diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index 790fe10..36407b3 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Pre-commit hook for dotfiles.
-# - When AGENTS.md is staged, runs scripts/audit-agents-md.sh and blocks
+# - When AGENTS.md is staged, runs audits/agents-md.sh and blocks
 #   the commit if any invariant regressed.
 # - For all other commits, this hook is a no-op (fast path).
 #
@@ -16,19 +16,19 @@ set -uo pipefail
 ROOT="$(git rev-parse --show-toplevel)"
 cd "$ROOT" || exit 1
 
-if git diff --cached --name-only | grep -qE '^(AGENTS\.md|AGENTS_INVARIANCE\.md|docs/gates/.*\.md|scripts/audit-agents-md\.sh|scripts/fixtures/.*\.diff)$'; then
+if git diff --cached --name-only | grep -qE '^(AGENTS\.md|audits/agents-md\.(md|sh)|audits/data\.sh|audits/parity-dispatch\.sh|dispatch/.*\.md|audits/fixtures/.*\.diff)$'; then
   if [[ "${SKIP_AGENTS_AUDIT:-0}" = "1" ]]; then
     echo "pre-commit: SKIP_AGENTS_AUDIT=1 — bypassing AGENTS.md audit (one-off)" >&2
   else
-    echo "pre-commit: AGENTS.md or its audit changed — running scripts/audit-agents-md.sh" >&2
-    if ! bash "$ROOT/scripts/audit-agents-md.sh"; then
+    echo "pre-commit: AGENTS.md or its audit changed — running audits/agents-md.sh" >&2
+    if ! bash "$ROOT/audits/agents-md.sh"; then
       cat >&2 <<'MSG'
 
 pre-commit: AGENTS.md invariance regressed.
 
 Fix the FAIL: lines above, then re-stage and re-commit.
 
-If you also changed AGENTS.md semantics, run AGENTS_INVARIANCE.md
+If you also changed AGENTS.md semantics, run audits/agents-md.md
 through an LLM agent before merging — the script catches mechanical
 regressions; the questionnaire catches reading-comprehension ones.
 
diff --git a/.githooks/pre-push b/.githooks/pre-push
index b3ac587..c6917e8 100755
--- a/.githooks/pre-push
+++ b/.githooks/pre-push
@@ -2,10 +2,10 @@
 # Pre-push hook for dotfiles.
 #
 # Behaviour:
-# - Runs scripts/audit-agents-md.sh always (script layer; deterministic).
-# - When the push includes commits that touched AGENTS.md, AGENTS_INVARIANCE.md,
-#   or any docs/gates/*.md, ALSO requires a fresh sign-off file written by an
-#   LLM agent that ran the AGENTS_INVARIANCE.md questionnaire.
+# - Runs audits/agents-md.sh always (script layer; deterministic).
+# - When the push includes commits that touched AGENTS.md, audits/agents-md.md,
+#   or any dispatch/*.md, ALSO requires a fresh sign-off file written by an
+#   LLM agent that ran the audits/agents-md.md questionnaire.
 #
 # Sign-off file: .agents-invariance-signoff (gitignored — it's a machine-local
 # attestation, not a tracked artifact). Format:
@@ -15,8 +15,8 @@
 # A sign-off is "fresh" if its <commit-sha-short> matches HEAD and the file was
 # written within the last 24 hours.
 #
-# To produce the sign-off: open AGENTS_INVARIANCE.md in an LLM session and
-# instruct: "Read AGENTS.md and answer every question in AGENTS_INVARIANCE.md.
+# To produce the sign-off: open audits/agents-md.md in an LLM session and
+# instruct: "Read AGENTS.md and answer every question in audits/agents-md.md.
 # When all-YES, write the sign-off line to .agents-invariance-signoff."
 #
 # One-off bypass:  SKIP_INVARIANCE_PUSH=1 git push ...
@@ -28,8 +28,8 @@ ROOT="$(git rev-parse --show-toplevel)"
 cd "$ROOT" || exit 1
 
 # 1. Always run the script layer.
-echo "pre-push: running scripts/audit-agents-md.sh" >&2
-if ! bash "$ROOT/scripts/audit-agents-md.sh"; then
+echo "pre-push: running audits/agents-md.sh" >&2
+if ! bash "$ROOT/audits/agents-md.sh"; then
   echo "pre-push: script layer failed — fix before push" >&2
   exit 1
 fi
@@ -46,7 +46,7 @@ while read -r local_ref local_sha remote_ref remote_sha; do
     range="$remote_sha..$local_sha"
     files=$(git diff --name-only "$range")
   fi
-  if echo "$files" | grep -qE '^(AGENTS\.md|AGENTS_INVARIANCE\.md|docs/gates/.*\.md)$'; then
+  if echo "$files" | grep -qE '^(AGENTS\.md|audits/agents-md\.md|dispatch/.*\.md)$'; then
     contract_changed=1
   fi
 done
@@ -69,11 +69,11 @@ fi
 if [[ ! -f "$SIGNOFF" ]]; then
   cat >&2 <<MSG
 
-pre-push: 🔴 BLOCKED — AGENTS.md / docs/gates / AGENTS_INVARIANCE.md changed in
+pre-push: 🔴 BLOCKED — AGENTS.md / dispatch/ / audits/agents-md.md changed in
           this push, but no .agents-invariance-signoff file exists.
 
 To proceed:
-  1. Open AGENTS_INVARIANCE.md in an LLM agent session.
+  1. Open audits/agents-md.md in an LLM agent session.
   2. Instruct: "Read AGENTS.md and answer every question. When all-YES, write
      a sign-off line to .agents-invariance-signoff in this format:
          <commit-sha-short>  <UTC-timestamp>  PASS"
diff --git a/AGENTS.md b/AGENTS.md
index a673d3c..1987ca8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,7 +22,7 @@ Prose dates: `MMM DD, YYYY: HH:MM AM/PM`. Filenames: `{MMM}_{DD}_{HH_MM}`.
 
 ## Changelog voice (Mintlify-style)
 
-Full rules in [`docs/CHANGELOG_VOICE.md`](./docs/CHANGELOG_VOICE.md). Summary: one headline per entry, no marketing words ("seamless"/"magical"/"powerful"/"robust" banned); lead paragraph states the change, not the announcement; bullets follow `**Bold lead-noun** — consequence-first clause`; internal cleanup gets aggressive trimming; never drop load-bearing facts (error codes, endpoints, env vars, schema names, money amounts); historical entries archived not rewritten; rate constants pinned to three files (`tenant_billing.zig`, `rates.ts`, `rates.mdx`).
+Routed by the `write_changelog` dispatch (`dispatch/write_changelog.md`); full rules in [`docs/CHANGELOG_VOICE.md`](./docs/CHANGELOG_VOICE.md). Summary: one headline per entry, no marketing words ("seamless"/"magical"/"powerful"/"robust" banned); lead paragraph states the change, not the announcement; bullets follow `**Bold lead-noun** — consequence-first clause`; internal cleanup gets aggressive trimming; never drop load-bearing facts (error codes, endpoints, env vars, schema names, money amounts); historical entries archived not rewritten; rate constants pinned to three files (`tenant_billing.zig`, `rates.ts`, `rates.mdx`).
 
 ## Confusion Management
 
@@ -52,7 +52,7 @@ Full rules in [`docs/CHANGELOG_VOICE.md`](./docs/CHANGELOG_VOICE.md). Summary: o
 - Releases: `gh release create`, `git push --tags`. `/ultrareview` (billed). CI/CD edits (`.github/workflows/**`, deploy configs).
 - Edits outside active spec's Files-Changed scope (no opportunistic cleanup bundling).
 - Cross-repo writes to `~/Projects/docs/` — own-branch flow per Operational defaults.
-- **Patching a harness/gate/hook to silence its hit.** When `audit-msid-ui.sh`, `lint-zig.py`, gitleaks, ZIG/FLL gates, or pre-commit/pre-push fire, the default is to **fix the violating code** — restructure, split, or use the gate's override comment. Editing the harness evades the rule it enforces; only on explicit per-session user direction naming the harness + reason. Handoff-doc "prior approvals" don't carry forward.
+- **Patching a harness/gate/hook to silence its hit.** When `msid-ui.sh`, `lint-zig.py`, gitleaks, ZIG/FLL gates, or pre-commit/pre-push fire, the default is to **fix the violating code** — restructure, split, or use the gate's override comment. Editing the harness evades the rule it enforces; only on explicit per-session user direction naming the harness + reason. Handoff-doc "prior approvals" don't carry forward.
 - Reverting changes the agent did not create. Branch mutation outside lifecycle transitions. Cross-worktree edits.
 - Unexpected changes in files you're editing → stop and ask; don't overwrite as stale.
 
