wdi-method 0.5.13 → 0.6.0

package/kit/skills/wdi-product/SKILL.md

@@ -24,7 +24,8 @@ You MUST NOT write or edit `prd.md` yourself. If a check fails, name what is mis
 |---|---|
 | `.what/_product-brief/brief.md` | The problem, the primary user, the boundary the PRD MUST respect |
 | `.what/_prd/*/prd.md` | Which initiatives already have a PRD, and what each already promises |
-| `.control/registry/requirements.yaml` | The next `CAP`/`FR`/`NFR`/`UJ` ids, allocated globally |
+| `.control/registry/goals.yaml` | The `BG` this initiative serves |
+| `.control/registry/requirements-*.yaml` | Every initiative's `FR`/`NFR`/`UJ`, so the next id continues the product's sequence |
 | `.control/decisions/` | `applied` decisions the PRD MUST already reflect |
 | `.constitution/method/document/prd-guide.md` | The rules the result is checked against |
 | `.control/product-glossary.md` | Terms already fixed |
@@ -67,33 +68,44 @@ they arrive through `persistent_facts` and `doc_standards` in `_bmad/custom/bmad
 Name the brief and, for `update`, the existing PRD and every `applied` decision that reaches it. The skill
 globs its own default locations, which this project redirects.
 
-## Step 4 — Verify
+## Step 4 — Land the requirements
+
+Each feature's **Realizes:** line cites `FR-N`/`NFR-N` ids. The template gives the statement, the proof
+of done, and the enforcer no home inside `prd.md` any more — write them straight into
+`.control/registry/requirements-<slug>.yaml` — the slug being this PRD's own folder name — on the id's own row, as part of producing this PRD. The `CAP` row goes in the same file: one feature is one capability, and a feature lives in exactly one PRD. This is
+landing, not editing `prd.md`: the same duty `wdi-problem` Step 4 carries for `BG-N`.
+
+An `update` run that adds or changes a promise lands the same way — the registry row changes, the PRD
+keeps citing the id, and Revision History (Step 6 below) records what changed for a reader.
+
+## Step 5 — Verify
 
 | # | Check | Fails when |
 |---|---|---|
 | 1 | Home | Anything outside `.what/_prd/<initiative>/`, or a folder still named `ISI-slug-inisiatif` |
 | 2 | Ids allocated from the registry | `FR-1` restarted, or an id invented in prose |
-| 3 | Every `FR` names its `capability`; every `NFR` names its `goal` | V15 has nothing to check |
-| 4 | Every `FR` has **exactly one** proof of done, in business language | Zero, or a second technical restatement beside it |
-| 5 | Every `NFR` names `enforced_by` | An `NFR` nothing enforces is decoration (V5) |
-| 6 | Cross-Cutting NFRs and Constraints both present | An absent section reads as "not checked" |
-| 7 | No solution shape | A framework, a table, or a transport named in `prd.md` rather than in `addendum.md` |
-| 8 | One Revision History row for this run, written for someone not in the room | Zero rows, several rows, or a row that says "Updated §4.2" |
-| 9 | Memlog at `.control/memlog/prd-<slug>.md`, slug matching the folder | A `.memlog.md` appeared inside `.what/` — `--workspace` was used |
-| 10 | `bmad-review` ran through `doc_standards` on `prd.md` and `addendum.md` | It did not fire |
+| 3 | Every `FR` names its `capability`; every `NFR` names its `goal` | `chain-links` has nothing to check |
+| 4 | Every `FR`'s statement and proof of done, every `NFR`'s statement and `enforced_by`, live only in `requirements-<slug>.yaml` | Full prose written in `prd.md` instead of, or as well as, the registry row from Step 4 |
+| 5 | Cross-Cutting NFRs (§6) and Constraints and Guardrails (§7) both present | An absent section reads as "not checked" |
+| 6 | No solution shape | A framework, a table, or a transport named in `prd.md` rather than in `addendum.md` |
+| 7 | §1 Why This Initiative states a delta against the brief's `Why`, not a restatement of it | The product's own vision written out again on the first PRD |
+| 8 | No Document Purpose, Glossary, Non-Goals, Open Questions, or Assumptions Index section | Any of the five appeared instead of being routed to its real home — see `prd-guide.md` |
+| 9 | One Revision History row for this run, written for someone not in the room | Zero rows, several rows, or a row that says "Updated §4.2" |
+| 10 | Memlog at `.control/memlog/prd-<slug>.md`, slug matching the folder | A `.memlog.md` appeared inside `.what/` — `--workspace` was used |
+| 11 | `bmad-review` ran through `doc_standards` on `prd.md` and `addendum.md` | It did not fire |
 
