diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c95f8faa..66e76869 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 # CI gate for every push and PR: the Node 20/22 test matrix (matches the ">=20" engines
-# field; 18 is EOL) plus the shared quality gate (Biome, typecheck, ShellCheck, zero-dep
-# assertion, version-drift, docs-drift, pack). The quality gate is the SAME reusable workflow
+# field; 18 is EOL), the research contracts (Python prototype suites + recomputation), plus
+# the shared quality gate (Biome, typecheck, ShellCheck, zero-dep assertion, version-drift,
+# docs-drift, pack). The quality gate is the SAME reusable workflow
 # the version bump and release require, so none of the three can drift from the others.
 name: CI
 
@@ -58,6 +59,38 @@ jobs:
           awk '/^not ok /{p=1} p{print} p&&/^  \.\.\.[[:space:]]*$/{p=0}' /tmp/win-test.log | head -200
           exit "$ec"
 
+  # The research contracts (review A02): the two Python prototypes' own suites, the Theorem-D
+  # sanity checks (no data needed), and the recomputation of every corrected number from the
+  # replication package shipped in this repo. A research claim that stops recomputing fails CI
+  # like a broken unit test.
+  research:
+    name: Research (Python prototypes + recomputation)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Install prototype test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install \
+            -r research/python-prototypes/impact_oracle/requirements.txt \
+            -r research/python-prototypes/router_gate/requirements.txt
+      - name: impact_oracle tests
+        working-directory: research/python-prototypes/impact_oracle
+        run: python -m pytest -q
+      - name: router_gate tests
+        working-directory: research/python-prototypes/router_gate
+        run: python -m pytest -q
+      - name: Theorem sanity checks (no data)
+        run: python research/recompute_corrections.py --theorem-checks
+      - name: Recompute the corrections from the replication package
+        run: |
+          mkdir -p "$RUNNER_TEMP/rp"
+          tar -xzf research/empirical-refutation/replication_package.tar.gz -C "$RUNNER_TEMP/rp"
+          python research/recompute_corrections.py "$RUNNER_TEMP/rp/repro"
+
   quality-gate:
     name: Quality gate
     uses: ./.github/workflows/reusable-quality-gate.yml
diff --git a/.github/workflows/reusable-quality-gate.yml b/.github/workflows/reusable-quality-gate.yml
index f3cc0dc4..836a1c93 100644
--- a/.github/workflows/reusable-quality-gate.yml
+++ b/.github/workflows/reusable-quality-gate.yml
@@ -33,4 +33,6 @@ jobs:
         run: node -e "process.exit(Object.keys(require('./package.json').dependencies||{}).length)"
       - run: node scripts/bump.mjs check
       - run: node src/cli.js docs check
+      - name: Claim registry and research copies are current
+        run: node scripts/claims-status.mjs --check
       - run: npm pack --dry-run
diff --git a/.gitignore b/.gitignore
index 118cb3a7..a7448fe1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,11 @@ node_modules/
 npm-debug.log*
 *.tgz
 
+# Python bytecode / test caches (research prototypes)
+__pycache__/
+*.pyc
+.pytest_cache/
+
 # Forge runtime artifacts (generated, never committed)
 .forge/
 *.log
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index f7b281be..3c55a1ac 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -1,11 +1,13 @@
 # forgekit — architecture
 
-> **One brain for every AI coding agent.** A large language model is stateless: one
-> context window, wiped every call. It has no memory of what your team learned, no
-> foresight about what an edit will break, and no enforced guardrails. forgekit is the
-> **cognitive substrate** — the layer that runs _before_ the model edits code, supplying
-> proof-carrying memory, impact foresight, and enforced guardrails — and a **cross-tool
-> config compiler** that delivers that brain as native config into every tool at once.
+> **A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis,
+> and explicit verification around coding agents.** A language model keeps no durable state
+> between independent calls and sees only a bounded context window, so on its own it does not
+> carry what your team learned, cannot see the parts of the repository an edit affects unless
+> they are in context, and cannot enforce rules on itself. forgekit is the **cognitive
+> substrate** — the layer that runs _before_ the model edits code, supplying evidence-referenced
+> ("proof-carrying") memory, heuristic impact analysis, and guardrails — and a **cross-tool
+> config compiler** that delivers it as native config into every tool at once.
 
 This document is the architecture reference. It is organized around four diagrams:
 
@@ -194,10 +196,13 @@ flowchart LR
     class SV accent;
 ```
 
-The completeness gate on the retrieval side is `forge context "<task>"`: it assembles a
-budgeted context via set-cover over the predicted edit set (`R(edit)`), applies a
-compression ladder, and reports the _computed missing set_ — the inputs it could not
-assemble. That missing set is exactly what the substrate pipeline's context stage reads
+The completeness gate on the retrieval side is `forge context "<task>"`: it pins the
+required-knowledge set for the edit (`R(edit)`), downgrades items along a compression ladder
+before dropping anything, fills the rest of the budget with a value-density heuristic (no
+approximation guarantee), and reports the _computed missing set_ — the inputs it could not
+assemble — plus pending reads and truncations. Its "complete" means syntactically delivered
+within an estimated token budget, not semantically sufficient
+([plan 04 §7](docs/plans/substrate-v2/04-context-assembly.md#7-status-2026-09-26--partial)). That missing set is exactly what the substrate pipeline's context stage reads
 to decide whether an edit is safe to start. Surface: `forge reuse query | mint | stats`.
 
 ## 5. The end-to-end reliability layer
@@ -597,7 +602,7 @@ forgekit/
     learn_consolidate.js  # bin/learn-consolidate.sh: deterministic consolidation of ~/.claude/skills/learned — merge duplicates, drop only ledger-refuted (dormant/retracted/attic) lessons; no model call
     reuse.js              # proof-carrying artifact cache: fingerprint (MinHash+LSH), exact→near→adapt→miss ladder, atlas revalidation
     embed.js              # optional embeddings tier (ADR-0005): FORGE_EMBED=cmd:<cmd>|http:<url>, swaps MinHash/Jaccard for cosine in `reuse query`/`ledger query`, disk-cached at .forge/embed-cache.jsonl, silent fallback to MinHash
-    context.js            # budgeted context assembly + completeness gate: R(edit) set cover, compression ladder, computed missing-set
+    context.js            # budgeted context assembly + completeness gate: R(edit) coverage, compression ladder, computed missing-set
     diagnose.js           # doom-loop diagnosis: normalized failure signatures; 3× = diagnosis claim + one-tier escalation
     imagine.js            # consequence simulation (Eq. 4): predicted breaks + minimal dry-run suite via greedy set cover
     uifingerprint.js      # deterministic design fingerprint + slop-distance / conformance gate (no LLM, no screenshots)
@@ -670,24 +675,21 @@ from the tree it describes.
 ```mermaid
 %%{init: {'theme':'base','themeVariables':{'primaryColor':'#201a15','primaryTextColor':'#f2ede7','primaryBorderColor':'#372c22','lineColor':'#f26430','secondaryColor':'#272019','tertiaryColor':'#171310','edgeLabelBackground':'#201a15','clusterBkg':'#171310','clusterBorder':'#4a3b2e','fontFamily':'ui-sans-serif, system-ui, sans-serif','fontSize':'14px'},'flowchart':{'curve':'basis','padding':10,'nodeSpacing':36,'rankSpacing':44}}}%%
 flowchart LR
-  test["test<br/>119 files"]
-  src["src<br/>110 files"]
-  test["test<br/>121 files"]
-  src["src<br/>111 files"]
+  test["test<br/>133 files"]
+  src["src<br/>119 files"]
   landing["landing<br/>61 files"]
   research["research<br/>37 files"]
+  bench["bench<br/>6 files"]
   global["global<br/>5 files"]
-  bench["bench<br/>3 files"]
-  scripts["scripts<br/>2 files"]
+  scripts["scripts<br/>3 files"]
   docs["docs<br/>1 file"]
   examples["examples<br/>1 file"]
-  test -- 247 --> src
-  test -- 244 --> src
-  bench -- 8 --> src
+  test -- 281 --> src
+  bench -- 12 --> src
   examples -- 4 --> src
+  test -- 3 --> global
+  test -- 3 --> scripts
   test -- 2 --> bench
-  test -- 2 --> global
-  test -- 2 --> scripts
   scripts --> src
   src --> global
 ```
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf9300be..507dc9a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,181 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Changed
+
+These tighten what a result is allowed to CLAIM, after the 2026-09-26 external deep review
+reproduced 16 cases where a label (`PASS`, `complete`, `exact`, trusted) was stronger than the
+evidence behind it. Scripts that read the JSON output may need to adapt:
+
+- **`forge verify` covers the whole repo, or says what it did not cover.** Every nested
+  package that declares its own suite (an explicit `scripts.test`, a pytest config, go.mod…)
+  is now planned and run in its own directory, and `tests.coverage` reports which packages
+  got a verdict. A passing root suite can no longer hide a failing workspace package (F08).
+  A root script that already runs every workspace (`npm test --workspaces`, `pnpm -r`,
+  `turbo run test`, …) covers them once, without duplicate runs. New `.forge/forge.config.json`
+  keys: `verify.workspaces: "root"` (declare that the root command covers everything),
+  `verify.exclude` (package paths that are not required suites) and `verify.generated`
+  (outputs a test run may legitimately write). Fixture/test-data packages are not required.
+- **A test runner that is only a devDependency is inventory, not an obligation (F09).** With an
+  explicit `scripts.test`, `detectStack().testCommands` no longer adds `npx vitest`/`npx jest`;
+  they are listed in the new `testInventory` (and `forge stack` prints them as "available").
+  npm's `"no test specified"` placeholder is not a suite.
+- **`forge verify` refuses to bind a verdict to code that changed while the tests ran (F10).**
+  The code state is captured before and after the run; if it moved, the result is
+  `INCOMPLETE` with `mutated: true`, and the stamp is bound to the PRE-run state. Interpreter
+  caches (`__pycache__`, `.pytest_cache`, …) never count as a change.
+- **The code-state fingerprint is a canonical manifest bound to HEAD (F01).** Renaming an
+  untracked file, moving bytes between files, adding an empty file, changing an exec bit or a
+  symlink target, and checking out another commit all change it; an unreadable untracked file
+  makes the state unbindable. Stamps from older forge versions no longer verify (by design:
+  their fingerprint could not tell those states apart) — re-run `forge verify`.
+- **Exact reuse keys are lossless except whitespace (F04).** Case, operators, literals and
+  punctuation are part of the key, so `>= 18` / `<= 18`, `"ADMIN"` / `"admin"`, `= true` /
+  `!= true`, `getURL` / `getUrl` never share one. A near candidate must also pass a semantic
+  guard (same operators, numbers, literals, identifiers, paths and polarity words) or it is
+  only offered at the adapt tier. Artifacts minted before this change never exact-hit.
+- **`forge context` reports delivery, not availability (F02, F03).** `tokens` is measured on the
+  rendered block (a chars/3.6 estimate, now labeled as such) and never exceeds `--budget`
+  while the result claims success: when even pointers cannot fit, items are dropped and the
+  result is `overflow: true`, `ok: false`. A `- read <file>` pointer is a `pending` read, not
+  coverage; a definition span / first-25-lines head covers only what it shows; omitted
+  dependents are listed in `truncated`. New `--block` prints the assembled context itself.
+- **`forge route universal` makes an unreachable objective explicit (F12).** A budget no
+  cascade fits, or a target none reaches, returns `ok: false`, `feasible: false`, a `reason`,
+  `budgetMet: false` (budget objective) and `minimumExpectedCost`, with the least-bad cascade
+  only as a labeled `fallback`; the CLI prints `INFEASIBLE` and exits 1. Every recommendation
+  also reports `maxPossibleCost` (every attempt runs) next to the expected cost.
+- **`forge route universal` says when a recommended model cannot be called (A07).** Each
+  cascade step lists the providers that serve it and where its cost comes from. A step that no
+  configured provider serves is marked `no provider id`, and the recommendation is labeled
+  `advice only` (`applicable: false`, `unmapped` in `--json`). Registry presence is not
+  availability: the shipped default recommendation was two such models.
+- **`forge route outcome` validates what it records (A04, A01).** Unknown model ids, negative
+  or non-finite costs and wrong-length feature vectors are refused; each row carries an
+  `attemptId` (`--attempt <id>` makes re-recording idempotent) and is `self-reported` unless
+  `--verify-run <run id>` ties it to a matching `forge verify` run.
+- **`forge imagine --run` is described as what it is: an isolated checkout of HEAD, not a
+  security sandbox (A05)**, and a project whose tests use another runner (jest, vitest,
+  pytest…) gets an explicit unsupported-runner result instead of a `node --test` run of files
+  written for a different runner.
+
+- **Cost model: the 90.2/85.6/74.3% scenarios built on the refuted 0.62 routing factor are
+  withdrawn.** Every stage saving is labeled a hypothesis. A cost headline must now state its
+  run id, code SHA, dataset, denominator, baseline, correctness rule, uncertainty and evidence
+  status (`docs/plans/substrate-v2/05-cost-model.md` §3).
+- **README leads with the three jobs**: shared evidence-referenced memory, heuristic
+  change-impact analysis, and explicit verification. P4 context assembly and P8 evaluation
+  are marked partial, and UI checks are documented as advisory.
+
+### Security
+
+- **The dashboard checks Host on every route, and writes need the page's session token and
+  this exact origin (F13).** A foreign Host (DNS rebinding) gets 403 on reads too; another
+  localhost port cannot write. Native clients that POSTed without a token must now send the
+  `x-forge-token` the server embeds in its page. Missing session logs render as "spend
+  unknown", never `$0`; unpriced models are "unpriced", not free (A10).
+
+### Fixed
+
+- **One evidence event, one vote (F06).** Four spellings of one commit (7/8/9/40 characters)
+  lifted a lesson from 0.655 to 0.821, across the 0.8 required-context bar. `val()` now counts
+  distinct events (an abbreviation of a git object id is the same event; a re-recorded ref is
+  the same event, and cannot refresh its decay), and `appendEvidence` stores resolvable
+  abbreviations under the full object id.
+- **A rewritten lesson no longer inherits the old wording's trust (F07).** Evidence carries
+  over only when the rewrite is equivalent up to case, whitespace and punctuation; otherwise
+  the new claim starts at the 0.5 prior, names its parent (`supersedes`) and any semantic
+  conflicts in its provenance, and the legacy lesson restarts as a candidate.
+- **Artifacts are revalidated where they are served (F05).** A cached artifact whose file was
+  edited or deleted is no longer served; dependency contracts recorded at mint (a
+  declaration fingerprint) invalidate an artifact when a same-name dependency's signature
+  changes; and "no atlas" is `unknown` validation (`requiresRevalidation: true`), never "ok".
+- **Archived is not refuted (F15).** Pruning records WHY a claim went to the attic
+  (`tombstoned`, `dormant`, `idle`, `duplicate` + survivor, in `attic/<id>.log`), and learned-
+  lesson consolidation drops a lesson only when its matching claim is actually retracted or
+  dormant — an idle archive keeps it, a deduplicated one defers to its survivor.
+- **Similar-but-opposite rules are never merged (F16).** Consolidation and the ledger's
+  duplicate compaction only merge texts that pass the semantic guard; "Enable
+  authentication…" and "Disable authentication…" stay two claims and are reported as a
+  conflict (`forge ledger compact`, `learn-consolidate`).
+- **Sparse router cost fits no longer invent a $1 intercept (F11).** One observed $0.05 attempt
+  used to predict ≈ $88.87; without enough data for slopes each model's intercept is its mean
+  log cost, with an explicit variance prior, and the fit reports `method`, `s2Source`,
+  `counts`, `alphaSE` and excluded zero-cost/missing rows.
+- **The reuse benchmark measures the tiers it names (F14).** The fixture's evidence refs were
+  capped below the serving floor, so every "exact"/"near" row had timed a miss. Fixtures now
+  cite a real git object, each row is validated before timing (a stale fixture aborts the
+  run), cold rows clear every memoized sketch, and exact/near/miss and warm/cold are separate
+  rows. `reports/benchmarks.md` was regenerated; the landing page and README quote it.
+- **`forge verify` no longer runs a project's suite with the parent test runner's
+  `NODE_TEST_CONTEXT`**, which made a nested `node --test` exit 0 without running its files.
+- The format-on-edit guard no longer rewrites a Biome project with a global prettier.
+- Evidence records with a non-finite day or an oversized ref, and malformed
+  `.forge/models.json` entries, are refused at the boundary (reported, never trusted).
+- The dashboard reports an unreadable store as unreadable (`meta.errors`), not as empty.
+- `forge substrate` says when the impact graph was truncated by the atlas file cap
+  (`capped`, `skippedFiles`), instead of presenting a partial graph as the whole repo (A06).
+- `forge verify` no longer counts its own outputs under `.forge/` as changed files.
+- `forge ledger verify --fix --dry-run` previews the address migration without writing.
+
+### Added
+
+- `bench/universal-router/reproduce.sh` rebuilds the shipped router prior from pinned,
+  sha256-checked public inputs (`sources.json`). The refit reproduces `data/router_prior.json`
+  exactly: all 176 fitted values, with only `fittedAt` different (Node v22.22.2, about 7 minutes
+  on 4 vCPUs). `holdout_eval.mjs` is a new seeded 150/350 held-out experiment. It is not a
+  reproduction of the reported 76.3% / $0.093 headline, whose harness is external. In it the
+  router did not beat a fixed cascade on solve rate (80.0% vs 80.6%) but was slightly cheaper.
+  It under-predicted cost by 5–22%, because failed attempts cost 1.2–2.0× as much as
+  successful ones. See `bench/universal-router/README.md`.
+- `src/semantic_guard.js` (behaviour-bearing token comparison) and `src/schema.js` (narrow
+  runtime validation), both zero-dependency.
+- Seeded property tests for the trust invariants (`test/trust_properties.test.js`) and a
+  regression test for each reproduced review finding.
+- CI runs the two Python prototype suites (49 + 23 tests), the Theorem-D sanity checks and
+  the recomputation of every corrected research number from the shipped replication package.
+- Command handlers for memory, verification and routing moved to `src/cli/` (a pure move;
+  `src/cli.js` keeps dispatch and help).
+
+### Documentation
+
+- A machine-readable claim/status registry (`docs/status/claims.json`, 47 claims assessed
+  against `d2abfa6`), with a generated table in `docs/status/README.md`. `node
+  scripts/claims-status.mjs --check`, now part of the CI quality gate, fails when the registry
+  is invalid, the table is stale, or a `docs/cognitive-substrate/` copy has drifted from its
+  `research/` source.
+- `docs/INTEGRATIONS.md`: for every supported tool, config emission, MCP registration,
+  automatic hooks and enforcement are listed separately, each marked tested, declared or not
+  supported. It also records which registry models have provider ids, with a date.
+- Universal router docs. The run-4 held-out headline is labeled repository-reported. The
+  shipped prior's refit is documented as reproduced exactly in this repository. The new
+  held-out replay is documented, as are the modeling limits: cascade cost under-predicted by
+  5–22%, optimistic targets, and budgets that bound only expected cost. The dataset pin is
+  corrected to `SWE-bench/SWE-bench_Verified@78f471b`.
+- Research corrections (2026-09-26) in the synthesis, the preprint and the white paper:
+  - Theorem D: joint attainability, with a counterexample.
+  - The equality condition of the silent-miss bound.
+  - "A caught miss is not a completed task."
+  - The frozen-model thesis restated to account for in-context learning.
+  - Prior art (CoALA, Reflexion).
+  - Impact-oracle results reported separately for each threshold.
+
+  `research/recompute_corrections.py --theorem-checks` asserts the Theorem D checks without
+  data, and the recomputation also prints macro F1.
+- Evidence grades are split into bibliographic verification, claim support, study design,
+  independent replication and transfer scope. METR's slowdown result is scoped to its
+  16-developer, early-2025 study, with a link to the February 2026 update.
+- The Qur'anic lens labels the Arabic source text, the translation, tafsir and the author's
+  design analogy separately, and states what the lens does and does not establish. No Arabic
+  text or translation was changed.
+- The research PDFs are marked as historical, pre-correction editions and recorded in
+  `research/HISTORICAL_EDITIONS.md` (git blob, sha256, pinned commit, figure map, render
+  recipe). They were not re-rendered: the Qur'anic text in a fresh render could not be
+  verified, and the refutation paper needs a TeX toolchain.
+- `forge verify`, `forge stack`, `forge ledger`, `forge reuse`, `forge dash` and `forge route
+  universal` sections of the guide describe the new coverage, binding, archive, reuse,
+  dashboard and advice-only behavior.
+
 ## [1.4.3] - 2026-09-24
 
 ### Fixed
diff --git a/CITATION.cff b/CITATION.cff
index 07081f27..0d65a8cd 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -4,12 +4,11 @@ title: "Forge (forgekit)"
 version: 1.4.3
 date-released: "2026-09-24"
 abstract: >-
-  One brain for every AI coding agent — the cognitive substrate every frozen model is
-  missing. Forge gives a stateless model the memory, blast-radius foresight, and
-  guardrails it structurally lacks: proof-carrying team memory, an independent
-  verification gate, self-correcting project memory, a security-vetting skill-gate, and a
-  cost governor — authored once and emitted natively to Claude Code, Codex, Cursor,
-  Gemini, Aider, and more.
+  A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis,
+  and explicit verification around coding agents: evidence-referenced ("proof-carrying")
+  team memory, a heuristic blast-radius analysis, a test-running verification gate, a
+  security-vetting skill-gate, and a cost meter — authored once and emitted natively to
+  Claude Code, Codex, Cursor, Gemini, Aider, and more.
 type: software
 authors:
   - name: CodeWithJuber
diff --git a/ONBOARDING.md b/ONBOARDING.md
index 1ffce1e7..e3b60335 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -1,11 +1,12 @@
 # Onboarding — five minutes to productive
 
-**One brain for every AI coding agent.** A language model is _stateless_ — one
-context window, wiped every call — so it has no memory of what your team learned, no
-foresight about what an edit breaks, and no enforced guardrails. forgekit is the
-**cognitive substrate** that supplies exactly those three things, and it delivers them
-as native config to Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed,
-Continue, and OpenClaw at once. Author the brain once; every tool reads it.
+**A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis,
+and explicit verification around coding agents.** A language model keeps no durable state
+between independent calls and sees only its context window, so on its own it does not carry
+what your team learned, cannot see what an edit affects unless those files are in context, and
+cannot enforce rules on itself. forgekit supplies that state and those checks from outside the
+model, and delivers them as native config to Claude Code, Codex, Cursor, Gemini, Aider, Copilot,
+Windsurf, Zed, Continue, and OpenClaw at once. Author it once; every tool reads it.
 
 This page is the fast path: install, configure a repo, do a task, and watch the ledger
 start paying off on day two.
diff --git a/README.md b/README.md
index 93591f82..b863c5ae 100644
--- a/README.md
+++ b/README.md
@@ -14,28 +14,39 @@
   </picture>
 </p>
 
-Forge is one shared brain for your AI coding agents. It gives a stateless model the
-three things it structurally lacks — memory, foresight, and guardrail hooks — and
-delivers them into every tool you use.
-
-> An experimental reliability toolkit for AI-assisted coding — evidence-referenced,
-> content-addressed memory (we call it "proof-carrying memory" / PCM — see the honesty note
-> below), heuristic impact foresight, and guardrail hooks (automatic on Claude Code;
-> instructions and MCP tools elsewhere) — authored once and delivered as native config to
-> Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue, and OpenClaw
-> (plus MCP config for Roo and VS Code). Guardrails reduce risk; they are not a security
-> sandbox.
+**A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis, and
+explicit verification around coding agents.** Forgekit is a Node.js CLI and MCP server with no
+runtime dependencies. You author project rules once, and it emits native configuration for Claude
+Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue and OpenClaw (plus MCP
+configuration for Roo and VS Code). Claude Code is the most deeply exercised integration.
+
+It does three jobs:
+
+1. **Share reliable project knowledge.** Lessons, facts and decisions live in the repository as
+   *evidence-referenced memory*: each claim carries references to its evidence, only tests, CI or
+   a person raise its confidence, and teammates merge it over plain git.
+2. **Inspect likely change impact.** Before an edit, a *heuristic* impact analysis lists the files
+   the change probably touches, including coupled files you did not name. It reads a
+   regex-derived code graph, so it can miss files as well as over-warn.
+3. **Verify the current change.** `forge verify` runs the repository's detected test suites and
+   reports `PASS`, `FAIL`, `INCOMPLETE` or `NOT_CONFIGURED` for the code state it ran on. A run that
+   covers only part of the repository is *partial* verification, and says so.
 
 > **Status: beta — read before you rely on it.**
 >
-> - The core (`init`, `sync`, `substrate`, `impact`, `ledger`, guards) is tested and in daily
->   use; some flags may change before `1.0`.
+> - Releases follow Semantic Versioning ([CHANGELOG](CHANGELOG.md),
+>   [release notes](docs/RELEASING.md)): since 1.0.0 a breaking change ships as a new major
+>   version. "Beta" describes maturity, not interface churn — the analyses are heuristic, the
+>   checks are advisory unless you enable enforcement, and most integrations have less real-world
+>   exercise than Claude Code. The core (`init`, `sync`, `substrate`, `impact`, `ledger`, guards)
+>   is tested and in daily use.
 > - **Claude Code is the deepest-tested integration** (full plugin, ambient `UserPromptSubmit`
->   guards). The other nine tools receive native config plus MCP tools, but have had less
->   real-world exercise. On OpenClaw specifically, rules arrive via `AGENTS.md` project
->   context; the config-only path uses a one-command MCP registration, while installing the
->   package as a compatible Codex bundle loads its skills and bundle-scoped MCP server.
->   Neither path provides ambient hooks (see
+>   guards). The other nine tools receive native config (most also an MCP server entry; Aider
+>   and Windsurf/Devin do not) but no automatic hooks, and have had less real-world exercise.
+>   On OpenClaw specifically, rules arrive via `AGENTS.md` project context; the config-only
+>   path uses a one-command MCP registration, while installing the package as a compatible
+>   Codex bundle loads its skills and bundle-scoped MCP server. Neither path provides ambient
+>   hooks (see
 >   [OpenClaw in ARCHITECTURE](ARCHITECTURE.md#openclaw-what-is-automatic-and-what-is-not)).
 > - **Impact/blast-radius analysis is heuristic** — a regex-approximate code graph, not a sound
 >   call graph. It is not conservative: it can miss affected files as well as flag unaffected
@@ -49,49 +60,9 @@ delivers them into every tool you use.
 >   not require `bash` on `PATH`: their Node launcher finds Git Bash and preserves guard exits.
 >   `protect-paths` needs no bash at all and fails closed: when it cannot reach a verdict, the
 >   tool call is blocked rather than let through.
-
-## Start in 60 seconds
-Forgekit is a beta Node.js CLI and MCP server for AI-assisted software development. It
-externalizes project memory, predicts the likely impact of code changes, and adds
-deterministic checks around coding-agent workflows. The same source can emit native
-configuration for several AI coding tools; Claude Code is the most deeply exercised
-integration.
-
-The project is best read as **agent reliability and developer tooling**. It is not presented
-as an enterprise multi-agent application, a general-purpose RAG platform, or an Azure AI
-deployment.
-
-## Portfolio evidence
-
-For reviewers evaluating hands-on Agentic AI or GenAI work, each claim below links to the
-implementation and its closest test or build proof. The evidence snapshot used for this
-table is default-branch commit
-[`3d9be37`](https://github.com/CodeWithJuber/forgekit/commit/3d9be37e26639c5c0a787d9196562b70444e2640).
-
-| Area | Implementation evidence | Test or delivery evidence | Evidence-safe claim |
-| --- | --- | --- | --- |
-| MCP tools | [`src/mcp_tools.js`](src/mcp_tools.js) defines 21 tool schemas; [`src/cortex_mcp.js`](src/cortex_mcp.js) implements JSON-RPC `initialize`, `tools/list`, and `tools/call` handlers | [`test/mcp.test.js`](test/mcp.test.js), [`test/cortex_mcp.test.js`](test/cortex_mcp.test.js), [current audited CI run](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393690) | Implemented an MCP server that exposes memory, preflight, routing, impact, verification, and health operations to compatible clients |
-| Agent memory | [`src/ledger.js`](src/ledger.js) implements content-addressed claims, an oracle taxonomy, time-decayed validity, ranked retrieval, and a semilattice merge; [`src/ledger_store.js`](src/ledger_store.js) adds persistence, hash verification, and quarantine; [`src/ledger_sync.js`](src/ledger_sync.js) adds directory and git-ref sync | [`test/ledger.test.js`](test/ledger.test.js), [`test/ledger_store.test.js`](test/ledger_store.test.js), [`test/ledger_sync.test.js`](test/ledger_sync.test.js) | Implemented durable, evidence-weighted, mergeable memory for coding-agent workflows |
-| LLM integration | [`src/llm.js`](src/llm.js) implements Anthropic Messages and OpenAI-compatible chat-completions calls; [`src/providers.js`](src/providers.js) configures Anthropic, OpenRouter, LiteLLM, OpenAI, Gemini, and custom endpoints | [`test/llm.test.js`](test/llm.test.js), [`test/providers.test.js`](test/providers.test.js) | Implemented direct, bounded single-prompt LLM adapters and provider configuration; this is not a streaming or autonomous tool-call client loop |
-| Retrieval and embeddings | [`src/context.js`](src/context.js) assembles code definitions, dependants, tests, and trusted lessons under a token budget; [`src/embed.js`](src/embed.js) supports an optional command or OpenAI-compatible embedding endpoint, cosine similarity, and a disk cache; [`src/reuse.js`](src/reuse.js) falls back to MinHash and gates reuse on evidence | [`test/context.test.js`](test/context.test.js), [`test/embed.test.js`](test/embed.test.js), [`test/reuse.test.js`](test/reuse.test.js) | Implemented repository-local retrieval/context augmentation and an optional embedding adapter; no vector database or enterprise-document ingestion pipeline is claimed |
-| Guardrails and verification | [`hooks/hooks.json`](hooks/hooks.json) wires lifecycle hooks; [`global/guards/protect-paths.sh`](global/guards/protect-paths.sh) and [`global/guards/secret-redact.sh`](global/guards/secret-redact.sh) add path and secret controls; [`src/skillgate.js`](src/skillgate.js), [`src/verify.js`](src/verify.js), and [`src/consensus.js`](src/consensus.js) implement scanning and multi-lens checks | [`test/secrets.test.js`](test/secrets.test.js), [`test/skillgate.test.js`](test/skillgate.test.js), [`test/verify.test.js`](test/verify.test.js), [`test/consensus.test.js`](test/consensus.test.js); [Security workflow](https://github.com/CodeWithJuber/forgekit/actions/workflows/security.yml) and [CodeQL](https://github.com/CodeWithJuber/forgekit/actions/workflows/codeql.yml) | Implemented deterministic defence-in-depth controls and evidence-producing verification; the regex guards are not a security sandbox |
-| Human review affordances | [`src/ledger.js`](src/ledger.js) defines human accept/revert oracles; [`src/ledger_store.js`](src/ledger_store.js) implements ratify and retract records | [`test/ledger.test.js`](test/ledger.test.js), [`test/ledger_store.test.js`](test/ledger_store.test.js) | Implemented auditable human correction and ratification paths; no identity-enforced RBAC or enterprise approval workflow is claimed |
-| Agent roles | [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) registers [`scout`](global/crew/scout.md), [`verifier`](global/crew/verifier.md), [`independent-reviewer`](global/crew/independent-reviewer.md), [`frontend-verifier`](global/crew/frontend-verifier.md), and [`doc-sync`](global/crew/doc-sync.md) | [`test/channels.test.js`](test/channels.test.js) checks plugin-channel wiring | Authored five concrete Claude Code role definitions; they are declarative roles, not a multi-agent orchestration runtime |
-| Evaluation | [`src/eval.js`](src/eval.js) calculates precision, recall, and F1; [`bench/bench.mjs`](bench/bench.mjs) provides a seeded benchmark harness; [`reports/benchmarks.md`](reports/benchmarks.md) records methodology and limitations | [`test/eval.test.js`](test/eval.test.js), [`test/bench.test.js`](test/bench.test.js) | Implemented reproducible evaluation for the repository's impact predictor and local performance; the datasets are small and are not field benchmarks |
-| Python research | [`research/python-prototypes/router_gate/`](research/python-prototypes/router_gate/) implements assumption gating, model routing, execution, verification, escalation, CLI, and MCP; [`research/python-prototypes/impact_oracle/`](research/python-prototypes/impact_oracle/) implements Python AST parsing and a persistent NetworkX dependency graph | [`router_gate` tests](research/python-prototypes/router_gate/tests/test_router_gate.py), [`router_gate` live demonstration results](research/python-prototypes/router_gate/eval_results.json), [`impact_oracle` tests](research/python-prototypes/impact_oracle/tests/test_demo_package.py) | Built working Python research prototypes; the shipped Forgekit runtime is Node and the Python packages are not presented as production services |
-| Delivery engineering | [`package.json`](package.json) defines a Node 20+ CLI with no runtime dependencies; [`.github/workflows/release.yml`](.github/workflows/release.yml) gates releases and configures npm provenance; [`.github/workflows/smoke.yml`](.github/workflows/smoke.yml) exercises clean install and uninstall | [Release v0.32.1](https://github.com/CodeWithJuber/forgekit/releases/tag/v0.32.1); successful audited runs for [CI](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393690), [Smoke](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393550), [Security](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393540), [CodeQL](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393514), and [Scorecard](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393496) | Demonstrates packaging, cross-platform CI, security checks, and repeatable OSS release engineering; it does not establish enterprise production operation |
-
-### Maturity boundary
-
-| Evidence level | What belongs here |
-| --- | --- |
-| **Implemented and tested in the Node runtime** | CLI and config emitters; 21 MCP tools; agent memory and sync; code-context assembly; optional embedding adapter; LLM provider adapters; heuristic impact analysis; lifecycle guardrails; verification; benchmark harness; release automation |
-| **Research or integration demonstration** | Five declarative Claude Code agent roles; Python router/gate and impact-oracle packages; a 30-task live routing demonstration; support for external embedding providers; configuration emitted for integrations other than the deeply tested Claude Code path |
-| **Not claimed by this repository** | A collaborating multi-agent runtime; LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, or Copilot Studio; Azure OpenAI or Azure AI Foundry; a vector database; enterprise-document RAG; business-system or RPA connectors; production Python deployment; multi-tenant cloud operation, SLA/SLO, Kubernetes, or infrastructure as code |
-
-Personal maintainer use is intentionally not used as proof of organizational adoption. No
-customer count, enterprise deployment, production traffic, or service-level claim is made
-without corresponding public evidence.
+> - Guardrails reduce risk; they are not a security sandbox. What each integration actually does —
+>   config emission, MCP registration, automatic hooks, blocking — is in
+>   [docs/INTEGRATIONS.md](docs/INTEGRATIONS.md).
 
 ## 60-second quickstart
 
@@ -108,26 +79,35 @@ forge substrate "Change verifyToken in src/auth.js to require length > 20; updat
 ```
 
 The result includes an assumption verdict, a model-tier recommendation, predicted impact,
-context completeness, scope clusters, and a verification checklist. On Claude Code, the
+a context-coverage check (what was delivered, not a proof that it suffices), scope clusters, and
+a verification checklist. On Claude Code, the
 pre-action check can run automatically through a `UserPromptSubmit` hook. On other supported
 tools, Forgekit emits instructions and MCP configuration that the tool can invoke.
 
+The three jobs, one command each:
+
+```bash
+forge ledger query "token validation"   # 1. what does the team already know about this area?
+forge impact verifyToken                 # 2. which files will this edit probably touch?
+forge verify                             # 3. did the change pass the suites that actually ran?
+```
+
 ## Contents
 
-- [Portfolio evidence](#portfolio-evidence)
-- [Maturity boundary](#maturity-boundary)
 - [60-second quickstart](#60-second-quickstart)
 - [Why Forgekit exists](#why-forgekit-exists)
 - [How the loop works](#how-the-loop-works)
 - [Core capabilities](#core-capabilities)
-- [LLMs, retrieval, and embeddings](#llms-retrieval-and-embeddings)
-- [Agent roles and MCP tools](#agent-roles-and-mcp-tools)
-- [Measured evidence](#measured-evidence)
 - [Setup details](#setup-details)
 - [Commands](#commands)
 - [Team memory](#team-memory)
-- [Structural comparison](#structural-comparison)
+- [LLMs, retrieval, and embeddings](#llms-retrieval-and-embeddings)
+- [Agent roles and MCP tools](#agent-roles-and-mcp-tools)
 - [Honest limits](#honest-limits)
+- [Portfolio evidence](#portfolio-evidence)
+- [Maturity boundary](#maturity-boundary)
+- [Measured evidence](#measured-evidence)
+- [Structural comparison](#structural-comparison)
 - [Python research prototypes](#python-research-prototypes)
 - [White paper](#white-paper)
 - [Public site](#public-site)
@@ -170,14 +150,14 @@ so a wrong lesson decays out instead of ossifying. Full design:
 
 ## What you get
 
-The day-to-day value first — the substrate gives a frozen model what it can't hold itself:
+The day-to-day value first — what the substrate keeps outside the model, so it survives between sessions and tools:
 
 - **Memory that persists across sessions and teammates.** _[Implemented]_ Every lesson, fact,
   and verified reuse is _proof-carrying memory (PCM)_ — our name for **evidence-referenced,
   content-addressed memory**: a claim that carries references to its own evidence and is only
   trusted once independent oracles raise its confidence above a floor (the "proof" is that
   evidence trail, not a formal proof). Wrong lessons decay out instead of ossifying.
-- **Foresight before you break things.** _[Heuristic]_ Ask "what does changing `verifyToken`
+- **Heuristic impact before you break things.** _[Heuristic]_ Ask "what does changing `verifyToken`
   break?" and get the _blast radius_ — the set of files an edit is predicted to impact, read
   from a regex-approximate code graph (not sound, and it can miss affected files), including
   coupled files you never named.
@@ -204,14 +184,14 @@ Every number is a median from `npm run bench` on this repo, recorded with its en
 block in [`reports/benchmarks.md`](reports/benchmarks.md) — the project rule is _a number is
 an assumption until measured_.
 
-- **Blast radius in 0.40 ms** (warm code-graph). On 6 hand-labeled cases from this repo's
-  real import graph, recall is 1.00 against 0.27 for looking at the edited file alone, and
+- **Blast radius in 1.68 ms** (warm code-graph). On 6 hand-labeled cases from this repo's
+  real import graph, recall is 1.00 against 0.26 for looking at the edited file alone, and
   precision is 0.17 — `impact` walks reverse dependencies transitively by default, so it
   returns everything downstream while the labels name only the direct referencers (restricted
   to one hop the same cases return their labeled sets). The precision 0.90 this line used to
   quote does not reproduce. On nine real Python repositories the research prototype's impact
   oracle reached recall 0.022 ([refutation](research/empirical-refutation/)).
-- **A full pre-action gate in 886 ms** (median on this repo, warm, on a 4-core Windows VM — this
+- **A full pre-action gate in 851 ms** (median on this repo, warm, on a 4-core Linux VM — this
   row is machine-bound; see the environment block) — assumption check, routing,
   reuse lookup, context assembly, blast radius, scope, and goal anchor in one deterministic
   pass, no LLM call. On Claude Code it runs on **every prompt, automatically**.
@@ -221,8 +201,8 @@ an assumption until measured_.
   judge accepted it cost $1.06 against $1.76, but only 6 and 3 of 64 outputs were accepted
   ([refutation](research/empirical-refutation/)). `forge cost --stages` reports only _your_
   measured stages.
-- **Conflict-free team memory** — merging two 500-claim ledger replicas takes **4308 ms** on that
-  same VM (I/O-bound, 4–6x a Linux host); the
+- **Conflict-free team memory** — merging two 500-claim ledger replicas takes **191 ms** on that
+  same VM (I/O-bound, so it varies with the disk); the
   merge is order-independent and property-tested, so teammate ledgers converge to the same state
   no matter who syncs first, over plain git.
 The substrate is advisory by default. Set `FORGE_ENFORCE=1` to block only its strongest
@@ -245,126 +225,30 @@ from a fresh repository graph.
   candidates.
 - **Budgeted context assembly.** Definitions, direct dependants, sibling tests, and trusted
   lessons are selected under a token budget. Missing required context becomes a question
-  rather than invented context.
+  rather than invented context. Coverage is syntactic — delivered, not proven sufficient — token
+  counts are estimates, and a file that only fits as a "read this" pointer stays a pending read.
 - **Model-tier recommendation.** A deterministic rubric combines task text and repository
   signals. An optional LLM proposal can only lower the tier, confidence-gated and bounded; a
   vote for a higher tier is never applied automatically — it is recorded as an advisory
   `escalateTo` recommendation, which names the tier only once an external check has actually
   failed (the doom-loop diagnosis at its thrash threshold). Forgekit advises which tier to
-  request; it does not itself proxy or fail over model traffic.
+  request; it does not itself proxy or fail over model traffic. The opt-in cross-provider router
+  (`route universal`) minimises **expected routing cost** for a success target; its budgets are
+  expectations, not spend caps, and its benchmark headline is repository-reported. Its shipped
+  prior refits exactly from pinned public data in this repository, and a new in-repo held-out
+  replay finds it no better than a fixed cascade chosen on the same dev tasks
+  ([docs/UNIVERSAL_ROUTING.md](docs/UNIVERSAL_ROUTING.md)).
 - **Proof-gated reuse.** Cached code is served only after evidence clears a confidence floor
   and declared dependencies still resolve in the current repository graph.
 - **Lifecycle guardrails.** Claude Code hooks cover prompt preflight, protected paths, cost
   budget, repeated failures, format-on-edit, secret redaction, completion checks, and session
   learning. These controls reduce risk; they do not create a secure execution boundary.
-- **Independent verification.** `forge verify` runs the repository's detected test suites,
-  reports `PASS`, `FAIL`, `INCOMPLETE`, or `NOT_CONFIGURED` honestly, checks unknown symbols,
-  and binds provenance to the code state. `--deep` adds structural, security, spec-drift,
+- **Verification, partial or full.** `forge verify` runs the repository's detected test
+  suites, reports `PASS`, `FAIL`, `INCOMPLETE`, or `NOT_CONFIGURED`, checks unknown symbols,
+  and binds provenance to the code state it ran on. A verdict covers only the suites that ran:
+  partial coverage is `INCOMPLETE`, not `PASS`. `--deep` adds structural, security, spec-drift,
   impact, and optional model-review lenses.
 
-## LLMs, retrieval, and embeddings
-
-### Direct LLM adapters
-
-`src/llm.js` supports two wire formats:
-
-- Anthropic Messages API;
-- OpenAI-compatible chat completions, used for OpenAI, Gemini, OpenRouter, and LiteLLM.
-
-Credentials are read from environment variables and are not put in command-line arguments.
-The implementation performs a bounded single-prompt request. It does not implement streaming,
-conversation persistence, or a model-driven tool-call execution loop.
-
-### Repository-local retrieval
-
-Forgekit retrieves from its code graph and evidence ledger, then assembles a context bundle
-for an external coding agent. This is retrieval and augmentation for source-code work, not a
-general enterprise RAG pipeline. There is no document connector layer, chunking service,
-citation generator, managed index, or vector database in this repository.
-
-### Optional embeddings
-
-MinHash remains the zero-dependency default. To opt into semantic similarity, configure an
-external provider with one of the formats the current implementation accepts:
-
-```bash
-# OpenAI-compatible embedding endpoint
-export FORGE_EMBED="https://api.example.com/v1/embeddings"
-export FORGE_EMBED_MODEL="your-embedding-model"
-export FORGE_EMBED_KEY="your-provider-key"
-
-# Or a local/external command that implements Forgekit's stdin/stdout vector protocol
-export FORGE_EMBED="cmd:./my-embedding-provider"
-```
-
-Vectors are cached in `.forge/embed-cache.jsonl`. Provider failure, timeout, malformed output,
-or missing vectors falls back to MinHash. The repository test uses a deterministic fake
-provider; it verifies adapter and fallback behavior, not live performance of a hosted model.
-
-The performance snapshot in [`reports/benchmarks.md`](reports/benchmarks.md) was generated at
-commit `eb68ea9` and does not measure the optional embedding path. Current
-embedding behavior is defined by [`src/embed.js`](src/embed.js) and
-[`test/embed.test.js`](test/embed.test.js).
-
-## Agent roles and MCP tools
-
-Forgekit registers five Claude Code role definitions:
-
-- `scout` — read-only repository investigation;
-- `verifier` — fresh-context correctness review;
-- `independent-reviewer` — diff/spec/test-only merge gate;
-- `frontend-verifier` — visual and accessibility review;
-- `doc-sync` — documentation consistency after code changes.
-
-These are concrete role prompts supplied to the host tool. Forgekit does not contain a runtime
-that spawns these roles, exchanges inter-agent messages, or executes a LangGraph-style state
-machine.
-
-The built-in MCP server exposes 21 tools, including:
-
-- pre-action checks: `substrate_check`, `preflight_check`, `assumption_gate`, `route_task`;
-- repository analysis: `predict_impact`, `scope_files`, `rank_code`, `collide_check`;
-- memory: `cortex_lessons`, `forge_remember`, `forge_ledger_query`,
-  `forge_ledger_ratify`, `forge_ledger_retract`;
-- operations: `forge_doctor`, `forge_provider_status`, `forge_cost`, dashboard data.
-
-The MCP server is the tool-provider side of function calling. The compatible host remains
-responsible for deciding when to call a tool and feeding the result back to its model.
-
-## Measured evidence
-
-Numbers below are reported only with their test boundary. See
-[`reports/benchmarks.md`](reports/benchmarks.md) and the linked evaluation artifacts for full
-methodology.
-
-Parser-stable snapshot labels used by the generated project pages are:
-
-- **A full pre-action gate in 886 ms median** — deterministic, warm repository graph, LLM disabled;
-- **Blast radius in 0.40 ms median** — warm impact query; and
-- **20.2% more cost than always-premium** — the held-out routing result. The 62.1% saving the
-  white paper reported came from a 30-task demonstration with thresholds tuned on those same
-  tasks; on 80 pre-registered held-out tasks the same router spent 20.2% *more* (table below).
-  Per judged-correct output the pipeline cost $1.06 against always-premium's $1.76.
-
-The boundaries in the table below are part of each result.
-
-| Measurement | Recorded result | Boundary |
-| --- | ---: | --- |
-| Warm impact query | 0.40 ms median | 30 runs on one JavaScript repository with a memoized adjacency index; not model latency |
-| Deterministic substrate check | 886 ms median | 3 runs on one repository, warm graph, LLM disabled, on a 4-core Windows VM — wall-clock rows are machine-bound and were ~150 ms on the Linux host that produced the pre-2026-09-22 snapshot; re-run `npm run bench` on your own hardware |
-| Impact quality | precision 0.17, recall 1.00, F1 0.29 (the precision 0.90 / F1 0.92 reported before 2026-09-21 do not reproduce) | 6 hand-labelled symbols in this repository (which imports only by relative path, so it does not exercise tsconfig path aliases), scored by `evalImpact` against labels re-derived by `git grep`; `impact` walks reverse dependencies transitively by default, so precision measures the transitive closure against direct-only labels; edited-file-only baseline recall 0.27 |
-| Ledger replica merge | 4308 ms median | 3 runs merging two synthetic 500-claim replicas with 250 claims shared, on the same 4-core Windows VM (I/O-bound: 4–6x the Linux host's figure) |
-| Python router live demonstration | 62.1% calculated cost reduction versus always-premium | 30 hand-labelled tasks, thresholds tuned to the set, real measured LLM tokens, approximate public prices; demonstration, not field benchmark |
-| Python router, held-out evaluation | total spend 20.2% **higher** than always-premium; gate F1 0.37 | 80 tasks from real GitHub issues and PRs, thresholds frozen, pre-registered; refutes the row above |
-| Python impact oracle | precision 0.633, recall 1.000, F1 0.753 | 5 mutations in the bundled demo package; mutation-derived test failures as ground truth |
-| Python impact oracle, real repositories | precision 0.398, recall 0.022, F1 0.042 (grep baseline F1 0.437) | 759 files in 9 open-source repositories, co-change ground truth, pre-registered; refutes the row above |
-
-The current audited CI run at commit `3d9be37` completed successfully for Node 20, Node 22,
-and Windows Git Bash, plus the reusable quality gate. The quality gate ran the Node unit suite,
-Biome checks, TypeScript type checking, critical-level npm audit, ShellCheck, zero-runtime-dependency
-assertion, version and documentation checks, and `npm pack --dry-run`. The Python prototype
-pytest suites are present in the repository but are not part of that current CI workflow.
-
 ## Setup details
 
 Install using one path:
@@ -426,7 +310,7 @@ and output live in [`docs/GUIDE.md`](docs/GUIDE.md).
 |                         | `forge preflight`    | assumption check — what a task names that the repo doesn't define                                                                                                                                                           |
 |                         | `forge impact`       | hazard-aware blast radius — SCC-aware propagation + data-driven threshold from PageRank centrality and ledger incident history                                                                                              |
 |                         | `forge scope`        | decompose files into independent clusters (+ coupled files you didn't name)                                                                                                                                                 |
-|                         | `forge context`      | budgeted context assembly + completeness gate — what an edit NEEDS known                                                                                                                                                    |
+|                         | `forge context`      | budgeted context assembly + completeness gate — what an edit NEEDS known, delivered or owed                                                                                                                                 |
 |                         | `forge route`        | recommend the cheapest capable model for a task (+ gateway config); `route universal`: any provider's models, lowest expected cost for the success asked for, learned from outcomes                                         |
 |                         | `forge verify`       | independent verification gate — tests + hallucinated-symbol + provenance (--deep: multi-lens consensus)                                                                                                                     |
 |                         | `forge precommit`    | commit-level gate — staged code w/o docs + secret scan (FORGE_COMMIT_GATE=block|warn|0)                                                                                                                                     |
@@ -488,32 +372,93 @@ repository's git remote. A non-fast-forward race triggers a re-merge and bounded
 directory can be selected with `--dir <path>` or `FORGE_SYNC_DIR`; `--personal` includes the
 per-user ledger.
 
-## Structural comparison
+## LLMs, retrieval, and embeddings
 
-This table describes architecture, not a claim of superiority or equivalent product scope.
+### Direct LLM adapters
 
-| Concern | Forgekit implements | Boundary |
-| --- | --- | --- |
-| Memory | Content-addressed claims, provenance, oracle-weighted validity, time decay, and git-native union merge | No hosted synchronization, managed database, enterprise tenancy, or RBAC |
-| Retrieval | MinHash retrieval by default; optional external embeddings; proof-gated code reuse | No vector database or general enterprise corpus pipeline |
-| Routing | A visible deterministic recommendation with optional bounded LLM input; LiteLLM alias config emission | Does not proxy traffic, manage quotas, perform failover, or hold provider keys |
-| Tool use | A JSON-RPC MCP server with 21 executable tool handlers | Does not implement the model/client loop that chooses and executes tool calls autonomously |
-| Agent roles | Five host-consumable Claude Code role definitions | No multi-agent graph, scheduler, inter-agent messaging layer, or named orchestration framework |
-| Verification | Repository tests, provenance, structural and security lenses, limited benchmark suites | No managed GenAI evaluation service, production telemetry, online evaluation, or broad red-team certification |
+`src/llm.js` supports two wire formats:
+
+- Anthropic Messages API;
+- OpenAI-compatible chat completions, used for OpenAI, Gemini, OpenRouter, and LiteLLM.
+
+Credentials are read from environment variables and are not put in command-line arguments.
+The implementation performs a bounded single-prompt request. It does not implement streaming,
+conversation persistence, or a model-driven tool-call execution loop.
+
+### Repository-local retrieval
+
+Forgekit retrieves from its code graph and evidence ledger, then assembles a context bundle
+for an external coding agent. This is retrieval and augmentation for source-code work, not a
+general enterprise RAG pipeline. There is no document connector layer, chunking service,
+citation generator, managed index, or vector database in this repository.
+
+### Optional embeddings
+
+MinHash remains the zero-dependency default. To opt into semantic similarity, configure an
+external provider with one of the formats the current implementation accepts:
+
+```bash
+# OpenAI-compatible embedding endpoint
+export FORGE_EMBED="https://api.example.com/v1/embeddings"
+export FORGE_EMBED_MODEL="your-embedding-model"
+export FORGE_EMBED_KEY="your-provider-key"
+
+# Or a local/external command that implements Forgekit's stdin/stdout vector protocol
+export FORGE_EMBED="cmd:./my-embedding-provider"
+```
+
+Vectors are cached in `.forge/embed-cache.jsonl`. Provider failure, timeout, malformed output,
+or missing vectors falls back to MinHash. The repository test uses a deterministic fake
+provider; it verifies adapter and fallback behavior, not live performance of a hosted model.
+
+The performance snapshot in [`reports/benchmarks.md`](reports/benchmarks.md) was generated at
+commit `eb68ea9` and does not measure the optional embedding path. Current
+embedding behavior is defined by [`src/embed.js`](src/embed.js) and
+[`test/embed.test.js`](test/embed.test.js).
+
+## Agent roles and MCP tools
+
+Forgekit registers five Claude Code role definitions:
+
+- `scout` — read-only repository investigation;
+- `verifier` — fresh-context correctness review;
+- `independent-reviewer` — diff/spec/test-only merge gate;
+- `frontend-verifier` — visual and accessibility review;
+- `doc-sync` — documentation consistency after code changes.
+
+These are concrete role prompts supplied to the host tool. Forgekit does not contain a runtime
+that spawns these roles, exchanges inter-agent messages, or executes a LangGraph-style state
+machine.
+
+The built-in MCP server exposes 21 tools, including:
+
+- pre-action checks: `substrate_check`, `preflight_check`, `assumption_gate`, `route_task`;
+- repository analysis: `predict_impact`, `scope_files`, `rank_code`, `collide_check`;
+- memory: `cortex_lessons`, `forge_remember`, `forge_ledger_query`,
+  `forge_ledger_ratify`, `forge_ledger_retract`;
+- operations: `forge_doctor`, `forge_provider_status`, `forge_cost`, dashboard data.
+
+The MCP server is the tool-provider side of function calling. The compatible host remains
+responsible for deciding when to call a tool and feeding the result back to its model.
 
 ## Honest limits
 
-- **Beta software.** The CLI is released and CI-tested, but interfaces may still change before
-  `1.0`. Support is maintainer-led and best-effort; there is no SLA.
+- **Beta software.** The CLI is released, CI-tested and semantically versioned (a breaking
+  change is a major version); "beta" is about maturity and evidence, not about interface churn.
+  Support is maintainer-led and best-effort; there is no SLA.
 - **Claude Code is the deepest-tested integration.** Other emitters and MCP configuration are
   implemented, but the repository does not provide equivalent real-world exercise evidence for
   every supported host.
 - **The code graph is heuristic.** Regex extraction is not a sound call graph and can both
   over-predict and miss dependencies.
 - **Routing is advisory.** Forgekit recommends a tier. LiteLLM or another gateway must be run
-  separately to move traffic, handle failover, enforce quotas, or manage credentials.
+  separately to move traffic, handle failover, enforce quotas, or manage credentials. Routing
+  costs are expected values, not caps, and no cost saving has been measured end to end: the
+  ~90 % figure in the plans is a target (a hypothesis), and the white paper's 62.1 % routing
+  saving was refuted on held-out tasks.
 - **Memory is external state, not model training.** Claims live in files and are retrieved into
-  context; Forgekit does not update model weights.
+  context; Forgekit does not update model weights. It supplies persistence and external checks
+  that a model does not guarantee on its own — one tested way to do that, not the only one.
 - **Embeddings are an adapter, not an included model or vector store.** A user supplies the
   external command or HTTP service. MinHash remains the default and fallback.
 - **Guardrails are defence in depth.** Shell-regex checks can be bypassed and post-tool redaction
@@ -527,6 +472,92 @@ This table describes architecture, not a claim of superiority or equivalent prod
   business-system/RPA connector layer, multi-tenant service, Kubernetes deployment, IaC stack,
   or public production-usage case study in this repository.
 
+## Portfolio evidence
+
+The project is best read as **agent reliability and developer tooling**. It is not presented
+as an enterprise multi-agent application, a general-purpose RAG platform, or an Azure AI
+deployment. Per-claim status (implemented, measured, refuted, hypothesis, partial, reported) is
+kept in [docs/status/](docs/status/README.md).
+
+For reviewers evaluating hands-on Agentic AI or GenAI work, each claim below links to the
+implementation and its closest test or build proof. The evidence snapshot used for this
+table is default-branch commit
+[`3d9be37`](https://github.com/CodeWithJuber/forgekit/commit/3d9be37e26639c5c0a787d9196562b70444e2640).
+
+| Area | Implementation evidence | Test or delivery evidence | Evidence-safe claim |
+| --- | --- | --- | --- |
+| MCP tools | [`src/mcp_tools.js`](src/mcp_tools.js) defines 21 tool schemas; [`src/cortex_mcp.js`](src/cortex_mcp.js) implements JSON-RPC `initialize`, `tools/list`, and `tools/call` handlers | [`test/mcp.test.js`](test/mcp.test.js), [`test/cortex_mcp.test.js`](test/cortex_mcp.test.js), [current audited CI run](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393690) | Implemented an MCP server that exposes memory, preflight, routing, impact, verification, and health operations to compatible clients |
+| Agent memory | [`src/ledger.js`](src/ledger.js) implements content-addressed claims, an oracle taxonomy, time-decayed validity, ranked retrieval, and a semilattice merge; [`src/ledger_store.js`](src/ledger_store.js) adds persistence, hash verification, and quarantine; [`src/ledger_sync.js`](src/ledger_sync.js) adds directory and git-ref sync | [`test/ledger.test.js`](test/ledger.test.js), [`test/ledger_store.test.js`](test/ledger_store.test.js), [`test/ledger_sync.test.js`](test/ledger_sync.test.js) | Implemented durable, evidence-weighted, mergeable memory for coding-agent workflows |
+| LLM integration | [`src/llm.js`](src/llm.js) implements Anthropic Messages and OpenAI-compatible chat-completions calls; [`src/providers.js`](src/providers.js) configures Anthropic, OpenRouter, LiteLLM, OpenAI, Gemini, and custom endpoints | [`test/llm.test.js`](test/llm.test.js), [`test/providers.test.js`](test/providers.test.js) | Implemented direct, bounded single-prompt LLM adapters and provider configuration; this is not a streaming or autonomous tool-call client loop |
+| Retrieval and embeddings | [`src/context.js`](src/context.js) assembles code definitions, dependants, tests, and trusted lessons under a token budget; [`src/embed.js`](src/embed.js) supports an optional command or OpenAI-compatible embedding endpoint, cosine similarity, and a disk cache; [`src/reuse.js`](src/reuse.js) falls back to MinHash and gates reuse on evidence | [`test/context.test.js`](test/context.test.js), [`test/embed.test.js`](test/embed.test.js), [`test/reuse.test.js`](test/reuse.test.js) | Implemented repository-local retrieval/context augmentation and an optional embedding adapter; no vector database or enterprise-document ingestion pipeline is claimed |
+| Guardrails and verification | [`hooks/hooks.json`](hooks/hooks.json) wires lifecycle hooks; [`global/guards/protect-paths.sh`](global/guards/protect-paths.sh) and [`global/guards/secret-redact.sh`](global/guards/secret-redact.sh) add path and secret controls; [`src/skillgate.js`](src/skillgate.js), [`src/verify.js`](src/verify.js), and [`src/consensus.js`](src/consensus.js) implement scanning and multi-lens checks | [`test/secrets.test.js`](test/secrets.test.js), [`test/skillgate.test.js`](test/skillgate.test.js), [`test/verify.test.js`](test/verify.test.js), [`test/consensus.test.js`](test/consensus.test.js); [Security workflow](https://github.com/CodeWithJuber/forgekit/actions/workflows/security.yml) and [CodeQL](https://github.com/CodeWithJuber/forgekit/actions/workflows/codeql.yml) | Implemented deterministic defence-in-depth controls and evidence-producing verification; the regex guards are not a security sandbox |
+| Human review affordances | [`src/ledger.js`](src/ledger.js) defines human accept/revert oracles; [`src/ledger_store.js`](src/ledger_store.js) implements ratify and retract records | [`test/ledger.test.js`](test/ledger.test.js), [`test/ledger_store.test.js`](test/ledger_store.test.js) | Implemented auditable human correction and ratification paths; no identity-enforced RBAC or enterprise approval workflow is claimed |
+| Agent roles | [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) registers [`scout`](global/crew/scout.md), [`verifier`](global/crew/verifier.md), [`independent-reviewer`](global/crew/independent-reviewer.md), [`frontend-verifier`](global/crew/frontend-verifier.md), and [`doc-sync`](global/crew/doc-sync.md) | [`test/channels.test.js`](test/channels.test.js) checks plugin-channel wiring | Authored five concrete Claude Code role definitions; they are declarative roles, not a multi-agent orchestration runtime |
+| Evaluation | [`src/eval.js`](src/eval.js) calculates precision, recall, and F1; [`bench/bench.mjs`](bench/bench.mjs) provides a seeded benchmark harness; [`reports/benchmarks.md`](reports/benchmarks.md) records methodology and limitations | [`test/eval.test.js`](test/eval.test.js), [`test/bench.test.js`](test/bench.test.js) | Implemented reproducible evaluation for the repository's impact predictor and local performance; the datasets are small and are not field benchmarks |
+| Python research | [`research/python-prototypes/router_gate/`](research/python-prototypes/router_gate/) implements assumption gating, model routing, execution, verification, escalation, CLI, and MCP; [`research/python-prototypes/impact_oracle/`](research/python-prototypes/impact_oracle/) implements Python AST parsing and a persistent NetworkX dependency graph | [`router_gate` tests](research/python-prototypes/router_gate/tests/test_router_gate.py), [`router_gate` live demonstration results](research/python-prototypes/router_gate/eval_results.json), [`impact_oracle` tests](research/python-prototypes/impact_oracle/tests/test_demo_package.py) | Built working Python research prototypes; the shipped Forgekit runtime is Node and the Python packages are not presented as production services |
+| Delivery engineering | [`package.json`](package.json) defines a Node 20+ CLI with no runtime dependencies; [`.github/workflows/release.yml`](.github/workflows/release.yml) gates releases and configures npm provenance; [`.github/workflows/smoke.yml`](.github/workflows/smoke.yml) exercises clean install and uninstall | [Release v0.32.1](https://github.com/CodeWithJuber/forgekit/releases/tag/v0.32.1); successful audited runs for [CI](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393690), [Smoke](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393550), [Security](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393540), [CodeQL](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393514), and [Scorecard](https://github.com/CodeWithJuber/forgekit/actions/runs/33693393496) | Demonstrates packaging, cross-platform CI, security checks, and repeatable OSS release engineering; it does not establish enterprise production operation |
+
+### Maturity boundary
+
+| Evidence level | What belongs here |
+| --- | --- |
+| **Implemented and tested in the Node runtime** | CLI and config emitters; 21 MCP tools; agent memory and sync; code-context assembly; optional embedding adapter; LLM provider adapters; heuristic impact analysis; lifecycle guardrails; verification; benchmark harness; release automation |
+| **Research or integration demonstration** | Five declarative Claude Code agent roles; Python router/gate and impact-oracle packages; a 30-task live routing demonstration; support for external embedding providers; configuration emitted for integrations other than the deeply tested Claude Code path |
+| **Not claimed by this repository** | A collaborating multi-agent runtime; LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, or Copilot Studio; Azure OpenAI or Azure AI Foundry; a vector database; enterprise-document RAG; business-system or RPA connectors; production Python deployment; multi-tenant cloud operation, SLA/SLO, Kubernetes, or infrastructure as code |
+
+Personal maintainer use is intentionally not used as proof of organizational adoption. No
+customer count, enterprise deployment, production traffic, or service-level claim is made
+without corresponding public evidence.
+
+## Measured evidence
+
+Numbers below are reported only with their test boundary. See
+[`reports/benchmarks.md`](reports/benchmarks.md) and the linked evaluation artifacts for full
+methodology.
+
+Parser-stable snapshot labels used by the generated project pages are:
+
+- **A full pre-action gate in 851 ms median** — deterministic, warm repository graph, LLM disabled;
+- **Blast radius in 1.68 ms median** — warm impact query; and
+- **20.2% more cost than always-premium** — the held-out routing result. The 62.1% saving the
+  white paper reported came from a 30-task demonstration with thresholds tuned on those same
+  tasks; on 80 pre-registered held-out tasks the same router spent 20.2% *more* (table below).
+  Per judged-correct output the pipeline cost $1.06 against always-premium's $1.76.
+
+The boundaries in the table below are part of each result.
+
+| Measurement | Recorded result | Boundary |
+| --- | ---: | --- |
+| Warm impact query | 1.68 ms median | 30 runs on one JavaScript repository with a memoized adjacency index; not model latency |
+| Deterministic substrate check | 851 ms median | 3 runs on one repository, warm graph, LLM disabled, on a 4-core Linux VM (Node v22.22.2, recorded 2026-09-26 in the environment block) — wall-clock rows are machine-bound; re-run `npm run bench` on your own hardware |
+| Impact quality | precision 0.17, recall 1.00, F1 0.28 (the precision 0.90 / F1 0.92 reported before 2026-09-21 do not reproduce) | 6 hand-labelled symbols in this repository (which imports only by relative path, so it does not exercise tsconfig path aliases), scored by `evalImpact` against labels re-derived by `git grep`; `impact` walks reverse dependencies transitively by default, so precision measures the transitive closure against direct-only labels; edited-file-only baseline recall 0.26 |
+| Ledger replica merge | 191 ms median | 3 runs merging two synthetic 500-claim replicas with 250 claims shared, on the same 4-core Linux VM (I/O-bound: varies with the disk more than the CPU-bound rows do) |
+| Python router live demonstration | 62.1% calculated cost reduction versus always-premium (repriced tokens; refuted by the next row) | 30 hand-labelled tasks, thresholds tuned to the set, real measured LLM tokens, approximate public prices; demonstration, not field benchmark |
+| Python router, held-out evaluation | total spend 20.2% **higher** than always-premium; gate F1 0.37; success = judge-accepted (6/64 vs 3/64), not test-verified | 80 tasks from real GitHub issues and PRs, thresholds frozen, pre-registered; refutes the row above |
+| Python impact oracle | precision 0.633, recall 1.000, F1 0.753 | 5 mutations in the bundled demo package; mutation-derived test failures as ground truth |
+| Python impact oracle, real repositories | precision 0.398, recall 0.022, F1 0.042 (grep baseline F1 0.437) | 759 files in 9 open-source repositories, co-change ground truth, pre-registered; refutes the row above |
+
+The current audited CI run at commit `3d9be37` completed successfully for Node 20, Node 22,
+and Windows Git Bash, plus the reusable quality gate. The quality gate ran the Node unit suite,
+Biome checks, TypeScript type checking, critical-level npm audit, ShellCheck, zero-runtime-dependency
+assertion, version and documentation checks, and `npm pack --dry-run`. The Python prototype
+pytest suites were not part of CI at that commit; since `aedddf5` a separate CI job runs both
+prototype suites, the Theorem D sanity checks (`research/recompute_corrections.py
+--theorem-checks`) and the recomputation of every corrected number from the replication package.
+
+## Structural comparison
+
+This table describes architecture, not a claim of superiority or equivalent product scope.
+
+| Concern | Forgekit implements | Boundary |
+| --- | --- | --- |
+| Memory | Content-addressed claims, provenance, oracle-weighted validity, time decay, and git-native union merge | No hosted synchronization, managed database, enterprise tenancy, or RBAC |
+| Retrieval | MinHash retrieval by default; optional external embeddings; proof-gated code reuse | No vector database or general enterprise corpus pipeline |
+| Routing | A visible deterministic recommendation with optional bounded LLM input; LiteLLM alias config emission | Does not proxy traffic, manage quotas, perform failover, or hold provider keys |
+| Tool use | A JSON-RPC MCP server with 21 executable tool handlers | Does not implement the model/client loop that chooses and executes tool calls autonomously |
+| Agent roles | Five host-consumable Claude Code role definitions | No multi-agent graph, scheduler, inter-agent messaging layer, or named orchestration framework |
+| Verification | Repository tests, provenance, structural and security lenses, limited benchmark suites | No managed GenAI evaluation service, production telemetry, online evaluation, or broad red-team certification |
+
 ## Python research prototypes
 
 The Python packages under [`research/python-prototypes/`](research/python-prototypes/) are the
@@ -553,8 +584,13 @@ that set, not a general accuracy estimate. Despite legacy package metadata using
 ### Impact Oracle
 
 [`impact_oracle`](research/python-prototypes/impact_oracle/) parses Python ASTs, stores a NetworkX
-dependency graph as JSON, and predicts change impact through reverse-dependency traversal. The
-bundled evaluation mutates five symbols and uses pytest failures as independent ground truth.
+dependency graph as JSON, and predicts change impact through reverse-dependency traversal plus the
+repaired sibling and forward relations (the in-tree package is the repaired v2, 49 tests). The
+bundled evaluation mutates five symbols and uses pytest failures as independent ground truth. On
+nine real repositories the as-shipped traversal reached recall 0.022; the repaired version's
+held-out point estimate is above grep's, but that it beats grep is not established
+([refutation](research/empirical-refutation/)). The Node `forge impact` graph is a different,
+regex-derived implementation and inherits none of these numbers.
 
 The production Forgekit equivalents are the Node implementations behind `forge preflight`,
 `forge route`, `forge atlas`, `forge impact`, and the MCP substrate tools.
@@ -564,7 +600,12 @@ The production Forgekit equivalents are the Node implementations behind `forge p
 The [cognitive-substrate white paper](docs/cognitive-substrate/) explains the motivation,
 formal model, evidence map, adjacent work, and the relationship between the Python research
 prototypes and the current Node implementation. Treat the paper's measurements according to
-their stated methodology; do not blend results from different codebases or evaluation sets.
+their stated methodology; do not blend results from different codebases or evaluation sets. The
+"faculty" and theorem language lives there and in [`research/`](research/), with dated
+corrections: the papers now state what a frozen model does not guarantee (durable state across
+calls, context beyond the window, weight updates from outcomes, reliable self-verification) rather
+than claiming it cannot adapt at all, and they name the prior art (CoALA, Reflexion) the
+architecture builds on. Their PDFs are historical, pre-correction editions; read the HTML.
 
 ## Public site
 
@@ -588,6 +629,9 @@ not an AI application deployment.
 | --- | --- |
 | [`ONBOARDING.md`](ONBOARDING.md) | Five-minute setup and design principles |
 | [`docs/GUIDE.md`](docs/GUIDE.md) | Full command reference, worked examples, MCP schemas, and honest limits |
+| [`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md) | Per-tool behaviour: config emission, MCP registration, automatic hooks, blocking — and how each is tested |
+| [`docs/UNIVERSAL_ROUTING.md`](docs/UNIVERSAL_ROUTING.md) | The cross-provider router: model, shipped prior, evidence status and modeling limits |
+| [`docs/status/`](docs/status/README.md) | Machine-readable status of every load-bearing claim (generated table) |
 | [`ARCHITECTURE.md`](ARCHITECTURE.md) | Runtime layers, emitters, state, and design decisions |
 | [`reports/benchmarks.md`](reports/benchmarks.md) | Reproducible benchmark snapshot, methodology, environment, and limitations |
 | [`research/python-prototypes/README.md`](research/python-prototypes/README.md) | Explicit maturity boundary for the Python research packages |
diff --git a/ROADMAP.md b/ROADMAP.md
index 25670832..14a10ff5 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,8 +1,9 @@
 # Roadmap
 
-forgekit is one brain for every AI coding agent — the cognitive substrate (memory, foresight,
-guardrails) that a stateless model is missing, authored once and delivered as native config to
-every tool. This is where that brain is headed.
+forgekit is a beta toolkit for shared evidence-referenced memory, heuristic change-impact
+analysis, and explicit verification around coding agents — the state and checks a model does not
+carry between sessions on its own, authored once and delivered as native config to every tool.
+This is where it is headed.
 
 Direction, not promises — shaped by the two field reports this project is grounded in
 (the SDLC pain-point map and the ecosystem landscape). Open a Discussion to weigh in.
@@ -19,10 +20,13 @@ Gateway environments are supported end to end — `ANTHROPIC_AUTH_TOKEN` recogni
 `ANTHROPIC_BASE_URL`, and direct-HTTP LLM calls when the `claude` CLI is absent (`src/llm.js`).
 See [CHANGELOG.md](./CHANGELOG.md).
 
-## Shipped — Substrate v2 (all phases P0–P8, v0.5.0)
+## Shipped — Substrate v2 (P0–P3 and P5–P7, v0.5.0; P4 and P8 partial)
 
 The plan lives in [docs/plans/substrate-v2/](./docs/plans/substrate-v2/00-overview.md)
-(phase dependency graph + acceptance gates, all marked done): every paper faculty and
+(phase dependency graph + acceptance gates). Two phases do not meet their acceptance criteria and
+are marked **partial**: P4 context assembly (budget overflow and pointer-only coverage were
+reported as complete; the repair reports them) and P8 evaluation (no end-to-end cost has been
+measured). Per-claim status is in [docs/status/](./docs/status/README.md). Every paper faculty and
 mechanism mapped to an algorithm, unified by the **Proof-Carrying Memory (PCM)
 protocol** (ADR-0006) — every stored thing is a claim that carries its evidence, earns
 confidence only from independent oracles, and merges across teammates conflict-free
@@ -68,12 +72,17 @@ confidence only from independent oracles, and merges across teammates conflict-f
   ledger is the sole store. `FORGE_LEDGER_ONLY=0` is a one-release escape hatch that restores
   the file store. The only remaining step is deleting the now-dormant legacy write/read code
   once that escape hatch is removed in a later release.
-- **OpenAI + Gemini provider detection** — extend `autoDetectProvider()` beyond
-  Anthropic/OpenRouter/LiteLLM (`OPENAI_API_KEY`, `GEMINI_API_KEY`) with the same
-  guided, low-configuration auto-detect contract.
-- **Playwright loop** — still open: interaction checks and feeding verdicts back as
-  oracle evidence on design claims (fingerprinting itself shipped as
-  `forge uicheck visual`).
+- **Evidence before stronger claims** — the 2026-09-26 review's evaluation plan: an impact study
+  on unseen repositories with the parser and relations frozen first, and co-edited-file prediction
+  and regression-test selection reported separately; the universal router on a new scaffold, time
+  split or language with real spend under an external cap, with a cascade cost model that
+  conditions on earlier failures (the in-repo replay under-predicts cascade cost by 5–22%); and
+  the P8 paired end-to-end cost harness. Until they run, the matching headlines stay `hypothesis` or `reported` in
+  [docs/status/](./docs/status/README.md).
+- **UI checks stay advisory** until a labelled set (keyboard, focus order, zoom, overflow,
+  reduced motion, screen-reader names) measures their false-positive cost. OpenAI + Gemini
+  provider detection (0.17.0) and the Playwright interaction loop (`forge uicheck interact`,
+  0.16.0) have shipped; this list used to show both as open.
 - **Advisory → gated promotions** — the measured-promotion gate has shipped
   (`src/promote.js`, generalizing the risk predictor's kill-criteria): a candidate only
   replaces a baseline when it beats it on held-out data, never by assertion. First
diff --git a/bench/bench.mjs b/bench/bench.mjs
index 1e8b6930..3ba4d12c 100644
--- a/bench/bench.mjs
+++ b/bench/bench.mjs
@@ -166,8 +166,32 @@ function fillLedger(dir, { count, offset = 0, evidenceEvery = 4 }) {
   }
 }
 
-/** n in-memory artifact claims, each with one test.run confirm so it clears SERVE_FLOOR. */
-function makeArtifacts(n) {
+/**
+ * A real git object to cite as evidence: a throwaway one-commit repo, and its full commit id,
+ * checked to resolve (`git cat-file -e`) — the same resolution appendEvidence performs. The
+ * old fixture cited `bench:artifact:<i>`, an untyped ref that val() caps below SERVE_FLOOR, so
+ * every "exact"/"near" row actually measured a MISS (review F14).
+ * @returns {{dir: string, oid: string}}
+ */
+export function resolvedEvidenceRepo() {
+  const dir = mkdtempSync(join(tmpdir(), "forge-bench-git-"));
+  const g = (...args) => execFileSync("git", args, { cwd: dir, stdio: "ignore" });
+  g("init");
+  g("config", "user.email", "bench@example.invalid");
+  g("config", "user.name", "bench");
+  g("config", "commit.gpgsign", "false");
+  writeFileSync(join(dir, "fixture.txt"), "reuse bench fixture\n");
+  g("add", "-A");
+  g("commit", "-m", "bench fixture");
+  const oid = execFileSync("git", ["rev-parse", "HEAD"], { cwd: dir, encoding: "utf8" }).trim();
+  g("cat-file", "-e", oid); // throws if it does not resolve
+  return { dir, oid };
+}
+
+/** n in-memory artifact claims, each with one RESOLVED test.run confirm (a `git:` object id)
+ *  so it genuinely clears SERVE_FLOOR. `ref` overrides the evidence ref — a stale/unresolved
+ *  fixture for the validation self-test. */
+export function makeArtifacts(n, { ref }) {
   const rand = mulberry32(42);
   const claims = [];
   const specs = [];
@@ -179,23 +203,43 @@ function makeArtifacts(n) {
       0,
     );
     if (!minted.ok) throw new Error(minted.reason);
-    const o = outcomeRecord({
-      oracle: "test.run",
-      result: "confirm",
-      ref: `bench:artifact:${i}`,
-      author: "bench",
-      t: 0,
-    });
-    minted.claim.evidence = o.ok ? [o.outcome] : [];
+    const o = outcomeRecord({ oracle: "test.run", result: "confirm", ref, author: "bench", t: 0 });
+    if (!o.ok) throw new Error(`bench evidence rejected: ${o.reason}`);
+    minted.claim.evidence = [o.outcome];
     claims.push(minted.claim);
   }
   return { claims, specs };
 }
 
-const coldSketches = (claims) => {
-  for (const c of claims) delete c._sketch;
+/** Strip EVERY memoized sketch the lookup path caches — ledger.js's claim-text `_sketch`/
+ *  `_terms` and reuse.js's `_specSketch`/`_keySketch` — so a "cold" row behaves like a fresh
+ *  process. (It used to delete `_sketch` only, which reuse never reads.) */
+export const coldSketches = (claims) => {
+  for (const c of claims) {
+    delete c._sketch;
+    delete c._terms;
+    delete c._specSketch;
+    delete c._keySketch;
+  }
 };
 
+/**
+ * A row is only labeled with a tier it actually exercised: run the lookup once, untimed, and
+ * abort the benchmark unless the expected tier comes back (review F14).
+ * @param {any[]} claims
+ * @param {string} spec
+ * @param {"exact"|"near"|"adapt"|"miss"} tier
+ */
+export function expectTier(claims, spec, tier) {
+  coldSketches(claims);
+  const r = lookup(claims, spec);
+  if (r.tier !== tier)
+    throw new Error(
+      `bench fixture invalid: expected a ${tier} lookup, got ${r.tier}${r.reasons?.length ? ` (${r.reasons.slice(0, 2).join("; ")})` : ""}`,
+    );
+  return r;
+}
+
 // ---------------------------------------------------------------------------
 // The run
 // ---------------------------------------------------------------------------
@@ -204,6 +248,17 @@ function environment() {
   let commit = "unknown";
   try {
     commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: REPO_ROOT }).toString().trim();
+    // Numbers measured on an uncommitted tree are not the numbers OF that commit — say so.
+    const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: REPO_ROOT })
+      .toString()
+      .trim();
+    if (dirty) commit += " + uncommitted changes";
+  } catch {}
+  // The filesystem the tmpdir fixtures live on changes the disk-bound rows (A06).
+  let fsType = "unknown";
+  try {
+    if (platform() === "linux")
+      fsType = execFileSync("stat", ["-f", "-c", "%T", tmpdir()], { encoding: "utf8" }).trim();
   } catch {}
   return {
     node: process.version,
@@ -212,6 +267,7 @@ function environment() {
     memGB: Math.round(totalmem() / 2 ** 30),
     platform: platform(),
     arch: arch(),
+    fsType,
     commit,
     date: new Date().toISOString(),
   };
@@ -240,7 +296,7 @@ function runBenchmarks() {
       "atlas",
       "full build (this repo)",
       tFull,
-      `${atlas.files} files, ${atlas.symbols.length} symbols, ${atlas.edges.length} edges`,
+      `${atlas.files} files, ${atlas.symbols.length} symbols, ${atlas.edges.length} edges${atlas.capped ? `, CAPPED at ${atlas.cap} files` : `, cap ${atlas.cap ?? "none"} not reached`}`,
     );
     const tIncr = timeIt(
       () => {
@@ -335,10 +391,17 @@ function runBenchmarks() {
       tFp,
       fmtRate(fpSpecs.length / (tFp.median / 1000)),
     );
+    const evidence = resolvedEvidenceRepo();
+    cleanup.push(evidence.dir);
     for (const n of [100, 1000]) {
-      const { claims, specs } = makeArtifacts(n);
+      const { claims, specs } = makeArtifacts(n, { ref: `git:${evidence.oid}` });
       const exactQ = specs[n >> 1];
       const nearQ = `${specs[n >> 1]} gently`; // superset tokens → Jaccard ≈ 0.97 → near tier
+      const missQ = "configure the blue ocean lighthouse keeper rotation schedule";
+      // Validate BEFORE timing: each row must exercise the tier it is labeled with.
+      expectTier(claims, exactQ, "exact");
+      expectTier(claims, nearQ, "near");
+      expectTier(claims, missQ, "miss");
       let hit = null;
       const tExact = timeIt(
         () => {
@@ -347,7 +410,14 @@ function runBenchmarks() {
         },
         { runs: 10, warmup: 2 },
       );
-      push("reuse", `lookup exact @ ${n} artifacts`, tExact, `tier=${hit.tier}`);
+      push("reuse", `lookup exact hit, cold @ ${n} artifacts`, tExact, `tier=${hit.tier}`);
+      const tExactWarm = timeIt(
+        () => {
+          hit = lookup(claims, exactQ); // memoized sketches kept: a long-lived process
+        },
+        { runs: 10, warmup: 2 },
+      );
+      push("reuse", `lookup exact hit, warm @ ${n} artifacts`, tExactWarm, `tier=${hit.tier}`);
       const tNear = timeIt(
         () => {
           coldSketches(claims);
@@ -357,10 +427,18 @@ function runBenchmarks() {
       );
       push(
         "reuse",
-        `lookup near (LSH) @ ${n} artifacts`,
+        `lookup near hit (LSH), cold @ ${n} artifacts`,
         tNear,
         `tier=${hit.tier}, j=${hit.jaccard?.toFixed(2) ?? "-"}`,
       );
+      const tMiss = timeIt(
+        () => {
+          coldSketches(claims);
+          hit = lookup(claims, missQ);
+        },
+        { runs: 5, warmup: 1 },
+      );
+      push("reuse", `lookup miss, cold @ ${n} artifacts`, tMiss, `tier=${hit.tier}`);
     }
 
     // --- context: assemble() on this repo for a representative task ----------------
@@ -409,17 +487,27 @@ const RESULT_HEADERS = ["suite", "benchmark", "median", "p95", "runs", "notes"];
 const QUALITY_HEADERS = ["case (target)", "precision", "recall", "F1", "predicted", "truth"];
 const SERIES_HEADERS = ["series", "precision", "recall", "F1", "ground truth"];
 
-/** Paper prototype vs this repo — two different methodologies, side by side and
- *  labeled, NEVER averaged or blended. The paper row is a constant from the
- *  whitepaper (Figure 5 / deliverable-package.md), not something this harness ran. */
+/** Paper prototype vs this repo — different methodologies, side by side and labeled,
+ *  NEVER averaged or blended. The two paper rows are constants, not something this harness
+ *  ran: the self-built demo (whitepaper Figure 5 / deliverable-package.md), which the
+ *  pre-registered field study REFUTED, and that field study's own result on real co-change
+ *  data (research/empirical-refutation; recomputed by the 2026-09-26 external review). The
+ *  regex atlas measured below is a different (Node) graph — not the evaluated Python oracle. */
 export function seriesRows(quality) {
   return [
     [
-      "paper prototype (Python, mutation-derived)",
+      "paper prototype, self-built demo (REFUTED)",
       "0.63",
       "1.00",
       "0.75",
-      "mutation testing against a real suite",
+      "mutation testing on the authors' own fixture",
+    ],
+    [
+      "paper prototype, field study (pooled, 9 repos)",
+      "0.40",
+      "0.02",
+      "0.04",
+      "759 files' mined co-change (research/empirical-refutation)",
     ],
     [
       "this repo (regex atlas, hand-labeled)",
@@ -475,7 +563,7 @@ function resultsMarkdown(env, rows, quality) {
     "",
     `Edited-file-only baseline recall over the same cases: **${quality.baseline.recall.toFixed(2)}**.`,
     "",
-    "Two methodologies, side by side — different codebases, different ground-truth",
+    "Different methodologies, side by side — different codebases, different ground-truth",
     "derivations, so the rows are comparable in spirit only and are never blended:",
     "",
     formatTable(SERIES_HEADERS, seriesRows(quality), { markdown: true }),
diff --git a/bench/impact_cases.mjs b/bench/impact_cases.mjs
index f0ae7195..c84ed07d 100644
--- a/bench/impact_cases.mjs
+++ b/bench/impact_cases.mjs
@@ -48,13 +48,15 @@
 //   - test/ledger.test.js imports { mergeStates } (:14) and calls it
 //   (src/ledger_sync.js:3 also names it in the module header — same file, already labeled.)
 //
-// claimText (src/ledger.js) — 10 files
+// claimText (src/ledger.js) — 11 files
 //   - src/ledger.js       defines it (:610); sketchOf() (:636), termsOf() (:637) and :880 call it
 //   - src/context.js      imports { claimText } (:13) and calls it (:185)
 //   - src/dash.js         imports { claimText } (:16) and calls it (:58, :389, :400)
 //   - src/deja.js         imports { claimText } (:19) and calls it (:179)
 //   - src/ledger_store.js imports { claimText } (:26) and calls it (:663)
-//   - src/cli.js          dynamic-imports { claimText } (:874, :1644) and calls it
+//   - src/cli.js          dynamic-imports { claimText } (:989) and calls it (:1012, :1023)
+//   - src/cli/memory.js   dynamic-imports { claimText } (:251) and calls it (:257, :283, :313)
+//                         — the recall/brain handlers moved here out of src/cli.js (review A03)
 //   - src/cortex_mcp.js   dynamic-imports { claimText } (:91) and calls it (:96, :106)
 //   - test/ledger.test.js imports { claimText } (:8) and calls it
 //   - src/learn_consolidate.js imports { claimText } (:32) and calls it (:110)
@@ -123,6 +125,7 @@ export const IMPACT_CASES = [
       "src/ledger_retention.js",
       "src/ledger_store.js",
       "src/cli.js",
+      "src/cli/memory.js",
       "src/cortex_mcp.js",
       "test/ledger.test.js",
     ],
diff --git a/bench/universal-router/README.md b/bench/universal-router/README.md
index 5883e2ae..ab40587d 100644
--- a/bench/universal-router/README.md
+++ b/bench/universal-router/README.md
@@ -4,13 +4,128 @@
 outcomes (`forge route outcome`, then `forge route fit`). It was fitted from public per-task
 results:
 
-- **Tasks:** the 500 issues of SWE-bench Verified (dataset revision `78f471b`); the issue text is the task.
+- **Tasks:** the 500 issues of SWE-bench Verified (Hugging Face `SWE-bench/SWE-bench_Verified`, revision `78f471b`). The issue text (`problem_statement`) is the task.
 - **Runs:** eleven models from seven providers, each run once per issue with the same agent scaffold (mini-SWE-agent 2.0.0), taken from SWE-bench/experiments @ `40f164d` (runs dated 2026-02-17). Each run gives a verified resolved/unresolved outcome and the observed cost.
 
-To regenerate it, build the input JSON, then run:
+The fit chooses the latent dimension k and the prior scale by 3-fold cross-validation. That selection is recorded in `selection` inside the file.
+
+Raw per-task results are not redistributed here, only the fitted parameters and their provenance.
+The scripts below download them from the pinned public sources into a work directory outside the
+repository. Do not commit what they write.
+
+## Reproduction status (2026-09-26)
+
+| What | Status | Evidence |
+|---|---|---|
+| Source availability | Public and pinned | `sources.json` pins all twelve source files: URL, revision or commit, size and sha256, plus the git blob id of each GitHub file. Revision `78f471b` is in `SWE-bench/SWE-bench_Verified`; `princeton-nlp/SWE-bench_Verified` does not contain it. |
+| Calculation: refit the shipped prior from public data | Reproduced exactly, from this repository alone | `reproduce.sh`, run from an empty work directory: all 176 values identical to `data/router_prior.json` (k=1, scale 4), with the router code of `d2abfa6` and again with the review changes later committed as `aedddf5` (runs below). Only `provenance.fittedAt` differs. |
+| Pipeline: the run-4 held-out headline | Not reproducible from this repository | The 76.3% solved at $0.093 per task result comes from harness-bench. Its 150/350 split ids, pre-registration, baseline selection and metric aggregation are not in this repository. `holdout_eval.mjs` (below) is a different experiment and does not stand in for it. |
+| Independent external replication | Repository-reported only | The 2026-09-22 replication at the end of this file is reported by this repository and has not been checked by a third party. The refits below ran in the project's own development environment: they show that the calculation reproduces, not that someone else replicated it. The external review of 2026-09-26 stopped its refit at a 180 s limit; the refit takes about 7 minutes on the machine below. |
+
+The refit runs of 2026-09-26, each from an empty work directory, on Node v22.22.2, Python 3.11.15,
+pyarrow 25.0.1, Linux x64, Intel Xeon @ 2.80GHz (4 vCPU):
+
+| Router code the fit ran | Values of the shipped prior reproduced | Values only in the refit | Fit time |
+|---|---|---|---|
+| HEAD `d2abfa6`, no uncommitted change to `src/router`, `src/route.js` or `data/models.json` (`git status` before and after; router code unchanged since the fit) | 176 of 176, identical | 8: `provenance.build` | 413 s |
+| HEAD `d2abfa6` plus uncommitted changes to `src/router/cost.js`, `index.js`, `policy.js` and `registry.js` (review F11/F12; 290 lines added, 41 removed), byte-identical to those files as later committed in `aedddf5` | 176 of 176, identical | 35: `provenance.build`, and the new cost diagnostics `method`, `s2Source`, `counts`, `alphaSE`, `excluded` | 424 s |
+
+## Reproduce the shipped prior
+
+```sh
+sh bench/universal-router/reproduce.sh [WORK_DIR]
+```
+
+This is the one entry point. It needs network access to huggingface.co, raw.githubusercontent.com
+and PyPI, `python3` 3.10 or newer with the `venv` module, and `node` 20 or newer. It writes only
+under `WORK_DIR` (default `${TMPDIR:-/tmp}/forgekit-router-repro`):
+
+| Step | What runs | Writes |
+|---|---|---|
+| 1 | a virtual environment with the pinned pyarrow (`requirements.txt`) | `venv/` |
+| 2 | `build_input.py`: downloads the files pinned in `sources.json`, checks each one's size and sha256 (and git blob id for the GitHub files), writes the fitting input | `cache/`, `universal_all.json` |
+| 3 | `fit_prior.mjs`: refits the prior (single-threaded; minutes), timed | `router_prior.json`, `environment.txt` |
+| 4 | `compare_priors.mjs`: checks that every value of `data/router_prior.json` is reproduced | `prior-comparison.json` |
+
+`environment.txt` records the Node, Python and pyarrow versions, the CPU, the fit time, and the
+code the fit ran: the git HEAD and any uncommitted change to `src/router`, `src/route.js` or
+`data/models.json`.
+
+It exits 0 when the refit reproduces every value of the shipped prior except
+`provenance.fittedAt`, and 1 when any value differs or is missing. The comparison is exact:
+numbers must be the same doubles. For each field (for example `mirt.L`) the report gives the
+number of values that differ and the largest absolute difference. Values that only the refit has
+are listed as added, not counted as a mismatch: `provenance.build` from the builder, and any field
+newer code writes (such as the cost diagnostics in the status table). `compare_priors.mjs --strict`
+also fails on additions. A rerun reads `cache/` instead of downloading, and
+`build_input.py --offline --cache DIR` never downloads.
+
+What goes into the input, and why:
+
+- **Task text:** `problem_statement`, verbatim (252 statements keep their CRLF line endings). The builder reads only the `instance_id` and `problem_statement` columns. The parquet also holds the gold patch, the test patch and the evaluation fields, and none of them leave the builder. Keep that evaluator/agent boundary: `universal_all.json` carries outcome labels and costs, so it is training data for the fitter and must never be given to a coding agent as a prompt.
+- **Order:** tasks by `instance_id` ascending (also the parquet's row order and the key order of every run file), models by registry id ascending. Bit-for-bit equality depends on both: feature means are summed in task order, and cross-validation folds are assigned by task index.
+- **Models and runs:** `sources.json` maps each registry id to its run. The builder stops if `data/models.json` names a different `benchmark_run`.
+- **Feature version:** the sha256 of `src/router/features.js` and of `src/route.js` (which holds the rubric and its exemplars), with CRLF read as LF. It is written to `source.build.featureVersion`, which a refit carries into `provenance.build`.
+- **Zero-cost attempts:** Gemini 3 Flash's failed attempts on `django__django-15731` and `django__django-15814` are recorded at cost 0. They stay in the input as failures, which the ability model uses. The cost model uses only positive costs, so `cost.n` is 5,498 of 5,500.
+
+If a refit ever disagrees, look at `features` and `cost` first. Neither depends on the MIRT
+optimiser, so a difference there points at the input: task text, order or registry prices.
+
+## Held-out replay in this repository (a new split, not run 4)
+
+`holdout_eval.mjs` is a new experiment on the same 500 tasks, with its own split. It does not
+reproduce or test the run-4 headline, whose split and metric code are not here.
+
+```sh
+node bench/universal-router/holdout_eval.mjs WORK_DIR/universal_all.json --out WORK_DIR/holdout.json
+```
+
+- **Split:** a Fisher-Yates shuffle of the ids in input order, driven by mulberry32 with seed 20260926 (`--seed`). The first 150 ids are dev and the other 350 are held out. Both id lists are in the output.
+- **Fit:** `buildPrior(input, devIds)` on the 150 dev tasks only. The shipped prior, fitted on all 500 tasks, is never used.
+- **Router:** `routeUniversal` with the dev fit, objective `match-best-single`, cascades of up to three models, over a registry restricted to the eleven fitted models. It sees only the task text.
+- **Replay:** try the cascade's models in order until one's recorded attempt resolved the task. The cost is the sum of the recorded costs of the attempted models.
+- **Baselines, chosen on dev only:** the model that solved the most dev tasks; the model with the lowest dev mean cost; and the cheapest fixed cascade of up to three models (1,111 considered) that solves at least as many dev tasks as that model, which is the router's own objective applied to dev outcomes.
+- **Uncertainty:** paired bootstrap over held-out tasks, 10,000 seeded draws, 95% percentile intervals.
+- **Record:** the output holds the seed, both id lists, the dev fit's selection table, every held-out decision, and the code the run loaded: the sha256 of each `src/router` file, `src/route.js` and `data/models.json`, the git HEAD and any uncommitted change. With a `target:` or `budget:` objective that no cascade can meet, the router returns its least-bad cascade as a fallback; the replay runs it and counts the task as infeasible (`match-best-single` is always feasible).
+
+Result for seed 20260926, run on 2026-09-26 (dev fit: k=1, scale 2, 58 s). The numbers are the
+same with the router code of `d2abfa6` and with the review changes to `src/router` later
+committed as `aedddf5` (see the status table).
+
+| Held-out, 350 tasks | Solved | Cost per task | Cost per solved task |
+|---|---|---|---|
+| Router | 80.0% | $0.124 | $0.155 |
+| Best single model on dev: claude-opus-4.5 | 76.0% | $0.768 | $1.011 |
+| Cheapest single model on dev: gpt-5-mini | 57.4% | $0.047 | $0.082 |
+| Best fixed cascade on dev: minimax-m2.5 > gpt-5-mini > kimi-k2.5 | 80.6% | $0.136 | $0.169 |
+
+| Router minus | Solve rate, points [95% CI] | Cost per task [95% CI] | Tasks only one of the two solved (router, baseline) |
+|---|---|---|---|
+| Best single model | +4.0 [+0.6, +7.4] | -$0.644 [-$0.698, -$0.594] | 26, 12 |
+| Cheapest single model | +22.6 [+18.3, +27.1] | +$0.077 [+$0.060, +$0.095] | 80, 1 |
+| Best fixed cascade | -0.6 [-1.4, 0.0] | -$0.012 [-$0.024, -$0.003] | 0, 2 |
+
+What this shows:
+
+- Against the model that looked best on dev, the router solves more held-out tasks at about a sixth of the cost. Most of that comes from one cheap model: the router opened with minimax-m2.5 on 308 of the 350 tasks, and minimax-m2.5 alone solved 76.0% of the held-out tasks at $0.077 per task.
+- Against a fixed cascade chosen on the same dev tasks, the router shows no advantage. It solved no task the cascade missed, the cascade solved two that it missed, and it cost $0.012 less per task. This agrees with `docs/UNIVERSAL_ROUTING.md`: with a 150-issue fit the router does not beat a fixed cascade chosen on the same dev data.
+- Five more seeds (1 to 5), run after the result above as a sensitivity check, show the same picture. Against the dev-chosen fixed cascade, the router's difference ranged from -0.6 to +1.1 points and from -$0.012 to +$0.026 per task, and in no split was it both more accurate and cheaper. Against the best single model on dev, the result depends on which model won dev. When an Opus model won (3 of 6 splits), the router saved $0.46 to $0.64 per task and solved 2.9 to 4.0 points more, with an interval excluding zero only for seed 20260926. When minimax-m2.5 won (the other 3), the router solved 0.0 to 1.1 points more at $0.003 to $0.026 more per task.
+- The chosen cascades' predicted success averaged 80.2% against 80.0% observed (across the six splits, predicted minus observed ranged from -2.8 to +9.1 points). Their expected cost was $0.102 per task against $0.124 replayed, and cost was under-predicted in all six splits, by 5% to 22% of the replayed cost. In these runs a failed attempt costs on average 1.2 to 2.0 times as much as a successful one, for every model, and a cascade reaches its second model only after a failure. The cost model does not condition on the outcome.
+
+Limits that apply to every number above:
+
+- One scaffold (mini-SWE-agent 2.0.0), one recorded attempt per model and task, twelve Python repositories (django alone is 231 of the 500 tasks), and the costs the runs recorded in February 2026, not today's prices.
+- The replay assumes a perfect, free check between cascade attempts: it stops at the first attempt whose recorded SWE-bench label is resolved. A deployed cascade needs its own verifier, which can be wrong and costs money.
+- The shipped prior is fitted on all 500 tasks, so it cannot be evaluated out of sample on them. `holdout_eval.mjs` refits on the dev tasks for that reason.
+- One 150/350 split is small, and the six splits above differ by several points.
+- SWE-bench Verified has known validity problems. OpenAI's analysis of 2026-02-23 found test flaws in 59.4% of an audited subset of 138 hard problems (not 59.4% of all 500 tasks) and reported evidence of contamination. Read these results as a historical comparison of routing policies on one benchmark, not as evidence of current coding ability or of present-day costs.
+
+## The original pipeline: harness-bench (run 4)
+
+The shipped prior and the run-4 held-out test were first built with harness-bench, which is not
+part of this repository and is still the only way to rerun run 4:
 
 ```bash
-# harness-bench writes the input from SWE-bench Verified + SWE-bench/experiments.
 # `build routing` makes the 150/350 split that `build universal` reads, so it runs first:
 #   python3 -m hbench.cli build routing   --swe-exp <experiments checkout>
 #   python3 -m hbench.cli build universal --swe-exp <experiments checkout> --forgekit <this repo>
@@ -28,13 +143,12 @@ git -C swe-exp fetch --depth 1 --filter=blob:none origin 40f164d5b8f1d249bf95a6d
 git -C swe-exp checkout FETCH_HEAD
 ```
 
-The fit chooses the latent dimension k and the prior scale by 3-fold cross-validation. That selection is recorded in `selection` inside the file.
-
-Raw per-task results are not redistributed here, only the fitted parameters and their provenance.
+`build_input.py` needs neither harness-bench nor a checkout, and the prior refitted from its input
+matches the shipped one bit for bit.
 
-## Independent replication (2026-09-22)
+## Replication reported on 2026-09-22
 
-The run-4 benchmark and this prior were re-run from scratch on a second machine (Windows, Node 24, Python 3.12). The inputs were fetched as above, and the code was forgekit at `c5227db` (router code unchanged since the fit).
+The run-4 benchmark and this prior were re-run from scratch on a second machine (Windows, Node 24, Python 3.12). The inputs were fetched as above, and the code was forgekit at `c5227db` (router code unchanged since the fit). This is the repository's own report; no third party has checked it.
 
 | What | Result |
 |---|---|
@@ -44,6 +158,10 @@ The run-4 benchmark and this prior were re-run from scratch on a second machine
 | Headline | router 76.3% solved at $0.093 per task; best single model chosen on dev 75.1% at $0.364; pre-registered endpoint met |
 | Prior refit (`fit_prior.mjs`, all 500 issues) | all 176 fitted values identical to `data/router_prior.json` (k=1, scale 4); only `provenance.fittedAt` differs |
 
+The `fitSeconds` values belong to the held-out test, which fits on the 150 dev issues. The refit
+on all 500 issues takes several times longer: 413 s on the machine in the status table, where a
+150-issue fit takes 58 s.
+
 Two portability fixes were needed on Windows:
 - `fit_prior.mjs`'s default `--out` path (fixed here).
 - harness-bench's `adapters/forgekit_universal.mjs`, which passes plain paths to `import()` and so needs `pathToFileURL(...).href`. That file lives in harness-bench, not in this repo.
diff --git a/bench/universal-router/build_input.py b/bench/universal-router/build_input.py
new file mode 100644
index 00000000..4b3ec727
--- /dev/null
+++ b/bench/universal-router/build_input.py
@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+"""Build the universal router's fitting input from pinned public data.
+
+Reads the files pinned in bench/universal-router/sources.json (SWE-bench Verified as one parquet
+file, and the eleven runs' per_instance_details.json from SWE-bench/experiments), checks every
+file's size and sha256 (and, for GitHub files, the git blob id) before using it, and writes the
+JSON that bench/universal-router/fit_prior.mjs reads:
+
+    {source: {...}, tasks: [{id, text}], outcomes: {<registry id>: {<instance_id>: {resolved, cost}}}}
+
+Evaluator/agent boundary: the parquet also holds the gold patch, the test patch and the
+evaluation fields. Only two columns are read, instance_id and problem_statement, so nothing else
+reaches the output. The output does carry outcome labels and costs: it is training data for the
+router fit, never a prompt for a coding agent.
+
+Canonical orders. The fit is order-sensitive (feature means are summed in task order, and the
+cross-validation folds are assigned by task index), so both orders are fixed here:
+    tasks   instance_id ascending (code-point order)
+    models  registry id ascending (code-point order)
+
+Attempts with a recorded cost of 0 (two failed Gemini runs at the pinned commit) are kept as
+outcomes. fit_prior.mjs's cost model only uses positive costs, so it skips them.
+
+Usage:
+    python3 bench/universal-router/build_input.py --out universal_all.json [--cache DIR] [--offline]
+
+Needs Python 3.10+ and pyarrow (pinned in requirements.txt). Downloads honour HTTPS_PROXY.
+"""
+
+import argparse
+import hashlib
+import io
+import json
+import math
+import sys
+import tempfile
+import urllib.request
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent.parent
+REL_HERE = HERE.relative_to(ROOT).as_posix()
+# Files the text features depend on: the feature code, and the rubric (with its exemplars) that
+# it calls. Hashed after normalising CRLF to LF, so a Windows checkout records the same value.
+FEATURE_CODE = ["src/router/features.js", "src/route.js"]
+
+
+def sha256_hex(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def git_blob_id(data):
+    return hashlib.sha1(b"blob %d\0" % len(data) + data).hexdigest()
+
+
+def problems_with(entry, data):
+    """Differences between a file's bytes and its pinned description (empty when it matches)."""
+    out = []
+    if len(data) != entry["bytes"]:
+        out.append(f"size {len(data)} != pinned {entry['bytes']}")
+    got = sha256_hex(data)
+    if got != entry["sha256"]:
+        out.append(f"sha256 {got} != pinned {entry['sha256']}")
+    if "gitBlob" in entry and git_blob_id(data) != entry["gitBlob"]:
+        out.append(f"git blob {git_blob_id(data)} != pinned {entry['gitBlob']}")
+    return out
+
+
+def fetch(entry, dest, offline):
+    """Return the verified bytes of one pinned file, reading `dest` or downloading into it."""
+    if dest.exists():
+        data = dest.read_bytes()
+        bad = problems_with(entry, data)
+        if not bad:
+            return data, "cached"
+        if offline:
+            sys.exit(f"build_input: {dest}: {'; '.join(bad)}")
+        print(
+            f"  {dest.name}: cached copy does not match ({'; '.join(bad)}); downloading again"
+        )
+    elif offline:
+        sys.exit(f"build_input: {dest} is missing and --offline was given")
+    request = urllib.request.Request(
+        entry["url"], headers={"User-Agent": "forgekit-build-input"}
+    )
+    with urllib.request.urlopen(request, timeout=300) as response:
+        data = response.read()
+    bad = problems_with(entry, data)
+    if bad:
+        sys.exit(f"build_input: {entry['url']}: {'; '.join(bad)}")
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    part = dest.with_name(dest.name + ".part")
+    part.write_bytes(data)
+    part.replace(dest)
+    return data, "downloaded"
+
+
+def read_tasks(parquet_bytes):
+    """(instance_id, problem_statement) pairs. No other column is read."""
+    import pyarrow.parquet as pq
+
+    table = pq.read_table(
+        io.BytesIO(parquet_bytes), columns=["instance_id", "problem_statement"]
+    )
+    ids = table.column("instance_id").to_pylist()
+    texts = table.column("problem_statement").to_pylist()
+    if len(set(ids)) != len(ids):
+        sys.exit("build_input: duplicate instance_id in the dataset")
+    for tid, text in zip(ids, texts):
+        if not isinstance(tid, str) or not isinstance(text, str) or not text:
+            sys.exit(f"build_input: {tid!r}: missing instance_id or problem_statement")
+    return ids, dict(zip(ids, texts))
+
+
+def read_outcomes(model_id, raw, task_ids):
+    """{instance_id: {resolved, cost}} in canonical task order, after strict validation."""
+    per = json.loads(raw)
+    if not isinstance(per, dict):
+        sys.exit(f"build_input: {model_id}: per_instance_details.json is not an object")
+    missing = sorted(set(task_ids) - set(per))
+    extra = sorted(set(per) - set(task_ids))
+    if missing or extra:
+        sys.exit(
+            f"build_input: {model_id}: {len(missing)} dataset tasks missing, "
+            f"{len(extra)} unknown ids (e.g. {(missing + extra)[:3]})"
+        )
+    rows = {}
+    for tid in task_ids:
+        rec = per[tid]
+        resolved, cost = rec.get("resolved"), rec.get("cost")
+        if not isinstance(resolved, bool):
+            sys.exit(
+                f"build_input: {model_id} {tid}: resolved is {resolved!r}, not a boolean"
+            )
+        numeric = isinstance(cost, (int, float)) and not isinstance(cost, bool)
+        if not numeric or not math.isfinite(cost) or cost < 0:
+            sys.exit(
+                f"build_input: {model_id} {tid}: cost is {cost!r}, not a finite number >= 0"
+            )
+        rows[tid] = {"resolved": resolved, "cost": cost}
+    return rows
+
+
+def feature_version():
+    out = {}
+    for rel in FEATURE_CODE:
+        data = (ROOT / rel).read_bytes().replace(b"\r\n", b"\n")
+        out[rel] = f"sha256:{sha256_hex(data)}"
+    return out
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    ap.add_argument(
+        "--out", required=True, help="where to write the fitting input JSON"
+    )
+    ap.add_argument(
+        "--cache",
+        help="directory that holds (or receives) the pinned source files; "
+        "without it they are downloaded into a temporary directory",
+    )
+    ap.add_argument(
+        "--offline", action="store_true", help="never download; use --cache only"
+    )
+    args = ap.parse_args()
+    if args.offline and not args.cache:
+        sys.exit("build_input: --offline needs --cache")
+
+    sources_path = HERE / "sources.json"
+    sources = json.loads(sources_path.read_text(encoding="utf-8"))
+    ds, ex = sources["dataset"], sources["experiments"]
+    runs = ex["runs"]
+    model_ids = sorted(runs)
+
+    # The registry is what fit_prior.mjs keeps models by: a pinned run whose id is not in it
+    # would be dropped silently, and a registry that names another run would be misleading.
+    registry = json.loads((ROOT / "data" / "models.json").read_text(encoding="utf-8"))
+    by_id = {m["id"]: m for m in registry["models"]}
+    for mid in model_ids:
+        if mid not in by_id:
+            sys.exit(
+                f"build_input: {mid} is pinned in sources.json but not in data/models.json"
+            )
+        if by_id[mid].get("benchmark_run") != runs[mid]["run"]:
+            sys.exit(
+                f"build_input: {mid}: data/models.json says benchmark_run "
+                f"{by_id[mid].get('benchmark_run')!r}, sources.json pins {runs[mid]['run']!r}"
+            )
+
+    with tempfile.TemporaryDirectory(prefix="router-input-") as tmp:
+        cache = Path(args.cache) if args.cache else Path(tmp)
+        print(f"sources: {sources_path.relative_to(ROOT).as_posix()} (cache: {cache})")
+        dest = cache / ds["repo"].replace("/", "__") / ds["revision"] / ds["path"]
+        parquet, how = fetch(ds, dest, args.offline)
+        print(f"  {ds['repo']}@{ds['revision'][:7]} {ds['path']}: {how}, sha256 ok")
+        task_ids, texts = read_tasks(parquet)
+        task_ids = sorted(task_ids)
+        exp_repo = ex["repo"].removeprefix("https://github.com/")
+        outcomes = {}
+        for mid in model_ids:
+            run = runs[mid]
+            dest = cache / exp_repo.replace("/", "__") / ex["commit"] / run["path"]
+            raw, how = fetch(run, dest, args.offline)
+            print(f"  {mid:<18} {run['run']}: {how}, sha256 + git blob ok")
+            outcomes[mid] = read_outcomes(mid, raw, task_ids)
+
+    source = {
+        "benchmark": f"{ds['name']} (rev {ds['revision'][:7]})",
+        "runs": f"{exp_repo}@{ex['commit'][:7]}, {ex['scaffold']}, dated {ex['runDate']}",
+        "split": "all",
+        "build": {
+            "builder": f"{REL_HERE}/build_input.py",
+            "dataset": f"{ds['repo']}@{ds['revision']}",
+            "experiments": f"{exp_repo}@{ex['commit']}",
+            "taskText": "problem_statement, verbatim",
+            "taskOrder": "instance_id ascending",
+            "modelOrder": "registry id ascending",
+            "featureVersion": feature_version(),
+        },
+    }
+    doc = {
+        "source": source,
+        "tasks": [{"id": tid, "text": texts[tid]} for tid in task_ids],
+        "outcomes": outcomes,
+    }
+    # Bytes, not text mode: the same file (and sha256) on every platform.
+    text = json.dumps(doc, ensure_ascii=False, separators=(",", ":")) + "\n"
+    out = Path(args.out)
+    out.parent.mkdir(parents=True, exist_ok=True)
+    part = out.with_name(out.name + ".part")
+    part.write_bytes(text.encode("utf-8"))
+    part.replace(out)
+
+    cells = [(mid, tid, o) for mid in model_ids for tid, o in outcomes[mid].items()]
+    zero = [(mid, tid, o["resolved"]) for mid, tid, o in cells if o["cost"] == 0]
+    print(f"tasks: {len(task_ids)}  models: {len(model_ids)}  outcomes: {len(cells)}")
+    for mid in model_ids:
+        solved = sum(o["resolved"] for o in outcomes[mid].values())
+        print(f"  {mid:<18} resolved {solved}/{len(task_ids)}")
+    print(
+        f"zero-cost attempts kept as outcomes: {len(zero)} "
+        f"({sum(1 for z in zero if not z[2])} unresolved); the cost fit skips them"
+    )
+    for mid, tid, resolved in zero:
+        print(f"  {mid} {tid} resolved={str(resolved).lower()} cost=0")
+    for rel, digest in source["build"]["featureVersion"].items():
+        print(f"feature code {rel}: {digest}")
+    print(
+        f"wrote {out} ({len(text.encode('utf-8'))} bytes, sha256 {sha256_hex(text.encode('utf-8'))})"
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bench/universal-router/compare_priors.mjs b/bench/universal-router/compare_priors.mjs
new file mode 100644
index 00000000..df9f8374
--- /dev/null
+++ b/bench/universal-router/compare_priors.mjs
@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+// Compare two router prior files (the data/router_prior.json format) value by value.
+//
+//   node bench/universal-router/compare_priors.mjs <expected.json> <actual.json>
+//        [--ignore <dotted.path>]... [--strict]
+//
+// The question it answers: does <actual> reproduce every value of <expected>? Each leaf of
+// <expected> must exist in <actual> with an identical value: numbers with ===, which after JSON
+// parsing is bit-for-bit equality of the doubles, and strings, booleans and nulls likewise.
+// provenance.fittedAt is always skipped; each --ignore adds a dotted path (a prefix skips its
+// whole subtree), and the report lists every path it skipped.
+//
+// Leaves that exist only in <actual> are reported as `added`, grouped by field. Newer code can
+// write fields the expected file predates (build metadata in provenance.build, diagnostics in
+// cost such as cost.alphaSE), and an addition does not change any expected value, so additions
+// are not a mismatch unless --strict is given.
+//
+// Output: a JSON report on stdout (leaf counts; per field, meaning the path without array
+// indices such as mirt.L, the number of differing values and the maximum absolute difference;
+// examples; missing and added paths) and a one-line summary on stderr. Exit code 0 when every
+// compared value is identical (and, with --strict, nothing was added), 1 otherwise, 2 on a
+// usage error.
+import { readFileSync } from "node:fs";
+
+const args = process.argv.slice(2);
+const files = [];
+const ignore = ["provenance.fittedAt"];
+let strict = false;
+let badFlag = false;
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--ignore" && args[i + 1]) ignore.push(args[++i]);
+  else if (args[i] === "--strict") strict = true;
+  else if (args[i].startsWith("--")) badFlag = true;
+  else files.push(args[i]);
+}
+if (badFlag || files.length !== 2) {
+  console.error(
+    "usage: compare_priors.mjs <expected.json> <actual.json> [--ignore <dotted.path>]... [--strict]",
+  );
+  process.exit(2);
+}
+// An unreadable file is a usage error (2), never a mismatch (1).
+const load = (f) => {
+  try {
+    return JSON.parse(readFileSync(f, "utf8"));
+  } catch (e) {
+    console.error(`compare_priors: cannot read ${f}: ${e.message}`);
+    process.exit(2);
+  }
+};
+const [expected, actual] = files.map(load);
+
+/**
+ * Leaves of a JSON value: key = JSON of the full path, with its display path and its field
+ * (the path without array indices). An empty object or array is a leaf of its own.
+ * @returns {Map<string, {path: string, field: string, value: unknown}>}
+ */
+function leaves(value, path = [], field = [], acc = new Map()) {
+  if (value !== null && typeof value === "object") {
+    const isArray = Array.isArray(value);
+    const keys = isArray ? value.map((_, i) => i) : Object.keys(value);
+    if (!keys.length)
+      acc.set(JSON.stringify(path), { path: path.join("."), field: field.join("."), value });
+    for (const k of keys) leaves(value[k], [...path, k], isArray ? field : [...field, k], acc);
+  } else acc.set(JSON.stringify(path), { path: path.join("."), field: field.join("."), value });
+  return acc;
+}
+
+const skipped = (p) => ignore.some((g) => p === g || p.startsWith(`${g}.`));
+const same = (x, y) =>
+  x === y ||
+  (typeof x === "object" && typeof y === "object" && JSON.stringify(x) === JSON.stringify(y));
+
+const A = leaves(expected);
+const B = leaves(actual);
+const fields = new Map();
+const missing = [];
+const added = [];
+const ignoredPaths = [];
+let compared = 0;
+let identical = 0;
+for (const [key, a] of A) {
+  if (skipped(a.path)) {
+    ignoredPaths.push(a.path);
+    continue;
+  }
+  const b = B.get(key);
+  if (!b) {
+    missing.push(a.path);
+    continue;
+  }
+  compared++;
+  if (!fields.has(a.field))
+    fields.set(a.field, { values: 0, differing: 0, maxAbsDiff: 0, nonNumeric: 0, examples: [] });
+  const f = fields.get(a.field);
+  f.values++;
+  if (same(a.value, b.value)) {
+    identical++;
+    continue;
+  }
+  f.differing++;
+  if (typeof a.value === "number" && typeof b.value === "number")
+    f.maxAbsDiff = Math.max(f.maxAbsDiff, Math.abs(a.value - b.value));
+  else f.nonNumeric++;
+  if (f.examples.length < 5) f.examples.push({ path: a.path, expected: a.value, actual: b.value });
+}
+const addedByField = new Map();
+for (const [key, b] of B) {
+  if (A.has(key)) continue;
+  if (skipped(b.path)) ignoredPaths.push(b.path);
+  else {
+    added.push(b.path);
+    addedByField.set(b.field, (addedByField.get(b.field) ?? 0) + 1);
+  }
+}
+
+const differing = compared - identical;
+const exactMatch = differing === 0 && !missing.length;
+const pass = exactMatch && !(strict && added.length);
+const report = {
+  expected: files[0],
+  actual: files[1],
+  exactMatch,
+  strict,
+  pass,
+  ignored: { patterns: ignore, paths: [...new Set(ignoredPaths)] },
+  leaves: { compared, identical, differing, missing: missing.length, added: added.length },
+  fields: Object.fromEntries(
+    [...fields].map(([name, f]) => [
+      name,
+      {
+        values: f.values,
+        differing: f.differing,
+        maxAbsDiff: f.differing > f.nonNumeric ? f.maxAbsDiff : f.differing ? null : 0,
+        ...(f.nonNumeric ? { nonNumericDiffering: f.nonNumeric } : {}),
+        ...(f.examples.length ? { examples: f.examples } : {}),
+      },
+    ]),
+  ),
+  missing,
+  added: { byField: Object.fromEntries(addedByField), paths: added },
+};
+console.log(JSON.stringify(report, null, 2));
+
+const parts = exactMatch
+  ? [`exact match: ${identical}/${compared} values of ${files[0]} identical`]
+  : [
+      `MISMATCH: ${differing}/${compared} values differ`,
+      ...(missing.length ? [`${missing.length} paths missing from ${files[1]}`] : []),
+      ...[...fields]
+        .filter(([, f]) => f.differing)
+        .map(([name, f]) =>
+          f.differing > f.nonNumeric
+            ? `${name} ${f.differing}/${f.values}, max |diff| ${f.maxAbsDiff.toPrecision(3)}`
+            : `${name} ${f.differing}/${f.values} (text)`,
+        ),
+    ];
+if (added.length) {
+  // Group additions by their first two path segments: "cost.alphaSE 11, provenance.build 10".
+  const groups = new Map();
+  for (const [field, count] of addedByField) {
+    const g = field.split(".").slice(0, 2).join(".");
+    groups.set(g, (groups.get(g) ?? 0) + count);
+  }
+  const list = [...groups].map(([g, c]) => `${g} ${c}`).join(", ");
+  parts.push(`${added.length} values only in ${files[1]}${strict ? " (--strict)" : ""}: ${list}`);
+}
+console.error(`${parts.join("; ")} (skipped: ${ignore.join(", ")})`);
+process.exit(pass ? 0 : 1);
diff --git a/bench/universal-router/holdout_eval.mjs b/bench/universal-router/holdout_eval.mjs
new file mode 100644
index 00000000..a21d5c38
--- /dev/null
+++ b/bench/universal-router/holdout_eval.mjs
@@ -0,0 +1,455 @@
+#!/usr/bin/env node
+// Held-out replay of the universal router on public SWE-bench Verified outcomes (review E3,
+// stage 1), run entirely from this repository.
+//
+// This is NOT harness-bench run 4. That experiment's 150/350 split ids, pre-registration and
+// metric code live in harness-bench, not here, so its headline (76.3% solved at $0.093 per task)
+// is neither reproduced nor tested by this script. This is a separate experiment with its own
+// seeded split of the same 500 tasks.
+//
+//   node bench/universal-router/holdout_eval.mjs <input.json> --out <results.json>
+//     [--seed 20260926] [--dev 150] [--draws 10000] [--objective match-best-single] [--max-depth 3]
+//
+// <input.json> is what build_input.py writes. The steps:
+//  1. Split. Shuffle the task ids (input order: instance_id ascending) with a Fisher-Yates
+//     shuffle driven by mulberry32(seed). The first --dev ids are dev, the rest are held out.
+//     Both id lists go into the output.
+//  2. Fit on dev only: buildPrior(input, devIds). The shipped all-500 prior is never used.
+//  3. Baselines, each chosen on dev outcomes only: the single model that solved the most dev
+//     tasks; the single model with the lowest dev mean cost; and the fixed cascade (up to
+//     --max-depth models) with the lowest dev mean cost among those that solve at least as many
+//     dev tasks as that best single model (the router's match-best-single objective applied to
+//     dev outcomes).
+//  4. Replay each held-out task. routeUniversal() picks a cascade with the dev fit, over a
+//     registry restricted to the fitted models. The cascade, and each baseline, is then played
+//     on the recorded outcomes: try the models in order until one resolved the task. Its cost
+//     is the sum of the recorded costs of the attempted models. A failed attempt recorded at
+//     cost 0 costs 0 and is counted.
+//  5. Paired bootstrap over held-out tasks (seeded): 95% percentile intervals for the router's
+//     solve-rate and mean-cost differences to each baseline.
+//
+// The replay assumes a perfect check between cascade attempts (the recorded SWE-bench label)
+// that costs nothing. A real cascade needs its own verifier, which can be wrong and costs money.
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { arch, cpus, platform } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { routeUniversal } from "../../src/router/index.js";
+import { cascades } from "../../src/router/policy.js";
+import { buildPrior } from "../../src/router/prior.js";
+import { loadRegistry } from "../../src/router/registry.js";
+
+const args = process.argv.slice(2);
+const opt = (name, fallback) => (args.includes(name) ? args[args.indexOf(name) + 1] : fallback);
+const inputPath = args[0];
+const outPath = opt("--out");
+if (!inputPath || inputPath.startsWith("--") || !outPath) {
+  console.error("usage: holdout_eval.mjs <input.json> --out <results.json> [--seed N] [--dev N]");
+  process.exit(2);
+}
+const seed = Number(opt("--seed", 20260926)) >>> 0;
+const nDev = Number(opt("--dev", 150));
+const draws = Number(opt("--draws", 10000));
+const objective = opt("--objective", "match-best-single");
+const maxDepth = Number(opt("--max-depth", 3));
+
+const t0 = Date.now();
+
+// The code this run loaded, recorded before anything else happens: the router's source files
+// and the rubric (sha256, CRLF read as LF), the git HEAD, and any uncommitted change to them.
+const ROOT = fileURLToPath(new URL("../../", import.meta.url));
+function codeState() {
+  const files = [
+    ...readdirSync(join(ROOT, "src/router"))
+      .filter((f) => f.endsWith(".js"))
+      .sort()
+      .map((f) => `src/router/${f}`),
+    "src/route.js",
+    "data/models.json",
+  ];
+  const sha256 = Object.fromEntries(
+    files.map((f) => {
+      const text = readFileSync(join(ROOT, f), "utf8").replace(/\r\n/g, "\n");
+      return [f, `sha256:${createHash("sha256").update(text).digest("hex")}`];
+    }),
+  );
+  const git = (...a) =>
+    execFileSync("git", ["-C", ROOT, ...a], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  let gitHead = null;
+  let uncommitted = null;
+  try {
+    gitHead = git("rev-parse", "HEAD");
+    uncommitted =
+      git("diff", "--stat", "HEAD", "--", "src/router", "src/route.js", "data/models.json") ||
+      "none";
+  } catch {}
+  return { gitHead, uncommitted, sha256 };
+}
+const code = codeState();
+const rawInput = readFileSync(inputPath);
+const input = JSON.parse(rawInput.toString("utf8"));
+const taskIds = input.tasks.map((t) => t.id);
+const textOf = new Map(input.tasks.map((t) => [t.id, t.text]));
+if (!(Number.isInteger(nDev) && nDev > 0 && nDev < taskIds.length))
+  throw new Error(`--dev must be an integer in 1..${taskIds.length - 1}`);
+if (!(Number.isInteger(draws) && draws > 0)) throw new Error("--draws must be a positive integer");
+if (!(Number.isInteger(maxDepth) && maxDepth > 0))
+  throw new Error("--max-depth must be a positive integer");
+
+/** mulberry32: a small, well-known 32-bit PRNG; one seed gives one stream on every platform. */
+function mulberry32(a) {
+  let s = a >>> 0;
+  return () => {
+    s = (s + 0x6d2b79f5) | 0;
+    let t = Math.imul(s ^ (s >>> 15), 1 | s);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+// 1. Split.
+const shuffled = taskIds.slice();
+const splitRand = mulberry32(seed);
+for (let i = shuffled.length - 1; i > 0; i--) {
+  const j = Math.floor(splitRand() * (i + 1));
+  [shuffled[i], shuffled[j]] = [shuffled[j], shuffled[i]];
+}
+const devSet = new Set(shuffled.slice(0, nDev));
+const dev = taskIds.filter((id) => devSet.has(id));
+const heldOut = taskIds.filter((id) => !devSet.has(id));
+
+// 2. Fit on dev only.
+const registry = loadRegistry(null);
+const models = Object.keys(input.outcomes).filter((id) => registry.models.some((m) => m.id === id));
+const restricted = {
+  models: registry.models.filter((m) => models.includes(m.id)),
+  sources: registry.sources,
+};
+const tFit = Date.now();
+const fit = buildPrior(input, devSet);
+const fitSeconds = (Date.now() - tFit) / 1000;
+if (fit.provenance.tasks !== dev.length) throw new Error("dev fit saw tasks outside the dev set");
+
+// Play a model sequence on one task's recorded outcomes.
+function play(seq, id) {
+  let cost = 0;
+  let zeroCostFailed = 0;
+  for (let i = 0; i < seq.length; i++) {
+    const o = input.outcomes[seq[i]]?.[id];
+    if (!o || !Number.isFinite(o.cost))
+      throw new Error(`no recorded outcome for ${seq[i]} on ${id}`);
+    cost += o.cost;
+    if (o.resolved) return { solved: 1, cost, attempts: i + 1, zeroCostFailed };
+    if (o.cost === 0) zeroCostFailed++;
+  }
+  return { solved: 0, cost, attempts: seq.length, zeroCostFailed };
+}
+
+function summarize(rows) {
+  const n = rows.length;
+  const sum = (k) => rows.reduce((s, r) => s + r[k], 0);
+  const solved = sum("solved");
+  const totalCost = sum("cost");
+  return {
+    tasks: n,
+    solved,
+    solveRate: solved / n,
+    meanCost: totalCost / n,
+    costPerSolved: solved ? totalCost / solved : null,
+    totalCost,
+    meanAttempts: sum("attempts") / n,
+    zeroCostFailedAttempts: sum("zeroCostFailed"),
+  };
+}
+const playAll = (seq, ids) => ids.map((id) => play(seq, id));
+const bySeq = (a, b) => (a.seq.join(" ") < b.seq.join(" ") ? -1 : 1);
+
+// 3. Baselines, chosen on dev outcomes only.
+const devSingles = models.map((m) => ({ seq: [m], ...summarize(playAll([m], dev)) }));
+const bestSingle = devSingles
+  .slice()
+  .sort((a, b) => b.solved - a.solved || a.totalCost - b.totalCost || bySeq(a, b))[0];
+const cheapestSingle = devSingles
+  .slice()
+  .sort((a, b) => a.totalCost - b.totalCost || b.solved - a.solved || bySeq(a, b))[0];
+let bestFixedCascade = null;
+let cascadesConsidered = 0;
+for (const seq of cascades(models, maxDepth)) {
+  cascadesConsidered++;
+  const s = { seq, ...summarize(playAll(seq, dev)) };
+  if (s.solved < bestSingle.solved) continue;
+  const c = bestFixedCascade;
+  if (
+    !c ||
+    s.totalCost < c.totalCost ||
+    (s.totalCost === c.totalCost &&
+      (s.solved > c.solved || (s.solved === c.solved && seq.length < c.seq.length)))
+  )
+    bestFixedCascade = s;
+}
+
+// 4. Router replay on held-out tasks.
+const decisions = heldOut.map((id) => {
+  const r = routeUniversal(null, textOf.get(id), {
+    model: fit,
+    registry: restricted,
+    objective,
+    maxDepth,
+  });
+  // A target or budget no cascade can meet comes back as ok:false with the least-bad cascade
+  // as `fallback` (match-best-single is always feasible). The replay runs that fallback and
+  // counts the task as infeasible.
+  const pick = r.ok ? r : r.fallback;
+  if (!pick?.cascade) throw new Error(`router gave no cascade for ${id}: ${r.reason}`);
+  const seq = pick.cascade.map((c) => c.model);
+  return {
+    id,
+    cascade: seq,
+    feasible: Boolean(r.ok),
+    pSuccess: pick.pSuccess,
+    expectedCost: pick.expectedCost,
+    ...play(seq, id),
+  };
+});
+const infeasible = decisions.filter((d) => !d.feasible).length;
+
+const policies = {
+  router: decisions,
+  bestSingle: playAll(bestSingle.seq, heldOut),
+  cheapestSingle: playAll(cheapestSingle.seq, heldOut),
+  bestFixedCascade: playAll(bestFixedCascade.seq, heldOut),
+};
+const baselines = ["bestSingle", "cheapestSingle", "bestFixedCascade"];
+
+// 5. Paired bootstrap over held-out tasks.
+const bootSeed = (seed ^ 0x9e3779b9) >>> 0;
+const bootRand = mulberry32(bootSeed);
+const n = heldOut.length;
+const cols = Object.fromEntries(
+  Object.entries(policies).map(([k, rows]) => [
+    k,
+    {
+      solved: Float64Array.from(rows, (r) => r.solved),
+      cost: Float64Array.from(rows, (r) => r.cost),
+    },
+  ]),
+);
+const samples = Object.fromEntries(
+  baselines.map((b) => [
+    b,
+    {
+      dSolve: new Float64Array(draws),
+      dCost: new Float64Array(draws),
+      ratio: new Float64Array(draws),
+    },
+  ]),
+);
+const names = Object.keys(policies);
+const sums = Object.fromEntries(names.map((k) => [k, { solved: 0, cost: 0 }]));
+for (let d = 0; d < draws; d++) {
+  for (const k of names) {
+    sums[k].solved = 0;
+    sums[k].cost = 0;
+  }
+  for (let i = 0; i < n; i++) {
+    const j = Math.floor(bootRand() * n);
+    for (const k of names) {
+      sums[k].solved += cols[k].solved[j];
+      sums[k].cost += cols[k].cost[j];
+    }
+  }
+  for (const b of baselines) {
+    samples[b].dSolve[d] = (sums.router.solved - sums[b].solved) / n;
+    samples[b].dCost[d] = (sums.router.cost - sums[b].cost) / n;
+    samples[b].ratio[d] = sums.router.cost / sums[b].cost;
+  }
+}
+/** Percentile with linear interpolation between order statistics (numpy's default). */
+function quantile(sorted, q) {
+  const h = (sorted.length - 1) * q;
+  const lo = Math.floor(h);
+  return sorted[lo] + (h - lo) * (sorted[Math.min(lo + 1, sorted.length - 1)] - sorted[lo]);
+}
+const interval = (estimate, arr) => {
+  const s = Float64Array.from(arr).sort();
+  return { estimate, ci95: [quantile(s, 0.025), quantile(s, 0.975)] };
+};
+const heldOutSummary = Object.fromEntries(names.map((k) => [k, summarize(policies[k])]));
+const comparisons = Object.fromEntries(
+  baselines.map((b) => {
+    const r = heldOutSummary.router;
+    const x = heldOutSummary[b];
+    // Paired discordant tasks: with only a handful, the bootstrap interval says little.
+    let routerOnly = 0;
+    let baselineOnly = 0;
+    for (let i = 0; i < n; i++) {
+      if (cols.router.solved[i] > cols[b].solved[i]) routerOnly++;
+      else if (cols.router.solved[i] < cols[b].solved[i]) baselineOnly++;
+    }
+    return [
+      b,
+      {
+        solveRateDelta: interval(r.solveRate - x.solveRate, samples[b].dSolve),
+        meanCostDelta: interval(r.meanCost - x.meanCost, samples[b].dCost),
+        meanCostRatio: interval(r.meanCost / x.meanCost, samples[b].ratio),
+        solvedByOnlyOne: { router: routerOnly, baseline: baselineOnly },
+      },
+    ];
+  }),
+);
+
+// Calibration of the router's own predictions for the cascades it chose (quintiles of pSuccess).
+const byP = decisions.slice().sort((a, b) => a.pSuccess - b.pSuccess);
+const mean = (rows, f) => rows.reduce((s, r) => s + f(r), 0) / rows.length;
+const calibration = {
+  meanPredictedSuccess: mean(decisions, (r) => r.pSuccess),
+  observedSolveRate: heldOutSummary.router.solveRate,
+  brier: mean(decisions, (r) => (r.pSuccess - r.solved) ** 2),
+  meanExpectedCost: mean(decisions, (r) => r.expectedCost),
+  meanObservedCost: heldOutSummary.router.meanCost,
+  quintiles: [0, 1, 2, 3, 4].map((q) => {
+    const rows = byP.slice(Math.round((q * n) / 5), Math.round(((q + 1) * n) / 5));
+    return {
+      tasks: rows.length,
+      predicted: mean(rows, (r) => r.pSuccess),
+      observed: mean(rows, (r) => r.solved),
+      expectedCost: mean(rows, (r) => r.expectedCost),
+      observedCost: mean(rows, (r) => r.cost),
+    };
+  }),
+};
+
+// What the router chose.
+const tally = (f) => {
+  const m = new Map();
+  for (const r of decisions) m.set(f(r), (m.get(f(r)) ?? 0) + 1);
+  return Object.fromEntries([...m].sort((a, b) => b[1] - a[1]));
+};
+const composition = {
+  cascadeLength: tally((r) => r.cascade.length),
+  firstModel: tally((r) => r.cascade[0]),
+  cascades: tally((r) => r.cascade.join(" > ")),
+};
+
+// Per-repository slices (held-out only; small slices are noisy).
+const repoOf = (id) => id.split("__")[0];
+const repos = [...new Set(heldOut.map(repoOf))].sort();
+const perRepository = repos.map((repo) => {
+  const idx = heldOut.map((id, i) => (repoOf(id) === repo ? i : -1)).filter((i) => i >= 0);
+  const slice = (k) => {
+    const s = summarize(idx.map((i) => policies[k][i]));
+    return { solveRate: s.solveRate, meanCost: s.meanCost };
+  };
+  return { repo, tasks: idx.length, ...Object.fromEntries(names.map((k) => [k, slice(k)])) };
+});
+
+const cpu = cpus();
+const result = {
+  experiment:
+    "holdout_eval.mjs: in-repo held-out replay of the universal router on SWE-bench Verified " +
+    "outcomes (review E3, stage 1)",
+  notTheHeadline:
+    "A new seeded split made by this script. It is not harness-bench run 4, whose split ids, " +
+    "pre-registration and metric code are not in this repository, so it neither reproduces " +
+    "nor tests the 76.3% / $0.093 headline.",
+  assumptions: [
+    "Each model's single recorded attempt per task (mini-SWE-agent 2.0.0, February 2026 costs) " +
+      "stands for any attempt of that model on that task.",
+    "A cascade stops at the first attempt whose recorded SWE-bench label is resolved: a perfect " +
+      "check between attempts, with no verification cost.",
+    "The router sees only the task text (problem_statement); labels and costs are used only " +
+      "to fit on dev and to score held-out decisions.",
+  ],
+  generatedAt: new Date().toISOString(),
+  environment: {
+    node: process.version,
+    platform: `${platform()}-${arch()}`,
+    cpu: cpu[0]?.model ?? null,
+    cpus: cpu.length,
+  },
+  code,
+  input: {
+    path: inputPath,
+    sha256: createHash("sha256").update(rawInput).digest("hex"),
+    source: input.source ?? null,
+    tasks: taskIds.length,
+    models,
+  },
+  split: {
+    seed,
+    prng: "mulberry32",
+    method:
+      "Fisher-Yates shuffle of the task ids in input order (instance_id ascending); " +
+      "the first `dev` ids are dev, the rest held out. Id lists are in input order.",
+    dev: { tasks: dev.length, ids: dev },
+    heldOut: { tasks: heldOut.length, ids: heldOut },
+  },
+  fit: {
+    seconds: fitSeconds,
+    tasks: fit.provenance.tasks,
+    outcomes: fit.provenance.outcomes,
+    k: fit.mirt.k,
+    scale: fit.selection.chosen.scale,
+    selection: fit.selection,
+  },
+  policy: { objective, maxDepth, candidates: models.length, infeasibleTasks: infeasible },
+  devSelection: {
+    singles: devSingles,
+    bestSingle: bestSingle.seq,
+    cheapestSingle: cheapestSingle.seq,
+    bestFixedCascade: bestFixedCascade.seq,
+    bestFixedCascadeDev: bestFixedCascade,
+    cascadesConsidered,
+  },
+  heldOut: {
+    ...heldOutSummary,
+    singles: Object.fromEntries(models.map((m) => [m, summarize(playAll([m], heldOut))])),
+  },
+  bootstrap: {
+    draws,
+    seed: bootSeed,
+    method: "paired: resample held-out tasks with replacement; percentile 95% intervals",
+    router_minus: comparisons,
+  },
+  calibration,
+  composition,
+  perRepository,
+  perTask: decisions,
+  elapsedSeconds: (Date.now() - t0) / 1000,
+};
+writeFileSync(outPath, `${JSON.stringify(result, null, 2)}\n`);
+
+const pct = (v) => `${(100 * v).toFixed(1)}%`;
+const usd = (v) => `$${v.toFixed(3)}`;
+const line = (name, s, seq) =>
+  `  ${name.padEnd(20)} ${pct(s.solveRate).padStart(6)} solved  ${usd(s.meanCost)}/task  ` +
+  `${s.costPerSolved === null ? "-" : usd(s.costPerSolved)}/solved${seq ? `  [${seq.join(" > ")}]` : ""}`;
+console.log(
+  `holdout_eval (NOT the harness-bench split): seed ${seed}, dev ${dev.length} / held-out ${n}, ` +
+    `fit k=${fit.mirt.k} scale=${fit.selection.chosen.scale} in ${fitSeconds.toFixed(1)}s`,
+);
+if (infeasible)
+  console.log(
+    `  ${objective}: infeasible on ${infeasible} tasks (their fallback cascade was replayed)`,
+  );
+console.log(line("router", heldOutSummary.router));
+console.log(line("best single (dev)", heldOutSummary.bestSingle, bestSingle.seq));
+console.log(line("cheapest (dev)", heldOutSummary.cheapestSingle, cheapestSingle.seq));
+console.log(line("fixed cascade (dev)", heldOutSummary.bestFixedCascade, bestFixedCascade.seq));
+for (const b of baselines) {
+  const c = comparisons[b];
+  const pp = (v) => `${(100 * v).toFixed(1)}`;
+  console.log(
+    `  router - ${b}: solve ${pp(c.solveRateDelta.estimate)} pp ` +
+      `[${pp(c.solveRateDelta.ci95[0])}, ${pp(c.solveRateDelta.ci95[1])}], ` +
+      `cost ${c.meanCostDelta.estimate.toFixed(3)} [${c.meanCostDelta.ci95[0].toFixed(3)}, ` +
+      `${c.meanCostDelta.ci95[1].toFixed(3)}] $/task; solved by only one: ` +
+      `router ${c.solvedByOnlyOne.router}, ${b} ${c.solvedByOnlyOne.baseline}`,
+  );
+}
+console.log(`wrote ${outPath} in ${result.elapsedSeconds.toFixed(1)}s`);
diff --git a/bench/universal-router/reproduce.sh b/bench/universal-router/reproduce.sh
new file mode 100755
index 00000000..0480ec2b
--- /dev/null
+++ b/bench/universal-router/reproduce.sh
@@ -0,0 +1,72 @@
+#!/bin/sh
+# Reproduce data/router_prior.json from pinned public data, on a cold machine.
+#
+#   sh bench/universal-router/reproduce.sh [WORK_DIR]
+#
+# Needs network access (Hugging Face, raw.githubusercontent.com, PyPI), python3 >= 3.10 with
+# the venv module, and node >= 20. Everything goes under WORK_DIR (default:
+# ${TMPDIR:-/tmp}/forgekit-router-repro), outside the repository: the downloaded per-task
+# results are not redistributed here and must not be committed.
+#
+#   1. a venv with the pinned pyarrow (requirements.txt)
+#   2. build_input.py: download + sha256-check the sources pinned in sources.json and write
+#      WORK_DIR/universal_all.json (a second run reads WORK_DIR/cache instead of downloading)
+#   3. fit_prior.mjs: refit the prior into WORK_DIR/router_prior.json (several minutes of CPU).
+#      WORK_DIR/environment.txt records the versions, the CPU, the fit time, and which code the
+#      fit ran: the git HEAD and any uncommitted change to src/router, src/route.js or
+#      data/models.json.
+#   4. compare_priors.mjs: compare it with data/router_prior.json; the report is
+#      WORK_DIR/prior-comparison.json
+#
+# Exit status: 0 when the refit reproduces every value of the shipped prior (except
+# provenance.fittedAt; values only in the refit, such as provenance.build, are listed in the
+# report as added); 1 when any value differs or is missing; anything else is an error in 1-3.
+set -eu
+
+here=$(cd "$(dirname "$0")" && pwd)
+root=$(cd "$here/../.." && pwd)
+work=${1:-${TMPDIR:-/tmp}/forgekit-router-repro}
+mkdir -p "$work"
+work=$(cd "$work" && pwd)
+
+echo "== 1/4 python venv with the pinned pyarrow ($work/venv)"
+[ -d "$work/venv" ] || python3 -m venv "$work/venv"
+py="$work/venv/bin/python"
+[ -x "$py" ] || py="$work/venv/Scripts/python.exe"
+"$py" -m pip install --quiet --disable-pip-version-check -r "$here/requirements.txt"
+
+echo "== 2/4 build the fitting input"
+"$py" "$here/build_input.py" --cache "$work/cache" --out "$work/universal_all.json"
+
+echo "== 3/4 refit the prior (this takes minutes; about 7 on a 2.8 GHz Xeon)"
+# The code the fit loads, recorded just before it starts.
+head=unknown
+changes="unknown (not a git checkout)"
+if git -C "$root" rev-parse --verify -q HEAD > /dev/null 2>&1; then
+  head=$(git -C "$root" rev-parse HEAD)
+  changes=$(git -C "$root" diff --stat HEAD -- src/router src/route.js data/models.json)
+  changes=${changes:-none}
+fi
+start=$(date +%s)
+node "$here/fit_prior.mjs" "$work/universal_all.json" --out "$work/router_prior.json"
+elapsed=$(($(date +%s) - start))
+
+{
+  echo "node: $(node --version)"
+  echo "python: $("$py" --version 2>&1)"
+  echo "pyarrow: $("$py" -c 'import pyarrow; print(pyarrow.__version__)')"
+  echo "cpu: $(node -p 'const c = require("os").cpus(); `${c[0]?.model} x${c.length}`')"
+  echo "platform: $(node -p 'process.platform + "-" + process.arch')"
+  echo "fit_elapsed_seconds: $elapsed"
+  echo "repo_head: $head"
+  echo "uncommitted changes to src/router, src/route.js, data/models.json:"
+  echo "$changes"
+} > "$work/environment.txt"
+cat "$work/environment.txt"
+
+echo "== 4/4 compare with data/router_prior.json"
+status=0
+node "$here/compare_priors.mjs" "$root/data/router_prior.json" "$work/router_prior.json" \
+  > "$work/prior-comparison.json" || status=$?
+echo "report: $work/prior-comparison.json"
+exit "$status"
diff --git a/bench/universal-router/requirements.txt b/bench/universal-router/requirements.txt
new file mode 100644
index 00000000..8a047b50
--- /dev/null
+++ b/bench/universal-router/requirements.txt
@@ -0,0 +1 @@
+pyarrow==25.0.1
diff --git a/bench/universal-router/sources.json b/bench/universal-router/sources.json
new file mode 100644
index 00000000..11b6c86d
--- /dev/null
+++ b/bench/universal-router/sources.json
@@ -0,0 +1,110 @@
+{
+  "$comment": "Pinned inputs of bench/universal-router/build_input.py. Every file is checked against its sha256 before use; files from GitHub also carry their git blob id at the pinned commit. Keys of experiments.runs are registry ids (data/models.json), in canonical (ascending) order.",
+  "dataset": {
+    "name": "SWE-bench Verified",
+    "repo": "SWE-bench/SWE-bench_Verified",
+    "revision": "78f471bf655a3137b2e8a75af1501690ec009ec3",
+    "revisionDate": "2026-08-16",
+    "path": "data/test-00000-of-00001.parquet",
+    "url": "https://huggingface.co/datasets/SWE-bench/SWE-bench_Verified/resolve/78f471bf655a3137b2e8a75af1501690ec009ec3/data/test-00000-of-00001.parquet",
+    "bytes": 6304616,
+    "sha256": "030cfd7f2a704c4c0226e7f104c725a3b41230b1d3517f9c915ad7ea5be3fa25",
+    "note": "Revision 78f471b exists in the SWE-bench org repo, not in princeton-nlp/SWE-bench_Verified. The file is stored with Git LFS, so its sha256 is also its LFS oid."
+  },
+  "experiments": {
+    "repo": "https://github.com/SWE-bench/experiments",
+    "commit": "40f164d5b8f1d249bf95a6df8b74b577fd8e519d",
+    "scaffold": "mini-SWE-agent 2.0.0",
+    "runDate": "2026-02-17",
+    "runs": {
+      "claude-haiku-4.5": {
+        "run": "20260217_mini-v2.0.0_claude-4-5-haiku-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_claude-4-5-haiku-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_claude-4-5-haiku-high/per_instance_details.json",
+        "gitBlob": "251ca4c02f45e8b109c0749821fa98414064daae",
+        "bytes": 53125,
+        "sha256": "4104e3cf041d57048ac22bf1ffc0805b154a064dfcbb1c0666647e4613008533"
+      },
+      "claude-opus-4.5": {
+        "run": "20260217_mini-v2.0.0_claude-4-5-opus-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_claude-4-5-opus-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_claude-4-5-opus-high/per_instance_details.json",
+        "gitBlob": "39c730e7216071796617cb9c0a3c034b7c018d57",
+        "bytes": 52799,
+        "sha256": "e9657d90a145b9b22db233eb8a796d978ef9f8ecb9434570d0d599a635831907"
+      },
+      "claude-opus-4.6": {
+        "run": "20260217_mini-v2.0.0_claude-4-6-opus",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_claude-4-6-opus/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_claude-4-6-opus/per_instance_details.json",
+        "gitBlob": "082659fa7078a88eddb71c64b40c4f0e7f192ba2",
+        "bytes": 52805,
+        "sha256": "c669276c9b7c23ffe967df0d7cc9f1f6406001ae02095761ddb2ac067103430d"
+      },
+      "claude-sonnet-4.5": {
+        "run": "20260217_mini-v2.0.0_claude-4-5-sonnet-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_claude-4-5-sonnet-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_claude-4-5-sonnet-high/per_instance_details.json",
+        "gitBlob": "697da24c32b43e81245ac92a741afa39f1b3293b",
+        "bytes": 52885,
+        "sha256": "c7f61049937deafa6327e0d5f17c0baf482751388530530bb9f5d53ce0fbf7cc"
+      },
+      "deepseek-v3.2": {
+        "run": "20260217_mini-v2.0.0_deepseek-3-2-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_deepseek-3-2-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_deepseek-3-2-high/per_instance_details.json",
+        "gitBlob": "ad4a0b8333a866bb11d1849be15a809866fc8191",
+        "bytes": 53441,
+        "sha256": "5eeebd0aa53aa6234f36380d14141597f7776b32b0ba1a020dc2abaf005b50c1"
+      },
+      "gemini-3-flash": {
+        "run": "20260217_mini-v2.0.0_gemini-3-flash-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_gemini-3-flash-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_gemini-3-flash-high/per_instance_details.json",
+        "gitBlob": "092530f4dc7eba8985a485aa1374af53436237d7",
+        "bytes": 53102,
+        "sha256": "6e49e555537839726c02dbbefd45cdf63bbed8c138eaf349d783381ca0716e33"
+      },
+      "glm-5": {
+        "run": "20260217_mini-v2.0.0_glm-5-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_glm-5-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_glm-5-high/per_instance_details.json",
+        "gitBlob": "27bb601b3f59860985dcea4b682ad9a0e2feca5f",
+        "bytes": 53220,
+        "sha256": "cd139949a7a4044709f28d628c0a6ae9861da3e334033ae736a92a44d1d0a57c"
+      },
+      "gpt-5-mini": {
+        "run": "20260217_mini-v2.0.0_gpt-5-mini",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_gpt-5-mini/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_gpt-5-mini/per_instance_details.json",
+        "gitBlob": "22de38049e86540c4d93ddfa2ec6f21664360820",
+        "bytes": 52686,
+        "sha256": "b98b3f03cf9fbcf0eaa878ccde6d34a72483149ceb04559c90fd52277cb9d1ae"
+      },
+      "gpt-5.2": {
+        "run": "20260217_mini-v2.0.0_gpt-5-2-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_gpt-5-2-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_gpt-5-2-high/per_instance_details.json",
+        "gitBlob": "cfdc6c07ad339e60e6d34b4d9050b85243b1bbc8",
+        "bytes": 52861,
+        "sha256": "8bac088fcc87374906a207a3cf93e25df715546ace895b3a588cc075f6353fd1"
+      },
+      "kimi-k2.5": {
+        "run": "20260217_mini-v2.0.0_kimi-k2-5-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_kimi-k2-5-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_kimi-k2-5-high/per_instance_details.json",
+        "gitBlob": "d76d9549613a46e3ae98fcc727f8129cf9ae66b4",
+        "bytes": 53298,
+        "sha256": "3794b2c4b853845d97cf89db10f4264a0b27ba75f6b1bbbf1e34ddf6fa8a5c1f"
+      },
+      "minimax-m2.5": {
+        "run": "20260217_mini-v2.0.0_minimax-2-5-high",
+        "path": "evaluation/verified/20260217_mini-v2.0.0_minimax-2-5-high/per_instance_details.json",
+        "url": "https://raw.githubusercontent.com/SWE-bench/experiments/40f164d5b8f1d249bf95a6df8b74b577fd8e519d/evaluation/verified/20260217_mini-v2.0.0_minimax-2-5-high/per_instance_details.json",
+        "gitBlob": "c14b9ea51db8dc65ff8fb9ae03366ddbe4906ce5",
+        "bytes": 53456,
+        "sha256": "62a26211006b557f1a31371ee6cf3119be5bdaed43dcce3fe6efedc0912c012c"
+      }
+    }
+  }
+}
diff --git a/docs/GUIDE.md b/docs/GUIDE.md
index afd67525..8b298ff1 100644
--- a/docs/GUIDE.md
+++ b/docs/GUIDE.md
@@ -226,6 +226,24 @@ Run `forge route gateway` to emit a LiteLLM config so the routing happens automa
 Its tier aliases point at the same resolved ids, and each alias carries an `# id:` comment
 saying where its id came from (the live catalog, or the shipped snapshot and why).
 
+`forge route universal "<task>"` is a separate, opt-in router: it recommends a model or a
+cascade across providers, minimising **expected** cost for the success you ask for
+(`--objective match-best-single | target:p | value:V | budget:B`). Its shipped prior was fitted
+on public SWE-bench Verified outcomes and refits exactly from pinned public data
+(`bench/universal-router/reproduce.sh`); its held-out headline is repository-reported, from an
+external harness, not independently reproduced, and a new in-repo held-out replay finds it no
+better than a fixed cascade chosen on the same dev tasks. `budget:B` bounds expected cost, not what a task
+can actually spend; an objective no cascade can meet is reported as infeasible (an explicit
+`INFEASIBLE` line; `feasible: false` with the minimum achievable expected cost in `--json`).
+A recommended model that no configured provider serves is marked `no provider id`, and the
+recommendation is labelled `advice only` (`applicable: false`, `unmapped` in `--json`).
+Being in the registry does not make a model callable. Add its id under `providers` in
+`.forge/models.json`, or pass `--provider <name>` to route only among models you can call.
+`forge route outcome` records one attempt's pass/fail, labelled self-reported unless
+`--verify-run <run id>` ties it to a `forge verify` run whose verdict agrees; `--attempt <id>`
+makes recording idempotent. The model, its evidence status and its limits:
+[docs/UNIVERSAL_ROUTING.md](UNIVERSAL_ROUTING.md).
+
 ### `forge models` — what each tier resolves to
 
 Forge ships no model id it depends on. `src/model_tiers.json` names each tier's **family**
@@ -658,13 +676,49 @@ $ forge verify
 Forge verify
 
   changed files:    2
-  tests:            ✓ pass
+  tests:            ✓ pass (npm test, npm test (packages/api))
+  suites ran:       npm test=PASS, npm test (packages/api)=PASS
+  packages:         2/2 covered
   symbols checked:  7
-  provenance:       .forge/provenance.json
+  provenance:       .forge/provenance.json (run d83f0b7f-45f1-466c-8e3b-9754b26cf356)
 
   PASS
 ```
 
+**What a PASS covers.** Every package that declares its own suite is planned and run in its
+own directory: the root, plus each nested package with an explicit `scripts.test`, a pytest
+config, a `go.mod`, and so on. `packages: n/m covered` counts the packages that reached a
+verdict. If any package's suite never reaches one, the result is `INCOMPLETE`, never `PASS`.
+If any package fails, the result is `FAIL`, however green the root is. A root script that
+already runs every workspace (`npm test --workspaces`, `pnpm -r test`, `yarn workspaces
+foreach`, `turbo run test`, `lerna run test`, `nx run-many`) covers them in one run instead
+of once per package. Fixture and test-data packages are never required. A test runner that is
+only a devDependency is not an obligation either; `forge stack` lists it as `available`.
+Tune this per repo under `verify` in `.forge/forge.config.json`:
+
+```json
+{ "verify": { "workspaces": "auto", "exclude": ["packages/legacy"], "generated": ["coverage/**"] } }
+```
+
+- `workspaces: "root"` declares that the root command already covers every package.
+- `exclude` lists package paths that are not required suites.
+- `generated` lists outputs a test run may legitimately write.
+
+**Bound to the code that was tested.** The stamp is bound to a fingerprint of the working
+tree: HEAD, the staged and unstaged diffs, and each untracked file's path, mode, size and
+content hash. The fingerprint is taken before AND after the run. If something changed the code
+while the tests ran (a formatter, a code generator, another agent), the result is `INCOMPLETE`
+with `mutated: true`, and the stamp names the pre-run state. Interpreter caches
+(`__pycache__`, `.pytest_cache`, …) and the `generated` paths never count as a change. An
+untracked file that cannot be read makes the state unbindable; it is never silently skipped.
+Stamps written before this fingerprint (scheme `manifest-v2`) no longer verify: re-run
+`forge verify`.
+
+Every run also appends one event to `.forge/verify-events.jsonl`: the run id, the verifier
+and its version, the suites, the coverage, the pre- and post-run state, and an environment
+digest, sealed with a machine-local MAC. The event is never rewritten. `forge route outcome
+--verify-run <run id>` ties a routing outcome to it.
+
 **`forge verify --deep` — multi-lens consensus.** The deep mode runs a table of
 independent lenses over the same diff — the test suite, unknown symbols, atlas
 dependents the diff never touched, code-without-docs drift, secret-shaped tokens in
@@ -739,10 +793,16 @@ $ forge stack
   languages:  JavaScript/TypeScript, TypeScript
   frameworks: Next.js, React
   pkg mgrs:   pnpm
-  test:       npx vitest
+  test:       pnpm test
+  available:  npx vitest
   evidence:   package.json
 ```
 
+`test` is what the repo declares it runs: an explicit `scripts.test` wins, and npm's
+`"no test specified"` placeholder is not a suite. `available` lists runners that are
+installed (a devDependency) but not what the repo runs. They are inventory, not an
+obligation: `forge verify` never requires them.
+
 Detection reads `package.json` (deps → frameworks, lockfile → package manager),
 `pyproject.toml`/`requirements.txt`, `go.mod`, `Cargo.toml`, `Gemfile`, `composer.json`,
 `pom.xml`/`build.gradle`, and `*.csproj`. Widening it is adding a data row, not code.
@@ -919,7 +979,8 @@ before canonicalization folded CRLF into LF: those carry their pre-fold id in th
 which reads still accept, so nothing is broken without it — but the old form and a teammate's
 freshly minted copy of the same fact stay two entries until you run it. It moves each claim's
 evidence and provenance logs with it, unions them into an existing twin rather than
-overwriting, and is idempotent.
+overwriting, and is idempotent. Add `--dry-run` to preview the migration: it prints what
+would move and what would merge, and writes nothing.
 
