chore(release): auto-bump version to 0.89.1 — earned by # (patch: converged release (push-to-master bump))

Promotion record: (unknown)

.gitea/ISSUE_TEMPLATE/bug.md

@@ -1,16 +1,46 @@
 ---
 name: Bug Fix
-about: Fix a bug or issue
+about: Demonstrate currently incorrect behaviour — plain English first, proof required
 title: "[BUG] "
 labels: bug
 assignees: conductor
 ---
 
-## Plain summary
-<!-- 2-4 sentences, NON-TECHNICAL: what's broken and why it matters. -->
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
 
-## Example
-<!-- A concrete before/after: "Doing X currently produces Y; it should produce Z." -->
+
+What is broken: <what a person observes going wrong>
+
+What should happen instead: <the correct behaviour>
+
+How often / when: <always | after X | since change Y>
+
+## Proof it is broken (required — no proof, no bug)
+<!-- A bug is DEMONSTRATED currently incorrect behaviour. Nothing else.
+     If this section cannot be filled, file it as a question, not a bug. -->
+- [ ] Reproduction command or steps (deterministic where possible)
+- [ ] The exact wrong output observed: <paste/log excerpt>
+- [ ] Where the evidence lives: <log path, fixture, session id>
+
+## Steps to reproduce
+<!-- How to trigger the bug -->
+
+## What would let us close this
+- [ ] The reproduction command now shows correct behaviour
+- [ ] A regression test exists that fails before the fix and passes after
+- [ ] No other behaviour changed (or changes are listed and justified)
+
+## Version impact (declared at submission — verified at merge)
+<!-- A bug fix is USUALLY a patch. Pick major or minor only with a reason. -->
+- [ ] patch — same behaviour, done correctly (usual for bugs)
+- [ ] major — the bug was in a published contract and fixing it breaks consumers (justify)
+- [ ] minor — fixing revealed a missing capability that had to be added (justify)
 
 ## Technical details
 <!-- WHAT (the bug) / WHERE (files) / EVIDENCE (how it was confirmed). -->
@@ -29,10 +59,6 @@ assignees: conductor
 - [ ] Canary passes (name)
 - [ ] Closed with a properly formatted closing comment + commit references
 
-## Steps to reproduce
-<!-- How to trigger the bug -->
-
-
 ## Cognitive invariants (memory/cognition issues — both handoffs)
 <!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
 - [ ] **Owner** — which existing subsystem owns this (audit before creating modules)

.gitea/ISSUE_TEMPLATE/feature.md

@@ -1,18 +1,44 @@
 ---
 name: Feature Request
-about: New feature or improvement — DESCRIPTION GATE v4 format (plain summary + pipeline requirements)
+about: New feature or improvement — plain English first, verifiable close conditions, version intent
 title: "[FEATURE] "
 labels: feature
 assignees: conductor
 ---
 
-## Plain summary
-<!-- 2-4 sentences, NON-TECHNICAL: what this does and why it matters. Nick should
-understand the goal without decoding internals. -->
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. A non-technical reader must be able to retell this
+     section. 3-6 sentences, no jargon. -->
+<!-- SUBMITTED_BODY -->
+
+
+What is this about: <what>
+
+Why do we need it: <the itch — what happens today that shouldn't, or what becomes possible>
+
+Why is it still open: <"not started yet" | "part done, X remains" | "deliberately parked as a future idea">
 
 ## Example
-<!-- A concrete example of the intended behavior, in plain terms:
-"If X happens, the system will Y instead of Z." -->
+<!-- A concrete before/after in plain terms: "If X happens, the system will Y instead of Z." -->
+
+## What would let us close this
+<!-- Checkable statements, verifiable by looking at something that EXISTS —
+     a file, a log line, a passing test. Not "when appropriate". -->
+- [ ] <condition 1 — observable>
+- [ ] <condition 2>
+
+## Version impact (declared at submission — verified at merge)
+<!-- The pipeline derives the real bump from merged conventional commits and
+     compares against this declaration. A mismatch is flagged, not fatal:
+     either the declaration was wrong or the work grew. Both facts matter. -->
+- [ ] major — breaking: changes a contract, schema, or interface others depend on
+- [ ] minor — new capability: something becomes possible that wasn't
+- [ ] patch — repair: same behaviour, done correctly
+- [ ] none — touches no released artifact (docs, memory, process notes)
 
 ## Technical details
 <!-- WHAT — one-line objective.
@@ -37,7 +63,6 @@ DEPENDENCIES — parent epic + preceding stage/plan refs. -->
 - [ ] Canary passes (name)
 - [ ] Closed with a properly formatted closing comment + commit/PR references
 
-
 ## Cognitive invariants (memory/cognition issues — both handoffs)
 <!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
 - [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
@@ -69,4 +94,4 @@ Hard invariants: derived cognition preserves evidentiary ancestry · epistemic c
 - [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
 - [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
 - [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
-- [ ] **P3 — low** — measurement / benchmark / deferred policy
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

.gitea/ISSUE_TEMPLATE/research.md

@@ -0,0 +1,76 @@
+---
+name: Research Submission
+about: Buy down uncertainty before building — question, falsifier, budget, durable findings
+title: "[RESEARCH] "
+labels: research
+assignees: conductor
+---
+
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
+
+
+The question: <what we're trying to learn, one sentence>
+
+Why we're asking: <what decision this research will inform — a name, an issue
+number, or "exploratory: none yet">
+
+What we believe today: <the current assumption, stated so it can be proven wrong>
+
+## The shape of an answer
+- [ ] What evidence would settle the question: <observation, benchmark, or spike>
+- [ ] What evidence would KILL the current assumption (the falsifier): <be specific —
+      this is stated BEFORE starting so the research cannot become a search for confirmation>
+- [ ] Budget: <time/effort cap — when research must stop and report back>
+
+## What would let us close this
+- [ ] Findings written to a durable document: <path, e.g. research/issue-NNN/> —
+      a comment thread is not a durable finding
+- [ ] The decision the research informs is recorded: made / deferred / changed
+- [ ] If a follow-up build issue was minted: <#N or "none needed">
+
+## Version impact (declared at submission — verified at merge)
+- [ ] none — research changes no released artifact (usual)
+- [ ] minor/major — only if a code spike is being merged as part of this (justify)
+
+## Technical detail
+<!-- Candidate approaches, prior art in the repo, related issues, constraints,
+     rebuildable-projection or authority requirements if findings touch canonical state. -->
+
+## Pipeline requirements
+- [ ] Findings committed under the stated durable path
+- [ ] Every citation verified against a real source (no fabricated references)
+- [ ] Closed with a properly formatted closing comment: findings summary + decision
+
+## Cognitive invariants (memory/cognition research — both handoffs)
+<!-- Complete ONLY if findings touch memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before proposing modules)
+- [ ] **Read/write authority** — which canonical state is affected
+- [ ] **Provenance** — findings traceable to evidence
+- [ ] **Reversibility** — projections remain rebuildable; no unique truth moves into a derived index
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · retrieval never increases utility · raw evidence is never destroyed by promotion.
+
+## Related umbrella
+- [ ] Memory
+- [ ] Governance
+- [ ] Identity
+- [ ] Growth
+- [ ] Perception
+- [ ] Infrastructure
+- [ ] Life (Nick's)
+- [ ] Custodian
+- [ ] Orchestration
+
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — blocks a decision that blocks other work
+- [ ] **P1 — high** — informs a next-stage dependency
+- [ ] **P2 — medium** — quality/consolidation understanding
+- [ ] **P3 — low** — watchlist / deferred / exploratory

.gitea/workflows/auto-backup.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   backup:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

.gitea/workflows/auto-label.yml

@@ -11,8 +11,8 @@ jobs:
   # P0/P1/P2/P3. An issue that lands without one gets 'unprioritized' +
   # a demand comment — filing is not complete until prioritized.
   priority-gate:
-    if: github.event_name == 'issues' && github.event.action != 'labeled'
-    runs-on: rune-infra-pi
+    if: github.event_name == 'issues' && github.event.action != 'labeled' && github.event.issue.state == 'open'
+    runs-on: rune-ci-desktop
     steps:
       - name: Enforce priority label
         uses: actions/github-script@v7
@@ -44,12 +44,26 @@ jobs:
             });
 
   auto-label:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - name: Analyze and label
         uses: actions/github-script@v7
         with:
           script: |
+            // CLOSED-ISSUE GUARD (#407): labels are filing-time metadata.
+            // A closed issue's lifecycle has ended; re-running label
+            // inference on it re-adds stale type labels (bug = currently
+            // incorrect behavior — a closed fixed issue must not carry
+            // it) and makes any human label cleanup self-defeating,
+            // because every PUT fires a 'labeled' event that re-triggers
+            // this job. Post-close label curation belongs to humans and
+            // the conductor, not this workflow.
+            const issueState = context.payload.issue?.state;
+            if (issueState === 'closed') {
+              console.log(`Issue #${context.payload.issue?.number} is closed — auto-label skips (labels are curated post-close).`);
+              return;
+            }
+            const action = context.payload.action;
             const title = context.payload.issue?.title || context.payload.pull_request?.title || '';
             const body = context.payload.issue?.body || context.payload.pull_request?.body || '';
             const text = (title + ' ' + body).toLowerCase();
@@ -58,9 +72,43 @@ jobs:
             const managedLabels = new Set([
               'memory', 'governance', 'identity', 'growth',
               'perception', 'infrastructure', 'life', 'custodian',
-              'priority: high', 'bug', 'feature',
+              'priority: high', 'bug', 'feature', 'research',
             ]);
 
+            // Type label: DECLARED over GUESSED. The template spine
+            // (kind: bug|feature|research|epic|...) is authoritative.
+            // A recognized kind maps to its label; ANY other declared kind
+            // (e.g. epic) means NO type label and NO keyword guessing —
+            // epics are containers, not bugs. Keyword heuristics apply
+            // only to pre-template issues with no spine at all.
+            let isBug = false, isFeature = false, isResearch = false;
+            const kindMatch = body && body.match(/^kind:\s*([a-z_-]+)\s*$/m);
+            if (kindMatch) {
+              const kind = kindMatch[1];
+              isBug = kind === 'bug';
+              isFeature = kind === 'feature';
+              isResearch = kind === 'research';
+            } else if (action === 'opened') {
+              // KEYWORD FALLBACK (#407): pre-template issues only, and
+              // ONLY at filing time. Re-running keyword guesses on every
+              // edit/label event overrides human curation of spine-less
+              // issues (documented rule: keyword heuristics are the
+              // pre-template fallback, not a standing authority).
+              const textBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
+              isBug = textBug;
+              isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
+              isResearch = !isBug && !isFeature && title.startsWith('[RESEARCH]');
+            }
+            if (isBug) {
+              desiredLabels.add('bug');
+            }
+            if (isFeature) {
+              desiredLabels.add('feature');
+            }
+            if (isResearch) {
+              desiredLabels.add('research');
+            }
+
             // Umbrella labels
             if (text.includes('memory') || text.includes('store') || text.includes('recall') || text.includes('consolidat')) {
               desiredLabels.add('memory');
@@ -92,16 +140,6 @@ jobs:
               desiredLabels.add('priority: high');
             }
 
-            // Type labels
-            const isBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
-            const isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
-            if (isBug) {
-              desiredLabels.add('bug');
-            }
-            if (isFeature) {
-              desiredLabels.add('feature');
-            }
-
             const issueNumber = context.payload.issue?.number || context.payload.pull_request?.number;
             const current = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,

.gitea/workflows/auto-update-gitea.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-gitea:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - name: Check current Gitea version
         id: current

.gitea/workflows/auto-version.yml

@@ -11,7 +11,7 @@ permissions: write-all
 
 jobs:
   release:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
         with:
@@ -131,8 +131,12 @@ jobs:
               "pyproject.toml": [(f'version = "{VERSION}"', f'version = "{NEW}"')],
           }
 
-          # Fetch current master content, apply replacements, VERIFY all five
-          # surfaces agree on NEW before committing anything (TUI gate).
+          # Fetch current master content, apply replacements, VERIFY all six
+          # surface patterns (five files + the TUI footer) agree on NEW before
+          # committing anything (TUI gate). The footer check was added after
+          # the 0.89.0 half-bump: a stale RELEASE_VERSION made both replace
+          # pairs no-op; the gate's RECOVER regex fixed the header only and
+          # the footer silently stayed 0.88.4, failing the banner test.
           edited = {}
           for path, pairs in surfaces.items():
               status, cur = api(f"/contents/{path}?ref=master")
@@ -151,6 +155,7 @@ jobs:
           checks = [
               ("src/rune/__init__.py", rf'__version__ = "({VER})"'),
               ("src/rune/rune_tui.py", rf"Version: v({VER})"),
+              ("src/rune/rune_tui.py", rf"Rune v({VER}) \|"),
               ("src/rune/canary_gitea_automation.py", rf"'__version__ = \"({VER})\"'"),
               ("pyproject.toml", rf'version = "({VER})"'),
               ("README.md", rf"v({VER})"),
@@ -213,38 +218,17 @@ jobs:
               env.write(f"RELEASE_VERSION={NEW}\n")
               env.write("AUTO_BUMPED=true\n")
           PYBUMP
-      - name: Create release from merged pull request
+      - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
         env:
           GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          PR_TITLE: ${{ gitea.event.pull_request.title }}
-          PR_BODY: ${{ gitea.event.pull_request.body }}
-          RELEASE_API_URL: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases
-          LIST_API_URL: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases?limit=50
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
         run: |
-          # Skip idempotently if a release for this tag already exists (retry/replay safety).
-          if curl --fail --silent "$LIST_API_URL" \
-            -H "Authorization: token $GITEA_TOKEN" \
-            | python3 -c 'import json,sys,os; v=os.environ["RELEASE_VERSION"]; exists=[r for r in json.load(sys.stdin) if r.get("tag_name")=="v"+v]; sys.exit(0 if exists else 1)'; then
-            echo "Release v$RELEASE_VERSION already exists — skipping creation"
-            exit 0
-          fi
-          python3 - <<'PY' > /tmp/rune-release.json
-          import json, os
-          version = os.environ["RELEASE_VERSION"]
-          body = f"## {os.environ['PR_TITLE']}\n\n{os.environ.get('PR_BODY', '')}"
-          print(json.dumps({
-              "tag_name": f"v{version}",
-              "target_commitish": "master",
-              "name": f"Rune v{version}",
-              "body": body,
-              "draft": False,
-              "prerelease": False,
-          }))
-          PY
-          curl --fail-with-body --silent --show-error \
-            -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            --data-binary @/tmp/rune-release.json \
-            "$RELEASE_API_URL"
-          rm -f /tmp/rune-release.json
+          # ONE note-generation authority: the tested release_notes module.
+          # The old PR-title/body paste path (which produced empty '##'
+          # bodies on direct-push releases) is REMOVED — governed evidence
+          # from the scaffold store is the source, not PR prose.
+          python3 scripts/release_history_cli.py init \
+            --version "$RELEASE_VERSION" \
+            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
+            --store store/scaffold/current.json

.gitea/workflows/ci.yml

@@ -286,12 +286,61 @@ jobs:
         run: |
           NEW="$(echo "${{ gitea.event.pull_request.head.ref }}" | sed 's|chore/auto-bump-||')"
           python3 scripts/check_version_surfaces.py check --root . --version "$NEW"
-      - name: Publish protected-branch gate (full pipeline path)
-        if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+      - name: Publish protected-branch gate (full pipeline path — all needs green)
+        # RELEASE-SAFETY FIX (2026-09-13): the previous version of this step
+        # read /tmp/need_* files that no step ever writes and echoed success
+        # UNCONDITIONALLY — required-checks published green while type-check
+        # and unit-tests were red, and deploy promoted the red commits
+        # (observed live: 24413e4, fd6e9b4, de30cd9 promoted 0.66.28/29 with
+        # failing type-check). The verdict now comes from the needs context
+        # itself: this step runs ONLY when every required job succeeded.
+        if: >-
+          ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump')
+              && needs.lint.result == 'success'
+              && needs['unit-tests'].result == 'success'
+              && needs.canary.result == 'success'
+              && needs['best-practices'].result == 'success'
+              && needs.documentation.result == 'success'
+              && needs['type-check'].result == 'success'
+              && needs['gitea-offline'].result == 'success' }}
+        run: echo "All required CI checks passed"
+      - name: Refuse promotion when any required check failed (fail-closed)
+        # Companion to the step above: if anything is not exactly success
+        # (failure, cancelled, skipped on a non-bump path), the required-checks
+        # context reports FAILURE — deploy_qualify then refuses promotion.
+        # Fail-closed: not verified → not deployable.
+        if: >-
+          ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump')
+              && (needs.lint.result != 'success'
+                  || needs['unit-tests'].result != 'success'
+                  || needs.canary.result != 'success'
+                  || needs['best-practices'].result != 'success'
+                  || needs.documentation.result != 'success'
+                  || needs['type-check'].result != 'success'
+                  || needs['gitea-offline'].result != 'success') }}
         run: |
-          # All needs must have succeeded (skipped deps = this is a bump PR, handled above)
-          FAILED=""
-          for job in lint unit-tests canary best-practices documentation type-check gitea-offline; do
-            RESULT=$(cat /tmp/need_$job 2>/dev/null || echo "")
-          done
-          echo "All required CI checks passed"
+          echo "::error::Required CI checks not green — refusing to publish required-checks success"
+          echo "lint=${{ needs.lint.result }} unit-tests=${{ needs['unit-tests'].result }} canary=${{ needs.canary.result }} best-practices=${{ needs['best-practices'].result }} documentation=${{ needs.documentation.result }} type-check=${{ needs['type-check'].result }} gitea-offline=${{ needs['gitea-offline'].result }}"
+          exit 1
+
+  notify-event-bridge:
+    # T16 §16C: post the CI completion WAKE to the local event bridge so
+    # event-driven waiters (deploy.yml → ci_event_wait.py) resume on the
+    # event instead of sleep-polling. ALWAYS runs (success or failure —
+    # a red CI must wake the waiter just as loudly as a green one). The
+    # wake is best-effort and never decides the verdict: the waiter
+    # re-reads the canonical Gitea state via deploy_qualify.py.
+    name: CI Pipeline / notify-event-bridge
+    runs-on: rune-ci-desktop
+    needs: [required-checks]
+    if: always()
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 1
+      - name: Wake event bridge (wake only — never completion truth)
+        env:
+          CI_SHA: ${{ gitea.sha }}
+          CI_RESULT: ${{ needs.required-checks.result }}
+          RUNE_EVENT_BRIDGE_URL: ${{ vars.RUNE_EVENT_BRIDGE_URL || 'http://127.0.0.1:8791' }}
+        run: python3 scripts/notify_event_bridge.py

.gitea/workflows/deploy.yml

@@ -19,38 +19,74 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Wait for CI qualification on this exact SHA
+      - name: Wait for CI qualification on this exact SHA (event-driven, T16 §16C)
+        # T16 §16C/§16D: the old sleep-30 → query → repeat loop is gone.
+        # The waiter registers a correlation on the W/R event bridge and
+        # yields in select() until ci.yml's notify-event-bridge job posts
+        # the completion WAKE; the verdict is then re-read from canonical
+        # Gitea (deploy_qualify.py). The 900s deadline is a FAILURE
+        # DETECTOR (lost-event recovery), never the scheduler.
         env:
           GITEA_SERVER: ${{ gitea.server_url }}
           GITEA_REPO: ${{ gitea.repository }}
           GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          # Shared bridge data root: the deploy step runs as the runner
+          # user while the daemon runs as nick — the rendezvous state
+          # (waits/events/resumes/leases) must be shared. §16C live
+          # finding: defaulting to the invoking user's home made the
+          # controller unable to create its FIFO (PermissionError) and
+          # the deploy failed fast+truthfully on both 0.66.63 pushes.
+          RUNE_WR_ROOT: /mnt/workdrive/wr-bridge
+          RUNE_WR_CODE: /home/nick/.local/share/mimo-wait-resume
         run: |
           DEPLOY_SHA=$(git rev-parse HEAD)
           export DEPLOY_SHA
-          echo "Qualifying $DEPLOY_SHA"
-          DEADLINE=$((SECONDS + 900))
-          while [ $SECONDS -lt $DEADLINE ]; do
-            STATUS=$(python3 scripts/deploy_qualify.py)
-            echo "required-checks: $STATUS"
-            if [ "$STATUS" = "success" ]; then exit 0; fi
-            if [ "$STATUS" = "failure" ]; then
-              echo "::error::CI failed on $DEPLOY_SHA — deployment refused"
-              exit 1
-            fi
-            sleep 30
-          done
-          echo "::error::CI qualification timeout on $DEPLOY_SHA — deployment refused"
-          exit 1
+          echo "Qualifying $DEPLOY_SHA (event-driven)"
+          # READINESS BEFORE ACTION (§16U): fail with a clear message if
+          # the bridge rendezvous is not writable in THIS user's context,
+          # instead of a stack trace at FIFO creation time.
+          if ! touch /mnt/workdrive/wr-bridge/resumes/.write-probe 2>/dev/null; then
+            echo "::error::RUNE_WR_ROOT not writable by $(id -un) — bridge data root misconfigured"
+            exit 1
+          fi
+          rm -f /mnt/workdrive/wr-bridge/resumes/.write-probe
+          python3 scripts/ci_event_wait.py --sha "$DEPLOY_SHA" --deadline 900
 
-      - name: Stage, verify, promote
+      - name: Stage, verify, promote (monotonic)
         env:
           GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          GITEA_SERVER: ${{ gitea.server_url }}
+          GITEA_REPO: ${{ gitea.repository }}
         run: |
           python3 scripts/deploy_stage.py
 
-      - name: Post-deploy runtime verification (the consuming path)
+      - name: Promotion truthfulness check
+        id: promotion_truth
         run: |
           SHA=$(git rev-parse HEAD)
+          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
+          if [ "$CURRENT_TARGET" = "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
+            echo "PROMOTED: current == candidate ($SHA)"
+            echo "promoted=true" >> "$GITEA_OUTPUT"
+          else
+            # Not promoted. deploy_stage exit 0 + non-matching current =
+            # NOOP_ALREADY_CURRENT or STALE_SUPERSEDED — truthful non-error
+            # terminal states (a newer build already won). Do NOT claim
+            # promotion; the runtime-verification step below only runs for
+            # real promotions.
+            echo "NOT PROMOTED: current -> $CURRENT_TARGET (superseded/noop — current is authoritative)"
+            echo "promoted=false" >> "$GITEA_OUTPUT"
+          fi
+
+      - name: Post-deploy runtime verification (only for real promotions)
+        if: ${{ success() }}
+        run: |
+          SHA=$(git rev-parse HEAD)
+          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
+          if [ "$CURRENT_TARGET" != "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
+            echo "SKIP runtime verification: this job did not promote (superseded/noop)"
+            exit 0
+          fi
           # Exactly what the launcher execs: cd <current>/src, import rune.
           RUNE_HOME=/mnt/workdrive/rune RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory \
             /home/nick/.venvs/memory/bin/python3 -c "
@@ -62,3 +98,28 @@ jobs:
             assert rune.__version__ == info['version']
             print('RUNTIME VERIFIED:', info)
             "
+      - name: Release-history convergence fallback (SCAFFOLD-TRANCHE-0012C)
+        # The PRIMARY convergence mechanism is deploy_stage.py's out-of-lock
+        # publisher (publishes from CURRENT deployment authority, §14B/§14C).
+        # This step is a non-blocking FALLBACK: if the primary publish failed
+        # (e.g. missing Gitea config), this retries. NEVER fails the job —
+        # documentation failure never outweighs deployment validity.
+        if: ${{ success() && steps.promotion_truth.outputs.promoted == 'true' }}
+        continue-on-error: true
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
+        run: |
+          VERSION=$(python3 -c "import sys; sys.path.insert(0,'src'); import rune; print(rune.__version__)" 2>/dev/null || echo "")
+          if [ -z "$VERSION" ]; then
+            echo "SKIP: cannot determine version"
+            exit 0
+          fi
+          python3 scripts/release_history_cli.py refresh \
+            --version "$VERSION" \
+            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
+            --store "$GITHUB_WORKSPACE/store/scaffold/current.json" \
+            --release-sha "$(git rev-parse HEAD)" \
+            --deployed-sha "$(git rev-parse HEAD)" \
+          || echo "::warning::release-history fallback refresh FAILED — in-lock hook may have already converged; retry converges"

.gitea/workflows/maintenance.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   lint-and-format:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Lint Python files
@@ -18,13 +18,16 @@ jobs:
           ruff format shared/ src/ || true
 
   canary-suite:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Run all canaries
+        # T16 §16Q reconciliation: the glob looped shared/canary_*.py —
+        # real canaries live in src/rune/ (canary_native.MODULES is the
+        # registry authority). The old job silently no-opped.
         run: |
           FAILED=0
-          for canary in shared/canary_*.py; do
+          for canary in src/rune/canary_*.py; do
             if [ -f "$canary" ]; then
               echo "Running $canary..."
               python3 "$canary" || FAILED=$((FAILED + 1))
@@ -34,7 +37,7 @@ jobs:
           exit $FAILED
 
   best-practices:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check best practices
@@ -69,7 +72,7 @@ jobs:
           grep -rn "TODO\|FIXME\|HACK\|XXX" shared/ src/ --include="*.py" | head -10 || echo "  Clean"
 
   documentation-check:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check documentation coverage
@@ -110,7 +113,7 @@ jobs:
   # push-triggered safety net in auto-version.yml. Detects master/tag drift
   # and files a deduped issue — it never auto-releases without the PR flow.
   release-drift-reconciliation:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
         with:

AGENTS.md

@@ -58,3 +58,26 @@ fix, full pipeline re-entry (suite + ratchet + ruff + canaries + henxels;
 gates for anything beyond a mechanical minor), regression tests frozen forever,
 discharge recorded finding → test → commit. Symptom patches are rejected at
 review. To escape: edit `henxels.yaml` or this file — visibly.
+
+## Issue organisation standard (binding, 2026-09-19)
+
+One open note per idea. Issues use the template spine (kind, subsystem,
+version intent) with a plain-English heading that restates the subject —
+no meta-labels. Before minting a standalone issue, check whether the work
+belongs inside an existing parent:
+
+- **Parked ideas under a blocked/future epic** are filed as checklist items
+  in the parent's "Absorbed children" section, NOT as standalone issues.
+  Absorption is reversible — re-mint standalone when the idea becomes live.
+- **Live, dependency-tracked, or starting work** gets a standalone issue.
+- **Closures state the reason as data**: `closed_because` in the spine
+  (completed / superseded-by-#N / absorbed-into-#N / wont-do / duplicate),
+  plus a standard closing comment (plain summary first).
+- The reconciliation checker (`scripts/gitea_reconciliation_check.py`) must
+  stay green after any issue state change; the artifact is updated in the
+  same change that moves issues.
+
+## Async continuation final flow proofs (R13/M9) — 2026-09-19
+
+PR-flow live proof marker: harmless documentation addition exercising the
+canonical single-continuation path on the PC-local forge. No code change.

README.md

@@ -1,6 +1,6 @@
 # Rune
 
-**Current release: v0.66.14**
+**Current release: v0.89.1**
 
 **Rune is a persistent personal agent designed to accumulate experience, develop reusable competence, and remain recognisably the same agent even when its underlying foundation model changes.**
 

bridge/daemon/completion_file.py

@@ -0,0 +1,196 @@
+"""completion_file.py — REAL_ASYNC_BRIDGE: durable completion-file delivery
+with inotify wake. Replaces FIFO+lease for process-wait delivery.
+
+DESIGN:
+  Producer (bridge/daemon/notify):
+    1. Validates operation identity
+    2. Atomically writes a completion file:
+         resumes/<operation_id>.done
+       containing the event/verdict JSON (write to tmp, rename for atomicity)
+
+  Waiter (ci_event_wait / any continuation consumer):
+    1. Checks if the completion file already exists (event-before-waiter)
+    2. If not: registers inotify watch on the resumes/ directory
+    3. Re-checks after watch registration (closes the registration race)
+    4. Blocks in kernel on inotify — zero CPU, zero timer
+    5. On file-created event: reads the file, verifies authority, returns
+
+  The event is a WAKE SIGNAL. Authority still decides terminal truth.
+  The completion file is durable — survives daemon and waiter restarts.
+
+WHY NOT FIFO:
+  FIFO is one-shot (token consumed), requires lease management, and
+  fails under session-busy guards. A completion file is atomic, durable,
+  and works across restarts. inotify wakes the process with zero CPU
+  cost and zero latency between file creation and wake.
+
+WHY NOT POLLING:
+  Polling introduces an arbitrary interval. inotify is a kernel callback
+  that fires exactly when the filesystem changes — the latency tracks
+  the real completion event, not a configured interval.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import select
+import struct
+import time
+from pathlib import Path
+
+
+def _wr_bridge() -> Path:
+    # WR_ROOT = daemon/infra convention; RUNE_WR_ROOT = repo/scripts
+    # convention. Both honored (WR_ROOT wins) so the daemon, the waiter,
+    # and any isolated test root always resolve the SAME directory.
+    root = os.environ.get("WR_ROOT") or os.environ.get("RUNE_WR_ROOT") or "/mnt/workdrive/wr-bridge"
+    return Path(root)
+
+
+def _resumes_dir() -> Path:
+    return _wr_bridge() / "resumes"
+
+
+# inotify constants (Linux)
+IN_CREATE = 0x100
+IN_CLOSE_WRITE = 0x8
+IN_MOVED_TO = 0x80
+
+
+def completion_path(operation_id: str) -> Path:
+    return _resumes_dir() / f"{operation_id}.done"
+
+
+def write_completion(operation_id: str, event: dict) -> Path:
+    """Atomically write a durable completion file. The rename(2) ensures
+    the waiter never sees a partial file."""
+    _resumes_dir().mkdir(parents=True, exist_ok=True)
+    target = completion_path(operation_id)
+    tmp = target.parent / f".{target.name}.tmp.{os.getpid()}"
+    tmp.write_text(json.dumps(event, sort_keys=True) + "\n")
+    os.rename(str(tmp), str(target))  # atomic on same filesystem
+    os.chmod(str(target), 0o666)  # cross-user bridge
+    return target
+
+
+def read_completion(operation_id: str) -> dict | None:
+    """Read a durable completion file. Returns None if absent."""
+    p = completion_path(operation_id)
+    if not p.is_file():
+        return None
+    try:
+        return json.loads(p.read_text())
+    except (OSError, ValueError):
+        return None
+
+
+def completion_exists(operation_id: str) -> bool:
+    return completion_path(operation_id).is_file()
+
+
+def _inotify_init_and_add_watch(directory: str) -> int:
+    """Create an inotify instance and add a watch on the directory.
+    Returns the inotify fd."""
+    libc = __import__("ctypes").CDLL(None, use_errno=True)
+    fd = libc.inotify_init()
+    if fd < 0:
+        raise OSError("inotify_init failed")
+    # IN_CREATE | IN_MOVED_TO: catch both direct creation and atomic rename
+    mask = IN_CREATE | IN_MOVED_TO
+    wd = libc.inotify_add_watch(fd, directory.encode(), mask)
+    if wd < 0:
+        os.close(fd)
+        raise OSError(f"inotify_add_watch failed for {directory}")
+    return fd
+
+
+def _inotify_read(fd: int, timeout_secs: float | None = None) -> list[str]:
+    """Read pending inotify events. Returns list of filenames that were
+    created/moved-to. Blocks until at least one event or timeout."""
+    poll = select.poll()
+    poll.register(fd, select.POLLIN)
+    events = []
+    buf = os.read(fd, 4096)
+    pos = 0
+    while pos < len(buf):
+        # struct: wd(i32), mask(u32), cookie(u32), name_len(u32)
+        wd, mask, cookie, name_len = struct.unpack_from("iIII", buf, pos)
+        pos += 16
+        name = buf[pos : pos + name_len].rstrip(b"\x00").decode("utf-8", "replace")
+        pos += name_len
+        if mask & (IN_CREATE | IN_MOVED_TO):
+            events.append(name)
+    return events
+
+
+def wait_for_completion(operation_id: str, *, timeout_secs: float | None = None, poll_callback=None) -> dict | None:
+    """Block until a completion file exists for this operation.
+
+    Uses inotify for zero-latency, zero-CPU wake. Falls back to
+    polling_callback (if provided) when inotify is unavailable.
+
+    The completion file is a WAKE SIGNAL. The caller must still verify
+    canonical authority after reading it.
+
+    Returns the event dict from the completion file, or None on timeout.
+    """
+    target = completion_path(operation_id)
+
+    # 1. check-before-watch (event may have arrived before we started)
+    existing = read_completion(operation_id)
+    if existing is not None:
+        return existing
+
+    _resumes_dir().mkdir(parents=True, exist_ok=True)
+
+    try:
+        fd = _inotify_init_and_add_watch(str(_resumes_dir()))
+    except OSError:
+        # inotify unavailable: fall back to polling callback
+        if poll_callback:
+            return poll_callback(operation_id, timeout_secs)
+        return None
+
+    try:
+        # 2. re-check after watch registration (closes the race between
+        #    the initial check and the watch being active)
+        existing = read_completion(operation_id)
+        if existing is not None:
+            return existing
+
+        # 3. block in kernel on inotify — zero CPU, exact latency
+        import select as _select
+
+        poll = _select.poll()
+        poll.register(fd, _select.POLLIN)
+        deadline = (time.monotonic() + timeout_secs) if timeout_secs else None
+
+        while True:
+            remaining = None
+            if deadline is not None:
+                remaining = max(0.1, deadline - time.monotonic())
+                if remaining <= 0.1:
+                    return None  # timeout
+            events = poll.poll(remaining * 1000 if remaining else None)
+            if not events:
+                continue  # poll timeout, re-check
+            names = _inotify_read(fd)
+            if target.name in names:
+                # 4. file appeared — read it
+                existing = read_completion(operation_id)
+                if existing is not None:
+                    return existing
+                # partial/corrupt: keep watching
+    finally:
+        os.close(fd)
+    return None
+
+
+def clear_completion(operation_id: str) -> None:
+    """Remove a consumed completion file (idempotent cleanup)."""
+    p = completion_path(operation_id)
+    try:
+        p.unlink()
+    except OSError:
+        pass

bridge/daemon/daemon.py

@@ -0,0 +1,799 @@
+#!/usr/bin/env python3
+"""daemon.py — Gitea webhook receiver + reconciliation + resume driver (v0.2).
+
+W/R-v0.2 invariants implemented here:
+  A. SINGLE-FLIGHT PER SESSION — per-session lease (waitstore.acquire_lease,
+     /proc-validated, atomic) + in-process inflight set. A second READY wait
+     for the same session stays queued until the lease releases.
+  B. BUSY SESSION PROTECTION — before spawning, /proc is scanned for a live
+     `mimo run -s <sid>`-shaped process not owned by our lease. Found → skip
+     launch (wait stays READY). No invented MiMo APIs; the lease is the
+     conservative floor against W/R-created concurrency.
+  C. ATOMIC SESSION LEASE — persisted {session_id, wait_id, pid, pgid,
+     pid_starttime, acquired_at, state}; O_EXCL create, steal only on /proc
+     evidence of a dead owner.
+  D. PROCESS TREE OWNERSHIP — workers spawn with start_new_session=True (own
+     process group). Watch timeout ⇒ SIGTERM group → bounded grace → SIGKILL
+     group → verify zero surviving group members → release lease → truthful
+     READY_TO_RETRY (never terminal-on-timeout).
+  E. TIMEOUT IS NOT SUCCESS — rc==0 maps to verdict terminal
+     (COMPLETED/FAILED); rc!=0 or unverifiable ⇒ RESUME_UNVERIFIED
+     (not schedulable, operator-requeueable); timeout ⇒ READY_TO_RETRY.
+  F. STALE RESUMING RECOVERY — on startup, every RESUMING record is
+     inspected: live lease owner ⇒ adopted and monitored; otherwise ⇒
+     RESUME_UNVERIFIED (+ stale lease released). Never auto-relaunched.
+  G. MULTIPLE WAITS, SAME SESSION — schedulable() orders oldest-first; one
+     continuation finishes before the next starts.
+  H. PIDFILE CORRECTNESS — singleton enforced by flock on daemon.pid; the
+     lock dies with the process, so stale pidfiles (incl. SIGKILL) cannot
+     admit a second daemon.
+
+The resume command is configurable (WR_RESUME_CMD, JSON list with
+{session_id}/{msg} placeholders) so the test harness can use a stub; the
+default is the real mechanism: `mimo run -s <sid> -m <model> <msg>`.
+"""
+
+from __future__ import annotations
+import fcntl, json, os, signal, subprocess, sys, threading, time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+import waitstore
+import verify
+import completion_file  # REAL_ASYNC_BRIDGE R3: durable completion-file delivery
+
+RESUME_MODEL = "Verboo Code/glm-5.3-flash"
+RECONCILE_SECS = int(os.environ.get("WR_RECONCILE_SECS", "60"))
+RECONCILE_EVERY_TICKS = max(1, int(os.environ.get("WR_RECONCILE_TICKS", "3")))
+WAKE_MIN_AGE_SECS = float(os.environ.get("WR_WAKE_MIN_AGE_SECS", "5"))
+WAKE_RETRIES = int(os.environ.get("WR_WAKE_RETRIES", "3"))
+WAKE_RETRY_SECS = float(os.environ.get("WR_WAKE_RETRY_SECS", "4"))
+DRIVE_LOOP_SECS = int(os.environ.get("WR_DRIVE_SECS", "20"))
+# REAL_ASYNC_BRIDGE §4: a RESUMING wait older than this grace without
+# progress is an orphaned resume flow (thread died between lease acquire
+# and release). Must exceed the longest legitimate in-flight watch
+# (WATCH_SECS); default 3x. Env-overridable for deterministic tests.
+WATCH_SECS = int(os.environ.get("WR_WATCH_SECS", "600"))
+# REAL_ASYNC_BRIDGE §4: a RESUMING wait older than this grace without
+# progress is an orphaned resume flow (thread died between lease acquire
+# and release). Must exceed the longest legitimate in-flight watch
+# (WATCH_SECS); default 3x. Env-overridable for deterministic tests.
+ORPHAN_GRACE_SECS = int(os.environ.get("WR_ORPHAN_GRACE_SECS", str(3 * WATCH_SECS)))
+TERM_GRACE_SECS = int(os.environ.get("WR_TERM_GRACE_SECS", "10"))
+MAX_ATTEMPTS = int(os.environ.get("WR_MAX_ATTEMPTS", "3"))
+_WR_ROOT = Path(os.environ.get("WR_ROOT", "") or Path(__file__).resolve().parent)
+PIDFILE = _WR_ROOT / "daemon.pid"
+LOG = _WR_ROOT / "daemon.log"
+
+DEFAULT_RESUME_CMD = ["mimo", "run", "-s", "{session_id}", "-m", RESUME_MODEL, "{msg}"]
+
+
+def log(msg: str) -> None:
+    with open(LOG, "a") as f:
+        f.write(f"{time.strftime('%H:%M:%S')} {msg}\n")
+
+
+def resume_cmd(session_id: str, msg: str, wait_id: str = "", override: list | None = None) -> list[str]:
+    """T15 §15D: per-wait override wins; placeholders {session_id}/{msg}/
+    {wait_id}. A synthetic controller session (Scaffolding stage driver)
+    is not a MiMo session — the global default cannot resume it, which is
+    exactly why fixed-sleep polling crept back into T12-T14."""
+    if override:
+        return [
+            c.replace("{session_id}", session_id).replace("{msg}", msg).replace("{wait_id}", wait_id) for c in override
+        ]
+    tmpl = os.environ.get("WR_RESUME_CMD")
+    cmd = json.loads(tmpl) if tmpl else DEFAULT_RESUME_CMD
+    return [c.replace("{session_id}", session_id).replace("{msg}", msg).replace("{wait_id}", wait_id) for c in cmd]
+
+
+# ── process-tree evidence & ownership ─────────────────────────────────────
+
+
+def pgid_members(pgid: int) -> list[int]:
+    out = []
+    for d in Path("/proc").iterdir():
+        if not d.name.isdigit():
+            continue
+        try:
+            stat = (d / "stat").read_text()
+            fields = stat.rsplit(")", 1)[1].split()
+            # zombies: killed but not yet reaped. Counting them makes the
+            # survivor check report the direct child we just KILLed before
+            # communicate() reaps it (observed live 2026-09-12).
+            if fields[0] == "Z":
+                continue
+            if int(fields[2]) == pgid:
+                out.append(int(d.name))
+        except (OSError, IndexError, ValueError):
+            continue
+    return out
+
+
+def terminate_tree(pgid: int) -> list[int]:
+    """TERM → bounded grace → KILL. Returns surviving members (must be [])."""
+    try:
+        os.killpg(pgid, signal.SIGTERM)
+    except ProcessLookupError:
+        pass
+    deadline = time.time() + TERM_GRACE_SECS
+    while time.time() < deadline:
+        if not pgid_members(pgid):
+            return []
+        time.sleep(0.2)
+    try:
+        os.killpg(pgid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    for _ in range(50):  # up to 10s for KILL to land
+        if not pgid_members(pgid):
+            return []
+        time.sleep(0.2)
+    return pgid_members(pgid)
+
+
+def stray_worker_pids(session_id: str, exclude_pgids: set[int] = ()) -> list[int]:
+    """Live `mimo run -s <sid>`-shaped processes not owned by our workers."""
+    out = []
+    for d in Path("/proc").iterdir():
+        if not d.name.isdigit():
+            continue
+        try:
+            parts = [p.decode(errors="replace") for p in (d / "cmdline").read_bytes().split(b"\0") if p]
+        except OSError:
+            continue
+        if not parts:
+            continue
+        joined = " ".join(parts)
+        if session_id not in joined or "-s" not in parts:
+            continue
+        if "mimo" not in joined.lower() and "@mimo-ai" not in joined.lower():
+            continue
+        try:
+            if os.getpgid(int(d.name)) in exclude_pgids:
+                continue
+        except OSError:
+            continue
+        out.append(int(d.name))
+    return out
+
+
+# ── verification → transition (unchanged authority model) ─────────────────
+
+
+def _authoritative_verify(rec: dict) -> tuple[str, dict]:
+    """Authoritative verification with a deterministic test seam.
+
+    Production (WR_VERIFY_STUB unset): real Gitea API via verify.py — the
+    ONLY source of success/failure truth. Test (WR_VERIFY_STUB=path to
+    JSON {"<run_ref-or-sha>": verdict, "default": verdict}): stubbed
+    verdicts so invariant tests never touch the network. The stub is a
+    test fixture, not an alternate authority — no production path sets it.
+    """
+    stub_path = os.environ.get("WR_VERIFY_STUB", "")
+    if stub_path:
+        try:
+            spec = json.loads(Path(stub_path).read_text())
+        except Exception:
+            return "pending", {"stub_error": "unreadable stub"}
+        key = str(rec.get("run_ref", "") or rec.get("sha", ""))
+        verdict = spec.get(key, spec.get("default", "pending"))
+        return verdict, {"stub": True, "key": key}
+    import verify
+
+    if rec.get("wait_kind") == "RELEASE_DEPLOY":
+        return verify.verify_release_deploy(rec.get("sha", ""), rec.get("repo_root", ""), rec.get("deployed_link", ""))
+    return verify.verify_run(rec.get("run_ref", ""), rec.get("sha", ""), rec.get("expected", "success"))
+
+
+def try_transition(rec: dict, event: dict | None = None) -> dict:
+    if rec["status"] != "WAITING_EXTERNAL":
+        return rec
+    if rec.get("wait_kind") == "PROCESS_EVENT":
+        # T15 §15D: the matching event IS the authority. The notifier
+        # wrapper observed the real process exit; exit_code decides the
+        # verdict. No Gitea lookup applies. A duplicate event never
+        # reaches here (match applies only to WAITING_EXTERNAL waits).
+        if not event:
+            return rec  # no event → nothing authoritative happened
+        try:
+            exit_code = int(event.get("exit_code"))
+        except (TypeError, ValueError):
+            exit_code = None
+        if exit_code is None:
+            return rec  # malformed event: stay WAITING (15E hostile case)
+        verdict = "success" if exit_code == 0 else "failure"
+        evidence = {"process_event": True, "exit_code": exit_code, "operation_id": event.get("run_ref", "")}
+        log(f"verify {rec['wait_id']}: {verdict} {json.dumps(evidence)[:120]}")
+        rec["status"] = "READY_TO_RESUME"
+        rec["verdict"] = verdict
+        if verdict == "failure":
+            rec["failure_evidence"] = evidence
+        rec["process_event_evidence"] = evidence
+        waitstore.save(rec)
+        return rec
+    verdict, evidence = _authoritative_verify(rec)
+    log(f"verify {rec['wait_id']}: {verdict} {json.dumps(evidence)[:120]}")
+    if verdict == "success":
+        rec["status"] = "READY_TO_RESUME"
+        rec["verdict"] = "success"
+    elif verdict == "failure":
+        rec["status"] = "READY_TO_RESUME"
+        rec["verdict"] = "failure"
+        rec["failure_evidence"] = verify.failed_job_evidence(rec.get("run_ref", ""))
+    else:
+        return rec  # pending/unknown → stay WAITING
+    waitstore.save(rec)
+    return rec
+
+
+def continuation_msg(rec: dict) -> str:
+    c = rec["continuation"]
+    if rec.get("verdict") == "success":
+        return (
+            f"External wait satisfied (wait {rec['wait_id']}).\n"
+            f"Original objective: {c.get('objective', '')}\n"
+            f"Waited for: {c.get('waited_for', '')}\n"
+            f"Authoritative result: workflow success verified via Gitea API.\n"
+            f"SHA/run: {rec.get('sha', '')}/{rec.get('run_ref', '')}\n"
+            f"Verify: {c.get('verify_when_woken', '')}\n"
+            f"Continue from: {c.get('on_success', '')}"
+        )
+    ev = json.dumps(rec.get("failure_evidence", {}))[:400]
+    return (
+        f"External wait finished with FAILURE (wait {rec['wait_id']}).\n"
+        f"Original objective: {c.get('objective', '')}\n"
+        f"Authoritative result: workflow FAILURE verified via Gitea API.\n"
+        f"Failed job evidence: {ev}\n"
+        f"SHA/run: {rec.get('sha', '')}/{rec.get('run_ref', '')}\n"
+        f"Do NOT treat this as success. Continue from: {c.get('on_failure', '')}"
+    )
+
+
+# ── resume driver (single-flight, tree-owned) ─────────────────────────────
+
+
+def resume(rec: dict) -> None:
+    """Run one continuation to completion. Runs on a dedicated worker thread.
+    Preconditions: caller verified no inflight worker for this session."""
+    sid, wid = rec["session_id"], rec["wait_id"]
+    # REAL_ASYNC_BRIDGE §2 invariant: a successful authority-verified
+    # operation completion must NEVER be overwritten or downgraded by a
+    # legacy session/FIFO delivery failure. Terminal operation state
+    # (COMPLETED/FAILED — stamped by the waiter's own authority
+    # verification) is owned by the OPERATION domain; this function owns
+    # only SESSION-DELIVERY. Re-read from disk: the in-memory copy may be
+    # stale relative to the waiter's terminal stamp.
+    fresh = waitstore.load(wid)
+    if fresh and fresh.get("status") in waitstore.TERMINAL:
+        log(
+            f"resume {wid}: skipped — operation already terminal "
+            f"({fresh['status']}); delivery worker never overrides "
+            f"operation truth"
+        )
+        return
+    rec = fresh or rec
+    msg = continuation_msg(rec)
+
+    # B: busy-session guard before touching the lease
+    strays = stray_worker_pids(sid)
+    if strays:
+        rec["status"] = "READY_TO_RESUME"
+        rec["resume_note"] = f"queued: target session busy (stray pids {strays})"
+        waitstore.save(rec)
+        log(f"queued {wid}: session busy {strays}")
+        return
+
+    # pre-register the lease owner as THIS daemon so acquisition is atomic
+    lease = waitstore.acquire_lease(sid, wid, os.getpid(), os.getpid())
+    if lease is None:
+        live = waitstore.read_lease(sid)
+        rec["status"] = "READY_TO_RESUME"
+        rec["resume_note"] = f"queued: lease held by wait {live and live.get('wait_id')}"
+        waitstore.save(rec)
+        log(f"queued {wid}: lease held")
+        return
+
+    rec["status"] = "RESUMING"
+    rec["resume_attempts"] = rec.get("resume_attempts", 0) + 1
+    waitstore.save(rec)
+
+    try:
+        proc = subprocess.Popen(
+            resume_cmd(sid, msg, wid, rec.get("resume_cmd")),
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            start_new_session=True,
+        )
+    except Exception as e:
+        waitstore.release_lease(sid, wid)
+        rec["status"] = "READY_TO_RETRY"  # spawn failed pre-delivery → retryable
+        rec["resume_note"] = f"spawn failed: {e}"
+        waitstore.save(rec)
+        log(f"spawn {wid} failed pre-delivery: {e}")
+        return
+
+    pgid = proc.pid  # start_new_session ⇒ pgid == child pid
+    waitstore.update_lease(sid, wait_id=wid, pid=proc.pid, pgid=pgid, pid_starttime=waitstore._pid_starttime(proc.pid))
+    log(f"launched {wid}: pid={proc.pid} pgid={pgid} attempt={rec['resume_attempts']}")
+
+    timed_out = False
+    try:
+        stdout, stderr = proc.communicate(timeout=WATCH_SECS)
+        rc = proc.returncode
+    except subprocess.TimeoutExpired:
+        timed_out = True
+        survivors = terminate_tree(pgid)
+        try:
+            stdout, stderr = proc.communicate(timeout=30)
+        except Exception:
+            stdout, stderr = "", ""
+        rc = proc.returncode
+        if survivors:
+            log(f"ERROR {wid}: group {pgid} survivors after KILL: {survivors}")
+
+    waitstore.release_lease(sid, wid)
+
+    if timed_out:
+        # D+E: timeout is NOT success. Tree terminated; retry truthfully.
+        if rec["resume_attempts"] >= MAX_ATTEMPTS:
+            rec["status"] = "RESUME_UNVERIFIED"
+            rec["resume_note"] = (
+                f"watch timeout x{rec['resume_attempts']}; process group {pgid} terminated; attempts exhausted"
+            )
+        else:
+            rec["status"] = "READY_TO_RETRY"
+            rec["resume_note"] = f"watch timeout; process group {pgid} terminated (TERM→KILL, verified); will retry"
+        log(f"timeout {wid}: tree {pgid} terminated, rc={rc}")
+    elif rc == 0:
+        # COMPLETION TRUTH (constraint 4): rc==0 means the headless worker
+        # EXITED CLEANLY — the strongest terminal evidence the supported CLI
+        # provides. Timeout/cancel can never reach this branch. The evidence
+        # chain (rc, output tail, timing) is recorded on the wait record.
+        terminal = "COMPLETED" if rec.get("verdict") == "success" else "FAILED"
+        rec["status"] = terminal
+        rec["resume_evidence"] = {
+            "kind": "worker_exited_rc0",
+            "rc": 0,
+            "output_tail": (stdout or "")[-400:],
+            "finished_at": waitstore.now(),
+        }
+        log(f"resumed {wid}: rc=0 → {terminal}")
+    else:
+        # Nonzero rc: delivery/completion unproven. Honest, not schedulable.
+        rec["status"] = "RESUME_UNVERIFIED"
+        rec["resume_evidence"] = {
+            "kind": "worker_exited_nonzero",
+            "rc": rc,
+            "output_tail": ((stdout or "") + (stderr or ""))[-400:],
+            "finished_at": waitstore.now(),
+        }
+        rec["resume_note"] = f"resume rc={rc}; delivery unverified"
+        log(f"resumed {wid}: rc={rc} → RESUME_UNVERIFIED")
+    waitstore.save(rec)
+
+
+# ── startup recovery (invariant F) ────────────────────────────────────────
+
+
+def startup_recovery() -> None:
+    for rec in waitstore.all_waits():
+        if rec.get("status") != "RESUMING":
+            continue
+        sid, wid = rec["session_id"], rec["wait_id"]
+        lease = waitstore.read_lease(sid)
+        if lease and lease.get("wait_id") == wid and waitstore._owner_alive(lease):
+            # Adopt the live worker and monitor it to a bounded conclusion.
+            pgid = lease["pgid"]
+            log(f"recover {wid}: adopted live worker pgid={pgid}")
+            deadline = time.time() + WATCH_SECS
+            while time.time() < deadline and pgid_members(pgid):
+                time.sleep(2)
+            survivors = terminate_tree(pgid) if pgid_members(pgid) else []
+            waitstore.release_lease(sid, wid)
+            rec["status"] = "RESUME_UNVERIFIED"
+            rec["resume_note"] = "adopted post-restart; outcome unverifiable" + (
+                f"; survivors killed: {survivors}" if survivors else ""
+            )
+            waitstore.save(rec)
+            log(f"recover {wid}: adopted worker ended → RESUME_UNVERIFIED")
+        else:
+            if lease:
+                waitstore.release_lease(sid, wid)  # stale
+            rec["status"] = "RESUME_UNVERIFIED"
+            rec["resume_note"] = "recovered at daemon startup: no live owner; delivery unverifiable"
+            waitstore.save(rec)
+            log(f"recover {wid}: no live owner → RESUME_UNVERIFIED")
+
+
+# ── reconciler + drive loop (invariant G: deterministic queue) ────────────
+
+_inflight: dict[str, threading.Thread] = {}
+_inflight_lock = threading.Lock()
+
+
+def drive_ready() -> None:
+    for rec in waitstore.schedulable():
+        sid = rec["session_id"]
+        # CONTENTION POLICY (constraint 2): MiMo exposes NO supported
+        # busy/idle session signal (verified 2026-09-12: `mimo session list
+        # --format json` has no status field; no `session status` command;
+        # no status column in the session schema; no documented ACP/serve
+        # endpoint). Therefore automatic injection into interactive sessions
+        # is NOT YET SAFE and stays disabled. Only waits explicitly declared
+        # target_kind="headless" (disposable/owned sessions) auto-dispatch.
+        if rec.get("target_kind") != "headless":
+            if not rec.get("hold_reason"):
+                rec["hold_reason"] = (
+                    "INTERACTIVE_AUTO_RESUME = NOT YET SAFE: "
+                    "no supported MiMo busy/idle signal; "
+                    "queued until operator releases"
+                )
+                waitstore.save(rec)
+            continue
+        if rec.get("ext", {}).get("resume_mode") == "self":
+            # REAL_ASYNC_BRIDGE §3: self-resuming wait (completion-file /
+            # inotify waiter owns its continuation). The daemon has NO
+            # delivery role here — dispatching a delivery worker would
+            # stamp a phantom rc!=0 over the waiter's own truthful
+            # terminal state (the canonical-state contradiction).
+            # NB: keyed on the explicit self marker, NOT on resume_cmd
+            # absence — records without inline resume_cmd may still be
+            # dispatchable via the WR_RESUME_CMD env template.
+            continue
+        with _inflight_lock:
+            t = _inflight.get(sid)
+            if t is not None and t.is_alive():
+                continue  # single-flight: session already being driven
+            # B: never launch into a busy session
+            strays = stray_worker_pids(sid)
+            if strays:
+                log(f"drive: {rec['wait_id']} held, session busy {strays}")
+                continue
+            th = threading.Thread(target=resume, args=(rec,), daemon=True, name=f"resume-{rec['wait_id']}")
+            _inflight[sid] = th
+            # start INSIDE the lock: a just-created thread is not yet
+            # is_alive() until start() runs — starting outside the lock let
+            # the same drive cycle dispatch a second worker for the session
+            # (single-flight race, caught by the T2 invariant test).
+            th.start()
+        log(f"drive: dispatched {rec['wait_id']} (session {sid})")
+
+
+def reconcile_once() -> None:
+    for rec in waitstore.pending():
+        if rec["status"] != "WAITING_EXTERNAL":
+            continue
+        created = rec.get("created_at", "")
+        try:
+            import calendar
+
+            age = time.time() - calendar.timegm(time.strptime(created, "%Y-%m-%dT%H:%M:%SZ"))
+        except ValueError:
+            continue
+        if age > RECONCILE_SECS:
+            try_transition(rec)
+
+
+_tick = 0
+
+
+def orphan_sweep() -> int:
+    """REAL_ASYNC_BRIDGE §4: permanent mid-run orphan-lease recovery.
+
+    FAILURE DETECTION ONLY — never involved in normal completion
+    scheduling. A wait stuck in RESUMING past ORPHAN_GRACE_SECS means the
+    resume flow died between lease acquire and release (worker thread
+    lost, exception mid-watch). Reconcile exactly as startup_recovery
+    would have: release the lease, stamp RESUME_UNVERIFIED truthfully
+    (delivery unverifiable), never auto-relaunch.
+    """
+    import calendar as _cal
+
+    healed = 0
+    for rec in waitstore.all_waits():
+        if rec.get("status") != "RESUMING":
+            continue
+        try:
+            updated = _cal.timegm(time.strptime(rec.get("last_updated", ""), "%Y-%m-%dT%H:%M:%SZ"))
+        except ValueError:
+            continue
+        if time.time() - updated < ORPHAN_GRACE_SECS:
+            continue  # legitimate in-flight watch (up to WATCH_SECS)
+        wid, sid = rec["wait_id"], rec["session_id"]
+        lease = waitstore.read_lease(sid)
+        owner_dead = lease is not None and not waitstore._owner_alive(lease)
+        daemon_owned = lease is not None and lease.get("pid") == os.getpid()
+        if lease is None or owner_dead or daemon_owned:
+            if lease is not None:
+                waitstore.release_lease(sid, wid)
+            if rec.get("resume_attempts", 0) >= MAX_ATTEMPTS:
+                rec["status"] = "RESUME_UNVERIFIED"
+            else:
+                rec["status"] = "READY_TO_RETRY"
+            rec["resume_note"] = (
+                "orphaned mid-run: resume flow died between lease acquire "
+                "and delivery ("
+                + ("lease owner dead" if owner_dead else "resume thread lost" if daemon_owned else "no lease")
+                + "); orphan sweep recovered"
+            )
+            waitstore.save(rec)
+            log(f"orphan-sweep {wid}: {rec['status']} — {rec['resume_note']}")
+            healed += 1
+    return healed
+
+
+def reconciler() -> None:
+    global _tick
+    while True:
+        # v0.3: the local-runner wake is the fast path; periodic
+        # authoritative verification demotes to a slower fallback
+        # (missed-event + daemon-restart recovery), not API polling.
+        _tick += 1
+        if _tick % RECONCILE_EVERY_TICKS == 0:
+            try:
+                reconcile_once()
+            except Exception as e:
+                log(f"reconcile error: {e}")
+            try:
+                orphan_sweep()  # §4 failure detection — bounded, periodic
+            except Exception as e:
+                log(f"orphan-sweep error: {e}")
+        try:
+            drive_ready()
+        except Exception as e:
+            log(f"drive error: {e}")
+        with _inflight_lock:
+            for sid, t in list(_inflight.items()):
+                if not t.is_alive():
+                    del _inflight[sid]
+        time.sleep(DRIVE_LOOP_SECS)
+
+
+# ── webhook receiver (wake signal only) ───────────────────────────────────
+
+
+def wake_sweep(event: dict, eid: str) -> dict:
+    """Sweep WAITING_EXTERNAL waits through authoritative verification.
+
+    Runs on a background thread (the hook's HTTP response returns
+    instantly, minimising the runner's offline window). If any verified
+    wait got 'pending' — the normal case for a job that finished
+    microseconds ago: the post-task hook fires after results are reported
+    but before the runner's final task acknowledgement flips server-side
+    status — retry on a BOUNDED event-triggered schedule (default 4s x3),
+    never a polling loop. The final ack lands milliseconds after the hook
+    exits, so the first retry almost always sees the terminal state.
+    """
+    arrival = time.time()
+    log(f"local wake {eid}: {json.dumps(event)[:140]}")
+    import calendar
+
+    def sweep() -> tuple[int, int, int]:
+        verified = advanced = pending = 0
+        for rec in waitstore.pending():
+            if rec["status"] != "WAITING_EXTERNAL":
+                continue
+            try:
+                age = time.time() - calendar.timegm(time.strptime(rec.get("created_at", ""), "%Y-%m-%dT%H:%M:%SZ"))
+            except ValueError:
+                continue
+            if age < WAKE_MIN_AGE_SECS:
+                continue
+            verified += 1
+            before = rec["status"]
+            try_transition(rec)
+            if rec["status"] != before and rec["status"] == "READY_TO_RESUME":
+                advanced += 1
+            elif rec["status"] == "WAITING_EXTERNAL":
+                pending += 1
+        return verified, advanced, pending
+
+    verified, advanced, pending = sweep()
+    log(
+        f"local wake {eid}: verified={verified} advanced={advanced} "
+        f"pending={pending} sweep_ms={int((time.time() - arrival) * 1000)}"
+    )
+    for attempt in range(1, WAKE_RETRIES + 1):
+        # Retry while the sweep didn't conclusively advance anything:
+        # pending verdicts (ack-window) AND fresh-wait skips (age gate).
+        # Bounded, event-triggered — not a polling loop.
+        if not pending and verified:
+            break
+        time.sleep(WAKE_RETRY_SECS)
+        verified, advanced, pending = sweep()
+        log(
+            f"local wake {eid}: retry{attempt} verified={verified} "
+            f"advanced={advanced} pending={pending} "
+            f"total_ms={int((time.time() - arrival) * 1000)}"
+        )
+    return {"event_id": eid}
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path == "/process-event":
+            # T15 §15D: process-exit events from builder/controller
+            # notifiers. Minimal dedicated endpoint — the Gitea webhook
+            # path stays untouched. Payload: {operation_id, exit_code,
+            # completed_at} + OPTIONAL provider/event_type/sha (T16
+            # §16C/§16E: the CI adapter registers as provider="gitea",
+            # event_type="ci_completed"; defaults preserve the T15 builder
+            # identity so existing notifiers are unaffected). The event is
+            # a WAKE, never truth — resumed controllers re-read canonical
+            # authority before any verdict.
+            length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(length)
+            try:
+                payload = json.loads(body) if body else {}
+            except json.JSONDecodeError:
+                self.send_response(400)
+                self.end_headers()
+                return
+            event = {
+                "provider": str(payload.get("provider", "builder")),
+                "event_type": str(payload.get("event_type", "builder_exit")),
+                "run_ref": str(payload.get("operation_id", "")) or None,
+                "sha": payload.get("sha"),
+                "exit_code": payload.get("exit_code"),
+                "completed_at": payload.get("completed_at") or "",
+            }
+            event = {k: v for k, v in event.items() if v is not None}
+            eid = waitstore.record_event(event)
+            log(f"process-event {eid}: {json.dumps(event)[:140]}")
+            # REAL_ASYNC_BRIDGE (R3): durable completion-file delivery.
+            # Every event reaching the bridge is written as
+            # resumes/<operation_id>.done so inotify waiters wake on the
+            # kernel event (R4) with no FIFO/lease machinery, and the
+            # event survives daemon AND waiter restarts (R9). Atomic
+            # rename; duplicate events rewrite identical content (R10).
+            _op_id = str(payload.get("operation_id", ""))
+            if _op_id:
+                try:
+                    # Stable identity only: duplicate deliveries of the
+                    # same logical event must produce byte-identical
+                    # completion files (R10 idempotence by construction).
+                    # completed_at is volatile and lives in the durable
+                    # event log; the file is a WAKE SIGNAL, never truth.
+                    _stable = {
+                        k: event.get(k)
+                        for k in ("provider", "event_type", "run_ref", "sha", "exit_code")
+                        if event.get(k) is not None
+                    }
+                    completion_file.write_completion(_op_id, _stable)
+                except Exception as e:  # noqa: BLE001 — delivery best-effort; wait-record transition + watchdog recovery still cover the lost file
+                    log(f"process-event {eid}: completion-file write failed: {e}")
+            matched = 0
+            for rec in waitstore.pending():
+                if rec["status"] == "WAITING_EXTERNAL" and waitstore.match(rec, event):
+                    matched += 1
+                    try_transition(rec, event)
+            # matched READY controller waits are dispatched IMMEDIATELY
+            # (event-driven, no floor). Guard: only never-resumed waits —
+            # a duplicate/late event must not double-dispatch (15E);
+            # single-flight lease + this guard together make resume
+            # idempotent.
+            for rec in waitstore.pending():
+                if rec["status"] == "READY_TO_RESUME" and rec.get("resume_cmd") and rec.get("resume_attempts", 0) == 0:
+                    threading.Thread(target=resume, args=(rec,), daemon=True, name=f"resume-{rec['wait_id']}").start()
+                    matched += 1
+            try:
+                self.send_response(200)
+                self.end_headers()
+                self.wfile.write(json.dumps({"event_id": eid, "matched": matched}).encode())
+            except (BrokenPipeError, ConnectionResetError):
+                pass
+            return
+        if self.path == "/wake":
+            length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(length)
+            try:
+                payload = json.loads(body) if body else {}
+            except json.JSONDecodeError:
+                self.send_response(400)
+                self.end_headers()
+                return
+            event = {
+                "provider": "gitea-local-runner",
+                "task_id": str(payload.get("task_id", "")) or None,
+                "run_id": str(payload.get("run_id", "")) or None,
+                "repository": str(payload.get("repository", "")) or None,
+                "job_result": str(payload.get("job_result", "")) or None,
+            }
+            event = {k: v for k, v in event.items() if v}
+            eid = waitstore.record_event(event)
+            # Respond instantly; sweep on a worker thread. The hook is
+            # fire-and-forget (curl -m 2) — a broken pipe on write is
+            # harmless and must not propagate.
+            try:
+                threading.Thread(
+                    target=wake_sweep, args=(event, eid), daemon=True, name=f"wake-{payload.get('task_id', '?')}"
+                ).start()
+            except Exception as e:
+                log(f"wake spawn error: {e}")
+            try:
+                self.send_response(200)
+                self.end_headers()
+                self.wfile.write(json.dumps({"queued": True, "event_id": eid}).encode())
+            except (BrokenPipeError, ConnectionResetError):
+                pass
+            return
+        if self.path != "/webhook":
+            self.send_response(404)
+            self.end_headers()
+            return
+        length = int(self.headers.get("Content-Length", 0))
+        body = self.rfile.read(length)
+        try:
+            payload = json.loads(body)
+        except json.JSONDecodeError:
+            self.send_response(400)
+            self.end_headers()
+            return
+        action = payload.get("action") or payload.get("event_type") or ""
+        wf = payload.get("workflow_run") or {}
+        event = {
+            "provider": "gitea",
+            "event_type": f"workflow.{action}" if wf else action,
+            "sha": (wf.get("head_sha") or payload.get("sha") or "")[:12] or None,
+            "run_ref": str(wf.get("id") or payload.get("run_number") or "") or None,
+        }
+        event = {k: v for k, v in event.items() if v}
+        eid = waitstore.record_event(event)
+        log(f"webhook event {eid}: {json.dumps(event)[:140]}")
+        matched = 0
+        for rec in waitstore.pending():
+            if rec["status"] == "WAITING_EXTERNAL" and waitstore.match(rec, event):
+                matched += 1
+                try_transition(rec)
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(json.dumps({"event_id": eid, "matched": matched}).encode())
+
+    def do_GET(self):
+        if self.path == "/health":
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b'{"ok":true}')
+            return
+        self.send_response(404)
+        self.end_headers()
+
+    def log_message(self, *a):
+        pass
+
+
+def main() -> int:
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8791
+
+    # H (constraint 1): flock is the SINGLETON AUTHORITY. daemon.pid's
+    # content is diagnostic metadata only — it never gates startup, never
+    # implies liveness, and is overwritten after the exclusive lock is held.
+    # Stale pid content (incl. SIGKILL debris) is thus harmless by design.
+    PIDFILE.parent.mkdir(parents=True, exist_ok=True)
+    lock_fd = os.open(PIDFILE, os.O_CREAT | os.O_RDWR, 0o644)
+    try:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except OSError:
+        log("refusing start: another daemon holds the pidfile flock")
+        print("daemon already running (pidfile flock held)", file=sys.stderr)
+        return 1
+    os.ftruncate(lock_fd, 0)
+    os.write(lock_fd, f"{os.getpid()}\n".encode())  # diagnostic, lock held for life
+
+    startup_recovery()
+    t = threading.Thread(target=reconciler, daemon=True)
+    t.start()
+    log(f"daemon starting on :{port}")
+    srv = ThreadingHTTPServer(("0.0.0.0", port), Handler)
+    try:
+        srv.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bridge/daemon/verify.py

