task-pipeline-skill 1.57.0 → 1.59.0

package/CHANGELOG.md

@@ -1,5 +1,120 @@
 # Changelog
 
+## v1.59.0 — never amend a commit a record already names
+
+### Fixed
+
+- **The stamping procedure invited the defect it then had to repair, twice in one
+  close-out.** `retrospective.md` says stamp the run with its own commit; the only way to
+  know that commit is to make it; so the stamp gets folded in with `--amend` — and the
+  amend mints a new SHA, leaving the stamp naming a commit that resolves on the machine
+  that wrote it and reaches no clone. It happened here on 2026-08-16 and then again in the
+  umbrella twenty minutes later, which is a procedure fault rather than two lapses.
+
+  The doctrine now says it in one line — **once a file names a SHA, that commit is
+  frozen** — states the order that removes the temptation (commit the work, *then* stamp in
+  a commit of its own), and names the only repair that does not re-enter the loop: a
+  follow-up commit, never a second amend.
+
+- **The documentation gate asked the weaker of the two questions.** It required every
+  backticked SHA in the retro to *resolve*, and an amended-away commit resolves for as long
+  as the object survives locally. It now also requires **reachability from `HEAD`**
+  (`git merge-base --is-ancestor`), which is the question a reader two months later is
+  actually asking. Watched failing on a purpose-built repository whose stamped commit had
+  been amended away: `commit ... resolves but is NOT reachable from HEAD`.
+
+- **Three id registers that could never allocate are removed** (`B-45`). They were declared
+  over the `fs` backend, whose `reserve` refuses by design, and `agent_sync.py check` had
+  been calling it a problem for as long as they stood. A declaration that cannot be served
+  is worse than none: it reads as a capability, so nobody writes the procedure it hides —
+  and on 2026-08-15 two sessions filed a different `B-073`. Allocation is manual, documented
+  in `CLAUDE.md`, and the guard that requires that documentation now fires on the **backend**
+  rather than on the declaration, so removing the registers could not retire it.
+
+Guards: 344 → **344**. Property checks: 9 → 9. No new plant, and that is the honest
+number: what changed is a gate script (`templates/docgate.sh`) rather than a validator
+guard, and it was watched failing against a purpose-built repository whose stamped commit
+had been amended away — the plant lives in that measurement rather than in the workflow,
+because a gate that runs over a project's own git history cannot be planted from inside a
+copy of this one.
+
+- **The coordination snapshot exists and is linked.** `docs/AGENT_SYNC.md` was missing
+  entirely, which `check` had also been reporting. Generated from the live configuration and
+  linked from `CLAUDE.md`; `agent_sync.py check` → **exit 0, `setup healthy`**, for the first
+  time in this repository.
+
+## v1.58.0 — a fan-out is not finished when its branches are
+
+The graph model this pipeline was audited against in v1.57.0 named one defect and fixed
+it in one place. Applying the same model to the rest of the skill found the same defect
+in **three more**, and they are the same sentence each time: work fans out, the branches
+each go green, and the node that consumes them trusts them because they arrived.
+
+### Added
+
+- **The harvest is a convergence, and now it has a check.** Stage 0 queries the code, the
+  graph, `CLAUDE.md`, the ADRs, the docs, past briefs, the wiki, the board — all
+  independently — and lands them in one brief the interview then treats as a single
+  answer. Phase 2 checks each *answer* against the harvest; **nothing compared the sources
+  with each other**, so a doc contradicting the code produced two rows that each looked
+  fine and the run followed whichever it read last. The ledger now carries a
+  `Contradictions:` line with four things to look for, and the stage-0 gate reads it.
+  `Contradictions: none` is the answer most runs write, and writing it is the point.
+
+- **Stage 3's COPY and VISUAL tracks are a parallel layer, and their convergence has a
+  check.** Neither consumes the other — copy is written from the scenarios and the brand
+  pack, the visual from the frame and the style pack — so the order they were written in
+  was a fake edge teaching a run to wait for a result that never arrives. What they do
+  share is the screen, which is where the real failure lives: **each track is right alone
+  and they disagree together.** A label the layout has no room for, a state one drew and
+  the other never wrote, two names for one component, a tone the motion contradicts.
+
+- **Stage 9's three artifacts are named as a convergence**, and the graph↔docs divergence
+  check as its gate rather than a nicety — it is the only thing that compares two of the
+  three outputs against each other.
+
+Guards: 339 → **344**. Property checks: 9 → 9. Five new plants, one per branch of the
+three new checks, each anchored on a heading and each asserting it changed something.
+Two of the five were broken on their first run and both failures were mine: a grep
+pattern one character short of the message it looked for — **the same class fixed hours
+earlier in this programme and not swept into the new plants**, which is R-003 — and an
+assertion looking for the doctrine in the file that does not hold it.
+
+### Changed
+
+- **The stage-4 gate reads both halves of what it requires**, and the id/version
+  allocation this repository actually uses is written down. `.claude/agent-sync.json`
+  declares three id registers over an `fs` backend whose `reserve` refuses by design —
+  correctly, since *pretending would hand two agents the same id* — and the declaration
+  read as a capability, so nobody wrote the manual procedure it was hiding. On 2026-08-15
+  two sessions filed a different `B-073` and two branches claimed one version number.
+  `CLAUDE.md` now carries the three-step allocation (lease first, compute from the
+  **committed** file, commit before releasing) and the version rule (`git ls-remote --tags`,
+  because a local checkout is not where the answer lives), the shipped doctrine in
+  `documentation.md` carries the generalisable half, and a guard requires both.
+
+### Fixed
+
+- **Two concurrent runs of `test/negatives.py` no longer corrupt each other** (`B-075`).
+  Every step copies the repo to a **fixed** `/tmp` name, which is right in CI — one runner
+  per job — and wrong on a machine where a second suite is already running. The runner now
+  serialises the runs instead: an exclusive lock for the duration of the suite, so a second
+  run **waits** rather than corrupting the first and says so instead of producing a number
+  nobody can trust. The 344 workflow steps are untouched — they are the CI contract, one
+  runner per job, and they were never the ones colliding.
+
+  **The first fix was wrong and is worth recording.** It rewrote every `/tmp/...` path in a
+  step's script to a per-run name, and it broke two plants whose payload **is the workflow
+  text** — they search the copied workflow for a literal path in order to duplicate it. A
+  mechanical rewrite cannot tell a path being *used* from a path being *discussed*, which is
+  the umbrella's standing instruction #7 met for the second time in two days, both times by
+  the same author. The suite caught it; reading did not.
+
+  **Watched both ways, under real overlap.** Before, two concurrent runs of one selector
+  returned `1 guard did not fire, 7 broken` and `8 guards did not fire` — two different
+  wrong answers about a tree that was not changing. After, both return `all 8 guards
+  provably reject their planted defect`, exit 0, with the second printing that it waited.
+
 ## v1.57.0 — an arrow that carries nothing is not an arrow, and two green diffs can still contradict each other
 
