ultra-builder-pro-cli 0.16.0 → 0.17.0

package/skills/ultra-change/SKILL.md

@@ -1,98 +1,73 @@
 ---
 name: ultra-change
-description: Open or resume one bounded post-baseline change and connect its intent, delta, task plan, fresh context, and convergence evidence. Use when handling daily feature work, fixes, redesigns, or incidents after an Ultra baseline exists.
+description: Capture or revise one bounded feature, fix, redesign, or incident contract against a ready Ultra baseline. Use when post-baseline work needs accepted intent before research, planning, or implementation.
 ---
 
-# Align, route, and maintain one continuous change
-
-Use Ultra MCP for lifecycle writes. Keep external memory and code-graph content in
-their providers; Ultra stores references only. Read
-`../ultra-think/references/decision-dialogue.md` before forming a Change Contract.
-
-## Capture and align the outcome
-
-1. Read `system.doctor`, `baseline.get`, `change.list`, `change.breadcrumb`, and active
-   decision threads. Resume the matching change or alignment thread; do not duplicate
-   either authority.
-2. New ordinary work requires a ready baseline. An incident on unhealthy authority
-   requires an explicit `baseline_bypass` reason and approver. Never infer approval
-   from urgency.
-3. Inspect the current checkout before questioning the owner. Convert the request into
-   a working outcome, constraints, accepted facts, unknowns, and likely risk profile.
-   Resolve repository facts yourself.
-4. Start a baseline-bound decision thread when the Change Contract contains a material
-   owner choice. Normalize explicit decisions already present in the user's request
-   without asking them to repeat themselves. Otherwise open one earliest decision,
-   present it with a recommendation and durable effect, and STOP.
-5. Read `references/change-contract.md`. After all blocking decisions are resolved,
-   prepare one compact Change Contract checkpoint containing the outcome, executable
-   acceptance, non-goals, public seams, recovery contract, unresolved decisions,
-   documentation impact, profile rationale, material risk flags, and research
-   disposition. The owner approves the contract once; do not ask for a second equivalent
-   confirmation.
-6. Select `quick`, `standard`, `major`, or `incident` from current scope and risk.
-   Escalate a proposed quick change when its contract carries material risk or research.
-   Write the compact approved alignment projection to
-   `.ultra/docs/alignment/<thread-id>.md`, confirm the decision checkpoint with that
-   artifact digest, then call `change.create` with `alignment_thread_id`. The create
-   operation materializes the authoritative Change Contract projections. Read the
-   normalized change and linked workflow back.
-
-Do not create a decision thread for a fact the agent can inspect or a reversible
-implementation detail already delegated by the accepted contract.
-
-## Record the change workflow
-
-Use `workflow.step` as evidence becomes durable:
-
-- `bind-baseline`: current baseline id, revision, branch, and worktree evidence;
-- `classify-change`: kind and rationale;
-- `record-intent`: intent artifact, acceptance, scope, and resolved docs impact;
-- `plan-change`: completed plan workflow and authoritative task ids;
-- `compile-context`: current task-bound `change.context` manifest and digest;
-- `verify-readiness`: ready breadcrumb with one executable next action.
-
-Standard and major changes keep deltas under
-`.ultra/changes/active/<id>/delta/` and an evidence-linked `plan.md`. Deltas describe
-differences from the baseline; they are not a second baseline. Incidents maintain the
-structured diagnosis artifact and recovery evidence.
-
-When `research_disposition.status` is `bounded` or `required`, run `ultra-research`
-with the exact recorded mode and selected steps before planning. Planning is blocked
-until that change-bound research run is complete, current, and selection-equivalent.
-Use `none` only when the Change Contract already has sufficient evidence.
-
-Use `ultra-plan` to create complete DB-backed task contracts. Recompile
-`change.context` after any task, HEAD, specification, or decision change. The task's DB
-contract is authoritative; Prompt input may not override its seam or verification.
-Required missing or stale refs block. Budget warnings guide narrower context but never
-justify dropping necessary evidence or refusing legitimate work.
-
-An ordinary active change remains executable only while its durable `bind-baseline`
-evidence still names the current approved-ready baseline. HEAD, worktree, specification,
-or source-evidence drift created after that binding is advisory until delivery
