeup/<slug>/project-profile.md`, when the caller knows it.
  * @returns {(object[]|null)} One entry per declared cache, or null when none is declared.
@@ -162,12 +173,19 @@ export function environmentFingerprint(rawCwd, { commands = [], profilePath = nu
     cwd,
     tree: treeState(cwd),
     toolchain: tokens.map((bin) => ({ bin, path: resolveBin(bin, cwd) })),
-    lockfiles: LOCKFILES
-      .filter((f) => existsSync(join(cwd, f)))
-      .map((f) => {
-        try { return { file: f, sha256: sha256(readFileSync(join(cwd, f))) }; }
-        catch { return { file: f, sha256: null }; }
-      }),
+    // The root AND wherever the commands actually run. Measured on a consumer whose fixtures are
+    // `cd app && …`: the lockfile that decides what the build resolves lives in `app/`, and a scan
+    // of the project root alone recorded an empty list beside a build whose dependencies were the
+    // whole question.
+    lockfiles: [...new Set(["", ...commands.flatMap((c) => cdTargets(c))])]
+      .flatMap((sub) => LOCKFILES
+        .map((f) => (sub ? `${sub.replace(/\/+$/, "")}/${f}` : f))
+        .filter((rel) => existsSync(join(cwd, rel)))
+        .map((rel) => {
+          try { return { file: rel, sha256: sha256(readFileSync(join(cwd, rel))) }; }
+          catch { return { file: rel, sha256: null }; }
+        }))
+      .filter((l, i, all) => all.findIndex((x) => x.file === l.file) === i),
     caches: declaredCaches(profilePath),
     env: {
       allowlist: ENV_ALLOWLIST,

package/kernel/verify/ratchet-tree.mjs

@@ -4,7 +4,7 @@
 //
 // The attempt loop branched a red T0 two ways, and only one of them reverted anything:
 //
-//   • a SEESAW regression (a previously-finished scope broke) → `git stash push -u`;
+//   • a trial that scored worse than the incumbent → `git stash push -u`;
 //   • a red on the scope's OWN fixtures → "loop to the next attempt", and no revert at all.
 //
 // So the failing tree stayed on the branch, and attempt N+1's fresh, zero-memory subagent began

package/kernel/verify/spec.mjs

@@ -422,6 +422,9 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
   return findings;
 }
 