@@ -63,7 +63,7 @@ Full rules in [`docs/CHANGELOG_VOICE.md`](./docs/CHANGELOG_VOICE.md). Summary: o
 - **Docs-repo edits on own branch.** `~/Projects/docs/` is shared across milestones. Before: `cd ~/Projects/docs && git status`; HEAD ≠ `main` → checkout `main` or `git worktree add` off `main`; commit on `chore/m{N}-{slug}-changelog`. Recovery: `git stash` (or patch + `git checkout .`), re-apply on fresh branch.
 - Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits.
 - Before commit/push: `gitleaks` must pass.
-- `*.zig` → read `docs/ZIG_RULES.md`; ZIG GATE fires. Auth-flow (`src/auth/**`, `ui/packages/app/lib/auth/**`, token-minting handlers, credential-typed spec dimensions): read `docs/AUTH.md` first.
+- `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires. Auth-flow (`src/auth/**`, `ui/packages/app/lib/auth/**`, token-minting handlers, credential-typed spec dimensions): read `docs/AUTH.md` first.
 - `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make check-pg-drain`. Use `conn.exec()` for no-rows.
 - Local Docker `ENOSPC`: `~/bin/mac-cleanup.sh`, verify `docker system df`, retry.
 - Cross-repo patterns under `$HOME/Projects/` (check before inventing): `marketplace_api` Python · `e2e-observability-platform` Rust · `cache-kit.rs` Rust · `docs` MDX · `usezombie` Zig/TS · `docs.megam.io` TS · `www.megam.io` TS · `rioos.megam.io` TS · `posthog-zig` Zig · `oss/bun` Zig · `oss/nullclaw` Zig · `oss/exonum` Rust · `oss/signoz` TS/Go · `dotfiles` Shell/MDX.
@@ -94,7 +94,7 @@ One per active stream. Stay inside; no edits outside, no reads from siblings. Me
 
 Guards fire pre-hoc regardless of lifecycle stage. Override: `<GATE>: SKIPPED per user override (reason: ...)` immediately preceding the edit — **user-invokable only** unless noted. Per-edit output is **one-line by default**; full block fires only on violation or new file. **HARNESS VERIFY is the determinism anchor** — pre-edit lines are early-warning ceremony.
 
-**Rule extension protocol** — when adding a new rules file (`docs/<TOPIC>_RULES.md`) or gate body (`docs/gates/<slug>.md`), all four steps land in the same diff: (1) row in EXECUTE doc-reads table; (2) ≥1 question in `AGENTS_INVARIANCE.md`; (3) path in `DOTFILES_RESIDENT` (audit script); (4) `make audit` ALL CHECKS PASSED. The Invariance Suite Gate fires; questionnaire all-YES + sign-off are mandatory before push.
+**Rule extension protocol** — when adding a new rules file (`docs/<TOPIC>_RULES.md`) or dispatch entry (`dispatch/<entry>.md`), all four steps land in the same diff: (1) row in EXECUTE doc-reads table; (2) ≥1 question in `audits/agents-md.md`; (3) path in `DOTFILES_RESIDENT` (audit script); (4) `make audit` ALL CHECKS PASSED. A new dispatch entry *also* lands in `REQUIRED_DISPATCH` (`audits/data.sh`) + a row in the dispatch table above, so `check_dispatch_parity` (disk == table == REQUIRED) stays green — step (4) is the backstop that bites if either is missed. The Invariance Suite Gate fires; questionnaire all-YES + sign-off are mandatory before push.
 
 **🚨 Gate-flag triage** — gate fires → **STOP, surface to Kishore.** NOT silence. NOT harness-patch. The gate exists to make the code better; silencing it forfeits the gain. The ask is structured:
 
@@ -107,32 +107,23 @@ Guards fire pre-hoc regardless of lifecycle stage. Override: `<GATE>: SKIPPED pe
 
 Kishore decides fix-or-defer. Agent does **NOT** unilaterally call a flag false-positive — even a one-line "obvious fix" goes through the ask.
 
-**Gate index — full details in each `docs/gates/<slug>.md` body. Read the body when the gate fires.** Trigger-surface extensions: `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.py`, `*.rs`, `*.go`, `*.sh`, `*.sql`.
+**Dispatch index — full rule prose in each `dispatch/<entry>.md` façade. Read the façade when its trigger fires.** Trigger-surface extensions: `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.py`, `*.rs`, `*.go`, `*.sh`, `*.sql`. Each entry is a **façade pair**: a latent `.md` (prose the agent reads) + a deterministic `.sh` (run by `audits/` + the git hooks) where the rule is mechanisable. Signal tags the `.sh` halves print: 🟢 pass · 🔴 fail · 🔵 judgment-only (no script decides — read the prose, call it) · ⚪ delegated to the product repo. The router below **is** the gate set — there is no separate `docs/gates/` directory.
 
 **Legacy-workaround family** — four rules together: **RULE NDC** (no dead code at write time, `docs/greptile-learnings/RULES.md`), **RULE NLR** (touch-it-fix-it cleanup), **RULE NLG** (no new legacy framing pre-`2.0.0`), **Legacy-Design Consult Guard** (user A/B/C consult before patching/keeping/testing legacy). Workarounds prohibited at authoring time, cleaned on touch, never silently retained.
 
