task-pipeline-skill 1.30.0 → 1.32.0

package/CHANGELOG.md

@@ -1,5 +1,195 @@
 # Changelog
 
+## v1.32.0 — the column a machine may not fill
+
+Stage 8 already performs the verification trio, reads the CI verdict and opens the
+rendered page. All of it **per run**, none of it accumulating — so *"which features has
+nobody confirmed since they shipped?"* had no artifact to be asked of.
+
+`docs/superpowers/verification.md` is one row per shipped REQ, and its point is a single
+column: **`Human` — a date, or the literal `never`.** Nothing else. *"soon"*, *"mostly"*
+and *"looks fine"* are how a column stops being answerable, and this is the one thing in
+the pipeline a machine may not write on your behalf.
+
+**`never` is a fact, not a failure.** The count has no floor, no direction, and may
+never be given a target — the moment `never` becomes something to avoid writing, the
+column starts lying and the pipeline loses its only signal about the world outside its
+own checks. One of the new checks is a **property check** proving that filling the
+column does not fail the build: a gate that punishes an honest answer guarantees there
+will not be one.
+
+**It keys to the brief, not to the coverage table**, and that was a measurement rather
+than a preference. Ten acceptance files here carry their first REQ-bearing table in
+nearly as many shapes, because `acceptance.md` fixes it in prose — the same drift the
+carry-over ledger reached with six header shapes. Eight of nine briefs carry
+machine-readable `| REQ-NNN |` rows; the ninth was this programme's own brief, fixed the
+day it was measured. That the coverage table has no template is a real finding with a
+real cost, and it is on the board rather than fixed here.
+
+Both directions, because they are different failures: a shipped REQ that entered no
+ledger, and a ledger row about a requirement no brief carries.
+
+**Seeded truthfully: 103 rows, every one `never`.** Thirty-one versions shipped, and not
+one recorded instance of a person confirming a shipped requirement afterwards. That is
+not a new problem — it is the first time it can be stated.
+
+**Review round: N1's lesson carried forward by its wrong half.** The Human check
+scanned *every* cell for a date or `never`, so a bare date sitting in the Note column
+satisfied a row whose Human read *"soon"* — precisely the prose the guard exists to
+reject. N1 concluded *"the header names the candidate columns and the match happens
+inside them"*, not *"never look at columns"*; this file is templated and has exactly one
+shape, so the column is located by name and read alone.
+
+**A file that states one truth twice, and drifted for two modules.** `artifacts.md`
+carries an ASCII layout tree *and* the tables that name the same files — and the tree
+never gained `backlog.md` (shipped in v1.31.0) or `verification.md` (this release), both
+named in tables a hundred lines above it. A reader found it; nothing compared them. The
+tree is now computed against those tables.
+
+The seeded ledger also truncated its `What` column at 72 characters, leaving unterminated
+code spans, while the template it follows says *"copied from the brief, not re-worded"* —
+sixty-seven of a hundred and three rows landing at exactly 72 is a script's fingerprint,
+not an editor's. Reseeded in full: 26 to 246 characters, none at 72.
+
+**The ledger recorded unbuilt features as shipped and verified.** The seed took every
+REQ from every brief — including this programme's own, whose REQ-004/008/009/010 belong
+to modules that do not exist yet, and whose N2 rows were stamped with N1's version. In
+the file whose entire purpose is *what actually shipped*. Reseeded: **99 rows**, four
+omitted as not yet built, each module stamped with its own release.
+
+**And the count is printed.** It was computed and dropped on the floor for a release — a
+measurement nobody surfaces is the same silence as no measurement:
+
+```
+verification: 99 shipped REQ · 99 never confirmed by a person  (disclosure — no floor, no target)
+```
+
+Ninety-nine shipped requirements, not one confirmed by a person. That is the answer to a
+question this repository could not previously ask.
+
+Guards: 175 → **185**, property checks 4 → 8.
+
+## v1.31.0 — the board, and the pointer that was never the one dangling
+
+The carry-over ledger has always offered `backlog` as a home for a deferred row — a
+place the pipeline **named and did not own**. The obvious fix was to build that
+backlog. Measuring first changed the target: across ten ledgers in this repository,
+**not one row has ever used that value.** The dangling pointer was never `backlog`. It
+was `open` — **sixteen rows across six ledgers** (later re-measured: **24 rows across eight**), deferred out loud and filed nowhere.
+
+`docs/superpowers/backlog.md` is the board: one per project, **mutable** where the
+ledger is append-only, because a queue is re-ranked and a history is not. Rows leave
+only into a *Closed* list, with the commit.
+
+**Priority is computed, never assigned:** `prio = sev × blast + age_bonus`, inputs in
+the row and the formula in the doctrine, so a ranking can be **checked** rather than
+trusted. Two consequences are the point rather than side effects: an old small thing
+eventually outranks a new medium one, and a row's priority moves without anyone
+touching it — which is what makes the re-derivation at the end of an iteration real
+work instead of ceremony.
+
+**Ten ledgers, six different column shapes.** `#` or `id`; the status column named
+*Home*, *Where it lives now*, *Resolution*, *Status* or *State*. So the guard finds
+columns **by name** — a positional read would have silently checked the wrong cell in
+five files out of six, and passed.
+
+Both directions, because they are different failures: a ledger row pointing at an id
+nobody issued, and a board row traceable to nothing. Neither is visible from the other
+side.
+
+The seam was closed rather than deferred: all sixteen rows carry a board id, so the
+floor is **zero** and the next unhomed row fails the build instead of joining a debt.
+This repo's own board opens seeded from those ledgers, with several rows that were the
+same finding written separately by different runs — collapsed into one each, which is the
+job the board exists for. The count is deliberately not restated here: it moved twice
+while this entry was being written, which is exactly why this repository deletes
+restated numbers rather than chasing them.
+
+**The review found the guard reading the wrong cell in half the corpus.** The status
+column was taken by position — and five of ten ledgers here carry *two* status-ish
+columns (`status`+`home`, `resolution`+`state`), so "take the last one" read a different
+cell per file and passed genuinely open rows in silence. Three more rows carry more
+cells than their header and were skipped outright.
+
+The test is now **position-free**: a row is open if any of its cells says so, and homed
+if a board id appears anywhere in it. Neither question asks which column it came from,
+so neither can be defeated by a shape nobody anticipated. It immediately found **eight
+more open rows** — the true count was 24, not 16, and my own measurement was a third
+low. Three of the eight were the same *"evals never run"* finding written by three
+different runs; the board collapses them into one, which is the job it exists for.
+
+Two more from the same round: the new stage-0 bullet was spliced into the middle of the
+word *"the"* and `npm test` did not see it, and `templates/backlog.md` — the file seeded
+verbatim into every host project — shipped a worked example that **contradicted the
+formula printed two lines below it**. The arithmetic is now a guard, over both boards.
+
+**The class the board logs hit the board itself.** A blank line inside its table split
+three rows off into prose — and row **B-004** on that same board reads *"a blank line
+silently splits a markdown table, and the documentation gate does not catch it."* Second
+instance of a class this repository already had written down, so it became a script
+rather than a third ledger row, swept across the whole corpus. B-004 is closed by the
+check it asked for.
+
+**A promise is not a check.** Three doctrine passages described stage-10 resolution as
+keyed on a ledger row homed `backlog`, and the seeded template said outright that *the
+gate refuses it* — while the shipped guard only ever looked for `open`. A reader seeded
+a scratch ledger with exactly that row and watched it pass. Both triggers are enforced
+now, and the doctrine describes what runs.
+
+The split-table guard, one round old, could not tell *"table split"* from *"table ends,
+table begins"* — it never checked whether the line after the blank opens its own table,
+which its own comment claimed it did. A **property check** now proves it stays quiet on
+the valid pattern, because a checker with false positives is worse than none.
+
+**A tightening that turned the guard off.** Fixing the false positive above, the
+separators were hand-listed — and the list omitted the arrow this repo's own annotations
+use (`open → B-001`), so **all twenty-four resolved rows became invisible** and the
+check passed by seeing nothing at all rather than by finding everything homed. The one
+negative test covering that path caught it, which is the entire argument for the suite
+in a sentence. The separator is now *"not a word character"* and the predicate is proven
+against eight concrete cases instead of one.
+
+**The detector reversed three times, and the third answer was in between.** Positional
+read the wrong cell wherever a ledger carried two status columns. Pure-text then broke in
+both directions with one regex — too strict for a live row worded *"open as a printed
+exclusion"*, too loose for a description reading *"Open-source …"*, because a hyphen is
+punctuation exactly like the arrow. What ships reads the header for **candidate columns**
+— all of them, never just the last — and matches a status on a word boundary **inside**
+them. A description cannot masquerade as a status because it is never looked at.
+
+Every reversal was found by a reader. None by a probe.
+
+**Two surfaces did not know the board exists.** `cursor/rules/task-pipeline.mdc` and
+the command restate stage 0 and stage 10 in detail, and neither mentioned it — the same
+one-rule-in-one-file-of-nine class this repository has a guard for on the rotation axes
+and none for a new mechanism. Both carry it now, the Cursor rule by restatement because
+it is self-contained by contract.
+
+**The class that ran through six rounds is closed by computation, not by a sixth fix.**
+Every one of those rounds found the same shape: the doctrine promised a resolution
+trigger the check did not enforce — `open` alone while the prose said `backlog`,
+`backlog` added while `unresolved` was still only promised, *"two triggers"* written in
+a file whose code checked three. `audit.md` says a class seen twice becomes a script, so
+the enumeration is now **extracted from the regex** and required to appear wherever the
+doctrine lists it, in both directions. A guard that loses its own source fails rather
+than passing.
+
+**And the seam's origin was the template nobody opened.**
+`templates/carryover.md` — the first ledger every host project ever sees — showed a bare
+`backlog` home as a *settled* outcome, with a worked example carrying no board id. Six
+rounds went into the doctrine, the guard, the board and three consuming surfaces before
+anyone read the file the value came from. It names three unsettled values now, its
+example carries a real id, and the guard checks the template beside the live ledgers.
+
+**The guard written to close a false-success class had the class.** It verified that a
+trigger word appeared *somewhere on the page* rather than that it was presented as an
+enabled trigger — so prose reading *"those are the only two triggers"* would pass on the
+strength of the third word appearing in a later paragraph. Scoped to the enumerating
+paragraph now, and what it still cannot decide is written into the code rather than
+implied by its silence.
+
+Guards: 156 → **175**, property checks 1 → 4.
+
 ## v1.30.0 — the cap that would have measured the wrong axis
 