 The pipeline has drawn a dependency graph at stage 4 since it had a stage 4, and grouped

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.57.0 |
+| **Version** | 1.59.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.57.0",
+  "version": "1.59.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.57.0",
+  "version": "1.59.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -115,8 +115,12 @@ log and archive are **queried** by the task's nouns, because nothing caps them
 outranks any document — **but only out loud**, so an override is a recorded decision
 rather than an undetected divergence. That ledger is also stage 9's work list.
 
-**Three artifacts close a run, not two.** Stage 9 syncs the docs, the wiki **and the
-code graph** (`/graphify . --update`). The graph is what the next run's harvest queries
+**Three artifacts close a run, not two — and they are a convergence, not a sequence.**
+Stage 9 syncs the docs, the wiki **and the code graph** (`/graphify . --update`). None of
+the three consumes another; all three consume the same change, and the **graph↔docs
+divergence check is the gate over their convergence** rather than an extra nicety. That is
+why it is not optional where a graph exists: it is the only thing that compares two of the
+three outputs against each other. The graph is what the next run's harvest queries
 first, so a stale one is a false premise **carrying the authority of a machine** —
 a wrong doc gets argued with, a wrong graph gets believed. Refreshing it buys the
 graph↔docs divergence check; doc-side findings are fixed at stage 9, absences become
@@ -248,10 +252,10 @@ capable available — see `references/model-tiering.md`).
 