-| # | Gate | Body | Trigger surface · Override |
-|---|---|---|---|
-| 1 | Invariance Suite Gate (meta) | `docs/gates/invariance-suite.md` | Edit to `AGENTS.md`, `AGENTS_INVARIANCE.md`, `docs/gates/`, `scripts/audit-agents-md.sh`, `scripts/fixtures/*.diff` · **no override** (user-only push: `SKIP_INVARIANCE_PUSH=1`). Body fires the audit + questionnaire + `.agents-invariance-signoff` write. |
-| 2 | RULE NLR | `docs/gates/nlr.md` | Edit to file with legacy framing / dead code (`?*T = null` no caller, `legacy_*`, `V2` twins, `if (legacy_caller)`, `// legacy` comments, `pub` no consumer) · `RULE NLR: SKIPPED per user override (reason: ...)` user-only. |
-| 3 | RULE NLG | `docs/gates/nlg.md` | New `legacy_*` / `V2` / compat shim / tracking-list while `cat VERSION` < `2.0.0` · `RULE NLG: SKIPPED per user override (reason: ...)` user-only. |
-| 4 | Legacy-Design Consult Guard | `docs/gates/legacy-design.md` | Patching legacy to fit new architecture; defensive `orelse` whose only reason is legacy nullability; tests for legacy path · **no override** — user A/B/C decision. |
-| 5 | Schema Table Removal Guard | `docs/gates/schema-removal.md` | Create/edit/delete `schema/*.sql`, edit `schema/embed.zig` / migration array, `DROP TABLE` / `ALTER TABLE` · `SCHEMA GUARD: SKIPPED per user override (reason: ...)`. |
-| 6 | File & Function Length Gate | `docs/gates/file-length.md` | Caps: file ≤ 350 · fn ≤ 50 · method ≤ 70. Net-adding lines to `.zig`/`.js`/`.ts`/`.tsx`/`.jsx`/`.py`/`.rs`/`.go`/`.sh`/`.sql`/`.yaml`/`.toml`. Exempt `vendor/`, `node_modules/`, `third_party/`, `.md` · `LENGTH GATE: SKIPPED per user override (reason: ...)`. |
-| 7 | Milestone-ID Gate | `docs/gates/milestone-id.md` | Saving source / config outside `docs/`. Regex `M[0-9]+_[0-9]+`, `§X.Y`, `T7`, `dim N.M` · `MILESTONE ID ALLOWED per user override (reason: ...)` in preceding comment. |
-| 8 | Architecture Consult & Update Gate | `docs/gates/architecture.md` | Naming a stream/channel/Redis namespace/queue/RPC/Postgres schema; describing a flow; mid-task architecture question — grep relevant `docs/architecture/` · **no override** — doc wins until reconciled. |
-| 9 | ZIG GATE | `docs/gates/zig.md` | `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/` (tests in scope) · `ZIG GATE: SKIPPED per user override (reason: ...)`. |
-| 10 | Pub Surface & Struct-Shape Gate | `docs/gates/pub-surface.md` | New `*.zig` under `src/`; threshold-cross (first pub type / first method-on-pub-free-fn-dominant / last pub free fn removed); **any new `^pub` line in new-bytes** (threshold list is a floor, not a ceiling) · `PUB GATE: SKIPPED per user override (reason: ...)`. **`FILE SHAPE DECISION` skip needs user's explicit ask this turn — auto-mode does NOT cover.** Consumer-grep delegated to `zlint`'s `unused-decls: error`; body enforces **shape verdict** + **no inheritance** (own verdict per surface; do not inherit sibling justifications). **Per-edit proof-line mandatory** (full block OR one-line `PUB GATE: skipped — <reason>`); silent gate-clean edits are violations. |
-| 11 | UI Component Substitution Gate | `docs/gates/ui-substitution.md` | `*.tsx`/`*.jsx` under `ui/packages/app/`. Raw HTML (`<section>`/`<button>`/`<input>`/`<article>`/`<dialog>`/`<dl>`/`<table>`/`<nav>`/`<header>`/`<form>`) → design-system primitive (`asChild` for HTML semantics) · `UI GATE: SKIPPED per user override (reason: ...)`. |
-| 12 | DESIGN TOKEN GATE | `docs/gates/design-token.md` | `*.tsx`/`*.jsx` under `ui/packages/app/` or `ui/packages/website/`. Blocks `*-[...]` arbitraries (`text-[Npx]`, `leading-[...]`, `tracking-[...]`, `max-w-[Npx|Nch]`, `text-[clamp(...)]`, raw palette) when token utility exists in `theme.css` · `// DESIGN TOKEN: SKIPPED per user override (reason: ...)` immediately preceding the line; auto-mode does NOT cover; reason must cite a concrete external constraint. |
-| 13 | UFS GATE | `docs/gates/ufs.md` | Source under `src/`, `ui/packages/*/`, `zombiectl/` matching `*.zig`/`*.ts`/`*.tsx`/`*.js`/`*.jsx`. Repeat string literals → named const; semantic numeric literals → named const; cross-runtime constants share identifier verbatim across Zig/TS/JS. Pin-test exception requires `// pin test: literal is the contract` · `UFS GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. |
-| 14 | GREPTILE GATE | `docs/gates/greptile.md` | (1) per-iteration when diff languages change; (2) end-of-turn before claiming complete. Read `docs/greptile-learnings/RULES.md` for any rule code referenced · `GREPTILE GATE: SKIPPED per user override (reason: ...)` — violations stay in PR Discovery. |
-| 15 | Verification Gate | `docs/gates/verification.md` | Before any "verified"/"tests pass"/"ready to merge"/"shipping"/"CHORE(close) ready" message. `make` canonical; package-scoped runners (`bun run test`, `vitest <file>`, `zig build test` w/o integration) **not** verification · `VERIFY GATE: <target> skipped per environment constraint (reason: ...)` only when genuinely unrunnable. |
-| 16 | LOGGING GATE | `docs/gates/logging.md` | Edit changing log emits in `*.zig`/`*.ts`/`*.tsx`/`*.js`/`*.jsx`/`*.sh` outside vendor/test/node_modules · `LOGGING GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. |
-| 17 | LIFECYCLE GATE | `docs/gates/lifecycle.md` | `*.zig` adding/reshaping `pub fn init|deinit|close|release|destroy|shutdown|dispose|free`, `errdefer`/`defer` adjacent to alloc, struct field holding heap/arena/handle · `LIFECYCLE GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. PUB + LIFECYCLE may both fire on `pub fn init` — print both. |
-| 18 | ERROR REGISTRY GATE | `docs/gates/error-registry.md` | Edit adding/modifying `error_code=UZ-XXX-NNN` in `src/**`/`zombiectl/**`, editing `src/errors/error_registry.zig`, or touching HTTP/executor/CLI error surfaces · `ERROR REGISTRY GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. Used-but-undeclared = blocking; declared-but-unreferenced = informational. |
-| 19 | SPEC TEMPLATE GATE | `docs/gates/spec-template.md` | Edit to spec under `docs/v*/{pending,active,done}/`, `docs/TEMPLATE.md`, or `*.md` with spec frontmatter · `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover; reason must cite concrete external constraint. |
-| 20 | DOC READ GATE | `docs/gates/doc-read.md` | Edit whose path matches an EXECUTE doc-reads-table row. Output `📖 DOC READ: <path>` proof-line per triggered doc, citing §N applied or skip-with-reason · `DOC READ: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. |
+| Trigger — when you… | Dispatch | Latent façade carries · override |
+|---|---|---|
+| write `*.zig` | `write_zig` | `dispatch/write_zig.md` — consolidated Zig discipline (ZIG / PUB / LIFECYCLE gates): memory safety, init/deinit lifecycle + `errdefer` placement, pub-surface shape verdict (`FILE SHAPE DECISION` skip needs user's explicit ask — auto-mode does NOT cover), tagged-union results, file ≤ 350 / fn ≤ 50 / method ≤ 70, cross-compile both linux targets · `ZIG GATE` / `PUB GATE` / `LIFECYCLE GATE: SKIPPED per user override (reason: ...)`. |
+| write `*.ts`/`*.tsx`/`*.js`/`*.jsx` | `write_ts_adhere_bun` | `dispatch/write_ts_adhere_bun.md` — consolidated Bun/TS discipline + UI Component Substitution + DESIGN TOKEN gates: TS FILE SHAPE DECISION at PLAN, `const`/import/Bun-primitive discipline, raw-HTML → design-system primitive, `*-[...]` arbitrary → token utility · `UI GATE` / `DESIGN TOKEN GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover; reason must cite a concrete external constraint. |
+| write `schema/*.sql` | `write_sql` | `dispatch/write_sql.md` — schema / migration rules + Schema Table Removal Guard (`DROP`/`ALTER` / `schema/embed.zig` / migration-array edits), STS/NSQ/SGR/ITF SQL rules · `SCHEMA GUARD: SKIPPED per user override (reason: ...)`. |
+| write **any** source file | `write_any` | `dispatch/write_any.md` — cross-cutting authoring invariants: File & Function Length, LOGGING, MILESTONE-ID (`M[0-9]+_[0-9]+`), ERROR REGISTRY (`UZ-XXX-NNN`), UFS named-constants, GREPTILE end-of-turn read, legacy-workaround family (NLR/NLG/Legacy-Design) · `LENGTH` / `LOGGING` / `MILESTONE ID` / `UFS GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover. |
+| write a spec under `docs/v*/…` | `write_spec` | `dispatch/write_spec.md` — required + prohibited spec sections (SPEC TEMPLATE GATE), `docs/TEMPLATE.md` shape · `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`; auto-mode does NOT cover; reason must cite concrete external constraint. |
+| write `src/http/handlers/**` / OpenAPI | `write_http` | `dispatch/write_http.md` — REST API design rules; reads `docs/REST_API_DESIGN_GUIDELINES.md` before · ⚪ delegated (product repo). |
+| write auth-flow / token-minting files | `write_auth` | `dispatch/write_auth.md` — auth invariants; reads the product repo's `docs/AUTH.md` before · ⚪ delegated (product repo). |
+| write a changelog `<Update>` (`changelog.mdx`) | `write_changelog` | `dispatch/write_changelog.md` — Mintlify-style changelog voice (one headline, no marketing words, `**Bold lead-noun**` bullets, load-bearing facts kept, history append-only); reads `docs/CHANGELOG_VOICE.md` · 🔵 judgment-only. |
+| claim "tests pass / ready / shipping" | `verify` | `dispatch/verify.md` — verification tiers (`make` canonical; package-scoped runners are **not** verification), done-message glyph format · 🔵 judgment-only, `VERIFY GATE: <target> skipped per environment constraint (reason: ...)` only when genuinely unrunnable. |
+| name a stream/channel/Redis namespace/queue/RPC/Postgres schema, or describe a flow | `name_architecture` | `dispatch/name_architecture.md` — architecture-consult discipline; grep relevant `docs/architecture/` (chat brainstorming counts) · **no override** — doc wins until reconciled. |
+| edit the governance (`AGENTS.md`, `dispatch/`, `audits/agents-md.sh`, the questionnaire) | `edit_rules` | `dispatch/edit_rules.md` — the meta-dispatch / Invariance Suite absorbed: runs `audits/agents-md.sh` + the `audits/agents-md.md` questionnaire + `.agents-invariance-signoff` write · **no override** from the agent (user-only push: `SKIP_INVARIANCE_PUSH=1`). |
 
