task-pipeline-skill 1.78.4 → 1.80.0

package/plugins/task-pipeline/skills/task-pipeline/references/probing.md

@@ -0,0 +1,202 @@
+# Probing — how a check is proven before it is trusted
+
+The authoring doctrine for **probes**: planting a defect, watching the guard
+refuse it, and keeping that proof alive after the release that ships it. It
+lived inside [`gates.md`](gates.md) until 2026-08-31 and moved here whole —
+one home, routed from the gate doctrine it proves. The law it serves is
+[`audit.md`](audit.md)'s exit criterion: **a green from a check nobody has
+watched fail is not evidence.**
+
+## Contents
+
+- Probing — plant, run, restore
+- A probe rots, and every way it rots reports green
+- The neighbour probe — plant the evidence outside the subject
+- A green probe is evidence only if the mutation is known to have landed
+- Rationalizations
+
+## Probing — plant, run, restore
+
+The law is [`audit.md`](audit.md)'s exit criterion. The procedure is this, and it is
+not optional for a check you intend to trust:
+
+```bash
+cp -R . /tmp/probe && cd /tmp/probe
+python3 - <<'PY'                       # plant IN PYTHON, never sed -i
+p = "docs/DECISIONS.md"
+s = open(p).read().replace("DEC-0001", "DEC-9999", 1)
+open(p, "w").write(s)
+PY
+bash scripts/check-docs.sh; echo "planted -> exit=$?"   # MUST be non-zero
+cd - && bash scripts/check-docs.sh; echo "clean -> exit=$?"  # MUST be 0
+```
+
+**Assert on `$?`, not on a `FAIL` line in the output.** A line on stdout is a
+decoration; the exit code is what CI reads.
+
+**Doubt the probe before you doubt the check.** On the project this comes from,
+**four of five** silent probes were the probe's fault: one added a *definition*
+where the check looks for an unresolved *reference*; one edited a string whose
+whitespace did not match; one hit the first prose mention instead of the table row;
+one flipped a row whose cell was already empty, so nothing was planted. A silent
+check is a claim about two things, and the probe is the one to doubt first — prove
+your edit landed in the text the check actually parses.
+
+**Three assertions, and the third is the one hand-rolled probes keep missing.** A
+plant that trips some *other* check has proved that other check works. Three probes
+in one day passed that way: one removed 1 of 3 identical lines and left the shape
+intact; one decremented a number inside an **already-released** section; one deleted
+the shouted spelling of a phrase and left the lowercase one. Each landed somewhere
+real and demonstrated nothing about the guard it was written for. So:
+
+1. **the substitution landed** — `replace` matching nothing returns the string
+   unchanged and raises nothing;
+2. **the exit code is non-zero** — not a `FAIL` line on stdout;
+3. **the message that fired belongs to the guard under test** — named up front, not
+   recognised afterwards.
+
+`test/probe.py` does all three (`npm run test:probe` self-tests the harness, including
+its own failure branches, because a harness whose failure path has never executed is
+the thing it exists to stop). Declare the plant as `Plant(label, path, old, new,
+expect=<the guard's own words>)` rather than hand-rolling a fourth copy of the loop.
+
+**Record the probe.** One line per section, in the change that ships the check.
+Otherwise the next reader has to redo it to know whether it was ever done.
+
+---
+
+## A probe rots, and every way it rots reports green
+
+The three assertions above prove a probe works **today**. They say nothing about the
+day after, and a probe is uniquely exposed: the thing it guards is the thing that moves
+it. Four rotted in one release on 2026-08-22, and none of them failed loudly — two
+reported `caught`, two reported nothing at all.
+
+**1. The anchor is a literal the guarded thing moves.** A probe pinned to *"the bundle
+is N reference files"* stops landing the day a reference file is added — on the release
+that changes the very number it guards. Same for a version, a count word, a phrase a
+release rewrites. **Derive the anchor**: read whatever the text currently says and make
+*that* wrong. A probe that computes `wrong = stated - 1` never needs maintaining.
+
+**2. The precondition is inherited from the tree rather than created.** This is the
+subtle one, because it is triggered by the system working correctly. A probe that
+narrows a declared gap to expose *releases after the newest run stamp* has nothing to
+expose the moment a release writes an honest stamp — the newest release is now the
+newest stamp. A probe requiring an `## Unreleased` section has none the moment a release
+absorbs it. **Both landed. Both proved nothing.** A probe must construct the state it
+needs: remove the stamp, write the section, then plant the defect.
+
+**3. The document quotes the form the probe removes.** Covered as
+[`documentation.md`](documentation.md) canon 2's second half, and it belongs here too
+because the probe is where it surfaces: prose describing the wrong shape *with real
+values in it* is a second instance of the shape. The probe deletes the real one, the
+narrative still matches, the guard is silent.
+
+**How to see it before CI does.** Ask one question per probe: *what does this probe
+LOOK FOR, and who is allowed to change it?* Where the answer is "the thing it guards",
+it is rotting already. A repository-wide sweep is one grep — a two-digit literal inside
+a needle, an `assert` or a `replace` — and the triage is: the number a probe **writes**
+is correct, the number it **looks for** is the defect.
+
+## The neighbour probe — plant the evidence outside the subject
+
+A probe proves a guard rejects **the phrasing its author had in mind**. That is less than
+it looks, and the gap has one shape: **a check answered by text that is not its subject.**
+
+Measured on one project in one session, six times, each found by a reader planting a
+defect and watching `PASS`:
+
+| The check's subject | The text that answered it instead |
+|---|---|
+| stage 2 names the loop's arming | *"it **arms** the UX track"*, present since an earlier release |