-Check 9 MUST be fixed immediately rather than reported. V16 rejects a memlog inside the corpus.
+Check 10 MUST be fixed immediately rather than reported. `memlog-home` rejects a memlog inside the corpus.
 
-## Step 5 — `owns:`, and the collision it prevents
+## Step 6 — `owns:`, and the collision it prevents
 
 A new or changed `FR` that claims write authority over a domain entity MUST be checked against `owns:` in
 `components.yaml`. An entity has exactly one owning Product Component; an `FR` from another PRD that needs to
-change it MUST point at the owner's `FR` rather than promising to write it itself. V21 checks this, and the
+change it MUST point at the owner's `FR` rather than promising to write it itself. `entity-one-writer` checks this, and the
 collision has already happened once for real.
 
 Report a collision. You MUST NOT resolve it by widening one PRD's claim.
 
-## Step 6 — Impact
+## Step 7 — Impact
 
 A changed promise changes what other documents can still claim. Check, and **report** — never edit.
 
@@ -111,7 +123,7 @@ NOT reopen one yourself.
 
 - You MUST NOT write a second PRD for an area that already has one. The reader test decides, and its answer
   is `update` far more often than it feels.
-- You MUST NOT open G2 on a PRD that has not been through check 10. Gate time is for deciding, not
+- You MUST NOT open G2 on a PRD that has not been through check 11. Gate time is for deciding, not
   proofreading.
 - The gate reads `prd.md` and `EXPERIENCE.md` together. A PRD that passes while the experience side is
   missing has answered half of what G2 decides.
@@ -123,5 +135,6 @@ NOT reopen one yourself.
 
 ## Output
 
-Intent dispatched · what the promise now is in one line · the result of all ten checks naming the failures ·
-the `owns:` check · impact found and where it was routed · the gates the matrix names · open questions filed.
+Intent dispatched · what the promise now is in one line · the requirements landed in Step 4 · the result of
+all eleven checks naming the failures · the `owns:` check · impact found and where it was routed · the gates
+the matrix names · open questions filed.