 `forge ledger compact [--dry-run]` archives what this ledger's own history says will not be
 used again. It prints every number it learned, and nothing in it is a fixed threshold:
@@ -947,8 +1008,18 @@ Forge ledger — compact (every cut-off learned from this ledger)  [dry run]
 
 **Where use comes from:** forge writes `.forge/ledger/.usage.jsonl`, a gitignored local log. It records each claim that the session lesson block, pre-edit lessons, the déjà-vu advisory, `ledger query` or the MCP query served.
 
+**Similar is not the same.** Two claims are grouped as duplicates only when they also agree
+on everything that changes behaviour: operators, numbers and units, quoted literals,
+identifiers, paths, and negation. "Enable authentication…" and "Disable authentication…" are
+never merged, however similar their words. Such a pair is printed under `kept apart — similar
+but conflicting`, so a human can retract the wrong one.
+
 **What happens to archived claims:**
 - They move to `.forge/ledger/attic/`, and their logs stay where they are.
+- Each one records WHY it was archived in `attic/<id>.log`: `tombstoned`, `dormant`, `idle`,
+  or `duplicate` (naming the claim that was kept). Archived is not refuted: consolidation
+  drops a learned lesson only when its claim was actually retracted or went dormant. An idle
+  archive keeps the lesson, and a duplicate defers to the claim that was kept.
 - `forge ledger show` and `blame` still read them.
 - New evidence brings one back.
 - The Stop hook applies the first two rules on its own; duplicates are grouped only by this command.
@@ -1026,9 +1097,22 @@ tooling migrates.
 
 ### `forge reuse` — proof-carrying code cache
 
-Verified code becomes an `artifact` claim keyed by a normalized task fingerprint; a
-lookup walks exact → near → adapt → miss. An artifact serves **only while its proof
-holds** — confidence above the 0.6 floor and every declared dependency still in the atlas.
+Verified code becomes an `artifact` claim keyed by its task text; a lookup walks exact →
+near → adapt → miss. An artifact serves **only while its proof holds**: confidence above the
+0.6 floor, its file unchanged since it was minted, and every declared dependency still in
+the atlas with the same declaration.
+
+- **Exact means the same text.** The key ignores only whitespace (and Unicode
+  normalization). Case, operators, literals and punctuation all count, so `age >= 18` and
+  `age <= 18`, or `"ADMIN"` and `"admin"`, never share a key. Artifacts minted before this
+  key was introduced never hit exact.
+- **Near must also agree on behaviour.** A reworded match is offered as `near` only when
+  the two specs share their operators, numbers, literals, identifiers, paths and negation.
+  Otherwise it drops to `adapt`, with a note naming what differs.
+- **Checked where it is served.** An artifact whose file was edited or deleted since it was
+  minted is not served. When a dependency's declaration changed, it is not served either.
+  With no atlas to check against, the hit is marked `NOT revalidated` (`requiresRevalidation:
+  true` in `--json`), never presented as checked.
 
 ```console
 $ forge reuse query "debounce user input before firing search"
@@ -1090,7 +1174,7 @@ difference — not a feeling.
 $ forge context "change verifyToken in src/auth.js to reject short tokens"
 Forge context — budgeted assembly + completeness gate
 
-  budget: 1840/12000 tokens · required 4 · COMPLETE
+  budget: 1840/12000 tokens (chars/3.6 estimate of the rendered block) · required 4 · COMPLETE
     + def:src/auth.js [full] 620t
     + deps:verifyToken [head] 410t
     + tests:test/auth.test.js [full] 480t
@@ -1100,7 +1184,27 @@ Forge context — budgeted assembly + completeness gate
 On an incomplete assembly it lists the missing items and derived clarifying questions
 ("the task names `X` but the repo doesn't define it — which file implements it?") and
 exits 1. `--budget <tokens>` tightens the window; a tight budget downgrades granularity
-instead of silently dropping coverage.
+instead of silently dropping coverage, and reports what it could not deliver.
+
+What `COMPLETE` (`ok: true`) does and does not mean:
+
+- **Syntactically delivered, not semantically sufficient.** Every required item was delivered
+  as content inside the budget. Whether that content is enough for the edit is not measured.
+- **Token counts are an estimate** — characters ÷ 3.6 of the rendered block, labels and
+  separators included — not a model tokenizer's count.
+- **A pointer is not coverage.** An item that only fits as a one-line `- read <file>` pointer
+  is a pending read obligation, listed under `pending`, and the assembly is not complete until it
+  is read. A 25-line head covers a definition only when the definition's line is inside it, and
+  a dependents list cut at 12 names what it left out (`truncated`).
+- **Over budget is INCOMPLETE.** When even pointers do not fit, the result says `overflow: true`
+  and `ok: false`; it never reports a silent over-budget pass.
+- **Selection is a heuristic.** Optional items are picked greedily by value density (score ÷
+  tokens) with per-source diminishing returns, with no optimality guarantee.
+- **Only the explicit paths assemble.** `forge substrate` and `forge context` build the
+  selection; the ambient per-prompt hook does not (latency), it works from caches.
+
+Status and contract: [substrate-v2 plan 04 §7](plans/substrate-v2/04-context-assembly.md#7-status-2026-09-26--partial)
+(P4 is partial).
 
 ### `forge diagnose "<error>"` — doom-loop check
 
@@ -1149,13 +1253,19 @@ Forge imagine — consequence simulation (pre-action)
   minimal dry-run suite (1) — run these, in this order:
     - test/auth.test.js
 
-  (measure it: re-run with --run — sandboxed worktree dry-run of HEAD)
+  (measure it: re-run with --run — a dry-run in an isolated checkout of HEAD; not a security sandbox)
 ```
 
-Add **`--run`** to actually execute that suite in a sandboxed worktree of HEAD — the
-dry-run result lands as oracle evidence on the prediction. It refuses a dirty working
-tree (your uncommitted changes wouldn't be in the run); commit/stash first or pass
-`--allow-dirty` to knowingly measure the last commit. It also flags predicted breaks
+Add **`--run`** to actually execute that suite in an isolated git checkout (a detached-HEAD
+worktree) — the dry-run result lands as oracle evidence on the prediction. The checkout isolates
+files only: it is not a security sandbox, and the tests run with your network, credentials, home
+directory and process permissions. It tests the committed baseline, not a proposed uncommitted
+patch, so it refuses a dirty working tree (your uncommitted changes wouldn't be in the run);
+commit/stash first or pass `--allow-dirty` to knowingly measure the last commit. The selected
+files run under `node --test` and nothing else: when a selected test is not a `.js`, `.mjs` or
+`.cjs` file, or the project's `test` script uses another runner (Jest, Vitest, Mocha, pytest),
+the result is an explicit **unsupported runner** verdict instead of a run — run the project's own
+runner on the selected files. It also flags predicted breaks
 **no test covers** — the risk you can't dry-run away.
 
 ### `forge uicheck` — deterministic UI checks
@@ -1163,6 +1273,15 @@ tree (your uncommitted changes wouldn't be in the run); commit/stash first or pa
 Five subcommands: three are static parsing — no LLM, no screenshots — and `visual`
 and `interact` optionally drive a real browser.
 
+They are **advisory measurements of different things**: contrast arithmetic, design-token and
+scale conformance, distance from generic templates, fingerprint similarity, and four rendered
+behaviours. A passing contrast check is not an accessibility result, and distance from common
+templates is not user value. `contrast`, `design` and `visual` exit 1 on a fail so a script or CI
+step can gate on them if you choose; nothing runs them as a blocking hook, and `interact` only
+gates under `--enforce`. What each measures, and the labelled set, false-positive cost and
+exception path a check would need before becoming blocking:
+[substrate-v2 plan 07 §7](plans/substrate-v2/07-ui-quality-gate.md#7-ui-checks-are-advisory--what-each-one-measures-2026-09-26).
+
 **`contrast <fg> <bg> [--large] [--json]`** — exact WCAG math, asserted, never guessed
 (bare `forge uicheck <fg> <bg>` still works). It **exits 1 when the pair fails AA**, so a
 script or CI step can gate on it. `--large` grades against the large-text / UI-component
@@ -1308,16 +1427,20 @@ Forge uicheck interact — browser interaction checks
 
 A read-only lens over `.forge/` — stdlib `node:http`, localhost-only, one
 self-contained HTML page (no CDN, no build step). Panels: Ledger (claims with val bars,
-contested claims, per-author trust), Cost/Cache (measured stage counters), Impact
+contested claims, per-author trust), Cost/Cache (measured stage counters — stage
+self-estimates, not end-to-end spend; a stage with no logs is unknown, not $0), Impact
 (blast-radius explorer), Radar (dependency-currency rings read from the `.forge/radar.json`
 cache), Trends (per-stage metrics history as inline-SVG sparklines), Memory browser
 (ranked recall search over the ledger with confidence + freshness bars), and Session
 timeline (durable mint/tombstone events across sessions). The page live-refreshes every 5s,
 paused while the tab is hidden. Every claim row shows its `forge ledger blame` command.
-The only two writes are the human-driven `POST /api/ratify` and `POST /api/retract`; both
-are guarded against CSRF and DNS-rebinding — a request whose `Host` isn't the loopback
-interface, or whose browser `Origin` isn't the loopback origin, is refused with `403` (a
-non-loopback `--host` bind is the documented opt-out).
+The only two writes are the human-driven `POST /api/ratify` and `POST /api/retract`.
+Every route, reads included, refuses a request whose `Host` is not this loopback address
+and port, with `403`; that blocks DNS rebinding. A write also needs the per-session token
+the server embeds in its own page (sent back as the `x-forge-token` header). When a browser
+sends an `Origin`, it must be exactly this server's origin, so a page on another localhost
+port cannot write either. A script that POSTs must read the token from the page first.
+Binding a non-loopback `--host` turns the `Host` check off; that exposure is your choice.
 
 ```console
 $ forge dash
@@ -1370,10 +1493,23 @@ Read the `context` line with care: that 62% is the white paper's 30-task routing
 demonstration, measured on the tasks its thresholds were tuned on. A pre-registered
 evaluation on 80 held-out tasks refuted it — counting every escalation, routing cost
 20.2% _more_ than always-premium ([research/empirical-refutation/](../research/empirical-refutation/)).
-The line is quoted here as the CLI currently prints it.
+The line is quoted here as the CLI currently prints it. The ~90 % "target" it names is a
+hypothesis, never a result: the stage arithmetic it was argued from used the refuted routing
+figure and has been withdrawn (see the plan's cost model, §2).
 
 Plain `forge cost` remains the per-day spend view via `ccusage`.
 
+**Reading any cost number.** A figure is only comparable when it states: the currency and the
+date of the prices; whether it is actual spend or a counterfactual (tokens repriced at another
+model's price are a counterfactual, not an observed saving); which attempts it includes (first
+attempt only, or every retry and escalation); whether cached tokens and verifier and tool costs are
+counted; and what data is missing. A day or stage with no logs is **unknown, not $0 actual
+spend**. The number that decides whether the substrate saves money is total cost per completed,
+externally verified task, read beside the acceptance and abandonment rates, against a baseline
+with equivalent tools, context and repair opportunity — always-premium / read-everything is a weak
+comparator. Per-stage factors diagnose where cost goes; they are not multiplied into a total. The
+full rule: [substrate-v2 plan 05 §3](plans/substrate-v2/05-cost-model.md#3-acceptance-rule-for-any-cost-headline).
+
 ### The rest
 
 | Command                          | Answers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
@@ -1689,9 +1825,10 @@ session. For learned-from-mistakes memory, just work: Cortex captures recurring
 corrections on its own.
 
 **UI work.** `forge uicheck contrast <fg> <bg>` for exact contrast; `forge uicheck
-design <files> --taste <style>` as the anti-slop gate (mint the project fingerprint
+design <files> --taste <style>` as an advisory anti-slop check (mint the project fingerprint
 first: `forge uicheck fingerprint <files> --mint`); the `ui-workflow` and `taste`
-tools for the rest.
+tools for the rest. None of these replaces looking at the rendered UI with a keyboard and a
+screen reader.
 
 ---
 
@@ -1855,12 +1992,20 @@ code reads but this table misses fails CI on the forge repo):
 - **`forge reuse`'s MinHash near-match is weak on very short specs** — a few words hash
   to too few shingles to rank reliably; write a sentence, not a keyword — or configure
   the optional `FORGE_EMBED` embeddings tier, which replaces exactly this term.
-- **The UI fingerprint doesn't resolve CSS `var()` indirection yet** — a fully
-  tokenized palette is partially invisible to the design gate.
+- **The static UI fingerprint sees only what it can resolve** — `var()` indirection resolves
+  within the gated files and the theme stylesheets, but values set at runtime stay invisible to
+  it (use `visual`), and every UI check is advisory: contrast math is not an accessibility audit.
+  _(Corrected 2026-09-26: this said the fingerprint "doesn't resolve CSS `var()` indirection
+  yet", which the `uicheck` section above contradicts.)_
 - **`forge cost --stages` reports measured stages only** — a stage with no events says
-  "no data", never a default; the composed figure is not a bound (a stage can raise
-  cost) and ~90 % is a
-  labeled _target_, not a claim.
+  "no data", never a default; the composed figure is a diagnostic, not a bound or a total (a
+  stage can raise cost, and stages interact), and ~90 % is a labeled _target_ — a hypothesis,
+  not a claim.
+- **`forge context` completeness is syntactic.** `COMPLETE` means every required item was
+  delivered within an estimated token budget, with no pending reads; it does not mean the
+  context is sufficient for the edit.
+- **`forge imagine --run` is an isolated checkout, not a sandbox.** It runs the committed
+  baseline's selected tests under `node --test` with your normal permissions.
 - **The substrate's rubrics are heuristic, not benchmarked** — judge them after real
   use. What's _asserted_ (safe to gate on): repo grounding, graph traversal, scope
   decomposition, routing arithmetic, and the test/build commands. Everything else is
diff --git a/docs/INTEGRATIONS.md b/docs/INTEGRATIONS.md
new file mode 100644
index 00000000..b2bb6961
--- /dev/null
+++ b/docs/INTEGRATIONS.md
@@ -0,0 +1,92 @@
+# Integrations — what each tool actually gets
+
+Forgekit emits configuration for ten coding tools, plus MCP configuration for Roo Code and VS Code.
+"Supported" hides four different things, so this page lists them separately for every tool:
+
+1. **Config emission** — forge writes the tool's native rules file (or relies on one the tool
+   reads natively, such as `AGENTS.md`).
+2. **MCP registration** — forge writes an MCP server entry for its own server (`forge-cortex`)
+   where the tool can find it.
+3. **Automatic hook execution** — forge code runs by itself at lifecycle points (session start,
+   each prompt, before or after a tool call, when the agent stops), without the model choosing to
+   call it.
+4. **Enforcement** — some of that code can *block* an action, not just advise.
+
+Each cell says how the claim is backed (as of 1.4.3, commit `d2abfa6`; checked 2026-09-26 against
+`src/emit/*.js`, `src/sync.js`, `src/init.js`, `hooks/hooks.json` and the tests):
+
+| Label | Meaning |
+|---|---|
+| **tested (emission)** | a `node:test` test asserts the file forge writes and its content. The tool itself is not launched, so whether it loads the file rests on its documentation. |
+| **tested (execution)** | a test runs the code that executes on that path — for hooks, the guard script fed a synthetic hook payload — though not inside the real host. |
+| **declared** | forge writes the file, or relies on documented tool behaviour, and no test exercises it (not execution-tested). |
+| **not supported** | forge does nothing for this property on this tool. |
+
+## The matrix
+
+| Tool | Config emission | MCP registration | Automatic hooks | Enforcement (blocking) |
+|---|---|---|---|---|
+| **Claude Code** | `CLAUDE.md` importing `@AGENTS.md`, plus forge's block in `AGENTS.md` — tested (emission) | `.mcp.json` — tested (emission) | plugin `hooks/hooks.json` or `forge init`-merged `~/.claude/settings.json`: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop — tested (execution) for the guard scripts; manifests tested for wiring | yes — see [Claude Code enforcement](#claude-code-enforcement) — tested (execution) |
+| **Codex** | root `AGENTS.md` (32 KiB cap checked by `forge sync`) — tested (emission) | `.codex/config.toml` `[mcp_servers.forge-cortex]` — tested (emission); the package's Codex bundle (`.codex-plugin/`) — declared | not supported | not supported in the agent (see [Any tool that commits through git](#any-tool-that-commits-through-git)) |
+| **Cursor** | root `AGENTS.md`; warns when a legacy `.cursorrules` would shadow it — tested (emission) | `.cursor/mcp.json` — tested (emission) | not supported | not supported in the agent |
+| **Gemini CLI** | `AGENTS.md` added to `.gemini/settings.json` `context.fileName` — tested (emission) | `.gemini/settings.json` `mcpServers` — tested (emission) | not supported | not supported in the agent |
+| **Aider** | `.aider.conf.yml` with `read: AGENTS.md` — tested (emission) | not supported | not supported | not supported in the agent |
+| **GitHub Copilot** | root `AGENTS.md`, read by the coding agent — tested (emission) | `.vscode/mcp.json` — tested (emission) | not supported | not supported in the agent |
+| **Windsurf / Devin** | root `AGENTS.md`, with a warning past the tool's size caps — tested (emission) | not supported (the tool's MCP config is global-only) | not supported | not supported in the agent |
+| **Zed** | root `AGENTS.md`; warns about earlier-precedence files that shadow it — tested (emission) | `.zed/settings.json` `context_servers` — tested (emission) | not supported | not supported in the agent |
+| **Continue** | `.continue/rules/00-forge.md` — tested (emission) | `.continue/mcpServers/forge-cortex.yaml` — tested (emission) | not supported | not supported in the agent |
+| **OpenClaw** | the execution folder's `AGENTS.md` as project context — tested (emission) | `.openclaw/mcp.json` fragment, **not auto-registered**: one `openclaw mcp add` command applies it — tested (emission and command); or install the package as a Codex bundle — declared | not supported (forge installs nothing into OpenClaw's hook system) | not supported in the agent |
+| **Roo Code** | no rules file | `.roo/mcp.json` — tested (emission) | not supported | not supported |
+| **VS Code** | no rules file | `.vscode/mcp.json` — tested (emission) | not supported | not supported |
+
+`forge init` emits only for the tools a repository already uses (Claude Code plus any tool with a
+sign on disk) unless `--tools` says otherwise, and records the choice for later `forge sync` runs.
+Every target above is covered by the emission tests in `test/sync.test.js`, `test/mcp.test.js`,
+`test/openclaw.test.js` and `test/init_tools.test.js`. None of the ten host tools is launched in CI,
+so "the tool actually loads this file" is documentation-backed everywhere, including Claude Code.
+
+### Claude Code enforcement
+
+On Claude Code the guards run automatically, and four can stop or pause an action:
+
+| Guard | Event | What it can do | Default |
+|---|---|---|---|
+| `protect-paths` | PreToolUse (writes, shell, reads) | deny a tool call on secrets, credential stores and destructive commands; fails closed when it cannot reach a verdict | on |
+| `cost-budget` | PreToolUse | pause for the user (`permissionDecision: "ask"`) once the day's spend passes `FORGE_COST_CEILING` (default $10); it asks, and never blocks by itself | on |
+| completion gate | Stop | block "done" once per session when code changed without test evidence or a doc/state record | on (`FORGE_STOPGATE=0` disables) |
+| substrate gate | UserPromptSubmit / pre-edit | block a vacuous task or an edit into a very large dependent set | off unless `FORGE_ENFORCE=1` |
+
+`doom-loop`, `secret-redact`, `format-on-edit`, `lean-guard` and the session learner are advisory:
+they warn, redact output after the fact or record, and never block. Guards are defence in depth, not
+a sandbox: a sufficiently creative shell command can bypass a regex guard. Tests run each guard with
+synthetic payloads (`test/guards.test.js`, `test/protect_paths.test.js`, `test/stop_gate.test.js`,
+`test/hook_launcher.test.js`), and `test/hook_manifests.test.js` checks that the plugin manifest and
+the settings template wire the same guards.
+
+### Any tool that commits through git
+
+`forge harden` installs a git pre-commit hook (gitleaks when present, then `forge precommit`). It
+runs at commit time whatever agent or person made the change: with `FORGE_COMMIT_GATE=block` it
+refuses a commit whose staged code carries no doc or state change, and a detected secret blocks in
+every mode. It is tested in `test/commit_gate.test.js` and `test/harden.test.js`. This is the only
+enforcement forge offers outside Claude Code.
+
+## Models and providers
+
+Model availability and prices change faster than releases, so each needs a date and a source.
+
+- **The tiered router** (`forge route`) maps a task to a tier and the tier to a model through the
+  native provider adapters in `src/providers.js`: `anthropic` (Messages API), `openrouter` (the same
+  Anthropic model ids as `anthropic/<id>`), `litellm` (tier aliases on a gateway you run), and
+  `openai` and `gemini` (their OpenAI-compatible chat-completions endpoints, each with its own
+  tier-to-model map). Tier prices come from `src/model_tiers.json`, verified 2026-09-22; `forge models`
+  prints where each resolved id and price came from.
+- **The universal router** (`forge route universal`) reads a separate registry, `data/models.json`:
+  14 models from seven organisations. Only the seven Anthropic entries ship a provider id (for the
+  `anthropic` provider); the other seven — DeepSeek, Google, Z-AI, OpenAI (two), Moonshot and
+  MiniMax — are recommended by id but **cannot be applied** until you add a provider id for them in
+  `.forge/models.json`. Registry presence is not operational availability, and a recommendation
+  for a model you cannot call should be read as advice about the model, not a runnable route.
+  Registry prices, where present, carry their source and the date checked (2026-09-22); the other
+  models' costs come from the February 2026 benchmark runs behind the shipped prior. See
+  [UNIVERSAL_ROUTING.md](UNIVERSAL_ROUTING.md).
diff --git a/docs/UNIVERSAL_ROUTING.md b/docs/UNIVERSAL_ROUTING.md
index 2af5941f..6e5e7d0b 100644
--- a/docs/UNIVERSAL_ROUTING.md
+++ b/docs/UNIVERSAL_ROUTING.md
@@ -2,7 +2,15 @@
 
 `forge route universal` recommends a model, or a cascade of models ("try A; if a check fails, try B"), for a task. It works with any provider's models.
 
-The router code names no vendor, model, tier or threshold, and a test enforces that. Models come from data (`data/models.json`, plus `.forge/models.json` in a project). What each model can do and what it costs is learned from verified outcomes.
+The router code names no vendor, model, tier or threshold, and a test enforces that. Models come from data (`data/models.json`, plus `.forge/models.json` in a project). What each model can do and what it costs is learned from recorded outcomes.
+
+> **Evidence status (2026-09-26).** Three results, kept apart:
+>
+> - **The run-4 held-out headline** (76.3% solved at $0.093 per task) is **repository-reported**. It was produced by an external harness (harness-bench) that is not shipped here; its split ids, pre-registration and metric code are not in this repository, and it has not been independently reproduced.
+> - **The shipped prior's refit is reproduced in this repository.** `bench/universal-router/reproduce.sh` downloads the pinned, sha256-checked public inputs and refits `data/router_prior.json`; on 2026-09-26 all 176 fitted values came out identical (only `provenance.fittedAt` differs). That shows the calculation reproduces. It is the project's own run, not an independent third-party replication (see [Reproducibility](#reproducibility)).
+> - **A new held-out replay in this repository** (a different split, not run 4) finds that the router does **not** beat a fixed cascade chosen on the same dev tasks: 80.0% solved at $0.124 per task, against the cascade's 80.6% at $0.136 ([details](#a-new-held-out-replay-in-this-repository-2026-09-26)).
+>
+> The shipped prior is a useful initialization, not a guarantee about your workload. The universal router is a separately versioned component from the old tiered router whose 62.1% saving was refuted (`research/empirical-refutation/`); neither result transfers to the other.
 
 ## The model
 
@@ -45,29 +53,31 @@ E[cost of s] = Σ_i c_{m_i} · Σ_q w_q Π_{l<i} (1 − P[m_l][q])
 
 Every ordered cascade of up to 3 candidates is evaluated; `--depth` bounds the search. The objective is the user's stated preference:
 
-| Objective | Chooses |
-|---|---|
-| `match-best-single` (default, no parameter) | the cheapest cascade at least as likely to succeed as the best single candidate for this task |
-| `target:p` | the cheapest cascade with P(success) ≥ p |
-| `value:V` | the cascade that maximises V·P(success) − E[cost] |
-| `budget:B` | the most likely cascade with E[cost] ≤ B |
+| Objective | Chooses | What it is not |
+|---|---|---|
+| `match-best-single` (default, no parameter) | the cheapest cascade at least as likely to succeed as the best single candidate for this task | — |
+| `target:p` | the cheapest cascade with predicted P(success) ≥ p | not a guarantee of success ≥ p: predicted success was optimistic by 4–6 points on the run-4 test split (see [Modeling limits](#modeling-limits)) |
+| `value:V` | the cascade that maximises V·P(success) − E[cost] | — |
+| `budget:B` | the most likely cascade with **expected** cost E[cost] ≤ B | not a runtime spend cap: one task's cascade can cost up to the sum of every attempt in it, and E[cost] itself is under-predicted (see [Modeling limits](#modeling-limits)) |
+
+**When no cascade satisfies the objective.** A `budget:B` or `target:p` that nothing can meet is reported as infeasible, never as a quiet best effort: the result carries `feasible: false`, `budgetMet: false` for a budget objective, the `minimumExpectedCost` any candidate cascade achieves, the `maxPossibleCost` of the recommended cascade (the sum of all its attempts' costs — the worst case), and a `reason`, and `forge route universal` prints an explicit `INFEASIBLE` line. The caller must choose a fallback. Expected cost, the maximum possible cascade cost and the cost actually charged are three different numbers; forgekit advises, and enforcing a hard spend cap belongs to whatever runs the attempts.
 
 **4. Learning locally.**
-- `forge route outcome "<task>" --model <id> --pass|--fail --cost <usd>` records a verified result. Only a hash of the task and its features are stored, never the text.
-- `forge route fit` refits with the shipped fit as the prior mean. This is a Bayesian update: a few local outcomes barely move it, and many outcomes dominate.
+- `forge route outcome "<task>" --model <id> --pass|--fail [--cost <usd>] [--attempt <id>] [--verify-run <run id>]` records the result of one attempt. Only a hash of the task and its features are stored, never the text. The pass/fail is entered by the caller, so a record is labelled `provenance: "self-reported"`; with `--verify-run`, naming a `forge verify` run in this checkout's verifier-event log whose PASS or FAIL agrees with it, the record is labelled `provenance: "verify-event"` instead (a disagreeing or missing run is refused). Every record carries an `attemptId` (`--attempt`, or a fresh id when omitted), and recording the same attempt id again counts once, so a retry or a replayed outcomes file cannot count one attempt twice. Records are schema-validated when written and when read.
+- `forge route fit` refits with the shipped fit as the prior mean. It is a MAP, empirical-Bayes-style **shrinkage** update — a few local outcomes barely move it and many outcomes dominate — not a maintained posterior: it returns a point estimate and carries no covariance over from the shipped fit.
 - Cost intercepts are updated with a unit-information prior.
-- A model in the registry but not in the fit enters "cold", at the population-mean ability, until outcomes arrive.
+- A model in the registry but not in the fit enters "cold", at the population-mean ability and loadings, until outcomes arrive. Its point estimate hides a large epistemic uncertainty.
 
 **5. Candidates.**
 - `--provider <name>` limits the candidates to models that provider can serve (the `providers` map in the registry).
 - `--provider any` (the default) gives advice across every model.
-- The shipped registry gives provider ids only for Anthropic models. Add ids for OpenRouter, a LiteLLM gateway or a native API in `.forge/models.json`.
+- The shipped registry gives provider ids only for Anthropic models; the other seven registry entries are recommended by id but cannot be applied until you add a provider id. Add ids for OpenRouter, a LiteLLM gateway or a native API in `.forge/models.json`. Registry presence is not availability: a model with no provider id is advice only. The CLI marks such a cascade step `no provider id` and prints an `advice only` line; `--json` gives each step its `providers` and `costSource`, plus `applicable: false` and the `unmapped` models. Where the registry has prices, each carries its source and the date it was checked.
 
 ## Shipped prior
 
 `data/router_prior.json` was fitted on public per-task results, and `bench/universal-router/README.md` shows how to regenerate it:
 
-- **Tasks:** the 500 SWE-bench Verified issues.
+- **Tasks:** the 500 SWE-bench Verified issues (Hugging Face `SWE-bench/SWE-bench_Verified`, revision `78f471b`; that revision is not in `princeton-nlp/SWE-bench_Verified`).
 - **Runs:** eleven models from seven providers with the same scaffold (mini-SWE-agent 2.0.0), one attempt each, dated February 2026.
   - Anthropic: Claude Haiku / Sonnet / Opus 4.5 and Opus 4.6
   - OpenAI: GPT-5.2 and GPT-5 mini
@@ -78,7 +88,14 @@ Every ordered cascade of up to 3 candidates is evaluated; `--depth` bounds the s
   - Z-AI: GLM-5
 - **Selection:** cross-validation chose k = 1 at prior scale 4. Scale 2 had been the edge of the first grid, so the grid kept expanding until the held-out likelihood stopped improving.
 
-## Measured
+**What the shipped prior can and cannot tell you.**
+- It is fitted on **all 500** tasks, so it cannot be evaluated out of sample on any of them. The 150/350 experiments below fit a *different* model on 150 tasks; their numbers are not a test of the shipped prior, and the two must stay separate.
+- The outcomes come from one scaffold, on Python repositories, at February 2026 prices. They are a historical, relative comparison of those runs, not present-day model economics or general coding capability.
+- The benchmark itself has known label problems. OpenAI's 2026-02-23 analysis ([why OpenAI no longer evaluates SWE-bench Verified](https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/)) reports flawed tests in **59.4% of an audited 138-problem hard subset** — not 59.4% of all 500 tasks — plus evidence of training-data contamination. More benchmark volume alone does not fix contamination or label validity.
+
+## Held-out benchmark (repository-reported)
+
+> Repository-reported; produced by an external harness (harness-bench) that is not shipped here; not independently reproduced as of 2026-09-26.
 
 harness-bench run 4 is pre-registered. It fits on 150 dev issues and scores 350 held-out issues against each model's real outcome and cost.
 
@@ -91,13 +108,50 @@ harness-bench run 4 is pre-registered. It fits on 150 dev issues and scores 350
 
 **Against the best single model:** non-inferior (+1.1 points, CI [−2.0, +4.3]) at 74% lower cost. In 5-fold cross-validation it is +3.2 points (CI [+0.4, +6.2]) at −$0.58 per task.
 
-**Replicated.** An independent re-run from the pinned public data reproduced 217 of 218 test metrics exactly (only the wall-clock fit time differs). The shipped prior also refits bit for bit. See `bench/universal-router/README.md`.
+**Against a fixed cascade — the baseline that matters.** Most of the gain comes from choosing across providers. On the 150-issue fit the router does **not** beat a fixed cascade chosen on the same dev data; with 400 training issues its target modes are cheaper than the fixed equivalents (repository-reported). The in-repo replay below finds the same on a new split. A fixed cascade selected on dev data is an essential baseline for any routing claim.
+
+**Re-run reported by the project (2026-09-22).** The project reports re-running run 4 from the pinned public data on a second machine with the same external harness: 217 of 218 held-out metric values identical (only the wall-clock `fitSeconds` of the 150-issue dev fit differs, 37.6 s against 45.9 s), and the shipped prior refit identical. This is the repository's own report, not an independent third-party replication. See `bench/universal-router/README.md`.
+
+## A new held-out replay in this repository (2026-09-26)
+
+> A new experiment, not a reproduction of run 4. Source: `bench/universal-router/README.md`, run on 2026-09-26.
 
-**Limits (measured):**
-- **Where the gain comes from.** Most of it comes from choosing across providers. On the 150-issue fit the router does not beat a fixed cascade chosen on the same dev data; with 400 training issues its target modes are cheaper than the fixed equivalents.
-- **Targets are optimistic.** Predicted cascade success is optimistic by 4 to 6 points on the test split, so `target:p` lands below p. A cross-validated calibration map is the planned fix.
+`bench/universal-router/holdout_eval.mjs` shuffles the same 500 tasks with seed 20260926 into 150 dev and 350 held-out tasks, fits on the dev tasks only (the shipped prior is never used), routes each held-out task from its text with `match-best-single`, and replays the cascade against the recorded outcomes and costs. Every baseline is chosen on dev only. Intervals are 95% paired-bootstrap intervals over held-out tasks (10,000 draws).
+
+| Held-out, 350 tasks | Solved | $ per task |
+|---|---|---|
+| universal router, `match-best-single` (dev fit) | 80.0% | $0.124 |
+| best single model on dev (claude-opus-4.5) | 76.0% | $0.768 |
+| cheapest single model on dev (gpt-5-mini) | 57.4% | $0.047 |
+| best fixed cascade on dev (minimax-m2.5 > gpt-5-mini > kimi-k2.5) | 80.6% | $0.136 |
+
+- **Against the fixed cascade the router shows no advantage on solve rate:** −0.6 points [−1.4, 0.0] at −$0.012 per task [−$0.024, −$0.003]. It is marginally cheaper; it solved no task the cascade missed, and the cascade solved two that it missed. Five further seeds, run after this result as a sensitivity check, keep it within −0.6 to +1.1 points of the dev-chosen fixed cascade, and in no split is it both more accurate and cheaper.
+- **Against the best single model on dev** it solves +4.0 points [+0.6, +7.4] at −$0.644 per task, mostly because one cheap model (minimax-m2.5) opens 308 of the 350 cascades. That comparison depends on which model wins dev: across the six splits the interval excludes zero only for seed 20260926.
+- **The replay is optimistic about deployment.** It stops at the first attempt whose recorded label is "resolved", which assumes a perfect, free check between attempts; a deployed cascade needs its own verifier, which can be wrong and costs money. The same data limits apply as to the shipped prior: one scaffold, one attempt per model and task, twelve Python repositories, February 2026 costs.
+
+## Reproducibility
+
+| Part | Where | Status |
+|---|---|---|
+| Public inputs | Hugging Face `SWE-bench/SWE-bench_Verified` @ `78f471b` (not `princeton-nlp/SWE-bench_Verified`, which does not contain that revision); the eleven `per_instance_details.json` files at SWE-bench/experiments `40f164d` | Pinned with URL, revision, size and sha256 in `bench/universal-router/sources.json`; `build_input.py` checks every download against them |
+| Building the fit input (`universal_all.json`) | `bench/universal-router/build_input.py` | **In this repository**; no harness-bench needed |
+| Prior refit | `bench/universal-router/reproduce.sh` (build the input, refit with `fit_prior.mjs`, compare with `compare_priors.mjs`) | **Reproduced exactly in this repository (2026-09-26).** From an empty work directory, all 176 fitted values are identical to `data/router_prior.json` (only `provenance.fittedAt` differs), with the router code of `d2abfa6` and again with the review changes committed in `aedddf5`. The refit takes about 7 minutes (413–424 s on a 4-vCPU Intel Xeon @ 2.80GHz, Node v22.22.2, Python 3.11.15). The external review of 2026-09-26 stopped its refit at a 180-second limit, which was too short: not evidence against the fit. The 37.6 s and 45.9 s in the 2026-09-22 report are the 150-issue dev fit inside the held-out test, not this 500-issue refit. These are the project's own runs: the calculation reproduces; no third party has replicated it |
+| Run-4 held-out benchmark (150/350 split ids, pre-registration, metric aggregation, bootstrap) | harness-bench `test universal` | **Not reproducible from this repository**; the split ids, harness, metric JSON and environment lock would have to be published or pinned for a cold machine to reproduce the table above |
+| A new held-out replay (a different split; not run 4) | `bench/universal-router/holdout_eval.mjs` | **In this repository**; refits on dev tasks only and compares against baselines chosen on dev, including a fixed cascade. Results [above](#a-new-held-out-replay-in-this-repository-2026-09-26); it does not stand in for run 4 |
+
+## Modeling limits
+
+- **Conditional independence and point estimates.** The MIRT factor integrates a latent task difficulty, which is a reasonable way to model correlated failures, but the model still assumes attempts are conditionally independent given the latent variables, and it uses fitted point estimates of the parameters.
+- **Local refits shrink; they do not track uncertainty.** `forge route fit` is a MAP update centred on the shipped parameters, not a posterior with transferred covariance, and cold models at population-mean ability carry substantial epistemic uncertainty the recommendation does not display.
+- **The cascade cost formula under-predicts cost.** `E[cost of s]` multiplies each attempt's unconditional expected cost by the probability of reaching it, which assumes `E[cost_i | earlier attempts failed, x] = E[cost_i | x]`. On the recorded data that assumption does not hold. In the in-repo replay (seed 20260926) the chosen cascades' expected cost was $0.102 per task against $0.124 replayed, and cost was under-predicted in all six splits, by 5% to 22% of the replayed cost: a failed attempt costs on average 1.2 to 2.0 times as much as a successful one, for every model, and a later attempt is reached only after a failure (source: `bench/universal-router/README.md`). Until the cost model conditions on earlier outcomes, read `E[cost]`, and so `budget:B`, as optimistic.
+- **Targets are optimistic.** Predicted cascade success was optimistic by 4 to 6 points on the run-4 test split (repository-reported), so `target:p` lands below p. In the in-repo replay (`match-best-single`), predicted minus observed success ranged from −2.8 to +9.1 points across six splits (80.2% predicted against 80.0% observed for seed 20260926). `target:p` is not a guarantee until there is an out-of-fold calibration map, reliability intervals and an explicit abstention policy.
+- **Budgets are expectations.** `budget:B` constrains expected cost, not spend; see the infeasibility contract above.
 - **One scaffold, text-only features.** The data is one agent scaffold and text-only features, with February 2026 prices. Re-fit on your own outcomes.
 
+## Next evidence
+
+The evidence that would test the router rather than its training data: fresh, time-held-out tasks (private or permissioned) or unseen repositories; another agent scaffold; another language; and actual end-to-end spend under an external hard cap, not repriced tokens. SWE-bench Multilingual can support a separate transfer study only after its license and task setup are checked — its [dataset documentation](https://www.swebench.com/SWE-bench/guides/datasets/) describes 300 tasks across nine languages. Report the full cost/success curve with paired uncertainty, and the fixed-cascade baseline beside it.
+
 ## Relation to `forge route`
 
 `forge route` (tiered: haiku / sonnet / opus / fable) is unchanged and remains the default for Claude Code model selection. The universal router is opt-in: run `forge route universal`, or set `route.objective` in `.forge/config.json` to choose its default objective.
diff --git a/docs/cognitive-substrate/README.md b/docs/cognitive-substrate/README.md
index d6be1df2..7d00d1ec 100644
--- a/docs/cognitive-substrate/README.md
+++ b/docs/cognitive-substrate/README.md
@@ -7,10 +7,15 @@ an edit will break — all from the repo you already have, with no extra LLM cal
 
 In Claude Code it runs **automatically**. In other tools you (or the agent) run one command.
 
-> Why this exists, in one line: a frozen model is a stateless function `y = f(x)` — no memory,
-> no foresight, a fixed window. Those faculties can't be prompted in; they have to be supplied
-> from the outside. This is that outside layer. Full argument: the white paper
-> ([PDF](./cognitive_substrate_whitepaper.pdf) · [HTML](./cognitive_substrate_whitepaper.html)).
+> Why this exists, in one line: a model with frozen weights keeps no durable state between
+> independent calls, sees only a bounded context, never updates its weights from outcomes, and
+> cannot reliably verify itself without external evidence. Prompting does change what it does
+> inside one context, but it cannot supply those guarantees; this layer supplies persistence and
+> verification from the outside — one tested way to do it, not the only possible one. Full
+> argument: the white paper ([HTML](./cognitive_substrate_whitepaper.html), with the 2026-09-21
+> and 2026-09-26 corrections · [PDF](./cognitive_substrate_whitepaper.pdf), a pre-correction
+> edition). _(Corrected 2026-09-26: this line used to say "no memory, no foresight, a fixed
+> window. Those faculties can't be prompted in"; see the white paper's Corrections.)_
 
 ---
 
@@ -264,15 +269,38 @@ needs a hook surface. Tests and human corrections always win. The full, canonica
 ## Learn more
 
 - **White paper** — the full argument: [HTML](./cognitive_substrate_whitepaper.html) (with the
-  2026-09-21 corrections) · [PDF](./cognitive_substrate_whitepaper.pdf) (predates them). Its two
+  2026-09-21 and 2026-09-26 corrections) · [PDF](./cognitive_substrate_whitepaper.pdf)
+  (historical, pre-correction edition; provenance in
+  [research/HISTORICAL_EDITIONS.md](../../research/HISTORICAL_EDITIONS.md)). Its two
   prototype results were refuted on real data — see
   [research/empirical-refutation/](../../research/empirical-refutation/).
 - **[Package overview](./deliverable-package.md)** — headline results (refuted; see its banner)
   and prototypes
 - **[Evidence map](./evidence_map.md)** — every load-bearing statistic re-graded against
-  primary sources (5 confirmed, 5 vendor-reported, 2 dropped)
+  primary sources (5 confirmed, 5 vendor-reported, 2 dropped); since 2026-09-26 it also grades
+  claim support, study design, replication and transfer scope separately
 - **[Ecosystem map](./ecosystem_map.md)** — each capability vs. the real 2026 tool stack
 - **[Prototype source](../../research/python-prototypes/)** — the auditable Python originals
+- **[Claim status registry](../status/README.md)** — every load-bearing headline with its
+  status (implemented / measured / refuted / hypothesis / partial / reported) and evidence
+
+### Which copy is canonical
+
+`research/cognitive-substrate/` is the canonical source. Four files here are byte-identical
+copies kept for readers of `docs/`, and `node scripts/claims-status.mjs --check` fails when they
+drift (sha256):
+
+| Copy in `docs/cognitive-substrate/` | Canonical source |
+| --- | --- |
+| `cognitive_substrate_whitepaper.html` | `research/cognitive-substrate/cognitive_substrate_whitepaper.html` |
+| `cognitive_substrate_whitepaper.pdf` | `research/cognitive-substrate/cognitive_substrate_whitepaper.pdf` |
+| `evidence_map.md` | `research/cognitive-substrate/evidence/evidence_map.md` |
+| `ecosystem_map.md` | `research/cognitive-substrate/evidence/ecosystem_map.md` |
+
+Edit the canonical file, then copy it over (`node scripts/claims-status.mjs --sync-copies` does
+that). [`deliverable-package.md`](./deliverable-package.md) is not a copy: it is an adapted
+edition of `research/cognitive-substrate/EXECUTIVE_SUMMARY.md` with links rewritten for this
+folder, so it is edited by hand alongside it.
 
 **How the paper maps to what ships (all 11):** memory → `recall`/`cortex`/`ledger` ·
 learning → `cortex` + ledger oracles · imagination → `imagine [--run]`/`impact` ·
diff --git a/docs/cognitive-substrate/cognitive_substrate_whitepaper.html b/docs/cognitive-substrate/cognitive_substrate_whitepaper.html
index 95460e9b..615495dc 100644
--- a/docs/cognitive-substrate/cognitive_substrate_whitepaper.html
+++ b/docs/cognitive-substrate/cognitive_substrate_whitepaper.html
@@ -65,6 +65,7 @@
   .quran .map{font-size:.92rem; color:var(--ink); margin-top:.6em; padding-top:.6em; border-top:1px dotted #d8ccae;}
   .quran .map b{color:var(--quran);}
   .quran .grounding{font-size:.74rem; color:var(--faint); margin-top:.5em; font-family:monospace;}
+  .quran .lbl{font-family:sans-serif; font-size:.64rem; text-transform:uppercase; letter-spacing:.08em; color:var(--faint); margin:.55em 0 .1em;}
   .lit{background:var(--litbg); border:1px solid #d9e2ea; border-radius:4px; padding:6px 14px; margin:1.1em 0; font-size:.9rem;}
   .callout{border:1px solid var(--rule); border-radius:5px; padding:14px 20px; margin:1.4em 0; background:#fcfcfc;}
   .callout.key{border-left:3px solid var(--oracle); background:#f2f9f8;}
@@ -96,13 +97,13 @@ <h1>A Cognitive Substrate for Coding Agents</h1>
 </div>
 
 <div class="callout warn">
-<div class="h">Status: both prototype results in this edition were refuted &middot; corrections 2026-09-21</div>
-<p>This edition was written before any real-repository evaluation existed. A later pre-registered evaluation (<code>research/empirical-refutation/</code>) overturned both prototype claims: the impact oracle&rsquo;s recall was <b>0.022</b>, not 1.00, on 759 files in nine open-source repositories, and on 80 held-out tasks the router&rsquo;s total spend was <b>20.2% higher</b> than always using the premium tier, not 62.1% lower. An external review (2026-09-21) also found a misquoted statistic, a wrong worst-case cost, and an inconsistency between Eq.&nbsp;(1) and M2. Corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em> or <em class="corr">[refuted]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The theory sections remain the programme&rsquo;s working framework; the prototype numbers do not. The PDF edition predates these corrections.</p>
+<div class="h">Status: both prototype results in this edition were refuted &middot; corrections 2026-09-21 and 2026-09-26</div>
+<p>This edition was written before any real-repository evaluation existed. A later pre-registered evaluation (<code>research/empirical-refutation/</code>) overturned both prototype claims: the impact oracle&rsquo;s recall was <b>0.022</b>, not 1.00, on 759 files in nine open-source repositories, and on 80 held-out tasks the router&rsquo;s total spend was <b>20.2% higher</b> than always using the premium tier, not 62.1% lower. An external review (2026-09-21) also found a misquoted statistic, a wrong worst-case cost, and an inconsistency between Eq.&nbsp;(1) and M2. Corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em> or <em class="corr">[refuted]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The theory sections remain the programme&rsquo;s working framework; the prototype numbers do not. A second review (2026-09-26) found that the &ldquo;cannot learn / imagine / self&#8209;correct&rdquo; framing is broader than the missing guarantees it rests on, that the prior art for the architecture needed stating, that the Qur&rsquo;anic lens mixed source text, translation and the author&rsquo;s analogy without labels, and that the METR statistic needed its scope; those are listed in <a href="#corrections-2026-09-26">Corrections (2026-09-26)</a> and marked <em class="corr">[corrected 2026-09-26]</em>. The PDF edition predates both sets of corrections.</p>
 </div>
 
 <div class="abstract">
 <h4>Abstract</h4>
-<p>A large language model at inference time is, mathematically, a fixed function <var>y</var>&nbsp;=&nbsp;<var>f</var><span class="sub">&theta;</span>(<var>x</var>) with frozen parameters&nbsp;<var>&theta;</var> and a bounded input window. From this single fact, five apparent &ldquo;cognitive&rdquo; deficits of a coding agent follow as <em>structural consequences</em>, not incidental weaknesses: it cannot <b>remember</b> across sessions, cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>, and does not <b>know what already exists in a codebase or what an edit will affect</b>. We show that neither better prompting nor additional tools (skills, MCP servers) remove these deficits, because they leave <var>f</var><span class="sub">&theta;</span> and the open&#8209;loop pipeline intact. We then specify a <b>cognitive substrate</b>: an external architecture that keeps the LLM frozen but re&#8209;wraps its input&rarr;process&rarr;output loop into a closed, stateful cycle over persistent stores &mdash; an episodic/semantic memory, an online&#8209;updatable learning layer, a consequence simulator, a metacognitive verification gate, and a persistent structural model of the codebase &mdash; all under an explicit stewardship boundary. For each faculty we identify precisely what the existing literature solves and what residual gap remains for a coding agent. To turn the weakest&#8209;evidenced claim into something testable, we build and evaluate the <b>impact&#8209;awareness</b> faculty as a runnable prototype: a Codebase World&#8209;Model that parses a repository into a persistent dependency graph, and an Impact Oracle that predicts the <em>blast radius</em> of a proposed edit. Against mutation&#8209;derived ground truth on a ten&#8209;file package we wrote, the oracle was the only method that missed no affected file (recall&nbsp;=&nbsp;1.00 across five tested edits), where a text&#8209;search baseline missed transitive dependents and an edited&#8209;file&#8209;only baseline missed 47% of impact. On nine real repositories its recall was 0.022, and text search beat it by an order of magnitude on F1. <em class="corr">[refuted &mdash; see Corrections]</em> Throughout, a Qur'anic epistemic lens supplies the design's vocabulary of obligation &mdash; know what exists before acting (2:31&ndash;32), verify before you act (49:6), pursue not that of which you have no knowledge (17:36), and hold what you can damage as a trust (33:72).</p>
+<p>A large language model at inference time is, mathematically, a fixed function <var>y</var>&nbsp;=&nbsp;<var>f</var><span class="sub">&theta;</span>(<var>x</var>) with frozen parameters&nbsp;<var>&theta;</var> and a bounded input window. From this single fact, five apparent &ldquo;cognitive&rdquo; deficits of a coding agent follow as <em>structural consequences</em>, not incidental weaknesses: it cannot <b>remember</b> across sessions, cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>, and does not <b>know what already exists in a codebase or what an edit will affect</b>. We show that neither better prompting nor additional tools (skills, MCP servers) remove these deficits, because they leave <var>f</var><span class="sub">&theta;</span> and the open&#8209;loop pipeline intact. <em class="corr">[corrected 2026-09-26 &mdash; see Corrections]</em> We then specify a <b>cognitive substrate</b>: an external architecture that keeps the LLM frozen but re&#8209;wraps its input&rarr;process&rarr;output loop into a closed, stateful cycle over persistent stores &mdash; an episodic/semantic memory, an online&#8209;updatable learning layer, a consequence simulator, a metacognitive verification gate, and a persistent structural model of the codebase &mdash; all under an explicit stewardship boundary. For each faculty we identify precisely what the existing literature solves and what residual gap remains for a coding agent. To turn the weakest&#8209;evidenced claim into something testable, we build and evaluate the <b>impact&#8209;awareness</b> faculty as a runnable prototype: a Codebase World&#8209;Model that parses a repository into a persistent dependency graph, and an Impact Oracle that predicts the <em>blast radius</em> of a proposed edit. Against mutation&#8209;derived ground truth on a ten&#8209;file package we wrote, the oracle was the only method that missed no affected file (recall&nbsp;=&nbsp;1.00 across five tested edits), where a text&#8209;search baseline missed transitive dependents and an edited&#8209;file&#8209;only baseline missed 47% of impact. On nine real repositories its recall was 0.022, and text search beat it by an order of magnitude on F1. <em class="corr">[refuted &mdash; see Corrections]</em> Throughout, a Qur'anic epistemic lens supplies the design's vocabulary of obligation &mdash; know what exists before acting (2:31&ndash;32), verify before you act (49:6), pursue not that of which you have no knowledge (17:36), and hold what you can damage as a trust (33:72).</p>
 </div>
 
 <div class="toc">
@@ -120,6 +121,7 @@ <h4>Abstract</h4>
 <div><span class="num">12</span><a href="#limits">Limitations &amp; threats to validity</a></div>
 <div><span class="num">13</span><a href="#conclusion">Conclusion</a></div>
 <div><span class="num">&mdash;</span><a href="#corrections">Corrections (2026-09-21)</a></div>
+<div><span class="num">&mdash;</span><a href="#corrections-2026-09-26">Corrections (2026-09-26)</a></div>
 <div><span class="num">&mdash;</span><a href="#refs">References</a>, <a href="#evidence-appendix">evidence</a> &amp; <a href="#appendix">lens</a> appendices</div>
 </div>
 
@@ -155,7 +157,7 @@ <h2 id="root">2&ensp;The root cause, formally</h2>
 <thead><tr><th style="width:20%">Faculty</th><th style="width:44%">Why it is <em>structurally</em> absent</th><th>Follows from</th></tr></thead>
 <tbody>
 <tr><td><b>Memory</b> (across sessions)</td><td>By P1, nothing survives a turn but the token string; by P3, the string is bounded and lost at session end. There is no addressable store that outlives <var>x</var>.</td><td>P1, P3</td></tr>
-<tr><td><b>Learning</b> (from outcomes)</td><td>By P2, no inference&#8209;time event writes to <var>&theta;</var>. In&#8209;context &ldquo;learning&rdquo; is real optimization<sup class="cite">14,15</sup> but lives only inside the current <var>x</var> and vanishes with it (P1) &mdash; a <em>simulation</em> of learning, not learning.</td><td>P2, P1</td></tr>
+<tr><td><b>Learning</b> (from outcomes)</td><td>By P2, no inference&#8209;time event writes to <var>&theta;</var>. In&#8209;context &ldquo;learning&rdquo; is real optimization<sup class="cite">14,15</sup> but lives only inside the current <var>x</var> and vanishes with it (P1) &mdash; a <em>simulation</em> of learning, not learning. <em class="corr">[corrected 2026-09-26]</em></td><td>P2, P1</td></tr>
 <tr><td><b>Imagination</b> (simulate before acting)</td><td>Equation&nbsp;(1) maps tokens to tokens. There is no separate forward model of &ldquo;what happens to the world (or codebase) if I take action <var>a</var>&rdquo; distinct from emitting more tokens; the model cannot roll out and score a hypothetical it does not also have to narrate.</td><td>P1</td></tr>
 <tr><td><b>Self&#8209;correction</b></td><td>Any &ldquo;check&rdquo; the model runs is another evaluation of the same <var>f</var><span class="sub">&theta;</span> with the same blind spots. There is no independent verifier inside Equation&nbsp;(1); the literature confirms intrinsic self&#8209;correction is unreliable without an external signal.<sup class="cite">21</sup></td><td>P2</td></tr>
 <tr><td><b>Impact&#8209;awareness</b></td><td>By P3, the model sees only the tokens in <var>x</var>. A million&#8209;line repository does not fit; therefore it cannot know, unaided, what elsewhere depends on the symbol it is about to change.</td><td>P3</td></tr>
@@ -165,6 +167,7 @@ <h2 id="root">2&ensp;The root cause, formally</h2>
 <div class="callout warn">
 <div class="h">Why prompting and tools do not close the gap</div>
 <p>A better prompt changes <var>x</var>. More tools (skills, MCP servers, function calls) let the agent fetch new <var>x</var> or emit richer <var>y</var>. Both operate <em>inside</em> Equation&nbsp;(1) and leave P1&ndash;P3 untouched: the composed system is still a stateless map with frozen weights and a bounded window. A tool call retrieves a document into context, but nothing decides what was worth keeping, consolidates it, or updates the agent's priors for next time. The deficits are properties of the <em>loop shape</em> &mdash; open, memoryless, one&#8209;directional &mdash; not of the model's knowledge. To remove them you must change the shape of the loop, which is precisely what an external substrate can do while <var>&theta;</var> stays frozen.</p>
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> This callout overstates its case. Prompting and tools do change behaviour: examples, retrieved facts, feedback and extra computation placed in the context adapt a frozen model with no gradient update (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>). What they do not supply by themselves is four <em>guarantees</em>: durable state across independent invocations, context beyond the window, automatic parameter update from outcomes, and reliable self&#8209;verification without external evidence. The substrate is one tested way of supplying persistence and verification around the model, not the only logically possible architecture.</p>
 </div>
 
 <p>This reframing is the paper's pivot. If the deficits came from the loop shape, then the remedy is to <em>re&#8209;wrap the loop</em>: keep <var>f</var><span class="sub">&theta;</span> exactly as it is, and surround it with state and update so that the composite system is no longer memoryless, no longer open, and no longer blind beyond&nbsp;<var>W</var>. Figure&nbsp;1 states the whole thesis in one picture.</p>
@@ -246,6 +249,8 @@ <h3>4.1&ensp;What the strongest evidence confirms</h3>
 has no calibrated sense of its own uncertainty (mechanism&nbsp;M2 below), and it is why &ldquo;the model
 felt confident&rdquo; is not evidence of anything.</p>
 
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> Scope: this is one randomized trial of 16 experienced developers on 246 tasks in repositories they knew, with early&#8209;2025 tools. It is evidence about that setting, not a universal 2026 productivity coefficient in either direction. METR&rsquo;s February 2026 update (<a href="https://metr.org/blog/2026-02-24-uplift-update/">metr.org/blog/2026-02-24-uplift-update</a>) explains why selection effects complicate newer estimates.</p>
+
 <p>The trend evidence is equally well&#8209;sourced. Stack Overflow's 2025 survey of more than 49,000
 developers records trust in AI accuracy <b>falling from 40&#8239;% to 29&#8239;%</b> even as adoption rose
 to 84&#8239;%, with the top&#8209;ranked frustration &mdash; cited by <b>66&#8239;%</b> &mdash; being code
@@ -312,38 +317,51 @@ <h2 id="lens">5&ensp;The Qur'anic epistemic lens</h2>
 <div class="callout warn">
 <div class="h">How this lens is used &mdash; and how it is not</div>
 <p>The Qur'an is used here as a <b>framing lens and ethics source</b>, never as technical authority for an engineering claim. No verse is cited to prove that an algorithm works or that a data structure is correct &mdash; those claims stand on their engineering merits alone (&sect;3, &sect;8). What the lens supplies is threefold: (1) a precise <em>vocabulary of obligation</em> for what an agent that acts on real systems owes &mdash; to truthfulness, to verification, to stewardship; (2) a <em>hierarchy of knowledge</em> (&lsquo;ilm &rarr; fahm &rarr; &#7717;ikma: knowledge &rarr; understanding &rarr; wisdom) that motivates a <em>layered</em> memory architecture rather than a flat vector store; and (3) <em>ethical constraints on autonomy</em> that translate into concrete safeguards. Where a mapping is marked <em>load&#8209;bearing</em>, the concept motivates a specific design decision (e.g. a <em>mandatory</em>, not optional, verification gate); where marked <em>metaphor</em>, it is illustrative. Canonical text below is presented directly and attributed; it is not paraphrased. Arabic and translations were retrieved from quran.ai; the full 14&#8209;row mapping table is in the <a href="#appendix">appendix</a>.</p>
+<p><em class="corr">[corrected 2026-09-26]</em> <b>How to read each card.</b> Four layers are kept apart and labelled: the <em>Arabic source text</em> (clean Uthmani script; an ellipsis marks an abridgement, and the full verse is in <code>quranic-lens/quran_lens.md</code>); the <em>English translation</em> (M.A.S. Abdel Haleem); <em>tafsir</em> (classical commentary, Ibn Kathir), which these cards do not quote &mdash; the grounding line only records that it was consulted, and the companion file quotes it under its own label; and the <em>author&rsquo;s design analogy</em>, which is the author&rsquo;s engineering reading and neither a translation nor a commentary.</p>
 </div>
 
 <p>The lens earns its place because the deepest failure modes of an autonomous coding agent are not computational but <em>epistemic and ethical</em>: acting without knowing, trusting a report without checking it, and treating a granted capability as license. The Qur'anic vocabulary names these with unusual precision, and three verses in particular map so directly onto architectural decisions that they shaped the design rather than decorating it.</p>
 
 <div class="quran">
 <div class="tag">17:36 &mdash; l&#257; taqfu &middot; the root of impact&#8209;awareness &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">وَلَا تَقْفُ مَا لَيْسَ لَكَ بِهِ عِلْمٌ ۚ إِنَّ السَّمْعَ وَالْبَصَرَ وَالْفُؤَادَ كُلُّ أُولَٰئِكَ كَانَ عَنْهُ مَسْئُولًا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;Do not follow blindly what you do not know to be true: ears, eyes, and heart, you will be questioned about all these.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> Before any mutation (write, delete, refactor), a pre&#8209;action gate must establish what the agent actually knows: which entities the change affects, whether the relevant files/tests/dependents were actually read, and whether the predicted outcome rests on evidence rather than a pattern&#8209;matched guess. Actions taken without verified knowledge are <em>blocked</em>, not merely flagged. The verse's own structure &mdash; &ldquo;ears, eyes, heart&hellip; questioned about all these&rdquo; &mdash; maps to an <b>audit trail</b>: every channel the agent used (what it read, inferred, assumed) is logged so the decision can be reconstructed and questioned. This is precisely the impact oracle of &sect;8.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(17:36, en-abdel-haleem); fetch_tafsir(17:36, en-ibn-kathir)</div>
 </div>
 
 <div class="quran">
 <div class="tag">49:6 &mdash; tabayyun &middot; the verification gate &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">يَا أَيُّهَا الَّذِينَ آمَنُوا إِن جَاءَكُمْ فَاسِقٌ بِنَبَإٍ فَتَبَيَّنُوا أَن تُصِيبُوا قَوْمًا بِجَهَالَةٍ فَتُصْبِحُوا عَلَىٰ مَا فَعَلْتُمْ نَادِمِينَ</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;Believers, if a troublemaker brings you news, check it first, in case you wrong others unwittingly and later regret what you have done.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> The architecture places a verification step between <em>receiving information</em> (from context, tool output, or its own prior reasoning) and <em>acting on it</em>. The operative term <em>tabayyun</em> demands active investigation, not passive acceptance: before applying a fix based on an error report or its own diagnosis, the agent re&#8209;reads the current file state, confirms the issue still exists, and checks the fix introduces no new breakage detectable by types or tests. The gate is <em>architectural and mandatory</em> &mdash; the verse's command is categorical, not conditional on the reporter's trustworthiness &mdash; which is exactly the design lesson the self&#8209;correction literature reached empirically<sup class="cite">21</sup>: a real external check, not more self&#8209;prompting.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(49:6, en-abdel-haleem); fetch_tafsir(49:6, en-ibn-kathir)</div>
 </div>
 
 <div class="quran">
 <div class="tag">2:31&ndash;32 &mdash; ta&lsquo;l&#299;m al&#8209;asm&#257;' &middot; the world&#8209;model &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">وَعَلَّمَ آدَمَ الْأَسْمَاءَ كُلَّهَا ... قَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;He taught Adam all the names [of things]&hellip; They said, &lsquo;May You be glorified! We have knowledge only of what You have taught us.&rsquo;&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> Knowledge begins with <em>naming</em> &mdash; identifying entities and their relations. The agent must hold a structured map of what exists in the codebase (files, functions, classes, dependencies), not a flat listing: knowing that <var>A</var> calls <var>B</var>, that module <var>X</var> depends on <var>Y</var>, that test <var>T</var> covers class <var>C</var>. The angels' admission &mdash; &ldquo;we have knowledge only of what You have taught us&rdquo; &mdash; is a startlingly exact description of the LLM's own situation under P3: it knows only what is in its window. The external world&#8209;model supplies the &ldquo;names&rdquo; of entities that exceed context capacity.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(2:31-32, en-abdel-haleem)</div>
 </div>
 
 <div class="quran">
 <div class="tag">33:72 &mdash; al&#8209;am&#257;na &middot; stewardship &amp; bounded autonomy &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">إِنَّا عَرَضْنَا الْأَمَانَةَ عَلَى السَّمَاوَاتِ وَالْأَرْضِ وَالْجِبَالِ فَأَبَيْنَ أَن يَحْمِلْنَهَا ... وَحَمَلَهَا الْإِنسَانُ ۖ إِنَّهُ كَانَ ظَلُومًا جَهُولًا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;We offered the Trust to the heavens, the earth, and the mountains, yet they refused to undertake it and were afraid of it; mankind undertook it &mdash; they have always been inept and foolish.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> An agent that can modify a codebase bears an <em>am&#257;na</em> &mdash; accepted responsibility for something it can damage. The verse's structure is the design: the heavens declined the trust, recognizing its weight; the human bore it and is called <em>&#7827;al&#363;man jah&#363;l&#257;</em> (given to wrong and ignorance). So the architecture (a) operates under <b>least privilege</b> &mdash; a granted capability is never blanket permission; and (b) <em>assumes the agent will err</em> and builds in <b>reversibility</b> (sandboxing, staged commits, rollback), <b>audit</b>, and <b>scope bounds</b> as structural safeguards. The trust is not &ldquo;the agent is trustworthy&rdquo;; it is &ldquo;the agent has accepted accountability for a domain it can harm, and the architecture must respect that weight.&rdquo; This is the governance boundary enclosing the entire system in Figure&nbsp;2.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(33:72, en-abdel-haleem); fetch_tafsir(33:72, en-ibn-kathir)</div>
 </div>
@@ -352,6 +370,8 @@ <h2 id="lens">5&ensp;The Qur'anic epistemic lens</h2>
 
 <p>The remarkable thing is not that these mappings are poetic; it is that they are <em>operational</em>. &ldquo;Verify before acting&rdquo; is not a sentiment here &mdash; it is a mandatory gate in the action pipeline. &ldquo;Know the names of things&rdquo; is not a metaphor &mdash; it is a dependency graph. The lens told us <em>which</em> safeguards are non&#8209;negotiable; the engineering told us how to build them.</p>
 
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> The operational link is narrower than that sentence suggests. The lens motivates one discipline &mdash; <em>do not assert without evidence</em> &mdash; which the repository implements as a claim/status registry (<code>docs/status/claims.json</code>), verifier events and visible uncertainty. It establishes no algorithm&rsquo;s correctness, catch rate or uniqueness: every technical guarantee still needs code&#8209;level assumptions, tests or measurements, and a deterministic implementation does not make a semantic detector&rsquo;s catch rate approach 1. No theological adjudication is attempted or implied.</p>
+
 <h2 id="mechanisms">6&ensp;Six mechanisms the frozen loop also lacks</h2>
 
 <p>The five faculties of the first edition answer &ldquo;what cognitive capabilities does a stateless model
@@ -754,6 +774,7 @@ <h2 id="newvsold">11&ensp;Genuinely new vs. reinvented</h2>
 </tbody>
 </table>
 <p>In one line: <b>the components are largely borrowed; the loop shape, the validity anchoring, and the coding&#8209;agent target are the contribution.</b> That is a defensible and useful kind of novelty &mdash; it is what turns five scattered literatures into one buildable architecture.</p>
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> Prior art for the combination itself needs naming too: CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) already organises language agents into modular memory, action and decision procedures, and Reflexion<sup class="cite">18</sup> improves agents through linguistic feedback and an episodic memory buffer without weight updates. The defensible claim is <em>a portable implementation of evidence&#8209;weighted coding&#8209;agent memory and checks, with empirical evaluation of trust failure modes</em>; the &ldquo;novel&rdquo; rows above stand only where an explicit comparison with that prior art survives.</p>
 
 <h2 id="limits">12&ensp;Limitations &amp; threats to validity</h2>
 <ul>
@@ -765,7 +786,7 @@ <h2 id="limits">12&ensp;Limitations &amp; threats to validity</h2>
 </ul>
 
 <h2 id="conclusion">13&ensp;Conclusion</h2>
-<p>The faculties a coding agent seems to lack &mdash; memory, learning, imagination, self&#8209;correction, impact&#8209;awareness &mdash; are not deficiencies of knowledge that scale will cure. They are structural consequences of what a frozen transformer <em>is</em>: a stateless map with fixed weights and a bounded window (Eq.&nbsp;1, P1&ndash;P3). Because they follow from the <em>shape</em> of the loop, they cannot be prompted or tooled away; they can only be removed by re&#8209;wrapping the loop into a closed, stateful cycle over persistent stores, with the model left frozen inside it (Eq.&nbsp;2, Fig.&nbsp;1&ndash;2). We specified that substrate faculty by faculty, said honestly which parts are open research and which are engineering, and &mdash; for the one faculty that is buildable today &mdash; shipped a running impact oracle that, on a package we built, missed no affected file where the strategies a context&#8209;bounded agent actually uses missed up to half. On real repositories it missed almost everything (recall 0.022), which is the refutation&rsquo;s subject. <em class="corr">[refuted &mdash; see Corrections]</em> The Qur'anic lens gave the work its spine of obligation: <em>know what exists before you act, verify what you are told, and hold what you can damage as a trust.</em> Those are not just good engineering defaults; here they are the architecture. The next step is to build the memory and learning layers against the same discipline &mdash; anchored to what can be verified, not to what the model says of itself &mdash; and to evaluate the whole loop on real repositories with real histories.</p>
+<p>The faculties a coding agent seems to lack &mdash; memory, learning, imagination, self&#8209;correction, impact&#8209;awareness &mdash; are not deficiencies of knowledge that scale will cure. They are structural consequences of what a frozen transformer <em>is</em>: a stateless map with fixed weights and a bounded window (Eq.&nbsp;1, P1&ndash;P3). Because they follow from the <em>shape</em> of the loop, they cannot be prompted or tooled away; they can only be removed by re&#8209;wrapping the loop into a closed, stateful cycle over persistent stores, with the model left frozen inside it (Eq.&nbsp;2, Fig.&nbsp;1&ndash;2). <em class="corr">[corrected 2026-09-26 &mdash; see Corrections]</em> We specified that substrate faculty by faculty, said honestly which parts are open research and which are engineering, and &mdash; for the one faculty that is buildable today &mdash; shipped a running impact oracle that, on a package we built, missed no affected file where the strategies a context&#8209;bounded agent actually uses missed up to half. On real repositories it missed almost everything (recall 0.022), which is the refutation&rsquo;s subject. <em class="corr">[refuted &mdash; see Corrections]</em> The Qur'anic lens gave the work its spine of obligation: <em>know what exists before you act, verify what you are told, and hold what you can damage as a trust.</em> Those are not just good engineering defaults; here they are the architecture. The next step is to build the memory and learning layers against the same discipline &mdash; anchored to what can be verified, not to what the model says of itself &mdash; and to evaluate the whole loop on real repositories with real histories.</p>
 
 <hr class="sec"/>
 <h2 id="corrections">Corrections (2026-09-21)</h2>
@@ -779,6 +800,16 @@ <h2 id="corrections">Corrections (2026-09-21)</h2>
 <li><b>The faculty table (&sect;2) is unchanged here, and is now the canonical one.</b> The formal synthesis had a different &ldquo;follows from&rdquo; column in all five rows; it has been brought into line with this table, which argues each row and matches what forgekit&rsquo;s bindings address.</li>
 </ol>
 
+<hr class="sec"/>
+<h2 id="corrections-2026-09-26">Corrections (2026-09-26)</h2>
+<p>A second external deep review of the forgekit repository (2026-09-26, pinned at commit <code>d2abfa69fb77531199ffc67c5c076b524af69040</code>) asked what this edition&rsquo;s argument actually establishes. The changes are marked in place with <em class="corr">[corrected 2026-09-26]</em>; the argument itself is not rewritten, and each item quotes the wording it qualifies. The PDF edition predates these corrections as well.</p>
+<ol>
+<li><b>&ldquo;Cannot learn, imagine or self&#8209;correct&rdquo; is broader than the argument supports (abstract, &sect;2, &sect;13).</b> The edition says the model &ldquo;cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>&rdquo;, that &ldquo;neither better prompting nor additional tools (skills, MCP servers) remove these deficits&rdquo;, that in&#8209;context learning is &ldquo;a <em>simulation</em> of learning, not learning&rdquo;, and that the faculties &ldquo;cannot be prompted or tooled away&rdquo;. Frozen parameters exclude weight updates during use. They do not exclude changed behaviour from examples, retrieved facts, feedback or additional computation in the current context: GPT&#8209;3&rsquo;s few&#8209;shot evaluation measured exactly that adaptation through text, with no gradient updates (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020, &ldquo;Language Models are Few-Shot Learners&rdquo;, arXiv:2005.14165</a>). What a bare frozen model lacks is four <em>guarantees</em>: no built&#8209;in durable state across independent invocations; a bounded context; no automatic parameter update from outcomes; and unreliable self&#8209;verification without external evidence<sup class="cite">21</sup>. The substrate is one tested way of supplying persistence and verification around the model, not the only logically possible architecture.</li>
+<li><b>Prior art and what is (and is not) claimed (&sect;11).</b> External memory, feedback&#8209;driven improvement and structured agent control have clear prior art. CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) organises language agents into modular memory, action and decision procedures; Reflexion<sup class="cite">18</sup> (Shinn et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2303.11366">arXiv:2303.11366</a>) improves agents with linguistic feedback and an episodic memory buffer and no weight updates. The defensible framing is <em>a portable implementation of evidence&#8209;weighted coding&#8209;agent memory and checks, with empirical evaluation of trust failure modes</em>. The &ldquo;novel composition&rdquo; and &ldquo;novel framing&rdquo; rows of &sect;11 are claims about this combination for coding agents, kept only where an explicit comparison with that prior art survives, and the five faculties are a decomposition, not a proof that these five are necessary.</li>
+<li><b>The Qur&rsquo;anic lens: text, translation, commentary and analogy are now labelled (&sect;5, lens appendix).</b> Each verse card now labels the Arabic source text, the English translation and the author&rsquo;s design analogy separately, and a legend says where tafsir appears. The appendix column headed &ldquo;Retrieved gloss&rdquo; mixed retrieved translation (verse rows) with the author&rsquo;s own glosses (concept rows), and its &ldquo;Design principle&rdquo; column is now headed as the author&rsquo;s analogy. No Arabic text or translation was altered. The lens motivates the discipline <em>do not assert without evidence</em>, which the repository implements as a claim/status registry, verifier events and visible uncertainty; it establishes no algorithm&rsquo;s correctness, catch rate or uniqueness, and a deterministic implementation does not imply that a semantic detector&rsquo;s catch rate approaches 1. No theological adjudication is attempted.</li>
+<li><b>METR&rsquo;s 19% slowdown is scoped (&sect;4.1, evidence appendix C1).</b> The edition calls it &ldquo;the empirical heart of this paper&rdquo;. It is a randomized trial of 16 experienced open&#8209;source developers on 246 tasks in repositories they knew, with early&#8209;2025 tools: evidence about that setting, not a universal 2026 productivity coefficient in either direction. METR&rsquo;s February 2026 update (<a href="https://metr.org/blog/2026-02-24-uplift-update/">metr.org/blog/2026-02-24-uplift-update</a>) explains why selection effects complicate newer estimates; it is not evidence that AI now speeds developers up. The evidence map (<code>evidence/evidence_map.md</code>) now grades bibliographic verification, claim support, study design, independent replication and transfer scope separately.</li>
+</ol>
+
 <hr class="sec"/>
 <h2 id="refs">References</h2>
 <ol class="refs">
@@ -826,7 +857,7 @@ <h2 id="evidence-appendix">Appendix&ensp;Evidence map &mdash; the twelve statist
 <tr class="h"><td>ID</td><td>Claim</td><td>Primary source</td><td>Supports</td><td>Status</td></tr>
 <tr>
 <td style="white-space:nowrap"><b>C1</b></td>
-<td>Experienced open-source developers were 19% SLOWER with AI while believing they were ~20% faster (also forecast 24% speedup beforehand).</td>
+<td>Experienced open-source developers were 19% SLOWER with AI while believing they were ~20% faster (also forecast 24% speedup beforehand). <em class="corr">[corrected 2026-09-26]</em> Scope: 16 developers, 246 tasks, early-2025 tools; not a universal coefficient (see Corrections).</td>
 <td style="font-size:0.85em"><a href="https://arxiv.org/abs/2507.09089">Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity</a></td>
 <td style="font-size:0.85em">M2 (assumption/uncertainty - miscalibration), P3/self-correc</td>
 <td style="white-space:nowrap;color:#4E9A6B;font-weight:600">confirmed</td>
@@ -999,9 +1030,9 @@ <h2 id="ecosystem-appendix">Appendix&ensp;Ecosystem map &mdash; faculties &amp;
 </table>
 
 <h2 id="appendix">Appendix&ensp;Qur'anic&#8209;lens mapping table</h2>
-<p style="font-size:.92rem;color:var(--mute)">The complete 14&#8209;row mapping (12 load&#8209;bearing, 2 metaphor). Canonical Arabic and translations retrieved from quran.ai; full text, tafsir references, and design principles in the companion artifact <code>quran_lens.json</code>. Caveat: this table is a design lens, not technical or theological authority &mdash; see &sect;5.</p>
+<p style="font-size:.92rem;color:var(--mute)">The complete 14&#8209;row mapping (12 load&#8209;bearing, 2 metaphor). Canonical Arabic and translations retrieved from quran.ai; full text, tafsir references, and design principles in the companion artifact <code>quran_lens.json</code>. Caveat: this table is a design lens, not technical or theological authority &mdash; see &sect;5. <em class="corr">[corrected 2026-09-26]</em> The second column holds the retrieved translation for verse rows and the author&rsquo;s own gloss for concept rows (it was headed &ldquo;Retrieved gloss&rdquo;); the fourth column is the author&rsquo;s design analogy.</p>
 <table>
-<thead><tr><th style="width:22%">Concept / verse</th><th style="width:30%">Retrieved gloss</th><th style="width:16%">Faculty</th><th style="width:22%">Design principle (abbrev.)</th><th style="width:10%">Type</th></tr></thead>
+<thead><tr><th style="width:22%">Concept / verse</th><th style="width:30%">Translation (verses) / author&rsquo;s gloss (concepts)</th><th style="width:16%">Faculty</th><th style="width:22%">Author&rsquo;s design analogy (abbrev.)</th><th style="width:10%">Type</th></tr></thead>
 <tbody>
 <tr><td><b>17:36 — lā taqfu (do not pursue without knowledge)</b></td><td>Do not follow blindly what you do not know to be true: ears, eyes, and heart, you will be questioned about all these.</td><td>IMPACT-AWARENESS</td><td>Before any code mutation (file write, delete, refactor), the agent must run a pre-action verification gate that checks: (1) what entities in the codebase wil…</td><td style="color:#0d5c56;font-weight:600">load-bearing</td></tr>
 <tr><td><b>49:6 — tabayyun (verify reports before acting)</b></td><td>Believers, if a troublemaker brings you news, check it first, in case you wrong others unwittingly and later regret what you have done,</td><td>SELF-CORRECTION</td><td>The agent architecture must include a verification gate between receiving information (from context, tool output, or its own prior reasoning) and acting on it</td><td style="color:#0d5c56;font-weight:600">load-bearing</td></tr>
diff --git a/docs/cognitive-substrate/deliverable-package.md b/docs/cognitive-substrate/deliverable-package.md
index a8b67869..dbef96f7 100644
--- a/docs/cognitive-substrate/deliverable-package.md
+++ b/docs/cognitive-substrate/deliverable-package.md
@@ -8,7 +8,7 @@
 > | Claim below                                     | Measured on real data                                                                                                            |
 > | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
 > | Impact oracle recall **1.00**                   | **0.022** (9 OSS repos; 801 labelled files, 759 evaluated); `grep` beats it ~10× on F1                                          |
-> | Router/gate F1 **1.00**, cost saving **+62.1%** | F1 **0.37**; cost saving **−20.2%** (routing costs _more_ than always-premium; per judged-correct output $1.06 vs $1.76, from only 6 and 3 correct outputs of 64) |
+> | Router/gate F1 **1.00**, cost saving **+62.1%** | F1 **0.37**; cost saving **−20.2%** (routing costs _more_ than always-premium; per judge-accepted output $1.06 vs $1.76, from only 6 and 3 judge-accepted outputs of 64; the judge is a model, not executed tests) |
 >
 > The theory remains forgekit's working framework; the _numbers_ here do not. This banner was
 > added on 2026-09-21 after an external review; the white paper's HTML edition marks each refuted
@@ -22,6 +22,17 @@
 
 **One-line thesis:** The faculties a coding agent lacks — memory, learning, imagination, self-correction, impact-awareness — are not gaps in the model's _knowledge_ but structural consequences of what a frozen transformer _is_: a system with fixed weights and a bounded context window that keeps no state between calls (formally, a stateless map `y = f_θ(x)`). They cannot be prompted or tooled away; they can only be supplied by **re-wrapping the input→process→output loop** into a closed, stateful cycle around the frozen model.
 
+> *Corrected 2026-09-26:* the thesis above is broader than its argument. Frozen weights rule out
+> weight updates during use, not all adaptation: examples, retrieved facts and feedback in the
+> context change behaviour with no gradient step (Brown et al., 2020,
+> [arXiv:2005.14165](https://arxiv.org/abs/2005.14165)). What a bare model lacks is a set of
+> guarantees — no durable state across independent invocations, a bounded context, no automatic
+> parameter update, and unreliable self-verification without external evidence — and the substrate
+> is one tested way of supplying persistence and verification, not the only possible architecture.
+> Prior art for the broad architecture includes CoALA ([arXiv:2309.02427](https://arxiv.org/abs/2309.02427))
+> and Reflexion ([arXiv:2303.11366](https://arxiv.org/abs/2303.11366)); see the white paper's
+> Corrections (2026-09-26).
+
 **What v2 adds.** The first edition argued the five faculties from first principles and prototyped the one that is buildable today. This edition (1) **grounds the argument in the field's own evidence** — twelve load-bearing pain-point statistics independently re-grounded from primary sources and graded _confirmed / vendor-reported / unverifiable_; (2) adds **six metacognitive mechanisms** the frozen loop also lacks (routing, assumption gate, decomposition, goal-anchoring, anti-over-engineering, inline verification); (3) **maps all eleven capabilities against the real 2026 Claude-Code stack**, marking each solved / partial / residual-gap so we say clearly _what not to build_; and (4) ships a **second runnable prototype** — a complexity-aware router + assumption gate, evaluated live on real models.
 
 > **Governing discipline (the user's, adopted throughout):** _AI output is mathematically-calculated probability — non-deterministic, and never blindly trusted._ Every claim in this package is graded by how well it is sourced; every prototype decision is a transparent, attributable rule rather than another opaque model call; and trust is always earned by an **external** check, never asserted by the model.
diff --git a/docs/cognitive-substrate/evidence_map.md b/docs/cognitive-substrate/evidence_map.md
index 901e58d8..76287f5d 100644
--- a/docs/cognitive-substrate/evidence_map.md
+++ b/docs/cognitive-substrate/evidence_map.md
@@ -19,6 +19,39 @@
 | 11 | A standard MCP setup (few servers) can consume ~72% of a 200K-token context window before ... | (b) Qiyao Sun et al. (2025) | ⚠️ vendor-only | See note |
 | 12 | LLM evaluators recognize and favor their own generations - self-preference bias correlates... | Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Main Conference Track (Oral) (2024) | ✅ confirmed | See note |
 
+## Five kinds of grade, kept separate (added 2026-09-26)
+
+The `Status` column above records mainly **bibliographic verification** and source independence:
+whether a number can be traced to a primary source, and whether the party behind it has a stake. It
+is not a grade of whether the source supports the claim as used, of its design, of replication, or of
+how far the result travels, so "confirmed" does not mean "generalizes". The table below grades those
+dimensions separately, using only what each entry in this map already records.
+
+| Dimension | Question it answers |
+|---|---|
+| Bibliographic verification | Does the cited source exist, is it correctly attributed, and does it contain the number? |
+| Claim support | Does the source support the claim *as this paper uses it* (population, measure, direction)? |
+| Study design | Randomized trial, observational study, survey, vendor telemetry, benchmark audit? |
+| Independent replication | Has anyone other than the originator reproduced it? |
+| Transfer scope | Which population, date, tooling and setting can the result be carried to? |
+
+| Claim | Bibliographic verification | Claim support | Study design | Independent replication | Transfer scope |
+|---|---|---|---|---|---|
+| C1 METR slowdown | confirmed (arXiv:2507.09089; METR site) | supports 19% slower for its own population; does not support a universal or 2026 coefficient in either direction | randomized controlled trial: 16 experienced developers, 246 tasks | none recorded here; METR's own 2026-02-24 update is by the same group and METR calls it weak evidence because of selection effects | experienced developers on mature repositories they knew, early-2025 tools |
+| C2 Stack Overflow trust | confirmed (official survey site and blog) | supports the trust and favourability figures as survey responses | self-reported survey, 49,000+ respondents; self-selection noted by Stack Overflow | none recorded here | Stack Overflow survey respondents, 2025 |
+| C3 Veracode vulnerabilities | 45% confirmed in the vendor report; '2.74x' not found in Veracode's materials | supports 45% only; '2.74x' is unsupported (conflated with a separate study) | vendor benchmark of LLM-generated code samples | none recorded here | the LLMs, languages and prompts Veracode tested in 2025 |
+| C4 GitClear duplication | vendor report found; internally inconsistent (title 4x, body 8x) | partial: the direction is supported, the multiplier is not settled | vendor code-analytics telemetry, correlational | none independent (press summaries re-report the same dataset) | GitClear's analysed repositories, 2020-2024 |
+| C5 DORA amplifier | confirmed (official DORA report) | supports the 'amplifier' framing and the survey figures | survey of ~5,000 professionals plus interviews; published methodology | none recorded here | DORA survey respondents, 2025 |
+| C6 SWE-bench Verified audit | confirmed (OpenAI blog) | supports flawed tests in at least 59.4% of a 138-problem audited hard subset, not of all 500 tasks; the 80.9%/45.9% pairing is a third-party leaderboard snapshot | vendor audit of a benchmark subset, plus contamination probes | none recorded here | SWE-bench Verified's audited hard subset and the frontier models OpenAI probed |
+| C7 Faros PR review | confirmed in the vendor report | supports the reported deltas as vendor telemetry | cross-sectional vendor telemetry (22,000 developers), not a controlled study | none recorded here | Faros AI's customer organisations |
+| C8 comprehension (conflated) | unverifiable as attributed (two studies conflated) | not supported: the 400,000-session study does not measure comprehension | not assessed (primary number not retrieved) | not assessed | not assessed |
+| C9 Sonar verification gap | confirmed in the vendor survey | supports the 96% / 48% figures as survey responses | vendor survey, 1,100+ developers | none recorded here | Sonar survey respondents, January 2026 |
+| C10 JetBrains manual correction | not found in JetBrains' materials | not supported | not assessed | not assessed | not assessed |
+| C11 MCP context bloat | 43%/14% traceable to RAG-MCP (arXiv:2505.03275); 72% has no formal source | not supported as framed: 43% vs 14% is a method-vs-baseline stress test, not an accumulation curve | synthetic stress test in a preprint, plus blog anecdotes | none recorded here | that stress test's setup |
+| C12 self-preference bias | confirmed (NeurIPS 2024 proceedings) | supports the qualitative self-preference finding | controlled evaluation experiments, peer-reviewed | none recorded here | the evaluator models studied (GPT-4, Llama 2) |
+
+The same grades are in `evidence_map.json` under each record's `grades` field.
+
 ## Detailed Findings
 
 ### 1. C1_METR_slowdown: ✅ confirmed
@@ -35,6 +68,8 @@
 
 **Note:** Directly reachable on arXiv and METR's own site; numbers match field report exactly. Caveat directly stated by METR: small sample (16 devs), specific to mature/familiar open-source repos, and AI-averse developers increasingly decline to participate (self-selection risk noted by METR itself).
 
+**Correction (2026-09-26):** scope this wherever C1 appears. It is a study of 16 experienced developers on 246 tasks with early-2025 tooling, not a universal 2026 productivity coefficient in either direction. METR's [February 2026 update](https://metr.org/blog/2026-02-24-uplift-update/) explains why selection effects complicate newer estimates; it is not evidence that AI now speeds developers up either. (This scoping was recommended in `research/formal-synthesis/audits/our_evidence_corrections.json` and had not been applied here.)
+
 ### 2. C2_SO2025_trust: ✅ confirmed
 
 **Claim:** Trust in AI accuracy fell from 40% to 29% (or 46% actively distrust vs 33% trust per detailed breakdown); favorability 72%->60%; 66% say AI answers are 'almost right, but not quite'; 45% say debugging AI code is more time-consuming.
@@ -193,7 +228,7 @@
 
 
 **Safe to lean on without hedging (peer-reviewed / official primary source, methodology transparent):**
-- METR's 19%-slowdown RCT (C1) — the single best-controlled empirical finding in the set; cite with its own caveats (n=16, mature-repo setting).
+- METR's 19%-slowdown RCT (C1) — the single best-controlled empirical finding in the set; cite with its own caveats (n=16, mature-repo setting, early-2025 tools; not a universal 2026 coefficient — see the 2026-09-26 correction under C1).
 - Panickssery et al. NeurIPS 2024 self-preference bias (C12) — the only genuinely peer-reviewed academic paper among the twelve; strongest citation for the M6 argument that an LLM cannot be its sole verifier.
 - OpenAI's own retirement of SWE-bench Verified and the 59.4%-of-audited-problems figure (C6) — directly stated on OpenAI's blog. The specific 80.9%/45.9% score pairing, however, should be cited as a third-party leaderboard snapshot (Scale AI SEAL/BenchLM), not as OpenAI's own number, since it will drift release-to-release.
 - DORA 2025 "AI is an amplifier" finding (C5) — large, transparent, non-vendor-captured methodology (Google Cloud + independent research partners), the most credible of the survey-based claims.
diff --git a/docs/legacy/RECONCILE.md b/docs/legacy/RECONCILE.md
index dfc8dfc6..9770c24c 100644
--- a/docs/legacy/RECONCILE.md
+++ b/docs/legacy/RECONCILE.md
@@ -9,7 +9,7 @@ Read from your actual machine on 2026-07-04. Honest feedback, then what changed.
 
 ## 🔴 Fix now
 
-**1. Exposed GitHub token.** `~/.claude/settings.json` → `mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN` holds a `github_pat_…` in plaintext (file is mode 600, but any process running as you can read it, and it's one accidental screenshot/commit from leaking). Action: revoke it at github.com/settings/tokens, issue a new fine-scoped one, and reference it as `"${GITHUB_PAT}"` from your shell env instead of pasting the literal. Do the same review for the `hostlelo_ops_ed25519` path baked into an allow-rule.
+**1. Exposed GitHub token.** `~/.claude/settings.json` → `mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN` holds a `github_pat_…` in plaintext (file is mode 600, but any process running as you can read it, and it's one accidental screenshot/commit from leaking). Action: revoke it at github.com/settings/tokens, issue a new fine-scoped one, and reference it as `"${GITHUB_PAT}"` from your shell env instead of pasting the literal. Do the same review for the SSH private-key path (`<ops SSH key>`) baked into an allow-rule. _(Machine-specific key filename redacted 2026-09-26; the rest of this archived note is unchanged.)_
 
 **2. You're paying max rate for everything.** `"model": "opus[1m]"` + `"effortLevel": "high"` = the most expensive setup that exists, on every turn, in every project. You explicitly want low cost. Recommendation: default `"model": "sonnet"`, keep `effortLevel` at `"high"` only if you feel the quality drop, and switch to Opus per-session (`/model`) for genuinely hard work. Opus's 1M window also means huge prefixes → bigger cache-write bills. This one change is your biggest cost lever.
 
diff --git a/docs/legacy/patch-settings.js b/docs/legacy/patch-settings.js
index 0717ad53..de7d40cd 100644
--- a/docs/legacy/patch-settings.js
+++ b/docs/legacy/patch-settings.js
@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+// ARCHIVED — pre-Forge, not maintained, not part of the current CLI (kept for history only).
+// It edits an older hand-rolled ~/.claude setup; for the current workflow see ONBOARDING.md
+// and docs/GUIDE.md. Do not run it against a current install.
+//
 // Safe, reversible edits to ~/.claude/settings.json:
 //  - model -> sonnet (was opus[1m]); use Opus per-session for hard work
 //  - add statusLine + PreToolUse/PostToolUse hooks (keeps existing Stop hook)
diff --git a/docs/plans/substrate-v2/00-overview.md b/docs/plans/substrate-v2/00-overview.md
index 4853fda7..4ae289ee 100644
--- a/docs/plans/substrate-v2/00-overview.md
+++ b/docs/plans/substrate-v2/00-overview.md
@@ -1,10 +1,18 @@
 # Substrate v2 — completing the whitepaper, and the Proof-Carrying Memory protocol
 
-> Status: **shipped — all phases P0–P8 landed in v0.5.0** · Owner: forgekit core · Companion to
+> Status: **P0–P3 and P5–P7 shipped (v0.5.0); P4 context assembly and P8 evaluation are
+> partial** (see the phase table) · Owner: forgekit core · Companion to
 > [docs/cognitive-substrate/](../../cognitive-substrate/) (the paper this plan completes).
-> What remains (deferred, tracked in [ROADMAP.md](../../../ROADMAP.md)): the ledger
-> read-path flip (legacy stores still serve reads), the optional embeddings tier
-> (ADR-0005), and a Playwright-driven browser loop for the UI gate.
+> Per-claim status lives in [docs/status/claims.json](../../status/claims.json).
+>
+> _Corrected 2026-09-26._ This block said "shipped — all phases P0–P8 landed in v0.5.0" and listed
+> as deferred "the ledger read-path flip (legacy stores still serve reads), the optional embeddings
+> tier (ADR-0005), and a Playwright-driven browser loop for the UI gate". All three have since
+> shipped: reads are a merged legacy ∪ ledger view (`src/ledger_read.js`) and the write default is
+> ledger-only (`FORGE_LEDGER_ONLY`, on by default); the optional embeddings tier is `src/embed.js`
+> (`FORGE_EMBED`); the browser loop is `forge uicheck visual` and `forge uicheck interact`. What
+> remains is deleting the dormant legacy read/write code ([ROADMAP.md](../../../ROADMAP.md)) and
+> the two partial phases below.
 
 ForgeKit v0.4 implements roughly half of the committed whitepaper — the two prototyped
 mechanisms (M1 routing, M2 assumption gate), an approximate impact atlas, and an advisory
@@ -38,7 +46,7 @@ the storage, trust, and wire protocol for the whole substrate.
 | Imagination (faculty, §3)                               | atlas traversal only — no dry-run of consequences                       | test selection + sandbox                                     | [06](./06-faculties-and-mechanisms.md) §2                                |
 | M3/M4/M5/M6 (decomposition, drift, lean, inline verify) | `scope.js`/`anchor.js`/`lean.js`/`verify.js` heuristics                 | each gets its algorithm                                      | [06](./06-faculties-and-mechanisms.md) §3–§6                             |
 | Generated-UI quality (owner pain; M5-shaped)            | `src/uicheck.js` WCAG contrast only; taste is prose                     | anti-template gate                                           | [07](./07-ui-quality-gate.md)                                            |
-| Cost to ~90 % (owner target)                            | routing alone: 62 % on a tuned demo, refuted (−20.2 % held out)         | cache + context + gate stages unmeasured                     | [05](./05-cost-model.md)                                                 |
+| Cost: ~90 % owner target (a hypothesis)                 | routing alone: 62 % on a tuned demo, refuted (−20.2 % held out)         | end-to-end cost unmeasured; stage arithmetic withdrawn       | [05](./05-cost-model.md)                                                 |
 | ForgeKit's own UX                                       | CLI only                                                                | `forge dash` dashboard                                       | [08](./08-dashboard-ux.md)                                               |
 
 ## 2. The 11-capability master table
@@ -50,7 +58,7 @@ structure this plan assigns it. Nothing is left as prose-only discipline.
 | --- | -------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- |
 | 1   | Memory (faculty)           | PCM claim ledger; Eq. 3 retrieval; ʿilm→fahm→ḥikma layers                                                | Content-addressed (Merkle-keyed) claim store; Beta(α,β) posterior with exponential decay; MinHash sketches; consolidation = union-find clustering over Jaccard ≥ τ, promoting episodes → patterns → decision rules | [01](./01-pcm-protocol.md)                                                       |
 | 2   | Learning (faculty)         | Outcome write-back band (Eq. 2): oracle results update the `val` of every claim that informed the action | Bayesian evidence update; rubric-weight calibration by logistic regression over outcome claims (the paper's own "learn the rubric weights" note, §9.3)                                                             | [01](./01-pcm-protocol.md) §6                                                    |
-| 3   | Imagination (faculty)      | Consequence simulator `g` (paper Eq. 4): blast radius → impacted-test selection → sandboxed dry-run      | Reverse-dependency traversal with hop-decay; test selection as bipartite set cover (greedy ln n-approx); dry-run result becomes evidence on the prediction claim                                                   | [06](./06-faculties-and-mechanisms.md) §2                                        |
+| 3   | Imagination (faculty)      | Consequence simulator `g` (paper Eq. 4): blast radius → impacted-test selection → dry-run in an isolated git checkout (detached-HEAD worktree; not a security sandbox) | Reverse-dependency traversal with hop-decay; test selection as bipartite set cover (greedy ln n-approx); dry-run result becomes evidence on the prediction claim                                                   | [06](./06-faculties-and-mechanisms.md) §2                                        |
 | 4   | Self-correction (faculty)  | External-oracle cascade, never self-prompting (paper §3 honest negative, C12)                            | Cost-ordered oracle chain (types → impacted tests → independent reviewer); verdict requires ≥ 2 signals external to fθ                                                                                             | [06](./06-faculties-and-mechanisms.md) §4                                        |
 | 5   | Impact-awareness (faculty) | Atlas hardened; pre-edit gate becomes **mandatory** (hook-enforced)                                      | Incremental dep graph keyed by file content hash; reverse-edge index → O(deg) "who depends on X"                                                                                                                   | [06](./06-faculties-and-mechanisms.md) §1                                        |
 | 6   | M1 routing                 | Shipped; add auditable per-task rubric surface + outcome-calibrated weights                              | Additive transparent rubric; escalation only on verified failure; online weight calibration from ledger                                                                                                            | [06](./06-faculties-and-mechanisms.md) §7                                        |
@@ -63,9 +71,11 @@ structure this plan assigns it. Nothing is left as prose-only discipline.
 ## 3. Phase roadmap
 
 Phases are dependency-ordered; each has an acceptance gate. P1 is the keystone — every
-later phase stores its state as PCM claims. **All phases have shipped** (v0.5.0):
+later phase stores its state as PCM claims. P0–P3 and P5–P7 have shipped (v0.5.0); **P4 and P8
+are partial** — their acceptance criteria are not met (reasons in the table). _(Corrected
+2026-09-26: this said "**All phases have shipped** (v0.5.0)", and every node below was green.)_
 
-All nodes below are shipped (green); the color is the legend.
+Green nodes are shipped; amber nodes are partial.
 
 ```mermaid
 %%{init: {'theme':'base','themeVariables':{'primaryColor':'#201a15','primaryTextColor':'#f2ede7','primaryBorderColor':'#372c22','lineColor':'#f26430','secondaryColor':'#272019','tertiaryColor':'#171310','edgeLabelBackground':'#201a15','clusterBkg':'#171310','clusterBorder':'#4a3b2e','fontFamily':'ui-sans-serif, system-ui, sans-serif','fontSize':'14px'},'flowchart':{'curve':'basis','padding':10,'nodeSpacing':36,'rankSpacing':44}}}%%
@@ -82,7 +92,9 @@ flowchart LR
     P3 --> P8["P8 evaluation"]
     P5 --> P8
     classDef done fill:#1f3d2b,stroke:#67e8a5,color:#f2ede7;
-    class P0,P1,P2,P3,P4,P5,P6,P7,P8 done;
+    classDef partial fill:#3d321c,stroke:#e8b64a,color:#f2ede7;
+    class P0,P1,P2,P3,P5,P6,P7 done;
+    class P4,P8 partial;
 ```
 
 | Phase                      | Delivers                                                                                                                                                                              | Depends on                 | Acceptance                                                                                                           |
@@ -91,19 +103,21 @@ flowchart LR
 | **P1 Ledger core** ✅      | `src/ledger.js` (claim store, canonical hashing, Beta confidence, Eq. 3 retrieval, decay/prune); migrate `src/lessons.js` + `src/lessons_store.js` + `src/recall.js` onto claim kinds | P0                         | All existing cortex/recall tests green on the new store; property tests: id stability, decay monotonicity            |
 | **P2 Team sync** ✅        | `.forge/ledger/` git layout, union-merge driver, `forge ledger merge\|verify\|blame`                                                                                                  | P1                         | Three-way merge fuzz: any interleaving of two ledgers converges byte-identically (semilattice test)                  |
 | **P3 Reuse cache** ✅      | `forge reuse` — fingerprint, exact/near lookup, atlas revalidation, eviction                                                                                                          | P1                         | Cache hit returns artifact + evidence; stale-interface artifact refused; hit/miss metrics emitted                    |
-| **P4 Context assembly** ✅ | `forge context` — candidate scoring, knapsack selection, required-set completeness gate; wired into `src/substrate.js` + hooks                                                        | P1                         | Gate emits computed missing-set on incomplete context; token budget never exceeded                                   |
+| **P4 Context assembly** ◐ partial | `forge context` — candidate scoring, heuristic selection by value density, required-set completeness gate; wired into the explicit `src/substrate.js` gate (the ambient per-prompt hook does not assemble context) | P1                         | Gate emits computed missing-set on incomplete context; token budget never exceeded. **Partial:** at v1.4.3 an over-budget assembly and a pointer-only "read this file" were both reported complete (review F02/F03); the repair reports overflow and pending reads instead, budgets use a chars/3.6 _estimate_, and `ok` means syntactically delivered, not semantically sufficient ([04 §7](./04-context-assembly.md#7-status-2026-09-26--partial)) |
 | **P5 Loop closure** ✅     | Outcome write-back band; doom-loop diagnosis + escalation; imagination dry-run; M3/M4/M5/M6 extensions                                                                                | P1, P4                     | Revert/test outcomes visibly move `val` of informing claims; repeated failure signature halts with a diagnosis claim |
 | **P6 UI quality gate** ✅  | `forge uicheck` v2: design fingerprints, slop distance, scale conformance; machine-readable taste constraints                                                                         | P1                         | Known-template fixture flagged; project-conformant fixture passes; zero LLM calls in the gate                        |
 | **P7 Dashboard** ✅        | `forge dash` — local server + self-contained HTML over `.forge/` stores                                                                                                               | P1–P6 (reads their stores) | Renders ledger, cost meter, cache rate, blast radius offline                                                         |
-| **P8 Evaluation** ✅       | Extend `src/eval.js`: cost-stage measurement, cache-hit-rate harness, honest report                                                                                                   | P3–P5                      | A measured (not asserted) end-to-end cost figure per stage, published in reports/                                    |
+| **P8 Evaluation** ◐ partial | Extend `src/eval.js`: cost-stage measurement, cache-hit-rate harness, honest report                                                                                                   | P3–P5                      | A measured (not asserted) end-to-end cost figure per stage, published in reports/. **Partial:** stage metrics and `forge cost --stages` exist, but no paired end-to-end cost has been measured — [reports/cost-eval.md](../../../reports/cost-eval.md) holds no data ([05 §4](./05-cost-model.md#4-measurement-plan-p8--status-partial)) |
 
 ## 4. Honesty register (the paper's own discipline, applied to this plan)
 
 - **Measured, then refuted:** the 62 % routing saving (paper §9, live tokens) was measured on
   the 30 tasks its thresholds were tuned on; on 80 held-out tasks routing cost 20.2 % more than
   always-premium ([research/empirical-refutation/](../../../research/empirical-refutation/)).
-  The atlas recall/precision method (paper §8) is a 6-case self-labelled benchmark. Everything else in [05-cost-model.md](./05-cost-model.md) is a **target** until
-  P8 measures it — the ~90 % figure is a composition argument, not a result.
+  The atlas recall/precision method (paper §8) is a 6-case self-labelled benchmark. Every factor in [05-cost-model.md](./05-cost-model.md) — routing included — is a
+  **hypothesis** until P8 measures it, and the ~90 % figure is a target, never a result. _(Corrected
+  2026-09-26: this said "the ~90 % figure is a composition argument, not a result"; that argument's
+  scenario table rested on the refuted routing factor and was withdrawn, 05 §2.)_
 - **Solved-elsewhere, not rebuilt:** subagent orchestration (M3's mechanics), model
   gateways (M1's plumbing) — per paper §10 "do not rebuild".
 - **Research-edge, shipped as advisory first:** consolidation quality (ʿilm→fahm promotion),
diff --git a/docs/plans/substrate-v2/04-context-assembly.md b/docs/plans/substrate-v2/04-context-assembly.md
index a0a6fadd..6a8f7e3f 100644
--- a/docs/plans/substrate-v2/04-context-assembly.md
+++ b/docs/plans/substrate-v2/04-context-assembly.md
@@ -4,6 +4,12 @@
 > a budgeted optimization, and *whether the context is sufficient* becomes a computed
 > set, not a feeling. Supplies the paper's P3 remedy at the system level and gives M2's
 > questions a derivation. Phase P4, wired into `src/substrate.js`.
+>
+> **Status: partial (corrected 2026-09-26).** Several statements below describe the design, not
+> what ships: token costs are an estimate, selection is a heuristic with no approximation
+> guarantee, `contracts(S)` is not computed, and the ambient hook does not inject an assembled
+> selection. [§7](#7-status-2026-09-26--partial) states the implemented contract, including what
+> `ok` does and does not mean.
 
 ## 0. The two failures this kills
 
@@ -30,9 +36,10 @@ candidates `I`:
 | files | source spans for `S` and its direct callers; relevant test files |
 | summaries | `summary` claims covering cold ranges (below) |
 
-Each item `i` carries: token cost `tᵢ` (measured, not guessed — `str.length/3.6`
-heuristic calibrated in P8), score `sᵢ`, and a **coverage set** `cov(i)` — which required
-entities it satisfies.
+Each item `i` carries: token cost `tᵢ`, score `sᵢ`, and a **coverage set** `cov(i)` — which
+required entities it satisfies. _(Corrected 2026-09-26: `tᵢ` was described as "measured, not
+guessed — `str.length/3.6` heuristic calibrated in P8". It is an **estimate**: characters ÷ 3.6 of
+the rendered text, never calibrated, and no per-model tokenizer is used — see §7.)_
 
 ## 2. Selection — a budgeted knapsack
 
@@ -45,9 +52,13 @@ subject to Σ tᵢ·xᵢ ≤ B,   xᵢ ∈ {0,1}
 ```
 
 `sᵢ` = Eq. 3 score ([01](./01-pcm-protocol.md) §4) × source prior (atlas slice and
-required files outrank nice-to-have lessons). Solved greedily by density `sᵢ/tᵢ` with the
-best-single-item fallback — the classic ½-approximation to 0/1 knapsack; optimality is
+required files outrank nice-to-have lessons). Solved greedily by density `sᵢ/tᵢ`; optimality is
 not the point, *having an objective* is. Deterministic, O(n log n), zero model calls.
+_(Corrected 2026-09-26: this claimed "the best-single-item fallback — the classic
+½-approximation to 0/1 knapsack". What ships is a greedy **heuristic**: required items are pinned
+first, and the per-source discount below changes item values as the fill proceeds, which breaks the
+preconditions of the knapsack and set-cover approximation results, so no approximation guarantee is
+claimed.)_
 
 Two refinements:
 
@@ -69,7 +80,7 @@ Define the **required-knowledge set** for an edit — computed, not vibes:
 R(edit) = defs(S)                      // the symbols being changed
         ∪ blast₁(S)                    // direct dependents (atlas reverse edges, hop 1)
         ∪ tests(S)                     // tests covering S (atlas contains/test edges)
-        ∪ contracts(S)                 // types/interfaces S implements
+        ∪ contracts(S)                 // types/interfaces S implements — not computed yet (§7)
         ∪ lessons*(S)                  // scope-matching lessons with val ≥ 0.8
 ```
 
@@ -117,15 +128,53 @@ check — O(|R|) with a hash set.
   scores, covered vs. required entities, and the missing-set if any. `--json` for hooks.
 - `substrateCheck()` stage order becomes: preflight(lexical) → **context-assemble +
   completeness gate** → reuse → route → impact → lean → verify plan.
-- The ambient hook (`substrateContext()`) injects the *rendered selection*, replacing
-  ad-hoc "read these files" advisories.
+- ~~The ambient hook (`substrateContext()`) injects the *rendered selection*, replacing
+  ad-hoc "read these files" advisories.~~ _(Corrected 2026-09-26: not implemented, by design for
+  latency — the per-prompt hook runs the substrate from caches only and does not assemble context.
+  Assembly runs in the explicit gate (`forge substrate`) and `forge context`; see §7.)_
 
 ## 6. Honest limits
 
 - `R(edit)` inherits atlas's regex-approximation: over-approximate on dependents (safe —
   more required knowledge), potentially blind where regex misses an edge. The AST-backed
   atlas upgrade ([06](./06-faculties-and-mechanisms.md) §1) tightens both at once.
-- Greedy ½-approximation can leave budget value on the table; irrelevant next to the
-  failure mode it replaces (no objective at all).
+- The greedy heuristic can leave budget value on the table, and has no approximation guarantee
+  _(corrected 2026-09-26 from "Greedy ½-approximation")_; that is acceptable next to the failure
+  mode it replaces (no objective at all), but it is measured as a heuristic, not proved.
 - `lessons*` selection uses `val`, so a young team ledger under-supplies at first — the
   gate's floor (`defs ∪ blast₁ ∪ tests`) is structural and needs no history.
+
+## 7. Status (2026-09-26) — partial
+
+An external review (2026-09-26) reproduced two counterexamples to this phase's acceptance
+criterion at v1.4.3 (commit `d2abfa6`): with a budget of 1 token the result reported `ok: true`
+with 39 tokens used (F02), and with a budget of 8 tokens a one-line `- read src/calc.js` pointer
+counted as delivering a definition that sat below line 100 of that file (F03). P4 is therefore
+**partial**, and the source is being repaired to this contract:
+
+- **Token counts are estimates of the rendered block.** `tokens` is computed on the text actually
+  injected — labels, file headers and separators included — as characters ÷ 3.6. It is an
+  estimate: no per-model tokenizer is used, so a hard per-model cap needs a real tokenizer.
+- **Overflow is reported, never hidden.** When the required items cannot fit even as pointers, the
+  result carries `overflow: true` and `ok: false`; it never claims completion over budget.
+- **A pointer is an obligation, not coverage.** A one-line `- read <file>` creates a *pending read
+  obligation*, listed in `pending`; it does not count as covering anything until the span is
+  actually read.
+- **A head covers only what it shows.** The "first 25 lines" variant covers a definition only when
+  the definition's line falls inside the delivered span; definitions use a symbol-span variant when
+  the atlas knows the line.
+- **Truncation is visible.** A dependents list cut at 12 entries names the omitted entries in
+  `truncated`.
+- **Selection is a heuristic.** Optional items are chosen greedily by value density (score ÷
+  tokens) with per-source diminishing returns. The per-source discount breaks the preconditions of
+  the knapsack and set-cover approximation results, so no approximation guarantee is claimed.
+- **The ambient hook does not assemble context.** For latency, the per-prompt hook uses caches
+  only; the explicit gate (`forge substrate`) and `forge context` assemble.
+- **`ok` means syntactically delivered.** Every required key has delivered content within the
+  budget, with no overflow and no pending reads. It does not mean the delivered text is
+  semantically sufficient for the edit, and `contracts(S)` (the types and interfaces a symbol
+  implements) is not yet part of `R(edit)`.
+
+P4 becomes *implemented* when that contract ships with regression tests for the F02 and F03
+fixtures; it would take a measured sufficiency evaluation (edits made with and without the
+assembled context, judged by tests) before any stronger claim.
diff --git a/docs/plans/substrate-v2/05-cost-model.md b/docs/plans/substrate-v2/05-cost-model.md
index 0905b858..d4b395c4 100644
--- a/docs/plans/substrate-v2/05-cost-model.md
+++ b/docs/plans/substrate-v2/05-cost-model.md
@@ -1,13 +1,27 @@
-# 05 — The cost model: the path to ~90 %, stated honestly
-
-> The owner's target is ~90 % cost reduction. This doc gives the composition argument for
-> why the target is reachable, the exact formula, which factors are **measured** today
-> versus **targets**, and the P8 harness that will replace targets with measurements.
-> Discipline per the paper (§4, C6): a number is an assumption until measured.
-
-## 1. The stage model
-
-A task's cost passes through independent multiplicative stages:
+# 05 — The cost model: a ~90 % target, stated as a hypothesis
+
+> The owner's target is ~90 % cost reduction. This doc states that target, the stage model it
+> was argued from, why that argument is **not evidence** of any achieved saving, and the P8
+> harness that would replace hypotheses with measurements. Every factor below — routing included —
+> is a hypothesis until paired, externally verified runs measure it. Discipline per the paper (§4,
+> C6): a number is an assumption until measured.
+
+> **Corrected 2026-09-26.** This page used to open with a factor table whose routing row read
+> "`r_route` … **0.62 measured live** (paper §9, real tokens, real ladder)", and §2 derived three
+> scenarios "with routing fixed at its measured 0.62": **90.2 %** (repeat-heavy team), **85.6 %**
+> (moderate reuse) and **74.3 %** (cold start), concluding that "~90 % is credible on repeat-heavy
+> team workloads once the ledger is warm" and that the floor was "≈ 75 %". That 0.62 was the old
+> router's 62.1 % saving on the 30 tasks its thresholds were tuned on; on 80 held-out tasks the same
+> router's total spend was 20.2 % **higher** than always-premium
+> ([research/empirical-refutation/](../../../research/empirical-refutation/)), and it was a
+> repricing of measured tokens, not an observed cheaper-model outcome. A footnote conceded the
+> refutation while the arithmetic above it still used the number. The scenarios are **retired, not
+> re-derived**: §2 explains why multiplying independently estimated stage savings would not give a
+> valid total even with honest inputs.
+
+## 1. The stage model — a hypothesis about where cost could fall
+
+A task's cost may pass through these stages:
 
 ```
 C = C₀ · (1 − g·h_gate) · (1 − h_cache·σ_cache) · (1 − ρ_ctx) · (1 − r_route)
@@ -15,42 +29,94 @@ C = C₀ · (1 − g·h_gate) · (1 − h_cache·σ_cache) · (1 − ρ_ctx) ·
 