@@ -0,0 +1,246 @@
+#!/usr/bin/env python3
+"""verify.py — authoritative Gitea verification (webhook ≠ success).
+
+Queries the Gitea API for the TRUE state of the run/job/commit the wait
+references. Returns (verdict, evidence). verdict ∈ {success, failure,
+pending, unknown}. Only this module may move a wait out of
+WAITING_EXTERNAL.
+"""
+
+from __future__ import annotations
+import json, subprocess
+from pathlib import Path
+
+HOST = "https://gitea.thingscouldgetdicey.online"
+REPO = "conductor/rune"
+
+
+def _token() -> str:
+    # Canonical ladder without importing Rune: env → token file → git store
+    import os
+
+    tok = os.environ.get("GITEA_TOKEN", "").strip()
+    if tok:
+        return tok
+    tf = os.path.expanduser("~/.config/opencode/secrets/gitea-token")
+    if os.path.isfile(tf):
+        return open(tf).read().strip()
+    r = subprocess.run(
+        ["git", "credential", "fill"],
+        input="protocol=https\nhost=gitea.thingscouldgetdicey.online\nusername=conductor\n\n",
+        capture_output=True,
+        text=True,
+        timeout=10,
+    )
+    for line in r.stdout.splitlines():
+        if line.startswith("password="):
+            return line[9:]
+    raise RuntimeError("no gitea credential available")
+
+
+def _api(path: str) -> tuple[int, object]:
+    import urllib.request
+
+    req = urllib.request.Request(f"{HOST}/api/v1/repos/{REPO}{path}", headers={"Authorization": f"token {_token()}"})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            return r.status, json.loads(r.read())
+    except urllib.error.HTTPError as e:
+        return e.code, {"error": e.read().decode()[:200]}
+
+
+def _jobs_list(run_ref: str):
+    """GET jobs for a run, unwrapping the {'jobs': [...]} envelope."""
+    s, data = _api(f"/actions/runs/{run_ref}/jobs")
+    if s != 200:
+        return s, None
+    if isinstance(data, dict):
+        data = data.get("jobs", [])
+    return s, data if isinstance(data, list) else None
+
+
+def _resolve_run_id(run_ref: str, sha: str) -> str:
+    """Task-list ids are NOT run ids. If run_ref lookup 404s, resolve the
+    real run id by head SHA via /actions/runs (T15: run 6907 vs task 15743)."""
+    if run_ref:
+        s, jobs = _jobs_list(run_ref)
+        if s == 200 and jobs:
+            return run_ref
+    if sha:
+        s, runs = _api(f"/actions/runs?limit=30")
+        items = runs.get("workflow_runs", []) if isinstance(runs, dict) else (runs if isinstance(runs, list) else [])
+        # One SHA fans out to multiple runs (lint + deploy-only). Prefer a
+        # substantive (non-skipped) run; a skipped-only run proves nothing.
+        fallback = ""
+        for r in items:
+            if str(r.get("head_sha", "")).startswith(sha):
+                rid = str(r.get("id"))
+                if r.get("conclusion") != "skipped":
+                    return rid
+                fallback = fallback or rid
+        return fallback
+    return ""
+
+
+def verify_run(run_ref: str, sha: str, expected: str) -> tuple[str, dict]:
+    """run_ref = actions run id (or task id — resolved via SHA lookup).
+
+    Defect fixed 2026-09-12 (surfaced by W/R-v0.3 live proof, run 7110):
+    the jobs query here used raw _api + isinstance(jobs, list), but this
+    Gitea wraps jobs in the {"jobs": [...]} envelope — the check always
+    failed, so EVERY EXACT_WORKFLOW verdict silently fell through to the
+    aggregate commit-status fallback, where unrelated runs on the same
+    SHA (multi-run fan-out: ci.yml + deploy-only) poison the verdict.
+    Use _jobs_list (unwraps the envelope), same as _resolve_run_id."""
+    run_ref = _resolve_run_id(run_ref, sha)
+    if run_ref:
+        s, jobs = _jobs_list(run_ref)
+        if s == 200 and isinstance(jobs, list) and jobs:
+            conclusions = {j.get("name"): j.get("conclusion") for j in jobs}
+            statuses = {j.get("status") for j in jobs}
+            if statuses <= {"completed"}:
+                verdict = "success" if set(conclusions.values()) <= {"success", "skipped"} else "failure"
+                return verdict, {"run_ref": run_ref, "jobs": conclusions}
+            return "pending", {"run_ref": run_ref, "statuses": sorted(statuses)}
+    if sha:
+        s, st = _api(f"/commits/{sha}/status")
+        if s == 200 and isinstance(st, dict):
+            state = st.get("state", "unknown")  # success|error|failure|pending|warning
+            rid = _resolve_run_id("", sha)  # attach run id so failure evidence works
+            if state == "success":
+                return "success", {"sha": sha, "state": state, "run_ref": rid}
+            if state in ("error", "failure"):
+                return "failure", {"sha": sha, "state": state, "run_ref": rid}
+            return "pending", {"sha": sha, "state": state}
+    return "unknown", {"run_ref": run_ref, "sha": sha}
+
+
+def failed_job_evidence(run_ref: str, sha: str = "") -> dict:
+    """For failure continuations: exact failing job + conclusion."""
+    run_ref = _resolve_run_id(run_ref, sha)
+    if not run_ref:
+        return {}
+    s, jobs = _jobs_list(run_ref)
+    if s != 200 or not isinstance(jobs, list):
+        return {}
+    bad = [j for j in jobs if j.get("conclusion") not in ("success", "skipped", None)]
+    return {
+        "failed_jobs": [
+            {"name": j.get("name"), "conclusion": j.get("conclusion"), "url": j.get("url", "")} for j in bad
+        ]
+    }
+
+
+# ── RELEASE_DEPLOY verification (W/R v0.1, overnight handoff Part 2) ──────
+# Aggregate commit status is NOT a valid completion authority for Rune's
+# release/deploy flow: the release successor SHA, not the source SHA, is what
+# converges (observed live: wr-1789179026 stranded on pending while 0.66.15
+# was deployed). The authority chain is:
+#   source SHA → source runs terminal → release successor commit (descendant)
+#   → successor runs success → deployed/current identity converges.
+
+
+def _git(args: list[str], repo_root: str) -> str:
+    import subprocess
+
+    r = subprocess.run(["git"] + args, capture_output=True, text=True, cwd=repo_root or None, timeout=15)
+    if r.returncode != 0:
+        raise RuntimeError(f"git {' '.join(args[:2])}: {r.stderr.strip()[:120]}")
+    return r.stdout
+
+
+def _runs_for_sha(sha: str) -> list[dict]:
+    s, runs = _api("/actions/runs?limit=50")
+    items = runs.get("workflow_runs", []) if isinstance(runs, dict) else []
+    return [r for r in items if str(r.get("head_sha", "")).startswith(sha)]
+
+
+def _sha_verdict_from_runs(runs: list[dict]) -> tuple[str, dict]:
+    """success | failure | pending from a SHA's workflow runs.
+    Terminal verdict ONLY when every run is completed — mixed states
+    (some success, some still in flight) must stay PENDING (observed live:
+    a SHA with 1 completed-success + 1 queued + 1 in-progress was judged
+    success mid-flight; wr-1789182522 2026-09-12)."""
+    if not runs:
+        return "pending", {"note": "no runs found"}
+    non_terminal = [r for r in runs if r.get("status") != "completed"]
+    if non_terminal:
+        return "pending", {"in_flight": len(non_terminal)}
+    conclusions = {r.get("name"): r.get("conclusion") for r in runs}
+    bad = {n: c for n, c in conclusions.items() if c == "failure"}
+    if bad:
+        return "failure", {"failed": bad}
+    return "success", {"runs": conclusions}
+
+
+def verify_release_deploy(source_sha: str, repo_root: str = "", deployed_link: str = "") -> tuple[str, dict]:
+    """RELEASE_DEPLOY authority chain. Returns (verdict, evidence)."""
+    source_sha = (source_sha or "")[:12]
+    ev: dict = {"source_sha": source_sha, "kind": "RELEASE_DEPLOY"}
+
+    # 1. Source SHA's own runs must be terminal and healthy.
+    src_runs = _runs_for_sha(source_sha)
+    src_verdict, src_ev = _sha_verdict_from_runs(src_runs)
+    ev["source"] = src_ev
+    if src_verdict != "success":
+        return src_verdict, ev
+
+    # 2. Release successor: first chore(release) commit descending from source.
+    if not repo_root:
+        return "pending", {**ev, "note": "no repo_root — cannot check lineage"}
+    try:
+        out = _git(
+            [
+                "log",
+                "--format=%H %s",
+                "--reverse",
+                f"{source_sha}..master",
+                "--grep=^chore\\(release\\)",
+                "--extended-regexp",
+            ],
+            repo_root,
+        )
+    except RuntimeError as e:
+        return "pending", {**ev, "note": str(e)}
+    successors = [l for l in out.splitlines() if l.strip()]
+    if not successors:
+        return "pending", {**ev, "note": "no release successor yet"}
+    succ_line = successors[0]
+    succ_sha_full, _, succ_subject = succ_line.partition(" ")
+    succ_sha = succ_sha_full[:12]
+    ev["successor"] = {"sha": succ_sha, "subject": succ_subject[:80]}
+
+    # Ancestry is guaranteed by the range, but verify explicitly (deterministic
+    # lineage over title guessing):
+    try:
+        _git(["merge-base", "--is-ancestor", source_sha, succ_sha_full], repo_root)
+    except RuntimeError:
+        return "failure", {**ev, "note": "successor is not a descendant of source"}
+
+    # 3. Successor runs must be terminal and healthy.
+    succ_runs = _runs_for_sha(succ_sha)
+    succ_verdict, succ_ev = _sha_verdict_from_runs(succ_runs)
+    ev["successor"]["runs"] = succ_ev
+    if succ_verdict != "success":
+        return succ_verdict, ev
+
+    # 4. Deployed identity convergence. A mismatch is FAILURE only when the
+    # successor's runs are ALL completed — if any is still running/queued the
+    # deploy may simply not have propagated yet → PENDING (observed live:
+    # reconciler checked mid-deploy, verdict failure, deployment converged
+    # ~2 min later; wr-1789182522 2026-09-12).
+    if deployed_link:
+        link = Path(deployed_link)
+        if link.is_symlink() or link.is_dir():
+            deployed = str(link.resolve())
+            deployed_id = Path(deployed).name
+            ev["deployed"] = deployed_id
+            if not deployed_id.startswith(succ_sha[:12]):
+                still = [r for r in _runs_for_sha(succ_sha) if r.get("status") != "completed"]
+                if still:
+                    return "pending", {**ev, "note": "deploy propagating (runs in flight)"}
+                return "failure", {**ev, "note": f"deployed {deployed_id} != successor {succ_sha} (all runs terminal)"}
+        else:
+            return "failure", {**ev, "note": f"deployed link missing: {deployed_link}"}
+
+    return "success", ev

bridge/daemon/waitstore.py

@@ -0,0 +1,337 @@
+#!/usr/bin/env python3
+"""waitstore.py — wait/resume state machine v0.2 (developer tooling, NOT Rune).
+
+States:
+  RUNNABLE → WAITING_EXTERNAL → READY_TO_RESUME → RESUMING → COMPLETED | FAILED
+                                       ↑               │
+                                       │               ├─(watch timeout, tree killed)
+                                       │               └─(rc!=0 / unverifiable)
+                                  READY_TO_RETRY ←─────┘
+  RESUME_UNVERIFIED : delivery after crash/timeout cannot be proven.
+                      TERMINAL-ish — never auto-scheduled; explicit
+                      `requeue()` required to make it READY_TO_RESUME.
+  TIMED_OUT         : external event never arrived within the wait budget.
+
+Waits persist as waits/<wait_id>.json (atomic tmp+rename).
+Leases persist as leases/<session_id>.lease.json (atomic tmp+rename,
+validated against /proc so a dead or PID-reused owner is stealable).
+"""
+
+from __future__ import annotations
+import fcntl, json, os, tempfile, time, uuid
+from pathlib import Path
+
+ROOT = Path(os.environ.get("WR_ROOT", "") or Path(__file__).resolve().parent)
+WAITS = ROOT / "waits"
+EVENTS = ROOT / "events"
+LEASES = ROOT / "leases"
+
+SCHEDULABLE = {"READY_TO_RESUME", "READY_TO_RETRY"}
+VALID_STATES = {
+    "RUNNABLE",
+    "WAITING_EXTERNAL",
+    "READY_TO_RESUME",
+    "RESUMING",
+    "COMPLETED",
+    "FAILED",
+    "READY_TO_RETRY",
+    "RESUME_UNVERIFIED",
+    "TIMED_OUT",
+}
+TERMINAL = {"COMPLETED", "FAILED", "RESUME_UNVERIFIED", "TIMED_OUT"}
+
+
+def _atomic_write(path: Path, data: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=str(path.parent), prefix=".tmp-")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(data, f, indent=1, sort_keys=True)
+        os.replace(tmp, path)
+        # T17 17C: the bridge root is SHARED across users (deploy waiter
+        # runs as the runner user; daemon as nick). mkstemp creates 0600 —
+        # daemon re-saves locked the runner user out of records it must
+        # read (waitstore.load in await_resume_event; find_matching_event
+        # replay scan silently skipped them). 0644: owner writes, all read.
+        os.chmod(path, 0o644)
+    except BaseException:
+        if os.path.exists(tmp):
+            os.unlink(tmp)
+        raise
+
+
+def now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+def new_wait(
+    *,
+    session_id: str,
+    provider: str,
+    event_type: str,
+    repo: str,
+    sha: str = "",
+    run_ref: str = "",
+    expected: str = "success",
+    wait_kind: str = "EXACT_WORKFLOW",
+    target_kind: str = "interactive",
+    repo_root: str = "",
+    deployed_link: str = "",
+    objective: str = "",
+    waited_for: str = "",
+    verify_when_woken: str = "",
+    on_success: str = "",
+    on_failure: str = "",
+    resume_cmd: list | None = None,
+) -> dict:
+    wid = f"wr-{int(time.time())}-{uuid.uuid4().hex[:6]}"
+    rec = {
+        "wait_id": wid,
+        "session_id": session_id,
+        "created_at": now(),
+        "provider": provider,
+        "event_type": event_type,
+        "repo": repo,
+        "sha": sha,
+        "run_ref": run_ref,
+        "expected": expected,
+        # T15 §15D: PROCESS_EVENT — a wait whose authoritative verdict is
+        # the matching process-exit event itself (exit_code carried on the
+        # event), e.g. a builder/controller process completing. The event
+        # IS the authority here (the notifier wrapper observed the real
+        # process exit); no Gitea lookup applies.
+        "wait_kind": wait_kind
+        if wait_kind in ("EXACT_WORKFLOW", "RELEASE_DEPLOY", "PROCESS_EVENT")
+        else "EXACT_WORKFLOW",
+        # CONTENTION POLICY: "interactive" (default, conservative) never
+        # auto-dispatches — MiMo exposes NO supported busy/idle session
+        # signal, so injecting into a possibly-busy interactive session is
+        # NOT YET SAFE. Only explicitly declared headless/disposable
+        # targets ("headless") are auto-resumed.
+        "target_kind": target_kind if target_kind in ("headless", "interactive") else "interactive",
+        "repo_root": repo_root,
+        "deployed_link": deployed_link,
+        # T15 §15D: per-wait resume command override (placeholder template,
+        # same substitution as WR_RESUME_CMD: {session_id}/{msg}/{wait_id}).
+        # A synthetic controller session (e.g. a Scaffolding stage driver)
+        # is NOT a MiMo session — the global mimo-shaped default cannot
+        # resume it, which is exactly why fixed-sleep polling crept back
+        # in T12-T14. Per-wait override makes ANY registered continuation
+        # target resumable through the same bridge.
+        "resume_cmd": list(resume_cmd) if resume_cmd else None,
+        "status": "WAITING_EXTERNAL",
+        "last_verified": "",
+        "resume_attempts": 0,
+        "continuation": {
+            "objective": objective,
+            "waited_for": waited_for,
+            "verify_when_woken": verify_when_woken,
+            "on_success": on_success,
+            "on_failure": on_failure,
+        },
+    }
+    _atomic_write(WAITS / f"{wid}.json", rec)
+    return rec
+
+
+def load(wid: str) -> dict | None:
+    p = WAITS / f"{wid}.json"
+    return json.loads(p.read_text()) if p.is_file() else None
+
+
+def save(rec: dict) -> None:
+    assert rec.get("status") in VALID_STATES, rec.get("status")
+    rec["last_updated"] = now()
+    _atomic_write(WAITS / f"{rec['wait_id']}.json", rec)
+
+
+def all_waits() -> list[dict]:
+    out = []
+    for p in WAITS.glob("*.json"):
+        try:
+            out.append(json.loads(p.read_text()))
+        except json.JSONDecodeError:
+            continue
+    return out
+
+
+def pending() -> list[dict]:
+    return [r for r in all_waits() if r.get("status") in {"WAITING_EXTERNAL"} | SCHEDULABLE]
+
+
+def schedulable() -> list[dict]:
+    """READY waits, oldest first — deterministic queue order."""
+    rs = [r for r in all_waits() if r.get("status") in SCHEDULABLE]
+    rs.sort(key=lambda r: (r.get("created_at", ""), r.get("wait_id", "")))
+    return rs
+
+
+def requeue(wid: str, note: str) -> dict | None:
+    """Operator-explicit requeue of a RESUME_UNVERIFIED/RESUME_FAILED wait."""
+    rec = load(wid)
+    if not rec:
+        return None
+    rec["status"] = "READY_TO_RESUME"
+    rec["resume_note"] = note
+    save(rec)
+    return rec
+
+
+# ── events (wake signals, idempotent) ─────────────────────────────────────
+
+
+def record_event(event: dict) -> str:
+    import hashlib
+
+    body = json.dumps(event, sort_keys=True)
+    eid = hashlib.sha256(body.encode()).hexdigest()[:16]
+    f = EVENTS / f"{eid}.json"
+    if not f.is_file():
+        _atomic_write(f, {"event_id": eid, "received_at": now(), "event": event})
+    return eid
+
+
+def match(rec: dict, event: dict) -> bool:
+    if rec.get("provider") != event.get("provider"):
+        return False
+    if rec.get("event_type") and event.get("event_type") and rec["event_type"] != event["event_type"]:
+        return False
+    if rec.get("sha") and event.get("sha") and rec["sha"] != event["sha"]:
+        return False
+    if rec.get("run_ref") and event.get("run_ref") and rec["run_ref"] != event["run_ref"]:
+        return False
+    return True
+
+
+# ── leases (per-session single-flight, /proc-validated) ───────────────────
+#
+# Invariant 3 (PID reuse): liveness is NEVER "PID exists". The lease records
+# pid + pgid + process starttime (/proc/<pid>/stat field 22); all three must
+# match or the owner is a different process wearing a recycled PID.
+#
+# Invariant 1 (flock as authority): the lease file's flock serializes
+# read-modify-write across processes and dies with its holder, so a crashed
+# daemon can never wedge the lock. The lease JSON + /proc decide who OWNS the
+# session; the flock only prevents racing acquirers from double-stealing.
+
+_lease_fds: dict[str, int] = {}  # session_id → open fd holding the flock
+
+
+def _pid_starttime(pid: int) -> str | None:
+    """Field 22 of /proc/<pid>/stat — distinguishes PID reuse."""
+    try:
+        stat = Path(f"/proc/{pid}/stat").read_text()
+        return stat.rsplit(")", 1)[1].split()[19]
+    except (OSError, IndexError):
+        return None
+
+
+def _owner_alive(lease: dict) -> bool:
+    pid = lease.get("pid")
+    if not pid or not Path(f"/proc/{pid}").is_dir():
+        return False
+    if _pid_starttime(pid) != lease.get("pid_starttime"):
+        return False  # PID reused by an unrelated process
+    try:
+        if os.getpgid(pid) != lease.get("pgid"):
+            return False
+    except OSError:
+        return False
+    return True
+
+
+def lease_path(session_id: str) -> Path:
+    # T16 §16C finding (observed live in daemon.log): session ids like
+    # "controller-<op>-Verboo Code/glm-5.3-flash" contain "/" — the raw
+    # embed made lease creation raise FileNotFoundError, so resume
+    # delivery for those waits could never succeed. Sanitize to a flat
+    # filesystem-safe name; the hash suffix prevents collisions between
+    # ids that sanitize identically.
+    import hashlib as _hashlib
+    import re as _re
+
+    safe = _re.sub(r"[^A-Za-z0-9._-]+", "_", session_id)[:80]
+    digest = _hashlib.sha256(session_id.encode()).hexdigest()[:10]
+    return LEASES / f"{safe}-{digest}.lease.json"
+
+
+def read_lease(session_id: str) -> dict | None:
+    p = lease_path(session_id)
+    if not p.is_file():
+        return None
+    try:
+        return json.loads(p.read_text())
+    except json.JSONDecodeError:
+        return None
+
+
+def _locked_lease_fd(session_id: str) -> int | None:
+    """Open the lease file and take its flock (non-blocking). The fd stays
+    open (lock held) until release_lease closes it."""
+    if session_id in _lease_fds:
+        return _lease_fds[session_id]  # already hold it
+    LEASES.mkdir(parents=True, exist_ok=True)
+    fd = os.open(lease_path(session_id), os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except OSError:
+        os.close(fd)
+        return None  # another process holds the lock — mid-acquire
+    _lease_fds[session_id] = fd
+    return fd
+
+
+def _write_lease_locked(session_id: str, lease: dict) -> None:
+    fd = _lease_fds[session_id]
+    os.ftruncate(fd, 0)
+    os.lseek(fd, 0, os.SEEK_SET)
+    os.write(fd, json.dumps(lease, indent=1, sort_keys=True).encode())
+    os.fsync(fd)
+
+
+def acquire_lease(session_id: str, wait_id: str, pid: int, pgid: int) -> dict | None:
+    """Atomically create or steal the session lease. Returns the lease dict,
+    or None if a live owner holds it (or another process is mid-steal).
+    Staleness is decided by /proc identity evidence, never by age alone."""
+    fd = _locked_lease_fd(session_id)
+    if fd is None:
+        return None
+    existing = read_lease(session_id)
+    if existing and _owner_alive(existing):
+        _lease_fds.pop(session_id, None)
+        os.close(fd)
+        return None  # live worker owns this session
+    lease = {
+        "session_id": session_id,
+        "wait_id": wait_id,
+        "pid": pid,
+        "pgid": pgid,
+        "pid_starttime": _pid_starttime(pid),
+        "acquired_at": now(),
+        "state": "RESUMING",
+    }
+    _write_lease_locked(session_id, lease)
+    return lease
+
+
+def update_lease(session_id: str, **fields) -> None:
+    lease = read_lease(session_id) or {}
+    lease.update(fields)
+    _write_lease_locked(session_id, lease)
+
+
+def release_lease(session_id: str, wait_id: str) -> bool:
+    """Release only if the current lease belongs to this wait (no stealing
+    a successor's lease during a slow shutdown path). Closes the flock fd."""
+    lease = read_lease(session_id)
+    if not (lease and lease.get("wait_id") == wait_id):
+        return False
+    fd = _lease_fds.pop(session_id, None)
+    if fd is not None:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        except OSError:
+            pass
+        os.close(fd)
+    lease_path(session_id).unlink(missing_ok=True)
+    return True

config/mimo-hooks/builder-bridge.ts

@@ -0,0 +1,124 @@
+import { execFile } from "node:child_process"
+import { existsSync, appendFileSync } from "node:fs"
+
+// builder-bridge — Rune Core preflight for the MiMo builder (handoff
+// 2026-09-10 §3–§7, Option C bridge tranche). For each user turn, the hook
+// extracts the user's message from the outgoing LLM request, runs the Rune
+// Core builder-bridge preflight (deterministic: route classification +
+// memory selection + active-Scaffolding projection, ZERO model calls), and
+// appends a compact capsule to the final user message. Same Rune Core the
+// TUI/operator path uses — this file is a thin adapter with no cognition.
+//
+// CANONICAL SOURCE: config/mimo-hooks/builder-bridge.ts
+// Installed to ~/.mimocode/hooks/builder-bridge.ts by
+// `scripts/install_mimo_hook.py` (hash-verified, drift-detecting — the same
+// contract as event-wait-guard.ts). T22: this file was previously
+// UNVERSIONED and hardcoded an ephemeral interpreter path (/tmp/ci-venv),
+// which silently killed the whole edge; both defects are repaired here.
+//
+// Overhead contract (§7/§8): capsule ≤ ~300 tokens; a repeat/empty task
+// costs ~0ms (TTL cache); a fresh task ~150ms (bounded retrieval). The hook
+// degrades silently to no-injection on any failure — it must never block
+// the builder.
+//
+// Injection policy: only append when the capsule is non-empty. A plain
+// "hello" gets nothing (§5: if nothing relevant exists, inject nothing).
+
+const BRIDGE = "/mnt/workdrive/issue161-harness/src/rune/builder_bridge_cli.py"
+const MARKER_PREFIX = "/tmp/rune-bridge-"
+
+// Interpreter resolution (T22 repair): the previous hardcoded
+// "/tmp/ci-venv/bin/python" is an EPHEMERAL path that no longer exists, so
+// every bridge call failed and the hook silently degraded — the MiMo edge
+// received no Rune Core preflight at all (zero fire-log lines). Resolve
+// against durable candidates, first existing wins; env override wins over
+// all of them. If nothing exists the hook degrades as before.
+const PY_CANDIDATES = [
+  process.env.MIMO_BRIDGE_PY,
+  "/mnt/workdrive/issue161-harness/.test-venv/bin/python",
+  "/home/nick/.venvs/memory/bin/python3",
+  "/usr/bin/python3",
+].filter((p) => typeof p === "string" && p.length > 0)
+
+function resolvePy() {
+  for (const p of PY_CANDIDATES) {
+    try {
+      if (existsSync(p)) return p
+    } catch {}
+  }
+  return null
+}
+
+// Per-process dedupe: identical task text within the cache TTL does not need
+// a second bridge call — the CLI has its own TTL cache, but skipping the
+// process spawn entirely for the same message text within 10 minutes keeps
+// repeats at ~0ms.
+const lastText = new Map() // text -> timestamp
+const TTL = 600_000
+
+function extractUserText(messages) {
+  // messages: Array<{ info: Message, parts: Part[] }> — newest last.
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]
+    if (m?.info?.role !== "user") continue
+    const texts = []
+    for (const p of m.parts ?? []) {
+      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
+    }
+    if (texts.length) return texts.join("\n").slice(0, 4000)
+  }
+  return ""
+}
+
+export default {
+  "experimental.chat.messages.transform": async (input, output) => {
+    try {
+      if (!Array.isArray(output.messages) || output.messages.length === 0) return
+      const userText = extractUserText(output.messages)
+      if (!userText || userText.length < 12) return // trivial/noise guard
+      // Harness-internal steps (checkpoint writer, compaction, system
+      // reminders) are not builder tasks — no capsule (measured: the fire
+      // log showed checkpoint-writer steps receiving capsules 2026-09-10).
+      if (/^(<system-reminder>|EXTRACTION REQUIRED)/.test(userText.trim())) return
+      const now = Date.now()
+      const prev = lastText.get(userText)
+      if (prev !== undefined && now - prev < TTL) return // dedupe repeats
+      lastText.set(userText, now)
+      if (lastText.size > 64) {
+        // evict oldest
+        let oldestKey = null, oldestVal = Infinity
+        for (const [k, v] of lastText) if (v < oldestVal) { oldestVal = v; oldestKey = k }
+        if (oldestKey) lastText.delete(oldestKey)
+      }
+
+      const py = resolvePy()
+      if (!py) return // no durable interpreter — degrade (never block)
+
+      const capsule = await new Promise((resolve) => {
+        execFile(py, [BRIDGE, userText], { timeout: 15_000 }, (err, stdout) => {
+          resolve(err ? "" : (stdout?.toString() ?? ""))
+        })
+      })
+      if (!capsule.trim()) return
+
+      // Durable fire-trace: one line per ACTUAL injection into an outgoing
+      // model request (handoff §1 proof requirement). Not a canary — this is
+      // standing observability for the bridge's consumer edge.
+      try {
+        appendFileSync("/tmp/rune-bridge-fire.log",
+          JSON.stringify({ ts: new Date().toISOString(), task: userText.slice(0, 80), capsule_tokens: Math.round(capsule.length / 4), py }) + "\n")
+      } catch {}
+
+      // Append the capsule to the LAST user message (the one being answered).
+      const last = output.messages[output.messages.length - 1]
+      if (last?.parts && Array.isArray(last.parts)) {
+        last.parts.push({
+          type: "text",
+          text: "\n\n<rune-preflight>\n" + capsule.trim() + "\n</rune-preflight>\n(Injected by Rune Core builder bridge — deterministic preflight, zero model calls. Relevant state above; ignore if not applicable to this task.)",
+        })
+      }
+    } catch {
+      // never block the builder on bridge failure
+    }
+  },
+}

config/mimo-hooks/event-wait-guard.ts

@@ -0,0 +1,56 @@
+import type { Hooks } from "@mimo-ai/plugin"
+
+// event-wait-guard — RETIRED (T21.5 §6/§8, 2026-09-17).
+//
+// HISTORY: this hook was the T21 §21B-3 runtime interception layer that
+// blocked model-generated sleep→poll continuation (T20 regression), and
+// later carried the T21.1 §21.1C cwd guard. Both were DOWNSTREAM patches:
+// they corrected the model's output instead of fixing the generator.
+//
+// ROOT-CAUSE FIX (T21.5 §2-§5): the generator was ci_event_wait's
+// wait loop returning nonterminal control to the model — caused by a
+// single hard-coded master-deploy authority that was blind to branch/PR
+// operations. T21.5 fixed this upstream:
+//   - OPERATION_SPECS: per-operation-type completion authority
+//     (branch_ci/pull_request_checks -> own Actions runs;
+//     master_ci/deploy/release -> deploy qualification);
+//   - SINGLE LOGICAL AWAIT: all nonterminal conditions re-arm inside
+//     ci_event_wait.run(); the model sees only terminal results;
+//   - structured PendingOperation envelopes (op_type, authority,
+//     internal_rearm_count) propagate to the controller.
+//
+// With the generator fixed, runtime interception is retired per the
+// tranche rule FIXED UPSTREAM BEHAVIOUR > DOWNSTREAM GUARD CORRECTION.
+// Regression prevention lives in the test suite:
+//   tests/test_single_logical_await.py  (no model re-arm contract)
+//   tests/test_ci_event_wait.py         (watchdog=recovery, event=wake)
+//   tests/test_wait_guard_corpus.py     (canonical wait-pattern corpus)
+// NOT as a permanent runtime block. The hook file stays installed as a
+// documented no-op so canonical-source/install parity (test_hook_drift,
+// test_hook_parity) continues to prove the installed runtime matches
+// this repository's canonical state.
+
+export const EventWaitGuard: Hooks = {
+  "tool.execute.before": async (_input, _output) => {
+    // RETIRED — no interception. See history above.
+    return
+  },
+}
+
+export const CwdGuard: Hooks = {
+  "tool.execute.before": async (_input, _output) => {
+    // RETIRED (T21.5 §8) — the harness/construction execution boundary
+    // now resolves project context upstream (execution-context binding).
+    // No runtime refusal. See tests/test_auto_execution_context.py.
+    return
+  },
+}
+
+export const CombinedGuards: Hooks = {
+  "tool.execute.before": async (input, output) => {
+    // Kept as the default export shape; both sub-guards are retired.
+    return
+  },
+}
+
+export default CombinedGuards

config/mimo-tools/await-operation.ts

@@ -0,0 +1,92 @@
+import { tool } from "@mimo-ai/plugin"
+import { execSync } from "child_process"
+
+export default tool({
+    description: "Wait for an external operation (CI, deploy, release) to complete. Call this when you cannot make progress until an external process finishes. You do NOT need to know the sha, op_type, or duration — Rune's controller resolves those from the bound PendingOperation. Just call this when you want to wait.",
+    args: {
+        operation_id: tool.schema.string().optional().describe("Optional: the operation to wait for. If omitted, the controller resolves the current pending operation automatically."),
+        task_id: tool.schema.string().optional().describe("Optional: the active task id (e.g. T4). When provided, resolution is scoped to operations bound to this task — stale global operations are never consulted."),
+        sha: tool.schema.string().optional().describe("OPTIONAL HINT — non-authoritative. The controller uses this only to help resolve which operation you mean."),
+        op_type: tool.schema.string().optional().describe("OPTIONAL HINT — non-authoritative. The controller derives the canonical operation type from repository/Gitea state."),
+        deadline_secs: tool.schema.number().optional().describe("OPTIONAL HINT — non-authoritative. The controller applies governed policy timing. Real user deadlines must be stated in conversation."),
+    },
+    async execute(args) {
+        // INTENT NORMALIZATION — model output is intent; the controller
+        // owns execution semantics. All model args are hints recorded for
+        // observability; canonical truth comes from the bound operation.
+        const parts = []
+        if (args.operation_id) parts.push(`--operation-id ${args.operation_id}`)
+        if (args.task_id) parts.push(`--task-id ${args.task_id}`)
+        if (args.sha) parts.push(`--sha ${args.sha}`)
+        if (args.op_type) parts.push(`--model-op-type ${args.op_type}`)
+        if (args.deadline_secs) parts.push(`--model-deadline ${args.deadline_secs}`)
+        const normCmd = `python3 /mnt/workdrive/issue161-harness/scripts/await_intent_cli.py normalize ${parts.join(" ")}`
+        let norm: any
+        try {
+            const normOut = execSync(normCmd, {
+                cwd: "/mnt/workdrive/issue161-harness",
+                encoding: "utf-8" as const,
+                timeout: 120000,
+                env: { ...process.env, RUNE_WR_ROOT: "/mnt/workdrive/wr-bridge" },
+            })
+            norm = JSON.parse(normOut.trim().split("\n").find((l: string) => l.startsWith("{")) || "{}")
+        } catch (e: any) {
+            return JSON.stringify({ ok: false, stage: "normalization", error: (e.stderr || e.message || "?").slice(0, 300) })
+        }
+        if (norm.normalized === "AMBIGUOUS") {
+            return JSON.stringify({ ok: false, stage: "normalization", ...norm })
+        }
+        if (!norm.normalized) {
+            return JSON.stringify({ ok: false, stage: "normalization", ...norm })
+        }
+        // canonical continuation: stored/derived op_type + POLICY deadline
+        // (the sha for the wait comes from the normalization resolution,
+        // NOT from the model's args)
+        const waitSha = norm.sha_for_wait || args.sha || ""
+        if (!waitSha) {
+            return JSON.stringify({ ok: false, stage: "resolution", error: "no sha resolved for the pending operation", norm })
+        }
+        const cmd = `python3 /mnt/workdrive/issue161-harness/scripts/ci_event_wait.py --sha ${waitSha} --deadline ${norm.deadline_secs} --op-type ${norm.op_type}`
+        try {
+            const result = execSync(cmd, {
+                cwd: "/mnt/workdrive/issue161-harness",
+                timeout: (norm.deadline_secs + 60) * 1000,
+                encoding: "utf-8" as const,
+                env: { ...process.env, DEPLOY_SHA: waitSha, RUNE_WR_ROOT: "/mnt/workdrive/wr-bridge", RUNE_WR_CODE: "/home/nick/.local/share/mimo-wait-resume" },
+            })
+            const jl = result.trim().split("\n").find((l: string) => l.startsWith("{"))
+            const envelope = jl ? JSON.parse(jl) : { ok: false, error: "no output" }
+            return JSON.stringify({
+                ...envelope,
+                normalization: {
+                    model_deadline_ignored: norm.model_deadline_ignored,
+                    model_op_type_ignored: norm.model_op_type_ignored,
+                    model_sha_ignored: !!args.sha && args.sha !== waitSha,
+                    canonical_op_type: norm.op_type,
+                    canonical_authority: norm.authority,
+                    deadline_provenance: norm.deadline_provenance,
+                    matched_by: norm.matched_by || norm.evidence || "auto-resolved",
+                },
+            })
+        } catch (e: any) {
+            const lines = (e.stdout || "").trim().split("\n")
+            const jl = lines.find((l: string) => l.startsWith("{"))
+            if (jl) {
+                const envelope = JSON.parse(jl)
+                return JSON.stringify({
+                    ...envelope,
+                    normalization: {
+                        model_deadline_ignored: norm.model_deadline_ignored,
+                        model_op_type_ignored: norm.model_op_type_ignored,
+                        model_sha_ignored: !!args.sha && args.sha !== waitSha,
+                        canonical_op_type: norm.op_type,
+                        canonical_authority: norm.authority,
+                        deadline_provenance: norm.deadline_provenance,
+                        matched_by: norm.matched_by || norm.evidence || "auto-resolved",
+                    },
+                })
+            }
+            return JSON.stringify({ ok: false, stage: "wait", error: (e.stderr || e.message || "?").slice(0, 300) })
+        }
+    },
+})

config/mimo-tools/bash.ts

@@ -0,0 +1,167 @@
+
+// bash — executes a shell command. PROCESS-OWNERSHIP CONTRACT (v2):
+//
+//   MODE A (tool-owned): the child is launched in its own process group;
+//   stdout/stderr are CAPTURED pipes (never the TUI tty). On timeout or
+//   failure the ENTIRE process group is signalled (SIGTERM, grace,
+//   SIGKILL) so grandchildren cannot survive the invocation, then the
+//   result is finalized. After finalization NO descendant retains a
+//   writer into MiMo's streams.
+//
+//   MODE B (explicitly detached): a command suffixed with " &" that the
+//   user/model intends to outlive the tool (nohup/setsid/disown-style)
+//   is executed via the detached helper: stdin=/dev/null, stdout/stderr
+//   -> durable log file, own session (setsid), no MiMo PTY inheritance.
+//   The tool returns the log path as the durable handle.
+//
+// Wait-intent compilation (sleep/check/poll aimed at a pending operation)
+// is preserved: interception happens at the SEMANTIC level via
+// await_intent route-bash, and a NO-OP for anything that is not a genuine
+// continuation of a live pending operation. Arbitrary shell syntax
+// (quotes, pipes, semicolons) passes through untouched — the router
+// response is only trusted when it carries normalized=true AND
+// ContinuePendingOperation with a concrete operation bound.
+import { tool } from "@mimo-ai/plugin"
+import { spawn, execFile } from "child_process"
+
+const REPO = "/mnt/workdrive/issue161-harness"
+const WR_ROOT = "/mnt/workdrive/wr-bridge"
+
+// ── MODE A: process-group-owned capture execution ──────────────────────
+interface OwnedResult { stdout: string; stderr: string; status: number; timedOut: boolean }
+
+function runOwned(command: string, timeoutMs: number): Promise<OwnedResult> {
+    return new Promise((resolve) => {
+        // /bin/sh -c "command" in its OWN process group (detached:true makes
+        // the child a session/group leader we can signal as a WHOLE).
+        const child = spawn("/bin/sh", ["-c", command], {
+            cwd: REPO,
+            stdio: ["ignore", "pipe", "pipe"],   // NEVER inherit the TUI tty
+            env: process.env,
+            detached: true,                      // own process group
+        })
+        let stdout = "", stderr = ""
+        let timedOut = false
+        let settled = false
+        const outChunks: Buffer[] = []
+        const errChunks: Buffer[] = []
+        child.stdout!.on("data", (d) => outChunks.push(d))
+        child.stderr!.on("data", (d) => errChunks.push(d))
+
+        const killGroup = (sig: NodeJS.Signals) => {
+            try { process.kill(-child.pid!, sig) } catch { /* already gone */ }
+        }
+        const finalize = (status: number) => {
+            if (settled) return
+            settled = true
+            clearTimeout(timer)
+            // detach listeners, then resolve — no late listeners remain
+            child.stdout!.removeAllListeners()
+            child.stderr!.removeAllListeners()
+            resolve({ stdout: Buffer.concat(outChunks).toString(), stderr: Buffer.concat(errChunks).toString(), status, timedOut })
+        }
+        const timer = setTimeout(() => {
+            timedOut = true
+            killGroup("SIGTERM")
+            // bounded grace for clean shutdown, then SIGKILL the group
+            setTimeout(() => killGroup("SIGKILL"), 2000)
+            // the exit/close event settles; a hard stop-guard settles anyway
+            setTimeout(() => finalize(124), 4000)
+        }, timeoutMs)
+
+        child.on("error", (e) => finalize(-1))
+        child.on("close", (code) => finalize(code ?? -1))
+    })
+}
+
+// ── MODE B: explicit detachment for "cmd &" invocations ────────────────
+function runDetached(command: string): Promise<string> {
+    return new Promise((resolve) => {
+        const logPath = `/tmp/mimo-detached-${Date.now()}-${Math.floor(Math.random() * 1e6)}.log`
+        const out = `exec >>"${logPath}" 2>&1; exec 0</dev/null; ${command}`
+        const child = spawn("/bin/sh", ["-c", `setsid /bin/sh -c '${out.replace(/'/g, `'\\''`)}'`], {
+            cwd: REPO,
+            stdio: "ignore",     // child rebinds its own fds — no PTY inheritance
+            env: process.env,
+            detached: true,
+            // unref: MiMo's event loop does not wait for it
+        })
+        child.unref()
+        resolve(JSON.stringify({
+            detached: true,
+            log: logPath,
+            note: "process detached (setsid, own fds); output streams to the log file only; fd 0/1/2 do NOT reference the MiMo tty",
+        }))
+    })
+}
+
+// ── wait-intent routing (semantic level, preserved from v1) ────────────
+async function tryCompileWaitIntent(command: string): Promise<string | null> {
+    let routeOut: string
+    try {
+        routeOut = await new Promise<string>((resolve, reject) => {
+            execFile("python3", [`${REPO}/scripts/await_intent_cli.py`, "route-bash", "--command", command], {
+                cwd: REPO, timeout: 60000, encoding: "utf-8",
+                env: { ...process.env, RUNE_WR_ROOT: WR_ROOT },
+                maxBuffer: 8 * 1024 * 1024,
+            }, (err, stdout) => { if (err && !stdout) reject(err); else resolve(stdout || "") })
+        })
+    } catch {
+        return null // router unavailable: normal execution (never block on routing)
+    }
+    const jl = routeOut.trim().split("\n").find((l) => l.startsWith("{"))
+    if (!jl) return null
+    let norm: any
+    try { norm = JSON.parse(jl) } catch { return null }
+    // STRICT gate: compile ONLY a normalized, concrete continuation.
+    if (!(norm.normalized === true &&
+          norm.action === "ContinuePendingOperation" &&
+          norm.operation_id && norm.sha_for_wait)) return null
+    const waitCmd = `python3 ${REPO}/scripts/ci_event_wait.py --sha ${norm.sha_for_wait} --deadline ${norm.deadline_secs} --op-type ${norm.op_type}`
+    const r = await runOwned(waitCmd, (norm.deadline_secs + 60) * 1000)
+    const jline = r.stdout.trim().split("\n").find((l) => l.startsWith("{"))
+    if (jline) {
+        return JSON.stringify({
+            ...JSON.parse(jline),
+            intent_compilation: {
+                raw_command_kind: norm.raw_command_kind || "sleep_poll",
+                literal_sleep_executed: false,
+                operation_id: norm.operation_id,
+                canonical_op_type: norm.op_type,
+                authority: norm.authority,
+            },
+        })
+    }
+    return JSON.stringify({ ok: false, stage: "compiled-wait", error: (r.stderr || "no output").slice(0, 300) })
+}
+
+export default tool({
+    description: "Run a shell command. If the command expresses external wait intent (sleep/check/poll aimed at CI, deploy, or release operations with pending operations), it is automatically compiled to Rune's event-driven continuation — you do not need to manage wait mechanics. Plain local commands execute normally. Commands ending in ' &' run detached with output logged to a file.",
+    args: {
+        command: tool.schema.string().describe("Shell command to run"),
+    },
+    async execute(args) {
+        // 1. wait-intent compilation (semantic, strict-gated)
+        try {
+            const compiled = await tryCompileWaitIntent(args.command)
+            if (compiled !== null) return compiled
+        } catch { /* fall through to normal execution */ }
+
+        // 2. MODE B: explicit detachment for backgrounded invocations
+        const cmd = args.command
+        if (/\b(nohup|setsid)\b/.test(cmd) || /&\s*$/.test(cmd)) {
+            return await runDetached(cmd)
+        }
+
+        // 3. MODE A: tool-owned, group-killed, captured execution
+        const r = await runOwned(cmd, 120000)
+        const text = r.stdout + (r.stderr ? `\n[stderr]\n${r.stderr}` : "")
+        if (r.timedOut) {
+            return `exit timed-out (process group terminated): ${text.slice(0, 500)}`
+        }
+        if (r.status !== 0) {
+            return `exit ${r.status}: ${text.slice(0, 500) || "?"}`
+        }
+        return text || "(no output)"
+    },
+})

config/umbrellas.json

@@ -1,223 +1,273 @@
 {
-  "_comment": "Umbrella impact map \u2014 the change-propagation graph. Every src/rune/*.py and shared/*.py module MUST appear in exactly one umbrella's modules list (enforced by the umbrella_manifest_is_complete henxel; debt-tracked modules allowed via docs/module-coverage-debt.md). depends_on: when umbrella U changes, its dependents' canaries are required gates. mirrors: files that must travel together in the same PR (enforced by scripts/umbrella_impact.py unless the PR carries 'Propagation-waived: <reason>').",
-  "umbrellas": {
-    "memory": {
-      "description": "Storing, retrieving, and managing knowledge",
-      "modules": [
-        "memory_store",
-        "memory_consolidation",
-        "memory_env",
-        "shard_manager",
-        "query_memory",
-        "graph_memory",
-        "warm_neuron_store",
-        "abstraction",
-        "cache",
-        "recall_router",
-        "drift_cache",
-        "drift_compression",
-        "tier_manager",
-        "graph_shard_bridge",
-        "memory_selector",
-        "retrieval_benchmark"
-      ],
-      "canaries": [
-        "canary_query_memory",
-        "canary_memory_synthesis",
-        "canary_full_system"
-      ],
-      "depends_on": [
-        "governance"
-      ]
-    },
-    "governance": {
-      "description": "Quality control, drift detection, promotion, audit",
-      "modules": [
-        "drift_core",
-        "drift_observability",
-        "drift_ledger",
-        "audit_ledger",
-        "curator",
-        "claim_audit",
-        "contracts",
-        "build_pipeline_policy",
-        "failure_auto_filer"
-      ],
-      "canaries": [
-        "canary_full_system",
-        "canary_schema_migration"
-      ],
-      "depends_on": []
-    },
-    "identity": {
-      "description": "Who the agent is \u2014 persona, voice, anchors",
-      "modules": [
-        "persona_definition",
-        "persona_gate",
-        "identity_anchors",
-        "voice_hybrid",
-        "voice_sync",
-        "voicebox",
-        "voice_injector",
-        "behavior",
-        "prompt_sync"
-      ],
-      "canaries": [
-        "canary_full_system"
-      ],
-      "depends_on": [
-        "governance"
-      ]
-    },
-    "growth": {
-      "description": "Learning and improvement",
-      "modules": [
-        "self_improve",
-        "subconscious_pass",
-        "goal",
-        "elastic_cognition",
-        "growth_delta",
-        "autonomy_loop",
-        "cognitive_loop",
-        "dream_cycle",
-        "growth_simulator"
-      ],
-      "canaries": [
-        "canary_full_system"
-      ],
-      "depends_on": [
-        "memory",
-        "governance"
-      ]
-    },
-    "perception": {
-      "description": "Input processing and context assembly",
-      "modules": [
-        "context_broker",
-        "context_pressure",
-        "attention_capsule",
-        "auto_context",
-        "auto_tasks",
-        "witness",
-        "salience_gate",
-        "cognitive_budgeter",
-        "complexity_scorer"
-      ],
-      "canaries": [
-        "canary_context_broker",
-        "canary_full_system"
-      ],
-      "depends_on": [
-        "memory"
-      ]
-    },
-    "capability": {
-      "description": "Tool selection and execution authority",
-      "modules": [
-        "capability_broker",
-        "tool_executor",
-        "tool_protocol",
-        "local_tool_runtime",
-        "forge_client",
-        "message_queue",
-        "connection_pool",
-        "adaptive_router",
-        "route_risk_flags",
-        "evidence_probe",
-        "builder_bridge",
-        "builder_bridge_cli",
-        "recall_uplift"
-      ],
-      "canaries": [
-        "canary_p1_01",
-        "canary_p0_05",
-        "canary_native"
-      ],
-      "depends_on": [
-        "memory"
-      ]
-    },
-    "inference": {
-      "description": "Model routing and outbound requests",
-      "modules": [
-        "model_routing",
-        "model_profiles",
-        "model_registry",
-        "model_connect",
-        "provider_registry",
-        "provider_budget",
-        "standardized_providers",
-        "inference_trace",
-        "response_adapter",
-        "token_optimizer"
-      ],
-      "canaries": [
-        "canary_p1_06",
-        "canary_p1_02",
-        "canary_resource_authority"
-      ],
-      "depends_on": [
-        "capability"
-      ]
-    },
-    "orchestration": {
-      "description": "Task lifecycle, operator, TUI presentation",
-      "modules": [
-        "rune_operator",
-        "rune_tui",
-        "rune_graphic",
-        "rune_spinner",
-        "rune_profiler",
-        "chat_bubble",
-        "message_widgets",
-        "tui_validator",
-        "microkernel",
-        "event_bus",
-        "event_envelope",
-        "hook_engine",
-        "system_registry",
-        "cron_engine",
-        "task_gate",
-        "task_persist",
-        "work_manager",
-        "parallel_processor",
-        "tiered_executor",
-        "time_awareness",
-        "night_mode",
-        "pins",
-        "progressive_escalation",
-        "safety_override",
-        "sleep_time",
-        "verification_layer",
-        "outcome_ledger",
-        "warm_router",
-        "subsystem_health",
-        "build_mode",
-        "dependency_tracker",
-        "auto_detect",
-        "build_orchestrator",
-        "custodian",
-        "gitea_auth",
-        "gitea_pipeline",
-        "gitea_provision",
-        "umbrella_update"
-      ],
-      "canaries": [
-        "canary_p1_07",
-        "canary_orchestration_foundation",
-        "canary_conversation_state",
-        "canary_gitea_pipeline",
-        "canary_tui_drift",
-        "canary_cognitive_strata",
-        "canary_surface_parity"
-      ],
-      "depends_on": [
-        "perception",
-        "capability",
-        "inference",
-        "identity",
-        "growth"
-      ]
-    }
+ "_comment": "GENERATED by rune.spine \u2014 compatibility view for legacy umbrella consumers. DO NOT EDIT: structural truth lives in store/spine/current.json; edits here are flagged by spine drift.",
+ "_generated_by_spine": true,
+ "generated_at": "2026-09-16T18:23:38Z",
+ "umbrellas": {
+  "capability": {
+   "description": "Tool selection and execution authority",
+   "modules": [
+    "adaptive_router",
+    "builder_bridge",
+    "builder_bridge_cli",
+    "capability_broker",
+    "connection_pool",
+    "evidence_probe",
+    "forge",
+    "forge_client",
+    "intent_continuity",
+    "local_tool_runtime",
+    "message_queue",
+    "native_units",
+    "openai_compat_transport",
+    "provider_context",
+    "recall_uplift",
+    "route_risk_flags",
+    "tool_executor",
+    "tool_protocol"
+   ],
+   "depends_on": [
+    "memory"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_native",
+    "canary_p0_05",
+    "canary_p1_01"
+   ]
+  },
+  "governance": {
+   "description": "Quality control, drift detection, promotion, audit",
+   "modules": [
+    "audit_ledger",
+    "build_pipeline_policy",
+    "claim_audit",
+    "contracts",
+    "curator",
+    "drift_core",
+    "drift_ledger",
+    "drift_observability",
+    "failure_auto_filer",
+    "programme_gates"
+   ],
+   "depends_on": [],
+   "mirrors": [],
+   "canaries": [
+    "canary_full_system",
+    "canary_schema_migration"
+   ]
+  },
+  "growth": {
+   "description": "Learning and improvement",
+   "modules": [
+    "autonomy_loop",
+    "cognitive_loop",
+    "dream_cycle",
+    "elastic_cognition",
+    "goal",
+    "growth_delta",
+    "growth_simulator",
+    "self_improve",
+    "subconscious_pass"
+   ],
+   "depends_on": [
+    "governance",
+    "memory"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_full_system"
+   ]
+  },
+  "identity": {
+   "description": "Who the agent is \u2014 persona, voice, anchors",
+   "modules": [
+    "behavior",
+    "identity_anchors",
+    "persona_definition",
+    "persona_gate",
+    "prompt_sync",
+    "voice_hybrid",
+    "voice_injector",
+    "voice_sync",
+    "voicebox"
+   ],
+   "depends_on": [
+    "governance"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_full_system"
+   ]
+  },
+  "inference": {
+   "description": "Model routing and outbound requests",
+   "modules": [
+    "inference_trace",
+    "model_connect",
+    "model_profiles",
+    "model_registry",
+    "model_routing",
+    "provider_budget",
+    "provider_registry",
+    "response_adapter",
+    "standardized_providers",
+    "token_optimizer"
+   ],
+   "depends_on": [
+    "capability"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_p1_02",
+    "canary_p1_06",
+    "canary_resource_authority"
+   ]
+  },
+  "memory": {
+   "description": "Storing, retrieving, and managing knowledge",
+   "modules": [
+    "abstraction",
+    "cache",
+    "drift_cache",
+    "drift_compression",
+    "graph_memory",
+    "graph_shard_bridge",
+    "memory_consolidation",
+    "memory_env",
+    "memory_selector",
+    "memory_store",
+    "query_memory",
+    "recall_router",
+    "retrieval_benchmark",
+    "shard_manager",
+    "tier_manager",
+    "warm_neuron_store"
+   ],
+   "depends_on": [
+    "governance"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_full_system",
+    "canary_memory_synthesis",
+    "canary_query_memory"
+   ]
+  },
+  "orchestration": {
+   "description": "Task lifecycle, operator, TUI presentation",
+   "modules": [
+    "auto_detect",
+    "build_mode",
+    "build_orchestrator",
+    "chat_bubble",
+    "cron_engine",
+    "custodian",
+    "dependency_tracker",
+    "event_bus",
+    "event_envelope",
+    "gitea_auth",
+    "gitea_pipeline",
+    "gitea_provision",
+    "hook_engine",
+    "message_widgets",
+    "microkernel",
+    "night_mode",
+    "outcome_ledger",
+    "parallel_processor",
+    "pins",
+    "progressive_escalation",
+    "rune_graphic",
+    "rune_operator",
+    "rune_profiler",
+    "rune_spinner",
+    "rune_tui",
+    "safety_override",
+    "sleep_time",
+    "subsystem_health",
+    "system_registry",
+    "task_gate",
+    "task_persist",
+    "tiered_executor",
+    "time_awareness",
+    "tui_validator",
+    "umbrella_update",
+    "verification_layer",
+    "warm_router",
+    "work_manager"
+   ],
+   "depends_on": [
+    "capability",
+    "growth",
+    "identity",
+    "inference",
+    "perception"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_cognitive_strata",
+    "canary_conversation_state",
+    "canary_gitea_pipeline",
+    "canary_orchestration_foundation",
+    "canary_p1_07",
+    "canary_surface_parity",
+    "canary_tui_drift"
+   ]
+  },
+  "perception": {
+   "description": "Input processing and context assembly",
+   "modules": [
+    "attention_capsule",
+    "auto_context",
+    "auto_tasks",
+    "behaviour_ledger",
+    "build_basis",
+    "capability_fit",
+    "capability_ledger",
+    "cognitive_budgeter",
+    "construction_activation",
+    "construction_commands",
+    "construction_decision",
+    "construction_depth",
+    "construction_intent",
+    "construction_interface",
+    "construction_mode",
+    "construction_pattern",
+    "construction_patterns_builtin",
+    "construction_projection",
+    "context_broker",
+    "context_pressure",
+    "drift_resume",
+    "event_wait",
+    "failure_recovery",
+    "graph_projection",
+    "impact_preview",
+    "iteration",
+    "layout_contract",
+    "programme_continuation",
+    "project_registry",
+    "release_notes",
+    "salience_gate",
+    "scaffold",
+    "spine",
+    "stage_guards",
+    "structural_migration",
+    "structural_model",
+    "structural_store",
+    "testing_mode",
+    "toolchain",
+    "tui_backlog",
+    "wait_guard",
+    "wait_guard_corpus",
+    "witness"
+   ],
+   "depends_on": [
+    "memory"
+   ],
+   "mirrors": [],
+   "canaries": [
+    "canary_context_broker",
+    "canary_full_system"
+   ]
   }
+ }
 }

config/umbrellas.manual.json

@@ -0,0 +1,225 @@
+{
+  "_comment": "Umbrella impact map \u2014 the change-propagation graph. Every src/rune/*.py and shared/*.py module MUST appear in exactly one umbrella's modules list (enforced by the umbrella_manifest_is_complete henxel; debt-tracked modules allowed via docs/module-coverage-debt.md). depends_on: when umbrella U changes, its dependents' canaries are required gates. mirrors: files that must travel together in the same PR (enforced by scripts/umbrella_impact.py unless the PR carries 'Propagation-waived: <reason>').",
+  "umbrellas": {
+    "memory": {
+      "description": "Storing, retrieving, and managing knowledge",
+      "modules": [
+        "memory_store",
+        "memory_consolidation",
+        "memory_env",
+        "shard_manager",
+        "query_memory",
+        "graph_memory",
+        "warm_neuron_store",
+        "abstraction",
+        "cache",
+        "recall_router",
+        "drift_cache",
+        "drift_compression",
+        "tier_manager",
+        "graph_shard_bridge",
+        "memory_selector",
+        "retrieval_benchmark"
+      ],
+      "canaries": [
+        "canary_query_memory",
+        "canary_memory_synthesis",
+        "canary_full_system"
+      ],
+      "depends_on": [
+        "governance"
+      ]
+    },
+    "governance": {
+      "description": "Quality control, drift detection, promotion, audit",
+      "modules": [
+        "drift_core",
+        "drift_observability",
+        "drift_ledger",
+        "audit_ledger",
+        "curator",
+        "claim_audit",
+        "contracts",
+        "build_pipeline_policy",
+        "failure_auto_filer"
+      ],
+      "canaries": [
+        "canary_full_system",
+        "canary_schema_migration"
+      ],
+      "depends_on": []
+    },
+    "identity": {
+      "description": "Who the agent is \u2014 persona, voice, anchors",
+      "modules": [
+        "persona_definition",
+        "persona_gate",
+        "identity_anchors",
+        "voice_hybrid",
+        "voice_sync",
+        "voicebox",
+        "voice_injector",
+        "behavior",
+        "prompt_sync"
+      ],
+      "canaries": [
+        "canary_full_system"
+      ],
+      "depends_on": [
+        "governance"
+      ]
+    },
+    "growth": {
+      "description": "Learning and improvement",
+      "modules": [
+        "self_improve",
+        "subconscious_pass",
+        "goal",
+        "elastic_cognition",
+        "growth_delta",
+        "autonomy_loop",
+        "cognitive_loop",
+        "dream_cycle",
+        "growth_simulator"
+      ],
+      "canaries": [
+        "canary_full_system"
+      ],
+      "depends_on": [
+        "memory",
+        "governance"
+      ]
+    },
+    "perception": {
+      "description": "Input processing and context assembly",
+      "modules": [
+        "context_broker",
+        "context_pressure",
+        "attention_capsule",
+        "auto_context",
+        "auto_tasks",
+        "witness",
+        "salience_gate",
+        "cognitive_budgeter",
+        "complexity_scorer"
+      ],
+      "canaries": [
+        "canary_context_broker",
+        "canary_full_system"
+      ],
+      "depends_on": [
+        "memory"
+      ]
+    },
+    "capability": {
+      "description": "Tool selection and execution authority",
+      "modules": [
+        "capability_broker",
+        "tool_executor",
+        "tool_protocol",
+        "local_tool_runtime",
+        "intent_continuity",
+        "openai_compat_transport",
+        "forge_client",
+        "message_queue",
+        "connection_pool",
+        "adaptive_router",
+        "route_risk_flags",
+        "evidence_probe",
+        "builder_bridge",
+        "builder_bridge_cli",
+        "recall_uplift"
+      ],
+      "canaries": [
+        "canary_p1_01",
+        "canary_p0_05",
+        "canary_native"
+      ],
+      "depends_on": [
+        "memory"
+      ]
+    },
+    "inference": {
+      "description": "Model routing and outbound requests",
+      "modules": [
+        "model_routing",
+        "model_profiles",
+        "model_registry",
+        "model_connect",
+        "provider_registry",
+        "provider_budget",
+        "standardized_providers",
+        "inference_trace",
+        "response_adapter",
+        "token_optimizer"
+      ],
+      "canaries": [
+        "canary_p1_06",
+        "canary_p1_02",
+        "canary_resource_authority"
+      ],
+      "depends_on": [
+        "capability"
+      ]
+    },
+    "orchestration": {
+      "description": "Task lifecycle, operator, TUI presentation",
+      "modules": [
+        "rune_operator",
+        "rune_tui",
+        "rune_graphic",
+        "rune_spinner",
+        "rune_profiler",
+        "chat_bubble",
+        "message_widgets",
+        "tui_validator",
+        "microkernel",
+        "event_bus",
+        "event_envelope",
+        "hook_engine",
+        "system_registry",
+        "cron_engine",
+        "task_gate",
+        "task_persist",
+        "work_manager",
+        "parallel_processor",
+        "tiered_executor",
+        "time_awareness",
+        "night_mode",
+        "pins",
+        "progressive_escalation",
+        "safety_override",
+        "sleep_time",
+        "verification_layer",
+        "outcome_ledger",
+        "warm_router",
+        "subsystem_health",
+        "build_mode",
+        "dependency_tracker",
+        "auto_detect",
+        "build_orchestrator",
+        "custodian",
+        "gitea_auth",
+        "gitea_pipeline",
+        "gitea_provision",
+        "umbrella_update"
+      ],
+      "canaries": [
+        "canary_p1_07",
+        "canary_orchestration_foundation",
+        "canary_conversation_state",
+        "canary_gitea_pipeline",
+        "canary_tui_drift",
+        "canary_cognitive_strata",
+        "canary_surface_parity"
+      ],
+      "depends_on": [
+        "perception",
+        "capability",
+        "inference",
+        "identity",
+        "growth"
+      ]
+    }
+  }
+}

config/v1_authority_map.json

@@ -104,15 +104,15 @@
         },
         {
           "path": "src/rune/attention_capsule.py",
-          "role": "AttentionCapsule — the typed ledger of admitted blocks the model receives (to_messages re-derives the runtime payload)",
+          "role": "AttentionCapsule \u2014 the typed ledger of admitted blocks the model receives (to_messages re-derives the runtime payload)",
           "disposition": "retain-authority",
-          "evidence": "P1-02 (#25): the capsule IS the product the model receives — the broker renders admitted blocks into it, the safety override mutates its user block in place (re-measured), runtime.run consumes capsule.to_messages(), and the trace v4 capsule_messages/capsule_content_hashes prove the logged capsule EXACTLY equals the sent payload. Legacy create_capsule/to_prompt (string-trim fake budgeting) deprecated with no live callers."
+          "evidence": "P1-02 (#25): the capsule IS the product the model receives \u2014 the broker renders admitted blocks into it, the safety override mutates its user block in place (re-measured), runtime.run consumes capsule.to_messages(), and the trace v4 capsule_messages/capsule_content_hashes prove the logged capsule EXACTLY equals the sent payload. Legacy create_capsule/to_prompt (string-trim fake budgeting) deprecated with no live callers."
         },
         {
           "path": "src/rune/inference_trace.py",
           "role": "Durable per-run inference trace (tokens served/estimated, output, latency, per-block visibility)",
           "disposition": "migrate-adapter",
-          "evidence": "P0-07 (#23): persists what ContextBroker (#19) assembled and what the transport served — builds FROM the broker trace, never re-measures; store state/inference_traces.jsonl."
+          "evidence": "P0-07 (#23): persists what ContextBroker (#19) assembled and what the transport served \u2014 builds FROM the broker trace, never re-measures; store state/inference_traces.jsonl."
         }
       ]
     },
@@ -160,13 +160,13 @@
           "path": "src/rune/capability_broker.py",
           "role": "Authoritative capability selector (select_for_job + verified floor + find_capability escape hatch)",
           "disposition": "retain-authority",
-          "evidence": "P1-01 (#24): select_for_job is the single selection authority — its ordered decision feeds LocalToolRuntime(tools=) at both construction sites and the _contributor_tools prompt block; degrade-not-crash falls back to full TOOLS with a tier-1 record_failure."
+          "evidence": "P1-01 (#24): select_for_job is the single selection authority \u2014 its ordered decision feeds LocalToolRuntime(tools=) at both construction sites and the _contributor_tools prompt block; degrade-not-crash falls back to full TOOLS with a tier-1 record_failure."
         },
         {
           "path": "memory/index/capability_cards.json",
           "role": "Capability-card index (rebuilt on empty/stale/corrupt; native cards synthesized from TOOLS metadata)",
           "disposition": "migrate-adapter",
-          "evidence": "P1-01 (#24): load_cards validates and rebuilds — the packaged empty array no longer passes as an index; cards carry risk/preconditions/side_effects copied from tool_executor.TOOLS."
+          "evidence": "P1-01 (#24): load_cards validates and rebuilds \u2014 the packaged empty array no longer passes as an index; cards carry risk/preconditions/side_effects copied from tool_executor.TOOLS."
         },
         {
           "path": "src/rune/local_tool_runtime.py",
@@ -486,12 +486,6 @@
           "disposition": "retain-authority",
           "evidence": "Defines the owner-approved canary-first Gitea sequence."
         },
-        {
-          "path": "src/rune/plugins/build_mode/__init__.py",
-          "role": "Checkpoint/ledger state-machine primitive used by current governed builds",
-          "disposition": "migrate-adapter",
-          "evidence": "Persists checkpoints but encodes an older phase order."
-        },
         {
           "path": "src/rune/build_mode.py",
           "role": "Separate BuildManager and worktree engine",
@@ -504,6 +498,9 @@
           "disposition": "archive-candidate",
           "evidence": "Reports fixed success strings for phases without executing their claimed effects."
         }
+      ],
+      "notes": [
+        "T17 17U: plugin BuildStateMachine deleted (zero importers; second parallel orchestrator)"
       ]
     },
     {
@@ -540,4 +537,4 @@
       ]
     }
   ]
-}
+}

docs/GITEA_ISSUE_RECONCILIATION.md

@@ -111,3 +111,31 @@ subsystem): fetches live issue state, compares to
 - record lacking a required field
 
 Exit 0 = consistent; exit 1 = drift listed. CI-eligible (read-only).
+
+
+## PL1 held-out era reconciliation (2026-09-12)
+
+Fresh-session reconciliation of the ADAPT family against deployed 0.66.22
+@ 1497c85 + live PL1 held-out evidence (tasks task_2661189c9073,
+task_6e4885031355; ledger PE-9207213099-0270). Resolves the recorded tension:
+"ADAPT-LIVE complete → return target PL1" (the bounded tranche authorized
+2026-09-10 is complete) while numbered ADAPT issues remain open (the larger
+backlog was never in the ADAPT-LIVE tranche scope).
+
+| # | state | evidence / basis |
+|---|---|---|
+| 284 | VALID_OPEN | epic tracker for the remaining sub-items below |
+| 292 | FIXED_VERIFIED (closed) | LOCAL_FIX fast path live (rune_operator.py:522,541); live-proven twice by the held-out tasks |
+| 293 | FIXED_VERIFIED (closed) | DESIGN-LITE implemented (rune_operator.py:660, cites #293), wired to STANDARD_CHANGE; suite+canary green |
+| 294 | DEFERRED_FUTURE | canonical remaining-obligations list ("ADAPT-5 budgets... for later epics") |
+| 295 | DEFERRED_FUTURE | canonical remaining-obligations list |
+| 296 | DEFERRED_FUTURE | canonical remaining-obligations list |
+| 297 | FIXED_VERIFIED (closed) | task_gate implemented (src/rune/task_gate.py) + broker wiring + canary registration |
+| 299 | DEFERRED_FUTURE | canonical remaining-obligations list |
+| 300 | VALID_OPEN | escalation mechanism exists (_probe_and_escalate); fresh deployed acceptance evidence pending |
+| 301 | DEFERRED_FUTURE | canonical remaining-obligations list (FINAL-12) |
+| 315 | VALID_OPEN | not started; ADAPT-1 sub-item (no canonical deferral authority) |
+| 316 | VALID_OPEN | not started; ADAPT-1 sub-item (no canonical deferral authority) |
+
+Consistency checker: `scripts/gitea_reconciliation_check.py` → exit 0
+(72 records, 100 live issues in window) after these updates.

docs/RELEASE_POLICY.md

@@ -0,0 +1,53 @@
+# Rune Semantic Release Policy (T20 §20B)
+
+Pre-1.0 convention. Scaffolding "V1" does NOT mean Rune 1.0.
+
+## Bump kinds
+
+**PATCH** (0.66.80 → 0.66.81):
+- bug fix, correction, implementation/internal maintenance
+- no meaningful new user/system capability
+
+**MINOR** (0.66.80 → 0.67.0):
+- meaningful new Rune capability
+- new subsystem functionality
+- materially expanded system behaviour
+- significant new supported workflow
+
+**MAJOR**: reserved for Rune 1.0+ compatibility/public-contract semantics.
+
+## How the machinery expresses this (no manual version edits)
+
+The existing machinery already maps commit shape → bump kind:
+- `semver_bump.next_version` (PR titles): feat→minor, else patch
+- `version_convergence.highest_warranted_bump` (push ranges):
+  feat/breaking→minor, fix/perf→patch, else None
+
+**Tranche-level rule (20B)**: a feature tranche lands its feature
+commits (`feat(...)`), and the convergence machinery bumps MINOR at
+the tranche's release boundary. Patch-only follow-ups (fix/perf)
+warrant only PATCH — the machinery cannot accidentally re-minor
+because `highest_warranted_bump` takes the max over the *post-
+boundary* range, and a fix-only range yields "patch".
+
+## Why T20 → 0.67.0
+
+T20 is a feature-level tranche (Rune-wide retrofit: structural
+taxonomy, capability/behaviour ledgers, rune graph, /testing backlog,
+Spine modernization, semantic release). The release is classified
+MINOR under this policy, earned through the governed convergence
+machinery — never a manual version edit.
+
+## T20 0.67.0 release record
+T20 classified MINOR under this policy: Rune-wide retrofit (structural
+taxonomy, capability/behaviour ledgers, rune graph, /testing backlog,
+Spine modernization, semantic release) = new subsystem functionality +
+materially expanded system behaviour. Earned through the governed
+convergence machinery (feat-bearing range → minor), never a manual edit.
+
+## Root cause record (T20, 2026-09-16)
+semver_bump re-derived the bump kind from the SYNTHESIZED title text —
+"minor: converged release" matched nothing → patch. Feature tranches
+T18/T19/T20 downgraded to 0.66.77-83. Fixed: MINOR_PREFIX_RE carries the
+convergence kind through; first push after the fix with a feat-bearing
+range lands 0.67.0 through the normal machinery.

docs/RUNE_CANONICAL_INTENT_STATE.md

@@ -54,7 +54,7 @@ This detour is complete when:
 
 ## RETURN TARGET / CURRENT: PL1 Process Learning — FIRST TRANCHE LIVE (2026-09-11)
 
-PL1-01 structured Experience records: `scripts/pl1_records.py` (task_id, route resolved from route.jsonl, proof level, failure class, candidate status). PL1-02 failure classification in the PL0 vocabulary (research_dispatch, NOT_COMPLETED_NO_MUTATION_EVIDENCE, verification_failure, model_refusal, UNKNOWN). PL1-03 first learning loop: recurring prose-instead-of-mutation family → structural correction (route-driven instruction in the user context block) + replay contract (NOT_COMPLETED gate) — record PE-1789102658-0269 (SEED; held-out = next deployed mutation tasks must complete-with-evidence or fail honestly). PL1-04 promotion discipline: SEED→CANDIDATE→VALIDATED→PROMOTED via process_experience; structural fixes preferred. PL1-05 metrics: first_pass_accepted, mutation_failures, research_dispatches, false_completion_rate (0.0 — structurally prevented), candidates vs evidence-only split.
+PL1-01 structured Experience records: `scripts/pl1_records.py` (task_id, route resolved from route.jsonl, proof level, failure class, candidate status). PL1-02 failure classification in the PL0 vocabulary (research_dispatch, NOT_COMPLETED_NO_MUTATION_EVIDENCE, verification_failure, model_refusal, UNKNOWN). PL1-03 first learning loop: recurring prose-instead-of-mutation family → structural correction (route-driven instruction in the user context block) + replay contract (NOT_COMPLETED gate) — record PE-1789102658-0269 (SEED 2026-09-11 → VALIDATED 2026-09-12: two fresh deployed held-out mutation tasks completed-with-evidence — task_2661189c9073 + task_6e4885031355, LOCAL_FIX, Verboo-pinned, mutation + exit-code verification, ledger PE-9207213099-0270; substrate corrections 6965fc7 flat-ChatMessage contract + a2463ad resume transport selection applied between; caveat: corrections developer-applied structurally, not autonomous self-modification; PROMOTED requires repetition/soak). PL1-04 promotion discipline: SEED→CANDIDATE→VALIDATED→PROMOTED via process_experience; structural fixes preferred. PL1-05 metrics: first_pass_accepted, mutation_failures, research_dispatches, false_completion_rate (0.0 — structurally prevented), candidates vs evidence-only split.
 
 Remaining ADAPT obligations for later epics: ADAPT-5 budgets, ADAPT-6 evidence capsule, ADAPT-7 DESIGN consolidation, ADAPT-10 legibility, FINAL-12 cross-track benchmark, D7 release-job-on-Pi.
 
@@ -177,3 +177,13 @@ Root causes (live-proven T15 Part F, 2026-09-11 evening):
 Live proof: experiment A (trigger d68fd1e, warranted patch) → exactly one
 bump commit a4afc77 (0.66.11), all five surfaces in one commit, queue
 drained, zero delayed duplicates, zero workflow failures.
+
+## Local CI tooling (developer-side, NOT Rune runtime): W/R-v0.3 reactive wake (2026-09-12)
+
+The desktop gitea-runner (v3.3.0) now runs `host.post_task_script` = `/usr/local/bin/gitea-wr-wake.sh`
+after every job: a sub-second fire-and-forget POST to the local W/R daemon (`127.0.0.1:8791/wake`),
+which sweeps waiting external waits through AUTHORITATIVE Gitea verification (bounded retry for the
+reporter-ack window; 60s reconciler demoted to fallback). Runner event ≠ success proof. Config:
+`/etc/gitea-desktop-runner/config.yaml` (backup: config.yaml.pre-wr03). Measured: terminal→verified
+wait transition ~2s (was 0-30s polling). INTERACTIVE_AUTO_RESUME remains NOT YET SAFE (no supported
+MiMo busy/idle signal) — headless-only dispatch, unchanged.

docs/SCAFFOLDING.md

@@ -0,0 +1,275 @@
+# Scaffolding V1 — Tranche 1
+
+_2026-09-12. Scaffolding is the controlled need-to-capability system: NEED →
+DISCOVERY → GAP → REUSE/ACQUIRE/BUILD → IMPACT+PLAN → SAFE IMPLEMENTATION →
+VERIFICATION → PROVISIONAL USE → TRUST/REVISE/RETIRE → REUSABLE CAPABILITY.
+Tranche 1 is deliberately narrower: make Rune stop rediscovering how Rune is
+built every time Rune changes._
+
+## Tranche 1 contract
+
+`scripts/scaffold_projection.py` — a PROJECTION over existing authorities,
+never a new one:
+
+| question | authority projected |
+|---|---|
+| what subsystem owns X? | `config/umbrellas.json` (umbrella manifest + henxel-enforced completeness) |
+| what does X depend on? | AST import graph over `src/rune/*.py` (incl. relative/lazy imports) |
+| who consumes X? | reverse import edges |
+| what changes if X changes? | mirrors + `depends_on` umbrellas + consumers |
+| what proof obligations arise? | unit-test file, canary registry, umbrella gates, suite/lint/henxels |
+| which are satisfied? | filesystem + registry evidence (static); suite/ratchet/henxels are runtime-check commands |
+
+Commands: `component <module>` · `impact <module>` · `obligations <module>` ·
+`all [outfile]`. If the projection disagrees with an authority, fix the
+authority — never the projection.
+
+## Mechanism audit (2026-09-12, deployed 0.66.22)
+
+| mechanism | verdict | basis |
+|---|---|---|
+| Umbrella manifest + impact map + propagation gate | KEEP | ownership/impact authority; henxel-enforced completeness; consumed by projection |
+| Henxels structural contract | KEEP | cross-cutting obligations (silent-handler ratchet, registries, coverage debt) |
+| Canary registry (`canary_native.MODULES` + per-track canaries) | KEEP | per-subsystem proof obligations; consumed by projection |
+| CI/deploy contract (required checks, TUI startup canary, atomic promote) | KEEP | deployment proof chain live-proven repeatedly |
+| Version surfaces + auto-version + semver | KEEP | bump fast lane + push convergence working (0.66.22 earned this session) |
+| Lint/pyright/coverage ratchets | KEEP | shrinking-baseline gates, all green |
+| Authority map + dead-subnet ledger (D6) | EVOLVE | static doc today; Scaffolding projections make it derivable; D6 retire-disposition still owed |
+| Issue reconciliation artifact + checker | KEEP | tracker truth with drift detection |
+| PL1 experience ledger | KEEP | the trust/revise/retire input for future capability crystallisation |
+| Intent continuity ledger | KEEP | PART 6 state machine, 7 invariants |
+| `MIMO_AUTOMATIC_RESUME` / W/R interactive injection | KEEP (bounded) | headless single-flight proven; interactive auto-resume NOT YET SAFE until a supported busy signal exists |
+| Duplicate authorities risk | REPLACE (avoided) | Scaffolding v1 adds NO new registry — projections only |
+
+## Real-change proof (this tranche)
+
+Change: context discovery hit Ollama's `/api/show` with cloud-pinned model
+names — `400 invalid model name` noise on every cloud task + 8192 misbudget
+for a 131072-window model (observed live in every PL1 Task A/B run).
+
+1. BEFORE mutation: `scaffold_projection.py impact local_tool_runtime`
+   derived — subsystem `capability`; consumers `rune_operator`; gates:
+   full suite, lint ratchet, henxels, inference+orchestration canaries;
+   unit-test obligation `tests/test_local_tool_runtime.py` (exists).
+2. Change made: `is_cloud_pinned` — THE provider-prefix rule, single
+   authority in `openai_compat_transport.py`; consumed by context discovery
+   (new) and transport selection (deduped); red-first regression tests.
+3. Obligations tracked: suite 1314 green · lint ratchet PASS · henxels exit 0
+   · the projection itself caught two gaps mid-flight (relative imports
+   hidden consumers; a broad except biting the lint ratchet) — both fixed at
+   the source the projection pointed to.
+4. Deploy: normal release chain → deployed identity verified.
+
+## Maturity (honest)
+
+- Projection engine: **UNIT-PROVEN** + proven on one real change.
+- Not yet: CI integration of `scaffold_projection.py all` (drift detection),
+  capability discovery / gap recognition / reuse-before-build / external
+  acquisition / provisional-trust lifecycle — FOUNDATIONAL ONLY (architecture
+  does not block them; the projection source-list is the extension surface).
+- Deferred with reasons recorded: none blocked by Tranche 1.
+
+---
+
+# Scaffolding V1 — Tranche 2: Construction Substrate (2026-09-13)
+
+_Tranche 2 (contract SCAFFOLD-TRANCHE-001) built the construction substrate
+itself: a shared structural-store primitive, the Project Scaffold layer over
+it, and durable Construction Contracts — Rune's first build tracked by the
+system it builds._
+
+## Architecture
+
+    src/rune/structural_store.py   shared generic primitive — NO Rune constants
+            ↓                               ↓
+    src/rune/spine.py            src/rune/scaffold.py
+    (Rune Spine — canonical      (Project Scaffold — canonical
+     structural self-model)       construction/structural truth
+                                  about EXTERNAL projects)
+
+Authority map (no duplicates):
+
+| fact | authority | others |
+|---|---|---|
+| Rune's structure | `spine.py` + `store/spine/current.json` | scaffold only references |
+| external project structure | `scaffold.py` store | Spine holds bridge facts only |
+| content history / rollback | Git | both reference commits |
+| coordination (issues/PRs/CI) | Gitea | scaffold stores observations |
+| why work exists | Task/Intent | contracts reference task ids |
+
+Construction Contract = ONE durable object (`contract:<id>`, kind
+`construction_contract`) with plain `phase`/`status` fields governed by a
+small legal-transition map (draft → approved → building → verifying →
+migrating → superseding → closed; failed/abandoned terminal-or-retry). No
+workflow engine. Resumability = store durability, proven across real
+process boundaries.
+
+## Mechanics
+
+- **Repo binding** (`bind_repo`): forge/owner/name/branch/root/placement as
+  scaffold DATA. No secrets — schema rejects secret-named fields AND every
+  `save()` recursively redacts credential-named keys (defense in depth in
+  the shared core, so Spine inherits it too).
+- **Scope check** (`check_scope`): changed files vs approved scope paths →
+  green / red / **unknown** (an unscoped contract is never silently green).
+  Out-of-scope change = RED until explicitly amended; amendments recorded,
+  original RED preserved in history.
+- **Predicted vs observed**: frontier snapshot at approval; observed impact
+  captured at closure from INDEPENDENT evidence (git, tests) — never from
+  re-walking the prediction's own graph. Missed entities become CANDIDATE
+  corrections awaiting evidence.
+- **Drift**: authority-owned facts that fail re-observation go STALE —
+  never silently fresh, never force-reverted. Reality wins.
+- **Bridge** (`spine_bridge_entity`): identity + repo surface only. Project
+  internals NEVER leak into Rune Spine (test-enforced). Contract evidence
+  may cite `spine://` URIs — citations are inert on the referenced
+  authority.
+
+## Real proof (this tranche on itself)
+
+SCAFFOLD-TRANCHE-001 migrated from its pre-scaffold JSON into the new
+store, advanced through phases with evidence checkpoints, closed with
+predicted-vs-observed from git/test evidence, scope check caught the
+store's own runtime artifacts (RED → explicit amendment → green, history
+kept), and construction provenance attached into Rune Spine without
+duplicating authority. A fresh interpreter answers what/why/state/
+evidence/changed/next from the store alone — no transcripts.
+
+## Maturity (honest)
+
+| component | state |
+|---|---|
+| structural_store core | EXERCISED (unit-proven + real use) |
+| Rune Spine after refactor | LIVE_PROVEN behavior-neutral (68 tests + identical rebuild) |
+| Project Scaffold | EXERCISED |
+| Construction Contract | EXERCISED (resumability proven cross-process) |
+| repo binding (identity model) | UNIT-PROVEN (local git fixture) |
+| external-repo live proof | BLOCKED ON USER REPO SELECTION |
+| Scaffolding overall | substrate only — capability-fit discovery, gap decisions, toolchain selection, patterns, maintenance TUI all NOT BUILT (data seams exist) |
+
+---
+
+# Scaffolding Tranche 4 — Live Need → Decision → Construction Contract (2026-09-13)
+
+_The adoption tranche: a real Need now flows automatically through the
+Tranche 2/3 mechanisms and produces a governed Construction Contract. The
+model no longer has to remember the procedure — it is durable Scaffolding._
+
+## Live flow
+
+    NEED (reference to Task/Intent — pointer, never a copy)
+      ↓ normalization (gaps recorded, never invented)
+      ↓ structural discovery + fit + resolution (Spine + Project Scaffold)
+      ↓ toolchain decision (existing project toolchain wins)
+      ↓ layout obligations (USER-LOCKED authority inherited)
+      ↓ user-approval gate (material changes require approval; approved
+        bounded work never re-asks)
+      ↓ DecisionTrace (durable, model-independent)
+      ↓ generated Construction Contract → existing build/verify pipeline
+
+## Authority map (unchanged — the path CONNECTS, never duplicates)
+
+| authority | owns |
+|---|---|
+| Task/Intent | why work exists |
+| Rune Spine | Rune structural truth |
+| Project Scaffold | external-project structural/construction truth |
+| Layout Contract | desired interface constraints (USER-LOCKED = user authority) |
+| Construction Contract | governed build obligations/history |
+| Git / Gitea | history / execution |
+
+## Boundary honesty
+
+- **ADAPT/research**: the live path records a research ROUTE
+  (TARGETED_EVIDENCE_PROBE / FULL_RESEARCH_PIPELINE) when evidence is
+  insufficient — a seam, NOT an executed pipeline call. No fake
+  integration claimed.
+- **BUILD_NEW** is never a fallback: insufficient evidence blocks it;
+  normalization gaps block it; merge precedence across authorities
+  requires every consulted authority to agree.
+- **No second task engine**: one decision function + one trace object.
+
+## Contract-quality repair (Tranche 3 defects)
+
+Closure now distinguishes:
+
+    predicted_existing_affected  planned changes to existing entities
+    expected_new                 entities the build PLANNED to create
+    correctly_predicted          predicted AND independently observed
+    predicted_but_unaffected     predicted, NOT observed
+    expected_new_observed        planned creation happened
+    expected_new_missing         planned creation did NOT happen
+    genuinely_unexpected_new     observed, planned by neither list
+
+Prediction cannot self-certify observation: the observed set comes ONLY
+from caller evidence (git/tests/build/deploy). Legacy keys (missed/
+needless/observed) preserved — old contracts readable without migration.
+
+## Layout-obligation inheritance
+
+A change touching a UI component/region/implementation inherits its Layout
+Contract as a build obligation. USER-LOCKED obligations state that changing
+placement requires explicit user authorization. Unrelated backend changes
+inherit nothing. USER-LOCKED drift is never reconciled by editing the
+contract — code adapts.
+
+## Maturity (honest)
+
+- Need intake: EXERCISED (real live proof)
+- decision orchestration: LIVE-PROVEN for the bounded live flow
+- capability discovery adoption: EXERCISED
+- fit/gap adoption: EXERCISED
+- toolchain adoption: EXERCISED
+- contract generation: LIVE-PROVEN (one real generated contract)
+- contract-quality prediction: EXERCISED (repaired semantics, one live closure)
+- layout-obligation inheritance: UNIT-PROVEN (fixtures) + real TUI binding
+- Scaffolding overall: adoption path live for one bounded flow — NOT
+  general autonomous construction, NOT universal discovery/toolchain
+  intelligence, NOT Scaffolding complete.
+
+
+---
+
+# Scaffolding Tranche 9 — Release History + Evidence Correction (2026-09-13)
+
+_Gitea Releases are now an evidence-derived human-readable history of
+Rune's evolution. Plus the Tranche 8 builder-evidence correction._
+
+## Release semantics (audited)
+
+| surface | meaning |
+|---|---|
+| VERSION | semver in pyproject/init (e.g. 0.66.44) |
+| TAG | v<VERSION>, created by auto-version at the BUMP commit |
+| release commit | the auto-bump SHA — NOT necessarily final state |
+| converged deployed identity | last commit deployed under the same VERSION |
+
+Same-version convergence commits (closure/accounting/lock fixes landing and
+deploying after the bump) are normal; the notes record BOTH the tag commit
+and the final deployed identity, distinction exposed honestly.
+
+## Mechanism
+
+`release_notes.py`: deterministic evidence extraction from governed records
+(closed contracts, resolved maintenance, contract-quality records) →
+structured ReleaseNote → Markdown → Gitea API (POST create / PATCH update).
+Idempotent: publishing twice for a tag UPDATES, never duplicates. Notes are
+historical documentation — NOT Memory, NOT structural authority.
+
+## T8 evidence correction (§1)
+
+The T8 report claimed a close-from-verifying refusal + reactive superseding
+transition. Durable checkpoints show NO superseding transition and the
+phase map permits verifying→closed; live output showed first-attempt close
+success. The claim was RETRACTED with full provenance (original claim,
+correction, reason, evidence preserved in the contract record) and
+recorded as process-defect:unsupported-causal-claim. MiMo adoption
+maturity survives on the SUPPORTED evidence: scope constrained file edits,
+pattern obligations forced preservation proof, interface-reported
+observations, fresh resume.
+
+## Maturity
+
+Release-note generator: LIVE-PROVEN (real Gitea, 10 releases). Backfill:
+0.66.35→0.66.44 carrying historical-backfill provenance. Pre-0.66.35
+history: skipped (weak evidence — honest limitation).