package/kit/skills/wdi-question/SKILL.md

@@ -1,88 +1,170 @@
----
-name: wdi-question
-description: Use when something cannot be decided now and must not be silently assumed. Files it into one of four lists in .control/questions/ by what the reader has to do about it, and closes it in place when the answer arrives.
----
-
-# WDI Question
-
-Free of stage and free of role. The purpose is narrow: make sure an unresolved thing is written down
-where it will be seen, instead of becoming an assumption nobody remembers making.
-
-The old single list reached `OQ-146` and stopped being readable. It is now four files in
-`.control/questions/`, split by **what the reader has to do about it** — not by subject, and not by
-severity.
-
-| File | Holds | Read when |
-|---|---|---|
-| `blocking.md` | Holds a gate. Target ≤3 per Product Component | Every gate |
-| `assumptions.md` | An assumption the agent took itself. One line: the assumption plus the cost of being wrong | Swept once per gate; MAY be skipped |
-| `external.md` | Waiting on a file, an action, or a credential from outside. Owner and `by_when` required | Before go-live — **not** at a design gate |
-| `answered.md` | Archive. Closed in place, never deleted | Almost never; only to stop a question being reopened |
-
-**Only `blocking.md` holds a gate.** `external.md` holds go-live; `assumptions.md` holds nothing.
-
-## The default class is `assumptions.md`
-
-A question is filed there unless it passes one of three tests. One is enough:
-
-1. It touches money, personal data, or a legal obligation.
-2. It changes the wording of an `FR`'s promise.
-3. Answering it wrong forces a rewrite of more than one Product Component.
-
-Failing all three, you MUST take the answer yourself and record it as one line — the assumption, and
-what it costs if it is wrong.
-
-**You MUST NOT register a question as blocking "to be safe."** That habit is what produced 146 ids and
-a list nobody read, and the cost is paid at every gate afterwards.
-
-## One batch, per gate, already ranked
-
-Inside a single working pass you do **not** ask. You collect. The batch is delivered once, at the gate,
-ranked, and it MUST NOT be dribbled out as each question surfaces.
-
-A healthy batch on `mode: catalog`: **≤3 blocking questions, plus ≤15 one-line assumptions.** A batch
-larger than that is a signal about the pass, not about the corpus — say so rather than delivering it
-as a list.
-
-When N agents ran in parallel, their questions arrive as **one** ranked batch, never as N reports.
-
-## Registering
-
-| Field | Rule |
-|---|---|
-| Question | One sentence, answerable. "How should referrals work?" is a topic, not a question |
-| Blocks | What cannot proceed — a gate, an `FR`, a story, or nothing |
-| Owner | Who can answer. A question with no owner is a wish |
-| By when | The moment it must be answered, usually a gate |
-
-Ids stay `OQ-`, allocated from the highest ever used including closed ones. An id MUST NOT be reused.
-
-A question whose discussion outgrows one line gets `.control/questions/OQ-NNN-<slug>.md` in the same
-folder, from `templates/oq.md`, and the list keeps a one-line pointer. The old home
-`.control/supplements/` is gone.
-
-## Closing
-
-An answered question is closed **in place** — the answer written beside it with the date and who
-answered — then moved to `answered.md`. You MUST NOT delete the entry.
-
-If the answer amounts to a decision that is expensive to reverse, the closure MUST route to
-`wdi-decision`. This list records that an answer arrived; a `DEC-` records what was chosen and what it
-cost.
-
-## Rules
-
-- You MUST NOT answer the question yourself when the owner is the client or a stakeholder. Drafting a
-  proposed answer for them to confirm is useful; recording it as settled is not.
-- An `[ASSUMPTION]` tag left in a PRD, an SRS, or an SDD MUST be filed here before that document
-  passes its gate. That is precisely the failure this skill exists to prevent.
-- A question past its "by when" MUST be raised, not silently carried forward. Carried forward twice is
-  a signal that either the owner is wrong or the question is not real.
-- A row MUST move between files when its class changes, and MUST NOT be copied into a second one. An
-  assumption that turns out to touch money moves to `blocking.md`; it does not appear in both.
-- Terms MUST match `.control/product-glossary.md`.
-
-## Output
-
-Which file each question landed in, the blocking ones ranked, the assumptions as one-line rows, and
-anything routed on to `wdi-decision`.
+---
+name: wdi-question
+description: Use when something cannot be decided now and must not be silently assumed. Files it into one of four lists in .control/questions/ by what the reader has to do about it, and closes it in place when the answer arrives.