-reconciliation. Adoption/migration state, missing approval or evidence, blocking gaps,
-and any other structural baseline failure block tasks, context, and later stages. Only
-the recorded incident break-glass authority can bypass that gate.
-
-Call `workflow.complete` only after all change workflow steps are current. Return the
-change id, kind, task set, context digest, blockers or warnings, workflow state, and the
-breadcrumb's one route.
-
-When implementation reveals a stable missing invariant, use
-`change.learning_propose` and the approval/reject/apply transition. Unresolved learning
-blocks delivery. An approved application must bind the declared target anchor, its
-before and after digests, and current evidence before the proposal becomes `applied`.
-
-## Automatic routing contract
-
-Automatic means route, inspect, and recover automatically; it never means silently
-choose an owner decision. The normal route is:
-
-`capture → align → Change Contract checkpoint → change authority → bounded research when
-needed → plan candidate → plan decision review → plan approval → ultra-dev → test →
-review → deliver → baseline reconciliation`.
-
-A quick change may omit research and use one task only when evidence proves the request
-has no material unresolved decision or risk. An incident routes through reproduction,
-hypothesis discrimination, recovery choice, fix, and verification before convergence.
+# Capture accepted change intent
+
+Change is the durable unit that connects later research, plan, implementation,
+verification, review, and baseline reconciliation. Capturing a change does not start
+those workflows or compile execution context.
+
+Read `../ultra-think/references/decision-dialogue.md` before asking a material question.
+
+## Inspect and align
+
+1. Read `system.doctor`, `baseline.get`, active changes, decisions, and
+   `change.breadcrumb`.
+2. Resume an existing change that matches the request. Do not duplicate authority.
+3. Ordinary work requires a healthy ready baseline. An incident may use only an
+   explicit `baseline_bypass` reason and approver; urgency is not approval.
+4. Inspect the checkout and accepted baseline before asking the user. Resolve code and
+   runtime facts yourself.
+5. Convert the request into a Change Contract:
+   - observable outcome and executable acceptance;
+   - non-goals and public seams;
+   - recovery strategy and verification;
+   - unresolved material decisions;
+   - documentation impact;
+   - change kind and evidence-backed risk flags;
+   - research disposition.
+
+Select `quick`, `standard`, `major`, or `incident` from actual scope and risk. A quick
+change may have no material risk, research obligation, or more than one task.
+
+Ask only when a choice changes accepted product intent, scope, public behavior,
+compatibility, security, material cost, external effects, or recovery. Use the host's
+native question UI when available. Normalize clear choices already in the user's
+request. The model owns reversible implementation detail inside the accepted contract.
+
+## Persist the contract
+
+When a durable alignment checkpoint is necessary, bind it to a compact artifact and
+pass its id as `alignment_thread_id`. Do not require a checkpoint for a complete,
+unambiguous request that already provides current authority.
+
+Call `change.create`. It records and completes exactly:
+
+1. `bind-baseline`
+2. `classify-change`
+3. `record-intent`
+
+The returned change workflow must be `completed`; research, plan, context, dev, test,
+review, and deliver remain independent capabilities. Standard and major changes may
+store delta artifacts under `.ultra/changes/active/<id>/delta/`. Incidents maintain
+the structured diagnosis artifact.
+
+Use `change.update` when accepted intent or evidence changes. Update the Change
+Contract, classification, research disposition, and docs impact together when their
+meaning is coupled. Downstream task, context, test, or review evidence affected by that
+change must become stale and be regenerated; never keep old evidence green by prompt
+assertion.
+
+If research is required, invoke `ultra-research` with the recorded disposition. If the
+contract is sufficiently evidenced, the host may recommend `ultra-plan`. `change.context`
+is compiled only for an actual plan, implementation, test, or review consumer.
+
+Stable implementation discoveries use the approval-gated specification-learning
+transitions. External memory and graph providers retain their own content; Ultra stores
+metadata references only.
+
+Return the normalized contract, change id and kind, research disposition, blockers,
+and `allowed_transitions`. The host selects a recommendation from those transitions;
+MCP does not encode a semantic next action.