 The audit's last finding was that `references/learned.md` has no retirement rule while

package/CONTRIBUTING.md

@@ -374,7 +374,29 @@ Exclusions are allowed and must each carry a reason in the code: a changelog nar
 old formats, `docs/superpowers/specs/` are point-in-time records.
 *(guard: `a worked GATE verdict omits ` and `states the cold-retirement condition as` — both now run over corpora walked from disk, so a new surface joins by existing)*
 
-**44. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
+**44. A carry-over row still `open` names a board id, and the board row names it back.**
+`docs/superpowers/backlog.md` is the project's queue between runs; the ledger's `open`
+was a home that pointed nowhere, and rows across eight ledgers sat in it — sixteen by the first, positional count, twenty-four once the check stopped reading by column. Both
+directions are checked because they are different failures — an id nobody issued, and a
+row traceable to nothing. The test is **position-free**: a row is open if any of its cells
+says so, and homed if a board id appears anywhere in it. Neither question asks which
+column the value came from — ten ledgers here carry six header shapes and **five of them
+have two status-ish columns**, so both a positional read and a by-name read pick a
+different cell per file and pass open rows in silence. Reading by name was the first
+design and it was wrong for the same reason.
+*(guard: `with no board id` and `names no Source`)*
+
+**45. Every shipped REQ has a verification row, and `Human` is a date or `never`.**
+`docs/superpowers/verification.md` records the one thing no check can decide — whether a
+person looked after it shipped. Both directions: a shipped REQ with no row, and a row
+whose REQ is in no brief. It keys to the brief because eight of nine briefs carry
+machine-readable REQ rows while ten acceptance files carry their coverage table in nearly
+as many shapes. **The `never` count has no floor and may never be given a target**; a
+property check proves that filling the column does not fail the build, because a gate
+that punishes an honest answer will not receive one.
+*(guard: `either a date or the literal` and `is in no brief's REQ table`)*
+
+**46. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a

package/README.md

@@ -129,6 +129,8 @@ until it is installed.
 | 10 + any audit | [`audit.md`](plugins/task-pipeline/skills/task-pipeline/references/audit.md) — the L0→L7 ladder and its seams, axis rotation, ratchets, proven checks |
 | any loop | [`loop-guard.md`](plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md) — churn detection, caps, the break protocol |
 | run-wide pacing | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) — the loop mode (`run.loop`, default off, never collapses a manual gate) and the context budget (fires on a harness signal, never on an estimate) |
+| the board between runs | [`backlog.md`](plugins/task-pipeline/skills/task-pipeline/references/backlog.md) — the work-list that outlives a run: seeded at stage 0 or picked up, priority **computed** from three stated inputs rather than assigned, and the seam where the carry-over ledger's `backlog` pointer finally resolves |
+| what a human confirmed | [`verification.md`](plugins/task-pipeline/skills/task-pipeline/references/verification.md) — one row per shipped REQ and the one column a machine may not fill: the date somebody **looked**, or `never`. No floor, no target — `never` is a fact, and a count driven down is a column that has started lying |
 | 0 + 9 + any settled decision | [`documentation.md`](plugins/task-pipeline/skills/task-pipeline/references/documentation.md) — the inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built |
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.30.0 |
+| **Version** | 1.32.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -174,6 +174,18 @@ Seed a **carry-over ledger** next to the brief, append-only. Anything deferred,
 dropped, or left half-done goes in the moment it's said — including implementer
 concerns and non-blocking review findings. **Deferred out loud is forgotten.**
 