 | factor    | stage                                     | meaning                                                                                                                  | status                                                                                      |
 | --------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
-| `h_gate`  | M2 gate                                   | fraction of requests halted as under-specified (spend ≈ 0 generation tokens; `g` ≈ their share of would-have-been spend) | mechanism **measured** in paper §9 (9/9 halts, zero gen tokens); rate is workload-dependent |
-| `h_cache` | reuse ([03](./03-reuse-cache.md))         | hit rate; `σ_cache` = avg saving per hit (≈ 1.0 exact, ≈ 0.85 near, ≈ 0.5 adapt)                                         | **target** — P8 measures                                                                    |
-| `ρ_ctx`   | assembly ([04](./04-context-assembly.md)) | input-token reduction from knapsack + compression ladder vs. read-everything baseline                                    | **target** — P8 measures                                                                    |
-| `r_route` | M1 routing                                | tier selection saving on remaining generation                                                                            | **0.62 measured live** (paper §9, real tokens, real ladder)                                 |
-
-Secondary effects deliberately **excluded** from the multiplication (they'd double-count
-or are unpriceable now): doom-loop halts (avoided thrash loops), M5 lean (fewer generated
-tokens), avoided-rework from the completeness gate (C2's "almost right" loop). These are
-tracked in P8 as separate counters, reported alongside — upside, not arithmetic.
-
-## 2. What the target requires
-
-With routing fixed at its measured 0.62, reaching 90 % total requires the _other_ stages
-to jointly remove ≈ 74 % of the remaining cost:
-
-```
-(1 − h_cache·σ) · (1 − ρ_ctx) · (1 − g·h_gate) ≤ 0.10 / 0.38 ≈ 0.263
-```
-
-Example compositions that satisfy it:
-
-| scenario                                         | h_cache·σ | ρ_ctx | g·h_gate | total reduction |
-| ------------------------------------------------ | --------- | ----- | -------- | --------------- |
-| repeat-heavy team (CRUD, components, migrations) | 0.55      | 0.35  | 0.10     | **90.2 %**      |
-| moderate reuse                                   | 0.40      | 0.30  | 0.10     | 85.6 %          |
-| cold start (fresh repo, empty ledger)            | 0.05      | 0.25  | 0.05     | 74.3 %          |
-
-Read the table honestly: **~90 % is credible on repeat-heavy team workloads once the
-ledger is warm, and is not credible cold.** The cache factor dominates, and it _grows_
-with team adoption (every teammate's verified artifact is everyone's hit —
-[02](./02-team-memory.md)) and with time (ledger accumulation). The floor — routing +
-assembly + gate alone — is ≈ 75 %, already substantial.
-
-## 3. Measurement plan (P8)
-
-**Instrumentation** — every stage emits one line to `.forge/metrics.jsonl`:
+| `h_gate`  | M2 gate                                   | fraction of requests halted as under-specified (spend ≈ 0 generation tokens; `g` ≈ their share of would-have-been spend) | **hypothesis** — the paper §9 demo halted its own under-specified examples with zero generation tokens (the tuned set); on 80 held-out tasks the gate's F1 was 0.37, and the halt rate and its net value on a real workload are unmeasured |
+| `h_cache` | reuse ([03](./03-reuse-cache.md))         | hit rate; `σ_cache` = avg saving per hit (≈ 1.0 exact, ≈ 0.85 near, ≈ 0.5 adapt)                                         | **hypothesis** — P8 measures                                                                |
+| `ρ_ctx`   | assembly ([04](./04-context-assembly.md)) | input-token reduction from knapsack + compression ladder vs. read-everything baseline                                    | **hypothesis** — P8 measures                                                                |
+| `r_route` | routing                                   | tier-selection saving on remaining generation                                                                            | **hypothesis** — no current measurement supports a positive value for this pipeline (components below) |
+
+Routing is two separately versioned components, and neither supplies a measured `r_route`:
+
+- **The old tiered router** — the Python prototype `research/python-prototypes/router_gate/`
+  (July 2026; 62.1 % on its 30 tuning tasks, **refuted**: 20.2 % more total spend than
+  always-premium on 80 held-out tasks) and its Node descendant `forge route` (`src/route.js`, a
+  k-NN rubric over labelled exemplars), which has never been evaluated end to end on cost.
+- **The universal router** — `forge route universal` (`src/router/`, prior
+  `data/router_prior.json` fitted 2026-09-22 on public SWE-bench Verified outcomes). Its held-out
+  headline is repository-reported, comes from an external harness, prices a different scaffold's
+  attempts, and says nothing about this pipeline's stages. A new in-repo replay on those
+  recorded attempts (2026-09-26) finds it no better than a fixed cascade chosen on the same dev
+  tasks, and finds its expected-cost formula under-predicting replayed cost by 5–22%
+  ([UNIVERSAL_ROUTING.md](../../UNIVERSAL_ROUTING.md)).
+
+Secondary effects are deliberately **excluded** from the multiplication (they would double-count or
+are unpriceable now): doom-loop halts (avoided thrash loops), M5 lean (fewer generated tokens),
+avoided rework from the completeness gate (C2's "almost right" loop). These are tracked in P8 as
+separate counters, reported alongside — upside, not arithmetic.
+
+## 2. Why the product is not a total
+
+Four separately estimated saving rates cannot simply be multiplied into a total:
+
+- **Cache hits change the routed workload.** The tasks that miss the cache are the novel ones, which
+  are likely the harder and more expensive ones; a routing saving estimated on all tasks does not
+  carry over to that residue.
+- **Context assembly changes quality, and quality changes retries.** Fewer input tokens that cost an
+  extra failed attempt or an escalation are not a saving; `ρ_ctx` measured as input-token reduction
+  alone ignores that.
+- **Halts can defer cost rather than remove it.** A clarified task usually comes back and is paid
+  for; a halt saves only if the work it prevents was wrong or unnecessary.
+- **Conditional ratios telescope only over one realized pipeline.** `C_final / C₀ = ∏ₖ (Cₖ / Cₖ₋₁)`
+  holds when every `Cₖ` is measured on the same tasks in the same run, each stage's denominator is
+  the cost that actually reached it, and the ledger includes what the stages themselves add:
+  lookups, prompt injection, verification, failed attempts and human recovery.
+
+Two further rules keep numbers honest:
+
+- **Repricing is a price counterfactual.** Repricing one model's measured tokens at another model's
+  price is not an observed cheaper-model outcome: the cheaper model would have produced different
+  tokens, different failures and different retries. It may be reported, labelled as a
+  counterfactual, never as a saving.
+- **Name the component and its version.** "Routing saves X" must say which router (the old tiered
+  router, `forge route`, or `forge route universal`), which version or prior, and which task set.
+
+The ~90 % figure remains the owner's target and a **hypothesis**. It is never a result, and no
+published achieved saving may be derived from this stage model.
+
+## 3. Acceptance rule for any cost headline
+
+A cost figure may be published only with every field below. A figure that cannot fill them is
+labelled a target, a hypothesis or a counterfactual; the evidence status is the one recorded in
+[`docs/status/claims.json`](../../status/claims.json).
+
+| Field                | What it must say                                                                                          |
+| -------------------- | --------------------------------------------------------------------------------------------------------- |
+| Run ID               | the run (or runs) that produced the number, so it can be found and re-read                                |
+| Code SHA             | the exact commit of forgekit (and of any external harness) that ran                                      |
+| Dataset              | the task set, how it was selected, and whether any of it was used to tune the policy                      |
+| Denominator          | per task, or — the primary outcome — per **completed, externally verified** task                         |
+| Baseline             | what it is compared with, run with equivalent tools, context and repair opportunity                       |
+| Correctness rule     | what counts as success: `tests_passed`, `human_accepted`, `deployed_without_revert` — or `judge_accepted`, named as such |
+| Uncertainty          | an interval, its method, and the unit resampled (task, repository, time block)                            |
+| Evidence status      | `measured`, `reported` (someone else's number, not reproduced here) or `hypothesis`                       |
+
+No published achieved saving may derive from a factor that has been refuted.
+
+**Cost reporting fields** (for `forge cost`, `forge dash` and any report; see
+[GUIDE → `forge cost --stages`](../../GUIDE.md#forge-cost---stages--the-measured-cost-report)):
+
+- currency and the date of the prices used;
+- actual spend versus counterfactual (repriced or modelled) spend, never mixed in one number;
+- which attempts are included (first attempt only, or every retry and escalation);
+- cached tokens, and verifier and tool costs, counted or explicitly excluded;
+- missing-data status: a stage or day with no logs is **unknown**, never $0 actual spend;
+- beside the primary outcome (total cost per completed, externally verified task), the acceptance
+  rate and the abandonment rate;
+- stage-level logs diagnose where cost goes; only paired, full-system outcomes judge whether the
+  system saves.
+
+## 4. Measurement plan (P8) — status: partial
+
+**Instrumentation (implemented)** — every stage emits one line to `.forge/metrics.jsonl`:
 
 ```
 { t, task, stage: "gate|cache|context|route|generate|verify",
@@ -59,27 +125,32 @@ assembly + gate alone — is ≈ 75 %, already substantial.
 
 Written by the existing guard layer (`cost-budget.sh` already meters spend; it gains
 stage tags), `substrateCheck()`, and the reuse/context modules. `forge cost` learns a
-`--stages` report; `forge dash` charts it.
+`--stages` report; `forge dash` charts it. The per-stage factors it prints are stage
+self-estimates over whatever was logged — diagnostics, not a total.
 
-**Harness** — extend `src/eval.js` (which already does precision/recall for impact):
+**Harness (not yet run)** — extend `src/eval.js` (which already does precision/recall for impact):
 
 1. **Replay corpus:** N ≥ 100 real tasks captured from session traces (spec + repo state
-   ref + outcome), stratified: repeat-heavy / mixed / cold.
-2. **Paired runs:** baseline (always-premium, read-everything, no cache) vs. substrate,
-   same tasks — the paper §9 methodology (identical tokens repriced) extended to all four
-   stages, so every saving is arithmetic on measured tokens, never an estimate.
-3. **Correctness guard:** a saving only counts if the external verifier passes the output
-   (paper §9.3's rule: "routing down only counts as a win if the cheap tier is still
-   correct" — applied to every stage; a cache hit that gets reverted is a _negative_
-   entry).
-4. **Report:** per-stage factors with confidence intervals → `reports/cost-eval.md`;
-   the README claim gets updated to whatever the harness measured, with the workload
-   caveat attached. Until then the README may say "~90 % composed target" — never "90 %
-   achieved". (It used to also say "62.1 % measured (routing)"; that figure came from the 30
-   tasks the router was tuned on and was refuted on 80 held-out tasks, where routing cost
-   20.2 % more than always-premium — see `research/empirical-refutation/`.)
-
-## 4. Cost of the substrate itself
+   ref + outcome), stratified: repeat-heavy / mixed / cold, selected before any policy is tuned
+   on them.
+2. **Paired runs:** baseline (equivalent tools, context and repair opportunity; always-premium /
+   read-everything is reported too, but it is a weak comparator) vs. substrate, same tasks, **each
+   policy actually executed**. Repricing the baseline's tokens at a cheaper model's price is a
+   counterfactual (§2) and is labelled as one.
+3. **Correctness guard:** a saving only counts if an external verifier passes the output
+   (`tests_passed` or `human_accepted`); a cache hit that gets reverted is a _negative_ entry, and
+   abandoned tasks count against the policy that abandoned them.
+4. **Report:** total cost per completed, externally verified task with an interval, acceptance and
+   abandonment rates beside it, and per-stage diagnostics → `reports/cost-eval.md`, every field of
+   §3 filled. The README may say "~90 % target (hypothesis)" — never "90 % achieved". (It used to
+   also say "62.1 % measured (routing)"; that figure came from the 30 tasks the router was tuned on
+   and was refuted on 80 held-out tasks, where routing cost 20.2 % more than always-premium — see
+   `research/empirical-refutation/`.)
+
+Until the harness has run, P8 is **partial**: instrumentation and the stage report exist, and
+[`reports/cost-eval.md`](../../../reports/cost-eval.md) holds no measured end-to-end figure.
+
+## 5. Cost of the substrate itself
 
 The overhead side of the ledger, counted against the savings in P8:
 
diff --git a/docs/plans/substrate-v2/06-faculties-and-mechanisms.md b/docs/plans/substrate-v2/06-faculties-and-mechanisms.md
index 18326f71..291737a3 100644
--- a/docs/plans/substrate-v2/06-faculties-and-mechanisms.md
+++ b/docs/plans/substrate-v2/06-faculties-and-mechanisms.md
@@ -33,7 +33,8 @@
 ## §2 Imagination — the consequence simulator g (paper Eq. 4)
 
 The paper: `ĉ = g(a, C)` predicting `{broken call sites, type errors, failing tests}` —
-partly exact (static), partly cheap simulation (sandboxed tests). Atlas gives the static
+partly exact (static), partly cheap simulation (tests run in an isolated git checkout — not a
+security sandbox; see the GUIDE's `forge imagine` section). Atlas gives the static
 half; P5 adds the simulation half:
 
 1. **Impacted-test selection.** Build the bipartite cover relation `covers(test, symbol)`
diff --git a/docs/plans/substrate-v2/07-ui-quality-gate.md b/docs/plans/substrate-v2/07-ui-quality-gate.md
index 527a996a..88adfd63 100644
--- a/docs/plans/substrate-v2/07-ui-quality-gate.md
+++ b/docs/plans/substrate-v2/07-ui-quality-gate.md
@@ -127,3 +127,37 @@ the gate's job is to stop the template from ever reaching them. Thresholds start
 advisory and only become enforcing once the P8 fixture set (known-slop vs. known-custom
 UI corpus) shows separation, same as every other research-edge gate
 ([00-overview.md](./00-overview.md) §4).
+
+## 7. UI checks are advisory — what each one measures (2026-09-26)
+
+The checks in this spec measure different things, and none of them measures whether a UI is good:
+
+| Check | What it measures | What it does not measure |
+|---|---|---|
+| `forge uicheck contrast` | WCAG contrast arithmetic for one foreground/background pair | whether the page is accessible: keyboard use, focus order, zoom, screen-reader names and motion are untouched |
+| design-token / scale checks (`design`) | whether spacing, radii, shadows and palette sit on the project's scales | whether the layout works for a user |
+| slop distance (`design`, `visual`) | distance from a small corpus of generic templates | user value or aesthetic quality — far from a template is not the same as good |
+| visual fingerprint conformance (`design`, `visual`) | similarity to the project's minted fingerprint | whether the rendered states are correct |
+| `forge uicheck interact` | four rendered behaviours: console-clean, keyboard-reachable, focus-visible, reduced-motion | the rest of accessibility and any task flow |
+
+**What the code does today.** `contrast` exits 1 when a pair fails AA, `design` exits 1 on a fail
+or on insufficient signal, and `visual` exits 1 on a fail (and 0, with a note, when no browser
+runtime is installed), so a script or CI step *can* gate on them. `interact` is advisory unless
+`--enforce` or `FORGE_ENFORCE=1` is set. No guard runs any of them automatically — §4's "the
+PostToolUse guard runs them on edited UI files" is not implemented — and the Stop completion gate
+accepts a fresh, signed `design`/`visual` PASS as *one* form of UI evidence, beside a design or
+state record, a passing e2e run or `forge verify`. The gate asks for evidence; a failing UI check
+is simply not evidence, and the gate blocks at most once per session either way.
+
+**Before any UI check becomes blocking** (by default, in a hook, or recommended as a CI gate) it
+needs evidence it does not have yet:
+
+- a small **labelled set** of rendered UI states covering keyboard navigation, focus order, zoom,
+  responsive overflow, reduced motion and screen-reader names, with the verdict a person reached
+  for each;
+- a **measured false-positive cost** on that set — how often the check blocks a UI the labels call
+  fine, and what each false block costs to clear;
+- an **exception path** that lets a person record an override with a reason, visible in review.
+
+Until then, a passing contrast check is not an accessibility result, and a large slop distance is
+not a quality result; both are prompts for a human look.
diff --git a/docs/status/README.md b/docs/status/README.md
new file mode 100644
index 00000000..005228c1
--- /dev/null
+++ b/docs/status/README.md
@@ -0,0 +1,89 @@
+# Claim status
+
+Every load-bearing headline this project makes — about the product, the research, and the
+numbers behind both — with its current status and the evidence behind it. The source of truth is
+the machine-readable registry [`claims.json`](claims.json); the table below is generated from it.
+
+**Statuses**
+
+| Status | Meaning |
+| --- | --- |
+| `implemented` | the code exists and does what the claim says; tests exercise it |
+| `measured` | a number produced by a stated procedure on stated data, reproducible from this repository |
+| `partial` | some of the claim holds; the notes say which part does not |
+| `reported` | stated by someone (this project included) with evidence this repository cannot reproduce end to end |
+| `hypothesis` | not tested yet: a target or an assumption |
+| `refuted` | tested and false as stated; the notes give the counterexample and any corrected wording |
+
+**Rules**
+
+- A headline that is not `measured` or `implemented` is never quoted as an achievement. A cost
+  figure also needs the fields in
+  [plan 05 §3](../plans/substrate-v2/05-cost-model.md#3-acceptance-rule-for-any-cost-headline).
+- `source_commit` is the commit a status was assessed against (here, `d2abfa6`, the commit an
+  external review pinned on 2026-09-26). Several claims marked `refuted` there have fixes in the
+  later commit `aedddf5`, which the notes name; a status changes only after the claim is
+  re-assessed against the new code, and `source_commit` moves with it. The universal-router rows
+  also use results produced on 2026-09-26 with this repository's own scripts
+  (`bench/universal-router/`), which the notes date.
+- Edit [`claims.json`](claims.json), then run `node scripts/claims-status.mjs` to regenerate this
+  table. `node scripts/claims-status.mjs --check` fails on an invalid registry, a stale table, or
+  a `docs/cognitive-substrate/` copy that has drifted from its canonical source in `research/`.
+
+The registry exists because the project's own rule — *do not assert without evidence* — needed a
+place where every assertion's evidence can be looked up.
+
+<!-- CLAIMS:BEGIN (generated by scripts/claims-status.mjs — do not edit) -->
+47 claims — implemented 10 · measured 10 · partial 3 · reported 3 · hypothesis 6 · refuted 15.
+Assessed against commit `d2abfa69fb77` (as of 2026-09-26).
+
+| ID | Status | Claim | Component · version | Evidence | Notes |
+| --- | --- | --- | --- | --- | --- |
+| `impact-oracle-perfect-recall` | **refuted** | The Python impact oracle has perfect recall: it never misses an affected module. | Python impact oracle (research/python-prototypes/impact_oracle) · v1, as shipped | [`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py)<br>[`research/python-prototypes/impact_oracle/README.md`](../../research/python-prototypes/impact_oracle/README.md) | Recall 1.00 held on five mutations of a ten-file demo package the authors wrote (precision 0.633, F1 0.753). On 759 evaluated files in nine open-source repositories its recall was 0.022. |
+| `impact-oracle-field-original` | **measured** | On nine repositories (co-edited-file prediction) the as-shipped oracle scores pooled P/R/F1 0.3982/0.0220/0.0416 against grep's 0.3535/0.5732/0.4373. | Python impact oracle (research/python-prototypes/impact_oracle) · v1, as shipped | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py)<br>[`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md) | Recomputed by the 2026-09-26 external review: 801 labelled / 759 evaluated files, 20,144 mirrored pairs; repository-cluster bootstrap (20,000 draws, seed 1234) F1 oracle [0.0010, 0.0927], grep [0.3807, 0.5394], grep minus oracle [0.3422, 0.5174]; macro F1 0.0220 vs 0.4947. Co-change is a proxy for historically related edits; regression-test selection was not measured. |
+| `impact-oracle-repaired-heldout` | **measured** | The repaired oracle's F1 on three held-out repositories is 0.416 against grep's 0.371 at the canonical threshold 0.02. | Python impact oracle (research/python-prototypes/impact_oracle) · v2, repaired (in-tree, 49 tests) | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py)<br>[`research/python-prototypes/impact_oracle/README.md`](../../research/python-prototypes/impact_oracle/README.md) | A point estimate (ΔF1 about +0.044). Per-repository counts exist only at threshold 0.10 (pooled ΔF1 +0.0565, 3/3 repositories favour it, one-sided sign test p = 0.125); pytest supplies 71.3% of held-out pairs. Never mix the 0.02 and 0.10 figures. |
+| `impact-oracle-repaired-beats-grep` | **hypothesis** | The repaired oracle beats a grep baseline on repositories it has not seen. | Python impact oracle (research/python-prototypes/impact_oracle) · v2, repaired | [`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md)<br>[`research/README.md`](../../research/README.md) | Not established: three held-out repositories, and the choice of which relations to add was made after diagnosing all nine (an architecture-selection channel into the test set). Next study: freeze parser and relation design before acquiring new repositories or a time split; report review-cost metrics beside F1. |
+| `impact-oracle-in-tree-is-v2` | **implemented** | The in-tree Python impact oracle is the repaired v2, with 49 tests (36 demo-package + 13 repair regressions). | Python impact oracle (research/python-prototypes/impact_oracle) · v2 | [`research/python-prototypes/impact_oracle/tests/test_repair_fixes.py`](../../research/python-prototypes/impact_oracle/tests/test_repair_fixes.py)<br>[`research/python-prototypes/impact_oracle/tests/test_demo_package.py`](../../research/python-prototypes/impact_oracle/tests/test_demo_package.py) | research/README.md said until 2026-09-26 that the repaired oracle shipped only in the replication archive. ImpactOracle(wm, sibling_enabled=False, forward_enabled=False) reproduces the refuted v1 traversal. |
+| `node-impact-fixture-quality` | **measured** | forge impact scores precision 0.17, recall 1.00, F1 0.29 on six hand-labelled cases from this repository. | Node code graph (src/atlas.js, forge impact) · 1.4.3 | [`reports/benchmarks.md`](../../reports/benchmarks.md)<br>[`bench/impact_cases.mjs`](../../bench/impact_cases.mjs) | Six self-labelled symbols in one repository; the transitive walk is scored against direct-only labels. The 2026-09-26 review measured macro 0.18 / 1.00 / 0.30 on the same cases. A regex-derived graph, not the evaluated Python AST oracle; none of the Python study's numbers apply to it. |
+| `router-gate-demo-saving` | **refuted** | Complexity routing saves 62.1% of cost against always using the premium tier. | Old tiered router (research/python-prototypes/router_gate) · July 2026 prototype, thresholds tuned on 30 tasks | [`research/python-prototypes/router_gate/eval_results.json`](../../research/python-prototypes/router_gate/eval_results.json)<br>[`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md) | Measured on the 30 tasks its thresholds were tuned on, by repricing measured tokens (a price counterfactual). On 80 held-out tasks its total spend was 20.2% higher. |
+| `router-gate-heldout-cost` | **measured** | On 64 non-halted held-out tasks the routed pipeline spent $6.3582 against always-premium's $5.2893: 20.21% more. | Old tiered router (research/python-prototypes/router_gate) · as evaluated (replication archive) | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py)<br>[`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md) | Escalation-inclusive and ungated. 58 of 64 tasks failed at every tier, which makes the inversion largely mechanical. |
+| `router-gate-judge-accepted-cost` | **measured** | Per judge-accepted output the routed pipeline cost $1.060 against always-premium's $1.763. | Old tiered router (research/python-prototypes/router_gate) · as evaluated (replication archive) | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py)<br>[`research/python-prototypes/router_gate/README.md`](../../research/python-prototypes/router_gate/README.md) | judge_accepted only: 6/64 vs 3/64 (Clopper-Pearson [0.035, 0.193] and [0.010, 0.131]), so the ratio is unstable. The judge is also the mid-tier executor. tests_passed, human_accepted and deployed_without_revert were not measured. |
+| `router-gate-gate-f1` | **measured** | The assumption gate scores F1 0.37 (recall 0.31) on 80 held-out tasks. | Old tiered router's assumption gate (research/python-prototypes/router_gate) · as evaluated (replication archive) | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/empirical-refutation/README.md`](../../research/empirical-refutation/README.md)<br>[`research/empirical-refutation/extended_preprint.html`](../../research/empirical-refutation/extended_preprint.html) | Against 1.00 on the 30-task tuning set. Labels are one model's. |
+| `router-gate-label-agreement` | **measured** | Re-labelling 30 held-out tasks gives halt κ 0.5161 and tier κ 0.8919. | Old tiered router evaluation labels · as evaluated (replication archive) | [`research/empirical-refutation/replication_package.tar.gz`](../../research/empirical-refutation/replication_package.tar.gz)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py) | Same model, reworded prompt: self-consistency, not agreement with a human. |
+| `forge-route-tier-cost` | **hypothesis** | The tiered forge route recommendation lowers cost at equal success. | Tiered router (src/route.js, forge route) · 1.4.3 | [`src/route.js`](../../src/route.js)<br>[`docs/plans/substrate-v2/05-cost-model.md`](../../docs/plans/substrate-v2/05-cost-model.md) | Never evaluated end to end on cost. A separately versioned descendant of the refuted router_gate rubric; no measured routing factor supports a positive saving. |
+| `universal-router-heldout-headline` | **reported** | On 350 held-out SWE-bench Verified issues the universal router (match-best-single) solves 76.3% at $0.093 per task, against 75.1% at $0.364 for the best single model chosen on dev. | Universal router (src/router, forge route universal) · fit on 150 dev issues (harness-bench run 4), not the shipped prior | [`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md)<br>[`bench/universal-router/README.md`](../../bench/universal-router/README.md) | Produced by an external harness (harness-bench) that is not shipped here. Its 150/350 split ids, pre-registration, baseline selection and metric aggregation are not in this repository, so it cannot be reproduced from it. The 2026-09-22 re-run (217 of 218 metric values identical) is the project's own report with the same harness, not an independent replication. bench/universal-router/holdout_eval.mjs is a different experiment and does not stand in for it. |
+| `universal-router-vs-fixed-cascade` | **measured** | With a 150-task dev fit the universal router does not beat a fixed cascade chosen on the same dev data. | Universal router (src/router, forge route universal) · dev fit of 150 tasks (holdout_eval.mjs), router code of d2abfa6 and aedddf5 | [`bench/universal-router/holdout_eval.mjs`](../../bench/universal-router/holdout_eval.mjs)<br>[`bench/universal-router/README.md`](../../bench/universal-router/README.md)<br>[`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md) | A new in-repo experiment, not a reproduction of run 4: seeded split 20260926, 150 dev / 350 held-out, fit on dev only, 10,000 paired bootstrap draws. Router 80.0% solved at $0.124 per task; best fixed cascade on dev (minimax-m2.5 > gpt-5-mini > kimi-k2.5) 80.6% at $0.136; router minus cascade -0.6 points [-1.4, 0.0] and -$0.012 [-$0.024, -$0.003]. Five more seeds, run after the first result: -0.6 to +1.1 points, never both more accurate and cheaper. The run-4 version of this finding is repository-reported. |
+| `universal-router-inrepo-replay-vs-best-single` | **measured** | On a new in-repo split (seed 20260926; 150 dev / 350 held-out tasks), the router solves 80.0% of held-out tasks at $0.124 per task, against 76.0% at $0.768 for the best single model chosen on dev (claude-opus-4.5). | Universal router (src/router, forge route universal) · dev fit of 150 tasks (holdout_eval.mjs), router code of d2abfa6 and aedddf5 | [`bench/universal-router/holdout_eval.mjs`](../../bench/universal-router/holdout_eval.mjs)<br>[`bench/universal-router/README.md`](../../bench/universal-router/README.md)<br>[`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md) | +4.0 points [+0.6, +7.4] at -$0.644 per task [-$0.698, -$0.594], mostly from one cheap model: minimax-m2.5 opens 308 of the 350 cascades. It depends on which model wins dev: across six splits the solve-rate interval excludes zero only for this seed. The replay assumes a perfect, free check between attempts; one scaffold, twelve Python repositories, February 2026 costs, and SWE-bench Verified's label-validity limits. |
+| `universal-router-prior-refit` | **measured** | The shipped prior (data/router_prior.json) refits exactly from pinned public data with this repository's own tooling. | Universal router prior (data/router_prior.json) · fitted 2026-09-22, k=1, scale 4 | [`bench/universal-router/README.md`](../../bench/universal-router/README.md)<br>[`bench/universal-router/reproduce.sh`](../../bench/universal-router/reproduce.sh)<br>[`bench/universal-router/sources.json`](../../bench/universal-router/sources.json)<br>[`bench/universal-router/compare_priors.mjs`](../../bench/universal-router/compare_priors.mjs)<br>[`bench/universal-router/fit_prior.mjs`](../../bench/universal-router/fit_prior.mjs) | Reproduced on 2026-09-26 by the project in its own environment (Node v22.22.2, Python 3.11.15, 4-vCPU Intel Xeon @ 2.80GHz): from an empty work directory all 176 fitted values are identical, only provenance.fittedAt differs, with the router code of d2abfa6 and again with aedddf5; the refit takes 413-424 s. The external review's refit stopped at a 180 s limit, which was too short; the 37.6 s / 45.9 s in the 2026-09-22 report were the 150-issue dev fit. Tasks: Hugging Face SWE-bench/SWE-bench_Verified at revision 78f471b (not princeton-nlp/SWE-bench_Verified). reproduce.sh and sources.json were added after the assessed commit. A calculation reproduction, not an independent third-party replication. |
+| `universal-router-prior-transfer` | **hypothesis** | The shipped prior predicts success and cost on a user's own workload. | Universal router prior (data/router_prior.json) · fitted 2026-09-22 | [`data/router_prior.json`](../../data/router_prior.json)<br>[`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md)<br>[openai.com/index/why-we-no-longer-evaluate-swe-bench-verified](https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/) | Fitted on all 500 SWE-bench Verified tasks (so it cannot be evaluated out of sample on them), one scaffold, Python repositories, February 2026 costs. OpenAI reports test flaws in 59.4% of an audited 138-problem hard subset (not of all 500) plus contamination evidence. Next: time-held-out or unseen repositories, another scaffold, another language, real spend. |
+| `universal-router-target-guarantee` | **refuted** | The target:p objective guarantees a success rate of at least p. | Universal router (src/router, forge route universal) · 1.4.3 | [`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md)<br>[`bench/universal-router/README.md`](../../bench/universal-router/README.md) | Predicted cascade success was optimistic by 4-6 points on the run-4 test split (repository-reported), so target:p lands below p; in the in-repo replay (match-best-single) predicted minus observed success ranged from -2.8 to +9.1 points across six splits. Not a guarantee until an out-of-fold calibration map, reliability intervals and an abstention policy exist. |
+| `universal-router-budget-contract` | **partial** | The budget:B objective returns a cascade whose expected cost is at most B, and says so explicitly when none exists. | Universal router (src/router, forge route universal) · 1.4.3 | [`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md)<br>[`src/router/policy.js`](../../src/router/policy.js) | B bounds expected cost, not spend: a cascade can cost the sum of all its attempts, and E[cost] is under-predicted by 5-22% in the in-repo replay (see universal-router-cascade-cost-independence). At the assessed commit an infeasible budget returned the least expensive cascade with no budgetMet:false (review F12); aedddf5 (committed after the assessed commit) reports feasible:false, budgetMet:false, minimumExpectedCost, maxPossibleCost and a reason, and the CLI prints INFEASIBLE. |
+| `universal-router-cascade-cost-independence` | **refuted** | A later cascade attempt costs the same in expectation whether or not earlier attempts failed. | Universal router cost model (src/router/policy.js) · 1.4.3 | [`bench/universal-router/README.md`](../../bench/universal-router/README.md)<br>[`bench/universal-router/holdout_eval.mjs`](../../bench/universal-router/holdout_eval.mjs)<br>[`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md) | The cascade cost formula assumes E[cost_i \| earlier attempts failed, x] = E[cost_i \| x]. On the recorded SWE-bench Verified runs (in-repo replay, holdout_eval.mjs) expected cascade cost was under-predicted in all six splits, by 5-22% of the replayed cost ($0.102 expected against $0.124 replayed per task for seed 20260926): a failed attempt costs on average 1.2-2.0 times a successful one, for every model, and a later attempt is reached only after a failure. Corrected wording: this formula's E[cost] is optimistic until the cost model conditions on earlier outcomes. |
+| `route-outcome-provenance` | **refuted** | Outcomes recorded with forge route outcome are verified results. | Universal router outcome log (src/router/index.js) · 1.4.3 | [`docs/UNIVERSAL_ROUTING.md`](../../docs/UNIVERSAL_ROUTING.md)<br>[`src/router/index.js`](../../src/router/index.js) | At the assessed commit the pass/fail was caller-entered, with no provenance or attempt identity, so replaying a log multiplied evidence. aedddf5 (committed after the assessed commit) labels records provenance: self-reported unless --verify-run names a forge verify run whose verdict agrees (then verify-event), makes recording idempotent by attemptId (--attempt), and schema-validates records on write and read. Re-assess before changing the status. |
+| `cost-reduction-90-target` | **hypothesis** | Forgekit reduces coding-agent cost by about 90%. | Cost model (docs/plans/substrate-v2/05-cost-model.md) · plan, corrected 2026-09-26 | [`docs/plans/substrate-v2/05-cost-model.md`](../../docs/plans/substrate-v2/05-cost-model.md)<br>[`reports/cost-eval.md`](../../reports/cost-eval.md) | The owner's target. The 90.2 / 85.6 / 74.3% scenarios were derived from the refuted 0.62 routing factor and were withdrawn on 2026-09-26; separately estimated stage savings do not multiply into a total. No end-to-end cost has been measured. |
+| `phase-p0-specs` | **implemented** | P0: specs 00-08, ADR-0005 and ADR-0006 are merged. | Substrate v2 plan · v0.5.0 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`docs/adr/0005-allow-runtime-dependencies.md`](../../docs/adr/0005-allow-runtime-dependencies.md)<br>[`docs/adr/0006-proof-carrying-memory.md`](../../docs/adr/0006-proof-carrying-memory.md) |  |
+| `phase-p1-ledger-core` | **implemented** | P1: the claim ledger stores content-addressed claims whose confidence moves only with independent oracle evidence. | Ledger (src/ledger.js, src/ledger_store.js) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/ledger.js`](../../src/ledger.js)<br>[`test/ledger.test.js`](../../test/ledger.test.js) | The review found evidence-semantics defects at the assessed commit: aliases of one git object counted as independent evidence (F06), and a rewritten lesson inherited the old statement's confidence (F07); aedddf5 (committed after the assessed commit) repairs both with regression tests. See ledger-evidence-independence. |
+| `phase-p2-team-sync` | **implemented** | P2: ledgers merge across teammates by git union, converging regardless of order. | Ledger sync (src/ledger_sync.js) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/ledger_sync.js`](../../src/ledger_sync.js)<br>[`test/ledger_sync.test.js`](../../test/ledger_sync.test.js) | Storage convergence, property-tested; not semantic agreement or factual correctness. The read-path flip (merged legacy + ledger view) and ledger-only writes shipped after P2. |
+| `phase-p3-reuse-cache` | **implemented** | P3: the reuse cache serves an artifact only while its evidence holds, and refuses a stale one. | Reuse cache (src/reuse.js, forge reuse) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/reuse.js`](../../src/reuse.js)<br>[`test/reuse.test.js`](../../test/reuse.test.js) | Acceptance counterexamples at the assessed commit: exact keys erased operators and case (F04), and changed or deleted artifacts still exact-hit (F05). aedddf5 (committed after the assessed commit) repairs both with regression tests; re-assess before relying on it, and mark this phase partial if the probes still fail. |
+| `phase-p4-context-assembly` | **partial** | P4: context assembly never exceeds its token budget and reports a computed missing set. | Context assembly (src/context.js, forge context) · 1.4.3 | [`docs/plans/substrate-v2/04-context-assembly.md`](../../docs/plans/substrate-v2/04-context-assembly.md)<br>[`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/context.js`](../../src/context.js) | Over budget and pointer-only coverage were reported as complete (F02, F03). aedddf5 (committed after the assessed commit) reports overflow and pending reads; tokens are a chars/3.6 estimate of the rendered block; selection is a value-density heuristic with no approximation guarantee; the ambient hook does not assemble context; ok means syntactically delivered. |
+| `phase-p5-loop-closure` | **implemented** | P5: outcomes move the confidence of the claims that informed an action; repeated failures mint a diagnosis; imagine dry-runs the selected tests. | Loop closure (src/diagnose.js, src/imagine.js) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/imagine.js`](../../src/imagine.js)<br>[`test/imagine.test.js`](../../test/imagine.test.js) | imagine --run is an isolated git checkout of the committed baseline, not a security sandbox, and runs selected files under node --test. |
+| `phase-p6-ui-quality-gate` | **implemented** | P6: forge uicheck flags a known-template fixture and passes a project-conformant one, with no LLM calls. | UI checks (src/uicheck.js, forge uicheck) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`docs/plans/substrate-v2/07-ui-quality-gate.md`](../../docs/plans/substrate-v2/07-ui-quality-gate.md)<br>[`test/uicheck.test.js`](../../test/uicheck.test.js) | The checks are advisory measurements (contrast, token conformance, template distance, fingerprint similarity); none measures accessibility or user value, and none is a blocking hook. |
+| `phase-p7-dashboard` | **implemented** | P7: forge dash renders the ledger, cost meter, cache rate and blast radius offline. | Dashboard (src/dash.js, forge dash) · 1.4.3 | [`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md)<br>[`src/dash.js`](../../src/dash.js)<br>[`test/dash.test.js`](../../test/dash.test.js) | The review found read routes answering a foreign Host header at the assessed commit (F13), repaired in aedddf5 (committed after the assessed commit). Cost panels show stage self-estimates, not end-to-end spend. |
+| `phase-p8-evaluation` | **partial** | P8: a measured, not asserted, end-to-end cost figure per stage is published in reports/. | Cost evaluation (src/cost_report.js, forge cost --stages) · 1.4.3 | [`reports/cost-eval.md`](../../reports/cost-eval.md)<br>[`docs/plans/substrate-v2/05-cost-model.md`](../../docs/plans/substrate-v2/05-cost-model.md)<br>[`docs/plans/substrate-v2/00-overview.md`](../../docs/plans/substrate-v2/00-overview.md) | Stage instrumentation and the stage report exist; no paired end-to-end run has been measured and reports/cost-eval.md holds no data. |
+| `context-completeness` | **refuted** | forge context COMPLETE means the required knowledge was delivered within the token budget. | Context assembly (src/context.js, forge context) · 1.4.3 | [`docs/plans/substrate-v2/04-context-assembly.md`](../../docs/plans/substrate-v2/04-context-assembly.md)<br>[`docs/GUIDE.md`](../../docs/GUIDE.md) | At the assessed commit a 1-token budget returned ok:true with 39 tokens (F02), and a one-line pointer counted as delivering a definition below line 100 (F03). The contract repaired in aedddf5 (committed after the assessed commit): ok means syntactically delivered, overflow and pending reads are reported, and semantic sufficiency is not measured. |
+| `verify-pass-binding` | **refuted** | A forge verify PASS is bound to the exact code state that was tested and covers every declared suite. | Verification (src/verify.js, forge verify) · 1.4.3 | [`src/verify.js`](../../src/verify.js)<br>[`test/verify.test.js`](../../test/verify.test.js)<br>[`docs/GUIDE.md`](../../docs/GUIDE.md) | Counterexamples at the assessed commit: the working-tree fingerprint ignored paths and file boundaries (F01), a failing nested workspace still gave a whole-repo PASS (F08), and code changed during the run was signed (F10). aedddf5 (committed after the assessed commit) uses a length-delimited manifest, reports uncovered workspaces as INCOMPLETE and detects mutation; re-run the review's probes before changing this status. |
+| `ledger-evidence-independence` | **refuted** | A claim's confidence rises only with independent evidence for that claim. | Ledger (src/ledger_store.js, src/ledger_bridge.js) · 1.4.3 | [`src/ledger_store.js`](../../src/ledger_store.js)<br>[`src/ledger_bridge.js`](../../src/ledger_bridge.js) | At the assessed commit four prefixes of one commit raised confidence past the 0.8 threshold (F06), and a contradictory rewrite kept its evidence and 0.64 confidence (F07). aedddf5 (committed after the assessed commit) repairs this with regression tests; re-run the review's probes before changing the status. |
+| `reuse-exact-identity` | **refuted** | An exact reuse hit serves an artifact minted for the same specification, and only while its bytes still match. | Reuse cache (src/reuse.js) · 1.4.3 | [`src/reuse.js`](../../src/reuse.js)<br>[`test/reuse.test.js`](../../test/reuse.test.js) | At the assessed commit '>= 18' and '<= 18' shared an exact key (F04), and an edited or deleted artifact still exact-hit (F05). aedddf5 (committed after the assessed commit) repairs this with regression tests; re-run the review's probes before changing the status. |
+| `imagine-sandbox` | **refuted** | forge imagine --run executes the selected tests in a sandbox. | Consequence simulation (src/imagine.js, forge imagine) · 1.4.3 | [`src/imagine.js`](../../src/imagine.js)<br>[`docs/GUIDE.md`](../../docs/GUIDE.md) | It is an isolated git checkout (a detached-HEAD worktree): it isolates checkout files, not network, credentials, the home directory or process permissions, and it tests the committed baseline, not uncommitted patches. Since aedddf5 (committed after the assessed commit) the CLI says so ("an isolated checkout of HEAD; not a security sandbox"), and a suite that is not node:test gets an explicit unsupported-runner result. |
+| `integrations-emission` | **implemented** | Forgekit emits native config for ten coding tools plus MCP config for Roo Code and VS Code. | Config compiler (src/sync.js, src/emit) · 1.4.3 | [`docs/INTEGRATIONS.md`](../../docs/INTEGRATIONS.md)<br>[`test/sync.test.js`](../../test/sync.test.js)<br>[`test/mcp.test.js`](../../test/mcp.test.js) | Emission is tested; no host tool is launched in CI. Automatic hooks and in-agent enforcement exist only on Claude Code; a git pre-commit gate covers any tool that commits through git. |
+| `pcm-evidence-referenced-memory` | **implemented** | Proof-carrying memory stores content-addressed claims that carry references to their evidence. | Ledger (src/ledger.js) · 1.4.3 | [`docs/adr/0006-proof-carrying-memory.md`](../../docs/adr/0006-proof-carrying-memory.md)<br>[`src/ledger.js`](../../src/ledger.js) | A name, not a formal proof: there is no theorem prover in the loop. |
+| `theorem-d-joint-maxima` | **refuted** | Instructions and deterministic checks together can reach a residual of (1 - p_max)(1 - q_max). | Formal synthesis, Theorem D · HTML edition, corrected 2026-09-26 | [`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html)<br>[`research/empirical-refutation/extended_preprint.html`](../../research/empirical-refutation/extended_preprint.html)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py) | Holds only if both maxima are attainable under one policy. Policy A (0.5, 0.9) leaves 0.05 and policy B (0.9, 0.1) leaves 0.09, while the separate maxima suggest 0.01; the attainable residual is a minimum over the joint feasible set, and the product is a lower bound. Asserted by recompute_corrections.py --theorem-checks. |
+| `theorem-d-equality` | **refuted** | Over n independent tasks with per-task residual at most ε, P(at least one miss) equals 1 - (1 - ε)^n. | Formal synthesis, Theorem D · HTML edition, corrected 2026-09-26 | [`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py) | It is at most 1 - (1 - ε)^n, with equality only when every per-task residual equals ε; independence alone does not give equality. The union bound nε needs no independence. |
+| `independent-checks-400x` | **refuted** | The same check at the Stop hook, pre-commit and CI multiplies as three independent checks. | Formal synthesis, Eq. 5 · HTML edition, corrected 2026-09-21 | [`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html)<br>[`research/recompute_corrections.py`](../../research/recompute_corrections.py) | Copies of one classifier fire together: the residual is (1-p)(1-c_max) = 0.015, not the product's 3.75e-5 (a 400-fold understatement). Recomputed in recompute_corrections.py section 2 and asserted in section 3b. |
+| `silent-miss-implies-completion` | **hypothesis** | A lower silent-miss residual means more completed, correct tasks. | Formal synthesis, section 5.4 · HTML edition, corrected 2026-09-26 | [`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html) | Not established: a caught mistake can abort, block repeatedly or fail its repair. Measure true catch rate, false-block rate, repaired success given a catch, abandonment, latency and recovery cost. |
+| `frozen-model-cannot-adapt` | **refuted** | A frozen model cannot learn, imagine or self-correct, and prompting cannot supply these. | Cognitive-substrate theory (white paper, synthesis) · HTML editions, corrected 2026-09-26 | [`research/cognitive-substrate/cognitive_substrate_whitepaper.html`](../../research/cognitive-substrate/cognitive_substrate_whitepaper.html)<br>[`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html)<br>[arxiv.org/abs/2005.14165](https://arxiv.org/abs/2005.14165) | Too broad: examples, retrieved facts and feedback change a frozen model's behaviour within a context with no weight update (Brown et al., 2020). The precise gaps are no durable state across independent invocations, a bounded context, no automatic parameter update, and unreliable self-verification without external evidence. |
+| `external-architecture-necessity` | **hypothesis** | An external stateful architecture is necessary to supply the five faculties. | Cognitive-substrate theory · HTML editions, corrected 2026-09-26 | [`research/README.md`](../../research/README.md)<br>[arxiv.org/abs/2309.02427](https://arxiv.org/abs/2309.02427)<br>[arxiv.org/abs/2303.11366](https://arxiv.org/abs/2303.11366) | The substrate is one tested way of supplying persistence and verification, not the only logically possible architecture; the five faculties are a decomposition. Prior art: CoALA, Reflexion. Defensible framing: a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes. |
+| `independent-convergence` | **refuted** | Four independent arrivals (the theory, forgekit, hikmah-stack and wisdom-lens) confirm one design law. | Formal synthesis, section 14 · HTML edition, corrected 2026-09-21 | [`research/formal-synthesis/substrate_synthesis.html`](../../research/formal-synthesis/substrate_synthesis.html)<br>[`research/formal-synthesis/README.md`](../../research/formal-synthesis/README.md) | All four share an author: their agreement is consistency, not independent evidence. |
+| `metr-19-percent-slowdown` | **reported** | In METR's 2025 trial, 16 experienced open-source developers took 19% longer on 246 tasks with early-2025 AI tools. | External evidence (METR, arXiv:2507.09089) · 2025 study | [`research/cognitive-substrate/evidence/evidence_map.md`](../../research/cognitive-substrate/evidence/evidence_map.md)<br>[arxiv.org/abs/2507.09089](https://arxiv.org/abs/2507.09089)<br>[metr.org/blog/2026-02-24-uplift-update](https://metr.org/blog/2026-02-24-uplift-update/) | A result about that population and tooling, not a universal 2026 productivity coefficient in either direction; METR's February 2026 update explains why selection effects complicate newer estimates. |
+| `swebench-verified-audit` | **reported** | OpenAI found flawed tests in 59.4% of an audited 138-problem hard subset of SWE-bench Verified, plus contamination evidence. | External evidence (OpenAI, 2026-02-23) · 2026-02-23 analysis | [openai.com/index/why-we-no-longer-evaluate-swe-bench-verified](https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/)<br>[`research/cognitive-substrate/evidence/evidence_map.md`](../../research/cognitive-substrate/evidence/evidence_map.md) | Not a finding about 59.4% of all 500 tasks. It limits what any SWE-bench Verified replay, including the universal router's, can show. |
+<!-- CLAIMS:END -->
diff --git a/docs/status/claims.json b/docs/status/claims.json
new file mode 100644
index 00000000..ea1dfc21
--- /dev/null
+++ b/docs/status/claims.json
@@ -0,0 +1,652 @@
+{
+  "$comment": "The claim/status registry. Edit this file, then run `node scripts/claims-status.mjs` to regenerate the table in docs/status/README.md; `--check` fails CI-style on drift. source_commit is the commit each status was assessed against; after a fix lands, re-assess the claim and update both status and source_commit.",
+  "as_of": "2026-09-26",
+  "statuses": {
+    "implemented": "the code exists and does what the claim says; tests exercise it",
+    "measured": "a number produced by a stated procedure on stated data, reproducible from this repository",
+    "partial": "some of the claim holds; the notes say which part does not",
+    "reported": "stated by someone (this project included) with evidence that this repository cannot reproduce end to end",
+    "hypothesis": "not tested yet; a target or an assumption",
+    "refuted": "tested and false as stated; the notes give the counterexample and any corrected wording"
+  },
+  "claims": [
+    {
+      "id": "impact-oracle-perfect-recall",
+      "claim": "The Python impact oracle has perfect recall: it never misses an affected module.",
+      "component": "Python impact oracle (research/python-prototypes/impact_oracle)",
+      "version": "v1, as shipped",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/empirical-refutation/README.md",
+        "research/recompute_corrections.py",
+        "research/python-prototypes/impact_oracle/README.md"
+      ],
+      "notes": "Recall 1.00 held on five mutations of a ten-file demo package the authors wrote (precision 0.633, F1 0.753). On 759 evaluated files in nine open-source repositories its recall was 0.022."
+    },
+    {
+      "id": "impact-oracle-field-original",
+      "claim": "On nine repositories (co-edited-file prediction) the as-shipped oracle scores pooled P/R/F1 0.3982/0.0220/0.0416 against grep's 0.3535/0.5732/0.4373.",
+      "component": "Python impact oracle (research/python-prototypes/impact_oracle)",
+      "version": "v1, as shipped",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/recompute_corrections.py",
+        "research/empirical-refutation/README.md"
+      ],
+      "notes": "Recomputed by the 2026-09-26 external review: 801 labelled / 759 evaluated files, 20,144 mirrored pairs; repository-cluster bootstrap (20,000 draws, seed 1234) F1 oracle [0.0010, 0.0927], grep [0.3807, 0.5394], grep minus oracle [0.3422, 0.5174]; macro F1 0.0220 vs 0.4947. Co-change is a proxy for historically related edits; regression-test selection was not measured."
+    },
+    {
+      "id": "impact-oracle-repaired-heldout",
+      "claim": "The repaired oracle's F1 on three held-out repositories is 0.416 against grep's 0.371 at the canonical threshold 0.02.",
+      "component": "Python impact oracle (research/python-prototypes/impact_oracle)",
+      "version": "v2, repaired (in-tree, 49 tests)",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/recompute_corrections.py",
+        "research/python-prototypes/impact_oracle/README.md"
+      ],
+      "notes": "A point estimate (ΔF1 about +0.044). Per-repository counts exist only at threshold 0.10 (pooled ΔF1 +0.0565, 3/3 repositories favour it, one-sided sign test p = 0.125); pytest supplies 71.3% of held-out pairs. Never mix the 0.02 and 0.10 figures."
+    },
+    {
+      "id": "impact-oracle-repaired-beats-grep",
+      "claim": "The repaired oracle beats a grep baseline on repositories it has not seen.",
+      "component": "Python impact oracle (research/python-prototypes/impact_oracle)",
+      "version": "v2, repaired",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "research/empirical-refutation/README.md",
+        "research/README.md"
+      ],
+      "notes": "Not established: three held-out repositories, and the choice of which relations to add was made after diagnosing all nine (an architecture-selection channel into the test set). Next study: freeze parser and relation design before acquiring new repositories or a time split; report review-cost metrics beside F1."
+    },
+    {
+      "id": "impact-oracle-in-tree-is-v2",
+      "claim": "The in-tree Python impact oracle is the repaired v2, with 49 tests (36 demo-package + 13 repair regressions).",
+      "component": "Python impact oracle (research/python-prototypes/impact_oracle)",
+      "version": "v2",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "research/python-prototypes/impact_oracle/tests/test_repair_fixes.py",
+        "research/python-prototypes/impact_oracle/tests/test_demo_package.py"
+      ],
+      "notes": "research/README.md said until 2026-09-26 that the repaired oracle shipped only in the replication archive. ImpactOracle(wm, sibling_enabled=False, forward_enabled=False) reproduces the refuted v1 traversal."
+    },
+    {
+      "id": "node-impact-fixture-quality",
+      "claim": "forge impact scores precision 0.17, recall 1.00, F1 0.29 on six hand-labelled cases from this repository.",
+      "component": "Node code graph (src/atlas.js, forge impact)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "reports/benchmarks.md",
+        "bench/impact_cases.mjs"
+      ],
+      "notes": "Six self-labelled symbols in one repository; the transitive walk is scored against direct-only labels. The 2026-09-26 review measured macro 0.18 / 1.00 / 0.30 on the same cases. A regex-derived graph, not the evaluated Python AST oracle; none of the Python study's numbers apply to it."
+    },
+    {
+      "id": "router-gate-demo-saving",
+      "claim": "Complexity routing saves 62.1% of cost against always using the premium tier.",
+      "component": "Old tiered router (research/python-prototypes/router_gate)",
+      "version": "July 2026 prototype, thresholds tuned on 30 tasks",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/python-prototypes/router_gate/eval_results.json",
+        "research/empirical-refutation/README.md"
+      ],
+      "notes": "Measured on the 30 tasks its thresholds were tuned on, by repricing measured tokens (a price counterfactual). On 80 held-out tasks its total spend was 20.2% higher."
+    },
+    {
+      "id": "router-gate-heldout-cost",
+      "claim": "On 64 non-halted held-out tasks the routed pipeline spent $6.3582 against always-premium's $5.2893: 20.21% more.",
+      "component": "Old tiered router (research/python-prototypes/router_gate)",
+      "version": "as evaluated (replication archive)",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/recompute_corrections.py",
+        "research/empirical-refutation/README.md"
+      ],
+      "notes": "Escalation-inclusive and ungated. 58 of 64 tasks failed at every tier, which makes the inversion largely mechanical."
+    },
+    {
+      "id": "router-gate-judge-accepted-cost",
+      "claim": "Per judge-accepted output the routed pipeline cost $1.060 against always-premium's $1.763.",
+      "component": "Old tiered router (research/python-prototypes/router_gate)",
+      "version": "as evaluated (replication archive)",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/recompute_corrections.py",
+        "research/python-prototypes/router_gate/README.md"
+      ],
+      "notes": "judge_accepted only: 6/64 vs 3/64 (Clopper-Pearson [0.035, 0.193] and [0.010, 0.131]), so the ratio is unstable. The judge is also the mid-tier executor. tests_passed, human_accepted and deployed_without_revert were not measured."
+    },
+    {
+      "id": "router-gate-gate-f1",
+      "claim": "The assumption gate scores F1 0.37 (recall 0.31) on 80 held-out tasks.",
+      "component": "Old tiered router's assumption gate (research/python-prototypes/router_gate)",
+      "version": "as evaluated (replication archive)",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/empirical-refutation/README.md",
+        "research/empirical-refutation/extended_preprint.html"
+      ],
+      "notes": "Against 1.00 on the 30-task tuning set. Labels are one model's."
+    },
+    {
+      "id": "router-gate-label-agreement",
+      "claim": "Re-labelling 30 held-out tasks gives halt κ 0.5161 and tier κ 0.8919.",
+      "component": "Old tiered router evaluation labels",
+      "version": "as evaluated (replication archive)",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "research/empirical-refutation/replication_package.tar.gz",
+        "research/recompute_corrections.py"
+      ],
+      "notes": "Same model, reworded prompt: self-consistency, not agreement with a human."
+    },
+    {
+      "id": "forge-route-tier-cost",
+      "claim": "The tiered forge route recommendation lowers cost at equal success.",
+      "component": "Tiered router (src/route.js, forge route)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "src/route.js",
+        "docs/plans/substrate-v2/05-cost-model.md"
+      ],
+      "notes": "Never evaluated end to end on cost. A separately versioned descendant of the refuted router_gate rubric; no measured routing factor supports a positive saving."
+    },
+    {
+      "id": "universal-router-heldout-headline",
+      "claim": "On 350 held-out SWE-bench Verified issues the universal router (match-best-single) solves 76.3% at $0.093 per task, against 75.1% at $0.364 for the best single model chosen on dev.",
+      "component": "Universal router (src/router, forge route universal)",
+      "version": "fit on 150 dev issues (harness-bench run 4), not the shipped prior",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "reported",
+      "evidence": [
+        "docs/UNIVERSAL_ROUTING.md",
+        "bench/universal-router/README.md"
+      ],
+      "notes": "Produced by an external harness (harness-bench) that is not shipped here. Its 150/350 split ids, pre-registration, baseline selection and metric aggregation are not in this repository, so it cannot be reproduced from it. The 2026-09-22 re-run (217 of 218 metric values identical) is the project's own report with the same harness, not an independent replication. bench/universal-router/holdout_eval.mjs is a different experiment and does not stand in for it."
+    },
+    {
+      "id": "universal-router-vs-fixed-cascade",
+      "claim": "With a 150-task dev fit the universal router does not beat a fixed cascade chosen on the same dev data.",
+      "component": "Universal router (src/router, forge route universal)",
+      "version": "dev fit of 150 tasks (holdout_eval.mjs), router code of d2abfa6 and aedddf5",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "bench/universal-router/holdout_eval.mjs",
+        "bench/universal-router/README.md",
+        "docs/UNIVERSAL_ROUTING.md"
+      ],
+      "notes": "A new in-repo experiment, not a reproduction of run 4: seeded split 20260926, 150 dev / 350 held-out, fit on dev only, 10,000 paired bootstrap draws. Router 80.0% solved at $0.124 per task; best fixed cascade on dev (minimax-m2.5 > gpt-5-mini > kimi-k2.5) 80.6% at $0.136; router minus cascade -0.6 points [-1.4, 0.0] and -$0.012 [-$0.024, -$0.003]. Five more seeds, run after the first result: -0.6 to +1.1 points, never both more accurate and cheaper. The run-4 version of this finding is repository-reported."
+    },
+    {
+      "id": "universal-router-inrepo-replay-vs-best-single",
+      "claim": "On a new in-repo split (seed 20260926; 150 dev / 350 held-out tasks), the router solves 80.0% of held-out tasks at $0.124 per task, against 76.0% at $0.768 for the best single model chosen on dev (claude-opus-4.5).",
+      "component": "Universal router (src/router, forge route universal)",
+      "version": "dev fit of 150 tasks (holdout_eval.mjs), router code of d2abfa6 and aedddf5",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "bench/universal-router/holdout_eval.mjs",
+        "bench/universal-router/README.md",
+        "docs/UNIVERSAL_ROUTING.md"
+      ],
+      "notes": "+4.0 points [+0.6, +7.4] at -$0.644 per task [-$0.698, -$0.594], mostly from one cheap model: minimax-m2.5 opens 308 of the 350 cascades. It depends on which model wins dev: across six splits the solve-rate interval excludes zero only for this seed. The replay assumes a perfect, free check between attempts; one scaffold, twelve Python repositories, February 2026 costs, and SWE-bench Verified's label-validity limits."
+    },
+    {
+      "id": "universal-router-prior-refit",
+      "claim": "The shipped prior (data/router_prior.json) refits exactly from pinned public data with this repository's own tooling.",
+      "component": "Universal router prior (data/router_prior.json)",
+      "version": "fitted 2026-09-22, k=1, scale 4",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "measured",
+      "evidence": [
+        "bench/universal-router/README.md",
+        "bench/universal-router/reproduce.sh",
+        "bench/universal-router/sources.json",
+        "bench/universal-router/compare_priors.mjs",
+        "bench/universal-router/fit_prior.mjs"
+      ],
+      "notes": "Reproduced on 2026-09-26 by the project in its own environment (Node v22.22.2, Python 3.11.15, 4-vCPU Intel Xeon @ 2.80GHz): from an empty work directory all 176 fitted values are identical, only provenance.fittedAt differs, with the router code of d2abfa6 and again with aedddf5; the refit takes 413-424 s. The external review's refit stopped at a 180 s limit, which was too short; the 37.6 s / 45.9 s in the 2026-09-22 report were the 150-issue dev fit. Tasks: Hugging Face SWE-bench/SWE-bench_Verified at revision 78f471b (not princeton-nlp/SWE-bench_Verified). reproduce.sh and sources.json were added after the assessed commit. A calculation reproduction, not an independent third-party replication."
+    },
+    {
+      "id": "universal-router-prior-transfer",
+      "claim": "The shipped prior predicts success and cost on a user's own workload.",
+      "component": "Universal router prior (data/router_prior.json)",
+      "version": "fitted 2026-09-22",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "data/router_prior.json",
+        "docs/UNIVERSAL_ROUTING.md",
+        "https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/"
+      ],
+      "notes": "Fitted on all 500 SWE-bench Verified tasks (so it cannot be evaluated out of sample on them), one scaffold, Python repositories, February 2026 costs. OpenAI reports test flaws in 59.4% of an audited 138-problem hard subset (not of all 500) plus contamination evidence. Next: time-held-out or unseen repositories, another scaffold, another language, real spend."
+    },
+    {
+      "id": "universal-router-target-guarantee",
+      "claim": "The target:p objective guarantees a success rate of at least p.",
+      "component": "Universal router (src/router, forge route universal)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "docs/UNIVERSAL_ROUTING.md",
+        "bench/universal-router/README.md"
+      ],
+      "notes": "Predicted cascade success was optimistic by 4-6 points on the run-4 test split (repository-reported), so target:p lands below p; in the in-repo replay (match-best-single) predicted minus observed success ranged from -2.8 to +9.1 points across six splits. Not a guarantee until an out-of-fold calibration map, reliability intervals and an abstention policy exist."
+    },
+    {
+      "id": "universal-router-budget-contract",
+      "claim": "The budget:B objective returns a cascade whose expected cost is at most B, and says so explicitly when none exists.",
+      "component": "Universal router (src/router, forge route universal)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "partial",
+      "evidence": [
+        "docs/UNIVERSAL_ROUTING.md",
+        "src/router/policy.js"
+      ],
+      "notes": "B bounds expected cost, not spend: a cascade can cost the sum of all its attempts, and E[cost] is under-predicted by 5-22% in the in-repo replay (see universal-router-cascade-cost-independence). At the assessed commit an infeasible budget returned the least expensive cascade with no budgetMet:false (review F12); aedddf5 (committed after the assessed commit) reports feasible:false, budgetMet:false, minimumExpectedCost, maxPossibleCost and a reason, and the CLI prints INFEASIBLE."
+    },
+    {
+      "id": "universal-router-cascade-cost-independence",
+      "claim": "A later cascade attempt costs the same in expectation whether or not earlier attempts failed.",
+      "component": "Universal router cost model (src/router/policy.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "bench/universal-router/README.md",
+        "bench/universal-router/holdout_eval.mjs",
+        "docs/UNIVERSAL_ROUTING.md"
+      ],
+      "notes": "The cascade cost formula assumes E[cost_i | earlier attempts failed, x] = E[cost_i | x]. On the recorded SWE-bench Verified runs (in-repo replay, holdout_eval.mjs) expected cascade cost was under-predicted in all six splits, by 5-22% of the replayed cost ($0.102 expected against $0.124 replayed per task for seed 20260926): a failed attempt costs on average 1.2-2.0 times a successful one, for every model, and a later attempt is reached only after a failure. Corrected wording: this formula's E[cost] is optimistic until the cost model conditions on earlier outcomes."
+    },
+    {
+      "id": "route-outcome-provenance",
+      "claim": "Outcomes recorded with forge route outcome are verified results.",
+      "component": "Universal router outcome log (src/router/index.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "docs/UNIVERSAL_ROUTING.md",
+        "src/router/index.js"
+      ],
+      "notes": "At the assessed commit the pass/fail was caller-entered, with no provenance or attempt identity, so replaying a log multiplied evidence. aedddf5 (committed after the assessed commit) labels records provenance: self-reported unless --verify-run names a forge verify run whose verdict agrees (then verify-event), makes recording idempotent by attemptId (--attempt), and schema-validates records on write and read. Re-assess before changing the status."
+    },
+    {
+      "id": "cost-reduction-90-target",
+      "claim": "Forgekit reduces coding-agent cost by about 90%.",
+      "component": "Cost model (docs/plans/substrate-v2/05-cost-model.md)",
+      "version": "plan, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "docs/plans/substrate-v2/05-cost-model.md",
+        "reports/cost-eval.md"
+      ],
+      "notes": "The owner's target. The 90.2 / 85.6 / 74.3% scenarios were derived from the refuted 0.62 routing factor and were withdrawn on 2026-09-26; separately estimated stage savings do not multiply into a total. No end-to-end cost has been measured."
+    },
+    {
+      "id": "phase-p0-specs",
+      "claim": "P0: specs 00-08, ADR-0005 and ADR-0006 are merged.",
+      "component": "Substrate v2 plan",
+      "version": "v0.5.0",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "docs/adr/0005-allow-runtime-dependencies.md",
+        "docs/adr/0006-proof-carrying-memory.md"
+      ],
+      "notes": ""
+    },
+    {
+      "id": "phase-p1-ledger-core",
+      "claim": "P1: the claim ledger stores content-addressed claims whose confidence moves only with independent oracle evidence.",
+      "component": "Ledger (src/ledger.js, src/ledger_store.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/ledger.js",
+        "test/ledger.test.js"
+      ],
+      "notes": "The review found evidence-semantics defects at the assessed commit: aliases of one git object counted as independent evidence (F06), and a rewritten lesson inherited the old statement's confidence (F07); aedddf5 (committed after the assessed commit) repairs both with regression tests. See ledger-evidence-independence."
+    },
+    {
+      "id": "phase-p2-team-sync",
+      "claim": "P2: ledgers merge across teammates by git union, converging regardless of order.",
+      "component": "Ledger sync (src/ledger_sync.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/ledger_sync.js",
+        "test/ledger_sync.test.js"
+      ],
+      "notes": "Storage convergence, property-tested; not semantic agreement or factual correctness. The read-path flip (merged legacy + ledger view) and ledger-only writes shipped after P2."
+    },
+    {
+      "id": "phase-p3-reuse-cache",
+      "claim": "P3: the reuse cache serves an artifact only while its evidence holds, and refuses a stale one.",
+      "component": "Reuse cache (src/reuse.js, forge reuse)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/reuse.js",
+        "test/reuse.test.js"
+      ],
+      "notes": "Acceptance counterexamples at the assessed commit: exact keys erased operators and case (F04), and changed or deleted artifacts still exact-hit (F05). aedddf5 (committed after the assessed commit) repairs both with regression tests; re-assess before relying on it, and mark this phase partial if the probes still fail."
+    },
+    {
+      "id": "phase-p4-context-assembly",
+      "claim": "P4: context assembly never exceeds its token budget and reports a computed missing set.",
+      "component": "Context assembly (src/context.js, forge context)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "partial",
+      "evidence": [
+        "docs/plans/substrate-v2/04-context-assembly.md",
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/context.js"
+      ],
+      "notes": "Over budget and pointer-only coverage were reported as complete (F02, F03). aedddf5 (committed after the assessed commit) reports overflow and pending reads; tokens are a chars/3.6 estimate of the rendered block; selection is a value-density heuristic with no approximation guarantee; the ambient hook does not assemble context; ok means syntactically delivered."
+    },
+    {
+      "id": "phase-p5-loop-closure",
+      "claim": "P5: outcomes move the confidence of the claims that informed an action; repeated failures mint a diagnosis; imagine dry-runs the selected tests.",
+      "component": "Loop closure (src/diagnose.js, src/imagine.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/imagine.js",
+        "test/imagine.test.js"
+      ],
+      "notes": "imagine --run is an isolated git checkout of the committed baseline, not a security sandbox, and runs selected files under node --test."
+    },
+    {
+      "id": "phase-p6-ui-quality-gate",
+      "claim": "P6: forge uicheck flags a known-template fixture and passes a project-conformant one, with no LLM calls.",
+      "component": "UI checks (src/uicheck.js, forge uicheck)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "docs/plans/substrate-v2/07-ui-quality-gate.md",
+        "test/uicheck.test.js"
+      ],
+      "notes": "The checks are advisory measurements (contrast, token conformance, template distance, fingerprint similarity); none measures accessibility or user value, and none is a blocking hook."
+    },
+    {
+      "id": "phase-p7-dashboard",
+      "claim": "P7: forge dash renders the ledger, cost meter, cache rate and blast radius offline.",
+      "component": "Dashboard (src/dash.js, forge dash)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/plans/substrate-v2/00-overview.md",
+        "src/dash.js",
+        "test/dash.test.js"
+      ],
+      "notes": "The review found read routes answering a foreign Host header at the assessed commit (F13), repaired in aedddf5 (committed after the assessed commit). Cost panels show stage self-estimates, not end-to-end spend."
+    },
+    {
+      "id": "phase-p8-evaluation",
+      "claim": "P8: a measured, not asserted, end-to-end cost figure per stage is published in reports/.",
+      "component": "Cost evaluation (src/cost_report.js, forge cost --stages)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "partial",
+      "evidence": [
+        "reports/cost-eval.md",
+        "docs/plans/substrate-v2/05-cost-model.md",
+        "docs/plans/substrate-v2/00-overview.md"
+      ],
+      "notes": "Stage instrumentation and the stage report exist; no paired end-to-end run has been measured and reports/cost-eval.md holds no data."
+    },
+    {
+      "id": "context-completeness",
+      "claim": "forge context COMPLETE means the required knowledge was delivered within the token budget.",
+      "component": "Context assembly (src/context.js, forge context)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "docs/plans/substrate-v2/04-context-assembly.md",
+        "docs/GUIDE.md"
+      ],
+      "notes": "At the assessed commit a 1-token budget returned ok:true with 39 tokens (F02), and a one-line pointer counted as delivering a definition below line 100 (F03). The contract repaired in aedddf5 (committed after the assessed commit): ok means syntactically delivered, overflow and pending reads are reported, and semantic sufficiency is not measured."
+    },
+    {
+      "id": "verify-pass-binding",
+      "claim": "A forge verify PASS is bound to the exact code state that was tested and covers every declared suite.",
+      "component": "Verification (src/verify.js, forge verify)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "src/verify.js",
+        "test/verify.test.js",
+        "docs/GUIDE.md"
+      ],
+      "notes": "Counterexamples at the assessed commit: the working-tree fingerprint ignored paths and file boundaries (F01), a failing nested workspace still gave a whole-repo PASS (F08), and code changed during the run was signed (F10). aedddf5 (committed after the assessed commit) uses a length-delimited manifest, reports uncovered workspaces as INCOMPLETE and detects mutation; re-run the review's probes before changing this status."
+    },
+    {
+      "id": "ledger-evidence-independence",
+      "claim": "A claim's confidence rises only with independent evidence for that claim.",
+      "component": "Ledger (src/ledger_store.js, src/ledger_bridge.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "src/ledger_store.js",
+        "src/ledger_bridge.js"
+      ],
+      "notes": "At the assessed commit four prefixes of one commit raised confidence past the 0.8 threshold (F06), and a contradictory rewrite kept its evidence and 0.64 confidence (F07). aedddf5 (committed after the assessed commit) repairs this with regression tests; re-run the review's probes before changing the status."
+    },
+    {
+      "id": "reuse-exact-identity",
+      "claim": "An exact reuse hit serves an artifact minted for the same specification, and only while its bytes still match.",
+      "component": "Reuse cache (src/reuse.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "src/reuse.js",
+        "test/reuse.test.js"
+      ],
+      "notes": "At the assessed commit '>= 18' and '<= 18' shared an exact key (F04), and an edited or deleted artifact still exact-hit (F05). aedddf5 (committed after the assessed commit) repairs this with regression tests; re-run the review's probes before changing the status."
+    },
+    {
+      "id": "imagine-sandbox",
+      "claim": "forge imagine --run executes the selected tests in a sandbox.",
+      "component": "Consequence simulation (src/imagine.js, forge imagine)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "src/imagine.js",
+        "docs/GUIDE.md"
+      ],
+      "notes": "It is an isolated git checkout (a detached-HEAD worktree): it isolates checkout files, not network, credentials, the home directory or process permissions, and it tests the committed baseline, not uncommitted patches. Since aedddf5 (committed after the assessed commit) the CLI says so (\"an isolated checkout of HEAD; not a security sandbox\"), and a suite that is not node:test gets an explicit unsupported-runner result."
+    },
+    {
+      "id": "integrations-emission",
+      "claim": "Forgekit emits native config for ten coding tools plus MCP config for Roo Code and VS Code.",
+      "component": "Config compiler (src/sync.js, src/emit)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/INTEGRATIONS.md",
+        "test/sync.test.js",
+        "test/mcp.test.js"
+      ],
+      "notes": "Emission is tested; no host tool is launched in CI. Automatic hooks and in-agent enforcement exist only on Claude Code; a git pre-commit gate covers any tool that commits through git."
+    },
+    {
+      "id": "pcm-evidence-referenced-memory",
+      "claim": "Proof-carrying memory stores content-addressed claims that carry references to their evidence.",
+      "component": "Ledger (src/ledger.js)",
+      "version": "1.4.3",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "implemented",
+      "evidence": [
+        "docs/adr/0006-proof-carrying-memory.md",
+        "src/ledger.js"
+      ],
+      "notes": "A name, not a formal proof: there is no theorem prover in the loop."
+    },
+    {
+      "id": "theorem-d-joint-maxima",
+      "claim": "Instructions and deterministic checks together can reach a residual of (1 - p_max)(1 - q_max).",
+      "component": "Formal synthesis, Theorem D",
+      "version": "HTML edition, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/formal-synthesis/substrate_synthesis.html",
+        "research/empirical-refutation/extended_preprint.html",
+        "research/recompute_corrections.py"
+      ],
+      "notes": "Holds only if both maxima are attainable under one policy. Policy A (0.5, 0.9) leaves 0.05 and policy B (0.9, 0.1) leaves 0.09, while the separate maxima suggest 0.01; the attainable residual is a minimum over the joint feasible set, and the product is a lower bound. Asserted by recompute_corrections.py --theorem-checks."
+    },
+    {
+      "id": "theorem-d-equality",
+      "claim": "Over n independent tasks with per-task residual at most ε, P(at least one miss) equals 1 - (1 - ε)^n.",
+      "component": "Formal synthesis, Theorem D",
+      "version": "HTML edition, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/formal-synthesis/substrate_synthesis.html",
+        "research/recompute_corrections.py"
+      ],
+      "notes": "It is at most 1 - (1 - ε)^n, with equality only when every per-task residual equals ε; independence alone does not give equality. The union bound nε needs no independence."
+    },
+    {
+      "id": "independent-checks-400x",
+      "claim": "The same check at the Stop hook, pre-commit and CI multiplies as three independent checks.",
+      "component": "Formal synthesis, Eq. 5",
+      "version": "HTML edition, corrected 2026-09-21",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/formal-synthesis/substrate_synthesis.html",
+        "research/recompute_corrections.py"
+      ],
+      "notes": "Copies of one classifier fire together: the residual is (1-p)(1-c_max) = 0.015, not the product's 3.75e-5 (a 400-fold understatement). Recomputed in recompute_corrections.py section 2 and asserted in section 3b."
+    },
+    {
+      "id": "silent-miss-implies-completion",
+      "claim": "A lower silent-miss residual means more completed, correct tasks.",
+      "component": "Formal synthesis, section 5.4",
+      "version": "HTML edition, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "research/formal-synthesis/substrate_synthesis.html"
+      ],
+      "notes": "Not established: a caught mistake can abort, block repeatedly or fail its repair. Measure true catch rate, false-block rate, repaired success given a catch, abandonment, latency and recovery cost."
+    },
+    {
+      "id": "frozen-model-cannot-adapt",
+      "claim": "A frozen model cannot learn, imagine or self-correct, and prompting cannot supply these.",
+      "component": "Cognitive-substrate theory (white paper, synthesis)",
+      "version": "HTML editions, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/cognitive-substrate/cognitive_substrate_whitepaper.html",
+        "research/formal-synthesis/substrate_synthesis.html",
+        "https://arxiv.org/abs/2005.14165"
+      ],
+      "notes": "Too broad: examples, retrieved facts and feedback change a frozen model's behaviour within a context with no weight update (Brown et al., 2020). The precise gaps are no durable state across independent invocations, a bounded context, no automatic parameter update, and unreliable self-verification without external evidence."
+    },
+    {
+      "id": "external-architecture-necessity",
+      "claim": "An external stateful architecture is necessary to supply the five faculties.",
+      "component": "Cognitive-substrate theory",
+      "version": "HTML editions, corrected 2026-09-26",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "hypothesis",
+      "evidence": [
+        "research/README.md",
+        "https://arxiv.org/abs/2309.02427",
+        "https://arxiv.org/abs/2303.11366"
+      ],
+      "notes": "The substrate is one tested way of supplying persistence and verification, not the only logically possible architecture; the five faculties are a decomposition. Prior art: CoALA, Reflexion. Defensible framing: a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes."
+    },
+    {
+      "id": "independent-convergence",
+      "claim": "Four independent arrivals (the theory, forgekit, hikmah-stack and wisdom-lens) confirm one design law.",
+      "component": "Formal synthesis, section 14",
+      "version": "HTML edition, corrected 2026-09-21",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "refuted",
+      "evidence": [
+        "research/formal-synthesis/substrate_synthesis.html",
+        "research/formal-synthesis/README.md"
+      ],
+      "notes": "All four share an author: their agreement is consistency, not independent evidence."
+    },
+    {
+      "id": "metr-19-percent-slowdown",
+      "claim": "In METR's 2025 trial, 16 experienced open-source developers took 19% longer on 246 tasks with early-2025 AI tools.",
+      "component": "External evidence (METR, arXiv:2507.09089)",
+      "version": "2025 study",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "reported",
+      "evidence": [
+        "research/cognitive-substrate/evidence/evidence_map.md",
+        "https://arxiv.org/abs/2507.09089",
+        "https://metr.org/blog/2026-02-24-uplift-update/"
+      ],
+      "notes": "A result about that population and tooling, not a universal 2026 productivity coefficient in either direction; METR's February 2026 update explains why selection effects complicate newer estimates."
+    },
+    {
+      "id": "swebench-verified-audit",
+      "claim": "OpenAI found flawed tests in 59.4% of an audited 138-problem hard subset of SWE-bench Verified, plus contamination evidence.",
+      "component": "External evidence (OpenAI, 2026-02-23)",
+      "version": "2026-02-23 analysis",
+      "source_commit": "d2abfa69fb77531199ffc67c5c076b524af69040",
+      "status": "reported",
+      "evidence": [
+        "https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/",
+        "research/cognitive-substrate/evidence/evidence_map.md"
+      ],
+      "notes": "Not a finding about 59.4% of all 500 tasks. It limits what any SWE-bench Verified replay, including the universal router's, can show."
+    }
+  ]
+}
diff --git a/global/crew/verifier.md b/global/crew/verifier.md
index 844e93fa..716ca68f 100644
--- a/global/crew/verifier.md
+++ b/global/crew/verifier.md
@@ -17,7 +17,8 @@ Check for:
 
 Where possible, run the project's tests/build/linter and report the actual result.
 For test selection, `forge imagine "<the change>" --run` computes the minimal
-covering test suite and dry-runs it in a sandboxed worktree — run that first.
+covering test suite and dry-runs it in an isolated git checkout of HEAD (not a security
+sandbox; node:test files only) — run that first.
 
 Output:
 - **Verdict:** ship / fix-first / needs-discussion.
diff --git a/global/guards/format-on-edit.sh b/global/guards/format-on-edit.sh
index 8523eb08..53b59cc9 100755
--- a/global/guards/format-on-edit.sh
+++ b/global/guards/format-on-edit.sh
@@ -17,9 +17,19 @@ fpath="$(forge_field file_path)"
 have() { command -v "$1" >/dev/null 2>&1; }
 run()  { "$@" >/dev/null 2>&1 || true; }
 
+# A project that formats with Biome must never be rewritten by a global prettier: the two
+# disagree (line width, object wrapping), so every edit churned the whole file. Biome owns
+# the files it is configured for; everything else (markdown included) is left alone.
+biome_project() { [ -f "biome.json" ] || [ -f "biome.jsonc" ]; }
+
 case "$fpath" in
   *.ts|*.tsx|*.js|*.jsx|*.mjs|*.cjs|*.json|*.css|*.scss|*.md|*.html|*.yaml|*.yml)
-    if have npx && [ -f "package.json" ]; then run npx --no-install prettier --write "$fpath"; fi
+    if biome_project; then
+      case "$fpath" in
+        *.md|*.html|*.yaml|*.yml) ;;
+        *) if have npx && [ -x "node_modules/.bin/biome" ]; then run npx --no-install biome format --write "$fpath"; fi ;;
+      esac
+    elif have npx && [ -f "package.json" ]; then run npx --no-install prettier --write "$fpath"; fi
     ;;
   *.py)
     if have ruff; then run ruff format "$fpath"; run ruff check --fix "$fpath";
diff --git a/global/tools/cognitive-substrate/SKILL.md b/global/tools/cognitive-substrate/SKILL.md
index 0bc7f8b5..0fcb3ebc 100644
--- a/global/tools/cognitive-substrate/SKILL.md
+++ b/global/tools/cognitive-substrate/SKILL.md
@@ -47,7 +47,7 @@ the impacted files — including importers you didn't name.
 `forge impact <symbol|file>` (blast radius) · `forge scope <file…>` (decomposition) ·
 `forge context "<task>"` (budgeted context assembly; *computes* what's missing) ·
 `forge imagine "<task>" [--run]` (predicted breaks + minimal covering test suite;
-`--run` dry-runs it in a sandboxed worktree) ·
+`--run` dry-runs it in an isolated git checkout of HEAD — not a security sandbox) ·
 `forge diagnose "<error>"` (doom-loop: 3× the same failure signature = stop retrying,
 escalate one tier with the minted diagnosis claim at the head of the prompt).
 MCP equivalents: `assumption_gate`, `route_task`, `predict_impact`, `scope_files`.
diff --git a/global/tools/cognitive-substrate/references/capability-map.md b/global/tools/cognitive-substrate/references/capability-map.md
index 3d47d877..be533a9e 100644
--- a/global/tools/cognitive-substrate/references/capability-map.md
+++ b/global/tools/cognitive-substrate/references/capability-map.md
@@ -4,7 +4,7 @@
 | --- | --- | --- |
 | Memory | `forge recall`, `forge cortex`, `forge ledger` | Facts/lessons persist as content-addressed ledger claims; `forge ledger blame` shows provenance. |
 | Learning | `forge cortex`, ledger oracles | External outcomes (tests, CI, human accept/revert) move claim confidence; model weights do not change. |
-| Imagination | `forge imagine [--run]`, `forge impact` | Predicted breaks + minimal covering test suite; `--run` dry-runs it in a sandboxed worktree. |
+| Imagination | `forge imagine [--run]`, `forge impact` | Predicted breaks + minimal covering test suite; `--run` dry-runs it in an isolated git checkout of HEAD (not a security sandbox; node:test files only). |
 | Self-correction | `forge verify`, `forge diagnose` | Tests/builds beat model claims; 3× the same failure signature mints a diagnosis + escalation. |
 | Impact-awareness | `forge atlas`, `forge impact`, `forge substrate` | Known symbols/files, likely dependents, and sibling/forward co-change candidates are surfaced, each tagged by relation (`forge impact` alone is reverse-only unless `--all-relations`). |
 | M1 routing | `forge route` | Transparent model-tier recommendation. |
diff --git a/landing/assets/c-home-Bx4kvpSa.js b/landing/assets/c-home-Bx4kvpSa.js
index fd6e6b2f..6fc41351 100644
--- a/landing/assets/c-home-Bx4kvpSa.js
+++ b/landing/assets/c-home-Bx4kvpSa.js
@@ -1,4 +1,4 @@
-import{jsxs as t,jsx as e}from"react/jsx-runtime";import{useRef as d,useState as y,Fragment as T,memo as D}from"react";import{c as k,K as f,b as E,a as A,H as W,T as S,d as v,e as N,S as w,f as H}from"./c-core-yvMVzPz6.js";import{u as p}from"./v-gsap-react-CvXmapK9.js";import{C,a as P,A as R}from"./v-lucide-react-D7AUp8l6.js";import c from"gsap";const x="npm install -g @codewithjuber/forgekit && forge init",b=["Give","every","coding","agent","the","same","working","memory."],L=[{label:"PRE-ACTION GATE",end:118,decimals:0,unit:"ms"},{label:"BLAST-RADIUS LOOKUP",end:.43,decimals:2,unit:"ms"},{label:"ROUTING COST SAVED",end:62.1,decimals:1,unit:"%"},{label:"RUNTIME DEPS",end:0,decimals:0,unit:""}];function Z(){const r=d(null),[o,n]=y(!1),i=async()=>{try{await navigator.clipboard.writeText(x)}catch{}n(!0),window.setTimeout(()=>n(!1),1600)};return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{c.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".hero-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".hero-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".hero-sub",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".hero-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".hero-install",{y:16,opacity:0},{y:0,opacity:1,duration:.48},"-=0.2");const m=c.timeline({delay:.35,defaults:{ease:"precise"}});m.fromTo(".hero-plate",{y:24,opacity:0},{y:0,opacity:1,duration:.64}),c.utils.toArray(".spec-row").forEach((l,g)=>{const h=.64+g*.09;m.fromTo(l,{y:12,opacity:0},{y:0,opacity:1,duration:.4},h);const u=l.querySelector(".spec-num");u&&m.add(()=>{k(u,Number(u.dataset.end),Number(u.dataset.decimals))},h+.1)}),c.fromTo(".hero-ornament .draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:1.2,delay:.6,ease:"precise"})})},{scope:r}),t("section",{"code-path":"src/components/home/Hero.tsx:108:5",ref:r,id:"top","aria-labelledby":"hero-title",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/Hero.tsx:116:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/Hero.tsx:122:7",className:"container-fk relative grid gap-16 pb-24 pt-28 lg:grid-cols-12 lg:gap-10",children:[t("div",{"code-path":"src/components/home/Hero.tsx:124:9",className:"min-w-0 lg:col-span-7",children:[t("p",{"code-path":"src/components/home/Hero.tsx:125:11",className:"hero-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[e(f,{"code-path":"src/components/home/Hero.tsx:126:13",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"forgekit v0.27.0 · MIT · zero runtime dependencies"]}),e("h1",{"code-path":"src/components/home/Hero.tsx:130:11",id:"hero-title",className:"mt-6 font-display text-[clamp(2.75rem,6vw,3.815rem)] font-medium leading-[1.02] tracking-h-display text-ink",children:b.map((s,a)=>t(T,{"code-path":"src/components/home/Hero.tsx:135:15",children:[e("span",{"code-path":"src/components/home/Hero.tsx:136:17",className:"hero-word inline-block will-change-transform",children:s}),a<b.length-1?" ":null]},a))}),e("p",{"code-path":"src/components/home/Hero.tsx:142:11",className:"hero-sub mt-6 max-w-[620px] text-fs-1 font-normal text-ink-2",children:"forgekit turns one source of truth into native configuration for AI coding tools, then adds proof-carrying lessons, blast-radius prediction, reuse search, and pre-action guardrails — so agents act from shared evidence instead of fresh guesses."}),t("div",{"code-path":"src/components/home/Hero.tsx:149:11",className:"mt-8 flex flex-wrap items-center gap-3",children:[e("a",{"code-path":"src/components/home/Hero.tsx:150:13",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`hero-cta ${E}`,children:"Read the docs"}),e("a",{"code-path":"src/components/home/Hero.tsx:158:13",href:"#workflow",className:`hero-cta ${A}`,children:"See the workflow"})]}),t("div",{"code-path":"src/components/home/Hero.tsx:164:11",className:"hero-install mt-8 flex max-w-[620px] items-center justify-between gap-4 rounded-chip border border-hairline bg-paper-sunk px-4 py-3.5",children:[t("code",{"code-path":"src/components/home/Hero.tsx:165:13",className:"overflow-x-auto whitespace-nowrap font-mono text-[14px] text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:166:15",className:"mr-2 text-signal-strong",children:"$"}),x]}),t("button",{"code-path":"src/components/home/Hero.tsx:169:13",type:"button",onClick:i,className:"micro-label flex shrink-0 items-center gap-1.5 text-ink-3 transition-colors duration-fast ease-out-soft hover:text-ink","aria-label":"Copy install command",children:[o?e(C,{"code-path":"src/components/home/Hero.tsx:176:17",size:14,strokeWidth:1.5,"aria-hidden":"true",className:"text-pass"}):e(P,{"code-path":"src/components/home/Hero.tsx:178:17",size:14,strokeWidth:1.5,"aria-hidden":"true"}),o?"COPIED":"COPY"]}),e("span",{"code-path":"src/components/home/Hero.tsx:182:13","aria-live":"polite",className:"sr-only",children:o?"Install command copied":""})]})]}),t("div",{"code-path":"src/components/home/Hero.tsx:189:9",className:"relative min-w-0 lg:col-span-5",children:[e("svg",{"code-path":"src/components/home/Hero.tsx:191:11","aria-hidden":"true",viewBox:"0 0 120 120",width:"120",height:"120",fill:"none",className:"hero-ornament absolute -right-12 -top-12 z-0 text-signal opacity-[0.18]",children:t("g",{"code-path":"src/components/home/Hero.tsx:199:13",stroke:"currentColor",strokeWidth:"1",strokeLinejoin:"miter",children:[e("path",{"code-path":"src/components/home/Hero.tsx:200:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M21.11 21.11 h77.78 v77.78 h-77.78 Z"}),e("path",{"code-path":"src/components/home/Hero.tsx:201:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M115 60 L60 5 L5 60 L60 115 Z"})]})}),t("div",{"code-path":"src/components/home/Hero.tsx:205:11",className:"hero-plate relative z-10 rounded-plate border border-hairline-strong bg-paper-raised p-7 shadow-e1 transition-[transform,box-shadow] duration-fast ease-out-soft hover:-translate-y-0.5 hover:shadow-e2",children:[t("p",{"code-path":"src/components/home/Hero.tsx:206:13",className:"micro-label flex items-center gap-2.5 text-ink-3",children:[e(f,{"code-path":"src/components/home/Hero.tsx:207:15",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"SPEC SHEET — FORGE SUBSTRATE"]}),e("dl",{"code-path":"src/components/home/Hero.tsx:210:13",className:"mt-5 divide-y divide-hairline border-y border-hairline",children:L.map(s=>t("div",{"code-path":"src/components/home/Hero.tsx:212:17",className:"spec-row flex items-baseline justify-between gap-4 py-3.5",children:[e("dt",{"code-path":"src/components/home/Hero.tsx:216:19",className:"micro-label text-ink-3",children:s.label}),t("dd",{"code-path":"src/components/home/Hero.tsx:217:19",className:"font-mono text-fs-1 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:218:21",className:"spec-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&e("span",{"code-path":"src/components/home/Hero.tsx:226:23",className:"ml-1 text-[0.65em] font-medium text-ink-3",children:s.unit})]})]},s.label))}),e("p",{"code-path":"src/components/home/Hero.tsx:234:13",className:"mt-4 font-mono text-micro lowercase text-ink-3",children:"sources: reports/benchmarks.md · package.json"})]})]})]})]})}const I=["one context window","wiped every call","no memory","no foresight"],M=[{term:"memory",gloss:"proof-carrying, team-shared"},{term:"foresight",gloss:"predicts an edit's blast radius"},{term:"guardrails",gloss:"enforced hooks, not prose"},{term:"one config"}],O=["Claude Code","Codex","Cursor","Gemini","Aider","Copilot","Windsurf","Zed","Continue","+ MCP"],_=D(function(){return e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:31:5","aria-hidden":"true",className:"animate-gate-pulse pointer-events-none absolute left-1/2 top-1/2 h-4 w-4 -translate-x-1/2 -translate-y-1/2 rounded-full border border-signal-bright"})});function J(){const r=d(null),[o,n]=y(!1);p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const a=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0},onComplete:()=>n(!0)});a.fromTo(".d-head",{y:16,opacity:0},{y:0,opacity:1,duration:.48}),a.fromTo(".d-left",{y:24,opacity:0},{y:0,opacity:1,duration:.56},.1),a.fromTo(".d-left-row",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.07},.35),a.fromTo(".gate-line-a, .gate-line-b",{strokeDashoffset:1},{strokeDashoffset:0,duration:.7},.5),a.fromTo(".d-glyph-wrap",{scale:.6,opacity:0},{scale:1,opacity:1,duration:.32},.92),a.fromTo(".d-gate-label",{opacity:0},{opacity:1,duration:.32},.95),a.fromTo(".gate-arrow",{opacity:0},{opacity:1,duration:.16},1.2),a.fromTo(".d-right",{y:24,opacity:0},{y:0,opacity:1,duration:.56},1),c.utils.toArray(".d-right-row").forEach((m,l)=>{const g=1.25+l*.08;a.fromTo(m,{y:12,opacity:0},{y:0,opacity:1,duration:.4},g);const h=m.querySelector(".d-star");h&&a.fromTo(h,{rotate:0},{rotate:45,duration:.32},g+.08)}),a.fromTo(".d-tools-label",{opacity:0},{opacity:1,duration:.4},1.6),a.fromTo(".d-tool",{y:8,opacity:0},{y:0,opacity:1,duration:.5,stagger:.04},1.7),a.fromTo([".d-caption",".d-foot"],{y:12,opacity:0},{y:0,opacity:1,duration:.48,stagger:.09},2.2),a.fromTo(".arc-draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:.9},2.7),a.fromTo(".arc-arrow",{opacity:0},{opacity:1,duration:.2},3.55)})},{scope:r});const i=t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:130:5",className:"d-glyph-wrap relative inline-flex",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:131:7",size:18,strokeWidth:1.5,className:"text-signal-bright"}),o&&e(_,{"code-path":"src/components/home/SubstrateDiagram.tsx:132:19"})]});return t("section",{"code-path":"src/components/home/SubstrateDiagram.tsx:137:5",ref:r,"aria-labelledby":"diagram-title",className:"relative overflow-hidden border-b border-hairline-on-ink bg-ink text-paper-on-ink",children:[e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:143:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04]",style:{backgroundImage:"url('/girih-lattice-ink.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:149:7",className:"container-fk relative py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:151:9",className:"d-head flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:152:11",id:"diagram-title",className:"micro-label text-signal-bright",children:"ONE BRAIN FOR EVERY AI CODING AGENT"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:155:11",className:"font-mono text-micro text-paper-on-ink-3",children:"FIG. 1"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:159:9",className:"relative mt-12 lg:pb-16",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:160:11",className:"flex flex-col items-stretch lg:flex-row lg:items-center",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:162:13",className:"d-left rounded-card border border-hairline-on-ink bg-[rgba(245,242,234,0.03)] p-6 lg:flex-[4]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:163:15",className:"micro-label text-paper-on-ink-2",children:"BEFORE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:164:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"stateless model."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:167:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:I.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:169:19",className:"d-left-row flex items-center gap-3 py-3",children:[e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:170:21","aria-hidden":"true",className:"h-1.5 w-1.5 shrink-0 border border-[rgba(245,242,234,0.35)]"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:174:21",className:"text-small font-normal text-paper-on-ink-2",children:s})]},s))})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:181:13",className:"d-gate hidden flex-col items-center self-center lg:flex lg:flex-[1]",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:182:15",className:"relative flex w-full items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:183:17",viewBox:"0 0 96 20",preserveAspectRatio:"none",className:"h-5 w-full",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:190:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1","vector-effect":"non-scaling-stroke",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:191:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M0 10 L34 10"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:192:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M62 10 L90 10"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:194:19",className:"gate-arrow",d:"M90 10 l-5 -3 M90 10 l-5 3",stroke:"#F5F2EA",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:203:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 bg-transparent px-1",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:207:15",className:"d-gate-label micro-label mt-2 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:211:13",className:"d-gate flex flex-col items-center self-center py-2 lg:hidden",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:212:15",className:"relative flex h-24 items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:213:17",viewBox:"0 0 20 96",className:"h-24 w-5",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:214:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:215:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M10 0 L10 34"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:216:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M10 62 L10 90"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:218:19",className:"gate-arrow",d:"M10 90 l-3 -5 M10 90 l3 -5",stroke:"#F5F2EA",strokeWidth:"1",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:226:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:230:15",className:"d-gate-label micro-label mt-1 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:234:13",className:"d-right rounded-card border border-[rgba(217,72,15,0.45)] bg-[rgba(217,72,15,0.06)] p-6 transition-colors duration-fast ease-out-soft hover:border-[rgba(217,72,15,0.8)] lg:flex-[7]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:235:15",className:"micro-label text-signal-bright",children:"AFTER — THE COGNITIVE SUBSTRATE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:236:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"the cognitive substrate."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:239:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:M.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:241:19",className:"d-right-row flex items-baseline gap-3 py-3",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:242:21",size:10,strokeWidth:1.5,className:"d-star shrink-0 self-center text-signal-bright"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:247:21",className:"text-small font-semibold text-paper-on-ink",children:s.term}),s.gloss&&t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:249:23",className:"text-small font-normal text-paper-on-ink-2",children:["— ",s.gloss]})]},s.term))})]})]}),t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:260:11","aria-hidden":"true",viewBox:"0 0 1120 56",preserveAspectRatio:"none",className:"pointer-events-none absolute -bottom-2 left-0 hidden h-14 w-full lg:block",fill:"none",children:[e("defs",{"code-path":"src/components/home/SubstrateDiagram.tsx:267:13",children:e("mask",{"code-path":"src/components/home/SubstrateDiagram.tsx:268:15",id:"arc-reveal",maskUnits:"userSpaceOnUse",x:"0",y:"0",width:"1120",height:"56",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:269:17",className:"arc-draw",d:"M950 0 C950 48, 170 48, 170 6",stroke:"#fff",strokeWidth:"2",pathLength:1,strokeDasharray:1,"vector-effect":"non-scaling-stroke"})})}),e("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:280:13",mask:"url(#arc-reveal)",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:281:15",d:"M950 0 C950 48, 170 48, 170 6",stroke:"rgba(245,242,234,0.07)",strokeWidth:"1",strokeDasharray:"4 4","vector-effect":"non-scaling-stroke"})}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:289:13",className:"arc-arrow",d:"M170 6 l-4 7 M170 6 l4 7",stroke:"rgba(245,242,234,0.2)",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:301:9",className:"mt-14 lg:mt-8",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:302:11",className:"d-tools-label micro-label text-paper-on-ink-2",children:"COMPILES TO NATIVE CONFIG FOR"}),e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:305:11",className:"mt-4 grid grid-cols-2 gap-px rounded-card border border-hairline-on-ink bg-hairline-on-ink sm:grid-cols-5 lg:grid-cols-10",children:O.map(s=>e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:307:15",className:"d-tool bg-ink px-2 py-3 text-center font-mono text-micro font-medium uppercase tracking-chip text-paper-on-ink-2 transition-colors duration-fast ease-out-soft hover:bg-[#24221D] hover:text-paper-on-ink",children:s},s))})]}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:317:9",className:"d-caption mt-8 text-center text-small font-normal text-paper-on-ink-2",children:"every task passes a fast gate · every verified outcome flows back into the shared memory"}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:320:9",className:"d-foot mt-3 text-center font-mono text-micro text-paper-on-ink-3",children:"author once · zero runtime dependencies · plain-git team memory"})]})]})}const B=[{tag:"measured",tagLabel:"MEASURED",end:118,decimals:0,unit:"ms",label:"full pre-action gate",source:"reports/benchmarks.md"},{tag:"measured",tagLabel:"MEASURED",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",source:"reports/benchmarks.md"},{tag:"prototype",tagLabel:"PROTOTYPE",end:62.1,decimals:1,unit:"%",label:"routing cost saved",source:"white-paper prototype"},{tag:"manifest",tagLabel:"MANIFEST",end:0,decimals:0,unit:"",label:"runtime dependencies",source:"package.json"}];function Q(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo(".stats-intro",{y:20,opacity:0},{y:0,opacity:1,duration:.48}),c.utils.toArray(".stat-cell").forEach((i,s)=>{const a=.2+s*.08;n.fromTo(i.querySelector(".stat-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},a),n.fromTo(i,{y:20,opacity:0},{y:0,opacity:1,duration:.56},a+.06);const m=i.querySelector(".stat-num");m&&n.add(()=>{k(m,Number(m.dataset.end),Number(m.dataset.decimals))},a+.12)})})},{scope:r}),t("section",{"code-path":"src/components/home/StatsBand.tsx:95:5",ref:r,"aria-label":"Measured metrics",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/StatsBand.tsx:101:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_0%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/StatsBand.tsx:107:7",className:"container-fk relative py-14 md:py-[72px]",children:[e("p",{"code-path":"src/components/home/StatsBand.tsx:108:9",className:"stats-intro mb-10 max-w-[720px] text-fs-1 font-normal text-ink-2",children:"One substrate — memory, foresight, guardrails — compiled to native config for every agent your team already runs."}),e("div",{"code-path":"src/components/home/StatsBand.tsx:114:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-2 lg:grid-cols-4",children:B.map(o=>t("div",{"code-path":"src/components/home/StatsBand.tsx:116:13",className:"stat-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:120:15",className:"stat-tag inline-block",children:e(W,{"code-path":"src/components/home/StatsBand.tsx:121:17",variant:o.tag,label:o.tagLabel})}),t("p",{"code-path":"src/components/home/StatsBand.tsx:123:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:124:17",className:"stat-num","data-end":o.end,"data-decimals":o.decimals,children:o.end.toFixed(o.decimals)}),o.unit&&e("span",{"code-path":"src/components/home/StatsBand.tsx:132:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:o.unit})]}),e("p",{"code-path":"src/components/home/StatsBand.tsx:135:15",className:"mt-2 text-small font-medium text-ink-2",children:o.label}),t(S,{"code-path":"src/components/home/StatsBand.tsx:136:15",children:[e(v,{"code-path":"src/components/home/StatsBand.tsx:137:17",asChild:!0,children:e("p",{"code-path":"src/components/home/StatsBand.tsx:138:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:o.source})}),e(N,{"code-path":"src/components/home/StatsBand.tsx:145:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},o.label))})]})]})}const G=[{index:"01",title:"Cross-tool config",body:"Author rules once, then compile native config layers for the agents your team already uses."},{index:"02",title:"Proof-carrying memory",body:"Every durable lesson carries evidence, provenance, confidence, decay, and merge behavior."},{index:"03",title:"Impact foresight",body:"Before editing, Forge predicts affected files and tests so agents plan smaller, safer changes."},{index:"04",title:"Reuse-first retrieval",body:"Agents are pushed toward existing code paths and prior fixes before inventing another solution."},{index:"05",title:"Guardrails that run",body:"Scope, assumptions, anchoring, cost, and secret-redaction checks are enforced by CLI hooks."},{index:"06",title:"Team memory through git",body:"Knowledge moves with the repository, not with a single chat transcript or vendor workspace."}];function ee(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo([".plat-eyebrow",".plat-h2",".plat-note"],{y:20,opacity:0},{y:0,opacity:1,duration:.56,stagger:.08}),c.utils.toArray(".plat-card").forEach((i,s)=>{const a=.3+s*.07;n.fromTo(i,{y:24,opacity:0},{y:0,opacity:1,duration:.56},a);const m=i.querySelector(".spec-star");m&&n.fromTo(m,{rotate:0},{rotate:45,duration:.32},a+.2)})})},{scope:r}),e("section",{"code-path":"src/components/home/PlatformSection.tsx:70:5",ref:r,id:"platform","aria-labelledby":"platform-title",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/home/PlatformSection.tsx:76:7",className:"container-fk py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/PlatformSection.tsx:77:9",className:"plat-eyebrow flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/PlatformSection.tsx:78:11",className:"micro-label text-signal-strong",children:"Platform"}),e("span",{"code-path":"src/components/home/PlatformSection.tsx:79:11",className:"font-mono text-micro text-ink-3",children:"§ 01"})]}),e("h2",{"code-path":"src/components/home/PlatformSection.tsx:81:9",id:"platform-title",className:"plat-h2 mt-4 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"A cognitive substrate, packaged like developer tooling."}),t("p",{"code-path":"src/components/home/PlatformSection.tsx:87:9",className:"plat-note mt-4 max-w-[680px] text-base font-normal text-ink-2",children:["Every claim here is repository-backed: ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:88:50",className:"code-chip",children:"README"}),","," ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:89:11",className:"code-chip",children:"CHANGELOG"}),", package metadata, benchmark reports, and optional GitHub counters on the status page. No mock marketing data."]}),e("div",{"code-path":"src/components/home/PlatformSection.tsx:93:9",className:"mt-12 grid gap-4 md:grid-cols-2 lg:grid-cols-3",children:G.map(o=>e(w,{"code-path":"src/components/home/PlatformSection.tsx:95:13",index:o.index,title:o.title,className:"plat-card",children:o.body},o.index))})]})})}const F=[{num:"01",title:"Initialize the substrate",body:"Run the installer to generate project-local agent instructions, hooks, and memory stores."},{num:"02",title:"Let agents plan with evidence",body:"Forge assembles context, reuse candidates, assumptions, scope, and impact predictions before edits."},{num:"03",title:"Promote only verified lessons",body:"Tests and human corrections update memory; self-graded claims never become trusted facts."}],j=`$ forge substrate "Change auth validation and update tests"
+import{jsxs as t,jsx as e}from"react/jsx-runtime";import{useRef as d,useState as y,Fragment as T,memo as D}from"react";import{c as k,K as f,b as E,a as A,H as W,T as S,d as v,e as N,S as w,f as H}from"./c-core-yvMVzPz6.js";import{u as p}from"./v-gsap-react-CvXmapK9.js";import{C,a as P,A as R}from"./v-lucide-react-D7AUp8l6.js";import c from"gsap";const x="npm install -g @codewithjuber/forgekit && forge init",b=["Give","every","coding","agent","the","same","working","memory."],L=[{label:"PRE-ACTION GATE",end:118,decimals:0,unit:"ms"},{label:"BLAST-RADIUS LOOKUP",end:.43,decimals:2,unit:"ms"},{label:"ROUTING COST ABOVE PREMIUM (HELD-OUT)",end:20.2,decimals:1,unit:"%"},{label:"RUNTIME DEPS",end:0,decimals:0,unit:""}];function Z(){const r=d(null),[o,n]=y(!1),i=async()=>{try{await navigator.clipboard.writeText(x)}catch{}n(!0),window.setTimeout(()=>n(!1),1600)};return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{c.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".hero-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".hero-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".hero-sub",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".hero-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".hero-install",{y:16,opacity:0},{y:0,opacity:1,duration:.48},"-=0.2");const m=c.timeline({delay:.35,defaults:{ease:"precise"}});m.fromTo(".hero-plate",{y:24,opacity:0},{y:0,opacity:1,duration:.64}),c.utils.toArray(".spec-row").forEach((l,g)=>{const h=.64+g*.09;m.fromTo(l,{y:12,opacity:0},{y:0,opacity:1,duration:.4},h);const u=l.querySelector(".spec-num");u&&m.add(()=>{k(u,Number(u.dataset.end),Number(u.dataset.decimals))},h+.1)}),c.fromTo(".hero-ornament .draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:1.2,delay:.6,ease:"precise"})})},{scope:r}),t("section",{"code-path":"src/components/home/Hero.tsx:108:5",ref:r,id:"top","aria-labelledby":"hero-title",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/Hero.tsx:116:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/Hero.tsx:122:7",className:"container-fk relative grid gap-16 pb-24 pt-28 lg:grid-cols-12 lg:gap-10",children:[t("div",{"code-path":"src/components/home/Hero.tsx:124:9",className:"min-w-0 lg:col-span-7",children:[t("p",{"code-path":"src/components/home/Hero.tsx:125:11",className:"hero-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[e(f,{"code-path":"src/components/home/Hero.tsx:126:13",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"forgekit v0.27.0 · MIT · zero runtime dependencies"]}),e("h1",{"code-path":"src/components/home/Hero.tsx:130:11",id:"hero-title",className:"mt-6 font-display text-[clamp(2.75rem,6vw,3.815rem)] font-medium leading-[1.02] tracking-h-display text-ink",children:b.map((s,a)=>t(T,{"code-path":"src/components/home/Hero.tsx:135:15",children:[e("span",{"code-path":"src/components/home/Hero.tsx:136:17",className:"hero-word inline-block will-change-transform",children:s}),a<b.length-1?" ":null]},a))}),e("p",{"code-path":"src/components/home/Hero.tsx:142:11",className:"hero-sub mt-6 max-w-[620px] text-fs-1 font-normal text-ink-2",children:"forgekit turns one source of truth into native configuration for AI coding tools, then adds proof-carrying lessons, blast-radius prediction, reuse search, and pre-action guardrails — so agents act from shared evidence instead of fresh guesses."}),t("div",{"code-path":"src/components/home/Hero.tsx:149:11",className:"mt-8 flex flex-wrap items-center gap-3",children:[e("a",{"code-path":"src/components/home/Hero.tsx:150:13",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`hero-cta ${E}`,children:"Read the docs"}),e("a",{"code-path":"src/components/home/Hero.tsx:158:13",href:"#workflow",className:`hero-cta ${A}`,children:"See the workflow"})]}),t("div",{"code-path":"src/components/home/Hero.tsx:164:11",className:"hero-install mt-8 flex max-w-[620px] items-center justify-between gap-4 rounded-chip border border-hairline bg-paper-sunk px-4 py-3.5",children:[t("code",{"code-path":"src/components/home/Hero.tsx:165:13",className:"overflow-x-auto whitespace-nowrap font-mono text-[14px] text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:166:15",className:"mr-2 text-signal-strong",children:"$"}),x]}),t("button",{"code-path":"src/components/home/Hero.tsx:169:13",type:"button",onClick:i,className:"micro-label flex shrink-0 items-center gap-1.5 text-ink-3 transition-colors duration-fast ease-out-soft hover:text-ink","aria-label":"Copy install command",children:[o?e(C,{"code-path":"src/components/home/Hero.tsx:176:17",size:14,strokeWidth:1.5,"aria-hidden":"true",className:"text-pass"}):e(P,{"code-path":"src/components/home/Hero.tsx:178:17",size:14,strokeWidth:1.5,"aria-hidden":"true"}),o?"COPIED":"COPY"]}),e("span",{"code-path":"src/components/home/Hero.tsx:182:13","aria-live":"polite",className:"sr-only",children:o?"Install command copied":""})]})]}),t("div",{"code-path":"src/components/home/Hero.tsx:189:9",className:"relative min-w-0 lg:col-span-5",children:[e("svg",{"code-path":"src/components/home/Hero.tsx:191:11","aria-hidden":"true",viewBox:"0 0 120 120",width:"120",height:"120",fill:"none",className:"hero-ornament absolute -right-12 -top-12 z-0 text-signal opacity-[0.18]",children:t("g",{"code-path":"src/components/home/Hero.tsx:199:13",stroke:"currentColor",strokeWidth:"1",strokeLinejoin:"miter",children:[e("path",{"code-path":"src/components/home/Hero.tsx:200:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M21.11 21.11 h77.78 v77.78 h-77.78 Z"}),e("path",{"code-path":"src/components/home/Hero.tsx:201:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M115 60 L60 5 L5 60 L60 115 Z"})]})}),t("div",{"code-path":"src/components/home/Hero.tsx:205:11",className:"hero-plate relative z-10 rounded-plate border border-hairline-strong bg-paper-raised p-7 shadow-e1 transition-[transform,box-shadow] duration-fast ease-out-soft hover:-translate-y-0.5 hover:shadow-e2",children:[t("p",{"code-path":"src/components/home/Hero.tsx:206:13",className:"micro-label flex items-center gap-2.5 text-ink-3",children:[e(f,{"code-path":"src/components/home/Hero.tsx:207:15",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"SPEC SHEET — FORGE SUBSTRATE"]}),e("dl",{"code-path":"src/components/home/Hero.tsx:210:13",className:"mt-5 divide-y divide-hairline border-y border-hairline",children:L.map(s=>t("div",{"code-path":"src/components/home/Hero.tsx:212:17",className:"spec-row flex items-baseline justify-between gap-4 py-3.5",children:[e("dt",{"code-path":"src/components/home/Hero.tsx:216:19",className:"micro-label text-ink-3",children:s.label}),t("dd",{"code-path":"src/components/home/Hero.tsx:217:19",className:"font-mono text-fs-1 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:218:21",className:"spec-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&e("span",{"code-path":"src/components/home/Hero.tsx:226:23",className:"ml-1 text-[0.65em] font-medium text-ink-3",children:s.unit})]})]},s.label))}),e("p",{"code-path":"src/components/home/Hero.tsx:234:13",className:"mt-4 font-mono text-micro lowercase text-ink-3",children:"sources: reports/benchmarks.md · package.json"})]})]})]})]})}const I=["one context window","wiped every call","no memory","no foresight"],M=[{term:"memory",gloss:"proof-carrying, team-shared"},{term:"foresight",gloss:"predicts an edit's blast radius"},{term:"guardrails",gloss:"enforced hooks, not prose"},{term:"one config"}],O=["Claude Code","Codex","Cursor","Gemini","Aider","Copilot","Windsurf","Zed","Continue","+ MCP"],_=D(function(){return e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:31:5","aria-hidden":"true",className:"animate-gate-pulse pointer-events-none absolute left-1/2 top-1/2 h-4 w-4 -translate-x-1/2 -translate-y-1/2 rounded-full border border-signal-bright"})});function J(){const r=d(null),[o,n]=y(!1);p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const a=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0},onComplete:()=>n(!0)});a.fromTo(".d-head",{y:16,opacity:0},{y:0,opacity:1,duration:.48}),a.fromTo(".d-left",{y:24,opacity:0},{y:0,opacity:1,duration:.56},.1),a.fromTo(".d-left-row",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.07},.35),a.fromTo(".gate-line-a, .gate-line-b",{strokeDashoffset:1},{strokeDashoffset:0,duration:.7},.5),a.fromTo(".d-glyph-wrap",{scale:.6,opacity:0},{scale:1,opacity:1,duration:.32},.92),a.fromTo(".d-gate-label",{opacity:0},{opacity:1,duration:.32},.95),a.fromTo(".gate-arrow",{opacity:0},{opacity:1,duration:.16},1.2),a.fromTo(".d-right",{y:24,opacity:0},{y:0,opacity:1,duration:.56},1),c.utils.toArray(".d-right-row").forEach((m,l)=>{const g=1.25+l*.08;a.fromTo(m,{y:12,opacity:0},{y:0,opacity:1,duration:.4},g);const h=m.querySelector(".d-star");h&&a.fromTo(h,{rotate:0},{rotate:45,duration:.32},g+.08)}),a.fromTo(".d-tools-label",{opacity:0},{opacity:1,duration:.4},1.6),a.fromTo(".d-tool",{y:8,opacity:0},{y:0,opacity:1,duration:.5,stagger:.04},1.7),a.fromTo([".d-caption",".d-foot"],{y:12,opacity:0},{y:0,opacity:1,duration:.48,stagger:.09},2.2),a.fromTo(".arc-draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:.9},2.7),a.fromTo(".arc-arrow",{opacity:0},{opacity:1,duration:.2},3.55)})},{scope:r});const i=t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:130:5",className:"d-glyph-wrap relative inline-flex",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:131:7",size:18,strokeWidth:1.5,className:"text-signal-bright"}),o&&e(_,{"code-path":"src/components/home/SubstrateDiagram.tsx:132:19"})]});return t("section",{"code-path":"src/components/home/SubstrateDiagram.tsx:137:5",ref:r,"aria-labelledby":"diagram-title",className:"relative overflow-hidden border-b border-hairline-on-ink bg-ink text-paper-on-ink",children:[e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:143:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04]",style:{backgroundImage:"url('/girih-lattice-ink.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:149:7",className:"container-fk relative py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:151:9",className:"d-head flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:152:11",id:"diagram-title",className:"micro-label text-signal-bright",children:"ONE BRAIN FOR EVERY AI CODING AGENT"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:155:11",className:"font-mono text-micro text-paper-on-ink-3",children:"FIG. 1"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:159:9",className:"relative mt-12 lg:pb-16",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:160:11",className:"flex flex-col items-stretch lg:flex-row lg:items-center",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:162:13",className:"d-left rounded-card border border-hairline-on-ink bg-[rgba(245,242,234,0.03)] p-6 lg:flex-[4]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:163:15",className:"micro-label text-paper-on-ink-2",children:"BEFORE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:164:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"stateless model."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:167:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:I.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:169:19",className:"d-left-row flex items-center gap-3 py-3",children:[e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:170:21","aria-hidden":"true",className:"h-1.5 w-1.5 shrink-0 border border-[rgba(245,242,234,0.35)]"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:174:21",className:"text-small font-normal text-paper-on-ink-2",children:s})]},s))})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:181:13",className:"d-gate hidden flex-col items-center self-center lg:flex lg:flex-[1]",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:182:15",className:"relative flex w-full items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:183:17",viewBox:"0 0 96 20",preserveAspectRatio:"none",className:"h-5 w-full",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:190:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1","vector-effect":"non-scaling-stroke",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:191:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M0 10 L34 10"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:192:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M62 10 L90 10"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:194:19",className:"gate-arrow",d:"M90 10 l-5 -3 M90 10 l-5 3",stroke:"#F5F2EA",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:203:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 bg-transparent px-1",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:207:15",className:"d-gate-label micro-label mt-2 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:211:13",className:"d-gate flex flex-col items-center self-center py-2 lg:hidden",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:212:15",className:"relative flex h-24 items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:213:17",viewBox:"0 0 20 96",className:"h-24 w-5",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:214:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:215:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M10 0 L10 34"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:216:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M10 62 L10 90"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:218:19",className:"gate-arrow",d:"M10 90 l-3 -5 M10 90 l3 -5",stroke:"#F5F2EA",strokeWidth:"1",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:226:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:230:15",className:"d-gate-label micro-label mt-1 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:234:13",className:"d-right rounded-card border border-[rgba(217,72,15,0.45)] bg-[rgba(217,72,15,0.06)] p-6 transition-colors duration-fast ease-out-soft hover:border-[rgba(217,72,15,0.8)] lg:flex-[7]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:235:15",className:"micro-label text-signal-bright",children:"AFTER — THE COGNITIVE SUBSTRATE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:236:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"the cognitive substrate."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:239:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:M.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:241:19",className:"d-right-row flex items-baseline gap-3 py-3",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:242:21",size:10,strokeWidth:1.5,className:"d-star shrink-0 self-center text-signal-bright"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:247:21",className:"text-small font-semibold text-paper-on-ink",children:s.term}),s.gloss&&t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:249:23",className:"text-small font-normal text-paper-on-ink-2",children:["— ",s.gloss]})]},s.term))})]})]}),t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:260:11","aria-hidden":"true",viewBox:"0 0 1120 56",preserveAspectRatio:"none",className:"pointer-events-none absolute -bottom-2 left-0 hidden h-14 w-full lg:block",fill:"none",children:[e("defs",{"code-path":"src/components/home/SubstrateDiagram.tsx:267:13",children:e("mask",{"code-path":"src/components/home/SubstrateDiagram.tsx:268:15",id:"arc-reveal",maskUnits:"userSpaceOnUse",x:"0",y:"0",width:"1120",height:"56",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:269:17",className:"arc-draw",d:"M950 0 C950 48, 170 48, 170 6",stroke:"#fff",strokeWidth:"2",pathLength:1,strokeDasharray:1,"vector-effect":"non-scaling-stroke"})})}),e("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:280:13",mask:"url(#arc-reveal)",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:281:15",d:"M950 0 C950 48, 170 48, 170 6",stroke:"rgba(245,242,234,0.07)",strokeWidth:"1",strokeDasharray:"4 4","vector-effect":"non-scaling-stroke"})}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:289:13",className:"arc-arrow",d:"M170 6 l-4 7 M170 6 l4 7",stroke:"rgba(245,242,234,0.2)",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:301:9",className:"mt-14 lg:mt-8",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:302:11",className:"d-tools-label micro-label text-paper-on-ink-2",children:"COMPILES TO NATIVE CONFIG FOR"}),e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:305:11",className:"mt-4 grid grid-cols-2 gap-px rounded-card border border-hairline-on-ink bg-hairline-on-ink sm:grid-cols-5 lg:grid-cols-10",children:O.map(s=>e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:307:15",className:"d-tool bg-ink px-2 py-3 text-center font-mono text-micro font-medium uppercase tracking-chip text-paper-on-ink-2 transition-colors duration-fast ease-out-soft hover:bg-[#24221D] hover:text-paper-on-ink",children:s},s))})]}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:317:9",className:"d-caption mt-8 text-center text-small font-normal text-paper-on-ink-2",children:"every task passes a fast gate · every verified outcome flows back into the shared memory"}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:320:9",className:"d-foot mt-3 text-center font-mono text-micro text-paper-on-ink-3",children:"author once · zero runtime dependencies · plain-git team memory"})]})]})}const B=[{tag:"measured",tagLabel:"MEASURED",end:118,decimals:0,unit:"ms",label:"full pre-action gate",source:"reports/benchmarks.md"},{tag:"measured",tagLabel:"MEASURED",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",source:"reports/benchmarks.md"},{tag:"prototype",tagLabel:"REFUTED DEMO",end:20.2,decimals:1,unit:"%",label:"more routing cost than always-premium, 80 held-out tasks",source:"research/empirical-refutation"},{tag:"manifest",tagLabel:"MANIFEST",end:0,decimals:0,unit:"",label:"runtime dependencies",source:"package.json"}];function Q(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo(".stats-intro",{y:20,opacity:0},{y:0,opacity:1,duration:.48}),c.utils.toArray(".stat-cell").forEach((i,s)=>{const a=.2+s*.08;n.fromTo(i.querySelector(".stat-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},a),n.fromTo(i,{y:20,opacity:0},{y:0,opacity:1,duration:.56},a+.06);const m=i.querySelector(".stat-num");m&&n.add(()=>{k(m,Number(m.dataset.end),Number(m.dataset.decimals))},a+.12)})})},{scope:r}),t("section",{"code-path":"src/components/home/StatsBand.tsx:95:5",ref:r,"aria-label":"Measured metrics",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/StatsBand.tsx:101:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_0%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/StatsBand.tsx:107:7",className:"container-fk relative py-14 md:py-[72px]",children:[e("p",{"code-path":"src/components/home/StatsBand.tsx:108:9",className:"stats-intro mb-10 max-w-[720px] text-fs-1 font-normal text-ink-2",children:"One substrate — memory, foresight, guardrails — compiled to native config for every agent your team already runs."}),e("div",{"code-path":"src/components/home/StatsBand.tsx:114:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-2 lg:grid-cols-4",children:B.map(o=>t("div",{"code-path":"src/components/home/StatsBand.tsx:116:13",className:"stat-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:120:15",className:"stat-tag inline-block",children:e(W,{"code-path":"src/components/home/StatsBand.tsx:121:17",variant:o.tag,label:o.tagLabel})}),t("p",{"code-path":"src/components/home/StatsBand.tsx:123:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:124:17",className:"stat-num","data-end":o.end,"data-decimals":o.decimals,children:o.end.toFixed(o.decimals)}),o.unit&&e("span",{"code-path":"src/components/home/StatsBand.tsx:132:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:o.unit})]}),e("p",{"code-path":"src/components/home/StatsBand.tsx:135:15",className:"mt-2 text-small font-medium text-ink-2",children:o.label}),t(S,{"code-path":"src/components/home/StatsBand.tsx:136:15",children:[e(v,{"code-path":"src/components/home/StatsBand.tsx:137:17",asChild:!0,children:e("p",{"code-path":"src/components/home/StatsBand.tsx:138:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:o.source})}),e(N,{"code-path":"src/components/home/StatsBand.tsx:145:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},o.label))})]})]})}const G=[{index:"01",title:"Cross-tool config",body:"Author rules once, then compile native config layers for the agents your team already uses."},{index:"02",title:"Proof-carrying memory",body:"Every durable lesson carries evidence, provenance, confidence, decay, and merge behavior."},{index:"03",title:"Impact foresight",body:"Before editing, Forge predicts affected files and tests so agents plan smaller, safer changes."},{index:"04",title:"Reuse-first retrieval",body:"Agents are pushed toward existing code paths and prior fixes before inventing another solution."},{index:"05",title:"Guardrails that run",body:"Scope, assumptions, anchoring, cost, and secret-redaction checks are enforced by CLI hooks."},{index:"06",title:"Team memory through git",body:"Knowledge moves with the repository, not with a single chat transcript or vendor workspace."}];function ee(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo([".plat-eyebrow",".plat-h2",".plat-note"],{y:20,opacity:0},{y:0,opacity:1,duration:.56,stagger:.08}),c.utils.toArray(".plat-card").forEach((i,s)=>{const a=.3+s*.07;n.fromTo(i,{y:24,opacity:0},{y:0,opacity:1,duration:.56},a);const m=i.querySelector(".spec-star");m&&n.fromTo(m,{rotate:0},{rotate:45,duration:.32},a+.2)})})},{scope:r}),e("section",{"code-path":"src/components/home/PlatformSection.tsx:70:5",ref:r,id:"platform","aria-labelledby":"platform-title",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/home/PlatformSection.tsx:76:7",className:"container-fk py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/PlatformSection.tsx:77:9",className:"plat-eyebrow flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/PlatformSection.tsx:78:11",className:"micro-label text-signal-strong",children:"Platform"}),e("span",{"code-path":"src/components/home/PlatformSection.tsx:79:11",className:"font-mono text-micro text-ink-3",children:"§ 01"})]}),e("h2",{"code-path":"src/components/home/PlatformSection.tsx:81:9",id:"platform-title",className:"plat-h2 mt-4 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"A cognitive substrate, packaged like developer tooling."}),t("p",{"code-path":"src/components/home/PlatformSection.tsx:87:9",className:"plat-note mt-4 max-w-[680px] text-base font-normal text-ink-2",children:["Every claim here is repository-backed: ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:88:50",className:"code-chip",children:"README"}),","," ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:89:11",className:"code-chip",children:"CHANGELOG"}),", package metadata, benchmark reports, and optional GitHub counters on the status page. No mock marketing data."]}),e("div",{"code-path":"src/components/home/PlatformSection.tsx:93:9",className:"mt-12 grid gap-4 md:grid-cols-2 lg:grid-cols-3",children:G.map(o=>e(w,{"code-path":"src/components/home/PlatformSection.tsx:95:13",index:o.index,title:o.title,className:"plat-card",children:o.body},o.index))})]})})}const F=[{num:"01",title:"Initialize the substrate",body:"Run the installer to generate project-local agent instructions, hooks, and memory stores."},{num:"02",title:"Let agents plan with evidence",body:"Forge assembles context, reuse candidates, assumptions, scope, and impact predictions before edits."},{num:"03",title:"Promote only verified lessons",body:"Tests and human corrections update memory; self-graded claims never become trusted facts."}],j=`$ forge substrate "Change auth validation and update tests"
 ✓ loaded team rules from AGENTS.md
 ✓ found reuse candidates before implementation
 ✓ predicted blast radius and test targets
diff --git a/landing/assets/c-home-P-c6ELPs.js b/landing/assets/c-home-P-c6ELPs.js
index 8deb829c..2d0da86d 100644
--- a/landing/assets/c-home-P-c6ELPs.js
+++ b/landing/assets/c-home-P-c6ELPs.js
@@ -1,4 +1,4 @@
-import{jsxs as t,jsx as e}from"react/jsx-runtime";import{useRef as d,useState as y,Fragment as T,memo as D}from"react";import{c as k,K as f,b as E,a as A,H as W,T as S,d as v,e as N,S as w,f as H}from"./c-core-YZbvYLvb.js";import{u as p}from"./v-gsap-react-CvXmapK9.js";import{C,a as P,A as R}from"./v-lucide-react-D7AUp8l6.js";import c from"gsap";const x="npm install -g @codewithjuber/forgekit && forge init",b=["Give","every","coding","agent","the","same","working","memory."],L=[{label:"PRE-ACTION GATE",end:118,decimals:0,unit:"ms"},{label:"BLAST-RADIUS LOOKUP",end:.43,decimals:2,unit:"ms"},{label:"ROUTING COST SAVED",end:62.1,decimals:1,unit:"%"},{label:"RUNTIME DEPS",end:0,decimals:0,unit:""}];function Z(){const r=d(null),[o,n]=y(!1),i=async()=>{try{await navigator.clipboard.writeText(x)}catch{}n(!0),window.setTimeout(()=>n(!1),1600)};return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{c.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".hero-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".hero-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".hero-sub",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".hero-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".hero-install",{y:16,opacity:0},{y:0,opacity:1,duration:.48},"-=0.2");const m=c.timeline({delay:.35,defaults:{ease:"precise"}});m.fromTo(".hero-plate",{y:24,opacity:0},{y:0,opacity:1,duration:.64}),c.utils.toArray(".spec-row").forEach((l,g)=>{const h=.64+g*.09;m.fromTo(l,{y:12,opacity:0},{y:0,opacity:1,duration:.4},h);const u=l.querySelector(".spec-num");u&&m.add(()=>{k(u,Number(u.dataset.end),Number(u.dataset.decimals))},h+.1)}),c.fromTo(".hero-ornament .draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:1.2,delay:.6,ease:"precise"})})},{scope:r}),t("section",{"code-path":"src/components/home/Hero.tsx:108:5",ref:r,id:"top","aria-labelledby":"hero-title",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/Hero.tsx:116:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/Hero.tsx:122:7",className:"container-fk relative grid gap-16 pb-24 pt-28 lg:grid-cols-12 lg:gap-10",children:[t("div",{"code-path":"src/components/home/Hero.tsx:124:9",className:"min-w-0 lg:col-span-7",children:[t("p",{"code-path":"src/components/home/Hero.tsx:125:11",className:"hero-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[e(f,{"code-path":"src/components/home/Hero.tsx:126:13",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"forgekit v0.27.0 · MIT · zero runtime dependencies"]}),e("h1",{"code-path":"src/components/home/Hero.tsx:130:11",id:"hero-title",className:"mt-6 font-display text-[clamp(2.75rem,6vw,3.815rem)] font-medium leading-[1.02] tracking-h-display text-ink",children:b.map((s,a)=>t(T,{"code-path":"src/components/home/Hero.tsx:135:15",children:[e("span",{"code-path":"src/components/home/Hero.tsx:136:17",className:"hero-word inline-block will-change-transform",children:s}),a<b.length-1?" ":null]},a))}),e("p",{"code-path":"src/components/home/Hero.tsx:142:11",className:"hero-sub mt-6 max-w-[620px] text-fs-1 font-normal text-ink-2",children:"forgekit turns one source of truth into native configuration for AI coding tools, then adds proof-carrying lessons, blast-radius prediction, reuse search, and pre-action guardrails — so agents act from shared evidence instead of fresh guesses."}),t("div",{"code-path":"src/components/home/Hero.tsx:149:11",className:"mt-8 flex flex-wrap items-center gap-3",children:[e("a",{"code-path":"src/components/home/Hero.tsx:150:13",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`hero-cta ${E}`,children:"Read the docs"}),e("a",{"code-path":"src/components/home/Hero.tsx:158:13",href:"#workflow",className:`hero-cta ${A}`,children:"See the workflow"})]}),t("div",{"code-path":"src/components/home/Hero.tsx:164:11",className:"hero-install mt-8 flex max-w-[620px] items-center justify-between gap-4 rounded-chip border border-hairline bg-paper-sunk px-4 py-3.5",children:[t("code",{"code-path":"src/components/home/Hero.tsx:165:13",className:"overflow-x-auto whitespace-nowrap font-mono text-[14px] text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:166:15",className:"mr-2 text-signal-strong",children:"$"}),x]}),t("button",{"code-path":"src/components/home/Hero.tsx:169:13",type:"button",onClick:i,className:"micro-label flex shrink-0 items-center gap-1.5 text-ink-3 transition-colors duration-fast ease-out-soft hover:text-ink","aria-label":"Copy install command",children:[o?e(C,{"code-path":"src/components/home/Hero.tsx:176:17",size:14,strokeWidth:1.5,"aria-hidden":"true",className:"text-pass"}):e(P,{"code-path":"src/components/home/Hero.tsx:178:17",size:14,strokeWidth:1.5,"aria-hidden":"true"}),o?"COPIED":"COPY"]}),e("span",{"code-path":"src/components/home/Hero.tsx:182:13","aria-live":"polite",className:"sr-only",children:o?"Install command copied":""})]})]}),t("div",{"code-path":"src/components/home/Hero.tsx:189:9",className:"relative min-w-0 lg:col-span-5",children:[e("svg",{"code-path":"src/components/home/Hero.tsx:191:11","aria-hidden":"true",viewBox:"0 0 120 120",width:"120",height:"120",fill:"none",className:"hero-ornament absolute -right-12 -top-12 z-0 text-signal opacity-[0.18]",children:t("g",{"code-path":"src/components/home/Hero.tsx:199:13",stroke:"currentColor",strokeWidth:"1",strokeLinejoin:"miter",children:[e("path",{"code-path":"src/components/home/Hero.tsx:200:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M21.11 21.11 h77.78 v77.78 h-77.78 Z"}),e("path",{"code-path":"src/components/home/Hero.tsx:201:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M115 60 L60 5 L5 60 L60 115 Z"})]})}),t("div",{"code-path":"src/components/home/Hero.tsx:205:11",className:"hero-plate relative z-10 rounded-plate border border-hairline-strong bg-paper-raised p-7 shadow-e1 transition-[transform,box-shadow] duration-fast ease-out-soft hover:-translate-y-0.5 hover:shadow-e2",children:[t("p",{"code-path":"src/components/home/Hero.tsx:206:13",className:"micro-label flex items-center gap-2.5 text-ink-3",children:[e(f,{"code-path":"src/components/home/Hero.tsx:207:15",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"SPEC SHEET — FORGE SUBSTRATE"]}),e("dl",{"code-path":"src/components/home/Hero.tsx:210:13",className:"mt-5 divide-y divide-hairline border-y border-hairline",children:L.map(s=>t("div",{"code-path":"src/components/home/Hero.tsx:212:17",className:"spec-row flex items-baseline justify-between gap-4 py-3.5",children:[e("dt",{"code-path":"src/components/home/Hero.tsx:216:19",className:"micro-label text-ink-3",children:s.label}),t("dd",{"code-path":"src/components/home/Hero.tsx:217:19",className:"font-mono text-fs-1 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:218:21",className:"spec-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&e("span",{"code-path":"src/components/home/Hero.tsx:226:23",className:"ml-1 text-[0.65em] font-medium text-ink-3",children:s.unit})]})]},s.label))}),e("p",{"code-path":"src/components/home/Hero.tsx:234:13",className:"mt-4 font-mono text-micro lowercase text-ink-3",children:"sources: reports/benchmarks.md · package.json"})]})]})]})]})}const I=["one context window","wiped every call","no memory","no foresight"],M=[{term:"memory",gloss:"proof-carrying, team-shared"},{term:"foresight",gloss:"predicts an edit's blast radius"},{term:"guardrails",gloss:"enforced hooks, not prose"},{term:"one config"}],O=["Claude Code","Codex","Cursor","Gemini","Aider","Copilot","Windsurf","Zed","Continue","+ MCP"],_=D(function(){return e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:31:5","aria-hidden":"true",className:"animate-gate-pulse pointer-events-none absolute left-1/2 top-1/2 h-4 w-4 -translate-x-1/2 -translate-y-1/2 rounded-full border border-signal-bright"})});function J(){const r=d(null),[o,n]=y(!1);p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const a=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0},onComplete:()=>n(!0)});a.fromTo(".d-head",{y:16,opacity:0},{y:0,opacity:1,duration:.48}),a.fromTo(".d-left",{y:24,opacity:0},{y:0,opacity:1,duration:.56},.1),a.fromTo(".d-left-row",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.07},.35),a.fromTo(".gate-line-a, .gate-line-b",{strokeDashoffset:1},{strokeDashoffset:0,duration:.7},.5),a.fromTo(".d-glyph-wrap",{scale:.6,opacity:0},{scale:1,opacity:1,duration:.32},.92),a.fromTo(".d-gate-label",{opacity:0},{opacity:1,duration:.32},.95),a.fromTo(".gate-arrow",{opacity:0},{opacity:1,duration:.16},1.2),a.fromTo(".d-right",{y:24,opacity:0},{y:0,opacity:1,duration:.56},1),c.utils.toArray(".d-right-row").forEach((m,l)=>{const g=1.25+l*.08;a.fromTo(m,{y:12,opacity:0},{y:0,opacity:1,duration:.4},g);const h=m.querySelector(".d-star");h&&a.fromTo(h,{rotate:0},{rotate:45,duration:.32},g+.08)}),a.fromTo(".d-tools-label",{opacity:0},{opacity:1,duration:.4},1.6),a.fromTo(".d-tool",{y:8,opacity:0},{y:0,opacity:1,duration:.5,stagger:.04},1.7),a.fromTo([".d-caption",".d-foot"],{y:12,opacity:0},{y:0,opacity:1,duration:.48,stagger:.09},2.2),a.fromTo(".arc-draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:.9},2.7),a.fromTo(".arc-arrow",{opacity:0},{opacity:1,duration:.2},3.55)})},{scope:r});const i=t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:130:5",className:"d-glyph-wrap relative inline-flex",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:131:7",size:18,strokeWidth:1.5,className:"text-signal-bright"}),o&&e(_,{"code-path":"src/components/home/SubstrateDiagram.tsx:132:19"})]});return t("section",{"code-path":"src/components/home/SubstrateDiagram.tsx:137:5",ref:r,"aria-labelledby":"diagram-title",className:"relative overflow-hidden border-b border-hairline-on-ink bg-ink text-paper-on-ink",children:[e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:143:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice-ink.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:149:7",className:"container-fk relative py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:151:9",className:"d-head flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:152:11",id:"diagram-title",className:"micro-label text-signal-bright",children:"ONE BRAIN FOR EVERY AI CODING AGENT"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:155:11",className:"font-mono text-micro text-paper-on-ink-3",children:"FIG. 1"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:159:9",className:"relative mt-12 lg:pb-16",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:160:11",className:"flex flex-col items-stretch lg:flex-row lg:items-center",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:162:13",className:"d-left rounded-card border border-hairline-on-ink bg-[rgba(245,242,234,0.03)] p-6 lg:flex-[4]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:163:15",className:"micro-label text-paper-on-ink-2",children:"BEFORE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:164:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"stateless model."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:167:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:I.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:169:19",className:"d-left-row flex items-center gap-3 py-3",children:[e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:170:21","aria-hidden":"true",className:"h-1.5 w-1.5 shrink-0 border border-[rgba(245,242,234,0.35)]"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:174:21",className:"text-small font-normal text-paper-on-ink-2",children:s})]},s))})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:181:13",className:"d-gate hidden flex-col items-center self-center lg:flex lg:flex-[1]",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:182:15",className:"relative flex w-full items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:183:17",viewBox:"0 0 96 20",preserveAspectRatio:"none",className:"h-5 w-full",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:190:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1","vector-effect":"non-scaling-stroke",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:191:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M0 10 L34 10"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:192:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M62 10 L90 10"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:194:19",className:"gate-arrow",d:"M90 10 l-5 -3 M90 10 l-5 3",stroke:"#F5F2EA",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:203:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 bg-transparent px-1",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:207:15",className:"d-gate-label micro-label mt-2 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:211:13",className:"d-gate flex flex-col items-center self-center py-2 lg:hidden",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:212:15",className:"relative flex h-24 items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:213:17",viewBox:"0 0 20 96",className:"h-24 w-5",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:214:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:215:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M10 0 L10 34"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:216:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M10 62 L10 90"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:218:19",className:"gate-arrow",d:"M10 90 l-3 -5 M10 90 l3 -5",stroke:"#F5F2EA",strokeWidth:"1",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:226:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:230:15",className:"d-gate-label micro-label mt-1 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:234:13",className:"d-right rounded-card border border-[rgba(217,72,15,0.45)] bg-[rgba(217,72,15,0.06)] p-6 transition-colors duration-fast ease-out-soft hover:border-[rgba(217,72,15,0.8)] lg:flex-[7]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:235:15",className:"micro-label text-signal-bright",children:"AFTER — THE COGNITIVE SUBSTRATE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:236:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"the cognitive substrate."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:239:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:M.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:241:19",className:"d-right-row flex items-baseline gap-3 py-3",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:242:21",size:10,strokeWidth:1.5,className:"d-star shrink-0 self-center text-signal-bright"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:247:21",className:"text-small font-semibold text-paper-on-ink",children:s.term}),s.gloss&&t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:249:23",className:"text-small font-normal text-paper-on-ink-2",children:["— ",s.gloss]})]},s.term))})]})]}),t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:260:11","aria-hidden":"true",viewBox:"0 0 1120 56",preserveAspectRatio:"none",className:"pointer-events-none absolute -bottom-2 left-0 hidden h-14 w-full lg:block",fill:"none",children:[e("defs",{"code-path":"src/components/home/SubstrateDiagram.tsx:267:13",children:e("mask",{"code-path":"src/components/home/SubstrateDiagram.tsx:268:15",id:"arc-reveal",maskUnits:"userSpaceOnUse",x:"0",y:"0",width:"1120",height:"56",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:269:17",className:"arc-draw",d:"M950 0 C950 48, 170 48, 170 6",stroke:"#fff",strokeWidth:"2",pathLength:1,strokeDasharray:1,"vector-effect":"non-scaling-stroke"})})}),e("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:280:13",mask:"url(#arc-reveal)",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:281:15",d:"M950 0 C950 48, 170 48, 170 6",stroke:"rgba(245,242,234,0.07)",strokeWidth:"1",strokeDasharray:"4 4","vector-effect":"non-scaling-stroke"})}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:289:13",className:"arc-arrow",d:"M170 6 l-4 7 M170 6 l4 7",stroke:"rgba(245,242,234,0.2)",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:301:9",className:"mt-14 lg:mt-8",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:302:11",className:"d-tools-label micro-label text-paper-on-ink-2",children:"COMPILES TO NATIVE CONFIG FOR"}),e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:305:11",className:"mt-4 grid grid-cols-2 gap-px rounded-card border border-hairline-on-ink bg-hairline-on-ink sm:grid-cols-5 lg:grid-cols-10",children:O.map(s=>e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:307:15",className:"d-tool bg-ink px-2 py-3 text-center font-mono text-micro font-medium uppercase tracking-chip text-paper-on-ink-2 transition-colors duration-fast ease-out-soft hover:bg-[#24221D] hover:text-paper-on-ink",children:s},s))})]}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:317:9",className:"d-caption mt-8 text-center text-small font-normal text-paper-on-ink-2",children:"every task passes a fast gate · every verified outcome flows back into the shared memory"}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:320:9",className:"d-foot mt-3 text-center font-mono text-micro text-paper-on-ink-3",children:"author once · zero runtime dependencies · plain-git team memory"})]})]})}const B=[{tag:"measured",tagLabel:"MEASURED",end:118,decimals:0,unit:"ms",label:"full pre-action gate",source:"reports/benchmarks.md"},{tag:"measured",tagLabel:"MEASURED",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",source:"reports/benchmarks.md"},{tag:"prototype",tagLabel:"PROTOTYPE",end:62.1,decimals:1,unit:"%",label:"routing cost saved",source:"white-paper prototype"},{tag:"manifest",tagLabel:"MANIFEST",end:0,decimals:0,unit:"",label:"runtime dependencies",source:"package.json"}];function Q(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo(".stats-intro",{y:20,opacity:0},{y:0,opacity:1,duration:.48}),c.utils.toArray(".stat-cell").forEach((i,s)=>{const a=.2+s*.08;n.fromTo(i.querySelector(".stat-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},a),n.fromTo(i,{y:20,opacity:0},{y:0,opacity:1,duration:.56},a+.06);const m=i.querySelector(".stat-num");m&&n.add(()=>{k(m,Number(m.dataset.end),Number(m.dataset.decimals))},a+.12)})})},{scope:r}),t("section",{"code-path":"src/components/home/StatsBand.tsx:95:5",ref:r,"aria-label":"Measured metrics",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/StatsBand.tsx:101:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_0%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/StatsBand.tsx:107:7",className:"container-fk relative py-14 md:py-[72px]",children:[e("p",{"code-path":"src/components/home/StatsBand.tsx:108:9",className:"stats-intro mb-10 max-w-[720px] text-fs-1 font-normal text-ink-2",children:"One substrate — memory, foresight, guardrails — compiled to native config for every agent your team already runs."}),e("div",{"code-path":"src/components/home/StatsBand.tsx:114:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-2 lg:grid-cols-4",children:B.map(o=>t("div",{"code-path":"src/components/home/StatsBand.tsx:116:13",className:"stat-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:120:15",className:"stat-tag inline-block",children:e(W,{"code-path":"src/components/home/StatsBand.tsx:121:17",variant:o.tag,label:o.tagLabel})}),t("p",{"code-path":"src/components/home/StatsBand.tsx:123:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:124:17",className:"stat-num","data-end":o.end,"data-decimals":o.decimals,children:o.end.toFixed(o.decimals)}),o.unit&&e("span",{"code-path":"src/components/home/StatsBand.tsx:132:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:o.unit})]}),e("p",{"code-path":"src/components/home/StatsBand.tsx:135:15",className:"mt-2 text-small font-medium text-ink-2",children:o.label}),t(S,{"code-path":"src/components/home/StatsBand.tsx:136:15",children:[e(v,{"code-path":"src/components/home/StatsBand.tsx:137:17",asChild:!0,children:e("p",{"code-path":"src/components/home/StatsBand.tsx:138:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:o.source})}),e(N,{"code-path":"src/components/home/StatsBand.tsx:145:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},o.label))})]})]})}const G=[{index:"01",title:"Cross-tool config",body:"Author rules once, then compile native config layers for the agents your team already uses."},{index:"02",title:"Proof-carrying memory",body:"Every durable lesson carries evidence, provenance, confidence, decay, and merge behavior."},{index:"03",title:"Impact foresight",body:"Before editing, Forge predicts affected files and tests so agents plan smaller, safer changes."},{index:"04",title:"Reuse-first retrieval",body:"Agents are pushed toward existing code paths and prior fixes before inventing another solution."},{index:"05",title:"Guardrails that run",body:"Scope, assumptions, anchoring, cost, and secret-redaction checks are enforced by CLI hooks."},{index:"06",title:"Team memory through git",body:"Knowledge moves with the repository, not with a single chat transcript or vendor workspace."}];function ee(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo([".plat-eyebrow",".plat-h2",".plat-note"],{y:20,opacity:0},{y:0,opacity:1,duration:.56,stagger:.08}),c.utils.toArray(".plat-card").forEach((i,s)=>{const a=.3+s*.07;n.fromTo(i,{y:24,opacity:0},{y:0,opacity:1,duration:.56},a);const m=i.querySelector(".spec-star");m&&n.fromTo(m,{rotate:0},{rotate:45,duration:.32},a+.2)})})},{scope:r}),e("section",{"code-path":"src/components/home/PlatformSection.tsx:70:5",ref:r,id:"platform","aria-labelledby":"platform-title",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/home/PlatformSection.tsx:76:7",className:"container-fk py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/PlatformSection.tsx:77:9",className:"plat-eyebrow flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/PlatformSection.tsx:78:11",className:"micro-label text-signal-strong",children:"Platform"}),e("span",{"code-path":"src/components/home/PlatformSection.tsx:79:11",className:"font-mono text-micro text-ink-3",children:"§ 01"})]}),e("h2",{"code-path":"src/components/home/PlatformSection.tsx:81:9",id:"platform-title",className:"plat-h2 mt-4 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"A cognitive substrate, packaged like developer tooling."}),t("p",{"code-path":"src/components/home/PlatformSection.tsx:87:9",className:"plat-note mt-4 max-w-[680px] text-base font-normal text-ink-2",children:["Every claim here is repository-backed: ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:88:50",className:"code-chip",children:"README"}),","," ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:89:11",className:"code-chip",children:"CHANGELOG"}),", package metadata, benchmark reports, and optional GitHub counters on the status page. No mock marketing data."]}),e("div",{"code-path":"src/components/home/PlatformSection.tsx:93:9",className:"mt-12 grid gap-4 md:grid-cols-2 lg:grid-cols-3",children:G.map(o=>e(w,{"code-path":"src/components/home/PlatformSection.tsx:95:13",index:o.index,title:o.title,className:"plat-card",children:o.body},o.index))})]})})}const F=[{num:"01",title:"Initialize the substrate",body:"Run the installer to generate project-local agent instructions, hooks, and memory stores."},{num:"02",title:"Let agents plan with evidence",body:"Forge assembles context, reuse candidates, assumptions, scope, and impact predictions before edits."},{num:"03",title:"Promote only verified lessons",body:"Tests and human corrections update memory; self-graded claims never become trusted facts."}],j=`$ forge substrate "Change auth validation and update tests"
+import{jsxs as t,jsx as e}from"react/jsx-runtime";import{useRef as d,useState as y,Fragment as T,memo as D}from"react";import{c as k,K as f,b as E,a as A,H as W,T as S,d as v,e as N,S as w,f as H}from"./c-core-YZbvYLvb.js";import{u as p}from"./v-gsap-react-CvXmapK9.js";import{C,a as P,A as R}from"./v-lucide-react-D7AUp8l6.js";import c from"gsap";const x="npm install -g @codewithjuber/forgekit && forge init",b=["Give","every","coding","agent","the","same","working","memory."],L=[{label:"PRE-ACTION GATE",end:118,decimals:0,unit:"ms"},{label:"BLAST-RADIUS LOOKUP",end:.43,decimals:2,unit:"ms"},{label:"ROUTING COST ABOVE PREMIUM (HELD-OUT)",end:20.2,decimals:1,unit:"%"},{label:"RUNTIME DEPS",end:0,decimals:0,unit:""}];function Z(){const r=d(null),[o,n]=y(!1),i=async()=>{try{await navigator.clipboard.writeText(x)}catch{}n(!0),window.setTimeout(()=>n(!1),1600)};return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{c.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".hero-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".hero-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".hero-sub",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".hero-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".hero-install",{y:16,opacity:0},{y:0,opacity:1,duration:.48},"-=0.2");const m=c.timeline({delay:.35,defaults:{ease:"precise"}});m.fromTo(".hero-plate",{y:24,opacity:0},{y:0,opacity:1,duration:.64}),c.utils.toArray(".spec-row").forEach((l,g)=>{const h=.64+g*.09;m.fromTo(l,{y:12,opacity:0},{y:0,opacity:1,duration:.4},h);const u=l.querySelector(".spec-num");u&&m.add(()=>{k(u,Number(u.dataset.end),Number(u.dataset.decimals))},h+.1)}),c.fromTo(".hero-ornament .draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:1.2,delay:.6,ease:"precise"})})},{scope:r}),t("section",{"code-path":"src/components/home/Hero.tsx:108:5",ref:r,id:"top","aria-labelledby":"hero-title",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/Hero.tsx:116:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/Hero.tsx:122:7",className:"container-fk relative grid gap-16 pb-24 pt-28 lg:grid-cols-12 lg:gap-10",children:[t("div",{"code-path":"src/components/home/Hero.tsx:124:9",className:"min-w-0 lg:col-span-7",children:[t("p",{"code-path":"src/components/home/Hero.tsx:125:11",className:"hero-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[e(f,{"code-path":"src/components/home/Hero.tsx:126:13",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"forgekit v0.27.0 · MIT · zero runtime dependencies"]}),e("h1",{"code-path":"src/components/home/Hero.tsx:130:11",id:"hero-title",className:"mt-6 font-display text-[clamp(2.75rem,6vw,3.815rem)] font-medium leading-[1.02] tracking-h-display text-ink",children:b.map((s,a)=>t(T,{"code-path":"src/components/home/Hero.tsx:135:15",children:[e("span",{"code-path":"src/components/home/Hero.tsx:136:17",className:"hero-word inline-block will-change-transform",children:s}),a<b.length-1?" ":null]},a))}),e("p",{"code-path":"src/components/home/Hero.tsx:142:11",className:"hero-sub mt-6 max-w-[620px] text-fs-1 font-normal text-ink-2",children:"forgekit turns one source of truth into native configuration for AI coding tools, then adds proof-carrying lessons, blast-radius prediction, reuse search, and pre-action guardrails — so agents act from shared evidence instead of fresh guesses."}),t("div",{"code-path":"src/components/home/Hero.tsx:149:11",className:"mt-8 flex flex-wrap items-center gap-3",children:[e("a",{"code-path":"src/components/home/Hero.tsx:150:13",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`hero-cta ${E}`,children:"Read the docs"}),e("a",{"code-path":"src/components/home/Hero.tsx:158:13",href:"#workflow",className:`hero-cta ${A}`,children:"See the workflow"})]}),t("div",{"code-path":"src/components/home/Hero.tsx:164:11",className:"hero-install mt-8 flex max-w-[620px] items-center justify-between gap-4 rounded-chip border border-hairline bg-paper-sunk px-4 py-3.5",children:[t("code",{"code-path":"src/components/home/Hero.tsx:165:13",className:"overflow-x-auto whitespace-nowrap font-mono text-[14px] text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:166:15",className:"mr-2 text-signal-strong",children:"$"}),x]}),t("button",{"code-path":"src/components/home/Hero.tsx:169:13",type:"button",onClick:i,className:"micro-label flex shrink-0 items-center gap-1.5 text-ink-3 transition-colors duration-fast ease-out-soft hover:text-ink","aria-label":"Copy install command",children:[o?e(C,{"code-path":"src/components/home/Hero.tsx:176:17",size:14,strokeWidth:1.5,"aria-hidden":"true",className:"text-pass"}):e(P,{"code-path":"src/components/home/Hero.tsx:178:17",size:14,strokeWidth:1.5,"aria-hidden":"true"}),o?"COPIED":"COPY"]}),e("span",{"code-path":"src/components/home/Hero.tsx:182:13","aria-live":"polite",className:"sr-only",children:o?"Install command copied":""})]})]}),t("div",{"code-path":"src/components/home/Hero.tsx:189:9",className:"relative min-w-0 lg:col-span-5",children:[e("svg",{"code-path":"src/components/home/Hero.tsx:191:11","aria-hidden":"true",viewBox:"0 0 120 120",width:"120",height:"120",fill:"none",className:"hero-ornament absolute -right-12 -top-12 z-0 text-signal opacity-[0.18]",children:t("g",{"code-path":"src/components/home/Hero.tsx:199:13",stroke:"currentColor",strokeWidth:"1",strokeLinejoin:"miter",children:[e("path",{"code-path":"src/components/home/Hero.tsx:200:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M21.11 21.11 h77.78 v77.78 h-77.78 Z"}),e("path",{"code-path":"src/components/home/Hero.tsx:201:15",className:"draw",pathLength:1,strokeDasharray:1,d:"M115 60 L60 5 L5 60 L60 115 Z"})]})}),t("div",{"code-path":"src/components/home/Hero.tsx:205:11",className:"hero-plate relative z-10 rounded-plate border border-hairline-strong bg-paper-raised p-7 shadow-e1 transition-[transform,box-shadow] duration-fast ease-out-soft hover:-translate-y-0.5 hover:shadow-e2",children:[t("p",{"code-path":"src/components/home/Hero.tsx:206:13",className:"micro-label flex items-center gap-2.5 text-ink-3",children:[e(f,{"code-path":"src/components/home/Hero.tsx:207:15",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"SPEC SHEET — FORGE SUBSTRATE"]}),e("dl",{"code-path":"src/components/home/Hero.tsx:210:13",className:"mt-5 divide-y divide-hairline border-y border-hairline",children:L.map(s=>t("div",{"code-path":"src/components/home/Hero.tsx:212:17",className:"spec-row flex items-baseline justify-between gap-4 py-3.5",children:[e("dt",{"code-path":"src/components/home/Hero.tsx:216:19",className:"micro-label text-ink-3",children:s.label}),t("dd",{"code-path":"src/components/home/Hero.tsx:217:19",className:"font-mono text-fs-1 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/Hero.tsx:218:21",className:"spec-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&e("span",{"code-path":"src/components/home/Hero.tsx:226:23",className:"ml-1 text-[0.65em] font-medium text-ink-3",children:s.unit})]})]},s.label))}),e("p",{"code-path":"src/components/home/Hero.tsx:234:13",className:"mt-4 font-mono text-micro lowercase text-ink-3",children:"sources: reports/benchmarks.md · package.json"})]})]})]})]})}const I=["one context window","wiped every call","no memory","no foresight"],M=[{term:"memory",gloss:"proof-carrying, team-shared"},{term:"foresight",gloss:"predicts an edit's blast radius"},{term:"guardrails",gloss:"enforced hooks, not prose"},{term:"one config"}],O=["Claude Code","Codex","Cursor","Gemini","Aider","Copilot","Windsurf","Zed","Continue","+ MCP"],_=D(function(){return e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:31:5","aria-hidden":"true",className:"animate-gate-pulse pointer-events-none absolute left-1/2 top-1/2 h-4 w-4 -translate-x-1/2 -translate-y-1/2 rounded-full border border-signal-bright"})});function J(){const r=d(null),[o,n]=y(!1);p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const a=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0},onComplete:()=>n(!0)});a.fromTo(".d-head",{y:16,opacity:0},{y:0,opacity:1,duration:.48}),a.fromTo(".d-left",{y:24,opacity:0},{y:0,opacity:1,duration:.56},.1),a.fromTo(".d-left-row",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.07},.35),a.fromTo(".gate-line-a, .gate-line-b",{strokeDashoffset:1},{strokeDashoffset:0,duration:.7},.5),a.fromTo(".d-glyph-wrap",{scale:.6,opacity:0},{scale:1,opacity:1,duration:.32},.92),a.fromTo(".d-gate-label",{opacity:0},{opacity:1,duration:.32},.95),a.fromTo(".gate-arrow",{opacity:0},{opacity:1,duration:.16},1.2),a.fromTo(".d-right",{y:24,opacity:0},{y:0,opacity:1,duration:.56},1),c.utils.toArray(".d-right-row").forEach((m,l)=>{const g=1.25+l*.08;a.fromTo(m,{y:12,opacity:0},{y:0,opacity:1,duration:.4},g);const h=m.querySelector(".d-star");h&&a.fromTo(h,{rotate:0},{rotate:45,duration:.32},g+.08)}),a.fromTo(".d-tools-label",{opacity:0},{opacity:1,duration:.4},1.6),a.fromTo(".d-tool",{y:8,opacity:0},{y:0,opacity:1,duration:.5,stagger:.04},1.7),a.fromTo([".d-caption",".d-foot"],{y:12,opacity:0},{y:0,opacity:1,duration:.48,stagger:.09},2.2),a.fromTo(".arc-draw",{strokeDashoffset:1},{strokeDashoffset:0,duration:.9},2.7),a.fromTo(".arc-arrow",{opacity:0},{opacity:1,duration:.2},3.55)})},{scope:r});const i=t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:130:5",className:"d-glyph-wrap relative inline-flex",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:131:7",size:18,strokeWidth:1.5,className:"text-signal-bright"}),o&&e(_,{"code-path":"src/components/home/SubstrateDiagram.tsx:132:19"})]});return t("section",{"code-path":"src/components/home/SubstrateDiagram.tsx:137:5",ref:r,"aria-labelledby":"diagram-title",className:"relative overflow-hidden border-b border-hairline-on-ink bg-ink text-paper-on-ink",children:[e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:143:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice-ink.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:149:7",className:"container-fk relative py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:151:9",className:"d-head flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:152:11",id:"diagram-title",className:"micro-label text-signal-bright",children:"ONE BRAIN FOR EVERY AI CODING AGENT"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:155:11",className:"font-mono text-micro text-paper-on-ink-3",children:"FIG. 1"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:159:9",className:"relative mt-12 lg:pb-16",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:160:11",className:"flex flex-col items-stretch lg:flex-row lg:items-center",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:162:13",className:"d-left rounded-card border border-hairline-on-ink bg-[rgba(245,242,234,0.03)] p-6 lg:flex-[4]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:163:15",className:"micro-label text-paper-on-ink-2",children:"BEFORE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:164:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"stateless model."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:167:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:I.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:169:19",className:"d-left-row flex items-center gap-3 py-3",children:[e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:170:21","aria-hidden":"true",className:"h-1.5 w-1.5 shrink-0 border border-[rgba(245,242,234,0.35)]"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:174:21",className:"text-small font-normal text-paper-on-ink-2",children:s})]},s))})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:181:13",className:"d-gate hidden flex-col items-center self-center lg:flex lg:flex-[1]",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:182:15",className:"relative flex w-full items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:183:17",viewBox:"0 0 96 20",preserveAspectRatio:"none",className:"h-5 w-full",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:190:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1","vector-effect":"non-scaling-stroke",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:191:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M0 10 L34 10"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:192:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M62 10 L90 10"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:194:19",className:"gate-arrow",d:"M90 10 l-5 -3 M90 10 l-5 3",stroke:"#F5F2EA",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:203:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2 bg-transparent px-1",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:207:15",className:"d-gate-label micro-label mt-2 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:211:13",className:"d-gate flex flex-col items-center self-center py-2 lg:hidden",children:[t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:212:15",className:"relative flex h-24 items-center justify-center",children:[t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:213:17",viewBox:"0 0 20 96",className:"h-24 w-5",fill:"none","aria-hidden":"true",children:[t("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:214:19",stroke:"rgba(245,242,234,0.14)",strokeWidth:"1",children:[e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:215:21",className:"gate-line-a",pathLength:1,strokeDasharray:1,d:"M10 0 L10 34"}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:216:21",className:"gate-line-b",pathLength:1,strokeDasharray:1,d:"M10 62 L10 90"})]}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:218:19",className:"gate-arrow",d:"M10 90 l-3 -5 M10 90 l3 -5",stroke:"#F5F2EA",strokeWidth:"1",opacity:"0"})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:226:17",className:"absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2",children:i})]}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:230:15",className:"d-gate-label micro-label mt-1 text-paper-on-ink-2",children:"FAST GATE"})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:234:13",className:"d-right rounded-card border border-[rgba(217,72,15,0.45)] bg-[rgba(217,72,15,0.06)] p-6 transition-colors duration-fast ease-out-soft hover:border-[rgba(217,72,15,0.8)] lg:flex-[7]",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:235:15",className:"micro-label text-signal-bright",children:"AFTER — THE COGNITIVE SUBSTRATE"}),e("h3",{"code-path":"src/components/home/SubstrateDiagram.tsx:236:15",className:"mt-3 font-display text-fs-2 font-medium text-paper-on-ink",children:"the cognitive substrate."}),e("ul",{"code-path":"src/components/home/SubstrateDiagram.tsx:239:15",className:"mt-4 divide-y divide-hairline-on-ink border-y border-hairline-on-ink",children:M.map(s=>t("li",{"code-path":"src/components/home/SubstrateDiagram.tsx:241:19",className:"d-right-row flex items-baseline gap-3 py-3",children:[e(f,{"code-path":"src/components/home/SubstrateDiagram.tsx:242:21",size:10,strokeWidth:1.5,className:"d-star shrink-0 self-center text-signal-bright"}),e("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:247:21",className:"text-small font-semibold text-paper-on-ink",children:s.term}),s.gloss&&t("span",{"code-path":"src/components/home/SubstrateDiagram.tsx:249:23",className:"text-small font-normal text-paper-on-ink-2",children:["— ",s.gloss]})]},s.term))})]})]}),t("svg",{"code-path":"src/components/home/SubstrateDiagram.tsx:260:11","aria-hidden":"true",viewBox:"0 0 1120 56",preserveAspectRatio:"none",className:"pointer-events-none absolute -bottom-2 left-0 hidden h-14 w-full lg:block",fill:"none",children:[e("defs",{"code-path":"src/components/home/SubstrateDiagram.tsx:267:13",children:e("mask",{"code-path":"src/components/home/SubstrateDiagram.tsx:268:15",id:"arc-reveal",maskUnits:"userSpaceOnUse",x:"0",y:"0",width:"1120",height:"56",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:269:17",className:"arc-draw",d:"M950 0 C950 48, 170 48, 170 6",stroke:"#fff",strokeWidth:"2",pathLength:1,strokeDasharray:1,"vector-effect":"non-scaling-stroke"})})}),e("g",{"code-path":"src/components/home/SubstrateDiagram.tsx:280:13",mask:"url(#arc-reveal)",children:e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:281:15",d:"M950 0 C950 48, 170 48, 170 6",stroke:"rgba(245,242,234,0.07)",strokeWidth:"1",strokeDasharray:"4 4","vector-effect":"non-scaling-stroke"})}),e("path",{"code-path":"src/components/home/SubstrateDiagram.tsx:289:13",className:"arc-arrow",d:"M170 6 l-4 7 M170 6 l4 7",stroke:"rgba(245,242,234,0.2)",strokeWidth:"1","vector-effect":"non-scaling-stroke",opacity:"0"})]})]}),t("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:301:9",className:"mt-14 lg:mt-8",children:[e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:302:11",className:"d-tools-label micro-label text-paper-on-ink-2",children:"COMPILES TO NATIVE CONFIG FOR"}),e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:305:11",className:"mt-4 grid grid-cols-2 gap-px rounded-card border border-hairline-on-ink bg-hairline-on-ink sm:grid-cols-5 lg:grid-cols-10",children:O.map(s=>e("div",{"code-path":"src/components/home/SubstrateDiagram.tsx:307:15",className:"d-tool bg-ink px-2 py-3 text-center font-mono text-micro font-medium uppercase tracking-chip text-paper-on-ink-2 transition-colors duration-fast ease-out-soft hover:bg-[#24221D] hover:text-paper-on-ink",children:s},s))})]}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:317:9",className:"d-caption mt-8 text-center text-small font-normal text-paper-on-ink-2",children:"every task passes a fast gate · every verified outcome flows back into the shared memory"}),e("p",{"code-path":"src/components/home/SubstrateDiagram.tsx:320:9",className:"d-foot mt-3 text-center font-mono text-micro text-paper-on-ink-3",children:"author once · zero runtime dependencies · plain-git team memory"})]})]})}const B=[{tag:"measured",tagLabel:"MEASURED",end:118,decimals:0,unit:"ms",label:"full pre-action gate",source:"reports/benchmarks.md"},{tag:"measured",tagLabel:"MEASURED",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",source:"reports/benchmarks.md"},{tag:"prototype",tagLabel:"REFUTED DEMO",end:20.2,decimals:1,unit:"%",label:"more routing cost than always-premium, 80 held-out tasks",source:"research/empirical-refutation"},{tag:"manifest",tagLabel:"MANIFEST",end:0,decimals:0,unit:"",label:"runtime dependencies",source:"package.json"}];function Q(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo(".stats-intro",{y:20,opacity:0},{y:0,opacity:1,duration:.48}),c.utils.toArray(".stat-cell").forEach((i,s)=>{const a=.2+s*.08;n.fromTo(i.querySelector(".stat-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},a),n.fromTo(i,{y:20,opacity:0},{y:0,opacity:1,duration:.56},a+.06);const m=i.querySelector(".stat-num");m&&n.add(()=>{k(m,Number(m.dataset.end),Number(m.dataset.decimals))},a+.12)})})},{scope:r}),t("section",{"code-path":"src/components/home/StatsBand.tsx:95:5",ref:r,"aria-label":"Measured metrics",className:"relative overflow-hidden border-b border-hairline",children:[e("div",{"code-path":"src/components/home/StatsBand.tsx:101:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_0%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),t("div",{"code-path":"src/components/home/StatsBand.tsx:107:7",className:"container-fk relative py-14 md:py-[72px]",children:[e("p",{"code-path":"src/components/home/StatsBand.tsx:108:9",className:"stats-intro mb-10 max-w-[720px] text-fs-1 font-normal text-ink-2",children:"One substrate — memory, foresight, guardrails — compiled to native config for every agent your team already runs."}),e("div",{"code-path":"src/components/home/StatsBand.tsx:114:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-2 lg:grid-cols-4",children:B.map(o=>t("div",{"code-path":"src/components/home/StatsBand.tsx:116:13",className:"stat-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:120:15",className:"stat-tag inline-block",children:e(W,{"code-path":"src/components/home/StatsBand.tsx:121:17",variant:o.tag,label:o.tagLabel})}),t("p",{"code-path":"src/components/home/StatsBand.tsx:123:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[e("span",{"code-path":"src/components/home/StatsBand.tsx:124:17",className:"stat-num","data-end":o.end,"data-decimals":o.decimals,children:o.end.toFixed(o.decimals)}),o.unit&&e("span",{"code-path":"src/components/home/StatsBand.tsx:132:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:o.unit})]}),e("p",{"code-path":"src/components/home/StatsBand.tsx:135:15",className:"mt-2 text-small font-medium text-ink-2",children:o.label}),t(S,{"code-path":"src/components/home/StatsBand.tsx:136:15",children:[e(v,{"code-path":"src/components/home/StatsBand.tsx:137:17",asChild:!0,children:e("p",{"code-path":"src/components/home/StatsBand.tsx:138:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:o.source})}),e(N,{"code-path":"src/components/home/StatsBand.tsx:145:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},o.label))})]})]})}const G=[{index:"01",title:"Cross-tool config",body:"Author rules once, then compile native config layers for the agents your team already uses."},{index:"02",title:"Proof-carrying memory",body:"Every durable lesson carries evidence, provenance, confidence, decay, and merge behavior."},{index:"03",title:"Impact foresight",body:"Before editing, Forge predicts affected files and tests so agents plan smaller, safer changes."},{index:"04",title:"Reuse-first retrieval",body:"Agents are pushed toward existing code paths and prior fixes before inventing another solution."},{index:"05",title:"Guardrails that run",body:"Scope, assumptions, anchoring, cost, and secret-redaction checks are enforced by CLI hooks."},{index:"06",title:"Team memory through git",body:"Knowledge moves with the repository, not with a single chat transcript or vendor workspace."}];function ee(){const r=d(null);return p(()=>{c.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=c.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:r.current,start:"top 75%",once:!0}});n.fromTo([".plat-eyebrow",".plat-h2",".plat-note"],{y:20,opacity:0},{y:0,opacity:1,duration:.56,stagger:.08}),c.utils.toArray(".plat-card").forEach((i,s)=>{const a=.3+s*.07;n.fromTo(i,{y:24,opacity:0},{y:0,opacity:1,duration:.56},a);const m=i.querySelector(".spec-star");m&&n.fromTo(m,{rotate:0},{rotate:45,duration:.32},a+.2)})})},{scope:r}),e("section",{"code-path":"src/components/home/PlatformSection.tsx:70:5",ref:r,id:"platform","aria-labelledby":"platform-title",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/home/PlatformSection.tsx:76:7",className:"container-fk py-14 md:py-[72px] lg:py-24",children:[t("div",{"code-path":"src/components/home/PlatformSection.tsx:77:9",className:"plat-eyebrow flex items-baseline justify-between gap-4",children:[e("p",{"code-path":"src/components/home/PlatformSection.tsx:78:11",className:"micro-label text-signal-strong",children:"Platform"}),e("span",{"code-path":"src/components/home/PlatformSection.tsx:79:11",className:"font-mono text-micro text-ink-3",children:"§ 01"})]}),e("h2",{"code-path":"src/components/home/PlatformSection.tsx:81:9",id:"platform-title",className:"plat-h2 mt-4 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"A cognitive substrate, packaged like developer tooling."}),t("p",{"code-path":"src/components/home/PlatformSection.tsx:87:9",className:"plat-note mt-4 max-w-[680px] text-base font-normal text-ink-2",children:["Every claim here is repository-backed: ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:88:50",className:"code-chip",children:"README"}),","," ",e("code",{"code-path":"src/components/home/PlatformSection.tsx:89:11",className:"code-chip",children:"CHANGELOG"}),", package metadata, benchmark reports, and optional GitHub counters on the status page. No mock marketing data."]}),e("div",{"code-path":"src/components/home/PlatformSection.tsx:93:9",className:"mt-12 grid gap-4 md:grid-cols-2 lg:grid-cols-3",children:G.map(o=>e(w,{"code-path":"src/components/home/PlatformSection.tsx:95:13",index:o.index,title:o.title,className:"plat-card",children:o.body},o.index))})]})})}const F=[{num:"01",title:"Initialize the substrate",body:"Run the installer to generate project-local agent instructions, hooks, and memory stores."},{num:"02",title:"Let agents plan with evidence",body:"Forge assembles context, reuse candidates, assumptions, scope, and impact predictions before edits."},{num:"03",title:"Promote only verified lessons",body:"Tests and human corrections update memory; self-graded claims never become trusted facts."}],j=`$ forge substrate "Change auth validation and update tests"
 ✓ loaded team rules from AGENTS.md
 ✓ found reuse candidates before implementation
 ✓ predicted blast radius and test targets
diff --git a/landing/assets/c-status-BYkziZCJ.js b/landing/assets/c-status-BYkziZCJ.js
index 2850a53e..a8669526 100644
--- a/landing/assets/c-status-BYkziZCJ.js
+++ b/landing/assets/c-status-BYkziZCJ.js
@@ -1,2 +1,2 @@
-import{jsxs as a,jsx as t,Fragment as u}from"react/jsx-runtime";import{useRef as p,useEffect as k,Fragment as C}from"react";import{p as w,c as N,K as A,b as E,a as M,g as h,H as v,h as g,T as O,d as _,e as L,f as I,u as q,i as G}from"./c-core-yvMVzPz6.js";import{u as m}from"./v-gsap-react-CvXmapK9.js";import{S as D,G as W,b as j,A as T}from"./v-lucide-react-D7AUp8l6.js";import d from"gsap";const F="Shared memory, impact analysis, and guardrail hooks for AI coding agents — authored once, emitted as native config for Claude Code, Codex, Cursor, Gemini, Aider, and more.",f="Live status, straight from the repository.".split(" "),l="inline-flex items-center gap-1.5 rounded-full border border-hairline px-3 py-1.5 font-mono text-micro font-medium uppercase tracking-chip text-ink-2";let S=!1;const R=e=>new Date(e).toLocaleTimeString("en-GB",{hour12:!1});function x({icon:e,count:s,label:n,state:o}){const c=o==="live";return a("span",{"code-path":"src/components/status/StatusHero.tsx:42:5",className:`st-chip ${l}`,children:[t(e,{"code-path":"src/components/status/StatusHero.tsx:43:7",size:12,strokeWidth:1.5,className:"text-ink-3","aria-hidden":"true"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:44:7",className:"live-count font-semibold text-ink","data-count":s,children:s}),n,a("span",{"code-path":"src/components/status/StatusHero.tsx:48:7",className:g("ml-0.5 inline-flex items-center gap-1",c?"text-pass":"text-warn"),children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:54:9","aria-hidden":"true",className:g("h-1.5 w-1.5 rounded-full",c?"bg-pass":"bg-warn")}),c?"LIVE":"CACHED"]})]})}function P({repo:e}){const s=p(null);m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".st-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".st-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".st-lead",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".st-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".st-chip",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.06},"-=0.2")})},{scope:s}),k(()=>{if(!e.counts||w()||S)return;S=!0;const o=s.current?.querySelectorAll(".live-count")??[],c=[];return o.forEach(i=>{c.push(N(i,Number(i.dataset.count),0))}),()=>c.forEach(i=>i?.kill())},[e.counts]);const n=(e.state==="live"||e.state==="cached")&&e.counts;return a("section",{"code-path":"src/components/status/StatusHero.tsx:127:5",ref:s,"aria-labelledby":"status-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/StatusHero.tsx:133:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/StatusHero.tsx:142:7",className:"container-fk relative pb-16 pt-14 md:pt-24",children:[a("p",{"code-path":"src/components/status/StatusHero.tsx:143:9",className:"st-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[t(A,{"code-path":"src/components/status/StatusHero.tsx:144:11",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"@codewithjuber/forgekit · v0.27.0 · Node >=20"]}),t("h1",{"code-path":"src/components/status/StatusHero.tsx:148:9",id:"status-title",className:"mt-6 max-w-[880px] font-display text-[clamp(2.5rem,5.5vw,3.815rem)] font-medium leading-[1.06] tracking-h-display text-ink",children:f.map((o,c)=>a(C,{"code-path":"src/components/status/StatusHero.tsx:153:13",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:154:15",className:"st-word inline-block will-change-transform",children:o}),c<f.length-1?" ":null]},c))}),t("p",{"code-path":"src/components/status/StatusHero.tsx:162:9",className:"st-lead mt-6 max-w-[680px] text-fs-1 font-normal text-ink-2",children:F}),a("div",{"code-path":"src/components/status/StatusHero.tsx:166:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("a",{"code-path":"src/components/status/StatusHero.tsx:167:11",href:"#quickstart",className:`st-cta ${E}`,children:"Install in 60 seconds"}),t("a",{"code-path":"src/components/status/StatusHero.tsx:170:11",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`st-cta ${M}`,children:"Read the docs"})]}),a("div",{"code-path":"src/components/status/StatusHero.tsx:181:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:182:11",className:`st-chip ${l}`,children:"MIT license"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:183:11",className:`st-chip ${l}`,children:"0 runtime dependencies"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:184:11",className:`st-chip ${l}`,children:"master @ HEAD"}),e.state==="loading"&&a(u,{children:[t(h,{"code-path":"src/components/status/StatusHero.tsx:189:15",className:"st-chip h-[28px] w-24 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:190:15",className:"st-chip h-[28px] w-20 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:191:15",className:"st-chip h-[28px] w-28 rounded-full bg-paper-sunk [animation-duration:1.6s]"})]}),n&&e.counts&&a(u,{children:[t(x,{"code-path":"src/components/status/StatusHero.tsx:197:15",icon:D,count:e.counts.stars,label:"stars",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:198:15",icon:W,count:e.counts.forks,label:"forks",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:199:15",icon:j,count:e.counts.issues,label:"open issues",state:e.state}),e.checkedAt!==null&&a("span",{"code-path":"src/components/status/StatusHero.tsx:206:17",className:"font-mono text-micro text-ink-3",children:["checked ",R(e.checkedAt)," · source: api.github.com"]})]}),e.state==="unavailable"&&a(u,{children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:215:15",className:l,children:"live GitHub stats disabled"}),t(v,{"code-path":"src/components/status/StatusHero.tsx:216:15",variant:"api-unavailable"})]})]})]})]})}const Q=[{tag:"measured",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",note:"Measured from this repo's benchmark report, not a marketing placeholder.",source:"reports/benchmarks.md"},{tag:"measured",end:118,decimals:0,unit:"ms",label:"pre-action gate",note:"Assumptions, routing, reuse, context, impact, scope, and anchoring.",source:"reports/benchmarks.md"},{tag:"prototype",end:62.1,decimals:1,unit:"%",label:"cost saved",note:"Documented from the white-paper prototype and exposed by Forge cost reports.",source:"whitepaper prototype"}];function U(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}});d.utils.toArray(".mo-cell").forEach((o,c)=>{const i=c*.08;n.fromTo(o.querySelector(".mo-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},i),n.fromTo(o,{y:20,opacity:0},{y:0,opacity:1,duration:.56},i+.06);const r=o.querySelector(".mo-num");r&&n.add(()=>{N(r,Number(r.dataset.end),Number(r.dataset.decimals))},i+.12)})})},{scope:e}),t("section",{"code-path":"src/components/status/MeasuredOutcomes.tsx:90:5",ref:e,"aria-label":"Measured outcomes",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:95:7",className:"container-fk py-14 md:py-[72px]",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:97:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-3",children:Q.map(s=>a("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:99:13",className:"mo-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:103:15",className:"mo-tag inline-block",children:t(v,{"code-path":"src/components/status/MeasuredOutcomes.tsx:104:17",variant:s.tag})}),a("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:106:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:107:17",className:"mo-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:111:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:s.unit})]}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:116:15",className:"mt-2 text-small font-semibold text-ink",children:s.label}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:117:15",className:"mt-2 text-small font-normal text-ink-2",children:s.note}),a(O,{"code-path":"src/components/status/MeasuredOutcomes.tsx:118:15",children:[t(_,{"code-path":"src/components/status/MeasuredOutcomes.tsx:119:17",asChild:!0,children:t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:120:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:s.source})}),t(L,{"code-path":"src/components/status/MeasuredOutcomes.tsx:127:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},s.label))})})})}const b=["npm install -g @codewithjuber/forgekit","forge init","forge doctor",'forge substrate "Change auth validation and update tests"'];function $(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.fromTo(".qs-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48,ease:"precise",scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}}),d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:".qs-terminal",start:"top 75%",once:!0}}).fromTo(".qs-terminal",{y:24,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".qs-line",{x:8,opacity:0},{x:0,opacity:1,duration:.32,stagger:.12},"-=0.1")})},{scope:e}),t("section",{"code-path":"src/components/status/QuickstartSection.tsx:54:5",ref:e,id:"quickstart","aria-labelledby":"quickstart-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/QuickstartSection.tsx:60:7",className:"container-fk py-14 md:py-[72px]",children:[t("h2",{"code-path":"src/components/status/QuickstartSection.tsx:61:9",id:"quickstart-title",className:"qs-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Quickstart"}),t(I,{"code-path":"src/components/status/QuickstartSection.tsx:67:9",title:"bash — install & first gate",copyText:b.join(`
+import{jsxs as a,jsx as t,Fragment as u}from"react/jsx-runtime";import{useRef as p,useEffect as k,Fragment as C}from"react";import{p as w,c as N,K as A,b as E,a as M,g as h,H as v,h as g,T as O,d as _,e as L,f as I,u as q,i as G}from"./c-core-yvMVzPz6.js";import{u as m}from"./v-gsap-react-CvXmapK9.js";import{S as D,G as W,b as j,A as T}from"./v-lucide-react-D7AUp8l6.js";import d from"gsap";const F="Shared memory, impact analysis, and guardrail hooks for AI coding agents — authored once, emitted as native config for Claude Code, Codex, Cursor, Gemini, Aider, and more.",f="Live status, straight from the repository.".split(" "),l="inline-flex items-center gap-1.5 rounded-full border border-hairline px-3 py-1.5 font-mono text-micro font-medium uppercase tracking-chip text-ink-2";let S=!1;const R=e=>new Date(e).toLocaleTimeString("en-GB",{hour12:!1});function x({icon:e,count:s,label:n,state:o}){const c=o==="live";return a("span",{"code-path":"src/components/status/StatusHero.tsx:42:5",className:`st-chip ${l}`,children:[t(e,{"code-path":"src/components/status/StatusHero.tsx:43:7",size:12,strokeWidth:1.5,className:"text-ink-3","aria-hidden":"true"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:44:7",className:"live-count font-semibold text-ink","data-count":s,children:s}),n,a("span",{"code-path":"src/components/status/StatusHero.tsx:48:7",className:g("ml-0.5 inline-flex items-center gap-1",c?"text-pass":"text-warn"),children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:54:9","aria-hidden":"true",className:g("h-1.5 w-1.5 rounded-full",c?"bg-pass":"bg-warn")}),c?"LIVE":"CACHED"]})]})}function P({repo:e}){const s=p(null);m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".st-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".st-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".st-lead",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".st-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".st-chip",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.06},"-=0.2")})},{scope:s}),k(()=>{if(!e.counts||w()||S)return;S=!0;const o=s.current?.querySelectorAll(".live-count")??[],c=[];return o.forEach(i=>{c.push(N(i,Number(i.dataset.count),0))}),()=>c.forEach(i=>i?.kill())},[e.counts]);const n=(e.state==="live"||e.state==="cached")&&e.counts;return a("section",{"code-path":"src/components/status/StatusHero.tsx:127:5",ref:s,"aria-labelledby":"status-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/StatusHero.tsx:133:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/StatusHero.tsx:142:7",className:"container-fk relative pb-16 pt-14 md:pt-24",children:[a("p",{"code-path":"src/components/status/StatusHero.tsx:143:9",className:"st-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[t(A,{"code-path":"src/components/status/StatusHero.tsx:144:11",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"@codewithjuber/forgekit · v0.27.0 · Node >=20"]}),t("h1",{"code-path":"src/components/status/StatusHero.tsx:148:9",id:"status-title",className:"mt-6 max-w-[880px] font-display text-[clamp(2.5rem,5.5vw,3.815rem)] font-medium leading-[1.06] tracking-h-display text-ink",children:f.map((o,c)=>a(C,{"code-path":"src/components/status/StatusHero.tsx:153:13",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:154:15",className:"st-word inline-block will-change-transform",children:o}),c<f.length-1?" ":null]},c))}),t("p",{"code-path":"src/components/status/StatusHero.tsx:162:9",className:"st-lead mt-6 max-w-[680px] text-fs-1 font-normal text-ink-2",children:F}),a("div",{"code-path":"src/components/status/StatusHero.tsx:166:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("a",{"code-path":"src/components/status/StatusHero.tsx:167:11",href:"#quickstart",className:`st-cta ${E}`,children:"Install in 60 seconds"}),t("a",{"code-path":"src/components/status/StatusHero.tsx:170:11",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`st-cta ${M}`,children:"Read the docs"})]}),a("div",{"code-path":"src/components/status/StatusHero.tsx:181:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:182:11",className:`st-chip ${l}`,children:"MIT license"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:183:11",className:`st-chip ${l}`,children:"0 runtime dependencies"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:184:11",className:`st-chip ${l}`,children:"master @ HEAD"}),e.state==="loading"&&a(u,{children:[t(h,{"code-path":"src/components/status/StatusHero.tsx:189:15",className:"st-chip h-[28px] w-24 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:190:15",className:"st-chip h-[28px] w-20 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:191:15",className:"st-chip h-[28px] w-28 rounded-full bg-paper-sunk [animation-duration:1.6s]"})]}),n&&e.counts&&a(u,{children:[t(x,{"code-path":"src/components/status/StatusHero.tsx:197:15",icon:D,count:e.counts.stars,label:"stars",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:198:15",icon:W,count:e.counts.forks,label:"forks",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:199:15",icon:j,count:e.counts.issues,label:"open issues",state:e.state}),e.checkedAt!==null&&a("span",{"code-path":"src/components/status/StatusHero.tsx:206:17",className:"font-mono text-micro text-ink-3",children:["checked ",R(e.checkedAt)," · source: api.github.com"]})]}),e.state==="unavailable"&&a(u,{children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:215:15",className:l,children:"live GitHub stats disabled"}),t(v,{"code-path":"src/components/status/StatusHero.tsx:216:15",variant:"api-unavailable"})]})]})]})]})}const Q=[{tag:"measured",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",note:"Measured from this repo's benchmark report, not a marketing placeholder.",source:"reports/benchmarks.md"},{tag:"measured",end:118,decimals:0,unit:"ms",label:"pre-action gate",note:"Assumptions, routing, reuse, context, impact, scope, and anchoring.",source:"reports/benchmarks.md"},{tag:"prototype",end:20.2,decimals:1,unit:"%",label:"more cost than always-premium",note:"Held-out result: the white-paper router's 62.1% demo saving was refuted on 80 pre-registered tasks.",source:"research/empirical-refutation"}];function U(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}});d.utils.toArray(".mo-cell").forEach((o,c)=>{const i=c*.08;n.fromTo(o.querySelector(".mo-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},i),n.fromTo(o,{y:20,opacity:0},{y:0,opacity:1,duration:.56},i+.06);const r=o.querySelector(".mo-num");r&&n.add(()=>{N(r,Number(r.dataset.end),Number(r.dataset.decimals))},i+.12)})})},{scope:e}),t("section",{"code-path":"src/components/status/MeasuredOutcomes.tsx:90:5",ref:e,"aria-label":"Measured outcomes",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:95:7",className:"container-fk py-14 md:py-[72px]",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:97:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-3",children:Q.map(s=>a("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:99:13",className:"mo-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:103:15",className:"mo-tag inline-block",children:t(v,{"code-path":"src/components/status/MeasuredOutcomes.tsx:104:17",variant:s.tag})}),a("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:106:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:107:17",className:"mo-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:111:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:s.unit})]}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:116:15",className:"mt-2 text-small font-semibold text-ink",children:s.label}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:117:15",className:"mt-2 text-small font-normal text-ink-2",children:s.note}),a(O,{"code-path":"src/components/status/MeasuredOutcomes.tsx:118:15",children:[t(_,{"code-path":"src/components/status/MeasuredOutcomes.tsx:119:17",asChild:!0,children:t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:120:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:s.source})}),t(L,{"code-path":"src/components/status/MeasuredOutcomes.tsx:127:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},s.label))})})})}const b=["npm install -g @codewithjuber/forgekit","forge init","forge doctor",'forge substrate "Change auth validation and update tests"'];function $(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.fromTo(".qs-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48,ease:"precise",scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}}),d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:".qs-terminal",start:"top 75%",once:!0}}).fromTo(".qs-terminal",{y:24,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".qs-line",{x:8,opacity:0},{x:0,opacity:1,duration:.32,stagger:.12},"-=0.1")})},{scope:e}),t("section",{"code-path":"src/components/status/QuickstartSection.tsx:54:5",ref:e,id:"quickstart","aria-labelledby":"quickstart-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/QuickstartSection.tsx:60:7",className:"container-fk py-14 md:py-[72px]",children:[t("h2",{"code-path":"src/components/status/QuickstartSection.tsx:61:9",id:"quickstart-title",className:"qs-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Quickstart"}),t(I,{"code-path":"src/components/status/QuickstartSection.tsx:67:9",title:"bash — install & first gate",copyText:b.join(`
 `),className:"qs-terminal mt-8 max-w-[820px] shadow-e1",children:b.map(s=>t("div",{"code-path":"src/components/status/QuickstartSection.tsx:73:13",className:"qs-line",children:s},s))})]})})}const z="https://github.com/CodeWithJuber/forgekit/blob/master/CHANGELOG.md";function B({changes:e}){const s=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const o=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:s.current,start:"top 75%",once:!0}});o.fromTo(".chg-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48}).fromTo(".chg-card",{y:24,opacity:0},{y:0,opacity:1,duration:.56},"-=0.2"),d.utils.toArray(".chg-item").forEach((c,i)=>{const r=.5+i*.09;o.fromTo(c,{y:12,opacity:0},{y:0,opacity:1,duration:.4},r),o.fromTo(c.querySelector(".chg-bar"),{scaleY:0},{scaleY:1,duration:.32},r+.15)})})},{scope:s}),t("section",{"code-path":"src/components/status/ChangesSection.tsx:47:5",ref:s,id:"changes","aria-labelledby":"changes-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/ChangesSection.tsx:53:7",className:"container-fk py-14 md:py-[72px]",children:[a("div",{"code-path":"src/components/status/ChangesSection.tsx:54:9",className:"chg-h2 flex items-baseline justify-between gap-4",children:[t("h2",{"code-path":"src/components/status/ChangesSection.tsx:55:11",id:"changes-title",className:"font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Latest repo changes"}),a("a",{"code-path":"src/components/status/ChangesSection.tsx:61:11",href:z,target:"_blank",rel:"noopener",className:"micro-label inline-flex shrink-0 items-center gap-1 normal-case tracking-normal text-ink-3 transition-colors duration-fast ease-out-soft hover:text-signal-strong",children:["full changelog",t(T,{"code-path":"src/components/status/ChangesSection.tsx:68:13",size:12,strokeWidth:1.5,"aria-hidden":"true"})]})]}),a("div",{"code-path":"src/components/status/ChangesSection.tsx:72:9",className:"chg-card mt-8 rounded-card border border-hairline bg-paper-raised p-8 shadow-e1",children:[a("p",{"code-path":"src/components/status/ChangesSection.tsx:73:11",className:"font-mono text-micro text-ink-3",children:["from CHANGELOG.md · [",e.version,"] - ",e.date]}),t("ul",{"code-path":"src/components/status/ChangesSection.tsx:76:11",className:"mt-6 flex flex-col gap-3",children:e.items.map((n,o)=>a("li",{"code-path":"src/components/status/ChangesSection.tsx:78:15",className:"chg-item relative pl-4 text-small font-normal text-ink-2",children:[t("span",{"code-path":"src/components/status/ChangesSection.tsx:82:17","aria-hidden":"true",className:"chg-bar absolute left-0 top-0 h-full w-[2px] origin-top bg-signal"}),n]},o))}),t("p",{"code-path":"src/components/status/ChangesSection.tsx:90:11",className:"mt-6 text-small font-normal text-ink-3",children:"Benchmark sections indexed: 3 · benchmarks file updated 2026-07-20."})]})]})})}const J=new Date().toISOString(),V=[{id:"S1",name:"package.json"},{id:"S2",name:"README.md"},{id:"S3",name:"CHANGELOG.md"},{id:"S4",name:"reports/benchmarks.md"},{id:"S5",name:"https://api.github.com/repos/CodeWithJuber/forgekit",gloss:"optional, no auth, only when BUILD_PAGES_LIVE=1",external:!0}];function K({generatedAt:e}){const s=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const o=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:s.current,start:"top 75%",once:!0}});o.fromTo(".ds-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".ds-card",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.4"),d.utils.toArray(".ds-row").forEach((c,i)=>{const r=.6+i*.06;o.fromTo(c,{y:12,opacity:0},{y:0,opacity:1,duration:.4},r),o.fromTo(c.querySelector(".ds-rule"),{scaleX:0},{scaleX:1,duration:.4},r)})})},{scope:s}),a("section",{"code-path":"src/components/status/SourcesSection.tsx:64:5",ref:s,id:"sources","aria-labelledby":"sources-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/SourcesSection.tsx:71:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_100%_100%,black_0%,transparent_72%)]",style:{backgroundImage:"url('/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:80:7",className:"container-fk relative py-14 md:pb-24 md:pt-[72px]",children:[t("h2",{"code-path":"src/components/status/SourcesSection.tsx:81:9",id:"sources-title",className:"ds-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Data Sources"}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:88:9",className:"ds-card mt-8 rounded-card border border-hairline bg-paper-raised p-8 shadow-e1",children:[a("p",{"code-path":"src/components/status/SourcesSection.tsx:89:11",className:"max-w-[760px] text-small font-normal text-ink-2",children:["No mock data is used. This page is regenerated from repository files during CI (generated ",e??J," from HEAD). Enable"," ",t("code",{"code-path":"src/components/status/SourcesSection.tsx:92:13",className:"code-chip",children:"BUILD_PAGES_LIVE=1"})," to refresh public GitHub counters with ETag/Last-Modified caching."]}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:97:11",className:"mt-8",children:[V.map(n=>a("div",{"code-path":"src/components/status/SourcesSection.tsx:99:15",className:"ds-row",children:[t("div",{"code-path":"src/components/status/SourcesSection.tsx:100:17","aria-hidden":"true",className:"ds-rule h-px origin-left bg-hairline"}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:101:17",className:"-mx-2 flex flex-wrap items-baseline gap-x-4 gap-y-1.5 rounded-chip px-2 py-4 transition-colors duration-fast ease-out-soft hover:bg-paper-sunk",children:[t("span",{"code-path":"src/components/status/SourcesSection.tsx:102:19",className:"w-10 shrink-0 font-mono text-micro text-ink-3",children:n.id}),t("span",{"code-path":"src/components/status/SourcesSection.tsx:105:19",className:"min-w-0",children:n.external?a("a",{"code-path":"src/components/status/SourcesSection.tsx:107:23",href:n.name,target:"_blank",rel:"noopener",className:"inline-flex items-baseline gap-1 break-all font-mono text-[14px] font-medium text-signal-strong underline-offset-4 hover:underline",children:[n.name,t(T,{"code-path":"src/components/status/SourcesSection.tsx:114:25",size:12,strokeWidth:1.5,"aria-hidden":"true",className:"shrink-0 self-center"})]}):t("code",{"code-path":"src/components/status/SourcesSection.tsx:122:23",className:"inline-block rounded-chip border border-hairline bg-paper-sunk px-1.5 py-0.5 font-mono text-[14px] font-medium text-ink",children:n.name})}),n.gloss&&a("span",{"code-path":"src/components/status/SourcesSection.tsx:128:21",className:"text-small font-normal text-ink-2",children:["(",n.gloss,")"]})]})]},n.id)),t("div",{"code-path":"src/components/status/SourcesSection.tsx:135:13","aria-hidden":"true",className:"h-px bg-hairline"})]})]})]})]})}function X(){return t("div",{"code-path":"src/components/status/ParityFooter.tsx:8:5",className:"bg-ink",children:t("div",{"code-path":"src/components/status/ParityFooter.tsx:9:7",className:"container-fk py-10",children:t("p",{"code-path":"src/components/status/ParityFooter.tsx:10:9",className:"max-w-[880px] font-mono text-micro text-paper-on-ink-2",children:"WCAG-minded semantic HTML, keyboard focus, responsive 320px–1920px+, and reduced-motion-safe. Same design tokens as the landing page — parity enforced in test/pages.test.js."})})})}const y="forgekit status — live repository data",Y={"@context":"https://schema.org","@type":"SoftwareApplication",name:"@codewithjuber/forgekit",softwareVersion:"0.27.0",applicationCategory:"DeveloperApplication",operatingSystem:"macOS, Linux, Windows",offers:{"@type":"Offer",price:"0"}};function nt(){const e=q(),s=G();return k(()=>{const n=document.title;document.title=y;const o=[document.querySelector('meta[property="og:title"]'),document.querySelector('meta[name="twitter:title"]')].filter(r=>r!==null),c=o.map(r=>r.content);o.forEach(r=>{r.content=y});const i=document.createElement("script");return i.type="application/ld+json",i.textContent=JSON.stringify(Y),document.head.appendChild(i),()=>{document.title=n,o.forEach((r,H)=>{r.content=c[H]??""}),i.remove()}},[]),a(u,{children:[t(P,{"code-path":"src/pages/Status.tsx:64:7",repo:e}),t(U,{"code-path":"src/pages/Status.tsx:65:7"}),t($,{"code-path":"src/pages/Status.tsx:66:7"}),t(B,{"code-path":"src/pages/Status.tsx:67:7",changes:s}),t(K,{"code-path":"src/pages/Status.tsx:68:7",generatedAt:e.counts?.pushedAt??null}),t(X,{"code-path":"src/pages/Status.tsx:69:7"})]})}export{nt as S};
diff --git a/landing/assets/c-status-DVDC3COz.js b/landing/assets/c-status-DVDC3COz.js
index 9527de1b..ed41610e 100644
--- a/landing/assets/c-status-DVDC3COz.js
+++ b/landing/assets/c-status-DVDC3COz.js
@@ -1,2 +1,2 @@
-import{jsxs as a,jsx as t,Fragment as u}from"react/jsx-runtime";import{useRef as p,useEffect as k,Fragment as C}from"react";import{p as w,c as N,K as A,b as E,a as M,g as h,H as v,h as g,T as O,d as _,e as L,f as I,u as q,i as G}from"./c-core-YZbvYLvb.js";import{u as m}from"./v-gsap-react-CvXmapK9.js";import{S as D,G as W,b as j,A as T}from"./v-lucide-react-D7AUp8l6.js";import d from"gsap";const F="Shared memory, impact analysis, and guardrail hooks for AI coding agents — authored once, emitted as native config for Claude Code, Codex, Cursor, Gemini, Aider, and more.",f="Live status, straight from the repository.".split(" "),l="inline-flex items-center gap-1.5 rounded-full border border-hairline px-3 py-1.5 font-mono text-micro font-medium uppercase tracking-chip text-ink-2";let S=!1;const R=e=>new Date(e).toLocaleTimeString("en-GB",{hour12:!1});function x({icon:e,count:s,label:n,state:o}){const c=o==="live";return a("span",{"code-path":"src/components/status/StatusHero.tsx:42:5",className:`st-chip ${l}`,children:[t(e,{"code-path":"src/components/status/StatusHero.tsx:43:7",size:12,strokeWidth:1.5,className:"text-ink-3","aria-hidden":"true"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:44:7",className:"live-count font-semibold text-ink","data-count":s,children:s}),n,a("span",{"code-path":"src/components/status/StatusHero.tsx:48:7",className:g("ml-0.5 inline-flex items-center gap-1",c?"text-pass":"text-warn"),children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:54:9","aria-hidden":"true",className:g("h-1.5 w-1.5 rounded-full",c?"bg-pass":"bg-warn")}),c?"LIVE":"CACHED"]})]})}function P({repo:e}){const s=p(null);m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".st-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".st-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".st-lead",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".st-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".st-chip",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.06},"-=0.2")})},{scope:s}),k(()=>{if(!e.counts||w()||S)return;S=!0;const o=s.current?.querySelectorAll(".live-count")??[],c=[];return o.forEach(i=>{c.push(N(i,Number(i.dataset.count),0))}),()=>c.forEach(i=>i?.kill())},[e.counts]);const n=(e.state==="live"||e.state==="cached")&&e.counts;return a("section",{"code-path":"src/components/status/StatusHero.tsx:127:5",ref:s,"aria-labelledby":"status-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/StatusHero.tsx:133:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/StatusHero.tsx:142:7",className:"container-fk relative pb-16 pt-14 md:pt-24",children:[a("p",{"code-path":"src/components/status/StatusHero.tsx:143:9",className:"st-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[t(A,{"code-path":"src/components/status/StatusHero.tsx:144:11",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"@codewithjuber/forgekit · v0.27.0 · Node >=20"]}),t("h1",{"code-path":"src/components/status/StatusHero.tsx:148:9",id:"status-title",className:"mt-6 max-w-[880px] font-display text-[clamp(2.5rem,5.5vw,3.815rem)] font-medium leading-[1.06] tracking-h-display text-ink",children:f.map((o,c)=>a(C,{"code-path":"src/components/status/StatusHero.tsx:153:13",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:154:15",className:"st-word inline-block will-change-transform",children:o}),c<f.length-1?" ":null]},c))}),t("p",{"code-path":"src/components/status/StatusHero.tsx:162:9",className:"st-lead mt-6 max-w-[680px] text-fs-1 font-normal text-ink-2",children:F}),a("div",{"code-path":"src/components/status/StatusHero.tsx:166:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("a",{"code-path":"src/components/status/StatusHero.tsx:167:11",href:"#quickstart",className:`st-cta ${E}`,children:"Install in 60 seconds"}),t("a",{"code-path":"src/components/status/StatusHero.tsx:170:11",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`st-cta ${M}`,children:"Read the docs"})]}),a("div",{"code-path":"src/components/status/StatusHero.tsx:181:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:182:11",className:`st-chip ${l}`,children:"MIT license"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:183:11",className:`st-chip ${l}`,children:"0 runtime dependencies"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:184:11",className:`st-chip ${l}`,children:"master @ HEAD"}),e.state==="loading"&&a(u,{children:[t(h,{"code-path":"src/components/status/StatusHero.tsx:189:15",className:"st-chip h-[28px] w-24 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:190:15",className:"st-chip h-[28px] w-20 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:191:15",className:"st-chip h-[28px] w-28 rounded-full bg-paper-sunk [animation-duration:1.6s]"})]}),n&&e.counts&&a(u,{children:[t(x,{"code-path":"src/components/status/StatusHero.tsx:197:15",icon:D,count:e.counts.stars,label:"stars",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:198:15",icon:W,count:e.counts.forks,label:"forks",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:199:15",icon:j,count:e.counts.issues,label:"open issues",state:e.state}),e.checkedAt!==null&&a("span",{"code-path":"src/components/status/StatusHero.tsx:206:17",className:"font-mono text-micro text-ink-3",children:["checked ",R(e.checkedAt)," · source: api.github.com"]})]}),e.state==="unavailable"&&a(u,{children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:215:15",className:l,children:"live GitHub stats disabled"}),t(v,{"code-path":"src/components/status/StatusHero.tsx:216:15",variant:"api-unavailable"})]})]})]})]})}const Q=[{tag:"measured",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",note:"Measured from this repo's benchmark report, not a marketing placeholder.",source:"reports/benchmarks.md"},{tag:"measured",end:118,decimals:0,unit:"ms",label:"pre-action gate",note:"Assumptions, routing, reuse, context, impact, scope, and anchoring.",source:"reports/benchmarks.md"},{tag:"prototype",end:62.1,decimals:1,unit:"%",label:"cost saved",note:"Documented from the white-paper prototype and exposed by Forge cost reports.",source:"whitepaper prototype"}];function U(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}});d.utils.toArray(".mo-cell").forEach((o,c)=>{const i=c*.08;n.fromTo(o.querySelector(".mo-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},i),n.fromTo(o,{y:20,opacity:0},{y:0,opacity:1,duration:.56},i+.06);const r=o.querySelector(".mo-num");r&&n.add(()=>{N(r,Number(r.dataset.end),Number(r.dataset.decimals))},i+.12)})})},{scope:e}),t("section",{"code-path":"src/components/status/MeasuredOutcomes.tsx:90:5",ref:e,"aria-label":"Measured outcomes",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:95:7",className:"container-fk py-14 md:py-[72px]",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:97:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-3",children:Q.map(s=>a("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:99:13",className:"mo-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:103:15",className:"mo-tag inline-block",children:t(v,{"code-path":"src/components/status/MeasuredOutcomes.tsx:104:17",variant:s.tag})}),a("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:106:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:107:17",className:"mo-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:111:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:s.unit})]}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:116:15",className:"mt-2 text-small font-semibold text-ink",children:s.label}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:117:15",className:"mt-2 text-small font-normal text-ink-2",children:s.note}),a(O,{"code-path":"src/components/status/MeasuredOutcomes.tsx:118:15",children:[t(_,{"code-path":"src/components/status/MeasuredOutcomes.tsx:119:17",asChild:!0,children:t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:120:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:s.source})}),t(L,{"code-path":"src/components/status/MeasuredOutcomes.tsx:127:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},s.label))})})})}const b=["npm install -g @codewithjuber/forgekit","forge init","forge doctor",'forge substrate "Change auth validation and update tests"'];function $(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.fromTo(".qs-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48,ease:"precise",scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}}),d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:".qs-terminal",start:"top 75%",once:!0}}).fromTo(".qs-terminal",{y:24,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".qs-line",{x:8,opacity:0},{x:0,opacity:1,duration:.32,stagger:.12},"-=0.1")})},{scope:e}),t("section",{"code-path":"src/components/status/QuickstartSection.tsx:54:5",ref:e,id:"quickstart","aria-labelledby":"quickstart-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/QuickstartSection.tsx:60:7",className:"container-fk py-14 md:py-[72px]",children:[t("h2",{"code-path":"src/components/status/QuickstartSection.tsx:61:9",id:"quickstart-title",className:"qs-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Quickstart"}),t(I,{"code-path":"src/components/status/QuickstartSection.tsx:67:9",title:"bash — install & first gate",copyText:b.join(`
+import{jsxs as a,jsx as t,Fragment as u}from"react/jsx-runtime";import{useRef as p,useEffect as k,Fragment as C}from"react";import{p as w,c as N,K as A,b as E,a as M,g as h,H as v,h as g,T as O,d as _,e as L,f as I,u as q,i as G}from"./c-core-YZbvYLvb.js";import{u as m}from"./v-gsap-react-CvXmapK9.js";import{S as D,G as W,b as j,A as T}from"./v-lucide-react-D7AUp8l6.js";import d from"gsap";const F="Shared memory, impact analysis, and guardrail hooks for AI coding agents — authored once, emitted as native config for Claude Code, Codex, Cursor, Gemini, Aider, and more.",f="Live status, straight from the repository.".split(" "),l="inline-flex items-center gap-1.5 rounded-full border border-hairline px-3 py-1.5 font-mono text-micro font-medium uppercase tracking-chip text-ink-2";let S=!1;const R=e=>new Date(e).toLocaleTimeString("en-GB",{hour12:!1});function x({icon:e,count:s,label:n,state:o}){const c=o==="live";return a("span",{"code-path":"src/components/status/StatusHero.tsx:42:5",className:`st-chip ${l}`,children:[t(e,{"code-path":"src/components/status/StatusHero.tsx:43:7",size:12,strokeWidth:1.5,className:"text-ink-3","aria-hidden":"true"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:44:7",className:"live-count font-semibold text-ink","data-count":s,children:s}),n,a("span",{"code-path":"src/components/status/StatusHero.tsx:48:7",className:g("ml-0.5 inline-flex items-center gap-1",c?"text-pass":"text-warn"),children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:54:9","aria-hidden":"true",className:g("h-1.5 w-1.5 rounded-full",c?"bg-pass":"bg-warn")}),c?"LIVE":"CACHED"]})]})}function P({repo:e}){const s=p(null);m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.timeline({delay:.15,defaults:{ease:"precise"}}).fromTo(".st-eyebrow",{y:12,opacity:0},{y:0,opacity:1,duration:.4}).fromTo(".st-word",{y:24,opacity:0},{y:0,opacity:1,duration:.64,stagger:.055},"-=0.15").fromTo(".st-lead",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.35").fromTo(".st-cta",{y:16,opacity:0},{y:0,opacity:1,duration:.48,stagger:.08},"-=0.3").fromTo(".st-chip",{y:12,opacity:0},{y:0,opacity:1,duration:.4,stagger:.06},"-=0.2")})},{scope:s}),k(()=>{if(!e.counts||w()||S)return;S=!0;const o=s.current?.querySelectorAll(".live-count")??[],c=[];return o.forEach(i=>{c.push(N(i,Number(i.dataset.count),0))}),()=>c.forEach(i=>i?.kill())},[e.counts]);const n=(e.state==="live"||e.state==="cached")&&e.counts;return a("section",{"code-path":"src/components/status/StatusHero.tsx:127:5",ref:s,"aria-labelledby":"status-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/StatusHero.tsx:133:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.05] [mask-image:radial-gradient(ellipse_75%_65%_at_85%_0%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/StatusHero.tsx:142:7",className:"container-fk relative pb-16 pt-14 md:pt-24",children:[a("p",{"code-path":"src/components/status/StatusHero.tsx:143:9",className:"st-eyebrow micro-label flex items-center gap-2.5 text-signal-strong",children:[t(A,{"code-path":"src/components/status/StatusHero.tsx:144:11",size:10,strokeWidth:1.5,className:"shrink-0 text-signal"}),"@codewithjuber/forgekit · v0.27.0 · Node >=20"]}),t("h1",{"code-path":"src/components/status/StatusHero.tsx:148:9",id:"status-title",className:"mt-6 max-w-[880px] font-display text-[clamp(2.5rem,5.5vw,3.815rem)] font-medium leading-[1.06] tracking-h-display text-ink",children:f.map((o,c)=>a(C,{"code-path":"src/components/status/StatusHero.tsx:153:13",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:154:15",className:"st-word inline-block will-change-transform",children:o}),c<f.length-1?" ":null]},c))}),t("p",{"code-path":"src/components/status/StatusHero.tsx:162:9",className:"st-lead mt-6 max-w-[680px] text-fs-1 font-normal text-ink-2",children:F}),a("div",{"code-path":"src/components/status/StatusHero.tsx:166:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("a",{"code-path":"src/components/status/StatusHero.tsx:167:11",href:"#quickstart",className:`st-cta ${E}`,children:"Install in 60 seconds"}),t("a",{"code-path":"src/components/status/StatusHero.tsx:170:11",href:"https://github.com/CodeWithJuber/forgekit#readme",target:"_blank",rel:"noopener",className:`st-cta ${M}`,children:"Read the docs"})]}),a("div",{"code-path":"src/components/status/StatusHero.tsx:181:9",className:"mt-8 flex flex-wrap items-center gap-3",children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:182:11",className:`st-chip ${l}`,children:"MIT license"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:183:11",className:`st-chip ${l}`,children:"0 runtime dependencies"}),t("span",{"code-path":"src/components/status/StatusHero.tsx:184:11",className:`st-chip ${l}`,children:"master @ HEAD"}),e.state==="loading"&&a(u,{children:[t(h,{"code-path":"src/components/status/StatusHero.tsx:189:15",className:"st-chip h-[28px] w-24 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:190:15",className:"st-chip h-[28px] w-20 rounded-full bg-paper-sunk [animation-duration:1.6s]"}),t(h,{"code-path":"src/components/status/StatusHero.tsx:191:15",className:"st-chip h-[28px] w-28 rounded-full bg-paper-sunk [animation-duration:1.6s]"})]}),n&&e.counts&&a(u,{children:[t(x,{"code-path":"src/components/status/StatusHero.tsx:197:15",icon:D,count:e.counts.stars,label:"stars",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:198:15",icon:W,count:e.counts.forks,label:"forks",state:e.state}),t(x,{"code-path":"src/components/status/StatusHero.tsx:199:15",icon:j,count:e.counts.issues,label:"open issues",state:e.state}),e.checkedAt!==null&&a("span",{"code-path":"src/components/status/StatusHero.tsx:206:17",className:"font-mono text-micro text-ink-3",children:["checked ",R(e.checkedAt)," · source: api.github.com"]})]}),e.state==="unavailable"&&a(u,{children:[t("span",{"code-path":"src/components/status/StatusHero.tsx:215:15",className:l,children:"live GitHub stats disabled"}),t(v,{"code-path":"src/components/status/StatusHero.tsx:216:15",variant:"api-unavailable"})]})]})]})]})}const Q=[{tag:"measured",end:.43,decimals:2,unit:"ms",label:"blast-radius lookup",note:"Measured from this repo's benchmark report, not a marketing placeholder.",source:"reports/benchmarks.md"},{tag:"measured",end:118,decimals:0,unit:"ms",label:"pre-action gate",note:"Assumptions, routing, reuse, context, impact, scope, and anchoring.",source:"reports/benchmarks.md"},{tag:"prototype",end:20.2,decimals:1,unit:"%",label:"more cost than always-premium",note:"Held-out result: the white-paper router's 62.1% demo saving was refuted on 80 pre-registered tasks.",source:"research/empirical-refutation"}];function U(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const n=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}});d.utils.toArray(".mo-cell").forEach((o,c)=>{const i=c*.08;n.fromTo(o.querySelector(".mo-tag"),{scale:.9,opacity:0},{scale:1,opacity:1,duration:.24},i),n.fromTo(o,{y:20,opacity:0},{y:0,opacity:1,duration:.56},i+.06);const r=o.querySelector(".mo-num");r&&n.add(()=>{N(r,Number(r.dataset.end),Number(r.dataset.decimals))},i+.12)})})},{scope:e}),t("section",{"code-path":"src/components/status/MeasuredOutcomes.tsx:90:5",ref:e,"aria-label":"Measured outcomes",className:"border-b border-hairline",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:95:7",className:"container-fk py-14 md:py-[72px]",children:t("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:97:9",className:"grid grid-cols-1 gap-px border border-hairline bg-hairline md:grid-cols-3",children:Q.map(s=>a("div",{"code-path":"src/components/status/MeasuredOutcomes.tsx:99:13",className:"mo-cell group bg-paper p-6 transition-colors duration-fast ease-out-soft hover:bg-paper-raised lg:p-7",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:103:15",className:"mo-tag inline-block",children:t(v,{"code-path":"src/components/status/MeasuredOutcomes.tsx:104:17",variant:s.tag})}),a("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:106:15",className:"mt-4 font-mono text-fs-4 font-semibold tracking-metric text-ink",children:[t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:107:17",className:"mo-num","data-end":s.end,"data-decimals":s.decimals,children:s.end.toFixed(s.decimals)}),s.unit&&t("span",{"code-path":"src/components/status/MeasuredOutcomes.tsx:111:19",className:"ml-1 text-[0.55em] font-medium text-ink-3",children:s.unit})]}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:116:15",className:"mt-2 text-small font-semibold text-ink",children:s.label}),t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:117:15",className:"mt-2 text-small font-normal text-ink-2",children:s.note}),a(O,{"code-path":"src/components/status/MeasuredOutcomes.tsx:118:15",children:[t(_,{"code-path":"src/components/status/MeasuredOutcomes.tsx:119:17",asChild:!0,children:t("p",{"code-path":"src/components/status/MeasuredOutcomes.tsx:120:19",tabIndex:0,className:"mt-3 inline-block cursor-help font-mono text-micro lowercase text-ink-3 transition-colors duration-fast ease-out-soft group-hover:text-signal-strong",children:s.source})}),t(L,{"code-path":"src/components/status/MeasuredOutcomes.tsx:127:17",side:"top",className:"rounded-chip border-hairline bg-paper-raised font-mono text-micro text-ink shadow-e1",children:"Source file in the repository"})]})]},s.label))})})})}const b=["npm install -g @codewithjuber/forgekit","forge init","forge doctor",'forge substrate "Change auth validation and update tests"'];function $(){const e=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{d.fromTo(".qs-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48,ease:"precise",scrollTrigger:{trigger:e.current,start:"top 75%",once:!0}}),d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:".qs-terminal",start:"top 75%",once:!0}}).fromTo(".qs-terminal",{y:24,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".qs-line",{x:8,opacity:0},{x:0,opacity:1,duration:.32,stagger:.12},"-=0.1")})},{scope:e}),t("section",{"code-path":"src/components/status/QuickstartSection.tsx:54:5",ref:e,id:"quickstart","aria-labelledby":"quickstart-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/QuickstartSection.tsx:60:7",className:"container-fk py-14 md:py-[72px]",children:[t("h2",{"code-path":"src/components/status/QuickstartSection.tsx:61:9",id:"quickstart-title",className:"qs-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Quickstart"}),t(I,{"code-path":"src/components/status/QuickstartSection.tsx:67:9",title:"bash — install & first gate",copyText:b.join(`
 `),className:"qs-terminal mt-8 max-w-[820px] shadow-e1",children:b.map(s=>t("div",{"code-path":"src/components/status/QuickstartSection.tsx:73:13",className:"qs-line",children:s},s))})]})})}const z="https://github.com/CodeWithJuber/forgekit/blob/master/CHANGELOG.md";function B({changes:e}){const s=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const o=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:s.current,start:"top 75%",once:!0}});o.fromTo(".chg-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.48}).fromTo(".chg-card",{y:24,opacity:0},{y:0,opacity:1,duration:.56},"-=0.2"),d.utils.toArray(".chg-item").forEach((c,i)=>{const r=.5+i*.09;o.fromTo(c,{y:12,opacity:0},{y:0,opacity:1,duration:.4},r),o.fromTo(c.querySelector(".chg-bar"),{scaleY:0},{scaleY:1,duration:.32},r+.15)})})},{scope:s}),t("section",{"code-path":"src/components/status/ChangesSection.tsx:47:5",ref:s,id:"changes","aria-labelledby":"changes-title",className:"border-b border-hairline",children:a("div",{"code-path":"src/components/status/ChangesSection.tsx:53:7",className:"container-fk py-14 md:py-[72px]",children:[a("div",{"code-path":"src/components/status/ChangesSection.tsx:54:9",className:"chg-h2 flex items-baseline justify-between gap-4",children:[t("h2",{"code-path":"src/components/status/ChangesSection.tsx:55:11",id:"changes-title",className:"font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Latest repo changes"}),a("a",{"code-path":"src/components/status/ChangesSection.tsx:61:11",href:z,target:"_blank",rel:"noopener",className:"micro-label inline-flex shrink-0 items-center gap-1 normal-case tracking-normal text-ink-3 transition-colors duration-fast ease-out-soft hover:text-signal-strong",children:["full changelog",t(T,{"code-path":"src/components/status/ChangesSection.tsx:68:13",size:12,strokeWidth:1.5,"aria-hidden":"true"})]})]}),a("div",{"code-path":"src/components/status/ChangesSection.tsx:72:9",className:"chg-card mt-8 rounded-card border border-hairline bg-paper-raised p-8 shadow-e1",children:[a("p",{"code-path":"src/components/status/ChangesSection.tsx:73:11",className:"font-mono text-micro text-ink-3",children:["from CHANGELOG.md · [",e.version,"] - ",e.date]}),t("ul",{"code-path":"src/components/status/ChangesSection.tsx:76:11",className:"mt-6 flex flex-col gap-3",children:e.items.map((n,o)=>a("li",{"code-path":"src/components/status/ChangesSection.tsx:78:15",className:"chg-item relative pl-4 text-small font-normal text-ink-2",children:[t("span",{"code-path":"src/components/status/ChangesSection.tsx:82:17","aria-hidden":"true",className:"chg-bar absolute left-0 top-0 h-full w-[2px] origin-top bg-signal"}),n]},o))}),t("p",{"code-path":"src/components/status/ChangesSection.tsx:90:11",className:"mt-6 text-small font-normal text-ink-3",children:"Benchmark sections indexed: 3 · benchmarks file updated 2026-07-20."})]})]})})}const J=new Date().toISOString(),V=[{id:"S1",name:"package.json"},{id:"S2",name:"README.md"},{id:"S3",name:"CHANGELOG.md"},{id:"S4",name:"reports/benchmarks.md"},{id:"S5",name:"https://api.github.com/repos/CodeWithJuber/forgekit",gloss:"optional, no auth, only when BUILD_PAGES_LIVE=1",external:!0}];function K({generatedAt:e}){const s=p(null);return m(()=>{d.matchMedia().add("(prefers-reduced-motion: no-preference)",()=>{const o=d.timeline({defaults:{ease:"precise"},scrollTrigger:{trigger:s.current,start:"top 75%",once:!0}});o.fromTo(".ds-h2",{y:20,opacity:0},{y:0,opacity:1,duration:.56}).fromTo(".ds-card",{y:20,opacity:0},{y:0,opacity:1,duration:.56},"-=0.4"),d.utils.toArray(".ds-row").forEach((c,i)=>{const r=.6+i*.06;o.fromTo(c,{y:12,opacity:0},{y:0,opacity:1,duration:.4},r),o.fromTo(c.querySelector(".ds-rule"),{scaleX:0},{scaleX:1,duration:.4},r)})})},{scope:s}),a("section",{"code-path":"src/components/status/SourcesSection.tsx:64:5",ref:s,id:"sources","aria-labelledby":"sources-title",className:"relative overflow-hidden border-b border-hairline",children:[t("div",{"code-path":"src/components/status/SourcesSection.tsx:71:7","aria-hidden":"true",className:"pointer-events-none absolute inset-0 opacity-[0.04] [mask-image:radial-gradient(ellipse_55%_60%_at_100%_100%,black_0%,transparent_72%)]",style:{backgroundImage:"url('https://cdn.jsdelivr.net/gh/CodeWithJuber/forgekit@d794b9e2266745a14b8c047f7fc363c4159318c4/landing/girih-lattice.svg')",backgroundSize:"96px"}}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:80:7",className:"container-fk relative py-14 md:pb-24 md:pt-[72px]",children:[t("h2",{"code-path":"src/components/status/SourcesSection.tsx:81:9",id:"sources-title",className:"ds-h2 font-display text-fs-3 font-medium tracking-h-section text-ink",children:"Data Sources"}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:88:9",className:"ds-card mt-8 rounded-card border border-hairline bg-paper-raised p-8 shadow-e1",children:[a("p",{"code-path":"src/components/status/SourcesSection.tsx:89:11",className:"max-w-[760px] text-small font-normal text-ink-2",children:["No mock data is used. This page is regenerated from repository files during CI (generated ",e??J," from HEAD). Enable"," ",t("code",{"code-path":"src/components/status/SourcesSection.tsx:92:13",className:"code-chip",children:"BUILD_PAGES_LIVE=1"})," to refresh public GitHub counters with ETag/Last-Modified caching."]}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:97:11",className:"mt-8",children:[V.map(n=>a("div",{"code-path":"src/components/status/SourcesSection.tsx:99:15",className:"ds-row",children:[t("div",{"code-path":"src/components/status/SourcesSection.tsx:100:17","aria-hidden":"true",className:"ds-rule h-px origin-left bg-hairline"}),a("div",{"code-path":"src/components/status/SourcesSection.tsx:101:17",className:"-mx-2 flex flex-wrap items-baseline gap-x-4 gap-y-1.5 rounded-chip px-2 py-4 transition-colors duration-fast ease-out-soft hover:bg-paper-sunk",children:[t("span",{"code-path":"src/components/status/SourcesSection.tsx:102:19",className:"w-10 shrink-0 font-mono text-micro text-ink-3",children:n.id}),t("span",{"code-path":"src/components/status/SourcesSection.tsx:105:19",className:"min-w-0",children:n.external?a("a",{"code-path":"src/components/status/SourcesSection.tsx:107:23",href:n.name,target:"_blank",rel:"noopener",className:"inline-flex items-baseline gap-1 break-all font-mono text-[14px] font-medium text-signal-strong underline-offset-4 hover:underline",children:[n.name,t(T,{"code-path":"src/components/status/SourcesSection.tsx:114:25",size:12,strokeWidth:1.5,"aria-hidden":"true",className:"shrink-0 self-center"})]}):t("code",{"code-path":"src/components/status/SourcesSection.tsx:122:23",className:"inline-block rounded-chip border border-hairline bg-paper-sunk px-1.5 py-0.5 font-mono text-[14px] font-medium text-ink",children:n.name})}),n.gloss&&a("span",{"code-path":"src/components/status/SourcesSection.tsx:128:21",className:"text-small font-normal text-ink-2",children:["(",n.gloss,")"]})]})]},n.id)),t("div",{"code-path":"src/components/status/SourcesSection.tsx:135:13","aria-hidden":"true",className:"h-px bg-hairline"})]})]})]})]})}function X(){return t("div",{"code-path":"src/components/status/ParityFooter.tsx:8:5",className:"bg-ink",children:t("div",{"code-path":"src/components/status/ParityFooter.tsx:9:7",className:"container-fk py-10",children:t("p",{"code-path":"src/components/status/ParityFooter.tsx:10:9",className:"max-w-[880px] font-mono text-micro text-paper-on-ink-2",children:"WCAG-minded semantic HTML, keyboard focus, responsive 320px–1920px+, and reduced-motion-safe. Same design tokens as the landing page — parity enforced in test/pages.test.js."})})})}const y="forgekit status — live repository data",Y={"@context":"https://schema.org","@type":"SoftwareApplication",name:"@codewithjuber/forgekit",softwareVersion:"0.27.0",applicationCategory:"DeveloperApplication",operatingSystem:"macOS, Linux, Windows",offers:{"@type":"Offer",price:"0"}};function nt(){const e=q(),s=G();return k(()=>{const n=document.title;document.title=y;const o=[document.querySelector('meta[property="og:title"]'),document.querySelector('meta[name="twitter:title"]')].filter(r=>r!==null),c=o.map(r=>r.content);o.forEach(r=>{r.content=y});const i=document.createElement("script");return i.type="application/ld+json",i.textContent=JSON.stringify(Y),document.head.appendChild(i),()=>{document.title=n,o.forEach((r,H)=>{r.content=c[H]??""}),i.remove()}},[]),a(u,{children:[t(P,{"code-path":"src/pages/Status.tsx:64:7",repo:e}),t(U,{"code-path":"src/pages/Status.tsx:65:7"}),t($,{"code-path":"src/pages/Status.tsx:66:7"}),t(B,{"code-path":"src/pages/Status.tsx:67:7",changes:s}),t(K,{"code-path":"src/pages/Status.tsx:68:7",generatedAt:e.counts?.pushedAt??null}),t(X,{"code-path":"src/pages/Status.tsx:69:7"})]})}export{nt as S};
diff --git a/landing/index.html b/landing/index.html
index 4545b689..161531f7 100644
--- a/landing/index.html
+++ b/landing/index.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>ForgeKit — One operating memory for every coding agent</title>
-  <meta name="description" content="Open-source memory, foresight, and guardrails shared across Claude Code, Codex, Cursor, Gemini, and more.">
+  <meta name="description" content="Open-source memory and foresight shared across Claude Code, Codex, Cursor, Gemini, and more, with automatic guardrails on Claude Code.">
   <meta name="theme-color" content="#171310">
   <meta name="color-scheme" content="light">
   <link rel="canonical" href="https://codewithjuber.github.io/forgekit/">
@@ -13,16 +13,16 @@
   <meta property="og:type" content="website">
   <meta property="og:site_name" content="ForgeKit">
   <meta property="og:title" content="ForgeKit — One operating memory for every coding agent">
-  <meta property="og:description" content="Open-source memory, foresight, and guardrails shared across Claude Code, Codex, Cursor, Gemini, and more.">
+  <meta property="og:description" content="Open-source memory and foresight shared across Claude Code, Codex, Cursor, Gemini, and more, with automatic guardrails on Claude Code.">
   <meta property="og:url" content="https://codewithjuber.github.io/forgekit/">
   <meta property="og:image" content="https://codewithjuber.github.io/forgekit/og.png">
   <meta property="og:image:width" content="1200">
   <meta property="og:image:height" content="630">
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:title" content="ForgeKit — One operating memory for every coding agent">
-  <meta name="twitter:description" content="Open-source memory, foresight, and guardrails shared across Claude Code, Codex, Cursor, Gemini, and more.">
+  <meta name="twitter:description" content="Open-source memory and foresight shared across Claude Code, Codex, Cursor, Gemini, and more, with automatic guardrails on Claude Code.">
   <meta name="twitter:image" content="https://codewithjuber.github.io/forgekit/og.png">
-  <script type="application/ld+json">{"@context":"https://schema.org","@type":"SoftwareApplication","name":"ForgeKit","applicationCategory":"DeveloperApplication","operatingSystem":"macOS, Linux, Windows","softwareVersion":"1.4.3","url":"https://codewithjuber.github.io/forgekit/","description":"Open-source memory, foresight, and guardrails shared across Claude Code, Codex, Cursor, Gemini, and more.","license":"https://opensource.org/license/mit","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"codeRepository":"https://github.com/CodeWithJuber/forgekit"}</script>
+  <script type="application/ld+json">{"@context":"https://schema.org","@type":"SoftwareApplication","name":"ForgeKit","applicationCategory":"DeveloperApplication","operatingSystem":"macOS, Linux, Windows","softwareVersion":"1.4.3","url":"https://codewithjuber.github.io/forgekit/","description":"Open-source memory and foresight shared across Claude Code, Codex, Cursor, Gemini, and more, with automatic guardrails on Claude Code.","license":"https://opensource.org/license/mit","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"codeRepository":"https://github.com/CodeWithJuber/forgekit"}</script>
   <script src="./app.js" defer></script>
   <style>
 :root {
@@ -1783,7 +1783,7 @@
   </style>
 </head>
 <body>
-<a class="skip-link" href="#main">Skip to content</a><div class="scroll-progress" aria-hidden="true" style="transform:scaleX(0)"></div><header class="site-header"><a class="brand" href="#top" aria-label="ForgeKit home"><span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span><span>forge</span><span class="brand-slash">/</span><span>kit</span></a><nav aria-label="Primary navigation"><a href="#system">System</a><a href="#proof">Evidence</a><a href="#install">Install</a></nav><a class="header-github" href="https://github.com/CodeWithJuber/forgekit" target="_blank" rel="noreferrer">GitHub <span aria-hidden="true">↗</span></a></header><main id="main"><section class="hero" id="top" aria-labelledby="hero-title"><div class="hero-copy"><div class="eyebrow"><span class="live-dot"></span>Open source cognitive substrate<span class="eyebrow-version">forgekit v1.4.3 · beta</span></div><h1 id="hero-title">One operating<br><em>memory.</em> Every<br>coding agent.</h1><p class="hero-description">ForgeKit gives every AI coding tool the same memory, foresight, and guardrails—without locking your work inside one vendor or one chat window.</p><div class="hero-actions"><a class="button button-primary" href="#install">Install ForgeKit <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a><a class="button button-secondary" href="https://github.com/CodeWithJuber/forgekit#readme" target="_blank" rel="noreferrer">Read the source <span aria-hidden="true">↗</span></a></div><dl class="hero-facts"><div><dt>Runtime deps</dt><dd>0</dd></div><div><dt>Native targets</dt><dd>9</dd></div><div><dt>License</dt><dd>MIT</dd></div></dl></div><div class="hero-instrument" aria-label="ForgeKit protocol monitor"><div class="instrument-head"><span>FK / PREFLIGHT</span><span class="instrument-status">SYSTEM READY</span></div><div class="instrument-scope"><span class="scope-index">01</span><div><span class="scope-label">REQUEST</span><strong>Refactor authentication flow</strong></div><span class="scope-time">00:118</span></div><div class="signal-map" aria-hidden="true"><div class="signal-axis signal-axis-x"></div><div class="signal-axis signal-axis-y"></div><div class="signal-node signal-node-a"><span></span>RECALL</div><div class="signal-node signal-node-b"><span></span>FORESEE</div><div class="signal-node signal-node-c"><span></span>GATE</div><div class="signal-pulse"></div></div><ol class="instrument-log"><li><span>01</span><strong>Memory recalled</strong><b>PASS</b></li><li><span>02</span><strong>Blast radius mapped</strong><b>PASS</b></li><li><span>03</span><strong>Guardrails checked</strong><b>PASS</b></li></ol><div class="instrument-foot"><span>TRACE FK-031-7D4</span><span>PROCEED →</span></div></div></section><section class="system-section" id="system" aria-labelledby="system-title"><div class="section-kicker"><span>01 / The substrate</span><span>State before action</span></div><div class="section-intro"><h2 id="system-title">The missing layer between<br>your intent and your agent.</h2><p>Models are capable. Their operating context is fragile. ForgeKit supplies the durable layer that travels with the repository and shows up before the next action.</p></div><div class="capability-console"><div class="capability-tabs" role="tablist" aria-label="ForgeKit capabilities"><button type="button" role="tab" aria-selected="true" aria-controls="capability-panel" id="capability-memory"><span>01</span><strong>Memory</strong><i aria-hidden="true">→</i></button><button type="button" role="tab" aria-selected="false" aria-controls="capability-panel" id="capability-foresight"><span>02</span><strong>Foresight</strong><i aria-hidden="true">→</i></button><button type="button" role="tab" aria-selected="false" aria-controls="capability-panel" id="capability-guardrails"><span>03</span><strong>Guardrails</strong><i aria-hidden="true">→</i></button></div><div class="capability-panel" id="capability-panel" role="tabpanel" aria-labelledby="capability-memory"><div class="capability-copy"><span class="console-label">ACTIVE CAPABILITY / 01</span><h3>Context that survives the chat.</h3><p>Forge keeps decisions, lessons, and project state in the repository—so Claude, Codex, Cursor, and the next agent all inherit the same working memory.</p><span class="capability-status"><i></i> 3 records recalled</span></div><div class="memory-records"><div class="records-head"><span>TYPE</span><span>RECORD</span><span>STATE</span></div><div class="record"><span>decision</span><strong>Use SQLite for local-first state</strong><b>94%</b></div><div class="record"><span>lesson</span><strong>Run schema checks before generation</strong><b>88%</b></div><div class="record"><span>preference</span><strong>Keep the CLI dependency-free</strong><b>82%</b></div></div></div></div></section><section class="protocol-section" aria-labelledby="protocol-title"><div class="section-kicker section-kicker-dark"><span>02 / The protocol</span><span>One request · five checks · one trace</span></div><div class="protocol-grid"><div class="protocol-copy"><h2 id="protocol-title">Action should leave evidence.</h2><p>Forge turns agent behavior into a reviewable sequence. Each meaningful move begins with context and ends with proof.</p></div><ol class="protocol-steps"><li><span>01</span><strong>Recall</strong><p>Load relevant decisions and lessons.</p></li><li><span>02</span><strong>Classify</strong><p>Measure scope, cost, and reversibility.</p></li><li><span>03</span><strong>Foresee</strong><p>Map downstream surfaces before editing.</p></li><li><span>04</span><strong>Gate</strong><p>Pause risky or under-specified actions.</p></li><li><span>05</span><strong>Trace</strong><p>Record what changed and how it was verified.</p></li></ol></div></section><section class="tools-section" aria-labelledby="tools-title"><div class="section-kicker"><span>03 / One source</span><span>Nine native targets</span></div><div class="tools-heading"><h2 id="tools-title">Change the agent. Keep the operating system.</h2><p>One source emits each tool’s native configuration. Your rules and memory stay with the project—not the provider.</p></div><ul class="tool-grid" aria-label="Supported AI coding tools"><li><span>01</span><i aria-hidden="true">CC</i><strong>Claude Code</strong></li><li><span>02</span><i aria-hidden="true">CX</i><strong>Codex</strong></li><li><span>03</span><i aria-hidden="true">CR</i><strong>Cursor</strong></li><li><span>04</span><i aria-hidden="true">GM</i><strong>Gemini</strong></li><li><span>05</span><i aria-hidden="true">AI</i><strong>Aider</strong></li><li><span>06</span><i aria-hidden="true">CP</i><strong>Copilot</strong></li><li><span>07</span><i aria-hidden="true">WS</i><strong>Windsurf</strong></li><li><span>08</span><i aria-hidden="true">ZD</i><strong>Zed</strong></li><li><span>09</span><i aria-hidden="true">CT</i><strong>Continue</strong></li></ul><p class="tools-note">Plus MCP configuration for Roo Code and VS Code-compatible clients.</p></section><section class="proof-section" id="proof" aria-labelledby="proof-title"><div class="section-kicker section-kicker-dark"><span>04 / Evidence ledger</span><span>Measured, not invented</span></div><div class="proof-heading"><h2 id="proof-title">Fast enough to stay in the loop.</h2><p>ForgeKit publishes the measurements behind its claims. The numbers below come from repository benchmarks and evaluation reports—not a marketing dashboard.</p></div><dl class="metrics-ledger"><div><dt>Pre-action gate</dt><dd data-benchmark="886 ms">886<span>ms</span></dd><small>End-to-end benchmark</small></div><div><dt>Blast-radius scan</dt><dd data-benchmark="0.40 ms">0.40<span>ms</span></dd><small>Heuristic analysis</small></div><div><dt>Held-out routing cost</dt><dd>+20.2<span>%</span></dd><small>vs always-premium, 80 tasks</small></div><div><dt>Runtime dependencies</dt><dd>0</dd><small>Node.js standard library</small></div></dl><a class="text-link text-link-light" href="https://github.com/CodeWithJuber/forgekit/tree/master/reports" target="_blank" rel="noreferrer">Inspect the evidence <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a></section><section class="limits-section" aria-labelledby="limits-title"><div class="limits-marker" aria-hidden="true">BETA</div><div class="limits-copy"><div class="section-kicker"><span>05 / Honest limits</span><span>Professional, not magical</span></div><h2 id="limits-title">The guardrail is not the road.</h2><p class="limits-lead">ForgeKit improves agent judgment; it does not replace yours. The project labels its assumptions so you can decide where to trust, test, or intervene.</p><ul><li><span>01</span><p><strong>Claude Code is the deepest-tested integration.</strong> Other targets have less real-world exercise today.</p></li><li><span>02</span><p><strong>Blast-radius analysis is heuristic.</strong> It guides review; it is not a formal dependency proof.</p></li><li><span>03</span><p><strong>Guardrails are not a sandbox.</strong> Keep permissions, review, and backups appropriate to the work.</p></li></ul></div></section><section class="install-section" id="install" aria-labelledby="install-title"><div class="install-copy"><div class="section-kicker"><span>06 / Start here</span><span>About sixty seconds</span></div><h2 id="install-title">Give the next agent a better starting point.</h2><p>Install ForgeKit, run <code>forge init</code> in your repository, and keep one shared operating context across every tool.</p><a class="text-link" href="https://github.com/CodeWithJuber/forgekit#60-second-quickstart" target="_blank" rel="noreferrer">Open the quickstart <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a></div><div class="install-terminal"><div class="install-tabs" role="tablist" aria-label="Installation methods"><button type="button" role="tab" aria-selected="true" aria-controls="install-panel" id="install-plugin">Claude / Codex</button><button type="button" role="tab" aria-selected="false" aria-controls="install-panel" id="install-npm">Any tool</button><button type="button" role="tab" aria-selected="false" aria-controls="install-panel" id="install-github">From source</button></div><div class="terminal-panel" id="install-panel" role="tabpanel" aria-labelledby="install-plugin"><div class="terminal-bar"><span>forgekit / install</span><button type="button" aria-live="polite"><svg aria-hidden="true" viewBox="0 0 20 20"><rect x="7" y="7" width="9" height="9" rx="1"></rect><path d="M13 7V4H4v9h3"></path></svg>Copy</button></div><pre tabindex="0"><code><span><i aria-hidden="true">$</i> /plugin marketplace add CodeWithJuber/forgekit
+<a class="skip-link" href="#main">Skip to content</a><div class="scroll-progress" aria-hidden="true" style="transform:scaleX(0)"></div><header class="site-header"><a class="brand" href="#top" aria-label="ForgeKit home"><span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span><span>forge</span><span class="brand-slash">/</span><span>kit</span></a><nav aria-label="Primary navigation"><a href="#system">System</a><a href="#proof">Evidence</a><a href="#install">Install</a></nav><a class="header-github" href="https://github.com/CodeWithJuber/forgekit" target="_blank" rel="noreferrer">GitHub <span aria-hidden="true">↗</span></a></header><main id="main"><section class="hero" id="top" aria-labelledby="hero-title"><div class="hero-copy"><div class="eyebrow"><span class="live-dot"></span>Open source cognitive substrate<span class="eyebrow-version">forgekit v1.4.3 · beta</span></div><h1 id="hero-title">One operating<br><em>memory.</em> Every<br>coding agent.</h1><p class="hero-description">ForgeKit gives every AI coding tool the same memory and foresight—with automatic guardrails on Claude Code—without locking your work inside one vendor or one chat window.</p><div class="hero-actions"><a class="button button-primary" href="#install">Install ForgeKit <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a><a class="button button-secondary" href="https://github.com/CodeWithJuber/forgekit#readme" target="_blank" rel="noreferrer">Read the source <span aria-hidden="true">↗</span></a></div><dl class="hero-facts"><div><dt>Runtime deps</dt><dd>0</dd></div><div><dt>Native targets</dt><dd>9</dd></div><div><dt>License</dt><dd>MIT</dd></div></dl></div><div class="hero-instrument" aria-label="ForgeKit protocol monitor"><div class="instrument-head"><span>FK / PREFLIGHT</span><span class="instrument-status">SYSTEM READY</span></div><div class="instrument-scope"><span class="scope-index">01</span><div><span class="scope-label">REQUEST</span><strong>Refactor authentication flow</strong></div><span class="scope-time">00:118</span></div><div class="signal-map" aria-hidden="true"><div class="signal-axis signal-axis-x"></div><div class="signal-axis signal-axis-y"></div><div class="signal-node signal-node-a"><span></span>RECALL</div><div class="signal-node signal-node-b"><span></span>FORESEE</div><div class="signal-node signal-node-c"><span></span>GATE</div><div class="signal-pulse"></div></div><ol class="instrument-log"><li><span>01</span><strong>Memory recalled</strong><b>PASS</b></li><li><span>02</span><strong>Blast radius mapped</strong><b>PASS</b></li><li><span>03</span><strong>Guardrails checked</strong><b>PASS</b></li></ol><div class="instrument-foot"><span>TRACE FK-031-7D4</span><span>PROCEED →</span></div></div></section><section class="system-section" id="system" aria-labelledby="system-title"><div class="section-kicker"><span>01 / The substrate</span><span>State before action</span></div><div class="section-intro"><h2 id="system-title">The missing layer between<br>your intent and your agent.</h2><p>Models are capable. Their operating context is fragile. ForgeKit supplies the durable layer that travels with the repository and shows up before the next action.</p></div><div class="capability-console"><div class="capability-tabs" role="tablist" aria-label="ForgeKit capabilities"><button type="button" role="tab" aria-selected="true" aria-controls="capability-panel" id="capability-memory"><span>01</span><strong>Memory</strong><i aria-hidden="true">→</i></button><button type="button" role="tab" aria-selected="false" aria-controls="capability-panel" id="capability-foresight"><span>02</span><strong>Foresight</strong><i aria-hidden="true">→</i></button><button type="button" role="tab" aria-selected="false" aria-controls="capability-panel" id="capability-guardrails"><span>03</span><strong>Guardrails</strong><i aria-hidden="true">→</i></button></div><div class="capability-panel" id="capability-panel" role="tabpanel" aria-labelledby="capability-memory"><div class="capability-copy"><span class="console-label">ACTIVE CAPABILITY / 01</span><h3>Context that survives the chat.</h3><p>Forge keeps decisions, lessons, and project state in the repository—so Claude, Codex, Cursor, and the next agent all inherit the same working memory.</p><span class="capability-status"><i></i> 3 records recalled</span></div><div class="memory-records"><div class="records-head"><span>TYPE</span><span>RECORD</span><span>STATE</span></div><div class="record"><span>decision</span><strong>Use SQLite for local-first state</strong><b>94%</b></div><div class="record"><span>lesson</span><strong>Run schema checks before generation</strong><b>88%</b></div><div class="record"><span>preference</span><strong>Keep the CLI dependency-free</strong><b>82%</b></div></div></div></div></section><section class="protocol-section" aria-labelledby="protocol-title"><div class="section-kicker section-kicker-dark"><span>02 / The protocol</span><span>One request · five checks · one trace</span></div><div class="protocol-grid"><div class="protocol-copy"><h2 id="protocol-title">Action should leave evidence.</h2><p>Forge turns agent behavior into a reviewable sequence. Each meaningful move begins with context and ends with proof.</p></div><ol class="protocol-steps"><li><span>01</span><strong>Recall</strong><p>Load relevant decisions and lessons.</p></li><li><span>02</span><strong>Classify</strong><p>Measure scope, cost, and reversibility.</p></li><li><span>03</span><strong>Foresee</strong><p>Map downstream surfaces before editing.</p></li><li><span>04</span><strong>Gate</strong><p>Pause risky or under-specified actions.</p></li><li><span>05</span><strong>Trace</strong><p>Record what changed and how it was verified.</p></li></ol></div></section><section class="tools-section" aria-labelledby="tools-title"><div class="section-kicker"><span>03 / One source</span><span>Nine native targets</span></div><div class="tools-heading"><h2 id="tools-title">Change the agent. Keep the operating system.</h2><p>One source emits each tool’s native configuration. Your rules and memory stay with the project—not the provider.</p></div><ul class="tool-grid" aria-label="Supported AI coding tools"><li><span>01</span><i aria-hidden="true">CC</i><strong>Claude Code</strong></li><li><span>02</span><i aria-hidden="true">CX</i><strong>Codex</strong></li><li><span>03</span><i aria-hidden="true">CR</i><strong>Cursor</strong></li><li><span>04</span><i aria-hidden="true">GM</i><strong>Gemini</strong></li><li><span>05</span><i aria-hidden="true">AI</i><strong>Aider</strong></li><li><span>06</span><i aria-hidden="true">CP</i><strong>Copilot</strong></li><li><span>07</span><i aria-hidden="true">WS</i><strong>Windsurf</strong></li><li><span>08</span><i aria-hidden="true">ZD</i><strong>Zed</strong></li><li><span>09</span><i aria-hidden="true">CT</i><strong>Continue</strong></li></ul><p class="tools-note">Plus MCP configuration for Roo Code and VS Code-compatible clients.</p></section><section class="proof-section" id="proof" aria-labelledby="proof-title"><div class="section-kicker section-kicker-dark"><span>04 / Evidence ledger</span><span>Measured, not invented</span></div><div class="proof-heading"><h2 id="proof-title">Fast enough to stay in the loop.</h2><p>ForgeKit publishes the measurements behind its claims. The numbers below come from repository benchmarks and evaluation reports—not a marketing dashboard.</p></div><dl class="metrics-ledger"><div><dt>Pre-action gate</dt><dd data-benchmark="851 ms">851<span>ms</span></dd><small>End-to-end benchmark</small></div><div><dt>Blast-radius scan</dt><dd data-benchmark="1.68 ms">1.68<span>ms</span></dd><small>Heuristic analysis</small></div><div><dt>Held-out routing cost</dt><dd>+20.2<span>%</span></dd><small>vs always-premium, 80 tasks</small></div><div><dt>Runtime dependencies</dt><dd>0</dd><small>Node.js standard library</small></div></dl><a class="text-link text-link-light" href="https://github.com/CodeWithJuber/forgekit/tree/master/reports" target="_blank" rel="noreferrer">Inspect the evidence <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a></section><section class="limits-section" aria-labelledby="limits-title"><div class="limits-marker" aria-hidden="true">BETA</div><div class="limits-copy"><div class="section-kicker"><span>05 / Honest limits</span><span>Professional, not magical</span></div><h2 id="limits-title">The guardrail is not the road.</h2><p class="limits-lead">ForgeKit improves agent judgment; it does not replace yours. The project labels its assumptions so you can decide where to trust, test, or intervene.</p><ul><li><span>01</span><p><strong>Claude Code is the deepest-tested integration.</strong> Other targets have less real-world exercise today.</p></li><li><span>02</span><p><strong>Blast-radius analysis is heuristic.</strong> It guides review; it is not a formal dependency proof.</p></li><li><span>03</span><p><strong>Guardrails are not a sandbox.</strong> Keep permissions, review, and backups appropriate to the work.</p></li></ul></div></section><section class="install-section" id="install" aria-labelledby="install-title"><div class="install-copy"><div class="section-kicker"><span>06 / Start here</span><span>About sixty seconds</span></div><h2 id="install-title">Give the next agent a better starting point.</h2><p>Install ForgeKit, run <code>forge init</code> in your repository, and keep one shared operating context across every tool.</p><a class="text-link" href="https://github.com/CodeWithJuber/forgekit#60-second-quickstart" target="_blank" rel="noreferrer">Open the quickstart <svg aria-hidden="true" viewBox="0 0 20 20"><path d="M4 10h11M11 5l5 5-5 5"></path></svg></a></div><div class="install-terminal"><div class="install-tabs" role="tablist" aria-label="Installation methods"><button type="button" role="tab" aria-selected="true" aria-controls="install-panel" id="install-plugin">Claude / Codex</button><button type="button" role="tab" aria-selected="false" aria-controls="install-panel" id="install-npm">Any tool</button><button type="button" role="tab" aria-selected="false" aria-controls="install-panel" id="install-github">From source</button></div><div class="terminal-panel" id="install-panel" role="tabpanel" aria-labelledby="install-plugin"><div class="terminal-bar"><span>forgekit / install</span><button type="button" aria-live="polite"><svg aria-hidden="true" viewBox="0 0 20 20"><rect x="7" y="7" width="9" height="9" rx="1"></rect><path d="M13 7V4H4v9h3"></path></svg>Copy</button></div><pre tabindex="0"><code><span><i aria-hidden="true">$</i> /plugin marketplace add CodeWithJuber/forgekit
 </span><span><i aria-hidden="true">$</i> /plugin install forgekit
 </span></code></pre><p><i></i> Recommended · ambient guards on every prompt</p></div></div></section></main><footer><div class="footer-brand"><span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span><strong>forge / kit</strong></div><p>One brain for every AI coding agent.</p><div class="footer-links"><a href="https://github.com/CodeWithJuber/forgekit" target="_blank" rel="noreferrer">GitHub ↗</a><a href="https://github.com/CodeWithJuber/forgekit/blob/master/LICENSE" target="_blank" rel="noreferrer">MIT License ↗</a></div><span class="footer-version">forgekit v1.4.3</span></footer>
 </body>
diff --git a/mintlify/cli/substrate.mdx b/mintlify/cli/substrate.mdx
index f399e3d9..eb8439b0 100644
--- a/mintlify/cli/substrate.mdx
+++ b/mintlify/cli/substrate.mdx
@@ -110,9 +110,13 @@ Consequence simulation — predicted breaks + the minimal dry-run test suite for
 