+/** Registry sources that name the pitch's own out-of-scope section, in the spellings pitches use. */
+const NOGO_SOURCE = /\bno[-\s]?gos?\b|\bnon[-\s]?goals?\b|\bout[-\s]of[-\s]scope\b|\bwill not build\b/i;
+
 /**
  * REQ-UNCOVERED — a live requirement that nothing in the plan reaches.
  *
@@ -451,6 +454,57 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
  * @returns {Array<{rule:string, level:("red"|"warn"), scope:string, detail:string}>} One red per
  *   uncovered live requirement; [] when every one is graded, claimed or cut.
  */
+/**
+ * REQ-NARRATED — a committed spec file stating the requirement-coverage verdict as fact.
+ *
+ * The Health Dashboard's `Coverage` row is about USE CASES and tasks, derived by inverting each
+ * task's `use_case_refs` over the local board. Measured on a consumer, a worker filled its Signal
+ * cell with a different claim entirely — *"every registered non-CUT REQ-id (REQ-1 … REQ-7) reaches
+ * an AC carrying `(covers: REQ-…)`"*, with a 🟢 beside it — while a grep for `covers:` across the
+ * whole spec folder returned that sentence and nothing else. Not one acceptance criterion carried
+ * the clause, and the run's own derived report said `0/11 PASS`.
+ *
+ * `AGENTS.md` names the invariant this breaks: the requirements matrix is a projection, never a
+ * verdict, derived from files for one named run and never narrated. The rule is the narrow,
+ * checkable form of it — a dashboard Coverage row in a committed file may not name a REQ id — and
+ * it cannot fire on the legitimate signal, which counts use cases and tasks.
+ *
+ * @param {{cwd:string, slug:string}} opts - Working root and feature slug.
+ * @returns {object[]} Findings, one per offending line.
+ */
+export function lintNarratedCoverage({ cwd, slug }) {
+  const findings = [];
+  const dir = join(sharedRoot(cwd, slug), "spec");
+  let files;
+  try { files = readdirSync(dir).filter((f) => f.endsWith(".md")); } catch { return findings; }
+  for (const f of files) {
+    let lines;
+    try { lines = readFileSync(join(dir, f), "utf8").split(/\r?\n/); } catch { continue; }
+    lines.forEach((line, i) => {
+      if (!/^\|\s*Coverage\s*\|/i.test(line.trim())) return;
+      const named = [...line.matchAll(/\bREQ-\d+/g)].map((m) => m[0]);
+      if (!named.length) return;
+      findings.push({ rule: "REQ-NARRATED", level: "red", scope: `${f}:${i + 1}`, detail:
+        `${f}:${i + 1} states the requirement-coverage verdict in a committed file, naming ${named.slice(0, 3).join(", ")}` +
+        `${named.length > 3 ? ` (+${named.length - 3})` : ""}. That row is the UC × Task indicator; the ` +
+        "REQ → AC → criterion → verdict state is a projection derived per run (probe requirements), " +
+        "never a claim a committed artifact may make — a reader who checks the file finds corroboration " +
+        "for something no run measured. Say what the use cases and tasks show, and leave the requirement " +
+        "matrix to the run that derives it." });
+    });
+  }
+  return findings;
+}
+
+/**
+ * REQ-UNCOVERED and REQ-NOGO — the registry's two ways of being wrong about what ships.
+ *
+ * @param {{clauses:object[], board:object[], scopes:object[]}} opts - The parsed registry, the
+ *   board `readBoard` produced (its acceptance criteria carry the covers clauses), and the scope
+ *   contracts.
+ * @returns {object[]} Findings, most specific first: a no-go registered as covered is reported as
+ *   itself rather than as the coverage gap it inevitably becomes.
+ */
 export function lintRequirementCoverage({ clauses = [], board = [], scopes = [] }) {
   const findings = [];
   const graded = coveredReqIds(board);
@@ -459,6 +513,21 @@ export function lintRequirementCoverage({ clauses = [], board = [], scopes = []
   const claimed = new Set();
   for (const s of scopes) for (const r of s.covers || []) claimed.add(reqId(r).toUpperCase());
   for (const c of clauses) {
+    // A NO-GO IS A CONSTRAINT, NOT A DELIVERABLE, and marking one `covered` asserts something that
+    // cannot be true: nothing grades "do not build a settings screen". Measured on a consumer — a
+    // coverage dispatch lifted seven clauses out of the pitch's No-gos section, registered each as
+    // covered, and L1b then refused the run with seven REQ-UNCOVERED findings, correctly and
+    // unavoidably. Reported here as itself, so the operator reads one cause instead of seven
+    // symptoms, and named before REQ-UNCOVERED can fire on the same row.
+    if (c.status === "covered" && NOGO_SOURCE.test(c.source || "")) {
+      findings.push({ rule: "REQ-NOGO", level: "red", scope: c.id, detail:
+        `${c.id} ← ${c.source} registers a NO-GO as a covered requirement — "${(c.clause || "").slice(0, 60)}". ` +
+        "A no-go is a constraint the shape deliberately does not build, so no acceptance criterion can " +
+        "grade it and nothing downstream can ever turn it green. Mark it CUT (PO-approved) in " +
+        "requirements.md — the family that already means deliberately-not-built — or drop the row and give " +
+        "the breach a Test Surface row (TS-NOGO-NN) instead, which is the channel that does grade one." });
+      continue;
+    }
     if (c.status !== "covered") continue; // CUT (PO-approved) — an answer on the record, not a gap
     const id = c.id.toUpperCase();
     if (graded.has(c.id) || claimed.has(id)) continue;
@@ -851,6 +920,7 @@ export function lint({ cwd, slug }) {
     // `readBoard`, not the `tasks` above: only the compile-order parser carries acceptance_criteria.
     ...lintRequirementCoverage({ clauses: reqClauses, board: readBoard(cwd, slug), scopes }),
     ...lintCommittedTier({ cwd, slug }),
+    ...lintNarratedCoverage({ cwd, slug }),
     ...lintStructure({ specDir: specRoot, tasks, intakeContent }),
     ...(() => {
       const bbText = runBreadboard(cwd, slug, intakeContent);