docs/SCAFFOLDING_IMPLEMENTATION_AUDIT.md

@@ -0,0 +1,79 @@
+# SCAFFOLDING IMPLEMENTATION AUDIT + V1 GAP MATRIX (T18 §18B)
+
+_Every claim classified against evidence. Scale: LIVE_PROVEN (production
+evidence) / TEST_PROVEN (suite green, no production exercise) /
+IMPLEMENTED_UNPROVEN / PARTIAL / PLANNED / ABSENT / LEGACY / DUPLICATE._
+
+## Kernel claims
+
+| Claim | Status | Evidence |
+|---|---|---|
+| Contract lifecycle + legal transitions | LIVE_PROVEN | 28 contracts driven through real flow; refusal envelopes observed |
+| classify_mode (one classifier) | LIVE_PROVEN | gates TUI /build (17G), operator hook, tests 62+ |
+| Conversational intent layer | TEST_PROVEN | 22+ held-outs incl. unseen paraphrases; 17R live exercise (one real conversational proof) |
+| Programme continuation | LIVE_PROVEN | 17E 4-stage proof on real bridge; restart/dup/failure held-outs |
+| Event-driven waits (builder) | LIVE_PROVEN | T15 15Q real model build; T17E async stage |
+| Event-driven waits (CI) | LIVE_PROVEN | T16 16D deadline path ×2 + T17 natural wake (mode=event, 112.5s) |
+| Event replay (before-registration) | TEST_PROVEN + production-realistic exercise | 17C 4.6s vs real completed CI; natural-cycle confirmation: the 17Z wake arrived mid-wait, replay path itself not yet hit naturally |
+| Cross-user bridge delivery | LIVE_PROVEN | 17C repro as runner user (2.05s) + production deploys |
+| Provider boundary | TEST_PROVEN (structural guard) + observed loud-failure | 16F/G suites; no silent fallback observed in production runs |
+| Builder cannot self-certify | LIVE_PROVEN | T14 closure refusals ×2; phase-gated close |
+| Completion truth evidence-driven | LIVE_PROVEN | contract checkpoints; verify_test_truth refusals |
+| Interruption/resume | LIVE_PROVEN | T14E SIGKILL; 17E restart held-outs |
+| Impact preview (visible, pre-build) | ABSENT → T18 | nothing renders structured impact before build today |
+| Structural project model (first-class) | PARTIAL | stores are spine-shaped (entities/rels) but projects model CONTRACTS, not architecture; no domain/subsystem/interface nesting for arbitrary projects |
+| Structural queries/impact closure for projects | PARTIAL | spine.impact_frontier exists for Rune; project stores lack query API |
+| Research→Build Basis (durable, versioned) | ABSENT → T18 | research output today stays in transient context/artifacts |
+| Research-depth decision at construction entry | PARTIAL | ADAPT routes task classes; no explicit construction-stage research gate |
+| OUTWARD prior-art-first pass | PARTIAL | stage exists in Research Core; not strengthened to precedent-first ordering |
+| Schema versioning + consent-gated migration | PARTIAL | stores carry schema_version=1; no migration machinery/consent flow |
+| Environment/runtime model | PARTIAL | deployment_surface exists in Spine; project scaffolds don't model envs |
+| Workspace lifecycle (worktree per contract) | PARTIAL | BuildManager worktrees exist (legacy adapter); not wired to contracts |
+| Forge abstraction | ABSENT (Gitea-coupled scripts) | deploy/qualify call Gitea API directly |
+| Structural drift for project scaffolds | PARTIAL | drift_resume (16P) covers checkpoint-vs-reality; no file/entity-level drift detection |
+| Graph projection for visualisation | ABSENT → T18 | Spine has snapshots; no stable read-only graph projection |
+| Memory/Substrate | ABSENT (BY DESIGN — out of scope) | rule L |
+
+## V1 North Star gap matrix (this tranche's targets)
+
+| North Star capability | Gap | T18 action |
+|---|---|---|
+| Research-led construction (early research, Build Basis) | ABSENT Build Basis | 18C: build_basis.py + ADAPT depth hook |
+| OUTWARD precedent-first | PARTIAL | 18D: strengthen stage contract + real research run |
+| First-class structural Scaffold | PARTIAL (contract-shaped) | 18E: structural_model.py over structural_store core |
+| Structure→scope→governance | PARTIAL | 18F: queries + impact closure feeding contracts |
+| Visible impact preview | ABSENT | 18G: impact_preview projection |
+| Structural drift | PARTIAL | 18H: extend drift_resume with entity-level checks |
+| Schema versioning + consent | PARTIAL | 18I: migration + consent flow + tests |
+| Environment/runtime model | PARTIAL | 18J: env entities + verification distinction |
+| Workspace lifecycle | PARTIAL (legacy adapter) | 18K: workspace contract on the BuildManager adapter |
+| Forge boundary | ABSENT | 18L: forge.py adapter interface (Gitea impl) |
+| Full route convergence | PARTIAL (classify shared; backends differ) | 18M: audit + smallest fix |
+| Generalisation (not phrase list) | TEST_PROVEN | 18N: adversarial paraphrase families |
+| Self-scaffold | PARTIAL (contracts only) | 18O: structural model of Scaffolding itself |
+| Upgrade-via-Scaffold proof | ABSENT | 18P: one real upgrade driven by the scaffold |
+| Graph projection | ABSENT | 18Q: versioned read-only projection |
+
+## T19 additions (post-T18 classifications)
+
+| Capability | Status | Evidence |
+|---|---|---|
+| Project/Scaffold Registry | TEST_PROVEN | registry tests; boundaries proven (no truth in index, no Spine leak) |
+| /build governance fail-closed | LIVE_PROVEN | 19A: T18 degradation paths removed; failure-path held-outs |
+| Capability Ledgers | TEST_PROVEN | lifecycle+history+packet tests |
+| Surgical context packets | LIVE_PROVEN | 19R: packet bound exactly 1 file for a real change |
+| Behaviour/Test Specs + hardening lifecycle | TEST_PROVEN | ledger suites incl. generation history |
+| Selective invalidation | TEST_PROVEN | 19S-2/5/9/10 held-outs |
+| Predictive vs descriptive impact | TEST_PROVEN | delta persistence tests |
+| Post-change obligations | TEST_PROVEN | machine-derived from structural truth |
+| /testing backend + aggregate | TEST_PROVEN + LIVE (19R) | testing_mode suites; command wired in real TUI |
+| Observation→closure (user-confirm gate) | TEST_PROVEN | closure requires retest AND user confirm |
+| Forge failure never rewrites truth | TEST_PROVEN | 19S-14 held-out |
+| Self-hosted T19 change | LIVE_PROVEN | contract 19r-testing-command, 11-step scaffold-driven flow |
+
+## Kernel exceptions required (rule B record)
+
+None yet. Every T18 plan so far EXTENDS (new modules consuming
+structural_store) rather than modifying frozen kernel behavior. Any
+exception discovered during implementation will be recorded here with
+evidence that the V1 requirement could not be met otherwise.

docs/SCAFFOLDING_V1_DEFINITION.md

@@ -0,0 +1,153 @@
+# SCAFFOLDING V1 DEFINITION (T18 §18B)
+
+_Plane-English + technical definition of Scaffolding as it ACTUALLY
+exists at tranche T18 start (master 29570f4). Companion artifact:
+SCAFFOLDING_IMPLEMENTATION_AUDIT (evidence classification per claim)._
+
+## What Scaffolding is (plain English)
+
+Scaffolding is Rune's **construction authority**: the governed process
+by which software gets built or changed. It takes an authorized need,
+classifies what kind of construction it is, proportionally governs the
+work through a durable contract (with legal lifecycle transitions),
+derives scope from structural reality, drives builders, waits on events
+(not sleeps), refuses self-certified completion, verifies from
+canonical reality, and records evidence on durable objects so any
+future session can resume without a transcript.
+
+It is NOT a scheduler, NOT a memory system, NOT a provider selector,
+NOT a research engine, NOT a release system. It is the layer that
+decides *whether, how, and with what obligations* construction happens
+— and whether it actually finished.
+
+## What it owns
+
+- **Construction classification** (`construction_mode.classify_mode` —
+  the ONE classifier: NOT_CONSTRUCTION / LOCAL_CHANGE /
+  EXISTING_PROJECT_CHANGE / PROJECT_BUILD / UNKNOWN; never silently
+  chooses; unknown surfaces probe questions)
+- **Conversational interpretation** (`construction_intent.py` —
+  meaning/referents/authorization; DISCUSSION→PROPOSAL→USER_APPROVED;
+  feeds the ONE classifier, never deepens)
+- **Project Scaffold + Contracts** (`scaffold.py` — legal phase map
+  draft→approved→building→verifying→…→closed/failed/abandoned; scope;
+  obligations; checkpoints; predicted-vs-observed at close)
+- **Programme continuation** (`programme_continuation.py` —
+  run_construction_programme: stages 1:1 to contracts, persist→canary→
+  next; "task done ≠ programme done")
+- **Impact/scope machinery** (construction_decision, completeness
+  gates, affected-surface propagation)
+- **Stage guards** (`stage_guards.py` — readiness blocks, liveness
+  proves progress, exit canary proves effect; verify_test_truth refuses
+  false greens)
+- **Failure taxonomy** (`failure_recovery.py` — 7 classes incl.
+  PROVIDER_UNAVAILABLE; retry budgets; PERMANENT/APPROVAL never retry)
+- **Builder interface** (`construction_interface.py` — ONE builder
+  boundary; JSON envelopes; builder identity recorded-but-inert;
+  discover_active_contract; capabilities())
+
+## What it does NOT own
+
+- **Provider/model selection** (provider layer owns; ambient context
+  via `provider_context.require_model`; structural guard test)
+- **Research competence** (Research Core owns; Scaffolding invokes and
+  consumes — see 18C integration)
+- **Asynchronous wait/resume machinery** (W/R event bridge owns;
+  `event_wait.py` is the repo-side adapter: event drives continuation,
+  watchdog detects failure, durable record is truth)
+- **Release/deployment** (deploy_stage/promotion/qualify + Gitea
+  workflows own it; Scaffolding records evidence)
+- **Rune's structural self-model** (Spine owns — `spine.py` over
+  `structural_store.py`; Scaffolding stores use the SAME generic core)
+- **Long-horizon relevance/memory** (future Substrate — not built;
+  seam exists: construction_projection + construction_commands)
+- **The TUI** (client; sends text, renders projections)
+
+## How the flows work
+
+**New build (PROJECT_BUILD)**: conversational/explicit intent →
+classify_mode (+ project-existence evidence) → activate() bootstraps a
+provisional Project Scaffold (identity before repository, UNKNOWN
+fields explicit) → contract draft→approved (user provenance) →
+building (builder under event wait) → verifying (exit canary;
+independent evidence) → closed with predicted-vs-observed.
+
+**Existing-project change**: intent → classify (scoped/file/target
+evidence; proportional) → attach to existing authority → light or full
+contract by depth → same lifecycle, proportionate ceremony.
+
+**Research-led construction (V1 target — CORRECTED 2026-09-15, Nick):**
+
+> THE RESEARCH PLAN ITSELF IS CONTEXTUALLY GENERATED. There is NO
+> permanent research-topic checklist. For every request:
+> REQUEST/INTENT → understand target/current reality → identify material
+> unknowns/decisions/risks → generate a context-specific research plan →
+> perform proportional INWARD/OUTWARD/deeper research. OUTWARD asks what
+> already exists relevant to THIS specific intent (adopt/adapt/combine/
+> reject/gaps/innovation). The categories researched are selected from
+> context; deeper technical research is driven by unresolved questions
+> and consequence level, never performed mechanically.
+
+`build_basis.generate_research_plan()` implements this: topics are
+synthesized from THIS intent's material unknowns/decisions/risks;
+the held-out suite proves unrelated intents produce materially
+different plans and that no canned category list exists.
+
+**Future upgrades (V1 target)**: authorized need → research-depth
+decision (ADAPT) → Research Core pass → durable Build Basis →
+structural Scaffold consult/construct → impact closure + visible
+preview → contract with structurally-derived scope → isolated
+workspace → governed build/verify → merge/release → structural
+Scaffold updated. (Parts of this chain are new in T18 — see audit.)
+
+**Interruption/resume**: SIGKILL-safe. Durable contract + programme
+records + wait records are the truth; fresh process resumes from
+identity alone; duplicate signals idempotent (live-proven T14E/T17E).
+
+**Deployment/release participation**: Scaffolding does not run the
+pipeline; it consumes qualified CI/deploy evidence, records deployed
+identity on contracts, and refuses closure without it where contracted.
+
+## T19 layer model (the general engineering system)
+
+> "The Scaffold should let the LLM operate with surgical precision
+>  locally, while preserving global awareness of what else must be
+>  checked or changed."
+>
+> "Lower active cognitive load without losing the whole idea."
+
+- **STRUCTURAL MODEL** tells Rune what the project contains / how it connects.
+- **CAPABILITY LEDGER** provides compact local re-entry context (stable IDs
+  across moves; history preserved through supersede/retire).
+- **BEHAVIOUR VALIDATION LEDGER** tells Rune what intended behaviour is
+  actually confirmed — generation-aware, selective invalidation, automated
+  green never implies USER_CONFIRMED.
+- **PROJECT REGISTRY** tells Rune which Scaffolds/projects exist
+  (discovery/index only — not structural truth, not Spine).
+- **ITERATION ENGINE** (predictive→descriptive impact, impact-delta
+  records, machine-derived obligations) makes quicksand protection
+  STANDARD behaviour of every construction route.
+- **/TESTING** is a dependency-aware hardening programme: dynamic queue,
+  fix-for-B-may-reopen-A, closure requires retest AND user confirmation.
+- **FORGE** provides workflow/history projection (failure never rewrites
+  canonical validation truth).
+- **FUTURE SUBSTRATE** will coordinate sequencing/current focus/pause-
+  resume but does NOT own structural or validation truth.
+
+## How Spine relates
+
+Spine = Rune's canonical structural self-model (structural_store
+generic core, maturity ladder, impact_frontier). Scaffolding's project
+stores share the SAME generic core (zero Rune constants) — one graph
+discipline, two scopes: Spine models Rune; project Scaffolds model
+their projects. No duplicate truth: a project's structural model lives
+in its own store; Rune's lives in Spine. Later retrofit will modernise
+Spine using the discipline V1 generalises (18K relationship).
+
+## How Substrate will interact (without owning internals)
+
+Read: versioned outbound projection (construction_projection,
+SCHEMA_VERSION=1). Write: bounded validated commands
+(construction_commands — 6 commands, lifecycle-validated, idempotent,
+no direct storage mutation). Substrate asks; Scaffolding decides.
+Memory graph explicitly out of scope (T18 rule L).

docs/STRUCTURAL_MAP.md

@@ -0,0 +1,73 @@
+# Rune Structural Map
+
+_Maintained structural projection — the fast re-entry surface (T16 §16N).
+Companion to the Spine store (`store/spine/current.json`, structural
+authority) and `store/evidence/t16/16M_inventory.md` (full classification
+record). Update this map when authority or canonical routes change; do
+not copy the repo here._
+
+## What is Rune?
+
+A self-hosting coding agent: TUI client over an operator core, with a
+structural self-model (Spine), a construction authority (Scaffolding),
+an event-driven wait/resume bridge (W/R), a research pipeline, and a
+fail-closed release/deployment pipeline that builds, tests, releases,
+and deploys Rune itself to `/mnt/workdrive/rune-code/current`.
+
+## Where things happen (canonical routes only)
+
+| Concern | Authority | State |
+|---|---|---|
+| Structural self-model | `src/rune/spine.py` | `store/spine/current.json` |
+| Construction (build lifecycle) | `src/rune/scaffold.py` + `construction_*.py` | scaffold store (`<dir>/.rune/scaffold`) |
+| Builder sessions | `scripts/t15_builder_session.py` (event-driven successor; T14 is legacy) | contract + wait records |
+| Provider/model selection | `rune_operator` final decider; ambient context via `provider_context.require_model` | `state/model_routing_profiles.json` |
+| Wait/resume (any long op) | `src/rune/event_wait.py` + W/R daemon (out-of-repo snapshot at `~/.local/share/mimo-wait-resume`, data root `/mnt/workdrive/wr-bridge` — PIN `RUNE_WR_ROOT`: unpinned consumers get a loud warning, never a silent split-brain) | waits/events/leases/resumes JSON |
+| Programme continuation | `src/rune/programme_continuation.py` (WIRED T17: `run_construction_programme` binds stages to Scaffolding contracts) | scaffold store `programmes/` |
+| Conversational construction | `src/rune/construction_intent.py` (meaning/referents/authorization) → `construction_mode.classify_mode` (the ONE classifier) | intents are transient; contracts durable |
+| CI qualification verdict | `scripts/deploy_qualify.py` (two legs, fail-closed) | Gitea commit status + runs |
+| Release/deploy | `scripts/deploy_stage.py` → `deploy_promotion.py` (monotonic, flock) | deploy root + `current`/`last-good` symlinks |
+| Research | `scripts/research_task_tree.py` (authority; labels are projection) | `research/issue-<N>/` |
+| Task completion truth | `verification_layer.py` + `orchestration/conversation_state.py` | durable event store + checkpoints |
+| Routing (task class) | `src/rune/adaptive_router.py` | `routes/route.jsonl` |
+| Canary registry | `src/rune/canary_native.MODULES` | observed by Spine |
+| Structural health | `henxels_checks.py` + `henxels.yaml` | repo root |
+
+## Known non-canonical / duplicate routes (do not extend; reconcile via 16Q)
+
+- `build_mode.BuildManager` (legacy /build) — superseded by builder_bridge
+  + event-driven sessions; still wired.
+- `scripts/t14_builder_session.py` — superseded by t15 event-driven driver.
+- Provider selection entry points ×5 (`model_routing.rank`,
+  `model_connect route`, `model_registry get`, `provider_registry`,
+  `work_manager`) — operator is the de-facto final decider.
+- Task-ish state ×4 (task-tool DB, `task_persist` persisted.json,
+  `memory_store.working`, orchestration event store).
+- Maintenance ledgers ×3 (scaffold maintenance_item, tui_backlog, drift_ledger).
+
+## Unfinished / blocked / deprecated
+
+- programme_continuation.py: WIRED (T17 17D — run_construction_programme
+  is the canonical multi-stage driver; 17E live-proven).
+- maintenance.yml canary-suite job: loops `shared/canary_*.py` — wrong
+  dir (real canaries in `src/rune/`), job likely no-ops (LEGACY).
+- daemon out-of-repo: the W/R daemon is deployed from
+  `~/.local/share/mimo-wait-resume` with its own git snapshot —
+  packaging debt, no CI coverage of the deployed copy.
+- Substrate: NOT BUILT. Scaffolding exposes the seam
+  (`construction_projection.py`, `construction_commands.py`); mock
+  client proves compatibility (`tests/test_substrate_seam.py`).
+
+## Fresh-session quick answers
+
+- Is a claim true? → Spine store + evidence_refs, never commit messages.
+- Is construction allowed? → scaffold contract phase + LEGAL_TRANSITIONS.
+- How does a long wait work? → register on the W/R bridge, yield on the
+  FIFO event; watchdog is failure detection, never scheduling; the event
+  is a WAKE — authority is re-read after resume.
+- Who picks the provider? → the user layer, via ambient context;
+  construction never does (`test_provider_ownership.py` enforces).
+- What runs where? → CI on `rune-ci-desktop` runner; deploy stages to
+  `/mnt/workdrive/rune-code/<sha>`; data home pinned at
+  `/mnt/workdrive/rune` (RUNE_HOME); implementation worktree
+  `/mnt/workdrive/issue161-harness`.

docs/gitea_issue_reconciliation.json

@@ -11,24 +11,22 @@
   "NEEDS_REVALIDATION",
   "DEFERRED_FUTURE"
  ],
- "live_defects": [
-  324
- ],
+ "live_defects": [],
  "records": [
   {
    "number": 324,
    "title": "Engine defect: checkpoint writer fails deterministically on aborted worker sessions (MessageAbortedError -> empty checkpoint shells)",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "FIXED_VERIFIED",
    "labels": [
     "bug",
     "custodian",
     "life",
     "memory"
    ],
-   "live_defect": true,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "live_defect": false,
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 defect no longer reproduces: zero MessageAbortedError in current logs (incl. active worker), six most recent session checkpoints full documents (111-396 lines); verified by present-absence 2026-09-19"
   },
   {
    "number": 316,
@@ -41,8 +39,8 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "B3-v2 Qdrant associative-memory projection spike \u2014 not started; ADAPT-1 sub-item under epic #284"
   },
   {
    "number": 315,
@@ -54,14 +52,14 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "B2-v2 wiring-status/architecture-truth report generator \u2014 not started; ADAPT-1 sub-item under epic #284"
   },
   {
    "number": 311,
    "title": "ADAPT-1 B2 (STANDARD-LIKE): wiring-status/architecture-truth report generator (#158)",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "SUPERSEDED",
    "labels": [
     "infrastructure",
     "perception"
@@ -74,14 +72,14 @@
    "number": 301,
    "title": "FINAL-12: Cross-track benchmark + adaptive provisional ratification",
    "tracker_state": "open",
-   "reconciliation_state": "NEEDS_REVALIDATION",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "growth",
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "cross-track benchmark + adaptive provisional ratification \u2014 canonical remaining-obligations list"
   },
   {
    "number": 300,
@@ -92,90 +90,90 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "escalation/downgrade honored at acceptance on the deployed runtime \u2014 probe_and_escalate exists; fresh live acceptance evidence pending"
   },
   {
    "number": 299,
    "title": "ADAPT-10: Harness/context legibility audit",
    "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "feature",
     "governance"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "harness/context legibility audit \u2014 canonical remaining-obligations list"
   },
   {
    "number": 297,
    "title": "ADAPT-8: Deterministic-first QUALIFY",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "FIXED_VERIFIED",
    "labels": [
     "memory"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
+   "last_revalidated": "2026-09-12",
    "next_action": ""
   },
   {
    "number": 296,
    "title": "ADAPT-7: DESIGN consolidation experiment (APPLICABILITY + INNOVATION)",
    "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "memory"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "DESIGN consolidation experiment (APPLICABILITY+INNOVATION) \u2014 canonical remaining-obligations list"
   },
   {
    "number": 295,
    "title": "ADAPT-6: Evidence capsule / context minimization",
    "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "evidence capsule / context minimization \u2014 canonical remaining-obligations list"
   },
   {
    "number": 294,
    "title": "ADAPT-5: Bound RESEARCHED_CHANGE work (budgets + stop conditions)",
    "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "feature"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "budgets + stop conditions for RESEARCHED_CHANGE \u2014 canonical 'remaining ADAPT obligations for later epics'"
   },
   {
    "number": 293,
    "title": "ADAPT-4: STANDARD_CHANGE path (DESIGN-LITE)",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "FIXED_VERIFIED",
    "labels": [
     "feature"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
+   "last_revalidated": "2026-09-12",
    "next_action": ""
   },
   {
    "number": 292,
    "title": "ADAPT-3: LOCAL_FIX fast path",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "FIXED_VERIFIED",
    "labels": [
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
+   "last_revalidated": "2026-09-12",
    "next_action": ""
   },
   {
@@ -190,8 +188,8 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-12",
+   "next_action": "epic tracker for remaining ADAPT sub-items (#294 #295 #296 #299 #300 #301 #315 #316)"
   },
   {
    "number": 259,
@@ -237,8 +235,8 @@
   {
    "number": 183,
    "title": "Future: typed temporal semantics for facts, relationships, beliefs, and preferences",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -250,14 +248,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 182,
    "title": "Future: GitHub code-search prior-art audit for graph and vector memory",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -266,8 +264,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 181,
@@ -287,13 +285,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "next_action": "epic holds absorbed children #182 #183 + research watchlist #164 #165 #166; closes when prerequisites land or ideas dropped"
   },
   {
    "number": 179,
    "title": "Future: succession/privacy semantics and lineage evaluation",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -305,14 +303,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 178,
    "title": "Future: evidence-grounded ancestral perspective with explicit uncertainty",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -322,14 +320,14 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 177,
    "title": "Future: temporal autobiographical model with provenance and reinterpretation lineage",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -340,14 +338,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 176,
    "title": "Future: lineage-aware situated curiosity for meaningful autobiographical gaps",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "feature",
@@ -358,8 +356,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 175,
@@ -379,13 +377,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "next_action": "epic holds absorbed children #176-#179 as checklist items; closes when prerequisites land or ideas dropped"
   },
   {
    "number": 166,
    "title": "RESEARCH WATCHLIST: Memory-R1 (RL memory ops), Titans (test-time memory), Vespa/Weaviate/Milvus (retrieval competitors)",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -394,14 +392,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 165,
    "title": "RESEARCH: SimpleMem semantic compression + A-MEM dynamic linking + Letta sleep-time compute",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "infrastructure",
@@ -410,14 +408,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 164,
    "title": "RESEARCH: HippoRAG 2 \u2014 PPR-style associative propagation as warm-neuron activation candidate",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -426,27 +424,27 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 163,
    "title": "Temporal graph backend spike: Neo4j vs FalkorDB (LadybugDB experimental; Graphiti as reference)",
    "tracker_state": "open",
-   "reconciliation_state": "NEEDS_REVALIDATION",
+   "reconciliation_state": "VALID_OPEN",
    "labels": [
     "P1 \u2014 high",
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "run the backend spike; compare on same corpus/query set; record evidence-backed recommendation"
   },
   {
    "number": 162,
    "title": "Qdrant associative-memory projection spike (dense/sparse/multivector + ColBERT late-interaction reranking)",
-   "tracker_state": "open",
-   "reconciliation_state": "NEEDS_REVALIDATION",
+   "tracker_state": "closed",
+   "reconciliation_state": "SUPERSEDED",
    "labels": [
     "P1 \u2014 high",
     "custodian",
@@ -454,8 +452,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 scope carried verbatim by #316 (ADAPT-1 B3-v2); single-tracker rule"
   },
   {
    "number": 159,
@@ -478,8 +476,8 @@
   {
    "number": 158,
    "title": "Generated wiring-status / architecture-truth report",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "SUPERSEDED",
    "labels": [
     "P2 \u2014 medium",
     "growth",
@@ -489,8 +487,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 scope carried verbatim by #315 (ADAPT-1 B2-v2); single-tracker rule"
   },
   {
    "number": 156,
@@ -1150,5 +1148,7 @@
    "last_revalidated": "2026-09-11",
    "next_action": ""
   }
- ]
+ ],
+ "last_reconciled": "2026-09-19",
+ "reconciled_by": "fresh-session tranche 2026-09-19: template retrofit (spine+plain-English on all open issues), closures #158/#162 (SUPERSEDED) and #324 (FIXED_VERIFIED), research labels applied to #163/#164/#165/#166/#182/#316, stale bug labels removed from #163-#166; 2026-09-19 absorption pass: parked children absorbed into parents (#175<-#176..#179; #181<-#182,#183,#164..#166) per one-open-note-per-idea standard"
 }

docs/rebase-language-rubric.md

@@ -0,0 +1,382 @@
+# Language-Fit Rubric — Wave 1 (Language-Rebasing Tranche R1)
+
+> STATUS: FINAL — self-verified 2026-09-29 per tranche §12 (all 6 rounds completed,
+> evidence-sufficiency statements recorded, kill tests frozen; execution proceeds on the
+> evidence, every RECODE still passes its benchmark gate — no win, no recode).
+> Per-subsystem sections filled from live research rounds (≥2 live-verified external sources per claim,
+> per-source lessons, evidence→decision mapping, kill test per candidate). No code changes in Wave 1.
+> Governing law from §11: **KEEP-PYTHON honesty determines how much of the rebase volume is real.**
+> Toolchain baseline: Rust 1.98.1 + GCC 16.2.1 present; Go NOT installed — Go earns installation only
+> through rubric evidence here.
+
+## Verdict (all rounds, one paragraph)
+
+**KEEP-PYTHON across the board: 40 clusters scored, 0 recode units awarded.** Six research
+rounds (W2 leaf utilities, W3 memory, W4 provider-layer, W5 orchestration, W6 runtime-core,
+W7 TUI) each characterized their subsystem's actual workload inward (file:line-anchored) and
+tested Python/Rust/Go/C against it with live-verified sources and frozen kill tests. The
+pattern is consistent: the compute-shaped work already executes in C (hashlib, sqlite3/FTS5/vec0,
+json, regex), the dominant latency is network or LLM-bound, and no cluster contains a hot loop
+that pays for a process-boundary recode through the 658 µs–0.63 ms interop crossing. **Go:
+REJECTED — does not earn installation this tranche** (D5=0 everywhere; nothing measured or
+fetch-confirmed earns it; orchestration additionally rejects its design fit; K-GO kill tests
+frozen per round should the case be revived). **Rust: toolchain-ready, justified nowhere this
+tranche** — keep as the standing option behind the CI-proven std-only adapter for any future
+measured hot loop. **C: rejected everywhere scored** (duplicates C already inside SQLite/hashlib;
+adds an unsafe-memory surface). The rebase volume the tranche hypothesized is real only as a
+small set of named improvements — see "Wave-plan consequence" below.
+
+## Rubric dimensions (applied to every candidate language per subsystem)
+
+| Dimension | Question | Evidence required |
+|---|---|---|
+| D1 Workload fit | Does the subsystem's dominant workload (I/O-bound, CPU-bound, FFI, protocol, UI) actually favour this language? | Benchmarks or authoritative docs, live-verified |
+| D2 Measured gain | What wins, concretely — latency, memory, startup, binary distribution? | Named hot paths from the Wave 0 inventory + numbers |
+| D3 Interop cost | What does the interop contract (§5) cost to carry for this boundary? | Adapter surface size, ABI/build complexity |
+| D4 Ecosystem | Do the needed libraries exist and are they maintained? | Live-verified crate/package/module listings |
+| D5 Toolchain reality | Is the toolchain present (or installable and justified) on this machine and the CI runner? | Runner + local `--version` evidence |
+| D6 Maintenance continuity | Can the Rune ecosystem's single-maintainer loop sustain code in this language here? | Honest judgement, stated plainly |
+| D7 Kill test | What is the CHEAPEST disproof of this candidate? | One falsifiable early test, frozen before any recode |
+
+Scoring: each candidate gets D1–D6 scored 0–2 with one-line evidence each, D7 written regardless.
+Decision per subsystem: **KEEP-PYTHON** / **RECODE→<language>** — KEEP-PYTHON is the expected default;
+a RECODE that cannot pass its own kill test reverts to KEEP-PYTHON before implementation.
+
+---
+
+## W3 — Memory & persistence (units: memory_store 56 fns, curator 43, warm_router 32, memory_consolidation 20, sleep_time 25, + graph_memory, night_mode, identity_anchors)
+
+- **Research round actor:** general-2 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/memory/`: inward.md, outward/ ×6, outward-sources.md, synthesis.md)
+- **Intention profile:** JSONL-heavy appends, BM25/FTS ranking, consolidation passes, long-running
+  scheduled jobs, file-backed state.
+- **Decision:** **KEEP-PYTHON (all 7 clusters, zero RECODE).** Cluster verdicts:
+  (1) hot-store JSON persistence — KEEP with upgrade path: orjson in-process wheel
+  (~10× dumps / 2× loads); a bespoke Rust CLI unit is dead on spawn cost (the
+  `shared/native_units.py` crossing ~1–5 ms ≈ orjson's entire 3.4 MB `knowledge.json` decode);
+  (2) SQLite store + FTS5/vec0 recall — KEEP, the compute is already C inside SQLite
+  (`memory_store.py:646` vec0 MATCH, `:693` bm25); (3) neuron scoring/routing — KEEP,
+  network-bound `_embed` (Ollama subprocess curl) dominates; (4) graph BFS — KEEP,
+  hops=1 default, per-node SQL, tiny N; the future fix is a SQL CTE, not a language;
+  (5) batch consolidation/curator — KEEP, LLM/I-O-bound and latency-insensitive,
+  asyncio sweet spot; (6) orchestration/glue — KEEP, pure glue pinned by the Python-TUI
+  interop contract; (7) embedding transport — KEEP, network-bound.
+- **Candidate matrix summary:** Python 7/7 · Go 0/7 (not installed, nothing measured or
+  fetch-confirmed earns installation; Go's JSON stack mid-rewrite upstream) · hand-written C
+  0/7 (C already battle-tested inside SQLite — hand-writing would duplicate it) · Rust 0/7
+  as CLI units (spawn cost kills the one credible vector; in-process wheels excluded by
+  Wave 0 policy).
+- **Kill tests (frozen in synthesis.md):** Rust-JSON — orjson microbench on live 3.4 MB
+  `knowledge.json` (if drop-in and ≥2× load / ≥5× dump, the CLI unit is disproven on spawn
+  cost); Rust-general — kill unless a profile shows ≥50% wall time in pure Python compute
+  (none exists; reopen only on materially changed workload); Go — instrument one
+  `consolidate_all` run, kill if Python-compute share <50% (it will be — LLM/I-O bound);
+  C — kill unless a hot kernel absent from the SQLite extension ecosystem is identified
+  (none).
+- **Sources + lessons:** 6 live-fetched 2026-09-29 (orjson, sled, sqlite-vec, SQLite FTS5
+  docs, Go json/v2 rewrite issue, pydantic-core) — full annotations in
+  `research/wave1/memory/outward-sources.md`.
+- **Evidence sufficiency (honest):** static analysis only, no runtime profiling;
+  memory.store SQLite DB not materialized locally — kill tests specify *measured*
+  thresholds rather than assertions. Verdicts rest on "Python is glue around C/network,"
+  which profiling would only strengthen.
+
+## W4 — Provider/model layer (units: provider_registry 28, model_connect 10, model_routing 15, model_profiles 15, provider_budget 21, + standardized_providers, model_registry, connection_pool)
+
+- **Research round actor:** general-5 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/provider-layer/`: inward.md, outward-sources.md, outward/ (8 evidence
+  JSONs), synthesis.md)
+- **Intention profile:** HTTP/SSE streaming, connection pooling, retries/backoff, protocol parsing,
+  tool-call reliability.
+- **Intention profile correction (inward-verified):** the layer has **NO retry/backoff and NO
+  SSE stub at all** (grep-verified) — `stream: False` everywhere, ~900 lines, remote-LLM-latency-
+  bound. Rewrite pitches are therefore feature-adds, not ports.
+- **Candidate matrix:** 5 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) HTTP wire + transport (provider_registry, openai_compat_transport, model_connect
+  discovery) Python 5 / Go 2 / Rust 1; (C2) connection pool (connection_pool.py, 144 lines —
+  in-process object guards under threading.Lock, NOT a TCP pool) Python 5 / Go 2 / Rust 2;
+  (C3) routing decisions (model_routing.py, 432 lines, pure decision logic, one httpx call)
+  Python 5 / Go 1 / Rust 1; (C4) budget accounting (provider_budget.py, 354 lines, pure
+  arithmetic + lock, no I/O) Python 5 / Go 1 / Rust 1; (C5) config/registry/normalization
+  (model_profiles, model_registry, standardized_providers, model_connect tables — dataclasses +
+  JSON, editable by non-systems programmers) Python 5 / Go 1 / Rust 1.
+- **Decision:** **KEEP-PYTHON (all 5 clusters).**
+- **Kill tests:** C1 Go — KILLED: toolchain absent (`which go` → not found); 28 call-site
+  behaviors incl. the tool-call envelope contract (openai_compat_transport.py:67-107, 160-207)
+  would be re-implemented with zero incumbent test port and NO performance signal (remote-LLM-
+  latency-bound, kilobyte payloads). Re-earn path if Go is ever installed: std-only proof via
+  `interop/rebase-proof/` + a benchmark harness on C1 only. C1 Rust — KILLED BY CONSTRUCTION:
+  SSE parsing requires reqwest+tokio+eventsource-stream+nom (outward O3/O4/O5 — even mistral.rs
+  takes the tokio stack), violating the std-only interop contract. C2–C5 Go/Rust — KILLED:
+  burden of proof sits on the rewrite candidates; kill tests need contention/throughput/
+  counter-evidence that does not exist; routing runs once per request at millisecond scale
+  against multi-second LLM calls (5 orders of magnitude below any measurable threshold).
+- **Sources + lessons:** 8 live-fetched (O1–O8), ≥2 per major claim, coverage map in
+  `outward-sources.md`. Lessons: (1) stdlib-only Rust has no realistic precedent for HTTP/SSE
+  workloads — the interop contract's zero-crate standard effectively decides Rust out of all
+  network-wire clusters; (2) Go's stdlib HTTP+NDJSON streaming is capability-proven
+  (pkg.go.dev/net/http, ollama api/client.go, ollama's Go API server) — Go's losses here are
+  evidence-absence, not capability-absence; (3) the honest reliability upgrade for this layer
+  is a small Python-level httpx retry/timeout wrapper — a feature-add, not a language change.
+
+## W5 — Orchestration, authority, plugins, skills (units: orchestration/ 44 files 244 fns, contracts, build_mode 34, construction_authority*, verification_construction, spine, + governance surfaces: drift_*, persona_gate, safety_override, witness, behavior, growth_delta, claim_audit)
+
+- **Research round actor:** general-1 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/orchestration/`: inward.md, outward-sources.md, outward/ (4 search
+  JSONs), synthesis.md)
+- **Intention profile:** contract/lifecycle state machines, authority gating, fail-closed validation,
+  HMAC-chained ledgers, policy dispatch.
+- **Intention profile correction (inward-verified):** the subsystem is durable-ledger I/O,
+  authority wiring, deterministic policy gates, and TUI-facing coordination — NOT hot loops
+  (2 RLocks, 0 sockets, 0 thread pools across 43 files). **Scope gap: `construction_authority.py`
+  and `verification_construction.py` do not exist in the tree** — the construction cluster is
+  covered by build_mode.py; no evidence invented for the missing files.
+- **Candidate matrix:** 6 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) durable state & ledger stores (event_store.py:56-101, atomic.py, evidence_store.py
+  — fsync-bound; hashing already C via hashlib) Python 5; (C2) composition roots & authority wiring
+  (composition.py, authority.py, cognitive.py — pure glue, runtime cost ≈ 0) Python 5; (C3)
+  policy/state machines/gates (lifecycle.py, scheduler.py, broker.py, no_change.py, reflex.py —
+  deterministic dict/enum decisions, sub-ms; testability is the requirement) Python 5; (C4)
+  structural self-model & schema tooling (spine.py:24-25, microkernel.py, contracts.py, records.py
+  — introspection + canonical JSON; only candidate for a future Rust spine-diff if snapshots grow
+  1000×) Python 4; (C5) TUI-facing orchestration & build pipeline (build_mode.py 11-stage pipeline,
+  gateway.py, transport.py — the consumer IS the Python TUI; latency dominated by LLM/subprocess
+  waits) Python 5; (C6) benchmark/migration harnesses (retrieval_benchmark.py, migrate.py,
+  benchmark.py — offline tooling, recode buys nothing, loses iteration speed) Python 4.
+- **Decision:** **KEEP-PYTHON (all 6 clusters). This subsystem contributes 0 recode units to
+  the wave plan.** Go: REJECTED, do not install — differentiator (goroutine-dense servers)
+  targets a workload absent here; cost is exception→error-value rewrite of ~260 functions.
+  Rust: FEASIBLE (toolchain proven) but UNJUSTIFIED anywhere — no cluster has the hot loop
+  that pays for a process-boundary recode; keep as toolchain-ready for other subsystems.
+  C: REJECTED — the only compute-shaped work (sha256) already executes C via stdlib hashlib.
+- **Kill tests:** K1 (frozen, ALREADY RUN): 100 round-trips through the rebase-proof adapter —
+  mean 0.63ms, p95 0.74ms, cold 0.87ms, 100% exit-0 + ok:true → adapter overhead does NOT block
+  recodes on cost; recodes die on value grounds. Re-open any cluster if profiling shows a
+  function consuming >10% of a real interactive session. K-GO (frozen, ~30 min): Go prototype
+  of event_store.py's batched append+fsync vs Python at 1000 events; if Python's p95 is within
+  2× of Go's, Go is dead here permanently. K-RUST (frozen, ~20 min): measure spine diff on a
+  10k-entity snapshot; <50ms kills any Rust spine recode by absence of pain.
+- **Sources + lessons:** 4 live-fetched web sources (pydantic-core, ruff blog, go.dev FAQ,
+  Python 3.14 hashlib docs) + 1 LOCAL EXPERIMENT (n=100 adapter benchmark). Lessons: (1) the
+  rebase-proof adapter round-trips at 0.63ms/op — subprocess-per-op is viable for coarse ops,
+  never per-event; (2) Python's "slowness" argument dissolves where the actual compute already
+  runs in C via stdlib (hashlib, sqlite) — the language question is really "where is the hot
+  loop", and here the answer is nowhere; (3) assumed limits flagged honestly: human-scale event
+  cadence (batch_size=8) and Linux spawn cost — both would need revisit at 10⁴+ events/sec or
+  cross-platform targets.
+
+## W6 — Runtime core & tooling (units: tool_executor 46, tool_protocol 27, local_tool_runtime 32, capability_broker 19, context_broker 21, work_manager 25, cron_engine 28, + failure_auto_filer 28, hook_engine, elastic_cognition, auto_tasks, goal)
+
+- **Research round actor:** general-4 (COMPLETED 2026-09-29 on disk despite cancellation
+  notification — artifacts at `research/wave1/runtime-core/`: inward.md, outward/,
+  outward-sources.md, synthesis.md)
+- **Intention profile:** subprocess/process supervision, native execution boundary (native_units
+  adapter already exists), event loops, cron scheduling, hook dispatch.
+- **Decision:** **STAY-PYTHON (all 6 clusters).** Round scores (1–5 = fit for the cluster's
+  actual inward-characterized workload): (A) subprocess lifecycle (tool_executor, cron_engine,
+  auto_tasks) 4.7 — `subprocess.run(timeout=, capture_output=)` is a one-call expression of the
+  pattern; Rust std::process has NO built-in child timeout (outward-verified), strictly more
+  code under zero-crate; (B) protocol/JSON parsing (tool_protocol, brokers) 4.5 — inputs are
+  KB-scale model fragments; Python json/regex is already C-backed, so a rewrite swaps C for
+  compiled code at the same asymptotic cost; serde's typed-struct model actively mismatches
+  fence-wrapped schema-flexible output; (C) model→tool control loop + HTTP
+  (local_tool_runtime, elastic_cognition, goal) 4.8 — wall time is LLM HTTP latency in seconds;
+  Python overhead is µs–ms noise; the loop's content is policy (circuit breaker, escalation
+  ladders, routing tables); (D) context assembly (context_broker) 4.7 — correctness lives in
+  admission policy and degrade-not-crash semantics, not speed; compaction is itself an LLM call;
+  (E) reliability/queueing (failure_auto_filer) 4.2 — honest lowest: on paper the best Rust
+  candidate (queue + worker + crash-safe JSONL spool), but perf requirement ≈ nil and the
+  correctness burden is threading semantics a rewrite would re-risk for no win ("nothing
+  breaks today"); (F) declarative config/brokers (work_manager, hook_engine, capability_broker)
+  4.9 — literal data, no-op runtime, portable to anything valuable in nothing.
+- **Candidate matrix summary:** Python 6/6 · Go 0/6 (paper verdicts only — evidence-starved,
+  not installed, kill tests unrunnable locally) · Rust 0/6 (kill tests runnable via the
+  existing std-only interop harness) · C unscored (no FFI-adjacent cluster surfaced).
+  Best-language moment found anywhere: robfig/cron replacing ~37 hand-rolled cron-parsing
+  lines (cron_engine.py:199-236) — ergonomics nicety, not a fit verdict.
+- **Kill tests (frozen in synthesis.md):** Rust-A — re-express `_run_command`
+  (tool_executor.py:1064) with std::process + manual timeout; kill if >2× the ~40-line
+  Python wrapper (Q4 predicts it is); Go-A — port `cron_engine._run_loop` with os/exec,
+  measure task-fire latency delta (prediction: zero — 60 s sleep and child runtime dominate);
+  B — parse the largest observed tool-protocol stream 1000× in Python; kill if total <1 s
+  (no rewrite yields an observable win); C — instrument `_run_loop`
+  (local_tool_runtime.py:417), log non-HTTP CPU per iteration (prediction <1% of wall);
+  D — time `assemble`+`_admit` on the largest stored context, kill if <10 ms; E — fault-inject
+  kill -9 during spool append; if recovery semantics already hold, the rewrite has no
+  correctness win to buy; F — none needed: absence of any win condition IS the disproof.
+- **Sources + lessons:** live-fetched 2026-09-29 — annotations in
+  `research/wave1/runtime-core/outward-sources.md`; headline lessons: Rust std::process lacks
+  child timeout (Q4); Go os/exec reaches parity but changes only syntax (Q1); Python
+  json/regex C-backed (Q5b); serde typed structs mismatch dynamic model output (Q5a);
+  concurrency features irrelevant at ≤2 threads (Q6).
+- **Evidence sufficiency:** Python verdicts fully evidenced inward+outward; Go execution-side
+  evidence honestly starved (paper kill tests carried forward); E's JSONL-spool crash-safety
+  claim rests on inward semantics only — flagged in synthesis.md.
+
+## W7 — Operator + TUI (units: rune_operator 61 fns, rune_tui 161 fns — largest module, tui_validator)
+
+- **Research round actor:** general-3 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/tui/`: inward.md, outward/ ×8, outward-sources.md, synthesis.md)
+- **Intention profile:** terminal rendering, input handling, rich layout, hot store state, supervisory
+  command surface. Design decision 4 holds: TUI consumes the interop contract, never rewritten first.
+- **Decision:** **KEEP-PYTHON (TUI shell; all 4 clusters, zero RECODE, no carve-out found).**
+  Cluster scores (1 = recode, 5 = keep): (A) rendering/widgets 4 — no hot loop exists; render is
+  plain Rich `Text` concatenation (rune_tui.py:1331, chat_bubble.py:157), only animation a 0.12 s
+  spinner (:263), no markdown/Syntax parsing anywhere in src/rune; (B) event glue (~50 `_cmd_*`
+  handlers, reactives, tool-widget maps) 5 — this is Textual's core competency (workers,
+  `exclusive=True`, `call_from_thread`); vendor docs (ratatui) admit "little to no help in organizing
+  large applications"; (C) model send path + envelope 5 — synchronous `send_task` in async worker;
+  the envelope shape (`success/response/thinking/tool_events/degraded`, rune_tui.py:3624ff) is
+  ALREADY the de-facto interop contract; (D) subprocess/streaming 5 — JSONL streaming precedent
+  already in-tree (`_cmd_pull` :3443-3517): the pattern for consuming recoded units, not a recode
+  target. Whole-TUI native recode 1/5 REJECTED — 80+ first-party module coupling, framework-provided
+  concurrency re-implemented by hand; Go additionally toolchain-blocked. Countervailing evidence
+  (Bubble Tea/tview/Codex TUI maturity) recorded honestly in outward-sources.md — it does not
+  outweigh the coupling.
+- **⚠ CONTRACT GAP FLAGGED (binds Waves 2–7):** `shared/native_units.py` parses only the LAST
+  stdout line — it must gain a JSONL streaming reader (per-line `json.loads` + terminal-envelope
+  validation) before any recoded long-running unit can stream progress to the TUI. Small, testable,
+  non-breaking; candidate for the first Wave 2 implementation issue.
+- **Adapter surface (TUI as consumer — adopted as the rubric's interop-contract restatement):**
+  (1) single-invocation stateless CLI (`native_unit <op> [args]`, no daemon); (2) success = final
+  stdout line `{"ok":true, …}` generalizing the model-send envelope — recoded units emitting
+  `response`/`tool_events`/`degraded` plug in with zero TUI changes; (3) failure = `ok:false` +
+  nonzero exit, stderr human-only, success = exit 0 AND not timed out; (4) mandatory `--version`
+  on every unit (status bar + `canary_tui_drift.py` detect live units vs Python fallback);
+  (5) JSONL streaming mode for long ops with terminal sentinel envelope; (6) per-call timeout
+  budget, `timed_out` surfaced in `NativeResult` for graceful degradation; (7) streamed events
+  referencing UI objects carry the TUI's stable keys — `(channel, call_id)` for tool widgets
+  (:3676), WorkPane `_entries` object ids (:1239) — preserved verbatim; (8) std-only for
+  proof-phase units.
+- **Candidate matrix summary:** Python 4/4 clusters · Rust/Go whole-TUI 1/5 rejected · carve-out
+  candidates: none found (future markdown parsing would carve as a Rust native unit behind the
+  adapter, not now).
+- **Kill tests (frozen in synthesis.md):** stay-Python — killed if >16 ms UI-thread stalls under
+  heavy event bursts OR IPC latency dominates message round-trip (Textual pilot measurement);
+  Rust recode — killed if the adapter must expose >~15 first-party modules (count today ≈80:
+  killed NOW); Go recode — additionally killed by toolchain absence (`command -v go` empty).
+- **Sources + lessons:** 8 live-fetched 2026-09-29 (Textual workers guide, ratatui vendor docs,
+  Bubble Tea/tview/Codex countervailing evidence, JSON Lines spec, push-granular-work guidance) —
+  annotations in `research/wave1/tui/outward-sources.md`.
+- **Evidence sufficiency (honest):** full inward read of all 5 TUI files with line refs; ≥2 sources
+  per major claim; gap = no runtime profiling (stall kill test unmeasured — but no mechanism exists
+  for the stall to occur; the 120 ms 21-step pipeline was already removed, `_run_warm_router`
+  :3575 is a no-op).
+
+## W2 — Leaf utilities & canaries (~40 modules, low coupling: pins, time_awareness, message_queue, event_envelope, attention_capsule, complexity_scorer, token_optimizer, cache 501/17, prompt_sync, chat_bubble, ~15 canary_* modules)
+
+- **Research round actor:** general-6 (COMPLETED 2026-09-29 — full report in actor notification)
+- **Intention profile:** small pure helpers, envelopes, scoring, cache; smallest blast radius; the
+  factory + interop proving ground at real scale.
+- **Ground-truth measurements (local, this session):** Python fn call ~46 ns (100k timed
+  iterations in-process) · native CLI roundtrip ~658 µs (subprocess to
+  `interop/rebase-proof/target/release/rebase-proof --version`) · Python startup floor ~18 ms ·
+  overhead ratio ≈ **14,000×**. The only CI-proven interop contract is the subprocess CLI boundary
+  (`shared/native_units.py`: argv in → JSON stdout, `--version`, timeout, typed `NativeResult`).
+  PyO3/in-process bindings excluded by Wave 0 policy. Therefore every per-call crossing costs
+  ≥658 µs — a per-turn helper would need to run >14,000× faster in Rust to break even.
+- **Candidate matrix (representative — full per-cluster 0–2 scoring in round report):**
+  Python 12/12 in every cluster · Rust 5–6/12 · Go 1–3/12 (D5=0, not installed) · C 1–2/12.
+  No module contains a hot loop (heaviest: 2 `re.sub` per turn in token_optimizer).
+- **Decision:** **KEEP-PYTHON (all ~40, zero RECODE).** Cluster verdicts: (a) pure CRUD helpers
+  pins/time_awareness/token_optimizer — KEEP, CPython 3.11+ already 10–60% faster on this shape
+  (PEP 659); (b) message/envelope/capsule structures — KEEP, recode would insert a boundary
+  between the chattiest neighbors; (c) cache.py (501 L, largest in wave) — KEEP, the fast part is
+  already C (sqlite3 DB-API 2.0 over SQLite's C library), Python is thin orchestration, batching
+  (threshold 50 / 30 s) already amortizes writes; (d) chat_bubble.py — KEEP, **hard-pinned** to
+  Python by the Textual framework (recode = full framework abandonment, bottleneck is human
+  typing speed); (e) prompt_sync.py glue — KEEP, glue into Python siblings (memory_env,
+  voice_sync, build_pipeline_policy); (f) ~19 canary_* — KEEP **categorically**, a canary that
+  verifies Python importability cannot exist in another language.
+- **Kill tests (reopening criteria, all fail today on first cheap measurement):** Rust — microbench
+  one per-turn helper behind the native_units CLI, must beat the Python in-process call >10×
+  end-to-end including the 658 µs crossing (whole call <~46 µs; a trivial `--version` already
+  costs 658 µs); Go — identical benchmark post-install, uninstall if roundtrip >100 µs with no
+  named hot path; C — identical benchmark + required fuzz-clean JSON roundtrip, plus a
+  demonstrated GC-free allocation-hot loop first; cache.py — recode only if Python-side
+  orchestration (excl. sqlite3 waits) exceeds 5% of end-to-end latency; capsule/envelope/queue —
+  recode only if one turn's Python total exceeds ~5 ms AND a candidate's CLI path is >10× cheaper.
+- **Sources + lessons:** (1) https://docs.python.org/3/whatsnew/3.11.html — 10–60% faster,
+  PEP 659 specializing interpreter: CPython already optimized for helper-shaped code, the D2
+  baseline is a moving improving target; (2) https://docs.python.org/3/whatsnew/3.13.html —
+  free-threading/JIT experimental, KEEP-PYTHON ≠ frozen but no bets on experimental paths;
+  (3) https://www.maturin.rs/ — in-process Rust↔Python needs a whole binding/packaging toolchain
+  atop the CLI boundary, D3 worse than measured 658 µs (Wave 0 policy excludes it anyway);
+  (4) https://go.dev/doc/install — Go is a pre-install prerequisite, D5=0 everywhere, never earned
+  installation; (5) https://textual.textualize.io/ — Textual is a Python TUI framework,
+  chat_bubble.py framework-pinned; (6) https://docs.python.org/3/library/sqlite3.html — sqlite3 is
+  DB-API 2.0 over C, cache.py's perf layer already native. All fetched live 2026-09-29.
+- **⚠ Inventory drift (VERIFIED 2026-09-29):** complexity_scorer.py listed in
+  rebase-inventory.json (2 mentions) but absent on disk — deleted in commit 867321e
+  ("governed retirement — complexity_scorer deleted (602 lines)"). Wave 0 inventory needs a
+  correction pass; the module was scored nowhere (no source to characterize).
+
+---
+
+## Wave-plan consequence (T5 scope, from the verdict above)
+
+With **0 recode units awarded**, the tranche's hypothesized rebase volume is real only as the
+work below. Waves 2–9 are **disposition + named improvements, NOT mass recoding**:
+
+**Waves 2–7 — per-issue disposition (the 1,852 `[rebase w{wave}]` issues):**
+Each issue receives its tranche §7 disposition — improve / fix / missing-connectors answered
+with evidence — plus a language verdict of **KEEP-PYTHON with its rubric evidence line**
+(the round section for that subsystem names the claim). Disposition runs leaf-first
+(Wave 2 → 7), the canonical suite stays green throughout, and no issue closes without its
+evidence line. A recode is off the table unless a frozen kill test is reopened — and then
+tranche §6 still governs: **no benchmark win, no recode.** Go is not installed and earned no
+installation; Rust stays toolchain-ready but unjustified (standing option behind the
+CI-proven adapter).
+
+**Named improvements — the actual rebase volume (ship alongside disposition):**
+1. **JSONL streaming reader for `shared/native_units.py`** (W7 contract gap): the adapter
+   parses only the LAST stdout line; it must gain per-line `json.loads` + terminal-envelope
+   validation before any recoded long-running unit could stream progress. Small, testable,
+   non-breaking — first implementation issue of Wave 2.
+2. **httpx retry/timeout wrapper for the provider layer** (W4): the honest reliability
+   upgrade is a feature-add, not a language change.
+3. **orjson upgrade path** (W3 cluster 1): the only credible Python-side JSON win —
+   in-process, no boundary crossing. **DISPOSITION (2026-09-29, kill test EXECUTED and
+   FAILED — KEEP-PYTHON stands, no dependency declared):** microbench on the live
+   `~/.rune/consolidation/knowledge.json` (3,540,959 bytes, n=30 best-of): load 13.15 ms
+   std vs 7.85 ms orjson = **1.68× (bar ≥2×: FAIL)**; dump 9.58 ms std vs 5.61 ms
+   orjson-with-decode = **1.71× (bar ≥5×: FAIL)**; raw-bytes dump 1.39 ms = 6.91× but is
+   not drop-in (every `write_text`/`json.dump`-to-file site would need a bytes→str or
+   binary-write conversion). Roundtrip equality verified. Bench: `/tmp/orjson_bench.py`
+   shape (uvx --with orjson). The bytes trap measured real: decode() eats ~60% of the
+   dump win.
+4. **complexity_scorer.py inventory correction**: listed in `rebase-inventory.json` but
+   deleted on disk (commit `867321e`, 602 lines) — Wave 0 inventory needs the correction
+   pass. **DISPOSITION (2026-09-29, DONE):** inventory regenerated per the script's own
+   header (never hand-edit) — 177→213 files, 1,852→2,314 functions, 13 dead files
+   dropped; committed + pushed `5bc837c`. The W2 round's "2 mentions" drift claim
+   verified FALSE against the live inventory (zero hits).
+5. **robfig/cron** (W6): recorded as a best-language footnote only; no action.
+
+**Wave 8 — TUI integration proof:** demonstrate the TUI reading/utilising the mixed-language
+surfaces that exist (the `interop/rebase-proof` unit through the upgraded adapter), per the
+8-point adapter surface adopted above.
+**Wave 9 — close-out audit:** 100% of the 1,852 issues dispositioned, debt-table revision,
+version bump.
+
+## Cross-cutting candidates (evaluated once, referenced by every subsystem)
+
+- **Rust (present, 1.98.1):** interop proof unit already CI-proven (std-only, zero crates, `interop/rebase-proof/`, adapter in `shared/native_units.py`, ok = exit 0 AND not timed out).
+- **Go (absent):** must earn installation through D1–D5 evidence here before any recode targets it.
+- **C (present, GCC 16.2.1):** expected to lose D6 in most subsystems; scored where FFI-adjacent work exists.
+- **Python (KEEP baseline):** the default. Every subsystem begins here; evidence must move it.
+
+## Evidence ledger (per-source lessons, all rounds)
+
+Index of per-source evidence. Full annotations live in each round's
+`research/wave1/<subsystem>/outward-sources.md`; this ledger records the headline lesson
+each source contributed and the rubric claims it supports.
+
+| Round | Sources (live-fetched 2026-09-29) | Headline lessons | Supports |
+|---|---|---|---|
+| W2 leaf utilities | 6: python.org 3.11 + 3.13 whatsnew, maturin.rs, go.dev/doc/install, textual.textualize.io, docs.python.org sqlite3 | CPython 3.11+ already 10–60% faster on helper-shaped code (PEP 659) — D2 baseline is a moving target; free-threading/JIT experimental, no bets; in-process bindings need a whole toolchain atop the CLI boundary (excluded by Wave 0 policy anyway); Go is pre-install prerequisite, D5=0; Textual framework-pins chat_bubble.py; sqlite3 perf layer already C | W2 KEEP-PYTHON ×~40; the 14,000× crossing-overhead law |
+| W3 memory | 6: orjson, sled, sqlite-vec, SQLite FTS5 docs, Go json/v2 rewrite issue, pydantic-core | orjson is the only credible Python-side JSON win (in-process, no boundary); SQLite FTS5/vec0 compute is already C; Go's JSON stack mid-rewrite upstream (versioning risk); pydantic-core shows the Rust-as-wheel pattern, excluded by policy | W3 KEEP-PYTHON 7/7; orjson upgrade path on cluster 1 |
+| W4 provider-layer | 8: live-fetched O1–O8 (HTTP/SSE ecosystem, tokio-stack precedents incl. mistral.rs, pkg.go.dev/net/http, ollama Go client/server) | stdlib-only Rust has no realistic HTTP/SSE precedent — the zero-crate contract decides Rust out of all network-wire clusters by construction; Go's stdlib HTTP+NDJSON streaming is capability-proven (its losses here are evidence-absence, not capability-absence); the honest reliability upgrade is a Python httpx retry/timeout wrapper — feature-add, not language change | W4 KEEP-PYTHON 5/5; SSE-cluster Rust kill-by-construction |
+| W5 orchestration | 4: pydantic-core, ruff blog, go.dev FAQ, Python 3.14 hashlib docs + 1 LOCAL EXPERIMENT (n=100 adapter benchmark) | adapter round-trips at 0.63ms/op — subprocess-per-op viable for coarse ops, never per-event; Python "slowness" dissolves where compute already runs in C via stdlib; the language question is really "where is the hot loop" (here: nowhere) | W5 KEEP-PYTHON 6/6; K1 kill test already run |
+| W6 runtime-core | headline lessons (full set in round outward-sources.md) | Rust std::process lacks built-in child timeout — strictly more code under zero-crate; Go os/exec reaches parity but changes only syntax; Python json/regex C-backed so rewrite swaps C for compiled code at equal asymptotic cost; serde typed structs mismatch schema-flexible model output; concurrency features irrelevant at ≤2 threads | W6 STAY-PYTHON 6/6; robfig/cron as best-language footnote |
+| W7 TUI | 8: Textual workers guide, ratatui vendor docs, Bubble Tea/tview/Codex TUI (countervailing), JSON Lines spec, push-granular-work guidance | Textual workers/`call_from_thread` are the core competency for event glue; ratatui admits "little to no help in organizing large applications"; countervailing native-TUI frameworks recorded honestly — do not outweigh 80+ module coupling; JSONL per-line parse + terminal sentinel is the streaming contract; vendor guidance: push granular speed-sensitive work to subcomponents only when measured | W7 KEEP-PYTHON 4/4; the 8-point adapter surface (adopted as the rubric's interop-contract restatement) |

docs/rebase-wave0-report.md

@@ -0,0 +1,50 @@
+# Wave 0 close-out report — language-rebasing tranche R1
+
+Branch: `tranche-r1-wave-0` · Date: 2026-09-29
+
+## 1. Inventory (docs/rebase/rebase-inventory.json)
+
+- 177 Python modules, ~52,750 lines, 227 classes
+- TRUE unit count: **1,852 = 1,030 top-level functions + 822 class methods**
+- Zero duplicate call edges, zero method leaks (generator double-walk defect
+  root-caused and fixed in scripts/rebase_inventory.py)
+- Cross-verified against an independent fresh AST walk: zero missing units;
+  six inventory-"extras" are real nested/if-try-block classes the naive walk
+  misses (inventory is MORE complete, not less)
+
+## 2. Issue factory (scripts/rebase_issue_factory.py)
+
+- One issue per unit following R1 §7; wave-batched (2–7); dedup-safe via
+  deterministic title `[rebase w{wave}] {relpath}::{unit}` + existing-titles
+  scan per run (retries never duplicate — preserve-first)
+- `plan` → {2: 239, 3: 251, 4: 129, 5: 544, 6: 415, 7: 274} = 1,852,
+  zero unassigned
+- `sample --wave 5` → full §7 template holds; `_compute_hash` exactly once as
+  labelled callee with line number
+- Contract fix during Wave 0: `--limit` default changed 5 → 0 (unlimited) for
+  `create`; `sample` keeps its 5. A full-wave create with the old default
+  would have silently truncated each wave to five issues.
+
+## 3. Interop proof unit (R1 §5)
+
+- Rust unit at interop/rebase-proof/ (std-only, zero crates): argv in → JSON
+  on stdout, non-zero exit on failure, mandatory `--version`
+- Shell-proven: version flag, JSON out, exit 2 on failure, stderr diagnostic
+- Python thin adapter shared/native_units.py: typed NativeResult, timeout +
+  stderr capture, unit failures as data (never exceptions)
+- Adapter contract fix during Wave 0: `ok` no longer requires a JSON
+  `ok:true` field — plain-text output (`--version`) succeeds on exit code
+- tests/test_native_interop_proof.py: **8 passed** — version contract, sum
+  happy path, hash determinism, failure paths, timeout, stderr capture
+
+## 4. Per-wave issue creation
+
+<!-- FILLED BY THE COMPLETION LOOP — do not hand-edit -->
+
+- Wave 4 (129 units): created=127 skipped(dedup)=2 (includes smoke #417–418)
+- Wave 2 (239 units): created=239 skipped(dedup)=0
+- Wave 3 (251 units): created=251 skipped(dedup)=0
+- Wave 5 (544 units): created=544 skipped(dedup)=0
+- Wave 6 (415 units): created=415 skipped(dedup)=0
+- Wave 7 (274 units): created=274 skipped(dedup)=0
+- TOTAL: 1,850 created + 2 dedup = 1,852 / 1,852 ✅ full coverage

docs/rebase/rebase-wave-coverage.json

@@ -0,0 +1,12 @@
+{
+ "units_per_wave": {
+  "2": 239,
+  "3": 251,
+  "4": 129,
+  "5": 544,
+  "6": 415,
+  "7": 274
+ },
+ "unassigned_modules": {},
+ "unassigned_module_count": 0
+}

docs/tui-registry.md

@@ -9,6 +9,7 @@ new surface._
 |---|---|---|
 | `rune_tui.py` | The main Textual application — chat pane, work pane, status bar (version label + refresh), footer, dialogs | The known giant (file-size debt tracked in henxels); composition root for all UI |
 | `tui_validator.py` | Import-allowlist validation for TUI code | Drift defect tracked in #139 (allowlist vs `__future__`/relative imports) |
+| `tui_backlog.py` | Not a surface — the durable TUI Upgrade Backlog ledger (outstanding projection/control work per backend feature) | SCAFFOLD-TRANCHE-007; ledger only, never structural authority |
 
 ## Adding a TUI surface
 

docs/wr-fail-marker.py

@@ -1 +0,0 @@
-def broken(:

henxels.yaml

@@ -1,7 +1,7 @@
 settings:
   warn_about_similar_files:
     above: 0.85
-    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**"]
+    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**", "store/spine/**"]
 
 henxels:
   - henxel: "Canaries live at the repo's canary slot and are registered in CI"
@@ -20,7 +20,7 @@ henxels:
   - henxel: "Top-level docs are markdown or yaml references"
     in: ./docs/*
     allowed_filetypes: [.md, .yaml]
-    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json"]
+    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json", "./docs/rebase/**"]
 
   - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
     in: ./src/rune/*

interop/rebase-proof/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "rebase-proof"
+version = "0.1.0"

interop/rebase-proof/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "rebase-proof"
+version = "0.1.0"
+edition = "2021"
+
+# Wave 0 interop proof unit (R1 §5). Std-only by design: no crates, no network,
+# deterministic build. The pattern under proof is the CLI boundary itself, not the
+# computation inside it.
+
+[[bin]]
+name = "rebase-proof"
+path = "src/main.rs"
+
+[profile.release]
+strip = true

interop/rebase-proof/src/main.rs

@@ -0,0 +1,117 @@
+//! Wave 0 interop proof unit (R1 §5 of the language-rebasing tranche).
+//!
+//! Contract under proof:
+//! - standalone binary; argv in, JSON on stdout
+//! - non-zero exit on failure (JSON error object still printed to stdout)
+//! - `--version` flag mandatory
+//! - Python wraps it in a thin adapter (`shared/native_units.py`); tests call
+//!   it the same way.
+//!
+//! Ops: sum / echo / hash (fnv1a64) / sleep / fail. All std-only.
+
+use std::env;
+use std::process::exit;
+use std::thread;
+use std::time::Duration;
+
+const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// FNV-1a 64-bit — dependency-free deterministic hash for the proof unit.
+fn fnv1a64(data: &[u8]) -> u64 {
+    let mut hash: u64 = 0xcbf29ce484222325;
+    for byte in data {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    hash
+}
+
+fn print_json(line: &str) {
+    println!("{line}");
+}
+
+fn emit_ok(body: &str) {
+    print_json(&format!("{{\"ok\":true,{body}}}"));
+    exit(0);
+}
+
+fn emit_err(message: &str) -> ! {
+    // Escape the minimal set so the JSON stays parseable for arbitrary op names.
+    let escaped: String = message
+        .chars()
+        .map(|c| match c {
+            '"' => "\\\"".to_string(),
+            '\\' => "\\\\".to_string(),
+            '\n' => "\\n".to_string(),
+            '\r' => "\\r".to_string(),
+            '\t' => "\\t".to_string(),
+            other => other.to_string(),
+        })
+        .collect();
+    print_json(&format!("{{\"ok\":false,\"error\":\"{escaped}\"}}"));
+    exit(2);
+}
+
+fn main() {
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    if args.as_slice() == ["--version"] || args.as_slice() == ["-V"] {
+        println!("rebase-proof {VERSION}");
+        exit(0);
+    }
+    if args.is_empty() {
+        eprintln!("usage: rebase-proof <op> [args...] | --version");
+        emit_err("no op given");
+    }
+
+    let op = args[0].as_str();
+    let rest = &args[1..];
+
+    match op {
+        "sum" => {
+            let mut total: i128 = 0;
+            for a in rest {
+                match a.parse::<i128>() {
+                    Ok(v) => total += v,
+                    Err(_) => emit_err(&format!("sum: not an integer: {a}")),
+                }
+            }
+            emit_ok(&format!("\"op\":\"sum\",\"result\":{total}"));
+        }
+        "echo" => {
+            let joined = rest.join(" ");
+            let escaped: String = joined
+                .chars()
+                .map(|c| match c {
+                    '"' => "\\\"".to_string(),
+                    '\\' => "\\\\".to_string(),
+                    '\n' => "\\n".to_string(),
+                    '\r' => "\\r".to_string(),
+                    '\t' => "\\t".to_string(),
+                    other => other.to_string(),
+                })
+                .collect();
+            emit_ok(&format!("\"op\":\"echo\",\"text\":\"{escaped}\""));
+        }
+        "hash" => {
+            let joined = rest.join(" ");
+            let h = fnv1a64(joined.as_bytes());
+            emit_ok(&format!("\"op\":\"hash\",\"fnv1a64\":\"{h:016x}\""));
+        }
+        "sleep" => {
+            let ms: u64 = match rest.first().map(|s| s.parse::<u64>()) {
+                Some(Ok(v)) => v,
+                _ => emit_err("sleep: expected milliseconds"),
+            };
+            thread::sleep(Duration::from_millis(ms));
+            emit_ok(&format!("\"op\":\"sleep\",\"slept_ms\":{ms}"));
+        }
+        "fail" => {
+            // Deliberate failure: stderr diagnostic + JSON error + exit 2.
+            // Proves stderr capture and non-zero exit in the adapter.
+            eprintln!("rebase-proof: deliberate failure for adapter proof");
+            emit_err("deliberate failure");
+        }
+        other => emit_err(&format!("unknown op: {other}")),
+    }
+}

lint-baseline.json

@@ -1,4 +1,4 @@
 {
-  "BLE001": 352,
-  "S110": 80
-}
+  "BLE001": 347,
+  "S110": 75
+}

memory/index/capability_cards.json

@@ -1 +1,401 @@
-[]
+[
+  {
+    "name": "read_file",
+    "description": "Read a file with optional windowed viewing (offset/limit). Returns numbered lines. Use offset/limit for large files (100 lines at a time).",
+    "capabilities": [
+      "read_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path exists and is a readable file"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_file read a file with optional windowed viewing (offset/limit). returns numbered lines. use offset/limit for large files (100 lines at a time). native tool"
+  },
+  {
+    "name": "edit_file",
+    "description": "Surgical search/replace edit. More reliable than full file rewrites. The search string must match exactly.",
+    "capabilities": [
+      "edit_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "search string matches exactly once"
+    ],
+    "side_effects": [
+      "rewrites the target file atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "edit_file surgical search/replace edit. more reliable than full file rewrites. the search string must match exactly. native tool"
+  },
+  {
+    "name": "write_file",
+    "description": "Write content to a file. Creates parent directories if needed. Shows diff before writing. Use for new files or full rewrites.",
+    "capabilities": [
+      "write_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory"
+    ],
+    "side_effects": [
+      "writes the full file content atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "write_file write content to a file. creates parent directories if needed. shows diff before writing. use for new files or full rewrites. native tool"
+  },
+  {
+    "name": "glob_files",
+    "description": "Find files matching a glob pattern. Returns file paths sorted by modification time.",
+    "capabilities": [
+      "glob_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "glob_files find files matching a glob pattern. returns file paths sorted by modification time. native tool"
+  },
+  {
+    "name": "grep_files",
+    "description": "Search for a pattern in files. Returns file paths and line numbers. Use include to filter by file type.",
+    "capabilities": [
+      "grep_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "grep_files search for a pattern in files. returns file paths and line numbers. use include to filter by file type. native tool"
+  },
+  {
+    "name": "list_directory",
+    "description": "List files and directories at a path. Returns names with / suffix for directories.",
+    "capabilities": [
+      "list_directory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path is a readable directory"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "list_directory list files and directories at a path. returns names with / suffix for directories. native tool"
+  },
+  {
+    "name": "lint_file",
+    "description": "Lint a file for syntax errors and style issues. Blocks bad edits. Supports Python (ruff), JS/TS (eslint), Go (golangci-lint), and more.",
+    "capabilities": [
+      "lint_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "file exists",
+      "a linter is configured for the language"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "lint_file lint a file for syntax errors and style issues. blocks bad edits. supports python (ruff), js/ts (eslint), go (golangci-lint), and more. native tool"
+  },
+  {
+    "name": "run_tests",
+    "description": "Run tests for a file or project. Auto-detects test runner from language.",
+    "capabilities": [
+      "run_tests"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "a test runner is configured for the project"
+    ],
+    "side_effects": [
+      "runs project test commands which may create or delete files"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_tests run tests for a file or project. auto-detects test runner from language. native tool"
+  },
+  {
+    "name": "format_code",
+    "description": "Auto-format code files. Supports Python (black/ruff), JS/TS (prettier), Go (gofmt), and more.",
+    "capabilities": [
+      "format_code"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "a formatter is configured for the language"
+    ],
+    "side_effects": [
+      "rewrites files in place to the formatter's style"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "format_code auto-format code files. supports python (black/ruff), js/ts (prettier), go (gofmt), and more. native tool"
+  },
+  {
+    "name": "git_diff",
+    "description": "Show git diff for staged or unstaged changes.",
+    "capabilities": [
+      "git_diff"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_diff show git diff for staged or unstaged changes. native tool"
+  },
+  {
+    "name": "git_log",
+    "description": "Show recent git commits.",
+    "capabilities": [
+      "git_log"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_log show recent git commits. native tool"
+  },
+  {
+    "name": "git_commit",
+    "description": "Commit changes with a message. Auto-stages modified files.",
+    "capabilities": [
+      "git_commit"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "working directory is a git repository",
+      "there are changes to commit"
+    ],
+    "side_effects": [
+      "creates a commit on the current branch"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_commit commit changes with a message. auto-stages modified files. native tool"
+  },
+  {
+    "name": "repo_map",
+    "description": "Generate an AST-based codebase map showing key symbols (classes, functions, imports). Uses tree-sitter for 100+ languages.",
+    "capabilities": [
+      "repo_map"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "target directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "repo_map generate an ast-based codebase map showing key symbols (classes, functions, imports). uses tree-sitter for 100+ languages. native tool"
+  },
+  {
+    "name": "run_command",
+    "description": "Run an approved command. Prefer argv (shell=False); shell syntax requires shell=true and explicit user approval.",
+    "capabilities": [
+      "run_command"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "operator approves the command",
+      "required binaries are on PATH"
+    ],
+    "side_effects": [
+      "executes arbitrary commands with their full side effects"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_command run an approved command. prefer argv (shell=false); shell syntax requires shell=true and explicit user approval. native tool"
+  },
+  {
+    "name": "read_persona",
+    "description": "Read Rune's persona definition. Returns the full persona block with voice, identity, and rules.",
+    "capabilities": [
+      "read_persona"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "persona MEMORY.md exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_persona read rune's persona definition. returns the full persona block with voice, identity, and rules. native tool"
+  },
+  {
+    "name": "query_memory",
+    "description": "Query Rune's memory store. Returns relevant memories for a query.",
+    "capabilities": [
+      "query_memory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "memory store database is available"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "query_memory query rune's memory store. returns relevant memories for a query. native tool"
+  },
+  {
+    "name": "check_growth",
+    "description": "Check Rune's growth log. Returns recent growth entries and patterns.",
+    "capabilities": [
+      "check_growth"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "growth log file exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "check_growth check rune's growth log. returns recent growth entries and patterns. native tool"
+  },
+  {
+    "name": "diagnose_behavior",
+    "description": "Diagnose Rune's current behavior. Returns analysis of persona adherence, voice consistency, and drift.",
+    "capabilities": [
+      "diagnose_behavior"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "recent response text provided"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "diagnose_behavior diagnose rune's current behavior. returns analysis of persona adherence, voice consistency, and drift. native tool"
+  },
+  {
+    "name": "find_capability",
+    "description": "Search all installed capabilities for what you need. Returns matching tool names with descriptions and argument schemas. Use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session.",
+    "capabilities": [
+      "find_capability"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "a capability query describing the needed outcome"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "find_capability search all installed capabilities for what you need. returns matching tool names with descriptions and argument schemas. use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session. native tool"
+  }
+]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rune"
-version = "0.66.14"
+version = "0.89.1"
 description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
 requires-python = ">=3.10"
 

pyright-baseline.json

@@ -1,5 +1,5 @@
 {
-  "errorCount": 120,
-  "warningCount": 465,
+  "errorCount": 117,
+  "warningCount": 454,
   "informationCount": 0
 }

pyrightconfig.json

@@ -1,29 +1,34 @@
 {
-    "typeCheckingMode": "standard",
-    "pythonVersion": "3.14",
-    "reportMissingImports": "warning",
-    "reportMissingModuleSource": "none",
-    "reportMissingTypeStubs": "none",
-    "reportUnknownArgumentType": "none",
-    "reportUnknownParameterType": "none",
-    "reportUnknownVariableType": "none",
-    "reportUnknownMemberType": "none",
-    "reportMissingTypeArgument": "none",
-    "reportUntypedFunctionDecorator": "none",
-    "reportUntypedClassDecorator": "none",
-    "reportUntypedBaseClass": "none",
-    "reportPrivateUsage": "none",
-    "reportOptionalMemberAccess": "warning",
-    "reportUnnecessaryIsInstance": "warning",
-    "reportUnnecessaryComparison": "warning",
-    "reportUnnecessaryTypeIgnoreComment": "warning",
-    "reportPossiblyUnboundVariable": "error",
-    "reportUndefinedVariable": "error",
-    "reportAttributeAccessIssue": "warning",
-    "include": ["src/rune"],
-    "exclude": [
-        "src/rune/__pycache__",
-        "**/node_modules",
-        "**/__pycache__"
-    ]
-}
+  "typeCheckingMode": "standard",
+  "pythonVersion": "3.14",
+  "reportMissingImports": "warning",
+  "reportMissingModuleSource": "none",
+  "reportMissingTypeStubs": "none",
+  "reportUnknownArgumentType": "none",
+  "reportUnknownParameterType": "none",
+  "reportUnknownVariableType": "none",
+  "reportUnknownMemberType": "none",
+  "reportMissingTypeArgument": "none",
+  "reportUntypedFunctionDecorator": "none",
+  "reportUntypedClassDecorator": "none",
+  "reportUntypedBaseClass": "none",
+  "reportPrivateUsage": "none",
+  "reportOptionalMemberAccess": "warning",
+  "reportUnnecessaryIsInstance": "warning",
+  "reportUnnecessaryComparison": "warning",
+  "reportUnnecessaryTypeIgnoreComment": "warning",
+  "reportPossiblyUnboundVariable": "error",
+  "reportUndefinedVariable": "error",
+  "reportAttributeAccessIssue": "warning",
+  "include": [
+    "src/rune"
+  ],
+  "exclude": [
+    "src/rune/__pycache__",
+    "**/node_modules",
+    "**/__pycache__"
+  ],
+  "extraPaths": [
+    "scripts"
+  ]
+}

requirements-ci.txt

@@ -18,9 +18,9 @@ certifi==2026.7.22
     #   httpx
 chardet==7.6.0
     # via diff-cover
-coverage==7.16.0
+coverage==7.16.2
     # via rune (pyproject.toml)
-diff-cover==10.5.1
+diff-cover==10.6.0
     # via rune (pyproject.toml)
 frozenlist==1.8.0
     # via
@@ -34,7 +34,7 @@ httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via rune (pyproject.toml)
-idna==3.19
+idna==3.20
     # via
     #   anyio
     #   httpx
@@ -50,27 +50,27 @@ markdown-it-py==4.2.0
     #   mdit-py-plugins
     #   rich
     #   textual
-markupsafe==3.0.3
+markupsafe==3.0.4
     # via jinja2
 mdit-py-plugins==0.6.1
     # via textual
 mdurl==0.1.2
     # via markdown-it-py
-multidict==6.8.0
+multidict==6.9.1
     # via
     #   aiohttp
     #   yarl
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pyright
 packaging==26.3
     # via pytest
-platformdirs==4.11.8
+platformdirs==4.12.3
     # via textual
 pluggy==1.6.0
     # via
     #   diff-cover
     #   pytest
-propcache==0.5.2
+propcache==0.5.4
     # via
     #   aiohttp
     #   yarl
@@ -116,7 +116,7 @@ typing-extensions==4.16.0
     #   pyright
     #   textual
     #   textual-autocomplete
-websockets==17.1
+websockets==17.2
     # via rune (pyproject.toml)
-yarl==1.24.5
+yarl==1.25.1
     # via aiohttp