 ```bash
 forge imagine "<task>"
-forge imagine "<task>" --run   # execute the minimal suite sandboxed
+forge imagine "<task>" --run   # execute the minimal suite in an isolated git checkout
 ```
 
+`--run` executes the suite in an isolated git checkout (a detached-HEAD worktree). It isolates
+checkout files only — not network, credentials, your home directory or process permissions — and
+it tests the committed baseline, not uncommitted changes.
+
 ## `forge lean`
 
 Scope-minimality (M5) — measure the diff's footprint vs what the task asked for.
diff --git a/mintlify/introduction.mdx b/mintlify/introduction.mdx
index 144c5307..8808cc9c 100644
--- a/mintlify/introduction.mdx
+++ b/mintlify/introduction.mdx
@@ -1,17 +1,21 @@
 ---
 title: "Forge: the cognitive substrate for AI coding agents"
-description: "Forge is the cognitive substrate stateless models are missing — memory, foresight, and guardrails — as native config for every AI coding agent."
+description: "A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis, and explicit verification around coding agents — as native config for every AI coding tool."
 ---
 
-**One brain for every AI coding agent.** A large language model is stateless: one
-context window, wiped every call. It has no memory of what your team learned, no
-foresight about what an edit will break, and no enforced guardrails. Forge
+**A beta toolkit for shared evidence-referenced memory, heuristic change-impact analysis,
+and explicit verification around coding agents.** A language model keeps no durable state between
+independent calls and sees only a bounded context window, so on its own it does not carry what
+your team learned, cannot see the parts of the repository an edit affects unless they are in
+context, and cannot enforce rules on itself. Forge
 (`@codewithjuber/forgekit`) is the **cognitive substrate** — the layer that runs
 _before_ the model edits code, supplying evidence-referenced, content-addressed memory (we
-call it "proof-carrying memory"), heuristic impact foresight, and enforced guardrails — and
-a **cross-tool config compiler** that delivers that brain as native config into every tool
-at once. Claude Code is the deepest-tested integration; the others receive native config and
-MCP tools with less real-world exercise.
+call it "proof-carrying memory"), heuristic impact foresight, and guardrails (blocking on
+Claude Code) — and a **cross-tool config compiler** that delivers that brain as native config
+into every tool at once. Claude Code is the deepest-tested integration and the only one with
+automatic hooks; the others receive native config (most also an MCP server entry) with less
+real-world exercise. The repository's `docs/INTEGRATIONS.md` lists, per tool, what is emitted,
+registered, run automatically and enforced.
 
 <CardGroup cols={3}>
   <Card title="Memory" icon="brain">
@@ -30,10 +34,11 @@ MCP tools with less real-world exercise.
 
 ## The problem
 
-A large language model is stateless — one context window, wiped every call.
+A language model keeps no durable state between independent calls, and it sees only what fits in
+its context window.
 
-- It has **no memory** of what your team already learned.
-- It has **no foresight** about what an edit will break.
+- It does not **carry what your team learned** from one session to the next.
+- It does not **see what an edit will affect** unless those files are in its context.
 - It has **no enforced guardrails** — prose rules get forgotten after a compaction.
 
 And every tool wants its own config file (`CLAUDE.md`, `AGENTS.md`, `.cursor/rules`,
@@ -42,11 +47,12 @@ things, and the compiler that delivers it into every tool from one source.
 
 ## The thesis
 
-A model can't learn from your codebase between calls: its weights are frozen and its
-working memory is wiped after every response. Memory, foresight, and self-checking
-can't be prompted into it — they have to be supplied from _outside_. That outside layer
-is the cognitive substrate. Formally, inference is a fixed function `y = f(x)` with no
-state between calls; Forge is the state.
+A model with frozen weights does adapt within one context — examples, retrieved facts and
+feedback change what it does — but it does not guarantee four things on its own: durable state
+across independent calls, context beyond its window, weight updates from outcomes, and reliable
+self-verification without external evidence. Forge supplies persistence and external checks from
+_outside_ the model. It is one tested way of doing that, not the only possible architecture;
+the research programme's dated corrections explain the difference.
 
 <Steps>
   <Step title="Author once">
@@ -75,8 +81,9 @@ state between calls; Forge is the state.
   content-addressed memory: a claim that carries references to its evidence and is trusted
   only once independent oracles raise its confidence above a floor. The "proof" is that
   evidence trail, not a formal proof.
-- **Foresight before you break things.** Ask "what does changing `verifyToken` break?"
-  and get the blast radius from the code graph, including coupled files you never named.
+- **Heuristic impact before you break things.** Ask "what does changing `verifyToken`
+  break?" and get the blast radius from a regex-derived code graph, including coupled files you
+  never named — it can miss files as well as over-warn.
 - **Guardrails that can't be forgotten.** Deterministic hooks enforce protected paths,
   cost budgets, and doom-loop detection — they survive a context compaction.
 - **Work that finishes end to end.** A completion gate blocks "done" once per session
@@ -117,8 +124,10 @@ Forge states its own ceiling everywhere.
 - **Tests and human corrections always win.**
 
 <Note>
-  Forge is **beta**. The core (`init`, `sync`, `substrate`, `impact`, `ledger`, guards)
-  is tested and in daily use; some flags may change before `1.0`.
+  Forge is **beta**: releases follow semantic versioning (a breaking change is a new major
+  version), and "beta" describes maturity — heuristic analyses, advisory checks, and less
+  real-world exercise outside Claude Code. The core (`init`, `sync`, `substrate`, `impact`,
+  `ledger`, guards) is tested and in daily use.
 </Note>
 
 ## Next steps
diff --git a/reports/2026-07-05.md b/reports/2026-07-05.md
index f4542af8..8e89e492 100644
--- a/reports/2026-07-05.md
+++ b/reports/2026-07-05.md
@@ -1,5 +1,11 @@
 # Claude Config Radar — 2026-07-05
 
+> ⚠️ **Archived — historical.** An auto-generated daily report from 2026-07-05, kept for the record.
+> Not maintained and not the current state; its action items (including the credential-rotation
+> reminders, which mention no secret values) are historical and superseded. See
+> **[docs/GUIDE.md](../docs/GUIDE.md)** for today's tooling and **[SECURITY.md](../SECURITY.md)** for
+> reporting a live security issue.
+
 **TL;DR**
 - 🔴 **Security-relevant dep bump**: pgvector **0.8.2** fixes a buffer overflow in parallel HNSW index builds (**CVE-2026-3172**) — your stack uses pgvector, so this is the one worth acting on.
 - 🟡 **shadcn/ui** made **Base UI the default** component library (docs + new projects) as of July 2026 — escalation of yesterday's "picking Base UI ~2:1" note; Radix not deprecated.
diff --git a/reports/benchmarks.md b/reports/benchmarks.md
index b52e2f9c..e27ae4c1 100644
--- a/reports/benchmarks.md
+++ b/reports/benchmarks.md
@@ -4,7 +4,7 @@
 > **a number is an assumption until measured.** Every figure in the generated section below
 > came from an actual run of `npm run bench` on the machine recorded in the environment
 > block — no projections, no targets, no numbers copied forward from a different machine.
-> Re-run `npm run bench` (≈10 s, node stdlib only) and the generated section is rewritten
+> Re-run `npm run bench` (≈20 s, node stdlib only) and the generated section is rewritten
 > in place with your machine's numbers.
 
 ## Methodology
@@ -45,12 +45,22 @@
 - **ledger / val()**: pure in-memory scoring; the fixture gives most claims 0–1 evidence
   records, and val() cost scales with evidence count — a heavily-evidenced ledger will be
   slower per claim.
-- **reuse / lookup**: the memoized `_sketch` cache is stripped before every timed run, so
-  each run behaves like a fresh CLI process. The *exact* tier returns before any pool
-  sketching (normalized-string compare); the *near* tier pays MinHash-sketching the whole
-  candidate pool plus LSH banding — that difference is the point of reporting both.
+- **reuse / lookup**: every row is VALIDATED before it is timed — the fixture's artifacts
+  cite a real, resolvable git object as their test evidence, and the harness aborts unless
+  the lookup returns the tier the row is labeled with (review F14, 2026-09-26: the previous
+  fixture cited untyped `bench:artifact:<i>` refs, which val() caps below the serving floor,
+  so every "exact"/"near" row had actually measured a MISS; those older numbers are
+  invalid). "cold" rows strip every memoized sketch the lookup path caches (`_sketch`,
+  `_terms`, `_specSketch`, `_keySketch` — the old harness stripped only `_sketch`, which the
+  reuse ladder never reads), so each run behaves like a fresh CLI process; "warm" rows keep
+  them, like a long-lived process. The *exact* tier returns before any pool sketching
+  (identity-key compare); *near* and *miss* pay MinHash-sketching the candidate pool plus
+  LSH banding — that difference is the point of reporting them separately.
 - **context / assemble()**: warm atlas, empty ledger (the repo copy has no `.forge`),
   includes the real file reads for pinned items. Task: a three-symbol, one-file edit spec.
+  "complete"/"incomplete" is the assembler's own honest verdict: an item that could only
+  be delivered as a pointer or partial span is a pending read, so a large named file makes
+  this task's context incomplete at the default budget (review F02/F03).
 - **substrate / substrateCheck**: the whole deterministic gate — preflight grounding,
   routing rubric, up to 8 impact queries, reuse lookup, context assembly, scope
   decomposition, lessons, minimality, goal anchor — with `llm: false`. **No model latency
@@ -90,9 +100,12 @@ now resolve to the exact symbol (`src/atlas.js:17 imports → src/util.js:conten
 
 What these numbers do **not** mean: n = 6 cases, one JavaScript repo, symbols chosen to be
 uniquely named (the atlas resolves ambiguous names to nothing — a separate, known
-limitation). They are not comparable to the paper's numbers, which came from mutation
-testing a Python codebase against a real test suite. The two appear side by side below,
-labeled, and are never blended.
+limitation). They are not comparable to the paper prototype's numbers: its 0.63 / 1.00 /
+0.75 came from mutation testing on the authors' own fixture — a self-built demo that the
+pre-registered field study REFUTED (pooled precision 0.40, recall 0.022, F1 0.042 over 759
+files' mined co-change in nine repositories; see `research/empirical-refutation/`). The
+regex atlas here is a different, Node graph — not the evaluated Python oracle. All three
+appear side by side below, labeled, and are never blended.
 
 > **History of this row.** The precision 0.90 / F1 0.92 this file carried until 2026-09-21 came
 > from a much smaller atlas (145 files) and a reverse walk that stopped at the direct
@@ -114,61 +127,69 @@ labeled, and are never blended.
 
 ```json
 {
-  "node": "v24.19.0",
-  "cpu": "AMD EPYC Processor (with IBPB)",
+  "node": "v22.22.2",
+  "cpu": "Intel(R) Xeon(R) Processor @ 2.80GHz",
   "cores": 4,
-  "memGB": 8,
-  "platform": "win32",
+  "memGB": 16,
+  "platform": "linux",
   "arch": "x64",
-  "commit": "703da31d574c30d22bef019b1c8563ade0d0d6be",
-  "date": "2026-09-21T22:09:58.366Z"
+  "fsType": "ext2/ext3",
+  "commit": "a56606afd5baebdabee95ad95af626a965557d92 + uncommitted changes",
+  "date": "2026-09-26T20:35:15.125Z"
 }
 ```
 
 ### Measured results
 
-| suite     | benchmark                                   | median   | p95     | runs | notes                                  |
-|-----------|---------------------------------------------|----------|---------|------|----------------------------------------|
-| atlas     | full build (this repo)                      | 530 ms   | 622 ms  | 5    | 455 files, 10498 symbols, 29728 edges  |
-| atlas     | incremental rebuild (unchanged)             | 339 ms   | 359 ms  | 5    | per-file hash cache hit                |
-| atlas     | impact("claimText") (warm adjacency)        | 0.40 ms  | 1.08 ms | 30   | 51 files impacted                      |
-| ledger    | mint+put 1000 claims                        | 1854 ms  | 1986 ms | 5    | 539/s                                  |
-| ledger    | loadClaims at 1000 claims                   | 213 ms   | 230 ms  | 5    | full state from disk                   |
-| ledger    | mergeDirs 2×500-claim replicas (250 shared) | 4308 ms  | 4409 ms | 3    | +250 claims, +313 records              |
-| ledger    | val() over 1000 claims                      | 0.076 ms | 0.16 ms | 20   | 13,140,604/s (mean val 0.51)           |
-| reuse     | fingerprint 2000 specs                      | 116 ms   | 156 ms  | 5    | 17,171/s                               |
-| reuse     | lookup exact @ 100 artifacts                | 5.71 ms  | 10.5 ms | 10   | tier=miss                              |
-| reuse     | lookup near (LSH) @ 100 artifacts           | 4.76 ms  | 5.18 ms | 5    | tier=miss, j=-                         |
-| reuse     | lookup exact @ 1000 artifacts               | 52.8 ms  | 88.5 ms | 10   | tier=miss                              |
-| reuse     | lookup near (LSH) @ 1000 artifacts          | 46.7 ms  | 89.8 ms | 5    | tier=miss, j=-                         |
-| context   | assemble() (this repo, 3-symbol task)       | 12.6 ms  | 30.0 ms | 10   | 4070/6000 tokens, 9 required, complete |
-| substrate | substrateCheck (allowBuild, llm off)        | 886 ms   | 908 ms  | 3    | 99 impacted files, route simple        |
+| suite     | benchmark                                    | median  | p95     | runs | notes                                                        |
+|-----------|----------------------------------------------|---------|---------|------|--------------------------------------------------------------|
+| atlas     | full build (this repo)                       | 719 ms  | 753 ms  | 5    | 504 files, 13396 symbols, 37369 edges, cap 20000 not reached |
+| atlas     | incremental rebuild (unchanged)              | 346 ms  | 365 ms  | 5    | per-file hash cache hit                                      |
+| atlas     | impact("claimText") (warm adjacency)         | 1.68 ms | 2.38 ms | 30   | 61 files impacted                                            |
+| ledger    | mint+put 1000 claims                         | 248 ms  | 326 ms  | 5    | 4,038/s                                                      |
+| ledger    | loadClaims at 1000 claims                    | 13.6 ms | 15.3 ms | 5    | full state from disk                                         |
+| ledger    | mergeDirs 2×500-claim replicas (250 shared)  | 191 ms  | 198 ms  | 3    | +250 claims, +313 records                                    |
+| ledger    | val() over 1000 claims                       | 0.85 ms | 1.39 ms | 20   | 1,170,474/s (mean val 0.51)                                  |
+| reuse     | fingerprint 2000 specs                       | 232 ms  | 290 ms  | 5    | 8,636/s                                                      |
+| reuse     | lookup exact hit, cold @ 100 artifacts       | 1.01 ms | 9.43 ms | 10   | tier=exact                                                   |
+| reuse     | lookup exact hit, warm @ 100 artifacts       | 0.67 ms | 5.89 ms | 10   | tier=exact                                                   |
+| reuse     | lookup near hit (LSH), cold @ 100 artifacts  | 18.5 ms | 33.0 ms | 5    | tier=near, j=0.98                                            |
+| reuse     | lookup miss, cold @ 100 artifacts            | 18.2 ms | 25.4 ms | 5    | tier=miss                                                    |
+| reuse     | lookup exact hit, cold @ 1000 artifacts      | 3.98 ms | 6.11 ms | 10   | tier=exact                                                   |
+| reuse     | lookup exact hit, warm @ 1000 artifacts      | 3.38 ms | 4.14 ms | 10   | tier=exact                                                   |
+| reuse     | lookup near hit (LSH), cold @ 1000 artifacts | 128 ms  | 133 ms  | 5    | tier=near, j=0.95                                            |
+| reuse     | lookup miss, cold @ 1000 artifacts           | 123 ms  | 130 ms  | 5    | tier=miss                                                    |
+| context   | assemble() (this repo, 3-symbol task)        | 17.6 ms | 27.0 ms | 10   | 4174/6000 tokens, 9 required, incomplete                     |
+| substrate | substrateCheck (allowBuild, llm off)         | 851 ms  | 995 ms  | 3    | 141 impacted files, route simple                             |
 
 ### Impact-oracle quality (hand-labeled cases, this repo)
 
 | case (target) | precision | recall | F1   | predicted | truth |
 |---------------|-----------|--------|------|-----------|-------|
-| normalizeSpec | 0.12      | 1.00   | 0.21 | 17        | 2     |
+| normalizeSpec | 0.11      | 1.00   | 0.20 | 18        | 2     |
 | evalImpact    | 0.29      | 1.00   | 0.44 | 7         | 2     |
-| isStale       | 0.20      | 1.00   | 0.33 | 30        | 6     |
-| mergeStates   | 0.16      | 1.00   | 0.28 | 25        | 4     |
-| claimText     | 0.16      | 1.00   | 0.27 | 51        | 8     |
-| contentHash   | 0.11      | 1.00   | 0.21 | 87        | 10    |
-| mean of 6     | 0.17      | 1.00   | 0.29 |           |       |
+| isStale       | 0.17      | 1.00   | 0.30 | 40        | 7     |
+| mergeStates   | 0.14      | 1.00   | 0.25 | 28        | 4     |
+| claimText     | 0.18      | 1.00   | 0.31 | 61        | 11    |
+| contentHash   | 0.10      | 1.00   | 0.19 | 105       | 11    |
+| mean of 6     | 0.17      | 1.00   | 0.28 |           |       |
 
-Edited-file-only baseline recall over the same cases: **0.27**.
+Edited-file-only baseline recall over the same cases: **0.26**.
 
-Two methodologies, side by side — different codebases, different ground-truth
+Different methodologies, side by side — different codebases, different ground-truth
 derivations, so the rows are comparable in spirit only and are never blended:
 
-| series                                     | precision | recall | F1   | ground truth                                  |
-|--------------------------------------------|-----------|--------|------|-----------------------------------------------|
-| paper prototype (Python, mutation-derived) | 0.63      | 1.00   | 0.75 | mutation testing against a real suite         |
-| this repo (regex atlas, hand-labeled)      | 0.17      | 1.00   | 0.29 | 6 hand-labeled cases (bench/impact_cases.mjs) |
+| series                                         | precision | recall | F1   | ground truth                                               |
+|------------------------------------------------|-----------|--------|------|------------------------------------------------------------|
+| paper prototype, self-built demo (REFUTED)     | 0.63      | 1.00   | 0.75 | mutation testing on the authors' own fixture               |
+| paper prototype, field study (pooled, 9 repos) | 0.40      | 0.02   | 0.04 | 759 files' mined co-change (research/empirical-refutation) |
+| this repo (regex atlas, hand-labeled)          | 0.17      | 1.00   | 0.28 | 6 hand-labeled cases (bench/impact_cases.mjs)              |
 
 <!-- BENCH:RESULTS:END -->
 
-> **Snapshot boundary.** The measured results above were generated at commit `eb68ea9` and
+> **Snapshot boundary.** The measured results above were generated at the commit recorded in
+> the environment block (`commit`; "+ uncommitted changes" means the working tree the review
+> fixes of 2026-09-26 were measured in, before they were committed) and
 > do not benchmark the optional embedding adapter now implemented in `src/embed.js` and
 > exercised with a deterministic fake provider in `test/embed.test.js`. MinHash remains the
 > zero-dependency default and failure fallback. The structural comparisons below describe the
@@ -216,6 +237,6 @@ that forgekit structurally does not.
 ## Reproduce
 
 ```sh
-npm run bench   # ≈10 s; prints the tables and rewrites the generated section above
+npm run bench   # ≈20 s; prints the tables and rewrites the generated section above
 npm test        # includes a smoke test of the harness's pure helpers (test/bench.test.js)
 ```
diff --git a/reports/cost-eval.md b/reports/cost-eval.md
index 0c66fd25..7171f28f 100644
--- a/reports/cost-eval.md
+++ b/reports/cost-eval.md
@@ -6,21 +6,30 @@
 > saving. The paper's 62 % routing saving (paper §9) was measured on the 30 tasks its
 > thresholds were tuned on and is **refuted**: on 80 held-out tasks, counting every escalation,
 > routing cost 20.2 % _more_ than always-premium ([research/empirical-refutation/](../research/empirical-refutation/)).
-> The plan's ~90 % composed figure is a **target**, not a result, and does not appear in this table.
+> The plan's ~90 % figure is a **target** and a hypothesis, not a result, and does not appear in this table.
+>
+> **Corrected 2026-09-26.** The methodology below used to say the cost model "is multiplicative —
+> `C = C₀ · Π(1 − fᵢ)` over independent stages — so each stage factor is measured separately and
+> composed arithmetically", and that paired runs reprice "identical tokens". Stage savings interact
+> (cache hits change the routed workload, context changes retries, halts can defer work), so the
+> per-stage factors are diagnostics, not a total; and repricing tokens at another model's price is a
+> counterfactual, not an observed outcome. The acceptance rule for any cost headline is in
+> [05-cost-model.md §3](../docs/plans/substrate-v2/05-cost-model.md#3-acceptance-rule-for-any-cost-headline).
 
 ## Methodology
 
-The cost model is multiplicative — `C = C₀ · Π(1 − fᵢ)` over independent stages — so each
-stage factor is measured separately and composed arithmetically, never asserted:
+Each stage factor is measured separately as a diagnostic; the system is judged only on paired,
+full-system outcomes (total cost per completed, externally verified task), never on a product of
+stage factors:
 
 1. **Instrumentation.** Every substrate stage appends one line to `.forge/metrics.jsonl`
    (`{t, stage, outcome, tokensIn, tokensOut, tier, savedEstimate, ref}` — `src/metrics.js`).
    `forge cost --stages` computes the per-stage factors from those lines (`src/cost_report.js`);
    a stage with no events reports **no data**, never a default.
-2. **Paired runs.** Baseline (always-premium, read-everything, no cache) vs. substrate over
-   the same replay corpus (N ≥ 100 real tasks, stratified repeat-heavy / mixed / cold), the
-   paper §9 methodology: identical tokens repriced, so every saving is arithmetic on measured
-   tokens.
+2. **Paired runs.** Baseline (equivalent tools, context and repair opportunity; always-premium /
+   read-everything reported too) vs. substrate over the same replay corpus (N ≥ 100 real tasks,
+   stratified repeat-heavy / mixed / cold), each policy actually executed. Repriced tokens are a
+   labelled counterfactual, not a measured saving.
 3. **Correctness guard (spec §3).** A saving counts only if the external verifier passes the
    output. A routed-down answer that fails is not a saving; a cache hit that gets reverted is
    recorded as a *negative* entry.
@@ -33,7 +42,7 @@ stage factor is measured separately and composed arithmetically, never asserted:
 | cache (reuse, tier-weighted) | — | 0 | no data yet — run with metrics enabled |
 | route (vs always-premium) | — | 0 | no data yet — run with metrics enabled |
 | context (assembly ρ) | — | 0 | no data yet — run with metrics enabled |
-| **composed (measured stages only)** | — | 0 | nothing to compose yet |
+| **composed (measured stages only; diagnostic, not a total)** | — | 0 | nothing to compose yet |
 
 Secondary counters (doom-loop halts avoided, M5 lean, avoided rework) are reported alongside
 when populated — they are deliberately excluded from the multiplication (spec §1).
diff --git a/research/HISTORICAL_EDITIONS.md b/research/HISTORICAL_EDITIONS.md
new file mode 100644
index 00000000..0ad05f00
--- /dev/null
+++ b/research/HISTORICAL_EDITIONS.md
@@ -0,0 +1,120 @@
+# Historical editions of the research papers
+
+> ⚠️ **Historical, pre-correction editions.** Every PDF listed here predates the 2026-09-21 and
+> 2026-09-26 corrections. It is kept so that what was published can still be read and cited, not
+> as the current text. The corrected sources are the HTML and LaTeX files named in the table;
+> read those.
+
+## Status on 2026-09-26: not regenerated
+
+A re-render of the three HTML papers was attempted on 2026-09-26 and **not committed**:
+
+1. **Figures need resolving.** The HTML sources reference every figure through a
+   `{{artifact:…}}` placeholder, which no browser resolves, so a plain render has no figures. The
+   map below resolves them; it was checked against the images embedded in the old PDFs.
+2. **The Qur'anic text could not be verified.** All three HTML papers carry Qur'anic Arabic. When
+   the white paper and the synthesis were rendered in the environment available that day, Chromium
+   set their verse text in three fallback fonts at once (DejaVu Sans for most glyphs, Liberation
+   Serif and FreeSerif for the rest); mixing fonts inside a word can break letter joining and mark
+   placement, and the rendered pages could not be inspected by eye. A PDF whose sacred text has not
+   been checked is not published as the new edition.
+3. **The refutation paper needs TeX.** `empirical-refutation/paper.pdf` is built from
+   `paper/main.tex` with a TeX Live toolchain; none was available.
+
+## The editions
+
+Each edition stays retrievable byte for byte at the pinned commit
+`d2abfa69fb77531199ffc67c5c076b524af69040`:
+`git show d2abfa69fb77531199ffc67c5c076b524af69040:<path> > edition.pdf`, or
+`git cat-file -p <blob>` with the blob below.
+
+| PDF (historical, pre-correction) | Git blob at `d2abfa6` | sha256 (prefix) | Bytes | Last changed in | Corrected source |
+| --- | --- | --- | --- | --- | --- |
+| `research/formal-synthesis/substrate_synthesis.pdf` | `2e17362fc62d9f32b1083f17a0ac865704244ef6` | `644e28d0f8d1cbd3…` | 835072 | `5e60069` (2026-08-14) | `research/formal-synthesis/substrate_synthesis.html` |
+| `research/empirical-refutation/extended_preprint.pdf` | `74f74ae08612bb9dc11038f651f923e0730b8bfc` | `8d2ec1091d17f0ba…` | 791707 | `9ebe256` (2026-09-20) | `research/empirical-refutation/extended_preprint.html` |
+| `research/empirical-refutation/paper.pdf` | `f94a727cec7f84ac197057f3f22cde0fb09f28b1` | `a5001d8fc59a1b4a…` | 830746 | `c5fb041` (2026-09-20) | `research/empirical-refutation/paper/main.tex` |
+| `research/cognitive-substrate/cognitive_substrate_whitepaper.pdf` | `44ce7bbd4a7bc1e6220f162074c9b473c6287e7b` | `599e626ba24958c6…` | 1816584 | `e6e6de7` (2026-09-20) | `research/cognitive-substrate/cognitive_substrate_whitepaper.html` |
+| `docs/cognitive-substrate/cognitive_substrate_whitepaper.pdf` (byte-identical copy) | same blob as the row above | same | 1816584 | — | the same HTML, copied to `docs/cognitive-substrate/` |
+
+The copies of `repro/paper/main.tex` and `repro/paper/paper.pdf` inside
+`empirical-refutation/replication_package.tar.gz` (git blob `50bd453a30dad5d8ca3369129f8015fd4524fa81`)
+are also left exactly as published. The paper PDF was built with pdfTeX (TeX Live 2026) and the ACM
+`acmart` class, as its own metadata records.
+
+## Figure map
+
+Each `{{artifact:<id>}}` placeholder in the HTML sources (13 in all: 3 in the synthesis, 3 in the
+preprint, 7 in the white paper), the figure file under `research/` it stands for, and whether that
+file's pixel size matches the image embedded in the old PDF:
+
+| Placeholder id | Figure (under `research/`) | Size (px) | Matches the old PDF |
+| --- | --- | --- | --- |
+| `art_5f049677-4c3c-40f2-8905-dd01c966e9ae` | `formal-synthesis/figures/schematic_duality.png` (synthesis and preprint, Figure 1) | 1366 × 1046 | yes |
+| `art_f0decf80-d016-496f-8032-f7b2e73e71b2` | `formal-synthesis/figures/schematic_taskloop.png` (synthesis and preprint, Figure 2) | 1607 × 1092 | yes |
+| `art_5d076ce3-0f54-4394-9a77-f70a336ca843` | `formal-synthesis/figures/schematic_convergence.png` (synthesis, Figure 8) | 2460 × 1539 | yes |
+| `art_712fac51-fe17-4ed6-80f0-9dd42bf42758` | `empirical-refutation/figures/fig_repair_beforeafter.png` (preprint, Figure 3) | 3142 × 1383 | yes |
+| `art_e2776474-3d1e-48c6-9490-55d4d927a301` | `cognitive-substrate/figures/schematic_loop.png` (white paper, Figure 1) | 3003 × 1439 | yes |
+| `art_d2be1b53-86ce-4069-b2aa-5be59836598e` | `cognitive-substrate/figures/schematic_system.png` (white paper, Figure 2) | 2847 × 1840 | yes |
+| `art_8d9fa6dd-3554-49c7-9e76-ba667544a622` | `cognitive-substrate/figures/schematic_extended.png` (white paper, Figure 3) | 1483 × 931 | yes |
+| `art_07bb9186-5e55-44f6-af3f-dde83d6b9e65` | `cognitive-substrate/figures/impact_graph.png` (white paper, Figure 4) | 1900 × 1326 | yes |
+| `art_392e293d-be93-4efe-81c1-e9612a711ac4` | `cognitive-substrate/figures/eval_precision_recall.png` (white paper, Figure 5) | 2300 × 918 | **no** — the old PDF embeds a 1921 × 842 raster, so the repository's file is a different render of this figure; compare the two before publishing |
+| `art_5b206b7b-c90e-417f-b1e8-48b0ec389cb8` | `cognitive-substrate/figures/schematic_router_loop.png` (white paper, Figure 6) | 1537 × 838 | yes |
+| `art_ac78be07-be03-4560-bb9f-f5fe2f16d7ef` | `cognitive-substrate/figures/router_eval.png` (white paper, Figure 7) | 1719 × 732 | yes |
+
+## Rendering a new edition
+
+1. Work in a scratch directory outside the repository and install `playwright-core` there, never
+   in the repository: `npm init -y && npm install playwright-core`. Point it at an installed
+   Chromium (`executablePath`).
+2. Install a font with full Qur'anic coverage (a Naskh face such as Amiri or Scheherazade New) and
+   make it the first `font-family` for `.quran .ar` in the render, so one font sets each verse.
+3. Replace every `{{artifact:<id>}}` with its figure from the map (a `data:image/png;base64,…`
+   URI keeps the render self-contained), render A4 with a header and footer stamp
+   `edition <date> · source sha256 <first 12 hex of the HTML file's sha256> · forgekit <version>`,
+   and confirm every image loaded and no request failed.
+4. **Inspect by eye** every page that carries a figure or a verse card. Only then replace the PDF,
+   re-copy the white paper to `docs/cognitive-substrate/` (`node scripts/claims-status.mjs
+   --sync-copies`), and add a row here recording the replaced edition's git blob and the new
+   edition's source hash.
+
+A render script that does steps 1 and 3 (it resolved all 13 figure placeholders across the three
+papers with no failed request on 2026-09-26):
+
+```js
+// node render.mjs <repo> <html-path-in-repo> <out.pdf>   (run from the scratch directory)
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { chromium } from "playwright-core";
+
+const FIGURES = { /* "art_…": "research/…/figures/….png", one entry per row of the map above */ };
+const [repo, rel, out] = process.argv.slice(2);
+const raw = readFileSync(path.join(repo, rel));
+const sha = createHash("sha256").update(raw).digest("hex").slice(0, 12);
+const version = JSON.parse(readFileSync(path.join(repo, "package.json"), "utf8")).version;
+const stamp = `edition ${new Date().toISOString().slice(0, 10)} · source sha256 ${sha} · forgekit ${version}`;
+let html = raw.toString("utf8");
+for (const [id, fig] of Object.entries(FIGURES)) {
+  const uri = `data:image/png;base64,${readFileSync(path.join(repo, fig)).toString("base64")}`;
+  html = html.split(`{{artifact:${id}}}`).join(uri);
+}
+const browser = await chromium.launch({ executablePath: process.env.CHROMIUM });
+const page = await browser.newPage();
+const failed = [];
+page.on("requestfailed", (r) => failed.push(r.url()));
+await page.setContent(html, { waitUntil: "networkidle" });
+const unresolved = (html.match(/\{\{artifact:[^}]+\}\}/g) || []).length;
+const broken = await page.evaluate(() => [...document.images].filter((i) => !i.naturalWidth).length);
+if (unresolved || broken || failed.length) throw new Error(`figures: ${unresolved} unresolved, ${broken} broken, ${failed.length} failed`);
+const line = (s) => `<div style="font:8px sans-serif;color:#666;width:100%;text-align:center">${s}</div>`;
+await page.pdf({
+  path: out, format: "A4", printBackground: true, displayHeaderFooter: true,
+  margin: { top: "18mm", bottom: "18mm", left: "14mm", right: "14mm" },
+  headerTemplate: line(stamp),
+  footerTemplate: line(`${stamp} · page <span class="pageNumber"></span> / <span class="totalPages"></span>`),
+});
+await browser.close();
+```
+
+For `paper.pdf`, build `paper/main.tex` with TeX Live (`pdflatex` and `bibtex`, ACM `acmart`
+class) and stamp the same fields in the PDF metadata or a footnote.
diff --git a/research/README.md b/research/README.md
index 6cac916d..8eea9665 100644
--- a/research/README.md
+++ b/research/README.md
@@ -1,56 +1,122 @@
 # Research
 
-The full research programme behind forgekit: a theory of what a frozen language model
-structurally lacks, an architecture that supplies it, two runnable prototypes, and — most
-importantly — a pre-registered empirical evaluation that **refuted the prototypes' headline
-claims**.
+The full research programme behind forgekit: an account of what a language model with frozen
+weights does not guarantee on its own, an architecture that supplies it, two runnable
+prototypes, and — most importantly — a pre-registered empirical evaluation that **refuted the
+prototypes' headline claims**.
 
 Read in this order. The later work corrects the earlier work, and the corrections are the
-most useful part.
+most useful part. Every load-bearing headline below also has a row, with its status and the
+evidence behind it, in the machine-readable claim registry
+[`docs/status/claims.json`](../docs/status/claims.json), rendered as a table in
+[`docs/status/README.md`](../docs/status/README.md).
 
 ## Start here: what is actually true
 
 | | Claimed (self-built demos) | Measured (real data) |
 |---|---|---|
 | Impact oracle recall | 1.00 | **0.022** — `grep` with no graph beats it ~10× on F1 |
-| Router/gate F1 | 1.00 | **0.37** on 80 real GitHub issues/PRs |
-| Cost saving | +62.1% | **−20.2%** — routing costs *more* than always-premium |
+| Router/gate: gate F1 (should-ask) | 1.00 | **0.37** on 80 real GitHub issues/PRs |
+| Router/gate: cost saving vs always-premium | +62.1% | **−20.2%** — routing costs *more* than always-premium |
 
-Per output a judge accepted, the router cost $1.06 against always-premium's $1.76, but
-only 6 and 3 of 64 outputs were accepted, so that comparison is not stable; 58 of the 64
-tasks failed at every tier, which is why escalation made routing cost more overall.
+Success in the router rows means **judge-accepted**: a model judge accepted the output. No
+held-out task admitted execution-based verification, so `tests_passed`, `human_accepted` and
+`deployed_without_revert` were never measured. Per judge-accepted output the router cost $1.06
+against always-premium's $1.76, but only 6 and 3 of the 64 non-halted tasks were judge-accepted,
+so that ratio is not stable; 58 of the 64 tasks failed at every tier, which is why escalation made
+routing cost more overall ($6.3582 against $5.2893, 20.21% more). The judge was also the mid-tier
+executor, and the "second labelling pass" is the same model with a reworded prompt (n = 30: halt
+κ 0.5161, tier κ 0.8919), so κ measures self-consistency, not agreement with a human.
+(Corrected 2026-09-26: the first sentence read "Per output a judge accepted, …" and named neither
+what the judge's acceptance is not nor who the judge was; the row was labelled "Router/gate F1".)
 
-After diagnosing and repairing two defects, with numeric parameters frozen before the
-held-out repositories were touched: recall **0.653**, F1 **0.416**, a point estimate above
-`grep`'s 0.371 for the first time. That the repaired oracle *beats* grep is **not
-established**: the three held-out repositories all favour it, but three out of three is a
-one-sided sign-test p of 0.125, pytest supplies 71% of the held-out pairs, the file-level
-intervals overlap, and the choice of which relations to add was made on all nine
-repositories. (Corrected 2026-09-21; earlier versions called it "a real but narrow win".)
+After diagnosing and repairing two defects, with numeric parameters frozen before the held-out
+repositories were touched: at the pre-registered canonical threshold 0.02, recall **0.653** and
+F1 **0.416**, a point estimate above `grep`'s 0.371 for the first time (paired ΔF1 about +0.044).
+That the repaired oracle *beats* grep is **not established**. Per-repository counts exist only at
+threshold 0.10, where the pooled ΔF1 is +0.0565 and all three held-out repositories favour the
+oracle, but three out of three is a one-sided sign-test p of 0.125; pytest supplies 71.3% of the
+held-out pairs; the file-level intervals overlap; and the choice of which relations to add was made
+after diagnosing all nine repositories — an architecture-selection channel into the nominal test
+set, which limits the unseen-repository claim without erasing the measured gain. Numbers at 0.02
+and 0.10 are never mixed in one comparison. (Corrected 2026-09-21; earlier versions called it "a
+real but narrow win". Thresholds separated 2026-09-26.)
 
 The general lesson, demonstrated on our own work: **a self-built demonstration can overstate
 field performance by more than an order of magnitude, and careful caveating does not convert
 a demonstration into evidence.**
 
+## What the impact study measured — and what it did not
+
+*(Added 2026-09-26, after a second external review recomputed the archived results.)*
+
+The archived counts reproduce: 801 labelled files, 759 evaluated after the pre-registered cap of
+200 files per repository, nine repositories, 20,144 mirrored labelled pairs. The original oracle's
+pooled precision / recall / F1 is **0.3982 / 0.0220 / 0.0416**; grep's is **0.3535 / 0.5732 /
+0.4373**. A repository-cluster bootstrap (20,000 draws, seed 1234) gives oracle F1 **[0.0010,
+0.0927]**, grep **[0.3807, 0.5394]**, and grep minus oracle **[0.3422, 0.5174]** — figures
+recomputed by the 2026-09-26 external review and reproduced by
+[`recompute_corrections.py`](recompute_corrections.py) §5, which also prints the repository-level
+view: macro F1 0.0220 for the oracle against 0.4947 for grep, with grep ahead in 9 of 9
+repositories. The negative result is well supported within this archived corpus.
+
+What it is a result *about* needs stating as carefully as the numbers:
+
+- **Co-change is a proxy.** Two files that changed in the same commit are *historically related
+  edits*, not proof of semantic necessity or of test breakage; conversely a dependency graph is not
+  a full co-change graph. The study measured one task: (a) predicting co-edited files. The other
+  task an impact tool is used for — (b) selecting the tests that detect a behaviour regression —
+  was not measured, and results for the two should always be reported separately.
+- **Pairs are not independent.** Every ground-truth pair is mirrored (counted from both ends) and
+  files share repositories, so file- or pair-level resampling overstates precision. Uncertainty is
+  reported at the repository level, and macro results sit beside pooled ones.
+- **The Node graph is not the evaluated oracle.** The shipped `forge impact` / `src/atlas.js` is a
+  regex-derived, multi-language code graph that ports the two repairs; it is not the Python AST
+  oracle the study evaluated, and the study's numbers are not its numbers. Its own measurement is a
+  six-case, self-labelled fixture in [`reports/benchmarks.md`](../reports/benchmarks.md).
+
+### Next study (pre-declared shape)
+
+The nine-repository archive is a reproducibility starter, not a fresh holdout. The next impact
+study freezes the parser and relation design **before** acquiring a new repository set or time
+split; includes runtime coupling, configuration changes, dynamic imports and languages other than
+Python; predeclares relation budgets so that widening predictions cannot win merely by returning
+most files; and reports review-cost metrics — files reviewed per true affected file, and the
+missed-regression rate — beside F1, for co-edited-file prediction and regression-test selection
+separately.
+
 ## The four layers
 
 ### 1. [`cognitive-substrate/`](cognitive-substrate/) — the theory
-The originating argument: an LLM is a frozen map `y = f_θ(x)` with three properties —
-statelessness, frozen parameters, bounded context — which structurally deny it five faculties
-(memory, learning, imagination, self-correction, impact-awareness). The remedy is an external
-stateful architecture, not better prompting.
+The originating argument: an LLM is a map `y = f_θ(x)` with frozen parameters, no state between
+calls and a bounded context, and a coding agent built on it lacks five faculties (memory,
+learning, imagination, self-correction, impact-awareness) unless something outside supplies them.
+Stated precisely, what is missing is a set of guarantees — no durable state across independent
+invocations, a bounded context, no automatic parameter update, and unreliable self-verification
+without external evidence. Prompting does change behaviour inside a context (in-context adaptation;
+Brown et al., 2020, [arXiv:2005.14165](https://arxiv.org/abs/2005.14165)); the substrate is a tested
+way of supplying persistence and verification, not the only logically possible architecture.
+(Corrected 2026-09-26: this paragraph said the three properties "structurally deny it five
+faculties" and that "the remedy is an external stateful architecture, not better prompting".)
 
-- `cognitive_substrate_whitepaper.pdf` — the *Theory → Evidence → Build-Map* edition (48pp);
-  the `.html` edition carries the 2026-09-21 corrections, the PDF predates them
+- `cognitive_substrate_whitepaper.pdf` — the *Theory → Evidence → Build-Map* edition (48pp).
+  **Historical, pre-correction edition** (git blob `44ce7bb`); the `.html` edition is the corrected
+  source and carries the 2026-09-21 and 2026-09-26 corrections.
 - `EXECUTIVE_SUMMARY.md` — one-page entry point, **carries a status banner: its prototype numbers are refuted**
 - `literature/` — the gap map and 32 graded references behind each faculty claim
 - `evidence/` — twelve load-bearing industry statistics independently re-grounded and graded
   `confirmed` / `vendor-reported` / `unverifiable`, plus an ecosystem map of what the 2026
   Claude-Code stack already solves. Three widely-repeated statistics were caught as
-  misattributed and dropped.
+  misattributed and dropped. Since 2026-09-26 the evidence map also grades claim support, study
+  design, independent replication and transfer scope separately; the original grades mainly
+  confirm that a source exists and says what is quoted.
 - `quranic-lens/` — the fourteen-mapping ethical-epistemic reading used as a *design lens*:
   it names which safeguards are obligatory rather than optional. It is framing, never
-  technical authority; no verse is offered as proof of an engineering claim.
+  technical authority; no verse is offered as proof of an engineering claim. The Arabic source
+  text, the translation, tafsir and the author's design analogy are labelled separately, and the
+  lens's operational content is the discipline *do not assert without evidence* — the claim
+  registry, verifier events and visible uncertainty — not any algorithm's correctness, catch rate
+  or uniqueness.
 - `sources/` — the primary documents the evidence layer was graded against
 - `figures/` — the architecture schematics and prototype evaluations
 
@@ -62,7 +128,11 @@ two-layer duality: the silent-miss residual is
 `(1 − p) × P(no deterministic check fires | miss)`, so where each factor is bounded away from
 zero, neither layer alone reaches a small residual. Since the 2026-09-21
 corrections this is stated as a bound over an explicit `(p, q)` region, not as a proof that
-neither layer suffices, and the checks multiply only if they fire independently.
+neither layer suffices, and the checks multiply only if they fire independently. Since the
+2026-09-26 corrections the reachable residual is a minimum over the *jointly* feasible `(p, q)`
+pairs — separately maximal `p` and `q` need not be attainable under one policy, so
+`(1 − p_max)(1 − q_max)` is only a lower bound — and a caught miss is no longer read as a
+completed task.
 
 **Priority note:** prior-art review found this composition law is standard protection-layer
 algebra, and two concurrent preprints derive a strictly more general Bayesian form weeks
@@ -70,6 +140,9 @@ earlier. Priority is conceded in the refutation paper's related work and, since
 2026-09-21 corrections, in the synthesis and the extended preprint as well (before that they
 still said "this paper proves"). What survives is that both preprints are simulation-only.
 
+- `substrate_synthesis.pdf` — **historical, pre-correction edition** (git blob `2e17362`); the
+  corrected source is `substrate_synthesis.html`.
+
 ### 3. [`empirical-refutation/`](empirical-refutation/) — the measurement
 The pre-registered evaluation that overturned the claims above, the diagnosis of *why*, and
 the repair. Includes a replication package with the frozen pre-registration, mined ground
@@ -81,10 +154,44 @@ Also corrects a theoretical claim: perfect recall was inferred from a completene
 but such a theorem guarantees completeness only *relative to the relation* the closure runs
 over — it says nothing about whether that relation contains the edges that matter.
 
+- `replication_package.tar.gz` — the archive **exactly as published** (git blob `50bd453`); its
+  copies of `paper/main.tex` and `paper.pdf` predate the corrections. Corrected summary: the
+  README's Corrections sections; every corrected number is recomputed from it by
+  `recompute_corrections.py`.
+- `paper.pdf` and `extended_preprint.pdf` — **historical, pre-correction editions** (git blobs
+  `f94a727`, `74f74ae`); the corrected sources are `paper/main.tex` and `extended_preprint.html`.
+
 ### 4. [`python-prototypes/`](python-prototypes/) — the code
-`impact_oracle/` and `router_gate/`, runnable with their own test suites. The **repaired**
-oracle ships inside the refutation's replication package rather than replacing the version
-here, so swapping it in stays a deliberate decision.
+`impact_oracle/` and `router_gate/`, runnable with their own test suites. The in-tree
+`impact_oracle/` **is the repaired (v2) oracle**: both repairs are in its source, with their
+frozen parameters as module defaults, and its suite is 49 tests (36 demo-package tests plus 13
+regression tests for the two repairs). `ImpactOracle(wm, sibling_enabled=False,
+forward_enabled=False)` reproduces the refuted reverse-only traversal, and the untouched as-shipped
+v1 package is archived in the replication tarball. (Corrected 2026-09-26: this paragraph said the
+repaired oracle "ships inside the refutation's replication package rather than replacing the
+version here, so swapping it in stays a deliberate decision"; the swap had already been made.)
+
+## Prior art, and what is (and is not) claimed
+
+*(Added 2026-09-26.)* External memory, feedback-driven improvement and structured agent control
+all have clear prior art. **CoALA** (Sumers et al., 2023,
+[arXiv:2309.02427](https://arxiv.org/abs/2309.02427)) organises language agents into modular
+memory, action and decision procedures; **Reflexion** (Shinn et al., 2023,
+[arXiv:2303.11366](https://arxiv.org/abs/2303.11366)) improves agents through linguistic feedback
+and an episodic memory buffer, with no weight updates; GPT-3's few-shot evaluation
+([arXiv:2005.14165](https://arxiv.org/abs/2005.14165)) already measured adaptation through text
+alone. That prior art does not make forgekit unoriginal as a product, but it limits what the broad
+architecture can claim. The defensible framing is:
+
+> **a portable implementation of evidence-weighted coding-agent memory and checks, with
+> empirical evaluation of trust failure modes.**
+
+Novelty is claimed only for a specific protocol, invariant, evaluation result or integration that
+survives an explicit comparison with that prior art. The "five faculties" are a useful
+decomposition, not a proof that these five are necessary or that an external stateful architecture
+is the only way to supply them; and the "convergence" of the theory, forgekit and its sibling
+projects is consistency within one author's work, not independent confirmation — the same care the
+programme already applied when it conceded priority for the protection-layer equation.
 
 ## How this programme tries to stay honest
 
@@ -98,6 +205,15 @@ Where this falls short is stated too: the pre-registration and parameter freezes
 self-administered with no external timestamping authority, so a reader can verify internal
 consistency and the amendment trail but must take the ordering on trust.
 
+### Four kinds of reproducibility, kept apart
+
+| Kind | Status |
+|---|---|
+| **Source availability** | The papers' corrected sources (HTML, LaTeX), both Python prototypes, the replication archive and the recomputation script are all in this directory. |
+| **Calculation reproducibility** | Available. [`recompute_corrections.py`](recompute_corrections.py) (standard library only) recomputes every corrected statistic from the archived results, and asserts the Theorem D sanity checks with no data at all (`--theorem-checks`); CI runs both, and both prototypes' test suites, since `aedddf5`. The universal router's shipped prior also refits exactly from pinned public data with `bench/universal-router/reproduce.sh` (2026-09-26, the project's own run). |
+| **Pipeline reproducibility** | **Not available.** The historical mining pipeline (cloning, commit filtering, labelling, model calls) is not shipped as an entry point here, so new histories cannot be mined with one command; and the universal router's run-4 held-out benchmark ran in an external harness (harness-bench) that is not shipped either — see [`docs/UNIVERSAL_ROUTING.md`](../docs/UNIVERSAL_ROUTING.md). |
+| **Independent external replication** | None of the research results has been replicated by an independent team. The 2026-09-21 and 2026-09-26 reviews recomputed archived numbers; they did not re-mine repositories or re-run model calls. |
+
 ## Corrections (2026-09-21)
 
 An external deep review of this repository (2026-09-21) recomputed the research statistics
@@ -126,10 +242,40 @@ mkdir rp && tar -xzf research/empirical-refutation/replication_package.tar.gz -C
 python research/recompute_corrections.py rp/repro
 ```
 
-**Stale PDFs.** These PDFs predate the corrections and could not be rebuilt here (the HTML
-editions were rendered with WeasyPrint, the paper with a TeX Live toolchain; neither was
-available): `formal-synthesis/substrate_synthesis.pdf`,
+## Corrections (2026-09-26)
+
+A second external deep review (2026-09-26, pinned at commit
+`d2abfa69fb77531199ffc67c5c076b524af69040`) recomputed the archived results again and read the
+papers' framing against the code. The counts reproduced exactly again. Changes, each marked in
+place in its paper with `[corrected 2026-09-26]` and listed there with the original wording:
+
+- **Formal synthesis and extended preprint** — the range statement of Theorem D no longer combines
+  separately maximal `p` and `q` (counterexample: policies `(0.5, 0.9)` and `(0.9, 0.1)` leave 0.05
+  and 0.09, while the separate maxima suggest 0.01); the equality condition for
+  `1 − (1 − ε)ⁿ` is every `rᵢ = ε`, not independence alone; a new §5.4 separates silent-miss
+  probability from completed-task rate and lists what to measure; the frozen-map premise is stated
+  as the guarantees it removes; prior art (CoALA, Reflexion) is named and the byline no longer
+  calls the three bodies of work "independently-developed". The counterexample, the equality
+  condition and the 400× correction are asserted by `python3 research/recompute_corrections.py
+  --theorem-checks`.
+- **Whitepaper** — the "cannot learn / imagine / self-correct" framing marked as broader than the
+  missing guarantees; prior art added to §11; the Qur'anic lens's text, translation, tafsir and
+  design analogy labelled separately, with its operational scope stated; METR's 19% slowdown
+  scoped to its 16 developers, 246 tasks and early-2025 tools, with METR's
+  [February 2026 update](https://metr.org/blog/2026-02-24-uplift-update/).
+- **This README and the prototype READMEs** — the repaired oracle's location, the 0.02 / 0.10
+  thresholds, judge-accepted versus executed success, the unit of the impact study, and the
+  reproducibility table above.
+
+**Stale PDFs — historical, pre-correction editions.** `formal-synthesis/substrate_synthesis.pdf`,
 `empirical-refutation/extended_preprint.pdf`, `empirical-refutation/paper.pdf`,
-`cognitive-substrate/cognitive_substrate_whitepaper.pdf`, and the copy in
-`docs/cognitive-substrate/`. The copies of `paper/main.tex` and `paper.pdf` inside
-`replication_package.tar.gz` are left as published. Read the HTML and LaTeX sources.
+`cognitive-substrate/cognitive_substrate_whitepaper.pdf` and its byte-identical copy in
+`docs/cognitive-substrate/` predate both sets of corrections. Read the HTML and LaTeX sources,
+which carry them. A re-render was attempted on 2026-09-26 and **not** committed: the HTML sources
+reference their figures through `{{artifact:…}}` placeholders that a browser cannot resolve, all
+three HTML papers carry Qur'anic Arabic whose typesetting could not be checked by eye in that
+environment, and a PDF whose figures or sacred text cannot be verified is not published as the new
+edition. The paper PDF needs a TeX toolchain that was not available. Each edition's git blob, the
+pinned commit where it stays retrievable, and a faithful render recipe (including the
+figure-placeholder map) are in [`HISTORICAL_EDITIONS.md`](HISTORICAL_EDITIONS.md). The copies of
+`paper/main.tex` and `paper.pdf` inside `replication_package.tar.gz` are left as published.
diff --git a/research/cognitive-substrate/EXECUTIVE_SUMMARY.md b/research/cognitive-substrate/EXECUTIVE_SUMMARY.md
index 0938a0af..f6d12774 100644
--- a/research/cognitive-substrate/EXECUTIVE_SUMMARY.md
+++ b/research/cognitive-substrate/EXECUTIVE_SUMMARY.md
@@ -7,7 +7,7 @@
 > | Claim below | Measured on real data |
 > |---|---|
 > | Impact oracle recall **1.00** | **0.022** (9 OSS repos; 801 labelled files, 759 evaluated); `grep` beats it ~10× on F1 |
-> | Router/gate F1 **1.00**, cost saving **+62.1%** | F1 **0.37**; cost saving **−20.2%** (routing costs *more* than always-premium; per judged-correct output $1.06 vs $1.76, from only 6 and 3 correct outputs of 64) |
+> | Router/gate F1 **1.00**, cost saving **+62.1%** | F1 **0.37**; cost saving **−20.2%** (routing costs *more* than always-premium; per judge-accepted output $1.06 vs $1.76, from only 6 and 3 judge-accepted outputs of 64; the judge is a model, not executed tests) |
 >
 > The theory sections remain the programme's working framework. The *numbers* here do not. A repair
 > raised recall to 0.653 and F1 to 0.416, a point estimate above grep's 0.371, documented in the
@@ -25,6 +25,17 @@
 
 **One-line thesis:** The faculties a coding agent lacks — memory, learning, imagination, self-correction, impact-awareness — are not gaps in the model's *knowledge* but structural consequences of what a frozen transformer *is* (a stateless map `y = f_θ(x)`, fixed weights, bounded window). They cannot be prompted or tooled away; they can only be supplied by **re-wrapping the input→process→output loop** into a closed, stateful cycle around the frozen model.
 
+> *Corrected 2026-09-26:* the thesis above is broader than its argument. Frozen weights rule out
+> weight updates during use, not all adaptation: examples, retrieved facts and feedback in the
+> context change behaviour with no gradient step (Brown et al., 2020,
+> [arXiv:2005.14165](https://arxiv.org/abs/2005.14165)). What a bare model lacks is a set of
+> guarantees — no durable state across independent invocations, a bounded context, no automatic
+> parameter update, and unreliable self-verification without external evidence — and the substrate
+> is one tested way of supplying persistence and verification, not the only possible architecture.
+> Prior art for the broad architecture includes CoALA ([arXiv:2309.02427](https://arxiv.org/abs/2309.02427))
+> and Reflexion ([arXiv:2303.11366](https://arxiv.org/abs/2303.11366)); see the white paper's
+> Corrections (2026-09-26).
+
 **What v2 adds.** The first edition argued the five faculties from first principles and prototyped the one that is buildable today. This edition (1) **grounds the argument in the field's own evidence** — twelve load-bearing pain-point statistics independently re-grounded from primary sources and graded *confirmed / vendor-reported / unverifiable*; (2) adds **six metacognitive mechanisms** the frozen loop also lacks (routing, assumption gate, decomposition, goal-anchoring, anti-over-engineering, inline verification); (3) **maps all eleven capabilities against the real 2026 Claude-Code stack**, marking each solved / partial / residual-gap so we say clearly *what not to build*; and (4) ships a **second runnable prototype** — a complexity-aware router + assumption gate, evaluated live on real models.
 
 > **Governing discipline (the user's, adopted throughout):** *AI output is mathematically-calculated probability — non-deterministic, and never blindly trusted.* Every claim in this package is graded by how well it is sourced; every prototype decision is a transparent, attributable rule rather than another opaque model call; and trust is always earned by an **external** check, never asserted by the model.
diff --git a/research/cognitive-substrate/cognitive_substrate_whitepaper.html b/research/cognitive-substrate/cognitive_substrate_whitepaper.html
index 95460e9b..615495dc 100644
--- a/research/cognitive-substrate/cognitive_substrate_whitepaper.html
+++ b/research/cognitive-substrate/cognitive_substrate_whitepaper.html
@@ -65,6 +65,7 @@
   .quran .map{font-size:.92rem; color:var(--ink); margin-top:.6em; padding-top:.6em; border-top:1px dotted #d8ccae;}
   .quran .map b{color:var(--quran);}
   .quran .grounding{font-size:.74rem; color:var(--faint); margin-top:.5em; font-family:monospace;}
+  .quran .lbl{font-family:sans-serif; font-size:.64rem; text-transform:uppercase; letter-spacing:.08em; color:var(--faint); margin:.55em 0 .1em;}
   .lit{background:var(--litbg); border:1px solid #d9e2ea; border-radius:4px; padding:6px 14px; margin:1.1em 0; font-size:.9rem;}
   .callout{border:1px solid var(--rule); border-radius:5px; padding:14px 20px; margin:1.4em 0; background:#fcfcfc;}
   .callout.key{border-left:3px solid var(--oracle); background:#f2f9f8;}
@@ -96,13 +97,13 @@ <h1>A Cognitive Substrate for Coding Agents</h1>
 </div>
 
 <div class="callout warn">
-<div class="h">Status: both prototype results in this edition were refuted &middot; corrections 2026-09-21</div>
-<p>This edition was written before any real-repository evaluation existed. A later pre-registered evaluation (<code>research/empirical-refutation/</code>) overturned both prototype claims: the impact oracle&rsquo;s recall was <b>0.022</b>, not 1.00, on 759 files in nine open-source repositories, and on 80 held-out tasks the router&rsquo;s total spend was <b>20.2% higher</b> than always using the premium tier, not 62.1% lower. An external review (2026-09-21) also found a misquoted statistic, a wrong worst-case cost, and an inconsistency between Eq.&nbsp;(1) and M2. Corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em> or <em class="corr">[refuted]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The theory sections remain the programme&rsquo;s working framework; the prototype numbers do not. The PDF edition predates these corrections.</p>
+<div class="h">Status: both prototype results in this edition were refuted &middot; corrections 2026-09-21 and 2026-09-26</div>
+<p>This edition was written before any real-repository evaluation existed. A later pre-registered evaluation (<code>research/empirical-refutation/</code>) overturned both prototype claims: the impact oracle&rsquo;s recall was <b>0.022</b>, not 1.00, on 759 files in nine open-source repositories, and on 80 held-out tasks the router&rsquo;s total spend was <b>20.2% higher</b> than always using the premium tier, not 62.1% lower. An external review (2026-09-21) also found a misquoted statistic, a wrong worst-case cost, and an inconsistency between Eq.&nbsp;(1) and M2. Corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em> or <em class="corr">[refuted]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The theory sections remain the programme&rsquo;s working framework; the prototype numbers do not. A second review (2026-09-26) found that the &ldquo;cannot learn / imagine / self&#8209;correct&rdquo; framing is broader than the missing guarantees it rests on, that the prior art for the architecture needed stating, that the Qur&rsquo;anic lens mixed source text, translation and the author&rsquo;s analogy without labels, and that the METR statistic needed its scope; those are listed in <a href="#corrections-2026-09-26">Corrections (2026-09-26)</a> and marked <em class="corr">[corrected 2026-09-26]</em>. The PDF edition predates both sets of corrections.</p>
 </div>
 
 <div class="abstract">
 <h4>Abstract</h4>
-<p>A large language model at inference time is, mathematically, a fixed function <var>y</var>&nbsp;=&nbsp;<var>f</var><span class="sub">&theta;</span>(<var>x</var>) with frozen parameters&nbsp;<var>&theta;</var> and a bounded input window. From this single fact, five apparent &ldquo;cognitive&rdquo; deficits of a coding agent follow as <em>structural consequences</em>, not incidental weaknesses: it cannot <b>remember</b> across sessions, cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>, and does not <b>know what already exists in a codebase or what an edit will affect</b>. We show that neither better prompting nor additional tools (skills, MCP servers) remove these deficits, because they leave <var>f</var><span class="sub">&theta;</span> and the open&#8209;loop pipeline intact. We then specify a <b>cognitive substrate</b>: an external architecture that keeps the LLM frozen but re&#8209;wraps its input&rarr;process&rarr;output loop into a closed, stateful cycle over persistent stores &mdash; an episodic/semantic memory, an online&#8209;updatable learning layer, a consequence simulator, a metacognitive verification gate, and a persistent structural model of the codebase &mdash; all under an explicit stewardship boundary. For each faculty we identify precisely what the existing literature solves and what residual gap remains for a coding agent. To turn the weakest&#8209;evidenced claim into something testable, we build and evaluate the <b>impact&#8209;awareness</b> faculty as a runnable prototype: a Codebase World&#8209;Model that parses a repository into a persistent dependency graph, and an Impact Oracle that predicts the <em>blast radius</em> of a proposed edit. Against mutation&#8209;derived ground truth on a ten&#8209;file package we wrote, the oracle was the only method that missed no affected file (recall&nbsp;=&nbsp;1.00 across five tested edits), where a text&#8209;search baseline missed transitive dependents and an edited&#8209;file&#8209;only baseline missed 47% of impact. On nine real repositories its recall was 0.022, and text search beat it by an order of magnitude on F1. <em class="corr">[refuted &mdash; see Corrections]</em> Throughout, a Qur'anic epistemic lens supplies the design's vocabulary of obligation &mdash; know what exists before acting (2:31&ndash;32), verify before you act (49:6), pursue not that of which you have no knowledge (17:36), and hold what you can damage as a trust (33:72).</p>
+<p>A large language model at inference time is, mathematically, a fixed function <var>y</var>&nbsp;=&nbsp;<var>f</var><span class="sub">&theta;</span>(<var>x</var>) with frozen parameters&nbsp;<var>&theta;</var> and a bounded input window. From this single fact, five apparent &ldquo;cognitive&rdquo; deficits of a coding agent follow as <em>structural consequences</em>, not incidental weaknesses: it cannot <b>remember</b> across sessions, cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>, and does not <b>know what already exists in a codebase or what an edit will affect</b>. We show that neither better prompting nor additional tools (skills, MCP servers) remove these deficits, because they leave <var>f</var><span class="sub">&theta;</span> and the open&#8209;loop pipeline intact. <em class="corr">[corrected 2026-09-26 &mdash; see Corrections]</em> We then specify a <b>cognitive substrate</b>: an external architecture that keeps the LLM frozen but re&#8209;wraps its input&rarr;process&rarr;output loop into a closed, stateful cycle over persistent stores &mdash; an episodic/semantic memory, an online&#8209;updatable learning layer, a consequence simulator, a metacognitive verification gate, and a persistent structural model of the codebase &mdash; all under an explicit stewardship boundary. For each faculty we identify precisely what the existing literature solves and what residual gap remains for a coding agent. To turn the weakest&#8209;evidenced claim into something testable, we build and evaluate the <b>impact&#8209;awareness</b> faculty as a runnable prototype: a Codebase World&#8209;Model that parses a repository into a persistent dependency graph, and an Impact Oracle that predicts the <em>blast radius</em> of a proposed edit. Against mutation&#8209;derived ground truth on a ten&#8209;file package we wrote, the oracle was the only method that missed no affected file (recall&nbsp;=&nbsp;1.00 across five tested edits), where a text&#8209;search baseline missed transitive dependents and an edited&#8209;file&#8209;only baseline missed 47% of impact. On nine real repositories its recall was 0.022, and text search beat it by an order of magnitude on F1. <em class="corr">[refuted &mdash; see Corrections]</em> Throughout, a Qur'anic epistemic lens supplies the design's vocabulary of obligation &mdash; know what exists before acting (2:31&ndash;32), verify before you act (49:6), pursue not that of which you have no knowledge (17:36), and hold what you can damage as a trust (33:72).</p>
 </div>
 
 <div class="toc">
@@ -120,6 +121,7 @@ <h4>Abstract</h4>
 <div><span class="num">12</span><a href="#limits">Limitations &amp; threats to validity</a></div>
 <div><span class="num">13</span><a href="#conclusion">Conclusion</a></div>
 <div><span class="num">&mdash;</span><a href="#corrections">Corrections (2026-09-21)</a></div>
+<div><span class="num">&mdash;</span><a href="#corrections-2026-09-26">Corrections (2026-09-26)</a></div>
 <div><span class="num">&mdash;</span><a href="#refs">References</a>, <a href="#evidence-appendix">evidence</a> &amp; <a href="#appendix">lens</a> appendices</div>
 </div>
 
@@ -155,7 +157,7 @@ <h2 id="root">2&ensp;The root cause, formally</h2>
 <thead><tr><th style="width:20%">Faculty</th><th style="width:44%">Why it is <em>structurally</em> absent</th><th>Follows from</th></tr></thead>
 <tbody>
 <tr><td><b>Memory</b> (across sessions)</td><td>By P1, nothing survives a turn but the token string; by P3, the string is bounded and lost at session end. There is no addressable store that outlives <var>x</var>.</td><td>P1, P3</td></tr>
-<tr><td><b>Learning</b> (from outcomes)</td><td>By P2, no inference&#8209;time event writes to <var>&theta;</var>. In&#8209;context &ldquo;learning&rdquo; is real optimization<sup class="cite">14,15</sup> but lives only inside the current <var>x</var> and vanishes with it (P1) &mdash; a <em>simulation</em> of learning, not learning.</td><td>P2, P1</td></tr>
+<tr><td><b>Learning</b> (from outcomes)</td><td>By P2, no inference&#8209;time event writes to <var>&theta;</var>. In&#8209;context &ldquo;learning&rdquo; is real optimization<sup class="cite">14,15</sup> but lives only inside the current <var>x</var> and vanishes with it (P1) &mdash; a <em>simulation</em> of learning, not learning. <em class="corr">[corrected 2026-09-26]</em></td><td>P2, P1</td></tr>
 <tr><td><b>Imagination</b> (simulate before acting)</td><td>Equation&nbsp;(1) maps tokens to tokens. There is no separate forward model of &ldquo;what happens to the world (or codebase) if I take action <var>a</var>&rdquo; distinct from emitting more tokens; the model cannot roll out and score a hypothetical it does not also have to narrate.</td><td>P1</td></tr>
 <tr><td><b>Self&#8209;correction</b></td><td>Any &ldquo;check&rdquo; the model runs is another evaluation of the same <var>f</var><span class="sub">&theta;</span> with the same blind spots. There is no independent verifier inside Equation&nbsp;(1); the literature confirms intrinsic self&#8209;correction is unreliable without an external signal.<sup class="cite">21</sup></td><td>P2</td></tr>
 <tr><td><b>Impact&#8209;awareness</b></td><td>By P3, the model sees only the tokens in <var>x</var>. A million&#8209;line repository does not fit; therefore it cannot know, unaided, what elsewhere depends on the symbol it is about to change.</td><td>P3</td></tr>
@@ -165,6 +167,7 @@ <h2 id="root">2&ensp;The root cause, formally</h2>
 <div class="callout warn">
 <div class="h">Why prompting and tools do not close the gap</div>
 <p>A better prompt changes <var>x</var>. More tools (skills, MCP servers, function calls) let the agent fetch new <var>x</var> or emit richer <var>y</var>. Both operate <em>inside</em> Equation&nbsp;(1) and leave P1&ndash;P3 untouched: the composed system is still a stateless map with frozen weights and a bounded window. A tool call retrieves a document into context, but nothing decides what was worth keeping, consolidates it, or updates the agent's priors for next time. The deficits are properties of the <em>loop shape</em> &mdash; open, memoryless, one&#8209;directional &mdash; not of the model's knowledge. To remove them you must change the shape of the loop, which is precisely what an external substrate can do while <var>&theta;</var> stays frozen.</p>
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> This callout overstates its case. Prompting and tools do change behaviour: examples, retrieved facts, feedback and extra computation placed in the context adapt a frozen model with no gradient update (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>). What they do not supply by themselves is four <em>guarantees</em>: durable state across independent invocations, context beyond the window, automatic parameter update from outcomes, and reliable self&#8209;verification without external evidence. The substrate is one tested way of supplying persistence and verification around the model, not the only logically possible architecture.</p>
 </div>
 
 <p>This reframing is the paper's pivot. If the deficits came from the loop shape, then the remedy is to <em>re&#8209;wrap the loop</em>: keep <var>f</var><span class="sub">&theta;</span> exactly as it is, and surround it with state and update so that the composite system is no longer memoryless, no longer open, and no longer blind beyond&nbsp;<var>W</var>. Figure&nbsp;1 states the whole thesis in one picture.</p>
@@ -246,6 +249,8 @@ <h3>4.1&ensp;What the strongest evidence confirms</h3>
 has no calibrated sense of its own uncertainty (mechanism&nbsp;M2 below), and it is why &ldquo;the model
 felt confident&rdquo; is not evidence of anything.</p>
 
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> Scope: this is one randomized trial of 16 experienced developers on 246 tasks in repositories they knew, with early&#8209;2025 tools. It is evidence about that setting, not a universal 2026 productivity coefficient in either direction. METR&rsquo;s February 2026 update (<a href="https://metr.org/blog/2026-02-24-uplift-update/">metr.org/blog/2026-02-24-uplift-update</a>) explains why selection effects complicate newer estimates.</p>
+
 <p>The trend evidence is equally well&#8209;sourced. Stack Overflow's 2025 survey of more than 49,000
 developers records trust in AI accuracy <b>falling from 40&#8239;% to 29&#8239;%</b> even as adoption rose
 to 84&#8239;%, with the top&#8209;ranked frustration &mdash; cited by <b>66&#8239;%</b> &mdash; being code
@@ -312,38 +317,51 @@ <h2 id="lens">5&ensp;The Qur'anic epistemic lens</h2>
 <div class="callout warn">
 <div class="h">How this lens is used &mdash; and how it is not</div>
 <p>The Qur'an is used here as a <b>framing lens and ethics source</b>, never as technical authority for an engineering claim. No verse is cited to prove that an algorithm works or that a data structure is correct &mdash; those claims stand on their engineering merits alone (&sect;3, &sect;8). What the lens supplies is threefold: (1) a precise <em>vocabulary of obligation</em> for what an agent that acts on real systems owes &mdash; to truthfulness, to verification, to stewardship; (2) a <em>hierarchy of knowledge</em> (&lsquo;ilm &rarr; fahm &rarr; &#7717;ikma: knowledge &rarr; understanding &rarr; wisdom) that motivates a <em>layered</em> memory architecture rather than a flat vector store; and (3) <em>ethical constraints on autonomy</em> that translate into concrete safeguards. Where a mapping is marked <em>load&#8209;bearing</em>, the concept motivates a specific design decision (e.g. a <em>mandatory</em>, not optional, verification gate); where marked <em>metaphor</em>, it is illustrative. Canonical text below is presented directly and attributed; it is not paraphrased. Arabic and translations were retrieved from quran.ai; the full 14&#8209;row mapping table is in the <a href="#appendix">appendix</a>.</p>
+<p><em class="corr">[corrected 2026-09-26]</em> <b>How to read each card.</b> Four layers are kept apart and labelled: the <em>Arabic source text</em> (clean Uthmani script; an ellipsis marks an abridgement, and the full verse is in <code>quranic-lens/quran_lens.md</code>); the <em>English translation</em> (M.A.S. Abdel Haleem); <em>tafsir</em> (classical commentary, Ibn Kathir), which these cards do not quote &mdash; the grounding line only records that it was consulted, and the companion file quotes it under its own label; and the <em>author&rsquo;s design analogy</em>, which is the author&rsquo;s engineering reading and neither a translation nor a commentary.</p>
 </div>
 
 <p>The lens earns its place because the deepest failure modes of an autonomous coding agent are not computational but <em>epistemic and ethical</em>: acting without knowing, trusting a report without checking it, and treating a granted capability as license. The Qur'anic vocabulary names these with unusual precision, and three verses in particular map so directly onto architectural decisions that they shaped the design rather than decorating it.</p>
 
 <div class="quran">
 <div class="tag">17:36 &mdash; l&#257; taqfu &middot; the root of impact&#8209;awareness &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">وَلَا تَقْفُ مَا لَيْسَ لَكَ بِهِ عِلْمٌ ۚ إِنَّ السَّمْعَ وَالْبَصَرَ وَالْفُؤَادَ كُلُّ أُولَٰئِكَ كَانَ عَنْهُ مَسْئُولًا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;Do not follow blindly what you do not know to be true: ears, eyes, and heart, you will be questioned about all these.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> Before any mutation (write, delete, refactor), a pre&#8209;action gate must establish what the agent actually knows: which entities the change affects, whether the relevant files/tests/dependents were actually read, and whether the predicted outcome rests on evidence rather than a pattern&#8209;matched guess. Actions taken without verified knowledge are <em>blocked</em>, not merely flagged. The verse's own structure &mdash; &ldquo;ears, eyes, heart&hellip; questioned about all these&rdquo; &mdash; maps to an <b>audit trail</b>: every channel the agent used (what it read, inferred, assumed) is logged so the decision can be reconstructed and questioned. This is precisely the impact oracle of &sect;8.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(17:36, en-abdel-haleem); fetch_tafsir(17:36, en-ibn-kathir)</div>
 </div>
 
 <div class="quran">
 <div class="tag">49:6 &mdash; tabayyun &middot; the verification gate &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">يَا أَيُّهَا الَّذِينَ آمَنُوا إِن جَاءَكُمْ فَاسِقٌ بِنَبَإٍ فَتَبَيَّنُوا أَن تُصِيبُوا قَوْمًا بِجَهَالَةٍ فَتُصْبِحُوا عَلَىٰ مَا فَعَلْتُمْ نَادِمِينَ</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;Believers, if a troublemaker brings you news, check it first, in case you wrong others unwittingly and later regret what you have done.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> The architecture places a verification step between <em>receiving information</em> (from context, tool output, or its own prior reasoning) and <em>acting on it</em>. The operative term <em>tabayyun</em> demands active investigation, not passive acceptance: before applying a fix based on an error report or its own diagnosis, the agent re&#8209;reads the current file state, confirms the issue still exists, and checks the fix introduces no new breakage detectable by types or tests. The gate is <em>architectural and mandatory</em> &mdash; the verse's command is categorical, not conditional on the reporter's trustworthiness &mdash; which is exactly the design lesson the self&#8209;correction literature reached empirically<sup class="cite">21</sup>: a real external check, not more self&#8209;prompting.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(49:6, en-abdel-haleem); fetch_tafsir(49:6, en-ibn-kathir)</div>
 </div>
 
 <div class="quran">
 <div class="tag">2:31&ndash;32 &mdash; ta&lsquo;l&#299;m al&#8209;asm&#257;' &middot; the world&#8209;model &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">وَعَلَّمَ آدَمَ الْأَسْمَاءَ كُلَّهَا ... قَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;He taught Adam all the names [of things]&hellip; They said, &lsquo;May You be glorified! We have knowledge only of what You have taught us.&rsquo;&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> Knowledge begins with <em>naming</em> &mdash; identifying entities and their relations. The agent must hold a structured map of what exists in the codebase (files, functions, classes, dependencies), not a flat listing: knowing that <var>A</var> calls <var>B</var>, that module <var>X</var> depends on <var>Y</var>, that test <var>T</var> covers class <var>C</var>. The angels' admission &mdash; &ldquo;we have knowledge only of what You have taught us&rdquo; &mdash; is a startlingly exact description of the LLM's own situation under P3: it knows only what is in its window. The external world&#8209;model supplies the &ldquo;names&rdquo; of entities that exceed context capacity.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(2:31-32, en-abdel-haleem)</div>
 </div>
 
 <div class="quran">
 <div class="tag">33:72 &mdash; al&#8209;am&#257;na &middot; stewardship &amp; bounded autonomy &nbsp;<span style="color:#0d5c56">[load&#8209;bearing]</span></div>
+<div class="lbl">Arabic source text</div>
 <div class="ar">إِنَّا عَرَضْنَا الْأَمَانَةَ عَلَى السَّمَاوَاتِ وَالْأَرْضِ وَالْجِبَالِ فَأَبَيْنَ أَن يَحْمِلْنَهَا ... وَحَمَلَهَا الْإِنسَانُ ۖ إِنَّهُ كَانَ ظَلُومًا جَهُولًا</div>
+<div class="lbl">English translation &mdash; M.A.S. Abdel Haleem</div>
 <div class="tr">&ldquo;We offered the Trust to the heavens, the earth, and the mountains, yet they refused to undertake it and were afraid of it; mankind undertook it &mdash; they have always been inept and foolish.&rdquo;</div>
+<div class="lbl">Author&rsquo;s design analogy &mdash; not translation, not tafsir</div>
 <div class="map"><b>&rarr; Design principle.</b> An agent that can modify a codebase bears an <em>am&#257;na</em> &mdash; accepted responsibility for something it can damage. The verse's structure is the design: the heavens declined the trust, recognizing its weight; the human bore it and is called <em>&#7827;al&#363;man jah&#363;l&#257;</em> (given to wrong and ignorance). So the architecture (a) operates under <b>least privilege</b> &mdash; a granted capability is never blanket permission; and (b) <em>assumes the agent will err</em> and builds in <b>reversibility</b> (sandboxing, staged commits, rollback), <b>audit</b>, and <b>scope bounds</b> as structural safeguards. The trust is not &ldquo;the agent is trustworthy&rdquo;; it is &ldquo;the agent has accepted accountability for a domain it can harm, and the architecture must respect that weight.&rdquo; This is the governance boundary enclosing the entire system in Figure&nbsp;2.</div>
 <div class="grounding">Grounded with quran.ai: fetch_translation(33:72, en-abdel-haleem); fetch_tafsir(33:72, en-ibn-kathir)</div>
 </div>
@@ -352,6 +370,8 @@ <h2 id="lens">5&ensp;The Qur'anic epistemic lens</h2>
 
 <p>The remarkable thing is not that these mappings are poetic; it is that they are <em>operational</em>. &ldquo;Verify before acting&rdquo; is not a sentiment here &mdash; it is a mandatory gate in the action pipeline. &ldquo;Know the names of things&rdquo; is not a metaphor &mdash; it is a dependency graph. The lens told us <em>which</em> safeguards are non&#8209;negotiable; the engineering told us how to build them.</p>
 
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> The operational link is narrower than that sentence suggests. The lens motivates one discipline &mdash; <em>do not assert without evidence</em> &mdash; which the repository implements as a claim/status registry (<code>docs/status/claims.json</code>), verifier events and visible uncertainty. It establishes no algorithm&rsquo;s correctness, catch rate or uniqueness: every technical guarantee still needs code&#8209;level assumptions, tests or measurements, and a deterministic implementation does not make a semantic detector&rsquo;s catch rate approach 1. No theological adjudication is attempted or implied.</p>
+
 <h2 id="mechanisms">6&ensp;Six mechanisms the frozen loop also lacks</h2>
 
 <p>The five faculties of the first edition answer &ldquo;what cognitive capabilities does a stateless model
@@ -754,6 +774,7 @@ <h2 id="newvsold">11&ensp;Genuinely new vs. reinvented</h2>
 </tbody>
 </table>
 <p>In one line: <b>the components are largely borrowed; the loop shape, the validity anchoring, and the coding&#8209;agent target are the contribution.</b> That is a defensible and useful kind of novelty &mdash; it is what turns five scattered literatures into one buildable architecture.</p>
+<p style="font-size:.9em"><em class="corr">[corrected 2026-09-26]</em> Prior art for the combination itself needs naming too: CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) already organises language agents into modular memory, action and decision procedures, and Reflexion<sup class="cite">18</sup> improves agents through linguistic feedback and an episodic memory buffer without weight updates. The defensible claim is <em>a portable implementation of evidence&#8209;weighted coding&#8209;agent memory and checks, with empirical evaluation of trust failure modes</em>; the &ldquo;novel&rdquo; rows above stand only where an explicit comparison with that prior art survives.</p>
 
 <h2 id="limits">12&ensp;Limitations &amp; threats to validity</h2>
 <ul>
@@ -765,7 +786,7 @@ <h2 id="limits">12&ensp;Limitations &amp; threats to validity</h2>
 </ul>
 
 <h2 id="conclusion">13&ensp;Conclusion</h2>
-<p>The faculties a coding agent seems to lack &mdash; memory, learning, imagination, self&#8209;correction, impact&#8209;awareness &mdash; are not deficiencies of knowledge that scale will cure. They are structural consequences of what a frozen transformer <em>is</em>: a stateless map with fixed weights and a bounded window (Eq.&nbsp;1, P1&ndash;P3). Because they follow from the <em>shape</em> of the loop, they cannot be prompted or tooled away; they can only be removed by re&#8209;wrapping the loop into a closed, stateful cycle over persistent stores, with the model left frozen inside it (Eq.&nbsp;2, Fig.&nbsp;1&ndash;2). We specified that substrate faculty by faculty, said honestly which parts are open research and which are engineering, and &mdash; for the one faculty that is buildable today &mdash; shipped a running impact oracle that, on a package we built, missed no affected file where the strategies a context&#8209;bounded agent actually uses missed up to half. On real repositories it missed almost everything (recall 0.022), which is the refutation&rsquo;s subject. <em class="corr">[refuted &mdash; see Corrections]</em> The Qur'anic lens gave the work its spine of obligation: <em>know what exists before you act, verify what you are told, and hold what you can damage as a trust.</em> Those are not just good engineering defaults; here they are the architecture. The next step is to build the memory and learning layers against the same discipline &mdash; anchored to what can be verified, not to what the model says of itself &mdash; and to evaluate the whole loop on real repositories with real histories.</p>
+<p>The faculties a coding agent seems to lack &mdash; memory, learning, imagination, self&#8209;correction, impact&#8209;awareness &mdash; are not deficiencies of knowledge that scale will cure. They are structural consequences of what a frozen transformer <em>is</em>: a stateless map with fixed weights and a bounded window (Eq.&nbsp;1, P1&ndash;P3). Because they follow from the <em>shape</em> of the loop, they cannot be prompted or tooled away; they can only be removed by re&#8209;wrapping the loop into a closed, stateful cycle over persistent stores, with the model left frozen inside it (Eq.&nbsp;2, Fig.&nbsp;1&ndash;2). <em class="corr">[corrected 2026-09-26 &mdash; see Corrections]</em> We specified that substrate faculty by faculty, said honestly which parts are open research and which are engineering, and &mdash; for the one faculty that is buildable today &mdash; shipped a running impact oracle that, on a package we built, missed no affected file where the strategies a context&#8209;bounded agent actually uses missed up to half. On real repositories it missed almost everything (recall 0.022), which is the refutation&rsquo;s subject. <em class="corr">[refuted &mdash; see Corrections]</em> The Qur'anic lens gave the work its spine of obligation: <em>know what exists before you act, verify what you are told, and hold what you can damage as a trust.</em> Those are not just good engineering defaults; here they are the architecture. The next step is to build the memory and learning layers against the same discipline &mdash; anchored to what can be verified, not to what the model says of itself &mdash; and to evaluate the whole loop on real repositories with real histories.</p>
 
 <hr class="sec"/>
 <h2 id="corrections">Corrections (2026-09-21)</h2>
@@ -779,6 +800,16 @@ <h2 id="corrections">Corrections (2026-09-21)</h2>
 <li><b>The faculty table (&sect;2) is unchanged here, and is now the canonical one.</b> The formal synthesis had a different &ldquo;follows from&rdquo; column in all five rows; it has been brought into line with this table, which argues each row and matches what forgekit&rsquo;s bindings address.</li>
 </ol>
 
+<hr class="sec"/>
+<h2 id="corrections-2026-09-26">Corrections (2026-09-26)</h2>
+<p>A second external deep review of the forgekit repository (2026-09-26, pinned at commit <code>d2abfa69fb77531199ffc67c5c076b524af69040</code>) asked what this edition&rsquo;s argument actually establishes. The changes are marked in place with <em class="corr">[corrected 2026-09-26]</em>; the argument itself is not rewritten, and each item quotes the wording it qualifies. The PDF edition predates these corrections as well.</p>
+<ol>
+<li><b>&ldquo;Cannot learn, imagine or self&#8209;correct&rdquo; is broader than the argument supports (abstract, &sect;2, &sect;13).</b> The edition says the model &ldquo;cannot <b>learn</b> from outcomes, cannot <b>imagine</b> the consequences of an action before taking it, cannot reliably <b>correct itself</b>&rdquo;, that &ldquo;neither better prompting nor additional tools (skills, MCP servers) remove these deficits&rdquo;, that in&#8209;context learning is &ldquo;a <em>simulation</em> of learning, not learning&rdquo;, and that the faculties &ldquo;cannot be prompted or tooled away&rdquo;. Frozen parameters exclude weight updates during use. They do not exclude changed behaviour from examples, retrieved facts, feedback or additional computation in the current context: GPT&#8209;3&rsquo;s few&#8209;shot evaluation measured exactly that adaptation through text, with no gradient updates (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020, &ldquo;Language Models are Few-Shot Learners&rdquo;, arXiv:2005.14165</a>). What a bare frozen model lacks is four <em>guarantees</em>: no built&#8209;in durable state across independent invocations; a bounded context; no automatic parameter update from outcomes; and unreliable self&#8209;verification without external evidence<sup class="cite">21</sup>. The substrate is one tested way of supplying persistence and verification around the model, not the only logically possible architecture.</li>
+<li><b>Prior art and what is (and is not) claimed (&sect;11).</b> External memory, feedback&#8209;driven improvement and structured agent control have clear prior art. CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) organises language agents into modular memory, action and decision procedures; Reflexion<sup class="cite">18</sup> (Shinn et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2303.11366">arXiv:2303.11366</a>) improves agents with linguistic feedback and an episodic memory buffer and no weight updates. The defensible framing is <em>a portable implementation of evidence&#8209;weighted coding&#8209;agent memory and checks, with empirical evaluation of trust failure modes</em>. The &ldquo;novel composition&rdquo; and &ldquo;novel framing&rdquo; rows of &sect;11 are claims about this combination for coding agents, kept only where an explicit comparison with that prior art survives, and the five faculties are a decomposition, not a proof that these five are necessary.</li>
+<li><b>The Qur&rsquo;anic lens: text, translation, commentary and analogy are now labelled (&sect;5, lens appendix).</b> Each verse card now labels the Arabic source text, the English translation and the author&rsquo;s design analogy separately, and a legend says where tafsir appears. The appendix column headed &ldquo;Retrieved gloss&rdquo; mixed retrieved translation (verse rows) with the author&rsquo;s own glosses (concept rows), and its &ldquo;Design principle&rdquo; column is now headed as the author&rsquo;s analogy. No Arabic text or translation was altered. The lens motivates the discipline <em>do not assert without evidence</em>, which the repository implements as a claim/status registry, verifier events and visible uncertainty; it establishes no algorithm&rsquo;s correctness, catch rate or uniqueness, and a deterministic implementation does not imply that a semantic detector&rsquo;s catch rate approaches 1. No theological adjudication is attempted.</li>
+<li><b>METR&rsquo;s 19% slowdown is scoped (&sect;4.1, evidence appendix C1).</b> The edition calls it &ldquo;the empirical heart of this paper&rdquo;. It is a randomized trial of 16 experienced open&#8209;source developers on 246 tasks in repositories they knew, with early&#8209;2025 tools: evidence about that setting, not a universal 2026 productivity coefficient in either direction. METR&rsquo;s February 2026 update (<a href="https://metr.org/blog/2026-02-24-uplift-update/">metr.org/blog/2026-02-24-uplift-update</a>) explains why selection effects complicate newer estimates; it is not evidence that AI now speeds developers up. The evidence map (<code>evidence/evidence_map.md</code>) now grades bibliographic verification, claim support, study design, independent replication and transfer scope separately.</li>
+</ol>
+
 <hr class="sec"/>
 <h2 id="refs">References</h2>
 <ol class="refs">
@@ -826,7 +857,7 @@ <h2 id="evidence-appendix">Appendix&ensp;Evidence map &mdash; the twelve statist
 <tr class="h"><td>ID</td><td>Claim</td><td>Primary source</td><td>Supports</td><td>Status</td></tr>
 <tr>
 <td style="white-space:nowrap"><b>C1</b></td>
-<td>Experienced open-source developers were 19% SLOWER with AI while believing they were ~20% faster (also forecast 24% speedup beforehand).</td>
+<td>Experienced open-source developers were 19% SLOWER with AI while believing they were ~20% faster (also forecast 24% speedup beforehand). <em class="corr">[corrected 2026-09-26]</em> Scope: 16 developers, 246 tasks, early-2025 tools; not a universal coefficient (see Corrections).</td>
 <td style="font-size:0.85em"><a href="https://arxiv.org/abs/2507.09089">Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity</a></td>
 <td style="font-size:0.85em">M2 (assumption/uncertainty - miscalibration), P3/self-correc</td>
 <td style="white-space:nowrap;color:#4E9A6B;font-weight:600">confirmed</td>
@@ -999,9 +1030,9 @@ <h2 id="ecosystem-appendix">Appendix&ensp;Ecosystem map &mdash; faculties &amp;
 </table>
 
 <h2 id="appendix">Appendix&ensp;Qur'anic&#8209;lens mapping table</h2>
-<p style="font-size:.92rem;color:var(--mute)">The complete 14&#8209;row mapping (12 load&#8209;bearing, 2 metaphor). Canonical Arabic and translations retrieved from quran.ai; full text, tafsir references, and design principles in the companion artifact <code>quran_lens.json</code>. Caveat: this table is a design lens, not technical or theological authority &mdash; see &sect;5.</p>
+<p style="font-size:.92rem;color:var(--mute)">The complete 14&#8209;row mapping (12 load&#8209;bearing, 2 metaphor). Canonical Arabic and translations retrieved from quran.ai; full text, tafsir references, and design principles in the companion artifact <code>quran_lens.json</code>. Caveat: this table is a design lens, not technical or theological authority &mdash; see &sect;5. <em class="corr">[corrected 2026-09-26]</em> The second column holds the retrieved translation for verse rows and the author&rsquo;s own gloss for concept rows (it was headed &ldquo;Retrieved gloss&rdquo;); the fourth column is the author&rsquo;s design analogy.</p>
 <table>
-<thead><tr><th style="width:22%">Concept / verse</th><th style="width:30%">Retrieved gloss</th><th style="width:16%">Faculty</th><th style="width:22%">Design principle (abbrev.)</th><th style="width:10%">Type</th></tr></thead>
+<thead><tr><th style="width:22%">Concept / verse</th><th style="width:30%">Translation (verses) / author&rsquo;s gloss (concepts)</th><th style="width:16%">Faculty</th><th style="width:22%">Author&rsquo;s design analogy (abbrev.)</th><th style="width:10%">Type</th></tr></thead>
 <tbody>
 <tr><td><b>17:36 — lā taqfu (do not pursue without knowledge)</b></td><td>Do not follow blindly what you do not know to be true: ears, eyes, and heart, you will be questioned about all these.</td><td>IMPACT-AWARENESS</td><td>Before any code mutation (file write, delete, refactor), the agent must run a pre-action verification gate that checks: (1) what entities in the codebase wil…</td><td style="color:#0d5c56;font-weight:600">load-bearing</td></tr>
 <tr><td><b>49:6 — tabayyun (verify reports before acting)</b></td><td>Believers, if a troublemaker brings you news, check it first, in case you wrong others unwittingly and later regret what you have done,</td><td>SELF-CORRECTION</td><td>The agent architecture must include a verification gate between receiving information (from context, tool output, or its own prior reasoning) and acting on it</td><td style="color:#0d5c56;font-weight:600">load-bearing</td></tr>
diff --git a/research/cognitive-substrate/evidence/evidence_map.json b/research/cognitive-substrate/evidence/evidence_map.json
index bfdbeeb3..40d1f607 100644
--- a/research/cognitive-substrate/evidence/evidence_map.json
+++ b/research/cognitive-substrate/evidence/evidence_map.json
@@ -13,7 +13,17 @@
     "number_as_primary_states": "16 experienced developers, 246 tasks in mature repos (avg 22k+ stars, 1M+ lines); AI use INCREASED completion time by 19%; pre-task forecast was 24% speedup; post-task self-estimate was 20% speedup.",
     "number_in_field_report": "19% slowdown for experienced devs; matches primary source exactly.",
     "status": "confirmed",
-    "note": "Directly reachable on arXiv and METR's own site; numbers match field report exactly. Caveat directly stated by METR: small sample (16 devs), specific to mature/familiar open-source repos, and AI-averse developers increasingly decline to participate (self-selection risk noted by METR itself)."
+    "note": "Directly reachable on arXiv and METR's own site; numbers match field report exactly. Caveat directly stated by METR: small sample (16 devs), specific to mature/familiar open-source repos, and AI-averse developers increasingly decline to participate (self-selection risk noted by METR itself).",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed (arXiv:2507.09089; METR site)",
+      "claim_support": "supports 19% slower for its own population; does not support a universal or 2026 coefficient in either direction",
+      "study_design": "randomized controlled trial: 16 experienced developers, 246 tasks",
+      "independent_replication": "none recorded here; METR's own 2026-02-24 update is by the same group and METR calls it weak evidence because of selection effects",
+      "transfer_scope": "experienced developers on mature repositories they knew, early-2025 tools",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    },
+    "correction_2026_09_26": "Scope: a randomized trial of 16 experienced open-source developers on 246 tasks with early-2025 tools, not a universal 2026 productivity coefficient in either direction. METR's February 2026 update (https://metr.org/blog/2026-02-24-uplift-update/) explains why selection effects complicate newer estimates; do not cite it as evidence that AI now speeds developers up."
   },
   {
     "claim_id": "C2_SO2025_trust",
@@ -29,7 +39,16 @@
     "number_as_primary_states": "Trust in AI accuracy fell from 40% (prior years) to 29% (2025); positive favorability fell from 72% to 60%; 84% use or plan to use AI tools (up from 76%); 46% actively distrust AI accuracy vs 33% trust it, only 3% 'highly trust'; 66% cite 'almost right, but not quite' as the #1 frustration, which 'often leads to' the #2 frustration, debugging being more time-consuming (45%).",
     "number_in_field_report": "Matches primary source essentially exactly on all four sub-figures.",
     "status": "confirmed",
-    "note": "Reached directly on Stack Overflow's own survey site and company blog. Self-reported survey; Stack Overflow's own methodology notes flag respondent self-selection bias (recruited via Stack Overflow's own channels, so more AI-engaged/skeptical developers may be over-represented)."
+    "note": "Reached directly on Stack Overflow's own survey site and company blog. Self-reported survey; Stack Overflow's own methodology notes flag respondent self-selection bias (recruited via Stack Overflow's own channels, so more AI-engaged/skeptical developers may be over-represented).",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed (official survey site and blog)",
+      "claim_support": "supports the trust and favourability figures as survey responses",
+      "study_design": "self-reported survey, 49,000+ respondents; self-selection noted by Stack Overflow",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "Stack Overflow survey respondents, 2025",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C3_Veracode_vuln",
@@ -45,7 +64,16 @@
     "number_as_primary_states": "Veracode's own report/blog states only the 45% figure (code samples across 100+ LLMs, Java/JS/Python/C# introducing OWASP Top-10 flaws; Java worst at ~72%; XSS failure 86%). Veracode's own public materials located in this search do NOT state a '2.74x' multiplier anywhere.",
     "number_in_field_report": "Field report attributes BOTH '45%' and '2.74x more vulnerabilities than human-written code' to Veracode, then separately says the 2.74x figure was 'independently corroborated by CodeRabbit's December 2025 analysis of 470 real-world PRs (2.74x more security vulnerabilities...)'.",
     "status": "vendor-only",
-    "note": "The 45% figure is directly traceable to Veracode's own report (vendor self-reported, not independently reproduced). The '2.74x' figure could NOT be located in Veracode's own primary materials during this search - it appears only in secondary/derivative blog posts (e.g. softwareseni.com) that attribute it to Veracode, while the field report itself sources the same 2.74x number to a DIFFERENT study (CodeRabbit's PR analysis). This looks like a citation conflation between two separate vendor studies that happen to share a number. Treat the 2.74x figure as unverified/possibly misattributed pending direct access to Veracode's full PDF report."
+    "note": "The 45% figure is directly traceable to Veracode's own report (vendor self-reported, not independently reproduced). The '2.74x' figure could NOT be located in Veracode's own primary materials during this search - it appears only in secondary/derivative blog posts (e.g. softwareseni.com) that attribute it to Veracode, while the field report itself sources the same 2.74x number to a DIFFERENT study (CodeRabbit's PR analysis). This looks like a citation conflation between two separate vendor studies that happen to share a number. Treat the 2.74x figure as unverified/possibly misattributed pending direct access to Veracode's full PDF report.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "45% confirmed in the vendor report; '2.74x' not found in Veracode's materials",
+      "claim_support": "supports 45% only; '2.74x' is unsupported (conflated with a separate study)",
+      "study_design": "vendor benchmark of LLM-generated code samples",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "the LLMs, languages and prompts Veracode tested in 2025",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C4_GitClear_duplication",
@@ -61,7 +89,16 @@
     "number_as_primary_states": "GitClear's own materials are internally inconsistent on the multiplier. The report's own page TITLE reads 'AI Copilot Code Quality: 2025 Data Suggests 4x Growth in Code Clones' (gitclear.com), but the body text of the same report and GitClear's press-mentions page both state duplicated code blocks (5+ lines) 'rose eightfold' / 'increased eightfold' during 2024 (211M changed lines, 2020-2024, Google/Microsoft/Meta/enterprise repos). Secondary summaries split roughly evenly between citing '4x' and '8x'. Underlying non-disputed figures: copy-pasted lines rose from 8.3% (2020) to 12.3% (2024); moved/refactored lines fell from ~24-25% to <10%; 2024 was the first year copy-paste exceeded moved lines. The 4x-vs-8x gap could not be resolved from available pages - likely reflects two different metrics (duplicated-block frequency vs. some other clone measure) reported inconsistently across GitClear's own title/body/press materials.",
     "number_in_field_report": "Field report states '8x rise in duplicated code blocks' - this matches GitClear's report BODY and press-mentions page, but GitClear's own page TITLE says '4x Growth in Code Clones,' an internal inconsistency the field report does not surface.",
     "status": "vendor-only",
-    "note": "GitClear is a code-analytics vendor; findings are corroborated by many independent tech-press writeups summarizing the same underlying dataset, but no independent third party has re-run the analysis separately. Correlational, not causal. IMPORTANT ADDITIONAL CAVEAT: GitClear's own materials are internally inconsistent - the report's page title cites '4x' growth in code clones while the body and press page cite an '8x' rise in duplicated blocks. The paper should either cite the specific metric name (duplicated-block frequency, 8x per body text) rather than a bare multiplier, or note both figures and the discrepancy explicitly rather than asserting '8x' as settled."
+    "note": "GitClear is a code-analytics vendor; findings are corroborated by many independent tech-press writeups summarizing the same underlying dataset, but no independent third party has re-run the analysis separately. Correlational, not causal. IMPORTANT ADDITIONAL CAVEAT: GitClear's own materials are internally inconsistent - the report's page title cites '4x' growth in code clones while the body and press page cite an '8x' rise in duplicated blocks. The paper should either cite the specific metric name (duplicated-block frequency, 8x per body text) rather than a bare multiplier, or note both figures and the discrepancy explicitly rather than asserting '8x' as settled.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "vendor report found; internally inconsistent (title 4x, body 8x)",
+      "claim_support": "partial: the direction is supported, the multiplier is not settled",
+      "study_design": "vendor code-analytics telemetry, correlational",
+      "independent_replication": "none independent (press summaries re-report the same dataset)",
+      "transfer_scope": "GitClear's analysed repositories, 2020-2024",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C5_DORA_amplifier",
@@ -77,7 +114,16 @@
     "number_as_primary_states": "Nearly 5,000 professionals surveyed (June 13-July 21, 2025) plus 100+ hours interviews; 90% AI adoption (14pp increase from 2024); AI's primary role is 'that of an amplifier... magnifying the strengths of high-performing organisations and the dysfunctions of struggling ones'; in 2025 AI's relationship to delivery throughput reversed to positive vs 2024, but AI continues to increase delivery instability; ~30% report little/no trust in AI-generated code.",
     "number_in_field_report": "Matches primary source directly ('AI is an amplifier'; high adoption; throughput/stability tension).",
     "status": "confirmed",
-    "note": "DORA is a Google-run but methodologically transparent, widely-cited industry research program (not a single vendor's self-promotional study); full methodology, sample size and survey window are published. Best-supported of the twelve claims alongside METR."
+    "note": "DORA is a Google-run but methodologically transparent, widely-cited industry research program (not a single vendor's self-promotional study); full methodology, sample size and survey window are published. Best-supported of the twelve claims alongside METR.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed (official DORA report)",
+      "claim_support": "supports the 'amplifier' framing and the survey figures",
+      "study_design": "survey of ~5,000 professionals plus interviews; published methodology",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "DORA survey respondents, 2025",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C6_SWEbench_retirement",
@@ -93,7 +139,16 @@
     "number_as_primary_states": "OpenAI audited 138 problems (27.6% subset of the 500-task set) that its o3 model could not reliably solve across 64 runs; found at least 59.4% of THOSE audited problems had flawed test cases/descriptions (35.5% narrow tests, 18.8% wide tests, 5.1% other); also found all tested frontier models could reproduce gold-patch solutions from training memory, indicating contamination. The specific 80.9%-Verified-vs-45.9%-Pro pairing (Claude Opus 4.5) was NOT found stated in OpenAI's own blog; it is reported by third-party benchmark aggregators (e.g. Scale AI SEAL leaderboard, BenchLM.ai, cited via codeant.ai) as of April 2026.",
     "number_in_field_report": "Field report's phrasing ('59.4% of audited problems had flawed test cases') is accurate to primary source. The 80.9%/45.9% pairing is directionally correct (large real gap exists) but its precise sourcing is a third-party leaderboard snapshot, not OpenAI's own blog post.",
     "status": "confirmed",
-    "note": "The 59.4%-of-audited-problems figure is directly confirmed on OpenAI's own site - a strong, well-documented primary source. The specific 80.9/45.9 percentage pair is a real, traceable leaderboard snapshot (Scale AI SEAL/BenchLM) but should be cited as such, not as OpenAI's own number, and will drift as models are re-benchmarked."
+    "note": "The 59.4%-of-audited-problems figure is directly confirmed on OpenAI's own site - a strong, well-documented primary source. The specific 80.9/45.9 percentage pair is a real, traceable leaderboard snapshot (Scale AI SEAL/BenchLM) but should be cited as such, not as OpenAI's own number, and will drift as models are re-benchmarked.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed (OpenAI blog)",
+      "claim_support": "supports flawed tests in at least 59.4% of a 138-problem audited hard subset, not of all 500 tasks; the 80.9%/45.9% pairing is a third-party leaderboard snapshot",
+      "study_design": "vendor audit of a benchmark subset, plus contamination probes",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "SWE-bench Verified's audited hard subset and the frontier models OpenAI probed",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C7_Faros_PRreview",
@@ -109,7 +164,16 @@
     "number_as_primary_states": "Two years of telemetry from 22,000 developers / 4,000+ teams, comparing each org's lowest- vs highest-AI-adoption quarters: median time in PR review +441.5% (average time in review +199.6%, first-review wait +156.6%); incidents-to-PR ratio +242.7%; bugs per developer +54%; 31.3% more PRs merged with no review at all; code churn +861%.",
     "number_in_field_report": "Matches primary source numbers exactly.",
     "status": "vendor-only",
-    "note": "Faros AI is an engineering-intelligence vendor whose commercial product monitors exactly these metrics; the report itself and third-party coverage (ADTmag) note these are cross-sectional correlations across the vendor's own customer telemetry, not a controlled study, and 2025-vs-2026 report editions are independent cross-sections rather than a longitudinal panel."
+    "note": "Faros AI is an engineering-intelligence vendor whose commercial product monitors exactly these metrics; the report itself and third-party coverage (ADTmag) note these are cross-sectional correlations across the vendor's own customer telemetry, not a controlled study, and 2025-vs-2026 report editions are independent cross-sections rather than a longitudinal panel.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed in the vendor report",
+      "claim_support": "supports the reported deltas as vendor telemetry",
+      "study_design": "cross-sectional vendor telemetry (22,000 developers), not a controlled study",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "Faros AI's customer organisations",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C8_Anthropic_comprehension",
@@ -125,7 +189,16 @@
     "number_as_primary_states": "(a) Shen & Tamkin: developers who used AI to learn a new async-programming library completed tasks but scored measurably worse on a post-task comprehension test ('17% lower' per a secondary citation in an arXiv survey paper - I could not independently pull Shen & Tamkin's own abstract/number in this search, only a citing paper's paraphrase). (b) The 400,000-session Anthropic study found users make ~70% of planning decisions and Claude makes ~80% of execution decisions; occupation-based success rates were similar across professions (~26-34%); it does NOT report a comprehension-score deficit.",
     "number_in_field_report": "Field report merges these into one sentence ('Anthropic's own research (~400,000 Claude Code sessions) found... 17% lower on comprehension'), incorrectly attributing the comprehension finding to the session-count study.",
     "status": "unverifiable",
-    "note": "This is a citation-conflation error carried over from the field report (or its own sources). The 400K-session study is real and directly confirmed, but does not contain a comprehension-deficit finding. The '17% lower comprehension' figure traces to a separate, distinct Shen & Tamkin paper that this search could not directly retrieve/confirm in primary form (only via a third paper's citation of it). RECOMMENDATION: if the white paper wants to use the comprehension-deficit claim, cite Shen & Tamkin (2026) directly and verify the 17% figure against their own abstract/paper before use; do not attribute it to the 400K-session study."
+    "note": "This is a citation-conflation error carried over from the field report (or its own sources). The 400K-session study is real and directly confirmed, but does not contain a comprehension-deficit finding. The '17% lower comprehension' figure traces to a separate, distinct Shen & Tamkin paper that this search could not directly retrieve/confirm in primary form (only via a third paper's citation of it). RECOMMENDATION: if the white paper wants to use the comprehension-deficit claim, cite Shen & Tamkin (2026) directly and verify the 17% figure against their own abstract/paper before use; do not attribute it to the 400K-session study.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "unverifiable as attributed (two studies conflated)",
+      "claim_support": "not supported: the 400,000-session study does not measure comprehension",
+      "study_design": "not assessed (primary number not retrieved)",
+      "independent_replication": "not assessed",
+      "transfer_scope": "not assessed",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C9_Sonar_verification_gap",
@@ -141,7 +214,16 @@
     "number_as_primary_states": "Survey of 1,100+ (some sources say 1,149) professional developers, January 2026: 96% do not fully trust AI-generated code is functionally correct; only 48% always check AI-assisted code before committing; AI accounts for 42% of committed code (projected 65% by 2027); 38% say reviewing AI code takes more effort than reviewing human code; the term 'verification debt' is attributed to AWS CTO Werner Vogels.",
     "number_in_field_report": "Matches primary source exactly.",
     "status": "vendor-only",
-    "note": "Sonar is a code-quality/verification tooling vendor with a direct commercial interest in this narrative; numbers are self-reported survey data, not independently replicated, though the survey size and methodology are transparently disclosed in the primary PDF."
+    "note": "Sonar is a code-quality/verification tooling vendor with a direct commercial interest in this narrative; numbers are self-reported survey data, not independently replicated, though the survey size and methodology are transparently disclosed in the primary PDF.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed in the vendor survey",
+      "claim_support": "supports the 96% / 48% figures as survey responses",
+      "study_design": "vendor survey, 1,100+ developers",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "Sonar survey respondents, January 2026",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C10_JetBrains_manual_correction",
@@ -157,7 +239,16 @@
     "number_as_primary_states": "JetBrains' own 2025 report (24,534 developers) confirms 85% regularly use AI tools and 62% rely on at least one AI coding assistant, but this search could not locate any statement of a '77% manually correct AI output for conventions every session' figure anywhere in JetBrains' own materials, blog posts, or press coverage of the 2025 or 2026 editions.",
     "number_in_field_report": "77% manually correct for conventions every session (attributed to JetBrains 2025).",
     "status": "unverifiable",
-    "note": "Could not confirm this specific statistic in JetBrains' own primary materials despite multiple targeted searches of the official report, its AI-specific subpage, and secondary coverage. It may be a misremembered/misattributed figure, or drawn from the raw downloadable dataset (500+ questions) rather than the published highlights - the field report should either drop this figure or the paper authors should independently pull it from JetBrains' raw data release before use."
+    "note": "Could not confirm this specific statistic in JetBrains' own primary materials despite multiple targeted searches of the official report, its AI-specific subpage, and secondary coverage. It may be a misremembered/misattributed figure, or drawn from the raw downloadable dataset (500+ questions) rather than the published highlights - the field report should either drop this figure or the paper authors should independently pull it from JetBrains' raw data release before use.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "not found in JetBrains' materials",
+      "claim_support": "not supported",
+      "study_design": "not assessed",
+      "independent_replication": "not assessed",
+      "transfer_scope": "not assessed",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C11_MCP_context_bloat",
@@ -173,7 +264,16 @@
     "number_as_primary_states": "(b) RAG-MCP's own 'MCP stress test' (needle-in-a-haystack-style, N candidate MCP schemas with 1 ground truth) found baseline tool-selection accuracy of 13.62% vs 43.13% for their retrieval-augmented method at scale - i.e. the '43% vs 14%' figures are RAG-MCP's OWN method-vs-baseline comparison on a synthetic stress test, not a general real-world degradation curve as tools accumulate. (a) The 72%/143K-token figure is not from any peer-reviewed or vendor-formal study located in this search; it recurs across multiple blogs as an informal, uncredited individual measurement (one specific developer's personal setup: GitHub + Playwright + IDE MCP servers).",
     "number_in_field_report": "Field report states these as if they describe general degradation with tool count ('tool-selection accuracy drops from 43% to below 14% as tools accumulate') and cites a 72% context-window consumption figure as an established fact.",
     "status": "vendor-only",
-    "note": "The 43.13%-vs-13.62% numbers ARE real and traceable to a genuine arXiv paper (RAG-MCP), but the field report's framing ('as tools accumulate') mischaracterizes what those specific numbers measure (a baseline vs their proposed retrieval method on one synthetic stress test, not a general accumulation curve). The 72%-window figure has no traceable primary/academic source - only recurring, uncredited blog claims. RECOMMENDATION: if used, cite RAG-MCP correctly as 'a stress test showing retrieval-based tool selection outperforms naive selection at scale' rather than a general context-rot statistic, and treat the 72% figure as illustrative anecdote, not a verified finding."
+    "note": "The 43.13%-vs-13.62% numbers ARE real and traceable to a genuine arXiv paper (RAG-MCP), but the field report's framing ('as tools accumulate') mischaracterizes what those specific numbers measure (a baseline vs their proposed retrieval method on one synthetic stress test, not a general accumulation curve). The 72%-window figure has no traceable primary/academic source - only recurring, uncredited blog claims. RECOMMENDATION: if used, cite RAG-MCP correctly as 'a stress test showing retrieval-based tool selection outperforms naive selection at scale' rather than a general context-rot statistic, and treat the 72% figure as illustrative anecdote, not a verified finding.",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "43%/14% traceable to RAG-MCP (arXiv:2505.03275); 72% has no formal source",
+      "claim_support": "not supported as framed: 43% vs 14% is a method-vs-baseline stress test, not an accumulation curve",
+      "study_design": "synthetic stress test in a preprint, plus blog anecdotes",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "that stress test's setup",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   },
   {
     "claim_id": "C12_Panickssery_selfpreference",
@@ -189,6 +289,15 @@
     "number_as_primary_states": "GPT-4 and Llama 2, used as evaluators, have 'non-trivial accuracy' at distinguishing their own outputs from other LLMs' and humans' outputs; a linear correlation is found between self-recognition capability and strength of self-preference bias (LLM evaluators score their own outputs higher while human annotators rate them as equal quality); fine-tuning to improve self-recognition further amplifies self-preference.",
     "number_in_field_report": "Field report's characterization ('LLMs show self-preference/self-recognition bias when evaluating') matches the paper's core finding faithfully; no specific number is claimed by the field report beyond the qualitative finding.",
     "status": "confirmed",
-    "note": "Directly confirmed via the official NeurIPS 2024 proceedings page and the underlying arXiv preprint; a peer-reviewed, widely-cited paper (an NeurIPS 2024 Oral). This is the strongest-quality citation among all twelve (peer-reviewed venue, not industry survey/vendor report)."
+    "note": "Directly confirmed via the official NeurIPS 2024 proceedings page and the underlying arXiv preprint; a peer-reviewed, widely-cited paper (an NeurIPS 2024 Oral). This is the strongest-quality citation among all twelve (peer-reviewed venue, not industry survey/vendor report).",
+    "grades": {
+      "graded": "2026-09-26",
+      "bibliographic_verification": "confirmed (NeurIPS 2024 proceedings)",
+      "claim_support": "supports the qualitative self-preference finding",
+      "study_design": "controlled evaluation experiments, peer-reviewed",
+      "independent_replication": "none recorded here",
+      "transfer_scope": "the evaluator models studied (GPT-4, Llama 2)",
+      "note": "`status` records mainly bibliographic verification and source independence; these fields grade the other dimensions separately."
+    }
   }
 ]
\ No newline at end of file
diff --git a/research/cognitive-substrate/evidence/evidence_map.md b/research/cognitive-substrate/evidence/evidence_map.md
index 901e58d8..76287f5d 100644
--- a/research/cognitive-substrate/evidence/evidence_map.md
+++ b/research/cognitive-substrate/evidence/evidence_map.md
@@ -19,6 +19,39 @@
 | 11 | A standard MCP setup (few servers) can consume ~72% of a 200K-token context window before ... | (b) Qiyao Sun et al. (2025) | ⚠️ vendor-only | See note |
 | 12 | LLM evaluators recognize and favor their own generations - self-preference bias correlates... | Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Main Conference Track (Oral) (2024) | ✅ confirmed | See note |
 
+## Five kinds of grade, kept separate (added 2026-09-26)
+
+The `Status` column above records mainly **bibliographic verification** and source independence:
+whether a number can be traced to a primary source, and whether the party behind it has a stake. It
+is not a grade of whether the source supports the claim as used, of its design, of replication, or of
+how far the result travels, so "confirmed" does not mean "generalizes". The table below grades those
+dimensions separately, using only what each entry in this map already records.
+
+| Dimension | Question it answers |
+|---|---|
+| Bibliographic verification | Does the cited source exist, is it correctly attributed, and does it contain the number? |
+| Claim support | Does the source support the claim *as this paper uses it* (population, measure, direction)? |
+| Study design | Randomized trial, observational study, survey, vendor telemetry, benchmark audit? |
+| Independent replication | Has anyone other than the originator reproduced it? |
+| Transfer scope | Which population, date, tooling and setting can the result be carried to? |
+
+| Claim | Bibliographic verification | Claim support | Study design | Independent replication | Transfer scope |
+|---|---|---|---|---|---|
+| C1 METR slowdown | confirmed (arXiv:2507.09089; METR site) | supports 19% slower for its own population; does not support a universal or 2026 coefficient in either direction | randomized controlled trial: 16 experienced developers, 246 tasks | none recorded here; METR's own 2026-02-24 update is by the same group and METR calls it weak evidence because of selection effects | experienced developers on mature repositories they knew, early-2025 tools |
+| C2 Stack Overflow trust | confirmed (official survey site and blog) | supports the trust and favourability figures as survey responses | self-reported survey, 49,000+ respondents; self-selection noted by Stack Overflow | none recorded here | Stack Overflow survey respondents, 2025 |
+| C3 Veracode vulnerabilities | 45% confirmed in the vendor report; '2.74x' not found in Veracode's materials | supports 45% only; '2.74x' is unsupported (conflated with a separate study) | vendor benchmark of LLM-generated code samples | none recorded here | the LLMs, languages and prompts Veracode tested in 2025 |
+| C4 GitClear duplication | vendor report found; internally inconsistent (title 4x, body 8x) | partial: the direction is supported, the multiplier is not settled | vendor code-analytics telemetry, correlational | none independent (press summaries re-report the same dataset) | GitClear's analysed repositories, 2020-2024 |
+| C5 DORA amplifier | confirmed (official DORA report) | supports the 'amplifier' framing and the survey figures | survey of ~5,000 professionals plus interviews; published methodology | none recorded here | DORA survey respondents, 2025 |
+| C6 SWE-bench Verified audit | confirmed (OpenAI blog) | supports flawed tests in at least 59.4% of a 138-problem audited hard subset, not of all 500 tasks; the 80.9%/45.9% pairing is a third-party leaderboard snapshot | vendor audit of a benchmark subset, plus contamination probes | none recorded here | SWE-bench Verified's audited hard subset and the frontier models OpenAI probed |
+| C7 Faros PR review | confirmed in the vendor report | supports the reported deltas as vendor telemetry | cross-sectional vendor telemetry (22,000 developers), not a controlled study | none recorded here | Faros AI's customer organisations |
+| C8 comprehension (conflated) | unverifiable as attributed (two studies conflated) | not supported: the 400,000-session study does not measure comprehension | not assessed (primary number not retrieved) | not assessed | not assessed |
+| C9 Sonar verification gap | confirmed in the vendor survey | supports the 96% / 48% figures as survey responses | vendor survey, 1,100+ developers | none recorded here | Sonar survey respondents, January 2026 |
+| C10 JetBrains manual correction | not found in JetBrains' materials | not supported | not assessed | not assessed | not assessed |
+| C11 MCP context bloat | 43%/14% traceable to RAG-MCP (arXiv:2505.03275); 72% has no formal source | not supported as framed: 43% vs 14% is a method-vs-baseline stress test, not an accumulation curve | synthetic stress test in a preprint, plus blog anecdotes | none recorded here | that stress test's setup |
+| C12 self-preference bias | confirmed (NeurIPS 2024 proceedings) | supports the qualitative self-preference finding | controlled evaluation experiments, peer-reviewed | none recorded here | the evaluator models studied (GPT-4, Llama 2) |
+
+The same grades are in `evidence_map.json` under each record's `grades` field.
+
 ## Detailed Findings
 
 ### 1. C1_METR_slowdown: ✅ confirmed
@@ -35,6 +68,8 @@
 
 **Note:** Directly reachable on arXiv and METR's own site; numbers match field report exactly. Caveat directly stated by METR: small sample (16 devs), specific to mature/familiar open-source repos, and AI-averse developers increasingly decline to participate (self-selection risk noted by METR itself).
 