package/skills/ultra-deliver/SKILL.md

@@ -1,84 +1,56 @@
 ---
 name: ultra-deliver
-description: Converge one verified Ultra change, reconcile specification learning and baseline authority, archive recoverably, and optionally release when explicitly authorized. Use when current test and independent review evidence are ready for delivery.
+description: Converge a verified Ultra change, reconcile baseline specifications, and archive it with recoverable local evidence. Use when implementation, testing, and review are current.
 ---
 
-# Converge and deliver one change
+# Converge and archive local authority
 
-Use host judgment for release scope and authorization. Use Ultra MCP for evidence
-binding, workflow state, convergence, baseline reconciliation, archive recovery, and
-output digests.
+Delivery closes Ultra's local change authority. It does not grant or perform commit,
+push, tag, registry publication, deployment, or another external effect.
 
 ## Bind current evidence
 
-1. Read `system.doctor`, `baseline.get`, `change.get`, `change.breadcrumb`, active
-   decision state, linked tasks, and current test/review workflows and artifacts. An
-   open decision, blocking deferral, or unconfirmed checkpoint prevents delivery.
-2. Resume or start a `deliver` workflow linked to the change and baseline.
-3. Require completed tasks, current context, a passing test report at full HEAD with a
-   verified public seam, and current independent `spec_fidelity` and
-   `engineering_standards` verdicts. Record `bind-evidence`.
+1. Read doctor, baseline, change, breadcrumb, decisions, tasks, test, review, learning,
+   and current checkout.
+2. Resume or start a deliver workflow bound to the change and baseline.
+3. Require complete task evidence, a current test report, both review axes, current
+   context, and resolved material decisions. Record `bind-evidence`.
 
-Evidence from another revision, task set, change, or stale output is invalid. An
-approved break-glass incident follows only its recorded recovery contract.
+Evidence from another revision, task set, or change is invalid.
 
-## Reconcile and verify
+## Reconcile specifications
 
-Resolve every specification-learning proposal. Apply an approved item to its declared
-target and verify it before marking it applied; preserve rejection reasons. Reconcile
-accepted delta and documentation impact into baseline documents, or record an exact
-no-change reason. Record `reconcile-specifications`.
+Resolve every specification-learning candidate. Apply approved learning to its target
+with before/after digests and verification; preserve rejection reasons.
 
-Read `references/baseline-reconciliation.md` and write the bound reconciliation
-manifest inside the active change directory. It must record every baseline update as a
-semantic add or update with a real source anchor, before/after digests, verification,
-resolved gap ids, and resolved unknowns. A no-update delivery records one evidenced
-semantic no-change reason.
+Read `references/baseline-reconciliation.md` and write the reconciliation manifest
+inside the active change directory. Record semantic additions or updates, resolved
+gaps and unknowns, and verification. If baseline semantics did not change, record an
+evidenced no-change reason. Record `reconcile-specifications`.
 
-Verify the release candidate with repository-native focused/regression checks,
-type/lint/build where applicable, install/doctor smoke for distributed packages,
-public seams, and rollback or recovery sanity. Compile final convergence context and
-record its immutable manifest as the `verify-candidate` output. Any edit invalidates
-affected evidence.
+Compile final convergence context and run the risk-selected candidate checks, install
+or doctor smoke when this change modifies distributed assets, public-seam verification,
+and recovery sanity. Record the immutable context under `verify-candidate`.
 
-Call `change.converge` with only the change id. Do not submit verdicts or evidence
-summaries: MCP derives development, test report, public seam, specification,
-documentation, both review axes, and incident diagnosis evidence from DB-backed
-workflows and current artifacts. Resolve named blockers and rerun invalidated gates. Record
-`converge-authority` only when the change is ready.
+Call `change.converge`; MCP derives readiness from durable dev, test, review,
+specification, docs, diagnosis, and current checkout evidence. Record
+`converge-authority` only when ready.
 
-Call `change.archive` with the summary, `reconciliation_path`, and baseline updates or
-exact no-change reason.
-Ordinary archive refreshes baseline revision and digests atomically and rolls back on
-incomplete reconciliation. Record `archive-change`. For break-glass delivery, verify
-the returned bypass and blocking reconciliation gap.
+Call `change.archive` with the reconciliation manifest and summary. Verify the refreshed
+baseline and archived packet, then record `archive-change`.
 
-## Release only with authority
+Write `.ultra/reports/delivery/<workflow-id>.json` with
+`ultra-delivery-report-v1`: archived change, baseline, HEAD, worktree and context
+digests, local checks, rollback notes, and timestamp. The report must not contain a
+release decision. Record it under `verify-delivery` and complete the workflow.
 