package/kernel/verify/t0.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 // T0 mechanical verification layer.
 //
-// Runs a scope's e2e fixtures + DB probe (zero LLM tokens), then — on green — the seesaw
-// regression check (re-runs every FINISHED scope's fixtures from the registry). Writes one
+// Runs a scope's e2e fixtures and its DB probe (zero LLM tokens). Writes one
 // verdict artifact per attempt that spec-evaluator (T1) must cite; a verdict without it is
 // structurally invalid. No agent can fabricate this file's contents
 // because it is produced by actually running the commands.
@@ -30,7 +29,7 @@
 //
 // Usage:
 //   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify t0 <scope-contract.json> \
-//        --round N --attempt M [--cwd <dir>] [--out <dir>] [--seesaw-registry <path>] [--no-seesaw]
+//        --round N --attempt M [--cwd <dir>] [--out <dir>]
 //        [--no-ratchet]
 //
 // Exit code: 0 = overall green, 1 = overall red (mirrors the oracle convention), 2 = bad argv.
@@ -185,71 +184,45 @@ export function runDbProbe(dbProbeCmd, cwd) {
 }
 
 /**
- * Re-run every FINISHED scope's fixtures from the seesaw registry (regression guard).
- * @param {(string|null)} registryPath - Path to the seesaw registry JSON (absent/unreadable → skipped).
- * @param {string} cwd - Working directory.
- * @returns {{ran:boolean, pass:boolean, scopes_checked:string[], failing:string[], error?:string}}
- *   ran=false/pass=true when skipped; otherwise pass=true iff no prior scope regressed, with the
- *   scope ids checked and those now failing.
- */
-export function seesawCheck(registryPath, cwd) {
-  if (!registryPath || !existsSync(registryPath)) {
-    return { ran: false, pass: true, scopes_checked: [], failing: [] };
-  }
-  let registry;
-  try {
-    registry = JSON.parse(readFileSync(registryPath, "utf8"));
-  } catch {
-    return { ran: false, pass: true, scopes_checked: [], failing: [], error: "registry unparsable" };
-  }
-  const scopes = registry.scopes || [];
-  const failing = [];
-  for (const s of scopes) {
-    const { pass } = runFixtures(s.fixtures, cwd);
-    if (!pass) failing.push(s.scope_id);
-  }
-  return { ran: true, pass: failing.length === 0, scopes_checked: scopes.map((s) => s.scope_id), failing };
-}
-
-/**
- * Combine fixtures + DB probe + seesaw into the overall T0 verdict.
- * @param {{fixtures:{pass:boolean}, dbProbe:({pass:boolean}|null),
- *   seesaw:{ran:boolean,pass:boolean}}} parts - The three sub-results.
- * @returns {{fixtures_green:boolean, db_probe_green:boolean, seesaw_green:boolean,
- *   overall:("green"|"red"), regression:boolean}} Per-arm greens, the overall verdict (green iff
- *   all three), and `regression` = fixtures+db green but seesaw red (the rollback-and-retry case).
+ * Combine the fixtures and the DB probe into the overall T0 verdict.
+ *
+ * THE SEESAW ARM IS GONE (3.8.0), by a Betting Table decision rather than by neglect. It was
+ * declared in the schema, the docs and this function, and nothing ever wrote the registry it read,
+ * so it never ran once in any recorded run — while its absence held the hill's top phase shut:
+ * FINISHED required `seesaw.ran && seesaw.pass`, and the 38 committed hill shards across the live
+ * consumer's features contain no FINISHED at all. A cross-scope regression is still caught by the
+ * round build gate, which builds and launches the whole feature once per round; what the arm would
+ * have added is attribution and an earlier signal, at the price of re-running every finished
+ * scope's fixtures on every attempt — minutes per attempt on an eighteen-scope feature.
+ *
+ * @param {{fixtures:{pass:boolean}, dbProbe:({pass:boolean}|null)}} parts - The two sub-results.
+ * @returns {{fixtures_green:boolean, db_probe_green:boolean, overall:("green"|"red")}} Per-arm
+ *   greens and the overall verdict, green iff both.
  */
-export function computeVerdict({ fixtures, dbProbe, seesaw }) {
+export function computeVerdict({ fixtures, dbProbe }) {
   const fixturesGreen = fixtures.pass;
   const dbGreen = dbProbe === null || dbProbe.pass;
-  const seesawGreen = !seesaw.ran || seesaw.pass;
   return {
     fixtures_green: fixturesGreen,
     db_probe_green: dbGreen,
-    seesaw_green: seesawGreen,
-    overall: fixturesGreen && dbGreen && seesawGreen ? "green" : "red",
-    // A regression is specifically fixtures/db green but seesaw red — the case that should
-    // trigger rollback+retry (spec §3.5) rather than "go fix the new scope's own bug".
-    regression: fixturesGreen && dbGreen && !seesawGreen,
+    overall: fixturesGreen && dbGreen ? "green" : "red",
   };
 }
 