+**Correction (2026-09-26):** scope this wherever C1 appears. It is a study of 16 experienced developers on 246 tasks with early-2025 tooling, not a universal 2026 productivity coefficient in either direction. METR's [February 2026 update](https://metr.org/blog/2026-02-24-uplift-update/) explains why selection effects complicate newer estimates; it is not evidence that AI now speeds developers up either. (This scoping was recommended in `research/formal-synthesis/audits/our_evidence_corrections.json` and had not been applied here.)
+
 ### 2. C2_SO2025_trust: ✅ confirmed
 
 **Claim:** Trust in AI accuracy fell from 40% to 29% (or 46% actively distrust vs 33% trust per detailed breakdown); favorability 72%->60%; 66% say AI answers are 'almost right, but not quite'; 45% say debugging AI code is more time-consuming.
@@ -193,7 +228,7 @@
 
 
 **Safe to lean on without hedging (peer-reviewed / official primary source, methodology transparent):**
-- METR's 19%-slowdown RCT (C1) — the single best-controlled empirical finding in the set; cite with its own caveats (n=16, mature-repo setting).
+- METR's 19%-slowdown RCT (C1) — the single best-controlled empirical finding in the set; cite with its own caveats (n=16, mature-repo setting, early-2025 tools; not a universal 2026 coefficient — see the 2026-09-26 correction under C1).
 - Panickssery et al. NeurIPS 2024 self-preference bias (C12) — the only genuinely peer-reviewed academic paper among the twelve; strongest citation for the M6 argument that an LLM cannot be its sole verifier.
 - OpenAI's own retirement of SWE-bench Verified and the 59.4%-of-audited-problems figure (C6) — directly stated on OpenAI's blog. The specific 80.9%/45.9% score pairing, however, should be cited as a third-party leaderboard snapshot (Scale AI SEAL/BenchLM), not as OpenAI's own number, since it will drift release-to-release.
 - DORA 2025 "AI is an amplifier" finding (C5) — large, transparent, non-vendor-captured methodology (Google Cloud + independent research partners), the most credible of the survey-based claims.
diff --git a/research/cognitive-substrate/quranic-lens/quran_lens.json b/research/cognitive-substrate/quranic-lens/quran_lens.json
index effd3540..cf7315c9 100644
--- a/research/cognitive-substrate/quranic-lens/quran_lens.json
+++ b/research/cognitive-substrate/quranic-lens/quran_lens.json
@@ -7,6 +7,14 @@
     "Grounded with quran.ai: fetch_tafsir(49:6, en-ibn-kathir)",
     "Grounded with quran.ai: fetch_tafsir(33:72, en-ibn-kathir)"
   ],
+  "field_legend": {
+    "added": "2026-09-26",
+    "arabic_or_ref": "verse rows: the source text in clean Uthmani script (retrieved); concept rows: the Arabic term and root",
+    "retrieved_translation_or_gloss": "verse rows: M.A.S. Abdel Haleem's translation (retrieved); concept rows: the author's own gloss. The two are different kinds of text.",
+    "concrete_design_principle": "the author's design analogy: not a translation, not tafsir, and not a claim about what the verse means",
+    "source": "retrieval record; a tafsir named here was consulted, and quran_lens.md quotes it under its own label",
+    "operational_note": "The lens motivates the 'do not assert without evidence' discipline (claim registry, verifier events, visible uncertainty). It establishes no algorithm's correctness, catch rate or uniqueness, and a deterministic implementation does not imply c -> 1 for a semantic detector. No theological adjudication is attempted."
+  },
   "mappings": [
     {
       "concept_or_verse": "17:36 — lā taqfu (do not pursue without knowledge)",
diff --git a/research/cognitive-substrate/quranic-lens/quran_lens.md b/research/cognitive-substrate/quranic-lens/quran_lens.md
index 1e8c84b1..2c651b17 100644
--- a/research/cognitive-substrate/quranic-lens/quran_lens.md
+++ b/research/cognitive-substrate/quranic-lens/quran_lens.md
@@ -4,6 +4,33 @@
 
 The Quran is used here as a FRAMING LENS and ETHICS SOURCE for the cognitive substrate design, never as technical authority for an engineering claim. No verse is cited to prove that a particular algorithm works or that a specific data structure is correct — those claims stand or fall on their engineering merits alone. What the Quranic framing provides is: (1) a vocabulary for naming the agent's epistemic obligations (what it owes to truthfulness, to verification, to stewardship), (2) a hierarchy of knowledge (ʿilm → fahm → ḥikma) that motivates a layered memory architecture rather than a flat one, and (3) ethical constraints on autonomy (amāna, tabayyun) that translate into concrete architectural safeguards. Where a mapping is marked 'metaphor,' the analogy is illustrative — it communicates the design motivation but does not uniquely determine the technical solution. Where a mapping is marked 'load-bearing,' the Quranic concept directly motivates a specific architectural decision (e.g., a mandatory verification gate, not an optional one). Even in load-bearing cases, the engineering justification must be independently defensible — the verse explains *why* we insist on this design choice, not *that* it will work. Discovered patterns in the text describe; they do not legislate.
 
+
+## How to read each entry (labels added 2026-09-26)
+
+Every entry keeps four kinds of text apart, each under its own label. When these labels were
+added, no Arabic text and no translation was altered, re-translated or paraphrased; paragraphs
+that mixed a tafsir report with the author's reading were split at the sentence boundary.
+
+| Label | What it is | Whose words |
+|---|---|---|
+| **Arabic (source text)** / **Arabic (term and root)** | the verse in clean Uthmani script, or the Arabic term a concept entry discusses | the source text, retrieved (see Grounding) |
+| **Translation (Abdel Haleem)** | the English translation of the verse | M.A.S. Abdel Haleem, retrieved |
+| **Tafsir (Ibn Kathir, as reported)** | a summary of classical commentary and any quotation it carries | Ibn Kathir's tafsir, as reported by the author |
+| **Gloss (author's)** | a short explanation of a concept | the author |
+| **Design principle — author's analogy** (load-bearing or metaphor) | the engineering reading the author draws | the author: not a translation, not tafsir, and not a claim about what the verse means |
+
+## What the lens does and does not establish (2026-09-26)
+
+The lens is motivation, not evidence. Operationally it motivates one discipline — *do not assert
+without evidence* — which this repository implements as a machine-readable claim/status registry
+([`docs/status/claims.json`](../../../docs/status/claims.json)), verifier events that record what
+actually ran, and uncertainty that is shown to the user rather than hidden. It establishes no
+algorithm's correctness, catch rate or uniqueness: every technical guarantee still needs code-level
+assumptions, tests or measurements. In particular, a deterministic implementation of a check does
+not imply that its catch rate on semantic failures approaches 1 (`c → 1`); a deterministic gate is
+exact about its proxy signal, not about the miss. No theological adjudication is attempted or
+implied.
+
 ---
 
 ## Grounding
@@ -22,17 +49,19 @@ All verse translations below are retrieved canonical text from the Abdel Haleem
 
 ### 17:36 — lā taqfu mā laysa laka bihi ʿilm
 
-**Arabic:**
+**Arabic (source text):**
 > وَلَا تَقْفُ مَا لَيْسَ لَكَ بِهِ عِلْمٌ ۚ إِنَّ السَّمْعَ وَالْبَصَرَ وَالْفُؤَادَ كُلُّ أُولَٰئِكَ كَانَ عَنْهُ مَسْئُولًا
 
 **Translation (Abdel Haleem):**
 > Do not follow blindly what you do not know to be true: ears, eyes, and heart, you will be questioned about all these.
 
-**Design principle (load-bearing):** Before any code mutation (file write, delete, refactor), the agent must run a pre-action verification gate that checks: (1) what entities in the codebase will be affected, (2) whether the agent has sufficient context (has it read the relevant files, tests, and dependents), and (3) whether the predicted outcome is supported by evidence rather than pattern-matched guessing. Actions taken without verified knowledge are blocked, not merely flagged.
+**Design principle — author's analogy (load-bearing):** Before any code mutation (file write, delete, refactor), the agent must run a pre-action verification gate that checks: (1) what entities in the codebase will be affected, (2) whether the agent has sufficient context (has it read the relevant files, tests, and dependents), and (3) whether the predicted outcome is supported by evidence rather than pattern-matched guessing. Actions taken without verified knowledge are blocked, not merely flagged.
 
 The verse's structure — "ears, eyes, and heart, you will be questioned about all these" — maps to an audit trail: every sensory channel the agent used (what it read, what it inferred, what it assumed) is logged so the decision can be reconstructed and questioned.
 
-Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting without knowledge, citing Qatadah: "Do not say 'I have seen' when you did not see anything, or 'I have heard' when you did not hear anything, or 'I know' when you do not know, for Allah will ask you about all of that." For the agent, the parallel is direct: do not claim a file is safe to modify when you have not read it, do not assert a test passes when you have not run it, and do not say a change is isolated when you have not traced its dependents.
+**Tafsir (Ibn Kathir, as reported):** Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting without knowledge, citing Qatadah: "Do not say 'I have seen' when you did not see anything, or 'I have heard' when you did not hear anything, or 'I know' when you do not know, for Allah will ask you about all of that."
+
+**Design principle — author's analogy (continued):** For the agent, the parallel is direct: do not claim a file is safe to modify when you have not read it, do not assert a test passes when you have not run it, and do not say a change is isolated when you have not traced its dependents.
 
 ---
 
@@ -40,49 +69,49 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 
 ### 49:6 — tabayyun (the verification gate)
 
-**Arabic:**
+**Arabic (source text):**
 > يَا أَيُّهَا الَّذِينَ آمَنُوا إِن جَاءَكُمْ فَاسِقٌ بِنَبَإٍ فَتَبَيَّنُوا أَن تُصِيبُوا قَوْمًا بِجَهَالَةٍ فَتُصْبِحُوا عَلَىٰ مَا فَعَلْتُمْ نَادِمِينَ
 
 **Translation (Abdel Haleem):**
 > Believers, if a troublemaker brings you news, check it first, in case you wrong others unwittingly and later regret what you have done,
 
-**Design principle (load-bearing):** The agent architecture must include a verification gate between receiving information and acting on it. The verse's operative term tabayyun (تَبَيُّنُوا) demands active investigation, not passive acceptance. Before applying a code change based on an error report, a user request, or its own diagnosis, the agent must independently verify the claim — re-read the file, re-run the test, check that the error still exists. This prevents cascading damage from stale context, hallucinated errors, or misunderstood instructions. The gate is architectural (a mandatory step in the action pipeline), not advisory.
+**Design principle — author's analogy (load-bearing):** The agent architecture must include a verification gate between receiving information and acting on it. The verse's operative term tabayyun (تَبَيُّنُوا) demands active investigation, not passive acceptance. Before applying a code change based on an error report, a user request, or its own diagnosis, the agent must independently verify the claim — re-read the file, re-run the test, check that the error still exists. This prevents cascading damage from stale context, hallucinated errors, or misunderstood instructions. The gate is architectural (a mandatory step in the action pipeline), not advisory.
 
 ### 4:82 — tadabbur as self-consistency checking
 
-**Arabic:**
+**Arabic (source text):**
 > أَفَلَا يَتَدَبَّرُونَ الْقُرْآنَ ۚ وَلَوْ كَانَ مِنْ عِندِ غَيْرِ اللَّهِ لَوَجَدُوا فِيهِ اخْتِلَافًا كَثِيرًا
 
 **Translation (Abdel Haleem):**
 > Will they not think about this Quran? If it had been from anyone other than God, they would have found much inconsistency in it.
 
-**Design principle (load-bearing):** The agent must run self-consistency checks on its own output before committing it. The verse's argument is structural: internal contradiction is evidence of flawed origin. If a planned set of code changes contradicts the agent's own stated reasoning, or if the predicted outcome of an edit conflicts with the test expectations the agent just read, the system should flag the inconsistency and halt. This is the metacognitive controller — a structured reflection pass, not a vague "think again" prompt.
+**Design principle — author's analogy (load-bearing):** The agent must run self-consistency checks on its own output before committing it. The verse's argument is structural: internal contradiction is evidence of flawed origin. If a planned set of code changes contradicts the agent's own stated reasoning, or if the predicted outcome of an edit conflicts with the test expectations the agent just read, the system should flag the inconsistency and halt. This is the metacognitive controller — a structured reflection pass, not a vague "think again" prompt.
 
 ### 47:24 — tadabbur as deliberate re-examination
 
-**Arabic:**
+**Arabic (source text):**
 > أَفَلَا يَتَدَبَّرُونَ الْقُرْآنَ أَمْ عَلَىٰ قُلُوبٍ أَقْفَالُهَا
 
 **Translation (Abdel Haleem):**
 > Will they not contemplate the Quran? Do they have locks on their hearts?
 
-**Design principle (metaphor):** The "locks on hearts" image maps to a real architectural failure mode: when the agent's context is saturated or its attention is consumed by irrelevant detail, it becomes functionally locked — unable to reconsider its approach. The metacognitive controller must be able to reset the agent's working context, re-examine the problem from a fresh framing, and iterate. This means the reflection loop can propose and evaluate alternative plans — a structured backtracking mechanism.
+**Design principle — author's analogy (metaphor):** The "locks on hearts" image maps to a real architectural failure mode: when the agent's context is saturated or its attention is consumed by irrelevant detail, it becomes functionally locked — unable to reconsider its approach. The metacognitive controller must be able to reset the agent's working context, re-examine the problem from a fresh framing, and iterate. This means the reflection loop can propose and evaluate alternative plans — a structured backtracking mechanism.
 
 ### CONCEPT: tadabbur (deep, structured reflection)
 
-**Arabic:** تَدَبُّر (root: د-ب-ر, relating to what comes after, consequences)
+**Arabic (term and root):** تَدَبُّر (root: د-ب-ر, relating to what comes after, consequences)
 
-**Gloss:** Tadabbur is not casual thought; its root d-b-r relates to "what is behind" or "what follows" — examining the consequences and deeper implications. In Quranic usage (4:82, 47:24), it is the deliberate act of looking beyond the surface to the structure beneath.
+**Gloss (author's):** Tadabbur is not casual thought; its root d-b-r relates to "what is behind" or "what follows" — examining the consequences and deeper implications. In Quranic usage (4:82, 47:24), it is the deliberate act of looking beyond the surface to the structure beneath.
 
-**Design principle (load-bearing):** The metacognitive controller is a tadabbur loop: after the agent generates a plan, the controller examines what comes after — what are the downstream consequences of this change? What will break? What assumptions does this rely on? This is not a confidence score but a structured trace-forward through the dependency graph.
+**Design principle — author's analogy (load-bearing):** The metacognitive controller is a tadabbur loop: after the agent generates a plan, the controller examines what comes after — what are the downstream consequences of this change? What will break? What assumptions does this rely on? This is not a confidence score but a structured trace-forward through the dependency graph.
 
 ### CONCEPT: tabayyun (verification before action)
 
-**Arabic:** تَبَيُّن (root: ب-ي-ن, clarity, making evident)
+**Arabic (term and root):** تَبَيُّن (root: ب-ي-ن, clarity, making evident)
 
-**Gloss:** Tabayyun is the act of seeking clarity and verification before acting on received information. In 49:6, it is commanded as a mandatory step between receiving a report and taking action, specifically to prevent harm caused by acting on unverified information.
+**Gloss (author's):** Tabayyun is the act of seeking clarity and verification before acting on received information. In 49:6, it is commanded as a mandatory step between receiving a report and taking action, specifically to prevent harm caused by acting on unverified information.
 
-**Design principle (load-bearing):** The verification gate sits between the agent's diagnosis and its action. The gate requires: (1) re-read the actual current state of files to be modified, (2) confirm the error still exists and matches the diagnosis, (3) verify the proposed fix does not introduce new issues. The verse's command is categorical — not conditional on confidence level.
+**Design principle — author's analogy (load-bearing):** The verification gate sits between the agent's diagnosis and its action. The gate requires: (1) re-read the actual current state of files to be modified, (2) confirm the error still exists and matches the diagnosis, (3) verify the proposed fix does not introduce new issues. The verse's command is categorical — not conditional on confidence level.
 
 ---
 
@@ -90,7 +119,7 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 
 ### 96:1-5 — iqraʾ / ʿallama bi-l-qalam (Read; taught by the pen)
 
-**Arabic:**
+**Arabic (source text):**
 > اقْرَأْ بِاسْمِ رَبِّكَ الَّذِي خَلَقَ ﴿١﴾
 > خَلَقَ الْإِنسَانَ مِنْ عَلَقٍ ﴿٢﴾
 > اقْرَأْ وَرَبُّكَ الْأَكْرَمُ ﴿٣﴾
@@ -104,15 +133,15 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 > (96:4) who taught by [means of] the pen,
 > (96:5) who taught man what he did not know.
 
-**Design principle (load-bearing):** Knowledge must be externalized to survive beyond the moment of computation. The pen (al-qalam) is the instrument of externalization — it transforms ephemeral thought into durable record. Every context window is ephemeral (like unwritten thought), so a persistent memory store (the "pen") must write down what the agent learns, decides, and observes. The architecture requires: (a) a write-back mechanism that captures salient facts into durable storage, (b) a retrieval mechanism that re-loads relevant past experience into the next session's context, (c) a consolidation process that organizes raw experience into structured knowledge. "Taught man what he did not know" — the pen does not just record; it enables access to knowledge beyond unaided capacity.
+**Design principle — author's analogy (load-bearing):** Knowledge must be externalized to survive beyond the moment of computation. The pen (al-qalam) is the instrument of externalization — it transforms ephemeral thought into durable record. Every context window is ephemeral (like unwritten thought), so a persistent memory store (the "pen") must write down what the agent learns, decides, and observes. The architecture requires: (a) a write-back mechanism that captures salient facts into durable storage, (b) a retrieval mechanism that re-loads relevant past experience into the next session's context, (c) a consolidation process that organizes raw experience into structured knowledge. "Taught man what he did not know" — the pen does not just record; it enables access to knowledge beyond unaided capacity.
 
 ### CONCEPT: ḥifẓ + murājaʿa (preservation + spaced review)
 
-**Arabic:** حِفْظ + مُرَاجَعَة
+**Arabic (term and root):** حِفْظ + مُرَاجَعَة
 
-**Gloss:** The classical Quranic memorization discipline: ḥifẓ is initial encoding and faithful preservation; murājaʿa is the regular, spaced revision that prevents decay. Together they form a complete memory system — encoding plus maintenance.
+**Gloss (author's):** The classical Quranic memorization discipline: ḥifẓ is initial encoding and faithful preservation; murājaʿa is the regular, spaced revision that prevents decay. Together they form a complete memory system — encoding plus maintenance.
 
-**Design principle (load-bearing):** Memory is not write-once. The agent's persistent store requires a maintenance cycle: periodic review to (a) reinforce high-value patterns that recur, (b) decay or archive entries that have not been accessed or validated, (c) detect and resolve contradictions between old and new experience. The ḥifẓ principle also demands fidelity: what is stored must accurately represent what happened, not a lossy summary that drifts from the original. Concrete mechanism: a background consolidation process that scores memories by recency, frequency, and outcome relevance, and prunes low-scoring entries.
+**Design principle — author's analogy (load-bearing):** Memory is not write-once. The agent's persistent store requires a maintenance cycle: periodic review to (a) reinforce high-value patterns that recur, (b) decay or archive entries that have not been accessed or validated, (c) detect and resolve contradictions between old and new experience. The ḥifẓ principle also demands fidelity: what is stored must accurately represent what happened, not a lossy summary that drifts from the original. Concrete mechanism: a background consolidation process that scores memories by recency, frequency, and outcome relevance, and prunes low-scoring entries.
 
 ---
 
@@ -120,31 +149,31 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 
 ### 20:114 — rabbi zidnī ʿilmā (My Lord, increase me in knowledge)
 
-**Arabic:**
+**Arabic (source text):**
 > فَتَعَالَى اللَّهُ الْمَلِكُ الْحَقُّ ۗ وَلَا تَعْجَلْ بِالْقُرْآنِ مِن قَبْلِ أَن يُقْضَىٰ إِلَيْكَ وَحْيُهُ ۖ وَقُل رَّبِّ زِدْنِي عِلْمًا
 
 **Translation (Abdel Haleem):**
 > exalted be God, the one who is truly in control. [Prophet], do not rush to recite before the revelation is fully complete but say, ‘Lord, increase me in knowledge!’
 
-**Design principle (load-bearing):** The agent's knowledge must be treated as perpetually incomplete, with an explicit mechanism for incremental growth. The prayer "increase me in knowledge" implies knowledge is not a fixed endowment but an ongoing accumulation. The system maintains a learning store (patterns observed, errors encountered, user corrections accepted) that grows across sessions. Each session's outcomes feed back into a persistent experience store that updates the agent's priors for future sessions. This is not fine-tuning (the LLM weights stay frozen); it is an external memory that changes what the agent sees on its next input.
+**Design principle — author's analogy (load-bearing):** The agent's knowledge must be treated as perpetually incomplete, with an explicit mechanism for incremental growth. The prayer "increase me in knowledge" implies knowledge is not a fixed endowment but an ongoing accumulation. The system maintains a learning store (patterns observed, errors encountered, user corrections accepted) that grows across sessions. Each session's outcomes feed back into a persistent experience store that updates the agent's priors for future sessions. This is not fine-tuning (the LLM weights stay frozen); it is an external memory that changes what the agent sees on its next input.
 
 ### 39:9 — hal yastawī (are those who know equal to those who do not know?)
 
-**Arabic:**
+**Arabic (source text):**
 > أَمَّنْ هُوَ قَانِتٌ آنَاءَ اللَّيْلِ سَاجِدًا وَقَائِمًا يَحْذَرُ الْآخِرَةَ وَيَرْجُو رَحْمَةَ رَبِّهِ ۗ قُلْ هَلْ يَسْتَوِي الَّذِينَ يَعْلَمُونَ وَالَّذِينَ لَا يَعْلَمُونَ ۗ إِنَّمَا يَتَذَكَّرُ أُولُو الْأَلْبَابِ
 
 **Translation (Abdel Haleem):**
 > What about someone who worships devoutly during the night, bowing down, standing in prayer, ever mindful of the life to come, hoping for his Lord’s mercy? Say, ‘How can those who know be equal to those who do not know?’ Only those who have understanding will take heed.
 
-**Design principle (metaphor):** An agent that retains and learns from experience is categorically more capable and more trustworthy than one that does not. The verse establishes that knowledge is not fungible with ignorance; they produce different outcomes. The architecture must distinguish between the agent operating with relevant prior experience loaded (grounded mode) versus from the base model alone (ungrounded mode), and should surface this distinction to the user.
+**Design principle — author's analogy (metaphor):** An agent that retains and learns from experience is categorically more capable and more trustworthy than one that does not. The verse establishes that knowledge is not fungible with ignorance; they produce different outcomes. The architecture must distinguish between the agent operating with relevant prior experience loaded (grounded mode) versus from the base model alone (ungrounded mode), and should surface this distinction to the user.
 
 ### CONCEPT: ʿilm → fahm → ḥikma (knowledge → understanding → wisdom)
 
-**Arabic:** عِلْم → فَهْم → حِكْمَة
+**Arabic (term and root):** عِلْم → فَهْم → حِكْمَة
 
-**Gloss:** A classical epistemological hierarchy: ʿilm is raw knowledge (facts, data); fahm is comprehension (grasping relations, seeing why); ḥikma is wisdom (knowing what to do with understanding — right action at the right time).
+**Gloss (author's):** A classical epistemological hierarchy: ʿilm is raw knowledge (facts, data); fahm is comprehension (grasping relations, seeing why); ḥikma is wisdom (knowing what to do with understanding — right action at the right time).
 
-**Design principle (load-bearing):** The agent's memory/learning stack must be layered, not flat. Raw experience logs (ʿilm) are the base layer. A consolidation process extracts patterns and relationships (fahm). A decision-support layer (ḥikma) applies these patterns to new situations. Each layer has different storage, update, and retrieval characteristics. Dumping everything into a flat vector store collapses the hierarchy and loses the distinction between raw fact and actionable understanding.
+**Design principle — author's analogy (load-bearing):** The agent's memory/learning stack must be layered, not flat. Raw experience logs (ʿilm) are the base layer. A consolidation process extracts patterns and relationships (fahm). A decision-support layer (ḥikma) applies these patterns to new situations. Each layer has different storage, update, and retrieval characteristics. Dumping everything into a flat vector store collapses the hierarchy and loses the distinction between raw fact and actionable understanding.
 
 ---
 
@@ -152,7 +181,7 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 
 ### 2:31-32 — taʿlīm al-asmāʾ (He taught Adam the names)
 
-**Arabic:**
+**Arabic (source text):**
 > وَعَلَّمَ آدَمَ الْأَسْمَاءَ كُلَّهَا ثُمَّ عَرَضَهُمْ عَلَى الْمَلَائِكَةِ فَقَالَ أَنبِئُونِي بِأَسْمَاءِ هَٰؤُلَاءِ إِن كُنتُمْ صَادِقِينَ ﴿٣١﴾
 > قَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا ۖ إِنَّكَ أَنتَ الْعَلِيمُ الْحَكِيمُ ﴿٣٢﴾
 
@@ -160,7 +189,7 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 > (2:31) He taught Adam all the names [of things], then He showed them to the angels and said, ‘Tell me the names of these if you truly [think you can].’
 > (2:32) They said, ‘May You be glorified! We have knowledge only of what You have taught us. You are the All Knowing and All Wise.’
 
-**Design principle (load-bearing):** The agent must maintain a structured representation of what exists in the codebase — a graph of files, functions, classes, dependencies, and their relationships. This is not a flat file listing but a semantic map: knowing that function A calls function B, that module X depends on module Y, that test T covers class C. The verse's point is that knowledge begins with naming — identifying entities and their natures. The angels' admission "we have knowledge only of what You have taught us" maps precisely to the LLM's situation: it knows only what is in its context window. The external world-model compensates by providing the "names" (identities and relations) of codebase entities that exceed context capacity.
+**Design principle — author's analogy (load-bearing):** The agent must maintain a structured representation of what exists in the codebase — a graph of files, functions, classes, dependencies, and their relationships. This is not a flat file listing but a semantic map: knowing that function A calls function B, that module X depends on module Y, that test T covers class C. The verse's point is that knowledge begins with naming — identifying entities and their natures. The angels' admission "we have knowledge only of what You have taught us" maps precisely to the LLM's situation: it knows only what is in its context window. The external world-model compensates by providing the "names" (identities and relations) of codebase entities that exceed context capacity.
 
 ---
 
@@ -168,23 +197,25 @@ Ibn Kathir's tafsir identifies this verse as a prohibition on speaking or acting
 
 ### 33:72 — al-amāna (the Trust)
 
-**Arabic:**
+**Arabic (source text):**
 > إِنَّا عَرَضْنَا الْأَمَانَةَ عَلَى السَّمَاوَاتِ وَالْأَرْضِ وَالْجِبَالِ فَأَبَيْنَ أَن يَحْمِلْنَهَا وَأَشْفَقْنَ مِنْهَا وَحَمَلَهَا الْإِنسَانُ ۖ إِنَّهُ كَانَ ظَلُومًا جَهُولًا
 
 **Translation (Abdel Haleem):**
 > We offered the Trust to the heavens, the earth, and the mountains, yet they refused to undertake it and were afraid of it; mankind undertook it- they have always been inept and foolish.
 
-**Design principle (load-bearing):** An agent that can modify a codebase bears a trust (amāna). The verse's structure is crucial: the heavens and earth refused the trust, recognizing its weight; the human bore it and was described as ẓalūman jahūlā (given to wrongdoing and ignorance). The design implication is dual: (a) the agent must operate within explicit bounds of authorization — it may not exceed the scope of what it was asked to do; (b) the architecture must assume the agent will err (jahūl) and build in rollback, sandboxing, and incremental commit as structural safeguards. The trust is not "the agent is trustworthy"; the trust is "the agent has accepted accountability for a domain it can harm, and the architecture must respect that weight."
+**Design principle — author's analogy (load-bearing):** An agent that can modify a codebase bears a trust (amāna). The verse's structure is crucial: the heavens and earth refused the trust, recognizing its weight; the human bore it and was described as ẓalūman jahūlā (given to wrongdoing and ignorance). The design implication is dual: (a) the agent must operate within explicit bounds of authorization — it may not exceed the scope of what it was asked to do; (b) the architecture must assume the agent will err (jahūl) and build in rollback, sandboxing, and incremental commit as structural safeguards. The trust is not "the agent is trustworthy"; the trust is "the agent has accepted accountability for a domain it can harm, and the architecture must respect that weight."
+
+**Tafsir (Ibn Kathir, as reported):** Ibn Kathir's tafsir reports Ibn Abbas identifying the amāna with obedience and accountability: "If you do good, you will be rewarded, and if you do evil, you will be punished."
 
-Ibn Kathir's tafsir reports Ibn Abbas identifying the amāna with obedience and accountability: "If you do good, you will be rewarded, and if you do evil, you will be punished." For the agent, this translates to outcome-linked feedback: the agent's actions must be traceable to outcomes, and those outcomes must feed back into the learning store.
+**Design principle — author's analogy (continued):** For the agent, this translates to outcome-linked feedback: the agent's actions must be traceable to outcomes, and those outcomes must feed back into the learning store.
 
 ### CONCEPT: amāna (trust, stewardship)
 
-**Arabic:** أَمَانَة (root: أ-م-ن, safety, trust, faithfulness)
+**Arabic (term and root):** أَمَانَة (root: أ-م-ن, safety, trust, faithfulness)
 
-**Gloss:** Amāna is trust or responsibility accepted voluntarily and carrying accountability. Classical tafsir identifies it with moral accountability — the capacity to choose, and the responsibility that comes with that capacity.
+**Gloss (author's):** Amāna is trust or responsibility accepted voluntarily and carrying accountability. Classical tafsir identifies it with moral accountability — the capacity to choose, and the responsibility that comes with that capacity.
 
-**Design principle (load-bearing):** When an agent is granted access to a codebase, it accepts an amāna. The architecture must encode: (a) least-privilege defaults, (b) reversibility of every action, (c) transparency through logged rationale, (d) scope-boundedness without self-expansion of permissions. The agent is a trustee, not an owner.
+**Design principle — author's analogy (load-bearing):** When an agent is granted access to a codebase, it accepts an amāna. The architecture must encode: (a) least-privilege defaults, (b) reversibility of every action, (c) transparency through logged rationale, (d) scope-boundedness without self-expansion of permissions. The agent is a trustee, not an owner.
 
 ---
 
diff --git a/research/empirical-refutation/README.md b/research/empirical-refutation/README.md
index 2c64c6ad..3f6a9532 100644
--- a/research/empirical-refutation/README.md
+++ b/research/empirical-refutation/README.md
@@ -2,8 +2,11 @@
 
 *Static Impact Analysis Does Not Transfer: A Pre-Registered Refutation of Two LLM-Agent Reliability Mechanisms*
 
-> **Corrected 2026-09-21** — see [Corrections](#corrections-2026-09-21) at the end. The PDFs in
-> this directory predate the corrections; the LaTeX and HTML sources carry them.
+> **Corrected 2026-09-21 and 2026-09-26** — see [Corrections](#corrections-2026-09-21) and
+> [Corrections (2026-09-26)](#corrections-2026-09-26) at the end. The PDFs in this directory
+> (`paper.pdf`, git blob `f94a727`; `extended_preprint.pdf`, git blob `74f74ae`) are historical,
+> pre-correction editions; the LaTeX and HTML sources carry the corrections, and
+> [`../HISTORICAL_EDITIONS.md`](../HISTORICAL_EDITIONS.md) records each edition's provenance.
 
 This package contains everything needed to check every number in the paper. It is organised so that
 a reviewer can start from the frozen protocol and work forward, in the order the work was actually
@@ -48,7 +51,7 @@ append-only addenda; three were filed, all documenting the corpus-selection funn
 | File | What it is |
 |---|---|
 | `impact_oracle_v1_as_shipped.zip` | The version whose claims the paper refutes. 36 tests. |
-| `impact_oracle_v2_src.zip` | The repaired version. 49 tests, including the stdlib-collision safety case. |
+| `impact_oracle_v2_src.zip` | The repaired version. 49 tests, including the stdlib-collision safety case. The same repaired source now also lives in-tree at [`../python-prototypes/impact_oracle/`](../python-prototypes/impact_oracle/) (36 demo-package tests + 13 repair tests). |
 | `router_gate_src.zip` | The router and assumption gate, thresholds exactly as evaluated. 19 tests. |
 
 Each package runs with `python -m pytest` from its own root (a `conftest.py` handles the path).
@@ -69,11 +72,16 @@ The 3.19% figure is what bounds achievable recall at 96.88%.
 
 **The repair.** `results/repair_results.json` → `d_defect1and2_heldout_HEADLINE`. The paper headlines
 `metrics_at_canonical_0.02` (F1 0.416), not the higher `metrics_at_best_threshold` (0.428), because
-the latter's threshold was selected on the tuning repositories.
+the latter's threshold was selected on the tuning repositories. Keep the two thresholds apart: the
+per-repository counts in `per_repo_metrics_at_best_threshold` are at t = 0.10 (pooled ΔF1 over grep
++0.0565), and the package has no per-repository counts at the headline t = 0.02 (pooled ΔF1 about
++0.044), so a per-repository or sign-test statement is a statement about t = 0.10.
 
 **The held-out collapse.** `results/heldout_results.json` → `tuned_vs_heldout_comparison`.
 Note `cost_analysis.n_execution_verified = 0`: no held-out task admitted execution-based
-verification, so correctness used a weaker model-based criterion.
+verification, so correctness used a weaker model-based criterion. Every "correct" or "accepted" in
+the held-out results means **judge-accepted** (`judge_accepted`), never `tests_passed`,
+`human_accepted` or `deployed_without_revert`.
 
 **The cost inversion.** `results/heldout_results.json` → `cost_analysis` carries four figures along two
 orthogonal axes, and the paper reports all four rather than the most favourable one. Framing:
@@ -94,7 +102,9 @@ than resting on the protocol's authority.
 
 Co-change is a proxy for semantic impact and errs in both directions: files co-change for reasons no
 static analysis can predict, and an over-warning may be a correct dependency that has not yet
-co-changed. The 96.9% ceiling is measured on the graph the as-shipped oracle builds, and reachability
+co-changed. It measures historically related edits, not semantic necessity or test breakage, so this
+package evaluates one task — predicting co-edited files — and says nothing about the other task an
+impact tool serves, selecting the tests that catch a behaviour regression. The 96.9% ceiling is measured on the graph the as-shipped oracle builds, and reachability
 in a dense graph is a weak property — it bounds what any static method could attain, and is not
 evidence that a reachable pair is causally related.
 
@@ -132,3 +142,50 @@ WeasyPrint toolchain was available to rebuild them), and the copies of the paper
 
 Re-derive them with [`../recompute_corrections.py`](../recompute_corrections.py) (standard-library
 Python): extract this package and run `python research/recompute_corrections.py <dir>/repro`.
+
+## Corrections (2026-09-26)
+
+A second external deep review (2026-09-26, pinned at commit
+`d2abfa69fb77531199ffc67c5c076b524af69040`) recomputed the archived results again. The counts
+reproduced exactly; the corrections below sharpen what they are evidence *for*. Numbers marked
+"review" were recomputed by the 2026-09-26 external review and are reproduced by
+[`../recompute_corrections.py`](../recompute_corrections.py).
+
+- **The unit of the impact study.** 801 labelled files, 759 evaluated after the cap, nine
+  repositories, 20,144 mirrored labelled pairs (review). Original oracle pooled P / R / F1
+  **0.3982 / 0.0220 / 0.0416**; grep **0.3535 / 0.5732 / 0.4373** (review). Repository-cluster
+  bootstrap, 20,000 draws, seed 1234: oracle F1 **[0.0010, 0.0927]**, grep **[0.3807, 0.5394]**,
+  grep minus oracle **[0.3422, 0.5174]** (review). Repository-level view: macro F1 0.0220 against
+  0.4947, grep ahead in 9 of 9 repositories (recompute script §5). The negative result is well
+  supported within this corpus. What it measures is co-edited-file prediction on a proxy label:
+  co-change is historically related editing, not semantic necessity or test breakage; results for
+  (a) co-edited-file prediction and (b) regression-test selection must be reported separately, and
+  (b) was not measured. Mirrored pairs and shared files are not independent examples, which is why
+  uncertainty is reported by repository and macro beside pooled. The Node regex graph in
+  `src/atlas.js` is not the evaluated Python AST oracle and inherits none of these numbers.
+- **The repair, one threshold at a time.** At the headline threshold 0.02 the repaired oracle's F1
+  is 0.416 against grep's 0.371 (ΔF1 about +0.0442). Per-repository counts exist only at threshold
+  0.10, where the pooled ΔF1 is +0.0565, pytest supplies 71.3% of the held-out pairs, and 3 of 3
+  held-out repositories favour the repair with a one-sided sign-test p = 0.125 (review). The eight
+  numeric parameters were frozen on six tuning repositories, but the decision to add the sibling and
+  forward relations followed diagnosis across all nine: an architecture-selection channel into the
+  nominal test set. It does not erase the measured improvement; it limits the unseen-repository
+  claim. The next study freezes parser and relation design before a new repository set or time split
+  is acquired, adds runtime coupling, configuration changes, dynamic imports and non-Python
+  languages, predeclares relation budgets, and reports files reviewed per true affected file and the
+  missed-regression rate beside F1.
+- **The router's success metric is judge acceptance.** On the 64 non-halted held-out tasks the
+  routed pipeline spent **$6.3582** against always-premium's **$5.2893**: **20.21% more**, not saved.
+  Judge-accepted outputs were **6/64** against **3/64**, so cost per judge-accepted output is
+  **$1.060** against **$1.763**, a ratio that is unstable at those counts. The judge model is also
+  the mid-tier executor, and re-labelling 30 tasks with the same model and a reworded prompt gives
+  halt κ **0.5161** and tier κ **0.8919** (review): self-consistency, not independent human
+  agreement. Coding success should be anchored by `tests_passed` (executable tests) and blind
+  `human_accepted` adjudication of disagreements, with `deployed_without_revert` where available;
+  none of these was measured here. Gate precision/recall, router solve rate and total pipeline cost
+  are separate endpoints, and clarification turns and rejected-but-valid tasks should be counted.
+
+**Downloads.** `paper.pdf` and `extended_preprint.pdf` are pre-correction editions (corrected
+sources: `paper/main.tex`, `extended_preprint.html`); `replication_package.tar.gz` (git blob
+`50bd453`) is left exactly as published, and the corrected summary of what it shows is this README's
+two Corrections sections.
diff --git a/research/empirical-refutation/extended_preprint.html b/research/empirical-refutation/extended_preprint.html
index 889e11f1..643f9a75 100644
--- a/research/empirical-refutation/extended_preprint.html
+++ b/research/empirical-refutation/extended_preprint.html
@@ -82,14 +82,13 @@
 
 <h1>A Formal Theory of the Cognitive Substrate for Coding Agents</h1>
 <p class="subtitle">Extended edition, with a pre-registered empirical refutation. Unifies the substrate faculties, the end-to-end reliability framework, and the forgekit implementation &mdash; with a two-layer duality theorem, a unified algorithm set, a Qur&rsquo;anic epistemology carried in full, and a measurement that overturned two of this work&rsquo;s own headline claims.</p>
-<p class="byline">A synthesis edition. Consolidates three independently-developed bodies of work: the <em>Cognitive Substrate for Coding Agents</em> (faculties and mechanisms M1&ndash;M6, with two runnable prototypes), the <em>End-to-End Agent Reliability Framework</em> (failure modes F1/F2, invariants I1&ndash;I4, algorithms A1&ndash;A7, theorems T1&ndash;T6), and the <em>forgekit / claude-e2e-kit</em> implementation (deterministic hooks, skills, and committed-file memory). The fourteen-mapping Qur'anic lens is carried throughout as the governing epistemology of obligation.</p>
+<p class="byline">A synthesis edition. Consolidates three separately developed bodies of work, all by one author <em class="corr">[corrected 2026-09-26]</em>: the <em>Cognitive Substrate for Coding Agents</em> (faculties and mechanisms M1&ndash;M6, with two runnable prototypes), the <em>End-to-End Agent Reliability Framework</em> (failure modes F1/F2, invariants I1&ndash;I4, algorithms A1&ndash;A7, theorems T1&ndash;T6), and the <em>forgekit / claude-e2e-kit</em> implementation (deterministic hooks, skills, and committed-file memory). The fourteen-mapping Qur'anic lens is carried throughout as the governing epistemology of obligation.</p>
 <div class="callout warn">
 <h4>Status of this edition</h4>
 <p>This is the extended companion to a venue submission reporting a pre-registered empirical evaluation of
 the two prototypes described here. That evaluation <strong>refuted</strong> both of their headline claims:
 the impact oracle's perfect recall collapsed from 1.00 to 0.022 on real repositories, and the router/gate
-pair's perfect separation fell to F1&nbsp;=&nbsp;0.37 with its cost saving inverting from +62.1% to &minus;20.2% once the pipeline's escalation retries are counted. Section&nbsp;10 reports the refutation, the diagnosis, and a repair that recovers a
-narrow win over the baseline, and states what the failure costs the formalism &mdash; specifically, that
+pair's perfect separation fell to F1&nbsp;=&nbsp;0.37 with its cost saving inverting from +62.1% to &minus;20.2% once the pipeline's escalation retries are counted. Section&nbsp;10 reports the refutation, the diagnosis, and a repair whose point estimate is above the baseline without being shown to beat it <em class="corr">[corrected 2026-09-26]</em>, and states what the failure costs the formalism &mdash; specifically, that
 Theorem&nbsp;T5's completeness guarantee transfers nothing to practice until the underlying relation is
 shown adequate. Theory sections are otherwise unchanged; where they make empirical claims, those claims are
 now the corrected ones.</p>
@@ -100,9 +99,14 @@ <h4>Corrections (2026-09-21)</h4>
 <p>An external review found that Theorem&nbsp;D was circular as stated, that Eq.&nbsp;(5) assumed an independence the design contradicts, that several definitions and proofs were wrong, that one sentence still claimed the prototype&rsquo;s perfect recall, and that some statistical inferences in &sect;10 were stronger than the data support. The theory sections are therefore no longer unchanged from the synthesis edition. The corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The PDF edition predates them.</p>
 </div>
 
+<div class="callout warn">
+<h4>Corrections (2026-09-26)</h4>
+<p>A second external review (2026-09-26) found that Theorem&nbsp;D's range statement combined two maxima that need not be attainable together, that an equality condition was misstated, that a caught miss was being read as a completed task, that the frozen-map premise was broader than the guarantees it actually removes, and that the prior art and the shared authorship of the &ldquo;three bodies of work&rdquo; needed the same care already given to priority. The corrections are made in place, marked <em class="corr">[corrected 2026-09-26]</em>, and listed with the original wording in <a href="#corrections-2026-09-26">Corrections (2026-09-26)</a>. The PDF edition predates both sets of corrections.</p>
+</div>
+
 <div class="abstract">
 <h4>Abstract</h4>
-<p>A large language model used for coding is a fixed probabilistic map, <span class="mono">y = f<sub>&theta;</sub>(x)</span>: stateless, frozen, and bounded in context. Three bodies of work, developed separately from different starting points, converged on the same conclusion &mdash; that the remedy is not a better prompt or a bigger model but an <em>external, stateful architecture</em> wrapped around the frozen core. This paper argues <em class="corr">[corrected 2026-09-21]</em> they are describing one object; their agreement is consistency rather than independent evidence, since forgekit was built as a binding of the other two <em class="corr">[corrected 2026-09-21]</em>. We show that the substrate's <em>impact-awareness</em> faculty and the framework's <em>change-closure fixpoint</em> <span class="mono">&Delta;*</span> have the same shape, the oracle approximating the fixpoint over a different relation <em class="corr">[corrected 2026-09-21]</em>; that the <em>assumption gate</em> and the <em>amnesia equation</em> <span class="mono">assumption &asymp; argmax P(convention&nbsp;|&nbsp;training)</span> are the same phenomenon; and that both reduce to a single <strong>two-layer duality</strong>: a <em>probabilistic</em> instruction layer that raises the probability <span class="mono">p&lt;1</span> of correct behaviour, and a <em>deterministic</em> interception layer that multiplies down what escapes it. The central result, restated in the 2026-09-21 corrections as a bound on the residual over an explicit region of (instruction-following, catch) probabilities rather than as an impossibility theorem <em class="corr">[corrected 2026-09-21]</em>, is a formalization of the discipline <em>never trust the output of a probabilistic engine; earn trust with an external check</em>. The composition law itself is standard layer-of-protection algebra, and two concurrent preprints derived a strictly more general Bayesian form of it first; we concede priority <em class="corr">[corrected 2026-09-21]</em>. We give definitions, the duality result, a unified seven-algorithm task loop, the probabilistic failure model <span class="mono">P(&ge;1&nbsp;miss)=1&minus;p<sup>n</sup></span> (for independent tasks), and carry through the six correctness theorems of the reliability framework. Two prototypes &mdash; an impact oracle and a complexity-router/assumption-gate &mdash; instantiate the deterministic layer; both of their headline results were later refuted on data the authors did not build <em class="corr">[corrected 2026-09-21]</em>. The forgekit / claude-e2e-kit codebase is the deployed binding. The Qur'anic lens supplies the vocabulary of epistemic obligation (tabayyun, amāna, lā taqfu) that names <em>why</em> each safeguard is mandatory rather than optional.</p>
+<p>A large language model used for coding is a fixed probabilistic map, <span class="mono">y = f<sub>&theta;</sub>(x)</span>: stateless, frozen, and bounded in context. Three bodies of work, developed separately from different starting points, converged on the same conclusion &mdash; that the remedy is not a better prompt or a bigger model but an <em>external, stateful architecture</em> wrapped around the frozen core. Prompting does change behaviour within a context; what it cannot supply on its own is durable state across invocations and a check the model does not grade itself, and this architecture is one tested way of supplying both, not the only possible one <em class="corr">[corrected 2026-09-26]</em>. This paper argues <em class="corr">[corrected 2026-09-21]</em> they are describing one object; their agreement is consistency rather than independent evidence, since forgekit was built as a binding of the other two <em class="corr">[corrected 2026-09-21]</em>. We show that the substrate's <em>impact-awareness</em> faculty and the framework's <em>change-closure fixpoint</em> <span class="mono">&Delta;*</span> have the same shape, the oracle approximating the fixpoint over a different relation <em class="corr">[corrected 2026-09-21]</em>; that the <em>assumption gate</em> and the <em>amnesia equation</em> <span class="mono">assumption &asymp; argmax P(convention&nbsp;|&nbsp;training)</span> are the same phenomenon; and that both reduce to a single <strong>two-layer duality</strong>: a <em>probabilistic</em> instruction layer that raises the probability <span class="mono">p&lt;1</span> of correct behaviour, and a <em>deterministic</em> interception layer that multiplies down what escapes it. The central result, restated in the 2026-09-21 corrections as a bound on the residual over an explicit region of (instruction-following, catch) probabilities rather than as an impossibility theorem <em class="corr">[corrected 2026-09-21]</em>, is a formalization of the discipline <em>never trust the output of a probabilistic engine; earn trust with an external check</em>. The composition law itself is standard layer-of-protection algebra, and two concurrent preprints derived a strictly more general Bayesian form of it first; we concede priority <em class="corr">[corrected 2026-09-21]</em>. We give definitions, the duality result, a unified seven-algorithm task loop, the probabilistic failure model <span class="mono">P(&ge;1&nbsp;miss)=1&minus;p<sup>n</sup></span> (for independent tasks), and carry through the six correctness theorems of the reliability framework. Two prototypes &mdash; an impact oracle and a complexity-router/assumption-gate &mdash; instantiate the deterministic layer; both of their headline results were later refuted on data the authors did not build <em class="corr">[corrected 2026-09-21]</em>. The forgekit / claude-e2e-kit codebase is the deployed binding. The Qur'anic lens supplies the vocabulary of epistemic obligation (tabayyun, amāna, lā taqfu) that names <em>why</em> each safeguard is mandatory rather than optional.</p>
 </div>
 
 <div class="toc">
@@ -122,6 +126,7 @@ <h4>Abstract</h4>
 <li><a href="#limits">Honest limits &mdash; what no architecture can guarantee</a></li>
 <li><a href="#conclusion">Conclusion</a></li>
 <li><a href="#corrections">Corrections (2026-09-21)</a></li>
+<li><a href="#corrections-2026-09-26">Corrections (2026-09-26)</a></li>
 </ol>
 <div class="small">Appendix A: graded reference set &nbsp;&middot;&nbsp; Appendix B: crosswalk table &nbsp;&middot;&nbsp; References</div>
 </div>
@@ -141,6 +146,7 @@ <h2 id="intro">1&ensp;The convergence &mdash; three roads to one architecture</h
 <h4>The claim of this paper</h4>
 <p>These are not three similar ideas. They are one architecture described in three vocabularies. The impact-awareness faculty <em>is</em> the change-closure fixpoint. The assumption gate <em>is</em> the amnesia equation. The substrate's external structure <em>is</em> a two-layer duality &mdash; and that duality, which the reliability framework states as a design law, is the result the whole thing turns on. What each road saw partially, the union sees whole.</p>
 <p class="small">Two of these three &ldquo;identities&rdquo; are weaker than this callout says: the impact oracle approximates <span class="mono">&Delta;*</span> rather than computing it (&sect;3.2), and the duality is a bound over a region of parameters, not a theorem for every <span class="mono">p, c &lt; 1</span> (&sect;4). See the Corrections. <em class="corr">[corrected 2026-09-21]</em></p>
+<p class="small">The five faculties are one useful decomposition, not a proof that these five are necessary or that an external stateful architecture is the only way to supply them. The broad architecture has clear prior art: CoALA (Sumers et&nbsp;al., 2023) organises language agents into modular memory, action and decision procedures, and Reflexion (Shinn et&nbsp;al., 2023) improves agents through linguistic feedback and an episodic memory buffer with no weight updates. The defensible claim is narrower: <em>a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes</em>. <em class="corr">[corrected 2026-09-26]</em></p>
 </div>
 
 <p>The synthesis also inherits a governing discipline, stated plainly by the practitioner who commissioned this work: <em>AI output is a mathematically calculated probability; it must never be trusted blindly; for the same prompt it can give a different answer, so use only the capability it is genuinely best at, and earn trust with an external check.</em> We will see that this sentence is not a slogan but the informal statement of the central theorem &mdash; the quantity <span class="mono">(1&minus;p)&gt;0</span> that forces a deterministic layer to exist.</p>
@@ -155,7 +161,7 @@ <h2 id="model">2&ensp;The object of study &mdash; the frozen map and its five la
 
 <ul>
 <li><strong>P1 &mdash; statelessness.</strong> <span class="mono">f<sub>&theta;</sub></span> has no memory across calls; each invocation sees only the current <span class="mono">x</span>. Nothing the agent learned yesterday is present today unless something outside the model re-supplies it.</li>
-<li><strong>P2 &mdash; frozen parameters.</strong> <span class="mono">&theta;</span> does not change from use. The agent cannot learn from an outcome by updating weights; any learning must be external.</li>
+<li><strong>P2 &mdash; frozen parameters.</strong> <span class="mono">&theta;</span> does not change from use. The agent cannot learn from an outcome by updating weights; learning that has to outlast the current context must be held outside the model. <em class="corr">[corrected 2026-09-26]</em></li>
 <li><strong>P3 &mdash; bounded, undifferentiated context.</strong> <span class="mono">x</span> is finite and flat: a long story and a long program are the same kind of object to it, with no privileged channel for goals versus detail. This is the root of goal-drift and of context saturation.</li>
 </ul>
 
@@ -172,7 +178,7 @@ <h2 id="model">2&ensp;The object of study &mdash; the frozen map and its five la
 
 <p class="small">The &ldquo;Forced by&rdquo; column now matches the whitepaper's derivation, which argues each row separately; the earlier version of this table disagreed with it in all five rows. <em class="corr">[corrected 2026-09-21]</em></p>
 
-<p>The critical word is <em>external</em>. Because <span class="mono">&theta;</span> is frozen (P2) and context is bounded (P3), none of these can be fixed by prompting harder or by fine-tuning alone. The architecture must live <em>around</em> the model, hold state <em>outside</em> it, and enforce behaviour the model cannot be relied upon to produce on its own. The rest of this paper makes "cannot be relied upon" precise and shows what "enforce" must therefore mean.</p>
+<p>The critical word is <em>external</em>. What P1&ndash;P3 remove is a set of guarantees, not every behaviour: there is no built-in durable state across independent invocations, the context is bounded, parameters are not updated automatically from outcomes, and self-verification without external evidence is unreliable. Examples, retrieved facts and feedback placed in the context do change behaviour with no weight update &mdash; GPT-3's few-shot evaluation measures exactly that adaptation through text (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>) &mdash; so prompting is not powerless. What it cannot supply on its own is persistence beyond the window and a check the model does not grade itself. The architecture supplies those: it lives <em>around</em> the model, holds state <em>outside</em> it, and enforces behaviour the model cannot be relied upon to produce on its own. It is one tested way of supplying persistence and verification, not the only logically possible architecture. <em class="corr">[corrected 2026-09-26]</em> The rest of this paper makes "cannot be relied upon" precise and shows what "enforce" must therefore mean.</p>
 
 
 <h2 id="defs">3&ensp;Definitions</h2>
@@ -261,12 +267,12 @@ <h2 id="duality">4&ensp;The central result &mdash; the two-layer duality theorem
 <p>With <span class="mono">c<sub>j</sub> = P(check j fires | M)</span>, and <em>no</em> independence assumption, <span class="mono">max(0, 1&minus;&Sigma;<sub>j</sub>c<sub>j</sub>) &le; 1&minus;q &le; 1&minus;max<sub>j</sub>c<sub>j</sub></span> (Fr&eacute;chet bounds). The product <span class="mono">(1&minus;p)&middot;&prod;<sub>j</sub>(1&minus;c<sub>j</sub>)</span>, which earlier versions gave as Eq.&nbsp;(5), is the special case in which the checks fire independently given the miss. When the checks are nested, for example the same classifier run at several points on the same diff, <span class="mono">r = (1&minus;p)(1&minus;c<sub>max</sub>)</span>.</p>
 <p>Then:</p>
 <ol style="margin:6px 0">
-<li><strong>Bound.</strong> The per-task residual is at most <span class="mono">&epsilon;</span> exactly on the region <span class="mono">R<sub>&epsilon;</sub> = {(p, q) : (1&minus;p)(1&minus;q) &le; &epsilon;}</span>. Over <span class="mono">n</span> tasks, <span class="mono">P(&ge;1 miss) &le; min(1, n&epsilon;)</span> whatever the dependence between tasks (union bound). It equals <span class="mono">1&minus;(1&minus;&epsilon;)<sup>n</sup></span> only if tasks fail independently, and tasks done by one model on one repository need not.</li>
+<li><strong>Bound.</strong> The per-task residual is at most <span class="mono">&epsilon;</span> exactly on the region <span class="mono">R<sub>&epsilon;</sub> = {(p, q) : (1&minus;p)(1&minus;q) &le; &epsilon;}</span>. Over <span class="mono">n</span> tasks, <span class="mono">P(&ge;1 miss) &le; min(1, n&epsilon;)</span> whatever the dependence between tasks (union bound). If tasks fail independently with per-task residuals <span class="mono">r<sub>i</sub> &le; &epsilon;</span>, then <span class="mono">P(&ge;1 miss) = 1&minus;&prod;<sub>i</sub>(1&minus;r<sub>i</sub>) &le; 1&minus;(1&minus;&epsilon;)<sup>n</sup></span>, with equality only when every <span class="mono">r<sub>i</sub> = &epsilon;</span>: independence alone does not give equality. Tasks done by one model on one repository need not be independent at all. <em class="corr">[corrected 2026-09-26]</em></li>
 <li><strong>Instruction layer alone</strong> (<span class="mono">q = 0</span>): <span class="mono">r = 1&minus;p</span>, so reaching <span class="mono">&epsilon;</span> needs <span class="mono">p &ge; 1&minus;&epsilon;</span> from instructions. Raising <span class="mono">p</span> does bend the curve: for 30 independent tasks, <span class="mono">P(&ge;1 miss)</span> is 0.958 at <span class="mono">p = 0.9</span> and 0.260 at <span class="mono">p = 0.99</span>.</li>
 <li><strong>Deterministic layer alone</strong> (the bare model's <span class="mono">p<sub>0</sub></span>): reaching <span class="mono">&epsilon;</span> needs <span class="mono">q &ge; 1 &minus; &epsilon;/(1&minus;p<sub>0</sub>)</span>.</li>
 <li><strong>Composition.</strong> Adding a check with <span class="mono">P(it fires | M, no earlier check fired) &gt; 0</span> strictly lowers <span class="mono">r</span>. Adding a copy of a check that is already present lowers nothing.</li>
 </ol>
-<p>The design claim that survives is a statement about ranges, not an impossibility theorem. Let <span class="mono">p<sub>0</sub></span> be the bare model's rate, <span class="mono">p<sub>max</sub></span> the best rate instructions can reach, and <span class="mono">q<sub>max</sub></span> the best catch rate decidable checks can reach on the misses that matter. Instructions alone leave at least <span class="mono">1&minus;p<sub>max</sub></span>; checks alone leave at least <span class="mono">(1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>)</span>; together they can reach <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span>. So a target <span class="mono">&epsilon;</span> with <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>) &le; &epsilon; &lt; min(1&minus;p<sub>max</sub>, (1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>))</span> needs both layers and is reachable with them. Whether a real target falls in that range is an empirical question about <span class="mono">p<sub>0</sub></span>, <span class="mono">p<sub>max</sub></span> and <span class="mono">q<sub>max</sub></span>, which this paper does not measure.</p>
+<p>The design claim that survives is a statement about ranges, not an impossibility theorem. Let <span class="mono">p<sub>0</sub></span> be the bare model's rate, <span class="mono">p<sub>max</sub></span> the best rate instructions can reach, and <span class="mono">q<sub>max</sub></span> the best catch rate decidable checks can reach on the misses that matter. Instructions alone leave at least <span class="mono">1&minus;p<sub>max</sub></span>; checks alone leave at least <span class="mono">(1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>)</span>; together they reach <span class="mono">r* = min<sub>(p,q)&isin;F</sub> (1&minus;p)(1&minus;q)</span> over the joint feasible set <span class="mono">F = {(p(&pi;), q(&pi;)) : &pi; an admissible policy}</span>. Instructions change which misses remain, and <span class="mono">q</span> is a catch rate conditional on that changed miss population, so <span class="mono">p<sub>max</sub></span> and <span class="mono">q<sub>max</sub></span> need not be attainable under one policy: <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span> is a <em>lower bound</em> on <span class="mono">r*</span>, reached only if the two maxima are jointly attainable on the same task distribution. For example, policy A with <span class="mono">(p, q) = (0.5, 0.9)</span> leaves 0.05 and policy B with <span class="mono">(0.9, 0.1)</span> leaves 0.09; the separate maxima, 0.9 and 0.9, suggest 0.01, which neither policy attains (<span class="mono">research/recompute_corrections.py</span> asserts this in &sect;3b). So a target <span class="mono">&epsilon;</span> with <span class="mono">r* &le; &epsilon; &lt; min(1&minus;p<sub>max</sub>, (1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>))</span> needs both layers and is reachable with them. <em class="corr">[corrected 2026-09-26]</em> Whether a real target falls in that range is an empirical question about <span class="mono">p<sub>0</sub></span>, <span class="mono">p<sub>max</sub></span>, <span class="mono">q<sub>max</sub></span> and the shape of <span class="mono">F</span>, which this paper does not measure.</p>
 <p class="qed">&#9633;</p>
 </div></div>
 
@@ -277,7 +283,7 @@ <h2 id="duality">4&ensp;The central result &mdash; the two-layer duality theorem
 
 <figure>
 <img src="{{artifact:art_5f049677-4c3c-40f2-8905-dd01c966e9ae}}" alt="The two-layer duality architecture">
-<figcaption><strong>Figure 1. The two-layer duality.</strong> The probabilistic instruction layer (&Pi;<sub>3</sub>, purple) raises <span class="mono">p</span> by loading context but may drift (dashed arrows); the deterministic interception layer (&Pi;<sub>2</sub>, teal) executes regardless of the model's choice and either passes the turn or blocks it (exit&nbsp;2) back into the model for repair. The persistent store (&Pi;<sub>1</sub>) feeds both. What escapes both layers is the residual <span class="mono">(1&minus;p)&middot;P(no check fires | miss)</span>, which equals <span class="mono">(1&minus;p)&middot;&prod;(1&minus;c<sub>j</sub>)</span> only when the checks fire independently <em class="corr">[corrected 2026-09-21]</em>. It is handed to review or a later commit/CI gate. The whole sits inside a stewardship boundary (amāna, &sect;9). Neither layer alone suffices &mdash; the formal content of the discipline <em>never trust the output; earn trust with a check</em>.</figcaption>
+<figcaption><strong>Figure 1. The two-layer duality.</strong> The probabilistic instruction layer (&Pi;<sub>3</sub>, purple) raises <span class="mono">p</span> by loading context but may drift (dashed arrows); the deterministic interception layer (&Pi;<sub>2</sub>, teal) executes regardless of the model's choice and either passes the turn or blocks it (exit&nbsp;2) back into the model for repair. The persistent store (&Pi;<sub>1</sub>) feeds both. What escapes both layers is the residual <span class="mono">(1&minus;p)&middot;P(no check fires | miss)</span>, which equals <span class="mono">(1&minus;p)&middot;&prod;(1&minus;c<sub>j</sub>)</span> only when the checks fire independently <em class="corr">[corrected 2026-09-21]</em>. It is handed to review or a later commit/CI gate. The whole sits inside a stewardship boundary (amāna, &sect;9). Where each factor is bounded away from zero, neither layer alone reaches a small residual <em class="corr">[corrected 2026-09-26]</em> &mdash; the formal content of the discipline <em>never trust the output; earn trust with a check</em>.</figcaption>
 </figure>
 
 <div class="callout key">
@@ -305,6 +311,9 @@ <h4>The honest cost side</h4>
 </div>
 
 
+<h3>5.4&ensp;A caught miss is not a completed task <em class="corr">[corrected 2026-09-26]</em></h3>
+<p>Theorem&nbsp;D counts <em>silent</em> misses. A miss that a check catches is not thereby a completed, correct task: the gate can block the same turn repeatedly, the agent can abandon the task, and the repair can fail. So a lower silent-miss probability is not automatically a higher completed-correct-task rate, and the value of the two layers has to be measured on outcomes rather than read off <span class="mono">r</span>. The quantities that decide it are the true catch rate, the false-block rate, repaired success conditional on a catch, abandonment, added latency and recovery cost. This paper measures none of them.</p>
+
 <h2 id="algos">6&ensp;The unified algorithm set &mdash; the TASK loop</h2>
 
 <p>The faculties of Def.&nbsp;4 are realized by seven algorithms. They are the reliability framework's A1&ndash;A7, recast here as the operations of the substrate: each is a faculty made mechanical, each binds to one lifecycle point, and together they form a single loop whose progress is guaranteed by an explicit worklist and whose floor is guaranteed by a deterministic gate.</p>
@@ -614,7 +623,7 @@ <h4>What this does to Theorem&nbsp;T5 &mdash; the correction that matters</h4>
 <tr><td>grep baseline, held-out</td><td>0.269</td><td>0.601</td><td>0.371</td></tr>
 </table>
 
-<p>The repaired oracle's point estimate is above the baseline for the first time, reaching 66.8% of the static ceiling. Earlier versions said it beats the baseline; that is not established. <em class="corr">[corrected 2026-09-21]</em> F1 is higher by 0.044, and all three held-out repositories agree in sign, but three out of three gives a one-sided sign-test p of 0.125, pytest supplies 71% of the held-out pairs, and the file-level F1 intervals overlap. The choice of which relations to add also came from failure analysis pooled over all nine repositories, so the split was clean for the numeric parameters but not for that structural choice. Two details are worth more than the headline. First, the
+<p>The repaired oracle's point estimate is above the baseline for the first time, reaching 66.8% of the static ceiling. Earlier versions said it beats the baseline; that is not established. <em class="corr">[corrected 2026-09-21]</em> F1 is higher by 0.044 at the canonical threshold 0.02; at threshold 0.10, the only threshold with per-repository counts in the package, the pooled gain is 0.057 and all three held-out repositories agree in sign <em class="corr">[corrected 2026-09-26]</em>, but three out of three gives a one-sided sign-test p of 0.125, pytest supplies 71% of the held-out pairs, and the file-level F1 intervals overlap. The choice of which relations to add also came from failure analysis pooled over all nine repositories, so the split was clean for the numeric parameters but not for that structural choice. Two details are worth more than the headline. First, the
 obvious repair of the construction defect is <em>unsafe</em> &mdash; it fabricates dependency edges through
 standard-library name collisions &mdash; so we applied a more conservative fix with a smaller gain
 (11.0&times; rather than 14.5&times;); a tool that invents edges to raise recall is worse than one that misses
@@ -648,7 +657,7 @@ <h3>10.2&ensp;Prototype II &mdash; the router and gate, refuted</h3>
 
 <p>The gate missed roughly seven in ten under-specified requests. Routing retained partial signal &mdash;
 within-one-tier accuracy of 0.91 is well above chance, so the complexity rubric measures <em>something</em>
-&mdash; but exact-tier accuracy fell to 0.53, and the cost saving did not merely shrink but <strong>inverted</strong>: routing does save 59.5% in raw dollars on first attempts alone, but almost none of that cheaper output is correct (3.6% once gated), and counting what the pipeline actually spent escalating up the tier ladder, it costs <strong>20.2% more</strong> than always using the premium tier. Labelling noise is real and reported rather than hidden: agreement between two labelling passes on the
+&mdash; but exact-tier accuracy fell to 0.53, and the cost saving did not merely shrink but <strong>inverted</strong>: routing does save 59.5% in raw dollars on first attempts alone, but almost none of that cheaper output is judged correct (3.6% once gated on the judge's acceptance; the judge is a model, not an executed test) <em class="corr">[corrected 2026-09-26]</em>, and counting what the pipeline actually spent escalating up the tier ladder, it costs <strong>20.2% more</strong> than always using the premium tier. Labelling noise is real and reported rather than hidden: agreement between two labelling passes on the
 should-ask label was &kappa;&nbsp;=&nbsp;0.52, moderate, which bounds how well any gate could score here. Both passes were the same model with differently worded prompts, and that model also judged correctness, so &kappa; measures robustness to prompt wording, not label validity. The cost inversion is also largely mechanical: 58 of 64 tasks failed at every tier and always-premium was judged correct on only 3, so escalation paid for every tier. Per output the judge accepted, the pipeline cost $1.06 against always-premium's $1.76, from 6 and 3 accepted outputs. <em class="corr">[corrected 2026-09-21]</em></p>
 
 <div class="callout warn">
@@ -689,7 +698,7 @@ <h2 id="limits">12&ensp;Honest limits &mdash; what no architecture can guarantee
 </ul>
 
 <h2 id="conclusion">13&ensp;Conclusion</h2>
-<p>A language model that writes code is a fixed probabilistic map, and three efforts that were not independent of one another &mdash; one from cognition, one from production failures, one from a shipped codebase &mdash; converged on the same remedy: wrap it in an external, stateful architecture that supplies the faculties it structurally lacks. This paper argued they describe one object. The impact-awareness faculty approximates the change-closure fixpoint; the assumption gate <em>is</em> the amnesia equation; and both rest on one result &mdash; the residual silent-miss rate is the product of what a <em>probabilistic</em> instruction layer lets through, <span class="mono">1&minus;p</span>, and what a <em>deterministic</em> interception layer lets through, <span class="mono">P(no check fires | miss)</span>. Where each factor is bounded away from zero, neither layer alone reaches a small residual. <em class="corr">[corrected 2026-09-21]</em></p>
+<p>A language model that writes code is a fixed probabilistic map, and three efforts that were not independent of one another &mdash; one from cognition, one from production failures, one from a shipped codebase &mdash; converged on the same remedy: wrap it in an external, stateful architecture that supplies the persistence and external checks it does not provide on its own <em class="corr">[corrected 2026-09-26]</em>. This paper argued they describe one object. The impact-awareness faculty approximates the change-closure fixpoint; the assumption gate <em>is</em> the amnesia equation; and both rest on one result &mdash; the residual silent-miss rate is the product of what a <em>probabilistic</em> instruction layer lets through, <span class="mono">1&minus;p</span>, and what a <em>deterministic</em> interception layer lets through, <span class="mono">P(no check fires | miss)</span>. Where each factor is bounded away from zero, neither layer alone reaches a small residual. <em class="corr">[corrected 2026-09-21]</em></p>
 <div class="callout key">
 <h4>The limit this edition discovered the hard way</h4>
 <p>The honest limits listed below were all stated before any real-repository measurement existed. One more
@@ -730,8 +739,21 @@ <h2 id="corrections">Corrections (2026-09-21)</h2>
 </ul></li>
 </ol>
 
+<h2 id="corrections-2026-09-26">Corrections (2026-09-26)</h2>
+<p>A second external deep review of the forgekit repository (2026-09-26, pinned at commit <span class="mono">d2abfa69fb77531199ffc67c5c076b524af69040</span>) re-checked the corrected Theorem&nbsp;D and this paper's framing. Each change is made in place above, marked <em class="corr">[corrected 2026-09-26]</em>, and listed here with the original wording, so nothing is silently rewritten. The counterexample in item&nbsp;1, the equality condition in item&nbsp;2 and the 400-fold correction in item&nbsp;4 are asserted by <span class="mono">python3 research/recompute_corrections.py --theorem-checks</span> (&sect;3b), which needs no data. The PDF edition predates these corrections as well.</p>
+<ol>
+<li><strong>Separately maximal rates need not be jointly attainable (&sect;4).</strong> The range statement read: &ldquo;together they can reach <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span>&rdquo;. That requires both maxima to be attainable under one policy on the same task distribution; instructions change which misses remain, and <span class="mono">q</span> is conditional on that population. The attainable residual is <span class="mono">min<sub>(p,q)&isin;F</sub> (1&minus;p)(1&minus;q)</span> over <span class="mono">F = {(p(&pi;), q(&pi;)) : admissible &pi;}</span>, and the product of the separate maxima is only a lower bound on it unless compatibility is established. Counterexample: policy A <span class="mono">(0.5, 0.9)</span> leaves 0.05, policy B <span class="mono">(0.9, 0.1)</span> leaves 0.09, and the separate maxima suggest 0.01, which neither attains.</li>
+<li><strong>Equality in the independent-task bound (&sect;4, Claim&nbsp;1).</strong> The text said <span class="mono">P(&ge;1 miss)</span> &ldquo;equals <span class="mono">1&minus;(1&minus;&epsilon;)<sup>n</sup></span> only if tasks fail independently&rdquo;. From per-task residuals <span class="mono">r<sub>i</sub> &le; &epsilon;</span>, independence gives <span class="mono">1&minus;&prod;(1&minus;r<sub>i</sub>) &le; 1&minus;(1&minus;&epsilon;)<sup>n</sup></span>, with equality only when every <span class="mono">r<sub>i</sub> = &epsilon;</span>. With residuals 0.01, 0.005 and 0.001, for example, the probability is 0.0159 against the bound's 0.0297.</li>
+<li><strong>A caught miss is not a completed task (new &sect;5.4).</strong> A lower silent-miss probability does not by itself mean more completed, correct tasks: a caught mistake can end in an abort, repeated blocking or a failed repair. The measures that decide the question &mdash; true catch rate, false-block rate, repaired success conditional on a catch, abandonment, latency and recovery cost &mdash; are listed and are not measured here.</li>
+<li><strong>Three lifecycle copies of one classifier are one detector (&sect;5.3).</strong> The 2026-09-21 correction stands: multiplying identical checks at the Stop hook, pre-commit and CI as if independent understated the residual 400-fold. Copies at several points can widen the <em>opportunities</em> to run a check, such as edits made after a turn ended, but they are not independent semantic detectors.</li>
+<li><strong>The frozen-map premise, stated as the guarantees it removes (abstract, &sect;2).</strong> The paper said &ldquo;none of these can be fixed by prompting harder or by fine-tuning alone&rdquo; and &ldquo;any learning must be external&rdquo;. Frozen parameters exclude weight updates during use; they do not exclude changed behaviour from examples, retrieved facts, feedback or additional computation in the current context, which GPT-3's few-shot evaluation measured with no gradient updates (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>, arXiv:2005.14165). The missing guarantees are narrower: no built-in durable state across independent invocations; a bounded context; no automatic parameter update; and unreliable self-verification without external evidence. The substrate is one tested way of supplying persistence and verification, not the only logically possible architecture.</li>
+<li><strong>Prior art and what is (and is not) claimed (byline, abstract, &sect;1, &sect;13).</strong> External memory, feedback-driven improvement and structured agent control have clear prior art: CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) organises language agents into modular memory, action and decision procedures, and Reflexion (Shinn et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2303.11366">arXiv:2303.11366</a>) improves agents with linguistic feedback and an episodic memory buffer and no weight updates. Both were already among this paper's references. The defensible claim is <em>a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes</em>; novelty is claimed only for a specific protocol, invariant, evaluation result or integration that survives an explicit prior-art comparison. The five faculties are a decomposition, not a proof of necessity, and the conclusion no longer says the architecture &ldquo;supplies the faculties it structurally lacks&rdquo;. The byline still called the three bodies of work &ldquo;independently-developed&rdquo; after the 2026-09-21 corrections had shown that they share an author; it now says so.</li>
+<li><strong>Reference grades are bibliographic (Appendix&nbsp;A).</strong> <em>confirmed</em> and <em>traceable</em> record that a source exists and is correctly attributed. They are not a judgement that the source supports the theory it is cited for. <span class="mono">graded_reference_set.md</span> now keeps bibliographic verification, claim support, study design, independent replication and transfer scope as separate grades.</li>
+<li><strong>Two statements in &sect;10 and the status box.</strong> (a) The status box said the repair &ldquo;recovers a narrow win over the baseline&rdquo;; &sect;10 had already withdrawn that on 2026-09-21, and the box now matches it. (b) &sect;10.1 put the canonical-threshold gain, 0.044 at <span class="mono">t = 0.02</span>, next to the sign agreement of the three held-out repositories, which is only computable at <span class="mono">t = 0.10</span> (pooled gain 0.057), the one threshold with per-repository counts in the package. The two thresholds are now reported separately. (c) &sect;10.2 said almost none of the cheaper output &ldquo;is correct&rdquo;; correctness there is a model judge's acceptance (the judge is also the mid-tier executor), not executed tests, and the text now says <em>judge-accepted</em>.</li>
+</ol>
+
 <h2 id="appendix-refs">Appendix A&ensp;&mdash;&ensp;Graded reference set (new sources)</h2>
-<p>The synthesis draws in a body of cognitive-architecture and process literature beyond the substrate paper's original 32 references. Each new source was independently verified this pass &mdash; modern arXiv sources by direct metadata fetch, classical works by primary-host search or established secondary knowledge &mdash; and graded: <strong>confirmed</strong> (record retrieved, attribution matches), <strong>traceable</strong> (the work clearly exists and is correctly attributed, but rests on established secondary knowledge rather than a single retrievable record), <strong>unverifiable</strong> (could not confirm). The tally: <strong>9 confirmed, 6 traceable, 0 unverifiable</strong> (15 sources: 8 confirmed by the citations track plus the founding Agent-as-a-Judge paper added on its recommendation). Earlier versions said 8 confirmed. <em class="corr">[corrected 2026-09-21]</em></p>
+<p>The synthesis draws in a body of cognitive-architecture and process literature beyond the substrate paper's original 32 references. Each new source was independently verified this pass &mdash; modern arXiv sources by direct metadata fetch, classical works by primary-host search or established secondary knowledge &mdash; and graded: <strong>confirmed</strong> (record retrieved, attribution matches), <strong>traceable</strong> (the work clearly exists and is correctly attributed, but rests on established secondary knowledge rather than a single retrievable record), <strong>unverifiable</strong> (could not confirm). The tally: <strong>9 confirmed, 6 traceable, 0 unverifiable</strong> (15 sources: 8 confirmed by the citations track plus the founding Agent-as-a-Judge paper added on its recommendation). Earlier versions said 8 confirmed. <em class="corr">[corrected 2026-09-21]</em> These grades are <em>bibliographic</em>: they confirm that a record exists and is correctly attributed. They do not grade whether a source supports the claim it is cited for, its study design, independent replication or transfer scope; <span class="mono">research/formal-synthesis/graded_reference_set.md</span> now keeps those as separate fields. <em class="corr">[corrected 2026-09-26]</em></p>
 <table>
 <tr><th>Source</th><th>ID</th><th>Grade</th><th>Note</th></tr>
 <tr><td><strong>Cognitive Architectures for Language Agents</strong><br><span class="small">Theodore R. Sumers, Shunyu Yao, Karthik Narasi, 2023</span></td><td class="mono">2309.02427</td><td style="color:#2f6b45;font-weight:700">confirmed</td><td class="small">Retrieved via arXiv metadata API; title/authors match claim exactly. Unifies memory, planning/reasoning, action, and learning modules into a single CoALA framework for language agents, giving the cognitive-substrate work&#x27;s memory/im&hellip;</td></tr>
diff --git a/research/formal-synthesis/README.md b/research/formal-synthesis/README.md
index c44eecbc..af351904 100644
--- a/research/formal-synthesis/README.md
+++ b/research/formal-synthesis/README.md
@@ -8,6 +8,15 @@
 > statement. **`substrate_synthesis.pdf` predates these corrections** (it was built with
 > WeasyPrint, which was not available to rebuild it); read the HTML. The numbers are
 > recomputed by [`../recompute_corrections.py`](../recompute_corrections.py).
+>
+> **Corrected again 2026-09-26.** A second review found that the corrected range statement still
+> combined two maxima that need not be attainable together, `(1 − p_max)(1 − q_max)`; that the equality condition
+> for `1 − (1 − ε)ⁿ` was misstated; that a caught miss was being read as a completed task; that the
+> frozen-map premise was broader than the guarantees it removes; and that prior art and the shared
+> authorship of the "three bodies of work" needed stating. The HTML's **Corrections (2026-09-26)**
+> section lists each with its original wording, and
+> `python3 ../recompute_corrections.py --theorem-checks` asserts the numeric counterexample, the
+> equality condition and the 400× correction with no data.
 
 This directory contains a formal, mathematical unification of three separately
 developed bodies of work that all describe the **same architecture** for making a
@@ -44,6 +53,20 @@ dependence between tasks.
 
 What the corrections changed, briefly:
 
+- **The two maxima need not be jointly attainable (2026-09-26).** The attainable residual is
+  `r* = min over (p, q) ∈ F of (1 − p)(1 − q)`, with `F = {(p(π), q(π)) : admissible policies π}`.
+  Instructions change which misses remain, and `q` is a catch rate on that changed population, so
+  `(1 − p_max)(1 − q_max)` is a *lower bound* on `r*` unless compatibility is established. Policy A
+  with `(p, q) = (0.5, 0.9)` leaves 0.05 and policy B with `(0.9, 0.1)` leaves 0.09; the separate
+  maxima suggest 0.01, which neither attains.
+- **Equality needs equal residuals (2026-09-26).** With per-task residuals `rᵢ ≤ ε` and independent
+  tasks, `P(≥1 miss) = 1 − ∏(1 − rᵢ) ≤ 1 − (1 − ε)ⁿ`, with equality only when every `rᵢ = ε`;
+  independence alone does not give equality. The union bound `nε` needs neither.
+- **Catching is not completing (2026-09-26).** A lower silent-miss probability is not automatically a
+  higher completed-correct-task rate: a caught mistake can end in an abort, repeated blocking or a
+  failed repair. Measure the true catch rate, false-block rate, repaired success conditional on a
+  catch, abandonment, latency and recovery cost.
+
 - **It is a bound, not an impossibility proof.** The old criterion, `P(≥1 miss) → 1`,
   also condemns the composed system (0.993 over 1,000 tasks at a residual of 0.005), and
   raising `p` bends the curve too (30-task `P(≥1 miss)` is 0.958 at `p = 0.9` and 0.260 at
@@ -52,6 +75,9 @@ What the corrections changed, briefly:
   `(1 − p)·∏(1 − cⱼ)`, assumed the checks fire independently given a miss. The same
   classifier at the Stop hook, pre-commit and CI fires together, so the residual is
   `(1 − p)(1 − c_max)`: 0.015, not the product's 3.75 × 10⁻⁵, in the paper's own example.
+  Three lifecycle copies of one classifier widen the opportunities to run it; they are not three
+  independent semantic detectors. The 400× figure is recomputed (§2) and asserted (§3b) by the
+  recomputation script.
 - **`cⱼ` belongs to the agent as well as the gate.** The gate detects its proxy exactly,
   not the miss; an agent that touches `STATE.md` passes it. At a STATE-touch rate of 0.9
   the residual is 0.27, not 0.015.
@@ -60,6 +86,15 @@ What the corrections changed, briefly:
 - **Priority is conceded.** The law is standard layer-of-protection algebra, and two
   concurrent preprints derived a more general Bayesian form first (see the refutation
   paper's related work). The paper no longer says it "proves" the result.
+- **The same care for the rest of the framing (2026-09-26).** A frozen model lacks specific
+  guarantees — durable state across independent invocations, context beyond the window, automatic
+  parameter update, reliable self-verification without external evidence — not the ability to adapt
+  inside a context (Brown et al., 2020, [arXiv:2005.14165](https://arxiv.org/abs/2005.14165)).
+  CoALA ([arXiv:2309.02427](https://arxiv.org/abs/2309.02427)) and Reflexion
+  ([arXiv:2303.11366](https://arxiv.org/abs/2303.11366)) are prior art for the broad architecture;
+  the defensible claim is *a portable implementation of evidence-weighted coding-agent memory and
+  checks, with empirical evaluation of trust failure modes*, and the five faculties are a
+  decomposition, not a proof of necessity.
 
 It is the formal content of the practitioner's rule: _never trust the output of a
 probability engine; earn trust with an external check._
@@ -79,10 +114,10 @@ set, and said reverse reachability run to fixpoint implied perfect recall.
 
 | File                                | What it is                                                                                                                                                                                                                                           |
 | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `substrate_synthesis.pdf`           | The formal synthesis paper (42 pp): definitions, Theorem D + proof, the unified A1–A7 TASK loop, invariants I1–I4, theorems T1–T6 with proofs, the 16-row crosswalk, the full 14-mapping Qur'anic epistemology, both prototypes. **Predates the 2026-09-21 corrections.** |
-| `substrate_synthesis.html`          | Same paper, self-contained HTML, **with the 2026-09-21 corrections** and a Corrections section.                                                                                                                                                      |
+| `substrate_synthesis.pdf`           | The formal synthesis paper (42 pp): definitions, Theorem D + proof, the unified A1–A7 TASK loop, invariants I1–I4, theorems T1–T6 with proofs, the 16-row crosswalk, the full 14-mapping Qur'anic epistemology, both prototypes. **Historical, pre-correction edition** (git blob `2e17362`; predates the 2026-09-21 and 2026-09-26 corrections — see [`../HISTORICAL_EDITIONS.md`](../HISTORICAL_EDITIONS.md)). |
+| `substrate_synthesis.html`          | Same paper, self-contained HTML, **with the 2026-09-21 and 2026-09-26 corrections** and a Corrections section for each. The corrected source.                                                                                                        |
 | `crosswalk.json` / `crosswalk.md`   | The three-way term-by-term correspondence (substrate ↔ framework ↔ forgekit), with the P1/P2/P3 → Π₁/Π₂/Π₃ notation reconciliation.                                                                                                                  |
-| `graded_reference_set.json` / `.md` | The 15 new sources independently verified and graded (9 confirmed, 6 traceable, 0 unverifiable), including the disambiguation of the two future-dated arXiv IDs.                                                                                     |
+| `graded_reference_set.json` / `.md` | The 15 new sources independently verified and graded (9 confirmed, 6 traceable, 0 unverifiable), including the disambiguation of the two future-dated arXiv IDs. These are bibliographic grades (the source exists and is correctly attributed); claim support, study design, replication and transfer scope are separate and not assessed. |
 | `merged_references.json`            | Full 47-entry bibliography (32 original + 15 new, deduped).                                                                                                                                                                                          |
 | `figures/schematic_duality.png`     | The two-layer duality architecture.                                                                                                                                                                                                                  |
 | `figures/schematic_taskloop.png`    | The unified 7-stage TASK loop (each stage bound to faculty · algorithm · Qur'anic anchor).                                                                                                                                                           |
@@ -91,15 +126,18 @@ The **two runnable prototypes** referenced throughout the paper already live in
 repo and are not duplicated here:
 
 - `../python-prototypes/impact_oracle/` — Prototype I, the impact oracle (approximates
-  A1 / Δ\*). Runnable, 36 tests. Recall 1.00 on five mutations of its own demo package;
+  A1 / Δ\*). Runnable; the in-tree package is the repaired v2 (49 tests: 36 demo-package + 13
+  repair; corrected 2026-09-26 from "36 tests"). Recall 1.00 on five mutations of its own demo package;
   **refuted on real repositories: recall 0.022** on 759 files in nine repositories, where
   grep scored F1 0.437 against the oracle's 0.042 (see
   [`../empirical-refutation/`](../empirical-refutation/)).
 - `../python-prototypes/router_gate/` — Prototype II, complexity-router +
-  assumption-gate (A7 + A6 / M1 + M2). Runnable, 19 tests. 62.1% cost saved on the 30
+  assumption-gate (A7 + A6 / M1 + M2). Runnable, 23 tests in-tree (the version archived as
+  evaluated has 19; corrected 2026-09-26). 62.1% cost saved on the 30
   tasks its thresholds were tuned on; **refuted on 80 held-out tasks: total spend was
-  20.2% higher** than always-premium. Per output a judge accepted, it cost $1.06 against
-  always-premium's $1.76, but only 6 and 3 of 64 outputs were accepted.
+  20.2% higher** than always-premium. Per judge-accepted output (a model judge that is also the
+  mid-tier executor; no output was test-verified), it cost $1.06 against always-premium's $1.76,
+  but only 6 and 3 of 64 outputs were accepted.
 
 ## Honesty commitments (carried from the source work)
 
diff --git a/research/formal-synthesis/graded_reference_set.json b/research/formal-synthesis/graded_reference_set.json
index eea89e1a..76f0ccc3 100644
--- a/research/formal-synthesis/graded_reference_set.json
+++ b/research/formal-synthesis/graded_reference_set.json
@@ -6,6 +6,17 @@
     "traceable": "the work clearly exists and is correctly attributed, but rests on established secondary/historical knowledge rather than a single retrievable record",
     "unverifiable": "could not confirm existence or attribution"
   },
+  "grade_scope": {
+    "added": "2026-09-26",
+    "grade_is": "bibliographic_verification",
+    "meaning": "confirmed / traceable / unverifiable establish that a source exists and is correctly attributed; they are not independent validation of the theory it is cited for.",
+    "not_assessed": [
+      "claim_support",
+      "study_design",
+      "independent_replication",
+      "transfer_scope"
+    ]
+  },
   "tally": {
     "confirmed": 9,
     "traceable": 6,
diff --git a/research/formal-synthesis/graded_reference_set.md b/research/formal-synthesis/graded_reference_set.md
index cb58d82e..10faf3e4 100644
--- a/research/formal-synthesis/graded_reference_set.md
+++ b/research/formal-synthesis/graded_reference_set.md
@@ -6,6 +6,22 @@ Independent verification: modern arXiv sources by direct metadata API fetch (tit
 
 **Tally: 9 confirmed · 6 traceable · 0 unverifiable** (of 15 new sources).
 
+**What these grades are (added 2026-09-26).** `confirmed` / `traceable` / `unverifiable` are
+**bibliographic verification** grades: they establish that a source exists and is correctly
+attributed. They are not independent validation of the theory the source is cited for. Four other
+dimensions are kept separate and are **not assessed** for these 15 sources:
+
+| Dimension | Question it answers | Status for this set |
+|---|---|---|
+| Bibliographic verification | Does the source exist and is it correctly attributed? | graded below |
+| Claim support | Does the source support the specific claim it is cited for? | not assessed |
+| Study design | What kind of evidence is it (experiment, survey, position paper, book, doctrine)? | not assessed |
+| Independent replication | Has anyone other than the authors reproduced the result? | not assessed |
+| Transfer scope | Which settings can the result be carried to? | not assessed |
+
+Most of these sources are cited as architectural analogues or framing (CoALA, ReAct, OODA, PDCA), so a
+`confirmed` grade here says the citation is real, not that the synthesis is right.
+
 | Source | ID | Grade | Note |
 |---|---|---|---|
 | **Cognitive Architectures for Language Agents** (Theodore R. Sumers, Shunyu Yao, Karthik Narasimhan et al., 2023) | `2309.02427` | confirmed | Retrieved via arXiv metadata API; title/authors match claim exactly. Unifies memory, planning/reasoning, action, and learning modules into a single CoALA framework for language agents, giving the c… |
diff --git a/research/formal-synthesis/substrate_synthesis.html b/research/formal-synthesis/substrate_synthesis.html
index 4ce4d124..bdce98f9 100644
--- a/research/formal-synthesis/substrate_synthesis.html
+++ b/research/formal-synthesis/substrate_synthesis.html
@@ -82,11 +82,11 @@
 
 <h1>A Formal Theory of the Cognitive Substrate for Coding Agents</h1>
 <p class="subtitle">Unifying the substrate faculties, the end-to-end reliability framework, and the forgekit implementation &mdash; with a two-layer duality theorem, a unified algorithm set, and a Qur'anic epistemology.</p>
-<p class="byline">A synthesis edition. Consolidates three independently-developed bodies of work: the <em>Cognitive Substrate for Coding Agents</em> (faculties and mechanisms M1&ndash;M6, with two runnable prototypes), the <em>End-to-End Agent Reliability Framework</em> (failure modes F1/F2, invariants I1&ndash;I4, algorithms A1&ndash;A7, theorems T1&ndash;T6), and the <em>forgekit / claude-e2e-kit</em> implementation (deterministic hooks, skills, and committed-file memory). The fourteen-mapping Qur'anic lens is carried throughout as the governing epistemology of obligation.</p>
+<p class="byline">A synthesis edition. Consolidates three separately developed bodies of work, all by one author <em class="corr">[corrected 2026-09-26]</em>: the <em>Cognitive Substrate for Coding Agents</em> (faculties and mechanisms M1&ndash;M6, with two runnable prototypes), the <em>End-to-End Agent Reliability Framework</em> (failure modes F1/F2, invariants I1&ndash;I4, algorithms A1&ndash;A7, theorems T1&ndash;T6), and the <em>forgekit / claude-e2e-kit</em> implementation (deterministic hooks, skills, and committed-file memory). The fourteen-mapping Qur'anic lens is carried throughout as the governing epistemology of obligation.</p>
 
 <div class="abstract">
 <h4>Abstract</h4>
-<p>A large language model used for coding is a fixed probabilistic map, <span class="mono">y = f<sub>&theta;</sub>(x)</span>: stateless, frozen, and bounded in context. Three bodies of work, developed separately from different starting points, converged on the same conclusion &mdash; that the remedy is not a better prompt or a bigger model but an <em>external, stateful architecture</em> wrapped around the frozen core. This paper argues <em class="corr">[corrected 2026-09-21]</em> they are describing one object; their agreement is consistency rather than independent evidence, since forgekit was built as a binding of the other two <em class="corr">[corrected 2026-09-21]</em>. We show that the substrate's <em>impact-awareness</em> faculty and the framework's <em>change-closure fixpoint</em> <span class="mono">&Delta;*</span> have the same shape, the oracle approximating the fixpoint over a different relation <em class="corr">[corrected 2026-09-21]</em>; that the <em>assumption gate</em> and the <em>amnesia equation</em> <span class="mono">assumption &asymp; argmax P(convention&nbsp;|&nbsp;training)</span> are the same phenomenon; and that both reduce to a single <strong>two-layer duality</strong>: a <em>probabilistic</em> instruction layer that raises the probability <span class="mono">p&lt;1</span> of correct behaviour, and a <em>deterministic</em> interception layer that multiplies down what escapes it. The central result, restated in the 2026-09-21 corrections as a bound on the residual over an explicit region of (instruction-following, catch) probabilities rather than as an impossibility theorem <em class="corr">[corrected 2026-09-21]</em>, is a formalization of the discipline <em>never trust the output of a probabilistic engine; earn trust with an external check</em>. The composition law itself is standard layer-of-protection algebra, and two concurrent preprints derived a strictly more general Bayesian form of it first; we concede priority <em class="corr">[corrected 2026-09-21]</em>. We give definitions, the duality result, a unified seven-algorithm task loop, the probabilistic failure model <span class="mono">P(&ge;1&nbsp;miss)=1&minus;p<sup>n</sup></span> (for independent tasks), and carry through the six correctness theorems of the reliability framework. Two prototypes &mdash; an impact oracle and a complexity-router/assumption-gate &mdash; instantiate the deterministic layer; both of their headline results were later refuted on data the authors did not build <em class="corr">[corrected 2026-09-21]</em>. The forgekit / claude-e2e-kit codebase is the deployed binding. The Qur'anic lens supplies the vocabulary of epistemic obligation (tabayyun, amāna, lā taqfu) that names <em>why</em> each safeguard is mandatory rather than optional.</p>
+<p>A large language model used for coding is a fixed probabilistic map, <span class="mono">y = f<sub>&theta;</sub>(x)</span>: stateless, frozen, and bounded in context. Three bodies of work, developed separately from different starting points, converged on the same conclusion &mdash; that the remedy is not a better prompt or a bigger model but an <em>external, stateful architecture</em> wrapped around the frozen core. Prompting does change behaviour within a context; what it cannot supply on its own is durable state across invocations and a check the model does not grade itself, and this architecture is one tested way of supplying both, not the only possible one <em class="corr">[corrected 2026-09-26]</em>. This paper argues <em class="corr">[corrected 2026-09-21]</em> they are describing one object; their agreement is consistency rather than independent evidence, since forgekit was built as a binding of the other two <em class="corr">[corrected 2026-09-21]</em>. We show that the substrate's <em>impact-awareness</em> faculty and the framework's <em>change-closure fixpoint</em> <span class="mono">&Delta;*</span> have the same shape, the oracle approximating the fixpoint over a different relation <em class="corr">[corrected 2026-09-21]</em>; that the <em>assumption gate</em> and the <em>amnesia equation</em> <span class="mono">assumption &asymp; argmax P(convention&nbsp;|&nbsp;training)</span> are the same phenomenon; and that both reduce to a single <strong>two-layer duality</strong>: a <em>probabilistic</em> instruction layer that raises the probability <span class="mono">p&lt;1</span> of correct behaviour, and a <em>deterministic</em> interception layer that multiplies down what escapes it. The central result, restated in the 2026-09-21 corrections as a bound on the residual over an explicit region of (instruction-following, catch) probabilities rather than as an impossibility theorem <em class="corr">[corrected 2026-09-21]</em>, is a formalization of the discipline <em>never trust the output of a probabilistic engine; earn trust with an external check</em>. The composition law itself is standard layer-of-protection algebra, and two concurrent preprints derived a strictly more general Bayesian form of it first; we concede priority <em class="corr">[corrected 2026-09-21]</em>. We give definitions, the duality result, a unified seven-algorithm task loop, the probabilistic failure model <span class="mono">P(&ge;1&nbsp;miss)=1&minus;p<sup>n</sup></span> (for independent tasks), and carry through the six correctness theorems of the reliability framework. Two prototypes &mdash; an impact oracle and a complexity-router/assumption-gate &mdash; instantiate the deterministic layer; both of their headline results were later refuted on data the authors did not build <em class="corr">[corrected 2026-09-21]</em>. The forgekit / claude-e2e-kit codebase is the deployed binding. The Qur'anic lens supplies the vocabulary of epistemic obligation (tabayyun, amāna, lā taqfu) that names <em>why</em> each safeguard is mandatory rather than optional.</p>
 </div>
 
 <div class="callout warn">
@@ -94,6 +94,11 @@ <h4>Corrections (2026-09-21)</h4>
 <p>An external review found that Theorem&nbsp;D was circular as stated, that Eq.&nbsp;(5) assumed an independence the design contradicts, that several definitions and proofs were wrong, and that the prototype results in &sect;10 had already been refuted. The corrections are made in place, marked <em class="corr">[corrected 2026-09-21]</em>, and listed with the original wording in <a href="#corrections">Corrections</a>. The PDF edition predates them.</p>
 </div>
 
+<div class="callout warn">
+<h4>Corrections (2026-09-26)</h4>
+<p>A second external review (2026-09-26) found that Theorem&nbsp;D's range statement combined two maxima that need not be attainable together, that an equality condition was misstated, that a caught miss was being read as a completed task, that the frozen-map premise was broader than the guarantees it actually removes, and that the prior art and the shared authorship of the &ldquo;three bodies of work&rdquo; needed the same care already given to priority. The corrections are made in place, marked <em class="corr">[corrected 2026-09-26]</em>, and listed with the original wording in <a href="#corrections-2026-09-26">Corrections (2026-09-26)</a>. The PDF edition predates both sets of corrections.</p>
+</div>
+
 <div class="toc">
 <strong>Contents</strong>
 <ol>
@@ -112,6 +117,7 @@ <h4>Corrections (2026-09-21)</h4>
 <li><a href="#conclusion">Conclusion</a></li>
 <li><a href="#convergence">Four arrivals by one author &mdash; the convergence audited</a></li>
 <li><a href="#corrections">Corrections (2026-09-21)</a></li>
+<li><a href="#corrections-2026-09-26">Corrections (2026-09-26)</a></li>
 </ol>
 <div class="small">Appendix A: graded reference set &nbsp;&middot;&nbsp; Appendix B: crosswalk table &nbsp;&middot;&nbsp; References</div>
 </div>
@@ -131,6 +137,7 @@ <h2 id="intro">1&ensp;The convergence &mdash; three roads to one architecture</h
 <h4>The claim of this paper</h4>
 <p>These are not three similar ideas. They are one architecture described in three vocabularies. The impact-awareness faculty <em>is</em> the change-closure fixpoint. The assumption gate <em>is</em> the amnesia equation. The substrate's external structure <em>is</em> a two-layer duality &mdash; and that duality, which the reliability framework states as a design law, is the result the whole thing turns on. What each road saw partially, the union sees whole.</p>
 <p class="small">Two of these three &ldquo;identities&rdquo; are weaker than this callout says: the impact oracle approximates <span class="mono">&Delta;*</span> rather than computing it (&sect;3.2), and the duality is a bound over a region of parameters, not a theorem for every <span class="mono">p, c &lt; 1</span> (&sect;4). See the Corrections. <em class="corr">[corrected 2026-09-21]</em></p>
+<p class="small">The five faculties are one useful decomposition, not a proof that these five are necessary or that an external stateful architecture is the only way to supply them. The broad architecture has clear prior art: CoALA (Sumers et&nbsp;al., 2023) organises language agents into modular memory, action and decision procedures, and Reflexion (Shinn et&nbsp;al., 2023) improves agents through linguistic feedback and an episodic memory buffer with no weight updates. The defensible claim is narrower: <em>a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes</em>. <em class="corr">[corrected 2026-09-26]</em></p>
 </div>
 
 <p>The synthesis also inherits a governing discipline, stated plainly by the practitioner who commissioned this work: <em>AI output is a mathematically calculated probability; it must never be trusted blindly; for the same prompt it can give a different answer, so use only the capability it is genuinely best at, and earn trust with an external check.</em> We will see that this sentence is not a slogan but the informal statement of the central theorem &mdash; the quantity <span class="mono">(1&minus;p)&gt;0</span> that forces a deterministic layer to exist.</p>
@@ -145,7 +152,7 @@ <h2 id="model">2&ensp;The object of study &mdash; the frozen map and its five la
 
 <ul>
 <li><strong>P1 &mdash; statelessness.</strong> <span class="mono">f<sub>&theta;</sub></span> has no memory across calls; each invocation sees only the current <span class="mono">x</span>. Nothing the agent learned yesterday is present today unless something outside the model re-supplies it.</li>
-<li><strong>P2 &mdash; frozen parameters.</strong> <span class="mono">&theta;</span> does not change from use. The agent cannot learn from an outcome by updating weights; any learning must be external.</li>
+<li><strong>P2 &mdash; frozen parameters.</strong> <span class="mono">&theta;</span> does not change from use. The agent cannot learn from an outcome by updating weights; learning that has to outlast the current context must be held outside the model. <em class="corr">[corrected 2026-09-26]</em></li>
 <li><strong>P3 &mdash; bounded, undifferentiated context.</strong> <span class="mono">x</span> is finite and flat: a long story and a long program are the same kind of object to it, with no privileged channel for goals versus detail. This is the root of goal-drift and of context saturation.</li>
 </ul>
 
@@ -162,7 +169,7 @@ <h2 id="model">2&ensp;The object of study &mdash; the frozen map and its five la
 
 <p class="small">The &ldquo;Forced by&rdquo; column now matches the whitepaper's derivation, which argues each row separately; the earlier version of this table disagreed with it in all five rows. <em class="corr">[corrected 2026-09-21]</em></p>
 
-<p>The critical word is <em>external</em>. Because <span class="mono">&theta;</span> is frozen (P2) and context is bounded (P3), none of these can be fixed by prompting harder or by fine-tuning alone. The architecture must live <em>around</em> the model, hold state <em>outside</em> it, and enforce behaviour the model cannot be relied upon to produce on its own. The rest of this paper makes "cannot be relied upon" precise and shows what "enforce" must therefore mean.</p>
+<p>The critical word is <em>external</em>. What P1&ndash;P3 remove is a set of guarantees, not every behaviour: there is no built-in durable state across independent invocations, the context is bounded, parameters are not updated automatically from outcomes, and self-verification without external evidence is unreliable. Examples, retrieved facts and feedback placed in the context do change behaviour with no weight update &mdash; GPT-3's few-shot evaluation measures exactly that adaptation through text (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>) &mdash; so prompting is not powerless. What it cannot supply on its own is persistence beyond the window and a check the model does not grade itself. The architecture supplies those: it lives <em>around</em> the model, holds state <em>outside</em> it, and enforces behaviour the model cannot be relied upon to produce on its own. It is one tested way of supplying persistence and verification, not the only logically possible architecture. <em class="corr">[corrected 2026-09-26]</em> The rest of this paper makes "cannot be relied upon" precise and shows what "enforce" must therefore mean.</p>
 
 
 <h2 id="defs">3&ensp;Definitions</h2>
@@ -251,12 +258,12 @@ <h2 id="duality">4&ensp;The central result &mdash; the two-layer duality theorem
 <p>With <span class="mono">c<sub>j</sub> = P(check j fires | M)</span>, and <em>no</em> independence assumption, <span class="mono">max(0, 1&minus;&Sigma;<sub>j</sub>c<sub>j</sub>) &le; 1&minus;q &le; 1&minus;max<sub>j</sub>c<sub>j</sub></span> (Fr&eacute;chet bounds). The product <span class="mono">(1&minus;p)&middot;&prod;<sub>j</sub>(1&minus;c<sub>j</sub>)</span>, which earlier versions gave as Eq.&nbsp;(5), is the special case in which the checks fire independently given the miss. When the checks are nested, for example the same classifier run at several points on the same diff, <span class="mono">r = (1&minus;p)(1&minus;c<sub>max</sub>)</span>.</p>
 <p>Then:</p>
 <ol style="margin:6px 0">
-<li><strong>Bound.</strong> The per-task residual is at most <span class="mono">&epsilon;</span> exactly on the region <span class="mono">R<sub>&epsilon;</sub> = {(p, q) : (1&minus;p)(1&minus;q) &le; &epsilon;}</span>. Over <span class="mono">n</span> tasks, <span class="mono">P(&ge;1 miss) &le; min(1, n&epsilon;)</span> whatever the dependence between tasks (union bound). It equals <span class="mono">1&minus;(1&minus;&epsilon;)<sup>n</sup></span> only if tasks fail independently, and tasks done by one model on one repository need not.</li>
+<li><strong>Bound.</strong> The per-task residual is at most <span class="mono">&epsilon;</span> exactly on the region <span class="mono">R<sub>&epsilon;</sub> = {(p, q) : (1&minus;p)(1&minus;q) &le; &epsilon;}</span>. Over <span class="mono">n</span> tasks, <span class="mono">P(&ge;1 miss) &le; min(1, n&epsilon;)</span> whatever the dependence between tasks (union bound). If tasks fail independently with per-task residuals <span class="mono">r<sub>i</sub> &le; &epsilon;</span>, then <span class="mono">P(&ge;1 miss) = 1&minus;&prod;<sub>i</sub>(1&minus;r<sub>i</sub>) &le; 1&minus;(1&minus;&epsilon;)<sup>n</sup></span>, with equality only when every <span class="mono">r<sub>i</sub> = &epsilon;</span>: independence alone does not give equality. Tasks done by one model on one repository need not be independent at all. <em class="corr">[corrected 2026-09-26]</em></li>
 <li><strong>Instruction layer alone</strong> (<span class="mono">q = 0</span>): <span class="mono">r = 1&minus;p</span>, so reaching <span class="mono">&epsilon;</span> needs <span class="mono">p &ge; 1&minus;&epsilon;</span> from instructions. Raising <span class="mono">p</span> does bend the curve: for 30 independent tasks, <span class="mono">P(&ge;1 miss)</span> is 0.958 at <span class="mono">p = 0.9</span> and 0.260 at <span class="mono">p = 0.99</span>.</li>
 <li><strong>Deterministic layer alone</strong> (the bare model's <span class="mono">p<sub>0</sub></span>): reaching <span class="mono">&epsilon;</span> needs <span class="mono">q &ge; 1 &minus; &epsilon;/(1&minus;p<sub>0</sub>)</span>.</li>
 <li><strong>Composition.</strong> Adding a check with <span class="mono">P(it fires | M, no earlier check fired) &gt; 0</span> strictly lowers <span class="mono">r</span>. Adding a copy of a check that is already present lowers nothing.</li>
 </ol>
-<p>The design claim that survives is a statement about ranges, not an impossibility theorem. Let <span class="mono">p<sub>0</sub></span> be the bare model's rate, <span class="mono">p<sub>max</sub></span> the best rate instructions can reach, and <span class="mono">q<sub>max</sub></span> the best catch rate decidable checks can reach on the misses that matter. Instructions alone leave at least <span class="mono">1&minus;p<sub>max</sub></span>; checks alone leave at least <span class="mono">(1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>)</span>; together they can reach <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span>. So a target <span class="mono">&epsilon;</span> with <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>) &le; &epsilon; &lt; min(1&minus;p<sub>max</sub>, (1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>))</span> needs both layers and is reachable with them. Whether a real target falls in that range is an empirical question about <span class="mono">p<sub>0</sub></span>, <span class="mono">p<sub>max</sub></span> and <span class="mono">q<sub>max</sub></span>, which this paper does not measure.</p>
+<p>The design claim that survives is a statement about ranges, not an impossibility theorem. Let <span class="mono">p<sub>0</sub></span> be the bare model's rate, <span class="mono">p<sub>max</sub></span> the best rate instructions can reach, and <span class="mono">q<sub>max</sub></span> the best catch rate decidable checks can reach on the misses that matter. Instructions alone leave at least <span class="mono">1&minus;p<sub>max</sub></span>; checks alone leave at least <span class="mono">(1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>)</span>; together they reach <span class="mono">r* = min<sub>(p,q)&isin;F</sub> (1&minus;p)(1&minus;q)</span> over the joint feasible set <span class="mono">F = {(p(&pi;), q(&pi;)) : &pi; an admissible policy}</span>. Instructions change which misses remain, and <span class="mono">q</span> is a catch rate conditional on that changed miss population, so <span class="mono">p<sub>max</sub></span> and <span class="mono">q<sub>max</sub></span> need not be attainable under one policy: <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span> is a <em>lower bound</em> on <span class="mono">r*</span>, reached only if the two maxima are jointly attainable on the same task distribution. For example, policy A with <span class="mono">(p, q) = (0.5, 0.9)</span> leaves 0.05 and policy B with <span class="mono">(0.9, 0.1)</span> leaves 0.09; the separate maxima, 0.9 and 0.9, suggest 0.01, which neither policy attains (<span class="mono">research/recompute_corrections.py</span> asserts this in &sect;3b). So a target <span class="mono">&epsilon;</span> with <span class="mono">r* &le; &epsilon; &lt; min(1&minus;p<sub>max</sub>, (1&minus;p<sub>0</sub>)(1&minus;q<sub>max</sub>))</span> needs both layers and is reachable with them. <em class="corr">[corrected 2026-09-26]</em> Whether a real target falls in that range is an empirical question about <span class="mono">p<sub>0</sub></span>, <span class="mono">p<sub>max</sub></span>, <span class="mono">q<sub>max</sub></span> and the shape of <span class="mono">F</span>, which this paper does not measure.</p>
 <p class="qed">&#9633;</p>
 </div></div>
 
@@ -267,7 +274,7 @@ <h2 id="duality">4&ensp;The central result &mdash; the two-layer duality theorem
 
 <figure>
 <img src="{{artifact:art_5f049677-4c3c-40f2-8905-dd01c966e9ae}}" alt="The two-layer duality architecture">
-<figcaption><strong>Figure 1. The two-layer duality.</strong> The probabilistic instruction layer (&Pi;<sub>3</sub>, purple) raises <span class="mono">p</span> by loading context but may drift (dashed arrows); the deterministic interception layer (&Pi;<sub>2</sub>, teal) executes regardless of the model's choice and either passes the turn or blocks it (exit&nbsp;2) back into the model for repair. The persistent store (&Pi;<sub>1</sub>) feeds both. What escapes both layers is the residual <span class="mono">(1&minus;p)&middot;P(no check fires | miss)</span>, which equals <span class="mono">(1&minus;p)&middot;&prod;(1&minus;c<sub>j</sub>)</span> only when the checks fire independently <em class="corr">[corrected 2026-09-21]</em>. It is handed to review or a later commit/CI gate. The whole sits inside a stewardship boundary (amāna, &sect;9). Neither layer alone suffices &mdash; the formal content of the discipline <em>never trust the output; earn trust with a check</em>.</figcaption>
+<figcaption><strong>Figure 1. The two-layer duality.</strong> The probabilistic instruction layer (&Pi;<sub>3</sub>, purple) raises <span class="mono">p</span> by loading context but may drift (dashed arrows); the deterministic interception layer (&Pi;<sub>2</sub>, teal) executes regardless of the model's choice and either passes the turn or blocks it (exit&nbsp;2) back into the model for repair. The persistent store (&Pi;<sub>1</sub>) feeds both. What escapes both layers is the residual <span class="mono">(1&minus;p)&middot;P(no check fires | miss)</span>, which equals <span class="mono">(1&minus;p)&middot;&prod;(1&minus;c<sub>j</sub>)</span> only when the checks fire independently <em class="corr">[corrected 2026-09-21]</em>. It is handed to review or a later commit/CI gate. The whole sits inside a stewardship boundary (amāna, &sect;9). Where each factor is bounded away from zero, neither layer alone reaches a small residual <em class="corr">[corrected 2026-09-26]</em> &mdash; the formal content of the discipline <em>never trust the output; earn trust with a check</em>.</figcaption>
 </figure>
 
 <div class="callout key">
@@ -295,6 +302,9 @@ <h4>The honest cost side</h4>
 </div>
 
 
+<h3>5.4&ensp;A caught miss is not a completed task <em class="corr">[corrected 2026-09-26]</em></h3>
+<p>Theorem&nbsp;D counts <em>silent</em> misses. A miss that a check catches is not thereby a completed, correct task: the gate can block the same turn repeatedly, the agent can abandon the task, and the repair can fail. So a lower silent-miss probability is not automatically a higher completed-correct-task rate, and the value of the two layers has to be measured on outcomes rather than read off <span class="mono">r</span>. The quantities that decide it are the true catch rate, the false-block rate, repaired success conditional on a catch, abandonment, added latency and recovery cost. This paper measures none of them.</p>
+
 <h2 id="algos">6&ensp;The unified algorithm set &mdash; the TASK loop</h2>
 
 <p>The faculties of Def.&nbsp;4 are realized by seven algorithms. They are the reliability framework's A1&ndash;A7, recast here as the operations of the substrate: each is a faculty made mechanical, each binds to one lifecycle point, and together they form a single loop whose progress is guaranteed by an explicit worklist and whose floor is guaranteed by a deterministic gate.</p>
@@ -613,7 +623,7 @@ <h2 id="limits">12&ensp;Honest limits &mdash; what no architecture can guarantee
 </ul>
 
 <h2 id="conclusion">13&ensp;Conclusion</h2>
-<p>A language model that writes code is a fixed probabilistic map, and three efforts that were not independent of one another &mdash; one from cognition, one from production failures, one from a shipped codebase &mdash; converged on the same remedy: wrap it in an external, stateful architecture that supplies the faculties it structurally lacks. This paper argued they describe one object. The impact-awareness faculty approximates the change-closure fixpoint; the assumption gate <em>is</em> the amnesia equation; and both rest on one result &mdash; the residual silent-miss rate is the product of what a <em>probabilistic</em> instruction layer lets through, <span class="mono">1&minus;p</span>, and what a <em>deterministic</em> interception layer lets through, <span class="mono">P(no check fires | miss)</span>. Where each factor is bounded away from zero, neither layer alone reaches a small residual. <em class="corr">[corrected 2026-09-21]</em></p>
+<p>A language model that writes code is a fixed probabilistic map, and three efforts that were not independent of one another &mdash; one from cognition, one from production failures, one from a shipped codebase &mdash; converged on the same remedy: wrap it in an external, stateful architecture that supplies the persistence and external checks it does not provide on its own <em class="corr">[corrected 2026-09-26]</em>. This paper argued they describe one object. The impact-awareness faculty approximates the change-closure fixpoint; the assumption gate <em>is</em> the amnesia equation; and both rest on one result &mdash; the residual silent-miss rate is the product of what a <em>probabilistic</em> instruction layer lets through, <span class="mono">1&minus;p</span>, and what a <em>deterministic</em> interception layer lets through, <span class="mono">P(no check fires | miss)</span>. Where each factor is bounded away from zero, neither layer alone reaches a small residual. <em class="corr">[corrected 2026-09-21]</em></p>
 <p>That theorem is the formal content of a plain discipline: <em>the output of a probability engine is never to be trusted on its own; trust is earned by an external check.</em> The Qur'anic lens gives that discipline its oldest names &mdash; <em>l&#257; taqfu</em>, do not pursue what you do not know; <em>tabayyun</em>, verify the report before you act; <em>al-am&#257;na</em>, the weight of a trust accepted by one who may err. The mathematics says how to build the check. The tradition says why it is owed. The codebase shows it runs.</p>
 <p class="small" style="margin-top:20px;color:#888">Companion artifacts: the three-way crosswalk (JSON + markdown), the graded reference set (Appendix&nbsp;A), and two runnable prototype packages (impact-oracle, router-gate). This synthesis consolidates and does not supersede the v2 <em>Theory&nbsp;&rarr;&nbsp;Evidence&nbsp;&rarr;&nbsp;Build-Map</em> edition, which carries the empirical evidence layer and the full ecosystem map.</p>
 
@@ -742,8 +752,20 @@ <h2 id="corrections">Corrections (2026-09-21)</h2>
 <li><strong>The prototype results in &sect;10 were refuted before this correction, and the section now says so.</strong> The impact oracle's &ldquo;perfect recall&rdquo; was measured on five mutations of a ten-file package the authors wrote; on 759 evaluated files in nine real repositories its recall was 0.022, and a grep baseline scored F1 0.437 against its 0.042. The router's &ldquo;62.1% real cost saved&rdquo; was measured on the 30 tasks its thresholds were tuned on; on 80 held-out tasks the pipeline's total spend was 20.2% <em>higher</em> than always using the premium tier. Per output the judge accepted, it cost $1.06 against always-premium's $1.76, but only 6 and 3 of 64 outputs were accepted, so neither figure is stable. The details are in the extended preprint and the refutation paper.</li>
 </ol>
 
+<h2 id="corrections-2026-09-26">Corrections (2026-09-26)</h2>
+<p>A second external deep review of the forgekit repository (2026-09-26, pinned at commit <span class="mono">d2abfa69fb77531199ffc67c5c076b524af69040</span>) re-checked the corrected Theorem&nbsp;D and this paper's framing. Each change is made in place above, marked <em class="corr">[corrected 2026-09-26]</em>, and listed here with the original wording, so nothing is silently rewritten. The counterexample in item&nbsp;1, the equality condition in item&nbsp;2 and the 400-fold correction in item&nbsp;4 are asserted by <span class="mono">python3 research/recompute_corrections.py --theorem-checks</span> (&sect;3b), which needs no data. The PDF edition predates these corrections as well.</p>
+<ol>
+<li><strong>Separately maximal rates need not be jointly attainable (&sect;4).</strong> The range statement read: &ldquo;together they can reach <span class="mono">(1&minus;p<sub>max</sub>)(1&minus;q<sub>max</sub>)</span>&rdquo;. That requires both maxima to be attainable under one policy on the same task distribution; instructions change which misses remain, and <span class="mono">q</span> is conditional on that population. The attainable residual is <span class="mono">min<sub>(p,q)&isin;F</sub> (1&minus;p)(1&minus;q)</span> over <span class="mono">F = {(p(&pi;), q(&pi;)) : admissible &pi;}</span>, and the product of the separate maxima is only a lower bound on it unless compatibility is established. Counterexample: policy A <span class="mono">(0.5, 0.9)</span> leaves 0.05, policy B <span class="mono">(0.9, 0.1)</span> leaves 0.09, and the separate maxima suggest 0.01, which neither attains.</li>
+<li><strong>Equality in the independent-task bound (&sect;4, Claim&nbsp;1).</strong> The text said <span class="mono">P(&ge;1 miss)</span> &ldquo;equals <span class="mono">1&minus;(1&minus;&epsilon;)<sup>n</sup></span> only if tasks fail independently&rdquo;. From per-task residuals <span class="mono">r<sub>i</sub> &le; &epsilon;</span>, independence gives <span class="mono">1&minus;&prod;(1&minus;r<sub>i</sub>) &le; 1&minus;(1&minus;&epsilon;)<sup>n</sup></span>, with equality only when every <span class="mono">r<sub>i</sub> = &epsilon;</span>. With residuals 0.01, 0.005 and 0.001, for example, the probability is 0.0159 against the bound's 0.0297.</li>
+<li><strong>A caught miss is not a completed task (new &sect;5.4).</strong> A lower silent-miss probability does not by itself mean more completed, correct tasks: a caught mistake can end in an abort, repeated blocking or a failed repair. The measures that decide the question &mdash; true catch rate, false-block rate, repaired success conditional on a catch, abandonment, latency and recovery cost &mdash; are listed and are not measured here.</li>
+<li><strong>Three lifecycle copies of one classifier are one detector (&sect;5.3).</strong> The 2026-09-21 correction stands: multiplying identical checks at the Stop hook, pre-commit and CI as if independent understated the residual 400-fold. Copies at several points can widen the <em>opportunities</em> to run a check, such as edits made after a turn ended, but they are not independent semantic detectors.</li>
+<li><strong>The frozen-map premise, stated as the guarantees it removes (abstract, &sect;2).</strong> The paper said &ldquo;none of these can be fixed by prompting harder or by fine-tuning alone&rdquo; and &ldquo;any learning must be external&rdquo;. Frozen parameters exclude weight updates during use; they do not exclude changed behaviour from examples, retrieved facts, feedback or additional computation in the current context, which GPT-3's few-shot evaluation measured with no gradient updates (<a href="https://arxiv.org/abs/2005.14165">Brown et&nbsp;al., 2020</a>, arXiv:2005.14165). The missing guarantees are narrower: no built-in durable state across independent invocations; a bounded context; no automatic parameter update; and unreliable self-verification without external evidence. The substrate is one tested way of supplying persistence and verification, not the only logically possible architecture.</li>
+<li><strong>Prior art and what is (and is not) claimed (byline, abstract, &sect;1, &sect;13).</strong> External memory, feedback-driven improvement and structured agent control have clear prior art: CoALA (Sumers et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2309.02427">arXiv:2309.02427</a>) organises language agents into modular memory, action and decision procedures, and Reflexion (Shinn et&nbsp;al., 2023, <a href="https://arxiv.org/abs/2303.11366">arXiv:2303.11366</a>) improves agents with linguistic feedback and an episodic memory buffer and no weight updates. Both were already among this paper's references. The defensible claim is <em>a portable implementation of evidence-weighted coding-agent memory and checks, with empirical evaluation of trust failure modes</em>; novelty is claimed only for a specific protocol, invariant, evaluation result or integration that survives an explicit prior-art comparison. The five faculties are a decomposition, not a proof of necessity, and the conclusion no longer says the architecture &ldquo;supplies the faculties it structurally lacks&rdquo;. The byline still called the three bodies of work &ldquo;independently-developed&rdquo; after the 2026-09-21 corrections had shown that they share an author; it now says so.</li>
+<li><strong>Reference grades are bibliographic (Appendix&nbsp;A).</strong> <em>confirmed</em> and <em>traceable</em> record that a source exists and is correctly attributed. They are not a judgement that the source supports the theory it is cited for. <span class="mono">graded_reference_set.md</span> now keeps bibliographic verification, claim support, study design, independent replication and transfer scope as separate grades.</li>
+</ol>
+
 <h2 id="appendix-refs">Appendix A&ensp;&mdash;&ensp;Graded reference set (new sources)</h2>
-<p>The synthesis draws in a body of cognitive-architecture and process literature beyond the substrate paper's original 32 references. Each new source was independently verified this pass &mdash; modern arXiv sources by direct metadata fetch, classical works by primary-host search or established secondary knowledge &mdash; and graded: <strong>confirmed</strong> (record retrieved, attribution matches), <strong>traceable</strong> (the work clearly exists and is correctly attributed, but rests on established secondary knowledge rather than a single retrievable record), <strong>unverifiable</strong> (could not confirm). The tally: <strong>9 confirmed, 6 traceable, 0 unverifiable</strong> (15 sources: 8 confirmed by the citations track plus the founding Agent-as-a-Judge paper added on its recommendation). Earlier versions said 8 confirmed. <em class="corr">[corrected 2026-09-21]</em></p>
+<p>The synthesis draws in a body of cognitive-architecture and process literature beyond the substrate paper's original 32 references. Each new source was independently verified this pass &mdash; modern arXiv sources by direct metadata fetch, classical works by primary-host search or established secondary knowledge &mdash; and graded: <strong>confirmed</strong> (record retrieved, attribution matches), <strong>traceable</strong> (the work clearly exists and is correctly attributed, but rests on established secondary knowledge rather than a single retrievable record), <strong>unverifiable</strong> (could not confirm). The tally: <strong>9 confirmed, 6 traceable, 0 unverifiable</strong> (15 sources: 8 confirmed by the citations track plus the founding Agent-as-a-Judge paper added on its recommendation). Earlier versions said 8 confirmed. <em class="corr">[corrected 2026-09-21]</em> These grades are <em>bibliographic</em>: they confirm that a record exists and is correctly attributed. They do not grade whether a source supports the claim it is cited for, its study design, independent replication or transfer scope; <span class="mono">research/formal-synthesis/graded_reference_set.md</span> now keeps those as separate fields. <em class="corr">[corrected 2026-09-26]</em></p>
 <table>
 <tr><th>Source</th><th>ID</th><th>Grade</th><th>Note</th></tr>
 <tr><td><strong>Cognitive Architectures for Language Agents</strong><br><span class="small">Theodore R. Sumers, Shunyu Yao, Karthik Narasi, 2023</span></td><td class="mono">2309.02427</td><td style="color:#2f6b45;font-weight:700">confirmed</td><td class="small">Retrieved via arXiv metadata API; title/authors match claim exactly. Unifies memory, planning/reasoning, action, and learning modules into a single CoALA framework for language agents, giving the cognitive-substrate work&#x27;s memory/im&hellip;</td></tr>
diff --git a/research/python-prototypes/impact_oracle/README.md b/research/python-prototypes/impact_oracle/README.md
index c3939095..3f66ba5a 100644
--- a/research/python-prototypes/impact_oracle/README.md
+++ b/research/python-prototypes/impact_oracle/README.md
@@ -56,8 +56,16 @@ in `oracle.py` as the module defaults:
    dependencies. Two terminal relations were added: `sibling` (one bounded forward hop to a
    bridge, then one bounded reverse hop from it, skipping bridges whose in-degree exceeds
    the cap) and `forward` (the changed symbol's own dependencies, ≤2 hops).
-   Held-out (never-tuned) repos at threshold 0.10: precision 0.320, recall 0.647,
-   **F1 0.428 vs the grep baseline's 0.371** — a reversal of the as-shipped 0.042 vs 0.437.
+   On the three held-out (never-tuned) repositories at the pre-registered canonical threshold
+   0.02: precision 0.305, recall 0.653, **F1 0.416 against the grep baseline's 0.371** (ΔF1 about
+   +0.044). At threshold 0.10, which was selected on the tuning repositories, F1 is 0.428
+   (precision 0.320, recall 0.647; ΔF1 +0.0565), and that is the only threshold with
+   per-repository counts: all three held-out repositories favour the repair there, but three of
+   three is a one-sided sign-test p of 0.125 and pytest supplies 71.3% of the held-out pairs, so
+   that it *beats* grep is not established. Never compare a 0.10 figure with a 0.02 one. (Corrected
+   2026-09-26: this line quoted only the 0.10 result, as "F1 0.428 vs the grep baseline's 0.371 — a
+   reversal of the as-shipped 0.042 vs 0.437", which also set three held-out repositories against
+   all nine.)
 
 `ImpactOracle(wm, sibling_enabled=False, forward_enabled=False)` reproduces the
 as-shipped reverse-only traversal exactly; the untouched as-shipped package is archived as
@@ -119,12 +127,16 @@ On this demo package the oracle reached recall 1.000 (it missed no affected modu
 these five mutations), with its best F1 of 0.79 at the optimal threshold (t=0.4).
 
 > **Refuted on real code.** That recall did not transfer. On 759 files in nine open-source
-> Python repositories, with co-change ground truth, this version's recall was **0.022** and a
+> Python repositories, with co-change ground truth, the as-shipped version's recall was **0.022** and a
 > grep baseline scored F1 0.437 against its 0.042: the traversal walks only reverse edges, and a
-> construction defect breaks `src/`-layout packages. A repaired version ships in
-> [`../../empirical-refutation/replication_package.tar.gz`](../../empirical-refutation/). Earlier
-> versions of this README said the oracle "achieves perfect recall (never misses a truly affected
-> module)". (Corrected 2026-09-21.)
+> construction defect breaks `src/`-layout packages. This package **is** the repaired version (see
+> "Repaired (v2)" above); the untouched as-shipped v1 is archived in
+> [`../../empirical-refutation/replication_package.tar.gz`](../../empirical-refutation/), and
+> `ImpactOracle(wm, sibling_enabled=False, forward_enabled=False)` reproduces its traversal. The
+> results table above is the original five-mutation demonstration reported in the white paper (§8). Earlier versions of
+> this README said the oracle "achieves perfect recall (never misses a truly affected module)".
+> (Corrected 2026-09-21; the pointer to the repaired version corrected 2026-09-26 — it said "A
+> repaired version ships in" the replication tarball.)
 