+| the section states the authorization floor | the same phrase in a Rationalizations row, and in a section written twenty-nine releases before |
+| the run stamps have a cap | the **standing instructions'** `max 10`, in the same table cell — and, once the check was narrowed past it, the same cap moved to the other side of the `·` |
+| a section read in full stays capped | rows under **one** heading, while a second heading in the same file held forty more |
+
+Every one of those guards had a probe. Every probe fired. The probes and the guards were
+written in the same hour from the same reading, so they shared the same blind spot.
+
+**So a guard that reads a scoped span owes a second probe, and it plants in two places at
+once:**
+
+1. **break the subject** — remove the thing the guard is about;
+2. **plant the guard's own evidence next door** — in a sibling section, an adjacent table
+   cell, a rationalizations row, the other side of a separator;
+3. require the guard to **still fail**.
+
+A guard that passes step 3 is reading its subject. A guard that goes green is reading the
+neighbourhood, and the ordinary probe cannot tell the difference — which is why this one
+is separate rather than a stricter version of it.
+
+**Step 2 means the literal the predicate matches *today*, read out of the guard.** The
+first three neighbour probes written against this section got that wrong on their first
+run: one planted the needles of two **retired** predicates, which proves the guards that
+used to exist were neighbour-answerable and says nothing about the one that does. A
+neighbour probe keyed to a needle the guard no longer reads is the same defect it was
+written to catch, one level up.
+
+**A probe that only deletes is not a neighbour probe.** It may still be a correct probe —
+but if it relies on copies that already sit next door, it must **assert they are there**.
+Otherwise a later edit removes them and the probe quietly becomes a delete-only test that
+still passes, having stopped testing the thing it is named for.
+
+**Positional narrowing is not scoping.** Three of the six were "fixed" by cutting the
+search down to a row, then to everything after a phrase, and fell each time to text that
+was still inside the cut. Scope by *what the span is about*: split to the cell, then to
+the item, then match on flattened text so an emphasis marker cannot hide the boundary.
+
+**And state the span in the guard.** One line above the predicate — *what it reads, and
+where that ends*. It costs nothing and it is the only part of a check a later reader can
+disagree with before the defect arrives.
+
+## A green probe is evidence only if the mutation is known to have landed
+
+Also reported from another project, three times in one day, each caught only because the
+result was too good:
+
+1. a scripted substitution missed on indentation — the file was unchanged and the probe
+   measured nothing;
+2. an assertion written against a bare identifier kept matching the **import line** after
+   the field it guarded was deleted;
+3. a file-extension alternation matched the longer extension as though it were the
+   shorter, reporting nine live files as missing.
+
+In all three the observable was identical to success. *"See it fail once"* has an unstated
+precondition — **that the thing you changed is the thing the check reads** — and a planted
+defect that did not land produces the same green as a check that cannot fail.
+
+**So a probe that mutates an existing file asserts its plant landed, in the same breath as
+planting it.** A probe that writes a whole file has no such question: the file exists or
+the command failed. This repository measured itself while writing this section and got the
+number wrong three times. A hand-rolled classifier said *206 of 206 already carry it*.
+The guard written from the rule said **22 did not** — and was itself too narrow, matching
+one spelling of the assertion, so six probes that already had it in lower case were
+called defective. A sweep then "fixed" those six and **corrupted five**, splitting live
+statements. The true figure was **16**, and it took the guard, a compile check and a
+restore from git to find it.
+
+Two things are worth keeping from that. **The check corrected the measurement that
+motivated it** — which is the argument for writing checks rather than counting by hand.
+And **a check keyed to one spelling of a rule is *The neighbour probe*'s class, above**: it
+reported as defective the probes that obeyed the rule in different words. **Every**
+mutating probe carries the assertion now — the figure is deliberately not
+written here. A first draft said *201*, which was true of the branch point and false in
+the same commit, because the twelve probes added for this release are themselves mutating
+probes. The guard computes it; a number in prose beside a check that can count is the
+class this bundle calls restating instead of computing. Probes that write a whole file
+need none: the file exists or the command
+failed.
+
+**Prefer an assertion that names the construct over one that names a substring of it.** A
+guard written against a bare identifier survives the deletion of everything it guarded,
+because the identifier still appears in an import. That is case 2 above and it is the same class as
+[`gates.md`](gates.md) → *A ratchet's matcher is itself a check, and it needs a near-miss*, one level down.
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "The check is green, that's evidence" | Only if you have seen it red. An unproven check is a decoration that reports success. |
+| "I probed it when I wrote it" | A probe proves the check works today. The thing it guards is the thing that moves it — re-read the anchor on every release that touches the subject. |
+| "The plant obviously landed, the file is smaller" | `replace` matching nothing returns the string unchanged and raises nothing. Assert the mutation landed, in the same breath as planting it. |
+| "Some guard fired, so the probe passed" | A plant that trips some *other* check has proved that other check works. The message that fired must belong to the guard under test, named up front. |