+Read **the verification ledger** — `docs/superpowers/verification.md` — and quote how
+many rows sit at `never`: that is the project's standing exposure, and stage 0 is where
+it is cheapest to look. `never` is a fact, not a failure; the count has no floor and may
+never be given a target.
+
+Read **the board** — `docs/superpowers/backlog.md`, the project's work-list *between*
+runs — and quote its open count in the brief; seed it from the template when absent. Its
+priority is **computed, never assigned**: `prio = sev × blast + age_bonus`, with the
+three inputs in the row so a ranking can be checked rather than trusted, and `age` moving
+on its own is why the re-derivation at an iteration's end is real work. Where the ledger
+records what *this run* deferred, the board is what the project still owes.
+
 Stop when shared understanding is reached (every branch answered or explicitly
 deferred) and lock the answers into a short brief the user confirms. Only then
 start. Later stages read that brief instead of asking again.
@@ -334,6 +346,17 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     per project, not per run**. Every gate above is good at *this* run and blind
     across runs: the same class of failure gets caught, fixed and forgotten five
     times and nothing notices it is the same one. So, in this order —
+    **0a. Every REQ this run shipped has a verification row**, and every row names a
+    REQ some brief carries — both directions, because a shipped feature that entered no
+    ledger and a ledger row about nothing are different failures.
+
+    **0. Resolve the ledger onto the board first.** Every carry-over row still
+    `open`, `unresolved`, or homed `backlog` leaves with a `B-NNN` id on
+    `docs/superpowers/backlog.md`, and the ledger row is updated to name it — both
+    directions, because a pointer to an id nobody issued and a board row traceable to
+    nothing are different failures. Then re-derive the board's priorities: `age` moved
+    while the run was happening.
+
     **1. Stamp the run first** — date, topic, commit, verdict, counts. It costs one
     line and it is the only thing that makes the next step computable: one retirement
     trigger counts firings across the last five run stamps **or sixty days**, whichever

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.30.0",
+  "version": "1.32.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.30.0",
+  "version": "1.32.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -30,8 +30,8 @@ grill's **domain awareness** (challenge terms against `CONTEXT.md`, sharpen fuzz
 language, ADRs for hard-to-reverse calls) and covering the **autonomy sweep** (what
 would otherwise stop stages 1→10: docs sources incl. doc repos, the wiki and the code graph, branch/tracker
 policy, test and lint commands, deploy target and authorization, log locations, docs/wiki/graph targets, and for UI tasks whether the design is done visually in Figma or text-only, whether the Figma MCP is connected, and — if it isn't — whether to ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; **and with Figma on, the design destination: which team/org by name and which file** — the recorded one, a URL the operator gives, or creation in that named team explicitly authorized, written into the project's canonical record before the first frame, because a destination decided at drawing time is how a project ends up with three design files and no way to tell which is real. **Never create while a recorded file resolves; if it doesn't resolve, stop and ask — never create a replacement**) —
-until the brief is locked — including the **REQ table**, the request as an addressable list where every row names how it is verified — so the rest runs autonomously and the final stage can account for all of it. The list is frozen: adding is free, removing needs the operator's agreement. Anything deferred goes into the carry-over ledger the moment it's said. For any user-facing task, recommend/use
-**super-ux**. **If the brief describes a platform rather than a change**, stage 2 also cuts it into modules (`references/decomposition.md`) — module map committed, walking skeleton first, every REQ in exactly one module — and stages 3→10 then run per module, one brick at a time. **If any loop starts undoing an earlier pass** (same file edited twice for the same reason, a closed finding returning, a third entry into one stage), stop and run the loop guard (`references/loop-guard.md`): name both shapes, escalate to the layer that owns the conflict, re-plan the check as an ordered list, then go item by item. **The closing stage opens with the ladder walk** (`references/audit.md`): the REQ table finds what was named and lost, but a comparison needs two sides and an absence has one — so walk each REQ bottom-up through its rungs (decision → spec section → contract *and its failure behavior* → task → change → executed test → surface/docs), check the seam at each step, order findings by seam rather than by file, and turn every absence into a new REQ row **before** the coverage table is written. A green from a check nobody has watched fail against a planted defect is not evidence; a finding class seen twice becomes a script rather than a third ledger row; and the carry-over ledger's counts are printed beside every gate verdict, so "green" never reads as "verified". If a searching pass starts finding mostly what the previous pass's own fixes broke, the axis is exhausted — rotate it, don't look harder. **The docs stage closes three artifacts, not two:** module docs, the wiki, **and the code graph** (`/graphify . --update` where `graphify-out/` exists — `references/knowledge-graph.md`), because the graph is what the next run's harvest queries first and a stale one is a false premise carrying the authority of a machine. Then check the graph against the docs: a hub `graphify god-nodes` reports that no document names is an undocumented seam; an edge the docs deny is a leak in the code or a lie in the docs; a doc naming a module the graph no longer has is stale. Doc-side findings are fixed there, absences become REQ rows in the closing stage. **In a project of several repositories, stage 10 closes on the parent too:** a parent records each submodule as a pointer to one commit, and moving the submodule does not move the pointer — so the work can be committed, pushed and green while a clone of the parent still gets the commit before it. Neither repo looks wrong alone, which is why it survives every check that runs inside one. Require `git submodule status` with no line starting `+`, and every repo clean and pushed (`git -C <repo> status --porcelain`, `git -C <repo> log @{u}..HEAD`). The fix is two commands and the second gets forgotten: push the submodule, then `git add <submodule> && git commit`. **The run's last act is the retrospective** (`references/retrospective.md` → `docs/superpowers/retro.md`, one file per project): **stamp the run first** (its commit is what makes the cold-retirement trigger computable), **then prune** — every standing instruction against its three retirement triggers (it became a check; the paths/commands it names are gone; it hasn't fired in five run stamps, or in sixty days — the calendar is the unit that still moves when the stamp counter has stopped), the list held to a hard cap of ten, every deletion logged as one line and never silent — then, only if the run diverged, write the entry: symptom with evidence, the stage it surfaced at, the stage that *owned* it, the root cause, the fix by grade (mechanical check > standing instruction > note that expires in two runs), and the check that catches it next time. Stage 0 reads those standing instructions in full, so the prune is a gate criterion, not a good intention: a rule nobody reads to the end is worse than no rule, because everyone believes it is covered. Honor every stage gate by its type (`auto` = verify yourself;
+until the brief is locked — including the **REQ table**, the request as an addressable list where every row names how it is verified — so the rest runs autonomously and the final stage can account for all of it. The list is frozen: adding is free, removing needs the operator's agreement. Anything deferred goes into the carry-over ledger the moment it's said, and **the board** (`docs/superpowers/backlog.md`, `references/backlog.md`) — the work-list between runs — is read at stage 0 with its open count quoted in the brief, or seeded when absent; **the verification ledger** (`docs/superpowers/verification.md`, `references/verification.md`) is read at stage 0 for how many rows sit at `never`, written at stage 8 with one row per shipped REQ, and required at stage 10 in both directions. For any user-facing task, recommend/use
+**super-ux**. **If the brief describes a platform rather than a change**, stage 2 also cuts it into modules (`references/decomposition.md`) — module map committed, walking skeleton first, every REQ in exactly one module — and stages 3→10 then run per module, one brick at a time. **If any loop starts undoing an earlier pass** (same file edited twice for the same reason, a closed finding returning, a third entry into one stage), stop and run the loop guard (`references/loop-guard.md`): name both shapes, escalate to the layer that owns the conflict, re-plan the check as an ordered list, then go item by item. **The closing stage opens with the ladder walk** (`references/audit.md`): the REQ table finds what was named and lost, but a comparison needs two sides and an absence has one — so walk each REQ bottom-up through its rungs (decision → spec section → contract *and its failure behavior* → task → change → executed test → surface/docs), check the seam at each step, order findings by seam rather than by file, and turn every absence into a new REQ row **before** the coverage table is written. A green from a check nobody has watched fail against a planted defect is not evidence; a finding class seen twice becomes a script rather than a third ledger row; and every ledger row still `open`, `unresolved` or homed `backlog` leaves stage 10 with a board id and the board's priorities are re-derived (`references/backlog.md`); the carry-over ledger's counts are printed beside every gate verdict, so "green" never reads as "verified". If a searching pass starts finding mostly what the previous pass's own fixes broke, the axis is exhausted — rotate it, don't look harder. **The docs stage closes three artifacts, not two:** module docs, the wiki, **and the code graph** (`/graphify . --update` where `graphify-out/` exists — `references/knowledge-graph.md`), because the graph is what the next run's harvest queries first and a stale one is a false premise carrying the authority of a machine. Then check the graph against the docs: a hub `graphify god-nodes` reports that no document names is an undocumented seam; an edge the docs deny is a leak in the code or a lie in the docs; a doc naming a module the graph no longer has is stale. Doc-side findings are fixed there, absences become REQ rows in the closing stage. **In a project of several repositories, stage 10 closes on the parent too:** a parent records each submodule as a pointer to one commit, and moving the submodule does not move the pointer — so the work can be committed, pushed and green while a clone of the parent still gets the commit before it. Neither repo looks wrong alone, which is why it survives every check that runs inside one. Require `git submodule status` with no line starting `+`, and every repo clean and pushed (`git -C <repo> status --porcelain`, `git -C <repo> log @{u}..HEAD`). The fix is two commands and the second gets forgotten: push the submodule, then `git add <submodule> && git commit`. **The run's last act is the retrospective** (`references/retrospective.md` → `docs/superpowers/retro.md`, one file per project): **stamp the run first** (its commit is what makes the cold-retirement trigger computable), **then prune** — every standing instruction against its three retirement triggers (it became a check; the paths/commands it names are gone; it hasn't fired in five run stamps, or in sixty days — the calendar is the unit that still moves when the stamp counter has stopped), the list held to a hard cap of ten, every deletion logged as one line and never silent — then, only if the run diverged, write the entry: symptom with evidence, the stage it surfaced at, the stage that *owned* it, the root cause, the fix by grade (mechanical check > standing instruction > note that expires in two runs), and the check that catches it next time. Stage 0 reads those standing instructions in full, so the prune is a gate criterion, not a good intention: a rule nobody reads to the end is worse than no rule, because everyone believes it is covered. Honor every stage gate by its type (`auto` = verify yourself;
 `manual` = wait for explicit go). Confirm the **model once at preflight** —
 recommend the most capable one the environment offers, never a hardcoded id — then
 run the whole pipeline on it without re-asking.