-The `release-if-authorized` step is not permission. When publication is outside the
-user's request, complete it with exactly one `release_authorization` decision containing
-`authorized: false` and the reason. When explicitly authorized, record
-`authorized: true`, `approved_by`, the exact release `scope`, and the reason; then
-determine compatibility impact, update version and
-changelog, rerun invalidated checks, create a non-force commit/tag, push, publish, and
-verify remote commit, tag, release, and registry version independently.
-If release authority is not already explicit, present that authorization as one compact
-question and stop. Do not bundle release permission with unrelated delivery choices or
-ask again when the current user request already grants the exact scope.
+## External effects
 
-Write `.ultra/reports/delivery/<workflow-id>.json` atomically using
-`ultra-delivery-report-v1`, with change/archive state, baseline id/status, full HEAD,
-worktree digest, convergence-context digest, exact passing
-checks, the explicit release authorization/performed decision, release identifiers
-when applicable, structured evidence for every performed commit/push/tag/registry/
-deployment action, rollback notes, and timestamp. The report authorization must match
-the DB-recorded decision. Record `verify-delivery` with that
-output and call `workflow.complete` only after the change is archived and local and
-remote evidence agree for every authorized action. MCP derives the delivery summary
-from this report rather than a Prompt claim.
+If the user separately requests commit, push, tag, publish, or deploy, handle that as a
+host-owned effect after Ultra delivery. Confirm only missing material authority, run
+the repository's release checks, and report remote evidence separately. Never infer an
+external effect from `ultra-deliver`, and never encode it as completed Ultra delivery
+state.
 
-Return workflow id, archive and baseline state, evidence digests, commit/release facts,
-recovery notes, residual risks, and one next route. Successful delivery routes to
-`ultra-status` for the final authoritative view or `ultra-change` for the next accepted
-outcome. Stale gates return to their owning workflow; a new owner choice routes to
-`ultra-think`; broken authority routes to `ultra-doctor`.
+Return archive and baseline state, evidence digests, recovery notes, residual risks,
+and allowed transitions.

package/skills/ultra-dev/SKILL.md

@@ -1,66 +1,64 @@
 ---
 name: ultra-dev
-description: Execute one authoritative Ultra task through a fresh-context, test-driven, review-backed live-path slice with resumable DB state. Use when a planned task is ready to implement, resume, or recover after a blocker or interrupted session.
+description: Implement one authoritative Ultra task through a fresh-context, test-driven, review-backed live path. Use when a planned task is executable, interrupted, or ready for focused recovery.
 ---
 
-# Implement one executable task
+# Implement one task
 
-Bind exactly one task and change. Use the host for code reasoning and edits; use Ultra
-MCP for workflow state, context authority, task/session transitions, evidence, and
-recovery.
+The host model owns code reasoning and edits. Ultra owns the task and workflow state,
+fresh context contract, session lease, evidence references, and recovery.
 
-## Start or resume
+## Bind and resume
 
-1. Read `system.doctor`, `change.breadcrumb`, active decision state, `task.get`, workflow
-   state, dependencies, active sessions, Git HEAD, and worktree scope. If the
-   breadcrumb names an open decision or unconfirmed checkpoint, return to
-   `ultra-think` and do not edit code.
-2. Resume an existing `dev` workflow or call `workflow.start` with `change_id` and
-   `task_id`. Startup fails when the DB-backed task execution contract is incomplete or
-   owned by another change.
-3. Record `bind-task` with task, dependency, branch, and worktree evidence.
-4. Compile `change.context` for `implement`. It derives public seam, verification, and
-   required refs from the task row. Record its immutable manifest as the
-   `compile-context` output only when ready. That starting snapshot remains historical
-   task evidence; later task commits do not invalidate it when its commit stays on the
-   current ancestry and the task contract is unchanged.
-5. Run session admission before spawning an isolated session. Do not open a second
-   active lease without the documented resume, takeover, or abandon decision.
+1. Read doctor, breadcrumb, active decisions, task contract, dependencies, dev runs,
+   sessions, HEAD, and worktree.
+2. Resume the matching dev run or start one with `change_id` and `task_id`.
+3. Record `bind-task` with current authority and dependency evidence.
+4. Compile `change.context` for `implement` using DB-backed public seam, verification
+   command, and refs. Context budgets are advisory; missing required evidence is
+   blocking. Record the immutable manifest as `compile-context`.
+5. Reuse an existing valid session. Otherwise pass admission and call `session.spawn`.
+   Work only in the returned worktree and preserve unrelated changes.
 
-## Red, green, verify
+Do not spawn recursively from a parent-owned worker session. Process exit is transport
+evidence, never task completion.
 