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -63,7 +63,7 @@ changes:
 task-pipeline v1.34.0 · pipeline-audit · module P1 «the progress print» (1 of 4)
   0 ✓  1 ✓  2 ✓  3 ▶  4 ·  5 ·  6 ·  7 ·  8 ·  9 · 10 ·
   ███████░░░░░░░░░░░░░░░░░░░  gates 3/11 · now 3 Spec · manual
-  board B-028 · carry-over 0 rows · exposure 99 never · unlooked 0
+  board B-028 · carry-over 0 rows · exposure N never · unlooked 0
 ```
 
 Four lines, and each one answers a question an operator otherwise has to ask:
@@ -142,7 +142,8 @@ its pair is task start and iteration close. The hand-back shares one and adds th
 end — a rail at task start has nothing to report, and a run that ends without a hand-back
 is the case this section exists for. A reader resolving *"both boundaries"* against the
 other section wrote one at task start, where TASK is the only field with content. The run
-writes a hand-back with **four sections and two lists**. It is a gate criterion **at stage
+writes a hand-back with **the sections and the two counted lists below** — the
+block is the count, and a number restated here said *four* over a block of six. It is a gate criterion **at stage
 10**, not a good intention: this file already carried one instruction with no gate behind
 it (*"copy it, tick it"*), and the v1.37.0 audit found no run had ever obeyed it.
 
@@ -380,7 +381,7 @@ And why the verb prints
 `unmeasured` rather than `0` when there are no such lines is the same reason again — the
 hook being absent and the run reading nothing are **opposite facts** the ledger cannot
 separate, so it claims neither. A `0` there would be the reassuring answer to a question
-nobody asked, over 35 files nobody checked.
+nobody asked, over a directory of reference files nobody checked.
 
 It is a disclosure: no floor, no direction, never a target. The moment the number becomes
 something to raise, a run will open files to raise it.
@@ -416,7 +417,10 @@ written by any run — the detector had no input, and the guard was doctrine wea
 script's clothes. One file serves both readers: the guard reads the `touch:` lines,
 this block reads the verdict rows and the iteration counter.
 
-Three kinds of line, appended, never rewritten:
+Appended, never rewritten. The full set of line shapes is declared under
+`## Lines` in [`../templates/run.md`](../templates/run.md) — the list is the count,
+and a count restated here drifted once already. The three these two readers
+consume:
 
 ```
 stage: 3 Spec — gate manual — verdict pass — 2026-08-10T14:02Z

package/plugins/task-pipeline/skills/task-pipeline/references/spec.md

@@ -13,6 +13,7 @@ Writing the approved design down so a zero-context implementer — human or suba
 
 - Order of operations
 - UX track (user-facing tasks only)
+- The COPY and VISUAL tracks, and their convergence
 - Write the spec
 - Module dossier — when the run is one brick of a platform
 - Self-review — before showing it
@@ -65,6 +66,60 @@ These skills are **idempotent** — extend the existing `docs/ux/` layers, never
 rebuild them. If the chain already exists and is validated (typically when the run
 entered from super-ux), verify it and embed it; build only what's missing.
 