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -68,6 +68,8 @@ gate stops until it is installed.
 | **what travels with the bundle vs stays in a project** | [`references/portability.md`](references/portability.md) |
 | any repeating loop | [`references/loop-guard.md`](references/loop-guard.md) |
 | run-wide · how a run keeps going (the loop mode + the context budget) | [`references/continuity.md`](references/continuity.md) |
+| run-wide · the work-list **between** runs, and how its priority is computed | [`references/backlog.md`](references/backlog.md) |
+| run-wide · whether a **human** ever confirmed what shipped, and when | [`references/verification.md`](references/verification.md) |
 
 **Optional bridge.** If the operator already runs an equivalent skill set (e.g.
 `superpowers:brainstorming` / `writing-plans` / `subagent-driven-development` /

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -205,10 +205,15 @@ GATE 10 acceptance: PASS — 14/14 REQ verified
 
 All of:
 
-1. **The ladder walk ran** ([`audit.md`](audit.md)) — every REQ's rungs checked
+1. **Every shipped REQ has a verification row, and every row names a REQ its own run
+   carries** ([`verification.md`](verification.md)) — both directions, because a shipped
+   feature that entered no ledger and a ledger row about nothing are different failures.
+   The row's `Human` is a date or the literal `never`; `never` is a **fact** and its
+   count has no floor, no direction and never a target.
+2. **The ladder walk ran** ([`audit.md`](audit.md)) — every REQ's rungs checked
    bottom-up, findings ordered by seam, absences turned into REQ rows **before**
    the table was written, and the two pass counts recorded.
-2. **Every check this gate leans on has been seen failing** at least once against a
+3. **Every check this gate leans on has been seen failing** at least once against a
    planted defect (`audit.md` → *Exit criterion*; the procedure, with the commands,
    is [`gates.md`](gates.md) → *Probing*). An unproven check's green is not
    evidence. That includes **the documentation gate** the project's doc map names
@@ -216,12 +221,12 @@ All of:
    is *proven*, and its **ratchet counts are printed beside this verdict**. A
    documentation gate is the easiest one in a run to inherit unproven, because it
    was green the first time anyone looked at it.
-3. **Every REQ has a status** — none `unknown`, none blank.
-4. **Every `verified` carries evidence** of the kind above.
-5. **Every `partial` names what's missing** and where it's tracked.
-6. **Every `deferred` / `dropped` has the operator's agreement** recorded (in the
+4. **Every REQ has a status** — none `unknown`, none blank.
+5. **Every `verified` carries evidence** of the kind above.
+6. **Every `partial` names what's missing** and where it's tracked.
+7. **Every `deferred` / `dropped` has the operator's agreement** recorded (in the
    ledger or here) and, for `deferred`, a tracker entry.
-7. **No carry-over row is left `unresolved`** — every one has a home, and the
+8. **No carry-over row is left `unresolved`** — every one has a home, and the
    ledger's counts are printed with this verdict, not just filed.
 7a. **Both disclosures are printed** ([`gates.md`](gates.md) → *Disclosures*):
    `abstained` — every REQ closing `partial`, every `unknown`, every ⚠️ *cannot verify
@@ -230,11 +235,11 @@ All of:
    a movement either way wants one sentence. A run reporting `abstained: 0` is claiming
    it knew everything, which is a stronger statement than any run this stage has ever
    seen close honestly.
-8. **Every repository is closed, the parent included** — `git submodule status`
+9. **Every repository is closed, the parent included** — `git submodule status`
    shows no `+`, and each repo is clean and pushed. A submodule is finished when
    its parent points at it.
-9. **The operator answers the closing question** and signs off.
-10. **The retrospective is written** ([`retrospective.md`](retrospective.md)) — **in
+10. **The operator answers the closing question** and signs off.
+11. **The retrospective is written** ([`retrospective.md`](retrospective.md)) — **in
     order**: the run is stamped with its commit first, **then** the prune runs before
     anything is added (standing instructions checked against their retirement triggers,
     the list at or under its cap of ten, every deletion logged), **then** a run that