 ## File structure
 
diff --git a/research/python-prototypes/router_gate/README.md b/research/python-prototypes/router_gate/README.md
index 80cbd0df..0fda151f 100644
--- a/research/python-prototypes/router_gate/README.md
+++ b/research/python-prototypes/router_gate/README.md
@@ -173,3 +173,25 @@ python -m pytest
 ```
 
 The included evaluation task set is a demonstration set, not a field benchmark. Calibrate thresholds on your own workload before enforcing automated model selection in high-stakes production paths.
+
+## Held-out result, and what "success" means
+
+*(Added 2026-09-26.)* The 30-task demonstration above was the set the thresholds were tuned on. On
+80 pre-registered held-out tasks from real GitHub issues and pull requests
+([`research/empirical-refutation/`](../../empirical-refutation/)), gate F1 was 0.37, and on the 64
+non-halted tasks the routed pipeline spent **$6.3582** against always-premium's **$5.2893** —
+**20.21% more**, not saved.
+
+"Success" in that evaluation is **`judge_accepted`**: a model judge (the same model the pipeline
+used as its mid-tier executor) accepted 6 of 64 routed outputs and 3 of 64 always-premium outputs.
+That gives $1.060 against $1.763 per judge-accepted output, a ratio that is unstable at those counts.
+No held-out task admitted execution-based verification, so **`tests_passed`**, **`human_accepted`**
+and **`deployed_without_revert`** were never measured. Re-labelling 30 tasks with the same model and a
+reworded prompt gave halt κ 0.5161 and tier κ 0.8919 — self-consistency, not agreement with a human.
+The figures are recomputed from the replication archive by
+[`research/recompute_corrections.py`](../../recompute_corrections.py) (§7, §9).
+
+When you evaluate this pipeline on your own workload, record those four outcomes separately, anchor
+coding success on executable tests and blind human adjudication of disagreements, and keep gate
+precision/recall, router solve rate and total pipeline cost as separate endpoints; count
+clarification turns and tasks the gate rejected that were in fact valid.
diff --git a/research/recompute_corrections.py b/research/recompute_corrections.py
index 8d2c6ba8..4b89c248 100644
--- a/research/recompute_corrections.py
+++ b/research/recompute_corrections.py
@@ -8,11 +8,16 @@
     python research/recompute_corrections.py rp/repro
 
 Sections 1-3 need no data (they are arithmetic on the synthesis paper's own worked
-examples). Sections 4-9 read `results/*.json` and `data/*.parquet` from the package.
+examples). Section 3b (added 2026-09-26) holds executable sanity checks on Theorem D that
+need no data either; each is an `assert`, so a wrong statement fails the run with a
+non-zero exit. Sections 4-9 read `results/*.json` and `data/*.parquet` from the package.
 Every random draw uses a fixed seed that is printed next to its result.
 
-The corrections these numbers support were prompted by an external deep review of the
-repository (2026-09-21); see the "Corrections" sections of each paper.
+    python research/recompute_corrections.py --theorem-checks   # sections 1-3b only, no data
+    python research/recompute_corrections.py --help
+
+The corrections these numbers support were prompted by external deep reviews of the
+repository (2026-09-21 and 2026-09-26); see the "Corrections" sections of each paper.
 """
 
 import json
@@ -117,6 +122,56 @@ def theorem_d():
     print(f"  T4: 150 lines x 80 bytes = {150 * 80} bytes > 8 KB cap (8192); 8192/150 = {8192 / 150:.1f} bytes/line")
 
 
+def theorem_checks():
+    """Executable sanity checks on Theorem D (2026-09-26 corrections). Each one is an assert."""
+    header("3b. Theorem D sanity checks (asserted; 2026-09-26 corrections)")
+    tol = 1e-12
+
+    # (a) Separately maximal p and q need not be jointly attainable under one policy. The
+    # residual of a policy pi is (1 - p(pi)) * (1 - q(pi)); the target is its minimum over the
+    # joint feasible set F = {(p(pi), q(pi)) : admissible pi}, not the product of the maxima.
+    policies = {"A": (0.5, 0.9), "B": (0.9, 0.1)}
+    residual = {name: (1 - p) * (1 - q) for name, (p, q) in policies.items()}
+    p_max = max(p for p, _ in policies.values())
+    q_max = max(q for _, q in policies.values())
+    naive = (1 - p_max) * (1 - q_max)
+    attained = min(residual.values())
+    for name, (p, q) in policies.items():
+        print(f"  policy {name}: (p, q) = ({p}, {q}) -> residual (1-p)(1-q) = {residual[name]:.4f}")
+    print(f"  separate maxima p_max = {p_max}, q_max = {q_max} -> (1-p_max)(1-q_max) = {naive:.4f}")
+    print(f"  lowest residual any feasible policy attains = {attained:.4f}")
+    assert abs(residual["A"] - 0.05) < tol, residual["A"]
+    assert abs(residual["B"] - 0.09) < tol, residual["B"]
+    assert abs(naive - 0.01) < tol, naive
+    assert naive < attained, "the product of separate maxima is not attained by any policy here"
+    print("  => (1-p_max)(1-q_max) is a LOWER bound on the attainable residual unless the maxima are")
+    print("     jointly attainable; optimise min over F = {(p(pi), q(pi))} of (1-p)(1-q) instead")
+
+    # (b) Over n independent tasks with per-task residuals r_i <= eps,
+    # P(>=1 miss) = 1 - prod(1 - r_i) <= 1 - (1 - eps)^n, with EQUALITY only when every r_i = eps.
+    # Independence alone does not give equality; the union bound n * eps needs neither.
+    eps = 0.01
+    unequal = [0.01, 0.005, 0.001]
+    n = len(unequal)
+    bound = 1 - (1 - eps) ** n
+    p_unequal = 1 - math.prod(1 - r for r in unequal)
+    p_equal = 1 - math.prod(1 - r for r in [eps] * n)
+    print(f"  n={n}, eps={eps}: 1-(1-eps)^n = {bound:.6f}; union bound n*eps = {n * eps:.6f}")
+    print(f"    residuals {unequal}: 1-prod(1-r_i) = {p_unequal:.6f}  (strictly below the bound)")
+    print(f"    residuals all equal to eps: 1-prod(1-r_i) = {p_equal:.6f}  (equality)")
+    assert p_unequal < bound - tol, (p_unequal, bound)
+    assert abs(p_equal - bound) < tol, (p_equal, bound)
+    assert bound <= n * eps + tol, (bound, n * eps)
+
+    # (c) Three lifecycle copies of one classifier are not three independent detectors: the
+    # independence product understates the nested residual (1-p)(1-c) 400-fold (section 2).
+    p, c, k = 0.7, 0.95, 3
+    ratio = ((1 - p) * (1 - c)) / ((1 - p) * (1 - c) ** k)
+    print(f"  {k} copies of one check (p={p}, c={c}): nested / independence-product residual = {ratio:.0f}x")
+    assert round(ratio) == 400, ratio
+    print("  all Theorem D sanity checks passed")
+
+
 # --------------------------------------------------------------------------------------
 # Minimal Parquet reader (flat schema; PLAIN/dictionary; UNCOMPRESSED or SNAPPY)
 # --------------------------------------------------------------------------------------
@@ -344,6 +399,12 @@ def pooled(rows, idx):
     po, pg = pooled(oracle, full), pooled(grep, full)
     print(f"  pooled oracle P/R/F1 = {po[0]:.4f} / {po[1]:.4f} / {po[2]:.4f}")
     print(f"  pooled grep   P/R/F1 = {pg[0]:.4f} / {pg[1]:.4f} / {pg[2]:.4f}")
+    # Repository-level view (added 2026-09-26): macro F1 weights each repository equally, so one
+    # large repository cannot carry the pooled figure. F1 is 0 where a method predicts nothing.
+    f1o = [prf(*oracle[i])[2] for i in full]
+    f1g = [prf(*grep[i])[2] for i in full]
+    print(f"  macro F1 over {len(repos)} repositories: oracle {sum(f1o) / len(f1o):.4f}, grep {sum(f1g) / len(f1g):.4f}")
+    print(f"  repositories where grep F1 > oracle F1: {sum(g > o for o, g in zip(f1o, f1g))} of {len(repos)}")
     rng = random.Random(SEED)
     draws = []
     for _ in range(B):
@@ -484,11 +545,18 @@ def w(i, j):
 
 
 def main():
+    args = sys.argv[1:]
+    if args and args[0] in ("-h", "--help"):
+        print(__doc__)
+        return
     theorem_d()
-    if len(sys.argv) < 2:
+    theorem_checks()
+    if args and args[0] == "--theorem-checks":
+        return
+    if not args:
         print("\n(pass the extracted replication package's repro/ directory to recompute sections 4-9)")
         return
-    pkg = sys.argv[1]
+    pkg = args[0]
     ground_truth(pkg)
     cluster_bootstrap(pkg)
     repaired_vs_grep(pkg)
diff --git a/scripts/build-pages.mjs b/scripts/build-pages.mjs
index 4e774a87..c274a93d 100644
--- a/scripts/build-pages.mjs
+++ b/scripts/build-pages.mjs
@@ -237,7 +237,7 @@ h2{font-size:var(--fs-2);letter-spacing:-.01em;margin:0 0 var(--sp-4)}
 code{font:500 var(--fs-n1) var(--mono);background:var(--panel-2);border:1px solid var(--line);border-radius:var(--r-s);padding:0 var(--sp-2)}
 footer{padding:var(--sp-8) 0;color:var(--faint);font-size:var(--fs-n1)}
 @media(max-width:800px){.grid{grid-template-columns:1fr}}
-</style></head><body><div class="wrap"><header class="nav"><a class="brand" href="../">forge<em>kit</em></a><nav class="links" aria-label="Primary"><a href="../">Landing</a><a href="#quickstart">Quickstart</a><a href="#changes">Latest</a><a href="#sources">Data Sources</a><a href="https://github.com/CodeWithJuber/forgekit">GitHub ↗</a></nav></header><main id="top"><section class="hero" style="border-bottom:0;padding-bottom:0"><p class="eyebrow">${esc(d.name)} · v${esc(d.version)} · Node ${esc(d.node)}</p><h1>Live status, straight from the repository.</h1><p class="lead">${esc(d.description)}</p><p><a class="btn primary" href="#quickstart">Install in 60 seconds</a> <a class="btn" href="https://github.com/CodeWithJuber/forgekit#readme">Read the docs</a></p><div class="meta"><span class="chip">${esc(d.license)} license</span><span class="chip">${esc(d.deps)} runtime dependencies</span><span class="chip">${esc(d.branch)} @ ${esc(d.commit)}</span>${live}</div></section><div class="grid" aria-label="Measured outcomes"><article class="cell"><div class="metric"><em>${esc(d.impact)}</em></div><strong>blast-radius lookup</strong><p class="muted">Measured from this repo's benchmark report, not a marketing placeholder.</p><p class="src">reports/benchmarks.md</p></article><article class="cell"><div class="metric"><em>${esc(d.speed)}</em></div><strong>pre-action gate</strong><p class="muted">Assumptions, routing, reuse, context, impact, scope, and anchoring.</p><p class="src">reports/benchmarks.md</p></article><article class="cell"><div class="metric"><em>${esc(d.saved.match(/^[\d.]+\s*%?/)?.[0] ?? d.saved)}</em></div><strong>${esc(d.saved.replace(/^[\d.]+\s*%?\s*/, "") || "routing signal")}</strong><p class="muted">Documented from the white-paper prototype and exposed by Forge cost reports.</p><p class="src">whitepaper prototype</p></article></div><section id="quickstart"><h2>Quickstart</h2><div class="terminal">npm install -g @codewithjuber/forgekit
+</style></head><body><div class="wrap"><header class="nav"><a class="brand" href="../">forge<em>kit</em></a><nav class="links" aria-label="Primary"><a href="../">Landing</a><a href="#quickstart">Quickstart</a><a href="#changes">Latest</a><a href="#sources">Data Sources</a><a href="https://github.com/CodeWithJuber/forgekit">GitHub ↗</a></nav></header><main id="top"><section class="hero" style="border-bottom:0;padding-bottom:0"><p class="eyebrow">${esc(d.name)} · v${esc(d.version)} · Node ${esc(d.node)}</p><h1>Live status, straight from the repository.</h1><p class="lead">${esc(d.description)}</p><p><a class="btn primary" href="#quickstart">Install in 60 seconds</a> <a class="btn" href="https://github.com/CodeWithJuber/forgekit#readme">Read the docs</a></p><div class="meta"><span class="chip">${esc(d.license)} license</span><span class="chip">${esc(d.deps)} runtime dependencies</span><span class="chip">${esc(d.branch)} @ ${esc(d.commit)}</span>${live}</div></section><div class="grid" aria-label="Measured outcomes"><article class="cell"><div class="metric"><em>${esc(d.impact)}</em></div><strong>blast-radius lookup</strong><p class="muted">Measured from this repo's benchmark report, not a marketing placeholder.</p><p class="src">reports/benchmarks.md</p></article><article class="cell"><div class="metric"><em>${esc(d.speed)}</em></div><strong>pre-action gate</strong><p class="muted">Assumptions, routing, reuse, context, impact, scope, and anchoring.</p><p class="src">reports/benchmarks.md</p></article><article class="cell"><div class="metric"><em>${esc(d.saved.match(/^[\d.]+\s*%?/)?.[0] ?? d.saved)}</em></div><strong>${esc(d.saved.replace(/^[\d.]+\s*%?\s*/, "") || "routing signal")}</strong><p class="muted">Held-out result: on 80 pre-registered tasks the white-paper router spent this much more than always-premium; its 62.1% demo saving is refuted.</p><p class="src">research/empirical-refutation</p></article></div><section id="quickstart"><h2>Quickstart</h2><div class="terminal">npm install -g @codewithjuber/forgekit
 forge init
 forge doctor
 forge substrate "Change auth validation and update tests"</div></section><section id="changes"><h2>Latest repo changes</h2><div class="card"><ul class="list">${d.latest.map((x) => `<li>${esc(x)}</li>`).join("")}</ul><p class="muted">Benchmark sections indexed: ${esc(d.benchMentions)} · benchmarks file updated ${esc(d.benchUpdated)}.</p></div></section><section id="sources"><h2>Data Sources</h2><div class="card"><p class="muted">No mock data is used. This page is regenerated from repository files during CI (generated ${esc(d.generated)} from ${esc(d.commit)}). Enable <code>BUILD_PAGES_LIVE=1</code> to refresh public GitHub counters with ETag/Last-Modified caching.</p><ul class="list"><li>package.json</li><li>README.md</li><li>CHANGELOG.md</li><li>reports/benchmarks.md</li><li>${api} (optional, no auth, only when BUILD_PAGES_LIVE=1)</li></ul></div></section></main><footer>WCAG-minded semantic HTML, keyboard focus, responsive 320px–1920px+, and reduced-motion-safe. Same color and font tokens as the landing page — parity enforced in test/pages.test.js.</footer></div></body></html>`;
diff --git a/scripts/claims-status.mjs b/scripts/claims-status.mjs
new file mode 100644
index 00000000..24d0c8c1
--- /dev/null
+++ b/scripts/claims-status.mjs
@@ -0,0 +1,340 @@
+#!/usr/bin/env node
+/**
+ * The claim/status registry, checked and rendered (node stdlib only).
+ *
+ * `docs/status/claims.json` records every load-bearing headline the project makes — what is
+ * claimed, which component and version it is about, the commit it was assessed against, its
+ * status, and the evidence behind it. This script keeps three things honest:
+ *
+ *   1. the registry itself: required fields, a closed set of statuses, unique ids, a commit
+ *      that looks like one, and evidence paths that exist in the repository;
+ *   2. the status table in `docs/status/README.md`, which is generated from the registry
+ *      between the CLAIMS:BEGIN / CLAIMS:END markers and never edited by hand;
+ *   3. the research copies under `docs/cognitive-substrate/`, which must stay byte-identical
+ *      (sha256) to their canonical sources under `research/cognitive-substrate/`.
+ *
+ * Usage:
+ *   node scripts/claims-status.mjs                  # validate, rewrite the table, check copies
+ *   node scripts/claims-status.mjs --check          # validate + fail on any drift (CI mode)
+ *   node scripts/claims-status.mjs --sync-copies    # re-copy canonical research files first
+ *   node scripts/claims-status.mjs --root <dir>     # operate on another checkout
+ *
+ * Exit codes: 0 ok · 1 invalid registry or drift · 2 usage error.
+ */
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** The closed set of statuses a claim may carry, in display order. */
+export const STATUSES = ["implemented", "measured", "partial", "reported", "hypothesis", "refuted"];
+
+/** Every claim must carry each of these fields. */
+export const REQUIRED_FIELDS = [
+  "id",
+  "claim",
+  "component",
+  "version",
+  "source_commit",
+  "status",
+  "evidence",
+  "notes",
+];
+
+export const REGISTRY_PATH = "docs/status/claims.json";
+export const README_PATH = "docs/status/README.md";
+export const BEGIN = "<!-- CLAIMS:BEGIN (generated by scripts/claims-status.mjs — do not edit) -->";
+export const END = "<!-- CLAIMS:END -->";
+
+/**
+ * Byte-identical copies kept under docs/ for readers there: [copy, canonical source].
+ * `research/` is canonical; `--sync-copies` copies source → copy.
+ * @type {ReadonlyArray<readonly [string, string]>}
+ */
+export const COPY_PAIRS = [
+  [
+    "docs/cognitive-substrate/cognitive_substrate_whitepaper.html",
+    "research/cognitive-substrate/cognitive_substrate_whitepaper.html",
+  ],
+  [
+    "docs/cognitive-substrate/cognitive_substrate_whitepaper.pdf",
+    "research/cognitive-substrate/cognitive_substrate_whitepaper.pdf",
+  ],
+  [
+    "docs/cognitive-substrate/evidence_map.md",
+    "research/cognitive-substrate/evidence/evidence_map.md",
+  ],
+  [
+    "docs/cognitive-substrate/ecosystem_map.md",
+    "research/cognitive-substrate/evidence/ecosystem_map.md",
+  ],
+];
+
+const ID_RE = /^[a-z0-9][a-z0-9-]*$/;
+const COMMIT_RE = /^[0-9a-f]{7,40}$/;
+const URL_RE = /^https?:\/\//;
+
+const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * Validate a parsed registry. Pure apart from optional evidence-path existence checks, which
+ * run only when `root` is given.
+ * @param {any} registry the parsed claims.json
+ * @param {{root?: string|null}} [opts]
+ * @returns {string[]} human-readable problems; empty means valid
+ */
+export function validateRegistry(registry, { root = null } = {}) {
+  const errors = [];
+  if (!registry || typeof registry !== "object" || Array.isArray(registry)) {
+    return ["registry must be a JSON object with a `claims` array"];
+  }
+  if (!Array.isArray(registry.claims) || registry.claims.length === 0) {
+    return ["registry.claims must be a non-empty array"];
+  }
+  const seen = new Set();
+  registry.claims.forEach((c, i) => {
+    const where = `claims[${i}]${c && typeof c.id === "string" ? ` (${c.id})` : ""}`;
+    if (!c || typeof c !== "object" || Array.isArray(c)) {
+      errors.push(`${where}: must be an object`);
+      return;
+    }
+    for (const f of REQUIRED_FIELDS) {
+      if (!(f in c)) errors.push(`${where}: missing required field "${f}"`);
+    }
+    for (const f of ["id", "claim", "component", "version", "source_commit", "status"]) {
+      if (f in c && (typeof c[f] !== "string" || !c[f].trim())) {
+        errors.push(`${where}: "${f}" must be a non-empty string`);
+      }
+    }
+    if ("notes" in c && typeof c.notes !== "string") {
+      errors.push(`${where}: "notes" must be a string`);
+    }
+    if (typeof c.id === "string" && c.id) {
+      if (!ID_RE.test(c.id)) errors.push(`${where}: id must match ${ID_RE}`);
+      if (seen.has(c.id)) errors.push(`${where}: duplicate id "${c.id}"`);
+      seen.add(c.id);
+    }
+    if (typeof c.status === "string" && c.status && !STATUSES.includes(c.status)) {
+      errors.push(`${where}: status "${c.status}" is not one of ${STATUSES.join(", ")}`);
+    }
+    if (typeof c.source_commit === "string" && c.source_commit) {
+      if (!COMMIT_RE.test(c.source_commit)) {
+        errors.push(`${where}: source_commit must be 7-40 lowercase hex characters`);
+      }
+    }
+    if ("evidence" in c) {
+      if (!Array.isArray(c.evidence) || c.evidence.length === 0) {
+        errors.push(`${where}: evidence must be a non-empty array of paths or URLs`);
+      } else {
+        for (const e of c.evidence) {
+          if (typeof e !== "string" || !e.trim()) {
+            errors.push(`${where}: every evidence entry must be a non-empty string`);
+            continue;
+          }
+          if (root && !URL_RE.test(e)) {
+            const rel = e.split("#")[0];
+            if (!existsSync(path.join(root, rel))) {
+              errors.push(`${where}: evidence path not found: ${rel}`);
+            }
+          }
+        }
+      }
+    }
+  });
+  return errors;
+}
+
+/** Escape a value for a single Markdown table cell. */
+const cell = (s) =>
+  String(s ?? "")
+    .replace(/\r?\n/g, " ")
+    .replace(/\|/g, "\\|")
+    .trim();
+
+/**
+ * One evidence entry as a Markdown link: URLs keep their address; repository paths become
+ * links relative to docs/status/README.md.
+ * @param {string} e
+ */
+export function evidenceLink(e) {
+  if (URL_RE.test(e)) {
+    const label = e.replace(URL_RE, "").replace(/\/$/, "");
+    return `[${cell(label)}](${e})`;
+  }
+  return `[\`${cell(e)}\`](../../${e})`;
+}
+
+/**
+ * Render the generated block (without the markers): a status summary and one table row per
+ * claim, in registry order.
+ * @param {any} registry a valid registry
+ * @returns {string}
+ */
+export function renderTable(registry) {
+  const claims = registry.claims;
+  const counts = STATUSES.map((s) => [s, claims.filter((c) => c.status === s).length]);
+  const commits = [...new Set(claims.map((c) => c.source_commit))];
+  const lines = [
+    `${claims.length} claims — ${counts.map(([s, n]) => `${s} ${n}`).join(" · ")}.`,
+    `Assessed against commit${commits.length > 1 ? "s" : ""} ${commits.map((c) => `\`${c.slice(0, 12)}\``).join(", ")}${registry.as_of ? ` (as of ${registry.as_of})` : ""}.`,
+    "",
+    "| ID | Status | Claim | Component · version | Evidence | Notes |",
+    "| --- | --- | --- | --- | --- | --- |",
+  ];
+  for (const c of claims) {
+    lines.push(
+      `| \`${cell(c.id)}\` | **${cell(c.status)}** | ${cell(c.claim)} | ${cell(c.component)} · ${cell(c.version)} | ${c.evidence.map(evidenceLink).join("<br>")} | ${cell(c.notes)} |`,
+    );
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Replace the generated block in the README text.
+ * @param {string} text current README
+ * @param {string} block rendered block (no markers)
+ * @returns {string}
+ */
+export function spliceReadme(text, block) {
+  const begin = text.indexOf(BEGIN);
+  const end = text.indexOf(END);
+  if (begin === -1 || end === -1 || end < begin) {
+    throw new Error(`${README_PATH} must contain the markers ${BEGIN} … ${END}`);
+  }
+  return `${text.slice(0, begin)}${BEGIN}\n${block}\n${text.slice(end)}`;
+}
+
+/** @param {string} file */
+export const sha256File = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+/**
+ * Compare each docs copy with its canonical source.
+ * @param {string} root
+ * @param {ReadonlyArray<readonly [string, string]>} [pairs]
+ * @returns {{copy: string, source: string, ok: boolean, reason: string}[]}
+ */
+export function checkCopies(root, pairs = COPY_PAIRS) {
+  return pairs.map(([copy, source]) => {
+    const c = path.join(root, copy);
+    const s = path.join(root, source);
+    if (!existsSync(s)) return { copy, source, ok: false, reason: "canonical source missing" };
+    if (!existsSync(c)) return { copy, source, ok: false, reason: "copy missing" };
+    const same = sha256File(c) === sha256File(s);
+    return { copy, source, ok: same, reason: same ? "identical" : "sha256 differs" };
+  });
+}
+
+/**
+ * Copy every drifted canonical source over its docs copy.
+ * @param {string} root
+ * @param {ReadonlyArray<readonly [string, string]>} [pairs]
+ * @returns {string[]} the copies rewritten
+ */
+export function syncCopies(root, pairs = COPY_PAIRS) {
+  const written = [];
+  for (const r of checkCopies(root, pairs)) {
+    if (r.ok || r.reason === "canonical source missing") continue;
+    copyFileSync(path.join(root, r.source), path.join(root, r.copy));
+    written.push(r.copy);
+  }
+  return written;
+}
+
+/**
+ * The CLI. Returns an exit code instead of exiting, so tests can drive it.
+ * @param {string[]} argv
+ * @param {{root?: string, pairs?: ReadonlyArray<readonly [string, string]>,
+ *          log?: (s: string) => void, error?: (s: string) => void}} [io]
+ * @returns {number}
+ */
+export function run(argv, io = {}) {
+  const log = io.log ?? ((s) => process.stdout.write(`${s}\n`));
+  const error = io.error ?? ((s) => process.stderr.write(`${s}\n`));
+  let root = io.root ?? DEFAULT_ROOT;
+  const pairs = io.pairs ?? COPY_PAIRS;
+  const flags = new Set();
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--root") {
+      const next = argv[++i];
+      if (!next) {
+        error("--root needs a directory");
+        return 2;
+      }
+      root = path.resolve(next);
+    } else if (a === "--check" || a === "--sync-copies") flags.add(a);
+    else if (a === "--help" || a === "-h") {
+      log(
+        "usage: node scripts/claims-status.mjs [--check] [--sync-copies] [--root <dir>]\n" +
+          "  (no flag)      validate the registry, rewrite the table in docs/status/README.md, check copies\n" +
+          "  --check        validate and fail (exit 1) on a stale table or a drifted docs copy\n" +
+          "  --sync-copies  copy canonical research/ files over drifted docs/ copies first",
+      );
+      return 0;
+    } else {
+      error(`unknown argument: ${a}`);
+      return 2;
+    }
+  }
+  const check = flags.has("--check");
+
+  let registry;
+  try {
+    registry = JSON.parse(readFileSync(path.join(root, REGISTRY_PATH), "utf8"));
+  } catch (e) {
+    error(`cannot read ${REGISTRY_PATH}: ${/** @type {Error} */ (e).message}`);
+    return 1;
+  }
+  const problems = validateRegistry(registry, { root });
+  if (problems.length) {
+    for (const p of problems) error(`registry: ${p}`);
+    return 1;
+  }
+
+  let failed = false;
+  const readmeFile = path.join(root, README_PATH);
+  let current;
+  try {
+    // Compare line content, not line endings: a Windows checkout (core.autocrlf) has CRLF.
+    current = readFileSync(readmeFile, "utf8").replace(/\r\n/g, "\n");
+  } catch (e) {
+    error(`cannot read ${README_PATH}: ${/** @type {Error} */ (e).message}`);
+    return 1;
+  }
+  let expected;
+  try {
+    expected = spliceReadme(current, renderTable(registry));
+  } catch (e) {
+    error(/** @type {Error} */ (e).message);
+    return 1;
+  }
+  if (expected !== current) {
+    if (check) {
+      error(`${README_PATH} is stale — run \`node scripts/claims-status.mjs\` to regenerate it`);
+      failed = true;
+    } else {
+      writeFileSync(readmeFile, expected);
+      log(`rewrote the generated table in ${README_PATH}`);
+    }
+  }
+
+  if (flags.has("--sync-copies") && !check) {
+    for (const c of syncCopies(root, pairs)) log(`re-copied ${c} from its canonical source`);
+  }
+  for (const r of checkCopies(root, pairs)) {
+    if (!r.ok) {
+      error(`copy drift: ${r.copy} vs ${r.source} — ${r.reason} (run with --sync-copies)`);
+      failed = true;
+    }
+  }
+
+  if (failed) return 1;
+  log(
+    `ok: ${registry.claims.length} claims valid, ${README_PATH} current, ${pairs.length} docs copies identical`,
+  );
+  return 0;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exit(run(process.argv.slice(2)));
+}
diff --git a/src/cli.js b/src/cli.js
index 555427f2..71352e6c 100755
--- a/src/cli.js
+++ b/src/cli.js
@@ -6,12 +6,15 @@ import { fileURLToPath } from "node:url";
 // forge — zero-dependency dispatcher. Works identically whether installed via the
 // npm bin, the hardened install.sh symlink, or the Claude Code plugin.
 import { BRAND } from "./brand.js";
+// Domain command handlers live in their own modules (review A03); the presentation helpers
+// every handler shares are defined once in ./cli/shared.js.
+import memoryHandlers from "./cli/memory.js";
+import routingHandlers from "./cli/routing.js";
+import { bar, heading, paint, table } from "./cli/shared.js";
+import verificationHandlers from "./cli/verification.js";
 // The command surface lives in commands.js as data — docs_check.js reconciles the
 // README/GUIDE tables against the same table this help is rendered from.
 import { COMMANDS, commandSummary, GROUPS } from "./commands.js";
-// Color is capability-gated (FORCE_COLOR > NO_COLOR > TERM=dumb > TTY) — piped
-// output stays byte-plain, so nothing downstream ever parses an escape code.
-import { bar, heading as fmtHeading, paint, table } from "./fmt.js";
 import { printCommandHelp } from "./help.js";
 import { suggest } from "./math.js";
 
@@ -39,14 +42,6 @@ function maybeFirstRunHint(cmd) {
   );
 }
 
-// Per-command title lines ("Forge <cmd> — …") are branding chrome, not results. They
-// print only when asked (`--verbose` or FORGE_VERBOSE=1); by default a command emits
-// just its output. The `--help`/`--version` banner is unaffected.
-const VERBOSE = process.argv.includes("--verbose") || process.env.FORGE_VERBOSE === "1";
-const heading = (text) => {
-  if (VERBOSE) console.log(fmtHeading(text));
-};
-
 function printHelp() {
   printVersion();
   console.log(`\n${BRAND.tagline}\n`);
@@ -65,7 +60,7 @@ function printHelp() {
 // Command dispatch table: name → async handler `(argv, cmd) => …`. Populated at module
 // load by the per-command handler declarations below. run() looks a command up here.
 /** @type {Record<string, (argv: string[], cmd: string) => unknown>} */
-const HANDLERS = {};
+const HANDLERS = { ...memoryHandlers, ...verificationHandlers, ...routingHandlers };
 
 async function run(argv) {
   const [cmd] = argv;
@@ -350,6 +345,11 @@ HANDLERS.stack = async (argv) => {
   row("frameworks", s.frameworks);
   row("pkg mgrs", s.packageManagers);
   row("test", s.testCommands);
+  // Runners that are only installed (a devDependency) are inventory, never a required suite.
+  row(
+    "available",
+    (s.testInventory ?? []).filter((c) => !s.testCommands.includes(c)),
+  );
   row("tools", s.tools);
   row("notes", s.notes);
   console.log(`  ${"evidence:".padEnd(11)} ${s.evidence.join(", ")}`);
@@ -718,578 +718,6 @@ HANDLERS.recall = async (argv) => {
   }
   return;
 };
-HANDLERS.ledger = async (argv) => {
-  const ls = await import("./ledger_store.js");
-  const { epochDay, gitAuthor } = await import("./util.js");
-  const root = process.cwd();
-  // --personal targets the ledger beside the global recall store (~/.forge/recall/
-  // ledger) — otherwise facts shadowed by `forge recall add` would be write-only,
-  // with no command able to inspect or verify them.
-  const personal = argv.includes("--personal");
-  const args = argv.filter((a) => a !== "--json" && a !== "--personal");
-  const dir = personal
-    ? (await import("node:path")).join((await import("./recall.js")).defaultStore(), "ledger")
-    : ls.repoLedger(root);
-  const sub = args[1] || "stats";
-  const json = argv.includes("--json");
-  const nowDay = epochDay();
-  if (sub === "stats") {
-    const s = ls.stats(dir, nowDay);
-    if (json) return console.log(JSON.stringify(s, null, 2));
-    heading(`${BRAND.brand} ledger — proof-carrying memory\n`);
-    console.log(`  claims: ${s.total}  (tombstoned ${s.tombstoned})`);
-    for (const [kind, n] of Object.entries(s.byKind)) console.log(`    ${kind}: ${n}`);
-    if (s.pendingRetractions)
-      console.log(
-        paint(
-          `  ${s.pendingRetractions} claim(s) with an agent-proposed retraction — review, then \`forge ledger retract <full id> --reason …\``,
-          "warn",
-        ),
-      );
-    console.log(
-      `  val: ${paint(`trusted ${s.val.trusted}`, "ok")} · ${paint(`uncertain ${s.val.uncertain}`, "warn")} · ${paint(`dormant ${s.val.dormant}`, "dim")}`,
-    );
-    console.log(
-      paint("\n  stored in .forge/ledger/ (git-committable, conflict-free merge)", "dim"),
-    );
-    return;
-  }
-  if (sub === "verify") {
-    // --fix re-addresses claims still stored under their pre-CRLF-fold id. Reads accept
-    // that address either way, so this is not a repair — it is what stops one fact living
-    // at two addresses once a teammate on another platform mints its current form.
-    const migration = args.includes("--fix") ? ls.migrateAddresses(dir) : null;
-    const r = ls.verify(dir);
-    if (json) return console.log(JSON.stringify(migration ? { ...r, migration } : r, null, 2));
-    if (migration) {
-      const { migrated, merged, failed } = migration;
-      console.log(
-        `  migrated ${migrated.length} claim(s) to their current address, merged ${merged.length} into an existing twin${failed.length ? `, ${failed.length} failed` : ""}`,
-      );
-    }
-    console.log(`  ${r.ok ? "OK" : "ISSUES"} — ${r.claims} claim(s), ${r.outcomes} outcome(s)`);
-    for (const i of r.issues) console.log(`    - ${i}`);
-    if (!r.ok) process.exitCode = 1;
-    return;
-  }
-  if (sub === "show") {
-    const id = args[2];
-    const hit = id && id.length >= 2 ? ls.getClaimByPrefix(dir, id, { attic: true }) : null;
-    if (!hit) {
-      console.error(
-        id ? `  no claim matching ${id}` : "usage: forge ledger show <id-prefix (≥2 chars)>",
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const { val } = await import("./ledger.js");
-    const pending = ls.retractionProposals(ls.loadClaims(dir)).get(hit.id);
-    return console.log(
-      JSON.stringify(
-        { ...hit, val: val(hit, nowDay), ...(pending ? { pendingRetractions: pending } : {}) },
-        null,
-        2,
-      ),
-    );
-  }
-  if (sub === "merge") {
-    const src = args[2];
-    const { existsSync } = await import("node:fs");
-    if (!src || !existsSync(src)) {
-      console.error(
-        src
-          ? `  no ledger at ${src}`
-          : "usage: forge ledger merge <path-to-ledger-dir>  (a teammate's checkout, a backup, a worktree)",
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const r = ls.mergeDirs(dir, src);
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    console.log(`  merged: ${r.claims} new claim(s), ${r.records} new record(s) — conflict-free`);
-    if (r.quarantined)
-      console.log(
-        `  quarantined: ${r.quarantined} invalid record(s) (forged hash or unresolvable ref — see quarantine/ in the ledger dir)`,
-      );
-    return;
-  }
-  if (sub === "blame") {
-    const b = args[2] && args[2].length >= 2 ? ls.blame(dir, args[2], nowDay) : null;
-    if (!b) {
-      console.error(
-        args[2] ? `  no claim matching ${args[2]}` : "usage: forge ledger blame <id-prefix>",
-      );
-      process.exitCode = 1;
-      return;
-    }
-    if (json) return console.log(JSON.stringify(b, null, 2));
-    heading(`${BRAND.brand} ledger blame — ${b.kind} ${b.id.slice(0, 12)}\n`);
-    console.log(
-      `  val ${bar(b.val)} ${b.val.toFixed(2)} (trust-weighted ${b.valTrustWeighted.toFixed(2)})`,
-    );
-    for (const p of b.minted)
-      console.log(
-        `  minted  day ${p.t}  by ${p.author || "(unknown)"}${p.agent ? ` · ${p.agent}` : ""}`,
-      );
-    for (const e of b.evidence)
-      console.log(
-        `  ${e.result === "confirm" ? paint("confirm ", "ok") : paint("contradic", "err")}  day ${e.t}  ${e.oracle} → ${e.ref}${e.author ? `  by ${e.author}` : ""}`,
-      );
-    for (const t of b.tombstones)
-      console.log(
-        paint(`  retract  day ${t.t}  ${t.reason}${t.author ? `  by ${t.author}` : ""}`, "dim"),
-      );
-    const trusts = Object.entries(b.trust);
-    if (trusts.length) {
-      console.log("\n  author trust (earned from oracle outcomes on their claims):");
-      for (const [a, u] of trusts) console.log(`    ${u.toFixed(2)}  ${a}`);
-    }
-    return;
-  }
-  // The two writes (08-dashboard-ux.md §2) — CLI twins of the dashboard's POSTs, so
-  // the dashboard stays a convenience, never a requirement. Both append-only.
-  if (sub === "ratify") {
-    const id = args[2];
-    if (!id || id.length < 2) {
-      console.error("usage: forge ledger ratify <id-prefix (≥2 chars)>");
-      process.exitCode = 1;
-      return;
-    }
-    // Human-only promotion: the author is YOUR git identity, minted as a decision claim.
-    const r = ls.ratify(dir, id, { author: gitAuthor(), t: nowDay });
-    if (!r.ok) {
-      console.error(`  ${r.reason}`);
-      process.exitCode = 1;
-      return;
-    }
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    console.log(
-      `  ratified ${r.ratifies.slice(0, 12)} → decision ${r.decisionId.slice(0, 12)}${r.existed ? " (already ratified — same decision)" : ""}`,
-    );
-    return;
-  }
-  if (sub === "retract") {
-    const id = args[2];
-    const ri = args.indexOf("--reason");
-    const reason = ri >= 0 ? (args[ri + 1] ?? "") : "";
-    if (!id || id === "--reason" || !reason) {
-      console.error('usage: forge ledger retract <full claim id> --reason "<why>"');
-      process.exitCode = 1;
-      return;
-    }
-    // A tombstone is permanent, so it must name exactly one claim: the full 64-char id,
-    // never a prefix (a short prefix used to retract the first sorted match).
-    if (!ls.FULL_ID_RE.test(id)) {
-      console.error(
-        `  refused: retract needs the full 64-character claim id (got "${id}") — see \`forge ledger query\` or \`forge ledger show <prefix>\``,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const hit = ls.getClaimByPrefix(dir, id);
-    if (!hit) {
-      console.error(`  no claim matching ${id}`);
-      process.exitCode = 1;
-      return;
-    }
-    const r = ls.tombstone(dir, hit.id, {
-      author: gitAuthor(),
-      reason,
-      t: nowDay,
-    });
-    if (!r.ok) {
-      console.error(`  ${r.reason}`);
-      process.exitCode = 1;
-      return;
-    }
-    if (json) return console.log(JSON.stringify({ ...r, id: hit.id }, null, 2));
-    console.log(
-      `  retracted ${hit.id.slice(0, 12)} — ${reason}${r.deduped ? " (already retracted with this record)" : ""}`,
-    );
-    return;
-  }
-  // `compact` — archive what this ledger's own history says will not be used again, and
-  // near-duplicates, printing every learned number (ledger_retention.js). Reversible.
-  if (sub === "compact") {
-    const dryRun = argv.includes("--dry-run");
-    const r = ls.compactLedger(dir, nowDay, { dryRun });
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    const rt = r.retention;
-    const d = r.duplicates;
-    const lines = [
-      `Forge ledger — compact (every cut-off learned from this ledger)${dryRun ? "  [dry run]" : ""}`,
-      "",
-      `  claims: ${r.claims} · claims with logged use: ${r.servedClaims}`,
-      rt.learned
-        ? `  retention: idle cut-off ${rt.cutoff} d = the longest idle stretch any claim came back from (${rt.comebacks} comebacks, typical gap ${rt.typicalGap} d; usage log spans ${rt.usageSpan} d)`
-        : `  retention: not learned — ${rt.reason}`,
-      d?.boundary != null
-        ? `  duplicates: boundary ${d.boundary.toFixed(2)} (two components beat one: BIC ${d.bic2?.toFixed(1)} < ${d.bic1?.toFixed(1)}) · ${d.groups.length} group(s)`
-        : `  duplicates: none — ${d?.compared ? `one component fits the ${d.compared} nearest-neighbour similarities better` : "fewer than two claims of one kind are still live to compare"}`,
-      "",
-      `  archive: ${r.archive.length}`,
-    ];
-    for (const a of r.archive.slice(0, 20)) lines.push(`    ${a.id.slice(0, 12)}  ${a.reason}`);
-    if (r.archive.length > 20) lines.push(`    … ${r.archive.length - 20} more (--json for all)`);
-    lines.push(
-      "",
-      dryRun
-        ? "  dry run: nothing written"
-        : `  archived ${r.archived.length} claim(s) to .forge/ledger/attic/ — new evidence brings one back; show/blame still read it`,
-    );
-    return console.log(lines.join("\n"));
-  }
-  if (sub === "query") {
-    const q = args.slice(2).join(" ");
-    if (!q) {
-      console.error('usage: forge ledger query "<what you are about to do>"');
-      process.exitCode = 1;
-      return;
-    }
-    const { retrieve, claimText } = await import("./ledger.js");
-    // The embeddings tier (ADR-0005) is assembled HERE, not in ledger.js — the pure
-    // core stays provider-free. No FORGE_EMBED (or a failing provider) → sim is
-    // null and retrieval is the stock MinHash path.
-    const { claimSim, simLabel } = await import("./embed.js");
-    const claims = ls.loadClaims(dir);
-    const sim = claimSim(root, q, claims, claimText);
-    const ranked = retrieve(q, claims, { nowDay, budget: 8, sim });
-    ls.recordUse(
-      dir,
-      ranked.map((r) => r.claim.id),
-      { via: "cli.query", t: nowDay },
-    );
-    if (json)
-      return console.log(
-        JSON.stringify(
-          {
-            sim: simLabel(sim),
-            results: ranked.map((r) => ({
-              id: r.claim.id,
-              kind: r.claim.kind,
-              score: r.score,
-            })),
-          },
-          null,
-          2,
-        ),
-      );
-    console.log(paint(`  sim: ${simLabel(sim)}`, "dim"));
-    if (!ranked.length) return console.log("  no matching live claims");
-    for (const r of ranked)
-      console.log(
-        `  ${bar(r.score, 8)} ${r.score.toFixed(3)}  ${paint(r.claim.kind.padEnd(9), "accent")} ${paint(r.claim.id.slice(0, 8), "dim")}  ${claimText(r.claim).slice(0, 90)}`,
-      );
-    return;
-  }
-  // `at` / `diff` / `root` — the temporal surface. The store is append-only and every
-  // record carries its day, so a past day's beliefs are recomputed, never guessed.
-  const parseDay = (s) => {
-    if (/^\d{1,6}$/.test(s ?? "")) return Number(s); // bare epoch-day
-    const t = Date.parse(`${s}T00:00:00Z`);
-    if (Number.isNaN(t)) return null;
-    // Round-trip check: Date.parse silently rolls impossible dates over (2026-02-31
-    // → March 3rd), which would answer a temporal query for a day nobody asked about.
-    if (new Date(t).toISOString().slice(0, 10) !== s) return null;
-    return Math.floor(t / 86_400_000);
-  };
-  if (sub === "at") {
-    const day = parseDay(args[2]);
-    if (day === null) {
-      console.error(`usage: ${BRAND.cli} ledger at <YYYY-MM-DD | epoch-day> [--json]`);
-      process.exitCode = 1;
-      return;
-    }
-    const lg = await import("./ledger.js");
-    const live = lg.liveClaims(lg.stateAt(ls.loadState(dir), day));
-    const rows = live
-      .map((c) => ({
-        id: c.id,
-        kind: c.kind,
-        val: Number(lg.val(c, day).toFixed(4)),
-        tombstoned: Boolean(c.tombstone),
-        text: lg.claimText(c).slice(0, 90),
-      }))
-      .sort((a, b) => b.val - a.val || (a.id < b.id ? -1 : 1));
-    if (json) return console.log(JSON.stringify({ day, claims: rows.length, rows }, null, 2));
-    heading(`${BRAND.brand} ledger — beliefs as of day ${day}\n`);
-    const byKind = {};
-    for (const r of rows) byKind[r.kind] = (byKind[r.kind] ?? 0) + 1;
-    console.log(
-      `  claims: ${rows.length}  (${rows.filter((r) => r.tombstoned).length} tombstoned)`,
-    );
-    for (const [kind, n] of Object.entries(byKind)) console.log(`    ${kind}: ${n}`);
-    for (const r of rows.slice(0, 10))
-      console.log(
-        `  ${bar(r.val, 8)} ${r.val.toFixed(3)}  ${paint(r.kind.padEnd(9), "accent")} ${paint(r.id.slice(0, 8), "dim")}  ${r.text}`,
-      );
-    return;
-  }
-  if (sub === "diff") {
-    const a = parseDay(args[2]);
-    const b = args[3] ? parseDay(args[3]) : nowDay;
-    if (a === null || b === null) {
-      console.error(
-        `usage: ${BRAND.cli} ledger diff <since: YYYY-MM-DD | epoch-day> [<until>] [--json]`,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    if (a > b) {
-      // beliefDiff's contract is dayA ≤ dayB; a reversed window would print silently
-      // inverted appeared/retired classes, so refuse loudly instead.
-      console.error(`  <since> (day ${a}) is after <until> (day ${b}) — swap the arguments`);
-      process.exitCode = 1;
-      return;
-    }
-    const lg = await import("./ledger.js");
-    const d = lg.beliefDiff(ls.loadState(dir), a, b);
-    if (json) return console.log(JSON.stringify({ since: a, until: b, ...d }, null, 2));
-    heading(`${BRAND.brand} ledger — what changed, day ${a} → ${b}\n`);
-    console.log(
-      `  appeared ${d.appeared.length} · retired ${d.retired.length} · ${paint(`strengthened ${d.strengthened.length}`, "ok")} · ${paint(`weakened ${d.weakened.length}`, "warn")}`,
-    );
-    const row = (label, r) =>
-      console.log(
-        `  ${label}  ${paint(r.kind.padEnd(9), "accent")} ${paint(r.id.slice(0, 8), "dim")}  ${r.from === null ? "· " : r.from.toFixed(2)} → ${r.to === null ? "·" : r.to.toFixed(2)}  ${r.text.slice(0, 70)}`,
-      );
-    for (const r of d.appeared.slice(0, 5)) row(paint("new ", "ok"), r);
-    for (const r of d.retired.slice(0, 5)) row(paint("gone", "err"), r);
-    for (const r of d.strengthened.slice(0, 5)) row(paint("up  ", "ok"), r);
-    for (const r of d.weakened.slice(0, 5)) row(paint("down", "warn"), r);
-    return;
-  }
-  if (sub === "root") {
-    const lg = await import("./ledger.js");
-    const r = lg.stateRoot(ls.loadState(dir));
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    console.log(r.root); // bare hex on stdout — scriptable ("are we in sync?" is one diff)
-    return;
-  }
-  if (sub === "sync") {
-    const { ledgerSync, defaultRef } = await import("./ledger_sync.js");
-    const di = args.indexOf("--dir");
-    const re = args.indexOf("--remote");
-    const rf = args.indexOf("--ref");
-    const r = ledgerSync({
-      dir,
-      root,
-      personal,
-      dirTarget: di >= 0 ? args[di + 1] : undefined,
-      remote: re >= 0 ? args[re + 1] : undefined,
-      ref: rf >= 0 ? args[rf + 1] : undefined,
-    });
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    heading(`${BRAND.brand} ledger sync\n`);
-    if (!r.ok) {
-      console.error(`  ${paint(r.reason ?? "sync failed", "err")}`);
-      process.exitCode = 1;
-      return;
-    }
-    if (r.mode === "dir") {
-      console.log(
-        table([
-          [paint("target", "dim"), r.dir],
-          [paint("pulled", "dim"), `${r.pulled.claims} claim(s), ${r.pulled.records} record(s)`],
-          [
-            paint("pushed", "dim"),
-            r.upToDate
-              ? paint("up to date — state roots match, nothing to merge", "dim")
-              : `${r.pushed.claims} claim(s), ${r.pushed.records} record(s)`,
-          ],
-        ]),
-      );
-    } else {
-      console.log(
-        table([
-          [paint("ref", "dim"), `${r.remote} ${r.ref}`],
-          [paint("pulled", "dim"), `${r.pulled.claims} claim(s), ${r.pulled.records} record(s)`],
-          [
-            paint("pushed", "dim"),
-            r.upToDate
-              ? paint("up to date — nothing to push", "dim")
-              : `yes (retries ${r.retries})`,
-          ],
-        ]),
-      );
-    }
-    for (const n of r.notes ?? []) console.log(paint(`  note: ${n}`, "warn"));
-    if (r.mode === "ref" && r.ref === defaultRef(personal))
-      console.log(paint("\n  synced through a git ref — CRDT, converges in any order", "dim"));
-    return;
-  }
-  if (sub === "import") {
-    const b = await import("./ledger_bridge.js");
-    let r;
-    if (personal) {
-      // Personal import: facts from the global recall store into the personal ledger.
-      const { defaultStore } = await import("./recall.js");
-      r = {
-        lessons: 0,
-        outcomes: 0,
-        ...b.importFacts(defaultStore(), dir, nowDay),
-      };
-    } else {
-      const { brainStore } = await import("./brain.js");
-      r = b.importLegacy(root, {
-        recallStore: brainStore(root),
-        recallLedger: dir,
-        nowDay,
-      });
-    }
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    console.log(`  imported: ${r.lessons} lesson(s), ${r.facts} fact(s), ${r.outcomes} outcome(s)`);
-    for (const x of r.refused) console.log(`    refused: ${x}`);
-    return;
-  }
-  console.error(
-    `ledger: unknown subcommand "${sub}" (stats | verify | show <id> | blame <id> | query <text> | at <date> | diff <since> [<until>] | root | ratify <id> | retract <id> --reason "<why>" | merge <path> | sync [--dir <path>|--remote <name>|--ref <ref>] | import) [--personal] [--json]`,
-  );
-  process.exitCode = 1;
-  return;
-};
-HANDLERS.reuse = async (argv) => {
-  const ru = await import("./reuse.js");
-  const { load: loadAtlas } = await import("./atlas.js");
-  const { epochDay } = await import("./util.js");
-  const root = process.cwd();
-  const nowDay = epochDay();
-  const json = argv.includes("--json");
-  const flagVal = (name) => {
-    const i = argv.indexOf(name);
-    return i >= 0 ? argv[i + 1] : undefined;
-  };
-  const args = argv.filter(
-    (a, i) => !a.startsWith("--") && argv[i - 1] !== "--file" && argv[i - 1] !== "--ref",
-  );
-  const sub = args[1] || "stats";
-  if (sub === "query") {
-    const spec = args.slice(2).join(" ");
-    if (!spec) {
-      console.error('usage: forge reuse query "<what you are about to build>" [--json]');
-      process.exitCode = 1;
-      return;
-    }
-    const r = ru.reuseQuery(root, spec, { atlas: loadAtlas(root), nowDay });
-    if (json)
-      return console.log(
-        JSON.stringify(
-          {
-            tier: r.tier,
-            artifact: r.artifact?.id,
-            jaccard: r.jaccard,
-            similarity: r.similarity,
-            sim: r.sim,
-            reasons: r.reasons,
-          },
-          null,
-          2,
-        ),
-      );
-    console.log(`  sim: ${r.sim}`);
-    if (r.tier === "miss") {
-      console.log("  miss — nothing verified matches; generate, then `forge reuse mint` it");
-    } else {
-      const a = r.artifact;
-      console.log(
-        `  ${r.tier.toUpperCase()} hit (similarity ${(r.similarity ?? r.jaccard ?? 1).toFixed(2)}) — ${a.body.form}${a.body.code?.path ? ` at ${a.body.code.path}` : ""}`,
-      );
-      console.log(
-        `    claim ${a.id.slice(0, 12)} — \`forge ledger blame ${a.id.slice(0, 8)}\` for its proof`,
-      );
-      if (r.tier === "adapt")
-        console.log("    adapt tier: inject as a verified starting point, generate only the delta");
-    }
-    for (const why of r.reasons) console.log(`    note: ${why}`);
-    return;
-  }
-  if (sub === "mint") {
-    const spec = args.slice(2).join(" ");
-    const file = flagVal("--file");
-    const ref = flagVal("--ref");
-    if (!spec || !file) {
-      console.error(
-        'usage: forge reuse mint "<task the code solves>" --file <path> [--ref <test-run/commit>] [--json]',
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const { repoLedger } = await import("./ledger_store.js");
-    const desc = ru.describeFile(root, file);
-    const r = ru.mintArtifact(
-      repoLedger(root),
-      { spec, form: "module", ...desc },
-      ref
-        ? {
-            evidence: { oracle: "test.run", result: "confirm", ref },
-            t: nowDay,
-          }
-        : { t: nowDay },
-    );
-    if (json) return console.log(JSON.stringify(r, null, 2));
-    if (!r.ok) {
-      console.error(`  ${r.reason}`);
-      process.exitCode = 1;
-      return;
-    }
-    console.log(
-      `  minted: ${r.id.slice(0, 12)} (${desc.iface.length} export(s), ${desc.deps.length} dep(s))`,
-    );
-    console.log(
-      r.serves
-        ? "  serving: yes — verification evidence attached"
-        : "  serving: NOT YET — no evidence; attach a verified test/commit ref (--ref) or it stays at the 0.5 prior",
-    );
-    return;
-  }
-  if (sub === "stats") {
-    const { summarize } = await import("./metrics.js");
-    const s = summarize(root).cache ?? {
-      events: 0,
-      byOutcome: {},
-      savedEstimate: 0,
-    };
-    if (json) return console.log(JSON.stringify(s, null, 2));
-    heading(`${BRAND.brand} reuse — proof-carrying code cache\n`);
-    console.log(`  lookups: ${s.events}`);
-    for (const [o, n] of Object.entries(s.byOutcome)) console.log(`    ${o}: ${n}`);
-    console.log(`  est. tokens saved: ${s.savedEstimate}`);
-    return;
-  }
-  console.error(
-    `reuse: unknown subcommand "${sub}" (query <spec> | mint <spec> --file <path> | stats)`,
-  );
-  process.exitCode = 1;
-  return;
-};
-HANDLERS.context = async (argv) => {
-  const { assemble, renderContext } = await import("./context.js");
-  const { load: loadAtlas } = await import("./atlas.js");
-  const { epochDay } = await import("./util.js");
-  const json = argv.includes("--json");
-  const bi = argv.indexOf("--budget");
-  const budget = bi >= 0 ? Number(argv[bi + 1]) || undefined : undefined;
-  const task = argv
-    .filter((a, i) => i > 0 && !a.startsWith("--") && argv[i - 1] !== "--budget")
-    .join(" ");
-  if (!task) {
-    console.error('usage: forge context "<task>" [--budget <tokens>] [--json]');
-    process.exitCode = 1;
-    return;
-  }
-  const r = assemble(process.cwd(), task, {
-    atlas: loadAtlas(process.cwd()),
-    nowDay: epochDay(),
-    ...(budget ? { budget } : {}),
-  });
-  if (json) {
-    const { block, ...rest } = r;
-    return console.log(JSON.stringify(rest, null, 2));
-  }
-  console.log(renderContext(r));
-  if (!r.ok) process.exitCode = 1;
-  return;
-};
 HANDLERS.atlas = async (argv) => {
   const a = await import("./atlas.js");
   const sub = argv[1] || "build";
@@ -1415,127 +843,13 @@ HANDLERS.scan = async (argv) => {
   if (r.critical) process.exitCode = 1;
   return;
 };
-HANDLERS.verify = async (argv) => {
-  const json = argv.includes("--json");
-  if (argv.includes("--deep")) {
-    const { verifyDeep, LENSES } = await import("./consensus.js");
-    // `--llm` opts the reviewer panel in for this run; otherwise FORGE_LLM decides.
-    const r = verifyDeep({
-      targetRoot: process.cwd(),
-      llm: argv.includes("--llm") ? true : undefined,
-    });
-    if (json) {
-      console.log(JSON.stringify(r, null, 2));
-      if (!r.ok) process.exitCode = 1;
-      return;
-    }
-    heading(`${BRAND.brand} verify --deep — multi-lens consensus\n`);
-    console.log(
-      table(
-        r.lenses.map((l) => {
-          const meta = LENSES[l.lens];
-          const state =
-            l.ran === false
-              ? paint("— skipped", "dim")
-              : l.s > 0
-                ? paint("● finding", meta.solo ? "err" : "warn")
-                : paint("✓ clean", "ok");
-          return [l.lens, meta.family, `w=${meta.weight}`, state];
-        }),
-      ),
-    );
-    if (r.findings.length) {
-      console.log();
-      for (const f of r.findings) console.log(`  ! ${f}`);
-    }
-    console.log(
-      `\n  defectRiskScore:  ${bar(r.p)} ${r.p.toFixed(2)} (heuristic, not a calibrated probability)${
-        r.families.length ? `  (families: ${r.families.join(", ")})` : ""
-      }`,
-    );
-    console.log(
-      `  remainingUncheckedWeight: ${r.residual.toFixed(3)} — Theorem-D silent-miss bound (heuristic)`,
-    );
-    // The core tests state, spelled out — deep ok REQUIRES a passing core, so the
-    // reader must see whether a verifier actually ran (RA-01).
-    const t = r.tests ?? /** @type {import("./verify.js").VerifyTests} */ ({ ran: false });
-    console.log(
-      `  tests:            ${t.status ?? "unknown"}${t.runner ? ` (${t.runner})` : ""}${
-        !t.runner && t.detected?.length ? ` (detected: ${t.detected.join(", ")})` : ""
-      }`,
-    );
-    if (t.executed?.length)
-      console.log(
-        `  suites ran:       ${t.executed.map((s) => `${s.label}=${s.status}`).join(", ")}`,
-      );
-    if (t.notExecuted?.length)
-      console.log(`  suites skipped:   ${t.notExecuted.join(", ")} (no built-in executor)`);
-    const detail = t.output || (t.detected ?? []).join(", ");
-    const verdictLine =
-      r.status === "PASS"
-        ? paint("PASS", "ok")
-        : r.status === "NOT_CONFIGURED"
-          ? paint("NOT VERIFIED — no test runner configured (NOT_CONFIGURED)", "warn")
-          : r.status === "INCOMPLETE"
-            ? paint(`NOT VERIFIED — tests incomplete${detail ? ` (${detail})` : ""}`, "warn")
-            : paint("BLOCKED — cross-family consensus says defect", "err");
-    console.log(`\n  ${verdictLine}`);
-    if (!r.ok) process.exitCode = 1;
-    return;
-  }
-  const { verify } = await import("./verify.js");
-  const r = verify({ targetRoot: process.cwd() });
-  if (json) {
-    console.log(JSON.stringify(r, null, 2));
-    if (!r.ok) process.exitCode = 1;
-    return;
-  }
-  heading(`${BRAND.brand} verify\n`);
-  console.log(`  changed files:    ${r.changedFiles.length}`);
-  // Honest four-state tests line (RA-09): "nothing ran" is never dressed up as a pass,
-  // and a real run names the runner that actually executed.
-  const t = r.tests;
-  const testsLine =
-    t.status === "PASS"
-      ? `✓ pass (${t.runner ?? "project suite"})`
-      : t.status === "FAIL"
-        ? `✗ FAIL (${t.runner ?? "project suite"})`
-        : t.status === "INCOMPLETE"
-          ? `— INCOMPLETE: ${t.output || (t.detected ?? []).join(", ") || "test run did not complete"}`
-          : "— NOT CONFIGURED (no test runner detected)";
-  console.log(`  tests:            ${testsLine}`);
-  // Per-suite honesty (HI-01): a polyglot repo runs every executable suite; name which
-  // ones ran with what verdict, and which were detected but never executed.
-  if (t.executed?.length)
-    console.log(
-      `  suites ran:       ${t.executed.map((s) => `${s.label}=${s.status}`).join(", ")}`,
-    );
-  if (t.notExecuted?.length)
-    console.log(`  suites skipped:   ${t.notExecuted.join(", ")} (no built-in executor)`);
-  console.log(`  symbols checked:  ${r.provenance.symbolsChecked}`);
-  if (r.unknown.length)
-    console.log(
-      `  ! not in codebase (possible hallucination): ${r.unknown.slice(0, 12).join(", ")}`,
-    );
-  console.log(`  provenance:       .forge/provenance.json`);
-  // BLOCKED is reserved for a runner that actually FAILED; anything that never ran
-  // to completion is NOT VERIFIED (still exit 1 — unverified is not a pass).
-  const verdict = r.ok
-    ? "PASS"
-    : t.status === "FAIL"
-      ? "BLOCKED — tests failing"
-      : `NOT VERIFIED — ${t.status}`;
-  console.log(`\n  ${verdict}`);
-  if (!r.ok) process.exitCode = 1;
-  return;
-};
-HANDLERS.remember = async (argv) => {
-  const b = await import("./brain.js");
-  const name = argv[1];
-  const body = argv.slice(2).join(" ");
-  if (!name || !body) {
-    console.error('usage: forge remember "<name>" "<fact>"');
-    process.exitCode = 1;
+HANDLERS.remember = async (argv) => {
+  const b = await import("./brain.js");
+  const name = argv[1];
+  const body = argv.slice(2).join(" ");
+  if (!name || !body) {
+    console.error('usage: forge remember "<name>" "<fact>"');
+    process.exitCode = 1;
     return;
   }
   const res = b.remember(b.brainStore(process.cwd()), name, body);
@@ -1574,117 +888,6 @@ HANDLERS.brain = async () => {
   );
   return;
 };
-HANDLERS.cost = async (argv) => {
-  // `--stages` is the P8 measured report (per-stage factors from .forge/metrics.jsonl);
-  // the default path stays the ccusage per-day spend view, untouched.
-  if (argv.includes("--stages")) {
-    const { renderCostReport, report } = await import("./cost_report.js");
-    const r = report(process.cwd());
-    console.log(argv.includes("--json") ? JSON.stringify(r, null, 2) : renderCostReport(r));
-    return;
-  }
-  const { execFileSync } = await import("node:child_process");
-  const run = (bin, args) => execFileSync(bin, args, { encoding: "utf8", stdio: "pipe" });
-  heading(`${BRAND.brand} cost — real per-day spend (ccusage)\n`);
-  try {
-    let out;
-    try {
-      out = run("ccusage", ["daily"]);
-    } catch {
-      // Pinned (verified 2026-07-05) — never @latest for code we execute; re-verify via dev-radar.
-      out = run("npx", ["-y", "ccusage@20.0.14", "daily"]);
-    }
-    console.log(out.trim());
-  } catch {
-    const { estimateSpendFromLogs } = await import("./cost_report.js");
-    const est = estimateSpendFromLogs({ root: process.cwd() });
-    if (est && est.totalCost > 0) {
-      console.log(
-        `  $${est.totalCost.toFixed(2)} estimated from Claude session logs (${est.sessions} session(s))`,
-      );
-      if (est.byModel.length) {
-        for (const m of est.byModel)
-          console.log(
-            `    ${m.model.padEnd(30)} ${m.priced ? `$${m.cost.toFixed(4)}` : "unpriced"}  (${m.inTokens} in / ${m.outTokens} out)${m.priceSource ? ` · price: ${m.priceSource}` : ""}`,
-          );
-      }
-      if (est.unpriced?.length)
-        console.log(
-          paint(
-            `  not in the total — no catalog or snapshot price for: ${est.unpriced.join(", ")}`,
-            "dim",
-          ),
-        );
-      console.log(paint("\n  install ccusage for precise tracking: npm i -g ccusage", "dim"));
-    } else {
-      console.log(
-        "  ccusage not found. Install for real spend (reads local JSONL, nothing leaves your machine):\n    npm i -g ccusage    # then: forge cost",
-      );
-    }
-  }
-  console.log(
-    paint(
-      `\n  ceiling: FORGE_COST_CEILING (default $10) — the cost-budget guard warns when a day exceeds it.`,
-      "dim",
-    ),
-  );
-  return;
-};
-HANDLERS.models = async (argv) => {
-  // What each tier resolves to RIGHT NOW: family → newest model in the active provider's live
-  // catalog (else the shipped snapshot), priced from OpenRouter's catalog (else the snapshot).
-  const { describeResolution, PRICING_VERIFIED, resolveTiers } = await import("./model_tiers.js");
-  const { activeProvider, envModelOverride } = await import("./providers.js");
-  const root = process.cwd();
-  const provider = activeProvider(root);
-  const tiers = resolveTiers({ root, provider });
-  const override = envModelOverride();
-  if (argv.includes("--json"))
-    return console.log(
-      JSON.stringify(
-        { provider: provider.name, override, pricingVerified: PRICING_VERIFIED, tiers },
-        null,
-        2,
-      ),
-    );
-  heading(`${BRAND.brand} models — each tier's family, resolved to a concrete model\n`);
-  console.log(`  provider  ${provider.name} (${provider.label || provider.name})`);
-  if (override)
-    console.log(
-      `  override  ${override} — ANTHROPIC_MODEL/FORGE_MODEL pins every call; the tiers below apply without it`,
-    );
-  const priceText = (p) => (p ? `$${p.inCost}/$${p.outCost}` : "—");
-  const priceFrom = (p) =>
-    !p
-      ? "unpriced"
-      : p.source === "catalog"
-        ? "catalog"
-        : `snapshot${p.basis === "family" ? " (tier)" : ""}`;
-  const width = Math.max(28, ...tiers.map((t) => (t.model?.id ?? "").length + 2));
-  console.log(
-    `\n  ${"tier".padEnd(8)} ${"family".padEnd(7)} ${"model".padEnd(width)} ${"created".padEnd(11)} ${"$/M tok".padEnd(10)} ${"id from".padEnd(9)} price from`,
-  );
-  for (const t of tiers) {
-    console.log(
-      `  ${t.class.padEnd(8)} ${t.family.padEnd(7)} ${(t.model?.id ?? "—").padEnd(width)} ${(t.model?.createdAt?.slice(0, 10) ?? "—").padEnd(11)} ${priceText(t.price).padEnd(10)} ${(t.model?.source ?? "—").padEnd(9)} ${priceFrom(t.price)}`,
-    );
-  }
-  console.log("");
-  for (const t of tiers) console.log(`  ${t.family.padEnd(7)} ${describeResolution(t.model)}`);
-  const live = tiers.find((t) => t.price?.source === "catalog")?.price;
-  console.log(
-    live
-      ? `\n  prices: live from ${live.catalog}${live.cache === "stale" ? " (last cached copy — catalog unreachable)" : ""}`
-      : `\n  prices: shipped snapshot, verified ${PRICING_VERIFIED} (OpenRouter's catalog unavailable or unlisted)`,
-  );
-  console.log(
-    paint(
-      "  cache: .forge/cache/ — reused while the response's own Cache-Control/Expires says fresh, else revalidated (ETag); FORGE_NO_CATALOG_FETCH=1 stays offline",
-      "dim",
-    ),
-  );
-  return;
-};
 HANDLERS.spec = async (argv) => {
   const s = await import("./speclock.js");
   const sub = argv[1] || "check";
@@ -2081,229 +1284,6 @@ HANDLERS.config = async (argv) => {
   process.exitCode = 1;
   return;
 };
-HANDLERS.route = async (argv) => {
-  const r = await import("./route.js");
-  if (argv[1] === "gateway") {
-    const result = r.emitGatewayConfig(process.cwd());
-    if (typeof result === "object" && !result.ok) {
-      console.log(`  ${result.reason}`);
-      return;
-    }
-    console.log(`  wrote ${result} — LiteLLM tiers: forge-simple / forge-medium / forge-complex.`);
-    console.log("  next: pin+install litellm, run it, point ANTHROPIC_BASE_URL at it, then");
-    console.log(
-      "        REQUEST the tier `forge route` recommends (a plain claude-* request passes through).",
-    );
-    return;
-  }
-  if (argv[1] === "calibrate") {
-    // Advisory → gated promotion (ROADMAP): measure whether an affine calibration of the
-    // routing rubric beats the raw rubric on a held-out split of the HAND-LABELLED fixture
-    // (there is no outcome data). Advisory — routing keeps the rubric unless the gate
-    // promotes AND a caller adopts the calibration, which nothing in src/ does.
-    const res = r.calibrateRouting();
-    if (argv.includes("--json")) return console.log(JSON.stringify(res, null, 2));
-    heading(`${BRAND.brand} route calibrate — rubric calibration check (measured gate)\n`);
-    console.log(`  samples: ${res.n} hand-labelled task phrase(s) — no routing outcomes exist`);
-    if (res.baselineMetric !== undefined)
-      console.log(
-        `  held-out MAE: rubric ${res.baselineMetric} · calibrated ${res.candidateMetric}`,
-      );
-    console.log(
-      res.mode === "candidate"
-        ? `  → PROMOTE calibration — ${res.reason} (a=${res.model.a.toFixed(3)}, b=${res.model.b.toFixed(3)})`
-        : `  → keep the rubric — ${res.reason}`,
-    );
-    console.log(
-      "\n  advisory — routing stays on the rubric; nothing adopts a promoted calibration yet,",
-    );
-    console.log("  and calibrating on real routing outcomes needs data forge does not record");
-    return;
-  }
-  if (["universal", "outcome", "fit", "models"].includes(argv[1]) || argv.includes("--universal")) {
-    return routeUniversalCli(argv);
-  }
-  const json = argv.includes("--json");
-  const apply = argv.includes("--apply");
-  const providerIdx = argv.indexOf("--provider");
-  const providerName = providerIdx >= 0 ? argv[providerIdx + 1] : undefined;
-  const FLAGS = new Set(["--json", "--apply"]);
-  const task = argv
-    .slice(1)
-    .filter((a, i) => !FLAGS.has(a) && a !== "--provider" && argv[i] !== "--provider")
-    .join(" ");
-  if (!task) {
-    console.error(
-      'usage: forge route "<task>" [--apply] [--provider <name>] [--json]   |   forge route gateway',
-    );
-    process.exitCode = 1;
-    return;
-  }
-  if (providerName) {
-    const { setProvider } = await import("./providers.js");
-    const sr = setProvider(process.cwd(), providerName);
-    if (!sr.ok) {
-      console.error(`  ${sr.reason}`);
-      process.exitCode = 1;
-      return;
-    }
-  }
-  const rec = r.routeTask(process.cwd(), task);
-  r.meterRoute(process.cwd(), task, rec);
-  // The recommendation is a tier (a model family); its concrete id and price are resolved here,
-  // in the command — routeTask stays network-free because the hooks run it. BOTH output modes
-  // resolve, so a script reading --json never sees a different model than the text prints.
-  const { describeResolution, resolveTierModel, resolveTierPrice } = await import(
-    "./model_tiers.js"
-  );
-  const { activeProvider } = await import("./providers.js");
-  const opts = { root: process.cwd(), provider: activeProvider(process.cwd()) };
-  const resolved = resolveTierModel(rec.key, opts);
-  const price = resolveTierPrice(rec.key, { ...opts, resolved });
-  if (json) {
-    // `model` stays the snapshot row (its shape is public); `resolved` is what would be called.
-    console.log(JSON.stringify({ ...rec, resolved, price }, null, 2));
-  } else {
-    heading(`${BRAND.brand} route — cheapest capable model\n`);
-    const name =
-      resolved?.source === "catalog" && resolved.displayName
-        ? resolved.displayName
-        : rec.model.name;
-    console.log(
-      `  → ${paint(name, "accent")}  (${rec.tier}, ${price ? `${price.inCost}/${price.outCost} per M tok, ${price.source === "catalog" ? "live price" : "current effective"}` : "price unknown"})`,
-    );
-    if (resolved) console.log(`    model: ${resolved.id} — ${describeResolution(resolved)}`);
-    console.log(`    ${rec.model.use}`);
-    console.log(
-      `    complexity ${bar(rec.score, 8)} ${rec.score.toFixed(2)}${rec.reasons.length ? ` · driven by: ${rec.reasons.join(", ")}` : ""}`,
-    );
-    console.log(
-      `    signals: ${rec.signals.files} file(s), fan-out ${rec.signals.fanout}, churn ${rec.signals.churn}, past-mistakes ${rec.signals.pastMistakes}, ambiguity ${rec.signals.ambiguity.toFixed(2)}`,
-    );
-  }
-  if (apply) {
-    const { applyRoute } = await import("./providers.js");
-    const ar = applyRoute(rec.key);
-    if (ar.ok) {
-      if (!json) console.log(`\n  applied: model set to ${ar.model} (${ar.modelId}) in ${ar.path}`);
-    } else {
-      if (!json) console.error(`\n  apply failed: ${ar.reason}`);
-      process.exitCode = 1;
-    }
-  } else if (!json) {
-    console.log(
-      `\n  advisory · apply: \`${BRAND.cli} route "<task>" --apply\` · gateway: \`${BRAND.cli} route gateway\``,
-    );
-  }
-  return;
-};
-// Universal router (src/router): any provider's models, chosen by expected cost for the success
-// probability asked for. Models come from data/models.json and .forge/models.json.
-async function routeUniversalCli(argv) {
-  const U = await import("./router/index.js");
-  const { loadRegistry } = await import("./router/registry.js");
-  const json = argv.includes("--json");
-  const val = (flag) => (argv.includes(flag) ? argv[argv.indexOf(flag) + 1] : undefined);
-  const VALUED = new Set(["--objective", "--provider", "--model", "--cost", "--depth"]);
-  const words = argv
-    .slice(1)
-    .filter((a, i, arr) => !a.startsWith("--") && !VALUED.has(arr[i - 1] ?? ""));
-  const sub = ["outcome", "fit", "models", "universal"].includes(words[0])
-    ? words.shift()
-    : "universal";
-  const root = process.cwd();
-  if (sub === "models") {
-    const reg = loadRegistry(root);
-    const fit = U.loadRouterModel(root);
-    const rows = reg.models.map((m) => ({
-      id: m.id,
-      org: m.org ?? null,
-      status: fit?.models.includes(m.id) ? "fitted" : "cold",
-      providers: Object.keys(m.providers ?? {}),
-      price: m.price_in != null ? `${m.price_in}/${m.price_out}` : null,
-    }));
-    if (json)
-      return console.log(
-        JSON.stringify({ sources: reg.sources, fit: fit?.origin ?? null, models: rows }, null, 2),
-      );
-    heading(`${BRAND.brand} route models — registry (${reg.sources.join(" + ")})\n`);
-    for (const r of rows)
-      console.log(
-        `  ${r.id.padEnd(22)} ${String(r.org ?? "").padEnd(16)} ${r.status.padEnd(7)} ${r.price ? `$${r.price}/Mtok`.padEnd(14) : "".padEnd(14)} ${r.providers.join(", ") || "(no provider id: advice only)"}`,
-      );
-    console.log(`\n  fit in use: ${fit?.origin ?? "none"}`);
-    return;
-  }
-  if (sub === "fit") {
-    const model = U.fitRouter(root);
-    if (json) return console.log(JSON.stringify(model.provenance, null, 2));
-    console.log(
-      `  refit on ${model.provenance.local.outcomes} recorded outcome(s) over ${model.provenance.local.tasks} task(s); wrote .forge/router_model.json`,
-    );
-    return;
-  }
-  const task = words.join(" ");
-  if (!task) {
-    console.error(
-      'usage: forge route universal "<task>" [--objective match-best-single|target:<p>|value:<$>|budget:<$>] [--provider <name>|any] [--depth <n>] [--json]\n' +
-        '       forge route outcome "<task>" --model <id> --pass|--fail [--cost <usd>]\n' +
-        "       forge route fit | forge route models",
-    );
-    process.exitCode = 1;
-    return;
-  }
-  if (sub === "outcome") {
-    const passed = argv.includes("--pass") ? true : argv.includes("--fail") ? false : undefined;
-    const cost = val("--cost") !== undefined ? Number(val("--cost")) : null;
-    try {
-      const row = U.recordOutcome(root, { task, model: val("--model"), passed, cost });
-      if (json) return console.log(JSON.stringify(row, null, 2));
-      console.log(
-        `  recorded ${row.model} ${row.passed ? "pass" : "fail"} for task ${row.task} (.forge/route_outcomes.jsonl)`,
-      );
-    } catch (e) {
-      console.error(`  ${e.message}`);
-      process.exitCode = 1;
-    }
-    return;
-  }
-  let rec;
-  try {
-    rec = U.routeUniversal(root, task, {
-      objective: val("--objective"),
-      provider: val("--provider") ?? "any",
-      maxDepth: val("--depth") ? Number(val("--depth")) : undefined,
-    });
-  } catch (e) {
-    console.error(`  ${e.message}`);
-    process.exitCode = 1;
-    return;
-  }
-  if (json) return console.log(JSON.stringify(rec, null, 2));
-  if (!rec.ok) {
-    console.error(`  ${rec.reason}`);
-    process.exitCode = 1;
-    return;
-  }
-  heading(
-    `${BRAND.brand} route universal — ${rec.objective.kind}${rec.target != null ? ` (target ${rec.target.toFixed(2)})` : ""}\n`,
-  );
-  rec.cascade.forEach((c, i) => {
-    console.log(
-      `  ${i === 0 ? "→" : "then, if a check fails →"} ${paint(c.model, "accent")}  P(solve alone) ${c.pSolveAlone.toFixed(2)} · ~$${c.expectedAttemptCost.toFixed(3)}/attempt${c.status === "cold" ? " · cold (no outcomes yet)" : ""}`,
-    );
-  });
-  console.log(
-    `\n  P(success) ${rec.pSuccess.toFixed(2)} · expected cost $${rec.expectedCost.toFixed(3)} · best single: ${rec.bestSingle.model} ${rec.bestSingle.pSuccess.toFixed(2)} at $${rec.bestSingle.expectedCost.toFixed(3)}`,
-  );
-  console.log(
-    `  ${rec.candidates} candidate model(s), ${rec.cascadesEvaluated} cascade(s) compared · fit: ${rec.fit.origin}`,
-  );
-  console.log(
-    `  learn from results: \`${BRAND.cli} route outcome "<task>" --model <id> --pass|--fail --cost <usd>\`, then \`${BRAND.cli} route fit\``,
-  );
-}
-
 HANDLERS.anchor = async (argv) => {
   const { goalDrift, renderAnchor } = await import("./anchor.js");
   const { clearGoal, getGoal, setGoal } = await import("./goal.js");
@@ -2495,90 +1475,6 @@ HANDLERS.diagnose = async (argv) => {
   }
   return; // advisory — halting the retry loop is the AGENT's move, not an exit code
 };
-HANDLERS.imagine = async (argv) => {
-  const { dryRun, imagineTask, renderImagine } = await import("./imagine.js");
-  const json = argv.includes("--json");
-  const doRun = argv.includes("--run");
-  const allowDirty = argv.includes("--allow-dirty");
-  const FLAGS = new Set(["--json", "--run", "--allow-dirty"]);
-  const task = argv
-    .slice(1)
-    .filter((a) => !FLAGS.has(a))
-    .join(" ");
-  if (!task) {
-    console.error('usage: forge imagine "<task>" [--run] [--allow-dirty] [--json]');
-    process.exitCode = 1;
-    return;
-  }
-  const root = process.cwd();
-  const r = imagineTask(root, task);
-  if (!doRun) {
-    console.log(json ? JSON.stringify(r, null, 2) : renderImagine(r));
-    return;
-  }
-  // --run: the static prediction first (always), then the measured half. The sandbox
-  // is a git worktree of HEAD — uncommitted changes are INVISIBLE to it — so a dirty
-  // tree is refused by default rather than silently dry-running the wrong code.
-  if (!json) console.log(renderImagine(r, { footer: false }));
-  if (!allowDirty) {
-    let dirty = "";
-    try {
-      const { execFileSync } = await import("node:child_process");
-      dirty = execFileSync("git", ["status", "--porcelain"], {
-        cwd: root,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim();
-    } catch {} // not a repo / no git → dryRun reports its own precondition failure
-    if (dirty) {
-      console.error(
-        "\n  imagine --run refused: the working tree is dirty and the sandbox runs HEAD,\n" +
-          "  so your uncommitted changes would NOT be in the dry-run. Commit or stash them,\n" +
-          "  or pass --allow-dirty to knowingly measure the last commit instead.",
-      );
-      process.exitCode = 1;
-      return;
-    }
-  }
-  const d = dryRun(root, { tests: r.tests });
-  // Metrics are best-effort telemetry (05-cost-model.md) — never let recording
-  // failure break the verdict. Only a run that happened is worth counting.
-  try {
-    if (d.durationMs !== undefined) {
-      const { record } = await import("./metrics.js");
-      record(root, {
-        stage: "imagine",
-        outcome: d.ok && d.failed === 0 ? "clean" : "breaks",
-        ref: task.slice(0, 120),
-        durationMs: d.durationMs,
-      });
-    }
-  } catch {}
-  if (json) {
-    console.log(JSON.stringify({ ...r, dryRun: d }, null, 2));
-    return;
-  }
-  if (!d.ok) {
-    console.log(`\n  dry-run: did not produce a verdict — ${d.reason}`);
-    if (d.output) console.log(`\n${d.output.replace(/^/gm, "    ")}`);
-    process.exitCode = 1;
-    return;
-  }
-  console.log(`\n  dry-run (sandboxed worktree of HEAD · ${d.runner}):`);
-  console.log(
-    `    pass ${d.passed} · fail ${d.failed} · ${d.durationMs}ms · worktree ${d.worktree}`,
-  );
-  if (d.perFile)
-    for (const [t, s] of Object.entries(d.perFile))
-      console.log(`    ${s === "pass" ? "ok  " : "FAIL"} ${t}`);
-  if (d.failed > 0) {
-    console.log("\n  measured consequence: the selected suite BREAKS at HEAD — output tail:");
-    console.log(`\n${(d.output || "").replace(/^/gm, "    ")}`);
-  } else {
-    console.log("\n  measured consequence: the selected suite is green at HEAD.");
-  }
-  return;
-};
 HANDLERS.lean = async (argv) => {
   const { leanRepo, renderLean } = await import("./lean.js");
   const json = argv.includes("--json");
@@ -2634,349 +1530,6 @@ HANDLERS.scope = async (argv) => {
   return;
 };
 /** The last line of a `uicheck design|visual` run, per overall verdict. */
-const VERDICT_LABEL = {
-  pass: "✓ PASS",
-  fail: "✗ FAIL",
-  "insufficient-signal": "✗ INSUFFICIENT SIGNAL — nothing measurable, so this is not a PASS",
-};
-HANDLERS.uicheck = async (argv) => {
-  const sub = argv[1];
-  if (sub === "visual") {
-    // The Playwright visual loop (spec §5): render in a real browser, fingerprint
-    // the COMPUTED styles, run the same design gate. Playwright is an optional
-    // tier (ADR-0005) — its absence is a note and exit 0, never a failure.
-    const { visualGate } = await import("./uivisual.js");
-    const args = argv.slice(2);
-    const tasteIdx = args.indexOf("--taste");
-    const tasteArg = tasteIdx >= 0 ? (args.splice(tasteIdx, 2)[1] ?? null) : null;
-    const json = args.includes("--json");
-    const remote = args.includes("--remote");
-    const targets = args.filter((a) => !a.startsWith("--"));
-    if (targets.length !== 1 || (tasteIdx >= 0 && !tasteArg)) {
-      console.error(
-        `usage: ${BRAND.cli} uicheck visual <file-or-url> [--taste <name>] [--json] [--remote]`,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const r = await visualGate(targets[0], {
-      taste: tasteArg,
-      remote,
-      root: process.cwd(),
-    });
-    if (!r.ok) {
-      const reason = "reason" in r ? r.reason : "visual gate failed";
-      if ("skipped" in r && r.skipped) {
-        // Graceful absence (ADR-0005): a missing optional tier is not a failure.
-        if (json) console.log(JSON.stringify({ skipped: true, reason }, null, 2));
-        else {
-          heading(`${BRAND.brand} uicheck visual — skipped (no browser runtime)\n`);
-          console.log(`  ${reason}`);
-          console.log(
-            "  enable it: npm i -D playwright-core   (or point FORGE_PLAYWRIGHT at an existing install, e.g. FORGE_PLAYWRIGHT=/path/to/node_modules/playwright-core)",
-          );
-        }
-        return; // exit 0 — the static gate still stands
-      }
-      console.error(reason);
-      process.exitCode = 1;
-      return;
-    }
-    // The completion gate's UI evidence (a skipped run never reaches here, so a missing
-    // browser can never count as a PASS).
-    const { recordUiCheck } = await import("./gate.js");
-    recordUiCheck(process.cwd(), { check: "visual", pass: !r.fail });
-    if (json) {
-      const { ok: _ok, fail: _fail, ...body } = r;
-      console.log(JSON.stringify(body, null, 2));
-    } else {
-      heading(`${BRAND.brand} uicheck visual — rendered fingerprint + design gate\n`);
-      console.log(`  rendered:      ${r.url} (${r.elements} visible element style(s))`);
-      console.log(`  screenshots:   ${r.screenshots.join(", ")}`);
-      if (r.taste) console.log(`  taste:         ${r.taste} (thresholds from its profile)`);
-      console.log(
-        `  slop distance: ${r.slop}  (need ≥ ${r.tauSlop} — farther from generic is better)`,
-      );
-      console.log(
-        r.hasProjectFingerprint
-          ? `  conformance:   ${r.conform}  (need ≤ ${r.tauConform} — closer to the project system is better)`
-          : `  conformance:   (no project fingerprint claim — slop-only; mint one: \`${BRAND.cli} uicheck fingerprint <ui files> --mint\`)`,
-      );
-      for (const v of r.violations) console.log(`\n  ✗ ${v.detail}\n    fix: ${v.hint}`);
-      console.log("");
-      for (const c of r.checks)
-        console.log(
-          `  ${c.pass ? "✓" : "✗"} ${c.id}: ${c.detail}${c.pass || !c.hint ? "" : `\n    fix: ${c.hint}`}`,
-        );
-      console.log(`\n  ${VERDICT_LABEL[r.verdict]}`);
-    }
-    if (r.fail) process.exitCode = 1;
-    return;
-  }
-  if (sub === "interact") {
-    // The Playwright interaction loop (ROADMAP "Next"): drive the page and check what
-    // it DOES — keyboard reach, a visible focus ring, console cleanliness, reduced-
-    // motion honesty. Advisory by default (the `behavioral` oracle is cross-family-
-    // gated); --enforce or FORGE_ENFORCE=1 turns a fail into a non-zero exit. Playwright
-    // is an optional tier (ADR-0005) — its absence is a note and exit 0, never a failure.
-    const { runInteractions, recordInteraction } = await import("./uiinteract.js");
-    const args = argv.slice(2);
-    const json = args.includes("--json");
-    const remote = args.includes("--remote");
-    const record = args.includes("--record");
-    const enforce = args.includes("--enforce") || process.env.FORGE_ENFORCE === "1";
-    const targets = args.filter((a) => !a.startsWith("--"));
-    if (targets.length !== 1) {
-      console.error(
-        `usage: ${BRAND.cli} uicheck interact <file-or-url> [--record] [--enforce] [--json] [--remote]`,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const r = await runInteractions(targets[0], {
-      remote,
-      cwd: process.cwd(),
-    });
-    if (!r.ok) {
-      const reason = "reason" in r ? r.reason : "interaction run failed";
-      if ("skipped" in r && r.skipped) {
-        // Graceful absence (ADR-0005): a missing optional tier is not a failure.
-        if (json) console.log(JSON.stringify({ skipped: true, reason }, null, 2));
-        else {
-          heading(`${BRAND.brand} uicheck interact — skipped (no browser runtime)\n`);
-          console.log(`  ${reason}`);
-          console.log(
-            "  enable it: npm i -D playwright-core   (or point FORGE_PLAYWRIGHT at an existing install)",
-          );
-        }
-        return; // exit 0 — the advisory tier is absent
-      }
-      console.error(reason);
-      process.exitCode = 1;
-      return;
-    }
-    const recorded = record ? recordInteraction(process.cwd(), r.url, r.verdict) : null;
-    if (json) {
-      console.log(JSON.stringify({ url: r.url, ...r.verdict, recorded }, null, 2));
-    } else {
-      heading(`${BRAND.brand} uicheck interact — browser interaction checks\n`);
-      console.log(`  driven:        ${r.url} (headless, prefers-reduced-motion)`);
-      for (const c of r.verdict.checks) console.log(`  ${c.ok ? "✓" : "✗"} ${c.id}: ${c.detail}`);
-      console.log(`\n  ${r.verdict.pass ? "✓ PASS" : "✗ FAIL"}${enforce ? "" : "  (advisory)"}`);
-      if (recorded)
-        console.log(
-          recorded.recorded
-            ? `  recorded as behavioral evidence on design claim ${recorded.claimId.slice(0, 12)}`
-            : `  not recorded: ${recorded.reason}`,
-        );
-    }
-    if (!r.verdict.pass && enforce) process.exitCode = 1;
-    return;
-  }
-  if (sub === "fingerprint" || sub === "design") {
-    const ui = await import("./uifingerprint.js");
-    // `--taste <name>` (design only) takes a VALUE — splice it out before the
-    // file filter so the profile name is never mistaken for a file.
-    const args = argv.slice(2);
-    const tasteIdx = args.indexOf("--taste");
-    const tasteArg = tasteIdx >= 0 ? (args.splice(tasteIdx, 2)[1] ?? null) : null;
-    // `--theme <file>` (repeatable) names the Tailwind theme sources explicitly;
-    // without it they are discovered (@theme / @tailwind stylesheets, tailwind.config.*).
-    /** @type {string[]} */
-    const themeArgs = [];
-    let themeMissing = false;
-    for (let i = args.indexOf("--theme"); i >= 0; i = args.indexOf("--theme")) {
-      const [, value] = args.splice(i, 2);
-      if (!value || value.startsWith("--")) themeMissing = true;
-      else themeArgs.push(value);
-    }
-    const json = args.includes("--json");
-    const files = args.filter((a) => !a.startsWith("--"));
-    if (!files.length || (tasteIdx >= 0 && !tasteArg) || themeMissing) {
-      console.error(
-        `usage: ${BRAND.cli} uicheck ${sub} <file...> [--theme <css|tailwind.config>]... [--json]${sub === "fingerprint" ? " [--mint]" : " [--taste <name>]"}`,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    // An explicitly named theme that isn't there is an error, not a silent no-op.
-    const { existsSync } = await import("node:fs");
-    const { resolve } = await import("node:path");
-    const absent = themeArgs.filter((t) => !existsSync(resolve(process.cwd(), t)));
-    if (absent.length) {
-      console.error(`theme source not found: ${absent.join(", ")}`);
-      process.exitCode = 1;
-      return;
-    }
-    const theme = ui.loadThemeTokens(
-      process.cwd(),
-      ui.themeSourcesFor(process.cwd(), files, themeArgs),
-    );
-    const themeLine = theme.sources.length
-      ? `${theme.sources.join(", ")} (${theme.colors.size} color · ${theme.radius.size} radius · ${theme.shadow.size} shadow token(s))`
-      : "(none found — token utilities like rounded-card / bg-brand stay unresolved; name one with --theme <file>)";
-    const themeSummary = {
-      sources: theme.sources,
-      colors: theme.colors.size,
-      radius: theme.radius.size,
-      shadow: theme.shadow.size,
-    };
-    const fp = ui.fingerprintFiles(process.cwd(), files, { theme });
-    if (sub === "fingerprint") {
-      let minted = null;
-      if (argv.includes("--mint")) {
-        const { epochDay } = await import("./util.js");
-        minted = ui.mintProjectFingerprint(process.cwd(), files, {
-          t: epochDay(),
-          theme,
-        });
-      }
-      if (json) {
-        console.log(JSON.stringify(minted ? { fingerprint: fp, minted } : fp, null, 2));
-      } else {
-        heading(`${BRAND.brand} uicheck fingerprint — the design feature vector\n`);
-        console.log(
-          `  palette:  ${fp.paletteSize} color(s), hue bins [${fp.hueBuckets.join(" ")}]`,
-        );
-        console.log(
-          `  spacing:  ${fp.spacing.join(", ") || "(none)"} px — base ${fp.spacingBase ?? "(none)"}, ${Math.round(fp.spacingOnScale * 100)}% on-scale`,
-        );
-        console.log(`  type:     ${fp.fontFamilies.join(", ") || "(none)"}`);
-        console.log(
-          `  shape:    radii ${fp.radii.join(", ") || "(none)"} (${fp.radiusLevels} level(s)) · ${fp.shadowLevels} shadow level(s)`,
-        );
-        console.log(`  theme:    ${themeLine}`);
-        if (!ui.hasDesignSignal(fp))
-          console.log(
-            "\n  ! no measurable design feature in these files — `design` reports insufficient-signal",
-          );
-        if (minted) {
-          if (minted.ok)
-            console.log(
-              `\n  minted fingerprint claim ${minted.id.slice(0, 12)}${minted.existed ? " (already in ledger)" : ""} — the gate's "home"`,
-            );
-          else console.error(`\n  mint failed: ${"reason" in minted ? minted.reason : ""}`);
-        }
-      }
-      if (minted && !minted.ok) process.exitCode = 1;
-      return;
-    }
-    // design — the two-sided gate: fail when too close to generic OR (when the
-    // project has minted its fingerprint) too far from the project's own system.
-    // A taste profile (explicit --taste, else the style pinned by a
-    // `forge taste`-managed DESIGN.md) overrides thresholds + adds its checks.
-    const tasteName = tasteArg ?? ui.activeTasteStyle(process.cwd());
-    const profile = tasteName ? ui.loadTasteProfile(tasteName) : null;
-    if (tasteArg && !profile) {
-      // Explicit --taste must exist; an auto-picked style without a JSON sibling
-      // silently falls back to defaults (custom prose styles stay legal).
-      console.error(
-        `unknown taste profile "${tasteArg}" — run \`${BRAND.cli} taste\` to list styles`,
-      );
-      process.exitCode = 1;
-      return;
-    }
-    const projectFp = ui.loadProjectFingerprint(process.cwd());
-    const tauSlop = profile?.gate?.tau_slop ?? ui.UI_GATE_DEFAULTS.tauSlop;
-    const tauConform = profile?.gate?.tau_conform ?? ui.UI_GATE_DEFAULTS.tauConform;
-    const gate = ui.uiGate(fp, { projectFp, tauSlop, tauConform });
-    const checks = [...ui.scaleChecks(fp), ...(profile ? ui.profileChecks(fp, profile) : [])];
-    // insufficient-signal (an empty vector) exits non-zero like FAIL: nothing was
-    // measured, so nothing passed.
-    const verdict = ui.overallVerdict(gate, checks);
-    // The completion gate's UI evidence: this verdict, bound to the current code state.
-    // Only a real PASS counts; an empty measurement is not evidence.
-    const { recordUiCheck } = await import("./gate.js");
-    recordUiCheck(process.cwd(), { check: "design", pass: verdict === "pass", files });
-    if (json) {
-      console.log(
-        JSON.stringify(
-          {
-            ...gate,
-            verdict,
-            checks,
-            hasProjectFingerprint: !!projectFp,
-            taste: profile ? tasteName : null,
-            tauSlop,
-            tauConform,
-            theme: themeSummary,
-          },
-          null,
-          2,
-        ),
-      );
-    } else {
-      heading(`${BRAND.brand} uicheck design — slop distance + project conformance\n`);
-      if (profile) console.log(`  taste:         ${tasteName} (thresholds from its profile)`);
-      console.log(`  theme:         ${themeLine}`);
-      if (verdict !== "insufficient-signal") {
-        console.log(
-          `  slop distance: ${gate.slop}  (need ≥ ${tauSlop} — farther from generic is better)`,
-        );
-        console.log(
-          projectFp
-            ? `  conformance:   ${gate.conform}  (need ≤ ${tauConform} — closer to the project system is better)`
-            : `  conformance:   (no project fingerprint claim — slop-only; mint one: \`${BRAND.cli} uicheck fingerprint <ui files> --mint\`)`,
-        );
-      }
-      for (const v of gate.violations) console.log(`\n  ✗ ${v.detail}\n    fix: ${v.hint}`);
-      if (verdict !== "insufficient-signal") {
-        console.log("");
-        for (const c of checks)
-          console.log(
-            `  ${c.pass ? "✓" : "✗"} ${c.id}: ${c.detail}${c.pass || !c.hint ? "" : `\n    fix: ${c.hint}`}`,
-          );
-      }
-      console.log(`\n  ${VERDICT_LABEL[verdict]}`);
-    }
-    if (verdict !== "pass") process.exitCode = 1;
-    return;
-  }
-  const { contrastReport, ASSERTABLE_CHECKS, ADVISORY_ONLY } = await import("./uicheck.js");
-  // `uicheck contrast <fg> <bg>` is the named form; bare `uicheck <fg> <bg>` stays
-  // supported (it predates the subcommands and hooks already call it). Both exit 1
-  // when the pair fails AA — a failing contrast must fail the script that asked.
-  const args = argv.slice(sub === "contrast" ? 2 : 1);
-  const json = args.includes("--json");
-  const large = args.includes("--large");
-  const colors = args.filter((a) => !a.startsWith("--"));
-  if (sub === "contrast" && colors.length !== 2) {
-    console.error(
-      `usage: ${BRAND.cli} uicheck contrast <fg> <bg> [--large] [--json]   (colors: #hex[alpha], rgb(), hsl(), oklch(), oklab())`,
-    );
-    process.exitCode = 1;
-    return;
-  }
-  const [fg, bg] = colors;
-  /** @type {ReturnType<typeof contrastReport>|null} */
-  let r = null;
-  if (fg && bg) {
-    try {
-      r = contrastReport(fg, bg, { large });
-    } catch (e) {
-      if (json) console.log(JSON.stringify({ error: e.message }, null, 2));
-      else console.error(`  ${e.message}`);
-      process.exitCode = 1;
-      return;
-    }
-    if (!r.passesAA) process.exitCode = 1;
-    if (json) {
-      console.log(JSON.stringify(r, null, 2));
-      return;
-    }
-  }
-  heading(`${BRAND.brand} uicheck — deterministic UI review\n`);
-  if (r) {
-    const kind = large ? "large text / UI" : "normal text";
-    console.log(
-      `  contrast ${fg} on ${bg}: ${r.ratio}:1  →  ${r.level}${r.passesAA ? ` (passes AA for ${kind})` : ` (FAILS AA — ${kind} needs ${r.required.aa}:1)`}`,
-    );
-    for (const n of r.notes) console.log(`  note: ${n}`);
-  }
-  console.log(`\n  ASSERT (deterministic): ${ASSERTABLE_CHECKS.map((c) => c.id).join(", ")}`);
-  console.log(`  ADVISE (subjective, human-only): ${ADVISORY_ONLY.slice(0, 4).join(", ")} …`);
-  return;
-};
 HANDLERS.report = async (argv) => {
   // Static twin of `dash`: emit ONE self-contained HTML file (no server, opens
   // offline) instead of serving a live localhost lens. `--out <path>` overrides the
diff --git a/src/cli/memory.js b/src/cli/memory.js
new file mode 100644
index 00000000..30c1849f
--- /dev/null
+++ b/src/cli/memory.js
@@ -0,0 +1,611 @@
+// forge CLI — the evidence-referenced memory commands — `ledger`, `reuse`, `context`. Moved verbatim out of src/cli.js (review A03: command dispatch
+// and presentation are separated from domain operations; each domain's handlers live in one
+// module, and the domain logic stays in the modules they import). cli.js registers these into
+// its dispatch table; nothing here runs at import time.
+import { BRAND, bar, heading, paint, table } from "./shared.js";
+
+/** @type {Record<string, (argv: string[], cmd: string) => unknown>} */
+const HANDLERS = {};
+
+HANDLERS.ledger = async (argv) => {
+  const ls = await import("../ledger_store.js");
+  const { epochDay, gitAuthor } = await import("../util.js");
+  const root = process.cwd();
+  // --personal targets the ledger beside the global recall store (~/.forge/recall/
+  // ledger) — otherwise facts shadowed by `forge recall add` would be write-only,
+  // with no command able to inspect or verify them.
+  const personal = argv.includes("--personal");
+  const args = argv.filter((a) => a !== "--json" && a !== "--personal");
+  const dir = personal
+    ? (await import("node:path")).join((await import("../recall.js")).defaultStore(), "ledger")
+    : ls.repoLedger(root);
+  const sub = args[1] || "stats";
+  const json = argv.includes("--json");
+  const nowDay = epochDay();
+  if (sub === "stats") {
+    const s = ls.stats(dir, nowDay);
+    if (json) return console.log(JSON.stringify(s, null, 2));
+    heading(`${BRAND.brand} ledger — proof-carrying memory\n`);
+    console.log(`  claims: ${s.total}  (tombstoned ${s.tombstoned})`);
+    for (const [kind, n] of Object.entries(s.byKind)) console.log(`    ${kind}: ${n}`);
+    if (s.pendingRetractions)
+      console.log(
+        paint(
+          `  ${s.pendingRetractions} claim(s) with an agent-proposed retraction — review, then \`forge ledger retract <full id> --reason …\``,
+          "warn",
+        ),
+      );
+    console.log(
+      `  val: ${paint(`trusted ${s.val.trusted}`, "ok")} · ${paint(`uncertain ${s.val.uncertain}`, "warn")} · ${paint(`dormant ${s.val.dormant}`, "dim")}`,
+    );
+    console.log(
+      paint("\n  stored in .forge/ledger/ (git-committable, conflict-free merge)", "dim"),
+    );
+    return;
+  }
+  if (sub === "verify") {
+    // --fix re-addresses claims still stored under their pre-CRLF-fold id. Reads accept
+    // that address either way, so this is not a repair — it is what stops one fact living
+    // at two addresses once a teammate on another platform mints its current form.
+    // `--fix --dry-run` previews the migration without writing (A11).
+    const migration = args.includes("--fix")
+      ? ls.migrateAddresses(dir, { dryRun: argv.includes("--dry-run") })
+      : null;
+    const r = ls.verify(dir);
+    if (json) return console.log(JSON.stringify(migration ? { ...r, migration } : r, null, 2));
+    if (migration) {
+      const { migrated, merged, failed } = migration;
+      console.log(
+        `  ${migration.dryRun ? "(dry run) would migrate" : "migrated"} ${migrated.length} claim(s) to their current address, ${migration.dryRun ? "would merge" : "merged"} ${merged.length} into an existing twin${failed.length ? `, ${failed.length} failed` : ""}`,
+      );
+    }
+    console.log(`  ${r.ok ? "OK" : "ISSUES"} — ${r.claims} claim(s), ${r.outcomes} outcome(s)`);
+    for (const i of r.issues) console.log(`    - ${i}`);
+    if (!r.ok) process.exitCode = 1;
+    return;
+  }
+  if (sub === "show") {
+    const id = args[2];
+    const hit = id && id.length >= 2 ? ls.getClaimByPrefix(dir, id, { attic: true }) : null;
+    if (!hit) {
+      console.error(
+        id ? `  no claim matching ${id}` : "usage: forge ledger show <id-prefix (≥2 chars)>",
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const { val } = await import("../ledger.js");
+    const pending = ls.retractionProposals(ls.loadClaims(dir)).get(hit.id);
+    return console.log(
+      JSON.stringify(
+        { ...hit, val: val(hit, nowDay), ...(pending ? { pendingRetractions: pending } : {}) },
+        null,
+        2,
+      ),
+    );
+  }
+  if (sub === "merge") {
+    const src = args[2];
+    const { existsSync } = await import("node:fs");
+    if (!src || !existsSync(src)) {
+      console.error(
+        src
+          ? `  no ledger at ${src}`
+          : "usage: forge ledger merge <path-to-ledger-dir>  (a teammate's checkout, a backup, a worktree)",
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const r = ls.mergeDirs(dir, src);
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    console.log(`  merged: ${r.claims} new claim(s), ${r.records} new record(s) — conflict-free`);
+    if (r.quarantined)
+      console.log(
+        `  quarantined: ${r.quarantined} invalid record(s) (forged hash or unresolvable ref — see quarantine/ in the ledger dir)`,
+      );
+    return;
+  }
+  if (sub === "blame") {
+    const b = args[2] && args[2].length >= 2 ? ls.blame(dir, args[2], nowDay) : null;
+    if (!b) {
+      console.error(
+        args[2] ? `  no claim matching ${args[2]}` : "usage: forge ledger blame <id-prefix>",
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (json) return console.log(JSON.stringify(b, null, 2));
+    heading(`${BRAND.brand} ledger blame — ${b.kind} ${b.id.slice(0, 12)}\n`);
+    console.log(
+      `  val ${bar(b.val)} ${b.val.toFixed(2)} (trust-weighted ${b.valTrustWeighted.toFixed(2)})`,
+    );
+    for (const p of b.minted)
+      console.log(
+        `  minted  day ${p.t}  by ${p.author || "(unknown)"}${p.agent ? ` · ${p.agent}` : ""}`,
+      );
+    for (const e of b.evidence)
+      console.log(
+        `  ${e.result === "confirm" ? paint("confirm ", "ok") : paint("contradic", "err")}  day ${e.t}  ${e.oracle} → ${e.ref}${e.author ? `  by ${e.author}` : ""}`,
+      );
+    for (const t of b.tombstones)
+      console.log(
+        paint(`  retract  day ${t.t}  ${t.reason}${t.author ? `  by ${t.author}` : ""}`, "dim"),
+      );
+    const trusts = Object.entries(b.trust);
+    if (trusts.length) {
+      console.log("\n  author trust (earned from oracle outcomes on their claims):");
+      for (const [a, u] of trusts) console.log(`    ${u.toFixed(2)}  ${a}`);
+    }
+    return;
+  }
+  // The two writes (08-dashboard-ux.md §2) — CLI twins of the dashboard's POSTs, so
+  // the dashboard stays a convenience, never a requirement. Both append-only.
+  if (sub === "ratify") {
+    const id = args[2];
+    if (!id || id.length < 2) {
+      console.error("usage: forge ledger ratify <id-prefix (≥2 chars)>");
+      process.exitCode = 1;
+      return;
+    }
+    // Human-only promotion: the author is YOUR git identity, minted as a decision claim.
+    const r = ls.ratify(dir, id, { author: gitAuthor(), t: nowDay });
+    if (!r.ok) {
+      console.error(`  ${r.reason}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    console.log(
+      `  ratified ${r.ratifies.slice(0, 12)} → decision ${r.decisionId.slice(0, 12)}${r.existed ? " (already ratified — same decision)" : ""}`,
+    );
+    return;
+  }
+  if (sub === "retract") {
+    const id = args[2];
+    const ri = args.indexOf("--reason");
+    const reason = ri >= 0 ? (args[ri + 1] ?? "") : "";
+    if (!id || id === "--reason" || !reason) {
+      console.error('usage: forge ledger retract <full claim id> --reason "<why>"');
+      process.exitCode = 1;
+      return;
+    }
+    // A tombstone is permanent, so it must name exactly one claim: the full 64-char id,
+    // never a prefix (a short prefix used to retract the first sorted match).
+    if (!ls.FULL_ID_RE.test(id)) {
+      console.error(
+        `  refused: retract needs the full 64-character claim id (got "${id}") — see \`forge ledger query\` or \`forge ledger show <prefix>\``,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const hit = ls.getClaimByPrefix(dir, id);
+    if (!hit) {
+      console.error(`  no claim matching ${id}`);
+      process.exitCode = 1;
+      return;
+    }
+    const r = ls.tombstone(dir, hit.id, {
+      author: gitAuthor(),
+      reason,
+      t: nowDay,
+    });
+    if (!r.ok) {
+      console.error(`  ${r.reason}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (json) return console.log(JSON.stringify({ ...r, id: hit.id }, null, 2));
+    console.log(
+      `  retracted ${hit.id.slice(0, 12)} — ${reason}${r.deduped ? " (already retracted with this record)" : ""}`,
+    );
+    return;
+  }
+  // `compact` — archive what this ledger's own history says will not be used again, and
+  // near-duplicates, printing every learned number (ledger_retention.js). Reversible.
+  if (sub === "compact") {
+    const dryRun = argv.includes("--dry-run");
+    const r = ls.compactLedger(dir, nowDay, { dryRun });
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    const rt = r.retention;
+    const d = r.duplicates;
+    const lines = [
+      `Forge ledger — compact (every cut-off learned from this ledger)${dryRun ? "  [dry run]" : ""}`,
+      "",
+      `  claims: ${r.claims} · claims with logged use: ${r.servedClaims}`,
+      rt.learned
+        ? `  retention: idle cut-off ${rt.cutoff} d = the longest idle stretch any claim came back from (${rt.comebacks} comebacks, typical gap ${rt.typicalGap} d; usage log spans ${rt.usageSpan} d)`
+        : `  retention: not learned — ${rt.reason}`,
+      d?.boundary != null
+        ? `  duplicates: boundary ${d.boundary.toFixed(2)} (two components beat one: BIC ${d.bic2?.toFixed(1)} < ${d.bic1?.toFixed(1)}) · ${d.groups.length} group(s)`
+        : `  duplicates: none — ${d?.compared ? `one component fits the ${d.compared} nearest-neighbour similarities better` : "fewer than two claims of one kind are still live to compare"}`,
+      "",
+      `  archive: ${r.archive.length}`,
+    ];
+    for (const a of r.archive.slice(0, 20)) lines.push(`    ${a.id.slice(0, 12)}  ${a.reason}`);
+    if (r.archive.length > 20) lines.push(`    … ${r.archive.length - 20} more (--json for all)`);
+    // Similar-but-opposite pairs are never archived as duplicates (review F16): a person decides.
+    const conflicts = d?.conflicts ?? [];
+    if (conflicts.length) {
+      lines.push(
+        "",
+        `  kept apart — similar but conflicting (review, then retract one): ${conflicts.length}`,
+      );
+      for (const c of conflicts.slice(0, 10))
+        lines.push(`    ${c.a.slice(0, 12)} ↔ ${c.b.slice(0, 12)}  ${c.conflicts}`);
+    }
+    lines.push(
+      "",
+      dryRun
+        ? "  dry run: nothing written"
+        : `  archived ${r.archived.length} claim(s) to .forge/ledger/attic/ — new evidence brings one back; show/blame still read it`,
+    );
+    return console.log(lines.join("\n"));
+  }
+  if (sub === "query") {
+    const q = args.slice(2).join(" ");
+    if (!q) {
+      console.error('usage: forge ledger query "<what you are about to do>"');
+      process.exitCode = 1;
+      return;
+    }
+    const { retrieve, claimText } = await import("../ledger.js");
+    // The embeddings tier (ADR-0005) is assembled HERE, not in ledger.js — the pure
+    // core stays provider-free. No FORGE_EMBED (or a failing provider) → sim is
+    // null and retrieval is the stock MinHash path.
+    const { claimSim, simLabel } = await import("../embed.js");
+    const claims = ls.loadClaims(dir);
+    const sim = claimSim(root, q, claims, claimText);
+    const ranked = retrieve(q, claims, { nowDay, budget: 8, sim });
+    ls.recordUse(
+      dir,
+      ranked.map((r) => r.claim.id),
+      { via: "cli.query", t: nowDay },
+    );
+    if (json)
+      return console.log(
+        JSON.stringify(
+          {
+            sim: simLabel(sim),
+            results: ranked.map((r) => ({
+              id: r.claim.id,
+              kind: r.claim.kind,
+              score: r.score,
+            })),
+          },
+          null,
+          2,
+        ),
+      );
+    console.log(paint(`  sim: ${simLabel(sim)}`, "dim"));
+    if (!ranked.length) return console.log("  no matching live claims");
+    for (const r of ranked)
+      console.log(
+        `  ${bar(r.score, 8)} ${r.score.toFixed(3)}  ${paint(r.claim.kind.padEnd(9), "accent")} ${paint(r.claim.id.slice(0, 8), "dim")}  ${claimText(r.claim).slice(0, 90)}`,
+      );
+    return;
+  }
+  // `at` / `diff` / `root` — the temporal surface. The store is append-only and every
+  // record carries its day, so a past day's beliefs are recomputed, never guessed.
+  const parseDay = (s) => {
+    if (/^\d{1,6}$/.test(s ?? "")) return Number(s); // bare epoch-day
+    const t = Date.parse(`${s}T00:00:00Z`);
+    if (Number.isNaN(t)) return null;
+    // Round-trip check: Date.parse silently rolls impossible dates over (2026-02-31
+    // → March 3rd), which would answer a temporal query for a day nobody asked about.
+    if (new Date(t).toISOString().slice(0, 10) !== s) return null;
+    return Math.floor(t / 86_400_000);
+  };
+  if (sub === "at") {
+    const day = parseDay(args[2]);
+    if (day === null) {
+      console.error(`usage: ${BRAND.cli} ledger at <YYYY-MM-DD | epoch-day> [--json]`);
+      process.exitCode = 1;
+      return;
+    }
+    const lg = await import("../ledger.js");
+    const live = lg.liveClaims(lg.stateAt(ls.loadState(dir), day));
+    const rows = live
+      .map((c) => ({
+        id: c.id,
+        kind: c.kind,
+        val: Number(lg.val(c, day).toFixed(4)),
+        tombstoned: Boolean(c.tombstone),
+        text: lg.claimText(c).slice(0, 90),
+      }))
+      .sort((a, b) => b.val - a.val || (a.id < b.id ? -1 : 1));
+    if (json) return console.log(JSON.stringify({ day, claims: rows.length, rows }, null, 2));
+    heading(`${BRAND.brand} ledger — beliefs as of day ${day}\n`);
+    const byKind = {};
+    for (const r of rows) byKind[r.kind] = (byKind[r.kind] ?? 0) + 1;
+    console.log(
+      `  claims: ${rows.length}  (${rows.filter((r) => r.tombstoned).length} tombstoned)`,
+    );
+    for (const [kind, n] of Object.entries(byKind)) console.log(`    ${kind}: ${n}`);
+    for (const r of rows.slice(0, 10))
+      console.log(
+        `  ${bar(r.val, 8)} ${r.val.toFixed(3)}  ${paint(r.kind.padEnd(9), "accent")} ${paint(r.id.slice(0, 8), "dim")}  ${r.text}`,
+      );
+    return;
+  }
+  if (sub === "diff") {
+    const a = parseDay(args[2]);
+    const b = args[3] ? parseDay(args[3]) : nowDay;
+    if (a === null || b === null) {
+      console.error(
+        `usage: ${BRAND.cli} ledger diff <since: YYYY-MM-DD | epoch-day> [<until>] [--json]`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (a > b) {
+      // beliefDiff's contract is dayA ≤ dayB; a reversed window would print silently
+      // inverted appeared/retired classes, so refuse loudly instead.
+      console.error(`  <since> (day ${a}) is after <until> (day ${b}) — swap the arguments`);
+      process.exitCode = 1;
+      return;
+    }
+    const lg = await import("../ledger.js");
+    const d = lg.beliefDiff(ls.loadState(dir), a, b);
+    if (json) return console.log(JSON.stringify({ since: a, until: b, ...d }, null, 2));
+    heading(`${BRAND.brand} ledger — what changed, day ${a} → ${b}\n`);
+    console.log(
+      `  appeared ${d.appeared.length} · retired ${d.retired.length} · ${paint(`strengthened ${d.strengthened.length}`, "ok")} · ${paint(`weakened ${d.weakened.length}`, "warn")}`,
+    );
+    const row = (label, r) =>
+      console.log(
+        `  ${label}  ${paint(r.kind.padEnd(9), "accent")} ${paint(r.id.slice(0, 8), "dim")}  ${r.from === null ? "· " : r.from.toFixed(2)} → ${r.to === null ? "·" : r.to.toFixed(2)}  ${r.text.slice(0, 70)}`,
+      );
+    for (const r of d.appeared.slice(0, 5)) row(paint("new ", "ok"), r);
+    for (const r of d.retired.slice(0, 5)) row(paint("gone", "err"), r);
+    for (const r of d.strengthened.slice(0, 5)) row(paint("up  ", "ok"), r);
+    for (const r of d.weakened.slice(0, 5)) row(paint("down", "warn"), r);
+    return;
+  }
+  if (sub === "root") {
+    const lg = await import("../ledger.js");
+    const r = lg.stateRoot(ls.loadState(dir));
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    console.log(r.root); // bare hex on stdout — scriptable ("are we in sync?" is one diff)
+    return;
+  }
+  if (sub === "sync") {
+    const { ledgerSync, defaultRef } = await import("../ledger_sync.js");
+    const di = args.indexOf("--dir");
+    const re = args.indexOf("--remote");
+    const rf = args.indexOf("--ref");
+    const r = ledgerSync({
+      dir,
+      root,
+      personal,
+      dirTarget: di >= 0 ? args[di + 1] : undefined,
+      remote: re >= 0 ? args[re + 1] : undefined,
+      ref: rf >= 0 ? args[rf + 1] : undefined,
+    });
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    heading(`${BRAND.brand} ledger sync\n`);
+    if (!r.ok) {
+      console.error(`  ${paint(r.reason ?? "sync failed", "err")}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (r.mode === "dir") {
+      console.log(
+        table([
+          [paint("target", "dim"), r.dir],
+          [paint("pulled", "dim"), `${r.pulled.claims} claim(s), ${r.pulled.records} record(s)`],
+          [
+            paint("pushed", "dim"),
+            r.upToDate
+              ? paint("up to date — state roots match, nothing to merge", "dim")
+              : `${r.pushed.claims} claim(s), ${r.pushed.records} record(s)`,
+          ],
+        ]),
+      );
+    } else {
+      console.log(
+        table([
+          [paint("ref", "dim"), `${r.remote} ${r.ref}`],
+          [paint("pulled", "dim"), `${r.pulled.claims} claim(s), ${r.pulled.records} record(s)`],
+          [
+            paint("pushed", "dim"),
+            r.upToDate
+              ? paint("up to date — nothing to push", "dim")
+              : `yes (retries ${r.retries})`,
+          ],
+        ]),
+      );
+    }
+    for (const n of r.notes ?? []) console.log(paint(`  note: ${n}`, "warn"));
+    if (r.mode === "ref" && r.ref === defaultRef(personal))
+      console.log(paint("\n  synced through a git ref — CRDT, converges in any order", "dim"));
+    return;
+  }
+  if (sub === "import") {
+    const b = await import("../ledger_bridge.js");
+    let r;
+    if (personal) {
+      // Personal import: facts from the global recall store into the personal ledger.
+      const { defaultStore } = await import("../recall.js");
+      r = {
+        lessons: 0,
+        outcomes: 0,
+        ...b.importFacts(defaultStore(), dir, nowDay),
+      };
+    } else {
+      const { brainStore } = await import("../brain.js");
+      r = b.importLegacy(root, {
+        recallStore: brainStore(root),
+        recallLedger: dir,
+        nowDay,
+      });
+    }
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    console.log(`  imported: ${r.lessons} lesson(s), ${r.facts} fact(s), ${r.outcomes} outcome(s)`);
+    for (const x of r.refused) console.log(`    refused: ${x}`);
+    return;
+  }
+  console.error(
+    `ledger: unknown subcommand "${sub}" (stats | verify | show <id> | blame <id> | query <text> | at <date> | diff <since> [<until>] | root | ratify <id> | retract <id> --reason "<why>" | merge <path> | sync [--dir <path>|--remote <name>|--ref <ref>] | import) [--personal] [--json]`,
+  );
+  process.exitCode = 1;
+  return;
+};
+
+HANDLERS.reuse = async (argv) => {
+  const ru = await import("../reuse.js");
+  const { load: loadAtlas } = await import("../atlas.js");
+  const { epochDay } = await import("../util.js");
+  const root = process.cwd();
+  const nowDay = epochDay();
+  const json = argv.includes("--json");
+  const flagVal = (name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : undefined;
+  };
+  const args = argv.filter(
+    (a, i) => !a.startsWith("--") && argv[i - 1] !== "--file" && argv[i - 1] !== "--ref",
+  );
+  const sub = args[1] || "stats";
+  if (sub === "query") {
+    const spec = args.slice(2).join(" ");
+    if (!spec) {
+      console.error('usage: forge reuse query "<what you are about to build>" [--json]');
+      process.exitCode = 1;
+      return;
+    }
+    const r = ru.reuseQuery(root, spec, { atlas: loadAtlas(root), nowDay });
+    if (json)
+      return console.log(
+        JSON.stringify(
+          {
+            tier: r.tier,
+            artifact: r.artifact?.id,
+            jaccard: r.jaccard,
+            similarity: r.similarity,
+            sim: r.sim,
+            revalidation: r.revalidation?.status,
+            requiresRevalidation: r.requiresRevalidation === true,
+            reasons: r.reasons,
+          },
+          null,
+          2,
+        ),
+      );
+    console.log(`  sim: ${r.sim}`);
+    if (r.tier === "miss") {
+      console.log("  miss — nothing verified matches; generate, then `forge reuse mint` it");
+    } else {
+      const a = r.artifact;
+      console.log(
+        `  ${r.tier.toUpperCase()} hit (similarity ${(r.similarity ?? r.jaccard ?? 1).toFixed(2)}) — ${a.body.form}${a.body.code?.path ? ` at ${a.body.code.path}` : ""}`,
+      );
+      console.log(
+        `    claim ${a.id.slice(0, 12)} — \`forge ledger blame ${a.id.slice(0, 8)}\` for its proof`,
+      );
+      if (r.tier === "near")
+        console.log("    near tier: a reworded match — review the diff before reusing it as-is");
+      if (r.tier === "adapt")
+        console.log("    adapt tier: inject as a verified starting point, generate only the delta");
+      if (r.requiresRevalidation)
+        console.log(
+          `    NOT revalidated: ${(r.revalidation?.unknown ?? []).join(", ")} — check before use`,
+        );
+    }
+    for (const why of r.reasons) console.log(`    note: ${why}`);
+    return;
+  }
+  if (sub === "mint") {
+    const spec = args.slice(2).join(" ");
+    const file = flagVal("--file");
+    const ref = flagVal("--ref");
+    if (!spec || !file) {
+      console.error(
+        'usage: forge reuse mint "<task the code solves>" --file <path> [--ref <test-run/commit>] [--json]',
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const { repoLedger } = await import("../ledger_store.js");
+    // With an atlas, each dependency's declaration is fingerprinted, so a later signature
+    // change invalidates the artifact (review F05).
+    const desc = ru.describeFile(root, file, { atlas: loadAtlas(root) });
+    const r = ru.mintArtifact(
+      repoLedger(root),
+      { spec, form: "module", ...desc },
+      ref
+        ? {
+            evidence: { oracle: "test.run", result: "confirm", ref },
+            t: nowDay,
+          }
+        : { t: nowDay },
+    );
+    if (json) return console.log(JSON.stringify(r, null, 2));
+    if (!r.ok) {
+      console.error(`  ${r.reason}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(
+      `  minted: ${r.id.slice(0, 12)} (${desc.iface.length} export(s), ${desc.deps.length} dep(s))`,
+    );
+    console.log(
+      r.serves
+        ? "  serving: yes — verification evidence attached"
+        : "  serving: NOT YET — no evidence; attach a verified test/commit ref (--ref) or it stays at the 0.5 prior",
+    );
+    return;
+  }
+  if (sub === "stats") {
+    const { summarize } = await import("../metrics.js");
+    const s = summarize(root).cache ?? {
+      events: 0,
+      byOutcome: {},
+      savedEstimate: 0,
+    };
+    if (json) return console.log(JSON.stringify(s, null, 2));
+    heading(`${BRAND.brand} reuse — proof-carrying code cache\n`);
+    console.log(`  lookups: ${s.events}`);
+    for (const [o, n] of Object.entries(s.byOutcome)) console.log(`    ${o}: ${n}`);
+    console.log(`  est. tokens saved: ${s.savedEstimate}`);
+    return;
+  }
+  console.error(
+    `reuse: unknown subcommand "${sub}" (query <spec> | mint <spec> --file <path> | stats)`,
+  );
+  process.exitCode = 1;
+  return;
+};
+
+HANDLERS.context = async (argv) => {
+  const { assemble, renderContext } = await import("../context.js");
+  const { load: loadAtlas } = await import("../atlas.js");
+  const { epochDay } = await import("../util.js");
+  const json = argv.includes("--json");
+  const bi = argv.indexOf("--budget");
+  const budget = bi >= 0 ? Number(argv[bi + 1]) || undefined : undefined;
+  const task = argv
+    .filter((a, i) => i > 0 && !a.startsWith("--") && argv[i - 1] !== "--budget")
+    .join(" ");
+  if (!task) {
+    console.error('usage: forge context "<task>" [--budget <tokens>] [--json]');
+    process.exitCode = 1;
+    return;
+  }
+  const r = assemble(process.cwd(), task, {
+    atlas: loadAtlas(process.cwd()),
+    nowDay: epochDay(),
+    ...(budget ? { budget } : {}),
+  });
+  // --block delivers the assembled context itself — the spans the summary talks about (R13).
+  const withBlock = argv.includes("--block");
+  if (json) {
+    const { block, ...rest } = r;
+    console.log(JSON.stringify(withBlock ? r : rest, null, 2));
+  } else if (withBlock) {
+    console.log(r.block);
+  } else console.log(renderContext(r));
+  if (!r.ok) process.exitCode = 1;
+  return;
+};
+
+export default HANDLERS;
diff --git a/src/cli/routing.js b/src/cli/routing.js
new file mode 100644
index 00000000..02d92004
--- /dev/null
+++ b/src/cli/routing.js
@@ -0,0 +1,381 @@
+// forge CLI — the routing and cost commands — `route` (incl. `route universal`), `models`, `cost`. Moved verbatim out of src/cli.js (review A03: command dispatch
+// and presentation are separated from domain operations; each domain's handlers live in one
+// module, and the domain logic stays in the modules they import). cli.js registers these into
+// its dispatch table; nothing here runs at import time.
+import { BRAND, bar, heading, paint } from "./shared.js";
+
+/** @type {Record<string, (argv: string[], cmd: string) => unknown>} */
+const HANDLERS = {};
+
+HANDLERS.cost = async (argv) => {
+  // `--stages` is the P8 measured report (per-stage factors from .forge/metrics.jsonl);
+  // the default path stays the ccusage per-day spend view, untouched.
+  if (argv.includes("--stages")) {
+    const { renderCostReport, report } = await import("../cost_report.js");
+    const r = report(process.cwd());
+    console.log(argv.includes("--json") ? JSON.stringify(r, null, 2) : renderCostReport(r));
+    return;
+  }
+  const { execFileSync } = await import("node:child_process");
+  const run = (bin, args) => execFileSync(bin, args, { encoding: "utf8", stdio: "pipe" });
+  heading(`${BRAND.brand} cost — real per-day spend (ccusage)\n`);
+  try {
+    let out;
+    try {
+      out = run("ccusage", ["daily"]);
+    } catch {
+      // Pinned (verified 2026-07-05) — never @latest for code we execute; re-verify via dev-radar.
+      out = run("npx", ["-y", "ccusage@20.0.14", "daily"]);
+    }
+    console.log(out.trim());
+  } catch {
+    const { estimateSpendFromLogs } = await import("../cost_report.js");
+    const est = estimateSpendFromLogs({ root: process.cwd() });
+    if (est && est.totalCost > 0) {
+      console.log(
+        `  $${est.totalCost.toFixed(2)} estimated from Claude session logs (${est.sessions} session(s))`,
+      );
+      if (est.byModel.length) {
+        for (const m of est.byModel)
+          console.log(
+            `    ${m.model.padEnd(30)} ${m.priced ? `$${m.cost.toFixed(4)}` : "unpriced"}  (${m.inTokens} in / ${m.outTokens} out)${m.priceSource ? ` · price: ${m.priceSource}` : ""}`,
+          );
+      }
+      if (est.unpriced?.length)
+        console.log(
+          paint(
+            `  not in the total — no catalog or snapshot price for: ${est.unpriced.join(", ")}`,
+            "dim",
+          ),
+        );
+      console.log(paint("\n  install ccusage for precise tracking: npm i -g ccusage", "dim"));
+    } else {
+      console.log(
+        "  ccusage not found. Install for real spend (reads local JSONL, nothing leaves your machine):\n    npm i -g ccusage    # then: forge cost",
+      );
+    }
+  }
+  console.log(
+    paint(
+      `\n  ceiling: FORGE_COST_CEILING (default $10) — the cost-budget guard warns when a day exceeds it.`,
+      "dim",
+    ),
+  );
+  return;
+};
+
+HANDLERS.models = async (argv) => {
+  // What each tier resolves to RIGHT NOW: family → newest model in the active provider's live
+  // catalog (else the shipped snapshot), priced from OpenRouter's catalog (else the snapshot).
+  const { describeResolution, PRICING_VERIFIED, resolveTiers } = await import("../model_tiers.js");
+  const { activeProvider, envModelOverride } = await import("../providers.js");
+  const root = process.cwd();
+  const provider = activeProvider(root);
+  const tiers = resolveTiers({ root, provider });
+  const override = envModelOverride();
+  if (argv.includes("--json"))
+    return console.log(
+      JSON.stringify(
+        { provider: provider.name, override, pricingVerified: PRICING_VERIFIED, tiers },
+        null,
+        2,
+      ),
+    );
+  heading(`${BRAND.brand} models — each tier's family, resolved to a concrete model\n`);
+  console.log(`  provider  ${provider.name} (${provider.label || provider.name})`);
+  if (override)
+    console.log(
+      `  override  ${override} — ANTHROPIC_MODEL/FORGE_MODEL pins every call; the tiers below apply without it`,
+    );
+  const priceText = (p) => (p ? `$${p.inCost}/$${p.outCost}` : "—");
+  const priceFrom = (p) =>
+    !p
+      ? "unpriced"
+      : p.source === "catalog"
+        ? "catalog"
+        : `snapshot${p.basis === "family" ? " (tier)" : ""}`;
+  const width = Math.max(28, ...tiers.map((t) => (t.model?.id ?? "").length + 2));
+  console.log(
+    `\n  ${"tier".padEnd(8)} ${"family".padEnd(7)} ${"model".padEnd(width)} ${"created".padEnd(11)} ${"$/M tok".padEnd(10)} ${"id from".padEnd(9)} price from`,
+  );
+  for (const t of tiers) {
+    console.log(
+      `  ${t.class.padEnd(8)} ${t.family.padEnd(7)} ${(t.model?.id ?? "—").padEnd(width)} ${(t.model?.createdAt?.slice(0, 10) ?? "—").padEnd(11)} ${priceText(t.price).padEnd(10)} ${(t.model?.source ?? "—").padEnd(9)} ${priceFrom(t.price)}`,
+    );
+  }
+  console.log("");
+  for (const t of tiers) console.log(`  ${t.family.padEnd(7)} ${describeResolution(t.model)}`);
+  const live = tiers.find((t) => t.price?.source === "catalog")?.price;
+  console.log(
+    live
+      ? `\n  prices: live from ${live.catalog}${live.cache === "stale" ? " (last cached copy — catalog unreachable)" : ""}`
+      : `\n  prices: shipped snapshot, verified ${PRICING_VERIFIED} (OpenRouter's catalog unavailable or unlisted)`,
+  );
+  console.log(
+    paint(
+      "  cache: .forge/cache/ — reused while the response's own Cache-Control/Expires says fresh, else revalidated (ETag); FORGE_NO_CATALOG_FETCH=1 stays offline",
+      "dim",
+    ),
+  );
+  return;
+};
+
+HANDLERS.route = async (argv) => {
+  const r = await import("../route.js");
+  if (argv[1] === "gateway") {
+    const result = r.emitGatewayConfig(process.cwd());
+    if (typeof result === "object" && !result.ok) {
+      console.log(`  ${result.reason}`);
+      return;
+    }
+    console.log(`  wrote ${result} — LiteLLM tiers: forge-simple / forge-medium / forge-complex.`);
+    console.log("  next: pin+install litellm, run it, point ANTHROPIC_BASE_URL at it, then");
+    console.log(
+      "        REQUEST the tier `forge route` recommends (a plain claude-* request passes through).",
+    );
+    return;
+  }
+  if (argv[1] === "calibrate") {
+    // Advisory → gated promotion (ROADMAP): measure whether an affine calibration of the
+    // routing rubric beats the raw rubric on a held-out split of the HAND-LABELLED fixture
+    // (there is no outcome data). Advisory — routing keeps the rubric unless the gate
+    // promotes AND a caller adopts the calibration, which nothing in src/ does.
+    const res = r.calibrateRouting();
+    if (argv.includes("--json")) return console.log(JSON.stringify(res, null, 2));
+    heading(`${BRAND.brand} route calibrate — rubric calibration check (measured gate)\n`);
+    console.log(`  samples: ${res.n} hand-labelled task phrase(s) — no routing outcomes exist`);
+    if (res.baselineMetric !== undefined)
+      console.log(
+        `  held-out MAE: rubric ${res.baselineMetric} · calibrated ${res.candidateMetric}`,
+      );
+    console.log(
+      res.mode === "candidate"
+        ? `  → PROMOTE calibration — ${res.reason} (a=${res.model.a.toFixed(3)}, b=${res.model.b.toFixed(3)})`
+        : `  → keep the rubric — ${res.reason}`,
+    );
+    console.log(
+      "\n  advisory — routing stays on the rubric; nothing adopts a promoted calibration yet,",
+    );
+    console.log("  and calibrating on real routing outcomes needs data forge does not record");
+    return;
+  }
+  if (["universal", "outcome", "fit", "models"].includes(argv[1]) || argv.includes("--universal")) {
+    return routeUniversalCli(argv);
+  }
+  const json = argv.includes("--json");
+  const apply = argv.includes("--apply");
+  const providerIdx = argv.indexOf("--provider");
+  const providerName = providerIdx >= 0 ? argv[providerIdx + 1] : undefined;
+  const FLAGS = new Set(["--json", "--apply"]);
+  const task = argv
+    .slice(1)
+    .filter((a, i) => !FLAGS.has(a) && a !== "--provider" && argv[i] !== "--provider")
+    .join(" ");
+  if (!task) {
+    console.error(
+      'usage: forge route "<task>" [--apply] [--provider <name>] [--json]   |   forge route gateway',
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (providerName) {
+    const { setProvider } = await import("../providers.js");
+    const sr = setProvider(process.cwd(), providerName);
+    if (!sr.ok) {
+      console.error(`  ${sr.reason}`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const rec = r.routeTask(process.cwd(), task);
+  r.meterRoute(process.cwd(), task, rec);
+  // The recommendation is a tier (a model family); its concrete id and price are resolved here,
+  // in the command — routeTask stays network-free because the hooks run it. BOTH output modes
+  // resolve, so a script reading --json never sees a different model than the text prints.
+  const { describeResolution, resolveTierModel, resolveTierPrice } = await import(
+    "../model_tiers.js"
+  );
+  const { activeProvider } = await import("../providers.js");
+  const opts = { root: process.cwd(), provider: activeProvider(process.cwd()) };
+  const resolved = resolveTierModel(rec.key, opts);
+  const price = resolveTierPrice(rec.key, { ...opts, resolved });
+  if (json) {
+    // `model` stays the snapshot row (its shape is public); `resolved` is what would be called.
+    console.log(JSON.stringify({ ...rec, resolved, price }, null, 2));
+  } else {
+    heading(`${BRAND.brand} route — cheapest capable model\n`);
+    const name =
+      resolved?.source === "catalog" && resolved.displayName
+        ? resolved.displayName
+        : rec.model.name;
+    console.log(
+      `  → ${paint(name, "accent")}  (${rec.tier}, ${price ? `${price.inCost}/${price.outCost} per M tok, ${price.source === "catalog" ? "live price" : "current effective"}` : "price unknown"})`,
+    );
+    if (resolved) console.log(`    model: ${resolved.id} — ${describeResolution(resolved)}`);
+    console.log(`    ${rec.model.use}`);
+    console.log(
+      `    complexity ${bar(rec.score, 8)} ${rec.score.toFixed(2)}${rec.reasons.length ? ` · driven by: ${rec.reasons.join(", ")}` : ""}`,
+    );
+    console.log(
+      `    signals: ${rec.signals.files} file(s), fan-out ${rec.signals.fanout}, churn ${rec.signals.churn}, past-mistakes ${rec.signals.pastMistakes}, ambiguity ${rec.signals.ambiguity.toFixed(2)}`,
+    );
+  }
+  if (apply) {
+    const { applyRoute } = await import("../providers.js");
+    const ar = applyRoute(rec.key);
+    if (ar.ok) {
+      if (!json) console.log(`\n  applied: model set to ${ar.model} (${ar.modelId}) in ${ar.path}`);
+    } else {
+      if (!json) console.error(`\n  apply failed: ${ar.reason}`);
+      process.exitCode = 1;
+    }
+  } else if (!json) {
+    console.log(
+      `\n  advisory · apply: \`${BRAND.cli} route "<task>" --apply\` · gateway: \`${BRAND.cli} route gateway\``,
+    );
+  }
+  return;
+};
+// Universal router (src/router): any provider's models, chosen by expected cost for the success
+// probability asked for. Models come from data/models.json and .forge/models.json.
+
+// Universal router (src/router): any provider's models, chosen by expected cost for the success
+// probability asked for. Models come from data/models.json and .forge/models.json.
+async function routeUniversalCli(argv) {
+  const U = await import("../router/index.js");
+  const { loadRegistry } = await import("../router/registry.js");
+  const json = argv.includes("--json");
+  const val = (flag) => (argv.includes(flag) ? argv[argv.indexOf(flag) + 1] : undefined);
+  const VALUED = new Set([
+    "--objective",
+    "--provider",
+    "--model",
+    "--cost",
+    "--depth",
+    "--attempt",
+    "--verify-run",
+  ]);
+  const words = argv
+    .slice(1)
+    .filter((a, i, arr) => !a.startsWith("--") && !VALUED.has(arr[i - 1] ?? ""));
+  const sub = ["outcome", "fit", "models", "universal"].includes(words[0])
+    ? words.shift()
+    : "universal";
+  const root = process.cwd();
+  if (sub === "models") {
+    const reg = loadRegistry(root);
+    const fit = U.loadRouterModel(root);
+    const rows = reg.models.map((m) => ({
+      id: m.id,
+      org: m.org ?? null,
+      status: fit?.models.includes(m.id) ? "fitted" : "cold",
+      providers: Object.keys(m.providers ?? {}),
+      price: m.price_in != null ? `${m.price_in}/${m.price_out}` : null,
+    }));
+    if (json)
+      return console.log(
+        JSON.stringify({ sources: reg.sources, fit: fit?.origin ?? null, models: rows }, null, 2),
+      );
+    heading(`${BRAND.brand} route models — registry (${reg.sources.join(" + ")})\n`);
+    for (const r of rows)
+      console.log(
+        `  ${r.id.padEnd(22)} ${String(r.org ?? "").padEnd(16)} ${r.status.padEnd(7)} ${r.price ? `$${r.price}/Mtok`.padEnd(14) : "".padEnd(14)} ${r.providers.join(", ") || "(no provider id: advice only)"}`,
+      );
+    console.log(`\n  fit in use: ${fit?.origin ?? "none"}`);
+    return;
+  }
+  if (sub === "fit") {
+    const model = U.fitRouter(root);
+    if (json) return console.log(JSON.stringify(model.provenance, null, 2));
+    console.log(
+      `  refit on ${model.provenance.local.outcomes} recorded outcome(s) over ${model.provenance.local.tasks} task(s); wrote .forge/router_model.json`,
+    );
+    return;
+  }
+  const task = words.join(" ");
+  if (!task) {
+    console.error(
+      'usage: forge route universal "<task>" [--objective match-best-single|target:<p>|value:<$>|budget:<$>] [--provider <name>|any] [--depth <n>] [--json]\n' +
+        '       forge route outcome "<task>" --model <id> --pass|--fail [--cost <usd>] [--attempt <id>] [--verify-run <run id>]\n' +
+        "       forge route fit | forge route models",
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (sub === "outcome") {
+    const passed = argv.includes("--pass") ? true : argv.includes("--fail") ? false : undefined;
+    const cost = val("--cost") !== undefined ? Number(val("--cost")) : null;
+    try {
+      const row = U.recordOutcome(root, {
+        task,
+        model: val("--model"),
+        passed,
+        cost,
+        attemptId: val("--attempt") ?? null,
+        verifyRunId: val("--verify-run") ?? null,
+      });
+      if (json) return console.log(JSON.stringify(row, null, 2));
+      console.log(
+        row.duplicate
+          ? `  attempt ${row.attemptId} was already recorded — not counted twice`
+          : `  recorded ${row.model} ${row.passed ? "pass" : "fail"} (${row.provenance}) for task ${row.task} (.forge/route_outcomes.jsonl)`,
+      );
+    } catch (e) {
+      console.error(`  ${e.message}`);
+      process.exitCode = 1;
+    }
+    return;
+  }
+  let rec;
+  try {
+    rec = U.routeUniversal(root, task, {
+      objective: val("--objective"),
+      provider: val("--provider") ?? "any",
+      maxDepth: val("--depth") ? Number(val("--depth")) : undefined,
+    });
+  } catch (e) {
+    console.error(`  ${e.message}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (json) {
+    console.log(JSON.stringify(rec, null, 2));
+    if (!rec.ok) process.exitCode = 1;
+    return;
+  }
+  if (!rec.ok) {
+    console.error(`  ${rec.feasible === false ? "INFEASIBLE — " : ""}${rec.reason}`);
+    // F12: the least-bad cascade is shown only as an explicit, labeled fallback.
+    const fb = rec.fallback;
+    if (fb)
+      console.error(
+        `  fallback (does NOT meet the objective): ${fb.cascade.map((c) => c.model).join(" → ")} · P(success) ${fb.pSuccess.toFixed(2)} · expected $${fb.expectedCost.toFixed(3)} (up to $${fb.maxPossibleCost.toFixed(3)} if every attempt runs)`,
+      );
+    process.exitCode = 1;
+    return;
+  }
+  heading(
+    `${BRAND.brand} route universal — ${rec.objective.kind}${rec.target != null ? ` (target ${rec.target.toFixed(2)})` : ""}\n`,
+  );
+  rec.cascade.forEach((c, i) => {
+    console.log(
+      `  ${i === 0 ? "→" : "then, if a check fails →"} ${paint(c.model, "accent")}  P(solve alone) ${c.pSolveAlone.toFixed(2)} · ~$${c.expectedAttemptCost.toFixed(3)}/attempt${c.status === "cold" ? " · cold (no outcomes yet)" : ""}${c.providers.length ? "" : " · no provider id"}`,
+    );
+  });
+  // A07: a model in the registry is not a model you can call.
+  if (!rec.applicable)
+    console.log(
+      `\n  ${paint("advice only", "warn")}: ${rec.unmapped.join(", ")} ${rec.unmapped.length === 1 ? "has" : "have"} no provider id — add one under "providers" in .forge/models.json, or pass --provider <name> to route among models you can call (\`${BRAND.cli} route models\` lists who serves what)`,
+    );
+  console.log(
+    `\n  P(success) ${rec.pSuccess.toFixed(2)} · expected cost $${rec.expectedCost.toFixed(3)} (not a cap; up to $${rec.maxPossibleCost.toFixed(3)} if every attempt runs) · best single: ${rec.bestSingle.model} ${rec.bestSingle.pSuccess.toFixed(2)} at $${rec.bestSingle.expectedCost.toFixed(3)}`,
+  );
+  console.log(
+    `  ${rec.candidates} candidate model(s), ${rec.cascadesEvaluated} cascade(s) compared · fit: ${rec.fit.origin}`,
+  );
+  console.log(
+    `  learn from results: \`${BRAND.cli} route outcome "<task>" --model <id> --pass|--fail --cost <usd>\`, then \`${BRAND.cli} route fit\``,
+  );
+}
+
+export default HANDLERS;
diff --git a/src/cli/shared.js b/src/cli/shared.js
new file mode 100644
index 00000000..a7091bb0
--- /dev/null
+++ b/src/cli/shared.js
@@ -0,0 +1,16 @@
+// forge CLI — presentation helpers shared by every command module (src/cli.js and
+// src/cli/*.js), defined once so the handler modules cannot drift apart.
+import { BRAND } from "../brand.js";
+// Color is capability-gated (FORCE_COLOR > NO_COLOR > TERM=dumb > TTY) — piped
+// output stays byte-plain, so nothing downstream ever parses an escape code.
+import { bar, heading as fmtHeading, paint, table } from "../fmt.js";
+
+export { BRAND, bar, paint, table };
+
+// Per-command title lines ("Forge <cmd> — …") are branding chrome, not results. They
+// print only when asked (`--verbose` or FORGE_VERBOSE=1); by default a command emits
+// just its output. The `--help`/`--version` banner is unaffected.
+export const VERBOSE = process.argv.includes("--verbose") || process.env.FORGE_VERBOSE === "1";
+export const heading = (text) => {
+  if (VERBOSE) console.log(fmtHeading(text));
+};
diff --git a/src/cli/verification.js b/src/cli/verification.js
new file mode 100644
index 00000000..d5b8a490
--- /dev/null
+++ b/src/cli/verification.js
@@ -0,0 +1,567 @@
+// forge CLI — the verification commands — `verify`, `imagine`, `uicheck`. Moved verbatim out of src/cli.js (review A03: command dispatch
+// and presentation are separated from domain operations; each domain's handlers live in one
+// module, and the domain logic stays in the modules they import). cli.js registers these into
+// its dispatch table; nothing here runs at import time.
+import { BRAND, bar, heading, paint, table } from "./shared.js";
+
+/** @type {Record<string, (argv: string[], cmd: string) => unknown>} */
+const HANDLERS = {};
+
+HANDLERS.verify = async (argv) => {
+  const json = argv.includes("--json");
+  if (argv.includes("--deep")) {
+    const { verifyDeep, LENSES } = await import("../consensus.js");
+    // `--llm` opts the reviewer panel in for this run; otherwise FORGE_LLM decides.
+    const r = verifyDeep({
+      targetRoot: process.cwd(),
+      llm: argv.includes("--llm") ? true : undefined,
+    });
+    if (json) {
+      console.log(JSON.stringify(r, null, 2));
+      if (!r.ok) process.exitCode = 1;
+      return;
+    }
+    heading(`${BRAND.brand} verify --deep — multi-lens consensus\n`);
+    console.log(
+      table(
+        r.lenses.map((l) => {
+          const meta = LENSES[l.lens];
+          const state =
+            l.ran === false
+              ? paint("— skipped", "dim")
+              : l.s > 0
+                ? paint("● finding", meta.solo ? "err" : "warn")
+                : paint("✓ clean", "ok");
+          return [l.lens, meta.family, `w=${meta.weight}`, state];
+        }),
+      ),
+    );
+    if (r.findings.length) {
+      console.log();
+      for (const f of r.findings) console.log(`  ! ${f}`);
+    }
+    console.log(
+      `\n  defectRiskScore:  ${bar(r.p)} ${r.p.toFixed(2)} (heuristic, not a calibrated probability)${
+        r.families.length ? `  (families: ${r.families.join(", ")})` : ""
+      }`,
+    );
+    console.log(
+      `  remainingUncheckedWeight: ${r.residual.toFixed(3)} — Theorem-D silent-miss bound (heuristic)`,
+    );
+    // The core tests state, spelled out — deep ok REQUIRES a passing core, so the
+    // reader must see whether a verifier actually ran (RA-01).
+    const t = r.tests ?? /** @type {import("../verify.js").VerifyTests} */ ({ ran: false });
+    console.log(
+      `  tests:            ${t.status ?? "unknown"}${t.runner ? ` (${t.runner})` : ""}${
+        !t.runner && t.detected?.length ? ` (detected: ${t.detected.join(", ")})` : ""
+      }`,
+    );
+    if (t.executed?.length)
+      console.log(
+        `  suites ran:       ${t.executed.map((s) => `${s.label}=${s.status}`).join(", ")}`,
+      );
+    if (t.notExecuted?.length)
+      console.log(`  suites skipped:   ${t.notExecuted.join(", ")} (no built-in executor)`);
+    const detail = t.output || (t.detected ?? []).join(", ");
+    const verdictLine =
+      r.status === "PASS"
+        ? paint("PASS", "ok")
+        : r.status === "NOT_CONFIGURED"
+          ? paint("NOT VERIFIED — no test runner configured (NOT_CONFIGURED)", "warn")
+          : r.status === "INCOMPLETE"
+            ? paint(`NOT VERIFIED — tests incomplete${detail ? ` (${detail})` : ""}`, "warn")
+            : paint("BLOCKED — cross-family consensus says defect", "err");
+    console.log(`\n  ${verdictLine}`);
+    if (!r.ok) process.exitCode = 1;
+    return;
+  }
+  const { verify } = await import("../verify.js");
+  const r = verify({ targetRoot: process.cwd() });
+  if (json) {
+    console.log(JSON.stringify(r, null, 2));
+    if (!r.ok) process.exitCode = 1;
+    return;
+  }
+  heading(`${BRAND.brand} verify\n`);
+  console.log(`  changed files:    ${r.changedFiles.length}`);
+  // Honest four-state tests line (RA-09): "nothing ran" is never dressed up as a pass,
+  // and a real run names the runner that actually executed.
+  const t = r.tests;
+  const testsLine =
+    t.status === "PASS"
+      ? `✓ pass (${t.runner ?? "project suite"})`
+      : t.status === "FAIL"
+        ? `✗ FAIL (${t.runner ?? "project suite"})`
+        : t.status === "INCOMPLETE"
+          ? `— INCOMPLETE: ${t.output || (t.detected ?? []).join(", ") || "test run did not complete"}`
+          : "— NOT CONFIGURED (no test runner detected)";
+  console.log(`  tests:            ${testsLine}`);
+  // Per-suite honesty (HI-01): a polyglot repo runs every executable suite; name which
+  // ones ran with what verdict, and which were detected but never executed.
+  if (t.executed?.length)
+    console.log(
+      `  suites ran:       ${t.executed.map((s) => `${s.label}=${s.status}`).join(", ")}`,
+    );
+  if (t.notExecuted?.length)
+    console.log(`  suites skipped:   ${t.notExecuted.join(", ")} (no built-in executor)`);
+  // Coverage (review F08): which package dirs the verdict actually speaks for.
+  const cov = t.coverage;
+  if (cov && cov.required.length > 1)
+    console.log(
+      `  packages:         ${cov.covered.length}/${cov.required.length} covered${
+        cov.uncovered.length ? ` — no verdict for ${cov.uncovered.join(", ")}` : ""
+      }${cov.excluded.length ? ` (${cov.excluded.length} excluded)` : ""}`,
+    );
+  if (t.mutated)
+    console.log("  ! the code changed while the tests ran — the verdict is not bound to it");
+  console.log(`  symbols checked:  ${r.provenance.symbolsChecked}`);
+  if (r.unknown.length)
+    console.log(
+      `  ! not in codebase (possible hallucination): ${r.unknown.slice(0, 12).join(", ")}`,
+    );
+  console.log(`  provenance:       .forge/provenance.json (run ${r.provenance.event?.runId})`);
+  // BLOCKED is reserved for a runner that actually FAILED; anything that never ran
+  // to completion is NOT VERIFIED (still exit 1 — unverified is not a pass).
+  const verdict = r.ok
+    ? "PASS"
+    : t.status === "FAIL"
+      ? "BLOCKED — tests failing"
+      : `NOT VERIFIED — ${t.status}`;
+  console.log(`\n  ${verdict}`);
+  if (!r.ok) process.exitCode = 1;
+  return;
+};
+
+HANDLERS.imagine = async (argv) => {
+  const { dryRun, imagineTask, renderImagine } = await import("../imagine.js");
+  const json = argv.includes("--json");
+  const doRun = argv.includes("--run");
+  const allowDirty = argv.includes("--allow-dirty");
+  const FLAGS = new Set(["--json", "--run", "--allow-dirty"]);
+  const task = argv
+    .slice(1)
+    .filter((a) => !FLAGS.has(a))
+    .join(" ");
+  if (!task) {
+    console.error('usage: forge imagine "<task>" [--run] [--allow-dirty] [--json]');
+    process.exitCode = 1;
+    return;
+  }
+  const root = process.cwd();
+  const r = imagineTask(root, task);
+  if (!doRun) {
+    console.log(json ? JSON.stringify(r, null, 2) : renderImagine(r));
+    return;
+  }
+  // --run: the static prediction first (always), then the measured half. The sandbox
+  // is a git worktree of HEAD — uncommitted changes are INVISIBLE to it — so a dirty
+  // tree is refused by default rather than silently dry-running the wrong code.
+  if (!json) console.log(renderImagine(r, { footer: false }));
+  if (!allowDirty) {
+    let dirty = "";
+    try {
+      const { execFileSync } = await import("node:child_process");
+      dirty = execFileSync("git", ["status", "--porcelain"], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim();
+    } catch {} // not a repo / no git → dryRun reports its own precondition failure
+    if (dirty) {
+      console.error(
+        "\n  imagine --run refused: the working tree is dirty and the isolated checkout runs HEAD,\n" +
+          "  so your uncommitted changes would NOT be in the dry-run. Commit or stash them,\n" +
+          "  or pass --allow-dirty to knowingly measure the last commit instead.",
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const d = dryRun(root, { tests: r.tests });
+  // Metrics are best-effort telemetry (05-cost-model.md) — never let recording
+  // failure break the verdict. Only a run that happened is worth counting.
+  try {
+    if (d.durationMs !== undefined) {
+      const { record } = await import("../metrics.js");
+      record(root, {
+        stage: "imagine",
+        outcome: d.ok && d.failed === 0 ? "clean" : "breaks",
+        ref: task.slice(0, 120),
+        durationMs: d.durationMs,
+      });
+    }
+  } catch {}
+  if (json) {
+    console.log(JSON.stringify({ ...r, dryRun: d }, null, 2));
+    return;
+  }
+  if (!d.ok) {
+    console.log(`\n  dry-run: did not produce a verdict — ${d.reason}`);
+    if (d.output) console.log(`\n${d.output.replace(/^/gm, "    ")}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(
+    `\n  dry-run (isolated checkout of HEAD — not a security sandbox · ${d.runner ?? "node --test"}):`,
+  );
+  console.log(
+    `    pass ${d.passed} · fail ${d.failed} · ${d.durationMs}ms · worktree ${d.worktree}`,
+  );
+  if (d.perFile)
+    for (const [t, s] of Object.entries(d.perFile))
+      console.log(`    ${s === "pass" ? "ok  " : "FAIL"} ${t}`);
+  if (d.failed > 0) {
+    console.log("\n  measured consequence: the selected suite BREAKS at HEAD — output tail:");
+    console.log(`\n${(d.output || "").replace(/^/gm, "    ")}`);
+  } else {
+    console.log("\n  measured consequence: the selected suite is green at HEAD.");
+  }
+  return;
+};
+
+const VERDICT_LABEL = {
+  pass: "✓ PASS",
+  fail: "✗ FAIL",
+  "insufficient-signal": "✗ INSUFFICIENT SIGNAL — nothing measurable, so this is not a PASS",
+};
+
+HANDLERS.uicheck = async (argv) => {
+  const sub = argv[1];
+  if (sub === "visual") {
+    // The Playwright visual loop (spec §5): render in a real browser, fingerprint
+    // the COMPUTED styles, run the same design gate. Playwright is an optional
+    // tier (ADR-0005) — its absence is a note and exit 0, never a failure.
+    const { visualGate } = await import("../uivisual.js");
+    const args = argv.slice(2);
+    const tasteIdx = args.indexOf("--taste");
+    const tasteArg = tasteIdx >= 0 ? (args.splice(tasteIdx, 2)[1] ?? null) : null;
+    const json = args.includes("--json");
+    const remote = args.includes("--remote");
+    const targets = args.filter((a) => !a.startsWith("--"));
+    if (targets.length !== 1 || (tasteIdx >= 0 && !tasteArg)) {
+      console.error(
+        `usage: ${BRAND.cli} uicheck visual <file-or-url> [--taste <name>] [--json] [--remote]`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const r = await visualGate(targets[0], {
+      taste: tasteArg,
+      remote,
+      root: process.cwd(),
+    });
+    if (!r.ok) {
+      const reason = "reason" in r ? r.reason : "visual gate failed";
+      if ("skipped" in r && r.skipped) {
+        // Graceful absence (ADR-0005): a missing optional tier is not a failure.
+        if (json) console.log(JSON.stringify({ skipped: true, reason }, null, 2));
+        else {
+          heading(`${BRAND.brand} uicheck visual — skipped (no browser runtime)\n`);
+          console.log(`  ${reason}`);
+          console.log(
+            "  enable it: npm i -D playwright-core   (or point FORGE_PLAYWRIGHT at an existing install, e.g. FORGE_PLAYWRIGHT=/path/to/node_modules/playwright-core)",
+          );
+        }
+        return; // exit 0 — the static gate still stands
+      }
+      console.error(reason);
+      process.exitCode = 1;
+      return;
+    }
+    // The completion gate's UI evidence (a skipped run never reaches here, so a missing
+    // browser can never count as a PASS).
+    const { recordUiCheck } = await import("../gate.js");
+    recordUiCheck(process.cwd(), { check: "visual", pass: !r.fail });
+    if (json) {
+      const { ok: _ok, fail: _fail, ...body } = r;
+      console.log(JSON.stringify(body, null, 2));
+    } else {
+      heading(`${BRAND.brand} uicheck visual — rendered fingerprint + design gate\n`);
+      console.log(`  rendered:      ${r.url} (${r.elements} visible element style(s))`);
+      console.log(`  screenshots:   ${r.screenshots.join(", ")}`);
+      if (r.taste) console.log(`  taste:         ${r.taste} (thresholds from its profile)`);
+      console.log(
+        `  slop distance: ${r.slop}  (need ≥ ${r.tauSlop} — farther from generic is better)`,
+      );
+      console.log(
+        r.hasProjectFingerprint
+          ? `  conformance:   ${r.conform}  (need ≤ ${r.tauConform} — closer to the project system is better)`
+          : `  conformance:   (no project fingerprint claim — slop-only; mint one: \`${BRAND.cli} uicheck fingerprint <ui files> --mint\`)`,
+      );
+      for (const v of r.violations) console.log(`\n  ✗ ${v.detail}\n    fix: ${v.hint}`);
+      console.log("");
+      for (const c of r.checks)
+        console.log(
+          `  ${c.pass ? "✓" : "✗"} ${c.id}: ${c.detail}${c.pass || !c.hint ? "" : `\n    fix: ${c.hint}`}`,
+        );
+      console.log(`\n  ${VERDICT_LABEL[r.verdict]}`);
+    }
+    if (r.fail) process.exitCode = 1;
+    return;
+  }
+  if (sub === "interact") {
+    // The Playwright interaction loop (ROADMAP "Next"): drive the page and check what
+    // it DOES — keyboard reach, a visible focus ring, console cleanliness, reduced-
+    // motion honesty. Advisory by default (the `behavioral` oracle is cross-family-
+    // gated); --enforce or FORGE_ENFORCE=1 turns a fail into a non-zero exit. Playwright
+    // is an optional tier (ADR-0005) — its absence is a note and exit 0, never a failure.
+    const { runInteractions, recordInteraction } = await import("../uiinteract.js");
+    const args = argv.slice(2);
+    const json = args.includes("--json");
+    const remote = args.includes("--remote");