+## The COPY and VISUAL tracks, and their convergence
+
+Three tracks, three questions, and they do not substitute for each other:
+super-ux decides what the interface must **do**; `copywriting` how it
+**sounds**; `sheleg-design` how it **looks**. Until 2026-08-10 stage 3 named
+only the first, so a run designed a flow, then wrote its strings by taste and
+picked its values at the keyboard — and every gate in the pipeline reported
+green over both.
+
+- **COPY track — how it sounds.** Every string a product's user will read is written
+  through super-ux's `copywriting`, against the brand pack (`docs/brand/voice.md`,
+  `terminology.md`, `facts.md`). No pack ⇒ `/brand-init` **before** the first string,
+  not after: a voice reverse-engineered from copy already written is a description of
+  what happened, not a decision. In scope: interface strings, errors, empty states,
+  the landing, pricing, the user-facing changelog. **Out of scope, and saying so is
+  what keeps the track honest:** commit messages, PR descriptions, code comments, a
+  developer README, internal docs. Running a brand pack over a line in a contributors'
+  changelog is the fastest way to teach an agent to route around the track.
+- **VISUAL track — how it looks.** Where the task has a visual surface, the visual
+  layer goes through `sheleg-design` ([`companion-skills.md`](companion-skills.md)):
+  tokens and themes, typography and rhythm, motion and how it degrades to rest, the
+  boundary with Figma (tokens as variables, never raw values carried across). Not
+  through it: a purely structural change — what sits where is the UX track's — text,
+  a backend, an internal script.
+- **Each track's refusal is a sentence, never a silence.** *"Без дизайна" / "as is"*
+  ends the visual track; *"без бренда" / "draft"* ends the copy track. Either one is
+  the operator's to make and costs nothing — but it is **recorded in the brief and
+  said out loud in the close-out**, because a track skipped silently and a track that
+  ran are the same thing in a transcript. This is the rail's `⊘` rule one layer up: a
+  skip nobody can see is indistinguishable from work that happened.
+- **Two of the three are a parallel layer, and the third is their only real dependency.**
+  COPY and VISUAL both consume the UX track's scenarios; **neither consumes the other**.
+  Copy is written against the brand pack and the scenarios, not against tokens; the visual
+  is built from the frame and the style pack, not from strings. Writing them in a line —
+  which this doctrine did until 2026-08-15 — teaches a run to wait for a result that never
+  arrives. The order is `UX → { COPY ∥ VISUAL }`, and the only thing crossing each of
+  those two arrows is **the scenario set**.
+- **Their convergence needs a check, and it has a real contradiction to catch.** Both land
+  on the same screen, so the failure is not that one is wrong: it is that each is right
+  alone and they disagree together. Before the spec is committed, compare the two outputs
+  and record the answer:
+  1. **A string the layout has no room for** — a label, an error or an empty state longer
+     than the frame's element, at the frame's own width.
+  2. **A state one track has and the other does not** — copy for an empty state the design
+     never drew, or a loading state drawn with no string.
+  3. **Two names for one thing** — the design system's component name against the
+     terminology file's noun, where a user reads both.
+  4. **A tone the visual contradicts** — a calm, plain register on a screen whose motion
+     and colour say urgency.
+  `Tracks converge: clean` is the answer most runs write, and writing it is the point —
+  a check whose silence is indistinguishable from not having run is not evidence. This is
+  the same rule the harvest applies at stage 0 and the build applies to a fanned-out group
+  at stage 5 ([`build.md`](build.md) §4.2a); one shape, three places.
+
 ## Write the spec
 
 Path: `<artifacts>/specs/YYYY-MM-DD-<topic>-design.md`, committed, **same
@@ -212,7 +267,11 @@ and every REQ in the brief appears in at least one section.** For UI tasks it
 additionally requires: the chain (foundation → flows → screens → scenarios)
 designed, validated and approved; `/ux-lint` green; every user-facing requirement
 traced to a scenario ID — or an explicit waiver from the operator recorded in the
-spec.
+spec. **Every user-facing string went through the COPY track or the refusal is
+recorded, the visual layer went through the VISUAL track or the refusal is
+recorded** — a recorded refusal passes and an unmentioned one does not — **and
+where both tracks ran, their convergence check is recorded**: findings with the
+ruling, or `Tracks converge: clean` (*The COPY and VISUAL tracks*, above).
 