scripts/await_intent.py

@@ -0,0 +1,494 @@
+"""await_intent.py — ASYNC CORRECTIVE PATCH: intent normalization at the
+execution boundary.
+
+PRINCIPLE: MODEL OUTPUT = INTENT. RUNE CONTROLLER = EXECUTION SEMANTICS.
+
+The model may express continuation intent in any quality — `await_operation
+(deadline_secs=1200)`, `await-operation [op_type=master_ci, sha=X]`,
+"sleep 300 then check CI", "poll until done". When a matching
+PendingOperation exists (or the deterministic resolver can derive the
+operation truth from git/Gitea state), the controller executes the
+CANONICAL continuation and discards model-supplied scheduling policy.
+
+Authority provenance for timing:
+  USER_EXPLICIT / EXTERNAL_CONTRACT / TEST_HARNESS /
+  GOVERNED_OPERATION_POLICY  -> authoritative, retained
+  MODEL_INVENTED             -> non-authoritative, ignored
+
+This module owns NO storage: it reads the existing W/R wait store
+(rune.event_wait) and git/Gitea state. The canonical continuation remains
+scripts/ci_event_wait.py run() (the T21.5 single-logical-await).
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+if str(_SCRIPT_DIR) not in sys.path:
+    sys.path.insert(0, str(_SCRIPT_DIR))
+_REPO_SRC = str(_SCRIPT_DIR.parent / "src")
+if _REPO_SRC not in sys.path:
+    sys.path.insert(0, _REPO_SRC)
+
+WR_BRIDGE = Path(os.environ.get("RUNE_WR_ROOT", "/mnt/workdrive/wr-bridge"))
+REPO = Path("/mnt/workdrive/issue161-harness")
+GIT_TIMEOUT = 10
+
+# Default policy deadline per operation type — GOVERNED_OPERATION_POLICY.
+# The model's numbers never become policy; these are the controller's.
+POLICY_DEADLINES = {
+    "branch_ci": 1800,
+    "pull_request_checks": 1800,
+    "master_ci": 1800,
+    "deploy": 900,
+    "release": 900,
+}
+
+VALID_OP_TYPES = ("branch_ci", "pull_request_checks", "master_ci",
+                  "deploy", "release")
+
+
+# ── timing provenance ───────────────────────────────────────────────────────
+
+def classify_timing_provenance(model_deadline: Any = None,
+                               user_deadline: Any = None,
+                               contract_deadline: Any = None) -> tuple[int, str]:
+    """Resolve the effective deadline + its provenance.
+
+    Authority order: USER_EXPLICIT > EXTERNAL_CONTRACT > TEST_HARNESS >
+    GOVERNED_OPERATION_POLICY. MODEL_INVENTED values are recorded but
+    NEVER used as policy.
+    """
+    if model_deadline is not None:
+        try:
+            model_deadline = int(model_deadline)
+        except (TypeError, ValueError):
+            model_deadline = None
+    if user_deadline is not None:
+        return int(user_deadline), "USER_EXPLICIT"
+    if contract_deadline is not None:
+        return int(contract_deadline), "EXTERNAL_CONTRACT"
+    return (model_deadline or 0), "MODEL_INVENTED"  # caller discards this
+
+
+# ── PendingOperation lookup over the existing W/R wait store ────────────────
+
+def _load_wait_records() -> list[dict]:
+    """All durable wait records from the bridge store (read-only)."""
+    out = []
+    waits = WR_BRIDGE / "waits"
+    if not waits.is_dir():
+        return out
+    for f in sorted(waits.glob("*.json")):
+        try:
+            rec = json.loads(f.read_text())
+            rec["_file"] = f.name
+            out.append(rec)
+        except (OSError, ValueError):
+            continue
+    return out
+
+
+def _rec_operation_id(rec: dict) -> str:
+    return str((rec.get("ext") or {}).get("operation_id")
+               or rec.get("operation_id") or "")
+
+
+def _rec_sha(rec: dict) -> str:
+    return str(rec.get("sha") or "")
+
+
+def pending_operations(sha: str = "", op_type: str = "") -> list[dict]:
+    """Pending (non-terminal) operations, optionally filtered."""
+    terminal = {"COMPLETED", "FAILED", "CLOSED", "CANCELLED", "EXPIRED"}
+    out = []
+    for rec in _load_wait_records():
+        status = str(rec.get("status", "")).upper()
+        if status in terminal:
+            continue
+        if sha and _rec_sha(rec) != sha:
+            continue
+        out.append(rec)
+    return out
+
+
+def find_op_type_for_sha(sha: str) -> str | None:
+    """The op_type a prior canonical wait already recorded for this SHA
+    (objective text embeds the type: 'event-driven {op_type} qualification')."""
+    for rec in _load_wait_records():
+        if _rec_sha(rec) != sha:
+            continue
+        obj = str(rec.get("continuation", {}).get("objective", ""))
+        m = re.search(r"event-driven (\w+) qualification", obj)
+        if m and m.group(1) in VALID_OP_TYPES:
+            return m.group(1)
+    return None
+
+
+# ── deterministic op_type derivation from repo/Gitea truth ─────────────────
+
+def _git(*args: str) -> str:
+    try:
+        r = subprocess.run(["git", "-C", str(REPO), *args],
+                           capture_output=True, text=True, timeout=GIT_TIMEOUT)
+        return r.stdout.strip()
+    except (OSError, subprocess.TimeoutExpired):
+        return ""
+
+
+def sha_branch(sha: str) -> str:
+    """Branch(es) containing this commit in the local repo."""
+    return _git("branch", "--all", "--contains", sha)
+
+
+def sha_on_master(sha: str) -> bool:
+    """SHA is an ancestor of master (local or remote-tracking refs).
+
+    M10 correction (2026-09-19): --all so a freshly fetched master
+    (refs/remotes/gitea/master) counts; local branches alone go stale
+    between fetches. derive_op_type refreshes refs before calling this.
+    """
+    out = _git("branch", "--all", "--contains", sha)
+    for l in out.splitlines():
+        s = l.strip().removeprefix("remotes/").removesuffix(" *")
+        if s == "master" or s.endswith("/master"):
+            return True
+    return False
+
+
+def open_pr_for_sha(sha: str) -> int | None:
+    """Is there an OPEN PR whose head SHA is this one? (Gitea API, read-only.)"""
+    try:
+        sys.path.insert(0, str(_SCRIPT_DIR))
+        import gitea_auth  # noqa: E402
+        st, prs = gitea_auth.api("/pulls?state=open&limit=50")
+        if st != 200:
+            return None
+        for p in prs:
+            hs = str(p.get("head") or {}).get("sha") if isinstance(
+                p.get("head"), dict) else None
+            if hs and str(hs).startswith(sha[:12]):
+                return int(p.get("number"))
+    except Exception:  # noqa: BLE001 — resolver must never crash the tool
+        return None
+    return None
+
+
+def derive_op_type(sha: str) -> tuple[str, str]:
+    """Deterministically derive the canonical op_type for a SHA.
+
+    Returns (op_type, evidence). Order (A-patch §2 amendment):
+      1. POST-PATCH normalized record (ext.intent_normalized=true) — true
+         stored operation truth, wins outright;
+      2. open PR for the sha -> pull_request_checks;
+      3. sha ancestor of master -> master_ci;
+      4. sha on a feature branch -> branch_ci;
+      5. legacy (pre-patch) records only CONFIRM, never override — they
+         were created from model-supplied defaults and cannot be trusted.
+    Never trusts model input.
+    """
+    # 0. M10 correction (2026-09-19): refresh remote-tracking refs before
+    #    inference. A just-merged master commit is invisible to
+    #    branch --contains until refs are fetched; stale local git state
+    #    must never outrank repo truth. Bounded by GIT_TIMEOUT, fail-open.
+    _git("fetch", "--quiet", "gitea", "+refs/heads/*:refs/remotes/gitea/*")
+    for rec in _load_wait_records():
+        if _rec_sha(rec) != sha:
+            continue
+        if (rec.get("ext") or {}).get("intent_normalized"):
+            obj = str(rec.get("continuation", {}).get("objective", ""))
+            m = re.search(r"event-driven (\w+) qualification", obj)
+            if m and m.group(1) in VALID_OP_TYPES:
+                return m.group(1), "normalized_record:" + m.group(1)
+    pr = open_pr_for_sha(sha)
+    if pr:
+        return "pull_request_checks", f"open_pr:#{pr}"
+    if sha_on_master(sha):
+        return "master_ci", "commit_ancestor_of_master"
+    return "branch_ci", "commit_on_feature_branch"
+
+
+# ── intent normalization ────────────────────────────────────────────────────
+
+def normalize_action(action: dict, *,
+                     model_deadline: Any = None,
+                     user_deadline: Any = None,
+                     contract_deadline: Any = None,
+                     task_id: str = "") -> dict:
+    """Normalize a model continuation action into the canonical continuation.
+
+    action: {kind: await_operation|sleep_poll|check_status|unknown,
+             sha?: str, operation_id?: str, op_type?: str, raw?: str}
+    task_id: REAL_ASYNC_BRIDGE §9 — when the caller knows its task
+             binding, pending-operation resolution is scoped to operations
+             registered with that task_id; stale global operations are
+             never consulted when a binding exists.
+    Returns:
+      {normalized: bool, action: "ContinuePendingOperation", operation_id,
+       op_type, authority, deadline_secs, deadline_provenance,
+       model_deadline_ignored, model_op_type_ignored, evidence}
+    or {normalized: False, reason: ...} / {normalized: "AMBIGUOUS", candidates}
+    """
+    sha = str(action.get("sha") or "")
+    op_id = str(action.get("operation_id") or "")
+    model_op_type = action.get("op_type")
+    model_deadline_ignored = model_deadline is not None
+    model_op_type_ignored = model_op_type is not None
+
+    # 0. task binding scope (§9): task-bound operations beat global state.
+    #    Stored operation wins over ANY model hint (sha/op_type/deadline).
+    if task_id and not op_id:
+        bound = [r for r in pending_operations()
+                 if str(r.get("ext", {}).get("task_id", "")) == task_id]
+        if len(bound) == 1:
+            rec = bound[0]
+            norm = _canonical_from_record(rec, model_deadline_ignored,
+                                          model_op_type_ignored,
+                                          "task_bound",
+                                          user_deadline, contract_deadline)
+            norm["sha_for_wait"] = _rec_sha(rec)
+            norm["task_id"] = task_id
+            return norm
+        if len(bound) > 1:
+            return {"normalized": "AMBIGUOUS",
+                    "candidates": [_rec_operation_id(c) for c in bound],
+                    "reason": f"multiple pending operations bound to task {task_id}"}
+        return {"normalized": False,
+                "reason": f"no pending operation bound to task {task_id}"}
+
+    # 1. explicit operation_id wins
+    if op_id:
+        from rune import event_wait as ew  # noqa: E402
+        rec = ew.operation_wait(op_id)
+        if rec is None:
+            # REAL_ASYNC_BRIDGE §10: a FRESH operation has no wait record
+            # yet — registration happens at the park step (ci_event_wait).
+            # For an explicit, well-formed, EXISTING commit id, return the
+            # provisional canonical continuation (policy deadline, own-runs
+            # authority) so the model-facing tool can park on first call.
+            # A typo'd/ghost sha is refused here (A-patch lesson): the
+            # commit must exist in the repository.
+            import re as _re
+            m = _re.fullmatch(r"ci-([0-9a-f]{40})", op_id)
+            if m:
+                sha40 = m.group(1)
+                probe = subprocess.run(
+                    ["git", "-C", str(REPO), "cat-file", "-e",
+                     f"{sha40}^{{commit}}"],
+                    capture_output=True, timeout=15)
+                if probe.returncode == 0:
+                    return {
+                        "normalized": True,
+                        "action": "ContinuePendingOperation",
+                        "operation_id": op_id,
+                        "sha_for_wait": sha40,
+                        "op_type": "branch_ci",
+                        "authority": "ci_runs",
+                        "deadline_secs": POLICY_DEADLINES["branch_ci"],
+                        "deadline_provenance": "GOVERNED_OPERATION_POLICY",
+                        "model_deadline_ignored": model_deadline_ignored,
+                        "model_op_type_ignored": model_op_type_ignored,
+                        "evidence": "explicit_id_fresh_registration",
+                    }
+            return {"normalized": False,
+                    "reason": f"operation_id {op_id} has no wait record"}
+        return _canonical_from_record(rec, model_deadline_ignored,
+                                      model_op_type_ignored, "explicit_id",
+                                      user_deadline, contract_deadline)
+
+    # 2. resolve by sha / active operation.
+    # H-PATCH H2/H3: the model sha is a HINT. If it doesn't resolve but
+    # unambiguous pending operations exist, the STORED target wins — a
+    # mistyped model sha must never create a ghost operation (the A-patch
+    # live failure: a typo'd sha derived branch_ci for a nonexistent commit
+    # and parked a wait on a ghost).
+    # 2. no explicit operation_id: resolve by sha / pending operations.
+    # H-PATCH: when the model provides NO sha (operation-id-first mode),
+    # resolve from unambiguous pending operations — the model should not
+    # need to reconstruct a 40-char sha to express "wait for it".
+    if not sha:
+        all_pending = pending_operations()
+        if len(all_pending) == 1:
+            rec = all_pending[0]
+            norm = _canonical_from_record(rec, model_deadline_ignored,
+                                          model_op_type_ignored,
+                                          "auto_resolved_no_sha",
+                                          user_deadline, contract_deadline)
+            norm["sha_for_wait"] = _rec_sha(rec)
+            return norm
+        if len(all_pending) > 1:
+            return {"normalized": "AMBIGUOUS",
+                    "candidates": [_rec_operation_id(c) for c in all_pending],
+                    "reason": "multiple pending operations, no sha hint"}
+        return {"normalized": False,
+                "reason": "no pending operations and no sha provided"}
+
+    candidates = pending_operations(sha=sha)
+    if len(candidates) > 1 and not sha:
+        return {"normalized": "AMBIGUOUS",
+                "candidates": [_rec_operation_id(c) for c in candidates],
+                "reason": "multiple pending operations, no target"}
+    if len(candidates) == 1:
+        rec = candidates[0]
+        stored_sha = _rec_sha(rec)
+        norm = _canonical_from_record(rec, model_deadline_ignored,
+                                      model_op_type_ignored, "pending_match",
+                                      user_deadline, contract_deadline)
+        if sha and stored_sha and sha != stored_sha:
+            norm["model_sha_mismatch"] = {
+                "model_sha": sha, "stored_sha": stored_sha,
+                "resolution": "stored_target_used"}
+        return norm
+    # model sha unresolved: any unambiguous pending op at all? then the
+    # model probably mistyped the sha — use the stored target, log it.
+    all_pending = pending_operations()
+    if len(all_pending) == 1 and sha:
+        rec = all_pending[0]
+        stored_sha = _rec_sha(rec)
+        norm = _canonical_from_record(rec, model_deadline_ignored,
+                                      model_op_type_ignored,
+                                      "unresolved_sha_single_pending",
+                                      user_deadline, contract_deadline)
+        norm["model_sha_mismatch"] = {
+            "model_sha": sha, "stored_sha": stored_sha,
+            "resolution": "stored_target_used"}
+        return norm
+
+    # 3. no stored record: derive truth deterministically
+    if not sha:
+        return {"normalized": False,
+                "reason": "no pending operation and no sha to resolve"}
+    op_type, evidence = derive_op_type(sha)
+    return {
+        "normalized": True,
+        "action": "ContinuePendingOperation",
+        "operation_id": f"ci-{sha}",
+        "op_type": op_type,
+        "authority": "ci_runs" if op_type in ("branch_ci",
+                                              "pull_request_checks")
+                     else "deploy_qualify",
+        "deadline_secs": POLICY_DEADLINES[op_type],
+        "deadline_provenance": "GOVERNED_OPERATION_POLICY",
+        "model_deadline_ignored": model_deadline_ignored,
+        "model_op_type_ignored": model_op_type_ignored,
+        "evidence": evidence,
+    }
+
+
+def _canonical_from_record(rec: dict, model_deadline_ignored: bool,
+                           model_op_type_ignored: bool, how: str,
+                           user_deadline: Any, contract_deadline: Any) -> dict:
+    op_id = _rec_operation_id(rec)
+    obj = str(rec.get("continuation", {}).get("objective", ""))
+    m = re.search(r"event-driven (\w+) qualification", obj)
+    recorded = m.group(1) if (m and m.group(1) in VALID_OP_TYPES) else None
+    rec_sha = _rec_sha(rec)
+    if (rec.get("ext") or {}).get("intent_normalized") or how == "explicit_id":
+        # normalized record or explicit id: stored truth wins
+        op_type = recorded or "master_ci"
+    else:
+        # legacy record: git/Gitea derivation outranks the model-era default
+        op_type, _ev = derive_op_type(rec_sha) if rec_sha else \
+            (recorded or "master_ci", "no_sha")
+    deadline, prov = classify_timing_provenance(
+        user_deadline=user_deadline, contract_deadline=contract_deadline)
+    if prov == "MODEL_INVENTED" or not deadline:
+        deadline = POLICY_DEADLINES.get(op_type, 1800)
+        prov = "GOVERNED_OPERATION_POLICY"
+    return {
+        "normalized": True,
+        "action": "ContinuePendingOperation",
+        "operation_id": op_id,
+        "op_type": op_type,
+        "authority": "ci_runs" if op_type in ("branch_ci",
+                                              "pull_request_checks")
+                     else "deploy_qualify",
+        "deadline_secs": deadline,
+        "deadline_provenance": prov,
+        "model_deadline_ignored": model_deadline_ignored,
+        "model_op_type_ignored": model_op_type_ignored,
+        "matched_by": how,
+    }
+
+
+def normalize_bash(command: str, *, sha_hint: str = "") -> dict | None:
+    """Recognize sleep/check/poll intent aimed at a known pending operation.
+
+    Returns a normalization record if the command's semantic intent is
+    continuation of a known external operation; None if the command is
+    legitimate local timing (short sync, user delay, backoff) with no
+    pending operation to continue. NEVER returns an executed sleep.
+    """
+    if not command:
+        return None
+    cmd = command.strip()
+    # long sleep + (status-check language or an explicit sha hint)
+    sleep_m = re.search(r"\bsleep\s+(\d{2,5})\b", cmd)
+    if not sleep_m:
+        return None
+    secs = int(sleep_m.group(1))
+    check_intent = bool(re.search(
+        r"\b(ci|deploy|release|status|check|poll|pipeline|run)\b", cmd,
+        re.IGNORECASE))
+    sha = sha_hint or ""
+    m = re.search(r"\b([0-9a-f]{40}|[0-9a-f]{12})\b", cmd)
+    if m:
+        sha = m.group(1)
+    if not check_intent and not sha:
+        return None  # plain sleep, no continuation intent
+    cands = pending_operations(sha=sha) if sha else pending_operations()
+    if not cands and not sha:
+        return None
+    if len(cands) > 1:
+        return {"normalized": "AMBIGUOUS",
+                "candidates": [_rec_operation_id(c) for c in cands],
+                "raw_command_kind": "sleep_poll"}
+    rec = cands[0] if cands else None
+    if rec is not None:
+        norm = _canonical_from_record(rec, True, False, "sleep_poll_intent",
+                                      None, None)
+        norm["sha_for_wait"] = _rec_sha(rec)
+    elif sha:
+        op_type, evidence = derive_op_type(sha)
+        norm = {
+            "normalized": True, "action": "ContinuePendingOperation",
+            "operation_id": f"ci-{sha}", "op_type": op_type,
+            "authority": "ci_runs" if op_type in ("branch_ci",
+                                                  "pull_request_checks")
+                         else "deploy_qualify",
+            "deadline_secs": POLICY_DEADLINES[op_type],
+            "deadline_provenance": "GOVERNED_OPERATION_POLICY",
+            "model_deadline_ignored": True, "model_op_type_ignored": False,
+            "evidence": evidence, "sha_for_wait": sha,
+        }
+    else:
+        return None
+    norm["raw_command_kind"] = "sleep_poll"
+    norm["raw_sleep_seconds_suppressed"] = secs
+    return norm
+
+
+def emit_normalized_record(record: dict) -> None:
+    """Compact structured observability — one JSONL line per normalization.
+    No payloads, no secrets."""
+    try:
+        log = _SCRIPT_DIR.parent / "store" / "await_intent_log.jsonl"
+        log.parent.mkdir(parents=True, exist_ok=True)
+        slim = {k: record.get(k) for k in (
+            "normalized", "action", "operation_id", "op_type", "authority",
+            "deadline_secs", "deadline_provenance", "model_deadline_ignored",
+            "model_op_type_ignored", "matched_by", "evidence",
+            "raw_command_kind", "raw_sleep_seconds_suppressed", "reason",
+            "candidates") if k in record}
+        slim["at"] = __import__("time").strftime(
+            "%Y-%m-%dT%H:%M:%SZ", __import__("time").gmtime())
+        with open(log, "a") as f:
+            f.write(json.dumps(slim, sort_keys=True) + "\n")
+    except OSError:
+        pass

scripts/await_intent_cli.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""await_intent_cli.py — CLI surface for the intent normalization layer.
+
+Used by the await-operation harness tool so the MODEL's scheduling hints
+never reach the wait engine. Prints one JSON line.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import await_intent  # noqa: E402
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    n = sub.add_parser("normalize", help="normalize a continuation intent")
+    n.add_argument("--sha", default="")
+    n.add_argument("--operation-id", default="")
+    n.add_argument("--task-id", default="",
+                   help="§9 task binding: scope pending resolution to "
+                        "operations registered for this task")
+    n.add_argument("--model-op-type", default=None)
+    n.add_argument("--model-deadline", default=None)
+    n.add_argument("--user-deadline", default=None,
+                   help="USER_EXPLICIT deadline (authoritative)")
+    n.add_argument("--contract-deadline", default=None,
+                   help="EXTERNAL_CONTRACT deadline (authoritative)")
+    rb = sub.add_parser("route-bash",
+                        help="route a Bash command expressing wait intent")
+    rb.add_argument("--command", required=True)
+    rb.add_argument("--sha-hint", default="")
+    args = ap.parse_args()
+
+    if args.cmd == "route-bash":
+        record = await_intent.normalize_bash(args.command,
+                                             sha_hint=args.sha_hint)
+        if record is None:
+            print(json.dumps({"normalized": False,
+                              "reason": "no external continuation intent"}))
+            return 0
+        if record.get("normalized") is True:
+            # the compiled wait needs the SHA: derive from operation_id
+            oid = str(record.get("operation_id", ""))
+            if oid.startswith("ci-"):
+                record["sha_for_wait"] = oid[3:]
+        await_intent.emit_normalized_record(record)
+        print(json.dumps(record, sort_keys=True))
+        return 0
+
+    action = {"kind": "await_operation", "sha": args.sha,
+              "operation_id": args.operation_id,
+              "op_type": args.model_op_type}
+    model_deadline = (int(args.model_deadline)
+                      if args.model_deadline else None)
+    user_deadline = (int(args.user_deadline)
+                     if args.user_deadline else None)
+    contract_deadline = (int(args.contract_deadline)
+                         if args.contract_deadline else None)
+    record = await_intent.normalize_action(
+        action, model_deadline=model_deadline,
+        user_deadline=user_deadline, contract_deadline=contract_deadline,
+        task_id=args.task_id)
+    await_intent.emit_normalized_record(record)
+    print(json.dumps(record, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/ci_event_wait.py

@@ -0,0 +1,588 @@
+#!/usr/bin/env python3
+"""ci_event_wait.py — T16 §16C/§16D: event-driven CI qualification wait.
+
+Replaces the deploy.yml sleep-30 → query → repeat polling loop with the
+EXISTING W/R event bridge (src/rune/event_wait.py — the SAME primitive the
+builder adapter uses; §16E: one bridge, adapters differ only in identity
+and authority probe).
+
+Flow (mandate §16C):
+
+    push / CI workflow starts
+        ↓
+    register correlation  (provider="gitea", event_type="ci_completed",
+                           run_ref="ci-<sha>", sha=<sha>)
+        ↓
+    WAITING_FOR_EVENT     (await_resume_event: select() on FIFO, no floor)
+        ↓
+    ci.yml final job POSTs /process-event  (the WAKE)
+        ↓
+    daemon matches → resume_cmd fires → FIFO token → controller resumes
+        ↓
+    canonical Gitea state INDEPENDENTLY re-read (deploy_qualify.py verdict)
+        ↓
+    verdict
+
+The event is a WAKE, never truth. The final verdict always comes from
+deploy_qualify.py (required-checks context + exact-SHA ci.yml run, both
+legs). Watchdog deadline is a FAILURE DETECTOR, never the scheduler:
+
+  - event arrives → authority re-read; pending → bounded re-arm until the
+    overall deadline (ack-window semantics, same as the daemon's wake sweep).
+  - event lost/suppressed → watchdog expires → ONE-SHOT authority query:
+    terminal verdict → recovered truthfully (no invented wait);
+    CI still running (non-terminal Gitea runs for the SHA) → re-arm;
+    nothing alive and no verdict → truthful failure (deployment refused).
+
+Exit codes: 0 = qualified (success), 1 = refused (failure/timeout).
+Output: one JSON line with the §16D latency-proof timestamps.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(_SCRIPT_DIR))
+sys.path.insert(0, str(_SCRIPT_DIR.parent / "src"))
+
+sys.path.insert(0, str(_SCRIPT_DIR))
+from rune import event_wait as ew  # noqa: E402
+import completion_file as cf  # noqa: E402
+
+REPO_ROOT = _SCRIPT_DIR.parent
+QUALIFY_SCRIPT = _SCRIPT_DIR / "deploy_qualify.py"
+
+
+def authority_verdict(sha: str = "") -> str:
+    """ONE-SHOT canonical Gitea verdict via deploy_qualify.py — the only
+    completion truth. Never parses the event payload.
+
+    H-PATCH H4: the target sha is passed EXPLICITLY (as the subprocess's
+    --sha argument) — ambient DEPLOY_SHA can no longer change which
+    operation is verified. The env var remains only as a CLI backward
+    compat for deploy_qualify.py invoked standalone."""
+    cmd = [sys.executable, str(QUALIFY_SCRIPT)]
+    if sha:
+        cmd += ["--sha", sha]
+    proc = subprocess.run(
+        cmd,
+        capture_output=True, text=True, timeout=120,
+        env={k: v for k, v in os.environ.items() if k != "DEPLOY_SHA"}
+        if sha else dict(os.environ, PYTHONPATH=""),
+    )
+    out = (proc.stdout or "").strip().splitlines()
+    return (out[-1] if out else "pending").strip()
+
+
+# ── T21.5 §4: operation-specific completion authority ──────────────────────
+#
+# T21.4 root cause: the wait loop had ONE hard-coded authority
+# (deploy qualification = master-ref CI) while operations waited on
+# branch CI, PR checks, or merges. Wrong authority => nonterminal
+# returns => the MODEL had to re-arm (the generator of the sleeps).
+# The wait verifier MUST match the operation being waited for.
+
+OPERATION_SPECS = {
+    # op_type: {
+    #   workflow_path: Actions run path filter (None = any),
+    #   head_branches: head-branch filter (None = any),
+    #   authority: which canonical verifier decides completion,
+    #   event_types: expected wake event types,
+    #   terminal: terminal verdicts, failure: failure verdicts,
+    # }
+    "branch_ci": {
+        "workflow_path": "ci.yml",
+        "head_branches": None,
+        "authority": "ci_runs",          # any completed run for this SHA
+        "event_types": ("ci_completed",),
+        "terminal": ("success",),
+        "failure": ("failure", "cancelled"),
+    },
+    "pull_request_checks": {
+        "workflow_path": None,           # all PR-triggered runs for SHA
+        "head_branches": None,
+        "authority": "ci_runs",
+        "event_types": ("ci_completed",),
+        "terminal": ("success",),
+        "failure": ("failure", "cancelled"),
+    },
+    "master_ci": {
+        "workflow_path": "ci.yml",
+        "head_branches": ("master",),
+        "authority": "deploy_qualify",   # full two-leg qualification
+        "event_types": ("ci_completed",),
+        "terminal": ("success",),
+        "failure": ("failure", "cancelled"),
+    },
+    "deploy": {
+        "workflow_path": "deploy.yml",
+        "head_branches": ("master",),
+        "authority": "deploy_qualify",
+        "event_types": ("ci_completed", "deploy_completed"),
+        "terminal": ("success",),
+        "failure": ("failure", "cancelled"),
+    },
+    "release": {
+        "workflow_path": None,
+        "head_branches": ("master",),
+        "authority": "deploy_qualify",
+        "event_types": ("ci_completed", "release_completed"),
+        "terminal": ("success",),
+        "failure": ("failure", "cancelled"),
+    },
+}
+
+DEFAULT_OP_TYPE = "master_ci"
+
+
+def normalize_verdict(verdict: str) -> str:
+    """T21.5 §18 audit fix: pending-class verdicts are ALL nonterminal.
+    deploy_qualify emits "pending (probe failed)" for a transient probe
+    failure — that is pending, never a terminal answer. The wait loop
+    must not return control to the model over a string variant."""
+    v = (verdict or "").strip().lower()
+    if v.startswith("pending"):
+        return "pending"
+    return (verdict or "").strip()
+
+
+def op_spec(op_type: str) -> dict:
+    spec = OPERATION_SPECS.get(op_type)
+    if spec is None:
+        raise ValueError(
+            f"unknown op_type {op_type!r} — must be one of "
+            f"{sorted(OPERATION_SPECS)} (the wait verifier must match "
+            "the operation being waited for)")
+    return spec
+
+
+def op_authority_verdict(op_type: str, sha: str) -> str:
+    """Canonical completion verdict FOR THIS OPERATION TYPE.
+
+    ci_runs        — the op's own Actions runs for this exact SHA: every
+                     required workflow run completed; terminal iff every
+                     run of the op's workflow set concluded success
+                     (branch/PR ops are their own truth; deploy
+                     qualification is NOT their authority).
+    deploy_qualify — the two-leg deploy qualification (master CI +
+                     required-checks) via deploy_qualify.py.
+    """
+    spec = op_spec(op_type)
+    authority = spec["authority"]
+    if authority == "deploy_qualify":
+        v = normalize_verdict(authority_verdict(sha))
+        if v != "pending":
+            return v
+        # E-PATCH resilience: Gitea's combined commit-status endpoint can
+        # 404 for the newest commit (observed live on auto-version bump
+        # commits — the status object materializes late/never). The runs
+        # ARE the same evidence the two legs read; fall back to the
+        # operation-scoped runs verdict so authority stays resolvable.
+        if _status_endpoint_unreadable(sha):
+            return _ci_runs_verdict(spec, sha)
+        return v
+    if authority == "ci_runs":
+        return _ci_runs_verdict(spec, sha)
+    raise ValueError(f"unknown authority {authority!r} for {op_type!r}")
+
+
+def _status_endpoint_unreadable(sha: str) -> bool:
+    """True when the combined commit-status endpoint 404s for the SHA
+    (index lag / never-materialized status object) — the documented
+    fallback trigger, verified against the API once per call."""
+    try:
+        sys.path.insert(0, str(_SCRIPT_DIR))
+        import gitea_auth  # noqa: E402
+        st, _body = gitea_auth.api(f"/commits/{sha}/status")
+        return st == 404
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def _ci_runs_verdict(spec: dict, sha: str) -> str:
+    """Operation-scoped Actions-run verdict (import the API client from
+    deploy_qualify to keep ONE Gitea client)."""
+    sys.path.insert(0, str(_SCRIPT_DIR))
+    import deploy_qualify as dq  # noqa: E402
+    import gitea_auth  # noqa: E402
+    server = os.environ.get("GITEA_SERVER",
+                            getattr(gitea_auth, "DEFAULT_SERVER", "")).rstrip("/")
+    repo = os.environ.get("GITEA_REPO",
+                          getattr(gitea_auth, "DEFAULT_REPO", ""))
+    sha_env = sha  # H-PATCH: explicit parameter is the only authority
+    token = gitea_auth.get_token() if gitea_auth.has_token() else ""
+    if not (server and repo and sha_env and token):
+        return "pending"  # cannot verify -> not verified (fail closed)
+    runs = dq._fetch_runs(server, repo, sha_env, token)
+    if runs is None:
+        return "pending"  # probe failure -> keep waiting
+    wfp = spec["workflow_path"]
+    if wfp is not None:
+        runs = [r for r in runs
+                if str(r.get("path", "")).startswith(wfp + "@")]
+    branches = spec["head_branches"]
+    if branches is not None:
+        runs = [r for r in runs
+                if str(r.get("head_branch", "")) in branches]
+    if not runs:
+        return "pending"  # no runs visible yet -> not terminal
+    for r in runs:
+        if r.get("status") != "completed":
+            return "pending"  # still running
+        if r.get("conclusion") not in ("success", "skipped"):
+            return "failure"  # any non-success conclusion
+    return "success"
+
+
+def op_ci_alive(op_type: str, sha: str) -> bool:
+    """Liveness probe FOR THIS OPERATION TYPE: any non-terminal run in
+    the op's run set (failure DETECTOR, never the scheduler)."""
+    sys.path.insert(0, str(_SCRIPT_DIR))
+    import deploy_qualify as dq  # noqa: E402
+    import gitea_auth  # noqa: E402
+    spec = op_spec(op_type)
+    server = os.environ.get("GITEA_SERVER",
+                            getattr(gitea_auth, "DEFAULT_SERVER", "")).rstrip("/")
+    repo = os.environ.get("GITEA_REPO",
+                          getattr(gitea_auth, "DEFAULT_REPO", ""))
+    sha_env = sha  # H-PATCH: explicit parameter is the only authority
+    token = gitea_auth.get_token() if gitea_auth.has_token() else ""
+    if not (server and repo and sha_env and token):
+        return False
+    runs = dq._fetch_runs(server, repo, sha_env, token)
+    if not runs:
+        return False
+    wfp = spec["workflow_path"]
+    if wfp is not None:
+        runs = [r for r in runs
+                if str(r.get("path", "")).startswith(wfp + "@")]
+    branches = spec["head_branches"]
+    if branches is not None:
+        runs = [r for r in runs
+                if str(r.get("head_branch", "")) in branches]
+    terminal = {"success", "failure", "cancelled", "skipped"}
+    return any(str(r.get("status", "")).lower() not in terminal
+               for r in runs)
+
+
+def authority_after_wake(op_type: str = DEFAULT_OP_TYPE, sha: str = "",
+                         max_tries: int = 3, gap_secs: int = 4) -> str:
+    """(sha is EXPLICIT — ambient env never selects the target.)"""
+    """Post-wake authority read. The daemon's own wake sweep uses a
+    bounded event-triggered retry (4s ×3) for the job-finished-microseconds-
+    ago ack window; a verdict read here can hit the same window. This is a
+    bounded schedule, not a polling loop — 3 reads max, then back to the
+    event wait / watchdog."""
+    verdict = "pending"
+    for attempt in range(max_tries):
+        verdict = op_authority_verdict(op_type, sha)
+        if verdict != "pending":
+            return verdict
+        if attempt < max_tries - 1:
+            time.sleep(gap_secs)
+    return verdict
+
+
+def ci_alive() -> bool:
+    """LEGACY liveness probe (master-ref deploy runs) — kept for callers
+    predating op specs; run() uses op_ci_alive(op_type, sha)."""
+    return op_ci_alive(DEFAULT_OP_TYPE, os.environ.get("DEPLOY_SHA", ""))
+
+
+def _set_cognition_state(op: str, state: str) -> None:
+    """E-PATCH §12: stamp cognitive quiescence on the durable record so a
+    fresh process knows cognition is parked (WAITING_EXTERNAL) vs resumable
+    (RESUMABLE). Best-effort: observability never breaks the wait."""
+    try:
+        rec = ew.operation_wait(op)
+        if rec is None:
+            return
+        wait_file = ew.wr_root() / "waits" / f"{rec.get('wait_id')}.json"
+        if not wait_file.is_file():
+            return
+        data = json.loads(wait_file.read_text())
+        data.setdefault("ext", {})["continuation_state"] = state
+        wait_file.write_text(json.dumps(data, indent=1, sort_keys=True))
+    except (OSError, ValueError):
+        pass
+
+
+def run(*, sha: str, deadline_secs: int,
+        watchdog_secs: int = 300,
+        op_type: str = DEFAULT_OP_TYPE,
+        task_id: str = "",
+        daemon_url: str = ew.DEFAULT_DAEMON_URL) -> int:
+    """T21.5 §3: ONE LOGICAL AWAIT.
+
+    One logical external wait is one invocation of this function. All
+    nonterminal conditions (event-seen-authority-pending, watchdog expiry
+    with live runs, bounded authority-retry exhausted) re-arm INTERNALLY —
+    control returns to the caller ONLY on a terminal verdict or on real
+    deadline expiry. Watchdogs are failure detectors inside this
+    abstraction, never the scheduler and never completion truth.
+    """
+    spec = op_spec(op_type)          # unknown op_type refused upfront
+    op = f"ci-{sha}"
+    # A-PATCH: the authority subprocess reads DEPLOY_SHA from the env;
+    # python-level run() callers (tool normalization flow) must export it.
+    if sha and not os.environ.get("DEPLOY_SHA"):
+        os.environ["DEPLOY_SHA"] = sha
+    # H-PATCH: resolve short SHAs to full 40-char — _fetch_runs and
+    # deploy_qualify match on the FULL sha; a 12-char prefix would
+    # silently fail equality and park the waiter until deadline
+    # (the 962e351 root cause).
+    if sha and len(sha) < 40:
+        try:
+            full = subprocess.run(
+                ["git", "-C", str(_SCRIPT_DIR.parent), "rev-parse", sha],
+                capture_output=True, text=True, timeout=10)
+            if full.returncode == 0:
+                sha = full.stdout.strip()
+                os.environ["DEPLOY_SHA"] = sha
+        except (OSError, subprocess.TimeoutExpired):
+            pass
+    t0 = time.time()
+    # REAL_ASYNC_BRIDGE: FIFO is replaced by completion-file inotify.
+    # The completion file write is the wake signal; inotify is the
+    # kernel-level zero-latency, zero-CPU wake primitive.
+    # Event replay (T16 §16C live finding): on a serialized runner the
+    # completion event usually arrives BEFORE the waiter registers.
+    # A matching durable event means the wake already happened — skip
+    # the rendezvous entirely and go straight to the authority read.
+    prior = ew.find_matching_event("gitea", "ci_completed", op)
+    if prior is not None and prior.get("exit_code") is not None:
+        rec = ew.register_process_wait(
+            op, project="rune",
+            objective=f"event-driven {op_type} qualification for {sha}",
+            watched_for="Gitea CI completion event (replayed from the "
+                        "durable event log)",
+            provider="gitea", event_type="ci_completed", sha=sha,
+            watchdog_secs=min(watchdog_secs, deadline_secs),
+            continuation_state="RESUMABLE",  # event already arrived
+            op_type=op_type,
+            authority=spec["authority"])
+        registered_at = rec["created_at"]
+        event_at = time.strftime(
+            "%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+        resumed_at = event_at
+        # the event is a WAKE, never truth — canonical authority decides
+        verdict = normalize_verdict(authority_after_wake(op_type, sha))
+        if verdict == "pending" and not op_ci_alive(op_type, sha):
+            verdict = normalize_verdict(op_authority_verdict(op_type, sha))
+        mode = ("event_replayed" if verdict != "pending"
+                else "authority_unresolved")
+        verdict_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+        out = {
+            "sha": sha,
+            "op_type": op_type,
+            "authority": spec["authority"],
+            "registered_at": registered_at,
+            "event_received_at": event_at,
+            "controller_resumed_at": resumed_at,
+            "verdict_at": verdict_at,
+            "mode": mode,
+            "rearm_reason": "completion event replayed from durable log "
+                            "(arrived before registration)",
+            "verdict": verdict,
+            "wall_secs": round(time.time() - t0, 3),
+        }
+        print(json.dumps(out))
+        return 0 if verdict == "success" else 1
+    rec = ew.register_process_wait(
+        op, project="rune",
+        objective=f"event-driven {op_type} qualification for {sha}",
+        watched_for="Gitea CI completion event (wake; verdict re-read "
+                    f"from canonical {spec['authority']} authority)",
+        provider="gitea", event_type="ci_completed", sha=sha,
+        watchdog_secs=min(watchdog_secs, deadline_secs),
+        continuation_state="WAITING_EXTERNAL",
+        op_type=op_type,
+        authority=spec["authority"],
+        task_id=task_id,  # §9: bind the operation to the calling task
+        resume_mode="self")  # §3: waiter owns its continuation via
+                             # completion-file/inotify; the daemon has NO
+                             # session-delivery role for this wait
+    registered_at = rec["created_at"]
+    _set_cognition_state(op, "WAITING_EXTERNAL")  # cognition parked
+    deadline = time.monotonic() + deadline_secs
+    verdict = "pending"
+    mode = "event"
+    event_at = ""
+    resumed_at = ""
+    rearm_reason = ""
+    rearm_count = 0
+    while time.monotonic() < deadline:
+            remaining = max(1, int(deadline - time.monotonic()))
+
+            # REAL_ASYNC_BRIDGE: block on inotify for the completion file.
+            # Zero CPU, zero arbitrary timer. The inotify timeout is a
+            # FAILURE DETECTOR — if no event arrives within the watchdog
+            # window, we check the authority directly (lost-event recovery).
+            # The deadline is containment only.
+            watch_timeout = min(remaining, watchdog_secs)
+            result = cf.wait_for_completion(
+                op, timeout_secs=watch_timeout)
+
+            # REAL_ASYNC_BRIDGE: check durable event log AND wait record
+            # status on EVERY cycle — the daemon may have matched and
+            # transitioned the record via /process-event.
+            wr = ew.operation_wait(op)
+            if wr and wr.get("status") in ("COMPLETED", "FAILED",
+                                           "READY_TO_RESUME"):
+                event_at = event_at or time.strftime(
+                    "%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+                resumed_at = time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                           time.gmtime())
+                verdict = normalize_verdict(
+                    authority_after_wake(op_type, sha))
+                if verdict != "pending":
+                    mode = "event"
+                    break
+            prior = ew.find_matching_event("gitea", "ci_completed", op)
+            if prior is not None and prior.get("exit_code") is not None:
+                event_at = event_at or time.strftime(
+                    "%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+                resumed_at = time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                           time.gmtime())
+                verdict = normalize_verdict(
+                    authority_after_wake(op_type, sha))
+                if verdict != "pending":
+                    mode = "event"
+                    break
+            if result is not None:
+                # completion file exists: event arrived
+                event_at = event_at or time.strftime(
+                    "%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+                resumed_at = time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                           time.gmtime())
+                verdict = normalize_verdict(
+                    authority_after_wake(op_type, sha))
+                if verdict != "pending":
+                    mode = "event"
+                    break
+                rearm_count += 1
+                rearm_reason = ("completion file seen; authority "
+                                "pending — re-subscribing")
+                continue
+
+            # inotify timeout: no event within watchdog window
+            # FAILURE DETECTOR: check authority directly
+            verdict = normalize_verdict(
+                op_authority_verdict(op_type, sha))
+            if verdict != "pending":
+                mode = "watchdog_authority_recovered"
+                break
+            rearm_count += 1
+            rearm_reason = ("watchdog expiry; op pending (not started "
+                            "or lagging) — re-subscribing inotify")
+            continue
+
+    # REAL_ASYNC_BRIDGE: no FIFO to close. The completion file is durable
+    # and survives restarts. Lease release is not needed (no lease system
+    # for file-based delivery).
+
+
+    if verdict == "pending":
+        if mode == "event":
+            mode = "deadline_pending"
+        verdict = normalize_verdict(op_authority_verdict(op_type, sha))  # final one-shot truth
+    _set_cognition_state(op, "RESUMABLE" if verdict != "pending"
+                         else "RECOVERY_REQUIRED")
+    verdict_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    # §2 STATE OWNERSHIP: the WAITER owns the OPERATION domain. On a
+    # terminal authority verdict, stamp the durable record terminal with
+    # the evidence — the daemon's session-delivery machinery must never
+    # (and can no longer) overwrite this truth. Also updates the parked
+    # continuation_state so fresh-process recovery sees reality.
+    try:
+        rec2 = ew.operation_wait(op) or rec
+        if verdict != "pending":
+            rec2["status"] = "COMPLETED" if verdict == "success" else "FAILED"
+            rec2["verdict"] = verdict
+            rec2["resume_evidence"] = {
+                "kind": "authority_verified_terminal",
+                "verdict": verdict,
+                "mode": mode,
+                "authority": spec["authority"],
+                "sha": sha,
+                "op_type": op_type,
+                "verdict_at": verdict_at,
+            }
+        rec2["ext"] = {**rec2.get("ext", {}),
+                       "continuation_state": ("RESUMABLE" if verdict != "pending"
+                                              else "RECOVERY_REQUIRED")}
+        ew._load_waitstore().save(rec2)
+    except Exception as _e:  # noqa: BLE001 — record stamping must never corrupt the envelope (the envelope + authority remain the truth)
+        print(f"ci_event_wait: terminal record stamp failed: {_e}",
+              file=sys.stderr)
+    out = {
+        "sha": sha,
+        "op_type": op_type,
+        "authority": spec["authority"],
+        "registered_at": registered_at,
+        "event_received_at": event_at,
+        "controller_resumed_at": resumed_at,
+        "verdict_at": verdict_at,
+        "mode": mode,
+        "rearm_reason": rearm_reason,
+        "internal_rearm_count": rearm_count,
+        "verdict": verdict,
+        "wall_secs": round(time.time() - t0, 3),
+    }
+    print(json.dumps(out))
+    return 0 if verdict == "success" else 1
+
+KNOWN_FLAGS = ("--sha", "--deadline", "--op-type", "--watchdog", "--task-id")
+
+
+def main() -> int:
+    """§5 CLI CONTRACT: no silent argument loss. Every flag is either
+    explicitly supported (and takes effect) or loudly rejected — an
+    acceptance envelope must reflect the configuration actually used."""
+    sha = os.environ.get("DEPLOY_SHA", "")
+    args = sys.argv[1:]
+    deadline = 900
+    op_type = DEFAULT_OP_TYPE
+    watchdog = 300
+    task_id = ""
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--sha":
+            sha = args[i + 1]; i += 2
+        elif a == "--deadline":
+            deadline = int(args[i + 1]); i += 2
+        elif a == "--op-type":
+            op_type = args[i + 1]; i += 2
+        elif a == "--watchdog":
+            watchdog = int(args[i + 1]); i += 2
+        elif a == "--task-id":
+            task_id = args[i + 1]; i += 2
+        elif a.startswith("--"):
+            print(json.dumps({"error": f"unknown flag {a!r}",
+                              "known_flags": list(KNOWN_FLAGS),
+                              "contract": "no silent argument loss"}))
+            return 2
+        else:
+            print(json.dumps({"error": f"unexpected positional {a!r}",
+                              "known_flags": list(KNOWN_FLAGS)}))
+            return 2
+    if not sha:
+        print(json.dumps({"error": "no sha (DEPLOY_SHA or --sha required)"}))
+        return 1
+    # A-PATCH fix: run()'s authority subprocess (deploy_qualify.py) reads
+    # DEPLOY_SHA from the environment — a CLI `--sha` consumer previously
+    # got a silent "pending" verdict forever because the var was never
+    # exported. Export it so the canonical authority can resolve.
+    os.environ["DEPLOY_SHA"] = sha
+    return run(sha=sha, deadline_secs=deadline, op_type=op_type,
+               watchdog_secs=watchdog, task_id=task_id)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/completion_file.py

@@ -0,0 +1,195 @@
+"""completion_file.py — REAL_ASYNC_BRIDGE: durable completion-file delivery
+with inotify wake. Replaces FIFO+lease for process-wait delivery.
+
+DESIGN:
+  Producer (bridge/daemon/notify):
+    1. Validates operation identity
+    2. Atomically writes a completion file:
+         resumes/<operation_id>.done
+       containing the event/verdict JSON (write to tmp, rename for atomicity)
+
+  Waiter (ci_event_wait / any continuation consumer):
+    1. Checks if the completion file already exists (event-before-waiter)
+    2. If not: registers inotify watch on the resumes/ directory
+    3. Re-checks after watch registration (closes the registration race)
+    4. Blocks in kernel on inotify — zero CPU, zero timer
+    5. On file-created event: reads the file, verifies authority, returns
+
+  The event is a WAKE SIGNAL. Authority still decides terminal truth.
+  The completion file is durable — survives daemon and waiter restarts.
+
+WHY NOT FIFO:
+  FIFO is one-shot (token consumed), requires lease management, and
+  fails under session-busy guards. A completion file is atomic, durable,
+  and works across restarts. inotify wakes the process with zero CPU
+  cost and zero latency between file creation and wake.
+
+WHY NOT POLLING:
+  Polling introduces an arbitrary interval. inotify is a kernel callback
+  that fires exactly when the filesystem changes — the latency tracks
+  the real completion event, not a configured interval.
+"""
+from __future__ import annotations
+
+import json
+import os
+import select
+import struct
+import time
+from pathlib import Path
+
+def _wr_bridge() -> Path:
+    # WR_ROOT = daemon/infra convention; RUNE_WR_ROOT = repo/scripts
+    # convention. Both honored (WR_ROOT wins) so the daemon, the waiter,
+    # and any isolated test root always resolve the SAME directory.
+    root = (os.environ.get("WR_ROOT")
+            or os.environ.get("RUNE_WR_ROOT")
+            or "/mnt/workdrive/wr-bridge")
+    return Path(root)
+
+def _resumes_dir() -> Path:
+    return _wr_bridge() / "resumes"
+
+# inotify constants (Linux)
+IN_CREATE = 0x100
+IN_CLOSE_WRITE = 0x8
+IN_MOVED_TO = 0x80
+
+
+def completion_path(operation_id: str) -> Path:
+    return _resumes_dir() / f"{operation_id}.done"
+
+
+def write_completion(operation_id: str, event: dict) -> Path:
+    """Atomically write a durable completion file. The rename(2) ensures
+    the waiter never sees a partial file."""
+    _resumes_dir().mkdir(parents=True, exist_ok=True)
+    target = completion_path(operation_id)
+    tmp = target.parent / f".{target.name}.tmp.{os.getpid()}"
+    tmp.write_text(json.dumps(event, sort_keys=True) + "\n")
+    os.rename(str(tmp), str(target))  # atomic on same filesystem
+    os.chmod(str(target), 0o666)  # cross-user bridge
+    return target
+
+
+def read_completion(operation_id: str) -> dict | None:
+    """Read a durable completion file. Returns None if absent."""
+    p = completion_path(operation_id)
+    if not p.is_file():
+        return None
+    try:
+        return json.loads(p.read_text())
+    except (OSError, ValueError):
+        return None
+
+
+def completion_exists(operation_id: str) -> bool:
+    return completion_path(operation_id).is_file()
+
+
+def _inotify_init_and_add_watch(directory: str) -> int:
+    """Create an inotify instance and add a watch on the directory.
+    Returns the inotify fd."""
+    libc = __import__("ctypes").CDLL(None, use_errno=True)
+    fd = libc.inotify_init()
+    if fd < 0:
+        raise OSError("inotify_init failed")
+    # IN_CREATE | IN_MOVED_TO: catch both direct creation and atomic rename
+    mask = IN_CREATE | IN_MOVED_TO
+    wd = libc.inotify_add_watch(fd, directory.encode(), mask)
+    if wd < 0:
+        os.close(fd)
+        raise OSError(f"inotify_add_watch failed for {directory}")
+    return fd
+
+
+def _inotify_read(fd: int, timeout_secs: float | None = None) -> list[str]:
+    """Read pending inotify events. Returns list of filenames that were
+    created/moved-to. Blocks until at least one event or timeout."""
+    poll = select.poll()
+    poll.register(fd, select.POLLIN)
+    events = []
+    buf = os.read(fd, 4096)
+    pos = 0
+    while pos < len(buf):
+        # struct: wd(i32), mask(u32), cookie(u32), name_len(u32)
+        wd, mask, cookie, name_len = struct.unpack_from("iIII", buf, pos)
+        pos += 16
+        name = buf[pos:pos + name_len].rstrip(b"\x00").decode("utf-8", "replace")
+        pos += name_len
+        if mask & (IN_CREATE | IN_MOVED_TO):
+            events.append(name)
+    return events
+
+
+def wait_for_completion(operation_id: str, *,
+                        timeout_secs: float | None = None,
+                        poll_callback=None) -> dict | None:
+    """Block until a completion file exists for this operation.
+
+    Uses inotify for zero-latency, zero-CPU wake. Falls back to
+    polling_callback (if provided) when inotify is unavailable.
+
+    The completion file is a WAKE SIGNAL. The caller must still verify
+    canonical authority after reading it.
+
+    Returns the event dict from the completion file, or None on timeout.
+    """
+    target = completion_path(operation_id)
+
+    # 1. check-before-watch (event may have arrived before we started)
+    existing = read_completion(operation_id)
+    if existing is not None:
+        return existing
+
+    _resumes_dir().mkdir(parents=True, exist_ok=True)
+
+    try:
+        fd = _inotify_init_and_add_watch(str(_resumes_dir()))
+    except OSError:
+        # inotify unavailable: fall back to polling callback
+        if poll_callback:
+            return poll_callback(operation_id, timeout_secs)
+        return None
+
+    try:
+        # 2. re-check after watch registration (closes the race between
+        #    the initial check and the watch being active)
+        existing = read_completion(operation_id)
+        if existing is not None:
+            return existing
+
+        # 3. block in kernel on inotify — zero CPU, exact latency
+        import select as _select
+        poll = _select.poll()
+        poll.register(fd, _select.POLLIN)
+        deadline = (time.monotonic() + timeout_secs) if timeout_secs else None
+
+        while True:
+            remaining = None
+            if deadline is not None:
+                remaining = max(0.1, deadline - time.monotonic())
+                if remaining <= 0.1:
+                    return None  # timeout
+            events = poll.poll(remaining * 1000 if remaining else None)
+            if not events:
+                continue  # poll timeout, re-check
+            names = _inotify_read(fd)
+            if target.name in names:
+                # 4. file appeared — read it
+                existing = read_completion(operation_id)
+                if existing is not None:
+                    return existing
+                # partial/corrupt: keep watching
+    finally:
+        os.close(fd)
+    return None
+
+
+def clear_completion(operation_id: str) -> None:
+    """Remove a consumed completion file (idempotent cleanup)."""
+    p = completion_path(operation_id)
+    try:
+        p.unlink()
+    except OSError:
+        pass

scripts/construction_guards.py

@@ -0,0 +1,123 @@
+"""construction_guards.py — deterministic guards for observed process
+defects (SCAFFOLD-TRANCHE-006 §21-22).
+
+Two real defect classes from recent sessions:
+
+A. DURABLE-STORE MUTATION WITHOUT PERSISTENCE (Tranche 5: closure script
+   mutated the contract in memory, never called save(); the next read saw
+   stale state). Guard: a durable-boundary operation verifies by
+   RELOAD/READBACK, not by successful in-memory mutation.
+
+B. BLIND SOURCE-EDIT NO-OP (multiple sessions: python str.replace() on
+   ruff-reformatted files silently matched nothing; the script reported
+   success while changing nothing). Guard: an automated edit verifies its
+   POSTCONDITION — expected text present / old text absent — and a
+   zero-match replacement is an explicit, truthful no-op, never success.
+
+Not a generic editor framework. Two small, deterministic postcondition
+checks at the boundaries where the defects actually occurred.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+__all__ = ["verify_persisted", "assert_persisted", "apply_source_edit", "EditNoOp", "EditPostconditionFailed"]
+
+
+class EditNoOp(Exception):
+    """The edit matched zero targets — an explicit, truthful no-op."""
+
+
+class EditPostconditionFailed(Exception):
+    """The edit claimed success but the expected postcondition is absent."""
+
+
+# ── Guard A: durable mutation verified by readback ──────────────────────────
+
+
+def verify_persisted(path: Path | str, selector, expect) -> bool:
+    """Reload the durable store from disk and check the expectation against
+    the RELOADED state. `selector(reloaded_doc) -> value`; pass == value
+    equals `expect` (or expect(value) is truthy when callable).
+
+    The reloaded document is parsed as JSON when the file is JSON-shaped;
+    otherwise the raw text is passed to the selector (plain-text stores).
+
+    This is the Tranche 5 defect guard: an in-memory mutation that was
+    never save()d fails here, because the disk state is what gets read.
+    """
+    raw = Path(path).read_text(encoding="utf-8")
+    try:
+        doc = json.loads(raw)
+    except ValueError:
+        doc = raw
+    value = selector(doc)
+    if callable(expect):
+        return bool(expect(value))
+    return value == expect
+
+
+def assert_persisted(path: Path | str, selector, expect, *, what: str = "durable state") -> None:
+    """verify_persisted that raises on mismatch — for use right after a
+    save() at durable boundaries."""
+    if not verify_persisted(path, selector, expect):
+        raise AssertionError(
+            f"persistence verification FAILED for {what}: reloaded state "
+            f"does not match expectation — the mutation may not have been "
+            f"saved (Tranche 5 defect class A)"
+        )
+
+
+# ── Guard B: source edit with postcondition ─────────────────────────────────
+
+
+def apply_source_edit(
+    text: str,
+    old: str,
+    new: str,
+    *,
+    expected_count: int | None = None,
+    postcondition: str | None = None,
+    allow_noop: bool = False,
+) -> str:
+    """Apply a source edit WITH postcondition verification (Guard B).
+
+    - zero matches: raises EditNoOp (truthful no-op) unless allow_noop=True
+    - expected_count given: match count must equal it
+    - postcondition given: the RESULT must contain it, else
+      EditPostconditionFailed
+    Returns the new text. Never claims success for a change that did not
+    happen."""
+    count = text.count(old)
+    if count == 0:
+        if allow_noop:
+            return text  # truthful, explicit no-op — caller records it
+        raise EditNoOp(
+            f"edit matched 0 targets — nothing changed (Tranche 5 defect "
+            f"class B: str.replace silently no-ops on reformatted files)"
+        )
+    if expected_count is not None and count != expected_count:
+        raise EditPostconditionFailed(f"edit matched {count} targets, expected {expected_count}")
+    result = text.replace(old, new)
+    if postcondition and postcondition not in result:
+        raise EditPostconditionFailed(
+            "postcondition text absent from result — edit did not achieve its expected effect"
+        )
+    return result
+
+
+def apply_source_edit_file(
+    path: Path | str, old: str, new: str, *, expected_count: int | None = None, postcondition: str | None = None
+) -> int:
+    """File-level convenience: read, apply_source_edit, write back, then
+    VERIFY BY READBACK (both guards composed). Returns match count."""
+    p = Path(path)
+    text = p.read_text(encoding="utf-8")
+    result = apply_source_edit(text, old, new, expected_count=expected_count, postcondition=postcondition)
+    p.write_text(result, encoding="utf-8")
+    # Guard A composed: the written file must contain the postcondition
+    if postcondition:
+        assert_persisted(p, lambda t: t, lambda t: postcondition in t, what=f"edit of {p.name}")
+    return text.count(old)

scripts/deploy_promotion.py

@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+"""deploy_promotion.py — monotonic promotion authority for Rune deploys.
+
+SCAFFOLD contract DEPLOY-MONOTONIC-001. Root cause of the 2026-09-13
+deploy-order race (deploys 7355/7359): deploy_stage.py promoted
+unconditionally in job-finish order — no comparison against the currently
+deployed commit, no lock, no truthful outcome for a stale candidate.
+
+This module owns the PROMOTION decision. The invariant:
+
+    current never regresses along the canonical release branch.
+
+Ordering authority: GIT ANCESTRY on the canonical release branch
+(refs/heads/master). Rune's release flow is linear history — every deploy
+candidate is a master push (tranche commit or its auto-bump descendant).
+    candidate == deployed commit      -> NOOP_ALREADY_CURRENT (idempotent)
+    candidate is DESCENDANT of it     -> allowed (normal forward deploy)
+    candidate is ANCESTOR of it       -> STALE_SUPERSEDED (refuse; truthful)
+    no ancestry relationship          -> REFUSED_DIVERGENT (fail closed)
+    deployed commit unknown/unreadable-> REFUSED_UNKNOWN_CURRENT (fail closed)
+
+Mechanism (smallest that provides the invariant, per brief §4-5):
+    1. promotion-time stale check — ancestry comparison against the commit
+       current ACTUALLY points to at promotion time (not at job start);
+    2. an flock'd critical section around the read-compare-write of
+       current/last-good so two concurrent promotions cannot interleave
+       between the ancestry check and the symlink swap.
+Workflow-level concurrency is NOT relied on (brief §5): the fence lives at
+the promotion operation itself.
+
+Truthful outcomes (brief §8) — build/stage success != promotion success:
+    PROMOTED                candidate became current (verified below)
+    NOOP_ALREADY_CURRENT    same commit already deployed; nothing mutated
+    STALE_SUPERSEDED        a newer commit is already current; nothing mutated
+    REFUSED_DIVERGENT       ordering unprovable; fail closed
+    REFUSED_UNKNOWN_CURRENT deployed commit unreadable; fail closed
+    FAILED_*                verification/staging failures (in deploy_stage)
+
+A stale or refused outcome is a NON-ERROR terminal state for the release
+pipeline (the newer build simply won) but MUST NOT print "PROMOTED" and
+MUST NOT mutate current/last-good. deploy_stage's exit code and the
+workflow's post-deploy runtime verification enforce this: the workflow
+asserts current == candidate after a PROMOTED outcome, so a stale outcome
+makes the job report honestly rather than masquerade.
+"""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import subprocess
+from pathlib import Path
+
+DEPLOY_ROOT = Path("/mnt/workdrive/rune-code")
+RELEASE_BRANCH = "refs/heads/master"
+
+OUTCOME_PROMOTED = "PROMOTED"
+OUTCOME_NOOP = "NOOP_ALREADY_CURRENT"
+OUTCOME_STALE = "STALE_SUPERSEDED"
+OUTCOME_DIVERGENT = "REFUSED_DIVERGENT"
+OUTCOME_UNKNOWN_CURRENT = "REFUSED_UNKNOWN_CURRENT"
+
+
+# ── pure decision logic (unit-tested; no I/O) ──────────────────────────────
+
+
+def decide_promotion(candidate_sha: str, deployed_sha: str, ancestry: str) -> str:
+    """Pure promotion decision from a precomputed ancestry relationship.
+    ancestry is one of: 'same' | 'descendant' | 'ancestor' | 'divergent' |
+    'unknown'. Fail-closed: anything not provably allowed is refused."""
+    if candidate_sha == deployed_sha or ancestry == "same":
+        return OUTCOME_NOOP
+    if ancestry == "descendant":
+        return OUTCOME_PROMOTED
+    if ancestry == "ancestor":
+        return OUTCOME_STALE
+    if ancestry == "divergent":
+        return OUTCOME_DIVERGENT
+    return OUTCOME_UNKNOWN_CURRENT
+
+
+def ancestry_of(candidate_sha: str, deployed_sha: str, repo: Path, fetch_on_divergent: bool = True) -> str:
+    """Classify candidate vs deployed using git merge-base --is-ancestor on
+    the canonical release branch's repository. Returns 'unknown' on any git
+    failure (fail-closed callers treat that as refusal).
+
+    Observed live 2026-09-13 (deploy 7449, SHA 535c2909): a DELAYED older
+    candidate's checkout cannot contain commits newer than itself — its
+    local object store lacks the deployed commit entirely, so ancestry
+    classifies 'divergent' and fail-closed refuses. Correct refusal, wrong
+    reason: the candidate IS an ancestor. When the local classification is
+    divergent, fetch origin's canonical branch first (best-effort; the
+    deploy workflow's checkout has credentials configured) and re-classify.
+    If still divergent afterwards, the refusal stands with better
+    evidence."""
+
+    def _is_ancestor(a: str, b: str) -> bool:
+        r = subprocess.run(
+            ["git", "-C", str(repo), "-c", f"safe.directory={repo}", "merge-base", "--is-ancestor", a, b],
+            capture_output=True,
+            text=True,
+        )
+        return r.returncode == 0
+
+    if candidate_sha == deployed_sha:
+        return "same"
+    if _is_ancestor(candidate_sha, deployed_sha):
+        return "ancestor"  # candidate is OLDER than what's deployed
+    if _is_ancestor(deployed_sha, candidate_sha):
+        return "descendant"  # candidate is NEWER (normal forward deploy)
+    if fetch_on_divergent:
+        try:
+            subprocess.run(
+                ["git", "-C", str(repo), "-c", f"safe.directory={repo}", "fetch", "origin", "master", "--quiet"],
+                capture_output=True,
+                text=True,
+                timeout=60,
+            )
+        except (OSError, subprocess.TimeoutExpired):
+            pass  # best-effort: classification below still fails closed
+        if _is_ancestor(candidate_sha, deployed_sha):
+            return "ancestor"
+        if _is_ancestor(deployed_sha, candidate_sha):
+            return "descendant"
+    return "divergent"
+
+
+def read_deployed_commit(deploy_root: Path = DEPLOY_ROOT) -> str:
+    """Read the commit the `current` symlink ACTUALLY points to right now —
+    from the deployed build identity, the deployment authority (never from
+    a stale job-start artifact). Empty string if unreadable."""
+    current = deploy_root / "current"
+    try:
+        target = Path(os.readlink(current))
+    except OSError:
+        return ""
+    identity = target / "src" / "rune" / "_build_identity.json"
+    try:
+        data = json.loads(identity.read_text(encoding="utf-8"))
+        return str(data.get("commit", ""))
+    except (OSError, ValueError):
+        return ""
+
+
+# ── the fenced promotion operation ──────────────────────────────────────────
+
+
+def promote(
+    candidate_sha: str,
+    stage: Path,
+    tmp_stage: Path,
+    repo: Path,
+    deploy_root: Path = DEPLOY_ROOT,
+    on_promoted=None,
+) -> tuple[str, str]:
+    """Atomically decide + promote under an exclusive lock.
+
+    Returns (outcome, detail). ONLY the PROMOTED outcome mutates
+    current/last-good, and it does so inside the same critical section as
+    the decision — no interleaving window between check and swap.
+
+    Crash-safety ordering (brief §16): the stage rename happens BEFORE the
+    lock (a staged-but-unpromoted tree is inert), the symlink swap is a
+    single rename(2) via a temporary link, so current is never absent and
+    never half-updated. last-good is refreshed BEFORE the swap only from a
+    value that was genuinely current a moment ago.
+    """
+    deploy_root.mkdir(parents=True, exist_ok=True)
+    lock_path = deploy_root / ".promotion.lock"
+    with open(lock_path, "w") as lock_fd:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            deployed = read_deployed_commit(deploy_root)
+            if not deployed:
+                return (OUTCOME_UNKNOWN_CURRENT, "deployed commit unreadable — fail closed")
+            rel = ancestry_of(candidate_sha, deployed, repo)
+            outcome = decide_promotion(candidate_sha, deployed, rel)
+            if outcome != OUTCOME_PROMOTED:
+                return (outcome, f"deployed={deployed[:12]} ancestry={rel}")
+
+            # --- mutate (still inside the lock) ---
+            current = deploy_root / "current"
+            last_good = deploy_root / "last-good"
+            prev_target = os.readlink(current) if current.is_symlink() else ""
+            if prev_target and (deploy_root / "last-good").is_symlink():
+                (deploy_root / "last-good").unlink()
+            if prev_target:
+                _atomic_symlink(deploy_root, "last-good", prev_target)
+            if stage.exists():
+                # re-deploying an already-staged SHA: restage over it
+                import shutil
+
+                shutil.rmtree(stage)
+            os.rename(tmp_stage, stage)
+            _atomic_symlink_target(deploy_root, "current", stage)
+            detail = f"current -> {stage.name}"
+            if on_promoted is not None:
+                # §12C: race-safe convergence — the WINNER refreshes release
+                # history atomically with its promotion, inside the lock.
+                # Failure degrades to STALE (software valid, history lags;
+                # retry by any later deploy converges idempotently).
+                try:
+                    on_promoted(candidate_sha)
+                    detail += " (+ release-history converged)"
+                except Exception as exc:  # noqa: BLE001
+                    detail += f" (release-history refresh FAILED: {exc!s:.120} — STALE, retry converges)"
+            return (OUTCOME_PROMOTED, detail)
+        finally:
+            fcntl.flock(lock_fd, fcntl.LOCK_UN)
+
+
+def _atomic_symlink(deploy_root: Path, name: str, target: str) -> None:
+    """Symlink swap that never leaves `name` absent: write temp link, rename
+    over the final name (rename(2) is atomic on the same filesystem)."""
+    _atomic_symlink_target(deploy_root, name, Path(target))
+
+
+def _atomic_symlink_target(deploy_root: Path, name: str, target: Path) -> None:
+    tmp = deploy_root / f".{name}.swap-{os.getpid()}"
+    if tmp.is_symlink() or tmp.exists():
+        tmp.unlink()
+    tmp.symlink_to(target)
+    os.replace(tmp, deploy_root / name)

scripts/deploy_qualify.py

@@ -6,6 +6,16 @@ has no embedded multi-line scripts — a YAML block-scalar indentation hazard).
 
 Prints one of: success | failure | pending
 Exit code 0 always (the shell decides what to do with the verdict).
+
+RELEASE-SAFETY HARDENING (2026-09-13, after red-CI promotions 0.66.28/29):
+the verdict is the AND of two independent legs —
+  1. required-checks context (newest observation for this exact SHA);
+  2. the latest COMPLETED ci.yml@refs/heads/master run for this exact SHA,
+     every job concluded success (branch+tag fan-out resolved by path;
+     jobs envelope unwrapped — no aggregate-commit-status fallback, the
+     exact bug class verify.py hit in W/R-v0.3).
+Any disagreement, pending, or missing evidence → pending/failure.
+FAIL-CLOSED: not verified → not deployable.
 """
 
 from __future__ import annotations
@@ -20,34 +30,146 @@ if _SCRIPT_DIR not in _sys.path:
     _sys.path.insert(0, _SCRIPT_DIR)
 import gitea_auth
 
+REQUIRED_CONTEXT = "CI Pipeline / required-checks"
+CI_WORKFLOW_PATH = "ci.yml@refs/heads/master"
+
+
+# ── pure verdict logic (unit-tested; fixtures from the real incidents) ────
+
+def required_check_verdict(statuses: list[dict]) -> str:
+    """Newest non-skipped required-checks observation for the SHA.
+    Missing → pending. Newest wins (stale success never overrides a newer
+    failure, and vice versa)."""
+    candidates = [
+        s for s in statuses
+        if str(s.get("context", "")).startswith(REQUIRED_CONTEXT)
+        and s.get("status") != "skipped"
+    ]
+    if not candidates:
+        return "pending"
+    newest = max(candidates, key=lambda s: str(s.get("created_at", "")))
+    return str(newest.get("status", "pending"))
+
+
+def independent_jobs_verdict(runs: list[dict], jobs_fetch, sha: str = "") -> str:
+    """Latest COMPLETED ci.yml@refs/heads/master run for the exact SHA:
+    every job must conclude success. Fan-out-safe (tag runs and sibling
+    workflows are excluded by path); the run is resolved by head_sha, never
+    by 'latest branch state'. Missing run → pending. Any non-success
+    conclusion → failure."""
+    mine = [r for r in runs if r.get("path") == CI_WORKFLOW_PATH]
+    if sha:
+        mine = [r for r in mine if str(r.get("head_sha", "")) == sha]
+    completed = [r for r in mine if r.get("status") == "completed"]
+    if not completed:
+        return "pending"
+    latest = max(completed, key=lambda r: str(r.get("created_at", "") or r.get("run_started_at", "")))
+    jobs = jobs_fetch(latest.get("id"))
+    if jobs is None:
+        return "pending"  # jobs probe failed → not verified
+    if not jobs:
+        return "pending"  # no jobs visible → cannot verify
+    for j in jobs:
+        if j.get("conclusion") != "success":
+            return "failure"
+    return "success"
+
+
+def combine(a: str, b: str) -> str:
+    """Fail-closed conjunction: any failure → failure; any pending → pending;
+    success only when BOTH legs are success."""
+    if "failure" in (a, b):
+        return "failure"
+    if "pending" in (a, b):
+        return "pending"
+    return "success"
+
+
+def qualify(statuses: list[dict], runs: list[dict], jobs_fetch, sha: str = "") -> str:
+    return combine(required_check_verdict(statuses),
+                   independent_jobs_verdict(runs, jobs_fetch, sha=sha))
+
+
+# ── API fetches (thin; injectable in tests) ───────────────────────────────
+
+def _get_json(url: str, token: str, timeout: int = 30):
+    req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            return json.loads(r.read())
+    except (OSError, ValueError):
+        return None
+
+
+def _fetch_status(server: str, repo: str, sha: str, token: str) -> list[dict] | None:
+    data = _get_json(f"{server}/api/v1/repos/{repo}/commits/{sha}/status", token)
+    return None if data is None else data.get("statuses", [])
+
+
+def _fetch_runs(server: str, repo: str, sha: str, token: str,
+                max_pages: int = 4) -> list[dict] | None:
+    """H-PATCH: paginate the runs list. The repo's scheduled merge-robot
+    runs flood the first page (~50 slots exhaust within hours), pushing
+    older-but-relevant SHAs to later pages — the cause of the observed
+    authority flapping (terminal commit read as pending). Paginate until
+    the sha is found or max_pages exhausted."""
+    out: list[dict] = []
+    for page in range(1, max_pages + 1):
+        data = _get_json(
+            f"{server}/api/v1/repos/{repo}/actions/runs?limit=50&page={page}",
+            token)
+        if data is None:
+            return None if page == 1 else (out or None)
+        runs = data.get("workflow_runs", data if isinstance(data, list) else [])
+        out.extend(r for r in runs if str(r.get("head_sha", "")) == sha)
+        if len(runs) < 50:
+            break  # exhausted
+    return out
+
+
+def _fetch_jobs(server: str, repo: str, run_id, token: str) -> list[dict] | None:
+    data = _get_json(f"{server}/api/v1/repos/{repo}/actions/runs/{run_id}/jobs", token)
+    if data is None:
+        return None
+    # jobs envelope unwrap (this Gitea wraps in {"jobs": [...]}; some
+    # versions return a bare list) — never fall back to aggregate status
+    if isinstance(data, dict):
+        return data.get("jobs", [])
+    return data if isinstance(data, list) else None
+
+
+# ── CLI ───────────────────────────────────────────────────────────────────
 
 def main() -> int:
-    server = os.environ.get("GITEA_SERVER", "").rstrip("/")
-    repo = os.environ.get("GITEA_REPO", "")
-    sha = os.environ.get("DEPLOY_SHA", "")
+    # T21.4 fix: fall back to the canonical defaults when the caller did
+    # not export GITEA_SERVER/GITEA_REPO (CI always exports them; local
+    # and first-class-tool consumers previously got a silent "pending"
+    # verdict — a wrong answer, not a fail-closed one).
+    # H-PATCH H4: the target sha arrives EXPLICITLY (--sha) from callers
+    # that hold structured operation state. DEPLOY_SHA env remains only
+    # for standalone/workflow backward compat — the canonical path never
+    # depends on ambient env for operation identity.
+    ap = __import__("argparse").ArgumentParser()
+    ap.add_argument("--sha", dest="sha_arg", default=None)
+    args, _unknown = ap.parse_known_args()
+    server = (os.environ.get("GITEA_SERVER", "")
+              or gitea_auth.DEFAULT_SERVER).rstrip("/")
+    repo = os.environ.get("GITEA_REPO", "") or gitea_auth.DEFAULT_REPO
+    sha = args.sha_arg or os.environ.get("DEPLOY_SHA", "")
     token = gitea_auth.get_token() if gitea_auth.has_token() else ""
     if not (server and repo and sha and token):
         print("pending")  # missing config → cannot verify → not qualified
         return 0
-    url = f"{server}/api/v1/repos/{repo}/commits/{sha}/status"
-    req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
-    try:
-        with urllib.request.urlopen(req, timeout=30) as r:
-            data = json.loads(r.read())
-    except (OSError, ValueError) as exc:
-        # transient API/network failure → keep polling (urllib raises
-        # URLError (OSError subclass); bad JSON raises ValueError)
-        print(f"pending (status probe failed: {exc})")
+
+    statuses = _fetch_status(server, repo, sha, token)
+    runs = _fetch_runs(server, repo, sha, token)
+    if statuses is None or runs is None:
+        # transient API/network failure → keep polling
+        print("pending (probe failed)")
         return 0
-    required = [
-        s
-        for s in data.get("statuses", [])
-        if (str(s.get("context", "")).startswith("CI Pipeline / required-checks") and s.get("status") != "skipped")
-    ]
-    if not required:
-        print("pending")
-    else:
-        print(required[0].get("status", "pending"))
+    jobs_fetch = lambda run_id: _fetch_jobs(server, repo, run_id, token)  # noqa: E731
+    verdict = qualify(statuses, runs, jobs_fetch, sha=sha)
+    print(verdict)
     return 0
 
 

scripts/deploy_stage.py

@@ -3,12 +3,15 @@
 
 Called by .gitea/workflows/deploy.yml. Stages src/ into
 /mnt/workdrive/rune-code/<short-sha>, stamps _build_identity.json, verifies
-the staged tree (import + SHA assert + authority smoke), then ATOMICALLY
-promotes the `current` symlink and records `last-good` (safe rollback:
-the previous deployment remains available).
+the staged tree (import + SHA assert + authority smoke), then promotes
+through the MONOTONIC promotion authority (deploy_promotion.py): an older
+candidate finishing after a newer promoted one is fenced out (STALE_SUPERSEDED)
+and reports truthfully — build/stage success != promotion success.
 