 | # | Stage | Gate | Type |
 |---|---|---|---|
-| 0 | Intake grill — **mandatory** | source ledger written; **the documentation inventory answered into `docs/DOCMAP.md`** — registers, single homes, the propagation matrix, the gate command — and **intent reconciled against as-built**, every divergence resolved ([`references/documentation.md`](references/documentation.md)); the retro read in full and its archive queried; shared understanding reached; autonomy sweep covered; brief locked + confirmed | manual |
+| 0 | Intake grill — **mandatory** | source ledger written **with its `Contradictions:` line** — the harvest converges on one brief and nothing else compares the sources with each other; **the documentation inventory answered into `docs/DOCMAP.md`** — registers, single homes, the propagation matrix, the gate command — and **intent reconciled against as-built**, every divergence resolved ([`references/documentation.md`](references/documentation.md)); the retro read in full and its archive queried; shared understanding reached; autonomy sweep covered; brief locked + confirmed | manual |
 | 1 | Docs study | contracts grounded on fetched docs | auto |
 | 2 | Brainstorm + decompose | design approved; UI verdict recorded; every REQ answered; platform: module map approved | manual |
-| 3 | Spec | committed + reviewed; UI: chain validated, linter green, scenarios/`SCR-` traced | manual |
+| 3 | Spec | committed + reviewed; UI: chain validated, linter green, scenarios/`SCR-` traced; **COPY and VISUAL are a parallel layer after UX, and where both ran their convergence check is recorded** — a label the layout has no room for is right in each track and wrong on the screen ([`references/stages.md`](references/stages.md)) | manual |
 | 4 | Plan | parallel-ready, DoD per task; **every edge names what it carries** — the fake-edge test run, its `Edges:` count computed, and no arrow left whose payload nobody can name ([`references/planning.md`](references/planning.md)) | auto |
 | 5 | Dev | tasks DONE, TDD green per task, branch integrated per the brief; **a fanned-out group gets one convergence check over all its diffs together before the first worktree lands** — a per-task review cannot see a contradiction that exists only between two of them ([`references/build.md`](references/build.md) §4.2a); **anything generated passes its own checks, and local infrastructure does not publish the host's default ports** ([`references/learned.md`](references/learned.md)) | auto |
 | 6 | Tests | full suite green; new/changed code covered; **every new check probed both ways and asserted on its exit code**, and the suite run once against a cold environment ; **on a web front end the surface is checked in a browser, not in the diff** — a green suite cannot see a component that renders under a fixed header, a request that 404s past its mock, or a console error — and a browser **test suite** is the other half of the pair, never a substitute for the look (`playwright` or `chrome-devtools`, either one — **how**: [`references/browser.md`](references/browser.md), which channel: [`references/companion-skills.md`](references/companion-skills.md); absent → say *verified by reading the diff* and record it as the weaker claim it is) | auto |

package/plugins/task-pipeline/skills/task-pipeline/references/documentation.md

@@ -353,6 +353,23 @@ A register is the one file two agents will write in the same minute.
   a real state, not a formality. Describing a project as protected while nothing
   enforces it is worse than having no protection, because everyone downstream
   believes the guarantee.
+- **A register declared against a backend that cannot reserve is a register in name
+  only, and its presence is what stops the manual procedure being written.** Measured
+  2026-08-15: a project declared three id registers over a local-filesystem backend
+  whose `reserve` correctly refuses — *pretending would hand two agents the same id* —
+  and two sessions filed a different `B-073` on the same afternoon. The tool was honest;
+  the *declaration* was the problem, because a capability that appears to exist is one
+  nobody replaces. Where reservation is not available, write the three-step manual
+  allocation down where an agent reads it, and make it follow the lease:
+  1. take the lease on the register's file **first**;
+  2. compute the next id from the **committed** file — `git show HEAD:<file>` — never
+     from a working copy, which holds your own unpushed row and hides somebody else's;
+  3. write and **commit** before releasing the lease. An id held only in an uncommitted
+     file is an id nobody else can see you took.
+- **A version number is the same class with no register at all.** Two branches both
+  claimed one version on that same afternoon because each incremented from what its own
+  checkout knew. Read the remote — `git ls-remote --tags` — because that list is the only
+  place the answer lives.
 
 ---
 

package/plugins/task-pipeline/skills/task-pipeline/references/knowledge-sources.md

@@ -17,6 +17,7 @@ that goes stale when the answer changes.
 - The knowledge wiki — recommended
 - How to harvest — retrieval, not reading
 - Record it — the source ledger
+- The harvest is a convergence, so it needs a check across its sources
 - The source is not the copy you have
 - Carried-in claims — measured or recalled
 - Phase 2 — validate the answers against the harvest
@@ -177,6 +178,38 @@ source nobody will update.
 **"No sources found" is a valid, recorded outcome.** Write the row. An empty ledger
 tells the next run that the search happened and came back empty — silence doesn't.
 