 With Figma on, one more, and it is mechanical: **the canonical record names a file,
 and every frame link in `screens.md` carries that same file key.** Deep links are

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -2,7 +2,9 @@
 
 For each stage: what it does, what to invoke, artifacts, and the **GATE** that
 must pass before advancing. Each gate is tagged with its **type** — `auto` (the
-orchestrator verifies the check itself, pass/fail) or `manual` (wait for the
+orchestrator verifies the check itself, pass/fail), `judgment` (a named judge
+rules where no complete deterministic check exists — [`gates.md`](gates.md) →
+*The judgment gate*) or `manual` (wait for the
 operator's explicit go). These stages (0 intake + 1→10) are the plugin's
 **example** flow, encoded in `pipeline.example.json` against the universal contract
 `pipeline.schema.json`; a host project replaces it with its own
@@ -66,6 +68,7 @@ never that the work was skipped quietly.
 - Cross-cutting — the Doc Loop
 - Cross-cutting — the loop guard
 - Cross-cutting — the audit
+- A stage that produces text a user will read
 
 ## 0 — Intake grill — MANDATORY
 - **Freedom: medium** — the interview adapts to the answers; its two phases and their order do not ([`gates.md`](gates.md) → *Axis C*).
@@ -148,9 +151,10 @@ never that the work was skipped quietly.
 
   ```
   1. files the request names, resolved        git ls-files -- <paths>       -> N
-  2. any of them a public contract            the version-synced surfaces,
-                                              pipeline.schema.json, the
-                                              command, the README           -> yes/no
+  2. any of them a public contract            the surfaces the host's release
+                                              syncs, its schema or config
+                                              contracts, a shipped command,
+                                              its README                    -> yes/no
   3. behaviour a user or a caller observes changes                          -> yes/no
   ```
 