+---
+
+# WDI Question
+
+Free of stage and free of role. The purpose is narrow: make sure an unresolved thing is written down
+where it will be seen, instead of becoming an assumption nobody remembers making.
+
+The old single list reached `OQ-146` and stopped being readable. It is now four files in
+`.control/questions/`, split by **what the reader has to do about it** — not by subject, and not by
+severity.
+
+| File | Holds | Read when |
+|---|---|---|
+| `blocking.md` | Holds a gate. Target ≤3 per Product Component | Every gate |
+| `assumptions.md` | An assumption the agent took itself. One line: the assumption plus the cost of being wrong | Swept once per gate; MAY be skipped |
+| `external.md` | Waiting on a file, an action, or a credential from outside. Owner and `by_when` required | Before go-live — **not** at a design gate |
+| `answered.md` | Archive. Closed in place, never deleted | Almost never; only to stop a question being reopened |
+
+**Only `blocking.md` holds a gate.** `external.md` holds go-live; `assumptions.md` holds nothing.
+
+## The default class is `assumptions.md`
+
+A question is filed there unless it passes one of three tests. One is enough:
+
+1. It touches money, personal data, or a legal obligation.
+2. It changes the wording of an `FR`'s promise.
+3. Answering it wrong forces a rewrite of more than one Product Component.
+
+Failing all three, you take the answer yourself — and then one more test decides whether it is
+recorded at all.
+
+## The recording threshold — most assumptions MUST NOT be written down
+
+**Two filters, and a line has to pass both.**
+
+**First: it is about the PRODUCT, not about the corpus.** An open question names something undecided
+about what is being built — a behaviour, a boundary, a promise, a limit. *"Does the SRS contradict the
+SDD"* is not an open question; it is an **edit**, and it goes to whichever skill owns the file. A
+question about which document says what has never once changed what gets built, and it is the single
+easiest way to fill this list with rows nobody can act on.
+
+**Second: an assumption whose reversal costs less than the conversation about it MUST NOT be recorded.
+The shipping default IS the record.**
+
+The test is the `Cost if wrong` column that already exists. If the honest answer is *one setting
+changes* · *one default changes* · *a shortcut is added later* — with no rework, no migration, and
+nothing already built on it — then there is nothing to decide and nothing to remember. The code says
+what was chosen, and it says it more reliably than a line in a list.
+
+This is not a licence to assume quietly. It is the opposite: it protects the list. One real corpus
+carried twenty-five open lines, and **six** of them were this class — a default image dimension, how many
+quality presets to offer, whether one working folder at a time is enough. Every one had a default already
+running and a one-value reversal. Sitting in the same list as six real decisions, they made a
+six-item list look like twenty-five items of homework, and the owner stopped reading it.
+
+**The threshold does NOT apply**, and the line is recorded, when being wrong touches money, personal
+data, an irreversible action, a third-party contract, or the wording of an `FR`'s promise. Those are
+the three tests above, and they always win.
+
+**You MUST NOT register a question as blocking "to be safe."** That habit is what produced 146 ids and
+a list nobody read, and the cost is paid at every gate afterwards.
+
+## One batch, per gate, already ranked
+
+Inside a single working pass you do **not** ask. You collect. The batch is delivered once, at the gate,
+ranked, and it MUST NOT be dribbled out as each question surfaces.
+
+A healthy batch on `mode: catalog`: **≤3 blocking questions, plus ≤15 one-line assumptions.** A batch
+larger than that is a signal about the pass, not about the corpus — say so rather than delivering it
+as a list.
+
+When N agents ran in parallel, their questions arrive as **one** ranked batch, never as N reports.
+
+## Every row says whose it is, and whether it can be answered at all
+
+The four files split by **what the reader has to do**. That was not enough: a file can still hold
+lines nobody may answer yet beside lines the owner owes today, and then the owner opens it and sees
+one flat pile. In the corpus above, of twenty-five open lines exactly **six** were the owner's and
+answerable — the other nineteen were frozen, waiting on a measurement, external, or fossil.
+
+So every row carries **`Whose`**, and the vocabulary is closed:
+
+| `Whose` | Means | Who acts |
+|---|---|---|
+| `owner` | A judgement only the owner can make, and it can be made now | the owner |