+## The harvest is a convergence, so it needs a check across its sources
+
+Every row above was produced independently — the code does not know what the ADR says,
+the wiki does not know what the graph found. Then all of them arrive at one place, the
+brief, and the interview treats that place as a single answer. **That is a fan-out with
+a convergence, and a convergence trusts its inputs because they arrived**
+(`agent-stack` → `agent-orchestrator/references/graph-engineering.md`, the checker node).
+
+Phase 2 below checks each *answer* against the harvest. Nothing checks the **sources
+against each other**, and that is the gap: a doc that contradicts the code produces two
+rows that each look fine, and the run picks whichever it read last.
+
+So before the first question, walk the ledger once more and write a **`Contradictions:`**
+line under it. Four things to look for, and they are the checker's five catches with the
+one that cannot apply here dropped:
+
+1. **Empty** — a source that was consulted and said nothing about this task. Already a
+   valid row; the point is that it must be *written*, not omitted.
+2. **Mutually contradictory** — two sources that cannot both be true. Name both rows and
+   which one this run will follow, **out loud**, because the operator outranks a document
+   only when the override is recorded.
+3. **Off-topic** — a row that answers a neighbouring question. It inflates the ledger and
+   makes the next reader trust a source that was never about this.
+4. **Stale against a fresher neighbour** — the graph built a week before the code it
+   describes, an ADR superseded by a decision nobody linked. This is the one the `Fresh?`
+   column exists for and nobody compares.
+
+`Contradictions: none` is the answer most runs will write, and writing it is the point:
+a check whose silence is indistinguishable from not having run is not evidence. Anything
+found here is a stage-9 obligation — the ledger's row is what stage 9 goes back and
+fixes.
+
 ## The source is not the copy you have
 
 `learned.md` rule 17. The harvest reads the project's own files, and one property of them is

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -32,6 +32,7 @@ file exists to stop.
 
 - Write the entry only for a divergence — and name the layer that owned it
 - Every lesson carries its commit
+- Never amend a commit a record already names
 - The stamp table is capped at ten, and *one line per run* was never a cap
 - `publish:` is a line in the verdict, not a silence
 - Rotation — the archive is how pruning stops losing things
@@ -76,11 +77,39 @@ message and the parent, so `git show <sha>` reconstructs the entire incident two
 months later — which is exactly when the same class comes back and somebody needs
 to know whether this was already understood.
 
-**Every SHA must resolve.** This is [`learned.md`](learned.md) rule 14 — *a
-document may not send a reader to something absent* — applied to history, and it is
-mechanical: the project's documentation gate runs `git rev-parse --verify --quiet
-<sha>^{commit}` over every backticked SHA in the retro and its archive
-([`gates.md`](gates.md)).
+**Every SHA must resolve — and resolving is not enough.** This is
+[`learned.md`](learned.md) rule 14 — *a document may not send a reader to something
+absent* — applied to history, and it is mechanical: the documentation gate runs
+`git rev-parse --verify --quiet <sha>^{commit}` over every backticked SHA in the retro
+and its archive ([`gates.md`](gates.md)).
+
+**But a commit that was amended away still resolves on the machine that amended it**,
+and exists in no clone. The gate therefore also requires each SHA to be **reachable
+from `HEAD`** — `git merge-base --is-ancestor <sha> HEAD` — because that is the
+question a reader two months from now is actually asking, and the weaker one passes
+for as long as the object survives locally.
+
+## Never amend a commit a record already names
+
+Measured 2026-08-16, twice in one close-out and twenty minutes apart. The sequence is
+seductive because each step is right on its own: stamp the run with its commit → the
+stamp is part of the run, so fold it in with `--amend` → the amend mints a new SHA →
+the stamp now names a commit that will never reach the remote.
+
+The rule is one line and it is absolute: **once a file names a SHA, that commit is
+frozen.** A correction goes in a *follow-up commit*, never a second amend — amending to
+repair a stamp is the loop that produced the problem, and the second attempt lands in the
+same place as the first.
+
+Practically, that makes the order:
+
+1. commit the work;
+2. **then** stamp, in a commit of its own, naming the commit from step 1;
+3. prune and write the entry in that same second commit, or a third.
+
+The stamp costs one line and one commit. A run that folds it back into the work to keep
+the history tidy is trading a reader's ability to find the incident for the appearance of
+tidiness — and the reader is the entire reason the stamp exists.
 