-1. Reproduce the behavior or establish a characterization signal before logic edits.
-   Record `establish-feedback-loop` with the exact failing command and observed result.
-2. Set the task `in_progress`; implement the smallest complete vertical slice through
-   the declared public seam. Preserve unrelated worktree changes.
-3. Keep application judgment and edits in the host. Do not write projections, raw DB,
-   workflow output digests, or evidence state by hand.
-4. Refactor only inside the accepted slice while the focused signal stays green.
-   When implementation exposes a product, compatibility, security, cost, or recovery
-   choice outside the accepted task contract, preserve the evidence, open one decision
-   through the shared dialogue protocol, and stop. Do not convert implementation
-   convenience into an owner decision.
-5. Record `implement-slice`, then run focused, adjacent, static/build, public-seam,
-   error, and recovery checks proportional to risk. Record exact evidence under
-   `verify-slice`.
-6. Run `ultra-review` at the current diff. Record both independent verdict axes under
-   `review-slice`; unresolved blocking findings return to implementation.
+## Focused inner loop
+
+1. Reproduce the bug, write a failing test, or establish a characterization signal
+   before a logic change. Record `establish-feedback-loop`.
+2. Mark the task `in_progress` and implement the smallest complete slice through the
+   declared public seam.
+3. Keep the loop adaptive. The model may choose implementation details inside the
+   accepted contract. If new evidence changes product intent, compatibility, security,
+   material cost, external effects, or recovery, use the host's native question UI and
+   the decision protocol; do not ask about ordinary reversible details.
+4. Record `implement-slice`, then run focused tests plus the adjacent checks justified
+   by the task risk. Record exact results under `verify-slice`.
+5. Run a task-scoped independent review on specification fidelity and relevant
+   engineering risks. Record `review-slice`. Fix blocking findings and refresh affected
+   evidence.
+6. Create the authorized local task commit. Do not push, publish, tag, or deploy unless
+   the user separately authorized that external effect.
+
+Task-level tests and review belong to this inner loop. They do not replace aggregate
+change testing or review when multiple slices, integrations, or broader risks require
+those capabilities.
 
 ## Complete or recover
 
-Close the admitted session with `session.close` after its final heartbeat and verify
-that no running lease remains for the task. Then update the task to `completed` only
-after acceptance, verification, documentation, and review are current. Record
-`record-completion` with commands, results, changed paths, commit when authorized, and
-context/review references; then call `workflow.complete`. The MCP refuses dev
-convergence while the task is incomplete or a session is still running.
+In direct mode, integrate the task commit through the repository's accepted path,
+verify ancestry and the public seam, close the session, update the task to `completed`,
+record `record-completion`, and complete the dev workflow.
+
+In a parent-supervised worker, record completion evidence and exit without closing the
+parent-owned lease. The primary host verifies the exact session commit, performs any
+integration, refreshes review if the reviewed checkout changed, settles the lease, and
+completes the workflow.
 
-On interruption or an external blocker, record the current step as `blocked`, update
-the task consistently, and preserve the session and evidence. Resume the same run;
-completed steps remain durable. Any code or contract change invalidates affected test,
-review, or context evidence.
+Preserve worktrees by default. Remove one only when Git proves it is clean and
+integrated. On interruption, record the current step and task as blocked, preserve
+worktree and evidence, and resume the same run later.
 
-Return the task outcome, public seam, changed paths, exact checks, review results,
-workflow id, session state, residual risks, and one next route. Route another ready
-task to `ultra-dev`; route a fully implemented change to aggregate `ultra-test`;
-route a new owner choice to `ultra-think`; route broken authority to `ultra-doctor`.
+Return outcome, changed paths, public seam, exact checks, review axes, commit and
+session state, residual risk, and allowed transitions.

package/skills/ultra-doctor/SKILL.md

@@ -1,65 +1,50 @@
 ---
 name: ultra-doctor
-description: Diagnose and recover Ultra DB schema, workflow outputs, projections, sessions, incidents, change artifacts, archives, hooks, and installed host assets. Use when authority is degraded, workflow state disagrees with prompts, outputs are stale, hooks fail, or MCP operations cannot proceed.
+description: Diagnose and mechanically recover Ultra schema, workflow, projection, session, archive, hook, and installed-asset faults. Use when authority is degraded, stale, contradictory, or unavailable.
 ---
 
 # Diagnose before repair
 
-Default to read-only diagnosis. Call `system.doctor` with repair disabled and inspect:
+Doctor owns deterministic health and supported recovery. It cannot decide product
+scope, invent evidence, approve a baseline, answer a user decision, or mark semantic
+work complete.
 