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -25,6 +25,8 @@ docs/
     NNNN-<slug>.md                    # the OTHER permitted decision home — one project uses ONE
   superpowers/
     retro.md                          # stage 10's last act — ONE per project, not per run
+    backlog.md                        # the work-list BETWEEN runs — read at 0, resolved at 10
+    verification.md                   # one row per shipped REQ; `Human` is a date or `never`
     retro/YYYY-QN.md                  # the archive: rotated entries + retirements, queried not read
     specs/
       YYYY-MM-DD-<topic>-brief.md     # stage 0 — locked intake brief (grill output)
@@ -76,7 +78,7 @@ whatever the context happens to hold.
 
 | Stage | Reads | From where |
 |---|---|---|
-| **0 Harvest** | the project's own knowledge about this task | code · the code graph (`graphify-out/`) · `CLAUDE.md`/`AGENTS.md` · `CONTEXT.md`/`docs/adr/` · `docs/` + `docs/ux/` · past briefs and carry-over ledgers · the retro's standing instructions **in full** · the wiki · any doc repo or hosted system the project names |
+| **0 Harvest** | the project's own knowledge about this task | code · the code graph (`graphify-out/`) · `CLAUDE.md`/`AGENTS.md` · `CONTEXT.md`/`docs/adr/` · `docs/` + `docs/ux/` · past briefs and carry-over ledgers · **the board** (`docs/superpowers/backlog.md`, open count quoted in the brief) · **the verification ledger** (`docs/superpowers/verification.md`, how many rows sit at `never`) · the retro's standing instructions **in full** · the wiki · any doc repo or hosted system the project names |
 | **0 Inventory (1b)** | the documentation regime | `docs/DOCMAP.md` — registers, single homes, propagation matrix, gate commands, ratchet floors. Absent ⇒ seeded ([`adoption.md`](adoption.md)) |
 | **0 Reconcile (1c)** | intent vs as-built | git (how it *should* be) against the run record (how it *turned out*) |
 | **0 Grill** | the operator | the interview — every answer checked against the harvest, which is what makes it checkable rather than confident |
@@ -100,6 +102,8 @@ that has not read them is running the pipeline's defaults, not this project's.
 |---|---|---|---|
 | `CLAUDE.md` / `AGENTS.md` | commands, deploy path, house rules, which docs exist and where | 0 | 6–10 |
 | `docs/DOCMAP.md` | the decision home, each fact's single home, the propagation matrix, the gate and its ratchet floors | 0 (1b) | 9 |
+| `docs/superpowers/verification.md` | one row per shipped REQ, and the one column a machine may not fill: the date a **human** confirmed it, or `never` ([`verification.md`](verification.md)) | 0 | written at 8, required at 10 |
+| `docs/superpowers/backlog.md` | the project's work-list **between** runs — ids, the three priority inputs, state. Mutable; rows leave only into its *Closed* list ([`backlog.md`](backlog.md)) | 0 | re-derived at every iteration's end; resolved at 10 |
 | `docs/superpowers/retro.md` | standing instructions — the rules no check can decide. Capped at ten, **read in full**, stamped the moment one fires | 0 | pruned at 10 |
 | `specs/<topic>-brief.md` → *Autonomy* | every pre-resolved decision; stages 1→10 **answer from it instead of asking** | 0 | 1–10 |
 | `specs/<topic>-carryover.md` | everything deferred, parked or half-done; appended the moment it is said | all | read in full at 10 |
@@ -124,6 +128,8 @@ them is a finding, not a tie-break ([`knowledge-sources.md`](knowledge-sources.m
 | 0 Inventory | `docs/DOCMAP.md` + the registers + `scripts/check-docs.sh` — seeded **only when absent**, and the seeding is the register's first entry ([`documentation.md`](documentation.md)) | every later stage; **stage 9** walks the matrix, **stage 10** proves the gate |
 | 0 Grill (domain) | `CONTEXT.md`, `docs/adr/NNNN-<slug>.md` — created **lazily**, only when a term resolves or a decision qualifies. Where `docs/adr/` **is** the register, entries carry the register's field set | stages 2–4 + the repo |
 | any stage | a register entry per settled thing, via the **Doc Loop** — recorded, resolved, propagated, committed with its id | the next run's harvest |
+| 8 Verification row | `docs/superpowers/verification.md` — one row per REQ the run shipped, written right after the deploy verification; `Human` starts at `never` ([`verification.md`](verification.md)) | stage 10 requires it; stage 0 of every later run reads it |
+| 10 Board resolution | `docs/superpowers/backlog.md` — every unresolved ledger row — homed `backlog` or still `open` — arrives with a real id, and the ledger row is updated to name it; priority re-derived ([`backlog.md`](backlog.md)) | the next run's harvest, and every loop iteration |
 | 10 Retro rotation | `docs/superpowers/retro/YYYY-QN.md` — entries older than five stamps, plus every retirement, each with its commit | queried by a later run's harvest |
 | 2 Decompose | `specs/<topic>-modules.md` — module map, build order, contracts, per-module status (platforms only) | stages 3–10, every module's run |
 | 3 Spec | `specs/<topic>-design.md` — module dossier for a decomposed platform (+ links `docs/ux/*` for UI) | stage 4 |