+    const record = args.includes("--record");
+    const enforce = args.includes("--enforce") || process.env.FORGE_ENFORCE === "1";
+    const targets = args.filter((a) => !a.startsWith("--"));
+    if (targets.length !== 1) {
+      console.error(
+        `usage: ${BRAND.cli} uicheck interact <file-or-url> [--record] [--enforce] [--json] [--remote]`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const r = await runInteractions(targets[0], {
+      remote,
+      cwd: process.cwd(),
+    });
+    if (!r.ok) {
+      const reason = "reason" in r ? r.reason : "interaction run failed";
+      if ("skipped" in r && r.skipped) {
+        // Graceful absence (ADR-0005): a missing optional tier is not a failure.
+        if (json) console.log(JSON.stringify({ skipped: true, reason }, null, 2));
+        else {
+          heading(`${BRAND.brand} uicheck interact — skipped (no browser runtime)\n`);
+          console.log(`  ${reason}`);
+          console.log(
+            "  enable it: npm i -D playwright-core   (or point FORGE_PLAYWRIGHT at an existing install)",
+          );
+        }
+        return; // exit 0 — the advisory tier is absent
+      }
+      console.error(reason);
+      process.exitCode = 1;
+      return;
+    }
+    const recorded = record ? recordInteraction(process.cwd(), r.url, r.verdict) : null;
+    if (json) {
+      console.log(JSON.stringify({ url: r.url, ...r.verdict, recorded }, null, 2));
+    } else {
+      heading(`${BRAND.brand} uicheck interact — browser interaction checks\n`);
+      console.log(`  driven:        ${r.url} (headless, prefers-reduced-motion)`);
+      for (const c of r.verdict.checks) console.log(`  ${c.ok ? "✓" : "✗"} ${c.id}: ${c.detail}`);
+      console.log(`\n  ${r.verdict.pass ? "✓ PASS" : "✗ FAIL"}${enforce ? "" : "  (advisory)"}`);
+      if (recorded)
+        console.log(
+          recorded.recorded
+            ? `  recorded as behavioral evidence on design claim ${recorded.claimId.slice(0, 12)}`
+            : `  not recorded: ${recorded.reason}`,
+        );
+    }
+    if (!r.verdict.pass && enforce) process.exitCode = 1;
+    return;
+  }
+  if (sub === "fingerprint" || sub === "design") {
+    const ui = await import("../uifingerprint.js");
+    // `--taste <name>` (design only) takes a VALUE — splice it out before the
+    // file filter so the profile name is never mistaken for a file.
+    const args = argv.slice(2);
+    const tasteIdx = args.indexOf("--taste");
+    const tasteArg = tasteIdx >= 0 ? (args.splice(tasteIdx, 2)[1] ?? null) : null;
+    // `--theme <file>` (repeatable) names the Tailwind theme sources explicitly;
+    // without it they are discovered (@theme / @tailwind stylesheets, tailwind.config.*).
+    /** @type {string[]} */
+    const themeArgs = [];
+    let themeMissing = false;
+    for (let i = args.indexOf("--theme"); i >= 0; i = args.indexOf("--theme")) {
+      const [, value] = args.splice(i, 2);
+      if (!value || value.startsWith("--")) themeMissing = true;
+      else themeArgs.push(value);
+    }
+    const json = args.includes("--json");
+    const files = args.filter((a) => !a.startsWith("--"));
+    if (!files.length || (tasteIdx >= 0 && !tasteArg) || themeMissing) {
+      console.error(
+        `usage: ${BRAND.cli} uicheck ${sub} <file...> [--theme <css|tailwind.config>]... [--json]${sub === "fingerprint" ? " [--mint]" : " [--taste <name>]"}`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    // An explicitly named theme that isn't there is an error, not a silent no-op.
+    const { existsSync } = await import("node:fs");
+    const { resolve } = await import("node:path");
+    const absent = themeArgs.filter((t) => !existsSync(resolve(process.cwd(), t)));
+    if (absent.length) {
+      console.error(`theme source not found: ${absent.join(", ")}`);
+      process.exitCode = 1;
+      return;
+    }
+    const theme = ui.loadThemeTokens(
+      process.cwd(),
+      ui.themeSourcesFor(process.cwd(), files, themeArgs),
+    );
+    const themeLine = theme.sources.length
+      ? `${theme.sources.join(", ")} (${theme.colors.size} color · ${theme.radius.size} radius · ${theme.shadow.size} shadow token(s))`
+      : "(none found — token utilities like rounded-card / bg-brand stay unresolved; name one with --theme <file>)";
+    const themeSummary = {
+      sources: theme.sources,
+      colors: theme.colors.size,
+      radius: theme.radius.size,
+      shadow: theme.shadow.size,
+    };
+    const fp = ui.fingerprintFiles(process.cwd(), files, { theme });
+    if (sub === "fingerprint") {
+      let minted = null;
+      if (argv.includes("--mint")) {
+        const { epochDay } = await import("../util.js");
+        minted = ui.mintProjectFingerprint(process.cwd(), files, {
+          t: epochDay(),
+          theme,
+        });
+      }
+      if (json) {
+        console.log(JSON.stringify(minted ? { fingerprint: fp, minted } : fp, null, 2));
+      } else {
+        heading(`${BRAND.brand} uicheck fingerprint — the design feature vector\n`);
+        console.log(
+          `  palette:  ${fp.paletteSize} color(s), hue bins [${fp.hueBuckets.join(" ")}]`,
+        );
+        console.log(
+          `  spacing:  ${fp.spacing.join(", ") || "(none)"} px — base ${fp.spacingBase ?? "(none)"}, ${Math.round(fp.spacingOnScale * 100)}% on-scale`,
+        );
+        console.log(`  type:     ${fp.fontFamilies.join(", ") || "(none)"}`);
+        console.log(
+          `  shape:    radii ${fp.radii.join(", ") || "(none)"} (${fp.radiusLevels} level(s)) · ${fp.shadowLevels} shadow level(s)`,
+        );
+        console.log(`  theme:    ${themeLine}`);
+        if (!ui.hasDesignSignal(fp))
+          console.log(
+            "\n  ! no measurable design feature in these files — `design` reports insufficient-signal",
+          );
+        if (minted) {
+          if (minted.ok)
+            console.log(
+              `\n  minted fingerprint claim ${minted.id.slice(0, 12)}${minted.existed ? " (already in ledger)" : ""} — the gate's "home"`,
+            );
+          else console.error(`\n  mint failed: ${"reason" in minted ? minted.reason : ""}`);
+        }
+      }
+      if (minted && !minted.ok) process.exitCode = 1;
+      return;
+    }
+    // design — the two-sided gate: fail when too close to generic OR (when the
+    // project has minted its fingerprint) too far from the project's own system.
+    // A taste profile (explicit --taste, else the style pinned by a
+    // `forge taste`-managed DESIGN.md) overrides thresholds + adds its checks.
+    const tasteName = tasteArg ?? ui.activeTasteStyle(process.cwd());
+    const profile = tasteName ? ui.loadTasteProfile(tasteName) : null;
+    if (tasteArg && !profile) {
+      // Explicit --taste must exist; an auto-picked style without a JSON sibling
+      // silently falls back to defaults (custom prose styles stay legal).
+      console.error(
+        `unknown taste profile "${tasteArg}" — run \`${BRAND.cli} taste\` to list styles`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const projectFp = ui.loadProjectFingerprint(process.cwd());
+    const tauSlop = profile?.gate?.tau_slop ?? ui.UI_GATE_DEFAULTS.tauSlop;
+    const tauConform = profile?.gate?.tau_conform ?? ui.UI_GATE_DEFAULTS.tauConform;
+    const gate = ui.uiGate(fp, { projectFp, tauSlop, tauConform });
+    const checks = [...ui.scaleChecks(fp), ...(profile ? ui.profileChecks(fp, profile) : [])];
+    // insufficient-signal (an empty vector) exits non-zero like FAIL: nothing was
+    // measured, so nothing passed.
+    const verdict = ui.overallVerdict(gate, checks);
+    // The completion gate's UI evidence: this verdict, bound to the current code state.
+    // Only a real PASS counts; an empty measurement is not evidence.
+    const { recordUiCheck } = await import("../gate.js");
+    recordUiCheck(process.cwd(), { check: "design", pass: verdict === "pass", files });
+    if (json) {
+      console.log(
+        JSON.stringify(
+          {
+            ...gate,
+            verdict,
+            checks,
+            hasProjectFingerprint: !!projectFp,
+            taste: profile ? tasteName : null,
+            tauSlop,
+            tauConform,
+            theme: themeSummary,
+          },
+          null,
+          2,
+        ),
+      );
+    } else {
+      heading(`${BRAND.brand} uicheck design — slop distance + project conformance\n`);
+      if (profile) console.log(`  taste:         ${tasteName} (thresholds from its profile)`);
+      console.log(`  theme:         ${themeLine}`);
+      if (verdict !== "insufficient-signal") {
+        console.log(
+          `  slop distance: ${gate.slop}  (need ≥ ${tauSlop} — farther from generic is better)`,
+        );
+        console.log(
+          projectFp
+            ? `  conformance:   ${gate.conform}  (need ≤ ${tauConform} — closer to the project system is better)`
+            : `  conformance:   (no project fingerprint claim — slop-only; mint one: \`${BRAND.cli} uicheck fingerprint <ui files> --mint\`)`,
+        );
+      }
+      for (const v of gate.violations) console.log(`\n  ✗ ${v.detail}\n    fix: ${v.hint}`);
+      if (verdict !== "insufficient-signal") {
+        console.log("");
+        for (const c of checks)
+          console.log(
+            `  ${c.pass ? "✓" : "✗"} ${c.id}: ${c.detail}${c.pass || !c.hint ? "" : `\n    fix: ${c.hint}`}`,
+          );
+      }
+      console.log(`\n  ${VERDICT_LABEL[verdict]}`);
+    }
+    if (verdict !== "pass") process.exitCode = 1;
+    return;
+  }
+  const { contrastReport, ASSERTABLE_CHECKS, ADVISORY_ONLY } = await import("../uicheck.js");
+  // `uicheck contrast <fg> <bg>` is the named form; bare `uicheck <fg> <bg>` stays
+  // supported (it predates the subcommands and hooks already call it). Both exit 1
+  // when the pair fails AA — a failing contrast must fail the script that asked.
+  const args = argv.slice(sub === "contrast" ? 2 : 1);
+  const json = args.includes("--json");
+  const large = args.includes("--large");
+  const colors = args.filter((a) => !a.startsWith("--"));
+  if (sub === "contrast" && colors.length !== 2) {
+    console.error(
+      `usage: ${BRAND.cli} uicheck contrast <fg> <bg> [--large] [--json]   (colors: #hex[alpha], rgb(), hsl(), oklch(), oklab())`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const [fg, bg] = colors;
+  /** @type {ReturnType<typeof contrastReport>|null} */
+  let r = null;
+  if (fg && bg) {
+    try {
+      r = contrastReport(fg, bg, { large });
+    } catch (e) {
+      if (json) console.log(JSON.stringify({ error: e.message }, null, 2));
+      else console.error(`  ${e.message}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (!r.passesAA) process.exitCode = 1;
+    if (json) {
+      console.log(JSON.stringify(r, null, 2));
+      return;
+    }
+  }
+  heading(`${BRAND.brand} uicheck — deterministic UI review\n`);
+  if (r) {
+    const kind = large ? "large text / UI" : "normal text";
+    console.log(
+      `  contrast ${fg} on ${bg}: ${r.ratio}:1  →  ${r.level}${r.passesAA ? ` (passes AA for ${kind})` : ` (FAILS AA — ${kind} needs ${r.required.aa}:1)`}`,
+    );
+    for (const n of r.notes) console.log(`  note: ${n}`);
+  }
+  console.log(`\n  ASSERT (deterministic): ${ASSERTABLE_CHECKS.map((c) => c.id).join(", ")}`);
+  console.log(`  ADVISE (subjective, human-only): ${ADVISORY_ONLY.slice(0, 4).join(", ")} …`);
+  return;
+};
+
+export default HANDLERS;
diff --git a/src/commands.js b/src/commands.js
index 8bce40f4..4d77ea7d 100644
--- a/src/commands.js
+++ b/src/commands.js
@@ -106,7 +106,17 @@ export const COMMANDS = {
   ledger:
     "evidence-referenced memory — stats / verify / show / blame / query / compact / at / diff / root / ratify / retract / merge / sync / import",
   reuse: "proof-carrying code cache — query <spec> / mint <spec> --file <path> / stats",
-  context: "budgeted context assembly + completeness gate — what an edit NEEDS known",
+  context: {
+    summary:
+      "budgeted context assembly + completeness gate — what an edit NEEDS known, delivered or owed",
+    usage: 'forge context "<task>" [--budget <tokens>] [--block] [--json]',
+    flags: [
+      { flag: "--budget <tokens>", desc: "assembly budget (chars/3.6 estimate; default 6000)" },
+      { flag: "--block", desc: "print the assembled context block itself (what gets delivered)" },
+      { flag: "--json", desc: "machine-readable result (add --block to include the block)" },
+    ],
+    examples: ['forge context "update computeTax in src/tax.js" --block'],
+  },
   preflight: "assumption check — what a task names that the repo doesn't define",
   config: "provider setup — show / switch / add providers, set default model",
   route:
diff --git a/src/context.js b/src/context.js
index 2feac0f8..3aec0849 100644
--- a/src/context.js
+++ b/src/context.js
@@ -2,11 +2,13 @@
 // gate (docs/plans/substrate-v2/04-context-assembly.md). Two failures die here:
 // over-stuffing (everything competes for the window on equal terms — P3 of the
 // paper) and under-supplying (the agent edits a symbol without its callers, tests,
-// or the team's lessons, then "assumes"). Selection gets an objective function
-// (greedy knapsack by value density, with a compression ladder instead of silent
-// drops) and sufficiency becomes a COMPUTED SET: required knowledge R(edit) from
-// the atlas, missing = R \ covered — auto-fetched when resolvable, asked as a
-// derived M2 question when not. Context insufficiency stops being a feeling.
+// or the team's lessons, then "assumes"). Selection gets an objective (a greedy
+// value-density heuristic with a compression ladder instead of silent drops — no
+// approximation guarantee is claimed) and sufficiency becomes a COMPUTED SET: required
+// knowledge R(edit) from the atlas, missing = R \ covered — auto-fetched when resolvable,
+// asked as a derived M2 question when not. "Covered" means DELIVERED in the block: a
+// pointer to a file is a pending read, not coverage (review F03), and a block that cannot
+// fit the budget says so instead of claiming completion (review F02).
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { has as atlasHas, query as atlasQuery, impact } from "./atlas.js";
@@ -14,8 +16,20 @@ import { claimText, val } from "./ledger.js";
 import { loadClaims, repoLedger } from "./ledger_store.js";
 import { referencedEntities } from "./preflight.js";
 
-/** chars → tokens heuristic (calibrated in P8; consistent with the reuse estimator). */
+/** chars → tokens ESTIMATE (chars/3.6, consistent with the reuse estimator). It is not a
+ *  model tokenizer: a hard window limit needs the target model's own tokenizer, so treat
+ *  every budget here as an estimate with that stated basis. */
 export const tokensOf = (text) => Math.ceil(String(text).length / 3.6);
+/** How `tokens` is measured — reported with every assembly so nobody mistakes it for exact. */
+export const TOKEN_ESTIMATE = "chars/3.6 estimate of the rendered block";
+/** Items are joined with this separator; its cost is budgeted like any other text. */
+const SEP = "\n\n";
+/** Direct dependents listed by name before the rest are summarized as omitted. */
+const DEPS_SHOWN = 12;
+/** Lines of source shown after a definition's line in a symbol-span variant. */
+const SPAN_AFTER = 40;
+const SPAN_BEFORE = 2;
+const HEAD_LINES = 25;
 
 /** Lessons must be THIS trusted to enter the required set (spec §3: lessons*(S)). */
 export const LESSON_REQUIRED_VAL = 0.8;
@@ -100,23 +114,93 @@ export function requiredSet(root, task, { atlas = null, claims = [], nowDay = 0
 
 // An item is one injectable unit with a COMPRESSION LADDER: granularity variants from
 // full text down to a one-line pointer. The optimizer may downgrade an item instead of
-// dropping it — compression is a lossy move with a known cost, chosen explicitly,
-// never by scroll-off (spec §2).
-function fileItem(root, rel, { covers, source, score }) {
+// dropping it — compression is a lossy move with a known cost, chosen explicitly, never by
+// scroll-off (spec §2). EVERY VARIANT CARRIES ITS OWN COVERAGE (review F03): the full file
+// covers all its keys; a symbol span covers the definitions whose declaration line it shows;
+// the first-25-lines head covers only what lies inside it; a pointer (`- read <file>`)
+// covers NOTHING — it creates a pending read obligation. Availability is not delivery.
+
+/** One variant: its rendered text, estimated tokens, the keys it satisfies, the keys it only
+ *  points at (pending reads), and what it truncated. */
+const variant = (gran, text, covers, pending = [], truncated = null) => ({
+  gran,
+  text,
+  tokens: tokensOf(text),
+  covers,
+  pending,
+  ...(truncated ? { truncated } : {}),
+});
+
+/**
+ * All variants of one file, given the required keys it serves: `needs` entries are
+ * {key, kind: "def"|"file"|"tests", line?}. Ordered largest → smallest; a variant that is not
+ * smaller than the previous one is skipped.
+ */
+function fileItem(root, rel, { needs, source, score }) {
   const text = readRel(root, rel);
   if (text === null) return null;
-  const head = text.split("\n").slice(0, 25).join("\n");
-  const variants = [
-    { gran: "full", text: `// ${rel}\n${text}`, tokens: tokensOf(text) },
-    { gran: "head", text: `// ${rel} (first 25 lines)\n${head}`, tokens: tokensOf(head) },
-    { gran: "pointer", text: `- read ${rel}`, tokens: 8 },
-  ];
-  return { id: `${source}:${rel}`, source, covers, score, variants };
+  const lines = text.split("\n");
+  const total = lines.length;
+  const keys = needs.map((n) => n.key);
+  const defs = needs.filter((n) => n.kind === "def" && Number.isFinite(n.line));
+  const variants = [variant("full", `// ${rel}\n${text}`, keys)];
+  // Symbol span: the lines around the requested definitions, when the atlas knows them.
+  if (defs.length) {
+    const from = Math.max(1, Math.min(...defs.map((d) => d.line)) - SPAN_BEFORE);
+    const to = Math.min(total, Math.max(...defs.map((d) => d.line)) + SPAN_AFTER);
+    if (from > 1 || to < total) {
+      const covers = defs.filter((d) => d.line >= from && d.line <= to).map((d) => d.key);
+      variants.push(
+        variant(
+          "span",
+          `// ${rel}:${from}-${to} of ${total} (definition span)\n${lines.slice(from - 1, to).join("\n")}`,
+          covers,
+          keys.filter((k) => !covers.includes(k)),
+          { shownLines: [from, to], totalLines: total },
+        ),
+      );
+    }
+  }
+  if (total > HEAD_LINES) {
+    // The head covers a definition only if its declaration line is inside the head; a whole
+    // file or test file is never "covered" by its first 25 lines.
+    const covers = needs
+      .filter((n) => n.kind === "def" && Number.isFinite(n.line) && n.line <= HEAD_LINES)
+      .map((n) => n.key);
+    variants.push(
+      variant(
+        "head",
+        `// ${rel} (first ${HEAD_LINES} of ${total} lines)\n${lines.slice(0, HEAD_LINES).join("\n")}`,
+        covers,
+        keys.filter((k) => !covers.includes(k)),
+        { shownLines: [1, HEAD_LINES], totalLines: total },
+      ),
+    );
+  }
+  variants.push(variant("pointer", `- read ${rel}`, [], keys));
+  const ladder = [];
+  for (const v of variants.sort((a, b) => b.tokens - a.tokens))
+    if (!ladder.length || v.tokens < ladder[ladder.length - 1].tokens) ladder.push(v);
+  return { id: `${source}:${rel}`, source, covers: keys, score, variants: ladder };
 }
 
 /**
  * Assemble the context for a task: pinned required items (downgraded before dropped),
  * optional items greedily by value density, and the missing set as derived questions.
+ *
+ * Honesty contract (review F02/F03):
+ *   - `tokens` is measured on the RENDERED block (labels and separators included) with the
+ *     chars/3.6 estimate (`tokenEstimate` says so). The block never exceeds `budget` by that
+ *     measure: when even pointers cannot fit, required items are DROPPED (lowest score first)
+ *     and reported, with `overflow: true`.
+ *   - `covered` holds only keys whose content was actually delivered; `pending` holds keys the
+ *     block merely points at (a pointer, or a partial span/head) — read obligations; `missing`
+ *     holds keys neither delivered nor pointed at (unresolvable, or dropped on overflow).
+ *   - `ok` means every required key was DELIVERED within budget: no missing, no pending, no
+ *     overflow. It is syntactic delivery, not semantic sufficiency.
+ *   - Optional items are chosen greedily by value density (score per token) with per-source
+ *     diminishing returns — a heuristic, with no knapsack or set-cover guarantee (the
+ *     per-source discount breaks the preconditions those guarantees need).
  * @param {string} root
  * @param {string} task
  * @param {{budget?:number, atlas?:any, claims?:any[], nowDay?:number}} [opts]
@@ -131,29 +215,46 @@ export function assemble(
   const required = requiredSet(root, task, { atlas, claims: allClaims, nowDay });
 
   // --- build candidate items, keyed by what they cover -------------------------------
+  // File-backed keys are grouped per file first, so one file is one item whose variants
+  // know exactly which of its keys each one delivers.
+  /** @type {Map<string, {needs: {key:string, kind:string, line?:number}[], source:string, score:number}>} */
+  const files = new Map();
+  const need = (rel, n, source, score) => {
+    const f = files.get(rel) ?? { needs: [], source, score };
+    f.needs.push(n);
+    if (score > f.score) {
+      f.score = score;
+      f.source = source;
+    }
+    files.set(rel, f);
+  };
   const items = [];
+  /** @type {{id:string, shown:number, total:number, omitted:string[]}[]} */
+  const truncated = [];
   for (const r of required) {
     if (!r.resolvable) continue;
     if (r.kind === "def") {
       const hit = atlasQuery(atlas, r.name).find((s) => s.name === r.name || s.qname === r.name);
-      if (hit?.file) {
-        const it = fileItem(root, hit.file, { covers: [r.key], source: "def", score: 1 });
-        if (it) items.push(it);
-      }
+      if (hit?.file) need(hit.file, { key: r.key, kind: "def", line: hit.line }, "def", 1);
     } else if (r.kind === "file") {
-      const it = fileItem(root, r.name, { covers: [r.key], source: "def", score: 1 });
-      if (it) items.push(it);
+      need(r.name, { key: r.key, kind: "file" }, "def", 1);
     } else if (r.kind === "tests") {
-      const it = fileItem(root, r.name, { covers: [r.key], source: "tests", score: 0.9 });
-      if (it) items.push(it);
+      need(r.name, { key: r.key, kind: "tests" }, "tests", 0.9);
     } else if (r.kind === "deps" && atlas) {
-      const hop1 = impact(atlas, r.name, { maxHops: 1 })
-        .impacted.filter((x) => x.hopDistance === 1)
-        .slice(0, 12);
+      const hop1 = impact(atlas, r.name, { maxHops: 1 }).impacted.filter(
+        (x) => x.hopDistance === 1,
+      );
+      const shown = hop1.slice(0, DEPS_SHOWN);
+      const omitted = hop1.slice(DEPS_SHOWN).map((x) => `${x.node.name} (${x.node.file})`);
+      if (omitted.length)
+        truncated.push({ id: `deps:${r.name}`, shown: shown.length, total: hop1.length, omitted });
       const text = hop1.length
         ? [
             `direct dependents of ${r.name} (edit these with it or verify them):`,
-            ...hop1.map((x) => `  - ${x.node.name} (${x.node.file}, via ${x.edgeKinds[0]})`),
+            ...shown.map((x) => `  - ${x.node.name} (${x.node.file}, via ${x.edgeKinds[0]})`),
+            ...(omitted.length
+              ? [`  … and ${omitted.length} more, omitted here (\`forge impact ${r.name}\`)`]
+              : []),
           ].join("\n")
         : `no direct dependents of ${r.name} found in the atlas`;
       items.push({
@@ -161,22 +262,33 @@ export function assemble(
         source: "deps",
         covers: [r.key],
         score: 1,
-        variants: [{ gran: "full", text, tokens: tokensOf(text) }],
+        variants: [
+          variant("full", text, [r.key]),
+          variant("pointer", `- dependents: \`forge impact ${r.name}\``, [], [r.key]),
+        ],
       });
     } else if (r.kind === "lesson") {
       const c = allClaims.find((x) => x.id === r.name);
       if (c) {
         const text = `lesson (val ${val(c, nowDay).toFixed(2)}): ${c.body.correctedBehavior}`;
+        const id8 = c.id.slice(0, 8);
         items.push({
-          id: `lesson:${c.id.slice(0, 8)}`,
+          id: `lesson:${id8}`,
           source: "lesson",
           covers: [r.key],
           score: 0.95,
-          variants: [{ gran: "full", text, tokens: tokensOf(text) }],
+          variants: [
+            variant("full", text, [r.key]),
+            variant("pointer", `- lesson: \`forge ledger show ${id8}\``, [], [r.key]),
+          ],
         });
       }
     }
   }
+  for (const [rel, f] of files) {
+    const it = fileItem(root, rel, f);
+    if (it) items.push(it);
+  }
   // Optional extras: trusted scope-matching facts (nice-to-have, never required).
   for (const c of allClaims) {
     if (c.kind !== "fact" || c.tombstone) continue;
@@ -188,37 +300,51 @@ export function assemble(
       source: "fact",
       covers: [],
       score: 0.3 + 0.4 * v,
-      variants: [{ gran: "full", text, tokens: tokensOf(text) }],
+      variants: [variant("full", text, [])],
     });
   }
 
-  // A symbol's definition and an explicitly named file often resolve to the SAME file —
-  // merge items by id (union of covered keys) so one span never gets injected twice.
-  const byId = new Map();
-  for (const it of items) {
-    const prev = byId.get(it.id);
-    if (prev) {
-      prev.covers = [...new Set([...prev.covers, ...it.covers])];
-      prev.score = Math.max(prev.score, it.score);
-    } else byId.set(it.id, it);
-  }
-  const merged = [...byId.values()];
-
   // --- selection: pin required coverage, downgrade before dropping -------------------
-  const pinned = merged.filter((i) => i.covers.length);
-  const optional = merged
+  const pinned = items.filter((i) => i.covers.length).sort((a, b) => (a.id < b.id ? -1 : 1));
+  // Value density: score per token of the item's full variant (ties by id, deterministic).
+  const density = (i) => i.score / Math.max(1, i.variants[0].tokens);
+  const optional = items
     .filter((i) => !i.covers.length)
-    .sort((a, b) => b.score - a.score || (a.id < b.id ? -1 : 1));
-  const chosen = pinned.map((i) => ({ item: i, v: 0 })); // v = variant index
-  const used = () => chosen.reduce((n, c) => n + c.item.variants[c.v].tokens, 0);
+    .sort((a, b) => density(b) - density(a) || (a.id < b.id ? -1 : 1));
+  let chosen = pinned.map((i) => ({ item: i, v: 0 })); // v = variant index
+  const sepTokens = tokensOf(SEP);
+  // Per-piece ceilings plus separators bound the rendered block's estimate from above.
+  const used = () =>
+    chosen.reduce((n, c) => n + c.item.variants[c.v].tokens, 0) +
+    Math.max(0, chosen.length - 1) * sepTokens;
   // Downgrade the largest pinned item one rung at a time until the pins fit the budget.
   while (used() > budget) {
     const cand = chosen
       .filter((c) => c.v < c.item.variants.length - 1)
-      .sort((a, b) => b.item.variants[b.v].tokens - a.item.variants[a.v].tokens)[0];
-    if (!cand) break; // everything is already a pointer — required coverage beats budget
+      .sort(
+        (a, b) =>
+          b.item.variants[b.v].tokens - a.item.variants[a.v].tokens ||
+          (a.item.id < b.item.id ? -1 : 1),
+      )[0];
+    if (!cand) break;
     cand.v++;
   }
+  // Everything is already at its smallest rung and still does not fit: the budget cannot
+  // hold the required set. Drop pinned items (lowest score first, then largest) and SAY so —
+  // never return a block over budget, and never call it complete (F02).
+  /** @type {string[]} */
+  const dropped = [];
+  while (used() > budget && chosen.length) {
+    const worst = [...chosen].sort(
+      (a, b) =>
+        a.item.score - b.item.score ||
+        b.item.variants[b.v].tokens - a.item.variants[a.v].tokens ||
+        (a.item.id < b.item.id ? 1 : -1),
+    )[0];
+    chosen = chosen.filter((c) => c !== worst);
+    dropped.push(worst.item.id);
+  }
+  const overflow = dropped.length > 0;
   // Greedy fill by value density with per-source diminishing returns. The cut is checked
   // BEFORE taking an item, and skips only that source — other sources keep competing
   // (a `break` here used to end the whole fill, and only after taking a 6th item).
@@ -226,14 +352,20 @@ export function assemble(
   for (const item of optional) {
     const taken = perSource[item.source] ?? 0;
     if (SOURCE_DISCOUNT ** taken < SOURCE_VALUE_FLOOR) continue; // 4th+ from this source
-    const variant = item.variants[0];
-    if (used() + variant.tokens > budget) continue;
+    const v = item.variants[0];
+    if (used() + v.tokens + (chosen.length ? sepTokens : 0) > budget) continue;
     chosen.push({ item, v: 0 });
     perSource[item.source] = taken + 1;
   }
 
-  const covered = new Set(chosen.flatMap((c) => c.item.covers));
-  const missing = required.filter((r) => !r.resolvable || !covered.has(r.key));
+  const block = chosen.map((c) => c.item.variants[c.v].text).join(SEP);
+  const covered = new Set(chosen.flatMap((c) => c.item.variants[c.v].covers));
+  const pending = new Set(
+    chosen.flatMap((c) => c.item.variants[c.v].pending).filter((k) => !covered.has(k)),
+  );
+  const missing = required.filter(
+    (r) => !r.resolvable || (!covered.has(r.key) && !pending.has(r.key)),
+  );
   const questions = missing
     .filter((r) => !r.resolvable)
     .map((r) =>
@@ -241,32 +373,57 @@ export function assemble(
         ? `The task names \`${r.name}\` but the repo doesn't define it — which file implements it (or is it new)?`
         : `The task names \`${r.name}\` but that file doesn't exist — where should this live?`,
     );
+  for (const c of chosen) {
+    const t = c.item.variants[c.v].truncated;
+    if (t) truncated.push({ id: c.item.id, ...t });
+  }
 
   return {
-    ok: missing.length === 0,
+    ok: missing.length === 0 && pending.size === 0 && !overflow,
     budget,
-    tokens: used(),
+    tokens: tokensOf(block),
+    tokenEstimate: TOKEN_ESTIMATE,
+    overflow,
+    ...(overflow ? { dropped } : {}),
     required: required.map((r) => r.key),
     covered: [...covered].sort(),
+    pending: [...pending].sort(),
     missing: missing.map((r) => r.key),
     questions,
+    truncated,
     selection: chosen.map((c) => ({
       id: c.item.id,
       source: c.item.source,
       gran: c.item.variants[c.v].gran,
       tokens: c.item.variants[c.v].tokens,
+      covers: c.item.variants[c.v].covers,
     })),
-    block: chosen.map((c) => c.item.variants[c.v].text).join("\n\n"),
+    block,
   };
 }
 
 /** Human rendering for `forge context`. */
 export function renderContext(r) {
   const lines = ["Forge context — budgeted assembly + completeness gate", ""];
+  const state = r.ok ? "COMPLETE" : r.overflow ? "OVER BUDGET — INCOMPLETE" : "INCOMPLETE";
   lines.push(
-    `  budget: ${r.tokens}/${r.budget} tokens · required ${r.required.length} · ${r.ok ? "COMPLETE" : "INCOMPLETE"}`,
+    `  budget: ${r.tokens}/${r.budget} tokens (${r.tokenEstimate ?? TOKEN_ESTIMATE}) · required ${r.required.length} · ${state}`,
   );
   for (const s of r.selection) lines.push(`    + ${s.id} [${s.gran}] ${s.tokens}t`);
+  if (r.overflow)
+    lines.push(
+      "",
+      `  over budget: even pointers could not fit — dropped ${(r.dropped ?? []).join(", ")}`,
+    );
+  if (r.pending?.length) {
+    lines.push("", "  pending reads (pointed at, not delivered — read before acting):");
+    for (const p of r.pending) lines.push(`    - ${p}`);
+  }
+  for (const t of r.truncated ?? [])
+    if (t.omitted?.length)
+      lines.push(
+        `    ~ ${t.id}: ${t.omitted.length} of ${t.total} omitted (${t.omitted.slice(0, 5).join(", ")}${t.omitted.length > 5 ? ", …" : ""})`,
+      );
   if (r.missing.length) {
     lines.push("", "  missing (computed, not a feeling):");
     for (const m of r.missing) lines.push(`    - ${m}`);
diff --git a/src/cortex.js b/src/cortex.js
index 6409ced9..46e3845e 100644
--- a/src/cortex.js
+++ b/src/cortex.js
@@ -4,7 +4,7 @@
 // contradiction. Kept fs-thin and deterministic (day + ids passed in) so it's testable
 // without any hook wiring.
 
-import { recordLessonEvent, supersedeLessonClaim } from "./ledger_bridge.js";
+import { equivalentLesson, recordLessonEvent, supersedeLessonClaim } from "./ledger_bridge.js";
 import { ledgerLessons, mergedLessons } from "./ledger_read.js";
 import { recordUse, repoLedger } from "./ledger_store.js";
 import {
@@ -245,15 +245,45 @@ export function applyDistillation(root, lessonId, distilled) {
   // supersede below rewrite it there (save() is a ledger-only no-op that still succeeds).
   const lesson = localLessons(root, 0).find((l) => l.id === lessonId);
   if (!lesson) return false;
-  const updated = {
+  const rewritten = {
     ...lesson,
     whatWentWrong: distilled.whatWentWrong,
     correctedBehavior: distilled.correctedBehavior,
   };
+  // A model rewrite is a PROPOSAL (review F07): unless it is equivalent by the narrow rule
+  // (same text up to case/whitespace/punctuation, no semantic conflict), the lesson's earned
+  // standing does not carry over to the new wording — it restarts as a candidate that has to
+  // earn its own confirmations. What it earned before stays inspectable in provenance and on
+  // the ledger's superseded parent claim.
+  const hadEvidence =
+    (lesson.evidenceCount ?? 0) > 0 ||
+    (lesson.contradictionCount ?? 0) > 0 ||
+    lesson.status === "active";
+  const updated =
+    equivalentLesson(lesson, rewritten) || !hadEvidence
+      ? rewritten
+      : {
+          ...rewritten,
+          status: "candidate",
+          evidenceCount: 0,
+          contradictionCount: 0,
+          quarantineReconfirms: 0,
+          lastConfirmedDay: lesson.createdDay ?? lesson.lastConfirmedDay,
+          provenance: {
+            ...(lesson.provenance ?? {}),
+            rewrittenFrom: {
+              whatWentWrong: lesson.whatWentWrong,
+              correctedBehavior: lesson.correctedBehavior,
+              status: lesson.status,
+              evidenceCount: lesson.evidenceCount ?? 0,
+              contradictionCount: lesson.contradictionCount ?? 0,
+            },
+          },
+        };
   const ok = save(root, updated).ok;
-  // A body rewrite changes the content-addressed claim id — supersede in the ledger
-  // (mint the distilled claim, carry the evidence over, tombstone the template claim)
-  // or the lesson's history splits across two disjoint claims.
+  // A body rewrite changes the content-addressed claim id — supersede in the ledger (mint
+  // the distilled claim, tombstone the template claim as its parent; evidence carries over
+  // only for an equivalent rewrite) so the lesson's history stays linked, not split.
   if (ok) supersedeLessonClaim(root, lesson, updated);
   return ok;
 }
diff --git a/src/cost_report.js b/src/cost_report.js
index 6bcb275d..40fe17db 100644
--- a/src/cost_report.js
+++ b/src/cost_report.js
@@ -351,7 +351,8 @@ export function estimateSpendFromLogs({ root = process.cwd(), fetchImpl, date }
       else unpriced.push(model);
       modelBreakdown.push({
         model,
-        cost,
+        // An unpriced model's cost is UNKNOWN, not zero (review A10).
+        cost: pricing ? cost : null,
         priced: Boolean(pricing),
         priceSource: pricing
           ? `${pricing.source}${pricing.basis ? `:${pricing.basis}` : ""}`
@@ -362,8 +363,20 @@ export function estimateSpendFromLogs({ root = process.cwd(), fetchImpl, date }
         cacheReadTokens: u.cacheReadTokens,
       });
     }
-    modelBreakdown.sort((a, b) => b.cost - a.cost);
-    return { totalCost, sessions, byModel: modelBreakdown, unpriced };
+    modelBreakdown.sort((a, b) => (b.cost ?? -1) - (a.cost ?? -1));
+    // Label what this number IS (review A10): an estimate — logged tokens × published
+    // per-token prices, in USD — not an invoice; complete only when every model was priced;
+    // and it never includes verifier/test runtime or non-model tool costs.
+    return {
+      totalCost,
+      currency: "USD",
+      basis: "estimate: logged tokens × published per-token prices (not an invoice)",
+      complete: unpriced.length === 0,
+      excludes: ["verifier/test runtime", "tool and API costs outside model calls"],
+      sessions,
+      byModel: modelBreakdown,
+      unpriced,
+    };
   } catch {
     return null;
   }
diff --git a/src/dash.html b/src/dash.html
index 356e15d8..abf4fcc6 100644
--- a/src/dash.html
+++ b/src/dash.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="forge-dash-token" content="__FORGE_DASH_TOKEN__" />
     <title>forge dash</title>
     <style>
       /* Taste discipline (07-ui-quality-gate.md): ONE accent (forge ember, the brand's
@@ -502,6 +503,7 @@
         <span class="mono">forge sync</span>, then work a session. Claims, cost,
         and trends fill in here as the substrate records what happens.
       </div>
+      <div id="read-errors" class="empty-banner" role="alert" hidden></div>
 
       <section class="panel wide legend" id="legend" hidden>
         <h2>What each panel means</h2>
@@ -803,16 +805,23 @@ <h2>
         const events = stages.reduce((n, [, s]) => n + (s.events || 0), 0);
         const spend = d.spend;
         const noData =
-          (!spend || spend.totalCost <= 0) && saved === 0 && events === 0;
+          (!spend || !(spend.totalCost > 0)) && saved === 0 && events === 0;
         if (noData) {
-          $("cost-stats").innerHTML =
-            '<div class="empty">no cost data yet — run forge substrate or forge cost to start tracking</div>';
+          $("cost-stats").innerHTML = spend
+            ? '<div class="empty">no cost data yet — run forge substrate or forge cost to start tracking</div>'
+            : '<div class="empty">spend unknown — no session logs were found (that is not $0)</div>';
         } else {
+          // An ESTIMATE (logged tokens × catalog prices, USD) — never labeled as a bill, and
+          // marked partial when some model had no price (review A10).
           $("cost-stats").innerHTML =
             (spend && spend.totalCost > 0
               ? '<span class="stat"><span class="n ember">$' +
                 spend.totalCost.toFixed(2) +
-                '</span><span class="l">real spend</span></span>' +
+                '</span><span class="l">est. spend (USD, logged tokens × list price' +
+                (spend.complete === false
+                  ? `; partial — ${spend.unpriced?.length ?? 0} model(s) unpriced`
+                  : "") +
+                ")</span></span>" +
                 '<span class="stat"><span class="n">' +
                 spend.sessions +
                 '</span><span class="l">sessions</span></span>'
@@ -835,8 +844,10 @@ <h2>
                 (m) =>
                   '<tr><td class="mono">' +
                   esc(m.model) +
-                  '</td><td class="num">$' +
-                  m.cost.toFixed(4) +
+                  '</td><td class="num">' +
+                  (m.priced === false || m.cost == null
+                    ? "unpriced"
+                    : `$${m.cost.toFixed(4)}`) +
                   '</td><td class="num">' +
                   (m.inTokens || 0).toLocaleString() +
                   '</td><td class="num">' +
@@ -1147,6 +1158,15 @@ <h2>
       function renderEmptyState(d) {
         const es = $("empty-state");
         if (es) es.hidden = !d?.meta?.empty;
+        // A store that could not be READ is not an empty one — say which, and why.
+        const re = $("read-errors");
+        const errs = d?.meta?.errors ?? [];
+        if (re) {
+          re.hidden = !errs.length;
+          re.textContent = errs.length
+            ? `Could not read: ${errs.map((e) => `${e.section} (${e.error})`).join("; ")} — the panels below are incomplete, not empty.`
+            : "";
+        }
       }
 
       async function refresh() {
@@ -1180,9 +1200,12 @@ <h2>
           if (reason === null) return; // cancelled
           body.reason = reason;
         }
+        // The per-session write token the server embedded in this page (CSRF guard).
+        const token =
+          document.querySelector('meta[name="forge-dash-token"]')?.getAttribute("content") ?? "";
         const res = await fetch(`/api/${act}`, {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", "x-forge-token": token },
           body: JSON.stringify(body),
         });
         const r = await res.json().catch(() => ({}));
diff --git a/src/dash.js b/src/dash.js
index 2d323556..82dfc722 100644
--- a/src/dash.js
+++ b/src/dash.js
@@ -7,6 +7,7 @@
 // (human-only ḥikma promotion, mints a decision claim) and POST /api/retract
 // (tombstone with a reason). Both are append-only, so the dashboard can never
 // corrupt the ledger; everything else stays read-only.
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { basename, dirname, join } from "node:path";
@@ -101,14 +102,24 @@ function metricsSection(root) {
  * @param {{nowDay?: number}} [opts]
  */
 export function dashData(root, { nowDay = epochDay() } = {}) {
+  // A section that could not be read degrades to empty — but SAYS so (review A11): an
+  // unreadable store must never render as a healthy, empty one.
+  /** @type {{section: string, error: string}[]} */
+  const errors = [];
+  const failed = (section, e) =>
+    errors.push({ section, error: String(/** @type {any} */ (e)?.message ?? e).slice(0, 200) });
   let ledger = emptyLedger();
   try {
     ledger = ledgerSection(root, nowDay);
-  } catch {}
+  } catch (e) {
+    failed("ledger", e);
+  }
   let metrics = { stages: {}, recent: [] };
   try {
     metrics = metricsSection(root);
-  } catch {}
+  } catch (e) {
+    failed("metrics", e);
+  }
   let atlas = { built: false, symbols: 0, files: 0 };
   try {
     const a = loadAtlas(root);
@@ -118,18 +129,26 @@ export function dashData(root, { nowDay = epochDay() } = {}) {
         symbols: a.symbols?.length ?? 0,
         files: a.files ?? 0,
       };
-  } catch {}
+  } catch (e) {
+    failed("atlas", e);
+  }
   let spend = null;
   try {
     spend = estimateSpendFromLogs({ root });
-  } catch {}
+  } catch (e) {
+    failed("spend", e);
+  }
   // First-run signal for the empty-state copy: a truly untouched .forge/ has no
   // ledger claims AND no metrics events. `metrics.recent` is capped but only ever
   // empty when zero events exist, so it doubles as the metrics-count check — no
   // extra read, and (like everything above) it never throws.
   const meta = {
-    empty: (ledger?.stats?.total ?? 0) === 0 && (metrics?.recent?.length ?? 0) === 0,
+    empty:
+      errors.length === 0 &&
+      (ledger?.stats?.total ?? 0) === 0 &&
+      (metrics?.recent?.length ?? 0) === 0,
     forgeDir: join(root, ".forge"),
+    ...(errors.length ? { errors } : {}),
   };
   return { repo: basename(root), nowDay, meta, ledger, metrics, atlas, spend };
 }
@@ -463,31 +482,73 @@ async function handleWrite(root, pathname, req, res) {
 
 const WRITE_ROUTES = new Set(["/api/ratify", "/api/retract"]);
 
-// CSRF + DNS-rebinding guard for the two write routes. The dashboard is a localhost
-// convenience server with no auth, so an unguarded POST is reachable by (a) any web page
-// the user visits (a cross-site form/fetch — the browser attaches an Origin), and (b) a
-// DNS-rebinding attack (an attacker domain rebinds to 127.0.0.1 — the request then carries
-// the ATTACKER's Host, not the loopback one). We refuse a write unless the Host names the
-// loopback interface AND any browser Origin is that same loopback origin; native clients
-// (curl, the CLI) send no Origin and pass. Skipped entirely for an explicit non-loopback
-// bind — passing a public host is the documented "on your own head" opt-out.
+// Access control (review F13). The dashboard is a localhost convenience server with no login,
+// so it defends itself in three layers:
+//  1. EVERY route (reads too) answers only requests addressed to it: the Host header must name
+//     the loopback interface AND the port it listens on. A DNS-rebinding page (an attacker
+//     domain re-pointed at 127.0.0.1) carries the attacker's Host and is refused — before, only
+//     the two POSTs checked Host, and GET /api/data served the whole ledger to a foreign Host.
+//  2. Writes need a per-session CAPABILITY TOKEN: a random value minted when the server starts,
+//     embedded in the page it serves, and sent back in the `x-forge-token` header. Another
+//     page — including another localhost port — cannot read it, so it cannot forge a write.
+//  3. A browser write must also come from EXACTLY this origin (http, loopback host, same
+//     port) — the old check compared the hostname only, so any localhost port passed.
+// An explicit non-loopback bind (`--host 0.0.0.0`) skips the Host allow-list (its valid names
+// are unknowable here — the documented "on your own head" opt-out) but keeps the token.
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
-const normHost = (h) =>
-  String(h ?? "")
-    .replace(/:\d+$/, "")
-    .replace(/^\[|\]$/g, "")
+export const TOKEN_HEADER = "x-forge-token";
+const TOKEN_PLACEHOLDER = "__FORGE_DASH_TOKEN__";
+
+/** Split a Host header value into {host, port}; null when it is missing or malformed. */
+function parseHostHeader(value) {
+  const raw = String(value ?? "")
+    .trim()
     .toLowerCase();
-function writeAllowed(req, boundHost) {
-  if (!LOOPBACK_HOSTS.has(boundHost)) return true; // non-loopback bind: explicit opt-out
-  if (!LOOPBACK_HOSTS.has(normHost(req.headers.host))) return false; // DNS-rebinding
+  const m = /^(\[[0-9a-f:.]+\]|[^:[\]\s/]+)(?::(\d{1,5}))?$/.exec(raw);
+  if (!m) return null;
+  return { host: m[1].replace(/^\[|\]$/g, ""), port: m[2] ? Number(m[2]) : null };
+}
+
+/**
+ * Is this request addressed to this server — a loopback name, on the port it listens on?
+ * Applied to every route. A non-loopback bind is an explicit opt-out (always true).
+ * @param {{headers: Record<string, any>}} req
+ * @param {{boundHost: string, port: number}} bound
+ */
+export function hostAllowed(req, { boundHost, port }) {
+  if (!LOOPBACK_HOSTS.has(boundHost)) return true;
+  const h = parseHostHeader(req.headers.host);
+  if (!h || !LOOPBACK_HOSTS.has(h.host)) return false;
+  return (h.port ?? 80) === port;
+}
+
+/**
+ * May this request write? The session's capability token (constant-time compared) AND, when a
+ * browser sent an Origin, exactly this server's origin — scheme, loopback host and port.
+ * @param {{headers: Record<string, any>}} req
+ * @param {{boundHost: string, port: number, token: string}} bound
+ */
+export function writeAllowed(req, { boundHost, port, token }) {
+  const got = Buffer.from(String(req.headers[TOKEN_HEADER] ?? ""));
+  const want = Buffer.from(String(token ?? ""));
+  if (!want.length || got.length !== want.length || !timingSafeEqual(got, want)) return false;
   const origin = req.headers.origin;
-  if (origin) {
+  if (origin !== undefined) {
+    let u;
     try {
-      if (!LOOPBACK_HOSTS.has(new URL(origin).hostname.toLowerCase())) return false; // CSRF
+      u = new URL(String(origin));
     } catch {
-      return false; // a malformed Origin is never trusted
+      return false; // a malformed (or "null") Origin is never trusted
     }
+    if (u.protocol !== "http:") return false;
+    const oport = u.port ? Number(u.port) : 80;
+    if (LOOPBACK_HOSTS.has(boundHost)) {
+      const oh = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+      if (!LOOPBACK_HOSTS.has(oh) || oport !== port) return false;
+    } else if (u.host.toLowerCase() !== String(req.headers.host ?? "").toLowerCase()) return false;
   }
+  const site = req.headers["sec-fetch-site"];
+  if (site !== undefined && site !== "same-origin" && site !== "none") return false;
   return true;
 }
 
@@ -497,19 +558,43 @@ function writeAllowed(req, boundHost) {
  * /api/radar → dependency rings (cache-only), GET /api/timeline → durable event
  * stream, GET /api/impact?target=X → blast radius (when an atlas exists), POST
  * /api/ratify and POST /api/retract → the spec's two append-only writes. Else 404.
- * Localhost-only by default — pass a host explicitly to expose it, on your own head.
+ * Localhost-only by default — pass a host explicitly to expose it, on your own head. Every
+ * route checks the Host header; writes also need the page's session token (see above).
  * @param {string} root
  * @param {{port?: number, host?: string}} [opts]
  * @returns {import("node:http").Server}
  */
 export function serve(root, { port = 4242, host = "127.0.0.1" } = {}) {
-  const html = readFileSync(HTML_PATH, "utf8"); // read once at startup, self-contained
+  // The per-session capability token (F13): minted at startup, embedded in the page.
+  const token = randomBytes(24).toString("hex");
+  // read once at startup, self-contained; the token rides in a <meta> the page reads
+  const html = readFileSync(HTML_PATH, "utf8").replaceAll(TOKEN_PLACEHOLDER, token);
+  const boundHost = String(host)
+    .replace(/^\[|\]$/g, "")
+    .toLowerCase();
   const server = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", "http://localhost");
+    const addr = server.address();
+    const bound = {
+      boundHost,
+      port: addr && typeof addr === "object" ? addr.port : port,
+      token,
+    };
+    // Every route: refuse a request that is not addressed to this server (DNS rebinding).
+    if (!hostAllowed(req, bound))
+      return sendJson(res, 403, {
+        error: "refused: the Host header does not name this loopback server (DNS-rebinding guard)",
+      });
+    let url;
+    try {
+      url = new URL(req.url ?? "/", "http://localhost");
+    } catch {
+      return sendJson(res, 400, { error: "malformed request URL" });
+    }
     if (req.method === "POST" && WRITE_ROUTES.has(url.pathname)) {
-      if (!writeAllowed(req, host)) {
+      if (!writeAllowed(req, bound)) {
         sendJson(res, 403, {
-          error: "write refused: cross-origin or non-loopback request (CSRF/DNS-rebinding guard)",
+          error:
+            "write refused: missing session token or foreign origin (CSRF/DNS-rebinding guard) — use the dashboard page",
         });
         return;
       }
@@ -526,6 +611,10 @@ export function serve(root, { port = 4242, host = "127.0.0.1" } = {}) {
       res.writeHead(200, {
         "content-type": "text/html; charset=utf-8",
         "cache-control": "no-store",
+        // The page holds the write token: never let another site frame it (clickjacking).
+        "x-frame-options": "DENY",
+        "content-security-policy": "frame-ancestors 'none'",
+        "referrer-policy": "no-referrer",
       });
       return res.end(html);
     }
@@ -544,7 +633,18 @@ export function serve(root, { port = 4242, host = "127.0.0.1" } = {}) {
       );
     if (url.pathname === "/api/spend") {
       const spend = estimateSpendFromLogs({ root });
-      return sendJson(res, 200, spend || { totalCost: 0, sessions: 0, byModel: [] });
+      // No logs is UNKNOWN spend, never $0 (review A10).
+      return sendJson(
+        res,
+        200,
+        spend || {
+          available: false,
+          reason: "no Claude session logs found — spend is unknown, not zero",
+          totalCost: null,
+          sessions: 0,
+          byModel: [],
+        },
+      );
     }
     if (url.pathname === "/api/impact") {
       const target = url.searchParams.get("target");
@@ -565,5 +665,7 @@ export function serve(root, { port = 4242, host = "127.0.0.1" } = {}) {
     return sendJson(res, 404, { error: "not found" });
   });
   server.listen(port, host);
+  // Exposed for the CLI/tests (the page itself carries it for the browser).
+  Object.defineProperty(server, "dashToken", { value: token, enumerable: false });
   return server;
 }
diff --git a/src/imagine.js b/src/imagine.js
index 2093b7ee..be3f5804 100644
--- a/src/imagine.js
+++ b/src/imagine.js
@@ -3,10 +3,16 @@
 // exact-structure half: entities → blast radius → predicted breaks with confidence.
 // This module adds impacted-test SELECTION — the minimal dry-run suite that makes
 // pre-action simulation affordable at all (minutes → seconds vs "run everything") —
-// and the sandboxed worktree runner (spec §2.2) that EXECUTES that suite: dryRun()
-// checks out HEAD into an ephemeral `git worktree`, runs the suite there, parses the
-// TAP summary, and always discards the sandbox. Selection stays useful on its own as
+// and the isolated-checkout runner (spec §2.2) that EXECUTES that suite: dryRun()
+// checks out HEAD into an ephemeral, detached `git worktree`, runs the suite there, parses
+// the TAP summary, and always discards the checkout. Selection stays useful on its own as
 // "run these, in this order"; dryRun turns the prediction into measured evidence.
+//
+// What it is NOT (review A05): a security sandbox. A git worktree isolates the CHECKOUT —
+// the files the tests see — and nothing else: the tests run with this user's network,
+// credentials, home directory and process permissions. And it runs the COMMITTED baseline
+// (HEAD), not an uncommitted patch. Untrusted test code needs a restricted execution
+// backend, which this is not.
 import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -91,7 +97,7 @@ const locFile = (line) => {
 /**
  * @typedef {{ok: boolean, reason?: string, passed?: number, failed?: number,
  *   perFile?: Record<string, "pass"|"fail">, durationMs?: number, runner?: string,
- *   output?: string, worktree?: string}} DryRunVerdict
+ *   output?: string, worktree?: string, unsupported?: boolean}} DryRunVerdict
  */
 
 /**
@@ -115,8 +121,34 @@ export function tapSummary(stdout) {
 }
 
 /**
- * Sandboxed dry-run of a selected suite — the simulation half of ĉ = g(a, C)
- * (spec §2.2): run the tests in an EPHEMERAL `git worktree` of HEAD and discard it.
+ * Why a selected suite cannot be dry-run under `node --test`, or null when it can: a test
+ * file node cannot execute natively (anything but .js/.mjs/.cjs), or a package whose
+ * declared test script uses another runner. Pure w.r.t. the tree (reads package.json).
+ * @param {string} dir the checkout the suite would run in
+ * @param {string[]} tests repo-relative test paths
+ * @returns {string|null}
+ */
+export function unsupportedRunner(dir, tests) {
+  const foreign = tests.map(String).filter((t) => !/\.(?:c|m)?js$/.test(t));
+  if (foreign.length)
+    return `unsupported runner: forge's dry-run executes node:test files only, and ${foreign.slice(0, 3).join(", ")}${foreign.length > 3 ? ", …" : ""} ${foreign.length > 1 ? "are not" : "is not"} one — run the project's own runner on them`;
+  try {
+    const script = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"))?.scripts?.test;
+    if (
+      typeof script === "string" &&
+      script.trim() &&
+      !/no test specified/.test(script) &&
+      !/\bnode\s+(--[\w-]+(=\S+)?\s+)*--test\b/.test(script)
+    )
+      return `unsupported runner: the project's tests run under \`${script.slice(0, 60)}\`, not node:test — forge will not guess an adapter; run that command on the selected files`;
+  } catch {} // no/unreadable package.json → node:test is the only runner in play
+  return null;
+}
+
+/**
+ * Isolated-checkout dry-run of a selected suite — the simulation half of ĉ = g(a, C)
+ * (spec §2.2): run the tests in an EPHEMERAL, detached `git worktree` of HEAD and discard
+ * it. Isolation is of the CHECKOUT only — not network, credentials, home or permissions.
  * The worktree is HEAD, not the working tree — worktrees share the object store,
  * never uncommitted files — so callers MUST surface that a dirty tree dry-runs the
  * last commit, not the in-flight proposal (the CLI refuses dirty trees by default).
@@ -133,7 +165,7 @@ export function dryRun(root, { tests, timeoutMs = 120000 } = {}) {
   if (!hasBin("git"))
     return {
       ok: false,
-      reason: "git not found — the sandbox is a git worktree",
+      reason: "git not found — the isolated checkout is a git worktree",
     };
   try {
     execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
@@ -161,17 +193,14 @@ export function dryRun(root, { tests, timeoutMs = 120000 } = {}) {
       const msg = /** @type {{stderr?: Buffer}} */ (e).stderr?.toString().trim() || String(e);
       return { ok: false, reason: `git worktree add failed: ${msg}` };
     }
-    // Runner policy: always `node --test <files...>` — a custom package test script
-    // (jest, vitest, …) is a WHOLE-SUITE command that can't be scoped per-file safely,
-    // which would defeat minimal selection. We still run node --test and say so, so a
-    // surprising verdict is attributable to the runner mismatch.
-    let runner = "node --test";
-    try {
-      const pkg = JSON.parse(readFileSync(join(wt, "package.json"), "utf8"));
-      const script = pkg?.scripts?.test;
-      if (script && !/\bnode\s+(--[\w-]+\s+)*--test\b/.test(script))
-        runner = `node --test (package.json test script is custom: ${String(script).slice(0, 60)})`;
-    } catch {} // no/unreadable package.json → default runner
+    // Runner policy: this dry-run executes `node --test <files...>` and NOTHING else. A
+    // project whose tests run under another runner (jest, vitest, mocha, pytest — a
+    // whole-suite command that cannot be scoped per file) gets an explicit UNSUPPORTED
+    // result instead of a node:test run of files written for a different runner, whose
+    // "failures" would be the adapter's, not the code's (review A05).
+    const runner = "node --test";
+    const unsupported = unsupportedRunner(wt, tests);
+    if (unsupported) return { ok: false, unsupported: true, reason: unsupported, runner };
     // TAP reporter is forced: the default reporter depends on TTY-ness, and the
     // `# pass/# fail` summary below is the contract this parser relies on. The env
     // must NOT leak a parent test-runner's context — when dryRun itself runs under
@@ -272,7 +301,7 @@ export function dryRun(root, { tests, timeoutMs = 120000 } = {}) {
   try {
     result = body();
   } finally {
-    // ALWAYS discard the sandbox — a leaked worktree pins refs and litters
+    // ALWAYS discard the checkout — a leaked worktree pins refs and litters
     // `git worktree list` forever. Order matters on Windows: `git worktree remove`
     // can fail there when a just-exited `node --test` worker still holds a handle, so
     // we then rm the directory ourselves and prune LAST — pruning only reconciles
@@ -303,7 +332,7 @@ export function dryRun(root, { tests, timeoutMs = 120000 } = {}) {
  * Imagine the consequences of a task before acting: entities → impact() blast
  * radius → predicted breaks (per-file max confidence across targets), the minimal
  * dry-run suite, and riskScore = Σ confidence — the number spec §2.3 thresholds to
- * decide whether the (follow-up) sandboxed dry-run is worth paying for.
+ * decide whether the (follow-up) isolated-checkout dry-run is worth paying for.
  * @param {string} root
  * @param {string} task
  * @param {{atlas?: object, threshold?: number}} [opts] inject `atlas` to skip the build.
@@ -365,6 +394,9 @@ export function renderImagine(r, { footer = true } = {}) {
       `  ! no test covers: ${r.uncovered.slice(0, 6).join(", ")}${r.uncovered.length > 6 ? " …" : ""}`,
     );
   if (footer)
-    lines.push("", "  (measure it: re-run with --run — sandboxed worktree dry-run of HEAD)");
+    lines.push(
+      "",
+      "  (measure it: re-run with --run — a dry-run in an isolated checkout of HEAD; not a security sandbox)",
+    );
   return lines.join("\n");
 }
diff --git a/src/learn_consolidate.js b/src/learn_consolidate.js
index 430620d2..82cc0ba5 100644
--- a/src/learn_consolidate.js
+++ b/src/learn_consolidate.js
@@ -7,11 +7,17 @@
 // Here nothing is judged, reworded or invented:
 //  - MERGE: an exact duplicate (normalized text) or a near-duplicate (MinHash Jaccard ≥ τ,
 //    the ledger's own consolidation threshold, ledger.clusters) within one project
-//    collapses into its first occurrence.
+//    collapses into its first occurrence — but only when the semantic guard finds no
+//    behaviour-bearing difference (review F16): "Enable authentication…" and "Disable
+//    authentication…" overlap almost entirely and are OPPOSITE rules, so they are kept apart
+//    and reported as a conflict for a person to resolve.
 //  - DROP: only on ledger ground truth. A lesson is dropped when its best-matching ledger
-//    claim (lesson/fact, Jaccard ≥ τ against claimText) is dormant (ledger.isDormant: its
-//    oracle-evidenced val fell below DORMANT_VAL and no confirmation restored it),
-//    retracted (tombstoned), or archived to the ledger attic by `forge ledger prune`.
+//    claim (lesson/fact, Jaccard ≥ τ against claimText, and not reversed by polarity,
+//    operators, numbers or literals) is dormant (ledger.isDormant: its oracle-evidenced val
+//    fell below DORMANT_VAL and no confirmation restored it) or retracted (tombstoned). An
+//    ARCHIVED claim is not a refuted one (review F15): the attic also holds claims archived for
+//    idleness or as duplicates, so an attic claim refutes only when its own logs say so
+//    (tombstone/dormant), and a deduplicated one defers to the claim that survived it.
 //    A lesson with no matching claim is KEPT: absence of evidence is not refutation.
 // Claims are matched only within the lesson's project (a repo whose directory name is the
 // project), so a lesson refuted in one repo is not dropped from another.
@@ -30,7 +36,13 @@ import { homedir } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { claimText, isDormant, jaccard, sketch } from "./ledger.js";
-import { loadClaims, repoLedger } from "./ledger_store.js";
+import { archiveRecord, getClaimByPrefix, loadClaims, repoLedger } from "./ledger_store.js";
+import {
+  describeConflicts,
+  FLIP_KINDS,
+  sameSemantics,
+  semanticConflicts,
+} from "./semantic_guard.js";
 import { epochDay } from "./util.js";
 
 /** Same τ as ledger.clusters — "these two say the same thing". */
@@ -84,17 +96,31 @@ export function parseLearned(text) {
 /**
  * @typedef {{project: string, text: string}} Learned
  * @typedef {{id?: string, kind?: string, body?: any, tombstone?: any, attic?: boolean,
- *   project?: string}} LedgerClaim
+ *   archive?: {cause?: string, survivor?: string} | null, project?: string}} LedgerClaim
  */
 
-/** Why a claim refutes the lessons that match it, or null when it does not. */
-function refutation(claim, nowDay) {
-  if (claim.attic) return "archived to the ledger attic (dormant or retracted)";
+/**
+ * Why a claim refutes the lessons that match it, or null when it does not. Truth comes from
+ * the claim's own logs (a tombstone, or oracle evidence that made it dormant) — never from
+ * where it is stored: an archived claim that was merely idle refutes nothing, and one archived
+ * as a duplicate refutes only if the claim that survived it does (review F15).
+ * @param {LedgerClaim} claim
+ * @param {number} nowDay
+ * @param {Map<string, LedgerClaim>} [byId] every known claim, to follow a duplicate's survivor
+ * @param {number} [depth]
+ * @returns {string|null}
+ */
+function refutation(claim, nowDay, byId = new Map(), depth = 0) {
   if (claim.tombstone) return "retracted in the ledger";
   try {
     if (isDormant(claim, nowDay)) return "dormant in the ledger (oracle evidence refuted it)";
   } catch {}
-  return null;
+  if (claim.attic && claim.archive?.cause === "duplicate" && claim.archive.survivor && depth < 8) {
+    const survivor = byId.get(claim.archive.survivor);
+    const why = survivor ? refutation(survivor, nowDay, byId, depth + 1) : null;
+    return why ? `${why} (via the claim it was deduplicated into)` : null;
+  }
+  return null; // live, or archived for idleness / unknown reason: not a refutation
 }
 
 /**
@@ -103,26 +129,46 @@ function refutation(claim, nowDay) {
  * @param {{claims?: LedgerClaim[], nowDay?: number, tau?: number}} [opts] each claim may
  *   carry `project` (the repo directory name); a claim without one matches any project.
  * @returns {{kept: Learned[], merged: {text: string, into: string}[],
- *   dropped: {project: string, text: string, claim: string, reason: string}[]}}
+ *   dropped: {project: string, text: string, claim: string, reason: string}[],
+ *   conflicts: {project: string, text: string, other: string, conflicts: string}[]}}
  */
 export function consolidateLearned(
   entries,
   { claims = [], nowDay = epochDay(), tau = CONSOLIDATE_TAU } = {},
 ) {
+  const byId = new Map(claims.filter((c) => c?.id).map((c) => [String(c.id), c]));
   const usable = claims
     .filter((c) => c && (c.kind === "lesson" || c.kind === "fact"))
-    .map((c) => ({ c, s: sketch(claimText(c)), why: refutation(c, nowDay) }));
+    .map((c) => ({
+      c,
+      text: claimText(c),
+      s: sketch(claimText(c)),
+      why: refutation(c, nowDay, byId),
+    }));
   /** @type {(Learned & {s: any, n: string})[]} */
   const kept = [];
   const merged = [];
   const dropped = [];
+  /** @type {{project: string, text: string, other: string, conflicts: string}[]} */
+  const conflicts = [];
   for (const e of entries) {
     const text = String(e.text || "").trim();
     if (!text) continue;
     const project = e.project || GENERAL;
     const s = sketch(text);
     const n = norm(text);
-    const dup = kept.find((k) => k.project === project && (k.n === n || jaccard(k.s, s) >= tau));
+    // Similar is not the same (F16): a close pair that differs in polarity, operators,
+    // numbers, literals, identifiers or paths is two rules — keep both, report the conflict.
+    let dup = null;
+    for (const k of kept) {
+      if (k.project !== project || (k.n !== n && jaccard(k.s, s) < tau)) continue;
+      const differs = semanticConflicts(k.text, text);
+      if (!differs.length) {
+        dup = k;
+        break;
+      }
+      conflicts.push({ project, text, other: k.text, conflicts: describeConflicts(differs) });
+    }
     if (dup) {
       merged.push({ text, into: dup.text });
       continue;
@@ -131,7 +177,10 @@ export function consolidateLearned(
     for (const u of usable) {
       if (u.c.project && project !== GENERAL && u.c.project !== project) continue;
       const j = jaccard(u.s, s);
-      if (j >= tau && (!best || j > best.j)) best = { ...u, j };
+      // A claim saying the OPPOSITE (a flipped polarity/operator/number/literal) is not this
+      // lesson's evidence, however similar the words.
+      if (j >= tau && (!best || j > best.j) && sameSemantics(u.text, text, { kinds: FLIP_KINDS }))
+        best = { ...u, j };
     }
     if (best?.why) {
       dropped.push({
@@ -144,7 +193,12 @@ export function consolidateLearned(
     }
     kept.push({ project, text, s, n });
   }
-  return { kept: kept.map(({ project, text }) => ({ project, text })), merged, dropped };
+  return {
+    kept: kept.map(({ project, text }) => ({ project, text })),
+    merged,
+    dropped,
+    conflicts,
+  };
 }
 
 /**
@@ -182,10 +236,15 @@ export function ledgerClaimsFor(repos) {
       for (const c of loadClaims(dir)) out.push({ ...c, project });
     } catch {}
     try {
+      // Attic claims WITH their logs (evidence, tombstones) and the recorded archive reason —
+      // the raw JSON alone cannot tell an idle claim from a refuted one (F15).
       const attic = join(dir, "attic");
-      for (const f of existsSync(attic) ? readdirSync(attic) : [])
-        if (f.endsWith(".json"))
-          out.push({ ...JSON.parse(readFileSync(join(attic, f), "utf8")), attic: true, project });
+      for (const f of existsSync(attic) ? readdirSync(attic) : []) {
+        if (!f.endsWith(".json")) continue;
+        const id = f.replace(/\.json$/, "");
+        const view = getClaimByPrefix(dir, id, { attic: true });
+        if (view) out.push({ ...view, attic: true, archive: archiveRecord(dir, id), project });
+      }
     } catch {}
   }
   return out;
@@ -212,7 +271,7 @@ export function consolidateDir({
     ...(existsSync(join(dir, "CONSOLIDATED.md")) ? ["CONSOLIDATED.md"] : []),
     ...monthly,
   ];
-  const none = { kept: [], merged: [], dropped: [] };
+  const none = { kept: [], merged: [], dropped: [], conflicts: [] };
   if (!inputs.length) return { ok: true, row: "nothing", dir, inputs, ...none };
   const entries = inputs.flatMap((f) => parseLearned(readFileSync(join(dir, f), "utf8")));
   if (!entries.length) return { ok: true, row: "empty", dir, inputs, ...none };
@@ -242,6 +301,14 @@ export function renderReport(r) {
   ];
   for (const d of r.dropped.slice(0, 20))
     lines.push(`    - [${d.project}] ${d.text.slice(0, 80)} — ${d.reason} (claim ${d.claim})`);
+  const conflicts = r.conflicts ?? [];
+  if (conflicts.length) {
+    lines.push(`  kept apart — similar but conflicting (review these): ${conflicts.length}`);
+    for (const c of conflicts.slice(0, 20))
+      lines.push(
+        `    ! [${c.project}] ${c.text.slice(0, 60)} ↔ ${c.other.slice(0, 60)} — ${c.conflicts}`,
+      );
+  }
   return lines.join("\n");
 }
 
diff --git a/src/ledger.js b/src/ledger.js
index 19bb88e5..6247185a 100644
--- a/src/ledger.js
+++ b/src/ledger.js
@@ -300,6 +300,53 @@ const recordStrength = (e) =>
     ? "format"
     : refStrength(e.ref, e.oracle);
 
+/**
+ * Evidence EVENTS, not records (review F06). Two records that cite the same underlying event
+ * are one piece of evidence, however they are spelled: the same oracle + result on one git
+ * object cited as a 7-, 8-, 9- or 40-character id (an abbreviation is a PREFIX of the full id,
+ * case-insensitive), or the same typed ref re-recorded later, by another author, or re-imported.
+ * Record-level dedupe (content hash) never caught these, so four aliases of one commit lifted a
+ * lesson from 0.655 to 0.821 — across the 0.8 required-lesson bar — with one real event.
+ * The EARLIEST record (by (t, h)) represents the event, so re-citing an old event can neither
+ * add weight nor refresh its decay clock. Contradicting records are a different event from
+ * confirming ones (a flip-flopping oracle is evidence of both). Pure and deterministic —
+ * identical on every replica after any merge order.
+ * @param {any[]} evidence
+ * @returns {any[]} the representative record of each distinct event, in (t, h) order
+ */
+export function evidenceEvents(evidence) {
+  const kept = [];
+  const exact = new Set();
+  /** @type {{oracle:string, result:string, oid:string}[]} */
+  const gitKeys = [];
+  for (const e of sortRecords((evidence ?? []).filter(validOutcome))) {
+    const m = /^git:([0-9a-f]{7,64})$/i.exec(String(e.ref));
+    if (m) {
+      const oid = m[1].toLowerCase();
+      const same = gitKeys.find(
+        (k) =>
+          k.oracle === e.oracle &&
+          k.result === e.result &&
+          (k.oid.startsWith(oid) || oid.startsWith(k.oid)),
+      );
+      if (same) {
+        // keep the longest spelling as the group's identity, so a DIFFERENT object that merely
+        // shares a short prefix is not swallowed once the full id is known
+        if (oid.length > same.oid.length) same.oid = oid;
+        continue;
+      }
+      gitKeys.push({ oracle: e.oracle, result: e.result, oid });
+      kept.push(e);
+      continue;
+    }
+    const key = `${e.oracle}\u0000${e.result}\u0000${e.ref}`;
+    if (exact.has(key)) continue;
+    exact.add(key);
+    kept.push(e);
+  }
+  return kept;
+}
+
 /** Weight multiplier applied to merely-format-valid (unresolved) evidence in val(). */
 export const UNRESOLVED_WEIGHT = 0.5;
 /** A claim whose confirming evidence is ALL format-only may never be lifted to/above the
@@ -360,11 +407,19 @@ export function validOutcome(e) {
       (e.result === "confirm" || e.result === "contradict") &&
       typeof e.ref === "string" &&
       e.ref &&
+      e.ref.length <= MAX_REF_LENGTH &&
       validateRef(e.ref).ok &&
+      // A record's day must be a finite number (or absent): a NaN/Infinity/string `t` from an
+      // imported or hand-edited line would otherwise poison the decay arithmetic (review A04).
+      (e.t === undefined || Number.isFinite(e.t)) &&
+      (e.author === undefined || typeof e.author === "string") &&
       e.h,
   );
 }
 
+/** Longest evidence ref accepted — a pointer, not a payload. */
+export const MAX_REF_LENGTH = 2048;
+
 // Weight comes from the ORACLES table — a stored `w` is audit metadata, never trusted
 // (a hand-edited or forged log line must not be able to buy extra confidence).
 // The age is the DISTANCE from now: a future-dated record (a teammate's skewed clock, a
@@ -384,6 +439,9 @@ const decayed = (outcome, nowDay, halfLife) =>
  * appender's earned reliability. Pure function of (evidence set, trust map) ⇒
  * identical after any merge order.
  *
+ * Evidence is counted per EVENT, not per record (evidenceEvents, review F06): an abbreviated
+ * and a full id of one git object, or one ref re-recorded, count once.
+ *
  * Resolution strength (ME-05/C2): evidence forge did not resolve (anything but a `git:`
  * object id or a bridge pointer — see refStrength) counts at UNRESOLVED_WEIGHT, and a claim
  * with NO resolved confirmation is capped at UNRESOLVED_VAL_CAP so `lgtm`,
@@ -397,8 +455,8 @@ export function val(claim, nowDay = 0, { halfLife = DEFAULT_HALF_LIFE_DAYS, trus
   let confirms = 0;
   let all = 0;
   let resolvedConfirm = false;
-  for (const e of claim.evidence ?? []) {
-    if (!validOutcome(e)) continue;
+  // One event, one vote (F06): aliases and re-records of an event count once.
+  for (const e of evidenceEvents(claim.evidence)) {
     const resolved = recordStrength(e) === "resolved";
     const strength = resolved ? 1 : UNRESOLVED_WEIGHT;
     const d = decayed(e, nowDay, halfLife) * (trust?.[e.author ?? ""] ?? 1) * strength;
@@ -429,8 +487,8 @@ export function authorTrust(claims) {
     const author = claim.provenance?.author ?? "";
     if (!author) continue;
     const t = tally.get(author) ?? { c: 0, m: 0 };
-    for (const e of claim.evidence ?? []) {
-      if (!validOutcome(e) || (e.author ?? "") === author) continue;
+    for (const e of evidenceEvents(claim.evidence)) {
+      if ((e.author ?? "") === author) continue;
       const w = ORACLES[e.oracle].w;
       if (e.result === "confirm") t.c += w;
       else t.m += w;
@@ -465,7 +523,7 @@ export function rec(claim, nowDay = 0, { halfLife = DEFAULT_HALF_LIFE_DAYS } = {
  * @returns {{t:number, v:number, result:string}[]}
  */
 export function valTimeline(claim, { halfLife = DEFAULT_HALF_LIFE_DAYS } = {}) {
-  const evs = sortRecords((claim.evidence ?? []).filter(validOutcome));
+  const evs = evidenceEvents(claim.evidence);
   return evs.map((e, i) => ({
     t: e.t ?? 0,
     result: e.result,
diff --git a/src/ledger_bridge.js b/src/ledger_bridge.js
index 8b2b10de..c0dc05ad 100644
--- a/src/ledger_bridge.js
+++ b/src/ledger_bridge.js
@@ -23,6 +23,7 @@ import { load as loadLessons } from "./lessons_store.js";
 // merged `list` (P2 read flip) includes ledger-only teammate facts, which have no file
 // and would read here as "deleted from the store".
 import { listStored as listFacts, readFact } from "./recall.js";
+import { describeConflicts, sameSemantics, semanticConflicts } from "./semantic_guard.js";
 import { epochDay, gitAuthor, ledgerOnly } from "./util.js";
 
 /** One best-effort policy for the whole bridge (never throws into a caller). */
@@ -41,7 +42,7 @@ const bestEffort = (fn) => {
  *  content address) — so teammates who learn the same lesson mint the same id even
  *  if their legacy filenames differ, and confirm/contradict never re-mints.
  *  @returns {{ok:boolean, reason?:string, claim?:any}} */
-export function lessonClaim(lesson, t = 0) {
+export function lessonClaim(lesson, t = 0, lineage = {}) {
   return mintClaim({
     kind: "lesson",
     body: {
@@ -55,7 +56,8 @@ export function lessonClaim(lesson, t = 0) {
       whatWentWrong: lesson.whatWentWrong ?? "",
     },
     scope: { level: lesson.scope ?? "repo" },
-    provenance: { agent: "cortex", author: gitAuthor(), task: lesson.id ?? "" },
+    // `lineage` (supersedes/rewrite/conflicts) rides in PROVENANCE — never the content address.
+    provenance: { agent: "cortex", author: gitAuthor(), task: lesson.id ?? "", ...lineage },
     t,
   });
 }
@@ -113,29 +115,74 @@ export function recordLessonEvent(root, lesson, ev = {}) {
   });
 }
 
+// The narrow equivalence rule for carrying evidence across a rewrite (review F07): the two
+// texts differ at most in case, whitespace and punctuation, AND the semantic guard finds no
+// behaviour-bearing difference (polarity, operators, numbers, literals, identifiers, paths).
+const plainText = (s) =>
+  String(s ?? "")
+    .normalize("NFC")
+    .toLowerCase()
+    .replace(/[^\p{L}\p{N}<>=!]+/gu, " ")
+    .trim();
+const sameText = (a, b) => plainText(a) === plainText(b) && sameSemantics(a, b);
+
 /**
- * A lesson's body was rewritten (distillation) — content addressing means a NEW claim
- * id, so carry the history across: mint the new claim, copy the old claim's evidence
- * to it, and tombstone the old claim as superseded. Without this, evidence splits
- * between an orphaned template claim and the distilled one.
+ * Whether a lesson rewrite keeps the lesson's MEANING by the narrow, verifiable rule: both
+ * `whatWentWrong` and `correctedBehavior` equal up to case/whitespace/punctuation, with no
+ * semantic-guard conflict. Anything else is a different proposition.
+ * @param {object} before
+ * @param {object} after
+ */
+export function equivalentLesson(before, after) {
+  return (
+    sameText(before?.whatWentWrong, after?.whatWentWrong) &&
+    sameText(before?.correctedBehavior, after?.correctedBehavior)
+  );
+}
+
+/**
+ * A lesson's body was rewritten (distillation) — content addressing means a NEW claim id.
+ * Evidence is carried across ONLY when the rewrite is equivalent by the narrow rule above
+ * (review F07): proof earned by "Validate request signatures…" must not transfer to "Skip
+ * request signature validation." A changed meaning starts as an unproven claim at the 0.5
+ * prior (below every serving bar) and earns its own evidence; the old claim is tombstoned as
+ * its parent (`superseded-by:`), and its evidence stays inspectable there (`forge ledger
+ * blame`) without counting as confirmation of the new text. The new claim's provenance names
+ * its parent (`supersedes`) and the semantic conflicts, if any.
+ * @returns {{ok:boolean, reason?:string, id?:string, carried?:boolean, conflicts?:string}}
  */
 export function supersedeLessonClaim(root, before, after, t = epochDay()) {
   return bestEffort(() => {
     const dir = repoLedger(root);
     const oldC = lessonClaim(before, t);
-    const newC = lessonClaim(after, t);
+    const equivalent = equivalentLesson(before, after);
+    const conflicts = describeConflicts(
+      semanticConflicts(
+        `${before?.whatWentWrong ?? ""} ${before?.correctedBehavior ?? ""}`,
+        `${after?.whatWentWrong ?? ""} ${after?.correctedBehavior ?? ""}`,
+      ),
+    );
+    const newC = lessonClaim(after, t, {
+      ...(oldC.ok ? { supersedes: oldC.claim.id } : {}),
+      rewrite: equivalent ? "equivalent" : "unverified",
+      ...(conflicts ? { conflicts } : {}),
+    });
     if (!newC.ok) return { ok: false, reason: newC.reason };
     const put = putClaim(dir, newC.claim);
     if (!put.ok) return put;
+    let carried = false;
     if (oldC.ok && oldC.claim.id !== newC.claim.id) {
-      for (const o of readEvidence(dir, oldC.claim.id)) appendEvidence(dir, newC.claim.id, o);
+      if (equivalent) {
+        for (const o of readEvidence(dir, oldC.claim.id)) appendEvidence(dir, newC.claim.id, o);
+        carried = true;
+      }
       tombstone(dir, oldC.claim.id, {
         author: gitAuthor(),
         reason: `superseded-by:${newC.claim.id}`,
         t,
       });
     }
-    return { ok: true, id: newC.claim.id };
+    return { ok: true, id: newC.claim.id, carried, ...(conflicts ? { conflicts } : {}) };
   });
 }
 
diff --git a/src/ledger_retention.js b/src/ledger_retention.js
index 6114bb31..baefa2c1 100644
--- a/src/ledger_retention.js
+++ b/src/ledger_retention.js
@@ -27,6 +27,7 @@
 // its logs in place, and any new evidence brings it back (ledger_store appendRecord).
 
 import { claimText, isDormant, jaccard, SKETCH_K, sketch, val } from "./ledger.js";
+import { describeConflicts, semanticConflicts } from "./semantic_guard.js";
 
 /** @typedef {{id: string, kind?: string, body?: any, provenance?: {t?: number},
  *   evidence?: {t?: number}[], tombstone?: {t?: number} | null}} Claim */
@@ -94,6 +95,10 @@ export function learnIdleCutoff(histories, nowDay, { usageSince = null } = {}) {
 
 // ── Duplicates ────────────────────────────────────────────────────────────────────────
 
+/** What a claim ASSERTS, for the semantic guard: a fact's text (its name is a unique label,
+ *  not part of the statement), otherwise the claim's retrievable text. */
+const statementOf = (c) => (c.kind === "fact" ? String(c.body?.text ?? "") : claimText(c));
+
 /** Log-likelihood of xs under N(mu, v). */
 const gaussLL = (xs, mu, v) =>
   xs.reduce((s, x) => s - 0.5 * (Math.log(2 * Math.PI * v) + (x - mu) ** 2 / v), 0);
@@ -171,10 +176,15 @@ export function similarityBoundary(xs, k = SKETCH_K) {
 /**
  * Near-duplicate groups among live claims of the same kind, with one survivor each: the
  * highest val, then the most evidence, then the earliest minted, then the smallest id.
+ * Similarity only PROPOSES a duplicate (review F16): a close pair whose texts differ in
+ * polarity, operators, numbers, literals, identifiers or paths ("Enable authentication…" vs
+ * "Disable authentication…") is never grouped — it is reported in `conflicts`, both claims
+ * stay live, and a person decides.
  * @param {Claim[]} claims live (servable) claims
  * @param {number} nowDay
  * @returns {{boundary: number | null, bic1?: number, bic2?: number | null, compared: number,
- *   groups: {keep: string, drop: {id: string, similarity: number}[]}[]}}
+ *   groups: {keep: string, drop: {id: string, similarity: number}[]}[],
+ *   conflicts: {a: string, b: string, similarity: number, conflicts: string}[]}}
  */
 export function duplicateGroups(claims, nowDay) {
   const byKind = new Map();
@@ -198,10 +208,17 @@ export function duplicateGroups(claims, nowDay) {
       }
     nn.push(...best);
   }
-  if (!nn.length) return { boundary: null, compared: 0, groups: [] };
+  if (!nn.length) return { boundary: null, compared: 0, groups: [], conflicts: [] };
   const fit = similarityBoundary(nn);
   if (fit.boundary == null)
-    return { boundary: null, bic1: fit.bic1, bic2: fit.bic2, compared: nn.length, groups: [] };
+    return {
+      boundary: null,
+      bic1: fit.bic1,
+      bic2: fit.bic2,
+      compared: nn.length,
+      groups: [],
+      conflicts: [],
+    };
   // Union-find over the pairs at or above the boundary.
   const parent = new Map();
   const find = (x) => {
@@ -214,8 +231,20 @@ export function duplicateGroups(claims, nowDay) {
   const pairKey = (a, b) => (a < b ? `${a}\n${b}` : `${b}\n${a}`);
   /** @type {Map<string, number>} similarity of each pair at or above the boundary */
   const close = new Map();
+  /** @type {{a: string, b: string, similarity: number, conflicts: string}[]} */
+  const conflicts = [];
   for (const p of pairs) {
     if (p.sim < fit.boundary) continue;
+    const differs = semanticConflicts(statementOf(p.i.c), statementOf(p.j.c));
+    if (differs.length) {
+      conflicts.push({
+        a: p.i.c.id,
+        b: p.j.c.id,
+        similarity: p.sim,
+        conflicts: describeConflicts(differs),
+      });
+      continue;
+    }
     for (const it of [p.i, p.j]) if (!parent.has(it.c.id)) parent.set(it.c.id, it.c.id);
     parent.set(find(p.i.c.id), find(p.j.c.id));
     close.set(pairKey(p.i.c.id, p.j.c.id), p.sim);
@@ -254,7 +283,14 @@ export function duplicateGroups(claims, nowDay) {
     })
     .filter((g) => g.drop.length)
     .sort((a, b) => (a.keep < b.keep ? -1 : 1));
-  return { boundary: fit.boundary, bic1: fit.bic1, bic2: fit.bic2, compared: nn.length, groups };
+  return {
+    boundary: fit.boundary,
+    bic1: fit.bic1,
+    bic2: fit.bic2,
+    compared: nn.length,
+    groups,
+    conflicts: conflicts.sort((x, y) => (x.a < y.a ? -1 : x.a > y.a ? 1 : x.b < y.b ? -1 : 1)),
+  };
 }
 
 // ── The plan ──────────────────────────────────────────────────────────────────────────
@@ -265,7 +301,12 @@ export function duplicateGroups(claims, nowDay) {
  * @param {Map<string, number[]>} uses
  * @param {number} nowDay
  * @param {{halfLife?: number, duplicates?: boolean}} [opts] halfLife only feeds isDormant
- * @returns {{archive: {id: string, reason: string}[], retention: ReturnType<typeof learnIdleCutoff>,
+ * Every archive entry carries a machine-readable `cause` — "tombstoned", "dormant", "idle" or
+ * "duplicate" (+ `survivor`) — because archiving is STORAGE lifecycle, not a truth verdict
+ * (review F15): an idle or deduplicated claim is not a refuted one, and a reader must be able
+ * to tell them apart after the fact.
+ * @returns {{archive: {id: string, reason: string, cause: "tombstoned"|"dormant"|"idle"|"duplicate",
+ *   survivor?: string}[], retention: ReturnType<typeof learnIdleCutoff>,
  *   duplicates: ReturnType<typeof duplicateGroups> | null}}
  */
 export function retentionPlan(claims, uses, nowDay, { halfLife, duplicates = false } = {}) {
@@ -280,24 +321,29 @@ export function retentionPlan(claims, uses, nowDay, { halfLife, duplicates = fal
   for (const [id, days] of uses)
     if (!known.has(id)) learnFrom.push({ days: [...new Set(days)].sort((a, b) => a - b) });
   const retention = learnIdleCutoff(learnFrom, nowDay, { usageSince });
-  /** @type {{id: string, reason: string}[]} */
+  /** @type {{id: string, reason: string, cause: "tombstoned"|"dormant"|"idle"|"duplicate",
+   *   survivor?: string}[]} */
   const archive = [];
   const live = [];
   const dormantOpts = halfLife == null ? {} : { halfLife };
   for (let i = 0; i < claims.length; i++) {
     const c = claims[i];
     if (c.tombstone) {
-      archive.push({ id: c.id, reason: "tombstoned (never served)" });
+      archive.push({ id: c.id, reason: "tombstoned (never served)", cause: "tombstoned" });
       continue;
     }
     if (isDormant(c, nowDay, dormantOpts)) {
-      archive.push({ id: c.id, reason: "dormant (never served)" });
+      archive.push({ id: c.id, reason: "dormant (never served)", cause: "dormant" });
       continue;
     }
     const days = histories[i].days;
     const idle = days.length ? nowDay - days[days.length - 1] : null;
     if (retention.learned && idle != null && idle > /** @type {number} */ (retention.cutoff)) {
-      archive.push({ id: c.id, reason: `idle ${idle} d > learned cut-off ${retention.cutoff} d` });
+      archive.push({
+        id: c.id,
+        reason: `idle ${idle} d > learned cut-off ${retention.cutoff} d`,
+        cause: "idle",
+      });
       continue;
     }
     live.push(c);
@@ -310,6 +356,8 @@ export function retentionPlan(claims, uses, nowDay, { halfLife, duplicates = fal
         archive.push({
           id: d.id,
           reason: `near-duplicate of ${g.keep.slice(0, 12)} (similarity ${d.similarity.toFixed(2)} ≥ learned ${dup.boundary?.toFixed(2)})`,
+          cause: "duplicate",
+          survivor: g.keep,
         });
   }
   return { archive, retention, duplicates: dup };
diff --git a/src/ledger_store.js b/src/ledger_store.js
index 8d69e963..c7af1463 100644
--- a/src/ledger_store.js
+++ b/src/ledger_store.js
@@ -255,9 +255,26 @@ export function putClaim(dir, claim) {
   return { ok: true, id: claim.id, existed: already && healthy };
 }
 
+// The full object id a `git:` abbreviation names in THIS repo, or null (ambiguous, unknown,
+// or not a git repo). `^{object}` peels nothing; `--verify` refuses ambiguity.
+const gitFullId = (root, sha) => {
+  try {
+    const out = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${sha}^{object}`], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    return /^[0-9a-f]{40,64}$/.test(out) ? out : null;
+  } catch {
+    return null;
+  }
+};
+
 /** Append one evidence outcome (deduped by its content hash — append is idempotent). A typed,
  *  unresolvable ref (e.g. a `git:` sha absent from this repo) is REJECTED here, before it can
- *  reach val() and buy confidence. */
+ *  reach val() and buy confidence. A resolvable `git:` abbreviation is stored under its FULL
+ *  object id (re-sealed), so one commit has one spelling in the log (review F06; val() also
+ *  dedupes aliases already on disk). */
 export function appendEvidence(dir, id, outcome) {
   if (!validOutcome(outcome)) return { ok: false, reason: "invalid outcome (use outcomeRecord)" };
   const root = repoRootOf(dir);
@@ -266,6 +283,12 @@ export function appendEvidence(dir, id, outcome) {
     resolveFile: fileResolver(root),
   });
   if (!v.ok) return { ok: false, reason: v.reason ?? "unresolvable evidence ref" };
+  const m = /^git:([0-9a-f]{7,39})$/i.exec(String(outcome.ref));
+  const full = m ? gitFullId(root, m[1]) : null;
+  if (full) {
+    const { h: _h, ...rest } = outcome;
+    return appendRecord(dir, "evidence", id, sealRecord({ ...rest, ref: `git:${full}` }));
+  }
   return appendRecord(dir, "evidence", id, outcome);
 }
 
@@ -788,11 +811,14 @@ export function reindex(dir, _nowDay = 0) {
  * fork the fold exists to prevent. This moves the claim file to its current address and
  * takes its logs with it, unioning into an existing log rather than overwriting one (the
  * logs are append-only sets deduped by content hash, so a union is the merge).
- * Idempotent: a second run finds nothing to do.
+ * Idempotent: a second run finds nothing to do. `dryRun` reports the same summary (what
+ * would move, what would merge into an existing twin) and writes nothing — a migration is
+ * previewed before it touches a shared store (review A11).
  * @param {string} dir ledger dir
- * @returns {{migrated: string[], merged: string[], failed: string[]}}
+ * @param {{dryRun?: boolean}} [opts]
+ * @returns {{migrated: string[], merged: string[], failed: string[], dryRun: boolean}}
  */
-export function migrateAddresses(dir) {
+export function migrateAddresses(dir, { dryRun = false } = {}) {
   const migrated = [];
   const merged = [];
   const failed = [];
@@ -801,6 +827,10 @@ export function migrateAddresses(dir) {
     const current = claimId(claim.kind, claim.body, claim.scope);
     if (current === id) continue; // already at its current address
     if (legacyClaimId(claim.kind, claim.body, claim.scope) !== id) continue; // not ours to touch
+    if (dryRun) {
+      (existsSync(claimPath(dir, current)) ? merged : migrated).push(current);
+      continue;
+    }
     try {
       const target = claimPath(dir, current);
       const already = existsSync(target);
@@ -823,7 +853,7 @@ export function migrateAddresses(dir) {
       failed.push(id);
     }
   }
-  return { migrated, merged, failed };
+  return { migrated, merged, failed, dryRun };
 }
 
 export function verify(dir) {
@@ -897,10 +927,18 @@ export function verify(dir) {
 export function pruneLedger(dir, nowDay = epochDay(), { halfLife = DEFAULT_HALF_LIFE_DAYS } = {}) {
   const plan = retentionPlan(loadClaims(dir), readUses(dir), nowDay, { halfLife });
   const pruned = [];
-  for (const { id } of plan.archive) if (pruneToAttic(dir, id).ok) pruned.push(id);
+  for (const a of plan.archive)
+    if (pruneToAttic(dir, a.id, { ...archiveWhy(a), t: nowDay }).ok) pruned.push(a.id);
   return { pruned, retention: plan.retention };
 }
 
+/** The archive record fields of one retention-plan entry. */
+const archiveWhy = (a) => ({
+  cause: a.cause,
+  reason: a.reason,
+  ...(a.survivor ? { survivor: a.survivor } : {}),
+});
+
 /**
  * `forge ledger compact`: the prune plan plus near-duplicate grouping, with every learned
  * number reported so a person can see why each claim was archived. `dryRun` plans only.
@@ -917,7 +955,9 @@ export function compactLedger(
   const uses = readUses(dir);
   const plan = retentionPlan(claims, uses, nowDay, { halfLife, duplicates: true });
   const archived = [];
-  if (!dryRun) for (const a of plan.archive) if (pruneToAttic(dir, a.id).ok) archived.push(a.id);
+  if (!dryRun)
+    for (const a of plan.archive)
+      if (pruneToAttic(dir, a.id, { ...archiveWhy(a), t: nowDay }).ok) archived.push(a.id);
   return {
     dryRun,
     claims: claims.length,
@@ -929,15 +969,63 @@ export function compactLedger(
   };
 }
 
-/** Move one dormant/tombstoned claim file to the attic (audit trail, never retrieved). */
-export function pruneToAttic(dir, id) {
+const atticLogPath = (dir, id) => join(dir, "attic", `${id}.log`);
+
+/**
+ * Move one claim file to the attic (audit trail, never retrieved) and record WHY (review F15):
+ * `cause` is "tombstoned", "dormant", "idle" or "duplicate" (with the `survivor` it duplicates).
+ * Archiving is storage lifecycle, not a verdict — an idle or duplicate claim was not refuted,
+ * and readers (e.g. learned-lesson consolidation) must not treat it as refuted. The record is
+ * a sealed, append-only line in `attic/<id>.log` (union-merged like every ledger log).
+ * @param {string} dir
+ * @param {string} id
+ * @param {{cause?: string, reason?: string, survivor?: string, t?: number}} [why]
+ */
+export function pruneToAttic(dir, id, why = {}) {
   const from = claimPath(dir, id);
   if (!existsSync(from)) return { ok: false, reason: "no such claim" };
   mkdirSync(join(dir, "attic"), { recursive: true });
   renameSync(from, join(dir, "attic", `${id}.json`));
+  if (why.cause) {
+    try {
+      const rec = sealRecord({
+        cause: String(why.cause),
+        reason: redactSecrets(String(why.reason ?? "")).slice(0, 300),
+        ...(why.survivor ? { survivor: String(why.survivor) } : {}),
+        t: why.t ?? 0,
+      });
+      appendLine(atticLogPath(dir, id), canonicalize(rec));
+    } catch {} // the move is the archive; the reason is best-effort metadata
+  }
   return { ok: true };
 }
 
+/**
+ * Why a claim was archived: the latest verified record of `attic/<id>.log` ({cause, reason,
+ * survivor?, t}), or null when none was recorded (claims archived before reasons existed).
+ * @param {string} dir
+ * @param {string} id
+ */
+export function archiveRecord(dir, id) {
+  let text = "";
+  try {
+    text = readFileSync(atticLogPath(dir, id), "utf8");
+  } catch {
+    return null;
+  }
+  const recs = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const rec = JSON.parse(line);
+      const { h, ...rest } = rec ?? {};
+      if (h && sealRecord(rest).h === h && typeof rest.cause === "string") recs.push(rec);
+    } catch {}
+  }
+  const sorted = sortRecords(recs);
+  return sorted.length ? sorted[sorted.length - 1] : null;
+}
+
 /** Counts + val distribution for `forge ledger stats` and the dashboard. Buckets use
  *  the protocol's DORMANT_VAL threshold (and its mirror) — never a local literal. */
 export function stats(dir, nowDay = 0) {
diff --git a/src/reuse.js b/src/reuse.js
index 03982f73..e31d64ff 100644
--- a/src/reuse.js
+++ b/src/reuse.js
@@ -12,6 +12,7 @@ import { claimSim, simLabel } from "./embed.js";
 import { isDormant, jaccard, mintClaim, outcomeRecord, SKETCH_K, sketch, val } from "./ledger.js";
 import { appendEvidence, loadClaims, putClaim, readEvidence, repoLedger } from "./ledger_store.js";
 import { record as recordMetric } from "./metrics.js";
+import { describeConflicts, semanticConflicts } from "./semantic_guard.js";
 import { contentHash, gitAuthor } from "./util.js";
 
 /** Serving floor: an artifact is reused only when independent oracles have earned it
@@ -32,38 +33,44 @@ export const ADAPT_COS = 0.7;
 
 // ---------------------------------------------------------------------------
 // Normalization — TWO forms, because "the same neighbourhood" and "the same task" are
-// different questions (review C9):
-//   • specKey (IDENTITY) — case, whitespace and edge punctuation normalized, everything
-//     else kept verbatim. This is what the exact and near tiers compare: `listUsers` and
-//     `listOrders` are different tasks, and serving one's artifact for the other at tier
-//     "exact, similarity 1" was this cache's worst failure mode.
+// different questions (review C9, then review F04):
+//   • specKey (IDENTITY) — LOSSLESS except for whitespace: Unicode NFC and runs of whitespace
+//     collapsed, NOTHING else. Case, operators, literals, paths and punctuation all stay: the
+//     old identity form lowercased and trimmed punctuation per token, so `accept ages >= 18`
+//     and `<= 18`, `return "ADMIN"` and `"admin"`, `set enabled = true` and `!= true`, and
+//     `getURL` and `getUrl` shared ONE exact key — an exact hit could serve the opposite
+//     requirement. Two specs now share an exact key only when they are the same text.
 //   • normalizeSpec (SHAPE) — volatile literals and identifiers become typed placeholders,
 //     so those two specs still land in one near-NEIGHBOURHOOD and the adapt tier can offer
 //     the artifact as a verified starting point ("generate only the delta").
+// Similarity (the near tier's MinHash over the identity key, or an embedding cosine) finds
+// NEIGHBOURS; it never by itself authorizes serving code as-is: a near candidate must also
+// pass the semantic guard (same operators, numbers, literals, identifiers, paths and
+// polarity words), else it is only offered at the adapt tier, for review.
 // Both tokenizers are Unicode-aware: the ASCII `\w` trim erased every Arabic (or Chinese,
 // or Greek) word, so any two non-ASCII specs normalized to "" and collided as exact.
 // ---------------------------------------------------------------------------
 
+/** The identity-key format version. v1 keys (pre-F04) were lossy, so they never exact-hit. */
+export const KEY_VERSION = 2;
+
 const NUM_RE = /^-?\d[\d.,_]*$/;
 const PATH_RE = /[\\/]|\.(?:m?[jt]sx?|py|go|rs|java|rb|json|ya?ml|toml|md|css|html)$/i;
 const STR_RE = /^["'`].*["'`]$/;
 // camelCase, PascalCase-with-inner-cap, snake_case (incl. SCREAMING_SNAKE), dotted.paths
 // — code identifiers, not prose. A single ALLCAPS word (DESC, RATE, TODO) is treated as
-// prose emphasis and lowercased: shouting is not an identifier.
+// prose emphasis and lowercased: shouting is not an identifier. (SHAPE form only — the
+// identity form keeps case, and the semantic guard treats ALLCAPS as identity.)
 const IDENT_RE = /^(?:[a-z][a-z0-9]*[A-Z]|[A-Z][a-z0-9]+[A-Z]|\w+_\w+|\w+\.\w+)\w*$/;
 
 // Trim leading/trailing punctuation while keeping what MAKES a token: letters, digits and
 // marks of any script, plus the code punctuation the classifiers below key on.
 const TRIM_RE = /^[^\p{L}\p{N}\p{M}_"'`./\\-]+|[^\p{L}\p{N}\p{M}_"'`./\\-]+$/gu;
 
-/** Identity normalization: case, whitespace and edge punctuation only. The exact/near key —
- *  two specs match here only when they name the SAME things. */
+/** Identity normalization: NFC + whitespace runs collapsed + ends trimmed — nothing else. The
+ *  exact key: two specs match here only when they are the SAME text. */
 export function specKey(text) {
-  return String(text)
-    .split(/\s+/)
-    .map((raw) => raw.replace(TRIM_RE, "").toLowerCase())
-    .filter(Boolean)
-    .join(" ");
+  return String(text).normalize("NFC").trim().split(/\s+/).filter(Boolean).join(" ");
 }
 
 /** Deterministic, pure spec SHAPE normalization (unit-tested surface). */
@@ -129,19 +136,33 @@ export function bandKeys(sk) {
  * @returns {{ok:boolean, reason?:string, claim?:any}}
  */
 export function artifactClaim(
-  { spec, slice = "", iface = [], deps = [], code, lang = "", form = "function" },
+  {
+    spec,
+    slice = "",
+    iface = [],
+    deps = [],
+    depContracts = {},
+    code,
+    lang = "",
+    form = "function",
+  },
   t = 0,
 ) {
   return mintClaim({
     kind: "artifact",
     body: {
       code: code ?? {},
+      // name → fingerprint of the dependency's declaration at mint time (review F05): a
+      // same-name dependency whose signature changed invalidates the artifact.
+      ...(Object.keys(depContracts).length ? { depContracts: sortedObject(depContracts) } : {}),
       deps: [...deps].sort(),
       form,
       iface: [...iface].sort(),
-      // `key` is the identity form (exact + near); `spec` stays the SHAPE form (adapt and
-      // the LSH prefilter). A pre-C9 artifact has no key and can only reach adapt.
+      // `key` is the LOSSLESS identity form (exact + near); `spec` stays the SHAPE form (adapt
+      // and the LSH prefilter). A pre-C9 artifact has no key and can only reach adapt; a
+      // pre-F04 key (no keyV) was lossy and never reaches exact.
       key: specKey(spec),
+      keyV: KEY_VERSION,
       lang,
       slice,
       spec: normalizeSpec(spec),
@@ -182,12 +203,100 @@ export function mintArtifact(dir, fields, { evidence, t = 0 } = {}) {
 // The lookup ladder — pure over a claim list (store- and fs-free, fully testable).
 // ---------------------------------------------------------------------------
 
-/** Structural revalidation: every dep the artifact needs still resolves. A cache
- *  serving code whose dependencies vanished is worse than a miss. */
-export function revalidate(artifact, atlas) {
-  if (!atlas) return { checked: false, ok: true, missing: [] };
-  const missing = (artifact.body.deps ?? []).filter((d) => !atlasHas(atlas, d));
-  return { checked: true, ok: missing.length === 0, missing };
+const sortedObject = (o) =>
+  Object.fromEntries(Object.entries(o).sort(([a], [b]) => (a < b ? -1 : 1)));
+
+/**
+ * A dependency's contract fingerprint: the hash of its DECLARATION as the source reads now
+ * (the declaration line through the opening brace/arrow, whitespace-normalized) — what a
+ * caller relies on. `null` when the atlas does not know the symbol or the file is unreadable.
+ * With several same-name definitions the first by (file, line) is used, deterministically.
+ * @param {string} root
+ * @param {any} atlas
+ * @param {string} name
+ * @returns {string|null}
+ */
+export function depContract(root, atlas, name) {
+  const sym = (atlas?.symbols ?? [])
+    .filter((x) => x.name === name || x.qname === name)
+    .sort((a, b) =>
+      a.file < b.file ? -1 : a.file > b.file ? 1 : (a.line ?? 0) - (b.line ?? 0),
+    )[0];
+  if (!sym?.file || !sym.line) return null;
+  let text;
+  try {
+    text = readFileSync(join(root, sym.file), "utf8");
+  } catch {
+    return null;
+  }
+  const decl = text
+    .split(/\r?\n/)
+    .slice(sym.line - 1, sym.line + 5)
+    .join(" ");
+  const cut = decl.search(/\{|=>/);
+  const head = (cut >= 0 ? decl.slice(0, cut) : decl).replace(/\s+/g, " ").trim();
+  return head ? contentHash(`${sym.kind ?? ""}\u0000${head}`).slice(0, 16) : null;
+}
+
+/**
+ * Revalidation at the serving boundary (review F05). A proof is about the bytes and the
+ * interfaces that existed when it was earned; before an artifact is served it must be checked
+ * against what exists NOW:
+ *   - its file (a `{path, sha256}` pointer) must exist with the SAME content digest — a proof
+ *     of old bytes does not validate the current file, and a deleted file is not reusable;
+ *   - every dependency must still resolve in the atlas, and every dependency contract recorded
+ *     at mint must still match the current declaration (same name, changed signature ⇒ stale).
+ * `status` is "valid", "invalid" (with `problems`) or "unknown": no repo root means the file
+ * could not be checked, and no fresh atlas means the dependencies could not — UNKNOWN, never
+ * silently "ok". Inline artifacts carry their own code and need no file check.
+ * @param {any} artifact
+ * @param {any} atlas
+ * @param {{root?: string|null}} [opts]
+ * @returns {{status: "valid"|"invalid"|"unknown", ok: boolean, checked: boolean,
+ *   missing: string[], changed: string[], problems: string[], unknown: string[]}}
+ */
+export function revalidate(artifact, atlas, { root = null } = {}) {
+  const code = artifact?.body?.code ?? {};
+  const deps = artifact?.body?.deps ?? [];
+  const problems = [];
+  const unknown = [];
+  if (code.path) {
+    if (!root) unknown.push(`file ${code.path} (no repo root to check it against)`);
+    else {
+      let text = null;
+      try {
+        text = readFileSync(join(root, code.path), "utf8");
+      } catch {}
+      if (text === null) problems.push(`file ${code.path} no longer exists`);
+      else if (code.sha256 && contentHash(text) !== code.sha256)
+        problems.push(`file ${code.path} changed since it was verified`);
+    }
+  }
+  const missing = [];
+  const changed = [];
+  if (!atlas) {
+    if (deps.length) unknown.push("dependencies (no fresh atlas)");
+  } else {
+    for (const d of deps) if (!atlasHas(atlas, d)) missing.push(d);
+    for (const [name, sig] of Object.entries(artifact?.body?.depContracts ?? {})) {
+      if (missing.includes(name)) continue;
+      const now = root ? depContract(root, atlas, name) : null;
+      if (now === null) unknown.push(`contract of ${name}`);
+      else if (now !== sig) changed.push(name);
+    }
+  }
+  if (missing.length) problems.push(`missing ${missing.join(", ")}`);
+  if (changed.length) problems.push(`changed contract: ${changed.join(", ")}`);
+  const status = problems.length ? "invalid" : unknown.length ? "unknown" : "valid";
+  return {
+    status,
+    ok: status === "valid",
+    checked: status !== "unknown",
+    missing,
+    changed,
+    problems,
+    unknown,
+  };
 }
 
 /**
@@ -197,18 +306,31 @@ export function revalidate(artifact, atlas) {
  * number for a candidate, cosine thresholds NEAR_COS/ADAPT_COS apply; when it yields
  * null for that candidate (missing vector), MinHash Jaccard with NEAR_J/ADAPT_J is the
  * per-candidate fallback — a partially-embedded ledger never loses lexical recall.
+ * Similarity alone never serves code as-is (review F04): a near candidate whose operators,
+ * numbers, literals, identifiers, paths or polarity words differ from the query is held at
+ * the adapt tier (a starting point to review), with the conflict named in `reasons`.
+ * Every hit is revalidated at the serving boundary (review F05, see revalidate): an
+ * `invalid` artifact is never served; an `unknown` one is returned with
+ * `requiresRevalidation: true` — never presented as checked.
  * @param {any[]} claims live ledger claims (any kind — filtered here)
  * @param {string} spec the task
- * @param {{slice?:string, atlas?:any, nowDay?:number,
+ * @param {{slice?:string, atlas?:any, nowDay?:number, root?:string|null,
  *          sim?:((query:any, claim:any)=>number|null)|null}} opts
  * @returns {{tier:"exact"|"near"|"adapt"|"miss", artifact?:any, jaccard?:number,
  *            similarity?:number, simBackend?:string, revalidation?:object,
- *            reasons:string[], sim?:string}} `sim` is stamped by reuseQuery/reusePeek
- *            (the backend label the CLI prints); lookup itself never sets it.
+ *            requiresRevalidation?:boolean, reasons:string[], sim?:string,
+ *            invalidated?:{id:string, missing:string[], changed:string[], problems:string[]}[]}}
+ *            `sim` is stamped by reuseQuery/reusePeek (the backend label the CLI prints);
+ *            lookup itself never sets it.
  */
-export function lookup(claims, spec, { slice = "", atlas = null, nowDay = 0, sim = null } = {}) {
+export function lookup(
+  claims,
+  spec,
+  { slice = "", atlas = null, nowDay = 0, sim = null, root = null } = {},
+) {
   const { key, sketch: qs, keySketch: qk } = fingerprint(spec, slice);
   const reasons = [];
+  const invalidated = [];
   const artifacts = claims.filter(
     (c) => c.kind === "artifact" && !c.tombstone && !isDormant(c, nowDay),
   );
@@ -219,18 +341,42 @@ export function lookup(claims, spec, { slice = "", atlas = null, nowDay = 0, sim
     reasons.push(`${why} ${c.id.slice(0, 8)} below proof floor (val ${v.toFixed(2)})`);
     return false;
   };
+  // Revalidate at the boundary; an invalid artifact is recorded and skipped.
+  const servable = (c, why) => {
+    const rv = revalidate(c, atlas, { root });
+    if (rv.status !== "invalid") return rv;
+    invalidated.push({
+      id: c.id,
+      missing: rv.missing,
+      changed: rv.changed,
+      problems: rv.problems,
+    });
+    reasons.push(`${why} ${c.id.slice(0, 8)} failed revalidation: ${rv.problems.join("; ")}`);
+    return null;
+  };
+  const served = (tier, c, rv, extra = {}) => ({
+    tier,
+    artifact: c,
+    ...extra,
+    revalidation: rv,
+    ...(rv.status === "valid" ? {} : { requiresRevalidation: true }),
+    reasons,
+    invalidated,
+  });
 
-  // 1. exact: the same task (identity key — NOT the shape form, which erases the very
-  //    identifiers that distinguish two tasks), same graph-slice context. An empty key is
-  //    not an identity, so a spec that normalizes to nothing never matches anything.
+  // 1. exact: the same task (LOSSLESS identity key, current key version), same graph-slice
+  //    context. An empty key is not an identity, so a spec that normalizes to nothing never
+  //    matches anything.
   for (const c of artifacts) {
-    if (key && c.body.key === key && (c.body.slice ?? "") === slice && proved(c, "exact")) {
-      const rv = revalidate(c, atlas);
-      if (rv.ok)
-        return { tier: "exact", artifact: c, jaccard: 1, similarity: 1, revalidation: rv, reasons };
-      reasons.push(
-        `exact ${c.id.slice(0, 8)} failed revalidation: missing ${rv.missing.join(", ")}`,
-      );
+    if (
+      key &&
+      c.body.keyV === KEY_VERSION &&
+      c.body.key === key &&
+      (c.body.slice ?? "") === slice &&
+      proved(c, "exact")
+    ) {
+      const rv = servable(c, "exact");
+      if (rv) return served("exact", c, rv, { jaccard: 1, similarity: 1 });
     }
   }
 
@@ -265,33 +411,48 @@ export function lookup(claims, spec, { slice = "", atlas = null, nowDay = 0, sim
     .map(measure)
     .filter((x) => x.adapt)
     .sort((a, b) => b.v - a.v || (a.c.id < b.c.id ? -1 : 1));
+  // F04: similarity found a neighbour; the semantic guard decides whether it is the same
+  // instruction. Any behaviour-bearing difference holds the candidate at adapt.
+  for (const x of ranked) {
+    if (!x.near) continue;
+    const conflicts = semanticConflicts(spec, x.c.body.key ?? "");
+    if (!conflicts.length) continue;
+    x.near = false;
+    reasons.push(
+      `near ${x.c.id.slice(0, 8)} held at adapt — differs in ${describeConflicts(conflicts)}`,
+    );
+  }
 
-  const hit = (tier, x, revalidation) => ({
-    tier,
-    artifact: x.c,
-    // `jaccard` keeps its honest meaning (a Jaccard estimate) — only set on the
-    // MinHash backend. `similarity` is the score the tier decision actually used.
-    jaccard: x.backend === "minhash" ? x.v : undefined,
-    similarity: x.v,
-    simBackend: x.backend,
-    revalidation,
-    reasons,
-  });
+  const hit = (tier, x, revalidation) =>
+    served(tier, x.c, revalidation, {
+      // `jaccard` keeps its honest meaning (a Jaccard estimate) — only set on the
+      // MinHash backend. `similarity` is the score the tier decision actually used.
+      jaccard: x.backend === "minhash" ? x.v : undefined,
+      similarity: x.v,
+      simBackend: x.backend,
+    });
   // No early break: backends interleave in one ranking, so a non-near embed candidate
   // may sort above a near MinHash one — skip, don't stop.
   for (const x of ranked) {
     if (!x.near || !proved(x.c, "near")) continue;
-    const rv = revalidate(x.c, atlas);
-    if (rv.ok) return hit("near", x, rv);
-    reasons.push(
-      `near ${x.c.id.slice(0, 8)} failed revalidation: missing ${rv.missing.join(", ")}`,
-    );
+    const rv = servable(x.c, "near");
+    if (rv) return hit("near", x, rv);
   }
   for (const x of ranked) {
     if (x.near) continue; // handled above
-    if (proved(x.c, "adapt")) return hit("adapt", x, { checked: false, ok: true, missing: [] });
+    if (!proved(x.c, "adapt")) continue;
+    // adapt injects the artifact as a starting point: its FILE must still be the verified
+    // bytes (a deleted/changed file is no starting point); its deps are the delta's problem.
+    const rv = revalidate({ ...x.c, body: { ...x.c.body, deps: [], depContracts: {} } }, null, {
+      root,
+    });
+    if (rv.status === "invalid") {
+      reasons.push(`adapt ${x.c.id.slice(0, 8)} skipped: ${rv.problems.join("; ")}`);
+      continue;
+    }
+    return hit("adapt", x, rv);
   }
-  return { tier: "miss", reasons };
+  return { tier: "miss", reasons, invalidated };
 }
 
 // ---------------------------------------------------------------------------
@@ -325,28 +486,25 @@ export function reuseQuery(root, spec, { slice = "", atlas = null, nowDay = 0 }
   const dir = repoLedger(root);
   const claims = existsSync(join(dir, "claims")) ? loadClaims(dir) : [];
   const sim = specSim(root, spec, claims);
-  const r = lookup(claims, spec, { slice, atlas, nowDay, sim });
+  const r = lookup(claims, spec, { slice, atlas, nowDay, sim, root });
   r.sim = simLabel(sim);
 
   // A FAILED revalidation is an oracle outcome (graph.reval): an artifact whose deps
   // vanished demotes itself — for everyone. A PASSING one is not written back: serving is
   // never confirmation (review C2 — ten daily serves used to lift val 0.643 → 0.864 and
   // kept an artifact served after two failing test runs). Only a real oracle raises val.
-  const contradict = (c, missing) => {
+  // A changed file or dependency CONTRACT is not written back either: the proof was true of
+  // the bytes it saw — the artifact is merely not servable as the current code (review F05).
+  for (const inv of r.invalidated ?? []) {
+    if (!inv.missing.length) continue;
     const o = outcomeRecord({
       oracle: "graph.reval",
       result: "contradict",
-      ref: `atlas:missing:${missing.slice(0, 3).join(",")}`,
+      ref: `atlas:missing:${inv.missing.slice(0, 3).join(",")}`,
       author: gitAuthor(),
       t: nowDay,
     });
-    if (o.ok) appendEvidence(dir, c.id, o.outcome);
-  };
-  for (const reason of r.reasons) {
-    const m = reason.match(/^(?:exact|near) ([0-9a-f]{8}) failed revalidation: missing (.+)$/);
-    if (!m) continue;
-    const c = claims.find((x) => x.id.startsWith(m[1]));
-    if (c) contradict(c, m[2].split(", "));
+    if (o.ok) appendEvidence(dir, inv.id, o.outcome);
   }
 
   recordMetric(root, {
@@ -366,7 +524,7 @@ export function reusePeek(root, spec, { slice = "", atlas = null, nowDay = 0 } =
   if (!existsSync(join(dir, "claims"))) return { tier: "miss", reasons: [], sim: "minhash" };
   const claims = loadClaims(dir);
   const sim = specSim(root, spec, claims);
-  const r = lookup(claims, spec, { slice, atlas, nowDay, sim });
+  const r = lookup(claims, spec, { slice, atlas, nowDay, sim, root });
   r.sim = simLabel(sim);
   return r;
 }
@@ -383,7 +541,15 @@ const EXPORT_RES = [
 ];
 const IMPORT_RE = /import\s+\{([^}]+)\}\s+from\s+["']\.{1,2}\//g;
 
-export function describeFile(root, relPath) {
+/**
+ * The verifiable pointer + structural facts of a real file: `{path, sha256}`, exports, the
+ * codebase symbols it imports, and — given an atlas — each dependency's contract
+ * fingerprint, so a later signature change invalidates the artifact (review F05).
+ * @param {string} root
+ * @param {string} relPath
+ * @param {{atlas?: any}} [opts]
+ */
+export function describeFile(root, relPath, { atlas = null } = {}) {
   const abs = join(root, relPath);
   const text = readFileSync(abs, "utf8");
   const iface = [];
@@ -396,10 +562,19 @@ export function describeFile(root, relPath) {
         .map((s) => s.trim().split(/\s+as\s+/)[0])
         .filter(Boolean),
     );
+  const uniqueDeps = [...new Set(deps)];
+  /** @type {Record<string, string>} */
+  const depContracts = {};
+  if (atlas)
+    for (const d of uniqueDeps) {
+      const sig = depContract(root, atlas, d);
+      if (sig) depContracts[d] = sig;
+    }
   return {
     code: { path: relPath, sha256: contentHash(text) },
     iface: [...new Set(iface)],
-    deps: [...new Set(deps)],
+    deps: uniqueDeps,
+    depContracts,
     lang: relPath.split(".").pop() ?? "",
   };
 }
diff --git a/src/router/cost.js b/src/router/cost.js
index 01e14779..9e5d851d 100644
--- a/src/router/cost.js
+++ b/src/router/cost.js
@@ -7,30 +7,76 @@
 // have both, α_k − log(blended price_k) is nearly constant (same agent, same token volume), so
 // α_m = log(blended price_m) + mean(α_k − log blended price_k). The input/output blend ρ is the
 // value that makes that difference most constant across those models (chosen from data).
+//
+// Sparse data (review F11). The regression needs residual degrees of freedom: with fewer
+// observations than per-model intercepts + slopes + 2, the slopes cannot be estimated and the
+// old code fell back to α = 0 (a $1 attempt) with a residual variance computed from THAT
+// arbitrary fit — one observed $0.05 attempt predicted ≈ $88.87. Now, when the slopes are not
+// identifiable, each model's α is its MEAN LOG COST (slopes 0), and s² is the pooled
+// within-model variance shrunk toward an explicit prior (LOG_COST_VAR_PRIOR), or the prior
+// alone when no model has two observations. Every fit reports its `method`, where s² came from
+// (`s2Source`), the per-model observation `counts`, and the standard error of each α
+// (`alphaSE`), so a sparse estimate is visibly uncertain rather than silently confident.
+// Zero-cost attempts (a provider that recorded no charge) and missing costs cannot enter a
+// log-cost fit: they are excluded and counted in `excluded`.
 import { leastSquares } from "./linalg.js";
 
+/** Residual variance of log attempt cost assumed when the data cannot estimate it: the
+ *  shipped SWE-bench fit's own residual variance (data/router_prior.json → cost.s2 = 0.438,
+ *  5,498 attempts), rounded. An explicit, documented prior — pass `s2Prior` to override. */
+export const LOG_COST_VAR_PRIOR = 0.44;
+/** Pseudo-observations the variance prior is worth when pooling a few residuals. */
+const VAR_PRIOR_WEIGHT = 2;
+
 /**
  * @param {{model: number, x: number[], cost: number}[]} obs
  * @param {number} nModels
  * @param {number} nFeatures
  * @param {{priceIn?: number|null, priceOut?: number|null}[]} [prices] per model, USD per Mtok
  */
-export function fitCost(obs, nModels, nFeatures, prices = []) {
-  const used = obs.filter((o) => o.cost > 0 && Number.isFinite(o.cost));
+export function fitCost(
+  obs,
+  nModels,
+  nFeatures,
+  prices = [],
+  { s2Prior = LOG_COST_VAR_PRIOR } = {},
+) {
+  const inRange = obs.filter(
+    (o) => Number.isInteger(o?.model) && o.model >= 0 && o.model < nModels && Array.isArray(o.x),
+  );
+  const used = inRange.filter((o) => Number.isFinite(o.cost) && o.cost > 0);
+  const excluded = {
+    zeroCost: inRange.filter((o) => o.cost === 0).length,
+    missingCost: inRange.filter((o) => !Number.isFinite(o.cost) || o.cost < 0).length,
+    invalid: obs.length - inRange.length,
+  };
   const seen = new Set(used.map((o) => o.model));
   const models = [...seen].sort((a, b) => a - b);
   const col = new Map(models.map((m, i) => [m, i]));
   const X = used.map((o) => [...models.map((m) => (m === o.model ? 1 : 0)), ...o.x]);
   const y = used.map((o) => Math.log(o.cost));
-  // A tiny ridge on the slopes only keeps the system well-posed with few observations.
-  const ridge = [
-    ...models.map(() => 0),
-    ...new Array(nFeatures).fill(1e-6 * Math.max(1, used.length)),
-  ];
-  const coef =
-    used.length > models.length
-      ? leastSquares(X, y, ridge)
-      : [...models.map(() => 0), ...new Array(nFeatures).fill(0)];
+  const counts = new Array(nModels).fill(0);
+  for (const o of used) counts[o.model]++;
+  // Slopes are identifiable only with residual degrees of freedom left over (≥ 2).
+  const dofOls = used.length - models.length - nFeatures;
+  const method = dofOls >= 2 ? "ols" : used.length ? "mean-log" : null;
+  let coef;
+  if (method === "ols") {
+    // A tiny ridge on the slopes only keeps the system well-posed.
+    const ridge = [
+      ...models.map(() => 0),
+      ...new Array(nFeatures).fill(1e-6 * Math.max(1, used.length)),
+    ];
+    coef = leastSquares(X, y, ridge);
+  } else {
+    // Per-model mean log cost, no slopes: the estimate the data CAN support.
+    const sums = new Map();
+    for (const [i, o] of used.entries()) sums.set(o.model, (sums.get(o.model) ?? 0) + y[i]);
+    coef = [
+      ...models.map((m) => /** @type {number} */ (sums.get(m)) / counts[m]),
+      ...new Array(nFeatures).fill(0),
+    ];
+  }
   const alpha = new Array(nModels).fill(null);
   for (const m of models) alpha[m] = coef[col.get(m)];
   const beta = coef.slice(models.length);
@@ -39,8 +85,20 @@ export function fitCost(obs, nModels, nFeatures, prices = []) {
     const pred = X[i].reduce((s, v, c) => s + v * coef[c], 0);
     rss += (y[i] - pred) ** 2;
   }
-  const dof = Math.max(1, used.length - models.length - nFeatures);
-  const s2 = used.length ? rss / dof : 0;
+  let s2;
+  let s2Source;
+  if (method === "ols") {
+    s2 = rss / dofOls;
+    s2Source = "fitted";
+  } else {
+    // Within-model residuals only (no slopes were fitted), shrunk toward the prior.
+    const dofPooled = used.length - models.length;
+    s2 =
+      dofPooled > 0 ? (rss + VAR_PRIOR_WEIGHT * s2Prior) / (dofPooled + VAR_PRIOR_WEIGHT) : s2Prior;
+    s2Source = dofPooled > 0 ? "pooled+prior" : "prior";
+  }
+  // Standard error of each fitted α (a model with one observation is barely known).
+  const alphaSE = counts.map((n, m) => (alpha[m] === null || !n ? null : Math.sqrt(s2 / n)));
 
   // Cold start from prices.
   const priced = models.filter((m) => prices[m]?.priceIn > 0 && prices[m]?.priceOut > 0);
@@ -75,7 +133,21 @@ export function fitCost(obs, nModels, nFeatures, prices = []) {
       source[m] = "price";
     }
   }
-  return { alpha, beta, s2, rho, kappa, source, pricedModels: priced.length, n: used.length };
+  return {
+    alpha,
+    beta,
+    s2,
+    rho,
+    kappa,
+    source,
+    pricedModels: priced.length,
+    n: used.length,
+    method,
+    s2Source,
+    counts,
+    alphaSE,
+    excluded,
+  };
 }
 
 /** Expected attempt cost per model for a task (null where the model's cost is unknown). */
diff --git a/src/router/index.js b/src/router/index.js
index 5b513872..4cb78771 100644
--- a/src/router/index.js
+++ b/src/router/index.js
@@ -8,13 +8,15 @@
 //   policy.js    best single model or cascade under the chosen objective
 //   registry.js  which models exist and who can serve them (data)
 //
-// Learning: `recordOutcome` appends (task features, model, verified pass/fail, cost) to
-// .forge/route_outcomes.jsonl, and `fitRouter` refits with the shipped fit as the prior
+// Learning: `recordOutcome` appends (task features, model, pass/fail — self-reported unless tied
+// to a `forge verify` run — cost, an idempotent attempt id) to .forge/route_outcomes.jsonl, and `fitRouter` refits with the shipped fit as the prior
 // (a Bayesian update), writing .forge/router_model.json. The shipped fit comes from public
 // per-task results (data/router_prior.json records its source and date).
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { validate } from "../schema.js";
+import { readVerifyEvents } from "../verify.js";
 import { expectedCosts, fitCost } from "./cost.js";
 import { rawFeatures, standardise } from "./features.js";
 import { fitMirt, marginals, nodeProbabilities } from "./mirt.js";
@@ -115,19 +117,38 @@ export function routeUniversal(root, task, opts = {}) {
   const pick = choose(nodes, costs, candidates, objective, maxDepth);
   if (!pick) return { ok: false, reason: "no candidate model has a known cost for this provider" };
   const p1 = marginals(nodes);
-  return {
-    ok: true,
-    cascade: pick.seq.map((i) => ({
+  // Review A07: a registry entry is not availability. Each step names the providers that can
+  // serve it and where its cost comes from; a step no configured provider serves is advice only.
+  const entry = new Map(registry.models.map((m) => [m.id, m]));
+  const cascade = pick.seq.map((i) => {
+    const m = entry.get(aligned.ids[i]);
+    return {
       model: aligned.ids[i],
       status: aligned.status[i],
       pSolveAlone: p1[i],
       expectedAttemptCost: costs[i],
-    })),
+      providers: Object.keys(m?.providers ?? {}),
+      costSource:
+        aligned.status[i] === "fitted" ? "fit (observed attempt costs)" : (m?.price_source ?? null),
+    };
+  });
+  const unmapped = cascade.filter((c) => c.providers.length === 0).map((c) => c.model);
+  const rec = {
+    ok: true,
+    feasible: pick.feasible,
+    cascade,
+    // false: at least one step has no provider id — add one in .forge/models.json to apply it.
+    applicable: unmapped.length === 0,
+    unmapped,
     pSuccess: pick.p,
+    // EXPECTED cost under the fit (not a cap); the worst case runs every attempt.
     expectedCost: pick.cost,
+    maxPossibleCost: pick.maxPossibleCost,
+    minimumExpectedCost: pick.minimumExpectedCost,
     objective,
     target: pick.target,
     targetMet: pick.targetMet,
+    budgetMet: pick.budgetMet,
     bestSingle: {
       model: aligned.ids[pick.bestSingle.model],
       pSuccess: pick.bestSingle.p,
@@ -138,6 +159,19 @@ export function routeUniversal(root, task, opts = {}) {
     fit: { origin: fitted.origin, k: fitted.mirt.k, provenance: fitted.provenance ?? null },
     taskRef: taskRef(task),
   };
+  // Infeasible (F12): the caller must opt into the least-bad cascade explicitly — it is
+  // returned as `fallback`, never as a recommendation that reads as meeting the objective.
+  if (!pick.feasible)
+    return {
+      ok: false,
+      feasible: false,
+      reason: pick.reason,
+      budgetMet: pick.budgetMet,
+      targetMet: pick.targetMet,
+      minimumExpectedCost: pick.minimumExpectedCost,
+      fallback: rec,
+    };
+  return rec;
 }
 
 function readConfigObjective(root) {
@@ -149,41 +183,138 @@ function readConfigObjective(root) {
 export const taskRef = (task) =>
   createHash("sha256").update(String(task)).digest("hex").slice(0, 16);
 
+/** The feature vector length the router fits on (FEATURE_NAMES), for outcome validation. */
+const featureCount = (root) => loadRouterModel(root)?.features?.mean?.length ?? null;
+
+/** One outcome row as stored in `.forge/route_outcomes.jsonl` — validated on write AND read
+ *  (the file is user-editable and can be merged or replayed). */
+const outcomeSpec = (nFeatures) =>
+  /** @type {import("../schema.js").Spec} */ ({
+    type: "object",
+    required: ["task", "model", "passed", "features"],
+    props: {
+      attemptId: { type: "string", nonEmpty: true, max: 200 },
+      task: { type: "string", pattern: /^[0-9a-f]{16}$/ },
+      model: { type: "string", nonEmpty: true, max: 200 },
+      passed: { type: "boolean" },
+      cost: { type: "number", min: 0, max: 1e6, nullable: true },
+      features: {
+        type: "array",
+        items: { type: "number" },
+        ...(nFeatures ? { length: nFeatures } : { maxLength: 256 }),
+      },
+      provenance: { type: "enum", values: ["self-reported", "verify-event"] },
+      verifyRunId: { type: "string", nonEmpty: true, max: 100 },
+    },
+  });
+
 /**
- * Record a verified outcome of one attempt (the only evidence the router learns from). The task
- * text is not stored: only its hash and features.
+ * Record the outcome of one attempt (the only evidence the router learns from). The task text
+ * is not stored: only its hash and features. Validated before it is written (review A04): a
+ * model the registry does not know, a non-boolean verdict, a negative or non-finite cost, or
+ * a feature vector of the wrong length is refused.
+ *
+ * `passed` is SELF-REPORTED by the caller unless `verifyRunId` names a `forge verify` run in
+ * this checkout's verifier-event log whose verdict agrees (PASS ⇔ passed, FAIL ⇔ failed) —
+ * then the row is `provenance: "verify-event"` (A01). `attemptId` makes recording idempotent:
+ * the same attempt recorded twice (a retry, a replayed file) counts once; omit it and a fresh
+ * id is minted.
+ * @param {string} root
+ * @param {{task: string, model: string, passed: boolean, cost?: number|null,
+ *   features?: number[]|null, attemptId?: string|null, verifyRunId?: string|null,
+ *   registry?: {models: any[]}}} outcome
  */
-export function recordOutcome(root, { task, model, passed, cost = null, features = null }) {
+export function recordOutcome(
+  root,
+  {
+    task,
+    model,
+    passed,
+    cost = null,
+    features = null,
+    attemptId = null,
+    verifyRunId = null,
+    registry = loadRegistry(root),
+  },
+) {
   if (!model || typeof passed !== "boolean")
     throw new Error("recordOutcome needs model and passed (boolean)");
-  const dir = join(root, ".forge");
-  mkdirSync(dir, { recursive: true });
+  if (!registry.models.some((m) => m.id === model))
+    throw new Error(`unknown model "${model}" — not in the registry (\`forge route models\`)`);
+  let provenance = "self-reported";
+  if (verifyRunId) {
+    const run = readVerifyEvents(root).find((e) => e.runId === verifyRunId);
+    if (!run) throw new Error(`no verify run ${verifyRunId} in .forge/verify-events.jsonl`);
+    const verdict = run.status === "PASS" ? true : run.status === "FAIL" ? false : null;
+    if (verdict === null)
+      throw new Error(`verify run ${verifyRunId} is ${run.status} — not a pass/fail verdict`);
+    if (verdict !== passed)
+      throw new Error(
+        `verify run ${verifyRunId} says ${run.status}, not ${passed ? "pass" : "fail"}`,
+      );
+    provenance = "verify-event";
+  }
+  const id = attemptId ?? randomUUID();
+  if (readOutcomes(root).some((o) => o.attemptId === id)) {
+    const prev = readOutcomes(root).find((o) => o.attemptId === id);
+    return { ...prev, duplicate: true };
+  }
   const row = {
+    attemptId: id,
     at: new Date().toISOString(),
     task: taskRef(task),
     features: features ?? rawFeatures(root, task),
     model,
     passed,
-    cost: Number.isFinite(cost) ? cost : null,
+    cost: cost === null || cost === undefined ? null : Number(cost),
+    provenance,
+    ...(verifyRunId ? { verifyRunId } : {}),
   };
+  const v = validate(row, outcomeSpec(featureCount(root)), "outcome");
+  if (!v.ok) throw new Error(`invalid outcome: ${v.errors.join("; ")}`);
+  const dir = join(root, ".forge");
+  mkdirSync(dir, { recursive: true });
   appendFileSync(OUTCOMES(root), `${JSON.stringify(row)}\n`);
   return row;
 }
 
+/**
+ * The recorded outcomes, validated and deduplicated: a row that fails the outcome schema is
+ * skipped (and counted in `readOutcomes.lastInvalid`); rows sharing an `attemptId` count once;
+ * legacy rows without one are deduplicated by their exact content, so a replayed or
+ * union-merged file never multiplies training evidence.
+ * @param {string} root
+ */
 export function readOutcomes(root) {
   if (!existsSync(OUTCOMES(root))) return [];
-  return readFileSync(OUTCOMES(root), "utf8")
-    .split("\n")
-    .filter(Boolean)
-    .map((l) => {
-      try {
-        return JSON.parse(l);
-      } catch {
-        return null;
-      }
-    })
-    .filter(Boolean);
+  const spec = outcomeSpec(featureCount(root));
+  const seen = new Set();
+  const out = [];
+  let invalid = 0;
+  for (const line of readFileSync(OUTCOMES(root), "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      invalid++;
+      continue;
+    }
+    if (!validate(row, spec).ok) {
+      invalid++;
+      continue;
+    }
+    const key = row.attemptId
+      ? `id:${row.attemptId}`
+      : `row:${createHash("sha256").update(JSON.stringify(row)).digest("hex")}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(row);
+  }
+  readOutcomes.lastInvalid = invalid;
+  return out;
 }
+readOutcomes.lastInvalid = 0;
 
 /**
  * Refit on the project's recorded outcomes with the shipped fit as the prior mean (Bayesian
@@ -201,12 +332,14 @@ export function fitRouter(
   const byTask = new Map();
   const costObs = [];
   let skipped = 0;
+  let verified = 0;
   for (const o of outcomes) {
     const m = index.get(o.model);
     if (m === undefined || !Array.isArray(o.features)) {
       skipped++;
       continue;
     }
+    if (o.provenance === "verify-event") verified++;
     const x = standardise(shipped.features, o.features);
     if (!byTask.has(o.task)) byTask.set(o.task, { x, obs: [] });
     byTask.get(o.task).obs.push([m, o.passed ? 1 : 0]);
@@ -248,6 +381,9 @@ export function fitRouter(
       prior: shipped.provenance,
       local: {
         outcomes: outcomes.length - skipped,
+        // How much of the local evidence is tied to a verifier event vs self-reported (A01).
+        verifiedOutcomes: verified,
+        selfReportedOutcomes: outcomes.length - skipped - verified,
         skipped,
         tasks: data.tasks.length,
         fittedAt: new Date().toISOString(),
diff --git a/src/router/policy.js b/src/router/policy.js
index e9135c2b..f7d9d6c4 100644
--- a/src/router/policy.js
+++ b/src/router/policy.js
@@ -16,6 +16,16 @@
 //   target:p                    : the cheapest cascade with P(success) ≥ p (else the most likely).
 //   value:V                     : maximise V·P(success) − E[cost]  (V = what a solved task is worth).
 //   budget:B                    : the most likely cascade with E[cost] ≤ B.
+//
+// Infeasibility is explicit (review F12): when no cascade meets the target or fits the budget,
+// the least-bad cascade is still computed, but the result says `feasible: false` with a
+// `reason`, `budgetMet: false` for a budget objective, and `minimumExpectedCost` — the caller
+// must choose to fall back; nothing reads as "within budget". A budget constrains EXPECTED
+// cost only: `maxPossibleCost` (every attempt in the cascade runs) is the worst case, and the
+// ACTUAL charge is whatever the attempts cost — enforce a hard cap at execution time if one is
+// promised. The cost formula also assumes an attempt's cost does not depend on earlier
+// attempts having failed (E[cost_i | earlier failed, x] = E[cost_i | x]); hard residual tasks
+// may cost more, so treat expected cost as an estimate under that assumption.
 
 /** @param {number[][]} P @param {number[]} w @param {number[]} costs @param {number[]} seq */
 export function cascadeStats(P, w, costs, seq) {
@@ -100,10 +110,25 @@ export function choose(nodes, costs, candidates, objective, maxDepth) {
       best = { seq, ...st };
     }
   }
+  const targetMet = target === null ? null : best.p >= target - eps;
+  const budgetMet = objective.kind === "budget" ? best.cost <= objective.budget + eps : null;
+  const minimumExpectedCost = Math.min(...single.map((x) => x.cost));
+  const maxPossibleCost = best.seq.reduce((sum, m) => sum + costs[m], 0);
+  const feasible = targetMet !== false && budgetMet !== false;
+  const reason = feasible
+    ? undefined
+    : budgetMet === false
+      ? `infeasible: no cascade's expected cost fits the budget $${objective.budget} (the cheapest expected cost is $${minimumExpectedCost.toFixed(4)})`
+      : `infeasible: no cascade reaches P(success) ${target} (the best reachable is ${best.p.toFixed(4)})`;
   return {
     ...best,
     target,
-    targetMet: target === null ? null : best.p >= target - eps,
+    targetMet,
+    budgetMet,
+    feasible,
+    ...(reason ? { reason } : {}),
+    minimumExpectedCost,
+    maxPossibleCost,
     bestSingle: { model: bestSingle.m, p: bestSingle.p, cost: bestSingle.cost },
     evaluated,
   };
diff --git a/src/router/registry.js b/src/router/registry.js
index 08a47a6c..91cbe0be 100644
--- a/src/router/registry.js
+++ b/src/router/registry.js
@@ -4,6 +4,24 @@
 // ids, and can disable entries. No model, vendor or tier is named anywhere in router code.
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { violations } from "../schema.js";
+
+/** One `.forge/models.json` entry (review A04): an override is user-edited input, so an entry
+ *  with a non-finite or negative price, a non-string provider id, or no id is refused (and
+ *  reported in `warnings`) instead of flowing into cost arithmetic. */
+const MODEL_SPEC = /** @type {import("../schema.js").Spec} */ ({
+  type: "object",
+  required: ["id"],
+  props: {
+    id: { type: "string", nonEmpty: true, max: 200 },
+    label: { type: "string", max: 200 },
+    org: { type: "string", max: 200 },
+    price_in: { type: "number", min: 0, max: 1e6, nullable: true },
+    price_out: { type: "number", min: 0, max: 1e6, nullable: true },
+    enabled: { type: "boolean" },
+    providers: { type: "object" },
+  },
+});
 
 const SHIPPED = new URL("../../data/models.json", import.meta.url);
 
@@ -17,19 +35,31 @@ function readJson(path) {
 
 /**
  * @param {string|null} root project root (for .forge/models.json), or null
- * @returns {{models: object[], sources: string[]}}
+ * @returns {{models: object[], sources: string[], warnings: string[]}}
  */
 export function loadRegistry(root) {
   const base = readJson(SHIPPED) ?? { models: [] };
   const byId = new Map(base.models.map((m) => [m.id, { ...m }]));
   const sources = ["data/models.json"];
+  /** @type {string[]} */
+  const warnings = [];
   const localPath = root ? join(root, ".forge", "models.json") : null;
   if (localPath && existsSync(localPath)) {
     const local = readJson(localPath);
-    if (local?.models) {
+    if (local === null) warnings.push(".forge/models.json is not valid JSON — ignored");
+    else if (!Array.isArray(local?.models))
+      warnings.push(".forge/models.json has no `models` array — ignored");
+    if (Array.isArray(local?.models)) {
       sources.push(".forge/models.json");
-      for (const m of local.models) {
-        if (!m?.id) continue;
+      for (const [i, m] of local.models.entries()) {
+        const bad = violations(m, MODEL_SPEC, `models[${i}]`);
+        const providers = m?.providers ?? {};
+        for (const [k, v] of Object.entries(typeof providers === "object" ? providers : {}))
+          if (typeof v !== "string") bad.push(`models[${i}].providers.${k}: expected a string`);
+        if (bad.length) {
+          warnings.push(...bad);
+          continue;
+        }
         const prev = byId.get(m.id) ?? {};
         byId.set(m.id, {
           ...prev,
@@ -40,7 +70,7 @@ export function loadRegistry(root) {
     }
   }
   const models = [...byId.values()].filter((m) => m.enabled !== false);
-  return { models, sources };
+  return { models, sources, warnings };
 }
 
 /**
diff --git a/src/schema.js b/src/schema.js
new file mode 100644
index 00000000..3fcaa380
--- /dev/null
+++ b/src/schema.js
@@ -0,0 +1,87 @@
+// forge schema — narrow runtime validation for data that crosses a trust boundary: files a
+// user or teammate can edit (.forge/models.json, .forge/route_outcomes.jsonl), imported
+// records, and verifier events. JSDoc types are checked by tsc at build time only; bytes
+// read from disk or an MCP call arrive untyped, so they are validated here before anything
+// computes with them (review A04). One small, shared vocabulary instead of a bespoke partial
+// validator per module. Zero dependencies (ADR-0001) — this is deliberately not a JSON-Schema
+// implementation, just the handful of shapes forge's boundaries need.
+
+/**
+ * @typedef {{type: "string", nonEmpty?: boolean, max?: number, pattern?: RegExp}
+ *   | {type: "number", integer?: boolean, min?: number, max?: number}
+ *   | {type: "boolean"}
+ *   | {type: "enum", values: readonly unknown[]}
+ *   | {type: "array", items?: Spec, length?: number, maxLength?: number}
+ *   | {type: "object", props?: Record<string, Spec>, required?: readonly string[]}} BaseSpec
+ * @typedef {BaseSpec & {nullable?: boolean}} Spec
+ */
+
+/**
+ * Every violation of `spec` by `value`, as human-readable `path: problem` strings. Numbers
+ * must be FINITE (NaN/Infinity never pass). Unknown object keys are allowed (forward
+ * compatibility); only the declared ones are checked.
+ * @param {unknown} value
+ * @param {Spec} spec
+ * @param {string} [path]
+ * @returns {string[]}
+ */
+export function violations(value, spec, path = "value") {
+  if (value === null || value === undefined) return spec.nullable ? [] : [`${path}: required`];
+  switch (spec.type) {
+    case "string": {
+      if (typeof value !== "string") return [`${path}: expected a string`];
+      if (spec.nonEmpty && !value.trim()) return [`${path}: must not be empty`];
+      if (spec.max !== undefined && value.length > spec.max)
+        return [`${path}: longer than ${spec.max} characters`];
+      if (spec.pattern && !spec.pattern.test(value)) return [`${path}: malformed`];
+      return [];
+    }
+    case "number": {
+      if (typeof value !== "number" || !Number.isFinite(value))
+        return [`${path}: expected a finite number`];
+      if (spec.integer && !Number.isInteger(value)) return [`${path}: expected an integer`];
+      if (spec.min !== undefined && value < spec.min) return [`${path}: below ${spec.min}`];
+      if (spec.max !== undefined && value > spec.max) return [`${path}: above ${spec.max}`];
+      return [];
+    }
+    case "boolean":
+      return typeof value === "boolean" ? [] : [`${path}: expected true or false`];
+    case "enum":
+      return spec.values.includes(value)
+        ? []
+        : [`${path}: expected one of ${spec.values.map((v) => JSON.stringify(v)).join(", ")}`];
+    case "array": {
+      if (!Array.isArray(value)) return [`${path}: expected an array`];
+      if (spec.length !== undefined && value.length !== spec.length)
+        return [`${path}: expected ${spec.length} items, got ${value.length}`];
+      if (spec.maxLength !== undefined && value.length > spec.maxLength)
+        return [`${path}: more than ${spec.maxLength} items`];
+      const items = spec.items;
+      return items ? value.flatMap((v, i) => violations(v, items, `${path}[${i}]`)) : [];
+    }
+    case "object": {
+      if (typeof value !== "object" || Array.isArray(value)) return [`${path}: expected an object`];
+      const o = /** @type {Record<string, unknown>} */ (value);
+      const out = [];
+      for (const k of spec.required ?? [])
+        if (o[k] === undefined || o[k] === null)
+          if (!spec.props?.[k]?.nullable) out.push(`${path}.${k}: required`);
+      for (const [k, s] of Object.entries(spec.props ?? {}))
+        if (o[k] !== undefined) out.push(...violations(o[k], s, `${path}.${k}`));
+      return out;
+    }
+    default:
+      return [`${path}: unknown schema type`];
+  }
+}
+
+/**
+ * Validate and report: `{ok: true}` or `{ok: false, errors}`.
+ * @param {unknown} value
+ * @param {Spec} spec
+ * @param {string} [path]
+ */
+export function validate(value, spec, path) {
+  const errors = violations(value, spec, path);
+  return errors.length ? { ok: false, errors } : { ok: true, errors: [] };
+}
diff --git a/src/semantic_guard.js b/src/semantic_guard.js
new file mode 100644
index 00000000..06e9efad
--- /dev/null
+++ b/src/semantic_guard.js
@@ -0,0 +1,192 @@
+// forge semantic guard — "are these two texts the SAME instruction?", asked before any tier
+// acts on similarity alone. Lexical similarity (MinHash/Jaccard) and embedding cosine say two
+// texts are NEIGHBOURS; they cannot say the texts mean the same thing: `accept ages >= 18` vs
+// `<= 18`, "Enable authentication…" vs "Disable authentication…", `return "ADMIN"` vs
+// `"admin"`, `getURL` vs `getUrl` all score ≈ 1 (review F04/F16). Every place that would
+// MERGE, DEDUPE or SERVE-AS-IS on similarity runs this first and treats any conflict as a
+// blocker: the pair is kept apart (or downgraded to a reviewed tier) with the conflict named.
+//
+// Deliberately conservative and deterministic: the features are the tokens that carry
+// behaviour — operators, numbers (with units), quoted literals, code identifiers and paths
+// (case kept), and polarity/negation words. A false conflict costs a human glance; a missed
+// one serves or keeps the opposite rule. Pure — no I/O.
+
+// Polarity is judged two ways, so that emphasis ("run X" vs "always run X") is not a flip
+// but a real reversal is:
+//  1. NEGATION PARITY — the count of negators (not, never, without, n't, skip, ignore, bypass…)
+//     mod 2. "validate signatures" vs "skip signature validation" differ; "do not skip
+//     validation" vs "validate" do not (a double negative).
+//  2. A SPLIT ANTONYM PAIR — one side says a word from one pole of a pair and the other side
+//     says the opposite pole but not the first: enable/disable, allow/deny, include/exclude,
+//     add/remove, true/false, on/off, always/never, before/after, min/max, asc/desc, …
+const NEGATORS = new Set(
+  (
+    "not no never none nothing nobody nowhere neither nor without cannot " +
+    "skip skips skipped skipping ignore ignores ignored ignoring bypass bypasses bypassed " +
+    "bypassing avoid avoids avoided avoiding prevent prevents prevented omit omits omitted " +
+    "omitting disallow disallows disallowed"
+  ).split(/\s+/),
+);
+// [one pole, the other pole] — inflected forms listed explicitly (no stemmer, no surprises).
+const ANTONYM_PAIRS = [
+  ["enable enables enabled enabling", "disable disables disabled disabling"],
+  [
+    "allow allows allowed allowing permit permits permitted",
+    "deny denies denied denying block blocks blocked blocking forbid forbids forbidden reject rejects rejected",
+  ],
+  ["include includes included including", "exclude excludes excluded excluding"],
+  [
+    "add adds added adding create creates created insert inserts",
+    "remove removes removed removing delete deletes deleted deleting drop drops dropped",
+  ],
+  ["keep keeps kept retain retains", "discard discards discarded"],
+  ["true yes", "false"],
+  ["on", "off"],
+  ["always", "never"],
+  ["before", "after"],
+  ["min minimum lowest", "max maximum highest"],
+  [
+    "increase increases increased raise raises raised grow",
+    "decrease decreases decreased lower lowers lowered reduce reduces reduced shrink",
+  ],
+  ["ascending asc", "descending desc"],
+  ["sync synchronous synchronously", "async asynchronous asynchronously"],
+  ["public external", "private internal"],
+  ["encrypt encrypts encrypted", "decrypt decrypts decrypted unencrypted plaintext"],
+  ["signed sign", "unsigned"],
+  ["valid", "invalid"],
+  ["accept accepts accepted", "reject rejects rejected"],
+  ["required require requires mandatory must", "optional may"],
+  ["strict strictly", "lenient loose loosely"],
+  ["secure securely", "insecure insecurely"],
+  ["more greater larger above over", "less fewer smaller below under"],
+  ["first", "last"],
+  ["start starts started", "stop stops stopped"],
+  ["show shows shown", "hide hides hidden"],
+  ["lock locks locked", "unlock unlocks unlocked"],
+].map(([a, b]) => [new Set(a.split(" ")), new Set(b.split(" "))]);
+const POLE_WORDS = new Set(ANTONYM_PAIRS.flatMap(([a, b]) => [...a, ...b]));
+// A contraction ending in n't (don't, isn't, won't…) is a negator too.
+const NEGATED_CONTRACTION = /^[\p{L}]+n['’]t$/u;
+
+const OPERATOR_RE = /===|!==|==|!=|>=|<=|=>|&&|\|\||<<|>>|[<>=]|!(?=[\p{L}\p{N}_$(])/gu;
+const NUMBER_RE =
+  /(?<![\p{L}\p{N}_])-?\d+(?:[.,_]\d+)*(?:\s?(?:%|ms|s|sec|secs|seconds?|mins?|minutes?|h|hrs?|hours?|d|days?|kb|mb|gb|tb|px|em|rem|x))?(?![\p{L}\p{N}_])/giu;
+const LITERAL_RE = /(["'`])(?:(?!\1)[^\\]|\\.)*\1/gu;
+// camelCase / PascalCase-with-inner-cap / snake_case / SCREAMING_SNAKE / dotted.path /
+// ALLCAPS (≥2 letters) / anything with a digit next to letters — case is part of identity.
+const IDENT_RE =
+  /^(?:[\p{Ll}][\p{L}\p{N}]*\p{Lu}[\p{L}\p{N}]*|\p{Lu}[\p{Ll}\p{N}]+\p{Lu}[\p{L}\p{N}]*|[\p{L}\p{N}]+(?:_[\p{L}\p{N}]+)+_?|[\p{L}_$][\p{L}\p{N}_$]*(?:\.[\p{L}_$][\p{L}\p{N}_$]*)+|\p{Lu}{2,}[\p{Lu}\p{N}]*|[\p{L}]+\d[\p{L}\p{N}]*)$/u;
+const PATH_RE = /[\\/]|\.(?:m?[jt]sx?|py|go|rs|java|rb|json|ya?ml|toml|md|css|html|sh|sql)$/i;
+
+const sorted = (xs) => [...xs].sort();
+
+/**
+ * The behaviour-carrying features of a text.
+ * @param {string} text
+ * @returns {{operators: string[], numbers: string[], literals: string[],
+ *   identifiers: string[], paths: string[], polarity: string[]}}
+ */
+export function criticalFeatures(text) {
+  const s = String(text ?? "").normalize("NFC");
+  /** @type {string[]} */
+  const literals = s.match(LITERAL_RE) ?? [];
+  // Literals are compared whole; strip them before scanning the rest so a quoted ">=" or a
+  // quoted word never double-counts as an operator or a polarity word.
+  const rest = s.replace(LITERAL_RE, " ");
+  const operators = rest.match(OPERATOR_RE) ?? [];
+  const numbers = (rest.match(NUMBER_RE) ?? []).map((n) =>
+    n.toLowerCase().replace(/\s+/g, "").replace(/_/g, ""),
+  );
+  const identifiers = [];
+  const paths = [];
+  const polarity = [];
+  for (const raw of rest.split(/\s+/)) {
+    // edge punctuation only — inner punctuation (dots, underscores, slashes) is identity
+    const tok = raw.replace(/^[^\p{L}\p{N}_$./\\]+|[^\p{L}\p{N}_$/\\]+$/gu, "");
+    if (!tok) continue;
+    if (PATH_RE.test(tok) && /[\p{L}\p{N}]/u.test(tok)) paths.push(tok);
+    else if (IDENT_RE.test(tok)) identifiers.push(tok);
+    const word = tok.toLowerCase();
+    if (NEGATORS.has(word) || NEGATED_CONTRACTION.test(word) || POLE_WORDS.has(word))
+      polarity.push(word);
+  }
+  return {
+    operators: sorted(operators),
+    numbers: sorted(numbers),
+    literals: sorted(literals),
+    identifiers: sorted(identifiers),
+    paths: sorted(paths),
+    polarity: sorted(polarity),
+  };
+}
+
+const sameList = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
+
+const negationParity = (words) =>
+  words.filter((w) => NEGATORS.has(w) || NEGATED_CONTRACTION.test(w)).length % 2;
+
+/** Whether two polarity-word lists REVERSE each other (see the header): different negation