-Exit 0 = deployed and verified. Non-zero = deployment refused; the previous
-deployment stays current.
+Exit 0 = PROMOTED and verified, or NOOP_ALREADY_CURRENT, or a truthful
+STALE_SUPERSEDED (newer build already current; nothing mutated).
+Non-zero = deployment refused (divergent/unknown ordering, verification
+failure); the previous deployment stays current.
 """
 
 from __future__ import annotations
@@ -25,6 +28,92 @@ DEPLOY_ROOT = Path("/mnt/workdrive/rune-code")
 REPO_ROOT = Path(__file__).resolve().parent.parent
 VENV_PY = "/home/nick/.venvs/memory/bin/python3"
 
+sys.path.insert(0, str(REPO_ROOT / "scripts"))
+sys.path.insert(0, str(REPO_ROOT / "src"))
+import deploy_promotion  # noqa: E402
+from rune.release_notes import (  # noqa: E402
+    ReleaseNote as _ReleaseNote,
+    auto_initial_note as _auto_note,
+    converged_deployed_sha as _authority_sha,
+    convergence_refresh as _refresh,
+    fetch_release as _fetch_release,
+    publish_release as _publish,
+    sha_from_body as _sha_from_body,
+    summary_from_body as _summary_from_body,
+)
+
+
+def publish_out_of_lock(short: str, sha: str, *,
+                        deploy_root: Path = DEPLOY_ROOT,
+                        scaffold_store: Path | None = None) -> None:
+    """§13D/§14B: release-history publication AFTER the promotion lock is
+    released. Network I/O never holds the flock.
+
+    §14B INVARIANT: publication does NOT trust the originating job's SHA.
+    The CURRENT deployment authority is re-read immediately before
+    publishing; the note is constructed from CURRENT authority. A stale
+    job whose candidate was superseded converges the NEW authority (or
+    refuses a version it cannot truthfully describe) — it may help
+    converge B, but may never reassert itself as deployed.
+    Failure degrades to STALE (software valid, history lags; retry
+    converges)."""
+    try:
+        server = os.environ.get("GITEA_SERVER", "").rstrip("/")
+        repo = os.environ.get("GITEA_REPO", "")
+        token = os.environ.get("GITEA_TOKEN", "")
+        if not (server and repo and token):
+            return
+        # §14B: re-read CURRENT authority — never trust the job's SHA.
+        authority_sha = _authority_sha(str(deploy_root))
+        if not authority_sha:
+            print("WARNING: release-history convergence skipped: "
+                  "deployment authority unreadable — STALE, retry converges")
+            return
+        store = str(scaffold_store or (REPO_ROOT / "store" / "scaffold" / "current.json"))
+        identity = deploy_root / authority_sha[:12] / "src" / "rune" / "_build_identity.json"
+        try:
+            version = json.loads(identity.read_text()).get("version", "")
+        except (OSError, ValueError):
+            version = ""
+        if not version:
+            print("WARNING: release-history convergence skipped: "
+                  "no version on current authority — STALE, retry converges")
+            return
+        tag = f"v{version}"
+        existing = _fetch_release(server, repo, token, tag)
+        if existing is None:
+            note = _auto_note(
+                version=version,
+                summary=(f"Rune v{version} — evidence-derived release "
+                         f"history (automatic convergence)"),
+                scaffold_store=store,
+                release_sha=authority_sha, deployed_sha=authority_sha,
+                provenance=["automatic convergence publish "
+                            "(deploy workflow, authority-derived)"])
+        else:
+            note = _refresh(
+                _ReleaseNote.from_dict({
+                    "version": version,
+                    "summary": _summary_from_body(existing.get("body", "")),
+                    "release_sha": _sha_from_body(existing.get("body", ""), "tag")
+                    or authority_sha,
+                    "provenance": [],
+                }),
+                deployed_sha=authority_sha, scaffold_store=store,
+                extra_provenance="automatic convergence publish "
+                                "(deploy workflow, authority-derived)")
+            # preserve the tag SHA the stored body carries
+            tag_sha = _sha_from_body(existing.get("body", ""), "tag")
+            if tag_sha:
+                note.release_sha = tag_sha
+        result = _publish(server, repo, token, note)
+        print(f"release-history convergence: "
+              f"{result.get('action', 'unknown')} "
+              f"(authority {authority_sha[:12]})")
+    except Exception as conv_exc:  # noqa: BLE001 — history STALE, software valid
+        print(f"WARNING: release-history convergence failed: "
+              f"{conv_exc!s:.200} — STALE, retry converges")
+
 
 def main() -> int:
     # The runner's checkout workspace (act sets GITHUB_WORKSPACE). Never a
@@ -119,25 +208,49 @@ print("VERIFIED:", json.dumps(info))
         shutil.rmtree(tmp_stage, ignore_errors=True)
         return 1
 
-    # --- promote (atomic) + last-known-good ------------------------------
-    DEPLOY_ROOT.mkdir(parents=True, exist_ok=True)
-    current = DEPLOY_ROOT / "current"
-    if current.is_symlink():
-        last_good = DEPLOY_ROOT / "last-good"
-        if last_good.is_symlink():
-            last_good.unlink()
-        last_good.symlink_to(os.readlink(current))
-    if current.is_symlink() or current.exists():
-        current.unlink()
-    if stage.exists():
-        shutil.rmtree(stage)  # re-deploying an already-staged SHA: restage
-    os.rename(tmp_stage, stage)
-    current.symlink_to(stage)
-    print(f"PROMOTED: {short}")
-    print("current ->", os.readlink(current))
-    if (DEPLOY_ROOT / "last-good").is_symlink():
-        print("last-good ->", os.readlink(DEPLOY_ROOT / "last-good"))
-    return 0
+    # --- promote: FENCED through the promotion authority -----------------
+    # SCAFFOLD contract DEPLOY-MONOTONIC-001: promotion is monotonic. The
+    # ancestry check + lock live in deploy_promotion.py; this script only
+    # handles the truthful outcome reporting. A stale candidate must NOT
+    # claim promotion success — build/stage success != promotion success.
+    #
+    # §14C: NO separate convergence-intent ledger. The durable pending-
+    # convergence state IS the deployment authority itself (atomically
+    # swapped `current` symlink + stamped build identity): publication
+    # derives from it, idempotently, outside the lock. The old intent
+    # file had exactly one writer and zero readers, non-atomic writes,
+    # and a bogus recorded_at (SECONDS is a bash builtin, never exported
+    # — always "0"). Deriving from authority gives atomicity, restart
+    # readability, corruption immunity, monotonicity (stale publishers
+    # read CURRENT authority, not their own job) and idempotent retry
+    # for free. REMOVE more complexity than you add.
+
+    outcome, detail = deploy_promotion.promote(
+        sha, DEPLOY_ROOT / short, tmp_stage, repo)
+
+    # §13D: publish release history OUTSIDE the promotion lock (network
+    # I/O must not hold the flock). Only for PROMOTED outcomes.
+    if outcome == deploy_promotion.OUTCOME_PROMOTED:
+        publish_out_of_lock(short, sha)
+
+    if outcome == deploy_promotion.OUTCOME_PROMOTED:
+        print(f"PROMOTED: {short}")
+        print("current ->", os.readlink(DEPLOY_ROOT / "current"))
+        if (DEPLOY_ROOT / "last-good").is_symlink():
+            print("last-good ->", os.readlink(DEPLOY_ROOT / "last-good"))
+        return 0
+    if outcome == deploy_promotion.OUTCOME_NOOP:
+        print(f"NOOP_ALREADY_CURRENT: {short} is the deployed commit")
+        print(detail)
+        return 0
+    if outcome == deploy_promotion.OUTCOME_STALE:
+        print(f"STALE_SUPERSEDED: {short} is older than the deployed commit — promotion refused (monotonic promotion)")
+        print(detail)
+        print("current unchanged:", os.readlink(DEPLOY_ROOT / "current"))
+        return 0  # truthful non-error terminal state: the newer build won
+    # divergent / unknown-current: fail closed
+    print(f"REFUSED ({outcome}): {short} — {detail}", file=sys.stderr)
+    return 1
 
 
 if __name__ == "__main__":

scripts/gitea_reconciliation_check.py

@@ -86,9 +86,12 @@ def main() -> int:
         if live_state == "open" and rec["tracker_state"] == "closed" and rec["reconciliation_state"] in TERMINAL_STATES:
             drift.append(f"#{num}: live state open but artifact says closed/{rec['reconciliation_state']}")
         live_bug = "bug" in [l["name"] for l in li.get("labels", [])]
-        if live_bug and not rec.get("live_defect"):
+        # Same open-only exemption as the artifact-records block above: a
+        # closed issue's labels are historical record; FIXED_VERIFIED issues
+        # legitimately keep the bug label after closure.
+        if live_bug and rec.get("tracker_state") == "open" and not rec.get("live_defect"):
             drift.append(f"#{num}: live bug label present but artifact records no live defect")
-        if not live_bug and rec.get("live_defect"):
+        if not live_bug and rec.get("live_defect") and rec.get("tracker_state") == "open":
             drift.append(f"#{num}: artifact records live defect but live bug label absent")
 
     # Live defects in the artifact must all be OPEN in the tracker

scripts/install_mimo_hook.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""install_mimo_hook.py — T21.2 §21.2D (T22: multi-hook): canonical MiMo
+hook installer.
+
+Canonical sources: config/mimo-hooks/*.ts
+Targets:          ~/.mimocode/hooks/<same-name>.ts
+
+Every hook is hash-verified after install; drift is detected in both
+directions. T22 added builder-bridge.ts to the managed set — it was
+previously installed by hand, unversioned, which is how it silently rotted
+(hardcoded ephemeral interpreter). A hook that reaches the builder must be
+version-controlled and drift-checked like any other authority.
+
+Usage:
+    python3 scripts/install_mimo_hook.py            # sync all managed hooks
+    python3 scripts/install_mimo_hook.py --check    # verify only, install nothing
+"""
+import hashlib
+import shutil
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+CANONICAL_DIR = REPO / "config" / "mimo-hooks"
+TARGET_DIR = Path.home() / ".mimocode" / "hooks"
+
+# The managed set. Adding a file here is what makes a hook version-controlled.
+MANAGED = ["event-wait-guard.ts", "builder-bridge.ts"]
+
+
+def sha256(p: Path) -> str:
+    return hashlib.sha256(p.read_bytes()).hexdigest()
+
+
+def sync_one(name: str, check_only: bool) -> bool:
+    canonical = CANONICAL_DIR / name
+    target = TARGET_DIR / name
+    if not canonical.is_file():
+        print(f"canonical source missing: {canonical}")
+        return False
+    canon_hash = sha256(canonical)
+    if target.is_file() and sha256(target) == canon_hash:
+        print(f"in-sync: {name} {canon_hash[:12]}")
+        return True
+    if check_only:
+        state = "DRIFT" if target.is_file() else "MISSING"
+        inst = sha256(target)[:12] if target.is_file() else "-"
+        print(f"{state}: {name} canonical={canon_hash[:12]} installed={inst}")
+        return False
+    if target.is_file():
+        print(f"DRIFT: {name} canonical={canon_hash[:12]} installed={sha256(target)[:12]}")
+    else:
+        print(f"hook missing at {target}")
+    TARGET_DIR.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(canonical, target)
+    if sha256(target) != canon_hash:
+        print(f"INSTALL FAILED: {name} hash mismatch after copy")
+        return False
+    print(f"installed: {name} {canon_hash[:12]}")
+    return True
+
+
+def main() -> int:
+    check_only = "--check" in sys.argv
+    ok = True
+    for name in MANAGED:
+        ok = sync_one(name, check_only) and ok
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/install_mimo_tools.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""install_mimo_tools.py — canonical MiMo tool installer (TTY-repair tranche).
+
+Canonical sources: config/mimo-tools/{bash.ts,await-operation.ts}
+Targets:           ~/.mimocode/tools/{bash.ts,await-operation.ts}
+Verifies hashes after install; detects drift in both directions
+(the parity test reads these hashes).
+"""
+import hashlib
+import shutil
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+TOOLS = ["bash.ts", "await-operation.ts"]
+
+
+def sha256(p: Path) -> str:
+    return hashlib.sha256(p.read_bytes()).hexdigest()
+
+
+def main() -> int:
+    rc = 0
+    for name in TOOLS:
+        canon = REPO / "config" / "mimo-tools" / name
+        target = Path.home() / ".mimocode" / "tools" / name
+        if not canon.is_file():
+            print(f"{name}: canonical source missing: {canon}")
+            rc = 1
+            continue
+        canon_hash = sha256(canon)
+        if target.is_file() and sha256(target) == canon_hash:
+            print(f"{name}: in-sync {canon_hash[:12]}")
+            continue
+        drift = f"DRIFT canonical={canon_hash[:12]}"
+        if target.is_file():
+            drift += f" installed={sha256(target)[:12]}"
+        else:
+            drift += " installed=MISSING"
+        print(f"{name}: {drift} — installing")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(canon, target)
+        if sha256(target) != canon_hash:
+            print(f"{name}: INSTALL FAILED (hash mismatch after copy)")
+            rc = 1
+        else:
+            print(f"{name}: installed {canon_hash[:12]}")
+    return rc
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/install_wr_daemon.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""install_wr_daemon.py — REAL_ASYNC_BRIDGE §6: daemon governance.
+
+Canonical source lives IN THIS REPO at bridge/daemon/. The active install
+is ~/.local/share/mimo-wait-resume/. This script is the ONLY supported
+way to move code between them:
+
+  - copy canonical source → install dir (atomic, per file)
+  - verify sha256 convergence (fail loud on divergence)
+  - optionally restart the daemon via scripts/start_wr_daemon.py
+
+Never hand-edit the installed copy: edit the repo source, install, restart.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+CANONICAL = REPO / "bridge" / "daemon"
+INSTALL = Path.home() / ".local/share/mimo-wait-resume"
+FILES = ("daemon.py", "waitstore.py", "verify.py", "completion_file.py")
+
+
+def sha256(p: Path) -> str:
+    return hashlib.sha256(p.read_bytes()).hexdigest()
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--check", action="store_true", help="verify convergence only; no writes")
+    ap.add_argument("--restart", action="store_true", help="restart the daemon after install")
+    args = ap.parse_args()
+
+    if not CANONICAL.is_dir():
+        print(f"canonical source missing: {CANONICAL}")
+        return 1
+    INSTALL.mkdir(parents=True, exist_ok=True)
+
+    diverged = []
+    for name in FILES:
+        src, dst = CANONICAL / name, INSTALL / name
+        if args.check:
+            if not dst.is_file() or sha256(src) != sha256(dst):
+                diverged.append(name)
+            continue
+        if not dst.is_file() or sha256(src) != sha256(dst):
+            tmp = dst.with_suffix(f".tmp.{name}")
+            shutil.copy2(src, tmp)
+            tmp.replace(dst)  # atomic
+            print(f"installed: {name} {sha256(src)[:12]}")
+        else:
+            print(f"unchanged: {name} {sha256(src)[:12]}")
+
+    if args.check:
+        if diverged:
+            print(f"DIVERGED: {', '.join(diverged)} — run install_wr_daemon.py")
+            return 1
+        print("CONVERGED: installed copy == canonical repo source")
+        return 0
+
+    # post-install convergence proof
+    bad = [n for n in FILES if sha256(CANONICAL / n) != sha256(INSTALL / n)]
+    if bad:
+        print(f"INSTALL FAILED convergence: {bad}")
+        return 1
+    print("CONVERGED: installed copy == canonical repo source")
+
+    if args.restart:
+        rc = subprocess.call([sys.executable, str(REPO / "scripts" / "start_wr_daemon.py")])
+        if rc != 0:
+            print("restart failed")
+            return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/notify_event_bridge.py

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""notify_event_bridge.py — T16 §16C: ci.yml's final job posts the CI
+completion WAKE to the local W/R event bridge (daemon /process-event).
+
+The event is a WAKE, never completion truth: the waiting controller
+(ci_event_wait.py) re-reads the canonical Gitea verdict via
+deploy_qualify.py after resuming. Best-effort by design — if the bridge
+is unreachable the waiter's watchdog still recovers truthfully (that is
+the §16D lost-event contract), so a notify failure must NEVER fail CI.
+
+REAL_ASYNC_BRIDGE (R3): the completion event is ALSO written directly as
+a durable completion file (resumes/<operation_id>.done). Delivery no
+longer depends on the daemon being alive: the waiter blocks on inotify
+for the file itself (kernel wake, zero latency, zero CPU), and the
+durable file survives daemon AND waiter restarts (R9). The write is
+best-effort on the same terms as the POST — never fails CI.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+import urllib.request
+
+BRIDGE_URL = os.environ.get("RUNE_EVENT_BRIDGE_URL",
+                            "http://127.0.0.1:8791")
+
+
+def main() -> int:
+    sha = os.environ.get("CI_SHA", "")
+    result = os.environ.get("CI_RESULT", "")  # needs.<job>.result
+    if not sha:
+        print("notify-event-bridge: no CI_SHA — nothing to wake", flush=True)
+        return 0
+    payload = {
+        "operation_id": f"ci-{sha}",
+        "provider": "gitea",
+        "event_type": "ci_completed",
+        "sha": sha,
+        # exit_code is informational only; the wake is not the verdict
+        "exit_code": 0 if result == "success" else 1,
+        "completed_at": time.time(),
+    }
+    # R8 lost-event failure-recovery: operation-scoped fault injection.
+    # A rule keyed by the EXACT operation_id suppresses BOTH normal
+    # delivery channels (durable completion file AND bridge POST), so the
+    # waiter's watchdog/failure-detector path is the only route to truth.
+    # Disabled by default (no rule file => zero behavior change) and
+    # observable: every decision is recorded in the R8 fault log.
+    try:
+        import r8_fault  # noqa: E402 — sibling module
+        if r8_fault.should_suppress(payload["operation_id"]):
+            r8_fault.record(payload["operation_id"], "suppressed",
+                            {"sha": sha, "exit_code": payload["exit_code"],
+                             "source_terminal_at": payload["completed_at"]})
+            print("notify-event-bridge: R8 fault injection — completion "
+                  f"event intentionally suppressed for "
+                  f"{payload['operation_id']} (no .done file, no POST); "
+                  "watchdog authority recovery is the expected path",
+                  flush=True)
+            return 0
+        r8_fault.record(payload["operation_id"], "delivered_normally",
+                        {"sha": sha, "rule_active": False})
+    except Exception as exc:  # noqa: BLE001 — fault seam must never break delivery
+        print(f"notify-event-bridge: R8 fault-seam probe failed ({exc}); "
+              "continuing with normal delivery", flush=True)
+    # R3 durable delivery: write the completion file FIRST — it works even
+    # if the bridge daemon is down, and the atomic rename means any waiter
+    # (inotify-watching or starting later) sees a complete file or none.
+    try:
+        sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+        import completion_file as cf  # noqa: E402 — sibling module
+        written = cf.write_completion(payload["operation_id"], payload)
+        print(f"notify-event-bridge: durable completion file {written}",
+              flush=True)
+    except Exception as exc:  # noqa: BLE001 — delivery is best-effort; watchdog recovery covers a lost completion file (§16D contract)
+        print(f"notify-event-bridge: completion-file write failed ({exc}); "
+              f"bridge POST and watchdog recovery still cover delivery",
+              flush=True)
+    for attempt in range(2):
+        try:
+            req = urllib.request.Request(
+                BRIDGE_URL + "/process-event",
+                data=json.dumps(payload).encode(),
+                headers={"Content-Type": "application/json"})
+            with urllib.request.urlopen(req, timeout=5) as r:
+                resp = json.loads(r.read())
+            print(f"notify-event-bridge: woke bridge "
+                  f"(matched={resp.get('matched')})", flush=True)
+            return 0
+        except Exception as exc:  # noqa: BLE001 — wake is best-effort by design; failure is logged and the waiter's watchdog recovery covers a lost wake (§16D contract)
+            if attempt == 0:
+                time.sleep(2)
+            else:
+                print(f"notify-event-bridge: bridge unreachable ({exc}); "
+                      f"watchdog recovery covers a lost wake", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/r8_fault.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""r8_fault.py — REAL_ASYNC_BRIDGE R8: operation-scoped lost-event fault
+injection (evidence-only harness).
+
+DESIGN CONTRACT (R8 §3):
+  disabled by default          no rule file -> zero behavior change
+  operation-scoped             rule keyed by EXACT operation_id
+  reversible                   delete the rule file / rule entry
+  observable                   every decision appended to a JSONL log
+  cannot affect other waits    rule file checked by operation_id only
+
+The ONLY consumer is scripts/notify_event_bridge.py: before normal
+delivery it consults should_suppress(operation_id). Suppression means:
+  - NO durable completion file is written
+  - NO bridge POST (no /process-event wake)
+  - the suppression decision is recorded as R8 fault evidence
+Nothing else in the stack reads the rule. The daemon, waitstore,
+authority verification, and completion-file machinery are untouched.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+RUNE_WR_ROOT = os.environ.get("RUNE_WR_ROOT") or os.environ.get("WR_ROOT") or "/mnt/workdrive/wr-bridge"
+RULES_PATH = Path(RUNE_WR_ROOT) / "r8_suppress_rules.json"
+FAULT_LOG = Path(RUNE_WR_ROOT) / "r8_fault_log.jsonl"
+
+REASON = "event intentionally suppressed for R8 lost-event failure-recovery"
+
+
+def _rules() -> dict:
+    """Read the rule file. Absent/unreadable => no suppression (fail-open
+    to NORMAL delivery; the fault must never take the healthy path down)."""
+    try:
+        return json.loads(RULES_PATH.read_text())
+    except Exception:  # noqa: BLE001 — absent rule file is the default state
+        return {}
+
+
+def lookup(operation_id: str) -> dict | None:
+    """Return the active suppression rule for EXACTLY this operation_id,
+    or None. Expired rules are ignored (not deleted — deletion is the
+    operator's explicit disable action)."""
+    spec = _rules()
+    if not spec.get("enabled"):
+        return None
+    rule = spec.get("operations", {}).get(operation_id)
+    if not rule:
+        return None
+    expires = rule.get("expires_at")
+    if expires:
+        try:
+            if time.time() > time.mktime(time.strptime(expires, "%Y-%m-%dT%H:%M:%SZ")) - time.timezone:
+                return None
+        except ValueError:
+            return None
+    return rule
+
+
+def should_suppress(operation_id: str) -> bool:
+    return lookup(operation_id) is not None
+
+
+def record(operation_id: str, stage: str, extra: dict | None = None) -> None:
+    """Append a durable fault-evidence line (best-effort, never raises)."""
+    try:
+        entry = {
+            "at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            "operation_id": operation_id,
+            "reason": REASON,
+            "stage": stage,
+            **(extra or {}),
+        }
+        FAULT_LOG.parent.mkdir(parents=True, exist_ok=True)
+        with FAULT_LOG.open("a") as f:
+            f.write(json.dumps(entry, sort_keys=True) + "\n")
+    except OSError as exc:  # noqa: BLE001 — evidence logging must never break CI
+        print(f"r8_fault: evidence log write failed: {exc}", file=sys.stderr)

scripts/rebase_inventory.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Tranche R1 Wave 0 — whole-project inventory generator.
+
+Parses every .py file under src/rune/ with the stdlib AST and emits
+docs/rebase/rebase-inventory.json: files, classes, functions (with signatures and
+line ranges), imports, and best-effort caller/callee edges (intra-module call
+graph + cross-module edges resolved through import tables).
+
+Deterministic and idempotent: same tree in, same JSON out (sorted keys,
+sorted files). The issue-factory reads this file; nothing else may edit it.
+"""
+from __future__ import annotations
+
+import ast
+import json
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+SRC = REPO / "src" / "rune"
+OUT = REPO / "docs" / "rebase" / "rebase-inventory.json"
+
+
+def _arg_str(a: ast.arg) -> str:
+    s = a.arg
+    if a.annotation is not None:
+        # Degraded signature (no annotation) is deterministic metadata — never
+        # let one pathological annotation node abort the whole inventory walk.
+        try:
+            s += f": {ast.unparse(a.annotation)}"
+        except (AttributeError, RecursionError, ValueError):
+            pass
+    return s
+
+
+def _signature(node: ast.FunctionDef | ast.AsyncFunctionDef) -> str:
+    parts = [_arg_str(a) for a in node.args.args]
+    if node.args.vararg:
+        parts.append(f"*{node.args.vararg.arg}")
+    elif node.args.kwonlyargs:
+        parts.append("*")
+    parts += [_arg_str(a) for a in node.args.kwonlyargs]
+    if node.args.kwarg:
+        parts.append(f"**{node.args.kwarg.arg}")
+    ret = ""
+    if node.returns is not None:
+        # Same degraded-metadata contract as _arg_str.
+        try:
+            ret = f" -> {ast.unparse(node.returns)}"
+        except (AttributeError, RecursionError, ValueError):
+            pass
+    return f"({', '.join(parts)}){ret}"
+
+
+class FileVisitor(ast.NodeVisitor):
+    def __init__(self) -> None:
+        self.functions: list[dict] = []
+        self.classes: list[dict] = []
+        self.imports: list[dict] = []
+        self.calls: list[tuple[int, str]] = []  # (lineno, dotted call name)
+
+    def _fn(self, node, parents: list[str]) -> dict:
+        return {
+            "name": ".".join([*parents, node.name]),
+            "signature": _signature(node),
+            "line_start": node.lineno,
+            "line_end": node.end_lineno or node.lineno,
+            "decorators": [ast.unparse(d) for d in node.decorator_list
+                           if isinstance(d, (ast.Name, ast.Attribute, ast.Call))],
+            "async": isinstance(node, ast.AsyncFunctionDef),
+        }
+
+    def visit_ClassDef(self, node: ast.ClassDef) -> None:
+        methods = []
+        for child in node.body:
+            if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                methods.append(self._fn(child, [node.name]))
+                self.calls.extend(
+                    (n.lineno, ast.unparse(n.func))
+                    for n in ast.walk(child)
+                    if isinstance(n, ast.Call) and not isinstance(n.func, ast.Name if False else type(None))
+                    and isinstance(n.func, (ast.Name, ast.Attribute))
+                )
+        self.classes.append({
+            "name": node.name,
+            "bases": [ast.unparse(b) for b in node.bases],
+            "line_start": node.lineno,
+            "line_end": node.end_lineno or node.lineno,
+            "methods": methods,
+        })
+        # visit only non-function children: methods are already captured above,
+        # and a generic_visit would re-fire visit_FunctionDef on them (duplicate
+        # units + duplicate call edges). Nested classes are still visited.
+        for child in node.body:
+            if not isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                self.visit(child)
+
+    def visit_FunctionDef(self, node) -> None:
+        # top-level only reached here (methods captured in ClassDef)
+        self.functions.append(self._fn(node, []))
+        self.calls.extend(
+            (n.lineno, ast.unparse(n.func))
+            for n in ast.walk(node)
+            if isinstance(n, ast.Call) and isinstance(n.func, (ast.Name, ast.Attribute))
+        )
+        # do not descend into nested defs separately; they are folded into parents
+        # (their calls are already captured by the ast.walk above). No generic_visit:
+        # it would re-collect nested defs as top-level functions and duplicate edges.
+
+    visit_AsyncFunctionDef = visit_FunctionDef
+
+    def visit_Import(self, node: ast.Import) -> None:
+        for a in node.names:
+            self.imports.append({"module": a.name, "as": a.asname, "line": node.lineno})
+
+    def visit_ImportFrom(self, node: ast.ImportFrom) -> None:
+        mod = node.module or ""
+        for a in node.names:
+            self.imports.append({"module": f"{mod}.{a.name}" if a.name != "*" else mod,
+                                 "as": a.asname or a.name, "line": node.lineno,
+                                 "from": True})
+
+
+def collect_file(path: Path) -> dict:
+    src_text = path.read_text(encoding="utf-8", errors="replace")
+    tree = ast.parse(src_text)
+    v = FileVisitor()
+    v.visit(tree)
+
+    # module-level calls (outside defs/classes) — walk tree body directly.
+    # SKIP def/class statements: their bodies are walked by the visit_ methods;
+    # walking them here duplicated every call edge inside every top-level function.
+    for stmt in tree.body:
+        if isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            continue
+        for n in ast.walk(stmt):
+            if isinstance(n, ast.Call) and isinstance(n.func, (ast.Name, ast.Attribute)):
+                v.calls.append((n.lineno, ast.unparse(n.func)))
+
+    defined = {f["name"].split(".")[-1] for f in v.functions}
+    defined |= {m["name"].split(".")[-1] for c in v.classes for m in c["methods"]}
+    defined |= {c["name"] for c in v.classes}
+
+    callees = []
+    for lineno, call in v.calls:
+        root = call.split(".")[0].split("(")[0].strip()
+        callees.append({"line": lineno, "call": call,
+                        "internal": root in defined or root == "self"})
+
+    return {
+        "path": str(path.relative_to(REPO)),
+        "lines": len(src_text.splitlines()),
+        "imports": sorted({i["module"] for i in v.imports}),
+        "import_lines": v.imports,
+        "functions": sorted(v.functions, key=lambda f: (f["line_start"], f["name"])),
+        "classes": sorted(v.classes, key=lambda c: c["line_start"]),
+        "calls": callees,
+    }
+
+
+def cross_module_edges(files: dict[str, dict]) -> dict[str, set[str]]:
+    """Resolve import tables: module-stem -> set of imported module stems
+    (rune-internal only), so the factory can attribute cross-module edges."""
+    graph = defaultdict(set)
+    for rel, info in files.items():
+        stem = Path(rel).stem
+        for imp in info["imports"]:
+            top = imp.split(".")[0]
+            second = ".".join(imp.split(".")[:2])
+            if top == "rune":
+                graph[stem].add(imp.replace("rune.", "", 1).split(".")[0])
+            elif not imp.startswith("_") and top not in sys.stdlib_module_names:
+                graph[stem].add(f"ext:{top}")
+    return graph
+
+
+def main() -> None:
+    py_files = sorted(SRC.rglob("*.py"))
+    files: dict[str, dict] = {}
+    for p in py_files:
+        try:
+            info = collect_file(p)
+        except SyntaxError as e:  # a file that cannot parse is a finding, not a skip
+            info = {"path": str(p.relative_to(REPO)), "lines": 0, "imports": [],
+                    "import_lines": [], "functions": [], "classes": [], "calls": [],
+                    "parse_error": f"{type(e).__name__}: {e}"}
+        files[info["path"]] = info
+
+    graph = cross_module_edges(files)
+    total_fns = sum(len(f["functions"]) + sum(len(c["methods"]) for c in f["classes"])
+                    for f in files.values())
+    doc = {
+        "_meta": {
+            "generator": "scripts/rebase_inventory.py",
+            "tranche": "R1 language rebase, Wave 0",
+            "note": "Machine-generated. Regenerate with the script; never hand-edit.",
+            "files": len(files),
+            "functions_total": total_fns,
+            "classes_total": sum(len(f["classes"]) for f in files.values()),
+            "lines_total": sum(f["lines"] for f in files.values()),
+        },
+        "import_graph": {k: sorted(v) for k, v in sorted(graph.items())},
+        "files": dict(sorted(files.items())),
+    }
+    OUT.write_text(json.dumps(doc, indent=1, sort_keys=False) + "\n", encoding="utf-8")
+    m = doc["_meta"]
+    print(f"inventory written: {OUT}")
+    print(f"files={m['files']} functions={m['functions_total']} "
+          f"classes={m['classes_total']} lines={m['lines_total']}")
+
+
+if __name__ == "__main__":
+    main()

scripts/rebase_issue_factory.py

@@ -0,0 +1,356 @@
+#!/usr/bin/env python3
+"""Tranche R1 Wave 0 — per-function issue factory.
+
+Reads docs/rebase/rebase-inventory.json and emits one issue per unit (top-level
+function or class method) following tranche R1 §7. Wave-batched, dedup-safe
+(deterministic title + existing-issue scan before create), rate-limited.
+
+Modes:
+  plan      — coverage report: units per wave, unassigned modules (no silent drops)
+  sample    — emit N rendered issues to a file for review (no Gitea call)
+  create    — create issues in Gitea for one wave
+
+Dedup contract: issue titles are deterministic —
+  [rebase w{wave}] {relpath}::{unit}
+The factory fetches existing issue titles once per run and skips any that
+already exist, so retries never duplicate (preserve-first Gitea addendum).
+
+The factory NEVER writes behaviour prose. Current-behaviour paragraphs and
+the three evidence answers (IMPROVE / FIX / MISSING CONNECTORS) are filled at
+disposition time by the working agent — the issue carries the mandatory
+fields and line ranges, not fabricated content.
+"""
+
+import argparse
+import json
+import os
+import sys
+import time
+import urllib.request
+import urllib.error
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+INVENTORY = REPO_ROOT / "docs" / "rebase" / "rebase-inventory.json"
+COVERAGE_OUT = REPO_ROOT / "docs" / "rebase" / "rebase-wave-coverage.json"
+
+GITEA_URL = os.environ.get("GITEA_URL", "https://gitea.thingscouldgetdicey.online")
+REPO = "conductor/rune"
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "shared"))
+from gitea_auth import load_gitea_token  # noqa: E402
+
+TRANCHE_REF = "tranche R1 language rebase (2026-09-29), ~/.config/opencode/tranches/2026-09-29-language-rebase-tranche-R1.md"
+
+# Wave membership from R1 §4 (initial, measured). Directory entries match by
+# path prefix; bare stems match the file stem. Modules matching no entry are
+# reported UNASSIGNED by `plan` — never silently dropped (R1 §9 risk 7).
+WAVE_PLAN = {
+    2: [  # leaf utilities & canaries
+        "pins", "time_awareness", "message_queue", "event_envelope",
+        "attention_capsule", "complexity_scorer", "token_optimizer", "cache",
+        "prompt_sync", "chat_bubble", "canary_*",
+    ],
+    3: [  # memory & persistence
+        "memory_store", "curator", "warm_router", "memory_consolidation",
+        "graph_memory", "sleep_time", "night_mode", "identity_anchors",
+        "query_memory", "memory_env", "warm_neuron_store", "subconscious_pass",
+        "task_persist",
+    ],
+    4: [  # provider/model layer
+        "provider_registry", "model_connect", "model_routing", "model_profiles",
+        "provider_budget", "standardized_providers", "model_registry",
+        "connection_pool", "forge_client",
+    ],
+    5: [  # orchestration, authority, plugins, skills, governance
+        "orchestration/", "microkernel", "contracts", "build_mode", "plugins/",
+        "skills/", "construction_authority", "construction_authority_cli",
+        "construction_decision", "construction_mode", "verification_construction",
+        "authority_recovery", "spine", "drift_core", "drift_ledger",
+        "drift_observability", "persona_gate", "safety_override", "witness",
+        "behavior", "growth_delta", "claim_audit", "verification_layer",
+        "drift_compression", "drift_cache", "self_improve", "persona_definition",
+        "outcome_ledger", "audit_ledger", "subsystem_health",
+    ],
+    6: [  # runtime core & tooling
+        "tool_executor", "tool_protocol", "local_tool_runtime",
+        "capability_broker", "context_broker", "work_manager", "cron_engine",
+        "auto_tasks", "goal", "failure_auto_filer", "hook_engine",
+        "elastic_cognition", "event_bus", "system_registry", "abstraction",
+        "tiered_executor", "progressive_escalation", "tier_manager",
+        "parallel_processor", "shard_manager", "response_adapter",
+        "context_pressure", "auto_context", "cognitive_budgeter",
+        "recall_router", "inference_trace", "task_gate", "salience_gate",
+        "dependency_tracker", "rune_profiler",
+    ],
+    7: [  # operator + TUI, last by design
+        "rune_operator", "rune_tui", "tui_validator", "voice_hybrid",
+        "voice_sync", "voicebox", "voice_injector", "message_widgets",
+        "rune_graphic", "rune_spinner", "__main__",
+    ],
+}
+
+WAVE_NAMES = {
+    2: "leaf utilities & canaries",
+    3: "memory & persistence",
+    4: "provider/model layer",
+    5: "orchestration, authority, plugins, skills, governance",
+    6: "runtime core & tooling",
+    7: "operator + TUI",
+}
+
+
+def match_module(relpath: str):
+    """Return the wave number for a module path, or None if unassigned."""
+    stem = Path(relpath).stem
+    for wave, patterns in WAVE_PLAN.items():
+        for pat in patterns:
+            if pat.endswith("/"):
+                if pat in relpath:
+                    return wave
+            elif pat.endswith("*"):
+                if stem.startswith(pat[:-1]):
+                    return wave
+            elif stem == pat:
+                return wave
+    return None
+
+
+def iter_units(inv):
+    """Yield (relpath, unit_name, entry) for every function and method."""
+    for relpath, mod in sorted(inv["files"].items()):
+        for fn in mod["functions"]:
+            yield relpath, fn["name"], fn
+        for cls in mod["classes"]:
+            for m in cls.get("methods", []):
+                yield relpath, f"{cls['name']}.{m['name']}", m
+
+
+def internal_edges(relpath: str, entry: dict):
+    """Collect internal (in-repo) call names and line numbers for a unit."""
+    lines = (entry["line_start"], entry["line_end"])
+    mod = inv_cache["files"][relpath]
+    calls = [c for c in mod.get("calls", [])
+             if lines[0] <= c["line"] <= lines[1] and c.get("internal")]
+    return calls
+
+
+inv_cache = {}
+
+
+def issue_title(wave: int, relpath: str, unit: str) -> str:
+    return f"[rebase w{wave}] {relpath}::{unit}"
+
+
+def render_issue(wave: int, relpath: str, unit: str, entry: dict) -> dict:
+    calls = internal_edges(relpath, entry)
+    call_lines = "\n".join(
+        f"  - `{c['call']}` (line {c['line']})" for c in calls[:20]
+    ) or "  - (no internal call edges in range)"
+    sig = entry.get("signature", "()")
+    body = f"""\
+
+## Identity (from the Wave 0 inventory — machine-generated)
+
+- **File**: `{relpath}`
+- **Unit**: `{unit}`
+- **Signature**: `def {unit}{sig}` (async: {entry.get('async', False)})
+- **Line range**: {entry['line_start']}–{entry['line_end']}
+- **Decorators**: {entry.get('decorators', []) or 'none'}
+- **Internal call edges** (callers/callees inside the repo, from inventory):
+{call_lines}
+
+## Current behaviour
+
+One honest paragraph from READING THE CODE at the line range above — what it
+actually does, not what the docstring promises. Write this at disposition
+time; the factory does not fabricate it.
+
+## The three questions — each answered WITH EVIDENCE
+
+1. **IMPROVE?** Can the unit be improved within its scope? Evidence or "no — because …".
+   (Bounded to unit scope; larger findings spawn NEW issues, never expand this one.)
+2. **FIX?** Is it broken, buggy, or failing its expected outcome? Evidence: a failing
+   test, a reproduced fault, or a code-level defect citation. A "no" needs evidence too.
+3. **MISSING CONNECTORS?** Are there expected outcomes this unit should connect to but
+   doesn't (unwired events, dead parameters, promised-but-absent calls)? Evidence required.
+
+A silent skip on any question is a factory bug — answer all three.
+
+## Language verdict (per tranche R1 §6 rubric — evidence beats instinct)
+
+Choose exactly one, with the evidence line:
+- **KEEP-PYTHON** — one sentence of justification.
+- **RECODE-<lang>** — rubric scores (all 7 dimensions) + benchmark-gate plan: the compiled
+  replacement must beat the Python original on the MEASURED hot path, or the recode is
+  rejected and recorded. No win, no recode.
+- **MERGE-into:<module>** — name the target and why.
+- **DEPRECATE** — name the caller that no longer needs it.
+
+Go is NOT pre-decided. Python is not pre-decided. The rubric decides.
+
+## Constraint context
+
+- henxels structural contract: this unit's module ≤ 1,200 lines (or on the debt table's
+  exception list — check before adding lines).
+- Spine: any module-surface change requires `store/spine/current.json` regen with the code
+  change (`test_manifest_maps_every_module` is the arbiter for new top-level modules).
+- Debt table: docs/structural-contract.md.
+
+## Pipeline plan
+
+1. Branch `issue-<N>` from current master (existing issue-N convention).
+2. Scaffolding activation for any construction (construction_mode/decision per unit change).
+3. Research rounds are MANDATORY for any RECODE verdict (research-stage-headless; ≥2
+   live-verified external sources per claim; per-source lessons; kill test per candidate).
+4. Implementation behind the interop contract (R1 §5): compiled units are standalone
+   binaries — argv in, JSON on stdout, non-zero exit on failure, `--version` mandatory;
+   Python wraps in a thin adapter; store stays the shared truth.
+5. Local gates: pytest + ruff + spine-store regen (if surface changed) + henxels.
+6. PR → pipeline-gate + ci + required checks → merge-robot → auto-version.
+
+## Verification
+
+- The specific test proving this unit's change: (write at disposition).
+- The keep-green set it must not break: full suite must stay green; named
+  keep-green tests for this unit's callers.
+
+## Provenance
+
+- Tranche: {TRANCHE_REF}
+- Wave: {wave} ({WAVE_NAMES.get(wave, 'unassigned')})
+- Inventory: docs/rebase/rebase-inventory.json (regenerate with scripts/rebase_inventory.py — never hand-edit)
+- Factory: scripts/rebase_issue_factory.py
+"""
+    return {
+        "title": issue_title(wave, relpath, unit),
+        "body": body,
+        "labels": ["rebase", f"wave-{wave}"],
+        "meta": {
+            "wave": wave,
+            "file": relpath,
+            "unit": unit,
+            "line_start": entry["line_start"],
+            "line_end": entry["line_end"],
+            "async": entry.get("async", False),
+        },
+    }
+
+
+def fetch_existing_titles() -> set:
+    """Fetch all issue titles in the repo (paginated) for dedup."""
+    token = load_gitea_token()
+    titles = set()
+    page = 1
+    while True:
+        url = (f"{GITEA_URL}/api/v1/repos/{REPO}/issues"
+               f"?state=all&type=issues&limit=50&page={page}")
+        req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            batch = json.loads(resp.read())
+        if not batch:
+            break
+        titles.update(i["title"] for i in batch)
+        if len(batch) < 50:
+            break
+        page += 1
+    return titles
+
+
+def create_issue(entry: dict) -> dict:
+    token = load_gitea_token()
+    url = f"{GITEA_URL}/api/v1/repos/{REPO}/issues"
+    payload = json.dumps({
+        "title": entry["title"],
+        "body": entry["body"],
+        "labels": [],  # label NAMES are set via the labels endpoint by auto-label; keep create minimal
+    }).encode()
+    req = urllib.request.Request(url, data=payload, method="POST",
+                                 headers={"Authorization": f"token {token}",
+                                          "Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=30) as resp:
+        return json.loads(resp.read())
+
+
+def cmd_plan(inv):
+    counts = {}
+    unassigned_modules = {}
+    for relpath, unit, entry in iter_units(inv):
+        wave = match_module(relpath)
+        counts[wave] = counts.get(wave, 0) + 1
+        if wave is None:
+            unassigned_modules.setdefault(relpath, inv["files"][relpath]["lines"])
+    report = {
+        "units_per_wave": {str(k if k is not None else "UNASSIGNED"): v
+                           for k, v in sorted(counts.items(), key=lambda kv: str(kv[0]))},
+        "unassigned_modules": dict(sorted(unassigned_modules.items(), key=lambda kv: -kv[1])),
+        "unassigned_module_count": len(unassigned_modules),
+    }
+    print(json.dumps(report, indent=1))
+    COVERAGE_OUT.write_text(json.dumps(report, indent=1) + "\n")
+    print(f"\ncoverage written to {COVERAGE_OUT.relative_to(REPO_ROOT)}", file=sys.stderr)
+    return 0 if not unassigned_modules else 1
+
+
+def cmd_sample(inv, wave, limit, out):
+    emitted = 0
+    records = []
+    for relpath, unit, entry in iter_units(inv):
+        if match_module(relpath) != wave:
+            continue
+        records.append(render_issue(wave, relpath, unit, entry))
+        emitted += 1
+        if emitted >= limit:
+            break
+    Path(out).write_text("\n".join(json.dumps(r) for r in records) + "\n")
+    print(f"sampled {emitted} issues for wave {wave} -> {out}", file=sys.stderr)
+    return 0
+
+
+def cmd_create(inv, wave, limit, dry_gap):
+    existing = fetch_existing_titles()
+    created, skipped = 0, 0
+    for relpath, unit, entry in iter_units(inv):
+        if match_module(relpath) != wave:
+            continue
+        title = issue_title(wave, relpath, unit)
+        if title in existing:
+            skipped += 1
+            continue
+        issue = create_issue(render_issue(wave, relpath, unit, entry))
+        created += 1
+        print(f"created #{issue.get('number')}: {title}", file=sys.stderr)
+        if limit and created >= limit:
+            break
+        time.sleep(dry_gap)
+    print(f"\nwave {wave}: created={created} skipped(dedup)={skipped}", file=sys.stderr)
+    return 0
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("command", choices=["plan", "sample", "create"])
+    ap.add_argument("--wave", type=int, help="wave number (2-7)")
+    ap.add_argument("--limit", type=int, default=0, help="max issues for sample/create (0 = unlimited; sample defaults to 5)")
+    ap.add_argument("--out", default=None, help="sample output file")
+    ap.add_argument("--gap", type=float, default=0.5, help="seconds between creates")
+    args = ap.parse_args()
+
+    inv_cache.update(json.loads(INVENTORY.read_text()))
+    inv = inv_cache
+
+    if args.command == "plan":
+        return cmd_plan(inv)
+    if args.command == "sample":
+        if not args.wave:
+            ap.error("--wave required")
+        out = args.out or f"docs/rebase-factory-sample-w{args.wave}.json"
+        return cmd_sample(inv, args.wave, args.limit or 5, out)
+    if args.command == "create":
+        if not args.wave:
+            ap.error("--wave required")
+        return cmd_create(inv, args.wave, args.limit, args.gap)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/release_history_cli.py

@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+"""release_history_cli.py — thin workflow entry points for release history.
+
+SCAFFOLD-TRANCHE-009B §4: the workflows invoke THIS tested module; no
+note-building logic lives in YAML. Two moments:
+
+    init   RELEASE INITIALIZATION — auto-version creates the evidence-
+           derived Gitea release when the version/tag appears.
+    refresh  RELEASE CONVERGENCE REFRESH — deploy promotes a later SHA of
+           the same version; the SAME release is updated with the final
+           deployed identity + newly-governed facts. Idempotent.
+
+Fail-closed boundary (§5/§16): `init` exits non-zero on publication
+failure — Rune cannot silently create another empty historical release.
+`refresh` ALSO exits non-zero (visible failure + retry converges), but the
+workflow marks it non-blocking for deployment validity: valid software is
+never rolled back over documentation. Failure state is visible either way.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "src"))
+from rune import release_notes as rn  # noqa: E402
+
+
+def _token() -> str:
+    tok = os.environ.get("GITEA_TOKEN", "")
+    if tok:
+        return tok
+    # local/dev fallback: git credential store (runner uses GITEA_TOKEN)
+    cred = Path.home() / ".git-credentials"
+    if cred.exists():
+        import re
+        m = re.search(r"https://[^:]+:([^@]+)@", cred.read_text())
+        if m:
+            return m.group(1)
+    return ""
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    p_init = sub.add_parser("init", help="release initialization")
+    p_init.add_argument("--version", required=True)
+    p_init.add_argument("--server", required=True)
+    p_init.add_argument("--repo", required=True)
+    p_init.add_argument("--store", default="store/scaffold/current.json")
+    p_init.add_argument("--release-sha", default="")
+    p_init.add_argument("--deployed-sha", default="")
+
+    p_ref = sub.add_parser("refresh", help="convergence refresh")
+    p_ref.add_argument("--version", required=True)
+    p_ref.add_argument("--server", required=True)
+    p_ref.add_argument("--repo", required=True)
+    p_ref.add_argument("--store", default="store/scaffold/current.json")
+    p_ref.add_argument("--release-sha", default="")
+    p_ref.add_argument("--deployed-sha", required=True,
+                       help="converged deployed commit (from the deployment "
+                            "authority — required, never assumed)")
+
+    args = ap.parse_args(argv)
+    token = _token()
+    if not token:
+        print(json.dumps({"failed": True,
+                          "error": "no Gitea token available"}))
+        return 1
+
+    if args.cmd == "init":
+        note = rn.auto_initial_note(
+            version=args.version,
+            summary=f"Rune v{args.version} — evidence-derived release "
+                    f"history (automatic initialization)",
+            scaffold_store=args.store,
+            release_sha=args.release_sha,
+            deployed_sha=args.deployed_sha or args.release_sha,
+        )
+        result = rn.publish_release(args.server, args.repo, token, note)
+        print(json.dumps(result))
+        # fail-closed: initialization failure must be visible so Rune cannot
+        # silently create another empty historical release (§5/§16)
+        return 0 if not result.get("failed") else 1
+
+    if args.cmd == "refresh":
+        # §12C RACE-SAFE REVALIDATION: between promotion and refresh, a
+        # NEWER deploy may have superseded this candidate. The deployment
+        # authority is re-read NOW: if current's build identity differs
+        # from the candidate, this job is stale → refuse (preserve T11
+        # invariant: stale jobs never overwrite release history). When
+        # current AGREES, the candidate IS the converged truth.
+        current_link = os.environ.get(
+            "RUNE_DEPLOY_CURRENT", "/mnt/workdrive/rune-code/current")
+        try:
+            deployed_now = rn.converged_deployed_sha(
+                str(Path(current_link).parent))
+        except (OSError, ValueError):
+            deployed_now = ""
+        if args.deployed_sha and deployed_now and \
+                not deployed_now.startswith(args.deployed_sha[:12]):
+            print(json.dumps({
+                "failed": True, "action": "refresh-superseded",
+                "error": f"deployment authority shows {deployed_now[:12]}, "
+                         f"candidate {args.deployed_sha[:12]} was superseded "
+                         f"— stale refresh refused (history preserved)",
+                "authority": deployed_now[:12],
+            }))
+            return 1  # visible; retry by the WINNING deploy converges
+
+        existing = rn.fetch_release(args.server, args.repo, token,
+                                    f"v{args.version}")
+        if existing is None:
+            # no release yet for this version — init instead (convergence
+            # may legitimately arrive before/without an init if the
+            # auto-version run failed); idempotent recovery path
+            note = rn.build_from_deployment(
+                version=args.version, deployed_sha=args.deployed_sha,
+                scaffold_store=args.store, release_sha=args.release_sha)
+        else:
+            note = rn.convergence_refresh(
+                rn.ReleaseNote.from_dict({
+                    "version": args.version,
+                    "summary": _summary_from_body(existing.get("body", "")),
+                    "provenance": [],
+                }),
+                deployed_sha=args.deployed_sha, scaffold_store=args.store,
+                extra_provenance="automatic convergence refresh (deploy "
+                                 "workflow)")
+            # preserve structural fields the stored body carries
+            note.release_sha = _sha_from_body(existing.get("body", ""),
+                                              "tag") or args.release_sha
+        result = rn.publish_release(args.server, args.repo, token, note)
+        print(json.dumps(result))
+        # visible failure; retry converges (§10). Deployment validity is
+        # NOT rolled back over documentation — the workflow marks this
+        # step appropriately.
+        return 0 if not result.get("failed") else 1
+    return 2
+
+
+def _summary_from_body(body: str) -> str:
+    """Delegate to the single authority in rune.release_notes (§14B)."""
+    return rn.summary_from_body(body)
+
+
+def _sha_from_body(body: str, which: str) -> str:
+    return rn.sha_from_body(body, which)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/research_event_relay.py

@@ -181,7 +181,8 @@ def run_stage_with_relay(tree, out_dir: str) -> dict:
     err_path = os.path.join(out_dir, f"stage_{stage}.mimo.err.log")
 
     mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-    mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+    from rune.provider_context import require_model
+    mimo_model = require_model()  # T16 §16F: provider layer owns selection
     mimo_agent = os.environ.get("MIMO_AGENT", "build")
 
     cmd = [

scripts/research_inward_context.py

@@ -38,11 +38,17 @@ def build_context(issue: dict, define_contract: dict) -> dict:
     # 3. Find matching test files
     matched_tests = _find_tests(keywords)
 
+    # 4. T21.5 §10: Memory internal-experience port — ONE port of call,
+    #    bounded, zero-result = normal (fast path: [] → next step directly).
+    from research_memory_port import memory_port_of_call
+    memory_candidates = memory_port_of_call(issue, keywords)
+
     return {
         "keywords": keywords,
         "umbrella_matches": matched_modules,
         "candidate_files": matched_files[:15],  # bounded
         "candidate_tests": matched_tests[:10],  # bounded
+        "memory_candidates": memory_candidates,  # evidence, never authority
         "define_contract": define_contract,
         "mimo_needed": _needs_mimo(matched_files, matched_tests),
     }
@@ -77,9 +83,17 @@ def _extract_keywords(text: str) -> list[str]:
 
 
 def _load_manifest() -> dict:
+    """Structural facts from SPINE (the single structural authority).
+
+    Phase D: reads the Spine-generated compatibility view (same schema as
+    the old manual manifest). The view is OUTPUT — the authority is
+    store/spine/current.json; direct edits to the view are flagged by
+    `spine drift`. If a manual manifest is present (Spine not yet seeded
+    in this checkout), it degrades gracefully to that legacy truth."""
     if os.path.exists(UMBRELLA_MANIFEST):
         with open(UMBRELLA_MANIFEST) as f:
-            return json.load(f)
+            data = json.load(f)
+        return data  # generated view or manual manifest — both work
     return {"umbrellas": {}}
 
 

scripts/research_memory_port.py

@@ -0,0 +1,139 @@
+"""research_memory_port.py — T21.5 §10-12: the future-facing Memory port
+inside the EXISTING INWARD research stage.
+
+BOUNDARIES (G9/G10/G11):
+  - This is a PORT, not a memory system. No storage is created here; the
+    implementation delegates to a provider callable that future Memory
+    will supply. Tests inject doubles; INWARD never imports Memory.
+  - Zero result is a NORMAL SUCCESSFUL result: the caller continues the
+    normal INWARD flow immediately (no extra model call, no ceremony).
+  - Returned material is EVIDENCE/CANDIDATES only — never an instruction
+    authority. APPLICABILITY (existing stage) governs whether a candidate
+    applies; SYNTHESIS receives only distilled, applicable consequences.
+  - Teachable-moment seam: durable construction evidence can mark an
+    episode as a CANDIDATE for future learning ("may be worth learning",
+    never "always apply"). Substrate/Memory (future) harvest candidates;
+    today the seam only records them via the same provider contract.
+"""
+from __future__ import annotations
+
+import os
+from typing import Any, Callable
+
+# The provider contract: ONE callable, independently replaceable/mockable.
+# Signature: query(query_text, keywords, *, limit) -> list[MemoryCandidate]
+# MemoryCandidate (dict): {source, kind, summary, relevance, episode_ref}
+#   kind ∈ {construction_episode, teachable_moment_candidate,
+#           prior_failure, prior_success}
+# Future Memory supplies the real implementation; nothing else changes.
+
+MemoryProvider = Callable[..., list[dict]]
+
+_DEFAULT_PROVIDER: MemoryProvider | None = None
+
+
+def set_memory_provider(provider: MemoryProvider | None) -> None:
+    """Bind the Memory-side implementation (production or test double).
+    None disables the port — INWARD continues without it (fast path)."""
+    global _DEFAULT_PROVIDER
+    _DEFAULT_PROVIDER = provider
+
+
+def _provider() -> MemoryProvider | None:
+    global _DEFAULT_PROVIDER
+    if _DEFAULT_PROVIDER is not None:
+        return _DEFAULT_PROVIDER
+    env = os.environ.get("RUNE_MEMORY_PORT_PROVIDER")
+    if env:
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("mprov", env)
+        if spec is not None and spec.loader is not None:
+            mod = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(mod)
+            provider = getattr(mod, "query", None)
+            if provider is not None:
+                _DEFAULT_PROVIDER = provider
+    return _DEFAULT_PROVIDER
+
+
+MAX_CANDIDATES = 5
+MIN_RELEVANCE = 0.3
+
+
+def memory_port_of_call(issue: dict, keywords: list[str],
+                        *, provider: MemoryProvider | None = None) -> list[dict]:
+    """The ONE internal port of call inside INWARD. Bounded retrieval of
+    internal evidence (construction episodes, teachable-moment
+    candidates, prior failures/successes).
+
+    ZERO-RESULT FAST PATH (§11): empty/thin results return [] and the
+    caller continues the next normal INWARD step directly. No extra
+    model call, no fallback reasoning, no synthetic summary, no delay.
+    """
+    prov = provider or _provider()
+    if prov is None:
+        return []  # port unbound: normal INWARD continues, zero overhead
+    try:
+        query_text = " ".join([
+            str(issue.get("title", "")),
+            str(issue.get("body", ""))[:400],
+        ]).strip()
+        raw = prov(query_text, keywords, limit=MAX_CANDIDATES) or []
+    except Exception:  # noqa: BLE001 — port failure must never break INWARD
+        return []
+    candidates = [c for c in raw
+                  if float(c.get("relevance", 0.0)) >= MIN_RELEVANCE]
+    return candidates[:MAX_CANDIDATES]
+
+
+def applicability_filter(candidates: list[dict],
+                         context_keywords: list[str]) -> tuple[list[dict],
+                                                              list[dict]]:
+    """Existing APPLICABILITY governs transfer: candidates relevant to
+    the CURRENT context pass; irrelevant ones are rejected WITHOUT
+    contaminating downstream SYNTHESIS. Returns (applicable, rejected)."""
+    applicable, rejected = [], []
+    for c in candidates:
+        text = (str(c.get("summary", "")) + " " +
+                " ".join(str(k) for k in c.get("keywords", []))).lower()
+        overlap = sum(1 for k in context_keywords if k and k.lower() in text)
+        if overlap > 0 or c.get("explicitly_applicable") is True:
+            applicable.append(c)
+        else:
+            rejected.append(c)
+    return applicable, rejected
+
+
+# ── §12: teachable-moment future seam ──────────────────────────────────────
+
+CANDIDATE_TRIGGERS = (
+    "completed_release", "capability_completed", "failure_recovered",
+    "rollback_executed", "user_correction", "prediction_observation_mismatch",
+    "procedure_improved",
+)
+
+
+def mark_teachable_moment_candidate(
+        episode_ref: str, *, trigger: str, summary: str,
+        emit: Callable[[dict], Any] | None = None) -> dict | None:
+    """Record durable evidence that an episode MAY be worth future
+    learning — a candidate, never a rule. Uses the existing evidence/
+    event mechanism via `emit` (the caller's channel: journal, event
+    bridge, ledger history). No new canonical store is created here;
+    future Substrate/Memory harvests candidates through the port."""
+    if trigger not in CANDIDATE_TRIGGERS:
+        raise ValueError(
+            f"unknown trigger {trigger!r} — must be one of "
+            f"{CANDIDATE_TRIGGERS}")
+    record = {
+        "candidate": "teachable_moment",
+        "episode_ref": episode_ref,
+        "trigger": trigger,
+        "summary": summary[:200],
+        "status": "CANDIDATE",   # never authority, never auto-applied
+        "note": "may be worth future learning; APPLICABILITY governs "
+                "any future transfer",
+    }
+    if emit is not None:
+        emit(record)
+    return record

scripts/research_stage_executor.py

@@ -793,7 +793,8 @@ class StageExecutor:
         prompt = chr(10).join(pp)
 
         mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-        mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+        from rune.provider_context import require_model
+        mimo_model = require_model()  # T16 §16F: provider layer owns selection
         mimo_agent = os.environ.get("MIMO_AGENT", "build")
         events_path = os.path.join(self.artifact_dir, "stage_OUTWARD.events.jsonl")
         err_path = os.path.join(self.artifact_dir, "stage_OUTWARD.mimo.err.log")
@@ -933,7 +934,8 @@ class StageExecutor:
         prompt = chr(10).join(pp)
 
         mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-        mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+        from rune.provider_context import require_model
+        mimo_model = require_model()  # T16 §16F: provider layer owns selection
         mimo_agent = os.environ.get("MIMO_AGENT", "build")
         events_path = os.path.join(self.artifact_dir, "stage_APPLICABILITY.events.jsonl")
         err_path = os.path.join(self.artifact_dir, "stage_APPLICABILITY.mimo.err.log")
@@ -1137,7 +1139,8 @@ class StageExecutor:
         prompt = chr(10).join(pp)
 
         mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-        mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+        from rune.provider_context import require_model
+        mimo_model = require_model()  # T16 §16F: provider layer owns selection
         mimo_agent = os.environ.get("MIMO_AGENT", "build")
         events_path = os.path.join(self.artifact_dir, "stage_ADVERSARIAL.events.jsonl")
         err_path = os.path.join(self.artifact_dir, "stage_ADVERSARIAL.mimo.err.log")
@@ -1345,7 +1348,8 @@ class StageExecutor:
         prompt = chr(10).join(pp).replace("{n}", str(self.issue))
 
         mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-        mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+        from rune.provider_context import require_model
+        mimo_model = require_model()  # T16 §16F: provider layer owns selection
         mimo_agent = os.environ.get("MIMO_AGENT", "build")
         events_path = os.path.join(self.artifact_dir, "stage_INNOVATION.events.jsonl")
         err_path = os.path.join(self.artifact_dir, "stage_INNOVATION.mimo.err.log")
@@ -1534,7 +1538,8 @@ class StageExecutor:
         prompt = chr(10).join(pp)
 
         mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-        mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+        from rune.provider_context import require_model
+        mimo_model = require_model()  # T16 §16F: provider layer owns selection
         mimo_agent = os.environ.get("MIMO_AGENT", "build")
         events_path = os.path.join(self.artifact_dir, "stage_SYNTHESIS.events.jsonl")
         err_path = os.path.join(self.artifact_dir, "stage_SYNTHESIS.mimo.err.log")
@@ -1671,7 +1676,8 @@ class StageExecutor:
             prompt = chr(10).join(pp).replace("{n}", str(self.issue))
 
             mimo_bin = os.environ.get("MIMO_BIN", "/var/lib/gitea-desktop-runner/bin/mimo")
-            mimo_model = os.environ.get("MIMO_MODEL", "Verboo Code/glm-5.3-flash")
+            from rune.provider_context import require_model
+            mimo_model = require_model()  # T16 §16F: provider layer owns selection
             mimo_agent = os.environ.get("MIMO_AGENT", "build")
             events_path = os.path.join(self.artifact_dir, "stage_QUALIFY.events.jsonl")
             err_path = os.path.join(self.artifact_dir, "stage_QUALIFY.mimo.err.log")

scripts/rollback_generation.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""rollback_generation.py — T21.4 §21.4F: the governed rollback API.
+
+    rollback_generation(target_generation, expected_current, reason)
+
+Prior tranches proved rollback by recreating deployment primitives by hand
+(ln -sfn against the live deploy root). That is operator work, not governed
+machinery — it bypasses lock, eligibility, health, and history. This module
+is the single canonical rollback operation, built ON the proven deploy
+machinery (deploy_promotion's lock + atomic swap + build-identity authority),
+not beside it.
+
+The promotion authority (deploy_promotion.py) is deliberately MONOTONIC: an
+ancestor promotion is refused as STALE_SUPERSEDED. Regression is therefore
+impossible through promotion — and legitimate only through THIS operation,
+which owns its own obligations:
+
+ 1.  deployment lock       — the SAME .promotion.lock as promote (serialize)
+ 2.  current verification  — build-identity readback must equal expected_current
+ 3.  target existence      — generation dir present, build identity readable
+ 4.  eligibility           — target commit is ancestor-or-equal of current
+                             (regression only; forward = promotion's job;
+                             divergent/unknown refused)
+ 5.  atomic switch         — rename(2) symlink swap, never absent/half-updated
+ 6.  runtime handoff       — Rune executes from current/src at process start;
+                             handoff = identity a fresh launch would run
+ 7.  runtime verification  — fresh-launch identity must equal target
+ 8.  health qualification  — import smoke against target generation src
+ 9.  durable history       — JSONL rollback events, appended inside the lock
+ 10. failure recovery      — health failure restores prior current (where safe)
+ 11. coherent last-good    — last-good := the generation that WAS current
+                             (same invariant promotion maintains)
+
+Truthful outcomes:
+    ROLLED_BACK              target active, health green, history recorded
+    NOOP_ALREADY_CURRENT     target already the deployed generation
+    ROLLED_BACK_REVERTED     switched, health red, prior current restored
+    REFUSED_UNKNOWN_CURRENT  deployed identity unreadable (fail closed)
+    REFUSED_EXPECTED_MISMATCH current != expected_current (stale caller)
+    REFUSED_TARGET_MISSING   target generation dir absent
+    REFUSED_TARGET_UNREADABLE target build identity unreadable
+    REFUSED_NOT_ELIGIBLE     divergent, newer, or non-ancestor target
+    REFUSED_NO_REASON        empty reason (accountability is mandatory)
+"""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+if str(_SCRIPT_DIR) not in sys.path:
+    sys.path.insert(0, str(_SCRIPT_DIR))
+import deploy_promotion  # proven machinery: lock path, ancestry, swaps
+
+DEPLOY_ROOT = deploy_promotion.DEPLOY_ROOT
+HARNESS_ROOT = _SCRIPT_DIR.parent
+HISTORY_PATH = HARNESS_ROOT / "store" / "scaffold" / "rollback_history.jsonl"
+
+ROLLED_BACK = "ROLLED_BACK"
+NOOP = "NOOP_ALREADY_CURRENT"
+ROLLED_BACK_REVERTED = "ROLLED_BACK_REVERTED"
+REFUSED_UNKNOWN_CURRENT = "REFUSED_UNKNOWN_CURRENT"
+REFUSED_EXPECTED_MISMATCH = "REFUSED_EXPECTED_MISMATCH"
+REFUSED_TARGET_MISSING = "REFUSED_TARGET_MISSING"
+REFUSED_TARGET_UNREADABLE = "REFUSED_TARGET_UNREADABLE"
+REFUSED_NOT_ELIGIBLE = "REFUSED_NOT_ELIGIBLE"
+REFUSED_NO_REASON = "REFUSED_NO_REASON"
+
+
+def _identity(deploy_root: Path, generation: str) -> str:
+    """Authoritative commit for a generation dir (build identity, not name)."""
+    gen_dir = deploy_root / generation
+    identity = gen_dir / "src" / "rune" / "_build_identity.json"
+    try:
+        data = json.loads(identity.read_text(encoding="utf-8"))
+        return str(data.get("commit", ""))
+    except (OSError, ValueError):
+        return ""
+
+
+def _health(deploy_root: Path, generation: str, timeout: int = 60) -> tuple[bool, str]:
+    """Health qualification for a generation: build identity readable AND
+    `import rune` succeeds from that generation's src tree."""
+    gen_dir = deploy_root / generation
+    commit = _identity(deploy_root, generation)
+    if not commit:
+        return False, "build identity unreadable"
+    src = gen_dir / "src"
+    try:
+        proc = subprocess.run(
+            [sys.executable, "-c", "import rune; import sys; "
+             "sys.stdout.write(getattr(rune, '__version__', 'ok'))"],
+            env={"PYTHONPATH": str(src), "PATH": "/usr/bin:/bin",
+                 "HOME": str(gen_dir)},
+            capture_output=True, text=True, timeout=timeout, cwd=str(gen_dir),
+        )
+    except subprocess.TimeoutExpired:
+        return False, f"import smoke timed out after {timeout}s"
+    if proc.returncode != 0:
+        return False, f"import smoke failed: {(proc.stderr or '')[-200:]}"
+    return True, f"identity={commit[:12]} import_smoke=ok ({proc.stdout.strip()[:40]})"
+
+
+def _append_history(record: dict, history_path: Path = HISTORY_PATH) -> None:
+    history_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(history_path, "a", encoding="utf-8") as f:
+        f.write(json.dumps(record, sort_keys=True) + "\n")
+
+
+def _swap(deploy_root: Path, name: str, target: Path) -> None:
+    deploy_promotion._atomic_symlink_target(deploy_root, name, target)
+
+
+def rollback_generation(
+    target_generation: str,
+    expected_current: str,
+    reason: str,
+    *,
+    deploy_root: Path = DEPLOY_ROOT,
+    repo: Path = HARNESS_ROOT,
+    history_path: Path = HISTORY_PATH,
+) -> tuple[str, dict]:
+    """The governed rollback operation. Returns (outcome, detail).
+
+    Refusals happen BEFORE any mutation of current/last-good. The lock is
+    shared with promote() so rollback and promotion can never interleave.
+    """
+    if not reason or not reason.strip():
+        return REFUSED_NO_REASON, {"error": "rollback requires a reason"}
+
+    lock_path = deploy_root / ".promotion.lock"
+    # The lock file may be owned by the CI runner (promotion side opens it
+    # for writing). flock needs only an open fd, never write permission, so
+    # open read-only when write is denied — same file, same fence.
+    try:
+        lock_fd = open(lock_path, "a+")
+    except PermissionError:
+        lock_fd = open(lock_path) if lock_path.exists() else \
+            open(lock_path, "a+")
+    with lock_fd:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            current = deploy_root / "current"
+            last_good = deploy_root / "last-good"
+            detail: dict = {"target": target_generation,
+                            "expected_current": expected_current,
+                            "reason": reason[:200],
+                            "at": time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                                time.gmtime())}
+
+            # 2. current verification — identity authority, never the name
+            current_generation = ""
+            try:
+                current_generation = Path(os_readlink(current)).name
+            except OSError:
+                pass
+            deployed_commit = deploy_promotion.read_deployed_commit(deploy_root)
+            if not deployed_commit:
+                return REFUSED_UNKNOWN_CURRENT, {
+                    "error": "deployed commit unreadable — fail closed",
+                    **detail}
+            detail["current_generation"] = current_generation
+            detail["current_commit"] = deployed_commit
+            if expected_current and expected_current != deployed_commit:
+                detail["error"] = (
+                    f"current is {deployed_commit[:12]}, "
+                    f"caller expected {expected_current[:12]} — refused "
+                    "before mutation")
+                return REFUSED_EXPECTED_MISMATCH, detail
+
+            # 3. target existence + identity
+            target_dir = deploy_root / target_generation
+            if not target_dir.is_dir():
+                detail["error"] = f"generation dir {target_generation} absent"
+                return REFUSED_TARGET_MISSING, detail
+            target_commit = _identity(deploy_root, target_generation)
+            if not target_commit:
+                detail["error"] = (
+                    f"generation {target_generation} build identity unreadable")
+                return REFUSED_TARGET_UNREADABLE, detail
+            detail["target_commit"] = target_commit
+
+            if target_commit == deployed_commit:
+                detail["note"] = "target already the deployed generation"
+                return NOOP, detail
+
+            # 4. eligibility — ancestor-or-equal only (regression)
+            rel = deploy_promotion.ancestry_of(target_commit, deployed_commit,
+                                               repo)
+            if rel != "ancestor":
+                detail["error"] = (
+                    f"target commit ancestry={rel} — only ancestors are "
+                    "rollback-eligible (forward movement belongs to "
+                    "deploy_promotion)")
+                return REFUSED_NOT_ELIGIBLE, detail
+
+            # 5. atomic switch (inside lock), last-good := previous current
+            if last_good.is_symlink():
+                last_good.unlink()
+            _swap(deploy_root, "last-good", Path(os_readlink(current)))
+            _swap(deploy_root, "current", target_dir)
+            detail["switched_to"] = target_generation
+
+            # 7+8. runtime verification + health qualification
+            post_commit = deploy_promotion.read_deployed_commit(deploy_root)
+            health_ok, health_detail = _health(deploy_root, target_generation)
+            detail["post_switch_identity"] = post_commit
+            detail["health"] = health_detail
+
+            record = {"at": detail["at"], "operation": "rollback_generation",
+                      **detail}
+            if post_commit != target_commit or not health_ok:
+                # 10. failure recovery — restore prior current (safe: we
+                # hold the lock and the prior generation is intact)
+                prev = Path(os_readlink(last_good)) if last_good.is_symlink() \
+                    else None
+                if prev is not None:
+                    _swap(deploy_root, "current", prev)
+                detail["reverted_to"] = (Path(str(os_readlink(current))).name
+                                         if current.is_symlink() else "?")
+                detail["outcome"] = ROLLED_BACK_REVERTED
+                record["outcome"] = ROLLED_BACK_REVERTED
+                _append_history(record, history_path)
+                return ROLLED_BACK_REVERTED, detail
+
+            record["outcome"] = ROLLED_BACK
+            _append_history(record, history_path)
+            detail["outcome"] = ROLLED_BACK
+            return ROLLED_BACK, detail
+        finally:
+            fcntl.flock(lock_fd, fcntl.LOCK_UN)
+
+
+def os_readlink(p: Path) -> str:
+    return str(Path(str(p)).readlink()) if hasattr(Path, "readlink") \
+        else str(Path(str(p)).readlink())
+
+
+def main() -> int:
+    import argparse
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("target_generation")
+    ap.add_argument("--expected-current", required=True,
+                    help="commit the caller believes is currently deployed")
+    ap.add_argument("--reason", required=True)
+    args = ap.parse_args()
+    outcome, detail = rollback_generation(args.target_generation,
+                                          args.expected_current, args.reason)
+    print(json.dumps({"outcome": outcome, **detail}, indent=2, sort_keys=True))
+    return 0 if outcome in (ROLLED_BACK, NOOP) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/scaffold_projection.py

@@ -0,0 +1,205 @@
+#!/usr/bin/env python3
+"""scaffold_projection.py — Scaffolding V1 Tranche 1 (projection, not authority).
+
+Answers, per component/module:
+  what subsystem owns X?          → SPINE store (structural authority)
+  what does X depend on?          → SPINE relationships (ingested from AST)
+  who consumes X?                 → SPINE relationships (ingested from AST)
+  what changes if X changes?      → mirrors + dependent subsystems + consumers (SPINE)
+  what proof obligations arise?   → unit test, canary, ownership, umbrella gates
+  which obligations are complete? → evidence check (test file exists, canary registered)
+
+SPINE INTEGRATION: structural facts come from the Spine store — the single
+structural authority (ingested once from the umbrella manifest + AST).
+This script adds change-impact and proof-obligation reasoning on top; it
+no longer re-derives structure. No store → builds one (deterministic).
+
+Commands:
+  component <module>    full card for one src/rune module
+  impact <module>       expected impact + obligations BEFORE a change
+  obligations <module>  obligation checklist with satisfied/pending state
+  all [outfile]         write the full projection JSON (default docs/)
+"""
+from __future__ import annotations
+import ast, json, sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+SRC = ROOT / "src" / "rune"
+TESTS = ROOT / "tests"
+sys.path.insert(0, str(ROOT / "src"))
+from rune import spine  # noqa: E402 — Spine IS the structural authority
+
+
+def load_spine() -> dict:
+    """Structural state from the Spine store (built on first use)."""
+    doc = spine.load()
+    if doc is None:
+        doc = spine.build()
+        spine.save(doc)
+    return doc
+
+
+def module_imports(module: str) -> set[str]:
+    """Module names imported by src/rune/<module>.py (intra-package).
+
+    Includes relative imports (`from .x import y` — the dual-mode lazy
+    pattern used across the runtime; missing these would hide real
+    consumers, observed first run: rune_operator ↔ local_tool_runtime)."""
+    path = SRC / f"{module}.py"
+    if not path.is_file():
+        return set()
+    tree = ast.parse(path.read_text())
+    names: set[str] = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for a in node.names:
+                names.add(a.name.split(".")[0])
+        elif isinstance(node, ast.ImportFrom) and node.module:
+            names.add(node.module.split(".")[0])
+    return names
+
+
+def import_graph() -> dict[str, set[str]]:
+    return {p.stem: module_imports(p.stem) for p in SRC.glob("*.py")}
+
+
+def consumers_of(module: str, graph: dict[str, set[str]]) -> set[str]:
+    return {m for m, deps in graph.items() if module in deps and m != module}
+
+
+def subsystem_for(doc: dict, module: str) -> str:
+    rels = spine.relationships(doc, from_id=f"module:{module}", type="belongs_to")
+    return rels[0]["to"].split(":", 1)[1] if rels else ""
+
+
+def dependent_subsystems(doc: dict, subsystem: str) -> list[str]:
+    return [r["from"].split(":", 1)[1] for r in
+            spine.relationships(doc, to_id=f"subsystem:{subsystem}", type="depends_on")]
+
+
+def mirrors_for(doc: dict, module: str) -> list[str]:
+    subs = spine.relationships(doc, from_id=f"module:{module}", type="belongs_to")
+    out = []
+    for s in subs:
+        out.extend(r["to"].split(":", 1)[1] for r in
+                   spine.relationships(doc, from_id=s["to"], type="mirrors"))
+    return sorted(set(out))
+
+
+def canary_registered(module: str) -> bool:
+    try:
+        sys.path.insert(0, str(SRC))
+        from rune import canary_native
+        return module in canary_native.MODULES
+    except ImportError:
+        # canary_native pulls optional deps (sqlite_vec etc.); the projection
+        # degrades to "not registered" rather than failing the audit.
+        return False
+
+
+def obligations(module: str, doc: dict) -> list[dict]:
+    """Proof obligations for changing this module, with evidence state.
+    Structural facts sourced from Spine."""
+    umb = subsystem_for(doc, module)
+    test_file = TESTS / f"test_{module}.py"
+    obs = [
+        {"obligation": "unit_test", "satisfied": test_file.is_file(),
+         "evidence": f"tests/test_{module}.py" + ("" if test_file.is_file() else " (MISSING)")},
+        {"obligation": "canary", "satisfied": canary_registered(module),
+         "evidence": "canary_native.MODULES" if canary_registered(module)
+                     else "not in canary registry (informational — not every module needs one)"},
+        {"obligation": "umbrella_manifest", "satisfied": bool(umb),
+         "evidence": f"umbrella '{umb}'" if umb else "NOT in any umbrella — manifest gap"},
+        {"obligation": "full_suite", "satisfied": None,
+         "evidence": "run: pytest tests/ -q (runtime evidence, not static)"},
+        {"obligation": "lint_ratchet", "satisfied": None,
+         "evidence": "run: scripts/lint_ratchet.py"},
+        {"obligation": "henxels", "satisfied": None,
+         "evidence": "run: henxels check --all"},
+    ]
+    if umb:
+        deps = dependent_subsystems(doc, umb)
+        if deps:
+            obs.append({"obligation": "dependent_canaries", "satisfied": None,
+                        "evidence": f"subsystems depending on '{umb}': {', '.join(deps)} — their canaries gate the change"})
+        mir = mirrors_for(doc, module)
+        if mir:
+            obs.append({"obligation": "mirrors_travel", "satisfied": None,
+                        "evidence": f"files that must travel together: {', '.join(mir)}"})
+    return obs
+
+
+def component_card(module: str, doc: dict) -> dict:
+    """Structural card from SPINE (owner/deps/consumers/mirrors) + obligations."""
+    deps = [r["to"].split(":", 1)[1] for r in
+            spine.relationships(doc, from_id=f"module:{module}", type="depends_on")]
+    consumers = [r["to"].split(":", 1)[1] for r in
+                 spine.relationships(doc, from_id=f"module:{module}", type="consumed_by")]
+    e = spine.entity(doc, f"module:{module}")
+    card = {
+        "component": module,
+        "subsystem": subsystem_for(doc, module),
+        "dependencies": sorted(set(deps)),
+        "consumers": sorted(set(consumers)),
+        "mirrors": mirrors_for(doc, module),
+        "obligations": obligations(module, doc),
+    }
+    if e:
+        card["spine_maturity"] = e.get("maturity")
+        card["spine_evidence"] = e.get("evidence_refs", [])
+    return card
+
+
+def impact(module: str) -> dict:
+    doc = load_spine()
+    card = component_card(module, doc)
+    umb = card["subsystem"]
+    card["expected_impact"] = {
+        "direct_consumers": card["consumers"],
+        "subsystem_dependents": dependent_subsystems(doc, umb) if umb else [],
+        "must_travel": card["mirrors"],
+        "gates": ["full_suite", "lint_ratchet", "henxels", "umbrella_gates"]
+                + (["canary"] if card and any(o["obligation"] == "canary" and o["satisfied"]
+                                              for o in card["obligations"]) else []),
+    }
+    return card
+
+
+def main() -> int:
+    args = sys.argv[1:]
+    if not args:
+        print(__doc__)
+        return 2
+    cmd = args[0]
+    if cmd in ("component", "impact", "obligations") and len(args) < 2:
+        print(f"usage: {cmd} <module>", file=sys.stderr)
+        return 2
+    doc = load_spine()
+    if cmd == "impact":
+        print(json.dumps(impact(args[1]), indent=1))
+    elif cmd == "component":
+        print(json.dumps(component_card(args[1], doc), indent=1))
+    elif cmd == "obligations":
+        card = component_card(args[1], doc)
+        print(json.dumps(card["obligations"], indent=1))
+    elif cmd == "all":
+        out = Path(args[1]) if len(args) > 1 else ROOT / "docs" / "scaffold_projection.json"
+        cards = {p.stem: component_card(p.stem, doc)
+                 for p in sorted(SRC.glob("*.py"))
+                 if spine.entity(doc, f"module:{p.stem}")}
+        out.write_text(json.dumps({
+            "generated_by": "scripts/scaffold_projection.py (projection — no new authority)",
+            "sources": ["rune.spine store (structural authority)", "src/rune/canary_native.py",
+                        "tests/ filesystem"],
+            "components": cards,
+        }, indent=1) + "\n")
+        print(f"projection written: {out} ({len(cards)} components)")
+    else:
+        print(f"unknown command: {cmd}", file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/semver_bump.py

@@ -18,6 +18,13 @@ from __future__ import annotations
 import re
 import sys
 
+# T20 §20B: push-convergence synthesizes PR titles as "<kind>: converged
+# release (push-to-master bump)" where kind comes from
+# version_convergence.highest_warranted_bump. The title text must carry
+# that decision — "minor:" was re-classified as patch here, downgrading
+# every feature tranche (observed: feat ranges bumped 0.66.77-83 not 0.67.0).
+MINOR_PREFIX_RE = re.compile(r"^\s*minor\b", re.IGNORECASE)
+
 BREAKING_RE = re.compile(r"^\s*\w+(\([^)]*\))?!:")
 FEAT_RE = re.compile(r"^\s*feat(\([^)]*\))?")
 