@@ -335,55 +339,18 @@ never that the work was skipped quietly.
   never rebuild from scratch. If the chain already exists and is validated (e.g.
   the task entered from super-ux), just verify (linter green) and embed it into
   the spec; only build the parts that are missing.
-- **COPY track — how it sounds.** Every string a product's user will read is written
-  through super-ux's `copywriting`, against the brand pack (`docs/brand/voice.md`,
-  `terminology.md`, `facts.md`). No pack ⇒ `/brand-init` **before** the first string,
-  not after: a voice reverse-engineered from copy already written is a description of
-  what happened, not a decision. In scope: interface strings, errors, empty states,
-  the landing, pricing, the user-facing changelog. **Out of scope, and saying so is
-  what keeps the track honest:** commit messages, PR descriptions, code comments, a
-  developer README, internal docs. Running a brand pack over a line in a contributors'
-  changelog is the fastest way to teach an agent to route around the track.
-- **VISUAL track — how it looks.** Where the task has a visual surface, the visual
-  layer goes through `sheleg-design` ([`companion-skills.md`](companion-skills.md)):
-  tokens and themes, typography and rhythm, motion and how it degrades to rest, the
-  boundary with Figma (tokens as variables, never raw values carried across). Not
-  through it: a purely structural change — what sits where is the UX track's — text,
-  a backend, an internal script.
-- **Each track's refusal is a sentence, never a silence.** *"Без дизайна" / "as is"*
-  ends the visual track; *"без бренда" / "draft"* ends the copy track. Either one is
-  the operator's to make and costs nothing — but it is **recorded in the brief and
-  said out loud in the close-out**, because a track skipped silently and a track that
-  ran are the same thing in a transcript. This is the `⊘` rule one layer up: a skip
-  nobody can see is indistinguishable from work that happened.
-- **Three tracks, three questions, and they do not substitute for each other.** super-ux
-  decides what the interface must **do**; `copywriting` how it **sounds**;
-  `sheleg-design` how it **looks**. Until 2026-08-10 this stage named only the first,
-  so a run designed a flow, then wrote its strings by taste and picked its values at the
-  keyboard — and every gate in the pipeline reported green over both.
-- **Two of the three are a parallel layer, and the third is their only real dependency.**
-  COPY and VISUAL both consume the UX track's scenarios; **neither consumes the other**.
-  Copy is written against the brand pack and the scenarios, not against tokens; the visual
-  is built from the frame and the style pack, not from strings. Writing them in a line —
-  which this file did until 2026-08-15 — teaches a run to wait for a result that never
-  arrives. The order is `UX → { COPY ∥ VISUAL }`, and the only thing crossing each of
-  those two arrows is **the scenario set**.
-- **Their convergence needs a check, and it has a real contradiction to catch.** Both land
-  on the same screen, so the failure is not that one is wrong: it is that each is right
-  alone and they disagree together. Before the spec is committed, compare the two outputs
-  and record the answer:
-  1. **A string the layout has no room for** — a label, an error or an empty state longer
-     than the frame's element, at the frame's own width.
-  2. **A state one track has and the other does not** — copy for an empty state the design
-     never drew, or a loading state drawn with no string.
-  3. **Two names for one thing** — the design system's component name against the
-     terminology file's noun, where a user reads both.
-  4. **A tone the visual contradicts** — a calm, plain register on a screen whose motion
-     and colour say urgency.
-  `Tracks converge: clean` is the answer most runs write, and writing it is the point —
-  a check whose silence is indistinguishable from not having run is not evidence. This is
-  the same rule the harvest applies at stage 0 and the build applies to a fanned-out group
-  at stage 5 ([`build.md`](build.md) §4.2a); one shape, three places.
+- **COPY track and VISUAL track — a parallel layer after UX, and their
+  convergence.** Three tracks, three questions, none substituting for another:
+  super-ux decides what the interface must **do**, `copywriting` how it
+  **sounds** (every string a product's user will read, against the brand pack),
+  `sheleg-design` how it **looks** (tokens, themes, typography, motion). COPY and
+  VISUAL are **parallel** — both consume the UX track's scenarios, neither
+  consumes the other — and where both ran, **their convergence check is run and
+  recorded before the spec is committed**: each can be right alone and the two
+  disagree together on one screen. The full doctrine — each track's scope and
+  out-of-scope, the refusal sentences, the four contradictions the check
+  catches — is [`spec.md`](spec.md) → *The COPY and VISUAL tracks, and their
+  convergence*, its one home.
 - **Spec:** write the approved design to
   `<artifacts>/specs/YYYY-MM-DD-<topic>-design.md` and commit it. Lock all
   shared contracts (types, schemas, signatures, file layout). For UI tasks the
@@ -467,6 +434,12 @@ never that the work was skipped quietly.
   implementer that wrote it is still dispatched. The matrix pointed this companion at
   stages 5–6 from the day it was added and **this stage had never named it** — found by
   the guard comparing the two, not by a reader.
+- **Domain companions, where the task is on their ground** — recommended, never a
+  gate ([`companion-skills.md`](companion-skills.md)): `sheleg-dev` when the build
+  wires money, tracking, sign-in or page speed; `agent-stack` when the thing being
+  built is an agent system; `telegram-dev` when Telegram is the platform rather
+  than the transport. Absent, the build ships on the host's own doctrine and the
+  close-out names the seam nobody checked.
 - **Integration closes the stage:** sync with the base branch, re-run the full suite
   on the result, land it the project's way (merge, or a PR — outward, so it needs a
   go), remove the worktree. Stages 7–9 act on the integrated result, so a branch the
@@ -492,7 +465,9 @@ never that the work was skipped quietly.
   same as stage 5.
 - **GATE (auto):** **the hygiene gate green over the whole tree**, its six counts
   printed beside their floors; the **full** suite is green (not just the new tests); new/changed code
-  is covered; no `skip`/`xfail` smuggling a red suite past the gate. Never advance
+  is covered; **every check this run added or widened has been probed both ways —
+  seen rejecting a planted defect and passing the clean tree, asserted on its exit
+  code** ([`probing.md`](probing.md)); no `skip`/`xfail` smuggling a red suite past the gate. Never advance
   to deploy on a red or partial run. **The carry-over count is printed beside this
   verdict** — a ratchet nobody prints is a TODO with a better name
   ([`audit.md`](audit.md)) — **and so are the disclosures**, `abstained` and
@@ -589,6 +564,10 @@ never that the work was skipped quietly.
   on anything but `success`, and one of the three states stated — including **`no run
   found`**, out loud, because a project without CI is a legitimate state and not a
   green one.
+- **A public surface a logged-out reader will see** can additionally be audited for
+  search and answer-engine visibility with `seo-aeo-audit`
+  ([`companion-skills.md`](companion-skills.md)) — recommended, never a gate;
+  absent, visibility ships unaudited and the close-out says so.
 - **GATE (auto):** clean boot confirmed, or an **honest degradation report** with next
   steps — never silent success. **The CI verdict is one of the reported facts, with
   its run id** — "CI is green" written without a command behind it prints the same
@@ -860,3 +839,22 @@ nothing.
 - **Whatever can't be fixed now becomes a ratchet** — a named, counted set that may
   only shrink, printed beside every gate verdict, so "green" never reads as
   "verified".
+
+## A stage that produces text a user will read
+
+The framework has no opinion on which skills run where — `pipeline.json` is the contract —
+but two facts about copy are worth stating once, because a stage author rediscovers them
+expensively.
+
+**Route it through the copy skill, not through the stage's own prose.** A stage that writes
+interface strings, a landing page or a changelog entry for users is producing brand surface;
+the registers, terminology and canonical facts that constrain it live in `docs/brand/`, and
+a stage writing directly does not read them.
+
+**The humanization pass is decided once, in the brand pack, not per run.**
+`docs/brand/voice.md` carries an optional `Humanization pass:` field; absent means nobody
+has been asked, and the copy skill asks once and records the answer. A pipeline that asks
+every run has turned a settled decision into a prompt, and a pipeline that gates on a
+marker count has turned a writing-quality signal into a verdict — the false positives fall
+hardest on people writing in a second language, and nothing here fails a stage for them.
+`npx sshlg-skills humanizers` lists what is installed.