+| `run: <what>` | The answer comes from running or measuring something, not from an opinion | **you**, not the owner |
+| `frozen: DEC-NNN` | An applied decision forbids answering it yet | nobody, until that `DEC-` lifts |
+
+`run:` MUST name what has to be run. "Needs testing" is not a value; `run: capture 5-finding review,
+measure handoff time` is. A row that cannot name it is not waiting on a measurement — it is an
+`owner` row in disguise.
+
+`frozen:` MUST name a `DEC-` that is `applied` and that actually forbids the work. A freeze covers
+**planning as well as building**: where a decision bans new `FR`, new use cases, and a UX pass in a
+component, answering a design question there is exactly what it bans. When that `DEC-` lifts or is
+superseded, its frozen rows become `owner` rows automatically — no re-triage.
+
+A row whose `Whose` is wrong is worse than a missing row, because it puts work in the wrong person's
+lap and it is invisible.
+
+## Registering
+
+| Field | Rule |
+|---|---|
+| Question | One sentence, answerable. "How should referrals work?" is a topic, not a question |
+| Blocks | What cannot proceed — a gate, an `FR`, a ticket, or nothing |
+| Whose | `owner` · `run: <what>` · `frozen: DEC-NNN`. See above |
+| Owner | Who can answer. A question with no owner is a wish |
+| By when | The moment it must be answered, usually a gate |
+
+Ids stay `OQ-`, allocated from the highest ever used including closed ones. An id MUST NOT be reused.
+
+A question whose discussion outgrows one line gets `.control/questions/OQ-NNN-<slug>.md` in the same
+folder, from `templates/oq.md`, and the list keeps a one-line pointer. The old home
+`.control/supplements/` is gone.
+
+## Closing
+
+An answered question is closed **in place** — the answer written beside it with the date and who
+answered — then moved to `answered.md`. You MUST NOT delete the entry.
+
+**A fossil is closed, not answered, and you MUST look for fossils first.** A row questioning a rule, a
+layer, or a validator that has since been repealed cannot bite again: it closes with the repeal as its
+answer and MUST NOT be put to the owner as a decision. These are free, and a long list usually holds
+several — one real corpus was still carrying a question about `parallel-tickets-blocked`'s shape after the layer `parallel-tickets-blocked` runs
+on had been retired.
+
+**An answer goes into the document it belongs to, and that is usually the end of it.** An `FR` in the
+PRD, a rule in `business-rules.md`, a line in the brief — written there, closed here, done. The closure
+routes to `wdi-decision` **only** when the answer has no home in any design document, or contradicts an
+`AD-N`. `decision-guide.md` § A decision's first home owns that split, and a `DEC-` is never permission
+to edit a document.
+
+This matters most at G1 and G2, where almost nothing is homeless yet: an answer about a brief belongs in
+the brief.
+
+## Rules
+
+- You MUST NOT answer the question yourself when the owner is the client or a stakeholder. Drafting a
+  proposed answer for them to confirm is useful; recording it as settled is not.
+- An `[ASSUMPTION]` tag left in a PRD, an SRS, or an SDD MUST be filed here before that document
+  passes its gate. That is precisely the failure this skill exists to prevent.
+- A question past its "by when" MUST be raised, not silently carried forward. Carried forward twice is
+  a signal that either the owner is wrong or the question is not real.
+- A row MUST move between files when its class changes, and MUST NOT be copied into a second one. An
+  assumption that turns out to touch money moves to `blocking.md`; it does not appear in both.
+- Terms MUST match `.control/product-glossary.md`.
+
+## Output
+
+**The owner's section MUST contain only `owner` rows.** Everything else is reported as a count with one
+line saying why it is not theirs — never as a list they have to read past. A report that shows all
+nineteen alongside the six is the failure this skill was reshaped to end.
+
+| Section | Contents |
+|---|---|
+| **Yours, now** | every `owner` row, ranked. This is the list |
+| Mine | `run:` count, plus what has to be run |
+| Frozen | `frozen:` count, plus which `DEC-` holds them and what lifts it |
+| External | `external.md` count. States plainly that it holds no design gate |
+| Not recorded | how many assumptions the threshold turned away this pass |
+
+Then: which file each question landed in, and anything routed on to `wdi-decision`.
+
+**"Are we done — no more OQ?" is answerable, and the honest answer is usually no.** Say which third is
+the owner's, name what lifts the frozen third, and name what you have to run for the rest. A clean
+list is not the goal; a list where every line is somebody's and actionable is.