package/plugins/task-pipeline/skills/task-pipeline/references/backlog.md

@@ -0,0 +1,109 @@
+# The board — the work-list that outlives a run
+
+**One job: give the thing every loop already talks about a file to be.**
+[`continuity.md`](continuity.md) says each iteration must re-measure the work-list, and
+that *"next up is X"* at the end of an iteration is a claim about the board that no
+gate reads. Until this file existed, there was no board — the claim had nothing to be
+checked against.
+
+**Boundary, so this does not become a second ledger.** The carry-over ledger
+([`templates/carryover.md`](../templates/carryover.md)) records what **one run**
+deferred and closes at that run's stage 10. The board is the **project's queue**: it
+outlives runs, it is re-prioritised, and rows leave it only by closing. They meet at
+exactly one seam, and that seam already existed as a dangling pointer.
+
+---
+
+## Contents
+
+- The seam the ledger left open
+- Seeded or picked up
+- Priority is computed, not assigned
+- What a loop iteration does with it
+- Rationalizations
+
+## The seam the ledger left open
+
+The ledger's last column is *Where it lives now*, and one of its legal values is
+`backlog` — a place the pipeline named and did not own. So the honest reading of a
+finished run was: *"deferred, and filed somewhere nobody here can point at."*
+
+**Stage 10 resolves it, on three triggers.** A row is unresolved if its home reads
+`backlog` — the value that pointed nowhere — or `open`, which is what the rows in this
+repository actually said, or `unresolved`, which
+[`templates/carryover.md`](../templates/carryover.md) calls the canonical not-done value
+and says outright blocks this gate. Each of the three was, at some point, described in
+the doctrine and absent from the check; a reader found each by seeding the shape and
+watching it pass. **The trigger list is the one part of this file that must be read
+against the code, not beside it.**
+
+- every unresolved ledger row has a board id, and that id exists on the board;
+- every board row sourced from a ledger names the ledger row it came from.
+
+One direction alone is not enough, and this repository has a rule about that
+([`learned.md`](learned.md) rule 2): a ledger row pointing at a board id that was never
+created and a board row invented with no source are **different failures**, and only a
+pass in each direction finds both.
+
+## Seeded or picked up
+
+Stage 0's harvest reads `docs/superpowers/backlog.md` when it exists — it is a source
+in the ledger like any other, and its **open count is quoted in the brief**, because a
+run that begins without knowing what is already queued will cheerfully re-discover it.
+
+When the file is absent, stage 0 seeds it from
+[`templates/backlog.md`](../templates/backlog.md) and says so in the brief. Seeding is
+not a decision that needs asking: an empty board and no board are the same thing to
+work on, and only one of them can be appended to.
+
+**A picked-up board is re-measured, not recalled.** Its open count comes from a command
+at the top of the run, not from what the last run's report said — the previous run is
+precisely what invalidated that number ([`learned.md`](learned.md) rule 16).
+
+## Priority is computed, not assigned
+
+```
+prio = sev × blast + age_bonus        sev, blast ∈ 1..3
+                                      age_bonus = 1 past 14 days, 2 past 30
+```
+
+**The inputs live in the row and the formula lives here**, so a ranking can be checked
+rather than trusted. That is the whole reason the number is built this way: a
+hand-assigned priority is an opinion wearing a number's clothes, and the one thing
+nobody can audit is the number that was simply typed.
+
+Two consequences worth stating, because both are the point:
+
+- **An old small thing eventually outranks a new medium thing.** That is deliberate. A
+  row that has sat for a month is a row the queue has been lying about.
+- **A row's priority changes without anyone touching it**, because age moves. The
+  re-derivation at the end of an iteration is therefore not busywork — it is the only
+  moment the board stops being stale.
+
+`sev` and `blast` are judgement, and they are written down *as* judgement: two small
+integers a reader can disagree with, rather than a ranking they can only accept.
+
+## What a loop iteration does with it
+
+At the **top** of an iteration, one command: count the open rows and read the top few.
+At the **bottom**, re-derive `age` and `prio`, apply anything the iteration itself
+added, and take the highest-priority row.
+
+**A row added mid-iteration may outrank the row being worked on.** That is the case the
+board exists for, and it is not a reason to abandon the current item: finish the item at
+hand to its gate — `continuity.md` defines an iteration as *one item taken to its gate*
+— then take the new top. Switching mid-item is how a loop ends with three half-finished
+things and no gate passed on any of them.
+
+**The report cites the file.** *"Next up: B-014"* is checkable; *"next up: the export
+fix"* is not, and it is the one sentence in an iteration that no gate reads.
+
+## Rationalizations
+
+| The excuse | What is actually true |
+|---|---|
+| "The tracker is the backlog, this duplicates it" | Then the `Home` column carries the tracker id and this file is an index with the priority inputs visible. What it replaces is nothing; what it adds is a board an agent can read at 3am without credentials. |
+| "I'll re-prioritise when it matters" | Age moves on its own. A board re-prioritised only when someone remembers is ranked by when they last remembered. |
+| "The row is obvious, it doesn't need a source" | Six weeks later nobody can tell a finding from a passing thought, and the row is either done twice or dropped by whoever trusts it least. |
+| "Priority is a judgement call, a formula can't capture it" | The formula does not replace the judgement — it *exposes* it. `sev` and `blast` are exactly where the judgement lives, and writing them down is what lets somebody argue with it. |
+| "I'll drop the row, it's not worth a line in Closed" | Then the next run re-discovers it, re-decides it, and the decision is made twice by people who never met. A closed row costs one line. |

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -54,6 +54,8 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | Loop detection and its caps | `references/loop-guard.md` |
 | **The run mode** — item-by-item pacing, default off, what it never collapses | `references/continuity.md` |
 | **The context budget** — the evidence rule and what a flush actually updates | `references/continuity.md` |
+| **The board** — the work-list between runs, its computed priority, and the ledger seam it resolves | `references/backlog.md` |
+| **The verification ledger** — what shipped, and whether a human ever confirmed it | `references/verification.md` |
 | The retro: prune, cap, commits, archive | `references/retrospective.md` |
 | Rules earned by failure | `references/learned.md` |
 | **The routing default and its boundary** | `templates/routing-rule.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -173,6 +173,10 @@ never that the work was skipped quietly.
   seeded, the model decision is recorded, and the operator confirms the brief. Stop when a
   re-scan surfaces no new branches (don't grill past diminishing returns;
   reversible calls can be deferred with a note). Only then start stage 1.
+- **The verification ledger is read.** `docs/superpowers/verification.md` — the harvest
+  quotes **how many rows sit at `never`**, because that is the project's standing
+  exposure and stage 0 is where it is cheapest to look ([`verification.md`](verification.md)).
+- **The board is read, or seeded.** `docs/superpowers/backlog.md` ([`backlog.md`](backlog.md)) — its **open count is quoted in the brief**, measured by a command at the top of the run rather than inherited from the last run's report. Absent ⇒ seeded from the template and said so; an empty board and no board are the same thing to work on, and only one of them can be appended to.
 
 ## 1 — Docs study
 - **Freedom: medium** — which sources to fetch is judgement; grounding contracts on fetched docs is not ([`gates.md`](gates.md) → *Axis C*).
@@ -392,6 +396,12 @@ never that the work was skipped quietly.
   steps — never silent success. **The CI verdict is one of the reported facts, with
   its run id** — "CI is green" written without a command behind it prints the same
   whether it looked or not ([`gates.md`](gates.md) → *False success*).
+- **Write the verification row.** One line per REQ this run shipped, into
+  `docs/superpowers/verification.md` ([`verification.md`](verification.md)) — the run,
+  the tag or commit it went out in, what the gate said, and `Human: never` unless the
+  operator confirmed during the run. The verification above already happened; this is
+  the only step that makes it answerable **later**, and `never` is a fact rather than a
+  failure — the count has no floor and may never be given a target.
 
 ## 9 — Docs + wiki
 - **Freedom: low** — the matrix walk and the gate are mechanical; what a doc says is not this stage's call ([`gates.md`](gates.md) → *Axis C*).
@@ -453,7 +463,19 @@ never that the work was skipped quietly.
 ## 10 — Acceptance
 - **Freedom: medium** — the walk and the evidence rule are fixed; whether it is what was asked for is the operator's ([`gates.md`](gates.md) → *Axis C*).
 - **What:** the closing stage — go back to the brief and account for **every**
-  requirement. Doctrine: [`acceptance.md`](acceptance.md). Every earlier gate asks
+  requirement. Doctrine: [`acceptance.md`](acceptance.md).
+- **Every REQ this run shipped has a verification row, and every row names a REQ some
+  brief carries.** Both directions: a shipped feature that entered no ledger and a
+  ledger row about nothing are different failures ([`verification.md`](verification.md)).
+- **The ledger's open rows are resolved onto the board.** Every carry-over row still
+  `open` leaves with a `B-NNN` id on `docs/superpowers/backlog.md`, and the ledger row
+  is updated to name it ([`backlog.md`](backlog.md)). Both directions, because they are
+  different failures: a ledger row pointing at an id nobody issued, and a board row
+  traceable to nothing. Measured before this was built: across the ledgers in
+  this repository, **twenty-four rows sat `open` with no home at all** — deferred out
+  loud and filed nowhere. The first count said sixteen across six ledgers; it read the
+  status column by position and was wrong wherever a ledger carried two of them. Then the board's priority is re-derived, because `age` moved while the
+  run was happening. Every earlier gate asks
   "is this artifact good?"; none asks "does this still contain everything that was
   asked for?" The loss happens on the seams between stages, and this is where it
   surfaces.