 /**
- * The comparable T0 outcome — a VECTOR, not a float, because the three arms are not fungible.
+ * The comparable T0 outcome — a VECTOR, not a float, because the arms are not fungible.
  *
  * Every number here is a reduce over data `writeArtifact` already persists (`fixtures:
  * [{cmd, exit, pass}]`). Nothing new is measured; a number that has always been on disk is
  * finally counted.
  *
- * @param {{fixtures:{results:Array<{pass:boolean}>}, dbProbe:({pass:boolean}|null),
- *   seesaw:{ran:boolean, failing:string[]}}} parts - The three T0 sub-results.
- * @returns {{regressions:number, fixtures_passed:number, fixtures_total:number,
- *   db_probe:(0|1|null)}} The score vector. `db_probe` is null when no probe is declared, which
- *   is never a failure — only an absence.
+ * @param {{fixtures:{results:Array<{pass:boolean}>}, dbProbe:({pass:boolean}|null)}} parts - The
+ *   two T0 sub-results.
+ * @returns {{fixtures_passed:number, fixtures_total:number, db_probe:(0|1|null)}} The score vector.
+ *   `db_probe` is null when no probe is declared, which is never a failure — only an absence.
  */
-export function score({ fixtures, dbProbe, seesaw }) {
+export function score({ fixtures, dbProbe }) {
   return {
-    regressions: seesaw?.ran ? (seesaw.failing || []).length : 0,
     fixtures_passed: fixtures.results.filter((r) => r.pass).length,
     fixtures_total: fixtures.results.length,
     db_probe: dbProbe === null || dbProbe === undefined ? null : (dbProbe.pass ? 1 : 0),
@@ -262,23 +235,19 @@ export function score({ fixtures, dbProbe, seesaw }) {
  * Three decisions worth defending:
  *   • A TIE IS NOT BETTER. A tie that counted as an improvement would make a sawtooth look like a
  *     ratchet, and the whole point of the Day-1 measurement is to tell those two apart.
- *   • REGRESSIONS DOMINATE. Breaking a previously-finished scope is never an improvement, whatever
- *     the new scope's fixtures did. This is what lets the old seesaw branch collapse into the
- *     general rule rather than needing a special case.
  *   • DIFFERENT `fixtures_total` IS INCOMPARABLE, not worse. A re-slice changes the
  *     denominator; comparing across it is a category error, so the ratchet treats it as a baseline
  *     reset (`rebased`) rather than issuing a false verdict.
  *
- * @param {{regressions:number, fixtures_passed:number, fixtures_total:number,
+ * @param {{fixtures_passed:number, fixtures_total:number,
  *   db_probe:(0|1|null)}} next - The candidate score.
- * @param {({regressions:number, fixtures_passed:number, fixtures_total:number,
+ * @param {({fixtures_passed:number, fixtures_total:number,
  *   db_probe:(0|1|null)}|null)} current - The incumbent score, or null for the first trial.
  * @returns {(boolean|null)} true = strictly better · false = not better · null = incomparable.
  */
 export function better(next, current) {
   if (current === null || current === undefined) return true; // baseline
   if (next.fixtures_total !== current.fixtures_total) return null; // the contract changed
-  if (next.regressions !== current.regressions) return next.regressions < current.regressions;
   if (next.fixtures_passed !== current.fixtures_passed) return next.fixtures_passed > current.fixtures_passed;
   if (next.db_probe !== current.db_probe) return (next.db_probe ?? 0) > (current.db_probe ?? 0);
   // EVERY COMPONENT TIES. What that means depends entirely on whether the incumbent was green.
@@ -305,17 +274,17 @@ export function better(next, current) {
 }
 