 ---
 
@@ -176,7 +167,7 @@ Required: one-paragraph goal · explicit assumptions · file/task impact list ·
 
 ### EXECUTE
 
-**Doc reads by trigger:** see [`docs/EXECUTE_DOC_READS.md`](./docs/EXECUTE_DOC_READS.md) for the full trigger-to-doc mapping. Always re-read `docs/greptile-learnings/RULES.md` on sub-task shape change; spec's "Applicable Rules" list is canonical; missing rules — standard set is floor + surface omission. DOC READ GATE per edit; audit via `scripts/audit-doc-reads.sh`.
+**Doc reads by trigger:** see [`docs/EXECUTE_DOC_READS.md`](./docs/EXECUTE_DOC_READS.md) for the full trigger-to-doc mapping. Always re-read `docs/greptile-learnings/RULES.md` on sub-task shape change; spec's "Applicable Rules" list is canonical; missing rules — standard set is floor + surface omission. DOC READ GATE per edit — emit a `📖 DOC READ: <path>` proof-line per triggered doc, citing §N applied or skip-with-reason.
 
 Edit only approved scope; no opportunistic refactors. Stay in active worktree. Cross-repo writes to `~/Projects/docs/` need explicit per-session ask.
 
@@ -209,7 +200,7 @@ Required when spec involved — after last COMMIT, before PR. Also runs when par
 | # | When | Skill | What |
 |---|---|---|---|
 | 1 | VERIFY | `/write-unit-test` | Already ran — confirm clean. |
-| 2 | Before CHORE(close) commits | `/review` | Adversarial diff review vs spec, architecture, REST guide (HTTP), ZIG_RULES.md (Zig), Failure Modes/Invariants. Address or document deferrals. |
+| 2 | Before CHORE(close) commits | `/review` | Adversarial diff review vs spec, architecture, REST guide (HTTP), `dispatch/write_zig.md` (Zig), Failure Modes/Invariants. Address or document deferrals. |
 | 3 | After CHORE(close) + `gh pr create` | `/review-pr` | Comments via `gh pr review`. Address before human review/merge. |
 | 4 | After every push | `kishore-babysit-prs` | Polls greptile per cadence, walks every review id, triages P0/P1 vs RULES.md, fixes+replies+reschedules. Stops on two consecutive empty polls. Never `gh pr checks --watch` for greptile. |
 
diff --git a/Makefile b/Makefile
index 1079d04..f9ff237 100644
--- a/Makefile
+++ b/Makefile
@@ -1,28 +1,52 @@
-.PHONY: audit test-audit llmevals llmevals-check signoff
+.PHONY: audit test-audit llmevals signoff \
+        dispatch-coverage dispatch-evals dispatch-parity
 
-# Run the deterministic audit (script layer of the invariance suite).
+# Run the deterministic audit chain (all green):
+#   1. agents-md.sh          — AGENTS.md invariance + dispatch parity (script layer).
+#   2. dispatch-coverage.sh  — dispatch façade-pair coherence (6.3 + 6.4).
+#   3. evals/dispatch/run.sh — prose-pinned deterministic façade evals.
 audit:
-	@bash scripts/audit-agents-md.sh
+	@bash audits/agents-md.sh
+	@bash evals/dispatch/coverage.sh
+	@bash evals/dispatch/run.sh
+
+# Dispatch façade-pair coherence in isolation (tags ↔ checks ↔ fixtures ↔
+# probes ↔ leaf-helpers ↔ canonical gloss legend).
+dispatch-coverage:
+	@bash evals/dispatch/coverage.sh
+
+# Deterministic dispatch evals in isolation — pass+fail fixture per code.
+dispatch-evals:
+	@bash evals/dispatch/run.sh
 
 # Negative-test the audit itself — prove every check still FAILS on a bad
-# tree (conformance + determinism). Run whenever audit-agents-md.sh changes.
+# tree (conformance + determinism). Run whenever agents-md.sh changes.
 test-audit:
-	@bash scripts/test-audit-agents-md.sh
+	@bash evals/test-agents-md.sh
 
-# Cross-agent LLM eval signoff (AGENTS_INVARIANCE.md Scenario 23): each
+# Dispatch-parity proof — runs audits/parity-dispatch.sh against a model-B
+# sandbox (docs/gates/ empty, AGENTS.md dispatch table, 10 entries) and asserts
+# it goes green AND bites. agents-md.sh now sources the same check (check 9b);
+# this isolates + proves it against synthetic regressions.
+dispatch-parity:
+	@bash evals/test-dispatch-parity.sh
+
+# Cross-agent LLM eval signoff (audits/agents-md.md Scenario 23): each
 # installed agent (claude/codex/amp/opencode) answers the frozen golden-set;
 # verdicts graded by exact match. Live LLM calls — costs tokens on every
 # agent. Resumable (journalled); writes .agents-llmevals-signoff on
 # all-gradable-agents-pass.
+#
+# One entry point. The live run validates fixtures + reports availability as a
+# mandatory preamble (run.sh:188) before any spend. For the zero-token
+# dry path (CI / runner unavailable, Scenario 23.8) pass CHECK=1:
+#   make llmevals          — live graded run (costs tokens)
+#   make llmevals CHECK=1  — validate fixtures + availability only, no live calls
 llmevals:
-	@bash scripts/llmevals/run-llmevals.sh
-
-# Dry validation — fixtures well-formed + agent availability. No live calls.
-llmevals-check:
-	@bash scripts/llmevals/run-llmevals.sh --check
+	@bash evals/llms/run.sh $(if $(CHECK),--check)
 
 # Write the AGENTS_INVARIANCE sign-off file against current HEAD.
-# Only run this AFTER answering every AGENTS_INVARIANCE.md question with YES.
+# Only run this AFTER answering every audits/agents-md.md question with YES.
 # The pre-push hook reads .agents-invariance-signoff to allow contract pushes.
 signoff:
 	@printf '%s  %s  PASS\n' \
diff --git a/README.md b/README.md
index a85ed9d..3ff3c23 100644
--- a/README.md
+++ b/README.md
@@ -13,9 +13,40 @@ git config core.hooksPath .githooks    # arms pre-commit + pre-push (one-time, p
 The `core.hooksPath` line wires the AGENTS.md invariance suite into every
 commit and push from this clone. Without it, `.githooks/` is just files —
 git keeps using `.git/hooks/` (sample stubs only). Re-run on every fresh
-clone or worktree. See [AGENTS_INVARIANCE.md](AGENTS_INVARIANCE.md) for the
+clone or worktree. See [audits/agents-md.md](audits/agents-md.md) for the
 contract; run `make audit` any time to verify it by hand.
 