package/kit/skills/wdi-reconcile/SKILL.md

@@ -6,12 +6,21 @@ description: Use before a gate, or after a batch of changes, to find drift betwe
 # WDI Reconcile
 
 Documents drift apart quietly. An SRS gets amended while its SDD does not; a `DEC-` is accepted and never
-applied; a story ships behaviour the use case never described. None of this shows up as an error, which is
+applied; a ticket ships behaviour the use case never described. None of this shows up as an error, which is
 why it needs a pass that looks for it on purpose.
 
 This skill is **read-only**. It MUST NOT edit anything. Its output is a report, and every fix it
 recommends is performed by another skill.
 
+**It is not run after every change, and it MUST NOT be offered as one.** Its triggers are a gate, and a
+batch of changes large enough that nobody can hold the delta in their head. Offering it after a two-file
+edit is how a ten-minute change grows a twenty-minute tail — and the offer itself costs the reader
+something, because declining it repeatedly teaches them to decline it always.
+
+**Drift is reported only where it is load-bearing** — where a reader believing the stale sentence would
+make the wrong repair. A document behind the code is in its expected state, not a defect;
+`wdi-review` § Stale is not a finding owns the test, and it applies here unchanged.
+
 ## Step 1 — Scope by gate, then by `mode`
 
 Two filters, and skipping either produces a report that is red where the plan says it should be.
@@ -25,7 +34,7 @@ Establish which gate the work stands at — `wdi-help` answers that — and chec
 | G2 | + every `_prd/<initiative>/`, UX output wherever it currently sits, `product_components` with `mode` and `risk_accepted` |
 | G3 | + every `.what/<pc>/` § UC Catalogue and § Actor Register, `domain-model.md`, `business-rules.md`, the spine, the C4 set, `containers`, the three inventories |
 | G4 | + whatever each component's `mode` demands in `.what/<pc>/` and `.how/<pc>/` |
-| G5 | + `SPEC.md`, `waves.yaml`, story files, tests, `defects.yaml`, RTM rows |
+| G5 | + the contract, `specs.yaml`, ticket files, tests, `defects.yaml`, RTM rows |
 
 **By `mode`.** An artifact a component's `mode` does not demand MUST NOT be reported as missing. A
 component at `catalog` has an SDD skeleton and no depth, and that is a **finished** state — G4 is skipped
@@ -38,10 +47,16 @@ the plan. The corpus running ahead of the code is likewise normal and deliberate
 A narrower scope MAY be asked for — one Product Component, one initiative, one layer. State the scope
 in one line before checking, and say what it excluded.
 
+**A conflict the owner has already decided is not drift.** Where a document disagrees with the code
+because the owner chose the code, the finding is that the **document has not been edited yet** — one
+line, naming the edit — never a re-statement of the conflict and never a question. The decision is not
+reopened here, and `delivery-flow-guide.md` says why: the survey behind that warning was spent when the
+owner answered it.
+
 ## Step 2 — Run the validators first
 
 Run `uv run .constitution/method/scripts/validate.py`, and `uv run .constitution/method/scripts/inventory.py` when code
-exists. V1–V24 answer everything that can be **counted**, and you MUST NOT re-derive by reading what they
+exists. `goal-has-fr`–`cites-resolve` answer everything that can be **counted**, and you MUST NOT re-derive by reading what they
 already report. Carry their findings as they came, then spend the reading on what no validator can see.
 