package/plugins/task-pipeline/skills/task-pipeline/references/verification.md

@@ -0,0 +1,89 @@
+# The verification ledger — the column a machine may not fill
+
+**One job: record whether a human ever looked at what shipped, and when.**
+
+Stage 8 already performs the verification trio, reads the CI verdict and opens the
+rendered page ([`stages.md`](stages.md) → *8 — Post-deploy*). All of it is **per run**,
+and none of it accumulates. Ask a project *"which features has nobody confirmed since
+they shipped?"* and before this file the honest answer was: nobody knows, and no
+artifact could be consulted.
+
+**Boundary, so this is not a second coverage table.**
+[`acceptance.md`](acceptance.md)'s table says *an automated check passed at the moment of
+the run*. Three things it does not say, and each is why this file exists:
+
+- whether anybody **looked** after it shipped;
+- whether it still works N releases later;
+- anything at all about previous runs — it is per-run and dies with its run.
+
+---
+
+## Contents
+
+- Why it keys to the brief, not to the coverage table
+- `never` is a fact
+- What stage 8 writes and what stage 10 refuses
+- Rationalizations
+
+## Why it keys to the brief, not to the coverage table
+
+The obvious spine is the coverage table — it already carries one row per REQ with a
+verdict. Measured before building on it: **ten acceptance files in this repository, and
+the first REQ-bearing table differs in nearly every one.** Ladder walks and coverage
+tables share a file with different columns, because `acceptance.md` fixes the shape in
+prose and prose does not hold a shape across ten runs.
+
+The brief's REQ table does: **eight of nine briefs here carry machine-readable
+`| REQ-NNN |` rows**, and the ninth was fixed the day this was measured. So the ledger
+keys to the brief, and the coverage table remains what it always was — the run's own
+verdict, quoted into the `Auto` column and never re-derived.
+
+That the coverage table has no template and has already drifted is a real finding with a
+real cost, and it is on the board rather than fixed here: a run that widens its own scope
+to fix everything it touches finishes nothing.
+
+## `never` is a fact
+
+A `never` is not a defect, not a debt, and **not a number to drive down**. It is what is
+true about the world, written where somebody can act on it.
+
+The moment `never` becomes a thing to avoid writing, the column stops describing
+reality — and this is the pipeline's only signal about the world outside its own checks.
+So the count has **no floor, no direction, and may never be given a target**, exactly
+like the disclosures in [`gates.md`](gates.md). A project with forty `never` rows is not
+failing; it is a project that now knows something it could not previously ask.
+
+## What stage 8 writes and what stage 10 refuses
+
+**A coverage verdict of `review` becomes `none`.** *No check can decide this* is not
+a pass; `Auto` records what a machine established, and there the honest answer is
+nothing. The first seed wrote `pass` for four such rows — in the file whose whole
+purpose is not to do that.
+
+**Stage 8** writes one row per REQ the run shipped, right after the verification it
+already does. `Human` starts at `never` unless the operator confirmed during the run.
+
+**A REQ that spans two modules is stamped with the second, not the first.** Its criterion
+is satisfied when the last part of it exists, and stamping the earlier release claims a
+capability the project did not yet have. Caught by a reader on the first ledger this
+skill ever seeded: one row said a file was named in the maps a release before that file
+existed, and the row directly below it said when the file arrived. Two rows of one
+table, disagreeing about the same date.
+
+**Stage 10** refuses a REQ that shipped and has no row — and, in the other direction, a
+row whose REQ appears in no brief. They are different failures: a shipped feature that
+entered no ledger, and a ledger row about nothing. One direction alone finds one of them
+([`learned.md`](learned.md) rule 2).
+
+**Nothing else writes here.** Not a script, not the release job, and not stage 10 — a
+file that several stages may write is a file whose rows nobody owns.
+
+## Rationalizations
+
+| The excuse | What is actually true |
+|---|---|
+| "The tests passed, that *is* verification" | The tests passed *at the moment of the run*, against the checks somebody thought to write. This column is about the world, and the world is where the checks were not looking. |
+| "I'll fill `Human` in when I get to it" | Then the row says `never`, which is exactly correct until you do. The file is not asking you to lie faster. |
+| "Forty `never` rows looks terrible" | It looks like what it is. The alternative is forty unverified features and no way to name them, which looked fine right up until it didn't. |
+| "Stage 10 can fill it — it runs after the deploy" | Stage 10 is a machine. The single thing this column means is *a person looked*, and a machine writing it deletes the only information in the file. |
+| "We tag rarely, so `Shipped in` is awkward" | Then it carries the commit, and every row of that run carries the same one. What it may not carry is nothing. |

package/plugins/task-pipeline/skills/task-pipeline/templates/README.md

@@ -11,6 +11,8 @@ from `super-ux`.
 |---|---|---|
 | `brief.md` | `docs/superpowers/specs/YYYY-MM-DD-<topic>-brief.md` | 0 — intake grill |
 | `carryover.md` | `docs/superpowers/specs/YYYY-MM-DD-<topic>-carryover.md` | 0 seeds, all stages append, 10 reads |
+| `verification.md` | `docs/superpowers/verification.md` | 8 writes a row per shipped REQ, 10 requires it, a human fills `Human` |
+| `backlog.md` | `docs/superpowers/backlog.md` | 0 seeds when absent, any stage appends, 10 resolves and re-derives |
 | `context.md` | `CONTEXT.md` at the repo root (or per context) | 0 — grill, domain awareness |
 | `adr.md` | `docs/adr/NNNN-<slug>.md` | 0 — grill, hard-to-reverse decisions |
 | `docmap.md` | `docs/DOCMAP.md` — **one per project** | 0 — the documentation inventory |