+## How the rules work (in plain terms)
+
+[`AGENTS.md`](AGENTS.md) is the rulebook every AI agent follows. Instead of one
+giant list, the rules are split by **what you're about to do** — and the agent is
+handed only the one page that applies.
+
+Think of it like a front desk: you say "I'm about to write some Zig," and it gives
+you exactly the Zig rules — not the whole binder. Each of those pages lives in
+[`dispatch/`](dispatch/), and where a rule can be checked by a machine, a small
+script runs it automatically.
+
+| If you're about to… | The agent reads… |
+|---|---|
+| write Zig | `dispatch/write_zig.md` |
+| write TypeScript / JavaScript | `dispatch/write_ts_adhere_bun.md` |
+| write SQL or a database schema | `dispatch/write_sql.md` |
+| write *any* code at all | `dispatch/write_any.md` |
+| write a spec / changelog / API / auth code | the matching `dispatch/write_*.md` |
+| say "it's done — tests pass" | `dispatch/verify.md` |
+| name a stream or design a flow | `dispatch/name_architecture.md` |
+| change the rules themselves | `dispatch/edit_rules.md` |
+
+One command — `make audit` — keeps the rulebook honest: it fails loudly if this
+list, the files on disk, and the agent's own checklist ever fall out of sync.
+
+> **Want the full story?** The *why* behind this design — the latent/deterministic
+> "façade pair" per topic, the 🟢/🔴/🔵/⚪ signal tags, the parity guarantees, and
+> the migration that produced it — is written up in detail in
+> [`docs/DISPATCH_ARCHITECTURE.md`](docs/DISPATCH_ARCHITECTURE.md). The exact,
+> machine-checked list of entries lives in [`audits/data.sh`](audits/data.sh).
+
 The instructions below assume you are in the `~/Projects/dotfiles` directory.
 
 ## Install
diff --git a/AGENTS_INVARIANCE.md b/audits/agents-md.md
similarity index 83%
rename from AGENTS_INVARIANCE.md
rename to audits/agents-md.md
index fe1b6e7..b245f57 100644
--- a/AGENTS_INVARIANCE.md
+++ b/audits/agents-md.md
@@ -2,7 +2,7 @@
 
 A two-layer ruleset that proves AGENTS.md still holds the line after edits:
 
-1. **Deterministic layer** — `scripts/audit-agents-md.sh` (mechanical, fast, runs in `pre-commit`).
+1. **Deterministic layer** — `audits/agents-md.sh` (mechanical, fast, runs in `pre-commit`).
 2. **Prompt-invariance layer** — this file. An LLM agent reads AGENTS.md and answers every question below. Every answer must be **YES**. A NO means the ruleset regressed.
 
 You run this suite **before** any AGENTS.md change AND **after** the change. Both runs must produce the same all-YES result. A pass that flips to NO is the precise definition of a broken invariant.
@@ -12,7 +12,7 @@ You run this suite **before** any AGENTS.md change AND **after** the change. Bot
 ## Step 1 — Run the deterministic script
 
 ```bash
-bash scripts/audit-agents-md.sh
+bash audits/agents-md.sh
 ```
 
 If exit ≠ 0, **STOP**. The script's `FAIL:` lines name the regression. Fix AGENTS.md first; do not proceed to Step 2 with a failing script.
@@ -61,7 +61,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.1 (UI) | For every `*.tsx`/`*.jsx` under `ui/packages/app/`, must raw HTML be substituted with a design-system primitive when one exists? | YES |
 | 4.1a (UI) | For every `*.tsx`/`*.jsx` under `ui/packages/{app,website}/`, does DESIGN TOKEN GATE block arbitrary `*-[...]` Tailwind classes (`text-[Npx]`, `leading-[...]`, `tracking-[...]`, `max-w-[Npx|Nch]`, `text-[clamp(...)]`, raw palette colours) when an equivalent token utility exists in `ui/packages/design-system/src/theme.css`? | YES |
 | 4.1b (UI) | Is the DESIGN TOKEN GATE override `// DESIGN TOKEN: SKIPPED per user override (reason: ...)` user-only — i.e. auto-mode does NOT cover it, and reasons must cite a concrete external constraint (not "looks the same" / "shorter to write")? | YES |
-| 4.1c (UI) | Does the project-side `scripts/audit-design-tokens.sh` audit run as part of `make lint` (`_website_lint` + `_app_lint`) and block on any arbitrary that has a token equivalent? (Default scope: full ui/packages working tree via `git ls-files` after M70 retired `--diff`.) | YES |
+| 4.1c (UI) | Does the project-side `audits/design-tokens.sh` audit run as part of `make lint` (`_website_lint` + `_app_lint`) and block on any arbitrary that has a token equivalent? (Default scope: full ui/packages working tree via `git ls-files` after M70 retired `--diff`.) | YES |
 | 4.2 (Zig) | For every `*.zig` Edit/Write outside `vendor/`/`third_party/`/`.zig-cache/`, does ZIG GATE fire? | YES |
 | 4.3 (Zig) | Must FILE SHAPE DECISION print before the first Write to a new `*.zig` under `src/` — and is that override **not** covered by auto-mode? | YES |
 | 4.4 (Zig) | Does PUB GATE delegate mechanical consumer-grep to `zlint`'s `unused-decls: error` rule (run by `make lint`), leaving the gate body to enforce shape verdict + no-inheritance + per-edit proof? | YES |
@@ -77,7 +77,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.8 (Shell) | Are shell scripts subject to the File & Function Length Gate (≤350 / ≤50 / ≤70)? | YES |
 | 4.9 (Shell) | Must `gitleaks` pass before any commit/push? | YES |
 | 4.10 (CI) | Are CI/CD edits (`.github/workflows/**`, deploy configs) **forbidden without explicit user approval** even in auto mode? | YES |
-| 4.11 (Bun) | For `*.ts`/`*.tsx`/`*.js`/`*.jsx` edits, does AGENTS.md require reading `docs/BUN_RULES.md` (TS FILE SHAPE DECISION at PLAN, const/import/Bun-primitive discipline)? | YES |
+| 4.11 (Bun) | For `*.ts`/`*.tsx`/`*.js`/`*.jsx` edits, does AGENTS.md route to `dispatch/write_ts_adhere_bun.md` (TS FILE SHAPE DECISION at PLAN, const/import/Bun-primitive discipline)? | YES |
 | 4.12 (Logging) | For every Edit/Write that adds/removes/changes a log emit (Zig `std.log.*`/`std.debug.print`/`obs.scoped`, TS/JS `console.*`/custom logger, shell `echo` to `&2`), does LOGGING GATE require reading `docs/LOGGING_STANDARD.md` and printing the per-edit gate block citing §3 (wire format) / §4 (severity) / §5 (error codes) / §6 (PII) / §10A (tightenings)? | YES |
 | 4.13 (Logging) | Is `std.debug.print` in non-test source AND `console.log` in `zombiectl/src/**` an automatic blocking violation, with no "temporary" carve-out? | YES |
 | 4.14 (Logging) | Must a new `error_code=UZ-XXX-NNN` reference land in the same commit as its registry entry in `src/errors/error_registry.zig` (used-but-undeclared = blocking)? | YES |
@@ -85,7 +85,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.16 (Lifecycle) | Is `defer X.free(Y)` + `errdefer X.free(Y)` on the same allocation in the same scope a blocking violation? | YES |
 | 4.17 (Lifecycle) | Must the LAST `errdefer` in init lexically precede the LAST allocation it protects (no batched-at-bottom errdefer)? | YES |
 | 4.18 (Spec template) | For every Edit/Write to a spec under `docs/v*/{pending,active,done}/` or to `docs/TEMPLATE.md`, does SPEC TEMPLATE GATE forbid time/effort estimates, complexity ratings, percentage-complete fields, owners, and dates (per `TEMPLATE.md` "Prohibited" section)? | YES |
-| 4.19 (Spec template) | Does `audit-spec-template.sh` run as part of `make lint` and block on prohibited-section regex matches? | YES |
+| 4.19 (Spec template) | Does `spec-template.sh` run as part of `make lint` and block on prohibited-section regex matches? | YES |
 | 4.20 (Doc read) | For every Edit/Write whose file pattern matches a row in the EXECUTE doc-reads table, does DOC READ GATE require a `📖 DOC READ: <path>` proof-line — either citing §N applied OR the cited-skip variant — before the edit? | YES |
 | 4.21 (Doc read) | Is the `📖 DOC READ:` proof-line required **per-edit** (not once per session, not once per file across multiple edits)? | YES |
 | 4.22 (Doc read) | Are auto-mode and "I read this earlier in the session" both invalid grounds to skip the proof-line? | YES |
@@ -125,7 +125,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 7.7 | Is merging/closing/ready-from-draft of another user's PR forbidden without explicit approval? | YES |
 | 7.8 | Does AGENTS.md require an Indy-acked verbatim quote (in PR Session Notes or the spec's Discovery section, format `> Indy (YYYY-MM-DD HH:MM): "<quote>"`) for any claim that a spec Section/Dimension was "deferred to follow-up" — and does an agent-unilateral deferral count as incomplete scope (not deferral), blocking CHORE(close) until either the item lands or the quote is captured? | YES |
 | 7.9 | Does AGENTS.md treat `HANDOFF.md` (or `HANDOFF_*.md` at any depth) as a faithful state report — i.e. must a pickup agent reading a HANDOFF that claims items were deferred without ack-quotes treat those items as in-scope and surface the contradiction to Kishore before continuing? | YES |
-| 7.10 (Architecture) | Does the Architecture Consult & Update Gate body (`docs/gates/architecture.md`) explicitly name "chat brainstorming counts" — i.e. multi-turn chat designing a new pattern fires the gate even before code touches, and capturing the brainstorm as a "punchlist task to land after the code ships" is forbidden (a pickup agent reading such a task must rewrite it to same-commit or doc-only-now)? | YES |
+| 7.10 (Architecture) | Does the `name_architecture` dispatch façade (`dispatch/name_architecture.md`) explicitly name "chat brainstorming counts" — i.e. multi-turn chat designing a new pattern fires the dispatch even before code touches, and capturing the brainstorm as a "punchlist task to land after the code ships" is forbidden (a pickup agent reading such a task must rewrite it to same-commit or doc-only-now)? | YES |
 