 /**
- * Is this score a clean pass — every fixture passing, none of them absent, no outstanding regression?
+ * Is this score a clean pass — every fixture passing, and none of them absent?
  *
  * `fixtures_total > 0` is load-bearing: a scope with no fixtures has nothing to be green ABOUT, and
  * treating its empty score as a pass is the same absence-reads-as-success mistake `runFixtures`
  * made one function above.
  *
- * @param {{regressions:number, fixtures_passed:number, fixtures_total:number}} s - A trial score.
+ * @param {{fixtures_passed:number, fixtures_total:number}} s - A trial score.
  * @returns {boolean} True when the score represents a real, complete pass.
  */
 function isGreenScore(s) {
-  return s.regressions === 0 && s.fixtures_total > 0 && s.fixtures_passed === s.fixtures_total;
+  return s.fixtures_total > 0 && s.fixtures_passed === s.fixtures_total;
 }
 
 /**
@@ -343,7 +312,7 @@ export function decideStatus(verdict, crashed) {
  * Human-readable one-line summary of a score change, for the trial row's `delta` field.
  * @param {object} next - The candidate score.
  * @param {(object|null)} current - The incumbent score, or null.
- * @returns {string} e.g. "+2 fixtures", "+1 regression", "baseline", "no change".
+ * @returns {string} e.g. "+2 fixtures", "-1 db_probe", "baseline", "no change".
  */
 export function describeDelta(next, current) {
   if (!current) return "baseline";
@@ -351,10 +320,8 @@ export function describeDelta(next, current) {
     return `denominator ${current.fixtures_total} → ${next.fixtures_total}`;
   }
   const parts = [];
-  const dr = next.regressions - current.regressions;
   const df = next.fixtures_passed - current.fixtures_passed;
   const dp = (next.db_probe ?? 0) - (current.db_probe ?? 0);
-  if (dr) parts.push(`${dr > 0 ? "+" : ""}${dr} regression${Math.abs(dr) === 1 ? "" : "s"}`);
   if (df) parts.push(`${df > 0 ? "+" : ""}${df} fixture${Math.abs(df) === 1 ? "" : "s"}`);
   if (dp) parts.push(`${dp > 0 ? "+" : ""}${dp} db_probe`);
   return parts.length ? parts.join(", ") : "no change";
@@ -449,7 +416,7 @@ function sha256(text) {
  * every superseded object remains addressable).
  *
  * WHAT THIS REPLACED, and why the remedy is `wx` rather than a guard. The address used to be
- * `r<round>-a<attempt>.json`, written with a bare `writeFileSync` — and on a seesaw regression the
+ * `r<round>-a<attempt>.json`, written with a bare `writeFileSync` — and on a revert-and-retry the
  * protocol says stash, then RETRY THIS ATTEMPT, same attempt number. The address had no term for
  * the retry, so the artifact recording the regression was silently replaced by the one recording
  * the recovery, at the same path. Reproduced against the shipped script: two runs at
@@ -497,14 +464,12 @@ export function writeArtifact(outDir, round, attempt, verdictBody) {
 /** The typed argv contract (see `./lib/argv.mjs`). */
 export const ARGV_SPEC = {
   usage: "harness.mjs verify t0 <scope-contract.json> --round N --attempt M [--cwd <dir>] [--out <dir>] " +
-         "[--seesaw-registry <path>] [--no-seesaw] [--no-ratchet]",
+         "[--no-ratchet]",
   _: { arity: 1, max: 1, name: "scope-contract.json" },
   round: { type: "int", min: 1, required: true },
   attempt: { type: "int", min: 1, required: true },
   cwd: { type: "path" },
   out: { type: "path" },
-  "seesaw-registry": { type: "path" },
-  "no-seesaw": { type: "flag" },
   "no-ratchet": { type: "flag" },
 };
 