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -40,7 +40,7 @@ turn of every loop.
 | `nodes[].serves` | the REQ or goal clause it exists for. A node serving neither is **parked with that as the reason** |
 | `nodes[].blocked_by` | what must close first. This is what the frontier obeys |
 | `nodes[].touches` | what it **mutates**. Two runnable nodes writing one file is the false parallelism [`planning.md`](planning.md) refuses — *distinct is not the same as independent, and the check is what they touch, never what they are called* |
-| `nodes[].check` | **how this node will be closed** — one command, or the named judgement where no command can decide it. Required on every node except a `parked` one. `agents/verifier.md` runs it and reports its output as the evidence row; before this field existed that instruction pointed at an absence, leaving the verifier the two things it forbids — invent a check, or run everything (B-080) |
+| `nodes[].check` | **how this node will be closed** — one command, or the named judgement where no command can decide it. Required on every node except a `parked` one. The certification's `unit` tier runs it and reports its output as the evidence row ([`certification.md`](certification.md) — three blind tiers close a node, not one reader); before this field existed that instruction pointed at an absence, leaving a verifier the two things it forbids — invent a check, or run everything (B-080) |
 | `nodes[].evidence` | required when `status` is `done`. A node called done by assertion is what evidence exists to prevent |
 | `nodes[].parked_reason` | required when `status` is `parked`. A park with no reason is indistinguishable, a week later, from work quietly dropped |
 | `edges[].payload` | what the dependency hands over. **An edge carrying no named artifact is chronology drawn as architecture** |

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -549,8 +549,14 @@ SEVERITIES = ("breaks", "risk")
 # A tier report that quotes another tier's verdict was not written blind. Cheap
 # to detect and worth detecting: the failure it prevents is three reports that
 # agree because the second two read the first.
-CROSS_TIER = re.compile(r"\b(?:unit|seam|product)\s+tier\s+(?:passed|failed|says)"
-                        r"|\btier\s+\d\s+(?:passed|failed)"
+# The verb set was `passed|failed|says` and the R-005 reader measured five
+# citations sliding past it ("the seam tier confirmed…", "the unit tier said…",
+# "the unit tier's verdict…"). Widened to the tense and possessive forms the
+# reader planted; still a closed list on purpose — a looser net here starts
+# matching a report's honest prose about its OWN tier.
+CROSS_TIER = re.compile(r"\b(?:unit|seam|product)\s+tier(?:'s)?\s+"
+                        r"(?:passed|failed|says|said|confirm\w*|verdict|report)"
+                        r"|\btier\s+\d\s+(?:passed|failed|says|said|confirm\w*)"
                         r"|as\s+the\s+(?:unit|seam|product)\s+tier", re.I)
 
 
@@ -639,13 +645,30 @@ def tier_violations(t):
                        "— a fail that does not say what broke is a fail the next round "
                        "cannot act on" % t["tier"])
 
-    # Blind, and checked. Only the prose fields can carry it.
-    for k in ("confirms", "evidence", "not_examined"):
+    # Blind, and checked. EVERY prose field can carry it — the scan covered three
+    # of the six and a citation hiding in `scope` or a finding's `what`/`fix`
+    # passed untouched (certification.md claims the refusal for the whole report).
+    for k in ("confirms", "evidence", "not_examined", "scope"):
         for i, e in enumerate(t[k]):
             if isinstance(e, str) and CROSS_TIER.search(e):
                 out.append("tier report `%s[%d]` cites another tier's verdict (%r) — the "
                            "three run blind, because three reports that read each other "
                            "are one opinion with three signatures" % (k, i, e.strip()[:70]))
+    # Enumerated over the RAW list, so the index in this refusal and the index
+    # in the shape refusals above name the same object — the filtered list
+    # renumbered them (R-005 reader). `check` and `where` scan too: `check` is
+    # mandatory on every breaks finding, so it is the field a failing tier most
+    # reliably writes prose into.
+    for i, f in enumerate(t["findings"]):
+        if not isinstance(f, dict):
+            continue
+        for k in ("what", "fix", "check", "where"):
+            v = f.get(k)
+            if isinstance(v, str) and CROSS_TIER.search(v):
+                out.append("tier report `findings[%d].%s` cites another tier's verdict "
+                           "(%r) — the three run blind, because three reports that read "
+                           "each other are one opinion with three signatures"
+                           % (i, k, v.strip()[:70]))
     return out
 