 ### Scenario 8 — Conducting `/write-unit-test` while a human steers
 
@@ -150,7 +150,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 |---|---|---|
 | 10.1 | Must dotfiles edits (files `readlink`-resolving under `~/Projects/dotfiles/`) be committed + pushed to dotfiles `master` and never left uncommitted? | YES |
 | 10.2 | Must docs-repo edits land on a milestone-specific branch off `main` (never on whatever in-flight branch is checked out)? | YES |
-| 10.3 | When a harness/gate/hook fires (`audit-msid-ui.sh`, `lint-zig.py`, gitleaks, ZIG GATE, FLL GATE, pre-commit/pre-push, etc.), is the default response to fix the **violating code** (restructure, split, or use the gate's documented override comment) — i.e. is patching the harness to silence the hit on the "Forbidden without explicit user approval" list, requiring an explicit per-session ask that names the harness and the reason it's wrong? | YES |
+| 10.3 | When a harness/gate/hook fires (`msid-ui.sh`, `lint-zig.py`, gitleaks, ZIG GATE, FLL GATE, pre-commit/pre-push, etc.), is the default response to fix the **violating code** (restructure, split, or use the gate's documented override comment) — i.e. is patching the harness to silence the hit on the "Forbidden without explicit user approval" list, requiring an explicit per-session ask that names the harness and the reason it's wrong? | YES |
 | 10.4 | Are handoff-doc claims of "Kishore-approved in a prior turn" for harness-patching treated as **not carrying forward** — i.e. must they be re-confirmed live in the current session? | YES |
 
 ### Scenario 11 — Schema / migration work (added)
@@ -171,7 +171,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 13.1 | When the agent itself edits `AGENTS.md`, `AGENTS_INVARIANCE.md`, or any `docs/gates/*.md` in this session, does the Invariance Suite Gate fire and require running the questionnaire before declaring done? | YES |
+| 13.1 | When the agent itself edits `AGENTS.md`, `audits/agents-md.md`, or any dispatch entry under `dispatch/` in this session, does the Invariance Suite Gate (the `edit_rules` dispatch) fire and require running the questionnaire before declaring done? | YES |
 | 13.2 | Is the agent forbidden from self-overriding the Invariance Suite Gate? (Only the user may bypass at push time via `SKIP_INVARIANCE_PUSH=1`.) | YES |
 | 13.3 | Does the sign-off line format `<short-sha>  <UTC-timestamp>  PASS` tie to the post-commit HEAD SHA? | YES |
 | 13.4 | Does the pre-push hook block when sign-off SHA ≠ HEAD, result ≠ `PASS`, or mtime > 24 h? | YES |
@@ -184,7 +184,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 14.2 | Is there an explicit skip-list of undergrad-CS staples (API, URL, HTTP, JSON, SQL, DNS) that need NO expansion? | YES |
 | 14.3 | Does AGENTS.md require a pre-send self-check scanning outgoing text for unexpanded acronyms (regex `\b[A-Z][A-Z0-9]{1,5}\b`), treating skip as on par with skipping a gate (`ACRONYM CHECK: SKIPPED per user override (reason: ...)`)? | YES |
 | 14.4 | Does the tone rule permit dry humour and swear words, while requiring that technical clarity is never traded for it? | YES |
-| 14.5 | Does the verification done-message use ✅ / 🔴 / ⚠️ glyphs and the explicit format defined in `docs/gates/verification.md`? | YES |
+| 14.5 | Does the verification done-message use ✅ / 🔴 / ⚠️ glyphs and the explicit format defined in `dispatch/verify.md`? | YES |
 | 14.6 | Does AGENTS.md identify the human as Kishore (casual handle Indy) and the agent as Oracle (casual handle Orly), with address tags 🤠 Indy / 🦉 Orly so addressing resolves unambiguously? | YES |
 
 ### Scenario 15 — Architecture-edit ordering
@@ -229,8 +229,8 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 20.1 | Does AGENTS.md document a "Rule extension protocol" requiring 4 same-diff steps when introducing a new rules file (`docs/<TOPIC>_RULES.md`) or gate body (`docs/gates/<slug>.md`)? | YES |
-| 20.2 | Does the protocol require: (a) doc-reads table row, (b) AGENTS_INVARIANCE.md question, (c) `DOTFILES_RESIDENT` audit entry, (d) `make audit` passing before commit? | YES |
+| 20.1 | Does AGENTS.md document a "Rule extension protocol" requiring 4 same-diff steps when introducing a new rules file (`docs/<TOPIC>_RULES.md`) or dispatch entry (`dispatch/<entry>.md`)? | YES |
+| 20.2 | Does the protocol require: (a) doc-reads table row, (b) audits/agents-md.md question, (c) `DOTFILES_RESIDENT` audit entry, (d) `make audit` passing before commit? | YES |
 | 20.3 | Does the Invariance Suite Gate fire on any commit landing the protocol's edits, with sign-off mandatory before push? | YES |
 
 ### Scenario 21 — Gate-flag triage discipline
@@ -245,10 +245,10 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 22.1 | When `make harness-verify` (the pre-commit ceremony) invokes `audit-ufs.sh`, `audit-design-tokens.sh`, `audit-deinit-pairs.sh`, `audit-error-codes.sh`, `audit-logging.sh`, or `audit-spec-template.sh`, do those scripts default to scanning the full working tree via `git ls-files` — so staged-but-not-yet-committed content is in scope? | YES |
-| 22.2 | Is the `--diff` (BASE...HEAD) mode of `audit-ufs.sh` and `audit-design-tokens.sh` retired — explicitly rejected with exit 2 and a pointer to the gate body? | YES |
-| 22.3 | Does `audit-msid-ui.sh` (renamed from `audit-combined.sh` after the PUB clause moved to zlint + agent chat-output discipline) remain the lone diff-shaped audit (still default `--staged`) — because its sub-checks (MS-ID / UI substitution) assert on *added* lines, not file state, and `git diff --cached` reads the index? | YES |
-| 22.4 | Does every gate body under `docs/gates/` for the converted scripts carry a "Scope (M70)" section documenting full-codebase semantics + the M68 `02c1f3cf` forcing function? | YES |
+| 22.1 | When `make harness-verify` (the pre-commit ceremony) invokes `ufs.sh`, `design-tokens.sh`, `deinit-pairs.sh`, `error-codes.sh`, `logging.sh`, or `spec-template.sh`, do those scripts default to scanning the full working tree via `git ls-files` — so staged-but-not-yet-committed content is in scope? | YES |
+| 22.2 | Is the `--diff` (BASE...HEAD) mode of `ufs.sh` and `design-tokens.sh` retired — explicitly rejected with exit 2 and a pointer to the gate body? | YES |
+| 22.3 | Does `msid-ui.sh` (renamed from `combined.sh` after the PUB clause moved to zlint + agent chat-output discipline) remain the lone diff-shaped audit (still default `--staged`) — because its sub-checks (MS-ID / UI substitution) assert on *added* lines, not file state, and `git diff --cached` reads the index? | YES |
+| 22.4 | Does every dispatch façade that absorbed a converted full-codebase leaf audit (`dispatch/write_any.md` ← logging/error-registry/UFS, `dispatch/write_ts_adhere_bun.md` ← design-token, `dispatch/write_zig.md` ← lifecycle/deinit, `dispatch/write_spec.md` ← spec-template) carry a "Scope (M70)" section documenting full-codebase semantics + the M68 `02c1f3cf` forcing function? | YES |
 