@@ -547,14 +512,7 @@ export async function cli(rawArgv) {
 
   const fixtures = runFixtures(contract.e2e_verification_fixtures, cwd);
   const dbProbe = runDbProbe(contract.db_probe, cwd);
-  // --seesaw-registry is expected explicitly (tech-lead always passes it, protocol.md 3c);
-  // standalone CLI use without it simply skips the seesaw check rather than guessing a path.
-  const seesawRegistry = args.noSeesaw ? null : args.seesawRegistry || null;
-  const seesaw = args.noSeesaw || fixtures.pass === false
-    ? { ran: false, pass: true, scopes_checked: [], failing: [] } // don't seesaw on an already-red attempt
-    : seesawCheck(seesawRegistry, cwd);
-
-  const verdict = computeVerdict({ fixtures, dbProbe, seesaw });
+  const verdict = computeVerdict({ fixtures, dbProbe });
   const discovered = verdict.overall === "red" ? digestFailures({ fixtures, dbProbe }) : [];
 
   // ---- the ratchet ---------------------------------------------------------------------
@@ -564,7 +522,7 @@ export async function cli(rawArgv) {
   const trialsPath = join(outDir, "t0", "trials.jsonl");
   const priorTrials = readTrials(trialsPath).filter((t) => t.scope_id === contract.scope_id);
   const baseline = [...priorTrials].reverse().find((t) => t.status === "kept" || t.status === "rebased") || null;
-  const s = score({ fixtures, dbProbe, seesaw });
+  const s = score({ fixtures, dbProbe });
   const verdictBetter = better(s, baseline ? baseline.score : null);
   const crashed = fixtures.results.some((r) => r.error) || !!dbProbe?.error;
   const { status, action } = decideStatus(verdictBetter, crashed);
@@ -589,7 +547,6 @@ export async function cli(rawArgv) {
     // could not tell apart, and why `exit` still reads the way it always did.
     fixtures: fixtures.results.map((r) => commandEvidence(r)),
     db_probe: commandEvidence(dbProbe),
-    seesaw,
     ...verdict,
     score: s,
     discovered_tasks: discovered,
@@ -645,7 +602,7 @@ export async function cli(rawArgv) {
   appendTrial(trialsPath, row);
 
   console.log(JSON.stringify({
-    path, sha256: hash, trial, overall: verdict.overall, regression: verdict.regression,
+    path, sha256: hash, trial, overall: verdict.overall,
     score: s, status, baseline_trial: row.baseline_trial, delta: row.delta,
     tree_ref: row.tree_ref ?? keptRef(contract.scope_id),
   }, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.9",
+  "version": "3.8.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/assets/templates/synthesis.tmpl.md