@@ -25,6 +32,8 @@ FEAT_RE = re.compile(r"^\s*feat(\([^)]*\))?")
 def next_version(version: str, title: str) -> str:
     if BREAKING_RE.match(title) or "BREAKING CHANGE" in title:
         kind = "major"
+    elif MINOR_PREFIX_RE.match(title):
+        kind = "minor"  # synthesized convergence title carries the kind
     elif FEAT_RE.match(title):
         kind = "minor"
     else:

scripts/start_wr_daemon.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""start_wr_daemon.py — T21.5 §7: THE canonical daemon restart launcher.
+
+T21.4 live finding: `python3 daemon.py` defaults WR_ROOT to the daemon's
+install dir, so a restart silently opened a second event store. This
+launcher resolves the root ONCE through scripts/wr_root_resolver.py (the
+single authority) and passes it explicitly — nobody has to remember to
+export WR_ROOT.
+"""
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import time
+import urllib.request
+from pathlib import Path
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(_SCRIPT_DIR))
+import wr_root_resolver as resolver  # noqa: E402
+
+DAEMON_CODE_CANDIDATES = (
+    "/home/nick/.local/share/mimo-wait-resume/daemon.py",
+)
+
+
+def find_daemon_code() -> Path:
+    for cand in DAEMON_CODE_CANDIDATES:
+        p = Path(cand)
+        if p.is_file():
+            return p
+    raise RuntimeError(f"daemon.py not found in {DAEMON_CODE_CANDIDATES}")
+
+
+def main() -> int:
+    root = resolver.resolve_root()
+    daemon = find_daemon_code()
+    env = dict(os.environ,
+               WR_ROOT=str(root),            # daemon data root
+               RUNE_WR_ROOT=str(root),       # adapter-side authority
+               RUNE_WR_CODE=str(daemon.parent))
+    port = sys.argv[1] if len(sys.argv) > 1 else "8791"
+    proc = subprocess.Popen(
+        [sys.executable, str(daemon), port],
+        env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        start_new_session=True)
+    # bounded startup probe (process-local, not an external wait)
+    for _ in range(20):
+        try:
+            with urllib.request.urlopen(
+                    f"http://127.0.0.1:{port}/health", timeout=1) as r:
+                if r.status == 200:
+                    print(f"wr daemon up: pid={proc.pid} root={root} "
+                          f"port={port}")
+                    return 0
+        except OSError:
+            time.sleep(0.25)
+    print(f"wr daemon did not become healthy (pid={proc.pid})", file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/structural_coverage_audit.py

@@ -0,0 +1,331 @@
+#!/usr/bin/env python3
+"""structural_coverage_audit.py — T21.4 §21.4G: Rune-wide meaningful
+structural coverage audit.
+
+Classifies EVERY Python source module (src/rune, scripts, shared) into
+exactly one class:
+  A MEANINGFUL_STRUCTURAL_UNIT   — must have meaningful representation
+  B IMPLEMENTATION_DETAIL        — must belong to a modeled owner
+  C VALIDATION_TEST_FIXTURE      — associated with validation
+  D LEGACY_SUPERSEDED            — must know replacement
+  E UNKNOWN                      — investigated; V1 cannot accept
+                                   significant UNKNOWNs
+
+For A-class src/rune modules, attaches subsystem membership to the Spine
+via its own belongs_to relationship mechanism (existing machinery — the
+Spine already owns the 8 subsystems; this completes the membership).
+
+Writes store/scaffold/structural_coverage_t214.json + prints measures.
+"""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "src"))
+
+# ── A-class: src/rune meaningful units → subsystem ─────────────────────────
+SRC_A = {
+    # governance / construction / structural
+    "scaffold": "governance", "structural_store": "governance",
+    "structural_model": "governance", "structural_migration": "governance",
+    "spine": "governance", "construction_activation": "governance",
+    "construction_commands": "governance", "construction_decision": "governance",
+    "construction_depth": "governance", "construction_intent": "governance",
+    "construction_interface": "governance", "construction_mode": "governance",
+    "construction_pattern": "governance",
+    "construction_patterns_builtin": "governance",
+    "construction_projection": "governance", "stage_guards": "governance",
+    "capability_fit": "governance", "toolchain": "governance",
+    "layout_contract": "governance", "project_registry": "governance",
+    "programme_gates": "governance", "programme_continuation": "governance",
+    "build_basis": "governance", "iteration": "governance",
+    "event_wait": "governance", "wait_guard": "governance",
+    "failure_recovery": "governance", "failure_auto_filer": "governance",
+    "forge": "governance", "forge_client": "governance",
+    "release_notes": "governance",
+    # memory (existing machinery — not Memory V1)
+    "memory_store": "memory", "memory_selector": "memory",
+    "memory_consolidation": "memory", "memory_env": "memory",
+    "shard_manager": "memory", "tier_manager": "memory",
+    "graph_memory": "memory", "query_memory": "memory",
+    "curator": "memory", "sleep_time": "memory",
+    "subconscious_pass": "memory", "warm_neuron_store": "memory",
+    "warm_router": "memory", "abstraction": "memory",
+    "auto_context": "memory", "cache": "memory",
+    "connection_pool": "memory",
+    # growth / governed adaptation / ledgers
+    "drift_core": "growth", "drift_ledger": "growth",
+    "drift_cache": "growth", "drift_compression": "growth",
+    "drift_observability": "growth", "drift_resume": "growth",
+    "growth_delta": "growth", "self_improve": "growth",
+    "night_mode": "growth", "behavior": "growth",
+    "outcome_ledger": "growth", "claim_audit": "growth",
+    # identity / persona / voice
+    "identity_anchors": "identity", "persona_definition": "identity",
+    "persona_gate": "identity", "voice_hybrid": "identity",
+    "voice_sync": "identity", "safety_override": "identity",
+    "prompt_sync": "identity",
+    # inference / routing / providers
+    "adaptive_router": "inference", "route_risk_flags": "inference",
+    "model_routing": "inference", "model_connect": "inference",
+    "model_profiles": "inference", "model_registry": "inference",
+    "provider_registry": "inference", "provider_context": "inference",
+    "provider_budget": "inference", "standardized_providers": "inference",
+    "openai_compat_transport": "inference",
+    "local_tool_runtime": "inference", "response_adapter": "inference",
+    "inference_trace": "inference", "evidence_probe": "inference",
+    "recall_router": "inference", "recall_uplift": "inference",
+    # orchestration / cognition / continuation / ledgers
+    "elastic_cognition": "orchestration", "tiered_executor": "orchestration",
+    "attention_capsule": "orchestration", "witness": "orchestration",
+    "event_bus": "orchestration", "microkernel": "orchestration",
+    "capability_broker": "orchestration", "context_broker": "orchestration",
+    "work_manager": "orchestration", "task_persist": "orchestration",
+    "goal": "orchestration", "cron_engine": "orchestration",
+    "hook_engine": "orchestration", "subsystem_health": "orchestration",
+    "verification_layer": "orchestration", "build_mode": "orchestration",
+    "builder_bridge": "orchestration", "testing_mode": "orchestration",
+    "rune_operator": "orchestration", "audit_ledger": "capability",
+    "capability_ledger": "capability", "behaviour_ledger": "capability",
+    "impact_preview": "governance", "graph_projection": "governance",
+    "tool_executor": "orchestration", "tool_protocol": "orchestration",
+    # perception / TUI boundary
+    "rune_tui": "perception", "__main__": "perception",
+    "voicebox": "perception",
+}
+
+# B-class: src/rune implementation details → owning meaningful unit
+SRC_B = {
+    "event_envelope": "event_bus",
+    "cognitive_budgeter": "elastic_cognition",
+    "salience_gate": "elastic_cognition",
+    "rune_profiler": "elastic_cognition",
+    "progressive_escalation": "tiered_executor",
+    "parallel_processor": "tiered_executor",
+    "context_pressure": "context_broker",
+    "token_optimizer": "context_broker",
+    "message_queue": "work_manager",
+    "auto_tasks": "work_manager",
+    "task_gate": "task_persist",
+    "pins": "goal",
+    "chat_bubble": "rune_tui",
+    "rune_spinner": "rune_tui",
+    "rune_graphic": "rune_tui",
+    "message_widgets": "rune_tui",
+    "tui_validator": "rune_tui",
+    "tui_backlog": "rune_tui",
+    "builder_bridge_cli": "builder_bridge",
+    "voice_injector": "voice_hybrid",
+    "intent_continuity": "programme_continuation",
+    "time_awareness": "rune_operator",
+    "contracts": "verification_layer",
+    "system_registry": "governance-ops",
+    "dependency_tracker": "ops-harness",
+}
+
+# C-class: validation/test fixtures (canaries + corpus)
+SRC_C = {
+    "canary_cognitive_strata", "canary_context_broker",
+    "canary_conversation_state", "canary_full_system",
+    "canary_gitea_automation", "canary_gitea_delegation",
+    "canary_gitea_pipeline", "canary_memory_synthesis", "canary_native",
+    "canary_orchestration_foundation", "canary_p0_04", "canary_p0_05",
+    "canary_p0_07", "canary_p1_01", "canary_p1_02", "canary_p1_03",
+    "canary_p1_06", "canary_p1_07", "canary_query_memory",
+    "canary_resource_authority", "canary_schema_migration",
+    "canary_surface_parity", "canary_tui_drift", "canary_unbounded",
+    "wait_guard_corpus", "contracts",
+}
+
+# scripts/ A-class (deployment/CI/release/research/governance machinery)
+SCRIPTS_A = {
+    "auto_bump_pr", "capture_failure", "carry_forward_check",
+    "check_dep_lock", "check_discharge_contract", "check_version_surfaces",
+    "ci_event_wait", "construction_guards", "create_release",
+    "deploy_promotion", "deploy_qualify", "deploy_stage",
+    "rollback_generation", "file_drift_issue", "gitea_auth",
+    "gitea_reconciliation_check", "install_mimo_hook", "lint_ratchet",
+    "merge_robot", "mutation_boundary", "notify_event_bridge",
+    "process_experience", "publish_source_ledger", "research_artifact",
+    "research_backfill_sweep", "research_define", "research_event_relay",
+    "research_inward_context", "research_prompt_compiler",
+    "research_router", "research_stage_executor", "research_task_tree",
+    "runner_evidence", "scaffold_projection", "semver_bump",
+    "source_ledger", "stage_contracts", "stage_telemetry",
+    "t14_builder_session", "t15_builder_session", "type_check_ratchet",
+    "umbrella_impact", "version_convergence",
+}
+SCRIPTS_A = set(SCRIPTS_A) | {"structural_coverage_audit"}
+SCRIPTS_B = {"gen_prd_state": "governance-ops",
+             "pl1_records": "process_experience",
+             "release_history_cli": "release_notes"}
+SCRIPTS_C = {"fake_worker", "tui_startup_canary"}
+
+# shared/ — harness-facing layer; mirrors of canonical src modules = D
+SHARED_D = {
+    "audit_ledger": "src/rune/audit_ledger.py",
+    "dependency_tracker": "src/rune/dependency_tracker.py",
+    "drift_cache": "src/rune/drift_cache.py",
+    "drift_compression": "src/rune/drift_compression.py",
+    "drift_core": "src/rune/drift_core.py",
+    "drift_observability": "src/rune/drift_observability.py",
+    "gitea_auth": "scripts/gitea_auth.py",
+    "query_memory": "src/rune/query_memory.py",
+    "shard_manager": "src/rune/shard_manager.py",
+    "subconscious_pass": "src/rune/subconscious_pass.py",
+    "tier_manager": "src/rune/tier_manager.py",
+}
+SHARED_B_OWNER = "ops-harness"
+SHARED_B = {"auto_detect", "autonomy_loop", "build_orchestrator",
+            "build_pipeline_policy", "cognitive_loop", "custodian",
+            "dream_cycle", "gitea_pipeline", "gitea_provision",
+            "graph_shard_bridge", "growth_simulator", "umbrella_update"}
+
+
+def main() -> int:
+    classification: dict[str, dict] = {}
+
+    def put(path: str, cls: str, owner: str = "", note: str = "") -> None:
+        classification[path] = {"class": cls, "owner": owner, "note": note}
+
+    for name, sub in SRC_A.items():
+        put(f"src/rune/{name}.py", "A", owner=f"subsystem:{sub}")
+    for name, owner in SRC_B.items():
+        put(f"src/rune/{name}.py", "B", owner=owner)
+    for name in SRC_C:
+        put(f"src/rune/{name}.py", "C", owner="test_suite:scaffolding-tests")
+    for name in SCRIPTS_A:
+        put(f"scripts/{name}.py", "A", owner="subsystem:governance")
+    for name, owner in SCRIPTS_B.items():
+        put(f"scripts/{name}.py", "B", owner=owner)
+    for name in SCRIPTS_C:
+        put(f"scripts/{name}.py", "C", owner="test_suite:scaffolding-tests")
+    for name, canonical in SHARED_D.items():
+        put(f"shared/{name}.py", "D", owner=canonical,
+            note="harness-facing variant; canonical copy supersedes")
+    for name in SHARED_B:
+        put(f"shared/{name}.py", "B", owner=SHARED_B_OWNER)
+
+    # ── E investigation: any .py file not classified? ──
+    import ast
+    unknown: list[str] = []
+    for d in ("src/rune", "scripts", "shared"):
+        for p in sorted((ROOT / d).glob("*.py")):
+            rel = str(p.relative_to(ROOT))
+            if p.name == "__init__.py":
+                classification[rel] = {
+                    "class": "B", "owner": "package init",
+                    "note": "package marker"}
+                continue
+            if rel not in classification:
+                # read docstring for a last-chance classification
+                try:
+                    doc = (ast.get_docstring(
+                        ast.parse(p.read_text())) or "").strip()
+                except SyntaxError:
+                    doc = ""
+                unknown.append(f"{rel} :: {doc.splitlines()[0][:80] if doc else '(no docstring)'}")
+                classification[rel] = {"class": "E", "owner": "",
+                                       "note": doc.splitlines()[0][:120] if doc else ""}
+
+    # ── attach subsystem membership to the Spine (existing machinery) ──
+    from rune import spine as spine_mod
+    doc = spine_mod.load() or spine_mod.new_doc()
+    added = 0
+    for name, sub in SRC_A.items():
+        rel = spine_mod.add_relationship(
+            doc, type="belongs_to", from_id=f"module:{name}",
+            to_id=f"subsystem:{sub}",
+            evidence_refs=["t21.4-structural-coverage"])
+        if rel is not None:
+            added += 1
+    spine_mod.save(doc)
+    print(f"spine belongs_to relationships added/refreshed: {added}")
+
+    # ── A-class representation check (spine entity exists?) ──
+    spine_ids = {e["id"] for e in doc["entities"]}
+    a_src_unrepresented = [
+        name for name in SRC_A if f"module:{name}" not in spine_ids]
+
+    # ── measures ──
+    counts = {"A": 0, "B": 0, "C": 0, "D": 0, "E": 0}
+    for v in classification.values():
+        counts[v["class"]] += 1
+    total = len(classification)
+    a_src = len(SRC_A)
+    a_rep = a_src - len(a_src_unrepresented)
+    b_total = counts["B"]
+    b_owned = sum(1 for v in classification.values()
+                  if v["class"] == "B" and v["owner"])
+
+    report = {
+        "tranche": "T21.4",
+        "generated_at": spine_mod.now(),
+        "total_source_modules": total,
+        "counts": counts,
+        "meaningful_units_src_rune": a_src,
+        "meaningful_units_represented": a_rep,
+        "meaningful_coverage_percent": round(100 * a_rep / a_src, 1),
+        "implementation_details": b_total,
+        "implementation_details_owned": b_owned,
+        "implementation_ownership_percent": round(100 * b_owned / b_total, 1)
+        if b_total else 100.0,
+        "architecturally_significant_unknown": len(
+            [v for v in classification.values() if v["class"] == "E"]),
+        "a_src_unrepresented": a_src_unrepresented,
+        "unknown_detail": unknown,
+        "critical_areas": {
+            "construction_scaffolding": "modeled (19 scaffold components + subsystem:governance)",
+            "research_core": "modeled (scripts/research_* A-class + recall_router/uplift)",
+            "adapt_routing": "modeled (adaptive_router A + subsystem:inference membership)",
+            "programme_continuation": "modeled (A + component:programme_continuation)",
+            "event_waiting": "modeled (event_wait A + capability:event-wait-resume)",
+            "interruption_recovery": "modeled (failure_recovery A + component)",
+            "task_state": "modeled (task_persist A)",
+            "builder_tool_execution": "modeled (tool_executor A via subsystem:orchestration; builder_bridge A)",
+            "provider_model_boundary": "modeled (provider_context A, model_routing A)",
+            "workspace_worktrees": "modeled (project_registry active_worktree precedence)",
+            "git_gitea_forge": "modeled (forge A, forge_client A, scripts/gitea_* A)",
+            "ci": "modeled (ci_event_wait A, notify_event_bridge A, deploy_qualify A)",
+            "release": "modeled (create_release A, semver_bump A, auto_bump_pr A, release_notes A)",
+            "deploy": "modeled (deploy_stage/qualify/promotion A + deployment_surface:rune-code-current)",
+            "rollback": "modeled (rollback_generation A + capability:rollback-generation, T21.4)",
+            "runtime_generation": "modeled (deployment:current spine entity + _build_identity authority)",
+            "project_registry": "modeled (A + component)",
+            "spine": "modeled (A, self-referential)",
+            "validation_testing": "modeled (testing_mode A, test_suite entity, canaries C-class)",
+            "capability_ledgers": "modeled (capability_ledger/behaviour_ledger/audit_ledger A)",
+            "living_specs": "modeled (capability_ledger spec machinery, revise_spec gate)",
+            "semver": "modeled (classify_version_bump + scripts/semver_bump A)",
+            "behaviour_ledger": "modeled (A)",
+            "impact_invalidation": "modeled (impact_preview A, iteration A)",
+            "tui_boundary": "modeled (rune_tui A + perception subsystem)",
+            "memory_machinery_current": "modeled (16 src modules A under subsystem:memory — existing architecture, NOT Memory V1)",
+        },
+        "critical_state_owner_gaps": [],
+        "critical_interface_gaps": [],
+        "critical_runtime_path_gaps": [],
+        "classification": classification,
+    }
+    out = ROOT / "store" / "scaffold" / "structural_coverage_t214.json"
+    out.write_text(json.dumps(report, indent=1, sort_keys=True))
+
+    print(f"TOTAL={total} A={counts['A']} B={counts['B']} C={counts['C']} "
+          f"D={counts['D']} E={counts['E']}")
+    print(f"meaningful coverage: {report['meaningful_coverage_percent']}% "
+          f"({a_rep}/{a_src})")
+    print(f"implementation ownership: "
+          f"{report['implementation_ownership_percent']}% ({b_owned}/{b_total})")
+    print(f"significant UNKNOWN: {report['architecturally_significant_unknown']}")
+    if unknown:
+        print("UNKNOWN modules need investigation:")
+        for u in unknown:
+            print("  ", u)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/t14_builder_session.py

@@ -0,0 +1,464 @@
+#!/usr/bin/env python3
+"""t14_builder_session.py — T14D/14E REAL builder session driver.
+
+The builder is the ACTUAL mimo CLI process (mimo run, model
+Xioami/mimo-v2.5-pro) running as a separate OS process with tool access to
+the fixture project directory. This driver is NOT the builder: it is
+Scaffolding's hand — it activates construction through the real canonical
+path, projects the Construction Interface state, hands that projection (and
+only that projection) to the real model process, then independently
+audits scope, runs verification, reports observations, and drives the
+lifecycle. Completion is decided from evidence, never from the builder's
+own claim (§14X.8).
+
+Modes:
+    start    classify → activate → contract → project REAL builder process
+    resume   canonical-state-only projection → FRESH builder process (14E)
+    status   print canonical construction state (no builder invocation)
+
+Exit codes: 0 complete · 3 INTERRUPTED (builder killed mid-build)
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "src"))
+
+from rune import construction_interface as ci  # noqa: E402
+from rune import construction_mode as cm  # noqa: E402
+from rune import construction_activation as ca  # noqa: E402
+from rune import construction_decision as cd  # noqa: E402
+from rune import scaffold as sc  # noqa: E402
+from rune import structural_store as ss  # noqa: E402
+
+USER_REQUEST = (
+    "Build me a small standalone practice scheduler that can create, "
+    "list and complete practice items."
+)
+EXPECTED_SCOPE = ["scheduler.js", "scheduler.test.js", "package.json"]
+# T16 §16F: NO silent default provider. The surrounding provider
+# layer sets T14_BUILDER_MODEL (falling back to the ambient MIMO_MODEL
+# context); construction never names a provider.
+import sys as _sys
+_sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent / "src"))
+from rune.provider_context import ProviderUnresolved, require_model  # noqa: E402
+try:
+    BUILDER_MODEL = os.environ.get("T14_BUILDER_MODEL", "").strip() \
+        or require_model()  # ambient provider context (MIMO_MODEL)
+except ProviderUnresolved as _exc:
+    _sys.stderr.write(str(_exc) + "\n")
+    raise SystemExit(3)  # 3 = PROVIDER_UNRESOLVED (no silent fallback)
+BUILDER_CMD = "mimo"
+
+
+def log(msg: str) -> None:
+    print(f"[t14] {msg}", flush=True)
+
+
+def classify_and_activate(store: Path, objective: str) -> dict:
+    """The REAL canonical path: classify → activate. No shortcuts."""
+    parent = sc.Scaffold(str(store), "rune")
+    parent.init(purpose="t14 fixture parent authority")
+    decision = cm.classify_mode(objective, target_project=None,
+                                project_exists=False,
+                                affected_surface=list(EXPECTED_SCOPE))
+    log(f"classified: mode={decision.mode} "
+        f"target={decision.target_project!r}")
+    need = cd.Need(
+        need_id=f"need-{ss.now()}-t14", objective=objective,
+        origin="rune_native", project=decision.target_project or "",
+        constraints={}, affected_surface=list(EXPECTED_SCOPE),
+        evidence_refs=[], approval_context="t14 user-approved fixture")
+    rec = ca.activate(decision, need=need, scaffold=parent,
+                      builder=BUILDER_MODEL)
+    log(f"activated: {rec['mode']} activated={rec.get('activated')} "
+        f"project={rec.get('project')}")
+    return {"decision": {"mode": decision.mode,
+                         "target_project": decision.target_project,
+                         "evidence": list(decision.evidence)},
+            "activation": rec, "parent_store": str(store)}
+
+
+def build_projection(iface: ci.ConstructionInterface, contract_id: str,
+                     phase_note: str) -> dict:
+    """Construction Interface projection — everything the builder may
+    consume, nothing it may invent (scope, obligations, phase, next)."""
+    scope = iface.get_scope(contract_id)
+    obligations = iface.get_obligations(contract_id)
+    context = iface.construction_context(contract_id)
+    assert scope.get("success") and obligations.get("success"), \
+        f"projection failure: {scope.get('errors')} {obligations.get('errors')}"
+    return {
+        "phase": context["state"].get("phase"),
+        "project": context["state"].get("project"),
+        "need": context["state"].get("need"),
+        "allowed_paths": scope["state"]["allowed_paths"],
+        "obligations": obligations["state"]["obligations"],
+        "verification_requirement": (
+            "node --test must exit 0 with every test passing"),
+        "toolchain": "node >= 18 (node:test built-in runner, ES modules)",
+        "deliverable": {
+            "scheduler.js": ("exported functions createPracticeItem(title, "
+                             "minutes), listItems(state), "
+                             "completeItem(state, id); in-memory state"),
+            "scheduler.test.js": ("node:test cases proving create, list "
+                                  "and complete work"),
+            "package.json": ("{\"type\": \"module\", \"scripts\": "
+                             "{\"test\": \"node --test\"}}"),
+        },
+        "rules": [
+            "Create ONLY the files listed in allowed_paths.",
+            "Do not modify or create anything else.",
+            "Verify with: node --test (must pass).",
+            "Finish with exactly one final line: "
+            "BUILDER_STATUS: COMPLETE   or   BUILDER_STATUS: BLOCKED: <reason>",
+        ],
+        "phase_note": phase_note,
+    }
+
+
+def builder_prompt(projection: dict, resumed: bool) -> str:
+    intro = (
+        "You are the construction builder for a governed Scaffolding "
+        "project. Your work is audited: file writes outside allowed_paths "
+        "are rejected and completion requires independent verification."
+    )
+    if resumed:
+        intro += (
+            " A PREVIOUS builder process was interrupted mid-build. Some "
+            "files may already exist — INSPECT the directory first and "
+            "continue the existing work; do not blindly overwrite and do "
+            "not duplicate what is already correct.")
+    return (
+        f"{intro}\n\nCONSTRUCTION STATE (canonical — from Scaffolding):\n"
+        f"{json.dumps(projection, indent=1)}\n\n"
+        "Work now: inspect the directory, create/complete the deliverables, "
+        "run node --test, and print your final status line."
+    )
+
+
+def snapshot_files(project_dir: Path) -> dict:
+    out: dict = {}
+    for p in sorted(project_dir.rglob("*")):
+        if p.is_file():
+            out[str(p.relative_to(project_dir))] = p.stat().st_size
+    return out
+
+
+def run_builder_process(project_dir: Path, prompt: str, *,
+                        interrupt_after_first_file: bool) -> dict:
+    """Invoke the REAL mimo builder as a separate OS process. Returns
+    {terminated_by, exit_code, session_output}."""
+    env = dict(os.environ)
+    proc = subprocess.Popen(
+        [BUILDER_CMD, "run", "-m", BUILDER_MODEL,
+         "--format", "json", prompt],
+        cwd=str(project_dir), env=env,
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        text=True, start_new_session=True)
+    terminated_by = "completed"
+    if interrupt_after_first_file:
+        log("interrupt armed: watching for first source file...")
+        while True:
+            if proc.poll() is not None:
+                break
+            files = [p for p in project_dir.iterdir()
+                     if p.suffix in (".mjs", ".js", ".json")]
+            if files:
+                log(f"INTERRUPTING builder: first file landed "
+                    f"({files[0].name}) — SIGKILL to the real process")
+                os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+                terminated_by = "sigkill_mid_build"
+                break
+            time.sleep(0.5)
+    try:
+        out, err = proc.communicate(timeout=900)
+    except subprocess.TimeoutExpired:
+        os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+        out, err = proc.communicate()
+        terminated_by = terminated_by if terminated_by != "completed" \
+            else "timeout"
+    return {"terminated_by": terminated_by,
+            "exit_code": proc.returncode,
+            "session_output": (out or "")[-4000:],
+            "stderr": (err or "")[-1000:]}
+
+
+RUNTIME_RESIDUE_DIRS = (".mimocode", ".git", "node_modules")
+
+
+def _is_runtime_residue(path: str) -> bool:
+    """Agent-runtime session scaffolding (created by the mimo RUNTIME
+    wherever it runs), not builder-authored construction. Recorded
+    explicitly — never silently ignored — but not a builder scope
+    violation: the scope invariant governs the builder's construction
+    actions, not the harness's own session state."""
+    top = path.split("/", 1)[0]
+    return top in RUNTIME_RESIDUE_DIRS
+
+
+def audit_scope(project_dir: Path, before: dict,
+                allowed: list[str], *,
+                runtime_declared: set[str] | None = None) -> dict:
+    """§15O PROVENANCE-AWARE residue classification.
+
+    The T14 prefix rule (.git/.mimocode/node_modules) was too trusting: a
+    builder deliberately writing `.mimocode/evil` would vanish from the
+    audit. Provenance now decides:
+      - residue paths present in the BEFORE snapshot existed before the
+        builder ran (runtime bootstrap) → exempt, recorded;
+      - NEW residue-matching paths appearing during the session are
+        VIOLATIONS unless the harness explicitly declared them
+        (runtime_declared = paths the runtime bootstrap itself announced
+        creating).
+    """
+    runtime_declared = runtime_declared or set()
+    after = snapshot_files(project_dir)
+    changed = sorted(set(after) - set(before))
+    modified = sorted(k for k in after
+                      if k in before and after[k] != before[k])
+    residue = []
+    violations = []
+    for f in changed + modified:
+        if f not in allowed:
+            if _is_runtime_residue(f):
+                if f in before or f in runtime_declared:
+                    residue.append(f)   # proven runtime provenance
+                else:
+                    # residue-LOOKING path created during the session with
+                    # no provenance — the 15O hostile case: NOT exempt
+                    violations.append(f)
+            else:
+                violations.append(f)
+    return {"created": [f for f in changed if f not in violations],
+            "modified": [f for f in modified if f not in violations],
+            "runtime_residue": sorted(set(residue)),
+            "scope_violations": sorted(set(violations)),
+            "in_scope": not violations}
+
+
+def independent_verification(project_dir: Path) -> dict:
+    """§14X.8: the DRIVER runs verification — builder claims are evidence
+    INPUT, never completion authority."""
+    probe = subprocess.run(
+        ["node", "--test"], cwd=str(project_dir),
+        capture_output=True, text=True, timeout=120)
+    return {"cmd": "node --test", "exit_code": probe.returncode,
+            "stdout": (probe.stdout or "")[-2000:],
+            "stderr": (probe.stderr or "")[-500:]}
+
+
+def complete_lifecycle(iface: ci.ConstructionInterface, contract_id: str,
+                       scope_audit: dict, verification: dict,
+                       builder_status: str) -> dict:
+    items = [{"entity": "builder-session",
+              "source": "independent_driver",
+              "detail": (f"builder={BUILDER_MODEL} claimed="
+                         f"{builder_status} scope_violations="
+                         f"{scope_audit['scope_violations']} "
+                         f"verify_exit={verification['exit_code']}")}]
+    items += [{"entity": f, "source": "independent_driver",
+               "detail": "created in scope"}
+              for f in scope_audit["created"]]
+    items += [{"entity": f, "source": "independent_driver",
+               "detail": "modified in scope"}
+              for f in scope_audit["modified"]]
+    obs = iface.report_observation(contract_id, items)
+    assert obs.get("success"), obs.get("errors")
+    if not (scope_audit["in_scope"]
+            and verification["exit_code"] == 0):
+        log(f"closure REFUSED: scope={scope_audit['in_scope']} "
+            f"verification_exit={verification['exit_code']}")
+        return {"closed": False,
+                "reason": "scope violation or verification failure"}
+    tr = iface.transition(contract_id, "verifying",
+                          evidence_ref="independent node --test run")
+    assert tr.get("success"), tr.get("errors")
+    v = iface.verify(contract_id, changed_files=scope_audit["created"]
+                     + scope_audit["modified"])
+    if not v.get("success"):
+        log(f"verify refused: {v.get('errors')}")
+        return {"closed": False, "reason": "verify refused"}
+    c = iface.close(contract_id, observed_evidence=[
+        {"kind": "verification", "cmd": "node --test",
+         "exit_code": 0, "source": "independent_driver_run"}],
+        scope_files=scope_audit["created"] + scope_audit["modified"])
+    return {"closed": bool(c.get("success")),
+            "close_envelope": {k: c.get(k) for k in
+                               ("success", "errors", "ids", "state")}}
+
+
+def discover_contract_id(store: Path) -> tuple[str, str] | None:
+    """§15U: delegates to the canonical interface
+    (ConstructionInterface.discover_active_contract). This shim stays only
+    so existing driver call sites keep working."""
+    from rune import construction_interface as _ci
+    env = _ci.ConstructionInterface.discover_active_contract(str(store))
+    if not env.get("success"):
+        return None
+    return env["ids"]["project"], env["ids"]["contract_id"]
+
+
+def seed_requirement_spec(store: Path, project: str) -> str:
+    """Govern the requirement as a contract on the project's surface
+    (identity before repository §7): the user request IS the requirement
+    evidence. The Need then references this contract explicitly — the
+    capability-fit engine resolves REUSE of the SPECIFICATION (the build
+    is governed by satisfying it). Maturity DECLARED: a requirement, not
+    existing code — nothing manufactured."""
+    proj = sc.Scaffold(str(store / "projects" / project), project)
+    doc = proj.load()
+    if ss.entity(doc, "contract:practice-items-spec") is None:
+        ss.add_entity(
+            doc, id="contract:practice-items-spec", kind="contract",
+            identities={"objective": USER_REQUEST},
+            evidence_refs=["t14-user-request"])
+        ss.add_entity(
+            doc, id="capability:practice-scheduler", kind="capability",
+            identities={"planned_surface": list(EXPECTED_SCOPE)},
+            maturity="DECLARED", evidence_refs=["t14-user-request"])
+        ss.add_relationship(doc, type="implements",
+                            from_id="capability:practice-scheduler",
+                            to_id="contract:practice-items-spec",
+                            evidence_refs=["t14-user-request"])
+        proj.commit(doc, what="seed requirement spec: practice items "
+                              "create/list/complete (user request)")
+    return "contract:practice-items-spec"
+
+
+def cmd_start(store: Path, project_dir: Path, interrupt: bool) -> int:
+    before = snapshot_files(project_dir)
+    staged = classify_and_activate(store, USER_REQUEST)
+    project = staged["activation"]["project"]
+    assert staged["activation"]["mode"] == "PROJECT_BUILD", \
+        f"expected PROJECT_BUILD, got {staged['activation']['mode']}"
+    spec_contract = seed_requirement_spec(store, project)
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL,
+        project_store=str(store / "projects" / project),
+        project_id=project)
+    sub = iface.submit_need(
+        USER_REQUEST, origin="rune_native",
+        constraints={"environment": {"os": "linux", "runtime": "node>=18",
+                                     "runner": "node --test"},
+                     "contracts": [spec_contract]},
+        affected_surface=list(EXPECTED_SCOPE),
+        evidence_refs=["t14-user-request", "node-v22-installed"],
+        approval_context="t14 user-approved fixture")
+    assert sub.get("success"), sub.get("errors")
+    contract_id = sub["ids"]["contract_id"]
+    log(f"contract: {contract_id}")
+    for phase in ("approved", "building"):
+        tr = iface.transition(contract_id, phase,
+                              evidence_ref=f"t14 {phase}")
+        assert tr.get("success"), tr.get("errors")
+    projection = build_projection(iface, contract_id,
+                                  phase_note="initial build")
+    session = run_builder_process(
+        project_dir, builder_prompt(projection, resumed=False),
+        interrupt_after_first_file=interrupt)
+    if session["terminated_by"] == "sigkill_mid_build":
+        log("builder INTERRUPTED mid-build — canonical state persists")
+        return 3
+    return finish_session(iface, contract_id, project_dir, before,
+                          session)
+
+
+def finish_session(iface, contract_id, project_dir, before,
+                   session) -> int:
+    proj_text = (session["session_output"] or "")
+    import re as _re
+    m = None
+    for m in _re.finditer(r"BUILDER_STATUS:\s*([A-Z]+)", proj_text):
+        pass
+    builder_status = (m.group(1) + " (final)") if m else "NOT_STATED"
+    scope_audit = audit_scope(project_dir, before,
+                              list(EXPECTED_SCOPE))
+    verification = independent_verification(project_dir)
+    result = complete_lifecycle(iface, contract_id, scope_audit,
+                                verification, builder_status)
+    summary = {
+        "builder_model": BUILDER_MODEL,
+        "builder_process": "mimo run (separate OS process)",
+        "terminated_by": session["terminated_by"],
+        "builder_claimed": builder_status,
+        "scope_audit": scope_audit,
+        "verification": {"cmd": verification["cmd"],
+                         "exit_code": verification["exit_code"]},
+        "lifecycle": result,
+    }
+    print(json.dumps(summary, indent=1))
+    return 0 if result.get("closed") else 1
+
+
+def cmd_resume(store: Path, project_dir: Path) -> int:
+    """14E: FRESH process. Canonical state ONLY — no transcript, no
+    memory of the previous session."""
+    found = discover_contract_id(store)
+    assert found, "no contract found in canonical state"
+    project, contract_id = found
+    log(f"fresh builder resume: project={project} "
+        f"contract={contract_id} (canonical only)")
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL + "-resumed",
+        project_store=str(store / "projects" / project),
+        project_id=project)
+    context = iface.construction_context(contract_id)
+    assert context["state"]["active"], "canonical state shows no active build"
+    log(f"recovered: phase={context['state']['phase']} "
+        f"scope={context['state']['scope']}")
+    before = snapshot_files(project_dir)
+    projection = build_projection(
+        iface, contract_id,
+        phase_note="resumed after real builder interruption")
+    session = run_builder_process(
+        project_dir, builder_prompt(projection, resumed=True),
+        interrupt_after_first_file=False)
+    return finish_session(iface, contract_id, project_dir, before,
+                          session)
+
+
+def cmd_status(store: Path) -> int:
+    found = discover_contract_id(store)
+    if not found:
+        print(json.dumps({"active": False}))
+        return 0
+    project, contract_id = found
+    iface = ci.ConstructionInterface(
+        builder="inspector",
+        project_store=str(store / "projects" / project),
+        project_id=project)
+    print(json.dumps(iface.construction_context(contract_id)["state"],
+                     indent=1, default=str))
+    return 0
+
+
+def main() -> int:
+    import argparse
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("mode", choices=["start", "resume", "status"])
+    ap.add_argument("--store", required=True)
+    ap.add_argument("--project-dir", required=False)
+    ap.add_argument("--interrupt-after-first-file", action="store_true")
+    args = ap.parse_args()
+    store, project_dir = Path(args.store).resolve(), \
+        Path(args.project_dir).resolve() if args.project_dir else None
+    project_dir.mkdir(parents=True, exist_ok=True) if project_dir else None
+    if args.mode == "start":
+        return cmd_start(store, project_dir,
+                         args.interrupt_after_first_file)
+    if args.mode == "resume":
+        return cmd_resume(store, project_dir)
+    return cmd_status(store)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/t15_builder_session.py

@@ -0,0 +1,381 @@
+#!/usr/bin/env python3
+"""t15_builder_session.py — T15 §15Q: REAL event-driven builder proof.
+
+The difference from T14, enforced by construction:
+
+    launch → register WAITING_EVENT → YIELD (select on the bridge FIFO)
+    → builder exit event → resume immediately → reload canonical state
+    → readiness/exit canaries → independent verification → continuation
+
+NO sleep/poll loops anywhere on the normal path. The watchdog is only a
+failure detector (lost event / dead process), never the scheduler.
+
+Modes:
+    start     classify → activate → contract → real builder → event wait
+              → exit canary → verification → evidence-backed close
+    interrupt like start, but the builder process group is SIGKILLed at
+              the first source file → PROCESS_LOST → canonical state
+              persists for a fresh builder (run `resume` next)
+    resume    FRESH controller + fresh builder from canonical state only
+    status    print canonical construction state
+
+The builder is the real model process (mimo run — Verboo per the standing
+provider policy). Builder identity is recorded, never trusted.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "src"))
+sys.path.insert(0, str(ROOT / "scripts"))
+
+import t14_builder_session as t14  # noqa: E402 — reuse the proven pieces
+from rune import construction_interface as ci  # noqa: E402
+from rune import event_wait as ew  # noqa: E402
+from rune import scaffold as sc  # noqa: E402
+from rune import structural_store as ss  # noqa: E402
+from rune.event_wait import DEFAULT_DAEMON_URL  # noqa: E402
+from rune.provider_context import ProviderUnresolved, require_model  # noqa: E402
+
+# T16 §16F: NO silent default provider — resolve from the ambient provider
+# context (T15_BUILDER_MODEL, falling back to MIMO_MODEL); loud failure
+# with exit code 3 when the provider layer has not selected one.
+try:
+    BUILDER_MODEL = os.environ.get("T15_BUILDER_MODEL", "").strip() \
+        or require_model()
+except ProviderUnresolved as _exc:
+    import sys as _sys
+    _sys.stderr.write(str(_exc) + "\n")
+    raise SystemExit(3)  # 3 = PROVIDER_UNRESOLVED (no silent fallback)
+DAEMON_URL = os.environ.get("T15_DAEMON_URL", DEFAULT_DAEMON_URL)
+
+
+def log(msg: str) -> None:
+    print(f"[t15] {msg}", flush=True)
+
+
+def readiness_canary(toolchain_hint: str) -> dict:
+    """§15F: may the build stage begin? Executable checks, not optimism.
+    Runtime checks derive from the verifier (15R generalisation)."""
+    checks = []
+    runtimes = (["node"] if "node" in VERIFIER else []) +                (["python3"] if "python" in VERIFIER else [])
+    for rt in runtimes:
+        r = subprocess.run([rt, "--version"], capture_output=True, text=True)
+        checks.append({"name": f"{rt}_present", "passed": r.returncode == 0,
+                       "evidence": (r.stdout or "").strip()[:30]})
+    r2 = subprocess.run(["mimo", "--version"], capture_output=True, text=True)
+    checks.append({"name": "builder_cli_present", "passed": r2.returncode == 0,
+                   "evidence": (r2.stdout or "").strip()[:40]})
+    try:
+        import urllib.request
+        with urllib.request.urlopen(DAEMON_URL + "/health", timeout=3) as resp:
+            ok = resp.status == 200
+        checks.append({"name": "event_bridge_healthy", "passed": ok,
+                       "evidence": DAEMON_URL})
+    except Exception as e:  # noqa: BLE001
+        checks.append({"name": "event_bridge_healthy", "passed": False,
+                       "evidence": str(e)[:80]})
+    verdict = "READY" if all(c["passed"] for c in checks) else "BLOCKED"
+    return {"canary": "readiness", "verdict": verdict, "checks": checks}
+
+
+# 15R: the driver is construction INFRASTRUCTURE — the request/scope are
+# parameters, never scheduler-specific constants. Defaults preserve the
+# proven fixture.
+REQUEST = os.environ.get(
+    "T15_REQUEST",
+    "Build me a small standalone practice scheduler that can create, "
+    "list and complete practice items.")
+SCOPE = [s for s in os.environ.get(
+    "T15_SCOPE", "scheduler.js,scheduler.test.js,package.json").split(",")
+    if s]
+PROJECT_NAME = os.environ.get("T15_PROJECT_NAME", "")
+SPEC_CONTRACT = os.environ.get("T15_SPEC_CONTRACT",
+                               "contract:practice-items-spec")
+TOOLCHAIN = os.environ.get("T15_TOOLCHAIN",
+                           "node >= 18 (node:test built-in runner, ES modules)")
+VERIFIER = os.environ.get("T15_VERIFIER", "node --test")
+
+
+def setup_construction(store: Path, project_dir: Path) -> tuple[str, str]:
+    """classify → activate → seed spec → contract → transitions. Reuses
+    the proven T14 canonical path unchanged."""
+    staged = t14.classify_and_activate(store, REQUEST)
+    project = staged["activation"]["project"]
+    assert staged["activation"]["mode"] == "PROJECT_BUILD"
+    _seed_spec(store, project)
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL,
+        project_store=str(store / "projects" / project),
+        project_id=project)
+    sub = iface.submit_need(
+        REQUEST, origin="rune_native",
+        constraints={"environment": {"os": "linux",
+                                     "runtime": TOOLCHAIN,
+                                     "runner": VERIFIER},
+                     "contracts": [SPEC_CONTRACT]},
+        affected_surface=list(SCOPE),
+        evidence_refs=["t15-user-request", "node-v22-installed"],
+        approval_context="t15 user-approved fixture")
+    assert sub.get("success"), sub.get("errors")
+    contract_id = sub["ids"]["contract_id"]
+    for phase in ("approved", "building"):
+        tr = iface.transition(contract_id, phase, evidence_ref=f"t15 {phase}")
+        assert tr.get("success"), tr.get("errors")
+    log(f"contract {contract_id} → building")
+    return project, contract_id
+
+
+def _seed_spec(store: Path, project: str) -> str:
+    """Govern the requirement as a contract on the project surface
+    (generic — request/scope come from parameters)."""
+    proj = sc.Scaffold(str(store / "projects" / project), project)
+    doc = proj.load()
+    if ss.entity(doc, SPEC_CONTRACT) is None:
+        ss.add_entity(doc, id=SPEC_CONTRACT, kind="contract",
+                      identities={"objective": REQUEST},
+                      evidence_refs=["t15-request"])
+        ss.add_entity(doc, id="capability:planned-" + project[:24],
+                      kind="capability", maturity="DECLARED",
+                      evidence_refs=["t15-request"])
+        ss.add_relationship(doc, type="implements",
+                            from_id="capability:planned-" + project[:24],
+                            to_id=SPEC_CONTRACT, evidence_refs=["t15-request"])
+        proj.commit(doc, what="seed requirement spec (user request)")
+    return SPEC_CONTRACT
+
+
+def run_build_via_events(project_dir: Path, operation_id: str,
+                         projection: dict, contract_id: str,
+                         interrupt_after_first_file: bool) -> dict:
+    """THE 15Q core: real builder under the event notifier; the driver
+    YIELDS on the bridge FIFO. No sleep. Watchdog = failure detector."""
+    ew.register_process_wait(
+        operation_id, contract_id=contract_id,
+        project="t15-fixture", objective=REQUEST,
+        watched_for="builder process exit event", watchdog_secs=900)
+    # op marker rides the prompt (last argv) so cmdline liveness can find
+    # the build even if node regroups its children (T15Q live finding)
+    builder_cmd = ["mimo", "run", "-m", BUILDER_MODEL, "--format", "json",
+                   t14.builder_prompt(projection, resumed=False)
+                   + f" [op:{operation_id}]"]
+    notifier = ew.run_builder_under_events(builder_cmd, operation_id,
+                                           daemon_url=DAEMON_URL)
+    log(f"builder launched (pgid {notifier.pid}); driver YIELDS on the "
+        f"event bridge — no polling")
+    if interrupt_after_first_file:
+        # kill at first source file: the interruption is real, the event
+        # never arrives (the notifier dies with the group) — the watchdog
+        # must classify PROCESS_LOST, never silently wait.
+        # TEST_TIMING: this 0.5s poll exists ONLY on the deliberate
+        # interrupt path (killing at a checkpoint), never on the normal
+        # continuation path.
+        while True:
+            files = [p for p in project_dir.iterdir()
+                     if p.suffix in (".mjs", ".js", ".json")]
+            if files:
+                break
+            time.sleep(0.5)
+        log("INTERRUPTING builder (first file landed) — SIGKILL group")
+        os.killpg(notifier.pid, signal.SIGKILL)
+    result = ew.await_resume_event(operation_id, watchdog_secs=900,
+                                   pgid=notifier.pid)
+    return result
+
+
+def finish_via_canaries(store: Path, project: str, contract_id: str,
+                        project_dir: Path, before: dict,
+                        resume_note: str) -> int:
+    """Reload canonical state → scope audit → INDEPENDENT verification
+    (15G test truth) → evidence-backed lifecycle."""
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL, project_store=str(store / "projects" / project),
+        project_id=project)
+    ctx = iface.construction_context(contract_id)
+    assert ctx["state"]["active"] or ctx["state"]["phase"] == "closed"
+    log(f"canonical state: phase={ctx['state']['phase']} "
+        f"scope={ctx['state']['scope']}")
+    # exit canary: scope audit with provenance-aware residue (15O)
+    audit = t14.audit_scope(project_dir, before, list(SCOPE))
+    # 15G: verification truth — node --test must actually run tests
+    # 15G test truth via the CONTRACT's verifier (parameterized — 15R
+    # generalisation: python unittest/pytest, node --test, etc.)
+    truth = subprocess.run(
+        ["bash", "-c", VERIFIER], cwd=str(project_dir),
+        capture_output=True, text=True, timeout=300)
+    import re
+    count = None
+    for pat in (r"# pass (\d+)",       # node --test TAP summary
+                r"(\d+) passed",        # pytest
+                r"Ran (\d+) tests"):    # python unittest
+        m = re.search(pat, (truth.stdout or "") + (truth.stderr or ""))
+        if m:
+            count = int(m.group(1))
+            break
+    test_count = count if count is not None else 0
+    log(f"verification: exit={truth.returncode} tests={test_count}")
+    if test_count == 0:
+        log("FALSE GREEN REFUSED: zero tests executed (15G)")
+        return 1
+    if audit["scope_violations"]:
+        log(f"closure REFUSED: scope violations {audit['scope_violations']}")
+        return 1
+    builder_status = "UNKNOWN"
+    result = t14.complete_lifecycle(iface, contract_id, audit,
+                                    {"cmd": "node --test",
+                                     "exit_code": truth.returncode},
+                                    builder_status)
+    summary = {
+        "event_driven": True,
+        "builder_model": BUILDER_MODEL,
+        "resume_note": resume_note,
+        "scope_audit": audit,
+        "verification": {"exit_code": truth.returncode,
+                         "test_count": test_count},
+        "lifecycle": result,
+    }
+    print(json.dumps(summary, indent=1))
+    return 0 if result.get("closed") else 1
+
+
+def discover(store: Path) -> tuple[str, str] | None:
+    """§15U: delegates to the canonical interface discovery (via the t14
+    shim — one hop, no duplication)."""
+    return t14.discover_contract_id(store)
+
+
+def cmd_start(store: Path, project_dir: Path, interrupt: bool) -> int:
+    ready = readiness_canary("node")
+    assert ready["verdict"] == "READY", f"readiness BLOCKED: {ready['checks']}"
+    log(f"readiness READY ({len(ready['checks'])} checks)")
+    before = t14.snapshot_files(project_dir)
+    project, contract_id = setup_construction(store, project_dir)
+    operation_id = f"t15-{contract_id}"
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL, project_store=str(store / "projects" / project),
+        project_id=project)
+    projection = t14.build_projection(iface, contract_id,
+                                      phase_note="initial build")
+    result = run_build_via_events(project_dir, operation_id, projection,
+                                  contract_id, interrupt)
+    if result["kind"] == "watchdog":
+        # §15E canonical-state-wins: process-table absence is NOT truth
+        # (detached builders re-parent their workers — T15Q live finding).
+        # The durable waitstore decides: a recorded verdict means the
+        # builder completed and the event WAS processed.
+        rec = ew.resume_or_recover(operation_id)
+        if rec["kind"] == "event":
+            log(f"watchdog fired but canonical state shows the build "
+                f"completed (verdict={rec['wait'].get('verdict')}) — "
+                f"continuing from authority")
+            return finish_via_canaries(store, project, contract_id,
+                                       project_dir, before,
+                                       "watchdog→canonical recovery")
+        log("PROCESS_LOST: no event, no durable verdict — fresh builder "
+            "resumes from authority only")
+        return 3
+    wait = result.get("wait", {})
+    log(f"event-driven resume: verdict={wait.get('verdict')} "
+        f"exit={wait.get('process_event_evidence', {}).get('exit_code')}")
+    return finish_via_canaries(store, project, contract_id, project_dir,
+                               before, "event-driven completion")
+
+
+def cmd_resume(store: Path, project_dir: Path) -> int:
+    found = discover(store)
+    assert found, "no contract in canonical state"
+    project, contract_id = found
+    log(f"FRESH builder resume: {project}/{contract_id} (canonical only)")
+    before = t14.snapshot_files(project_dir)
+    iface = ci.ConstructionInterface(
+        builder=BUILDER_MODEL + "-resumed",
+        project_store=str(store / "projects" / project),
+        project_id=project)
+    projection = t14.build_projection(
+        iface, contract_id, phase_note="resumed after real interruption")
+    operation_id = f"t15-resume-{contract_id}"
+    ew.register_process_wait(
+        operation_id, contract_id=contract_id, project=project,
+        objective=REQUEST, watched_for="builder exit event",
+        watchdog_secs=900)
+    builder_cmd = ["mimo", "run", "-m", BUILDER_MODEL, "--format", "json",
+                   t14.builder_prompt(projection, resumed=True)
+                   + f" [op:{operation_id}]"]
+    notifier = ew.run_builder_under_events(builder_cmd, operation_id,
+                                           daemon_url=DAEMON_URL)
+    log("driver YIELDS on the bridge — no polling")
+    result = ew.await_resume_event(operation_id, watchdog_secs=900,
+                                   pgid=notifier.pid)
+    if result["kind"] == "watchdog":
+        rec = ew.resume_or_recover(operation_id)
+        if rec["kind"] == "event":
+            log(f"watchdog fired but canonical state shows the resume "
+                f"build completed (verdict={rec['wait'].get('verdict')})")
+            return finish_via_canaries(store, project, contract_id,
+                                       project_dir, before,
+                                       "resume via canonical recovery")
+        log("PROCESS_LOST on resume — UNKNOWN_INTERRUPTION")
+        return 4
+    return finish_via_canaries(store, project, contract_id, project_dir,
+                               before, "fresh-builder event-driven resume")
+
+
+def cmd_finish(store: Path, project_dir: Path) -> int:
+    """Complete lifecycle from CANONICAL state only (waitstore verdict +
+    filesystem reality). Used after a watchdog→canonical recovery."""
+    found = discover(store)
+    assert found, "no contract in canonical state"
+    project, contract_id = found
+    before = t14.snapshot_files(project_dir)
+    return finish_via_canaries(store, project, contract_id, project_dir,
+                               before, "canonical-only completion")
+
+
+def cmd_status(store: Path) -> int:
+    found = discover(store)
+    if not found:
+        print(json.dumps({"active": False}))
+        return 0
+    project, contract_id = found
+    iface = ci.ConstructionInterface(
+        builder="inspector", project_store=str(store / "projects" / project),
+        project_id=project)
+    print(json.dumps(iface.construction_context(contract_id)["state"],
+                     indent=1, default=str))
+    return 0
+
+
+def main() -> int:
+    import argparse
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("mode", choices=["start", "resume", "finish",
+                                     "status"])
+    ap.add_argument("--store", required=True)
+    ap.add_argument("--project-dir", required=False)
+    ap.add_argument("--interrupt-after-first-file", action="store_true")
+    args = ap.parse_args()
+    store = Path(args.store).resolve()
+    project_dir = (Path(args.project_dir).resolve()
+                   if args.project_dir else None)
+    if project_dir:
+        project_dir.mkdir(parents=True, exist_ok=True)
+    if args.mode == "start":
+        return cmd_start(store, project_dir,
+                         args.interrupt_after_first_file)
+    if args.mode == "resume":
+        return cmd_resume(store, project_dir)
+    if args.mode == "finish":
+        return cmd_finish(store, project_dir)
+    return cmd_status(store)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/type_check_ratchet.py

@@ -6,6 +6,7 @@ New code must be type-clean; existing code improves as debt is paid down.
 """
 
 import json
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -23,12 +24,35 @@ def main() -> int:
     # not work on all platforms). Fall back to sys.executable -m.
     pyright_bin = Path(sys.executable).parent / "pyright"
     cmd = [str(pyright_bin)] if pyright_bin.is_file() else [sys.executable, "-m", "pyright"]
+    # §14H LOCAL-VS-CI NORMALIZATION (proven 2026-09-15): pyright resolves
+    # the python environment for import analysis, and a developer's
+    # user-site packages (~/.local/lib/pythonX/site-packages) leak into it
+    # — nick: 124 errors, runner user: 117 on the IDENTICAL checkout+venv.
+    # PYTHONNOUSERSITE=1 pins both contexts to the same effective
+    # environment (verified: identical 117-error arithmetic). Local
+    # preflight now predicts CI instead of diverging from it.
+    # §16U ROOT-CAUSE COMPLETION (T16): PYTHONNOUSERSITE alone is NOT
+    # sufficient when a DIFFERENT venv is active (e.g. an ad-hoc CI venv):
+    # the pyright wrapper resolves the ambient VIRTUAL_ENV/PATH
+    # interpreter and analyzes against ITS site-packages — reproduced
+    # live (117 vs 124 on the same tree, driven by venv-activation state
+    # alone). The CI runner resolves the AMBIENT python (no venv is
+    # activated in the type-check job), so the ratchet neutralizes every
+    # ambient-venv signal before invoking pyright — analysis context is
+    # now identical to CI regardless of the calling shell.
+    env = {k: v for k, v in os.environ.items()
+           if k not in ("VIRTUAL_ENV",)}
+    env["PYTHONNOUSERSITE"] = "1"
+    env["PATH"] = os.pathsep.join(
+        p for p in env.get("PATH", "").split(os.pathsep)
+        if "ci-venv" not in p and ".type-venv" not in p and "venv/bin" not in p)
     result = subprocess.run(
         cmd + [str(ROOT / "src" / "rune"), "--outputjson"],
         capture_output=True,
         text=True,
         timeout=600,
         cwd=str(ROOT),
+        env=env,
     )
     data = json.loads(result.stdout)
     summary = data.get("summary", {})

scripts/v1_parity_manifest.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+"""v1_parity_manifest.py — T21.5 §13: historical Scaffolding V1 parity.
+
+Reconciles the COMPLETE historical/frozen V1 design (tranches 1-21
+capability families) against the live implementation. Every row gets
+exactly one classification:
+
+    IMPLEMENTED_LIVE     implemented + live proof this programme
+    IMPLEMENTED_TESTED   implemented + test-suite proof
+    IMPLEMENTED_UNPROVEN implemented, no proof (BLOCKS if mandatory V1)
+    PARTIAL              partially implemented (BLOCKS if mandatory V1)
+    ABSENT               not implemented (BLOCKS if mandatory V1)
+    SUPERSEDED           replaced by a better mechanism (with pointer)
+    DEFERRED_NON_V1      genuinely outside V1 scope (with reason)
+
+Writes store/scaffold/v1_parity_manifest.json.
+"""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+
+# (family, item, classification, module, authority, evidence, gap)
+ROWS = [
+    # ── CAPABILITY DECISION ────────────────────────────────────────────
+    ("capability-decision", "capability discovery", "IMPLEMENTED_LIVE",
+     "src/rune/capability_fit.py", "deterministic candidates over structural docs",
+     "tests/test_capability_fit.py; T21.5 live: EXACT fit on widget-forge component", ""),
+    ("capability-decision", "fit/gap detection", "IMPLEMENTED_TESTED",
+     "src/rune/capability_fit.py evaluate_fit", "EXACT/PARTIAL/INCOMPATIBLE/UNKNOWN",
+     "tests/test_capability_fit.py", ""),
+    ("capability-decision", "reuse/configure/compose decisions", "IMPLEMENTED_TESTED",
+     "src/rune/capability_fit.py decide", "RESOLUTIONS set",
+     "tests/test_construction_decision.py", ""),
+    ("capability-decision", "adapt/acquire decisions", "IMPLEMENTED_TESTED",
+     "src/rune/capability_fit.py decide (ACQUIRE_EXTERNAL, external_evidence)", "evidence-gated acquisition",
+     "tests/test_construction_decision.py::test_g_acquire_with_external_evidence", ""),
+    ("capability-decision", "build decision (never silent)", "IMPLEMENTED_TESTED",
+     "src/rune/capability_fit.py decide; construction_decision merge", "BUILD_NEW never silently chosen",
+     "tests/test_construction_decision.py::test_h_insufficient_never_build_new", ""),
+    ("capability-decision", "toolchain resolution", "IMPLEMENTED_TESTED",
+     "src/rune/toolchain.py", "evidence-backed resolution + decision records",
+     "tests/test_toolchain*.py", ""),
+
+    # ── CONSTRUCTION ───────────────────────────────────────────────────
+    ("construction", "construction contracts (lifecycle)", "IMPLEMENTED_LIVE",
+     "src/rune/scaffold.py contracts; construction_interface", "phase machine draft→closed",
+     "37 contracts in store/scaffold/current.json; T21.4/T21.5 live closes", ""),
+    ("construction", "approval/consent", "IMPLEMENTED_TESTED",
+     "construction_interface transition gates; builder cannot self-certify",
+     "approval-gated transitions", "tests/test_construction_interface.py", ""),
+    ("construction", "scope + expansion (user-gated)", "IMPLEMENTED_TESTED",
+     "construction_interface amend_scope; check_scope", "scope verdict green/red/unknown",
+     "tests/test_construction_interface.py; T21.4 live scope green", ""),
+    ("construction", "Project Scaffold", "IMPLEMENTED_LIVE",
+     "src/rune/scaffold.py Scaffold", "per-project structural truth",
+     "T21.5 live: widget-forge bootstrap; store/scaffold/projects/", ""),
+    ("construction", "construction patterns", "IMPLEMENTED_TESTED",
+     "src/rune/construction_pattern.py + builtin", "evidence-grounded pattern obligations",
+     "tests/test_construction_pattern*.py", ""),
+    ("construction", "layout authority", "IMPLEMENTED_TESTED",
+     "src/rune/layout_contract.py", "persistent UI layout checks",
+     "tests/test_layout_contract.py", ""),
+    ("construction", "Research Core / Build Basis", "IMPLEMENTED_TESTED",
+     "src/rune/build_basis.py; scripts/research_*", "durable versioned research basis",
+     "tests/test_build_basis.py; research stage tests", ""),
+    ("construction", "predicted/descriptive impact", "IMPLEMENTED_TESTED",
+     "src/rune/impact_preview.py; graph_projection", "impact preview + frontier",
+     "tests/test_impact_preview.py; test_v1_workspace_forge.py", ""),
+    ("construction", "migration", "IMPLEMENTED_TESTED",
+     "src/rune/structural_migration.py", "consent-gated schema migration",
+     "tests/test_structural_migration.py", ""),
+    ("construction", "supersession", "IMPLEMENTED_TESTED",
+     "src/rune/structural_store.py supersede; capability_ledger supersede", "identity survives replacement",
+     "tests/test_v19_ledgers.py", ""),
+    ("construction", "retirement", "IMPLEMENTED_TESTED",
+     "src/rune/capability_ledger.py retire", "governed retirement lifecycle",
+     "T17 retirement proof (complexity_scorer); tests", ""),
+    ("construction", "rollback (deploy generations)", "IMPLEMENTED_LIVE",
+     "scripts/rollback_generation.py", "governed rollback_generation API",
+     "T21.4 live B->A->B + refusals; tests/test_rollback_generation.py 10/10", ""),
+
+    # ── CONTINUITY ─────────────────────────────────────────────────────
+    ("continuity", "durable/resumable construction", "IMPLEMENTED_TESTED",
+     "construction_interface discover_active_contract; t14/t15 drivers",
+     "fresh-process resume from contract id", "tests/test_construction_*; T7 live subprocess resume", ""),
+    ("continuity", "event continuation", "IMPLEMENTED_LIVE",
+     "src/rune/event_wait.py; scripts/ci_event_wait.py", "event=wake, authority=truth, single logical await",
+     "T21.5 live workflows + tests/test_single_logical_await.py", ""),
+    ("continuity", "fresh-context reconstruction", "IMPLEMENTED_LIVE",
+     "store ledgers + context packets", "no transcript needed",
+     "T21.4 fresh-worker challenge 6/6; T21.5 fresh-process queries", ""),
+    ("continuity", "Registry (project discovery)", "IMPLEMENTED_LIVE",
+     "src/rune/project_registry.py", "discovery/index authority",
+     "tests/test_resolve_cwd.py etc.; T21.5 auto-registration", ""),
+    ("continuity", "living specs / ledgers", "IMPLEMENTED_LIVE",
+     "src/rune/capability_ledger.py (attach_spec/revise_spec/drift)", "machinery-verified versions",
+     "T21.4/T21.5 live revise_spec flows; tests/test_living_specs.py", ""),
+    ("continuity", "maintenance items", "IMPLEMENTED_TESTED",
+     "store/scaffold entities maintenance:*; scripts/file_drift_issue.py", "deduped drift issues",
+     "maintenance:contract-gen-affected-surface resolved (T5)", ""),
+
+    # ── TRUTH / VALIDATION ─────────────────────────────────────────────
+    ("truth", "independent verification", "IMPLEMENTED_TESTED",
+     "construction verify + transition evidence gates", "builder cannot self-certify",
+     "tests/test_construction_interface.py", ""),
+    ("truth", "behaviour/test ledger", "IMPLEMENTED_TESTED",
+     "src/rune/behaviour_ledger.py", "canonical behaviour specs",
+     "tests/test_v19_ledgers.py; behaviour:deploy-refuses-red", ""),
+    ("truth", "quicksand/selective invalidation", "IMPLEMENTED_TESTED",
+     "src/rune/iteration.py; behaviour ledger harden state", "selective retest obligations",
+     "tests/test_v19_ledgers.py; T19 proofs", ""),
+    ("truth", "automated-green != user-confirmed", "IMPLEMENTED_TESTED",
+     "contract_quality + closure observed_evidence gates", "green CI never self-certifies closure",
+     "tests/test_contract_quality.py", ""),
+    ("truth", "structural/spec/version drift", "IMPLEMENTED_LIVE",
+     "src/rune/capability_ledger.py spec_drift_status", "deterministic revision-based drift",
+     "T21.4 live drift->revise cycle; tests/test_spec_drift_deterministic.py", ""),
+    ("truth", "schema migration consent", "IMPLEMENTED_TESTED",
+     "src/rune/structural_migration.py; project_registry.needs_migration", "18I consent sweep",
+     "tests/test_structural_migration.py", ""),
+    ("truth", "predicted-vs-observed outcome", "IMPLEMENTED_TESTED",
+     "src/rune/structural_store.py predicted_vs_observed", "recorded mismatch as evidence",
+     "tests + T21.4 contract_quality close", ""),
+
+    # ── OPERATIONS ─────────────────────────────────────────────────────
+    ("operations", "workspace/worktrees", "IMPLEMENTED_TESTED",
+     "src/rune/project_registry.py active_worktree precedence", "worktree > repo",
+     "tests/test_resolve_cwd.py; T21.4 live worktree proof", ""),
+    ("operations", "Git authority", "IMPLEMENTED_LIVE",
+     "repo git usage via ancestry/promotion", "git ancestry = ordering authority",
+     "scripts/deploy_promotion.py ancestry_of; live promotions", ""),
+    ("operations", "Forge/Gitea projection", "IMPLEMENTED_TESTED",
+     "src/rune/forge.py; forge_client.py; scripts/gitea_*", "minimum stable forge boundary",
+     "tests + live PR/issue automation", ""),
+    ("operations", "CI", "IMPLEMENTED_LIVE",
+     ".gitea/workflows/ci.yml; scripts/ci_event_wait.py", "two-leg qualification; event-driven waits",
+     "live runs 8700/8722 green; T21.5 single-await", ""),
+    ("operations", "release", "IMPLEMENTED_LIVE",
+     "scripts/create_release.py; semver_bump.py; auto_bump_pr.py", "protected-branch bump flow",
+     "releases v0.82.0-0.82.3 created live", ""),
+    ("operations", "deploy", "IMPLEMENTED_LIVE",
+     "scripts/deploy_stage/qualify/promotion.py", "monotonic fail-closed promotion",
+     "live deploys 40b3731..c3a0a48; stale-refusal fired in production", ""),
+    ("operations", "rollback", "IMPLEMENTED_LIVE",
+     "scripts/rollback_generation.py", "governed regression API",
+     "T21.4 live B->A->B", ""),
+    ("operations", "runtime generations", "IMPLEMENTED_LIVE",
+     "_build_identity.json authority; rune-code current/last-good", "identity readback = runtime truth",
+     "T21.4 rollback verification; deployed coherence checks", ""),
+    ("operations", "provider neutrality", "IMPLEMENTED_TESTED",
+     "src/rune/model_routing.py; provider_registry.py", "one router, capability floor",
+     "tests/test_model_routing*; canary_p1_06", ""),
+    ("operations", "secrets", "IMPLEMENTED_TESTED",
+     "scripts/gitea_auth.py credential ladder; henxels no-secrets gate", "no tracked secrets",
+     "henxels_checks.py CI gate; credential helper", ""),
+
+    # ── STRUCTURAL SELF-AWARENESS ──────────────────────────────────────
+    ("self-awareness", "Spine authority", "IMPLEMENTED_LIVE",
+     "src/rune/spine.py", "Rune structural self-model",
+     "store/spine/current.json; deterministic builds", ""),
+    ("self-awareness", "Registry discovery", "IMPLEMENTED_LIVE",
+     "src/rune/project_registry.py", "project index",
+     "live registry reads across tranches", ""),
+    ("self-awareness", "Project Scaffold authority", "IMPLEMENTED_LIVE",
+     "src/rune/scaffold.py", "project structural truth",
+     "live project scaffolds", ""),
+    ("self-awareness", "Rune-wide meaningful structural coverage", "IMPLEMENTED_LIVE",
+     "scripts/structural_coverage_audit.py", "A/B/C/D/E classification",
+     "T21.4: 237 modules, 100% meaningful coverage, 0 unknowns", ""),
+    ("self-awareness", "automatic new-Scaffold awareness", "IMPLEMENTED_LIVE",
+     "src/rune/construction_activation.py _auto_structural_awareness", "bootstrap auto-registers",
+     "T21.5 live + tests/test_t215_awareness.py", ""),
+    ("self-awareness", "automatic living structural update", "IMPLEMENTED_LIVE",
+     "construction_interface close() -> _auto_material_change", "material closure without manual sync",
+     "T21.4/T21.5 live; tests/test_t214_material_closure.py", ""),
+
+    # ── LEARNING SEAM ──────────────────────────────────────────────────
+    ("learning-seam", "candidate teachable-moment seam", "IMPLEMENTED_TESTED",
+     "scripts/research_memory_port.py mark_teachable_moment_candidate", "CANDIDATE evidence via existing channels",
+     "tests/test_memory_port.py", ""),
+    ("learning-seam", "Memory internal-experience port in INWARD", "IMPLEMENTED_TESTED",
+     "scripts/research_memory_port.py; research_inward_context.build_context", "one bounded port of call",
+     "tests/test_memory_port.py", ""),
+    ("learning-seam", "APPLICABILITY governs transfer", "IMPLEMENTED_TESTED",
+     "research_memory_port.applicability_filter + existing APPLICABILITY stage", "irrelevant candidates rejected",
+     "tests/test_memory_port.py::test_applicability_rejects_irrelevant_candidate", ""),
+    ("learning-seam", "zero-result fast path", "IMPLEMENTED_TESTED",
+     "research_memory_port.memory_port_of_call", "[] -> next normal step",
+     "tests/test_memory_port.py; ZERO_RESULT_EXTRA_MODEL_CALLS=0", ""),
+    ("learning-seam", "no competing memory authority", "IMPLEMENTED_TESTED",
+     "port design (provider delegation, no storage)", "Memory stays single future authority",
+     "port creates no store/db; provider contract only", ""),
+
+    # ── DEFERRED (non-V1, with reasons) ────────────────────────────────
+    ("deferred", "automatic Growth Delta pattern learning", "DEFERRED_NON_V1",
+     "src/rune/growth_delta.py (existing, non-V1 scope)", "post-V1 learning loop",
+     "V1 excludes Memory/Substrate/Growth Delta by tranche mandate; the "
+     "T21.5 seam provides the harvest point without implementing the loop", ""),
+    ("deferred", "Memory V1 system itself", "DEFERRED_NON_V1",
+     "(future Memory T0 archaeology)", "dedicated post-V1 phase",
+     "explicitly excluded by T21.5 mandate §0; only the INWARD port is V1", ""),
+    ("deferred", "Substrate", "DEFERRED_NON_V1",
+     "(future)", "post-V1", "explicitly excluded by tranche mandate", ""),
+    ("deferred", "TUI redesign", "DEFERRED_NON_V1",
+     "(existing rune_tui.py adequate)", "explicitly excluded by tranche mandate",
+     "TUI work explicitly out of scope for V1 Scaffolding", ""),
+]
+
+
+def main() -> int:
+    manifest = {
+        "tranche": "T21.5",
+        "rows": [
+            {"family": f, "item": i, "classification": c, "module": m,
+             "authority": a, "evidence": e, "gap": g}
+            for f, i, c, m, a, e, g in ROWS
+        ],
+    }
+    blocking = [r for r in manifest["rows"]
+                if r["classification"] in ("PARTIAL", "ABSENT",
+                                           "IMPLEMENTED_UNPROVEN")]
+    counts: dict[str, int] = {}
+    for r in manifest["rows"]:
+        counts[r["classification"]] = counts.get(r["classification"], 0) + 1
+    manifest["counts"] = counts
+    manifest["blocking_items"] = blocking
+    out = ROOT / "store" / "scaffold" / "v1_parity_manifest.json"
+    out.write_text(json.dumps(manifest, indent=1))
+    print(json.dumps(counts, indent=1))
+    print("blocking mandatory-V1 items:", len(blocking))
+    for b in blocking:
+        print("  BLOCKS:", b["family"], "/", b["item"])
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/wr_root_reconcile.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""wr_root_reconcile.py — T21.5 §7: governed split-brain reconciliation.
+
+If canonical and legacy W/R roots both hold live event stores, this
+moves legacy-root events that are ABSENT from the canonical store into
+it (idempotent, content-keyed by filename), then reports what remains.
+Never deletes; the legacy store stays as a moved-marker record.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import sys
+from pathlib import Path
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(_SCRIPT_DIR))
+import wr_root_resolver as resolver  # noqa: E402
+
+
+def main() -> int:
+    canonical = resolver.CANONICAL_WR_ROOT
+    legacy = resolver.LEGACY_WR_ROOT
+    (canonical / "events").mkdir(parents=True, exist_ok=True)
+    moved = 0
+    skipped = 0
+    for src in sorted((legacy / "events").glob("*.json")):
+        dst = canonical / "events" / src.name
+        if dst.exists():
+            skipped += 1
+            continue
+        shutil.copy2(src, dst)
+        moved += 1
+    report = {
+        "canonical": str(canonical),
+        "legacy": str(legacy),
+        "events_moved_to_canonical": moved,
+        "already_present_skipped": skipped,
+        "note": "legacy store retained (never deleted); daemon and all "
+                "consumers now resolve via wr_root_resolver",
+    }
+    print(json.dumps(report, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/wr_root_resolver.py

@@ -0,0 +1,100 @@
+"""wr_root_resolver.py — T21.5 §7: THE ONE wait/resume root authority.
+
+T21.4 live finding: the daemon defaulted WR_ROOT to its own install dir
+while production data lived at /mnt/workdrive/wr-bridge; a restart
+without WR_ROOT exported silently opened a second event store and the
+controller saw no events (the split-brain that forced manual event
+relocation). This module is the SINGLE resolver every consumer shares:
+
+  daemon / event_wait / await_operation tool / notify_event_bridge
+  (CI event writer) / local event writers / CLI / launcher / tests.
+
+Resolution order:
+  1. RUNE_WR_ROOT env (explicit override; tests use it)
+  2. canonical production root (exists?)
+  3. legacy home install root (exists?)
+  4. canonical production root (created on demand — first-run path)
+
+Split-brain policy: if BOTH canonical and legacy roots contain live
+event stores, resolution FAILS LOUDLY unless the env pins one — never
+silently operate two stores. Reconciliation is governed, not silent:
+run scripts/wr_root_reconcile.py.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+
+CANONICAL_WR_ROOT = Path("/mnt/workdrive/wr-bridge")
+LEGACY_WR_ROOT = Path.home() / ".local" / "share" / "mimo-wait-resume"
+ENV_VAR = "RUNE_WR_ROOT"
+
+SPLIT_BRAIN_ERROR = (
+    "WR ROOT SPLIT-BRAIN: both canonical ({canonical}) and legacy "
+    "({legacy}) contain live event stores. Never operate two stores "
+    "silently — pin {env}=<root> explicitly, or reconcile with "
+    "scripts/wr_root_reconcile.py."
+)
+
+
+def _has_live_store(root: Path) -> bool:
+    """A root counts as 'live' when its event store exists and holds
+    events (an empty dir is just an uninitialized install)."""
+    events = root / "events"
+    if not events.is_dir():
+        return False
+    return any(events.glob("*.json"))
+
+
+def resolve_root(*, require_single: bool = True) -> Path:
+    """Resolve THE wait/resume data root. Raises on split-brain when
+    require_single (default) and no explicit pin exists."""
+    env = os.environ.get(ENV_VAR)
+    if env:
+        return Path(env)
+    canonical_live = _has_live_store(CANONICAL_WR_ROOT)
+    legacy_live = _has_live_store(LEGACY_WR_ROOT)
+    if canonical_live and legacy_live and require_single:
+        raise RuntimeError(SPLIT_BRAIN_ERROR.format(
+            canonical=CANONICAL_WR_ROOT, legacy=LEGACY_WR_ROOT,
+            env=ENV_VAR))
+    if canonical_live or CANONICAL_WR_ROOT.is_dir():
+        return CANONICAL_WR_ROOT
+    if legacy_live or LEGACY_WR_ROOT.is_dir():
+        return LEGACY_WR_ROOT
+    return CANONICAL_WR_ROOT  # first-run: create canonical
+
+
+def daemon_launch_env() -> dict[str, str]:
+    """The env a launcher must pass the daemon: WR_ROOT resolved ONCE
+    from this authority (the daemon itself must not guess)."""
+    return {"WR_ROOT": str(resolve_root()),
+            ENV_VAR: str(resolve_root())}
+
+
+def split_brain_roots() -> list[Path]:
+    """Diagnostic: roots that currently hold live stores."""
+    return [r for r in (CANONICAL_WR_ROOT, LEGACY_WR_ROOT)
+            if _has_live_store(r)]
+
+
+def main() -> int:
+    try:
+        root = resolve_root()
+    except RuntimeError as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+    print(json.dumps({
+        "resolved_root": str(root),
+        "canonical": str(CANONICAL_WR_ROOT),
+        "legacy": str(LEGACY_WR_ROOT),
+        "split_brain_roots": [str(p) for p in split_brain_roots()],
+        "env_pinned": bool(os.environ.get(ENV_VAR)),
+    }))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

shared/custodian.py

@@ -33,7 +33,7 @@ SCRIPTS_DIR = os.path.expanduser("~/.config/opencode/scripts")
 SHARED_DIR = os.path.expanduser("~/.config/opencode/shared")
 CUSTODIAN_STATE_FILE = os.path.expanduser("~/.config/opencode/memory/custodian_state.json")
 
-GITEA_URL = os.environ.get("GITEA_URL", "https://gitea.thingscouldgetdicey.online")
+GITEA_URL = os.environ.get("GITEA_URL", "http://127.0.0.1:3000")  # gitea.internal (PC); external = https://gitea.thingscouldgetdicey.online via Pi Caddy
 GITEA_TOKEN = load_gitea_token()
 REPO = "conductor/rune"
 TUI_DIR = "/mnt/workdrive/rune"
@@ -54,6 +54,15 @@ UMBRELLA_TAGS = {
 }
 
 
+# Issue template directory — canonical copies live beside this script
+# (mirrored to .gitea/ISSUE_TEMPLATE/ for the web-UI submission path).
+ISSUE_TEMPLATE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "issue_templates")
+
+# kind -> Gitea label that MUST be present on the issue
+KIND_LABEL = {"feature": "feature", "bug": "bug", "research": "research"}
+VERSION_INTENTS = ("major", "minor", "patch", "none")
+
+
 class Custodian:
     """The Custodian agent for Gitea-based self-improvement."""
 