 ### Scenario 23 — Agent comprehension robustness (anti-hallucination, LLM-eval enforced)
 
@@ -260,14 +260,14 @@ The questions force *proof of reading* over *recall*.
 
 | # | Question | Expected |
 |---|---|---|
-| 23.1 | When answering a gate-specific question, must the agent quote the gate **body** (`docs/gates/<slug>.md`), not the one-line index summary — because the index is explicitly "a floor, not a ceiling" and paraphrasing the body is a hallucination risk? | YES |
+| 23.1 | When answering a rule-specific question, must the agent quote the dispatch **façade** (`dispatch/<entry>.md`), not the one-line dispatch-index summary — because the index is explicitly "a floor, not a ceiling" and paraphrasing the façade is a hallucination risk? | YES |
 | 23.2 | When a recalled memory, `CLAUDE.md` snippet, or prior-session note conflicts with the current `AGENTS.md`/gate body, must the agent defer to the file-on-disk and surface the conflict (recall is stale-by-default)? | YES |
 | 23.3 | Must override strings be reproduced **verbatim** (`<GATE>: SKIPPED per user override (reason: ...)`) and never paraphrased, since the harness matches the literal string? | YES |
 | 23.4 | When two rules fire on the same edit (e.g. PUB + LIFECYCLE on `pub fn init`, or a spec that contradicts a rule), must the agent apply **both**/escalate rather than silently picking one? | YES |
 | 23.5 | For an auto-mode / override question, must the agent trace the full conditional chain (auto-mode AND (active-spec OR start-instruction); action-triggered guards still block) rather than collapsing it to "auto mode = yes"? | YES |
-| 23.6 | Is the negative-test harness (`scripts/test-audit-agents-md.sh`) required to pass — proving each deterministic check still *bites* — whenever `scripts/audit-agents-md.sh` itself changes? | YES |
-| 23.7 | Is Scenario 23 enforced by a live, cross-agent LLM-eval runner (`scripts/llmevals/run-llmevals.sh`, `make llmevals`) that feeds the frozen golden-set (`scripts/llmevals/fixtures.jsonl`) to EVERY installed agent (claude, codex, amp, opencode) and grades each `VERDICT:` by exact match — with a per-agent threshold and absent agents logged, never silently skipped? | YES |
-| 23.8 | When the LLM-eval runner is unavailable (no agent CLIs) or the golden-set changes, is the dry validator `make llmevals-check` (fixtures well-formed + availability, no live calls) the minimum that must still pass? | YES |
+| 23.6 | Is the negative-test harness (`evals/test-agents-md.sh`) required to pass — proving each deterministic check still *bites* — whenever `audits/agents-md.sh` itself changes? | YES |
+| 23.7 | Is Scenario 23 enforced by a live, cross-agent LLM-eval runner (`evals/llms/run.sh`, `make llmevals`) that feeds the frozen golden-set (`evals/llms/fixtures.jsonl`) to EVERY installed agent (claude, codex, amp, opencode) and grades each `VERDICT:` by exact match — with a per-agent threshold and absent agents logged, never silently skipped? | YES |
+| 23.8 | When the LLM-eval runner is unavailable (no agent CLIs) or the golden-set changes, is the dry validator `make llmevals CHECK=1` (fixtures well-formed + availability, no live calls) the minimum that must still pass? | YES |
 
 ## LLM-eval layer (Scenario 23 enforcement)
 
@@ -275,14 +275,15 @@ The deterministic audit proves the rules are *present*; it cannot prove an
 agent *reading* them complies — the hallucination / won't-follow class. The
 LLM-eval layer closes that gap:
 
-- **Golden-set** — `scripts/llmevals/fixtures.jsonl`: frozen
+- **Golden-set** — `evals/llms/fixtures.jsonl`: frozen
   question → expected `YES`/`NO` verdict + the justifying rule, each targeting
   a known drift mode (index-vs-body paraphrase, override-string drift,
   conditional collapse, co-firing rules, negation blindness, stale recall,
   investigate-vs-authorize, no-override bans). YES/NO is balanced so a
   constant-answer strategy fails the threshold.
-- **Runner** — `scripts/llmevals/run-llmevals.sh` embeds AGENTS.md +
-  all gate bodies in every prompt (no tool use, no file-read variance), asks
+- **Runner** — `evals/llms/run.sh` embeds AGENTS.md +
+  the dispatch façades (`dispatch/*.md`) in every prompt (no
+  tool use, no file-read variance), asks
   each installed agent, and grades the single `VERDICT:` line by exact match.
   Resumable — each agent's verdict is journalled, so a re-run after an
   interruption replays finished agents instead of re-spending tokens.
@@ -319,7 +320,7 @@ AGENTS.md INVARIANCE REPORT — <commit sha> — <UTC timestamp>
 | Prompt (Q&A)     | <N>/<total> YES      |
 | Size             | <bytes> / <limit>    |
 
-Gates present:        <count> / 12       (list any missing)
+Dispatch entries:     <count> / 10       (list any missing)
 Rules referenced:     <count> / 13       (list any missing)
 Lifecycle stages:     <count> / 8        (CHORE(open), PLAN, EXECUTE, HARNESS VERIFY, VERIFY, DOCUMENT, COMMIT, CHORE(close))
 Always-forbidden:     <count> / 6        (list any missing)
@@ -350,7 +351,7 @@ OVERALL: PASS | FAIL — <reason if fail>
 
 ## Wiring it into `pre-commit`
 
-The dotfiles `.githooks/pre-commit` calls `scripts/audit-agents-md.sh` directly when AGENTS.md is in the staged set. This is fast, deterministic, and needs no LLM.
+The dotfiles `.githooks/pre-commit` calls `audits/agents-md.sh` directly when AGENTS.md is in the staged set. This is fast, deterministic, and needs no LLM.
 
 The Step-2 prompt-invariance run is **agent-invoked**, not hooked, because:
 
@@ -360,8 +361,8 @@ The Step-2 prompt-invariance run is **agent-invoked**, not hooked, because:
 
 Recommended workflow when you edit AGENTS.md:
 
-1. Run Step 1 (`bash scripts/audit-agents-md.sh`).
-2. Open this file in a Claude Code / Oracle / Codex session and instruct: *"Read AGENTS.md and answer every question in AGENTS_INVARIANCE.md."*
+1. Run Step 1 (`bash audits/agents-md.sh`).
+2. Open this file in a Claude Code / Oracle / Codex session and instruct: *"Read AGENTS.md and answer every question in audits/agents-md.md."*
 3. The agent emits the Step-3 report. All-YES → commit. Any NO → fix AGENTS.md first.
 