 # --- verbs --------------------------------------------------------------------
@@ -1042,7 +1065,7 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 36 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 38 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 

package/plugins/task-pipeline/skills/task-pipeline/templates/backlog.md

@@ -35,8 +35,12 @@
   `age_bonus` is `1` past 14 days and `2` past 30. The formula is repeated here on
   purpose — the inputs are in this table, so a reader checks the arithmetic rather than
   trusting the ranking. Full doctrine: the skill's `references/backlog.md`.
-- **State** — `open` · `in-flight` · `closed` · `dropped`. `dropped` needs the
-  operator's agreement and the date they gave it.
+- **State** — `open` · `in-flight` · `closed` · `dropped` · `parked — <branch or
+  commit>` · `waived — revisit: <condition>`. `dropped` needs the operator's
+  agreement and the date they gave it. `parked` claims work exists and must say
+  where — a branch or a commit, never a directory. `waived` is a decision, not
+  debt: it carries the condition that reopens it. Both long forms:
+  the skill's `references/backlog.md`.
 - **Home** — an issue id where a tracker exists, `—` where this file *is* the tracker.
 
 ## Closed

package/plugins/task-pipeline/skills/task-pipeline/templates/brief.md

@@ -59,9 +59,10 @@ source is a recorded decision, an unquoted one is an undetected divergence.
 - **Knowledge wiki:** installed / not installed
   ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki); recommended, never a gate)
 - **Retro, in force:** `docs/evidence/retro.md` — none / N standing instructions
-  (read **in full**, together with the run stamps and the recent-log window; list
-  which ones bind this run, and stamp each as it fires **with the commit** — that
-  stamp is the only evidence behind stage 10's cold-retirement rule)
+  (read **in full**, together with the run stamps — both bounded by construction;
+  the recent log is **queried** by this task's nouns, never read end to end; list
+  which instructions bind this run, and stamp each as it fires **with the commit**
+  — that stamp is the only evidence behind stage 10's cold-retirement rule)
 - **Retro archive:** `docs/evidence/retro/` — **queried** by this task's nouns;
   what it returned: … (or `nothing`)
 - **Code graph:** built / installed-not-built / not installed

package/plugins/task-pipeline/skills/task-pipeline/templates/retro.md

@@ -6,10 +6,12 @@ The order is load-bearing: the cold-retirement trigger reads the stamp this stag
 writes, so a prune ahead of it can never run on real data (`learned.md` rule 21).
 Doctrine: `references/retrospective.md`.
 
-**What stage 0 reads in full:** *Standing instructions*, *Run stamps* and *Recent
-log* — all three are bounded by construction, which is why the cap is not
-negotiable. The **archive** (`docs/evidence/retro/YYYY-QN.md`) is *queried* by
-the task's nouns and never read end to end.
+**What stage 0 reads in full:** *Standing instructions* and *Run stamps* — both
+are bounded by construction (ten rows, one line per run), which is why the cap is
+not negotiable. The **Recent log** and the **archive**
+(`docs/evidence/retro/YYYY-QN.md`) are *queried* by the task's nouns and never
+read end to end: nothing caps the log's length, and an uncapped section read in
+full is the volume that stops the ten binding rows being read.
 
 ## Standing instructions (max 10 — in force right now)
 

package/plugins/task-pipeline/skills/task-pipeline/templates/run.md

@@ -20,7 +20,7 @@ Run: `<topic>` · started `<YYYY-MM-DD>` · module map: `<path or "none">`
 
 ## `read:` — which doctrine this run actually opened
 
-The bundle is 36 reference files and nothing recorded which of them a run read, so **a
+The bundle is 38 reference files and nothing recorded which of them a run read, so **a
 skipped file and a read one were indistinguishable** — the class every guard in this
 pipeline exists to catch, left standing over the doctrine itself.
 
@@ -48,7 +48,7 @@ same claim one level down.
 |---|---|---|
 | `unmeasured — no run ledger` | there is no ledger | nothing to read from |
 | `unmeasured — the ledger carries no read: lines` | the hook is absent, **or** the run opened no doctrine | two opposite facts, and the ledger cannot separate them, so neither is claimed |
-| `N of 36 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
+| `N of 38 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
 
 **It is a disclosure: no floor, no direction, never a target.** A run that needs four files
 and reads four is not worse than one that reads thirty — and the moment the number becomes