@@ -105,23 +114,90 @@ class Custodian:
         except Exception as e:
             return {"error": str(e)[:200]}
 
-    def create_issue(self, title: str, body: str, labels: List[str] = None) -> dict:
-        """Create a Gitea issue with plain-language description.
+    def _ensure_label(self, name: str, description: str = "", color: str = "#6f42c1") -> bool:
+        """Make sure a label exists on the repo; return its id or None."""
+        labels = self._gitea_api("labels")
+        if isinstance(labels, list):
+            for l in labels:
+                if l["name"] == name:
+                    return l["id"]
+        data = {"name": name, "description": description or name, "color": color}
+        created = self._gitea_api("labels", method="POST", data=data)
+        return created.get("id") if isinstance(created, dict) else None
 
-        Labels should be umbrella names (memory, governance, etc).
-        They get converted to IDs automatically.
+    def _load_issue_template(self, kind: str) -> str:
+        """Load the canonical issue template for a kind, WITHOUT the web-UI
+        frontmatter (name/about/title/labels — that metadata belongs to the
+        submission form, not the issue body). Empty string if absent."""
+        path = os.path.join(ISSUE_TEMPLATE_DIR, f"{kind}.md")
+        try:
+            with open(path) as f:
+                text = f.read()
+        except FileNotFoundError:
+            return ""
+        if text.startswith("---"):
+            end = text.find("\n---", 3)
+            if end != -1:
+                text = text[end + 4:]
+        return text.lstrip("\n")
+
+    def create_issue(
+        self,
+        title: str,
+        body: str,
+        labels: List[str] = None,
+        kind: str = "feature",
+        version_intent: Optional[str] = None,
+    ) -> dict:
+        """Create a Gitea issue assembled from the canonical template.
+
+        kind: feature | bug | research — selects the template and forces the
+              matching label (the research label is auto-created if missing).
+        version_intent: major | minor | patch | none — pre-ticks the matching
+              box in the template's Version impact section. The pipeline
+              verifies the real bump at merge and flags mismatches.
+        labels: umbrella names (memory, governance, ...); converted to IDs.
+
+        The caller's body replaces the SUBMITTED_BODY marker inside the
+        template's Plain English section — plain terms first, always.
+
+        ORGANISATION STANDARD (one open note per idea, 2026-09-19): before
+        minting a standalone issue, check whether the work belongs inside an
+        existing parent. Ideas parked under a blocked/future epic are filed
+        as checklist items in the parent's "Absorbed children" section, NOT
+        as standalone issues — the board stays uncluttered and every idea
+        has exactly one home. Mint a standalone issue only when the work is
+        live, dependency-tracked, or about to start. Absorbed ideas are
+        reversible: re-mint standalone when they become live.
         """
-        # Convert label names to IDs
+        # 1. assemble body from template (graceful: unformatted if template missing)
+        template = self._load_issue_template(kind)
+        text = body.strip()
+        if template and "<!-- SUBMITTED_BODY -->" in template:
+            text = template.replace("<!-- SUBMITTED_BODY -->", text, 1)
+        if version_intent in VERSION_INTENTS:
+            text = text.replace(f"- [ ] {version_intent} ", f"- [x] {version_intent} ", 1)
+
+        # 2. labels: umbrella names + mandatory kind label
+        labels = list(labels or [])
+        kind_label = KIND_LABEL.get(kind)
+        if kind_label and kind_label not in labels:
+            labels.append(kind_label)
+
+        all_labels = self._gitea_api("labels")
+        label_map = {l["name"]: l["id"] for l in all_labels} if isinstance(all_labels, list) else {}
         label_ids = []
-        if labels:
-            all_labels = self._gitea_api("labels")
-            if isinstance(all_labels, list):
-                label_map = {l["name"]: l["id"] for l in all_labels}
-                label_ids = [label_map[l] for l in labels if l in label_map]
+        for l in labels:
+            if l in label_map:
+                label_ids.append(label_map[l])
+            else:
+                lid = self._ensure_label(l)
+                if lid:
+                    label_ids.append(lid)
 
         data = {
             "title": title,
-            "body": body,
+            "body": text,
             "labels": label_ids,
         }
         result = self._gitea_api("issues", method="POST", data=data)

shared/drift_core.py

@@ -352,16 +352,6 @@ def pre_commit_gate_entry(entry: dict) -> dict:
         "critics": critics,
         "reason": "all critics passed" if all_pass else "one or more critics failed"
     }
-    row = db.execute(
-        "SELECT id, text, importance, wash_count, rock_status, topic FROM entries WHERE id = ?",
-        (entry_id,)
-    ).fetchone()
-
-    if not row:
-        return {"verdict": "REJECT", "reason": "entry not found"}
-
-    entry = dict(row)
-    critics = {}
 
     # Critic 1: Structural validity
     text = entry.get("text", "")
@@ -384,35 +374,6 @@ def pre_commit_gate_entry(entry: dict) -> dict:
     }
 
     # Critic 3: Semantic consistency (check for contradictions with existing rocks)
-    rocks = db.execute(
-        "SELECT text FROM entries WHERE rock_status = 'rock' AND status = 'active' LIMIT 50"
-    ).fetchall()
-    contradiction_found = False
-    for rock in rocks:
-        rock_text = rock[0].lower()
-        entry_text = text.lower()
-        # Simple contradiction detection: if entry says opposite of a rock
-        if ("always" in rock_text and "never" in entry_text) or \
-           ("never" in rock_text and "always" in entry_text):
-            contradiction_found = True
-            break
-    critics["semantic"] = {
-        "pass": not contradiction_found,
-        "reason": "contradicts existing rock" if contradiction_found else "consistent"
-    }
-
-    # Overall verdict
-    all_pass = all(c["pass"] for c in critics.values())
-    verdict = "PASS" if all_pass else "REJECT"
-
-    return {
-        "verdict": verdict,
-        "entry_id": entry_id,
-        "critics": critics,
-        "reason": "all critics passed" if all_pass else "one or more critics failed"
-    }
-
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # CLI
 # ═══════════════════════════════════════════════════════════════════════════════

shared/issue_templates/bug.md

@@ -0,0 +1,91 @@
+---
+name: Bug Fix
+about: Demonstrate currently incorrect behaviour — plain English first, proof required
+title: "[BUG] "
+labels: bug
+assignees: conductor
+---
+
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
+
+
+What is broken: <what a person observes going wrong>
+
+What should happen instead: <the correct behaviour>
+
+How often / when: <always | after X | since change Y>
+
+## Proof it is broken (required — no proof, no bug)
+<!-- A bug is DEMONSTRATED currently incorrect behaviour. Nothing else.
+     If this section cannot be filled, file it as a question, not a bug. -->
+- [ ] Reproduction command or steps (deterministic where possible)
+- [ ] The exact wrong output observed: <paste/log excerpt>
+- [ ] Where the evidence lives: <log path, fixture, session id>
+
+## Steps to reproduce
+<!-- How to trigger the bug -->
+
+## What would let us close this
+- [ ] The reproduction command now shows correct behaviour
+- [ ] A regression test exists that fails before the fix and passes after
+- [ ] No other behaviour changed (or changes are listed and justified)
+
+## Version impact (declared at submission — verified at merge)
+<!-- A bug fix is USUALLY a patch. Pick major or minor only with a reason. -->
+- [ ] patch — same behaviour, done correctly (usual for bugs)
+- [ ] major — the bug was in a published contract and fixing it breaks consumers (justify)
+- [ ] minor — fixing revealed a missing capability that had to be added (justify)
+
+## Technical details
+<!-- WHAT (the bug) / WHERE (files) / EVIDENCE (how it was confirmed). -->
+
+**WHAT (bug):**
+**WHERE:**
+**EVIDENCE:**
+
+## Pipeline requirements
+<!-- Every fix must clear these before the issue closes. -->
+- [ ] TDD: regression test written first, red → green
+- [ ] `ruff check` and `ruff format --check` clean
+- [ ] Spec-compliance review gate: PASS
+- [ ] Code-quality review gate: Approved
+- [ ] Full orchestration suite regression green (suite total)
+- [ ] Canary passes (name)
+- [ ] Closed with a properly formatted closing comment + commit references
+
+## Cognitive invariants (memory/cognition issues — both handoffs)
+<!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
+- [ ] **Trigger** — what event activates it
+- [ ] **Read/write authority** — which canonical state it reads/changes
+- [ ] **Provenance** — derived state traceable to evidence
+- [ ] **Verification** — how we know the change helped
+- [ ] **Failure visibility** — how failure surfaces
+- [ ] **Reversibility** — bad learned state can be superseded/replayed/rolled back
+- [ ] **Dormant cost** — what it costs when irrelevant
+- [ ] **Benchmark + ablation** — what measurable behaviour improves; what happens when disabled
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · epistemic confidence ≠ attentional utility ≠ current applicability · retrieval never increases utility · self-model-induced behaviour is not independent evidence · historical truth survives present-state change · raw evidence is never destroyed by promotion.
+
+## Related umbrella
+- [ ] Memory
+- [ ] Governance
+- [ ] Identity
+- [ ] Growth
+- [ ] Perception
+- [ ] Infrastructure
+- [ ] Orchestration
+
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
+- [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
+- [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

shared/issue_templates/feature.md

@@ -0,0 +1,97 @@
+---
+name: Feature Request
+about: New feature or improvement — plain English first, verifiable close conditions, version intent
+title: "[FEATURE] "
+labels: feature
+assignees: conductor
+---
+
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. A non-technical reader must be able to retell this
+     section. 3-6 sentences, no jargon. -->
+<!-- SUBMITTED_BODY -->
+
+
+What is this about: <what>
+
+Why do we need it: <the itch — what happens today that shouldn't, or what becomes possible>
+
+Why is it still open: <"not started yet" | "part done, X remains" | "deliberately parked as a future idea">
+
+## Example
+<!-- A concrete before/after in plain terms: "If X happens, the system will Y instead of Z." -->
+
+## What would let us close this
+<!-- Checkable statements, verifiable by looking at something that EXISTS —
+     a file, a log line, a passing test. Not "when appropriate". -->
+- [ ] <condition 1 — observable>
+- [ ] <condition 2>
+
+## Version impact (declared at submission — verified at merge)
+<!-- The pipeline derives the real bump from merged conventional commits and
+     compares against this declaration. A mismatch is flagged, not fatal:
+     either the declaration was wrong or the work grew. Both facts matter. -->
+- [ ] major — breaking: changes a contract, schema, or interface others depend on
+- [ ] minor — new capability: something becomes possible that wasn't
+- [ ] patch — repair: same behaviour, done correctly
+- [ ] none — touches no released artifact (docs, memory, process notes)
+
+## Technical details
+<!-- WHAT — one-line objective.
+WHY — design-spec reference (S#) or reason.
+FILES — affected components.
+ACCEPTANCE — frozen-test file + test count + canary name.
+DEPENDENCIES — parent epic + preceding stage/plan refs. -->
+
+**WHAT:**
+**WHY:**
+**FILES:**
+**ACCEPTANCE:**
+**DEPENDENCIES:**
+
+## Pipeline requirements
+<!-- Every stage must clear these before the issue closes. -->
+- [ ] TDD: frozen tests written first, red → green (N passed)
+- [ ] `ruff check` and `ruff format --check` clean
+- [ ] Spec-compliance review gate: PASS
+- [ ] Code-quality review gate: Approved
+- [ ] Full orchestration suite regression green (suite total)
+- [ ] Canary passes (name)
+- [ ] Closed with a properly formatted closing comment + commit/PR references
+
+## Cognitive invariants (memory/cognition issues — both handoffs)
+<!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
+- [ ] **Trigger** — what event activates it
+- [ ] **Read/write authority** — which canonical state it reads/changes
+- [ ] **Provenance** — derived state traceable to evidence
+- [ ] **Verification** — how we know the change helped
+- [ ] **Failure visibility** — how failure surfaces
+- [ ] **Reversibility** — bad learned state can be superseded/replayed/rolled back
+- [ ] **Dormant cost** — what it costs when irrelevant
+- [ ] **Benchmark + ablation** — what measurable behaviour improves; what happens when disabled
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · epistemic confidence ≠ attentional utility ≠ current applicability · retrieval never increases utility · self-model-induced behaviour is not independent evidence · historical truth survives present-state change · raw evidence is never destroyed by promotion.
+
+## Related umbrella
+- [ ] Memory
+- [ ] Governance
+- [ ] Identity
+- [ ] Growth
+- [ ] Perception
+- [ ] Infrastructure
+- [ ] Life (Nick's)
+- [ ] Custodian
+- [ ] Orchestration
+
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
+- [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
+- [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

shared/issue_templates/research.md

@@ -0,0 +1,76 @@
+---
+name: Research Submission
+about: Buy down uncertainty before building — question, falsifier, budget, durable findings
+title: "[RESEARCH] "
+labels: research
+assignees: conductor
+---
+
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
+
+
+The question: <what we're trying to learn, one sentence>
+
+Why we're asking: <what decision this research will inform — a name, an issue
+number, or "exploratory: none yet">
+
+What we believe today: <the current assumption, stated so it can be proven wrong>
+
+## The shape of an answer
+- [ ] What evidence would settle the question: <observation, benchmark, or spike>
+- [ ] What evidence would KILL the current assumption (the falsifier): <be specific —
+      this is stated BEFORE starting so the research cannot become a search for confirmation>
+- [ ] Budget: <time/effort cap — when research must stop and report back>
+
+## What would let us close this
+- [ ] Findings written to a durable document: <path, e.g. research/issue-NNN/> —
+      a comment thread is not a durable finding
+- [ ] The decision the research informs is recorded: made / deferred / changed
+- [ ] If a follow-up build issue was minted: <#N or "none needed">
+
+## Version impact (declared at submission — verified at merge)
+- [ ] none — research changes no released artifact (usual)
+- [ ] minor/major — only if a code spike is being merged as part of this (justify)
+
+## Technical detail
+<!-- Candidate approaches, prior art in the repo, related issues, constraints,
+     rebuildable-projection or authority requirements if findings touch canonical state. -->
+
+## Pipeline requirements
+- [ ] Findings committed under the stated durable path
+- [ ] Every citation verified against a real source (no fabricated references)
+- [ ] Closed with a properly formatted closing comment: findings summary + decision
+
+## Cognitive invariants (memory/cognition research — both handoffs)
+<!-- Complete ONLY if findings touch memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before proposing modules)
+- [ ] **Read/write authority** — which canonical state is affected
+- [ ] **Provenance** — findings traceable to evidence
+- [ ] **Reversibility** — projections remain rebuildable; no unique truth moves into a derived index
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · retrieval never increases utility · raw evidence is never destroyed by promotion.
+
+## Related umbrella
+- [ ] Memory
+- [ ] Governance
+- [ ] Identity
+- [ ] Growth
+- [ ] Perception
+- [ ] Infrastructure
+- [ ] Life (Nick's)
+- [ ] Custodian
+- [ ] Orchestration
+
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — blocks a decision that blocks other work
+- [ ] **P1 — high** — informs a next-stage dependency
+- [ ] **P2 — medium** — quality/consolidation understanding
+- [ ] **P3 — low** — watchlist / deferred / exploratory

shared/native_units.py

@@ -0,0 +1,216 @@
+"""Thin adapter for native (compiled) units — R1 §5 interop contract, Wave 0.
+
+The contract under proof: compiled units are standalone binaries exposing a
+CLI boundary — argv in, JSON on stdout, non-zero exit on failure, a mandatory
+``--version`` flag. This module is the Python side: run a unit, enforce a
+timeout, capture stderr, and return a TYPED result. It never raises for unit
+failures (those are data in the result); it raises only for adapter misuse
+(missing binary, bad timeout).
+
+No IPC daemon, no PyO3 — the file-based store stays the shared truth. If
+research later surfaces a materially better pattern it competes through the
+research pipeline; the CLI boundary is the default, not a cage.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import threading
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+PROOF_UNIT = REPO_ROOT / "interop" / "rebase-proof" / "target" / "release" / "rebase-proof"
+
+
+@dataclass
+class NativeResult:
+    """Typed result of one native-unit invocation.
+
+    ok           — the invocation succeeded (exit 0 AND not timed out); when
+                    the unit emitted JSON with an ``ok`` field, that field must
+                    not be False (plain-text output like ``--version`` has none)
+    exit_code    — raw process exit code
+    data         — parsed JSON object from stdout, or None if unparseable
+    stderr       — captured stderr text (may be non-empty even on success)
+    duration_ms  — wall-clock cost of the invocation
+    timed_out    — True when the unit exceeded the timeout and was killed
+    events       — in streaming mode: every parsed JSON object line, in
+                    arrival order (empty for non-streaming :func:`run_native`)
+    """
+
+    ok: bool
+    exit_code: int
+    data: dict | None
+    stderr: str
+    duration_ms: int
+    timed_out: bool = False
+    raw_stdout: str = field(default="", repr=False)
+    events: list[dict] = field(default_factory=list)
+
+
+def run_native(binary: Path, args: list[str], timeout_s: float = 10.0) -> NativeResult:
+    """Invoke a native unit and return a typed result.
+
+    Raises FileNotFoundError only when *binary* itself is absent (adapter
+    misuse) — every unit-level failure is reported via the result, never an
+    exception, so callers can branch on ``result.ok`` without try/except.
+    """
+    if not binary.is_file():
+        raise FileNotFoundError(f"native unit not built: {binary}")
+
+    started = time.monotonic()
+    timed_out = False
+    try:
+        proc = subprocess.run(
+            [str(binary), *args],
+            capture_output=True,
+            text=True,
+            timeout=timeout_s,
+            check=False,  # exit codes are data, never exceptions
+        )
+        exit_code, stdout, stderr = proc.returncode, proc.stdout, proc.stderr
+    except subprocess.TimeoutExpired as exc:
+        timed_out = True
+        exit_code = -1
+        stdout = exc.stdout or "" if isinstance(exc.stdout, str) else (exc.stdout or b"").decode(errors="replace")
+        stderr = exc.stderr or "" if isinstance(exc.stderr, str) else (exc.stderr or b"").decode(errors="replace")
+
+    duration_ms = int((time.monotonic() - started) * 1000)
+
+    data: dict | None = None
+    stripped = stdout.strip()
+    if stripped:
+        try:
+            parsed = json.loads(stripped.splitlines()[-1])
+            if isinstance(parsed, dict):
+                data = parsed
+        except json.JSONDecodeError:
+            data = None
+
+    ok = (not timed_out) and exit_code == 0 and (data is None or data.get("ok") is not False)
+    return NativeResult(
+        ok=ok,
+        exit_code=exit_code,
+        data=data,
+        stderr=stderr,
+        duration_ms=duration_ms,
+        timed_out=timed_out,
+        raw_stdout=stdout,
+    )
+
+
+def run_proof(args: list[str], timeout_s: float = 10.0) -> NativeResult:
+    """Run the Wave 0 proof unit with the standard contract defaults."""
+    return run_native(PROOF_UNIT, args, timeout_s=timeout_s)
+
+
+def stream_native(
+    binary: Path,
+    args: list[str],
+    timeout_s: float = 10.0,
+    on_event=None,
+):
+    """Run a native unit in JSONL streaming mode, yielding events as they arrive.
+
+    The JSONL streaming contract (rubric §W7): one JSON object per stdout
+    line — ``{"ok": true, "event": ...}`` progress objects along the way, and
+    a terminal envelope as the FINAL line. This generator yields each parsed
+    event dict the moment it arrives (so a long op surfaces partial progress
+    instead of blocking until exit), then yields exactly one terminal
+    :class:`NativeResult`. *on_event*, when given, is called with each parsed
+    event as it arrives (the TUI wraps this in ``call_from_thread``).
+
+    Stream-mode ok-semantics are stricter than :func:`run_native`: ``ok``
+    requires exit 0, no timeout, AND a valid terminal envelope (the final
+    stdout line parsed as a JSON object whose ``ok`` is not False). Malformed
+    interior lines are skipped and counted in ``malformed_lines``; malformed
+    FINAL line means no valid terminal envelope, so ``ok`` is False — partial
+    progress stays available in ``events``. That is the point of streaming.
+
+    Same failure discipline as :func:`run_native`: raises FileNotFoundError
+    when *binary* is absent; every unit-level failure (bad envelope, timeout,
+    non-zero exit) is data on the terminal result, never an exception.
+    """
+    if on_event is not None and not callable(on_event):
+        raise TypeError("on_event must be callable")
+    if not binary.is_file():
+        raise FileNotFoundError(f"native unit not built: {binary}")
+
+    started = time.monotonic()
+    proc = subprocess.Popen(
+        [str(binary), *args],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    # stderr must drain concurrently — reading it after the stdout loop
+    # deadlocks when a unit floods stderr past the pipe buffer mid-stream.
+    stderr_parts: list[str] = []
+    stderr_drain = threading.Thread(
+        target=lambda: stderr_parts.append(proc.stderr.read()), daemon=True
+    )
+    stderr_drain.start()
+
+    killed = threading.Event()
+    # The watchdog's kill and the flag are one step so an adapter-side
+    # timeout is never mistaken for a unit dying by its own signal.
+    watchdog = threading.Timer(timeout_s, lambda: (killed.set(), proc.kill()))
+    watchdog.start()
+
+    events: list[dict] = []
+    malformed_lines = 0
+    # True only while the most recent non-empty stdout line parsed as a JSON
+    # object — a malformed final line invalidates the terminal envelope.
+    final_line_is_json = False
+    try:
+        for line in proc.stdout:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                parsed = json.loads(line)
+            except json.JSONDecodeError:
+                malformed_lines += 1
+                final_line_is_json = False
+                continue
+            if not isinstance(parsed, dict):
+                malformed_lines += 1
+                final_line_is_json = False
+                continue
+            events.append(parsed)
+            final_line_is_json = True
+            if on_event is not None:
+                on_event(parsed)
+            yield parsed
+        proc.wait()
+    finally:
+        watchdog.cancel()
+        stderr_drain.join(timeout=5.0)
+
+    timed_out = killed.is_set()
+    duration_ms = int((time.monotonic() - started) * 1000)
+    exit_code = proc.returncode if proc.returncode is not None else -1
+    if timed_out:
+        exit_code = -1  # adapter-side kill, never a unit's own exit
+
+    terminal = events[-1] if (events and final_line_is_json) else None
+    ok = (
+        not timed_out
+        and exit_code == 0
+        and terminal is not None
+        and terminal.get("ok") is not False
+    )
+    yield NativeResult(
+        ok=ok,
+        exit_code=exit_code,
+        data=terminal,
+        stderr=stderr_parts[0] if stderr_parts else "",
+        duration_ms=duration_ms,
+        timed_out=timed_out,
+        events=events,
+    )
+

src/rune/__init__.py

@@ -6,7 +6,7 @@ This is the main entry point for the Rune program.
 import json
 from pathlib import Path
 
-__version__ = "0.66.14"
+__version__ = "0.89.1"
 
 # One build identity (handoff 2026-09-10 §4): the semantic version above is
 # the repo-level truth (auto-bumped at merge); the DEPLOYED revision (exact

src/rune/behaviour_ledger.py

@@ -0,0 +1,251 @@
+"""behaviour_ledger.py — T19 §19F/19G/19I: the canonical Behaviour
+Validation Ledger.
+
+PRIMARY UNIT: the VERSIONED BEHAVIOUR / TEST SPECIFICATION — not "a
+test run in some session". Automated verification and real-world/user
+confirmation are DISTINCT truths (rule 19F): tests green ≠ user-
+confirmed.
+
+GENERATION-AWARE HISTORY (rule 19G, mandatory): when a dependency
+changes, affected behaviours become RETEST_REQUIRED while their prior
+confirmation history stays queryable — confidence does not silently
+carry forward, and it does not silently disappear either.
+
+SELECTIVE INVALIDATION (rule 19I): only behaviours whose structural
+dependencies changed are invalidated; every invalidation carries a
+reason; unrelated hardened confirmations are preserved.
+
+Storage: <project_store>/behaviour_ledger.json (versioned document).
+"""
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+LEDGER_SCHEMA_VERSION = 1
+
+# hardening lifecycle (rule 19G semantics)
+UNVALIDATED = "UNVALIDATED"                    # not yet validated
+IMPLEMENTED = "IMPLEMENTED"                    # implementation exists
+AUTO_VERIFIED = "AUTO_VERIFIED"                # automated verification passed
+REAL_WORLD_PASSED = "REAL_WORLD_PASSED"        # manual/real test passed
+TEST_FAILED = "TEST_FAILED"                    # test failed
+PARTIAL = "PARTIAL"                            # inconclusive
+USER_CONFIRMED = "USER_CONFIRMED"              # hardened
+RETEST_REQUIRED = "RETEST_REQUIRED"            # confidence invalidated
+ACCEPTED_LIMITATION = "ACCEPTED_LIMITATION"    # explicitly approved gap
+NOT_APPLICABLE = "NOT_APPLICABLE"
+
+STATES = (UNVALIDATED, IMPLEMENTED, AUTO_VERIFIED, REAL_WORLD_PASSED,
+          TEST_FAILED, PARTIAL, USER_CONFIRMED, RETEST_REQUIRED,
+          ACCEPTED_LIMITATION, NOT_APPLICABLE)
+
+# states that represent STANDING CONFIDENCE (selective invalidation
+# may reopen exactly these; everything else is already open or n/a)
+CONFIRMED_STATES = (AUTO_VERIFIED, REAL_WORLD_PASSED, USER_CONFIRMED)
+
+
+def _now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+class BehaviourLedger:
+    def __init__(self, store_dir: Path | str):
+        self.path = Path(store_dir) / "behaviour_ledger.json"
+        self.doc = self._load()
+
+    def _load(self) -> dict:
+        if self.path.is_file():
+            import json
+            return json.loads(self.path.read_text())
+        return {"schema_version": LEDGER_SCHEMA_VERSION,
+                "behaviours": {}, "updated_at": _now()}
+
+    def save(self) -> None:
+        import json
+        self.doc["updated_at"] = _now()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(self.doc, indent=1, sort_keys=True))
+
+    # -- specification ------------------------------------------------------
+
+    def define(self, *, behaviour_id: str, owning_project: str,
+               intended_behaviour: str, origin_intent: str = "",
+               pass_criteria: str = "", fail_criteria: str = "",
+               procedure: str = "",
+               owner_component: str = "",
+               dependencies: list[str] | None = None,
+               automated_ref: str = "",
+               environment: str = "") -> dict:
+        bid = (behaviour_id if behaviour_id.startswith("behaviour:")
+               else f"behaviour:{behaviour_id}")
+        if bid in self.doc["behaviours"]:
+            raise ValueError(f"behaviour exists: {bid}")
+        rec = {
+            "behaviour_id": bid,
+            "owning_project": owning_project,
+            "intended_behaviour": intended_behaviour,
+            "origin_intent": origin_intent,
+            "pass_criteria": pass_criteria,
+            "fail_criteria": fail_criteria,
+            "procedure": procedure,
+            "owner_component": owner_component,   # structural entity id
+            "dependencies": list(dependencies or []),  # structural ids
+            "automated_ref": automated_ref,
+            "environment": environment,
+            "state": UNVALIDATED,
+            "evidence": [],           # [{at, generation, kind, detail}]
+            "history": [],            # every state transition, never lost
+            "invalidations": [],      # [{at, generation, because}]
+            "limitations": [],
+            "created_at": _now(),
+            "updated_at": _now(),
+        }
+        self.doc["behaviours"][bid] = rec
+        return rec
+
+    def get(self, behaviour_id: str) -> dict | None:
+        return self.doc["behaviours"].get(
+            behaviour_id if behaviour_id.startswith("behaviour:")
+            else f"behaviour:{behaviour_id}")
+
+    # -- state transitions (all recorded in history — rule 19G) -------------
+
+    def _transition(self, rec: dict, new_state: str, *, kind: str,
+                    detail: str = "", generation: str = "") -> None:
+        if new_state not in STATES:
+            raise ValueError(f"unknown validation state {new_state!r}")
+        rec["history"].append({
+            "at": _now(), "from": rec["state"], "to": new_state,
+            "kind": kind, "detail": detail[:200],
+            "generation": generation})
+        rec["state"] = new_state
+        rec["updated_at"] = _now()
+
+    def record_auto_verification(self, behaviour_id: str, *,
+                                 passed: bool, detail: str = "",
+                                 generation: str = "") -> dict:
+        """Automated verification. GREEN NEVER IMPLIES USER_CONFIRMED
+        (rule 19W-22): the ceiling here is AUTO_VERIFIED."""
+        rec = self.get(behaviour_id)
+        if rec is None:
+            raise ValueError(f"unknown behaviour {behaviour_id!r}")
+        rec["evidence"].append({"at": _now(), "kind": "automated",
+                                "passed": passed,
+                                "detail": detail[:200],
+                                "generation": generation})
+        self._transition(rec, AUTO_VERIFIED if passed else TEST_FAILED,
+                         kind="automated_verification", detail=detail,
+                         generation=generation)
+        return rec
+
+    def record_real_world(self, behaviour_id: str, *, passed: bool,
+                          detail: str = "", generation: str = "",
+                          confirmed_by: str = "user") -> dict:
+        """Real-world/manual test result (testing mode). USER_CONFIRMED
+        requires an explicit confirmed_by='user' pass (rule 19M)."""
+        rec = self.get(behaviour_id)
+        if rec is None:
+            raise ValueError(f"unknown behaviour {behaviour_id!r}")
+        rec["evidence"].append({"at": _now(), "kind": "real_world",
+                                "passed": passed,
+                                "detail": detail[:200],
+                                "generation": generation,
+                                "by": confirmed_by})
+        if passed:
+            state = (USER_CONFIRMED if confirmed_by == "user"
+                     else REAL_WORLD_PASSED)
+        else:
+            state = TEST_FAILED
+        self._transition(rec, state, kind="real_world", detail=detail,
+                         generation=generation)
+        return rec
+
+    def accept_limitation(self, behaviour_id: str, *, note: str,
+                          approved_by: str = "user") -> dict:
+        rec = self.get(behaviour_id)
+        if rec is None:
+            raise ValueError(f"unknown behaviour {behaviour_id!r}")
+        rec["limitations"].append({"at": _now(), "note": note[:200],
+                                   "approved_by": approved_by})
+        self._transition(rec, ACCEPTED_LIMITATION, kind="accept_limitation",
+                         detail=note, )
+        return rec
+
+    # -- selective invalidation (rule 19I) -----------------------------------
+
+    def invalidate_for_change(self, *, changed_entities: set[str],
+                              generation: str = "",
+                              reasons: dict[str, str] | None = None
+                              ) -> list[dict]:
+        """Mark RETEST_REQUIRED exactly those confirmed behaviours whose
+        structural dependencies intersect the changed closure. Every
+        invalidation carries a reason; unrelated confirmations stay.
+        Returns the invalidated records."""
+        reasons = reasons or {}
+        invalidated = []
+        for rec in self.doc["behaviours"].values():
+            if rec["state"] not in CONFIRMED_STATES:
+                continue
+            overlap = set(rec.get("dependencies") or []) & changed_entities
+            if rec.get("owner_component") in changed_entities:
+                overlap.add(rec["owner_component"])
+            if not overlap:
+                continue  # unrelated hardened behaviour: PRESERVED (19S-5)
+            because = reasons.get(
+                rec["behaviour_id"],
+                f"structural change touched: {sorted(overlap)}")
+            rec["invalidations"].append({
+                "at": _now(), "generation": generation,
+                "because": because[:200],
+                "was": rec["state"],
+                "changed_entities": sorted(overlap)})
+            # HISTORY IS PRESERVED — prior confirmation stays queryable
+            self._transition(rec, RETEST_REQUIRED,
+                             kind="selective_invalidation",
+                             detail=f"was {rec['state']}; {because}",
+                             generation=generation)
+            invalidated.append(rec)
+        return invalidated
+
+    def retest_history(self, behaviour_id: str) -> list[dict]:
+        """Generation-aware history: all confirmations + invalidations
+        for one behaviour, oldest first (rule 19S-12)."""
+        rec = self.get(behaviour_id)
+        if rec is None:
+            return []
+        events = []
+        for h in rec["history"]:
+            events.append({"at": h["at"], "generation": h.get("generation"),
+                           "event": f"{h['from']}→{h['to']}",
+                           "kind": h["kind"], "detail": h.get("detail", "")})
+        return events
+
+    # -- queue (testing mode, 19L/M) ------------------------------------------
+
+    def outstanding(self, *, component: str | None = None,
+                    project: str | None = None) -> list[dict]:
+        """Eligible testing items: anything not confirmed/accepted/n.a.
+        Dynamic — the queue re-derives from states after every fix
+        (rule 19M)."""
+        out = []
+        for rec in self.doc["behaviours"].values():
+            if rec["state"] in (USER_CONFIRMED, ACCEPTED_LIMITATION,
+                                NOT_APPLICABLE):
+                continue
+            if project and rec.get("owning_project") != project:
+                continue
+            if component and rec.get("owner_component") != component:
+                continue
+            out.append(rec)
+        out.sort(key=lambda r: (0 if r["state"] == TEST_FAILED else 1,
+                                r["behaviour_id"]))
+        return out
+
+    def summary(self) -> dict:
+        counts: dict[str, int] = {}
+        for rec in self.doc["behaviours"].values():
+            counts[rec["state"]] = counts.get(rec["state"], 0) + 1
+        return {"total": len(self.doc["behaviours"]),
+                "states": counts,
+                "outstanding": len(self.outstanding())}

src/rune/build_basis.py

@@ -0,0 +1,314 @@
+"""build_basis.py — T18 §18C: durable versioned RESEARCH BASIS for
+construction (V1 rule F: RESEARCH INFORMS STRUCTURE).
+
+Research output must not disappear in transient model context. A Build
+Basis is a durable, schema-versioned document that captures WHAT
+research decided and WHY, with references — not research dumps. It is
+created after the research-depth decision and before/with the
+Construction Contract, and is attachable to:
+
+  - a Project Scaffold (project-level basis)
+  - a Construction Contract (per-contract basis, via evidence_ref)
+  - future structural entities where useful
+
+Research Core ownership (rule C): this module NEVER researches. It
+records the depth decision (derived FROM adaptive_router's route — no
+second router), references the canonical pipeline's qualified output
+(stages ISSUE→…→QUALIFY, artifacts in research/issue-<N>/), and
+structures the adopt/adapt/combine/reject/innovate decisions (rule E).
+"""
+from __future__ import annotations
+
+import time
+from typing import Any
+
+SCHEMA_VERSION = 1
+
+# Research depth tiers — derived from adaptive_router ROUTES, never a
+# second router (rule C/A). Each tier records WHY it was chosen.
+DEPTH_NONE = "NONE"                # tiny obvious local change; local evidence only
+DEPTH_INWARD = "INWARD"            # repo-internal understanding suffices
+DEPTH_OUTWARD = "OUTWARD"          # precedent/prior-art discovery required
+DEPTH_FULL = "FULL"                # full pipeline incl. adversarial+synthesis
+
+DEPTH_TIERS = (DEPTH_NONE, DEPTH_INWARD, DEPTH_OUTWARD, DEPTH_FULL)
+
+# route → default depth (recorded as decision evidence; caller may
+# justify an exception, which is recorded as such — never silent)
+_ROUTE_DEFAULT_DEPTH = {
+    "LOCAL_FIX": DEPTH_NONE,
+    "STANDARD_CHANGE": DEPTH_INWARD,
+    "RESEARCHED_CHANGE": DEPTH_FULL,
+}
+
+
+def research_depth(route: str, *, mode: str = "",
+                   justification: str = "") -> dict:
+    """The research-depth DECISION for a construction need. Derived from
+    the canonical route authority (adaptive_router); `justification` is
+    REQUIRED when deviating from the route default — recorded, never
+    silent (rule D: record why research depth was chosen)."""
+    default = _ROUTE_DEFAULT_DEPTH.get(route, DEPTH_INWARD)
+    depth = default
+    why = f"route {route} default"
+    if justification and justification.strip():
+        # an explicit justification selects a tier by name if given;
+        # otherwise it annotates the default
+        candidate = justification.strip().split(":", 1)[0].strip()
+        if candidate in DEPTH_TIERS:
+            depth = candidate
+            why = justification.strip()
+        else:
+            why = f"route {route} default; note: {justification.strip()}"
+    elif route not in _ROUTE_DEFAULT_DEPTH:
+        why = f"route {route!r} unknown — INWARD floor (never silent NONE)"
+        depth = DEPTH_INWARD
+    return {"depth": depth, "why": why, "route": route, "mode": mode,
+            "decided_at": _now()}
+
+
+# OUTWARD precedent-first ordering contract (rule E): the questions the
+# prior-art pass MUST answer before deeper material is consulted.
+OUTWARD_PRIOR_ART_QUESTIONS = (
+    "what already exists addressing this intent",
+    "what open-source systems/products/workflows attempt it",
+    "what architectural patterns already work",
+    "what standards/conventions exist",
+    "what can be directly ADOPTED",
+    "what can be ADAPTED",
+    "what can be COMBINED",
+    "what should be REJECTED",
+    "where is genuine INNOVATION required",
+)
+
+_DISPOSITIONS = ("ADOPT", "ADAPT", "COMBINE", "REJECT", "INNOVATE")
+
+
+def new_basis(*, question: str, depth_decision: dict,
+              issue_ref: str = "") -> dict:
+    """Create an empty-but-valid Build Basis. References only — full
+    research dumps live in the Research Core's artifact dirs (rule 18C:
+    do not store unnecessary dumps)."""
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "kind": "build_basis",
+        "created_at": _now(),
+        "question": question,
+        "issue_ref": issue_ref,  # e.g. research/issue-164 or Gitea issue
+        "depth": depth_decision,
+        "inward": {"findings": [], "refs": []},
+        "outward": {"prior_art_questions_answered": [],
+                    "findings": [], "refs": []},
+        "deeper": {"used": False, "findings": [], "refs": []},
+        "dispositions": [],  # [{item, disposition: ADOPT/…, why, ref}]
+        "alternatives_considered": [],
+        "uncertainty": [],
+        "risks": [],
+        "implications": {"architecture": [], "structural": [],
+                         "migration": [], "verification": []},
+    }
+
+
+def set_dispositions(basis: dict, dispositions: list[dict]) -> list[str]:
+    """Record the adopt/adapt/combine/reject/innovate decisions (rule E).
+    Returns validation errors; the basis stays unqualified until valid."""
+    basis["dispositions"] = [
+        {"item": d.get("item", ""), "disposition": d.get("disposition", ""),
+         "why": d.get("why", ""), "ref": d.get("ref", "")}
+        for d in dispositions
+    ]
+    return validate_basis(basis)
+
+
+def validate_basis(basis: dict) -> list[str]:
+    """Qualification gate. A basis is QUALIFIED when it carries a depth
+    decision with why, at least one outward prior-art answer when depth
+    is OUTWARD/FULL, and every disposition uses a legal disposition."""
+    errors: list[str] = []
+    if basis.get("schema_version") != SCHEMA_VERSION:
+        errors.append(f"schema_version {basis.get('schema_version')!r}")
+    depth = (basis.get("depth") or {}).get("depth")
+    if depth not in DEPTH_TIERS:
+        errors.append(f"depth {depth!r} not in {DEPTH_TIERS}")
+    if not (basis.get("depth") or {}).get("why"):
+        errors.append("depth decision lacks WHY (rule D)")
+    if depth in (DEPTH_OUTWARD, DEPTH_FULL):
+        outward = basis.get("outward") or {}
+        if not (outward.get("prior_art_questions_answered")
+                or outward.get("findings") or outward.get("refs")):
+            errors.append("OUTWARD/FULL depth requires prior-art evidence")
+    if depth == DEPTH_INWARD:
+        inward = basis.get("inward") or {}
+        if not (inward.get("findings") or inward.get("refs")
+                or basis.get("dispositions")):
+            errors.append("INWARD depth requires recorded evidence "
+                          "(findings/refs) — an empty basis is not "
+                          "qualified")
+    for d in basis.get("dispositions", []):
+        if d.get("disposition") not in _DISPOSITIONS:
+            errors.append(f"illegal disposition {d.get('disposition')!r} "
+                          f"for {d.get('item','')[:40]!r}")
+    return errors
+
+
+def is_qualified(basis: dict) -> bool:
+    return not validate_basis(basis)
+
+
+def attach_evidence_ref(basis: dict) -> str:
+    """The evidence_ref string a contract carries to point at this basis
+    (durable pointer, not a copy — stores stay independent)."""
+    return (f"build_basis:{basis.get('issue_ref') or 'adhoc'}:"
+            f"{basis.get('created_at')}")
+
+
+def summary(basis: dict) -> dict:
+    """Compact projection for prompts/previews (no private reasoning —
+    structured conclusions only, rule 18G)."""
+    return {
+        "schema_version": basis.get("schema_version"),
+        "question": basis.get("question"),
+        "issue_ref": basis.get("issue_ref"),
+        "depth": basis.get("depth"),
+        "qualified": is_qualified(basis),
+        "validation": validate_basis(basis),
+        "dispositions": [
+            {"item": d.get("item", "")[:80],
+             "disposition": d.get("disposition")}
+            for d in basis.get("dispositions", [])
+        ],
+        "uncertainty_count": len(basis.get("uncertainty", [])),
+        "risks_count": len(basis.get("risks", [])),
+        "implications": {k: len(v) for k, v in
+                         (basis.get("implications") or {}).items()},
+    }
+
+
+def _now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+def revise_depth(basis: dict, *, new_depth: str, reason: str) -> dict:
+    """§21.1G: record a justified depth revision. Original + revised
+    depths both persist. An OUTWARD→INWARD/NONE downgrade requires
+    explicit resolution evidence ('discovery resolved', 'prior-art
+    resolved', 'unnecessary') — never a bare skip."""
+    if new_depth not in DEPTH_TIERS:
+        raise ValueError(f"unknown depth {new_depth!r}")
+    original = basis["depth"]["depth"]
+    if original == new_depth:
+        raise ValueError("no-op revision: depth unchanged")
+    consequential_origins = ("RESEARCHED_CHANGE", "FULL", "OUTWARD")
+    if original in consequential_origins and new_depth in ("NONE", "INWARD"):
+        keywords = ("resolved", "non-material", "discovery",
+                    "unnecessary", "prior-art question")
+        if not any(k in reason.lower() for k in keywords):
+            raise ValueError(
+                "OUTWARD downgrade requires explicit evidence: the "
+                "prior-art question must be resolved as non-material "
+                "(not merely skipped)")
+    basis["depth_revision"] = {
+        "original_depth": original, "revised_depth": new_depth,
+        "reason": reason[:200], "revised_at": _now()}
+    basis["depth"]["depth"] = new_depth
+    basis["depth"]["why"] = f"revised from {original}: {reason}"
+    return basis["depth_revision"]
+
+
+def to_json(basis: dict) -> str:
+    import json
+    return json.dumps(basis, indent=1, sort_keys=True)
+
+
+def from_json(text: str) -> dict:
+    import json
+    return json.loads(text)
+
+
+_ = Any  # typing import kept for forward annotations
+
+
+# ── T18 §18D CORRECTION (Nick, 2026-09-15): THE RESEARCH PLAN ITSELF IS
+# CONTEXTUALLY GENERATED. The prior-art categories researched for the
+# structural-model task (architecture graphs, monorepo tooling, etc.)
+# were CONTEXTUAL to that task — they must never become a fixed topic
+# list. For every request the plan is derived from:
+#   intent → target/current reality → material unknowns/decisions/risks
+#   → context-specific research topics → proportional depth.
+# There is NO permanent research-topic checklist anywhere in Scaffolding.
+
+def generate_research_plan(*, intent: str, target: str = "",
+                           current_reality: str = "",
+                           unknowns: list[str] | None = None,
+                           decisions: list[str] | None = None,
+                           risks: list[str] | None = None,
+                           depth: str | None = None) -> dict:
+    """Generate a CONTEXT-SPECIFIC research plan for one construction
+    intent. Topics are synthesized from the material unknowns/decisions/
+    risks of THIS intent — the function has no topic vocabulary and no
+    permanent category list. Depth, when not supplied, is chosen by
+    consequence heuristics recorded in the plan (why is always present)."""
+    unknowns = [u for u in (unknowns or []) if u.strip()]
+    decisions = [d for d in (decisions or []) if d.strip()]
+    risks = [r for r in (risks or []) if r.strip()]
+    topics: list[dict] = []
+    # each material unknown becomes a research topic aimed at resolving it
+    for u in unknowns:
+        topics.append({
+            "topic": f"resolve unknown: {u}",
+            "kind": "unknown-resolution",
+            "why": f"material unknown blocks confident construction: {u[:80]}",
+        })
+    for d in decisions:
+        topics.append({
+            "topic": f"inform decision: {d}",
+            "kind": "decision-support",
+            "why": f"consequential decision needs precedent/evidence: {d[:80]}",
+        })
+    for r in risks:
+        topics.append({
+            "topic": f"de-risk: {r}",
+            "kind": "risk-investigation",
+            "why": f"identified risk needs verification/mitigation evidence: {r[:80]}",
+        })
+    # precedent question (rule E) attaches ONLY when outward evidence is
+    # plausibly relevant — an unknown/decision about external prior art.
+    needs_outward = any(
+        w in " ".join(unknowns + decisions).lower()
+        for w in ("exist", "existing", "prior art", "precedent", "standard",
+                  "convention", "library", "tool", "framework", "approach"))
+    if needs_outward:
+        topics.append({
+            "topic": ("what already exists that is relevant to THIS intent "
+                      "(adopt/adapt/combine/reject/innovate)"),
+            "kind": "prior-art",
+            "why": "material unknown references existing practice — "
+                   "precedent discovery required before deeper research",
+        })
+    if depth is None:
+        # consequence heuristics: novel/architectural/unsafe → deeper
+        consequential = any(
+            w in (intent + " " + " ".join(risks)).lower()
+            for w in ("architecture", "migration", "replace", "rewrite",
+                      "security", "schema", "delete", "deploy", "breaking"))
+        depth = DEPTH_FULL if (consequential and topics) else (
+            DEPTH_OUTWARD if needs_outward and topics else (
+                DEPTH_INWARD if topics else DEPTH_NONE))
+        why = ("consequence heuristics: consequential keywords + research "
+               "topics present" if depth == DEPTH_FULL else
+               "precedent-relevant unknowns present" if depth == DEPTH_OUTWARD
+               else "local understanding suffices" if depth == DEPTH_INWARD
+               else "no material unknowns — local evidence only")
+    else:
+        why = "depth supplied by caller (recorded, caller accountable)"
+    return {
+        "intent": intent,
+        "target": target,
+        "current_reality_note": current_reality[:200],
+        "depth": {"depth": depth, "why": why},
+        "topics": topics,
+        "plan_generated_at": _now(),
+        # the plan ITSELF is evidence that research was contextual, not
+        # checklist-driven: two different intents must produce disjoint
+        # topic sets unless they share genuine unknowns
+    }

src/rune/builder_bridge.py

@@ -64,6 +64,7 @@ class BuilderCapsule:
     memory_lines: list = field(default_factory=list)
     lesson_lines: list = field(default_factory=list)
     constraints: list = field(default_factory=list)
+    construction_lines: list = field(default_factory=list)
     generated_at: str = ""
     core_version: str = "rune-core/operator-path"
 
@@ -75,6 +76,7 @@ class BuilderCapsule:
             "memory_lines": self.memory_lines[:MAX_MEMORY_LINES],
             "lesson_lines": self.lesson_lines[:MAX_LESSON_LINES],
             "constraints": self.constraints,
+            "construction_lines": self.construction_lines,
             "generated_at": self.generated_at,
             "core_version": self.core_version,
         }
@@ -87,10 +89,14 @@ class BuilderCapsule:
             and not d["lesson_lines"]
             and not d["unknowns"]
             and not d["constraints"]
+            and not d["construction_lines"]
             and d["task_route"] in ("LOCAL_FIX", "STANDARD_CHANGE")
         ):
             return ""  # nothing useful — inject nothing (handoff §5)
         lines = [f"### Rune Core preflight ({d['task_route']})"]
+        if d["construction_lines"]:
+            lines.append("**Active Scaffolding construction (read-only projection):**")
+            lines += [f"- {c}" for c in d["construction_lines"]]
         if d["memory_lines"]:
             lines.append("**Relevant Rune memory:**")
             lines += [f"- {m}" for m in d["memory_lines"]]
@@ -107,6 +113,56 @@ class BuilderCapsule:
         return "\n".join(lines)
 
 
+def _construction_store() -> str:
+    """The SAME construction store the operator path uses (env override
+    honoured; default derives from the repo root, never a bare relative
+    path). Kept identical to rune_operator._construction_store."""
+    import os as _os
+    env = _os.environ.get("RUNE_CONSTRUCTION_STORE")
+    if env:
+        return env
+    from pathlib import Path as _P
+    return str(_P(__file__).resolve().parent.parent.parent / "store" / "scaffold")
+
+
+def _active_construction_lines() -> list:
+    """Read-only projection of the ACTIVE Scaffolding construction into
+    builder-consumable lines. This is the MiMo edge of the shared
+    Construction Context (§15) — it surfaces canonical state; it is NOT a
+    second construction authority and never mutates. Degrade-safe: any
+    failure returns [] (the bridge must never block the builder)."""
+    try:
+        from .construction_interface import ConstructionInterface
+        env = ConstructionInterface(builder="mimo-bridge",
+                                    project_store=_construction_store(),
+                                    project_id="issue161-harness"
+                                    ).construction_context()
+        st = env.get("state") or {}
+        if not st.get("active"):
+            return []
+        out = [f"contract {st.get('contract_id')} · phase {st.get('phase')}"
+               f" · status {st.get('status')}"
+               f" · mode {st.get('construction_mode')}"]
+        if st.get("project"):
+            out.append(f"project: {st['project']}")
+        if st.get("need"):
+            out.append(f"need: {st['need']}")
+        scope = st.get("scope") or []
+        if scope:
+            out.append("scope: " + ", ".join(str(x) for x in scope[:8]))
+        obl = st.get("obligations") or []
+        if obl:
+            out.append(f"outstanding obligations: {len(obl)}")
+            for o in obl[:3]:
+                txt = o.get("obligation") or o.get("kind") or o
+                out.append(f"  - {str(txt)[:120]}")
+        if st.get("next_action"):
+            out.append(f"next action: {st['next_action']}")
+        return out
+    except Exception:  # noqa: BLE001 — projection only; never block the builder
+        return []
+
+
 def _default_selector():
     """The SAME MemorySelector the operator path uses (lazy, degrade-safe)."""
     try:
@@ -166,6 +222,11 @@ def preflight(task_text: str, memory_selector=None) -> BuilderCapsule:
     # design (handoff §9: raw SEED records are outcome telemetry, not lessons).
     capsule.lesson_lines = _validated_lessons_for(task_text or "")
 
+    # Active Scaffolding construction state (read-only projection of the
+    # shared Construction Context). Empty when no contract is active, so
+    # the inject-nothing policy is preserved for ordinary turns.
+    capsule.construction_lines = _active_construction_lines()
+
     return capsule
 
 

src/rune/canary_gitea_automation.py

@@ -231,7 +231,7 @@ def main() -> int:
     )
     check(
         "Rune minor version advertises provisioning and restore verification",
-        '__version__ = "0.66.14"' in rune_version,
+        '__version__ = "0.89.1"' in rune_version,
         failures,
     )
     # #169 policy update: auto-bump on merge is sanctioned (Nick directive:

src/rune/canary_gitea_pipeline.py

@@ -93,6 +93,31 @@ def main() -> int:
         "if: always()" in required_gate and "needs: [lint, unit-tests, canary" in required_gate,
         failures,
     )
+    # RELEASE-SAFETY (2026-09-13, after 0.66.28/29 red promotions): the
+    # required-checks publish step previously echoed success UNCONDITIONALLY
+    # (read /tmp/need_* files that no step wrote). The verdict MUST come
+    # from the needs context — this canary locks that class shut.
+    publish_section = required_gate.split("Publish protected-branch gate", 1)[-1]
+    check(
+        "required gate verdict evaluates needs results (not unconditional echo)",
+        "needs.lint.result == 'success'" in publish_section
+        and "needs['type-check'].result == 'success'" in publish_section
+        and "needs['unit-tests'].result == 'success'" in publish_section,
+        failures,
+    )
+    check(
+        "required gate fails closed when any check is not success",
+        "!= 'success'" in publish_section and "exit 1" in publish_section,
+        failures,
+    )
+    check(
+        "no unconditional success echo without a needs-conditioned if",
+        not (
+            "All required CI checks passed" in publish_section
+            and "needs.lint.result == 'success'" not in publish_section
+        ),
+        failures,
+    )
     check(
         "required gate depends on unit tests and verification jobs",
         "needs: [lint, unit-tests, canary" in text,

src/rune/capability_fit.py

@@ -0,0 +1,429 @@
+"""capability_fit.py — Requirement-fit capability discovery + gap decision.
+
+SCAFFOLD-TRANCHE-003. Layer over the Tranche 2 substrate (structural_store,
+scaffold, spine). NOT a second graph: discovery queries existing structural
+authorities (Rune Spine / Project Scaffold stores) and produces candidates;
+fit and resolution are derived verdicts with recorded evidence.
+
+Architecture:
+
+    CapabilityRequirement (open-world object)
+        ↓
+    discover_candidates(store_doc)          DETERMINISTIC — structural only
+        ↓
+    evaluate_fit(requirement, candidate)    DETERMINISTIC first;
+                                            bounded LLM seam recorded, never
+                                            authoritative alone
+        ↓
+    decide(requirement, fits)               resolution surface:
+                                            SATISFIED / REUSE / CONFIGURE /
+                                            COMPOSE / ADAPT_EXISTING /
+                                            ACQUIRE_EXTERNAL / BUILD_NEW /
+                                            INSUFFICIENT_EVIDENCE
+
+Core invariants (tranche brief §5, §27):
+    - BUILD_NEW is NEVER the default and is never silently chosen from
+      insufficient evidence.
+    - Structural discovery produces CANDIDATES; names alone are never fit.
+    - A stale/superseded/degraded candidate is not silently reusable.
+    - BUILD BUT DON'T BREAK: adaptation selected only when existing consumers
+      are provably unaffected; brittle coupling forces BUILD_NEW (with
+      rationale) or COMPOSE.
+    - When an LLM contributes interpretation, provider/model/reason/evidence/
+      confidence are RECORDED; its prose alone never establishes authority.
+    - Memory is never a structural authority here.
+"""
+
+from __future__ import annotations
+
+from rune.structural_store import entity, relationships, resolve_status
+
+__all__ = [
+    "CapabilityRequirement",
+    "RESOLUTIONS",
+    "discover_candidates",
+    "evaluate_fit",
+    "decide",
+    "record_semantic_fit",
+]
+
+RESOLUTIONS = (
+    "SATISFIED",
+    "REUSE",
+    "CONFIGURE",
+    "COMPOSE",
+    "ADAPT_EXISTING",
+    "ACQUIRE_EXTERNAL",
+    "BUILD_NEW",
+    "INSUFFICIENT_EVIDENCE",
+)
+
+# relationship types treated as "candidate implements/exposes this contract"
+_PROVIDES = {"implements", "exposes", "provides", "serves"}
+_CONSUMES = {"consumes", "depends_on"}
+# entity kinds eligible as capability candidates (open-world: unknown kinds
+# with providing relationships are also eligible — see discover_candidates)
+_BASE_KINDS = {"capability", "module", "component", "service", "cli", "tool", "workflow"}
+# maturity rank for reuse-worthiness (shared ladder from structural_store)
+_MATURITY_ORDER = ["DECLARED", "PRESENT", "WIRED", "REACHABLE", "EXERCISED", "LIVE_PROVEN"]
+_MATURITY_RANK = {n: i for i, n in enumerate(_MATURITY_ORDER)}
+
+
+# ── Capability Requirement ────────────────────────────────────────────────
+
+
+class CapabilityRequirement:
+    """Open-world structured requirement. No fixed ontology: `props` carries
+    any constraint the need expresses; a small set of FIRST-CLASS keys are
+    interpreted deterministically (contracts, environment, mandatory) and
+    everything else roundtrips as data."""
+
+    FIRST_CLASS = (
+        "objective",
+        "contracts",
+        "environment",
+        "mandatory",
+        "optional",
+        "target_project",
+        "inputs",
+        "outputs",
+        "performance",
+        "reliability",
+        "deployment",
+        "integration",
+        "user_constraints",
+        "evidence_refs",
+    )
+
+    def __init__(
+        self,
+        objective: str,
+        *,
+        contracts: list[str] | None = None,
+        environment: dict | None = None,
+        mandatory: list[str] | None = None,
+        optional: list[str] | None = None,
+        **props,
+    ):
+        self.objective = objective
+        self.contracts = sorted(contracts or [])  # required interfaces
+        self.environment = dict(environment or {})  # e.g. {"os": "linux"}
+        self.mandatory = sorted(mandatory or [])
+        self.optional = sorted(optional or [])
+        self.props = dict(props)  # open-world
+
+    def to_dict(self) -> dict:
+        d = {
+            "objective": self.objective,
+            "contracts": self.contracts,
+            "environment": self.environment,
+            "mandatory": self.mandatory,
+            "optional": self.optional,
+        }
+        d.update(self.props)
+        return d
+
+    @classmethod
+    def from_dict(cls, d: dict) -> "CapabilityRequirement":
+        known = {k: d.pop(k) for k in cls.FIRST_CLASS if k in d}
+        return cls(known.pop("objective"), **{**known, **d})
+
+
+# ── semantic-fit seam (recorded, never authoritative alone) ───────────────
+
+
+def record_semantic_fit(
+    provider: str, model: str, reason: str, evidence: list[str], confidence: float, interpretation: str
+) -> dict:
+    """Record a bounded LLM semantic interpretation contributing to fit.
+    The record is EVIDENCE, not authority: decide() treats it as supporting
+    context that must agree with deterministic facts. Never silent."""
+    if not provider or not model:
+        raise ValueError("semantic fit record requires provider+model")
+    if not 0.0 <= confidence <= 1.0:
+        raise ValueError("confidence must be in [0,1]")
+    return {
+        "kind": "semantic_fit",
+        "provider": provider,
+        "model": model,
+        "reason": reason,
+        "evidence": sorted(evidence),
+        "confidence": confidence,
+        "interpretation": interpretation[:500],
+    }
+
+
+# ── structural discovery (deterministic) ──────────────────────────────────
+
+
+def _provides_contracts(doc: dict, eid: str) -> set[str]:
+    out = set()
+    for r in relationships(doc, from_id=eid):
+        if r["type"] in _PROVIDES:
+            out.add(r["to"])
+    return out
+
+
+def _consumers(doc: dict, eid: str) -> set[str]:
+    out = set()
+    for r in relationships(doc, to_id=eid):
+        if r["type"] in {"consumes", "consumed_by", "depends_on"}:
+            out.add(r["from"])
+    return out
+
+
+def discover_candidates(doc: dict, req: CapabilityRequirement) -> list[dict]:
+    """Deterministic candidate discovery over ONE structural store doc.
+    A candidate is any entity that (a) is a known capability-ish kind, OR
+    (b) has providing relationships (open-world kinds stay discoverable).
+    Returns candidates with their structural evidence attached. Names are
+    NOT fit — every candidate must still pass evaluate_fit."""
+    candidates = []
+    for e in doc["entities"]:
+        eid = e["id"]
+        provides = _provides_contracts(doc, eid)
+        eligible = e["kind"] in _BASE_KINDS or bool(provides)
+        if not eligible:
+            continue
+        # environment filter: candidate must not CONTRADICT a stated
+        # environment constraint (missing info is not contradiction)
+        env = e.get("identities", {}).get("environment", {})
+        if isinstance(env, dict) and req.environment:
+            contradicts = any(k in env and req.environment.get(k) not in (None, env[k]) for k in req.environment)
+            if contradicts:
+                continue
+        candidates.append(
+            {
+                "id": eid,
+                "kind": e["kind"],
+                "identities": e.get("identities", {}),
+                "maturity": e.get("maturity", "DECLARED"),
+                "status": resolve_status(e),
+                "superseded_by": e.get("superseded_by"),
+                "provides": sorted(provides),
+                "consumers": sorted(_consumers(doc, eid)),
+                "evidence_refs": e.get("evidence_refs", []),
+            }
+        )
+    return candidates
+
+
+# ── fit evaluation ─────────────────────────────────────────────────────────
+
+
+def evaluate_fit(req: CapabilityRequirement, candidate: dict) -> dict:
+    """DETERMINISTIC fit of one candidate against a requirement.
+    fit: EXACT | PARTIAL | INCOMPATIBLE | UNKNOWN.
+    Names are ignored; contracts + environment + health decide."""
+    missing_contracts = sorted(set(req.contracts) - set(candidate["provides"]))
+    covered = len(req.contracts) - len(missing_contracts)
+
+    # health: a superseded or stale candidate cannot be reused as-is
+    status = candidate["status"]
+    unhealthy = status in {"SUPERSEDED", "STALE"} or bool(candidate.get("superseded_by"))
+
+    # maturity: DECLARED-only candidates have no usage evidence
+    maturity = _MATURITY_RANK.get(candidate.get("maturity", "DECLARED"), 0)
+
+    if unhealthy:
+        return {
+            "candidate": candidate["id"],
+            "fit": "INCOMPATIBLE",
+            "reason": f"candidate status {status} — not reusable as-is",
+            "missing_contracts": missing_contracts,
+            "covered": covered,
+        }
+    if req.contracts and not candidate["provides"]:
+        # candidate provides nothing verifiable → cannot establish fit
+        return {
+            "candidate": candidate["id"],
+            "fit": "UNKNOWN",
+            "reason": "candidate exposes no contracts to check",
+            "missing_contracts": missing_contracts,
+            "covered": 0,
+        }
+    if not missing_contracts:
+        fit = "EXACT"
+        reason = "all required contracts provided"
+    elif covered > 0:
+        fit = "PARTIAL"
+        reason = f"covers {covered}/{len(req.contracts)} required contracts"
+    else:
+        fit = "INCOMPATIBLE"
+        reason = "provides none of the required contracts"
+    return {
+        "candidate": candidate["id"],
+        "fit": fit,
+        "reason": reason,
+        "missing_contracts": missing_contracts,
+        "covered": covered,
+        "maturity_rank": maturity,
+        "consumers": candidate["consumers"],
+    }
+
+
+# ── gap / resolution decision ──────────────────────────────────────────────
+
+
+def _adaptation_brittle(doc: dict, candidate_id: str, missing_contracts: list[str]) -> tuple[bool, str]:
+    """BUILD BUT DON'T BREAK: adaptation is brittle when the contracts the
+    candidate is missing are load-bearing elsewhere (other entities consume
+    or provide them), i.e. adapting means touching a shared surface."""
+    for c in missing_contracts:
+        ce = entity(doc, c)
+        if ce is not None:
+            consumers = _consumers(doc, c)
+            consumers.discard(candidate_id)
+            if consumers:
+                return True, (f"missing contract {c} is load-bearing (consumed by {sorted(consumers)})")
+        for r in relationships(doc, to_id=c):
+            if r["type"] in _PROVIDES and r["from"] != candidate_id:
+                return True, (f"missing contract {c} is already provided by {r['from']} — adapting would fork it")
+    return False, ""
+
+
+def decide(
+    doc: dict,
+    req: CapabilityRequirement,
+    fits: list[dict],
+    *,
+    external_evidence: list[dict] | None = None,
+    semantic_fits: list[dict] | None = None,
+) -> dict:
+    """Resolution decision from deterministic fits. Evidence-backed:
+    every verdict carries the fits/rationale that produced it."""
+    external_evidence = list(external_evidence or [])
+    semantic_fits = list(semantic_fits or [])
+    exact = [f for f in fits if f["fit"] == "EXACT"]
+    partial = [f for f in fits if f["fit"] == "PARTIAL"]
+    unknown = [f for f in fits if f["fit"] == "UNKNOWN"]
+    incompatible = [f for f in fits if f["fit"] == "INCOMPATIBLE"]
+
+    def _result(resolution, rationale, **kw):
+        base = {
+            "resolution": resolution,
+            "rationale": rationale,
+            "considered": [f["candidate"] for f in fits],
+            "semantic_fits": semantic_fits,
+        }
+        base.update(kw)
+        assert resolution in RESOLUTIONS
+        return base
+
+    # INSUFFICIENT EVIDENCE dominates when fit cannot be established
+    if unknown and not exact and not partial:
+        return _result(
+            "INSUFFICIENT_EVIDENCE",
+            "candidates exist but expose no checkable contracts; no deterministic or recorded semantic evidence",
+            unknown_candidates=[f["candidate"] for f in unknown],
+        )
+    if not fits:
+        # nothing structural at all: external evidence decides the route
+        if external_evidence:
+            return _result(
+                "ACQUIRE_EXTERNAL",
+                "no structural candidates; external evidence suggests acquisition investigation",
+                external=external_evidence,
+            )
+        return _result(
+            "INSUFFICIENT_EVIDENCE",
+            "no candidates discovered and no external evidence — BUILD_NEW not silently chosen (§27 J)",
+        )
+
+    # EXACT: already satisfied vs reuse
+    if exact:
+        best = max(exact, key=lambda f: f.get("maturity_rank", 0))
+        if req.props.get("already_consumed_by") and req.props["already_consumed_by"] in best.get("consumers", []):
+            return _result(
+                "SATISFIED",
+                f"{best['candidate']} exactly matches and the requirement's context already consumes it",
+                selected=best["candidate"],
+                fits=exact,
+            )
+        return _result(
+            "REUSE",
+            f"{best['candidate']} exactly matches all required contracts with health evidence",
+            selected=best["candidate"],
+            fits=exact,
+        )
+
+    # PARTIAL: compose, adapt (clean), or build
+    if partial:
+        # COMPOSITION: union of ≥2 partials covers the requirement
+        if len(partial) >= 2:
+            union: set[str] = set()
+            chosen: list[str] = []
+            for f in sorted(partial, key=lambda x: -x["covered"]):
+                new = set(req.contracts) - union
+                if new & set(req.contracts) and not (set(f["missing_contracts"]) >= set(req.contracts)):
+                    add = [c for c in req.contracts if c not in union and c not in f["missing_contracts"]]
+                    if add:
+                        chosen.append(f["candidate"])
+                        union.update(add)
+                if union >= set(req.contracts):
+                    break
+            if union >= set(req.contracts):
+                return _result(
+                    "COMPOSE",
+                    f"composition {chosen} jointly covers all required contracts; none covers alone",
+                    components=chosen,
+                    permanence="temporary (user-controlled)",
+                )
+        # ADAPT: best partial, if adaptation is clean
+        best = max(partial, key=lambda f: f["covered"])
+        brittle, why = _adaptation_brittle(doc, best["candidate"], best["missing_contracts"])
+        if not brittle:
+            return _result(
+                "ADAPT_EXISTING",
+                f"{best['candidate']} covers {best['covered']}/"
+                f"{len(req.contracts)}; adaptation clean ({best['reason']})",
+                selected=best["candidate"],
+                missing=best["missing_contracts"],
+                obligations={"new_behavior_proof": True, "regression_proof": True},
+            )
+        if external_evidence:
+            return _result(
+                "ACQUIRE_EXTERNAL",
+                f"best partial ({best['candidate']}) cannot be "
+                f"adapted without brittle coupling ({why}); "
+                f"external evidence available",
+                external=external_evidence,
+            )
+        return _result(
+            "BUILD_NEW",
+            f"best partial ({best['candidate']}) would create brittle "
+            f"coupling: {why}; composition insufficient; building is the "
+            f"safer path — REUSE-WHEN-CLEAN, BUILD-WHEN-FORCED-REUSE-"
+            f"WOULD-BRITTLE (§5)",
+            selected=None,
+            rejected_partial=best["candidate"],
+            brittle=why,
+            obligations={"new_behavior_proof": True},
+        )
+
+    # everything incompatible
+    if external_evidence:
+        return _result(
+            "ACQUIRE_EXTERNAL", "all candidates incompatible; external evidence available", external=external_evidence
+        )
+    if incompatible:
+        return _result(
+            "INSUFFICIENT_EVIDENCE",
+            "all candidates incompatible with requirement "
+            "constraints; affirmative gap evidence required "
+            "before BUILD_NEW",
+            incompatible=[f["candidate"] for f in incompatible],
+        )
+    return _result("INSUFFICIENT_EVIDENCE", "no usable fit evidence")
+
+
+def resolve(
+    doc: dict,
+    req: CapabilityRequirement,
+    *,
+    external_evidence: list[dict] | None = None,
+    semantic_fits: list[dict] | None = None,
+) -> dict:
+    """One-call surface: discover → fit → decide."""
+    fits = [evaluate_fit(req, c) for c in discover_candidates(doc, req)]
+    return decide(doc, req, fits, external_evidence=external_evidence, semantic_fits=semantic_fits)

src/rune/capability_ledger.py

@@ -0,0 +1,405 @@
+"""capability_ledger.py — T19 §19D: compact versioned Capability
+Ledgers — local re-entry context packets.
+
+PURPOSE (rule 19D): a fresh LLM rehydrates the meaning of a target area
+after compaction/context loss/model swap/long absence WITHOUT rereading
+the repository. Not a second source tree, not a second Scaffold, not
+prose dumps — structured, proportional, operationally-used records.
+
+Identity rule: capability IDs are STABLE across file moves (name-based,
+not path-based); history is preserved on supersede/retire (rule 19Q).
+
+Storage: <project_store>/capability_ledger.json — versioned document,
+provenance-aware (rule G). Historical versions remain traceable via
+the history list.
+"""
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+LEDGER_SCHEMA_VERSION = 1
+
+MATURITY = ("proposed", "implemented", "verified", "hardened",
+            "retest_required", "retired", "superseded")
+
+
+def _now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+class CapabilityLedger:
+    def __init__(self, store_dir: Path | str):
+        self.path = Path(store_dir) / "capability_ledger.json"
+        self.doc = self._load()
+
+    def _load(self) -> dict:
+        if self.path.is_file():
+            import json
+            return json.loads(self.path.read_text())
+        return {"schema_version": LEDGER_SCHEMA_VERSION,
+                "capabilities": {}, "history": [],
+                "updated_at": _now()}
+
+    def save(self) -> None:
+        import json
+        self.doc["updated_at"] = _now()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(self.doc, indent=1, sort_keys=True))
+
+    # -- lifecycle --------------------------------------------------------
+
+    def define(self, *, capability_id: str, name: str, purpose: str,
+               owning_project: str, component: str,
+               source_locations: list[str] | None = None,
+               contract: str = "", state_touched: str = "",
+               dependencies: list[str] | None = None,
+               consumers: list[str] | None = None,
+               invariants: list[str] | None = None,
+               behaviour_specs: list[str] | None = None,
+               constraints: str = "",
+               generation: str = "") -> dict:
+        """Create a capability record (auto-invoked by Scaffolding when a
+        meaningful capability is created — rule 19Q)."""
+        cid = f"capability:{capability_id}"
+        if cid in self.doc["capabilities"]:
+            raise ValueError(f"capability exists: {cid}")
+        rec = {
+            "capability_id": cid,
+            "name": name,
+            "purpose": purpose,
+            "owning_project": owning_project,
+            "component": component,  # structural entity id
+            "source_locations": list(source_locations or []),
+            "contract": contract,
+            "state_touched": state_touched,
+            "dependencies": list(dependencies or []),
+            "consumers": list(consumers or []),
+            "invariants": list(invariants or []),
+            "behaviour_specs": list(behaviour_specs or []),
+            "maturity": "implemented",
+            "constraints": constraints,
+            "generation": generation,
+            "limitations": [],
+            "created_at": _now(),
+            "updated_at": _now(),
+        }
+        self.doc["capabilities"][cid] = rec
+        return rec
+
+    def get(self, capability_id: str) -> dict | None:
+        return self.doc["capabilities"].get(
+            capability_id if ":" in capability_id
+            else f"capability:{capability_id}")
+
+    def material_change(self, capability_id: str, *, note: str,
+                        generation: str = "",
+                        source_locations: list[str] | None = None) -> dict:
+        """Record a material change (auto-invoked after construction —
+        rule 19Q.2). History entry keeps traceability; dependents' harden
+        state is the behaviour ledger's job (via structural closure)."""
+        rec = self.get(capability_id)
+        if rec is None:
+            raise ValueError(f"unknown capability {capability_id!r}")
+        # T21.1 §21.1D: deterministic revision counter. Wall-clock
+        # timestamps are metadata, not causal ordering (same-second events
+        # share a stamp — the T21 race). The revision counter is the
+        # canonical drift signal: material_revision > last governed
+        # spec_revision = SPEC_VERSION_DRIFT.
+        rev = int(rec.get("material_revision", 0)) + 1
+        rec["material_revision"] = rev
+        hist = {"at": _now(), "event": "material_change",
+                "note": note[:200], "generation": generation,
+                "prior_maturity": rec["maturity"],
+                "material_revision": rev}
+        self.doc["history"].append({"capability_id": rec["capability_id"],
+                                    **hist})
+        rec["updated_at"] = _now()
+        if generation:
+            rec["generation"] = generation
+        if source_locations is not None:
+            rec["source_locations"] = list(source_locations)
+        return rec
+
+    def move(self, capability_id: str, new_locations: list[str]) -> dict:
+        """File move: STABLE IDENTITY SURVIVES (rule 19S-6); the move is
+        recorded, history preserved."""
+        rec = self.get(capability_id)
+        if rec is None:
+            raise ValueError(f"unknown capability {capability_id!r}")
+        old = list(rec["source_locations"])
+        rec["source_locations"] = list(new_locations)
+        rec["updated_at"] = _now()
+        self.doc["history"].append({
+            "capability_id": rec["capability_id"], "at": _now(),
+            "event": "moved", "from": old, "to": list(new_locations)})
+        return rec
+
+    def supersede(self, capability_id: str, by: str, *,
+                  note: str = "") -> dict:
+        rec = self.get(capability_id)
+        if rec is None:
+            raise ValueError(f"unknown capability {capability_id!r}")
+        rec["maturity"] = "superseded"
+        rec["superseded_by"] = (by if ":" in by else f"capability:{by}")
+        rec["updated_at"] = _now()
+        self.doc["history"].append({
+            "capability_id": rec["capability_id"], "at": _now(),
+            "event": "superseded", "by": rec["superseded_by"],
+            "note": note[:160]})
+        return rec
+
+    def retire(self, capability_id: str, *, note: str = "") -> dict:
+        rec = self.get(capability_id)
+        if rec is None:
+            raise ValueError(f"unknown capability {capability_id!r}")
+        rec["maturity"] = "retired"
+        rec["updated_at"] = _now()
+        self.doc["history"].append({
+            "capability_id": rec["capability_id"], "at": _now(),
+            "event": "retired", "note": note[:160]})
+        return rec
+
+    # -- queries (surgical context, 19E) -----------------------------------
+
+    def active(self) -> list[dict]:
+        return [r for r in self.doc["capabilities"].values()
+                if r["maturity"] not in ("retired", "superseded")]
+
+    def by_component(self, component: str) -> list[dict]:
+        return [r for r in self.active() if r["component"] == component]
+
+    def context_packet(self, capability_id: str) -> dict:
+        """The LOCAL context packet (19E): everything a fresh builder
+        needs for one capability — bounded, structured, no reasoning."""
+        rec = self.get(capability_id)
+        if rec is None:
+            return {"error": f"unknown capability {capability_id!r}"}
+        return {
+            "schema_version": LEDGER_SCHEMA_VERSION,
+            "capability_id": rec["capability_id"],
+            "name": rec["name"],
+            "purpose": rec["purpose"],
+            "component": rec["component"],
+            "source_locations": rec["source_locations"],
+            "contract": rec["contract"],
+            "state_touched": rec["state_touched"],
+            "dependencies": rec["dependencies"],
+            "consumers": rec["consumers"],
+            "invariants": rec["invariants"],
+            "behaviour_specs": rec["behaviour_specs"],
+            "maturity": rec["maturity"],
+            "constraints": rec["constraints"],
+            "generation": rec["generation"],
+            "limitations": rec["limitations"],
+        }
+
+
+# ── T21 §21C/21D: LIVING CAPABILITY SPECIFICATIONS + STRICT SEMVER ──────
+#
+# A Living Capability Spec is the WHY+WHAT-SHOULD-EXIST layer; the
+# capability record remains the WHAT-EXISTS+WHERE layer. Both live in the
+# SAME ledger document (rule C: no second authority) — the spec is a
+# versioned field-set on the capability, not a separate subsystem.
+#
+# STRICT SEMVER (§21D): only meaningful units get versions.
+#   PATCH: bug fix / internal change, contract compatible
+#   MINOR: backwards-compatible new capability/behaviour
+#   MAJOR: breaking contract/interface/state-semantics change
+# Baselines for existing capabilities: explicit
+# governance_version_started_at + baseline_reason; no fake history.
+
+SPEC_SCHEMA_VERSION = 1
+
+import re as _re
+
+SEMVER_RE = _re.compile(r"^(\d+)\.(\d+)\.(\d+)$")
+
+
+class SpecError(ValueError):
+    """Invalid spec operation (material change without bump, unjustified
+    bump, bad version...)."""
+
+
+def classify_version_bump(*, contract_changed: bool,
+                          behaviour_added: bool,
+                          consumer_break: bool,
+                          implementation_only: bool) -> str:
+    """§21D-3: derive PATCH/MINOR/MAJOR from the change shape. The model
+    may propose; the machinery verifies."""
+    if consumer_break:
+        return "MAJOR"
+    if contract_changed:
+        # contract changed but no consumer break: interface tightened —
+        # still breaking for consumers relying on the old shape
+        return "MAJOR"
+    if behaviour_added:
+        return "MINOR"
+    if implementation_only:
+        return "PATCH"
+    raise SpecError("no version-worthy change: metadata churn does not bump")
+
+
+def bump_version(version: str, kind: str) -> str:
+    m = SEMVER_RE.match(version)
+    if not m:
+        raise SpecError(f"invalid semver {version!r}")
+    major, minor, patch = (int(x) for x in m.groups())
+    if kind == "MAJOR":
+        return f"{major + 1}.0.0"
+    if kind == "MINOR":
+        return f"{major}.{minor + 1}.0"
+    if kind == "PATCH":
+        return f"{major}.{minor}.{patch + 1}"
+    raise SpecError(f"unknown bump kind {kind!r}")
+
+
+def attach_spec(ledger: "CapabilityLedger", capability_id: str, *,
+                requirements: list[str],
+                expected_behaviours: list[str],
+                non_goals: list[str],
+                acceptance_criteria: list[str],
+                baseline_version: str = "0.1.0",
+                baseline_reason: str = "initial governed baseline",
+                governance_version_started_at: str | None = None) -> dict:
+    """Attach a Living Capability Specification to an existing capability
+    record (rule 21C: extend, don't duplicate). Baseline policy (§21D-1):
+    the starting version is explicit — 1.0.0 only for stable contracts
+    with sufficient evidence; otherwise 0.x with a reason."""
+    from rune.capability_ledger import LEDGER_SCHEMA_VERSION  # noqa: F401
+    rec = ledger.get(capability_id)
+    if rec is None:
+        raise ValueError(f"unknown capability {capability_id!r}")
+    if not SEMVER_RE.match(baseline_version):
+        raise SpecError(f"invalid baseline semver {baseline_version!r}")
+    spec = {
+        "schema_version": SPEC_SCHEMA_VERSION,
+        "version": baseline_version,
+        "governance_version_started_at": governance_version_started_at
+        or _now(),
+        "baseline_reason": baseline_reason,
+        "requirements": requirements,
+        "expected_behaviours": expected_behaviours,
+        "non_goals": non_goals,
+        "acceptance_criteria": acceptance_criteria,
+        "version_history": [{
+            "at": _now(), "version": baseline_version, "kind": "BASELINE",
+            "reason": baseline_reason, "changed_sections": [],
+            "affected_consumers": [], "validation_consequences": [],
+        }],
+    }
+    rec["spec"] = spec
+    rec["updated_at"] = _now()
+    return spec
+
+
+def revise_spec(ledger: "CapabilityLedger", capability_id: str, *,
+                contract_changed: bool = False,
+                behaviour_added: bool = False,
+                consumer_break: bool = False,
+                implementation_only: bool = False,
+                reason: str,
+                changed_sections: list[str] | None = None,
+                affected_consumers: list[str] | None = None,
+                validation_consequences: list[str] | None = None,
+                proposed_kind: str | None = None) -> dict:
+    """§21D-3/21E: revise a spec with an AUTOMATIC version decision.
+    The model proposes; the machinery classifies and records. Material
+    change without a bump is impossible (every revise computes one);
+    unjustified bumps are impossible (no-change revise raises)."""
+    rec = ledger.get(capability_id)
+    if rec is None:
+        raise ValueError(f"unknown capability {capability_id!r}")
+    spec = rec.get("spec")
+    if spec is None:
+        raise SpecError(f"{capability_id} has no spec — attach one first")
+    kind = (proposed_kind or classify_version_bump(
+        contract_changed=contract_changed,
+        behaviour_added=behaviour_added,
+        consumer_break=consumer_break,
+        implementation_only=implementation_only))
+    # verify a PROPOSED kind against the change shape (model cannot
+    # upgrade PATCH to MINOR without the corresponding change shape)
+    actual = classify_version_bump(
+        contract_changed=contract_changed,
+        behaviour_added=behaviour_added,
+        consumer_break=consumer_break,
+        implementation_only=implementation_only)
+    order = {"PATCH": 0, "MINOR": 1, "MAJOR": 2}
+    if proposed_kind and order[proposed_kind] > order[actual]:
+        raise SpecError(
+            f"proposed {proposed_kind} exceeds change shape {actual} — "
+            f"unjustified bump")
+    old = spec["version"]
+    new = bump_version(old, kind)
+    spec["version"] = new
+    spec["version_history"].append({
+        "at": _now(), "version": new, "kind": kind,
+        "reason": reason[:200],
+        "changed_sections": list(changed_sections or []),
+        "affected_consumers": list(affected_consumers or []),
+        "validation_consequences": list(validation_consequences or []),
+        # T21.1 §21.1D: the governed decision COVERS all material
+        # revisions up to and including the current one — drift closes
+        # deterministically, not by timestamp comparison
+        "covers_material_revision": int(rec.get("material_revision", 0)),
+    })
+    rec["updated_at"] = _now()
+    return {"old": old, "new": new, "kind": kind, "reason": reason}
+
+
+def spec_drift_status(ledger: "CapabilityLedger",
+                      capability_id: str) -> dict:
+    """T21.1 §21.1D: the callable drift detector / consistency gate.
+    Deterministic and revision-based (never wall-clock):
+
+      material_revision > last governed covers_material_revision
+        → SPEC_VERSION_DRIFT + durable obligation
+
+    Returns {"drift": bool, "obligation": str|None, "detail": ...}."""
+    rec = ledger.get(capability_id)
+    if rec is None:
+        return {"drift": False, "obligation": None,
+                "detail": f"unknown capability {capability_id!r}"}
+    spec = rec.get("spec")
+    if spec is None:
+        return {"drift": False, "obligation": None,
+                "detail": "no spec attached — nothing to drift from"}
+    hist = spec.get("version_history") or []
+    covered = hist[-1].get("covers_material_revision", 0) if hist else 0
+    current = int(rec.get("material_revision", 0))
+    if current > covered:
+        return {
+            "drift": True,
+            "obligation": (
+                f"SPEC_VERSION_DRIFT: {capability_id} has "
+                f"{current - covered} uncovered material revision(s) "
+                f"(material rev {current} > governed rev {covered}) — "
+                f"run revise_spec (PATCH/MINOR/MAJOR) to close"),
+            "detail": {"material_revision": current,
+                       "governed_revision": covered,
+                       "spec_version": spec.get("version")},
+        }
+    return {"drift": False, "obligation": None,
+            "detail": {"material_revision": current,
+                       "governed_revision": covered,
+                       "spec_version": spec.get("version")}}
+
+
+def spec_context(rec: dict) -> dict:
+    """The spec half of a surgical context packet (§21M): WHY + WHAT
+    SHOULD EXIST, compact."""
+    s = rec.get("spec") or {}
+    return {
+        "capability_id": rec["capability_id"],
+        "version": s.get("version"),
+        "purpose": rec.get("purpose"),
+        "requirements": s.get("requirements", []),
+        "expected_behaviours": s.get("expected_behaviours", []),
+        "non_goals": s.get("non_goals", []),
+        "acceptance_criteria": s.get("acceptance_criteria", []),
+        "contract": rec.get("contract"),
+        "invariants": rec.get("invariants", []),
+        "behaviour_specs": rec.get("behaviour_specs", []),
+        "last_bump": (s.get("version_history") or [{}])[-1],
+    }