+ *  parity, or a split antonym pair. Emphasis alone ("always" on one side only) is not. */
+export function polarityFlip(a, b) {
+  if (negationParity(a) !== negationParity(b)) return true;
+  const A = new Set(a);
+  const B = new Set(b);
+  const has = (set, pole) => [...pole].some((w) => set.has(w));
+  for (const [p, q] of ANTONYM_PAIRS) {
+    if (has(A, p) && has(B, q) && !has(B, p)) return true;
+    if (has(A, q) && has(B, p) && !has(B, q)) return true;
+    if (has(B, p) && has(A, q) && !has(A, p)) return true;
+    if (has(B, q) && has(A, p) && !has(A, q)) return true;
+  }
+  return false;
+}
+
+/** Every feature class, and the classes that REVERSE meaning (as opposed to adding detail —
+ *  a rewrite that names a new identifier or path is more specific, not the opposite). */
+export const ALL_KINDS = /** @type {const} */ ([
+  "polarity",
+  "operators",
+  "numbers",
+  "literals",
+  "identifiers",
+  "paths",
+]);
+export const FLIP_KINDS = /** @type {const} */ (["polarity", "operators", "numbers", "literals"]);
+
+/**
+ * Every feature class on which two texts disagree — empty when they carry the same
+ * behaviour-bearing tokens. Each conflict names the class and what each side has that the
+ * other lacks.
+ * @param {string} a
+ * @param {string} b
+ * @param {{kinds?: readonly string[]}} [opts] restrict to these feature classes
+ * @returns {{kind: string, a: string[], b: string[]}[]}
+ */
+export function semanticConflicts(a, b, { kinds = ALL_KINDS } = {}) {
+  const fa = criticalFeatures(a);
+  const fb = criticalFeatures(b);
+  const out = [];
+  for (const kind of kinds) {
+    if (
+      kind === "polarity" ? !polarityFlip(fa.polarity, fb.polarity) : sameList(fa[kind], fb[kind])
+    )
+      continue;
+    const onlyA = fa[kind].filter((x) => !fb[kind].includes(x));
+    const onlyB = fb[kind].filter((x) => !fa[kind].includes(x));
+    out.push({ kind, a: onlyA.length ? onlyA : fa[kind], b: onlyB.length ? onlyB : fb[kind] });
+  }
+  return out;
+}
+
+/** True when neither text changes polarity, operators, numbers, literals, identifiers or
+ *  paths relative to the other. Similar-and-conflicting texts are NOT the same instruction.
+ *  @param {string} a @param {string} b @param {{kinds?: readonly string[]}} [opts] */
+export const sameSemantics = (a, b, opts) => semanticConflicts(a, b, opts).length === 0;
+
+/** One-line human description of a conflict list: `polarity: enable ≠ disable; …`. */
+export function describeConflicts(conflicts) {
+  return conflicts
+    .map((c) => `${c.kind}: ${c.a.join(" ") || "∅"} ≠ ${c.b.join(" ") || "∅"}`)
+    .join("; ");
+}
diff --git a/src/stack.js b/src/stack.js
index 900b7161..1b141315 100644
--- a/src/stack.js
+++ b/src/stack.js
@@ -82,7 +82,19 @@ const hasAnyDep = (names, pairs) => {
   return [...new Set(out)];
 };
 
-function detectNode(root, add) {
+// The script `npm init` writes. It is a placeholder, not a suite: running it "fails" every
+// time, which would turn every freshly-initialised workspace package into a false FAIL.
+const NPM_PLACEHOLDER_TEST = /no test specified/;
+
+/** The package's declared `scripts.test`, or null when absent or npm's placeholder. */
+export function declaredTestScript(pkg) {
+  const script = pkg?.scripts?.test;
+  return typeof script === "string" && script.trim() && !NPM_PLACEHOLDER_TEST.test(script)
+    ? script
+    : null;
+}
+
+function detectNode(root, add, { pmRoot = root } = {}) {
   const pkg = readJson(root, "package.json");
   if (!pkg) return;
   add.language("JavaScript/TypeScript");
@@ -92,20 +104,31 @@ function detectNode(root, add) {
   if (existsSync(join(root, "tsconfig.json")) || names.some((n) => n === "typescript"))
     add.language("TypeScript");
   for (const f of hasAnyDep(names, NODE_FRAMEWORKS)) add.framework(f);
-  // npx-based runner detections stay label-only: forge must never EXECUTE npx (it can
-  // download arbitrary packages), so no bin/args descriptor is emitted for them.
-  for (const t of hasAnyDep(names, NODE_TEST)) add.runner({ label: runnerCmd(root, t) });
   // package manager from the lockfile present
   if (existsSync(join(root, "pnpm-lock.yaml"))) add.pm("pnpm");
   else if (existsSync(join(root, "yarn.lock"))) add.pm("yarn");
   else if (existsSync(join(root, "bun.lockb"))) add.pm("bun");
   else if (existsSync(join(root, "package-lock.json"))) add.pm("npm");
+  // A runner found in the dependencies is INVENTORY — a tool that is available — not a
+  // suite someone declared (review F09). With an explicit `scripts.test`, that script IS
+  // the suite (`"test": "vitest run"` already runs vitest), so the dependency must not
+  // become a second, report-only obligation that turns a passing run INCOMPLETE. Only
+  // when nothing is declared does an installed runner stand in as the (report-only)
+  // suite. npx-based detections stay label-only either way: forge never EXECUTES npx (it
+  // can download arbitrary packages), so no bin/args descriptor is emitted for them.
+  const script = declaredTestScript(pkg);
+  for (const t of hasAnyDep(names, NODE_TEST)) {
+    const label = runnerCmd(pmRoot, t);
+    if (script) add.inventory(label);
+    else add.runner({ label });
+  }
   // an explicit test script beats guessing — executable via the DETECTED package manager
-  if (pkg.scripts?.test)
+  // (a workspace package uses the monorepo root's lockfile, hence pmRoot)
+  if (script)
     add.runner({
-      bin: pmRun(root),
+      bin: pmRun(pmRoot),
       args: ["test"],
-      label: `${pmRun(root)} test`,
+      label: `${pmRun(pmRoot)} test`,
     });
 }
 
@@ -345,8 +368,10 @@ function workspaceGlobs(root) {
 // Bounded BFS for nested package roots below `root`. Returns POSIX-relative dir paths,
 // deduped and sorted. Never descends past MONO_MAX_DEPTH, never stats more than
 // MONO_SCAN_BUDGET dirs, never returns more than MONO_MAX_ROOTS — so a giant repo is
-// sampled, never fully walked. Fail-safe: an unreadable dir is skipped.
-function nestedPackageRoots(root) {
+// sampled, never fully walked. Fail-safe: an unreadable dir is skipped. `truncated` says
+// the walk stopped early (budget or root cap): the list is then a SAMPLE, and nothing may
+// claim every package was covered (review F08).
+function scanPackageRoots(root) {
   const found = [];
   let budget = MONO_SCAN_BUDGET;
   /** @type {{dir:string, rel:string, depth:number}[]} */
@@ -376,7 +401,53 @@ function nestedPackageRoots(root) {
     if (WORKSPACE_MANIFESTS.some((m) => existsSync(join(dir, m)))) found.push(rel);
     enqueueChildren(dir, rel, depth + 1);
   }
-  return [...new Set(found)].sort();
+  return { roots: [...new Set(found)].sort(), truncated: queue.length > 0 };
+}
+
+/**
+ * Does a workspace glob (`packages/*`, `apps/**`, `libs/core`) name this package dir?
+ * `*` matches one path segment, `**` any number. Pure.
+ * @param {string} glob @param {string} rel POSIX path relative to the repo root
+ */
+export function matchesWorkspaceGlob(glob, rel) {
+  const g = String(glob).replace(/^\.\//, "").replace(/\/+$/, "");
+  let re = "";
+  for (let i = 0; i < g.length; i++) {
+    const c = g[i];
+    if (c === "*" && g[i + 1] === "*") {
+      // `**/` = zero or more whole segments; a trailing `**` = anything below
+      const slash = g[i + 2] === "/";
+      re += slash ? "(?:[^/]+/)*" : ".*";
+      i += slash ? 2 : 1;
+    } else if (c === "*") re += "[^/]*";
+    else if (c === "?") re += "[^/]";
+    else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`).test(String(rel).replace(/\/+$/, ""));
+}
+
+// A root test script that runs EVERY workspace's suite itself — so a nested package that is a
+// declared workspace member is covered by the root run and must not be run twice.
+const RECURSIVE_TEST_RE =
+  /(?:^|\s)(?:--workspaces|-ws|--recursive|-r)(?:\s|$)|\bworkspaces\s+foreach\b|\bturbo\s+(?:run\s+)?test\b|\blerna\s+run\s+test\b|\bnx\s+run-many\b/;
+
+/** Whether the root's declared test script runs every declared workspace's tests. Pure
+ *  w.r.t. the tree (reads package.json). */
+export function rootTestCoversWorkspaces(root) {
+  const script = declaredTestScript(readJson(root, "package.json"));
+  return !!script && RECURSIVE_TEST_RE.test(script);
+}
+
+/**
+ * The runners ONE directory declares — the manifest detectors only, no workspace walk.
+ * `pmRoot` is where the package manager's lockfile lives (a workspace package installs
+ * through the monorepo root). Used for per-package suites in a monorepo (review F08).
+ * @param {string} dir
+ * @param {{pmRoot?: string}} [opts]
+ * @returns {TestRunner[]}
+ */
+export function detectRunners(dir, { pmRoot = dir } = {}) {
+  return collect(dir, { pmRoot }).testRunners;
 }
 
 /**
@@ -391,25 +462,14 @@ function nestedPackageRoots(root) {
  * @property {string[]} [args]
  */
 
-/**
- * Detect the repo's real stack by reading its manifests. Pure aside from fs reads;
- * every detector is fail-safe. Returns deduped, deterministic (sorted) arrays;
- * `testRunners` is deduped by label and sorted by label.
- * Additive monorepo fields (ME-03): `workspaces` are the declared workspace globs and
- * `packageRoots` the nested package/suite roots found on disk (bounded, capped) — either
- * being non-empty signals the root suite does NOT necessarily cover the whole repo. Both
- * are `[]` for a plain single-root repo, so the pre-existing shape is unchanged.
- * @param {string} [root]
- * @returns {{languages:string[], frameworks:string[], packageManagers:string[],
- *   testCommands:string[], testRunners:TestRunner[], tools:string[], notes:string[],
- *   evidence:string[], workspaces:string[], packageRoots:string[]}}
- */
-export function detectStack(root = process.cwd()) {
+// Run every manifest detector over ONE directory. Fail-safe per detector.
+function collect(root, { pmRoot = root } = {}) {
   const sets = {
     languages: new Set(),
     frameworks: new Set(),
     packageManagers: new Set(),
     testCommands: new Set(),
+    testInventory: new Set(),
     tools: new Set(),
     notes: new Set(),
     evidence: new Set(),
@@ -425,15 +485,18 @@ export function detectStack(root = process.cwd()) {
     runner: (r) => {
       if (!r?.label) return;
       sets.testCommands.add(r.label);
+      sets.testInventory.add(r.label);
       if (!runners.has(r.label)) runners.set(r.label, r);
     },
+    /** an AVAILABLE runner that no declaration requires (inventory only, never a suite) */
+    inventory: (v) => v && sets.testInventory.add(v),
     tool: (v) => v && sets.tools.add(v),
     note: (v) => v && sets.notes.add(v),
     evidence: (v) => v && sets.evidence.add(v),
   };
   for (const d of DETECTORS) {
     try {
-      d(root, add);
+      d(root, add, { pmRoot });
     } catch {}
   }
   const sort = (s) => [...s].sort();
@@ -443,10 +506,39 @@ export function detectStack(root = process.cwd()) {
     packageManagers: sort(sets.packageManagers),
     testCommands: sort(sets.testCommands),
     testRunners: [...runners.values()].sort((a, b) => a.label.localeCompare(b.label)),
+    testInventory: sort(sets.testInventory),
     tools: sort(sets.tools),
     notes: sort(sets.notes),
     evidence: sort(sets.evidence),
+  };
+}
+
+/**
+ * Detect the repo's real stack by reading its manifests. Pure aside from fs reads;
+ * every detector is fail-safe. Returns deduped, deterministic (sorted) arrays;
+ * `testRunners` is deduped by label and sorted by label.
+ * `testCommands`/`testRunners` are the REQUIRED suites (what a declaration asks for:
+ * an explicit `scripts.test`, a pytest config, go.mod…); `testInventory` is every runner
+ * DETECTED, including ones merely installed as a dependency (review F09) — inventory is
+ * never an extra obligation.
+ * Additive monorepo fields (ME-03): `workspaces` are the declared workspace globs and
+ * `packageRoots` the nested package/suite roots found on disk (bounded, capped) — either
+ * being non-empty signals the root suite does NOT necessarily cover the whole repo. Both
+ * are `[]` for a plain single-root repo, so the pre-existing shape is unchanged.
+ * `packageRootsTruncated` is true when the bounded walk stopped early (the list is a
+ * sample, so full coverage cannot be claimed from it).
+ * @param {string} [root]
+ * @returns {{languages:string[], frameworks:string[], packageManagers:string[],
+ *   testCommands:string[], testRunners:TestRunner[], testInventory:string[], tools:string[],
+ *   notes:string[], evidence:string[], workspaces:string[], packageRoots:string[],
+ *   packageRootsTruncated:boolean}}
+ */
+export function detectStack(root = process.cwd()) {
+  const scan = scanPackageRoots(root);
+  return {
+    ...collect(root),
     workspaces: workspaceGlobs(root),
-    packageRoots: nestedPackageRoots(root),
+    packageRoots: scan.roots,
+    packageRootsTruncated: scan.truncated,
   };
 }
diff --git a/src/substrate.js b/src/substrate.js
index bae7428f..3281d33f 100644
--- a/src/substrate.js
+++ b/src/substrate.js
@@ -378,6 +378,8 @@ export function substrateCheck(
             }
           : undefined,
         jaccard: r.jaccard,
+        // F05: "unknown" (no fresh atlas) is not "checked" — say so rather than imply it.
+        ...(r.requiresRevalidation ? { requiresRevalidation: true } : {}),
       };
     } catch {
       return { tier: "miss" }; // cache trouble must never block the gate
@@ -412,11 +414,20 @@ export function substrateCheck(
     route,
     entities,
     reuse,
+    // P4 context: only the explicit gate assembles (file reads are too heavy for the
+    // per-prompt hook), so the ambient path reports `context: null` rather than a guess. The
+    // summary carries the honest delivery state (review F02/F03, R13): `ok` = every required
+    // item DELIVERED within budget; pointers are `pending` reads; `overflow` = the budget
+    // could not hold the required set. The assembled block itself is `forge context`'s job.
     context: context && {
       ok: context.ok,
       tokens: context.tokens,
       budget: context.budget,
+      tokenEstimate: context.tokenEstimate,
+      overflow: context.overflow,
       required: context.required.length,
+      covered: context.covered.length,
+      pending: context.pending,
       missing: context.missing,
       questions: context.questions,
     },
@@ -434,6 +445,8 @@ export function substrateCheck(
       // Consumers must not present impactedFiles as trustworthy when this is false.
       atlasFresh,
       ...(atlasFresh ? {} : { note: "impact unavailable: atlas missing or stale" }),
+      // Review A06: the scope a prediction covers — a graph the file cap truncated says so.
+      ...(atlas?.capped ? { capped: true, skippedFiles: atlas.skippedFiles ?? 0 } : {}),
     },
     scope,
     memory: {
@@ -620,17 +633,30 @@ export function renderSubstrate(result) {
   if (result.route.reasons.length) lines.push(`    driven by: ${result.route.reasons.join(", ")}`);
   if (result.reuse && result.reuse.tier !== "miss") {
     const a = result.reuse.artifact;
+    // exact = the same text; near = a reworded neighbour (review the diff); adapt = a starting
+    // point only. None is re-verified against the current tree unless revalidation says so.
+    const how =
+      result.reuse.tier === "exact"
+        ? "start from it, don't regenerate"
+        : result.reuse.tier === "near"
+          ? "reworded match — review the diff before reusing"
+          : "a starting point only — generate the delta";
     lines.push(
       "",
-      `  reuse: ${result.reuse.tier.toUpperCase()} hit — verified ${a?.form ?? "artifact"}${a?.path ? ` at ${a.path}` : ""} (\`forge ledger show ${a?.id.slice(0, 8)}\`) — start from it, don't regenerate`,
+      `  reuse: ${result.reuse.tier.toUpperCase()} hit — verified ${a?.form ?? "artifact"}${a?.path ? ` at ${a.path}` : ""} (\`forge ledger show ${a?.id.slice(0, 8)}\`) — ${how}${
+        result.reuse.requiresRevalidation ? " (not revalidated against the current tree)" : ""
+      }`,
     );
   }
   if (result.context) {
+    const c = result.context;
+    const state = c.ok ? "complete" : c.overflow ? "OVER BUDGET" : "INCOMPLETE";
     lines.push(
       "",
-      `  context: ${result.context.ok ? "complete" : "INCOMPLETE"} — ${result.context.required} required item(s), ${result.context.tokens}/${result.context.budget} tokens (\`forge context\` for the assembly)`,
+      `  context: ${state} — ${c.covered ?? "?"}/${c.required} required item(s) delivered, ${c.tokens}/${c.budget} tokens est. (\`forge context\` for the assembly)`,
     );
-    for (const q of result.context.questions ?? []) lines.push(`    ? ${q}`);
+    if (c.pending?.length) lines.push(`    pending reads: ${c.pending.slice(0, 6).join(", ")}`);
+    for (const q of c.questions ?? []) lines.push(`    ? ${q}`);
   }
   if (result.impact.atlasFresh === false) {
     lines.push("", "  impact: unavailable — atlas missing or stale (predictions not trustworthy)");
@@ -644,6 +670,10 @@ export function renderSubstrate(result) {
     for (const file of shown.slice(0, 10)) lines.push(`    - ${file}`);
     if (shown.length > 10) lines.push(`    … ${shown.length - 10} more`);
     if (hasCoChange(result.impact)) lines.push(`    (${RELATION_LEGEND})`);
+    if (result.impact.capped)
+      lines.push(
+        `    (graph capped: ${result.impact.skippedFiles} file(s) over the atlas cap were not indexed — impact can miss them)`,
+      );
   }
   // Predicted tests only speak for a FRESH atlas — right after an "impact: unavailable"
   // notice, a likely-affected-tests list would contradict it with stale data (RA-07).
diff --git a/src/verify.js b/src/verify.js
index 2598e094..83a90fef 100644
--- a/src/verify.js
+++ b/src/verify.js
@@ -4,12 +4,28 @@
 // (a cheap, zero-LLM hallucination signal). It emits a provenance stamp so a
 // reviewer reads WHAT was checked, not the authoring transcript.
 import { execFileSync } from "node:child_process";
-import { createHash, createHmac, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { arch, homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 import { build as buildAtlas, has, isStale, load as loadAtlas } from "./atlas.js";
-import { detectStack } from "./stack.js";
+import { BRAND } from "./brand.js";
+import { readForgeConfig } from "./repo_config.js";
+import {
+  detectRunners,
+  detectStack,
+  matchesWorkspaceGlob,
+  rootTestCoversWorkspaces,
+} from "./stack.js";
 
 // Shared call-site extractor — one source of truth with atlas.js (they used to duplicate this).
 export { extractCalledSymbols } from "./extract.js";
@@ -102,9 +118,18 @@ export function evidenceMac(parts) {
     .digest("hex");
 }
 
-/** The MAC a `verify` provenance stamp must carry to count as test evidence. */
+/** The MAC a `verify` provenance stamp must carry to count as test evidence. It covers the
+ *  verdict, the code state it is bound to (fingerprint scheme included, so a stamp minted
+ *  under an older, weaker fingerprint no longer verifies) and the verifier run id. */
 export const provenanceMac = (prov) =>
-  evidenceMac(["verify", prov?.tests?.status, prov?.codeState?.dirtyHash, prov?.codeState?.head]);
+  evidenceMac([
+    "verify",
+    prov?.codeState?.scheme ?? "",
+    prov?.tests?.status,
+    prov?.codeState?.dirtyHash,
+    prov?.codeState?.head,
+    prov?.event?.runId ?? "",
+  ]);
 
 /** Sign a provenance object in place (no-op when no key is available). */
 export function signProvenance(prov) {
@@ -113,45 +138,180 @@ export function signProvenance(prov) {
   return prov;
 }
 
+/** The fingerprint scheme. v2 (review F01): a canonical, length-delimited MANIFEST — the v1
+ *  hash concatenated untracked files' bytes with no path and no boundary, so renaming an
+ *  untracked file, or moving bytes from one file to the next, kept the same hash. */
+export const CODE_STATE_SCHEME = "manifest-v2";
+
+/**
+ * The per-repo `verify` settings from `.forge/forge.config.json` (`verify` key), validated:
+ *   - `workspaces`: "auto" (default — every nested package that declares a suite runs, unless
+ *     the root script is a recursive workspace run) or "root" (an explicit declaration that the
+ *     root test command covers every nested package).
+ *   - `exclude`: package paths (workspace-glob syntax) that are not required suites.
+ *   - `generated`: git glob pathspecs for outputs a test run may legitimately write (coverage
+ *     reports, build output that is not gitignored). They are excluded from the code-state
+ *     fingerprint EVERYWHERE, so they can never invalidate — or be vouched for by — a stamp.
+ * Malformed values are dropped, never trusted.
+ * @param {string} root
+ * @returns {{workspaces: "auto"|"root", exclude: string[], generated: string[]}}
+ */
+export function verifyConfig(root) {
+  let raw = {};
+  try {
+    raw = readForgeConfig(root)?.verify ?? {};
+  } catch {}
+  const strings = (v) =>
+    Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.trim()).map((x) => x.trim()) : [];
+  return {
+    workspaces: raw?.workspaces === "root" ? "root" : "auto",
+    exclude: strings(raw?.exclude),
+    generated: strings(raw?.generated),
+  };
+}
+
+// Interpreter/tool caches that are never source, whatever a repo's .gitignore says: running a
+// suite writes them (pytest's __pycache__, .pytest_cache), and counting them as code changes
+// would make every Python verify "mutated during the run". Always excluded, stated as policy.
+export const BUILTIN_GENERATED = [
+  "**/__pycache__/**",
+  "**/*.pyc",
+  "**/.pytest_cache/**",
+  "**/.mypy_cache/**",
+  "**/.ruff_cache/**",
+];
+
+// Canonical diff flags: binary-safe, no external drivers/textconv (repo attributes must not be
+// able to hide a change), fixed prefixes and no rename detection (user config must not change
+// the bytes that are hashed).
+const DIFF_FLAGS = [
+  "--binary",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--no-color",
+  "--no-renames",
+  "--src-prefix=a/",
+  "--dst-prefix=b/",
+];
+
+/**
+ * One manifest record for an untracked path — `[type, path, …]` as canonical JSON, so every
+ * field is unambiguously delimited. Symlinks are recorded by TARGET (never followed); a nested
+ * repository/directory entry (`sub/`) is bound by path only and reported in `unbound`; a
+ * regular file by exec bit, size and content sha256. Throws when a file cannot be read — the
+ * caller turns that into an unbindable state instead of hashing around the gap.
+ * @param {string} cwd @param {string} rel
+ */
+function manifestRecord(cwd, rel) {
+  const abs = join(cwd, rel);
+  if (rel.endsWith("/")) return { record: ["dir", rel], unbound: true };
+  const st = lstatSync(abs);
+  if (st.isSymbolicLink()) return { record: ["symlink", rel, readlinkSync(abs)] };
+  if (!st.isFile()) return { record: ["other", rel], unbound: true };
+  // git tracks only the executable bit; on Windows it is not meaningful at all.
+  const mode = platform() === "win32" ? "-" : st.mode & 0o111 ? "755" : "644";
+  const digest = createHash("sha256").update(readFileSync(abs)).digest("hex");
+  return { record: ["file", rel, mode, st.size, digest] };
+}
+
 /**
- * A content fingerprint of the FULL working-tree change relative to HEAD — the unstaged
- * diff, the staged diff, and every untracked (non-ignored) file's bytes, sorted, sha256'd.
- * Two checkouts with the same `dirtyHash` have byte-identical pending changes, so a
- * `verify` stamp can be BOUND to the exact code state it validated (HI-02): at Stop the
- * gate recomputes this and only trusts the PASS when the hash still matches. Never throws;
- * `gitAvailable:false` / `dirtyHash:null` is the honest "cannot bind" signal (the gate then
- * refuses to count the stamp) — including when git cannot produce a diff (an error or an
- * over-size output hashes as "cannot bind", never as the empty diff). Diffs are taken with
- * `--binary --no-ext-diff --no-textconv`, so repo attributes/drivers cannot hide a change.
- * Pure w.r.t. the tree — reads git + files, writes nothing.
+ * A fingerprint of the exact code state: HEAD plus the FULL working-tree change relative to
+ * it — the unstaged diff, the staged diff, and a canonical manifest of every untracked
+ * (non-ignored) path. Two states with the same `dirtyHash` have the same HEAD and
+ * byte-identical pending changes, file NAMES and boundaries included, so a `verify` stamp can
+ * be BOUND to the code state it validated (HI-02): at Stop the gate recomputes this and only
+ * trusts the PASS when the hash still matches.
+ *
+ * Policy (review F01), stated so nothing is implicit:
+ *   - tracked changes: `git diff` with canonical flags (paths, contents and mode changes);
+ *   - untracked files: path + exec bit + size + sha256 — a rename, a repartition of bytes
+ *     between files, an added EMPTY file, or a mode change all change the hash;
+ *   - untracked symlinks: bound by their target string, never followed;
+ *   - untracked nested repositories: bound by path only (their content is another repo's
+ *     state) and listed in `unbound`;
+ *   - gitignored files are not code state (generated/untracked-by-design), and neither are
+ *     interpreter/tool caches (BUILTIN_GENERATED), the `verify.generated` pathspecs, or forge's
+ *     own `.forge/` directory;
+ *   - an untracked file that cannot be read makes the state UNBINDABLE (`dirtyHash: null`,
+ *     `unbindable` says why) — never hashed around.
+ * Never throws; `gitAvailable:false` / `dirtyHash:null` is the honest "cannot bind" signal
+ * (the gate then refuses to count the stamp) — including when git cannot produce a diff (an
+ * error or an over-size output hashes as "cannot bind", never as the empty diff). Pure w.r.t.
+ * the tree — reads git + files, writes nothing.
  * @param {string} [cwd]
- * @returns {{head: string|null, dirtyHash: string|null, gitAvailable: boolean}}
+ * @returns {{head: string|null, dirtyHash: string|null, gitAvailable: boolean, scheme: string,
+ *   unbound?: string[], unbindable?: string}}
  */
 export function computeCodeState(cwd = process.cwd()) {
+  const scheme = CODE_STATE_SCHEME;
   try {
     if (git(["rev-parse", "--is-inside-work-tree"], cwd).trim() !== "true")
-      return { head: null, dirtyHash: null, gitAvailable: false };
+      return { head: null, dirtyHash: null, gitAvailable: false, scheme };
     const head = git(["rev-parse", "HEAD"], cwd).trim() || null;
+    const generated = [...BUILTIN_GENERATED, ...verifyConfig(cwd).generated];
+    // Generated outputs (built-in caches + what the repo declared) are excluded on BOTH sides.
+    const excludes = generated.map((g) => `:(top,exclude,glob)${g}`);
+    const trackedSpec = excludes.length ? ["--", ":/", ...excludes] : [];
+    const untrackedSpec = excludes.length ? ["--", ".", ...excludes] : [];
     // Exclude forge's OWN state dir: writing provenance.json / session files must never
     // perturb the fingerprint the stamp is bound to (self-reference), and it's ignored in
     // real repos anyway — this keeps the hash stable even if a user forgot to gitignore it.
-    const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], cwd)
+    const untracked = gitStrict(
+      ["ls-files", "--others", "--exclude-standard", "-z", ...untrackedSpec],
+      cwd,
+    )
       .split("\0")
       .filter((f) => f && !f.startsWith(".forge/"))
       .sort();
     const h = createHash("sha256");
-    const raw = ["--binary", "--no-ext-diff", "--no-textconv", "--no-color"];
+    // Every section is length-prefixed: no section's bytes can masquerade as another's.
+    const section = (name, data) => {
+      const buf = Buffer.isBuffer(data) ? data : Buffer.from(String(data), "utf8");
+      h.update(`${name}\u0000${buf.length}\u0000`);
+      h.update(buf);
+    };
+    section("scheme", scheme);
+    section("head", head ?? "");
+    section("generated", JSON.stringify(generated));
     // Unborn HEAD (no commit yet): index-vs-worktree + staged covers the whole change.
-    h.update(gitStrict(head ? ["diff", "HEAD", ...raw] : ["diff", ...raw], cwd));
-    h.update(gitStrict(["diff", "--cached", ...raw], cwd));
+    section(
+      "worktree",
+      gitStrict(
+        head
+          ? ["diff", "HEAD", ...DIFF_FLAGS, ...trackedSpec]
+          : ["diff", ...DIFF_FLAGS, ...trackedSpec],
+        cwd,
+      ),
+    );
+    section("index", gitStrict(["diff", "--cached", ...DIFF_FLAGS, ...trackedSpec], cwd));
+    const unbound = [];
+    const lines = [];
     for (const f of untracked) {
+      let rec;
       try {
-        h.update(readFileSync(join(cwd, f)));
-      } catch {}
+        rec = manifestRecord(cwd, f);
+      } catch (err) {
+        return {
+          head,
+          dirtyHash: null,
+          gitAvailable: true,
+          scheme,
+          unbindable: `untracked file ${f} could not be read (${err?.code ?? "error"})`,
+        };
+      }
+      if (rec.unbound) unbound.push(f);
+      lines.push(JSON.stringify(rec.record));
     }
-    return { head, dirtyHash: h.digest("hex"), gitAvailable: true };
+    section("untracked", lines.join("\n"));
+    return {
+      head,
+      dirtyHash: h.digest("hex"),
+      gitAvailable: true,
+      scheme,
+      ...(unbound.length ? { unbound } : {}),
+    };
   } catch {
-    return { head: null, dirtyHash: null, gitAvailable: false };
+    return { head: null, dirtyHash: null, gitAvailable: false, scheme };
   }
 }
 
@@ -172,12 +332,26 @@ export function computeCodeState(cwd = process.cwd()) {
  * @typedef {object} SuiteResult
  * @property {string} label            human-readable runner command
  * @property {"PASS"|"FAIL"|"INCOMPLETE"} status
+ * @property {string} [cwd]            where it ran, relative to the verified root ("." = root)
+ * @property {string[]} [covers]       the package dirs this suite's verdict speaks for
  * @property {number|null} [exitCode]  process exit code (0 pass, non-zero fail, null if it never ran)
  * @property {string} [code]           spawn error code (ENOENT/EACCES/ENOEXEC/…) when it did not execute
  * @property {string} [signal]         terminating signal, if any
  * @property {boolean} [timedOut]      true when the suite was killed for exceeding the timeout
  * @property {string} [output]         tail of the suite's own output (failures)
  */
+/**
+ * Which package dirs needed a verdict, and which got one (review F08). `required` is "." (the
+ * root, when it declares a suite) plus every nested package that declares its own suite and is
+ * not excluded; `covered` ran to a verdict (PASS/FAIL) by some suite; `uncovered` did not.
+ * @typedef {object} SuiteCoverage
+ * @property {string[]} required
+ * @property {string[]} covered
+ * @property {string[]} uncovered
+ * @property {{path: string, reason: string}[]} excluded
+ * @property {boolean} rootCoversWorkspaces  the root command runs every declared workspace
+ * @property {boolean} [truncated]           the package scan was a sample (non-git fallback)
+ */
 /**
  * @typedef {object} VerifyTests
  * @property {boolean} ran
@@ -188,6 +362,8 @@ export function computeCodeState(cwd = process.cwd()) {
  * @property {string[]} [detected]
  * @property {SuiteResult[]} [executed]   every suite forge actually spawned, with its per-suite verdict
  * @property {string[]} [notExecuted]     labels of detected suites forge has no built-in executor for
+ * @property {SuiteCoverage} [coverage]   which packages the verdict actually covers
+ * @property {boolean} [mutated]          the code state changed while the suites ran (review F10)
  * @property {string} [output]
  */
 // Bins forge is willing to execute directly. Everything else stays report-only.
@@ -284,70 +460,243 @@ export function classifySuiteFailure(e, { label, bin, timeout }) {
   };
 }
 
+// Where nested packages hide that are NOT the project's own suites: test fixtures, recorded
+// data, mocks. A declared workspace member is required even if its path matches.
+const FIXTURE_SEGMENTS = new Set([
+  "fixtures",
+  "__fixtures__",
+  "fixture",
+  "testdata",
+  "test-fixtures",
+  "__mocks__",
+]);
+// Never required: vendored or generated trees (mirrors the stack walker's skip list).
+const NON_SOURCE_SEGMENTS = new Set([
+  "node_modules",
+  "vendor",
+  "dist",
+  "build",
+  "out",
+  "target",
+  ".venv",
+  "venv",
+  "__pycache__",
+  "coverage",
+]);
+const PACKAGE_MANIFESTS = [
+  "package.json",
+  "pyproject.toml",
+  "setup.py",
+  "pytest.ini",
+  "go.mod",
+  "Cargo.toml",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "Gemfile",
+  "composer.json",
+];
+
+/**
+ * Every nested package dir (relative, POSIX) under `root`. In a git work tree this is COMPLETE:
+ * git lists every tracked or untracked-but-not-ignored manifest, so no package is missed by a
+ * scan budget. Outside git it falls back to the stack detector's bounded walk, and says so.
+ * @param {string} root
+ * @param {ReturnType<typeof detectStack>} stack
+ * @returns {{roots: string[], truncated: boolean}}
+ */
+function nestedPackages(root, stack) {
+  const inGit = git(["rev-parse", "--is-inside-work-tree"], root).trim() === "true";
+  const listed = inGit
+    ? git(
+        [
+          "ls-files",
+          "-z",
+          "--cached",
+          "--others",
+          "--exclude-standard",
+          "--",
+          ...PACKAGE_MANIFESTS.map((m) => `:(glob)**/${m}`),
+        ],
+        root,
+      )
+    : "";
+  // In a git work tree the listing is authoritative even when it is empty (no nested
+  // manifests); only outside git does the bounded walk stand in.
+  if (inGit) {
+    const roots = new Set();
+    for (const f of listed.split("\0")) {
+      const i = f.lastIndexOf("/");
+      if (i <= 0) continue; // a root manifest is the root package, not a nested one
+      const dir = f.slice(0, i);
+      if (dir.split("/").some((seg) => seg.startsWith(".") || NON_SOURCE_SEGMENTS.has(seg)))
+        continue;
+      roots.add(dir);
+    }
+    return { roots: [...roots].sort(), truncated: false };
+  }
+  return {
+    roots: [...(stack?.packageRoots ?? [])],
+    truncated: stack?.packageRootsTruncated === true,
+  };
+}
+
+/**
+ * The verification plan (review F08/F09): which suites run where, and which package dirs
+ * each verdict speaks for. A PASS may only be claimed for what a suite actually covered.
+ *   - The root's declared suites run at the root and cover ".".
+ *   - A nested package that declares its own suite (an explicit `scripts.test`, a pytest
+ *     config, go.mod…) is REQUIRED, unless excluded by `verify.exclude` or by living under
+ *     a fixture/test-data directory (a declared workspace member is never excluded that way).
+ *   - It is covered by the root run when the root script is a recursive workspace run and the
+ *     package is a declared workspace member, or when the repo declares `verify.workspaces:
+ *     "root"` — then it is not run twice. Otherwise its own suite runs in its own directory.
+ * Runners found only as dependencies are inventory, never obligations (see stack.js).
+ * @param {string} root
+ * @param {{stack?: any, config?: ReturnType<typeof verifyConfig>}} [opts]
+ */
+export function planSuites(root, { stack = detectStack(root), config = verifyConfig(root) } = {}) {
+  const detected = [...(stack?.testCommands ?? [])];
+  const rootRunners = stack?.testRunners?.length
+    ? stack.testRunners
+    : parseRunnerStrings(stack?.testCommands ?? []);
+  const workspaces = stack?.workspaces ?? [];
+  const recursive = rootTestCoversWorkspaces(root);
+  const declaredRoot = config.workspaces === "root";
+  /** @type {{cwd: string, runner: any, label: string, covers: string[]}[]} */
+  const nested = [];
+  /** @type {{path: string, reason: string}[]} */
+  const excluded = [];
+  const required = rootRunners.length ? ["."] : [];
+  const rootCovers = ["."];
+  const scan = nestedPackages(root, stack);
+  for (const pkg of scan.roots) {
+    const member = workspaces.some((g) => matchesWorkspaceGlob(g, pkg));
+    if (config.exclude.some((g) => matchesWorkspaceGlob(g, pkg) || pkg.startsWith(`${g}/`))) {
+      excluded.push({ path: pkg, reason: "verify.exclude" });
+      continue;
+    }
+    if (!member && pkg.split("/").some((seg) => FIXTURE_SEGMENTS.has(seg))) {
+      excluded.push({ path: pkg, reason: "fixture/test-data directory" });
+      continue;
+    }
+    let runners = [];
+    try {
+      runners = detectRunners(join(root, pkg), { pmRoot: root });
+    } catch {}
+    if (!runners.length) continue; // declares no suite — nothing is owed for it
+    required.push(pkg);
+    if (declaredRoot || (recursive && member)) {
+      rootCovers.push(pkg);
+      continue;
+    }
+    for (const r of runners) {
+      detected.push(`${r.label} (${pkg})`);
+      nested.push({ cwd: pkg, runner: r, label: `${r.label} (${pkg})`, covers: [pkg] });
+    }
+  }
+  const rootSuites = rootRunners.map((r) => ({
+    cwd: ".",
+    runner: r,
+    label: r?.label ?? String(r?.bin ?? "unknown"),
+    covers: rootCovers,
+  }));
+  return {
+    suites: [...rootSuites, ...nested],
+    detected: [...new Set(detected)],
+    coverage: {
+      required,
+      excluded,
+      rootCoversWorkspaces: recursive || declaredRoot,
+      ...(scan.truncated ? { truncated: true } : {}),
+    },
+  };
+}
+
+// The project's suite must run as if launched from a terminal. `NODE_TEST_CONTEXT` is node's
+// test-runner plumbing: inherited from a parent `node --test` (verify called from inside a
+// test run, or from a hook spawned by one), it makes the project's own `node --test` act as a
+// reporting child and exit 0 without running its files — a PASS that tested nothing.
+const suiteEnv = () => {
+  const env = { ...process.env };
+  delete env.NODE_TEST_CONTEXT;
+  return env;
+};
+
 /**
- * Run EVERY detected executable suite (HI-01) — a polyglot repo where a passing
- * Node suite hides a failing pytest suite must NOT report PASS. Aggregate to an
- * honest four-state verdict:
- *   - all executed suites PASS and nothing was skipped → PASS
- *   - any executed suite FAILs (real non-zero exit)     → FAIL
- *   - a detected suite is non-executable, or a spawn never completed (ENOENT /
- *     EACCES / ENOEXEC / signal / timeout, ME-02)        → INCOMPLETE
- *   - no runners at all                                  → NOT_CONFIGURED
+ * Run EVERY planned suite (HI-01 + review F08) — a polyglot repo where a passing Node suite
+ * hides a failing pytest suite, or a monorepo where a passing root hides a failing workspace,
+ * must NOT report PASS. Aggregate to an honest four-state verdict:
+ *   - every required package covered by a suite that ran and PASSED   → PASS
+ *   - any executed suite FAILs (real non-zero exit)                     → FAIL
+ *   - a planned suite is non-executable, a spawn never completed (ENOENT /
+ *     EACCES / ENOEXEC / signal / timeout, ME-02), or a required package
+ *     got no verdict (uncovered, or the package scan was only a sample) → INCOMPLETE
+ *   - no suites at all                                                   → NOT_CONFIGURED
  * Only a real non-zero EXIT CODE from a suite that actually ran is a FAIL; a suite
  * that never executed is INCOMPLETE, never a false FAIL.
  * @param {string} cwd
+ * @param {{plan?: ReturnType<typeof planSuites>}} [opts]
  * @returns {VerifyTests}
  */
-function runTests(cwd) {
+function runTests(cwd, { plan = planSuites(cwd) } = {}) {
   const timeout = Number(process.env.FORGE_VERIFY_TIMEOUT_MS) || 600000;
-  // Detect the repo's real test runners (no test script → none → NOT_CONFIGURED, not a
-  // forced npm-test failure).
-  let stack = null;
-  try {
-    stack = detectStack(cwd);
-  } catch {}
-  const detected = stack?.testCommands ?? [];
-  if (!detected.length) return { ran: false, status: "NOT_CONFIGURED" };
-  const runners = stack?.testRunners?.length ? stack.testRunners : parseRunnerStrings(detected);
+  // No declared suite anywhere → NOT_CONFIGURED, not a forced npm-test failure.
+  if (!plan.suites.length) return { ran: false, status: "NOT_CONFIGURED" };
 
   /** @type {SuiteResult[]} */
   const executed = [];
   /** @type {string[]} */
   const notExecuted = [];
-  const masked = maskedTestScript(cwd);
-  for (const r of runners) {
-    const label = r?.label ?? String(r?.bin ?? "unknown");
+  for (const { cwd: rel, runner: r, label, covers } of plan.suites) {
+    const dir = rel === "." ? cwd : join(cwd, rel);
+    const where = { cwd: rel, covers };
+    const masked = maskedTestScript(dir);
     if (masked && r?.bin && r.bin !== "pytest") {
       // The package script swallows its own failures — running it can only produce a
       // meaningless 0. Say so instead of minting evidence out of it.
       executed.push({
         label,
         status: "INCOMPLETE",
+        ...where,
         exitCode: null,
         output: `the package.json test script masks failures (\`${masked.slice(0, 80)}\`) — its exit code cannot be a verdict`,
       });
       continue;
     }
-    if (!isExecutable(r, cwd)) {
+    if (!isExecutable(r, dir)) {
       // No built-in executor (go/cargo/mvn/gradle/dotnet/rspec/phpunit/npx-runners) —
-      // report-only. Its absence means a PASS can't be claimed for the whole repo.
+      // report-only. Its absence means a PASS can't be claimed for what it covers.
       notExecuted.push(label);
       continue;
     }
     try {
       execFileSync(r.bin, r.args ?? [], {
-        cwd,
+        cwd: dir,
         encoding: "utf8",
         stdio: "pipe",
         timeout,
+        env: suiteEnv(),
       });
-      executed.push({ label, status: "PASS", exitCode: 0 });
+      executed.push({ label, status: "PASS", ...where, exitCode: 0 });
     } catch (e) {
-      executed.push(classifySuiteFailure(e, { label, bin: r.bin, timeout }));
+      executed.push({ ...classifySuiteFailure(e, { label, bin: r.bin, timeout }), ...where });
     }
   }
 
-  // Aggregate. A PASS must mean every detected required suite ran and passed.
+  // Coverage: a package counts as covered only when a suite that covers it reached a verdict.
+  const verdict = new Set();
+  for (const s of executed)
+    if (s.status === "PASS" || s.status === "FAIL") for (const p of s.covers ?? []) verdict.add(p);
+  const required = plan.coverage.required;
+  /** @type {SuiteCoverage} */
+  const coverage = {
+    ...plan.coverage,
+    covered: required.filter((p) => verdict.has(p)),
+    uncovered: required.filter((p) => !verdict.has(p)),
+  };
+
+  // Aggregate. A PASS must mean every required package's suite ran and passed.
   const anyFail = executed.some((s) => s.status === "FAIL");
   const anyIncomplete = executed.some((s) => s.status === "INCOMPLETE");
   const ranToVerdict = executed.some((s) => s.status === "PASS" || s.status === "FAIL");
@@ -355,8 +704,9 @@ function runTests(cwd) {
   /** @type {"PASS"|"FAIL"|"INCOMPLETE"} */
   let status;
   if (anyFail) status = "FAIL";
-  else if (anyIncomplete || notExecuted.length) status = "INCOMPLETE";
-  else status = "PASS"; // executed non-empty (NOT_CONFIGURED short-circuits above), all PASS
+  else if (anyIncomplete || notExecuted.length || coverage.uncovered.length || coverage.truncated)
+    status = "INCOMPLETE";
+  else status = "PASS"; // every required package covered by a passing suite
 
   // Honest human-readable summary, aggregated across suites.
   const parts = [];
@@ -368,17 +718,28 @@ function runTests(cwd) {
     if (s.status === "INCOMPLETE") parts.push(`"${s.label}" ${s.output ?? "did not execute"}`);
     else if (s.status === "FAIL") parts.push(`"${s.label}" FAILED: ${s.output ?? ""}`);
   }
+  const unexplained = coverage.uncovered.filter(
+    (p) =>
+      !executed.some((s) => s.covers?.includes(p)) &&
+      !notExecuted.some((l) => l.endsWith(`(${p})`)),
+  );
+  if (unexplained.length) parts.push(`no verdict for package(s): ${unexplained.join(", ")}`);
+  if (coverage.truncated)
+    parts.push(
+      'the package scan was a bounded sample (not a git work tree) — declare `verify.workspaces: "root"` or verify each package',
+    );
   const runnerLabels = executed.map((s) => s.label);
-  const runner = runnerLabels.join(", ") || runners.map((r) => r?.label).filter(Boolean)[0];
+  const runner = runnerLabels.join(", ") || plan.suites.map((x) => x.label).filter(Boolean)[0];
   return {
     ran: ranToVerdict,
     passed: status === "PASS",
     status,
     runner,
     ...(timedOut ? { timedOut: true } : {}),
-    detected,
+    detected: plan.detected,
     executed,
     notExecuted,
+    coverage,
     ...(parts.length ? { output: parts.join("; ") } : {}),
   };
 }
@@ -405,8 +766,71 @@ export function checkpointCadence({ pErr, tokensPerStep, costPerToken = 1, check
   return Math.min(50, Math.max(1, n)); // zero risk → Infinity → the 50-step ceiling
 }
 
+const VERIFY_EVENTS = (root) => join(root, ".forge", "verify-events.jsonl");
+
+/** The environment a verdict was produced in — part of the verifier event (A01). */
+function environmentDigest() {
+  const env = { node: process.version, platform: platform(), arch: arch() };
+  return {
+    ...env,
+    digest: createHash("sha256").update(JSON.stringify(env)).digest("hex").slice(0, 16),
+  };
+}
+
+/**
+ * The MAC over one verifier event: the run id, the verdict, and the code state before and
+ * after the run. It AUTHENTICATES who recorded the event (this machine's key) — it does not
+ * make the verdict true.
+ * @param {any} event
+ */
+export const verifyEventMac = (event) =>
+  evidenceMac([
+    "verify-event",
+    event?.runId,
+    event?.status,
+    event?.pre?.scheme,
+    event?.pre?.head,
+    event?.pre?.dirtyHash,
+    event?.post?.head,
+    event?.post?.dirtyHash,
+  ]);
+
+/**
+ * Read this checkout's verifier events (`.forge/verify-events.jsonl`), newest last. Lines
+ * that fail to parse or whose MAC does not verify are skipped, never trusted.
+ * @param {string} root
+ * @returns {any[]}
+ */
+export function readVerifyEvents(root) {
+  let text = "";
+  try {
+    text = readFileSync(VERIFY_EVENTS(root), "utf8");
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const e = JSON.parse(line);
+      const mac = verifyEventMac(e);
+      if (typeof e?.runId === "string" && (mac == null || e.mac === mac)) out.push(e);
+    } catch {}
+  }
+  return out;
+}
+
 /**
  * Independent verification pass over the working change.
+ *
+ * The verdict is bound to the code it TESTED (review F10): the code state is captured before
+ * and after the suites run, and if it changed in between (a test that rewrites source, a
+ * formatter, a concurrent agent edit) the result is INCOMPLETE with `mutated: true` — a PASS
+ * is never signed for bytes that were not the bytes tested. The provenance stamp's `codeState`
+ * is the PRE-run state; `event` is the immutable verifier event (A01): run id, verifier and
+ * version, per-suite cwd/command/verdict, package coverage, pre/post tree identity, timestamps
+ * and an environment digest. The event is also appended to `.forge/verify-events.jsonl`, so
+ * other evidence (router outcomes, ledger refs) can cite a run by id.
  * @param {{targetRoot?: string, base?: string}} [opts]
  * @returns {{ok: boolean, provenance: object, unknown: string[], tests: VerifyTests,
  *   changedFiles: string[], added: string}}
@@ -425,9 +849,11 @@ export function verify({ targetRoot = process.cwd(), base = "HEAD" } = {}) {
   // Untracked (new, not-yet-added) files are part of the change too — a brand-new source file
   // and its call sites would be invisible to `git diff`. Fold their paths into changedFiles and
   // their contents into `added` so provenance and the hallucination check both see them (P0-09).
+  // Forge's own state dir is not the change under verification (the fingerprint excludes it
+  // too): verify's outputs — provenance.json, verify-events.jsonl — never count as changed.
   const untracked = git(["ls-files", "--others", "--exclude-standard"], targetRoot)
     .split("\n")
-    .filter(Boolean);
+    .filter((f) => f && !f.startsWith(".forge/"));
   // Mirror the diff's --cached fallback so the base file list is derived from the SAME diff that
   // produced `added` (a base whose worktree matches HEAD but whose index differs would otherwise
   // yield `added` from --cached while changedFiles stayed empty, weakening impact/docsdrift).
@@ -458,16 +884,61 @@ export function verify({ targetRoot = process.cwd(), base = "HEAD" } = {}) {
   // When the graph was capped (huge repo, files dropped), "defined nowhere" is unreliable — a
   // symbol may live in a dropped file — so don't assert hallucinations.
   const unknown = atlas.capped ? [] : findUnknownSymbols(atlas, symbols);
-  const tests = runTests(targetRoot);
 
+  const runId = randomUUID();
+  const startedAt = new Date().toISOString();
+  const plan = planSuites(targetRoot);
+  const pre = computeCodeState(targetRoot);
+  const tests = runTests(targetRoot, { plan });
+  const post = computeCodeState(targetRoot);
+  const finishedAt = new Date().toISOString();
+  // F10: the tree moved while the suites ran. Neither state is the one that was tested, so
+  // no verdict may be bound to either — INCOMPLETE, whatever the suites said.
+  // (An unbindable PRE state — no git, or an unreadable file — cannot detect a mutation; its
+  //  stamp is unbindable anyway and the gate never counts it.)
+  const mutated =
+    typeof pre.dirtyHash === "string" &&
+    (post.dirtyHash !== pre.dirtyHash || post.head !== pre.head);
+  if (mutated && tests.status !== "NOT_CONFIGURED") {
+    const note =
+      "the code changed while the tests ran (a test, formatter or concurrent edit wrote to the tree) — the verdict cannot be bound to the tested bytes; re-run on a quiet tree, or declare expected outputs in verify.generated";
+    tests.mutated = true;
+    tests.status = "INCOMPLETE";
+    tests.passed = false;
+    tests.output = tests.output ? `${note}; ${tests.output}` : note;
+  }
+
+  const event = {
+    v: 1,
+    runId,
+    verifier: `${BRAND.cli} verify`,
+    verifierVersion: BRAND.version,
+    startedAt,
+    finishedAt,
+    status: tests.status,
+    suites: (tests.executed ?? []).map((s) => ({
+      label: s.label,
+      cwd: s.cwd ?? ".",
+      covers: s.covers ?? ["."],
+      status: s.status,
+      exitCode: s.exitCode ?? null,
+    })),
+    notExecuted: tests.notExecuted ?? [],
+    coverage: tests.coverage ?? null,
+    pre: { scheme: pre.scheme, head: pre.head, dirtyHash: pre.dirtyHash },
+    post: { head: post.head, dirtyHash: post.dirtyHash },
+    environment: environmentDigest(),
+  };
   const provenance = {
     base,
     changedFiles,
     untracked,
     tests,
-    // Bind the stamp to the exact code it was produced against (HI-02/ME-04): the Stop gate
-    // recomputes this and only counts the PASS as test-evidence when the hash still matches.
-    codeState: computeCodeState(targetRoot),
+    // Bind the stamp to the exact code it TESTED (HI-02/ME-04/F10): the Stop gate recomputes
+    // this and only counts the PASS as test-evidence when the hash still matches.
+    codeState: pre,
+    ...(mutated ? { codeStateAfter: post } : {}),
+    event,
     symbolsChecked: symbols.length,
     unknownSymbols: unknown,
   };
@@ -475,6 +946,13 @@ export function verify({ targetRoot = process.cwd(), base = "HEAD" } = {}) {
   signProvenance(provenance);
   mkdirSync(join(targetRoot, ".forge"), { recursive: true });
   writeFileSync(join(targetRoot, ".forge", "provenance.json"), JSON.stringify(provenance, null, 2));
+  try {
+    const mac = verifyEventMac(event);
+    appendFileSync(
+      VERIFY_EVENTS(targetRoot),
+      `${JSON.stringify(mac ? { ...event, mac } : event)}\n`,
+    );
+  } catch {} // the stamp above is the gate's evidence; the event log is best-effort history
 
   // Hard gate = the project's own tests, keyed off the honest four-state verdict. `ok` is TRUE
   // only when a real verifier PASSED — never when nothing ran (NOT_CONFIGURED/INCOMPLETE).
diff --git a/test/bench.test.js b/test/bench.test.js
index 120a3997..7ceb6f62 100644
--- a/test/bench.test.js
+++ b/test/bench.test.js
@@ -2,15 +2,20 @@
 // start a benchmark run (it is main-module guarded), and this file never runs one —
 // the full bench is `npm run bench`, on demand, never in CI's test pass.
 import assert from "node:assert/strict";
+import { rmSync } from "node:fs";
 import { test } from "node:test";
 import {
+  coldSketches,
+  expectTier,
   fmtMs,
   fmtRate,
   formatTable,
+  makeArtifacts,
   makeSpec,
   median,
   mulberry32,
   p95,
+  resolvedEvidenceRepo,
   timeIt,
 } from "../bench/bench.mjs";
 
@@ -75,3 +80,27 @@ test("mulberry32/makeSpec: deterministic fixtures — same seed, same spec, ever
   assert.notEqual(a, makeSpec(mulberry32(43), 40), "different seed diverges");
   assert.match(a, /^[a-z ]+$/, "prose-only tokens (no idents/paths/numbers/secrets)");
 });
+
+// Review 2026-09-26 — F14: a row labeled "exact"/"near" must exercise that tier. The old
+// fixture's untyped refs were capped below the serving floor, so every "hit" row timed a miss.
+test("bench fixtures: resolved evidence makes exact/near genuinely hit; a stale fixture aborts", () => {
+  const repo = resolvedEvidenceRepo();
+  try {
+    const { claims, specs } = makeArtifacts(20, { ref: `git:${repo.oid}` });
+    assert.equal(expectTier(claims, specs[10], "exact").tier, "exact");
+    assert.equal(expectTier(claims, `${specs[10]} gently`, "near").tier, "near");
+    const stale = makeArtifacts(20, { ref: "bench:artifact:0" });
+    assert.throws(
+      () => expectTier(stale.claims, stale.specs[10], "exact"),
+      /bench fixture invalid: expected a exact lookup, got miss/,
+    );
+  } finally {
+    rmSync(repo.dir, { recursive: true, force: true });
+  }
+});
+
+test("bench: coldSketches clears every cache the lookup path memoizes", () => {
+  const c = { _sketch: [1], _terms: new Set(), _specSketch: [2], _keySketch: [3] };
+  coldSketches([c]);
+  assert.deepEqual(Object.keys(c), []);
+});
diff --git a/test/claims_status.test.js b/test/claims_status.test.js
new file mode 100644
index 00000000..8ec60701
--- /dev/null
+++ b/test/claims_status.test.js
@@ -0,0 +1,211 @@
+// The claim/status registry (docs/status/claims.json) and its generator/checker
+// (scripts/claims-status.mjs): validation rules, table rendering, --check drift detection on a
+// throwaway checkout, and the repository's own registry staying valid and in sync.
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { test } from "node:test";
+import {
+  BEGIN,
+  checkCopies,
+  END,
+  README_PATH,
+  REGISTRY_PATH,
+  renderTable,
+  run,
+  STATUSES,
+  spliceReadme,
+  validateRegistry,
+} from "../scripts/claims-status.mjs";
+
+const SHA = "d2abfa69fb77531199ffc67c5c076b524af69040";
+
+/** A minimal valid claim; override any field. */
+const claim = (over = {}) => ({
+  id: "example-claim",
+  claim: "The example does what it says.",
+  component: "example component",
+  version: "1.0.0",
+  source_commit: SHA,
+  status: "measured",
+  evidence: ["evidence/result.md"],
+  notes: "",
+  ...over,
+});
+
+/** Run the CLI against `root`, capturing its output instead of printing it. */
+function cli(argv, root, pairs) {
+  const out = [];
+  const err = [];
+  const code = run(argv, {
+    root,
+    pairs,
+    log: (s) => out.push(s),
+    error: (s) => err.push(s),
+  });
+  return { code, out: out.join("\n"), err: err.join("\n") };
+}
+
+/** A throwaway checkout with a registry, a README carrying the markers, and one docs copy. */
+function fixture(claims = [claim()]) {
+  const root = mkdtempSync(join(tmpdir(), "forge-claims-"));
+  const write = (rel, text) => {
+    mkdirSync(dirname(join(root, rel)), { recursive: true });
+    writeFileSync(join(root, rel), text);
+  };
+  write("evidence/result.md", "# result\n");
+  write(REGISTRY_PATH, `${JSON.stringify({ as_of: "2026-09-26", claims }, null, 2)}\n`);
+  write(README_PATH, `# Claim status\n\n${BEGIN}\n${END}\n`);
+  write("research/paper.html", "<p>canonical</p>\n");
+  write("docs/paper.html", "<p>canonical</p>\n");
+  const pairs = [["docs/paper.html", "research/paper.html"]];
+  return { root, write, pairs, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+test("a valid registry has no problems", () => {
+  assert.deepEqual(validateRegistry({ claims: [claim()] }), []);
+  for (const status of STATUSES) {
+    assert.deepEqual(validateRegistry({ claims: [claim({ status })] }), [], status);
+  }
+});
+
+test("validation rejects a missing field, an unknown status and a duplicate id", () => {
+  const { notes: _drop, ...noNotes } = claim();
+  const problems = validateRegistry({
+    claims: [noNotes, claim({ id: "b", status: "proven" }), claim({ id: "b" })],
+  });
+  assert.ok(
+    problems.some((p) => /missing required field "notes"/.test(p)),
+    problems.join("\n"),
+  );
+  assert.ok(
+    problems.some((p) => /status "proven" is not one of/.test(p)),
+    problems.join("\n"),
+  );
+  assert.ok(
+    problems.some((p) => /duplicate id "b"/.test(p)),
+    problems.join("\n"),
+  );
+});
+
+test("validation rejects bad commits, empty evidence, malformed ids and empty registries", () => {
+  const problems = validateRegistry({
+    claims: [
+      claim({ id: "x", source_commit: "HEAD" }),
+      claim({ id: "y", evidence: [] }),
+      claim({ id: "Bad Id" }),
+      claim({ id: "z", claim: "  " }),
+    ],
+  });
+  assert.ok(problems.some((p) => /source_commit must be 7-40/.test(p)));
+  assert.ok(problems.some((p) => /evidence must be a non-empty array/.test(p)));
+  assert.ok(problems.some((p) => /id must match/.test(p)));
+  assert.ok(problems.some((p) => /"claim" must be a non-empty string/.test(p)));
+  assert.deepEqual(validateRegistry({ claims: [] }), ["registry.claims must be a non-empty array"]);
+  assert.deepEqual(validateRegistry([]), ["registry must be a JSON object with a `claims` array"]);
+});
+
+test("with a root, a missing evidence path is a problem and a URL is not checked", () => {
+  const f = fixture();
+  try {
+    const reg = {
+      claims: [
+        claim({ evidence: ["evidence/result.md#section", "https://example.org/paper"] }),
+        claim({ id: "gone", evidence: ["evidence/missing.md"] }),
+      ],
+    };
+    const problems = validateRegistry(reg, { root: f.root });
+    assert.deepEqual(problems, ["claims[1] (gone): evidence path not found: evidence/missing.md"]);
+  } finally {
+    f.cleanup();
+  }
+});
+
+test("the rendered table escapes pipes, links evidence and counts statuses", () => {
+  const out = renderTable({
+    as_of: "2026-09-26",
+    claims: [
+      claim({ claim: "a | b", evidence: ["evidence/result.md", "https://example.org/x/"] }),
+      claim({ id: "second", status: "refuted" }),
+    ],
+  });
+  assert.match(out, /^2 claims — implemented 0 · measured 1 · .*refuted 1\./);
+  assert.match(out, /Assessed against commit `d2abfa69fb77` \(as of 2026-09-26\)/);
+  assert.match(out, /a \\\| b/);
+  assert.match(out, /\[`evidence\/result\.md`\]\(\.\.\/\.\.\/evidence\/result\.md\)/);
+  assert.match(out, /\[example\.org\/x\]\(https:\/\/example\.org\/x\/\)/);
+  assert.throws(() => spliceReadme("no markers here", out), /must contain the markers/);
+});
+
+test("--check passes when current, and fails on a stale table without rewriting it", () => {
+  const f = fixture();
+  try {
+    assert.equal(cli(["--check"], f.root, f.pairs).code, 1, "a fresh README has no table yet");
+    const first = cli([], f.root, f.pairs);
+    assert.equal(first.code, 0, first.err);
+    assert.match(first.out, /rewrote the generated table/);
+    assert.equal(cli(["--check"], f.root, f.pairs).code, 0);
+
+    // Change a status in the registry: the table on disk is now stale.
+    const reg = JSON.parse(readFileSync(join(f.root, REGISTRY_PATH), "utf8"));
+    reg.claims[0].status = "refuted";
+    f.write(REGISTRY_PATH, JSON.stringify(reg));
+    const before = readFileSync(join(f.root, README_PATH), "utf8");
+    const stale = cli(["--check"], f.root, f.pairs);
+    assert.equal(stale.code, 1);
+    assert.match(stale.err, /is stale/);
+    assert.equal(readFileSync(join(f.root, README_PATH), "utf8"), before, "--check never writes");
+
+    assert.equal(cli([], f.root, f.pairs).code, 0);
+    assert.equal(cli(["--check"], f.root, f.pairs).code, 0);
+  } finally {
+    f.cleanup();
+  }
+});
+
+test("--check fails on an invalid registry and on a drifted docs copy; --sync-copies repairs it", () => {
+  const f = fixture();
+  try {
+    assert.equal(cli([], f.root, f.pairs).code, 0);
+    f.write("docs/paper.html", "<p>edited in the wrong place</p>\n");
+    assert.deepEqual(
+      checkCopies(f.root, f.pairs).map((r) => r.reason),
+      ["sha256 differs"],
+    );
+    const drift = cli(["--check"], f.root, f.pairs);
+    assert.equal(drift.code, 1);
+    assert.match(drift.err, /copy drift: docs\/paper\.html vs research\/paper\.html/);
+
+    const synced = cli(["--sync-copies"], f.root, f.pairs);
+    assert.equal(synced.code, 0, synced.err);
+    assert.equal(readFileSync(join(f.root, "docs/paper.html"), "utf8"), "<p>canonical</p>\n");
+    assert.equal(cli(["--check"], f.root, f.pairs).code, 0);
+
+    f.write(REGISTRY_PATH, JSON.stringify({ claims: [claim({ status: "vibes" })] }));
+    const invalid = cli(["--check"], f.root, f.pairs);
+    assert.equal(invalid.code, 1);
+    assert.match(invalid.err, /status "vibes"/);
+    assert.equal(cli(["--nope"], f.root, f.pairs).code, 2);
+  } finally {
+    f.cleanup();
+  }
+});
+
+test("--check reads a CRLF checkout (Windows core.autocrlf) as current", () => {
+  const f = fixture();
+  try {
+    assert.equal(cli([], f.root, f.pairs).code, 0);
+    const lf = readFileSync(join(f.root, README_PATH), "utf8");
+    f.write(README_PATH, lf.replace(/\n/g, "\r\n"));
+    const r = cli(["--check"], f.root, f.pairs);
+    assert.equal(r.code, 0, r.err);
+  } finally {
+    f.cleanup();
+  }
+});
+
+test("the repository's own registry is valid, its table current, and its docs copies identical", () => {
+  const r = cli(["--check"]);
+  assert.equal(r.code, 0, r.err);
+});
diff --git a/test/context.test.js b/test/context.test.js
index a195aa3f..b0067ad7 100644
--- a/test/context.test.js
+++ b/test/context.test.js
@@ -47,20 +47,24 @@ const trustedLesson = (root) => {
   putClaim(dir, minted.claim);
   // Four confirmations: val = (1 + 4·0.9)/(2 + 4·0.9) ≈ 0.82 — past the 0.8 floor.
   // (Three lands at 0.787 and is correctly NOT trusted enough to be required.) The refs
-  // must be git objects that resolve in this repo — the only ref type forge re-derives.
+  // must be git objects that resolve in this repo — the only ref type forge re-derives —
+  // and FOUR DISTINCT events: four spellings of one commit are one event (review F06).
   const g = (...args) => execFileSync("git", args, { cwd: root, stdio: "ignore" });
   g("init");
   g("config", "user.email", "t@t.t");
   g("config", "user.name", "t");
   g("add", "-A");
   g("commit", "-m", "fixture");
-  const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
-  for (const ref of [7, 8, 9, 40].map((n) => `git:${head.slice(0, n)}`))
+  for (let n = 1; n <= 4; n++) {
+    if (n > 1) g("commit", "--allow-empty", "-m", `review ${n}`);
+    const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
     appendEvidence(
       dir,
       minted.claim.id,
-      outcomeRecord({ oracle: "human.accept", result: "confirm", ref, t: 0 }).outcome,
+      outcomeRecord({ oracle: "human.accept", result: "confirm", ref: `git:${head}`, t: 0 })
+        .outcome,
     );
+  }
   return minted.claim;
 };
 
@@ -125,7 +129,7 @@ test("assemble: complete context — everything required is covered within budge
   assert.ok(r.block.includes("Never change the tax rate"), "the team lesson rides along");
 });
 
-test("assemble: a tight budget downgrades granularity instead of dropping coverage", () => {
+test("assemble: a tight budget downgrades before dropping — and says what it no longer delivers", () => {
   const { root, atlas } = fixture();
   const roomy = assemble(root, "update computeTax in src/tax.js", { atlas, nowDay: 0 });
   const tight = assemble(root, "update computeTax in src/tax.js", {
@@ -133,14 +137,76 @@ test("assemble: a tight budget downgrades granularity instead of dropping covera
     nowDay: 0,
     budget: 60,
   });
-  assert.equal(tight.ok, true, "coverage survives the squeeze");
-  assert.deepEqual(tight.missing, []);
+  assert.ok(tight.tokens <= 60, "the rendered block fits the budget");
   assert.ok(tight.tokens < roomy.tokens);
   assert.ok(
     tight.selection.some((s) => s.gran !== "full"),
     "compression ladder engaged (a lossy move chosen explicitly, not by scroll-off)",
   );
-  assert.deepEqual(roomy.covered, tight.covered, "same coverage either way");
+  assert.deepEqual(tight.missing, [], "nothing required vanished — it is pointed at…");
+  assert.ok(tight.pending.length > 0, "…as a pending read, not as delivered coverage (F03)");
+  assert.equal(tight.ok, false, "a pointer-only item is not a complete context");
+  for (const k of tight.covered) assert.ok(roomy.covered.includes(k));
+});
+
+// Review 2026-09-26 — F02: a hard budget is never exceeded while claiming success.
+test("F02: when even pointers cannot fit, the result is OVERFLOW, never ok", () => {
+  const { root, atlas } = fixture();
+  for (const budget of [1, 8, 20]) {
+    const r = assemble(root, "update computeTax in src/tax.js", { atlas, nowDay: 0, budget });
+    assert.ok(r.tokens <= budget, `budget ${budget}: rendered ${r.tokens}`);
+    assert.equal(r.ok, false, `budget ${budget}`);
+    assert.equal(r.overflow, true);
+    assert.ok(r.dropped.length > 0);
+    assert.ok(r.missing.length > 0, "what was dropped is reported missing");
+    assert.match(r.tokenEstimate, /estimate/);
+  }
+});
+
+// F03: availability is not delivery. The definition sits below 100 lines of padding.
+test("F03: a definition below line 100 is delivered by a span, or stays pending — never 'covered' by a pointer or head", () => {
+  const root = mkdtempSync(join(tmpdir(), "forge-context-"));
+  mkdirSync(join(root, "src"), { recursive: true });
+  const padding = Array.from({ length: 100 }, (_, i) => `// padding line ${i}`).join("\n");
+  writeFileSync(
+    join(root, "src", "calc.js"),
+    `${padding}\nexport function calcTotal(items) {\n  return items.length;\n}\n${padding}\n`,
+  );
+  const atlas = buildAtlas({ root });
+  const task = "change calcTotal in src/calc.js";
+  const pointerOnly = assemble(root, task, { atlas, nowDay: 0, budget: 8 });
+  assert.equal(pointerOnly.ok, false, "a `- read src/calc.js` line is not the definition");
+  assert.ok(!pointerOnly.covered.includes("def:calcTotal"));
+  assert.ok(
+    pointerOnly.pending.includes("def:calcTotal") || pointerOnly.missing.includes("def:calcTotal"),
+  );
+  // A mid-size budget cannot hold the whole file but CAN hold the definition's span.
+  const mid = assemble(root, task, { atlas, nowDay: 0, budget: 400 });
+  const item = mid.selection.find((s) => s.id === "def:src/calc.js");
+  assert.equal(item.gran, "span", JSON.stringify(mid.selection));
+  assert.ok(mid.covered.includes("def:calcTotal"), "the span delivers the definition");
+  assert.ok(mid.block.includes("export function calcTotal"));
+  assert.ok(mid.pending.includes("file:src/calc.js"), "the rest of the named file is still owed");
+  assert.equal(mid.ok, false);
+  assert.ok(mid.truncated.some((t) => t.id === "def:src/calc.js" && t.totalLines > 200));
+});
+
+test("F03: dependents beyond the listed twelve stay visible as omitted", () => {
+  const root = mkdtempSync(join(tmpdir(), "forge-context-"));
+  mkdirSync(join(root, "src"), { recursive: true });
+  writeFileSync(join(root, "src", "core.js"), "export function coreFn(x) {\n  return x;\n}\n");
+  for (let i = 0; i < 15; i++)
+    writeFileSync(
+      join(root, "src", `user${i}.js`),
+      `import { coreFn } from "./core.js";\nexport function use${i}() {\n  return coreFn(${i});\n}\n`,
+    );
+  const atlas = buildAtlas({ root });
+  const r = assemble(root, "change coreFn", { atlas, nowDay: 0 });
+  const t = r.truncated.find((x) => x.id === "deps:coreFn");
+  assert.ok(t, JSON.stringify(r.truncated));
+  assert.equal(t.shown, 12);
+  assert.equal(t.omitted.length, t.total - 12);
+  assert.match(r.block, /more, omitted here/);
 });
 
 test("assemble: an unknown symbol becomes a DERIVED question, and the gate can block on it", () => {
diff --git a/test/cost_report.test.js b/test/cost_report.test.js
index f41bba2a..6d184a74 100644
--- a/test/cost_report.test.js
+++ b/test/cost_report.test.js
@@ -284,7 +284,11 @@ test("estimateSpendFromLogs: live catalog price by id, family fallback, unknown
     "an unknown Opus is priced as the Opus tier",
   );
   assert.equal(by["<synthetic>"].priced, false);
+  assert.equal(by["<synthetic>"].cost, null, "unpriced is unknown, not $0 (A10)");
   assert.deepEqual(est.unpriced, ["<synthetic>"], "never billed at a guessed $3/$15");
+  assert.equal(est.complete, false, "a total with an unpriced model is partial");
+  assert.equal(est.currency, "USD");
+  assert.match(est.basis, /estimate.*not an invoice/);
   assert.equal(t.calls.length, 1, "one catalog request per estimate, not one per model");
 });
 
diff --git a/test/dash.test.js b/test/dash.test.js
index 8ad62dae..66203599 100644
--- a/test/dash.test.js
+++ b/test/dash.test.js
@@ -110,13 +110,17 @@ test("dashData: meta.empty is true on a bare repo, false once claims/metrics exi
   assert.equal(dashData(metricsOnly, { nowDay: NOW }).meta.empty, false);
 });
 
-test("dashData: meta never throws on a corrupt store, degrades to empty", () => {
+test("dashData: a corrupt store never throws — and is reported as unreadable, not empty (A11)", () => {
   const root = tmp();
   mkdirSync(join(root, ".forge", "ledger"), { recursive: true });
   writeFileSync(join(root, ".forge", "ledger", "claims"), "not a directory");
   writeFileSync(join(root, ".forge", "metrics.jsonl"), "{nope\n");
   const m = dashData(root, { nowDay: NOW }).meta;
-  assert.equal(m.empty, true, "unreadable stores count as no data, not a crash");
+  assert.equal(m.empty, false, "an unreadable store is not an untouched one");
+  assert.ok(
+    m.errors.some((e) => e.section === "ledger"),
+    `the unreadable section is named: ${JSON.stringify(m.errors)}`,
+  );
   assert.equal(m.forgeDir, join(root, ".forge"));
 });
 
@@ -211,10 +215,14 @@ test("serve: POST /api/ratify and /api/retract are the two append-only writes",
   await new Promise((resolve) => server.on("listening", resolve));
   const addr = /** @type {import("node:net").AddressInfo} */ (server.address());
   const base = `http://127.0.0.1:${addr.port}`;
+  // Like the browser: the write token comes from the page the server served (F13).
+  const page = await (await fetch(`${base}/`)).text();
+  const token = /name="forge-dash-token" content="([0-9a-f]+)"/.exec(page)?.[1];
+  assert.ok(token, "the page carries the session write token");
   const post = (path, body) =>
     fetch(`${base}${path}`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", "x-forge-token": token },
       body: typeof body === "string" ? body : JSON.stringify(body),
     });
   try {
@@ -259,6 +267,7 @@ test("serve: POST /api/ratify and /api/retract are the two append-only writes",
       method: "POST",
       headers: {
         "content-type": "application/json",
+        "x-forge-token": token,
         origin: "https://evil.example",
       },
       body: JSON.stringify({ id: trusted.id.slice(0, 8) }),
@@ -273,7 +282,11 @@ test("serve: POST /api/ratify and /api/retract are the two append-only writes",
           port: addr.port,
           path: "/api/ratify",
           method: "POST",
-          headers: { "content-type": "application/json", host: "evil.example" },
+          headers: {
+            "content-type": "application/json",
+            host: "evil.example",
+            "x-forge-token": token,
+          },
         },
         (res) => resolve(res.statusCode),
       );
@@ -475,3 +488,86 @@ test("serve: v2 endpoints answer 200 with their payloads", async () => {
     server.close();
   }
 });
+
+// Review 2026-09-26 — F13: every route checks Host; writes need the session token and the
+// EXACT origin (another localhost port is another site).
+const rawRequest = (port, { method = "GET", path = "/api/data", headers = {}, body } = {}) =>
+  new Promise((resolve) => {
+    const r = request({ host: "127.0.0.1", port, path, method, headers }, (res) => {
+      let data = "";
+      res.on("data", (c) => {
+        data += c;
+      });
+      res.on("end", () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
+    });
+    r.on("error", () => resolve({ status: -1 }));
+    r.end(body);
+  });
+
+test("F13: read routes refuse a foreign Host (DNS rebinding) and a wrong port", async () => {
+  const { root } = fixture();
+  const server = serve(root, { port: 0 });
+  await new Promise((resolve) => server.on("listening", resolve));
+  const { port } = /** @type {import("node:net").AddressInfo} */ (server.address());
+  try {
+    for (const path of ["/api/data", "/api/claims", "/api/timeline", "/"]) {
+      const evil = await rawRequest(port, {
+        path,
+        headers: { host: "attacker.invalid", origin: "http://attacker.invalid" },
+      });
+      assert.equal(evil.status, 403, `${path}: foreign Host must not read the ledger`);
+      assert.doesNotMatch(evil.body, /stats|ledger/i);
+    }
+    assert.equal(
+      (await rawRequest(port, { headers: { host: `localhost:${port + 1}` } })).status,
+      403,
+    );
+    assert.equal((await rawRequest(port, { headers: { host: `127.0.0.1:${port}` } })).status, 200);
+    assert.equal((await rawRequest(port, { headers: { host: `localhost:${port}` } })).status, 200);
+    const page = await rawRequest(port, { path: "/", headers: { host: `127.0.0.1:${port}` } });
+    assert.equal(
+      page.headers["x-frame-options"],
+      "DENY",
+      "the token-bearing page cannot be framed",
+    );
+  } finally {
+    server.close();
+  }
+});
+
+test("F13: writes need the session token AND this exact origin", async () => {
+  const { root, trusted } = fixture();
+  const server = serve(root, { port: 0 });
+  await new Promise((resolve) => server.on("listening", resolve));
+  const { port } = /** @type {import("node:net").AddressInfo} */ (server.address());
+  const token = /** @type {any} */ (server).dashToken;
+  const write = (headers) =>
+    rawRequest(port, {
+      method: "POST",
+      path: "/api/ratify",
+      headers: { host: `127.0.0.1:${port}`, "content-type": "application/json", ...headers },
+      body: JSON.stringify({ id: trusted.id.slice(0, 8) }),
+    });
+  try {
+    assert.equal((await write({})).status, 403, "no token → refused");
+    assert.equal((await write({ "x-forge-token": "0".repeat(48) })).status, 403, "wrong token");
+    assert.equal(
+      (await write({ "x-forge-token": token, origin: `http://localhost:${port + 1}` })).status,
+      403,
+      "an unrelated localhost origin/port cannot mutate claims",
+    );
+    assert.equal(
+      (await write({ "x-forge-token": token, origin: `https://127.0.0.1:${port}` })).status,
+      403,
+      "scheme is part of the origin",
+    );
+    assert.equal(
+      (await write({ "x-forge-token": token, "sec-fetch-site": "cross-site" })).status,
+      403,
+    );
+    const ok = await write({ "x-forge-token": token, origin: `http://127.0.0.1:${port}` });
+    assert.equal(ok.status, 200, `normal same-origin dashboard use still works: ${ok.body}`);
+  } finally {
+    server.close();
+  }
+});
diff --git a/test/embed.test.js b/test/embed.test.js
index a2fb6acd..a43adf12 100644
--- a/test/embed.test.js
+++ b/test/embed.test.js
@@ -4,7 +4,7 @@
 // hash-based pseudo-vectors that make two designated spec strings close).
 import assert from "node:assert/strict";
 import { execFileSync, spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
@@ -20,7 +20,7 @@ import {
 } from "../src/embed.js";
 import { mintClaim, retrieve, score } from "../src/ledger.js";
 import { appendEvidence, putClaim, repoLedger } from "../src/ledger_store.js";
-import { artifactClaim, lookup, mintArtifact, reuseQuery } from "../src/reuse.js";
+import { artifactClaim, describeFile, lookup, mintArtifact, reuseQuery } from "../src/reuse.js";
 import { epochDay } from "../src/util.js";
 
 const CLI = fileURLToPath(new URL("../src/cli.js", import.meta.url));
@@ -161,11 +161,19 @@ test("embed: no provider → null; crash / garbage / timeout → null (clean, no
 const STORED = "delete a user account";
 const REWORDED = "remove a user account";
 
+// The artifact's code must be a REAL file with its real digest: a pointer to a missing or
+// changed file is never served (review F05), and these tests are about the similarity tier.
+const realArtifactFile = (root) => {
+  mkdirSync(join(root, "src"), { recursive: true });
+  writeFileSync(join(root, "src", "users.js"), "export function deleteUser(id) {}\n");
+  return describeFile(root, "src/users.js").code;
+};
+
 const verifiedArtifactRoot = () => {
   const { root, head } = gitTmp();
   const m = mintArtifact(
     repoLedger(root),
-    { spec: STORED, code: { path: "src/users.js", sha256: "a".repeat(64) } },
+    { spec: STORED, code: realArtifactFile(root) },
     { evidence: { oracle: "test.run", result: "confirm", ref: `git:${head}` }, t: 0 },
   );
   assert.equal(m.ok, true);
@@ -311,7 +319,7 @@ test("forge ledger query / reuse query print which similarity backend served", (
   // evidence is stamped TODAY because the spawned CLI evaluates val at epochDay().
   const m = mintArtifact(
     dir,
-    { spec: STORED, code: { path: "src/users.js", sha256: "e".repeat(64) } },
+    { spec: STORED, code: realArtifactFile(cwd) },
     {
       evidence: { oracle: "test.run", result: "confirm", ref: `git:${head.slice(0, 12)}` },
       t: epochDay(),
diff --git a/test/imagine.test.js b/test/imagine.test.js
index 33d8574b..ad4d6324 100644
--- a/test/imagine.test.js
+++ b/test/imagine.test.js
@@ -12,6 +12,7 @@ import {
   selectTests,
   selectTestsReport,
   tapSummary,
+  unsupportedRunner,
 } from "../src/imagine.js";
 
 const fixture = () => mkdtempSync(join(tmpdir(), "forge-imagine-"));
@@ -243,3 +244,18 @@ test("tapSummary takes the runner's OWN (last) summary, and dryRun cross-checks
   assert.equal(red.failed, 1);
   assert.equal(red.passed, 0);
 });
+
+// Review 2026-09-26 — A05: the dry-run executes node:test files only; anything else is an
+// explicit UNSUPPORTED result, never a node:test run of files written for another runner.
+test("unsupportedRunner: foreign files and custom runners are refused explicitly", () => {
+  const dir = mkdtempSync(join(tmpdir(), "forge-imagine-runner-"));
+  assert.equal(unsupportedRunner(dir, ["test/a.test.js", "b.test.mjs"]), null, "no package.json");
+  assert.match(unsupportedRunner(dir, ["tests/test_x.py"]) ?? "", /node:test files only/);
+  writeFileSync(join(dir, "package.json"), JSON.stringify({ scripts: { test: "vitest run" } }));
+  assert.match(unsupportedRunner(dir, ["a.test.js"]) ?? "", /run under `vitest run`/);
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify({ scripts: { test: "node --test --import ./setup.js test/*.test.js" } }),
+  );
+  assert.equal(unsupportedRunner(dir, ["a.test.js"]), null, "a node --test script is supported");
+});
diff --git a/test/learn_consolidate.test.js b/test/learn_consolidate.test.js
index 174a1e3f..2775e3f3 100644
--- a/test/learn_consolidate.test.js
+++ b/test/learn_consolidate.test.js
@@ -26,7 +26,14 @@ import {
   renderConsolidated,
 } from "../src/learn_consolidate.js";
 import { isDormant, mintClaim, outcomeRecord } from "../src/ledger.js";
-import { appendEvidence, putClaim, repoLedger, tombstone } from "../src/ledger_store.js";
+import {
+  appendEvidence,
+  loadClaims,
+  pruneToAttic,
+  putClaim,
+  repoLedger,
+  tombstone,
+} from "../src/ledger_store.js";
 
 const SCRIPT = fileURLToPath(new URL("../bin/learn-consolidate.sh", import.meta.url));
 const tmp = (p = "forge-learn-") => mkdtempSync(join(tmpdir(), p));
@@ -212,3 +219,109 @@ test("the script runs deterministically with no model call; --llm is opt-in", {
   assert.match(llm.stdout, /by model judgment/);
   assert.match(llm.stdout, /originals kept/);
 });
+
+// Review 2026-09-26 — F16: similar is not the same. These two rules overlap almost entirely
+// and say the OPPOSITE; MinHash merged them and one silently disappeared.
+const ENABLE =
+  "Enable authentication for every admin route and require a signed session token before serving any page";
+const DISABLE = ENABLE.replace("Enable", "Disable");
+
+test("F16: opposite rules stay two claims, with the conflict exposed; exact duplicates still merge", () => {
+  const r = consolidateLearned(
+    [
+      { project: "shop", text: ENABLE },
+      { project: "shop", text: DISABLE },
+      { project: "shop", text: `${ENABLE}.` }, // exact after normalization
+    ],
+    { claims: [] },
+  );
+  assert.deepEqual(
+    r.kept.map((k) => k.text),
+    [ENABLE, DISABLE],
+    "neither rule is dropped as a 'duplicate' of the other",
+  );
+  assert.equal(r.merged.length, 1, "the exact duplicate still merges deterministically");
+  assert.equal(r.conflicts.length, 1);
+  assert.match(r.conflicts[0].conflicts, /polarity: enable ≠ disable/i);
+});
+
+test("F16: a refuted OPPOSITE claim does not drop a lesson", () => {
+  const refuted = repoWith("shop", ENABLE, { refute: true });
+  const r = consolidateLearned([{ project: "shop", text: DISABLE }], {
+    claims: ledgerClaimsFor([refuted.root]),
+    nowDay: 102,
+  });
+  assert.deepEqual(
+    r.kept.map((k) => k.text),
+    [DISABLE],
+  );
+  assert.equal(r.dropped.length, 0);
+});
+
+// F15: archived is storage lifecycle, not a truth verdict.
+test("F15: an idle-archived claim does not refute; a retracted or dormant one does", () => {
+  const idle = repoWith("shop", RETRY);
+  pruneToAttic(repoLedger(idle.root), idle.claim.id, {
+    cause: "idle",
+    reason: "idle 90 d",
+    t: 200,
+  });
+  const retracted = repoWith("shop", TRIVIA, { retract: true });
+  pruneToAttic(repoLedger(retracted.root), retracted.claim.id, {
+    cause: "tombstoned",
+    reason: "tombstoned",
+    t: 200,
+  });
+  const claims = ledgerClaimsFor([idle.root, retracted.root]);
+  assert.ok(
+    claims.every((c) => c.attic),
+    "both are read back from the attic with their logs",
+  );
+  const r = consolidateLearned(
+    [
+      { project: "shop", text: RETRY },
+      { project: "shop", text: TRIVIA },
+    ],
+    { claims, nowDay: 200 },
+  );
+  assert.deepEqual(
+    r.kept.map((k) => k.text),
+    [RETRY],
+    "the idle claim's lesson survives",
+  );
+  assert.deepEqual(
+    r.dropped.map((d) => d.reason),
+    ["retracted in the ledger"],
+  );
+});
+
+test("F15: a deduplicated claim defers to the claim that survived it", () => {
+  const { root } = repoWith("shop", FLAKY);
+  const dir = repoLedger(root);
+  const [survivor] = loadClaims(dir);
+  const dupe = mintClaim({
+    kind: "lesson",
+    body: {
+      correctedBehavior: `${FLAKY} again`,
+      trigger: { action: "edit", files: [], keywords: [], symbols: [] },
+      whatWentWrong: "",
+    },
+    scope: { level: "repo" },
+    provenance: { agent: "cortex", author: "t", task: "lsn_dupe" },
+    t: 100,
+  }).claim;
+  putClaim(dir, dupe);
+  pruneToAttic(dir, dupe.id, { cause: "duplicate", survivor: survivor.id, reason: "dup", t: 150 });
+  const live = consolidateLearned([{ project: "shop", text: `${FLAKY} again` }], {
+    claims: ledgerClaimsFor([root]),
+    nowDay: 150,
+  });
+  assert.equal(live.dropped.length, 0, "the survivor is live — the duplicate refutes nothing");
+  tombstone(dir, survivor.id, { author: "t", reason: "wrong", t: 151 });
+  const gone = consolidateLearned([{ project: "shop", text: `${FLAKY} again` }], {
+    claims: ledgerClaimsFor([root]),
+    nowDay: 152,
+  });
+  assert.equal(gone.dropped.length, 1);
+  assert.match(gone.dropped[0].reason, /via the claim it was deduplicated into/);
+});
diff --git a/test/ledger_bridge.test.js b/test/ledger_bridge.test.js
index fa1c516a..13689996 100644
--- a/test/ledger_bridge.test.js
+++ b/test/ledger_bridge.test.js
@@ -6,12 +6,14 @@ import { test } from "node:test";
 import { applyDistillation, recordContradiction, recordMistake } from "../src/cortex.js";
 import { val } from "../src/ledger.js";
 import {
+  equivalentLesson,
   factClaim,
   importLegacy,
   lessonClaim,
   reconcileFacts,
   recordLessonEvent,
   shadowFact,
+  supersedeLessonClaim,
 } from "../src/ledger_bridge.js";
 import { loadClaims, repoLedger } from "../src/ledger_store.js";
 import { newLesson } from "../src/lessons.js";
@@ -91,7 +93,7 @@ test("cortex dual-write: same-day sessions with colliding episode ids stay disti
   assert.equal(claim.evidence.length, 2, "both real confirmations recorded, none deduped away");
 });
 
-test("applyDistillation supersedes: evidence carries over, template claim is tombstoned", () => {
+test("applyDistillation supersedes: a changed meaning links history but inherits no trust (F07)", () => {
   const root = tmp();
   recordMistake(root, { signals: strongSignals, context: ctx, nowDay: 1, episodeId: "e1" });
   recordMistake(root, { signals: strongSignals, context: ctx, nowDay: 2, episodeId: "e2" });
@@ -109,13 +111,67 @@ test("applyDistillation supersedes: evidence carries over, template claim is tom
   const old = claims.find((c) => c.id === beforeClaim.id);
   const distilled = claims.find((c) => c.id !== beforeClaim.id);
   assert.match(old.tombstone.reason, new RegExp(`superseded-by:${distilled.id}`));
-  assert.equal(distilled.evidence.length, 1, "history carried across the body rewrite");
+  assert.equal(distilled.evidence.length, 0, "a new proposition earns its own evidence");
+  assert.equal(val(distilled, 2), 0.5, "the rewrite starts at the prior, below every bar");
+  assert.equal(old.evidence.length, 1, "the parent's history stays inspectable");
+  assert.equal(distilled.provenance.supersedes, beforeClaim.id, "lineage is recorded");
+  assert.equal(distilled.provenance.rewrite, "unverified");
   assert.equal(
     distilled.body.correctedBehavior,
     "Query the atlas for computeTax dependents before editing.",
   );
 });
 
+test("F07: a contradictory rewrite of a TRUSTED lesson keeps no serving confidence", () => {
+  const root = tmp();
+  const dir = repoLedger(root);
+  const before = newLesson(
+    {
+      id: "lsn_sig",
+      trigger: { symbols: ["handleWebhook"], files: [], keywords: [] },
+      whatWentWrong: "Webhook payloads were processed without checking their origin.",
+      correctedBehavior: "Validate request signatures before processing a webhook.",
+    },
+    0,
+  );
+  const minted = recordLessonEvent(root, before, { t: 0 });
+  for (const n of [1, 2, 3])
+    recordLessonEvent(root, before, { result: "confirm", ref: `episode:e${n}#n0`, t: n });
+  const trusted = loadClaims(dir).find((c) => c.id === minted.id);
+  assert.ok(val(trusted, 3) > 0.6, `the original is trusted (val ${val(trusted, 3)})`);
+  const after = { ...before, correctedBehavior: "Skip request signature validation." };
+  const r = supersedeLessonClaim(root, before, after, 3);
+  assert.equal(r.ok, true);
+  assert.equal(r.carried, false);
+  assert.match(r.conflicts, /polarity/, "the flip is named");
+  const rewritten = loadClaims(dir).find((c) => c.id === r.id);
+  assert.equal(rewritten.evidence.length, 0);
+  assert.ok(val(rewritten, 3) < 0.6, "below the 0.6 serving floor");
+});
+
+test("F07: an EQUIVALENT rewrite (case/whitespace/punctuation only) carries its evidence", () => {
+  const root = tmp();
+  const before = newLesson(
+    {
+      id: "lsn_eq",
+      trigger: { symbols: ["x"], files: [], keywords: [] },
+      whatWentWrong: "the cache key ignored the tenant",
+      correctedBehavior: "include the tenant id in every cache key",
+    },
+    0,
+  );
+  recordLessonEvent(root, before, { result: "confirm", ref: "episode:e1#n0", t: 1 });
+  const after = {
+    ...before,
+    whatWentWrong: "The cache key ignored the tenant.",
+    correctedBehavior: "Include the tenant id in every cache key.",
+  };
+  assert.equal(equivalentLesson(before, after), true);
+  const r = supersedeLessonClaim(root, before, after, 2);
+  assert.equal(r.carried, true);
+  assert.equal(loadClaims(repoLedger(root)).find((c) => c.id === r.id).evidence.length, 1);
+});
+
 test("recordLessonEvent: direct contract — mint-only, then evidence on a later event", () => {
   const root = tmp();
   const lesson = newLesson(
diff --git a/test/ledger_retention.test.js b/test/ledger_retention.test.js
index dde3a720..326ae684 100644
--- a/test/ledger_retention.test.js
+++ b/test/ledger_retention.test.js
@@ -169,7 +169,10 @@ test("duplicateGroups: near-duplicates collapse to one survivor; distinct facts
 test("duplicateGroups: a chain A–B–C drops only what is close to the survivor itself", () => {
   // B contains A's text and C's text; A and C share nothing. Union-find links all three, but
   // C is no duplicate of the survivor A, so only B goes.
-  const words = Array.from({ length: 14 }, (_, i) => `w${i}x`);
+  const words =
+    "amber birch cedar delta ember fjord grove heron inlet juniper kelp larch maple nectar".split(
+      " ",
+    );
   const claims = [
     { id: "a", kind: "fact", body: { text: words.slice(0, 8).join(" ") }, provenance: { t: 1 } },
     { id: "b", kind: "fact", body: { text: words.join(" ") }, provenance: { t: 2 } },
@@ -258,3 +261,34 @@ test("recordServedLessons: logs ledger-backed lessons, skips legacy ones", async
   assert.deepEqual([...uses.keys()], ["c-ledger"]);
   assert.deepEqual(uses.get("c-ledger"), [12]);
 });
+
+// Review 2026-09-26 — F16: the duplicate boundary PROPOSES; the semantic guard decides.
+test("F16: a close pair that says the opposite is never archived as a duplicate", () => {
+  const dir = tmp();
+  const base =
+    "authentication for every admin route of the payments dashboard behind the corporate proxy";
+  const on = fact("auth-on", `Enable ${base}`, 1);
+  const off = fact("auth-off", `Disable ${base}`, 2);
+  const again = fact("auth-on-2", `Enable ${base} please`, 3);
+  for (const c of [on, off, again, ...TOPICS.map((t, i) => fact(`t${i}`, t, 1))]) putClaim(dir, c);
+  const r = duplicateGroups(loadClaims(dir), 10);
+  const grouped = new Set(r.groups.flatMap((g) => [g.keep, ...g.drop.map((d) => d.id)]));
+  assert.ok(
+    !(
+      grouped.has(on.id) &&
+      grouped.has(off.id) &&
+      r.groups.length === 1 &&
+      r.groups[0].drop.length === 2
+    ),
+    "enable and disable are not one group",
+  );
+  for (const g of r.groups)
+    assert.ok(
+      !(g.keep === on.id && g.drop.some((d) => d.id === off.id)),
+      "disable is not a dup of enable",
+    );
+  assert.ok(
+    r.conflicts.some((c) => [c.a, c.b].includes(on.id) && [c.a, c.b].includes(off.id)),
+    `the conflict is reported: ${JSON.stringify(r.conflicts)}`,
+  );
+});
diff --git a/test/ledger_store.test.js b/test/ledger_store.test.js
index 2cc190ca..624b2fa8 100644
--- a/test/ledger_store.test.js
+++ b/test/ledger_store.test.js
@@ -798,3 +798,95 @@ test("migrateAddresses moves a pre-CRLF-fold claim to its current address, logs
   assert.equal(loaded[0].evidence.length, 1, "its evidence came with it");
   assert.deepEqual(migrateAddresses(dir).migrated, [], "idempotent: nothing left to move");
 });
+
+// Review 2026-09-26 — F06: evidence is counted per EVENT. One real commit cited under four
+// spellings (7/8/9/40 chars) used to lift confidence 0.655 → 0.821, past the 0.8 bar.
+test("F06: aliases of one git object are one event — in the store and in val()", () => {
+  const root = mkdtempSync(join(tmpdir(), "forge-f06-"));
+  const g = (...args) => execFileSync("git", args, { cwd: root, stdio: "ignore" });
+  g("init");
+  g("config", "user.email", "t@t.t");
+  g("config", "user.name", "t");
+  writeFileSync(join(root, "a.txt"), "a\n");
+  g("add", "-A");
+  g("commit", "-m", "init");
+  const full = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+  const dir = repoLedger(root);
+  const c = fact("f06", "one commit, four spellings");
+  putClaim(dir, c);
+  appendEvidence(dir, c.id, ev("confirm", `git:${full.slice(0, 7)}`, 0));
+  const one = val(loadClaims(dir)[0], 0);
+  for (const n of [8, 9, 40])
+    appendEvidence(dir, c.id, ev("confirm", `git:${full.slice(0, n)}`, 0));
+  const stored = readEvidence(dir, c.id);
+  assert.ok(
+    stored.every((e) => e.ref === `git:${full}`),
+    "abbreviations are stored under the full object id",
+  );
+  assert.equal(stored.length, 1, "…so re-citing the same commit dedupes at append");
+  assert.equal(val(loadClaims(dir)[0], 0), one, "four spellings, one event, one vote");
+});
+
+test("F06: val() collapses aliases already on disk (pure prefix aliasing, earliest wins)", () => {
+  const oid = "0123456789abcdef0123456789abcdef01234567";
+  const rec = (ref, t) =>
+    outcomeRecord({ oracle: "test.run", result: "confirm", ref, author: "a", t }).outcome;
+  const aliased = { evidence: [rec(`git:${oid.slice(0, 7)}`, 0), rec(`git:${oid}`, 5)] };
+  const single = { evidence: [rec(`git:${oid.slice(0, 7)}`, 0)] };
+  assert.equal(
+    val(aliased, 5),
+    val(single, 5),
+    "the later alias neither adds weight nor refreshes decay",
+  );
+  // Two DIFFERENT objects still count twice, even sharing a short prefix once both are known.
+  const other = `${oid.slice(0, 7)}fffffffffffffffffffffffffffffffff`;
+  const two = { evidence: [rec(`git:${oid}`, 0), rec(`git:${other}`, 0)] };
+  assert.ok(val(two, 0) > val(single, 0), "distinct objects are distinct events");
+  // The same untyped ref re-recorded by another author/day is also one event.
+  const again = {
+    evidence: [
+      outcomeRecord({ oracle: "ci.run", result: "confirm", ref: "ci:42", author: "a", t: 0 })
+        .outcome,
+      outcomeRecord({ oracle: "ci.run", result: "confirm", ref: "ci:42", author: "b", t: 3 })
+        .outcome,
+    ],
+  };
+  const once = { evidence: [again.evidence[0]] };
+  assert.equal(val(again, 3), val(once, 3));
+});
+
+// Review 2026-09-26 — A11: the storage contracts under concurrent writers and migration.
+test("A11: two processes appending to one log concurrently lose no record", async () => {
+  const dir = tmp();
+  const c = fact("concurrent", "two writers, one log");
+  putClaim(dir, c);
+  const { spawn } = await import("node:child_process");
+  const { fileURLToPath } = await import("node:url");
+  const storeUrl = new URL("../src/ledger_store.js", import.meta.url).href;
+  const ledgerUrl = new URL("../src/ledger.js", import.meta.url).href;
+  const writer = (tag) =>
+    new Promise((resolve, reject) => {
+      const code = `
+        const { appendEvidence } = await import(${JSON.stringify(storeUrl)});
+        const { outcomeRecord } = await import(${JSON.stringify(ledgerUrl)});
+        for (let i = 0; i < 60; i++) {
+          const o = outcomeRecord({ oracle: "ci.run", result: "confirm", ref: "ci:${tag}" + i, t: i });
+          const r = appendEvidence(${JSON.stringify(dir)}, ${JSON.stringify(c.id)}, o.outcome);
+          if (!r.ok) { console.error(r.reason); process.exit(1); }
+        }`;
+      const p = spawn(process.execPath, ["--input-type=module", "-e", code], { stdio: "inherit" });
+      p.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`writer ${tag} ${code}`))));
+    });
+  void fileURLToPath;
+  await Promise.all([writer("1"), writer("2")]);
+  assert.equal(readEvidence(dir, c.id).length, 120, "every append from both writers survives");
+  assert.equal(verify(dir).ok, true, "no torn or glued lines");
+});
+
+test("A11: migrateAddresses --dry-run previews without writing", () => {
+  const dir = tmp();
+  const c = fact("plain", "nothing to migrate");
+  putClaim(dir, c);
+  const preview = migrateAddresses(dir, { dryRun: true });
+  assert.deepEqual(preview, { migrated: [], merged: [], failed: [], dryRun: true });
+});
diff --git a/test/reuse.test.js b/test/reuse.test.js
index 3325ce1e..10fc367d 100644
--- a/test/reuse.test.js
+++ b/test/reuse.test.js
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
@@ -15,8 +15,10 @@ import {
   lookup,
   mintArtifact,
   normalizeSpec,
+  reusePeek,
   reuseQuery,
   revalidate,
+  specKey,
 } from "../src/reuse.js";
 
 const tmp = () => mkdtempSync(join(tmpdir(), "forge-reuse-"));
@@ -52,15 +54,37 @@ test("normalizeSpec: the same task worded across teammates fingerprints identica
   assert.equal(a, b, "identifier/number shape matches — same near-neighborhood");
 });
 
-test("fingerprint: exact key is context-sensitive (slice), sketch is stable", () => {
+test("fingerprint: exact key is context-sensitive (slice) and lossless but whitespace; sketch is stable", () => {
   const f1 = fingerprint("build a rate limiter", "slice-a");
   const f2 = fingerprint("build a rate limiter", "slice-b");
-  const f3 = fingerprint("build a  RATE limiter", "slice-a");
+  const f3 = fingerprint("  build a \n rate   limiter ", "slice-a");
+  const f4 = fingerprint("build a RATE limiter", "slice-a");
   assert.notEqual(f1.exact, f2.exact, "different graph context → different exact key");
-  assert.equal(f1.exact, f3.exact, "whitespace/case never fork the key");
+  assert.equal(f1.exact, f3.exact, "whitespace never forks the key");
+  assert.notEqual(f1.exact, f4.exact, "case is identity (F04): only whitespace is normalized");
   assert.deepEqual(f1.sketch, f2.sketch);
 });
 
+test("F04: behaviour-changing pairs never share an exact key and never near-serve", () => {
+  const pairs = [
+    ["accept ages >= 18 at signup", "accept ages <= 18 at signup"],
+    ['return "ADMIN" for the owner role', 'return "admin" for the owner role'],
+    ["set enabled = true on the feature flag", "set enabled != true on the feature flag"],
+    ["call getURL before the redirect", "call getUrl before the redirect"],
+  ];
+  for (const [a, b] of pairs) {
+    assert.notEqual(specKey(a), specKey(b), `${a} / ${b}`);
+    assert.notEqual(fingerprint(a).exact, fingerprint(b).exact);
+    const r = lookup([verified(a)], b, { nowDay: 0 });
+    assert.ok(r.tier === "adapt" || r.tier === "miss", `${b} got ${r.tier} from ${a}`);
+    if (r.tier === "adapt")
+      assert.ok(
+        r.reasons.some((x) => /held at adapt/.test(x)),
+        "the conflict is named",
+      );
+  }
+});
+
 test("bandKeys: 32 deterministic bands; near-duplicates share at least one", () => {
   const long =
     "implement a token bucket rate limiter for the public api gateway with configurable " +
@@ -97,10 +121,17 @@ const verified = (spec, { slice = "", deps = [], evidence = 2 } = {}) => {
   return c;
 };
 
-test("lookup: exact tier — same normalized spec and slice, proof attached", () => {
-  const r = lookup([verified(SPEC)], SPEC.replace("implement", "IMPLEMENT"), { nowDay: 0 });
+test("lookup: exact tier — same text (whitespace aside) and slice, proof attached", () => {
+  const r = lookup([verified(SPEC)], ` ${SPEC.replace(" ", "\n  ")} `, { nowDay: 0 });
   assert.equal(r.tier, "exact");
   assert.equal(r.jaccard, 1);
+  // No repo root and no atlas: the hit is returned, but never presented as checked (F05).
+  assert.equal(r.revalidation.status, "unknown");
+  assert.equal(r.requiresRevalidation, true);
+  // Shouting a word is a different text: not exact (F04), and ALLCAPS is identity to the
+  // semantic guard, so it is only offered as a starting point.
+  const shouted = lookup([verified(SPEC)], SPEC.replace("implement", "IMPLEMENT"), { nowDay: 0 });
+  assert.equal(shouted.tier, "adapt");
 });
 
 test("lookup: the proof floor — an unverified artifact NEVER serves", () => {
@@ -135,24 +166,42 @@ test("lookup: exact hits are slice-scoped — a different graph context falls th
 
 test("revalidate: a vanished dependency blocks serving (stale cache can't ship)", () => {
   const atlas = { symbols: [{ name: "validateInput" }] };
-  const okArt = verified(SPEC, { deps: ["validateInput"] });
-  const staleArt = verified(SPEC, { deps: ["validateInput", "removedHelper"] });
+  const inline = (deps) => {
+    const c = verified(SPEC, { deps });
+    return { ...c, body: { ...c.body, code: { inline: "export const x = 1" } } };
+  };
+  const okArt = inline(["validateInput"]);
+  const staleArt = inline(["validateInput", "removedHelper"]);
+  assert.equal(revalidate(okArt, atlas).status, "valid");
   assert.equal(revalidate(okArt, atlas).ok, true);
   const rv = revalidate(staleArt, atlas);
-  assert.deepEqual({ ok: rv.ok, missing: rv.missing }, { ok: false, missing: ["removedHelper"] });
+  assert.deepEqual(
+    { ok: rv.ok, status: rv.status, missing: rv.missing },
+    { ok: false, status: "invalid", missing: ["removedHelper"] },
+  );
   const r = lookup([staleArt], SPEC, { atlas, nowDay: 0 });
   assert.equal(r.tier, "miss");
   assert.ok(r.reasons.some((x) => /failed revalidation: missing removedHelper/.test(x)));
+  // No atlas is UNKNOWN validation, not success (F05).
+  assert.equal(revalidate(okArt, null).status, "unknown");
+  assert.equal(revalidate(okArt, null).ok, false);
 });
 
 // --- store level: fill → hit → demote --------------------------------------------------
 
+/** A real artifact file in `root` and its verifiable pointer (describeFile). */
+const realFile = (root, rel = "src/limit.js", body = "export const limit = 42;\n") => {
+  mkdirSync(join(root, rel, ".."), { recursive: true });
+  writeFileSync(join(root, rel), body);
+  return describeFile(root, rel);
+};
+
 test("mintArtifact + reuseQuery: verified fill serves; serving adds NO evidence of its own (C2)", () => {
   const { root, head } = gitRepo();
   const dir = repoLedger(root);
   const m = mintArtifact(
     dir,
-    { spec: SPEC, code: { path: "src/limit.js", sha256: "a".repeat(64) } },
+    { spec: SPEC, code: realFile(root).code },
     { evidence: { oracle: "test.run", result: "confirm", ref: `git:${head}` }, t: 0 },
   );
   assert.equal(m.ok, true);
@@ -213,6 +262,59 @@ test("mint without evidence is honest: stored but flagged as not serving", () =>
   assert.equal(reuseQuery(root, SPEC, { nowDay: 0 }).tier, "miss");
 });
 
+// --- F05: the proof is about the bytes it saw — revalidated at the serving boundary ------
+
+test("F05: an artifact whose file changed or was deleted is never served", () => {
+  const { root, head } = gitRepo();
+  const dir = repoLedger(root);
+  const desc = realFile(root, "answer.js", "export const answer = 42;\n");
+  mintArtifact(
+    dir,
+    { spec: SPEC, ...desc },
+    { evidence: { oracle: "test.run", result: "confirm", ref: `git:${head}` }, t: 0 },
+  );
+  const atlas = { symbols: [] };
+  assert.equal(reuseQuery(root, SPEC, { atlas, nowDay: 0 }).tier, "exact");
+  writeFileSync(join(root, "answer.js"), "export const answer = 99;\n");
+  const edited = reusePeek(root, SPEC, { atlas, nowDay: 0 });
+  assert.equal(edited.tier, "miss");
+  assert.ok(
+    edited.reasons.some((x) => /changed since it was verified/.test(x)),
+    edited.reasons,
+  );
+  rmSync(join(root, "answer.js"));
+  const deleted = reusePeek(root, SPEC, { atlas, nowDay: 0 });
+  assert.equal(deleted.tier, "miss");
+  assert.ok(
+    deleted.reasons.some((x) => /no longer exists/.test(x)),
+    deleted.reasons,
+  );
+  // A changed FILE is not an oracle contradiction: the proof was true of the old bytes.
+  assert.ok(!readEvidence(dir, loadClaims(dir)[0].id).some((e) => e.oracle === "graph.reval"));
+});
+
+test("F05: a same-name dependency whose signature changed invalidates the artifact", () => {
+  const root = tmp();
+  mkdirSync(join(root, "src"), { recursive: true });
+  writeFileSync(join(root, "src", "util.js"), "export function helper(a) {\n  return a;\n}\n");
+  writeFileSync(
+    join(root, "src", "mod.js"),
+    'import { helper } from "./util.js";\nexport const run = () => helper(1);\n',
+  );
+  const atlas = { symbols: [{ name: "helper", kind: "function", file: "src/util.js", line: 1 }] };
+  const desc = describeFile(root, "src/mod.js", { atlas });
+  assert.ok(desc.depContracts.helper, "the dependency's declaration is fingerprinted at mint");
+  const art = artifactClaim({ spec: SPEC, ...desc }, 0).claim;
+  assert.equal(revalidate(art, atlas, { root }).status, "valid");
+  writeFileSync(
+    join(root, "src", "util.js"),
+    "export function helper(a, strict) {\n  return a;\n}\n",
+  );
+  const rv = revalidate(art, atlas, { root });
+  assert.equal(rv.status, "invalid");
+  assert.deepEqual(rv.changed, ["helper"]);
+});
+
 // --- helpers ----------------------------------------------------------------------------
 
 test("describeFile: extracts exports, relative-import deps, and a verifiable content hash", () => {
@@ -254,7 +356,7 @@ test("metrics: record/read/summarize roundtrip; corrupt lines skipped", () => {
 test("lookup (C9): a different identifier is never served as exact or near", () => {
   const cache = [verified("add pagination to listUsers")];
   const same = lookup(cache, "Add pagination to listUsers", { nowDay: 0 });
-  assert.equal(same.tier, "exact", "the same task, reworded in case, is still exact");
+  assert.equal(same.tier, "near", "a case change is not the same TEXT (F04) — serve-with-diff");
   const other = lookup(cache, "add pagination to listOrders", { nowDay: 0 });
   assert.ok(
     other.tier === "adapt" || other.tier === "miss",
diff --git a/test/router_math.test.js b/test/router_math.test.js
index f22bfd70..25a34bbe 100644
--- a/test/router_math.test.js
+++ b/test/router_math.test.js
@@ -193,3 +193,66 @@ test("cost: fitted per model; a model with only a price enters from the price ra
   const e = expectedCosts(c, [0]);
   assert.ok(e[1] > e[0] && e.every((v) => v > 0));
 });
+
+// Review 2026-09-26 — F11: a sparse fit must not invent a $1 intercept (one $0.05 attempt
+// used to predict ≈ $88.87).
+test("F11: sparse cost fits use the mean log cost and report their uncertainty", () => {
+  const one = fitCost([{ model: 0, x: [], cost: 0.05 }], 1, 0);
+  assert.equal(one.method, "mean-log");
+  assert.equal(one.s2Source, "prior");
+  assert.ok(Math.abs(one.alpha[0] - Math.log(0.05)) < 1e-12);
+  const e1 = expectedCosts(one, [])[0];
+  assert.ok(e1 > 0.05 && e1 < 0.1, `one observed $0.05 predicts ${e1}, not tens of dollars`);
+  assert.ok(one.alphaSE[0] > 0.5, "one observation is visibly uncertain");
+
+  const two = fitCost(
+    [
+      { model: 0, x: [1, 2], cost: 0.04 },
+      { model: 0, x: [3, 1], cost: 0.06 },
+    ],
+    2,
+    2,
+  );
+  assert.equal(two.method, "mean-log", "2 points cannot identify 1 intercept + 2 slopes");
+  assert.equal(two.s2Source, "pooled+prior");
+  assert.deepEqual(two.beta, [0, 0]);
+  assert.equal(two.alpha[1], null, "a cold model with no price stays unknown");
+  const e2 = expectedCosts(two, [5, 5]);
+  assert.ok(Number.isFinite(e2[0]) && e2[0] < 0.1);
+  assert.equal(e2[1], null);
+
+  const mixed = fitCost(
+    [
+      { model: 0, x: [], cost: 0 }, // a failed attempt with no recorded charge
+      { model: 0, x: [], cost: null }, // missing
+      { model: 0, x: [], cost: 0.02 },
+      { model: 9, x: [], cost: 1 }, // out of range
+    ],
+    1,
+    0,
+  );
+  assert.deepEqual(mixed.excluded, { zeroCost: 1, missingCost: 1, invalid: 1 });
+  assert.equal(mixed.n, 1);
+  assert.ok(Number.isFinite(expectedCosts(mixed, [])[0]));
+});
+
+// F12: all-infeasible input is unambiguous.
+test("F12: choose() reports infeasibility explicitly instead of a silent least-bad pick", () => {
+  const nodes = { P: [[0.6], [0.8]], weights: [1] };
+  const r = choose(nodes, [1, 2], [0, 1], parseObjective("budget:0.01"), 2);
+  assert.equal(r.feasible, false);
+  assert.equal(r.budgetMet, false);
+  assert.equal(r.minimumExpectedCost, 1);
+  assert.match(r.reason, /infeasible: no cascade's expected cost fits the budget/);
+  assert.equal(
+    r.maxPossibleCost,
+    r.seq.reduce((s, m) => s + [1, 2][m], 0),
+  );
+  const t = choose(nodes, [1, 2], [0, 1], parseObjective("target:0.999"), 2);
+  assert.equal(t.feasible, false);
+  assert.equal(t.targetMet, false);
+  const ok = choose(nodes, [1, 2], [0, 1], parseObjective("budget:5"), 2);
+  assert.equal(ok.feasible, true);
+  assert.equal(ok.budgetMet, true);
+  assert.ok(ok.maxPossibleCost >= ok.cost, "the worst case bounds the expectation");
+});
diff --git a/test/router_universal.test.js b/test/router_universal.test.js
index a932c547..93546c25 100644
--- a/test/router_universal.test.js
+++ b/test/router_universal.test.js
@@ -74,8 +74,15 @@ test("routeUniversal: returns a cascade within the provider's models, with proba
   assert.ok(r.pSuccess > 0 && r.pSuccess <= 1 && r.expectedCost > 0);
   assert.ok(r.targetMet, "match-best-single always reaches the best single model");
   const any = routeUniversal(d, TASK, { objective: "target:0.95" });
-  assert.equal(any.ok, true);
-  assert.ok(any.cascade.length <= 3);
+  // A target this task cannot reach is INFEASIBLE (F12): the least-bad cascade is returned
+  // only as an explicit fallback, never as a recommendation that meets the target.
+  const got = any.ok ? any : any.fallback;
+  if (!any.ok) {
+    assert.equal(any.feasible, false);
+    assert.equal(any.targetMet, false);
+    assert.match(any.reason, /infeasible/);
+  }
+  assert.ok(got.cascade.length <= 3);
   // A model the fit has never seen enters cold, at the population mean.
   const cold = routeUniversal(d, TASK, {
     candidates: reg.models.filter((m) => !m.evidence).map((m) => m.id),
@@ -99,6 +106,83 @@ test("recordOutcome stores features and a hash, never the task text", () => {
   assert.throws(() => recordOutcome(d, { task: "x", model }));
 });
 
+// Review 2026-09-26 — A04/A01: outcomes are validated at the boundary, idempotent per attempt,
+// and self-reported unless tied to a verifier event.
+test("A04: recordOutcome refuses unknown models, bad costs and wrong feature dimensions", () => {
+  const d = project();
+  const model = loadRegistry(d).models[0].id;
+  const feats = new Array(12).fill(0);
+  const base = { task: "t", model, passed: true, features: feats };
+  assert.throws(() => recordOutcome(d, { ...base, model: "no-such-model" }), /unknown model/);
+  assert.throws(() => recordOutcome(d, { ...base, cost: -1 }), /cost/);
+  assert.throws(() => recordOutcome(d, { ...base, cost: Number.NaN }), /cost/);
+  assert.throws(() => recordOutcome(d, { ...base, features: [1, 2, 3] }), /features/);
+  assert.throws(() => recordOutcome(d, { ...base, verifyRunId: "not-a-run" }), /no verify run/);
+  const row = recordOutcome(d, { ...base, cost: 0.1 });
+  assert.equal(row.provenance, "self-reported", "a caller's boolean is self-reported evidence");
+  assert.match(row.attemptId, /^[0-9a-f-]{36}$/);
+});
+
+test("A01: an attempt id makes recording idempotent; replayed/corrupt rows never multiply evidence", () => {
+  const d = project();
+  const model = loadRegistry(d).models[0].id;
+  const feats = new Array(12).fill(0);
+  const first = recordOutcome(d, {
+    task: "t",
+    model,
+    passed: false,
+    features: feats,
+    attemptId: "a1",
+  });
+  const again = recordOutcome(d, {
+    task: "t",
+    model,
+    passed: false,
+    features: feats,
+    attemptId: "a1",
+  });
+  assert.equal(again.duplicate, true);
+  assert.equal(readOutcomes(d).length, 1);
+  // Replay the whole file (a bad merge, a copied log) plus garbage lines.
+  const path = join(d, ".forge", "route_outcomes.jsonl");
+  const text = readFileSync(path, "utf8");
+  writeFileSync(
+    path,
+    `${text}${text}not json\n${JSON.stringify({ ...first, attemptId: "a2", cost: -5 })}\n`,
+  );
+  assert.equal(readOutcomes(d).length, 1, "replayed rows dedupe by attempt id; invalid rows skip");
+  assert.equal(readOutcomes.lastInvalid, 2);
+});
+
+test("F12: an unreachable budget is INFEASIBLE, with the cheapest cost and an explicit fallback", () => {
+  const d = project();
+  const r = routeUniversal(d, TASK, { objective: "budget:0.0000001" });
+  assert.equal(r.ok, false);
+  assert.equal(r.feasible, false);
+  assert.equal(r.budgetMet, false);
+  assert.ok(r.minimumExpectedCost > 0.0000001);
+  assert.match(r.reason, /budget/);
+  assert.ok(r.fallback.cascade.length >= 1, "the least-bad cascade is still available, labeled");
+  assert.ok(r.fallback.maxPossibleCost >= r.fallback.expectedCost);
+});
+
+test("A07: a recommended model no provider serves is labeled advice only, never presented as callable", () => {
+  const d = project();
+  const reg = loadRegistry(d);
+  const unserved = reg.models.filter((m) => Object.keys(m.providers ?? {}).length === 0);
+  assert.ok(unserved.length >= 1, "the shipped registry has models with no provider id");
+  const only = routeUniversal(d, TASK, { candidates: [unserved[0].id] });
+  const rec = only.ok ? only : only.fallback;
+  assert.equal(rec.applicable, false);
+  assert.deepEqual(rec.unmapped, [unserved[0].id]);
+  assert.deepEqual(rec.cascade[0].providers, []);
+  // Routing within one provider only ever returns models that provider can serve.
+  const served = routeUniversal(d, TASK, { provider: "anthropic" });
+  assert.equal(served.applicable, true);
+  assert.ok(served.cascade.every((c) => c.providers.includes("anthropic")));
+  assert.ok(served.cascade.every((c) => typeof c.costSource === "string"));
+});
+
 test("fitRouter: local outcomes move a model's ability in their direction (Bayesian update)", () => {
   const d = project();
   const prior = loadRouterModel(d);
diff --git a/test/schema.test.js b/test/schema.test.js
new file mode 100644
index 00000000..31a87d0f
--- /dev/null
+++ b/test/schema.test.js
@@ -0,0 +1,67 @@
+// Review 2026-09-26 — A04: runtime validation at trust boundaries (files users/teammates can
+// edit, imported records), since JSDoc types are only checked at build time.
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { outcomeRecord, val, validOutcome } from "../src/ledger.js";
+import { loadRegistry } from "../src/router/registry.js";
+import { validate, violations } from "../src/schema.js";
+
+test("schema: finite numbers, bounds, enums, arrays and nested objects", () => {
+  const spec = /** @type {import("../src/schema.js").Spec} */ ({
+    type: "object",
+    required: ["id", "cost"],
+    props: {
+      id: { type: "string", nonEmpty: true, max: 5 },
+      cost: { type: "number", min: 0 },
+      kind: { type: "enum", values: ["a", "b"] },
+      x: { type: "array", items: { type: "number" }, length: 2 },
+      note: { type: "string", nullable: true },
+    },
+  });
+  assert.equal(validate({ id: "m1", cost: 0.1, kind: "a", x: [1, 2], note: null }, spec).ok, true);
+  const errs = violations(
+    { id: "", cost: Number.POSITIVE_INFINITY, kind: "z", x: [1, Number.NaN, 3] },
+    spec,
+    "row",
+  );
+  assert.ok(errs.includes("row.id: must not be empty"), errs.join("|"));
+  assert.ok(errs.includes("row.cost: expected a finite number"));
+  assert.ok(errs.some((e) => e.startsWith("row.kind: expected one of")));
+  assert.ok(errs.includes("row.x: expected 2 items, got 3"));
+  assert.deepEqual(violations(undefined, spec), ["value: required"]);
+  assert.deepEqual(violations({ id: "ok", cost: -1 }, spec), ["value.cost: below 0"]);
+});
+
+test("registry overrides: malformed entries are refused and reported, valid ones apply", () => {
+  const d = mkdtempSync(join(tmpdir(), "forge-schema-"));
+  mkdirSync(join(d, ".forge"), { recursive: true });
+  writeFileSync(
+    join(d, ".forge", "models.json"),
+    JSON.stringify({
+      models: [
+        { id: "cheap-local", price_in: 0.1, price_out: 0.2, providers: { gw: "local/x" } },
+        { id: "negative", price_in: -1, price_out: 1 },
+        { id: "bad-provider", providers: { gw: 42 } },
+        { price_in: 1 },
+      ],
+    }),
+  );
+  const reg = loadRegistry(d);
+  assert.ok(reg.models.some((m) => m.id === "cheap-local"));
+  assert.ok(!reg.models.some((m) => m.id === "negative" || m.id === "bad-provider"));
+  assert.equal(reg.warnings.length, 3, reg.warnings.join("\n"));
+  writeFileSync(join(d, ".forge", "models.json"), "{ not json");
+  assert.match(loadRegistry(d).warnings[0], /not valid JSON/);
+});
+
+test("evidence records: a non-finite day or an oversized ref never counts", () => {
+  const ok = outcomeRecord({ oracle: "test.run", result: "confirm", ref: "ci:1", t: 3 }).outcome;
+  assert.equal(validOutcome(ok), true);
+  assert.equal(validOutcome({ ...ok, t: Number.NaN }), false);
+  assert.equal(validOutcome({ ...ok, t: "3" }), false);
+  assert.equal(validOutcome({ ...ok, ref: `ci:${"9".repeat(3000)}` }), false);
+  assert.equal(val({ evidence: [{ ...ok, t: Number.NaN }] }, 3), 0.5, "ignored, not poisoning val");
+});
diff --git a/test/semantic_guard.test.js b/test/semantic_guard.test.js
new file mode 100644
index 00000000..89550279
--- /dev/null
+++ b/test/semantic_guard.test.js
@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  criticalFeatures,
+  describeConflicts,
+  sameSemantics,
+  semanticConflicts,
+} from "../src/semantic_guard.js";
+
+// The review's four exact-key collisions (F04) and its opposite-rule pair (F16): similar text,
+// different behaviour — every one must be a conflict.
+const CONFLICTING = [
+  ["accept ages >= 18", "accept ages <= 18", "operators"],
+  ['return "ADMIN"', 'return "admin"', "literals"],
+  ["set enabled = true", "set enabled != true", "operators"],
+  ["call getURL", "call getUrl", "identifiers"],
+  [
+    "Enable authentication for every admin route before serving a page",
+    "Disable authentication for every admin route before serving a page",
+    "polarity",
+  ],
+  ["retry 3 times on timeout", "retry 5 times on timeout", "numbers"],
+  ["read src/a.js first", "read src/b.js first", "paths"],
+  ["always run the linter", "never run the linter", "polarity"],
+  ["do cache the response", "don't cache the response", "polarity"],
+];
+
+test("semantic guard: behaviour-changing pairs conflict, and the conflict is named", () => {
+  for (const [a, b, kind] of CONFLICTING) {
+    const conflicts = semanticConflicts(a, b);
+    assert.ok(
+      conflicts.some((c) => c.kind === kind),
+      `${a} / ${b}: ${JSON.stringify(conflicts)}`,
+    );
+    assert.equal(sameSemantics(a, b), false);
+    assert.ok(describeConflicts(conflicts).includes(kind));
+  }
+});
+
+test("semantic guard: rewording that keeps every critical token is the same instruction", () => {
+  for (const [a, b] of [
+    ["Use pnpm, not npm", "use pnpm not npm"],
+    ["Always run the tests before committing.", "Always run the tests before committing"],
+    ["Add pagination to listUsers", "add pagination to listUsers"],
+    ["timeout after 30s", "timeout after 30 s"],
+  ])
+    assert.equal(
+      sameSemantics(a, b),
+      true,
+      `${a} / ${b}: ${describeConflicts(semanticConflicts(a, b))}`,
+    );
+});
+
+test("semantic guard: features are extracted per class; literals are not re-scanned", () => {
+  const f = criticalFeatures('fix src/api/users.ts: listUsers >= 25 items, not "ADMIN >= 1"');
+  assert.deepEqual(f.operators, [">="], "the >= inside the literal is not an operator");
+  assert.deepEqual(f.literals, ['"ADMIN >= 1"']);
+  assert.deepEqual(f.numbers, ["25"]);
+  assert.deepEqual(f.identifiers, ["listUsers"]);
+  assert.deepEqual(f.paths, ["src/api/users.ts"]);
+  assert.deepEqual(f.polarity, ["not"]);
+  assert.deepEqual(criticalFeatures(""), {
+    operators: [],
+    numbers: [],
+    literals: [],
+    identifiers: [],
+    paths: [],
+    polarity: [],
+  });
+});
diff --git a/test/stack.test.js b/test/stack.test.js
index eb47c7a5..02e3483f 100644
--- a/test/stack.test.js
+++ b/test/stack.test.js
@@ -96,7 +96,7 @@ test("empty repo → empty but safe; corrupt manifest never throws", () => {
   assert.doesNotThrow(() => detectStack(root));
 });
 
-test("testRunners: structured descriptors alongside UNCHANGED testCommands strings", () => {
+test("testRunners: an explicit test script is the suite; a runner dependency is inventory (F09)", () => {
   const root = tmp();
   writeFileSync(
     join(root, "package.json"),
@@ -107,16 +107,36 @@ test("testRunners: structured descriptors alongside UNCHANGED testCommands strin
   );
   writeFileSync(join(root, "pnpm-lock.yaml"), "lockfileVersion: 9\n");
   const s = detectStack(root);
-  // strings: back-compat surface, byte-identical to before
-  assert.deepEqual(s.testCommands, ["npx vitest", "pnpm test"]);
+  // The declared script already runs vitest: the dependency is NOT a second obligation.
+  assert.deepEqual(s.testCommands, ["pnpm test"]);
+  assert.deepEqual(s.testInventory, ["npx vitest", "pnpm test"], "still visible as inventory");
   // descriptors: the DETECTED package manager, structured for a shell-free spawn
   assert.deepEqual(
     s.testRunners.find((r) => r.label === "pnpm test"),
     { bin: "pnpm", args: ["test"], label: "pnpm test" },
   );
-  const npx = s.testRunners.find((r) => r.label === "npx vitest");
+  assert.equal(
+    s.testRunners.find((r) => r.label === "npx vitest"),
+    undefined,
+  );
+
+  // With NO declared script, the installed runner stands in as the (report-only) suite.
+  const bare = tmp();
+  writeFileSync(join(bare, "package.json"), JSON.stringify({ devDependencies: { vitest: "2" } }));
+  const b = detectStack(bare);
+  const npx = b.testRunners.find((r) => r.label === "npx vitest");
   assert.ok(npx && !npx.bin, "npx detections stay label-only — forge never executes npx");
 
+  // npm's `npm init` placeholder is not a suite.
+  const placeholder = tmp();
+  writeFileSync(
+    join(placeholder, "package.json"),
+    JSON.stringify({
+      scripts: { test: 'echo "Error: no test specified" && exit 1' },
+    }),
+  );
+  assert.deepEqual(detectStack(placeholder).testCommands, []);
+
   const go = tmp();
   writeFileSync(join(go, "go.mod"), "module x\n\ngo 1.22\n");
   const gs = detectStack(go);
diff --git a/test/substrate.test.js b/test/substrate.test.js
index ed9ffb26..337ce911 100644
--- a/test/substrate.test.js
+++ b/test/substrate.test.js
@@ -192,6 +192,20 @@ test("enforceDecision (enforcing): blocks an edit into a large blast radius", as
   assert.match(g.reason, /large blast radius/);
 });
 
+test("A06: a graph the file cap truncated says so in the substrate result and render", () => {
+  const root = repo();
+  build({ root, cap: 1 }); // two source files, one indexed
+  const r = substrateCheck(root, "Update `computeTax` in `math.js`", { allowBuild: false });
+  assert.equal(r.impact.atlasFresh, true);
+  assert.equal(r.impact.capped, true);
+  assert.equal(r.impact.skippedFiles, 1);
+  assert.match(renderSubstrate(r), /graph capped: 1 file\(s\) over the atlas cap/);
+  const whole = repo();
+  build({ root: whole });
+  const full = substrateCheck(whole, "Update `computeTax` in `math.js`", { allowBuild: false });
+  assert.equal(full.impact.capped, undefined, "an uncapped graph adds no truncation note");
+});
+
 test("stale ambient atlas is dropped: no impacts, no predicted tests, honest render (RA-07)", async () => {
   const { renderSubstrate, substrateContext } = await import("../src/substrate.js");
   const root = repo();
diff --git a/test/trust_properties.test.js b/test/trust_properties.test.js
new file mode 100644
index 00000000..f40e6fbd
--- /dev/null
+++ b/test/trust_properties.test.js
@@ -0,0 +1,292 @@
+// Review 2026-09-26 — A02: property tests for the trust invariants, over seeded random
+// inputs (deterministic: a fixed-seed PRNG, so a failure reproduces exactly). Each property is
+// one the review found broken by a single counterexample; the generators widen those
+// counterexamples into families. Zero failures over n seeded cases is evidence, not proof.
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { build as buildAtlas } from "../src/atlas.js";
+import { assemble } from "../src/context.js";
+import { evidenceEvents, outcomeRecord, val } from "../src/ledger.js";
+import { repoLedger } from "../src/ledger_store.js";
+import { describeFile, mintArtifact, reusePeek } from "../src/reuse.js";
+import { choose, parseObjective } from "../src/router/policy.js";
+import { semanticConflicts } from "../src/semantic_guard.js";
+import { computeCodeState } from "../src/verify.js";
+
+// mulberry32 — the same seeded PRNG the benchmark fixtures use.
+const prng = (seed) => {
+  let a = seed >>> 0;
+  return () => {
+    a = (a + 0x6d2b79f5) >>> 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+};
+const shuffle = (rand, xs) => {
+  const a = [...xs];
+  for (let i = a.length - 1; i > 0; i--) {
+    const j = Math.floor(rand() * (i + 1));
+    [a[i], a[j]] = [a[j], a[i]];
+  }
+  return a;
+};
+const gitRepo = (files) => {
+  const root = mkdtempSync(join(tmpdir(), "forge-prop-git-"));
+  const g = (...args) => execFileSync("git", args, { cwd: root, stdio: "ignore" });
+  g("init", "-q");
+  g("config", "user.email", "t@t.t");
+  g("config", "user.name", "t");
+  for (const [rel, body] of Object.entries(files)) writeFileSync(join(root, rel), body);
+  g("add", "-A");
+  g("commit", "-qm", "init");
+  const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+  return { root, head };
+};
+const POSIX = process.platform !== "win32"; // exec bits and symlinks
+
+test("property: the rendered context never exceeds its budget while claiming completion", () => {
+  const root = mkdtempSync(join(tmpdir(), "forge-prop-ctx-"));
+  mkdirSync(join(root, "src"), { recursive: true });
+  const pad = (n) => Array.from({ length: n }, (_, i) => `// line ${i}`).join("\n");
+  writeFileSync(
+    join(root, "src", "a.js"),
+    `${pad(60)}\nexport function alpha(x) {\n  return x;\n}\n`,
+  );
+  writeFileSync(
+    join(root, "src", "b.js"),
+    `import { alpha } from "./a.js";\nexport function beta() {\n  return alpha(2);\n}\n${pad(80)}\n`,
+  );
+  writeFileSync(join(root, "src", "a.test.js"), `import { alpha } from "./a.js";\n${pad(30)}\n`);
+  const atlas = buildAtlas({ root });
+  const rand = prng(20260926);
+  const budgets = [1, 2, 7, 8, 9, 20, 50, 100, 400, 6000];
+  for (let i = 0; i < 40; i++) budgets.push(1 + Math.floor(rand() * 900));
+  for (const budget of budgets) {
+    const r = assemble(root, "change alpha in src/a.js and src/b.js", { atlas, budget });
+    assert.ok(r.tokens <= budget, `budget ${budget}: rendered ${r.tokens} tokens`);
+    if (r.ok) {
+      assert.equal(r.overflow, false, `budget ${budget}`);
+      assert.deepEqual(r.pending, [], `budget ${budget}: ok with pending reads`);
+      assert.deepEqual(r.missing, [], `budget ${budget}: ok with missing keys`);
+    }
+    for (const k of r.covered) assert.ok(r.required.includes(k) || !k.includes(":"));
+    for (const k of r.pending)
+      assert.ok(!r.covered.includes(k), "pending and covered are disjoint");
+  }
+});
+
+test("property: evidence counts per event — any spelling mix, any order, any replay", () => {
+  const rand = prng(7);
+  const hex = () =>
+    Array.from({ length: 40 }, () => "0123456789abcdef"[Math.floor(rand() * 16)]).join("");
+  for (let trial = 0; trial < 60; trial++) {
+    const k = 1 + Math.floor(rand() * 4);
+    const oids = Array.from({ length: k }, hex);
+    // One canonical record per event…
+    const canonical = oids.map(
+      (oid, i) =>
+        outcomeRecord({ oracle: "test.run", result: "confirm", ref: `git:${oid}`, t: i }).outcome,
+    );
+    // …versus the same events cited under random abbreviations, re-cited LATER (which must not
+    // refresh decay), duplicated, and shuffled.
+    const aliases = [];
+    oids.forEach((oid, i) => {
+      aliases.push(canonical[i]);
+      const extra = Math.floor(rand() * 4);
+      for (let j = 0; j < extra; j++) {
+        const len = 7 + Math.floor(rand() * 34);
+        aliases.push(
+          outcomeRecord({
+            oracle: "test.run",
+            result: "confirm",
+            ref: `git:${rand() < 0.5 ? oid.slice(0, len) : oid.slice(0, len).toUpperCase()}`,
+            author: `a${j}`,
+            t: i + 1 + j,
+          }).outcome,
+        );
+      }
+    });
+    const replayed = shuffle(rand, [...aliases, ...aliases]);
+    const now = k + 5;
+    assert.equal(evidenceEvents(replayed).length, k, `trial ${trial}: ${k} distinct events`);
+    assert.equal(
+      val({ evidence: replayed }, now),
+      val({ evidence: canonical }, now),
+      `trial ${trial}: aliases, replays and order must not move confidence`,
+    );
+  }
+});
+
+test("property: a budget is never reported met when it is not, and infeasibility is explicit", () => {
+  const rand = prng(99);
+  for (let trial = 0; trial < 80; trial++) {
+    const m = 2 + Math.floor(rand() * 3);
+    const q = 1 + Math.floor(rand() * 3);
+    const P = Array.from({ length: m }, () => Array.from({ length: q }, () => rand()));
+    const w = Array.from({ length: q }, () => 1 / q);
+    const costs = Array.from({ length: m }, () => 0.01 + rand() * 3);
+    const budget = rand() * 2;
+    const r = choose(
+      { P, weights: w },
+      costs,
+      [...Array(m).keys()],
+      parseObjective(`budget:${budget}`),
+      3,
+    );
+    if (r.feasible) {
+      assert.equal(r.budgetMet, true);
+      assert.ok(r.cost <= budget + 1e-9, `trial ${trial}: feasible but over budget`);
+    } else {
+      assert.equal(r.budgetMet, false);
+      assert.ok(r.minimumExpectedCost > budget - 1e-12, `trial ${trial}`);
+      assert.match(r.reason, /infeasible/);
+    }
+    assert.ok(r.maxPossibleCost >= r.cost - 1e-12, "the worst case bounds the expectation");
+  }
+});
+
+test("property: the semantic guard is symmetric and flags every polarity/operator flip", () => {
+  const rand = prng(3);
+  const subjects = ["the cache", "request signatures", "the admin route", "retries", "the linter"];
+  const flips = [
+    ["enable", "disable"],
+    ["allow", "deny"],
+    ["include", "exclude"],
+    ["always run", "never run"],
+    ["add", "remove"],
+    [">=", "<="],
+    ["==", "!="],
+  ];
+  for (let trial = 0; trial < 60; trial++) {
+    const s = subjects[Math.floor(rand() * subjects.length)];
+    const [x, y] = flips[Math.floor(rand() * flips.length)];
+    const tail = rand() < 0.5 ? " before every deploy" : "";
+    const a = /[<>=!]/.test(x) ? `accept ${s} ${x} 18${tail}` : `${x} ${s}${tail}`;
+    const b = /[<>=!]/.test(y) ? `accept ${s} ${y} 18${tail}` : `${y} ${s}${tail}`;
+    const ab = semanticConflicts(a, b);
+    const ba = semanticConflicts(b, a);
+    assert.ok(ab.length > 0, `${a} / ${b} must conflict`);
+    assert.deepEqual(
+      ab.map((c) => c.kind),
+      ba.map((c) => c.kind),
+      "symmetric",
+    );
+    assert.deepEqual(semanticConflicts(a, a), [], "a text never conflicts with itself");
+  }
+});
+
+test("property: any composition of manifest transformations moves the fingerprint; undoing restores it", () => {
+  const { root } = gitRepo({ "tracked.js": "export const x = 1;\n" });
+  const p = (f) => join(root, f);
+  writeFileSync(p("a.txt"), "alpha\n");
+  writeFileSync(p("b.txt"), "left");
+  writeFileSync(p("c.txt"), "right");
+  writeFileSync(p("run.sh"), "echo hi\n");
+  chmodSync(p("run.sh"), 0o644);
+  if (POSIX) symlinkSync("b.txt", p("link"));
+  const split = (b, c) => () => {
+    writeFileSync(p("b.txt"), b);
+    writeFileSync(p("c.txt"), c);
+  };
+  const relink = (target) => () => {
+    rmSync(p("link"));
+    symlinkSync(target, p("link"));
+  };
+  // Each transformation touches its own files, so any subset composes and undoes cleanly.
+  const ops = [
+    [
+      "rename an untracked file",
+      () => renameSync(p("a.txt"), p("a2.txt")),
+      () => renameSync(p("a2.txt"), p("a.txt")),
+    ],
+    ["move a byte across a file boundary", split("lef", "tright"), split("left", "right")],
+    ["add an empty file", () => writeFileSync(p("empty.txt"), ""), () => rmSync(p("empty.txt"))],
+    [
+      "edit a tracked file",
+      () => writeFileSync(p("tracked.js"), "export const x = 2;\n"),
+      () => writeFileSync(p("tracked.js"), "export const x = 1;\n"),
+    ],
+    ...(POSIX
+      ? [
+          [
+            "set an exec bit",
+            () => chmodSync(p("run.sh"), 0o755),
+            () => chmodSync(p("run.sh"), 0o644),
+          ],
+          ["retarget a symlink", relink("c.txt"), relink("b.txt")],
+        ]
+      : []),
+  ];
+  const base = computeCodeState(root);
+  assert.equal(typeof base.dirtyHash, "string");
+  const rand = prng(20260926);
+  const seen = new Set([base.dirtyHash]);
+  for (let trial = 0; trial < 24; trial++) {
+    const k = 1 + Math.floor(rand() * 3);
+    const pick = shuffle(rand, ops).slice(0, k);
+    for (const [, apply] of pick) apply();
+    const moved = computeCodeState(root).dirtyHash;
+    const names = pick.map(([n]) => n).join(" + ");
+    assert.notEqual(moved, base.dirtyHash, `trial ${trial}: ${names} must change the fingerprint`);
+    seen.add(moved);
+    for (const [, , undo] of [...pick].reverse()) undo();
+    assert.equal(computeCodeState(root).dirtyHash, base.dirtyHash, `trial ${trial}: undo ${names}`);
+  }
+  assert.ok(seen.size > 2, "different compositions reach different fingerprints");
+});
+
+test("property: an artifact is never served after any edit, move or deletion of its file", () => {
+  const { root, head } = gitRepo({ "seed.txt": "seed\n" });
+  const dir = repoLedger(root);
+  const body = "export function clamp(x, lo, hi) {\n  return Math.min(hi, Math.max(lo, x));\n}\n";
+  writeFileSync(join(root, "clamp.js"), body);
+  const spec = "clamp a number between a lower and an upper bound, inclusive";
+  mintArtifact(
+    dir,
+    { spec, ...describeFile(root, "clamp.js") },
+    { evidence: { oracle: "test.run", result: "confirm", ref: `git:${head}` }, t: 0 },
+  );
+  const atlas = { symbols: [] };
+  const served = () => reusePeek(root, spec, { atlas, nowDay: 0 }).tier;
+  assert.equal(served(), "exact");
+  const rand = prng(11);
+  const edits = [
+    ["append a byte", () => writeFileSync(join(root, "clamp.js"), `${body} `)],
+    [
+      "flip one character",
+      () => {
+        const i = Math.floor(rand() * body.length);
+        const c = body[i] === "x" ? "y" : "x";
+        writeFileSync(join(root, "clamp.js"), body.slice(0, i) + c + body.slice(i + 1));
+      },
+    ],
+    [
+      "truncate",
+      () => writeFileSync(join(root, "clamp.js"), body.slice(0, Math.floor(rand() * body.length))),
+    ],
+    ["delete", () => rmSync(join(root, "clamp.js"))],
+    ["move away", () => renameSync(join(root, "clamp.js"), join(root, "clamp2.js"))],
+  ];
+  for (let trial = 0; trial < 30; trial++) {
+    const [name, edit] = edits[Math.floor(rand() * edits.length)];
+    edit();
+    assert.notEqual(served(), "exact", `trial ${trial}: served after "${name}"`);
+    assert.notEqual(served(), "near", `trial ${trial}: served after "${name}"`);
+    rmSync(join(root, "clamp2.js"), { force: true });
+    writeFileSync(join(root, "clamp.js"), body);
+    assert.equal(served(), "exact", `trial ${trial}: the verified bytes serve again`);
+  }
+});
diff --git a/test/verify.test.js b/test/verify.test.js
index b71ee858..2bd6cd47 100644
--- a/test/verify.test.js
+++ b/test/verify.test.js
@@ -1,16 +1,27 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  renameSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
 import {
+  CODE_STATE_SCHEME,
   classifySuiteFailure,
   computeCodeState,
   extractCalledSymbols,
   findUnknownSymbols,
   maskedTestScript,
+  planSuites,
   provenanceMac,
+  readVerifyEvents,
   signProvenance,
   verify,
 } from "../src/verify.js";
@@ -35,6 +46,12 @@ const withBins = (binDir, fn) => {
   }
 };
 
+// verify spawns the package manager shell-free (never a shell, never npx). On Windows `npm` is a
+// `.cmd` shim, which Node refuses to spawn without a shell, so a real npm-driven verify reports
+// INCOMPLETE there; the end-to-end PASS/FAIL tests below are POSIX-only for that reason.
+const NO_NPM_SPAWN =
+  process.platform === "win32" && "npm is a .cmd shim on Windows; verify never spawns a shell";
+
 const gitRepo = () => {
   const root = mkdtempSync(join(tmpdir(), "forge-verify-"));
   const g = (...args) => execFileSync("git", args, { cwd: root, stdio: "ignore" });
@@ -207,6 +224,13 @@ test("verify: an untracked source file appears in provenance (changedFiles + unt
   const r = verify({ targetRoot: root });
   assert.ok(r.changedFiles.includes("brand_new.js"), "untracked file in changedFiles");
   assert.ok(r.provenance.untracked.includes("brand_new.js"), "untracked file in provenance stamp");
+  // verify's own outputs (.forge/provenance.json, verify-events.jsonl) are not the change.
+  const again = verify({ targetRoot: root });
+  assert.deepEqual(
+    again.changedFiles.filter((f) => f.startsWith(".forge/")),
+    [],
+    again.changedFiles.join(", "),
+  );
 });
 
 // ---------------------------------------------------------------------------
@@ -421,3 +445,314 @@ test("verify: the provenance stamp is signed, and an edited one no longer verifi
   // …and the signer is what closes the gap: only `forge verify` runs it.
   assert.equal(signProvenance(handWritten).signature, provenanceMac(handWritten));
 });
+
+// ---------------------------------------------------------------------------
+// Review 2026-09-26 — F01: the fingerprint is a canonical manifest, not a byte stream.
+// ---------------------------------------------------------------------------
+
+const committedRepo = () => {
+  const root = gitRepo();
+  writeFileSync(join(root, "keep.js"), "export const keep = 1\n");
+  execFileSync("git", ["add", "."], { cwd: root, stdio: "ignore" });
+  execFileSync("git", ["commit", "-m", "init"], { cwd: root, stdio: "ignore" });
+  return root;
+};
+
+test("F01: renaming an untracked file (identical bytes) changes the fingerprint", () => {
+  const root = committedRepo();
+  writeFileSync(join(root, "a.js"), "export const x = 42\n");
+  const before = computeCodeState(root);
+  renameSync(join(root, "a.js"), join(root, "b.js"));
+  const after = computeCodeState(root);
+  assert.equal(before.scheme, CODE_STATE_SCHEME);
+  assert.notEqual(after.dirtyHash, before.dirtyHash, "a.js → b.js is a different code state");
+});
+
+test("F01: moving bytes between untracked files ([ab,c] vs [a,bc]) changes the fingerprint", () => {
+  const root = committedRepo();
+  writeFileSync(join(root, "x.js"), "ab");
+  writeFileSync(join(root, "y.js"), "c");
+  const s1 = computeCodeState(root);
+  writeFileSync(join(root, "x.js"), "a");
+  writeFileSync(join(root, "y.js"), "bc");
+  assert.notEqual(computeCodeState(root).dirtyHash, s1.dirtyHash, "file boundaries are bound");
+});
+
+test("F01: an added EMPTY untracked file, and HEAD itself, are part of the code state", () => {
+  const root = committedRepo();
+  const clean = computeCodeState(root);
+  writeFileSync(join(root, "empty.js"), "");
+  assert.notEqual(computeCodeState(root).dirtyHash, clean.dirtyHash, "empty file changes it");
+  execFileSync("git", ["add", "."], { cwd: root, stdio: "ignore" });
+  execFileSync("git", ["commit", "-m", "second"], { cwd: root, stdio: "ignore" });
+  const cleanAtNewHead = computeCodeState(root);
+  // Both states are CLEAN (empty diff) — only HEAD differs. v1 hashed them identically.
+  assert.notEqual(
+    cleanAtNewHead.dirtyHash,
+    clean.dirtyHash,
+    "a different commit is not the same code",
+  );
+});
+
+test("F01: an untracked file's exec bit and a symlink target are bound", {
+  skip: process.platform === "win32" && "POSIX modes/symlinks",
+}, () => {
+  const root = committedRepo();
+  writeFileSync(join(root, "run.sh"), "echo hi\n");
+  const s1 = computeCodeState(root);
+  chmodSync(join(root, "run.sh"), 0o755);
+  const s2 = computeCodeState(root);
+  assert.notEqual(s2.dirtyHash, s1.dirtyHash, "mode change is a code-state change");
+  symlinkSync("keep.js", join(root, "link.js"));
+  const s3 = computeCodeState(root);
+  renameSync(join(root, "link.js"), join(root, "link2.js"));
+  assert.notEqual(computeCodeState(root).dirtyHash, s3.dirtyHash, "symlink path is bound");
+});
+
+test("F01: an unreadable untracked file makes the state unbindable (fail closed)", {
+  skip:
+    (process.platform === "win32" || process.getuid?.() === 0) &&
+    "needs a non-root POSIX user (root reads mode-000 files)",
+}, () => {
+  const root = committedRepo();
+  writeFileSync(join(root, "secret.js"), "x");
+  chmodSync(join(root, "secret.js"), 0o000);
+  const s = computeCodeState(root);
+  assert.equal(s.dirtyHash, null);
+  assert.match(s.unbindable, /could not be read/);
+  chmodSync(join(root, "secret.js"), 0o644);
+});
+
+test("F01: the stamp's signature binds the fingerprint scheme (old-scheme stamps are stale)", () => {
+  const stamp = {
+    tests: { status: "PASS" },
+    codeState: { scheme: CODE_STATE_SCHEME, head: "a".repeat(40), dirtyHash: "b".repeat(64) },
+  };
+  signProvenance(stamp);
+  const v1 = { ...stamp, codeState: { ...stamp.codeState, scheme: undefined } };
+  assert.notEqual(
+    provenanceMac(v1),
+    stamp.signature,
+    "a stamp without the v2 scheme no longer verifies",
+  );
+});
+
+// ---------------------------------------------------------------------------
+// F10: a verdict is bound to the bytes it TESTED — a mutation during the run is INCOMPLETE.
+// ---------------------------------------------------------------------------
+
+test("F10: a test that rewrites source during the run cannot produce a signed PASS", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = fixtureWithTestScript("node --test");
+  writeFileSync(join(root, "subject.cjs"), "module.exports = 42;\n");
+  writeFileSync(
+    join(root, "subject.test.cjs"),
+    [
+      "const { test } = require('node:test');",
+      "const assert = require('node:assert');",
+      "const fs = require('node:fs');",
+      "test('checks then mutates', () => {",
+      "  assert.strictEqual(require('./subject.cjs'), 42);",
+      "  fs.writeFileSync(__dirname + '/subject.cjs', 'module.exports = 0;\\n');",
+      "});",
+      "",
+    ].join("\n"),
+  );
+  const r = verify({ targetRoot: root });
+  assert.equal(r.tests.executed[0].status, "PASS", "the suite itself passed…");
+  assert.equal(r.tests.status, "INCOMPLETE", "…but the tree moved, so no verdict is bound");
+  assert.equal(r.tests.mutated, true);
+  assert.equal(r.ok, false);
+  assert.notEqual(r.provenance.codeState.dirtyHash, r.provenance.codeStateAfter.dirtyHash);
+  assert.equal(
+    r.provenance.codeStateAfter.dirtyHash,
+    computeCodeState(root).dirtyHash,
+    "the after-state is the mutated tree",
+  );
+  assert.equal(r.provenance.signature, provenanceMac(r.provenance), "signed as INCOMPLETE");
+});
+
+test("F10: outputs declared in verify.generated may change during the run", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = fixtureWithTestScript("node --test");
+  mkdirSync(join(root, ".forge"), { recursive: true });
+  writeFileSync(
+    join(root, ".forge", "forge.config.json"),
+    JSON.stringify({ verify: { generated: ["reports/**"] } }),
+  );
+  writeFileSync(
+    join(root, "gen.test.cjs"),
+    [
+      "const { test } = require('node:test');",
+      "const fs = require('node:fs');",
+      "test('writes a report', () => {",
+      "  fs.mkdirSync(__dirname + '/reports', { recursive: true });",
+      "  fs.writeFileSync(__dirname + '/reports/out.txt', String(Date.now()));",
+      "});",
+      "",
+    ].join("\n"),
+  );
+  const r = verify({ targetRoot: root });
+  assert.equal(r.tests.status, "PASS", r.tests.output);
+  assert.equal(r.tests.mutated, undefined);
+});
+
+// ---------------------------------------------------------------------------
+// F08/F09: suites are planned per package; coverage is explicit.
+// ---------------------------------------------------------------------------
+
+const monorepo = ({ rootScript = "node --test", workspaces = ["packages/*"] } = {}) => {
+  const root = gitRepo();
+  writeFileSync(
+    join(root, "package.json"),
+    JSON.stringify({ name: "mono", private: true, workspaces, scripts: { test: rootScript } }),
+  );
+  writeFileSync(
+    join(root, "root.test.cjs"),
+    "const { test } = require('node:test');\ntest('root ok', () => {});\n",
+  );
+  mkdirSync(join(root, "packages", "bad"), { recursive: true });
+  writeFileSync(
+    join(root, "packages", "bad", "package.json"),
+    JSON.stringify({ name: "bad", scripts: { test: 'node -e "process.exit(1)"' } }),
+  );
+  return root;
+};
+
+test("F08: a failing workspace package cannot hide behind a passing root suite", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = monorepo();
+  const r = verify({ targetRoot: root });
+  const nested = r.tests.executed.find((s) => s.cwd === "packages/bad");
+  assert.ok(nested, `the nested suite ran: ${JSON.stringify(r.tests.executed)}`);
+  assert.equal(nested.status, "FAIL");
+  assert.equal(r.tests.status, "FAIL");
+  assert.deepEqual(r.tests.coverage.required, [".", "packages/bad"]);
+});
+
+test("F08: a recursive root script covers declared workspaces once (no duplicate run)", () => {
+  const root = monorepo({ rootScript: "npm test --workspaces --if-present" });
+  const plan = planSuites(root);
+  assert.equal(plan.suites.length, 1, "only the root suite runs");
+  assert.deepEqual(plan.suites[0].covers, [".", "packages/bad"], "…and it covers the workspace");
+  assert.equal(plan.coverage.rootCoversWorkspaces, true);
+});
+
+test("F08: verify.workspaces=root is an explicit coverage declaration; exclude/fixtures skip", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = monorepo();
+  mkdirSync(join(root, "test", "fixtures", "pkg"), { recursive: true });
+  writeFileSync(
+    join(root, "test", "fixtures", "pkg", "package.json"),
+    JSON.stringify({ scripts: { test: "exit 1" } }),
+  );
+  const plan = planSuites(root);
+  assert.ok(
+    plan.coverage.excluded.some((e) => e.path === "test/fixtures/pkg"),
+    "a fixture package is not a required suite",
+  );
+  mkdirSync(join(root, ".forge"), { recursive: true });
+  writeFileSync(
+    join(root, ".forge", "forge.config.json"),
+    JSON.stringify({ verify: { exclude: ["packages/bad"] } }),
+  );
+  const excluded = verify({ targetRoot: root });
+  assert.equal(excluded.tests.status, "PASS", excluded.tests.output);
+  assert.ok(excluded.tests.coverage.excluded.some((e) => e.reason === "verify.exclude"));
+  writeFileSync(
+    join(root, ".forge", "forge.config.json"),
+    JSON.stringify({ verify: { workspaces: "root" } }),
+  );
+  const declared = planSuites(root);
+  assert.equal(declared.suites.length, 1);
+  assert.ok(declared.suites[0].covers.includes("packages/bad"));
+});
+
+test("F08: a nested suite forge cannot execute leaves its package uncovered → INCOMPLETE", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = fixtureWithTestScript("node --test");
+  mkdirSync(join(root, "services", "api"), { recursive: true });
+  writeFileSync(join(root, "services", "api", "go.mod"), "module x\n\ngo 1.22\n");
+  const r = verify({ targetRoot: root });
+  assert.equal(r.tests.status, "INCOMPLETE");
+  assert.deepEqual(r.tests.coverage.uncovered, ["services/api"]);
+  assert.ok(r.tests.notExecuted.some((l) => l.includes("services/api")));
+});
+
+test("F09: an explicit passing script + a runner devDependency is a complete PASS", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = gitRepo();
+  writeFileSync(
+    join(root, "package.json"),
+    JSON.stringify({
+      name: "t",
+      scripts: { test: "node --test" },
+      devDependencies: { vitest: "2" },
+    }),
+  );
+  writeFileSync(
+    join(root, "ok.test.cjs"),
+    "const { test } = require('node:test');\ntest('ok', () => {});\n",
+  );
+  const r = verify({ targetRoot: root });
+  assert.equal(r.tests.status, "PASS", r.tests.output);
+  assert.deepEqual(
+    r.tests.notExecuted,
+    [],
+    "the vitest dependency is inventory, not an obligation",
+  );
+});
+
+// ---------------------------------------------------------------------------
+// A01: one verifier event per run — id, suites, coverage, pre/post state, environment.
+// ---------------------------------------------------------------------------
+
+test("A01: verify records an immutable, MAC'd verifier event", { skip: NO_NPM_SPAWN }, () => {
+  const root = fixtureWithTestScript("node --test");
+  writeFileSync(
+    join(root, "ok.test.cjs"),
+    "const { test } = require('node:test');\ntest('ok', () => {});\n",
+  );
+  const r = verify({ targetRoot: root });
+  const e = r.provenance.event;
+  assert.match(e.runId, /^[0-9a-f-]{36}$/);
+  assert.equal(e.status, "PASS");
+  assert.equal(e.pre.dirtyHash, r.provenance.codeState.dirtyHash);
+  assert.equal(e.post.dirtyHash, e.pre.dirtyHash);
+  assert.deepEqual(e.suites[0].covers, ["."]);
+  assert.equal(typeof e.environment.digest, "string");
+  const events = readVerifyEvents(root);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].runId, e.runId);
+  // A hand-edited event line (verdict flipped) is not read back as evidence.
+  const path = join(root, ".forge", "verify-events.jsonl");
+  const forged = { ...JSON.parse(readFileSync(path, "utf8").trim()), status: "FAIL" };
+  writeFileSync(path, `${JSON.stringify(forged)}\n`);
+  assert.equal(readVerifyEvents(root).length, 0);
+});
+
+test("F10: interpreter caches written by a test run are not a code mutation", {
+  skip: NO_NPM_SPAWN,
+}, () => {
+  const root = fixtureWithTestScript("node write-cache.cjs");
+  writeFileSync(
+    join(root, "write-cache.cjs"),
+    [
+      "const fs = require('node:fs');",
+      "fs.mkdirSync(__dirname + '/pkg/__pycache__', { recursive: true });",
+      "fs.writeFileSync(__dirname + '/pkg/__pycache__/m.cpython-312.pyc', String(Date.now()));",
+      "fs.mkdirSync(__dirname + '/.pytest_cache', { recursive: true });",
+      "fs.writeFileSync(__dirname + '/.pytest_cache/state', String(Date.now()));",
+      "",
+    ].join("\n"),
+  );
+  const r = verify({ targetRoot: root });
+  assert.equal(r.tests.status, "PASS", r.tests.output);
+  assert.equal(r.tests.mutated, undefined);
+});