@@ -26,6 +26,11 @@ depends_on:
 
 | Indicator | Status | Signal |
 |-----------|--------|--------|
+<!-- Coverage here is USE CASES × TASKS, derived by inverting each task's use_case_refs over the
+     local board. It is NOT requirement coverage: whether every REQ-id reaches an acceptance
+     criterion that a judge graded is a projection derived per run (`probe requirements`), and a
+     committed file that states it is corroborating something no run measured. Name REQ ids in this
+     row and spec-lint reds it (REQ-NARRATED). Count use cases and tasks; say nothing about REQ. -->
 | Coverage | COVERAGE_STATUS | COVERAGE_SIGNAL |
 | Risk | RISK_STATUS | RISK_SIGNAL |
 | Dependency | DEPENDENCY_STATUS | DEPENDENCY_SIGNAL |

package/skills/ba-pitch-analyzer/references/task-generation.md

@@ -614,7 +614,7 @@ or entirely `apps/api/**` with no cross-layer flow is the PA1 failure mode — r
 }
 ```
 `hill_phase` is always written `UPHILL_UNKNOWN` at generation time — it is derived later from
-mechanical T0/T1/seesaw facts, never declared by `ba`. `superseded_by` stays
+mechanical T0/T1 facts, never declared by `ba`. `superseded_by` stays
 `null` until a scope-architect `map-scopes` order retires this contract in favor of its replacements.
 
 **PA2 size lint:** a scope whose `allowed_file_substrate` glob set resolves to more than ~15

package/skills/hill-chart/assets/dashboard.template.html

@@ -916,7 +916,7 @@
     html += '</div>';
 
     // ---- 2. hill chart (headline) ----
-    html += '<div class="section"><h3>Hill Chart</h3><div class="sub">Where each scope sits between figuring it out and getting it done — mechanical, derived only from T0/T1/seesaw evidence, never self-reported. Position is how derisked a scope has ever been; dot color is its current-round health, so a scope can sit downhill and still show red if its latest attempt regressed.</div>';
+    html += '<div class="section"><h3>Hill Chart</h3><div class="sub">Where each scope sits between figuring it out and getting it done — mechanical, derived only from T0/T1 evidence, never self-reported. Position is how derisked a scope has ever been; dot color is its current-round health, so a scope can sit downhill and still show red if its latest attempt regressed.</div>';
     html += '<div class="section-card"><div class="hill-wrap hero">';
     if (pitch.hillAvailable) {
       html += renderHillSVG(pitch.scopeStatus, 'hero');

package/skills/scope-architect/SKILL.md

@@ -77,8 +77,8 @@ the ship report's census table.
                                                                write-whitelist; wrong here =
                                                                a legitimate ESCALATE later
              shared_substrate[]                              — files ≥2 scopes both touch;
-                                                               every write there forces a full
-                                                               seesaw run at the next gate
+                                                               declaring one costs concurrency:
+                                                               they build one at a time
              affordance_manifest                             — from ux-behavior.md state
                                                                tables: every interactive
                                                                element as {test_id, role} +
@@ -93,7 +93,7 @@ the ship report's census table.
                                                                TBD and flag it, never invent
                                                                a fixture for unbuilt behavior
              hill_phase: "UPHILL_UNKNOWN"                    — ALWAYS; phase is derived from
-                                                               T0/T1/seesaw facts later,
+                                                               T0/T1 facts later,
                                                                never authored
 4 LINT     node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify spec --slug <slug>
            → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap),

package/skills/tech-lead/references/gates.md

@@ -90,7 +90,7 @@ Collect (explicit — never inferred):
         attempts a single scope gets inside one round before its attempt loop trips and
         queues a hammer PROPOSAL for GATE H rather than blocking the round. Only meaningful
         when the spec folder has scope contracts; a spec with none skips the attempt loop
-        entirely and BUILD behaves exactly as in v0.2.6 (task-executor --next, no T0/seesaw).