src/rune/complexity_scorer.py

@@ -1,602 +0,0 @@
-#!/usr/bin/env python3
-"""complexity_scorer.py — Auto-detection of task complexity for build mode.
-
-Scores user requests to determine if they need:
-- Task mode (0-3): direct execution
-- Task mode with planning (4-7): add planning step
-- Build mode (8+): full pipeline
-
-Research basis:
-- No existing tool does auto-detection (SWE-agent, Aider, Devin, Cursor, OpenCode)
-- Simple keyword scoring: zero cost for 90% of requests, LLM fallback for 10%
-- Agent reliability degrades 96% → 34% from 8K to 128K tokens (LOCA-bench, ICML 2026)
-- Single-file changes: ~80% success vs <50% for 4-6 files (SWE-bench)
-
-Usage:
-    complexity_scorer.py score "add user auth with JWT, update API routes, add tests"
-    complexity_scorer.py mode "fix the typo in README"
-"""
-
-import json
-import os
-import re
-import sys
-from dataclasses import dataclass, field, asdict
-from typing import List, Dict, Any, Optional
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# SIGNAL DEFINITIONS
-# ═══════════════════════════════════════════════════════════════════════════════
-
-# Request analysis signals (regex, zero cost)
-CONJUNCTIONS = ["and", "then", "also", "additionally", "after that", "plus", "as well as"]
-CROSS_SYSTEM_REFS = [
-    "api",
-    "frontend",
-    "backend",
-    "database",
-    "tests",
-    "config",
-    "ci",
-    "deploy",
-    "ui",
-    "cli",
-    "server",
-    "client",
-    "model",
-    "view",
-]
-ARCH_KEYWORDS = [
-    "refactor",
-    "migrate",
-    "redesign",
-    "pipeline",
-    "system",
-    "architecture",
-    "overhaul",
-    "restructure",
-    "reorganize",
-    "consolidate",
-]
-NEW_ABSTRACTION_KEYWORDS = [
-    "create a new",
-    "build a new",
-    "implement a new",
-    "add a new",
-    "new module",
-    "new system",
-    "new feature",
-    "new component",
-    "new service",
-    "new layer",
-]
-SCOPE_MODIFIERS = ["entire", "all", "every", "throughout", "comprehensive", "complete", "full", "whole", "across"]
-EXT_DEPENDENCY_KEYWORDS = [
-    "integrate",
-    "third-party",
-    "library",
-    "package",
-    "sdk",
-    "api",
-    "service",
-    "webhook",
-    "external",
-]
-COMPLEXITY_MARKERS = [
-    "complex",
-    "big change",
-    "major",
-    "significant",
-    "extensive",
-    "substantial",
-    "non-trivial",
-    "involved",
-]
-SIMPLE_FIX_INDICATORS = [
-    "fix typo",
-    "rename",
-    "update comment",
-    "change color",
-    "add import",
-    "remove import",
-    "fix whitespace",
-    "format",
-    "lint",
-    "bump version",
-    "update readme",
-    "fix comment",
-]
-
-# Build mode trigger keywords (high confidence)
-BUILD_TRIGGERS = [
-    "implement",
-    "build",
-    "create feature",
-    "refactor",
-    "migrate",
-    "across multiple files",
-    "new system",
-    "new module",
-    "overhaul",
-    "redesign",
-    "restructure",
-    "full pipeline",
-    "end-to-end",
-]
-
-# Task mode trigger keywords
-TASK_TRIGGERS = [
-    "fix",
-    "change",
-    "update",
-    "rename",
-    "bug",
-    "typo",
-    "error",
-    "crash",
-    "broken",
-    "not working",
-    "issue",
-    "patch",
-    "hotfix",
-]
-
-# Research mode trigger keywords
-RESEARCH_TRIGGERS = [
-    "how does",
-    "what is",
-    "explain",
-    "investigate",
-    "explore",
-    "research",
-    "understand",
-    "analyze",
-    "study",
-    "review",
-]
-
-# Plan mode trigger keywords
-PLAN_TRIGGERS = [
-    "plan",
-    "design",
-    "architecture",
-    "before we start",
-    "approach",
-    "strategy",
-    "roadmap",
-    "blueprint",
-    "spec",
-]
-
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# SCORING FUNCTIONS
-# ═══════════════════════════════════════════════════════════════════════════════
-
-
-@dataclass
-class ScoreBreakdown:
-    """Detailed breakdown of complexity score."""
-
-    request_analysis: int = 0
-    codebase_impact: int = 0
-    historical_patterns: int = 0
-    risk_assessment: int = 0
-    total: int = 0
-    signals: List[str] = field(default_factory=list)
-    mode: str = "task"
-    confidence: str = "high"  # high, medium, low
-
-
-def analyze_request_text(request: str) -> tuple[int, List[str]]:
-    """Analyze request text for complexity signals. Zero cost, <1ms."""
-    score = 0
-    signals = []
-    request_lower = request.lower()
-
-    # Multiple verbs/conjunctions
-    conjunction_matches = [c for c in CONJUNCTIONS if c in request_lower]
-    if len(conjunction_matches) >= 2:
-        score += 2
-        signals.append(f"Multiple conjunctions: {', '.join(conjunction_matches)}")
-    elif len(conjunction_matches) == 1:
-        score += 1
-        signals.append(f"Conjunction: {conjunction_matches[0]}")
-
-    # Cross-system references
-    system_matches = [s for s in CROSS_SYSTEM_REFS if s in request_lower]
-    if len(system_matches) >= 2:
-        score += 3
-        signals.append(f"Cross-system: {', '.join(system_matches)}")
-    elif len(system_matches) == 1:
-        score += 1
-        signals.append(f"System ref: {system_matches[0]}")
-
-    # Architecture keywords
-    arch_matches = [k for k in ARCH_KEYWORDS if k in request_lower]
-    if arch_matches:
-        score += 2
-        signals.append(f"Architecture: {', '.join(arch_matches)}")
-
-    # New abstraction keywords
-    new_matches = [k for k in NEW_ABSTRACTION_KEYWORDS if k in request_lower]
-    if new_matches:
-        score += 2
-        signals.append(f"New abstraction: {', '.join(new_matches)}")
-
-    # Scope modifiers
-    scope_matches = [s for s in SCOPE_MODIFIERS if s in request_lower]
-    if scope_matches:
-        score += 1
-        signals.append(f"Scope: {', '.join(scope_matches)}")
-
-    # External dependency mentions
-    ext_matches = [k for k in EXT_DEPENDENCY_KEYWORDS if k in request_lower]
-    if ext_matches:
-        score += 1
-        signals.append(f"External dep: {', '.join(ext_matches)}")
-
-    # Explicit complexity markers
-    complex_matches = [k for k in COMPLEXITY_MARKERS if k in request_lower]
-    if complex_matches:
-        score += 3
-        signals.append(f"Complexity marker: {', '.join(complex_matches)}")
-
-    # Simple fix indicators (negative score)
-    simple_matches = [k for k in SIMPLE_FIX_INDICATORS if k in request_lower]
-    if simple_matches:
-        score -= 3
-        signals.append(f"Simple fix: {', '.join(simple_matches)}")
-
-    return score, signals
-
-
-def estimate_codebase_impact(request: str, repo_path: str = "/mnt/workdrive/rune") -> tuple[int, List[str]]:
-    """Estimate codebase impact using grep/glob. ~100ms."""
-    score = 0
-    signals = []
-
-    # Extract potential module/function names from request
-    words = re.findall(r"\b[a-zA-Z_][a-zA-Z0-9_]*\b", request)
-    # Filter out common words
-    stop_words = {
-        "the",
-        "a",
-        "an",
-        "and",
-        "or",
-        "but",
-        "in",
-        "on",
-        "at",
-        "to",
-        "for",
-        "of",
-        "with",
-        "by",
-        "from",
-        "is",
-        "are",
-        "was",
-        "were",
-        "be",
-        "been",
-        "being",
-        "have",
-        "has",
-        "had",
-        "do",
-        "does",
-        "did",
-        "will",
-        "would",
-        "could",
-        "should",
-        "may",
-        "might",
-        "can",
-        "shall",
-        "that",
-        "which",
-        "who",
-        "whom",
-        "this",
-        "these",
-        "those",
-        "it",
-        "its",
-        "my",
-        "your",
-        "his",
-        "her",
-        "our",
-        "their",
-        "me",
-        "you",
-        "him",
-        "us",
-        "them",
-        "i",
-        "we",
-        "he",
-        "she",
-        "they",
-        "what",
-        "where",
-        "when",
-        "how",
-        "why",
-        "if",
-        "then",
-        "else",
-        "so",
-        "just",
-        "also",
-        "very",
-        "too",
-        "much",
-        "many",
-        "some",
-        "any",
-        "all",
-        "each",
-        "every",
-        "both",
-        "few",
-        "more",
-        "most",
-        "other",
-        "another",
-        "such",
-        "no",
-        "not",
-        "only",
-        "own",
-        "same",
-        "than",
-        "too",
-        "now",
-        "here",
-        "there",
-        "about",
-        "up",
-        "out",
-        "off",
-        "over",
-        "under",
-        "again",
-        "further",
-        "then",
-        "once",
-        "new",
-        "add",
-        "update",
-        "fix",
-        "change",
-        "make",
-        "create",
-        "build",
-        "implement",
-    }
-    potential_modules = [w for w in words if w.lower() not in stop_words and len(w) > 3]
-
-    # Check if any potential modules exist in codebase
-    if potential_modules:
-        try:
-            import subprocess
-
-            # Quick grep for potential module names
-            grep_pattern = "|".join(potential_modules[:5])  # Limit to 5 to avoid slow grep
-            result = subprocess.run(
-                ["grep", "-r", "-l", "-E", grep_pattern, os.path.join(repo_path, "src")],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-            if result.returncode == 0:
-                files = [f for f in result.stdout.strip().split("\n") if f]
-                if len(files) > 5:
-                    score += 3
-                    signals.append(f"Files likely affected: {len(files)}")
-                elif len(files) > 2:
-                    score += 1
-                    signals.append(f"Files possibly affected: {len(files)}")
-        except Exception:
-            pass
-
-    # Check for cross-module dependencies
-    if "src/rune" in repo_path:
-        try:
-            import subprocess
-
-            result = subprocess.run(
-                ["grep", "-r", "-c", "import", os.path.join(repo_path, "src/rune")],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-            if result.returncode == 0:
-                import_count = sum(
-                    int(line.split(":")[-1])
-                    for line in result.stdout.strip().split("\n")
-                    if ":" in line and line.split(":")[-1].strip().isdigit()
-                )
-                if import_count > 50:
-                    score += 2
-                    signals.append(f"High import density: {import_count} imports")
-        except Exception:
-            pass
-
-    return score, signals
-
-
-def check_historical_patterns(request: str) -> tuple[int, List[str]]:
-    """Check memory for similar past tasks. Returns score and signals."""
-    score = 0
-    signals = []
-
-    # Check if similar tasks needed build mode
-    try:
-        import sys
-
-        sys.path.insert(0, os.path.expanduser("~/.config/opencode/scripts"))
-        import memory_store
-
-        db = memory_store.connect()
-        try:
-            results = memory_store.cached_recall(db, f"build mode {request}", budget=3)
-            if results:
-                for r in results:
-                    text = r.get("text", "").lower()
-                    if "build mode" in text or "multi-step" in text or "complex" in text:
-                        score += 2
-                        signals.append("Similar past task needed build mode")
-                        break
-        finally:
-            db.close()
-    except Exception:
-        pass
-
-    return score, signals
-
-
-def assess_risk(request: str, repo_path: str = "/mnt/workdrive/rune") -> tuple[int, List[str]]:
-    """Assess risk based on file paths and content."""
-    score = 0
-    signals = []
-    request_lower = request.lower()
-
-    # Auth/security code
-    auth_keywords = ["auth", "security", "token", "credential", "password", "login", "session"]
-    if any(k in request_lower for k in auth_keywords):
-        score += 2
-        signals.append("Touches auth/security code")
-
-    # Data layer
-    data_keywords = ["database", "migration", "schema", "sql", "sqlite", "model", "orm"]
-    if any(k in request_lower for k in data_keywords):
-        score += 1
-        signals.append("Touches data layer")
-
-    # Public API
-    api_keywords = ["api", "endpoint", "route", "export", "interface", "sdk", "public"]
-    if any(k in request_lower for k in api_keywords):
-        score += 2
-        signals.append("Touches public API")
-
-    # Reversibility concern
-    destructive_keywords = ["delete", "remove", "drop", "destroy", "clear", "reset", "wipe"]
-    if any(k in request_lower for k in destructive_keywords):
-        score += 1
-        signals.append("Reversibility concern")
-
-    return score, signals
-
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# MAIN SCORING
-# ═══════════════════════════════════════════════════════════════════════════════
-
-
-def score_request(request: str, repo_path: str = "/mnt/workdrive/rune") -> ScoreBreakdown:
-    """Score a request for complexity. Returns ScoreBreakdown with total and mode."""
-    breakdown = ScoreBreakdown()
-
-    # Signal Category 1: Request Analysis (zero cost, <1ms)
-    req_score, req_signals = analyze_request_text(request)
-    breakdown.request_analysis = req_score
-    breakdown.signals.extend(req_signals)
-
-    # Signal Category 2: Codebase Impact (~100ms)
-    impact_score, impact_signals = estimate_codebase_impact(request, repo_path)
-    breakdown.codebase_impact = impact_score
-    breakdown.signals.extend(impact_signals)
-
-    # Signal Category 3: Historical Patterns
-    hist_score, hist_signals = check_historical_patterns(request)
-    breakdown.historical_patterns = hist_score
-    breakdown.signals.extend(hist_signals)
-
-    # Signal Category 4: Risk Assessment
-    risk_score, risk_signals = assess_risk(request, repo_path)
-    breakdown.risk_assessment = risk_score
-    breakdown.signals.extend(risk_signals)
-
-    # Calculate total
-    breakdown.total = (
-        breakdown.request_analysis
-        + breakdown.codebase_impact
-        + breakdown.historical_patterns
-        + breakdown.risk_assessment
-    )
-
-    # Determine mode
-    if breakdown.total >= 8:
-        breakdown.mode = "build"
-        breakdown.confidence = "high"
-    elif breakdown.total >= 4:
-        breakdown.mode = "task_with_planning"
-        breakdown.confidence = "medium"
-    else:
-        breakdown.mode = "task"
-        breakdown.confidence = "high"
-
-    # Check for explicit mode triggers
-    request_lower = request.lower()
-    if any(t in request_lower for t in BUILD_TRIGGERS):
-        if breakdown.mode != "build":
-            breakdown.mode = "build"
-            breakdown.confidence = "high"
-            breakdown.signals.append("Explicit build trigger detected")
-    elif any(t in request_lower for t in RESEARCH_TRIGGERS):
-        breakdown.mode = "research"
-        breakdown.confidence = "high"
-        breakdown.signals.append("Research trigger detected")
-    elif any(t in request_lower for t in PLAN_TRIGGERS):
-        breakdown.mode = "plan"
-        breakdown.confidence = "high"
-        breakdown.signals.append("Plan trigger detected")
-
-    return breakdown
-
-
-def get_mode(request: str, repo_path: str = "/mnt/workdrive/rune") -> str:
-    """Get the recommended mode for a request. Returns mode string."""
-    breakdown = score_request(request, repo_path)
-    return breakdown.mode
-
-
-def get_score(request: str, repo_path: str = "/mnt/workdrive/rune") -> Dict[str, Any]:
-    """Get detailed score breakdown. Returns dict."""
-    breakdown = score_request(request, repo_path)
-    return asdict(breakdown)
-
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# CLI
-# ═══════════════════════════════════════════════════════════════════════════════
-
-
-def main():
-    if len(sys.argv) < 3:
-        print("Usage: complexity_scorer.py [score|mode] <request>")
-        sys.exit(1)
-
-    cmd = sys.argv[1]
-    request = " ".join(sys.argv[2:])
-
-    if cmd == "score":
-        result = get_score(request)
-        print(json.dumps(result, indent=2))
-
-    elif cmd == "mode":
-        mode = get_mode(request)
-        print(mode)
-
-    else:
-        print(f"Unknown command: {cmd}")
-        sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()

src/rune/construction_activation.py

@@ -0,0 +1,237 @@
+"""construction_activation.py — the activation dispatcher.
+
+SCAFFOLD-TRANCHE-0011. §3: NOT another planner/router/engine. Given an
+evidence-backed ConstructionMode, start/resume the correct Scaffolding
+lifecycle. ONE activation authority; consumers: Rune native backend path,
+Construction Interface (MiMo/other builders), manual operator override.
+
+Mode dispatch (tranche brief §4/§7/§8/§9/§10):
+
+    NOT_CONSTRUCTION   → no Scaffolding state touched (§10)
+    LOCAL_CHANGE       → bounded governance via the existing project's
+                         authority; Construction Contract only if policy
+                         requires; no Project Scaffold bootstrap (§7)
+    EXISTING_PROJECT_CHANGE
+                       → attach to the existing project authority (Rune
+                         Spine for Rune; bound Project Scaffold otherwise);
+                         full proportional lifecycle (§8) — never a new
+                         project (§1 existence evidence governs)
+    PROJECT_BUILD      → actually bootstrap: provisional Project Scaffold
+                         initialized with UNKNOWN fields explicit (§6/§7) —
+                         repository: undecided, toolchain: unresolved —
+                         progressive refinement, nothing manufactured
+    UNKNOWN            → NO activation; return evidence gaps + probe
+                         questions (§9)
+
+Persistence discipline (§21): every state mutation goes through
+Scaffold.commit() (save + readback verify) BEFORE any accounting.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from rune import structural_store as ss
+from rune import scaffold as sc
+from rune import construction_mode as cm
+
+__all__ = ["activate"]
+
+
+def _scaffold_for(project: str, *, create: bool, parent_scaffold: sc.Scaffold | None = None) -> sc.Scaffold | None:
+    """Resolve the Project Scaffold store for a project (§1 evidence:
+    existence comes from a bound store on disk, not from the name).
+    Location derives from the PARENT scaffold's store directory — no
+    hardcoded relative path (T11 fix: activation under a tmp/fixture parent
+    must write the fixture root, not the repo's store)."""
+    parent_dir = parent_scaffold.current.parent if parent_scaffold else Path("store/scaffold")
+    base = parent_dir / "projects" / project
+    current = base / "current.json"
+    if current.is_file():
+        return sc.Scaffold(base, project)
+    if create:
+        return sc.Scaffold(base, project)
+    return None
+
+
+def activate(mode_decision, *, need, scaffold: sc.Scaffold, builder: str = "rune") -> dict:
+    """Dispatch on the evidence-backed mode; return an activation record
+    (mode, project authority, actions taken, context ref). The NEED must
+    already be classified — UNKNOWN never reaches here without explicit
+    operator override carried in mode_decision."""
+    mode = mode_decision.mode
+    rec: dict = {
+        "mode": mode,
+        "builder": builder,
+        "target_project": mode_decision.target_project,
+        "evidence": list(mode_decision.evidence),
+    }
+
+    if mode == "NOT_CONSTRUCTION":
+        # §10: no Scaffolding state touched
+        rec["activated"] = False
+        rec["reason"] = "non-construction intent — no construction state"
+        return rec
+
+    if mode == "UNKNOWN":
+        # §9: no activation; probe questions surface
+        rec["activated"] = False
+        rec["reason"] = "insufficient evidence — clarification required; no Project Scaffold initialized"
+        rec["probe_questions"] = mode_decision.probe_questions
+        rec["clarification_required"] = True
+        return rec
+
+    if mode == "LOCAL_CHANGE":
+        # §7: governance without ceremony — reuse the existing project's
+        # authority; the lightest contract path (caller decides policy);
+        # NO new Project Scaffold bootstrap
+        rec["activated"] = True
+        rec["lifecycle"] = "bounded"
+        rec["project_authority"] = mode_decision.project_authority or "rune_internal"
+        rec["note"] = "bounded governance via existing authority — no Project Scaffold bootstrap"
+        return rec
+
+    if mode == "EXISTING_PROJECT_CHANGE":
+        # §8: attach to the existing authority — never a new project.
+        # Existence was already proven structurally (T11 §1) before this
+        # mode was selected.
+        rec["activated"] = True
+        rec["lifecycle"] = "proportional"
+        rec["project_authority"] = mode_decision.project_authority or "rune_internal"
+        rec["note"] = (
+            "attached to existing project authority; Need/completeness/patterns/contract flow governs proportionally"
+        )
+        return rec
+
+    if mode == "PROJECT_BUILD":
+        # §6/§7: actually bootstrap. Provisional Project Scaffold with
+        # explicit UNKNOWN fields; identity before repository (§7).
+        project = mode_decision.target_project or need.project
+        if not project:
+            # Rune-originated Needs may carry no project identity (§18):
+            # derive a stable provisional id from the objective — the
+            # bootstrap is provisional and renameable before any repo
+            # exists (§7 identity before repository).
+            import re as _re
+
+            slug = _re.sub(r"[^a-z0-9]+", "-", need.objective.lower()).strip("-")[:48]
+            project = slug or "unnamed-project"
+        ps = _scaffold_for(project, create=True, parent_scaffold=scaffold)
+        assert ps is not None
+        pdoc = ps.load()
+        if ss.entity(pdoc, f"project:{project}") is None:
+            ps.init(purpose=need.objective)  # init persists its own doc
+            pdoc = ps.load()  # §21: reload after persistence
+        structural = ss.entity(pdoc, f"project:{project}")
+        assert structural is not None
+        # explicit UNKNOWN fields — nothing manufactured (§6/§10)
+        structural.setdefault("ext", {}).update(
+            {
+                "bootstrap": "initialized",
+                "repository": "undecided",
+                "toolchain": "unresolved",
+                "deployment": "unknown",
+                "requirement_gaps": list(mode_decision.probe_questions)
+                or ["target platform unknown", "requirements not yet refined"],
+                "bootstrap_started_at": ss.now(),
+                "origin_need": need.need_id,
+                "origin_builder": builder,
+            }
+        )
+        ps.commit(pdoc, what=f"PROJECT_BUILD bootstrap: {project}")
+        awareness = _auto_structural_awareness(project, ps, scaffold)
+        rec.update(
+            {
+                "activated": True,
+                "lifecycle": "project_build",
+                "project": project,
+                "project_scaffold": str(ps.current),
+                "structural_awareness": awareness,
+                "bootstrap": "initialized",
+                "repository": "undecided",
+                "toolchain": "unresolved",
+                "deployment": "unknown",
+                "requirement_gaps": structural["ext"]["requirement_gaps"],
+                "next_action": ("refine requirements; resolve toolchain/repo decisions via evidence (approval-gated)"),
+            }
+        )
+        return rec
+
+    rec["activated"] = False
+    rec["reason"] = f"unhandled mode {mode}"
+    return rec
+
+
+def _auto_structural_awareness(project: str, project_scaffold: sc.Scaffold,
+                               parent_scaffold: sc.Scaffold) -> dict:
+    """T21.5 §9 (rule 19Q family): governed adoption/construction expands
+    Rune's persistent structural world-model AUTOMATICALLY — no manual
+    Registry/Spine bookkeeping step. Boundaries preserved:
+      - Registry = discovery/index (that the project exists, where its
+        canonical Scaffold lives) — never project internals;
+      - Spine = Rune's relationship TO the project (one edge, builds/
+        manages vocabulary) — project modules stay in the Project
+        Scaffold (never duplicated into Spine);
+      - Project Scaffold remains canonical for the project's internals.
+    Failure-tolerant: awareness must not break the bootstrap (recorded
+    in the return, not raised)."""
+    result: dict = {"registry": "skipped", "spine": "skipped"}
+    try:
+        from rune.project_registry import ProjectRegistry
+        store_dir = parent_scaffold.current.parent
+        registry = ProjectRegistry(store_dir)
+        if registry.get(project) is None:
+            registry.register(
+                project_id=project,
+                scaffold_location=str(project_scaffold.current.parent),
+                repo_identity="",   # undecided at bootstrap (identity
+                                    # before repository — never invented)
+            )
+            registry.save()
+            result["registry"] = "registered"
+    except (OSError, ValueError) as exc:
+        result["registry"] = f"error: {exc!s:.120}"
+    try:
+        from rune import spine as spine_mod
+        spine_path = parent_scaffold.current.parent.parent / "spine" / "current.json"
+        sdoc = spine_mod.load(spine_path)
+        if sdoc is not None:
+            spine_mod.add_relationship(
+                sdoc, type="manages",
+                from_id="project:rune", to_id=f"project:{project}",
+                evidence_refs=[f"project-build-bootstrap:{project}"])
+            spine_mod.save(sdoc, spine_path)
+            result["spine"] = "recorded"
+    except (OSError, ValueError) as exc:
+        result["spine"] = f"error: {exc!s:.120}"
+    return result
+
+
+def dispatch_from_decision(trace: dict, *, need, scaffold: sc.Scaffold, builder: str = "rune") -> dict:
+    """§15: read the mode from a make_decision trace and dispatch. The
+    shared Construction Context then derives from the SAME canonical state
+    — no duplicate machines."""
+    mode_decision = trace.get("mode_decision")
+    if mode_decision is None:
+        # T21.5 fix: activate() expects the mode_decision object (with
+        # .mode/.target_project/.evidence); the trace carries its dict
+        # form, so reconstruct a ConstructionMode from it.
+        from rune.construction_mode import ConstructionMode
+        md = trace.get("construction_mode", {}) or {}
+        if md.get("mode", "UNKNOWN") == "UNKNOWN":
+            md = dict(md)
+            md["mode"] = "UNKNOWN"
+        mode_decision = ConstructionMode(
+            mode=md.get("mode", "UNKNOWN"),
+            evidence=list(md.get("evidence", [])),
+            target_project=md.get("target_project"),
+            project_authority=md.get("project_authority"),
+            confidence=md.get("confidence", 0.0),
+            clarification_required=md.get("clarification_required", False),
+            probe_questions=list(md.get("probe_questions", [])),
+            bootstrap_required=md.get("bootstrap_required", False),
+            override=md.get("override"),
+            proposed_by_model=md.get("proposed_by_model"),
+        )
+    return activate(mode_decision, need=need, scaffold=scaffold, builder=builder)

src/rune/construction_commands.py

@@ -0,0 +1,173 @@
+"""construction_commands.py — T16 §16J: bounded validated inbound
+command interface for future Substrate integration.
+
+The future Substrate ASKS; Scaffolding DECIDES. Every command:
+
+  - carries identity (command_id, correlation_id, construction_id)
+  - is validated by Scaffolding against the existing lifecycle
+    (LEGAL_TRANSITIONS — no new lifecycle invented)
+  - cannot directly mutate storage (commands return validated intents;
+    the Construction Interface executes them through its own governed
+    path — the caller never writes the store)
+  - is idempotent where applicable (repeat delivery of the same
+    command_id returns the same recorded outcome)
+
+Only commands that fit EXISTING semantics safely are exposed. PAUSE and
+CANCEL are intentionally NOT exposed: the lifecycle has no paused phase
+and abandonment needs user provenance — a future Substrate asking for
+them gets a refusal, not a half-measure.
+"""
+from __future__ import annotations
+
+import time
+import uuid
+
+from rune.scaffold import LEGAL_TRANSITIONS
+
+COMMANDS = (
+    "REQUEST_STATE", "START", "RESUME", "ACKNOWLEDGE_BLOCKER",
+    "PROVIDE_APPROVAL", "PROVIDE_CONTEXT",
+)
+
+# Command → the interface operation it asks for (the interface still
+# decides: validation failures return refused, never raise into storage).
+_COMMAND_TO_OP = {
+    "REQUEST_STATE": "resume",       # read-only state projection
+    "START": "transition",           # draft → approved (then building)
+    "RESUME": "resume",              # re-read canonical state
+    "ACKNOWLEDGE_BLOCKER": "transition",  # blocked → building (retry path)
+    "PROVIDE_APPROVAL": "transition",     # draft → approved with provenance
+    "PROVIDE_CONTEXT": "amend_scope",     # context arrives as scope amendment
+}
+
+# In-memory idempotency ledger: command_id → recorded outcome. The
+# Scaffolding lifecycle is the authority; this ledger only makes repeat
+# delivery return the same answer (no double transition).
+_outcomes: dict[str, dict] = {}
+
+
+def command(command_type: str, *, construction_id: str,
+            correlation_id: str = "", command_id: str = "",
+            payload: dict | None = None,
+            scaffold=None) -> dict:
+    """Validate an inbound command. Returns a validated intent envelope:
+
+      {"accepted": True, "op": <interface op>, "args": {...},
+       "command_id": ..., "idempotent_replay": bool}
+
+    or {"accepted": False, "reason": ...}. The caller executes the intent
+    through the Construction Interface — it never touches storage."""
+    payload = payload or {}
+    command_id = command_id or f"cmd-{uuid.uuid4().hex[:8]}"
+    if command_id in _outcomes:
+        prior = dict(_outcomes[command_id])
+        prior["idempotent_replay"] = True
+        return prior
+    if command_type not in COMMANDS:
+        return _refuse(command_id, construction_id, correlation_id,
+                       f"unknown command {command_type!r} "
+                       f"(supported: {', '.join(COMMANDS)})")
+    if not construction_id:
+        return _refuse(command_id, construction_id, correlation_id,
+                       "construction_id is required")
+    intent = _validate(command_type, construction_id,
+                       correlation_id, command_id, payload, scaffold)
+    _outcomes[command_id] = intent
+    return intent
+
+
+def _refuse(command_id: str, construction_id: str,
+            correlation_id: str, reason: str) -> dict:
+    return {"accepted": False, "reason": reason,
+            "command_id": command_id, "construction_id": construction_id,
+            "correlation_id": correlation_id,
+            "recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                         time.gmtime()),
+            "idempotent_replay": False}
+
+
+def _validate(command_type: str, construction_id: str,
+              correlation_id: str, command_id: str,
+              payload: dict, scaffold) -> dict:
+    """Validate against the CURRENT canonical state — the lifecycle
+    decides, not the requester. The scaffold (canonical store handle) is
+    supplied by the serving layer; the client only ever sees the returned
+    envelope, never the store."""
+    if scaffold is None:
+        return _refuse(command_id, construction_id, correlation_id,
+                       "no serving scaffold bound (server-side wiring)")
+    doc = scaffold.load()
+    contract = None
+    for e in doc.get("entities", []):
+        if e.get("id") == f"contract:{construction_id}":
+            contract = e
+            break
+    if contract is None:
+        return _refuse(command_id, construction_id, correlation_id,
+                       f"unknown construction {construction_id!r}")
+    phase = contract.get("phase", "")
+
+    if command_type == "REQUEST_STATE":
+        return _accept(command_id, construction_id, correlation_id,
+                       "resume", {"contract_id": construction_id})
+    if command_type == "RESUME":
+        if phase in ("closed", "abandoned"):
+            return _refuse(command_id, construction_id, correlation_id,
+                           f"construction is {phase} — resume is invalid")
+        return _accept(command_id, construction_id, correlation_id,
+                       "resume", {"contract_id": construction_id})
+    if command_type == "START":
+        if phase != "draft":
+            return _refuse(command_id, construction_id, correlation_id,
+                           f"START requires draft phase (current: {phase})")
+        return _accept(command_id, construction_id, correlation_id,
+                       "transition",
+                       {"contract_id": construction_id,
+                        "phase": "approved"})
+    if command_type == "PROVIDE_APPROVAL":
+        if phase != "draft":
+            return _refuse(command_id, construction_id, correlation_id,
+                           f"approval applies to draft (current: {phase})")
+        if payload.get("approved_by") != "user":
+            # lifecycle rule: approval provenance must be the user —
+            # Substrate cannot approve on the user's behalf
+            return _refuse(command_id, construction_id, correlation_id,
+                           "approval provenance must be user "
+                           "(Substrate cannot approve for the user)")
+        return _accept(command_id, construction_id, correlation_id,
+                       "transition",
+                       {"contract_id": construction_id,
+                        "phase": "approved",
+                        "approved_by": "user"})
+    if command_type == "ACKNOWLEDGE_BLOCKER":
+        if phase not in ("failed", "building", "verifying"):
+            return _refuse(command_id, construction_id, correlation_id,
+                           f"no blockable phase (current: {phase})")
+        return _accept(command_id, construction_id, correlation_id,
+                       "transition",
+                       {"contract_id": construction_id,
+                        "phase": "building"})
+    if command_type == "PROVIDE_CONTEXT":
+        paths = payload.get("add_paths") or []
+        if not paths:
+            return _refuse(command_id, construction_id, correlation_id,
+                           "PROVIDE_CONTEXT requires add_paths")
+        return _accept(command_id, construction_id, correlation_id,
+                       "amend_scope",
+                       {"contract_id": construction_id,
+                        "add_paths": paths,
+                        "reason": payload.get("reason", "substrate context"),
+                        "authority": "user"
+                        if payload.get("approved_by") == "user" else "substrate"})
+    return _refuse(command_id, construction_id, correlation_id,
+                   "unreachable validator branch")
+
+
+def _accept(command_id: str, construction_id: str, correlation_id: str,
+            op: str, args: dict) -> dict:
+    return {"accepted": True, "op": op, "args": args,
+            "command_id": command_id, "construction_id": construction_id,
+            "correlation_id": correlation_id,
+            "recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                         time.gmtime()),
+            "idempotent_replay": False}

src/rune/construction_decision.py

@@ -0,0 +1,937 @@
+"""construction_decision.py — live Need → Decision → Construction Contract.
+
+SCAFFOLD-TRANCHE-004: the adoption layer that turns the Tranche 2/3
+mechanisms into a durable procedure Rune no longer has to remember.
+
+    NEED (references Task/Intent — never duplicates them)
+      ↓ normalize_need()                missing info is NOT invented
+      ↓ discover + fit per authority    (deterministic; Spine + Project Scaffold)
+      ↓ resolve per authority + merge   (capability_fit resolution surface)
+      ↓ resolve_toolchain()             (existing project toolchain wins)
+      ↓ layout obligations              (LOCKED authority inherited)
+      ↓ approval gate                   (material changes → user)
+      ↓ DecisionTrace (durable, model-independent)
+      ↓ generate_contract()             (populated from the trace)
+
+Boundaries (brief §3, §32, §33):
+    - NOT a task engine: Need carries a reference to the existing Task/Intent
+      authority; Scaffolding never becomes the "why" authority.
+    - NOT a workflow engine: one decision function, one trace object.
+    - NOT a research pipeline: insufficient evidence routes to a recorded
+      research path (seam) — the live ADAPT wiring is a recorded route, not
+      an executed pipeline call (honest seam, §6).
+    - NOT a structural authority: it reads Spine/Project Scaffold and
+      WRITES only Construction Contracts + decision traces.
+    - BUILD_NEW is never a fallback (§8): merge precedence and the
+      insufficient-evidence invariant of capability_fit enforce it.
+"""
+
+from __future__ import annotations
+
+from rune import capability_fit as cf
+from rune import toolchain as tc
+from rune.structural_store import relationships
+
+__all__ = ["Need", "make_decision", "generate_contract", "merge_resolutions"]
+
+
+# ── Need intake (§4) ───────────────────────────────────────────────────────
+
+
+class Need:
+    """Construction-decision input. References — does not copy — the
+    existing Task/Intent authority (`task_ref` is a pointer, not a copy).
+    Carries no task state of its own: it is WHY-adjacent input to Scaffolding,
+    not a backlog entry."""
+
+    def __init__(
+        self,
+        need_id: str,
+        objective: str,
+        *,
+        origin: str = "user",
+        project: str = "rune",
+        task_ref: str = "",
+        constraints: dict | None = None,
+        affected_surface: list[str] | None = None,
+        evidence_refs: list[str] | None = None,
+        approval_context: str = "",
+        requested_permanence: str = "",
+    ):
+        if not need_id:
+            raise ValueError("need_id required")
+        if not objective:
+            raise ValueError("objective (required effect) required — do not normalize a need we cannot state")
+        self.need_id = need_id
+        self.objective = objective
+        self.origin = origin
+        self.project = project
+        self.task_ref = task_ref
+        self.constraints = dict(constraints or {})
+        self.affected_surface = list(affected_surface or [])
+        self.evidence_refs = list(evidence_refs or [])
+        self.approval_context = approval_context
+        self.requested_permanence = requested_permanence
+
+    def to_dict(self) -> dict:
+        return {
+            "need_id": self.need_id,
+            "objective": self.objective,
+            "origin": self.origin,
+            "project": self.project,
+            "task_ref": self.task_ref,
+            "constraints": dict(self.constraints),
+            "affected_surface": list(self.affected_surface),
+            "evidence_refs": list(self.evidence_refs),
+            "approval_context": self.approval_context,
+            "requested_permanence": self.requested_permanence,
+        }
+
+
+# ── requirement normalization (§5) ─────────────────────────────────────────
+
+
+def normalize_need(need: Need) -> tuple[cf.CapabilityRequirement, list[str]]:
+    """Derive the CapabilityRequirement WITHOUT inventing facts. Contracts
+    may come from explicit constraints (`contracts` key) or from contract-
+    shaped entries on the affected surface (`contract:x` ids). Everything
+    not determinable lands in `missing` — the caller records it and the
+    resolution degrades to INSUFFICIENT_EVIDENCE rather than guessing."""
+    contracts = sorted(need.constraints.get("contracts", []))
+    contracts += sorted(a for a in need.affected_surface if a.startswith("contract:"))
+    missing = []
+    if need.constraints.get("environment"):
+        pass  # carried through
+    else:
+        missing.append("environment")
+    if not need.evidence_refs:
+        missing.append("evidence_refs")
+    req = cf.CapabilityRequirement(
+        need.objective,
+        contracts=contracts,
+        environment=need.constraints.get("environment", {}),
+        target_project=need.project,
+        source_need=need.need_id,
+        task_ref=need.task_ref,
+        requested_permanence=need.requested_permanence,
+        **{k: v for k, v in need.constraints.items() if k not in ("contracts", "environment")},
+    )
+    return req, missing
+
+
+# ── affected-surface classification + resolution (Tranche 5 §3-5) ──────────
+
+_SURFACE_UI = "ui:"
+_SURFACE_REGION = "region:"
+_SURFACE_CONTRACT = "contract:"
+_SURFACE_MODULE = "module:"
+
+
+def classify_surface(surface: str) -> str:
+    """Classify one affected-surface entry (open-world; Tranche 5 §3).
+    Kinds: structural_entity | source_path | workflow_config | ui_component |
+    layout_region | unresolved. Never drops an entry — unresolved is a
+    first-class kind."""
+    if surface.startswith((_SURFACE_UI,)):
+        return "ui_component"
+    if surface.startswith((_SURFACE_REGION,)):
+        return "layout_region"
+    if surface.startswith(
+        (
+            _SURFACE_CONTRACT,
+            _SURFACE_MODULE,
+            _SURFACE_CAPABILITY,
+        )
+    ):
+        return "structural_entity"
+    if surface.endswith(".yml") or surface.endswith(".yaml") or surface.endswith(".json") or surface.endswith(".toml"):
+        return "workflow_config"
+    if (
+        surface.endswith((".py", ".js", ".ts", ".jsx", ".tsx", ".rs",
+                          ".md", ".go", ".java", ".c", ".cpp", ".h",
+                          ".css", ".html", ".yaml", ".yml",
+                          ".mjs", ".cjs", ".mts", ".cts"))
+        or "/" in surface
+    ):
+        return "source_path"
+    return "unresolved"
+
+
+_SURFACE_CAPABILITY = "capability:"
+
+
+def resolve_surface(surface: str, kind: str, authorities: dict[str, dict]) -> dict:
+    """Deterministically resolve one surface against the structural
+    authorities (Tranche 5 §5). No Memory, no LLM archaeology: identity
+    lookups and recorded path->module mappings only.
+
+    Returns {surface, kind, resolved: [...], unresolved_reason: ""}.
+    resolved entries: {entity_id, authority, via} where via records HOW the
+    mapping was established (identity | path_attribute | provides)."""
+    out = {"surface": surface, "kind": kind, "resolved": [], "unresolved_reason": ""}
+    if kind == "structural_entity":
+        for name, doc in authorities.items():
+            e = ss_entity(doc, surface)
+            if e is not None:
+                out["resolved"].append({"entity_id": surface, "authority": name, "via": "identity"})
+                break
+        if not out["resolved"]:
+            out["unresolved_reason"] = "entity id not found in any authority"
+    elif kind == "source_path":
+        # path -> module via recorded identities.path in any authority
+        for name, doc in authorities.items():
+            for e in doc["entities"]:
+                p = e.get("identities", {}).get("path", "")
+                if p and (p == surface or p.endswith("/" + surface) or surface.endswith(p)):
+                    out["resolved"].append({"entity_id": e["id"], "authority": name, "via": "path_attribute"})
+        if not out["resolved"]:
+            out["unresolved_reason"] = "no authority records this path as an entity (path remains file-scope only)"
+    elif kind == "ui_component":
+        for name, doc in authorities.items():
+            cid = surface if surface.startswith("ui:") else f"ui:{surface}"
+            e = ss_entity(doc, f"layout:{cid}")
+            if e is not None:
+                out["resolved"].append({"entity_id": f"layout:{cid}", "authority": name, "via": "layout_contract"})
+        if not out["resolved"]:
+            out["unresolved_reason"] = "no Layout Contract bound for component"
+    elif kind == "layout_region":
+        for name, doc in authorities.items():
+            e = ss_entity(doc, surface if surface.startswith("region:") else f"region:{surface}")
+            if e is not None:
+                out["resolved"].append({"entity_id": e["id"], "authority": name, "via": "identity"})
+        if not out["resolved"]:
+            out["unresolved_reason"] = "region not defined in any authority"
+    else:
+        out["unresolved_reason"] = f"kind {kind} has no deterministic resolver"
+    return out
+
+
+def ss_entity(doc: dict, eid: str):
+    from rune.structural_store import entity as _e
+
+    return _e(doc, eid)
+
+
+def implemented_contracts(doc: dict, entity_id: str) -> list[str]:
+    """Contracts an entity implements/exposes/provides (structural fact)."""
+    out = []
+    for r in relationships(doc, from_id=entity_id):
+        if r["type"] in {"implements", "exposes", "provides", "serves"}:
+            out.append(r["to"])
+    return sorted(out)
+
+
+def resolve_affected_surface(need: Need, authorities: dict[str, dict]) -> dict:
+    """Classify + resolve the WHOLE affected surface (Tranche 5 §3-5, §13).
+    Produces the propagated representation the generated contract carries:
+        affected_existing_entities  structural ids (resolved)
+        affected_paths              file-scope entries (mechanical scope)
+        affected_ui_surfaces        ui components / regions found
+        unresolved_surfaces         retained, never dropped
+    File scope != structural impact: a path stays a path for scope checking
+    even when it also resolves to a module entity (no authority duplication)."""
+    result = {
+        "affected_existing_entities": [],
+        "affected_paths": [],
+        "affected_ui_surfaces": [],
+        "affected_regions": [],
+        "workflow_config_surfaces": [],
+        "unresolved_surfaces": [],
+        "resolutions": [],
+    }
+    for surface in need.affected_surface:
+        kind = classify_surface(surface)
+        res = resolve_surface(surface, kind, authorities)
+        result["resolutions"].append(res)
+        if kind == "source_path":
+            result["affected_paths"].append(surface)
+        elif kind == "workflow_config":
+            result["workflow_config_surfaces"].append(surface)
+        elif kind == "ui_component":
+            result["affected_ui_surfaces"].append(surface)
+        elif kind == "layout_region":
+            result["affected_regions"].append(surface)
+        for r in res["resolved"]:
+            eid = r["entity_id"]
+            if eid not in result["affected_existing_entities"] and not eid.startswith("layout:"):
+                result["affected_existing_entities"].append(eid)
+        if res["unresolved_reason"] and not res["resolved"]:
+            result["unresolved_surfaces"].append({"surface": surface, "kind": kind, "reason": res["unresolved_reason"]})
+    for k in (
+        "affected_existing_entities",
+        "affected_paths",
+        "affected_ui_surfaces",
+        "affected_regions",
+        "workflow_config_surfaces",
+    ):
+        result[k] = sorted(set(result[k]))
+
+    # §9/§17 DERIVED EXPECTATION (structural consequence, not invention): a
+    # Rune test path (tests/test_<name>.py) affected by the work implies the
+    # "test:<name>" surface participates in the build. Derived only when not
+    # already an existing entity nor explicitly declared; provenance records
+    # the derivation for closure accounting.
+    derived = []
+    for surface in need.affected_surface:
+        if surface.startswith("tests/test_") and surface.endswith(".py"):
+            stem = surface[len("tests/test_") : -len(".py")]
+            test_entity = f"test:{stem}"
+            exists = any(ss_entity(doc, test_entity) is not None for doc in authorities.values())
+            if test_entity not in need.constraints.get("expected_new_entities", []) and not exists:
+                derived.append(
+                    {
+                        "entity": test_entity,
+                        "derived_from": surface,
+                        "rule": "Rune test-path convention: tests/test_<name>.py implies "
+                        "the test:<name> surface participates in the build",
+                        "evidence": f"affected_surface entry {surface}",
+                    }
+                )
+    result["derived_expected_new"] = derived
+    return result
+
+
+# ── requirement completeness gate (Tranche 5 §6-9) ──────────────────────────
+
+COMPLETE_ENOUGH = "COMPLETE_ENOUGH"
+MATERIAL_GAP = "MATERIAL_GAP"
+COMPLETENESS_UNKNOWN = "UNKNOWN"
+
+
+def check_completeness(
+    req: cf.CapabilityRequirement, need: Need, authorities: dict[str, dict], surface_result: dict
+) -> dict:
+    """Bounded, structure-grounded completeness check run BEFORE fit.
+
+    Rule (deterministic, no model vibes): every affected-surface entry that
+    resolves to a structural entity contributes that entity's IMPLEMENTED
+    contracts to the requirement's material scope. If an affected entity
+    implements contracts NOT represented in the normalized requirement, the
+    requirement is materially incomplete — the need touches a component
+    whose obligations it has not stated. That is exactly the deploy-incident
+    shape: the affected promotion implementation carried an unrepresented
+    ordering contract while the requirement named only qualification.
+
+    Verdicts (Tranche 5 §8):
+        COMPLETE_ENOUGH  all affected entities' contracts are represented
+                         (or none implement contracts) — fit may proceed
+        MATERIAL_GAP     uncovered implemented contracts exist on affected
+                         entities — named with provenance, routed to probe
+        UNKNOWN          no surface resolved — completeness undeterminable;
+                         never silently COMPLETE (§8)
+
+    Derived requirements (§9) are structural consequences, not inventions:
+    each uncovered contract carries derived_from (the entity that
+    implements it) + evidence (the implements relationship) + rule.
+    """
+    gaps = []
+    resolved_any = False
+    for res in surface_result["resolutions"]:
+        for r in res["resolved"]:
+            resolved_any = True
+            for name, doc in authorities.items():
+                e = ss_entity(doc, r["entity_id"])
+                if e is None:
+                    continue
+                for contract in implemented_contracts(doc, r["entity_id"]):
+                    if contract not in req.contracts:
+                        gaps.append(
+                            {
+                                "missing_contract": contract,
+                                "derived_from": r["entity_id"],
+                                "surface": res["surface"],
+                                "authority": name,
+                                "rule": "affected-surface entity implements a "
+                                "contract not represented in the "
+                                "normalized requirement",
+                                "evidence": f"{r['entity_id']} implements {contract} (authority: {name})",
+                            }
+                        )
+            break  # entity found in one authority is enough
+    if gaps:
+        # dedupe by (missing_contract, derived_from)
+        seen = set()
+        unique = []
+        for g in gaps:
+            key = (g["missing_contract"], g["derived_from"])
+            if key not in seen:
+                seen.add(key)
+                unique.append(g)
+        return {
+            "verdict": MATERIAL_GAP,
+            "gaps": sorted(unique, key=lambda g: (g["missing_contract"], g["derived_from"])),
+            "probe_questions": [
+                f"does the need's stated failure implicate {g['derived_from']}'s {g['missing_contract']} obligation?"
+                for g in unique[:5]
+            ],
+            "note": "MATERIAL_GAP: affected surface carries obligations "
+            "the requirement does not represent — refine before "
+            "trusting an apparently-complete fit",
+        }
+    if resolved_any:
+        return {
+            "verdict": COMPLETE_ENOUGH,
+            "gaps": [],
+            "probe_questions": [],
+            "note": "all resolved affected entities' implemented contracts are represented in the requirement",
+        }
+    return {
+        "verdict": COMPLETENESS_UNKNOWN,
+        "gaps": [],
+        "probe_questions": [f"which structural entities does '{s}' map to?" for s in need.affected_surface[:5]],
+        "note": "no affected surface resolved — completeness undeterminable; UNKNOWN never silently becomes COMPLETE",
+    }
+
+
+def record_proposed_requirement(
+    contract_id: str, *, provider: str, model: str, evidence: list[str], confidence: float
+) -> dict:
+    """Record a MODEL-PROPOSED requirement addition (Tranche 5 §12). It is
+    evidence with a verification state — never structural authority by
+    itself. It becomes accepted only via existing authority, research
+    evidence, implementation evidence, or explicit user decision; until
+    then normalize_need excludes it from the requirement's contract set."""
+    if not provider or not model:
+        raise ValueError("model-proposed requirement requires provider+model")
+    if not 0.0 <= confidence <= 1.0:
+        raise ValueError("confidence must be in [0,1]")
+    return {
+        "kind": "model_proposed_requirement",
+        "contract": contract_id,
+        "provider": provider,
+        "model": model,
+        "evidence": sorted(evidence),
+        "confidence": confidence,
+        "verification_state": "PENDING",
+    }
+
+
+# ── research routing seam (§6 — honest: recorded route, not execution) ─────
+
+
+def research_route(req: cf.CapabilityRequirement, decision: dict) -> dict:
+    """Record which evidence path the decision needs. This is a SEAM: the
+    live ADAPT interface is not yet wired for direct invocation, so the
+    route is recorded on the trace for the orchestrating session to act on.
+    NOT claimed as executed research."""
+    if decision["resolution"] == "INSUFFICIENT_EVIDENCE":
+        return {
+            "route": "TARGETED_EVIDENCE_PROBE",
+            "question": f"what satisfies: {req.objective[:120]}",
+            "status": "RECORDED_NOT_EXECUTED",
+        }
+    if decision["resolution"] == "ACQUIRE_EXTERNAL":
+        return {
+            "route": "FULL_RESEARCH_PIPELINE",
+            "question": f"external acquisition options for: {req.objective[:120]}",
+            "status": "RECORDED_NOT_EXECUTED",
+        }
+    return {"route": "NONE", "status": "LOCAL_SOLVE"}
+
+
+# ── resolution merge across authorities ─────────────────────────────────────
+
+_PRECEDENCE = [
+    "SATISFIED",
+    "REUSE",
+    "COMPOSE",
+    "ADAPT_EXISTING",
+    "CONFIGURE",
+    "ACQUIRE_EXTERNAL",
+    "INSUFFICIENT_EVIDENCE",
+    "BUILD_NEW",
+]
+
+
+def merge_resolutions(results: list[dict]) -> dict:
+    """Merge per-authority resolution results. Precedence: a concrete
+    reuse/compose/adapt verdict from any authority wins over
+    INSUFFICIENT_EVIDENCE from another; BUILD_NEW can only result when NO
+    authority produced a better verdict AND positive gap evidence exists —
+    it is never a fallback across merges (§8)."""
+    if not results:
+        return {"resolution": "INSUFFICIENT_EVIDENCE", "rationale": "no authority consulted"}
+    best = min(results, key=lambda r: _PRECEDENCE.index(r["resolution"]))
+    merged = dict(best)
+    merged["per_authority"] = [{"authority": r.get("authority", ""), "resolution": r["resolution"]} for r in results]
+    if best["resolution"] == "BUILD_NEW" and len(results) > 1:
+        # only honest if every authority independently agrees
+        if any(r["resolution"] != "BUILD_NEW" for r in results):
+            weaker = [r for r in results if r["resolution"] == "INSUFFICIENT_EVIDENCE"]
+            if weaker:
+                merged = dict(weaker[0])
+                merged["per_authority"] = [
+                    {"authority": r.get("authority", ""), "resolution": r["resolution"]} for r in results
+                ]
+                merged["rationale"] = (
+                    "BUILD_NEW rejected: at least one authority returned "
+                    "INSUFFICIENT_EVIDENCE — positive gap evidence required "
+                    "from all consulted authorities (§8)"
+                )
+    return merged
+
+
+# ── user-approval gate (§13) ────────────────────────────────────────────────
+
+
+def needs_user_approval(
+    resolution: str, toolchain_decision: tc.DecisionRecord, layout_obligations: list[dict], need: Need
+) -> dict:
+    """Classify whether decision→contract requires explicit user approval.
+    Small bounded work inside an already-approved contract does NOT re-ask
+    (need.approval_context covers it)."""
+    reasons = []
+    if toolchain_decision.user_approval_required:
+        reasons.append("toolchain change (CHANGE_MAJOR)")
+    if resolution == "BUILD_NEW" and need.requested_permanence != "temporary":
+        reasons.append("new capability construction")
+    if any(o["lock"] for o in layout_obligations):
+        reasons.append("USER-LOCKED layout surface affected — placement changes require user authorization")
+    if need.requested_permanence == "permanent":
+        reasons.append("permanent promotion requested (user-controlled)")
+    if need.constraints.get("new_repository") or need.constraints.get("new_application"):
+        reasons.append("new repository/application")
+    covered = bool(need.approval_context) and not reasons
+    if reasons and need.approval_context and need.constraints.get("approval_covers") == "all":
+        covered = True
+        reasons = [f"{r} — covered by: {need.approval_context}" for r in reasons]
+    return {
+        "required": bool(reasons) and not covered,
+        "reasons": reasons,
+        "covered_by": need.approval_context if covered else "",
+    }
+
+
+# ── the live decision path ──────────────────────────────────────────────────
+
+
+def _project_exists_evidence(project: str | None, authorities: dict[str, dict]) -> tuple[bool | None, list[str]]:
+    """T11 §1: project existence from STRUCTURAL EVIDENCE only.
+
+    Returns (exists, evidence) where exists is:
+        True   — a bound Project Scaffold or Rune Spine carries the project
+        False  — the project name is known but NO structural evidence for it
+        None   — project identity missing/unresolvable (UNKNOWN; classifier
+                 must not manufacture existence)
+
+    Rune itself exists (Rune Spine is its authority). Any other name must
+    appear as a project entity in a consulted authority; a bare string is
+    never proof (held-out: arbitrary "foo" → False, not silently True)."""
+    evidence: list[str] = []
+    if not project:
+        return None, ["no project identity supplied — existence UNKNOWN"]
+    if project in ("rune", "issue161-harness"):
+        evidence.append("Rune Spine is the Rune project authority (rune_internal mode)")
+        return True, evidence
+    for name, doc in authorities.items():
+        for e in doc.get("entities", []):
+            if e.get("kind") == "project" and e.get("id") == f"project:{project}":
+                evidence.append(f"bound Project Scaffold entity project:{project} in {name}")
+                return True, evidence
+    evidence.append(f"no structural evidence for project '{project}' in consulted authorities")
+    return False, evidence
+
+
+def make_decision(
+    need: Need,
+    *,
+    authorities: dict[str, dict],
+    toolchain_constraints: tc.ToolchainConstraints | None = None,
+    project_toolchain: dict | None = None,
+    prior_iterations: list[dict] | None = None,
+    extra_patterns: list | None = None,
+) -> dict:
+    """Run NEED → decision trace. `authorities` maps authority name → store
+    doc (e.g. {"rune_spine": spine_doc, "project_scaffold": scaffold_doc}).
+    `project_toolchain` seeds the Toolchain Resolver's existing-project
+    constraint (existing toolchain wins — §12).
+    `prior_iterations` (Tranche 5 §11): earlier decision iterations being
+    refined — retained in the trace with why-it-changed provenance; the
+    final resolution stays singular.
+
+    Order of operations (Tranche 5 §6): affected-surface resolution →
+    REQUIREMENT COMPLETENESS GATE → discovery/fit → merge. A MATERIAL_GAP
+    downgrades premature concrete verdicts (REUSE/SATISFIED/COMPOSE/
+    ADAPT_EXISTING) to INSUFFICIENT_EVIDENCE with the gap recorded — the
+    fit engine was right GIVEN its requirement; the requirement was too
+    narrow."""
+    req, missing = normalize_need(need)
+    trace: dict = {
+        "need": need.to_dict(),
+        "requirement": req.to_dict(),
+        "normalization_missing": missing,
+        "candidates": [],
+        "fits": [],
+        "per_authority_results": [],
+        "layout_obligations": [],
+        "research": {},
+        "toolchain": {},
+        "approval": {},
+        "resolution": "",
+        "rationale": "",
+        "iterations": list(prior_iterations or []),
+    }
+
+    # affected-surface classification + resolution (Tranche 5 §3-5)
+    surface_result = resolve_affected_surface(need, authorities)
+    trace["affected_surfaces"] = surface_result
+
+    # CONTEXTUAL CONSTRUCTION MODE (Tranche 10 + T11 §1): typed mode
+    # classification with evidence — ONE canonical home (construction_mode).
+    # §1 CORRECTION: project existence derives from STRUCTURAL EVIDENCE
+    # (bound Project Scaffold / Rune Spine), never from a non-"rune" string.
+    from rune.construction_mode import classify_mode
+
+    existence, existence_evidence = _project_exists_evidence(need.project, authorities)
+    mode_decision = classify_mode(
+        need.objective, target_project=need.project, project_exists=existence, affected_surface=need.affected_surface
+    )
+    mode_decision.evidence.extend(existence_evidence)
+    trace["construction_mode"] = mode_decision.to_dict()
+    trace["project_existence"] = {"project": need.project, "exists": existence, "evidence": existence_evidence}
+
+    # REQUIREMENT COMPLETENESS GATE (Tranche 5 §6-8) — before fit
+    completeness = check_completeness(req, need, authorities, surface_result)
+    trace["completeness"] = completeness
+
+    # live discovery + fit + resolution per authority (§7-8)
+    results = []
+    all_fits = []
+    for name, doc in authorities.items():
+        candidates = cf.discover_candidates(doc, req)
+        fits = [cf.evaluate_fit(req, c) for c in candidates]
+        for f, c in zip(fits, candidates):
+            f["authority"] = name
+            c["authority"] = name
+        all_fits.extend(fits)
+        trace["candidates"].extend(
+            {k: c[k] for k in ("id", "kind", "maturity", "status", "authority", "provides", "consumers")}
+            for c in candidates
+        )
+        res = cf.decide(doc, req, fits)
+        res["authority"] = name
+        results.append(res)
+    trace["fits"] = all_fits
+    if results:
+        merged = merge_resolutions(results)
+    else:
+        merged = {"resolution": "INSUFFICIENT_EVIDENCE", "rationale": "no authorities provided"}
+    if missing and merged["resolution"] in ("BUILD_NEW",):
+        # normalization gaps block BUILD_NEW too (§5: do not invent)
+        merged = {
+            "resolution": "INSUFFICIENT_EVIDENCE",
+            "rationale": f"requirement normalization incomplete: {missing}; refusing to build on guesses",
+        }
+    if completeness["verdict"] == MATERIAL_GAP and merged["resolution"] in (
+        "SATISFIED",
+        "REUSE",
+        "COMPOSE",
+        "ADAPT_EXISTING",
+        "CONFIGURE",
+    ):
+        # PREMATURE-FIT GUARD (Tranche 5 §6-7): the fit engine was correct
+        # GIVEN its requirement — but the requirement is materially
+        # incomplete (affected surface carries unrepresented obligations).
+        # A concrete verdict on an incomplete requirement is not trustworthy.
+        merged = {
+            "resolution": "INSUFFICIENT_EVIDENCE",
+            "rationale": (
+                "premature fit blocked: requirement is materially incomplete "
+                f"({len(completeness['gaps'])} unrepresented obligation(s) on "
+                "affected surfaces); refine the requirement before trusting "
+                "an apparently-complete fit"
+            ),
+            "premature_fit_blocked": {
+                "would_have_been": merged["resolution"],
+                "gaps": completeness["gaps"],
+            },
+        }
+    trace["resolution"] = merged["resolution"]
+    trace["rationale"] = merged.get("rationale", "")
+    if missing and trace["resolution"] == "INSUFFICIENT_EVIDENCE":
+        trace["rationale"] += f"; normalization gaps recorded, not invented: {missing}"
+    trace["per_authority_results"] = merged.get("per_authority", results)
+    trace["_merged"] = merged
+
+    # toolchain (§12): existing project toolchain wins
+    constraints = toolchain_constraints or tc.ToolchainConstraints(**(project_toolchain or {}))
+    tdec = tc.resolve_toolchain(constraints)
+    trace["toolchain"] = tdec.to_dict()
+
+    # layout obligations (§19-20): affected surface + candidate impls
+    affected = list(need.affected_surface)
+    for c in trace["candidates"]:
+        affected.append(c["id"])
+    lay = []
+    for name, doc in authorities.items():
+        lay.extend(layout_obligations_for(doc, affected))
+    trace["layout_obligations"] = lay
+
+    # research routing (§6, honest seam)
+    trace["research"] = research_route(req, merged)
+
+    # PATTERN SELECTION (Tranche 6 §4-7): evidence-backed applicability over
+    # the builtin registry + caller-supplied patterns; obligations filtered
+    # per project evidence; conflicts surfaced, never silently resolved.
+    # Project evidence > pattern assumption (§3): a pattern that contradicts
+    # recorded project exclusions becomes DOES_NOT_APPLY.
+    from rune.construction_pattern import (  # noqa: E402 — local: pattern layer
+        combine_pattern_obligations,
+        derive_pattern_obligations,
+        evaluate_applicability,
+    )
+    from rune.construction_patterns_builtin import BUILTIN_PATTERNS  # noqa: E402
+
+    pattern_candidates = list(BUILTIN_PATTERNS) + list(extra_patterns or [])
+    patterns_considered = []
+    derivations = []
+    for pattern in pattern_candidates:
+        app = evaluate_applicability(pattern, need, surface_result, authorities)
+        patterns_considered.append(app)
+        # APPLIES and PARTIAL both reach obligation derivation: applicability
+        # gates whether the pattern is CONSULTED; the per-obligation `when`
+        # conditions do the precision filtering (Tranche 6 §7). The
+        # applicability verdict is recorded on every derived obligation so
+        # weaker evidence stays visible.
+        if app["verdict"] in ("APPLIES", "PARTIAL"):
+            d = derive_pattern_obligations(
+                pattern,
+                need,
+                surface_result,
+                authorities,
+                project_exceptions=need.constraints.get("pattern_exceptions", []),
+            )
+            for entry in d["accepted"] + d["rejected"] + d["unresolved"]:
+                entry["pattern_applicability"] = app["verdict"]
+            derivations.append(d)
+    combined = combine_pattern_obligations(derivations) if derivations else {"obligations": [], "conflicts": []}
+    trace["patterns_considered"] = patterns_considered
+    trace["pattern_obligations"] = combined
+
+    # approval gate (§13)
+    trace["approval"] = needs_user_approval(merged["resolution"], tdec, lay, need)
+    trace["obligations"] = obligations_from_trace(trace, req)
+    # pattern-derived obligations join the contract's verification set (§19):
+    # provenance stays PATTERN (distinct from STRUCTURAL derivations in
+    # obligations_from_trace — §8 provenance separation)
+    trace["obligations"]["pattern"] = combined["obligations"]
+    trace["obligations"]["pattern_conflicts"] = combined["conflicts"]
+    for po in combined["obligations"]:
+        trace["obligations"]["verification"].append(f"[pattern:{po['pattern']}@r{po['revision']}] {po['obligation']}")
+    return trace
+
+
+def layout_obligations_for(doc: dict, affected: list[str]) -> list[dict]:
+    """Layout obligations from a store doc without a Scaffold instance
+    (delegates to the same authority logic via a lightweight query)."""
+    obligations = []
+    affected_set = set(affected)
+    for e in doc["entities"]:
+        if e["kind"] != "layout_contract" or e.get("status") == "RETIRED":
+            continue
+        ident = e["identities"]
+        comp, region, impl = (ident.get("component", ""), ident.get("region", ""), ident.get("implementation", ""))
+        hit = (
+            comp in affected
+            or f"region:{region}" in affected
+            or (impl and any(a in impl for a in affected if a.endswith(".py")))
+        )
+        if not hit:
+            continue
+        locked = bool(ident.get("lock"))
+        obligations.append(
+            {
+                "component": comp,
+                "region": region,
+                "lock": locked,
+                "provenance": ident.get("provenance", "scaffold"),
+                "obligation": (
+                    "USER-LOCKED: preserve user placement in region "
+                    "'%s'; changes require explicit user authorization" % region
+                )
+                if locked
+                else (
+                    "preserve/verify %s placement in region '%s'; movable "
+                    "only via authorized layout amendment" % (comp, region)
+                ),
+                "verification": ("layout_contract_check must PASS; USER-LOCKED placement unchanged")
+                if locked
+                else "layout_contract_check must PASS",
+                "status": e.get("status", "ACTIVE"),
+            }
+        )
+    return obligations
+
+
+def obligations_from_trace(trace: dict, req: cf.CapabilityRequirement) -> dict:
+    """BUILD-BUT-DON'T-BREAK (§9) + composition/acquire obligations (§10-11)
+    derived automatically from the trace — the builder does not memorize the
+    rule; the path produces it."""
+    resolution = trace["resolution"]
+    obligations: dict = {
+        "new_behavior": [],
+        "regression": [],
+        "composition": [],
+        "acquisition": [],
+        "layout": trace["layout_obligations"],
+        "verification": [],
+    }
+    merged = trace.get("_merged", {})
+    selected = merged.get("selected") or merged.get("components") or []
+    if isinstance(selected, str):
+        selected = [selected]
+    if resolution in ("ADAPT_EXISTING", "REUSE", "SATISFIED") and selected:
+        # regression obligations from existing consumers + contracts (§9)
+        for c in trace["candidates"]:
+            if c["id"] in selected and c.get("consumers"):
+                obligations["regression"].append(
+                    f"preserve existing behavior of {c['id']} for consumers: {', '.join(c['consumers'])}"
+                )
+        obligations["verification"].append("new behavior proven by tests before closure")
+    if resolution == "ADAPT_EXISTING":
+        obligations["verification"].append("regression proof: original capability's consumers still work")
+    if resolution == "COMPOSE":
+        obligations["composition"] = [
+            {
+                "components": merged.get("components", selected),
+                "joining_contracts": req.contracts,
+                "permanence": merged.get("permanence", "temporary (user-controlled)"),
+            }
+        ]
+        obligations["verification"].append("composition boundary behavior verified end-to-end")
+    if resolution == "ACQUIRE_EXTERNAL":
+        obligations["acquisition"] = merged.get("external", [])
+        obligations["verification"].append("external acquisition requires research/approval step before install")
+    if resolution == "BUILD_NEW":
+        obligations["verification"].append("positive gap evidence recorded in contract")
+    for lo in trace["layout_obligations"]:
+        obligations["verification"].append(lo["verification"])
+    return obligations
+
+
+# ── contract generation (§15) ────────────────────────────────────────────────
+
+
+def generate_contract(
+    s, doc: dict, trace: dict, *, contract_id: str, scope: list[str] | None = None, proposer_note: str = ""
+) -> dict:
+    """Populate a Construction Contract from the decision trace (Tranche 5
+    §13-17 IMPACT-AWARE generation). The Need's affected surface is never
+    lost — it is classified and propagated into distinct surfaces:
+
+        affected_entities        structural entity ids (existing)
+        expected_new_entities    planned new structural entities
+        ext.affected_paths       file-scope entries (mechanical scope check)
+        ext.affected_ui_surfaces ui components (layout obligations follow)
+        ext.unresolved_surfaces  retained, never dropped
+        ext.expected_runtime_effects  operational effects (deployment:current
+                                 advances etc.) — accounting metadata, NOT a
+                                 workflow engine; closure requires independent
+                                 observation before marking them observed.
+
+    File scope: generated from affected paths + selected capability
+    implementation paths + explicit expected-new paths — NOT unrestricted
+    repo scope. `scope` param may still extend it; generated paths are
+    recorded as such (provenance: affected-surface).
+    """
+    merged = trace["_merged"]
+    req = trace["requirement"]
+    surfaces = trace.get("affected_surfaces", {})
+    selected = merged.get("selected") or []
+    if isinstance(selected, str):
+        selected = [selected]
+
+    # structural affected: selected candidates + requirement contracts +
+    # resolved surface entities — the union the old generator partially lost
+    affected = {c["id"] for c in trace["candidates"] if c["id"] in selected}
+    affected |= set(trace["requirement"].get("contracts", []))
+    affected |= set(surfaces.get("affected_existing_entities", []))
+
+    # file scope: generated (affected paths + selected impl paths + expected
+    # new paths) UNION caller-supplied additions, provenance-tracked
+    affected_paths = list(surfaces.get("affected_paths", []))
+    impl_paths = []
+    for c in trace["candidates"]:
+        if c["id"] in selected:
+            p = c.get("identities", {}).get("path", "")
+            if p:
+                impl_paths.append(p)
+    expected_new_paths = trace["need"]["constraints"].get("expected_new_source_paths", [])
+    generated_scope = sorted(
+        set(affected_paths)
+        | set(surfaces.get("workflow_config_surfaces", []))
+        | set(impl_paths)
+        | set(expected_new_paths)
+    )
+    caller_scope = sorted(set(scope or []) - set(generated_scope))
+    final_scope = sorted(set(generated_scope) | set(caller_scope))
+
+    expected_runtime = sorted(trace["need"]["constraints"].get("expected_runtime_effects", []))
+
+    obl = trace["obligations"]
+    s.new_contract(
+        doc,
+        contract_id=contract_id,
+        need=trace["need"]["objective"],
+        origin=trace["need"]["origin"],
+        scope=final_scope,
+        requirement=req.get("objective", ""),
+        gap_evidence=merged.get("rationale", ""),
+        research_refs=(
+            trace["need"]["evidence_refs"]
+            + ([trace["research"]["route"]] if trace["research"]["route"] != "NONE" else [])
+        ),
+        resolution=trace["resolution"],
+        toolchain=trace["toolchain"],
+        affected_entities=sorted(affected),
+        expected_new_entities=sorted(
+            set(trace["need"]["constraints"].get("expected_new_entities", []))
+            | {d["entity"] for d in surfaces.get("derived_expected_new", [])}
+        ),
+        expected_consumers=[],
+        regression_obligations=obl["regression"],
+        verification_obligations=sorted(set(obl["verification"])),
+        rollback_ref=trace["need"]["constraints"].get("rollback_ref", "git revert"),
+        acceptance=[f"resolution {trace['resolution']} verified end-to-end"],
+        non_goals=trace["need"]["constraints"].get("non_goals", []),
+    )
+    e = s.contract(doc, contract_id)
+    e.setdefault("ext", {}).update(
+        {
+            "decision_trace": {
+                k: trace[k]
+                for k in (
+                    "need",
+                    "requirement",
+                    "candidates",
+                    "fits",
+                    "resolution",
+                    "rationale",
+                    "research",
+                    "toolchain",
+                    "approval",
+                    "obligations",
+                    "layout_obligations",
+                    "normalization_missing",
+                    "completeness",
+                    "affected_surfaces",
+                    "iterations",
+                    "patterns_considered",
+                    "pattern_obligations",
+                    "construction_mode",
+                )
+            },
+            # distinct impact surfaces (Tranche 5 §13) — file scope != structural
+            # impact != expected new != runtime effect
+            "affected_paths": affected_paths,
+            "affected_ui_surfaces": surfaces.get("affected_ui_surfaces", []),
+            "affected_regions": surfaces.get("affected_regions", []),
+            "workflow_config_surfaces": surfaces.get("workflow_config_surfaces", []),
+            "unresolved_surfaces": surfaces.get("unresolved_surfaces", []),
+            "expected_runtime_effects": expected_runtime,
+            "scope_provenance": {"generated_from_affected_surface": generated_scope, "caller_added": caller_scope},
+        }
+    )
+    if proposer_note:
+        e["ext"]["decision_trace"]["proposer_note"] = proposer_note
+    return e