package/plugins/task-pipeline/skills/task-pipeline/templates/backlog.md

@@ -0,0 +1,58 @@
+# Backlog — <project>
+
+> **The board.** One per project, at `docs/superpowers/backlog.md`. Unlike the
+> carry-over ledger, this file is **mutable**: priority is re-derived, state changes,
+> rows close. What may never happen silently is a row *disappearing* — a closed row is
+> marked closed, with the commit that closed it.
+>
+> **This is the file a loop iteration reads at the top and re-prioritises at the
+> bottom.** `continuity.md` requires the work-list to be re-measured every iteration;
+> this is the list.
+
+| id | What | Source | Size | Sev | Blast | Age | Prio | State | Home |
+|---|---|---|---|---|---|---|---|---|---|
+| B-001 | `export.ts` has no size guard on the write path | `2026-07-28-export` / 5 Review | S | 2 | 1 | 12 | **2** | open | — |
+| B-002 | XLSX export path | `2026-07-28-export` / 5 Dev | M | 1 | 2 | 12 | 2 | open | LIN-483 |
+| B-003 | REQ-007 bulk export | `2026-07-28-export` / 2 Brainstorm | L | 1 | 1 | 12 | 1 | dropped | operator 2026-07-28 |
+
+## Columns
+
+- **id** — `B-NNN`, issued in order, **never reused and never closed up**. A gap is
+  evidence a row left; the *Closed* section below says which and why.
+- **What** — the concrete thing. *"Error handling"* is not a row; *"`export.ts`
+  swallows a failed write instead of surfacing it"* is. Same bar as the ledger.
+- **Source** — the run and stage that surfaced it, so a reader can find the context
+  without asking. A row with no source is a wish somebody typed.
+- **Size** — `S` / `M` / `L`. Not hours: an estimate in hours is a number that will be
+  quoted back as a commitment.
+- **Sev**, **Blast**, **Age** — the three inputs to priority, each stated so the
+  priority can be recomputed by anyone. `Sev` 1–3 (annoyance / wrong behaviour /
+  data-or-money). `Blast` 1–3 (one file / one module / crosses a seam). `Age` in days
+  since the row was written.
+- **Prio** — **computed, never assigned**: `Sev × Blast + age_bonus`, where
+  `age_bonus` is `1` past 14 days and `2` past 30. The formula is repeated here on
+  purpose — the inputs are in this table, so a reader checks the arithmetic rather than
+  trusting the ranking. Full doctrine: the skill's `references/backlog.md`.
+- **State** — `open` · `in-flight` · `closed` · `dropped`. `dropped` needs the
+  operator's agreement and the date they gave it.
+- **Home** — an issue id where a tracker exists, `—` where this file *is* the tracker.
+
+## Closed
+
+Rows leave the table above only into this list, one line each, with the commit.
+
+<!-- - **B-000 · What it was** — closed by `<commit>` on <date> -->
+
+*None yet.* Stated rather than omitted: an empty list and a missing list look the same
+from outside, and only one of them means nothing has closed.
+
+## How rows arrive
+
+1. **Stage 0** seeds this file when it is absent, and reads it when it is present.
+2. **Any stage, mid-run** — the moment something is said aloud and not done. Same rule
+   as the carry-over ledger: *deferred out loud, or lost.*
+3. **Stage 10** — every carry-over row that is unresolved arrives here with a real id,
+   and the ledger row is updated to name it. Unresolved means either home `backlog` —
+   the value that used to point nowhere — or still `open`. A row in either shape with no
+   id on this board is the dangling pointer this file exists to resolve, and the gate
+   refuses it.

package/plugins/task-pipeline/skills/task-pipeline/templates/carryover.md

@@ -12,7 +12,7 @@
 | # | Stage | What | Why it isn't done | REQ | Where it lives now |
 |---|---|---|---|---|---|
 | 1 | 5 Dev | XLSX export path | scope call — CSV first | REQ-004 | LIN-483 |
-| 2 | 5 Review | `export.ts` lacks a size guard | minor, non-blocking | — | backlog |
+| 2 | 5 Review | `export.ts` lacks a size guard | minor, non-blocking | — | `B-014` |
 | 3 | 2 Brainstorm | REQ-007 dropped: bulk export | operator agreed 2026-07-28 | REQ-007 | dropped |
 
 ## Columns
@@ -23,10 +23,15 @@
 - **Why it isn't done** — scope call, blocked, deliberate deferral, out of budget.
   "Forgot" is a legitimate and useful answer here.
 - **REQ** — the requirement it belongs to, or `—` if it's outside the REQ spine.
-- **Where it lives now** — issue id, backlog, `dropped` (with the operator's
-  agreement), or `unresolved`. **`unresolved` blocks the stage-10 gate**: an item
-  with no home is exactly the thing that gets forgotten, so acceptance refuses to
-  close on it.
+- **Where it lives now** — an issue id, a **board id** (`B-NNN` on
+  `docs/superpowers/backlog.md`), or `dropped` with the operator's agreement. Those are
+  the three ways a row is *settled*.
+  **Three values are not settled and all three block the stage-10 gate:** `unresolved`,
+  `open`, and a bare `backlog` — the last one because it names a place without naming a
+  row in it, which is how a deferral reads as filed while being findable by nobody.
+  Each leaves stage 10 with a real `B-NNN`, and the board row names this ledger back.
+  An item with no home is exactly the thing that gets forgotten, so acceptance refuses
+  to close on it.
 
 ## This ledger is a ratchet, not a TODO list
 

package/plugins/task-pipeline/skills/task-pipeline/templates/verification.md

@@ -0,0 +1,55 @@
+# Verification — <project>
+
+> **Append-only.** One row per REQ, written by stage 8 when the change ships. Nobody
+> edits a row except to fill `Human` — and filling it is the one thing in this
+> repository a machine may not do.
+>
+> This is not a second coverage table. The coverage table says *an automated check
+> passed at the moment of the run*. It says nothing about whether anybody **looked**
+> after it shipped, nor whether it still works N releases later, and it dies with its
+> run. This file is the column that outlives it.
+
+| REQ | What | Run | Shipped in | Auto | Human | Note |
+|---|---|---|---|---|---|---|
+| REQ-001 | CSV export from a report | `2026-07-28-export` | v1.4.0 | pass | 2026-07-30 | opened the deployed page, exported, opened the file |
+| REQ-004 | XLSX export | `2026-07-28-export` | v1.4.0 | pass | **never** | — |
+| REQ-007 | Export respects active filters | `2026-07-28-export` | v1.4.0 | partial | **never** | CSV path only |
+
+## Columns
+
+- **REQ** — the id from the run's brief. The brief's REQ table is the spine; a row here
+  whose id is in no brief is a row about nothing.
+- **What** — copied from the brief, not re-worded. *"Check REQ-004"* sends a human to
+  look something up; *"XLSX export"* sends them to the feature.
+- **Run** — the brief's topic slug, so the context is one file away.
+- **Shipped in** — the tag or commit that carried it. Where a project does not tag,
+  the commit, and the same value every row of that run carries.
+- **Auto** — what the run's own gate said: `pass` · `partial` · `none`. Copied from the
+  coverage table rather than re-derived; where the two disagree the coverage table wins
+  and the disagreement is a finding. A coverage verdict of **`review`** — *no check can
+  decide this* — becomes `none`, because this column records what a machine established
+  and there the honest answer is *nothing*.
+- **Human** — a date, or the literal **`never`**. Nothing else. *"soon"*, *"mostly"* and
+  *"looks fine"* are how a column stops being answerable, and this is the only column in
+  the pipeline that a machine may not fill on your behalf.
+- **Note** — what the human actually did. *"opened the deployed page and exported"* is a
+  note; *"checked"* is not, and six weeks later nobody can tell those two apart.
+
+## `never` is a fact, not a failure
+
+A row sitting at `never` is not a defect and not a debt to be paid down before the next
+release. It is **what is true**, printed where somebody can act on it. The moment
+`never` becomes something to avoid writing, this file starts lying and the pipeline
+loses the only signal it has about the world outside its own checks.
+
+That is why nothing here has a floor, a target, or a direction. Count them, print them,
+and let the number be what it is.
+
+## How rows arrive
+
+1. **Stage 8** writes one row per REQ the run shipped, immediately after the deploy
+   verification it already performs — `Human` starts at `never` unless the operator
+   confirmed during the run, in which case the note says what they did.
+2. **A human, later** — fills `Human` with the date they looked, and the note with what
+   they looked at. This is the only edit any row ever receives.
+3. **Nothing else writes here.** Not stage 10, not a script, not a release job.