+        entirely and BUILD behaves exactly as in v0.2.6 (task-executor --next, no T0).
         no_progress_k (v1.5): the STAGNATION term of the same inner breaker. Default 2 — the
         number of consecutive non-`kept` trials after which a scope ends early and queues the
         same GATE H proposal. attempt_budget counts ATTEMPTS and cannot see that the last two

package/skills/tech-lead/references/protocol.md

@@ -205,7 +205,7 @@ ingest-result <result>             → board/ledger writes
                                       fails, and the run ABORTS naming the phase. Resolve it
                                       yourself and record the answer in round-ledger.md, which
                                       the NEXT attempt's fresh context reads back.
-harness verify t0                      → fixtures + DB probe + (on green) seesaw, then scores the
+harness verify t0                      → fixtures + DB probe, then scores the
                                       attempt against the baseline trial and snapshots or
                                       restores the tree. Branch on `status` from its stdout
                                       JSON — the tree action has ALREADY happened:
@@ -217,9 +217,8 @@ harness verify t0                      → fixtures + DB probe + (on green) sees
               KEEPS, because a spec-conformance fix cannot raise a score that is already at
               full marks, and reverting it would discard exactly the work a fix round exists
               to do. Tree already restored from the last kept
-              snapshot. Subsumes the retired stash-and-retry branch: a FINISHED scope's broken
-              fixture raises score.regressions and reverts through this same rule, which
-              is why seesaw runs before anything is declared green.
+              snapshot. Subsumes the retired stash-and-retry branch: an attempt that scores
+              worse than the incumbent reverts through this same rule.
               rather than the code. Tree kept, baseline reset. Not a verdict, not a failure.
   crash     a fixture command failed to spawn or timed out; tree restored. Fix the fixture,
               not the code.
@@ -446,9 +445,8 @@ Do: verify the phase's artifact by hand before trusting either diagnosis. If it
 ```
 Invoke via Bash directly — NOT an Agent, this is deterministic tooling, not a worker:
   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify t0 shapeup/<slug>/scopes/<scope-id>.md
-        --round <N> --attempt <M> --seesaw-registry .shapeup/<slug>/seesaw/registry.json
-Effect: runs the scope's e2e fixtures + DB probe, then (on green) the seesaw regression check
-        over every FINISHED scope's fixtures. Writes the verdict artifact spec-evaluator's
+        --round <N> --attempt <M>
+Effect: runs the scope's e2e fixtures and DB probe. Writes the verdict artifact spec-evaluator's
         T0-citation rule will require a citation to, appends one row to t0/trials.jsonl, and — this
         is the ratchet — scores the attempt against the last kept trial and snapshots or
         restores the working tree ITSELF. Zero LLM tokens — deterministic tooling, not a
@@ -592,7 +590,7 @@ guarantee lives in the script and, where noted, in a hook.
 | Three-level circuit breaker: attempt_budget (inner, per scope) nests inside round_budget (outer), with an opt-in wall_clock_budget_s deadline | An exhausted scope queues a GATE H hammer proposal, it never blocks the round; only round_budget hitting 0 stops the whole run; the deadline breaker (checked every round boundary in `shapeup-run.js`) routes to GATE H so a run out of clock still ships what is green instead of being killed from outside |
 | The tech lead never hand-edits a scope contract | scope-architect is its sole writer (single-writer-per-file) |
 | Substrate-disjointness + PA1/PA2 lints are re-asserted at GATE L1b (harness verify spec) even when scope-architect already checked them | A human may have hand-approved past a 🔴 at the architect's checkpoint; `shapeup-run.js` runs spec-lint itself, in code, before resolving L1b |
-| Hill phase is read from mechanical facts (T0/T1/seesaw), never declared by a worker | Closes the self-reported-confidence risk outright — facts move dots, not authors |
+| Hill phase is read from mechanical facts (T0/T1), never declared by a worker | Closes the self-reported-confidence risk outright — facts move dots, not authors |
 | GATE H is delegated to scope-hammer, never adjudicated inline by the tech lead | Keeps the orchestrator thin; census/baseline-comparison/cut-list logic has one owner |
 
 ---