 `.control/generated/` is their output and MUST NOT be read as an independent source. When it is
@@ -53,18 +68,18 @@ missing or stale, say so and name `validate.py --generate` rather than working a
 |---|---|
 | Top-down | Does every `applied` `DEC-` actually appear in the files its `touches` names? |
 | Bottom-up | Does anything in `.how/<pc>/` describe behaviour that `.what/<pc>/` never promised? |
-| Decisions | Is there an `accepted` `DEC-` that was never applied, or an `applied` one with an empty `touches`? The second is V8; the first no validator can see |
-| Chain | `BG → CAP → FR/NFR → UC → story → test` — where does it break? |
+| Decisions | Is there an `accepted` `DEC-` that was never applied, or an `applied` one with an empty `touches`? The second is `applied-dec-touches`; the first no validator can see |
+| Chain | `BG → CAP → FR/NFR → UC → ticket → test` — where does it break? |
 | Depth | Does any document carry more than its component's `mode` demands? Over-writing is drift too, and it is the direction nobody looks for |
 | Vocabulary | Does any document use a domain noun that `.control/product-glossary.md` does not define, or a synonym for one it does? Detect against the rule in `wdi-blueprint`; MUST NOT keep a second rule here |
 | Registry | Does `components.yaml` still describe what the corpus contains — a `<pc>` folder with no entry, an `LC` with no prose in the slot its `type` names, a container in the C4 set but not in `containers`, `owns:` claiming an entity another component also claims |
 | Inventory | Do the three inventories still match the code? `inventory.py` answers it; carry its findings rather than re-deriving them |
 | **Constitution** | Does an artifact break the rule its own guide states? |
 | **Homeless output** | Does anything in `_bmad-output/` have no row in the ownership table in `corpus-guide.md`, or a row whose named owner is not installed? |
-| **Evidence** | V24 answers the mechanical half — does every cited path still resolve. What is left for a reader: does the file still **contain** what is cited |
+| **Evidence** | `cites-resolve` answers the mechanical half — does every cited path still resolve. What is left for a reader: does the file still **contain** what is cited |
 
 The chain check overlaps the validators on purpose. Validators answer what can be counted; this pass
-answers what has to be read — a `UC` that exists and is wrong passes V2 and fails here.
+answers what has to be read — a `UC` that exists and is wrong passes `fr-has-uc` and fails here.
 
 ### The Constitution check
 
@@ -79,6 +94,14 @@ governs it, and the four failures worth looking for are the ones no ID chain rec
 | A layer written by a skill that does not own it | The ownership table in `corpus-guide.md` |
 | A rule stated in a `.constitution/method/` file | `status: Reference` — it explains, it MUST NOT bind |
 | A `Reference` file contradicting a guide | The guide wins, and the contradiction is a defect to report |
+| `CONTEXT.md` or `CONTEXT-MAP.md` outside `_bmad-output/` | A second home for the vocabulary and for where each context lives. The homes are `.control/product-glossary.md`, `components.yaml`, and the two structure maps |
+| A `docs/` folder holding corpus or rules — `docs/adr/` above all | **Article 3**: this method has no `docs/` layer, and a leftover one is inventory to sort rather than a second home |
+
+**The last two are hunted by artifact, not by author, and that is deliberate.** An engine invoked outside its
+WDI wrapper still writes what it always writes — `wdi-blueprint` points `domain-modeling` at
+`_bmad-output/`, but a skill that calls it directly does not. Policing who invoked what is impossible from
+here; noticing the file that appeared is not. Inside `_bmad-output/` all three are legitimate working output
+and MUST NOT be reported.
 
 You MUST NOT invent a rule to fail an artifact against. Every finding here MUST quote the guide it comes
 from. A file at `status: Draft` MAY be read as guidance but MUST NOT be used to reject anything — that
@@ -90,15 +113,15 @@ anything at all.
 It checks whether **citations still resolve**. It does **not** check whether the code implements the
 corpus, and you MUST NOT widen it into that.
 
-A general corpus-versus-code comparison would be red through the middle of every wave, and a check
+A general corpus-versus-code comparison would be red through the middle of every spec, and a check
 that is always red is a check people learn to skip. What is already covered elsewhere MUST NOT be
 re-reported here:
 
 | Already answered by | Case |
 |---|---|
 | A red RTM row | Promised, not built yet |
-| V2 · V3 | Documented, never scheduled |
-| V4 | A story closed with no named test |
+| `fr-has-uc` · `uc-scheduled` | Documented, never scheduled |
+| `ticket-has-test` | A ticket closed with no named test |
 | `inventory.py` | The plan and the code disagreeing about a table, endpoint, or screen |
 
 That leaves exactly one gap, and it is the one this check fills: **a descriptive claim about code