-- SQLite integrity, schema version, required tables, and migration provenance;
-- baseline classification/readiness, research provenance, spec/evidence digests, gaps,
-  and revision/worktree drift;
-- active, blocked, and ready workflow runs, current steps, blockers, and output health;
-- active decision threads, the sole current question, blocking deferrals, checkpoint
-  state, and current checkpoint artifact digests;
-- event/projection cursor lag and failed or interrupted projection jobs;
-- sessions, incidents, circuit state, active-change artifacts, and archive journals;
-- external provider ownership boundaries.
+## Read-only diagnosis
 
-An expected blocked workflow is a workflow warning, not DB corruption. A stale or
-missing recorded output is an authority failure for that run. Doctor cannot invent
-evidence, complete a step, accept a failure, approve a baseline, or change product
-scope.
-An awaiting owner decision is also a recoverable warning, not corruption. A missing or
-changed artifact bound to a current confirmed checkpoint is an authority failure;
-doctor may report it but cannot reconstruct the decision or approval.
+Run `system.doctor` without repair and inspect:
 
-## Route failures
+- SQLite integrity, schema 18 migration, required tables, and backups;
+- baseline and research provenance, gaps, digests, and Git/worktree drift;
+- workflow status, obsolete-step migration, blockers, and output freshness;
+- decisions and checkpoint artifact freshness;
+- projection jobs and event cursors;
+- sessions, preserved worktrees, incidents, circuit state, and archive journals;
+- external provider boundaries.
 
-- Missing or migrated baseline evidence: `ultra-init` and the exact research step.
-- Stale workflow output: restore or regenerate the artifact from accepted evidence,
-  then record the affected step again and re-run completion.
-- Projection lag with healthy authority: eligible for mechanical regeneration.
-- Orphan session: reconcile the recorded lease; do not kill unrelated processes.
-- Missing change artifact: recover from version control, backup, or explicit owner
-  decision rather than silently recreating it.
-- Open decision: resume its exact question through `ultra-think`; checkpoint-ready
-  state requires owner confirmation, not mechanical repair.
-- Stale decision artifact: restore or update the artifact from accepted authority,
-  then reprepare and reconfirm the same checkpoint through `ultra-think`; do not
-  rewrite the owner decision or mark the failure healthy mechanically.
-- Corrupt SQLite: preserve DB/WAL/SHM and obtain a restore-or-rebaseline decision.
+An expected workflow pause or awaiting user decision is a warning, not corruption.
+Missing or changed required evidence is an authority failure but cannot be reconstructed
+by doctor.
 
-## Explicit project repair
+## Recovery boundary
 
-After authorization, call `system.doctor` with repair enabled. Repair is limited to
-supported schema upgrades, backup-first archive recovery, orphan reconciliation,
-staleness consumption, projection requeue, and projection regeneration. Verify the
-pre-migration and repair backup paths and rerun the read-only report. A completed repair
-action does not imply healthy workflow evidence.
+With explicit repair authorization, `system.doctor` may:
 
-When integrity prevents opening the DB, use only the documented restore or rebaseline
-command with its explicit confirmation token. Both must quarantine or back up prior
-authority and roll back on failure.
+- apply backup-first supported schema migrations;
+- migrate active pre-18 rigid workflows into recoverable adaptive state;
+- requeue or regenerate projections from healthy DB authority;
+- reconcile orphan sessions without deleting unrelated or dirty worktrees;
+- resume supported archive journals;
+- recover missing workflow provenance as a blocked run requiring real evidence.
 
-## Installed host failures
+It may not create a Git checkpoint, replace a healthy baseline, accept known failures,
+resolve decisions, regenerate semantic content, or edit application code.
 
-For a missing hook adapter or stale plugin path, capture the manifest and missing
-target, run `ubp --doctor` for the actual host, reinstall through the adapter rather
-than patching cache contents, and verify provenance, hashes, entry points, MCP startup,
-and a hook smoke test. Project doctor and installer doctor are separate authorities.
+Corrupt SQLite requires preservation of DB, WAL, and SHM followed by an explicit
+restore-or-rebaseline choice. Missing hook adapters or stale cache paths require
+`ubp --doctor` and adapter reinstall; never patch plugin cache contents by hand.
 
-Return health first, failing authority checks, workflow warnings, backup/recovery
-paths, whether repair ran, unresolved owners, and one exact next action. Do not edit
-application code or external memory/graph providers through this Skill.
+After repair, rerun doctor read-only and verify backup paths, schema, installed hashes,
+entry points, MCP startup, and hook smoke tests as applicable.
+
+Return health first, failed checks, mechanical repairs performed, preserved recovery
+paths, unresolved owners, and allowed transitions plus any unique required transition.