 ## The stamp table is capped at ten, and *one line per run* was never a cap
 

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -194,7 +194,11 @@ never that the work was skipped quietly.
   an updated `CONTEXT.md` (terms written as they resolved) and any ADRs under
   `docs/adr/` — see `grill.md` → *Domain awareness*.
 - **GATE (manual):** shared understanding reached — **the source ledger is written
-  (every source consulted, or an explicit "none found")**, **where a code graph
+  (every source consulted, or an explicit "none found")** and **its `Contradictions:`
+  line is written under it** — the harvest is a fan-out that converges on one brief, and
+  nothing else compares the sources *with each other*; `Contradictions: none` is the
+  answer most runs give and writing it is the point
+  ([`knowledge-sources.md`](knowledge-sources.md)), **where a code graph
   exists its row carries the measured lag and the signal it was measured with — a
   bare build date does not satisfy this, because it is the graph's own reply rather
   than a measurement of it** ([`knowledge-graph.md`](knowledge-graph.md) →
@@ -338,6 +342,29 @@ never that the work was skipped quietly.
   `sheleg-design` how it **looks**. Until 2026-08-10 this stage named only the first,
   so a run designed a flow, then wrote its strings by taste and picked its values at the
   keyboard — and every gate in the pipeline reported green over both.
+- **Two of the three are a parallel layer, and the third is their only real dependency.**
+  COPY and VISUAL both consume the UX track's scenarios; **neither consumes the other**.
+  Copy is written against the brand pack and the scenarios, not against tokens; the visual
+  is built from the frame and the style pack, not from strings. Writing them in a line —
+  which this file did until 2026-08-15 — teaches a run to wait for a result that never
+  arrives. The order is `UX → { COPY ∥ VISUAL }`, and the only thing crossing each of
+  those two arrows is **the scenario set**.
+- **Their convergence needs a check, and it has a real contradiction to catch.** Both land
+  on the same screen, so the failure is not that one is wrong: it is that each is right
+  alone and they disagree together. Before the spec is committed, compare the two outputs
+  and record the answer:
+  1. **A string the layout has no room for** — a label, an error or an empty state longer
+     than the frame's element, at the frame's own width.
+  2. **A state one track has and the other does not** — copy for an empty state the design
+     never drew, or a loading state drawn with no string.
+  3. **Two names for one thing** — the design system's component name against the
+     terminology file's noun, where a user reads both.
+  4. **A tone the visual contradicts** — a calm, plain register on a screen whose motion
+     and colour say urgency.
+  `Tracks converge: clean` is the answer most runs write, and writing it is the point —
+  a check whose silence is indistinguishable from not having run is not evidence. This is
+  the same rule the harvest applies at stage 0 and the build applies to a fanned-out group
+  at stage 5 ([`build.md`](build.md) §4.2a); one shape, three places.
 - **Spec:** write the approved design to
   `<artifacts>/specs/YYYY-MM-DD-<topic>-design.md` and commit it. Lock all
   shared contracts (types, schemas, signatures, file layout). For UI tasks the
@@ -360,6 +387,9 @@ never that the work was skipped quietly.
   through the COPY track or the refusal is recorded**, and **the visual layer went
   through the VISUAL track or the refusal is recorded** — a recorded refusal passes
   this gate and an unmentioned one does not, which is the only difference that matters.
+  **Where both tracks ran, their convergence check is recorded** — findings with the
+  ruling, or `Tracks converge: clean`; a screen where each track is right alone and they
+  disagree together is the defect neither track's own review can see.
   No plan (stage 4)
   starts before this — the chain comes BEFORE interface.
 

package/plugins/task-pipeline/skills/task-pipeline/templates/docgate.sh

@@ -441,14 +441,22 @@ else
     while IFS=: read -r ln tok; do
       s=$(echo "$tok" | tr -d '`')
       case ${#s} in 7|8|9|10|11|12|40) ;; *) continue ;; esac
-      git rev-parse --verify --quiet "$s^{commit}" >/dev/null 2>&1 ||
+      if ! git rev-parse --verify --quiet "$s^{commit}" >/dev/null 2>&1; then
         echo "$f:$ln: commit \`$s\` does not resolve" >> "$TMP/sha"
+      # Resolving is the weaker half. A commit that was AMENDED AWAY still resolves on
+      # the machine that amended it and reaches no clone — measured 2026-08-16, twice in
+      # one close-out: the stamp named the run's commit, the commit was amended to carry
+      # the stamp, and the SHA the stamp recorded stopped being reachable. Ask the
+      # question a reader actually has: is it in this history at all.
+      elif ! git merge-base --is-ancestor "$s^{commit}" HEAD >/dev/null 2>&1; then
+        echo "$f:$ln: commit \`$s\` resolves but is NOT reachable from HEAD — amended away, or on a branch this checkout does not have" >> "$TMP/sha"
+      fi
     done
   done
   if [ -s "$TMP/sha" ] 2>/dev/null; then
-    err "unresolvable commit reference(s):"; sed 's/^/         /' "$TMP/sha"
+    err "commit reference(s) a clone could not follow:"; sed 's/^/         /' "$TMP/sha"
   else
-    ok "every commit reference in $RETRO_GLOB resolves"
+    ok "every commit reference in $RETRO_GLOB resolves AND is reachable from HEAD"
   fi
 fi