 If you want Step 2 enforced in `pre-push` rather than ad-hoc, see `.githooks/pre-push.example`.
@@ -372,9 +373,9 @@ If you want Step 2 enforced in `pre-push` rather than ad-hoc, see `.githooks/pre
 
 When the operating model grows (new gate, new rule, new lifecycle wrinkle):
 
-1. Add to `scripts/audit-agents-md.sh` if the invariant is mechanically checkable.
+1. Add to `audits/agents-md.sh` if the invariant is mechanically checkable.
 2. Add to this file as a new question if the invariant needs reading comprehension.
-3. Update `REQUIRED_GATES` / `HARNESS_KEYS` / `FORBIDDEN_KEYS` arrays in the script as appropriate.
+3. Update `REQUIRED_DISPATCH` / `HARNESS_KEYS` / `FORBIDDEN_KEYS` arrays in `audits/data.sh` as appropriate.
 4. Run both layers and check in the new baseline.
 
 The cost of this suite is bounded by these arrays. If they grow without bound, the suite is leaking complexity — split AGENTS.md before adding more invariants.
diff --git a/scripts/audit-agents-md.sh b/audits/agents-md.sh
similarity index 71%
rename from scripts/audit-agents-md.sh
rename to audits/agents-md.sh
index 1836da1..66caacc 100755
--- a/scripts/audit-agents-md.sh
+++ b/audits/agents-md.sh
@@ -10,8 +10,7 @@ set -uo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 AGENTS="$ROOT/AGENTS.md"
-FIXTURES="$ROOT/scripts/fixtures"
-GATES_DIR="$ROOT/docs/gates"
+FIXTURES="$ROOT/audits/fixtures"
 FAIL=0
 
 # Expectation tables (EXPECTED_LABELS, REQUIRED_GATES, EXTS, FORBIDDEN_KEYS,
@@ -19,9 +18,9 @@ FAIL=0
 # RULE_EXTENSION_STEPS, AWK_PROG) live in the sibling data file — split out
 # to keep this audit under the LENGTH GATE cap. Data drift is itself caught
 # by the gate-parity + named-scenario-parity checks below.
-DATA="$ROOT/scripts/audit-data.sh"
+DATA="$ROOT/audits/data.sh"
 [[ -f "$DATA" ]] || { echo "FAIL: $DATA missing (audit data tables)" >&2; exit 2; }
-# shellcheck source=scripts/audit-data.sh
+# shellcheck source=audits/data.sh
 . "$DATA"
 SEEN_LABELS=()
 
@@ -43,26 +42,19 @@ info "Auditing $AGENTS"
 [[ -f "$AGENTS" ]] || { echo "FAIL: $AGENTS missing" >&2; exit 2; }
 
 # ---------------------------------------------------------------------------
-# 1. Gate inventory — every named gate still exists (REQUIRED_GATES in data).
-# ---------------------------------------------------------------------------
-missing_gates=0
-for g in "${REQUIRED_GATES[@]}"; do
-  # The name must appear as the Gate COLUMN value of an index row — i.e.
-  # right after a "| " cell delimiter ("| <name>") — on a line that ALSO
-  # carries a docs/gates/ body reference. Rationale for each part:
-  #   * A file-wide substring match was too loose: the same row's override
-  #     text repeats the name (·`$g: SKIPPED…`) on the very line holding the
-  #     docs/gates/ path, so renaming the Gate column kept the check green.
-  #   * The "| " prefix anchors to the column cell; the override repetition
-  #     is preceded by a backtick, not "| ", so it no longer satisfies it.
-  #   * We do NOT require a trailing " |": row 1's cell carries a "(meta)"
-  #     suffix, and REQUIRED_GATES stores the bare name.
-  # (Both failure shapes are pinned by the negative harness; see
-  #  scripts/test-audit-agents-md.sh.)
-  grep -F "| $g" "$AGENTS" | grep -q 'docs/gates/' \
-    || { fail "gate missing from index: $g"; missing_gates=1; }
+# 1. Dispatch inventory — every dispatch entry (REQUIRED_DISPATCH in data) has
+#    a row in the AGENTS.md dispatch table, with the entry name as the table's
+#    SECOND column ("| <trigger> | `<entry>` | …"). This is the same column the
+#    parity check (check 9b) counts, so inventory and parity agree by
+#    construction — a renamed/dropped entry fails here AND there.
+# ---------------------------------------------------------------------------
+bt='`'   # backtick held in a var — keeps it explicit inside the regex
+missing_dispatch=0
+for e in "${REQUIRED_DISPATCH[@]}"; do
+  grep -qE "^\|[^|]*\| *${bt}${e}${bt} *\|" "$AGENTS" \
+    || { fail "dispatch entry missing from table: $e"; missing_dispatch=1; }
 done
-[[ $missing_gates -eq 0 ]] && pass "gate inventory (${#REQUIRED_GATES[@]} gates present in index)"
+[[ $missing_dispatch -eq 0 ]] && pass "dispatch inventory (${#REQUIRED_DISPATCH[@]} entries present in table)"
 
 # ---------------------------------------------------------------------------
 # 2. Trigger surface — every source/config language has a mention (EXTS in data).
@@ -134,7 +126,7 @@ done
 
 # ---------------------------------------------------------------------------
 # 8. Combined-audit smoke — the awk pass (AWK_PROG in data) flags real
-#    violations and ignores clean diffs. Fixtures live in scripts/fixtures/.
+#    violations and ignores clean diffs. Fixtures live in audits/fixtures/.
 # ---------------------------------------------------------------------------
 if [[ -f "$FIXTURES/dirty.diff" && -f "$FIXTURES/clean.diff" ]]; then
   # Fixture content fingerprint — guards against well-meaning rewrites
@@ -164,65 +156,38 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 9. Gate-body completeness — DERIVED, not hand-listed. The set of gate
-#    bodies is computed from disk; each must carry the three structural
-#    markers (Triggers, Override, 🚧 H1) AND be referenced by AGENTS.md.
-#    A hand-maintained array was the root cause of UFS/DESIGN-TOKEN drift
-#    (bodies on disk + in the AGENTS.md index, but absent from the array,
-#    so the audit silently skipped them). Deriving removes that failure mode.
-# ---------------------------------------------------------------------------
-mapfile -t GATE_FILES < <(cd "$ROOT" && ls docs/gates/*.md 2>/dev/null | sort)
-gate_body_fail=0
-if [[ ${#GATE_FILES[@]} -eq 0 ]]; then
-  fail "no gate bodies found under docs/gates/"; gate_body_fail=1
-fi
-for gf in "${GATE_FILES[@]}"; do
-  full="$ROOT/$gf"
-  grep -qE '^\*\*Triggers' "$full"   || { fail "$gf missing **Triggers** marker"; gate_body_fail=1; }
-  grep -qE '^\*\*Override' "$full"   || { fail "$gf missing **Override** marker"; gate_body_fail=1; }
-  grep -qE '^# 🚧 '          "$full" || { fail "$gf missing 🚧 shield in H1";    gate_body_fail=1; }
-  # AGENTS.md must point at this gate body (no orphan body on disk).
-  grep -qF "$gf" "$AGENTS"           || { fail "AGENTS.md does not reference $gf (orphan gate body)"; gate_body_fail=1; }
-done
-[[ $gate_body_fail -eq 0 ]] && pass "gate bodies complete (${#GATE_FILES[@]} files derived from disk, each with Triggers + Override + 🚧 + AGENTS.md ref)"
-
-# ---------------------------------------------------------------------------
-# 9b. Gate parity — the three sources of truth must agree in size, so adding
-#     a gate to one place but forgetting another is a hard FAIL:
-#       (a) gate-index rows in AGENTS.md (lines carrying a docs/gates/ ref),
-#       (b) gate bodies on disk,
-#       (c) the REQUIRED_GATES name array (check #1).
-#     Also: every docs/gates/ path the AGENTS.md index names must exist on
-#     disk (no dangling pointer). This is the structural backstop that the
-#     hand-list let slip — it makes "wire it everywhere or fail" mechanical.
-# ---------------------------------------------------------------------------
-parity_fail=0
-index_rows=$(grep -cE '^\| *[0-9]+ .*docs/gates/[a-z0-9-]+\.md' "$AGENTS")
-disk_count=${#GATE_FILES[@]}
-required_count=${#REQUIRED_GATES[@]}
-if [[ "$index_rows" -ne "$disk_count" || "$disk_count" -ne "$required_count" ]]; then
-  fail "gate parity mismatch: AGENTS.md index rows=$index_rows, disk bodies=$disk_count, REQUIRED_GATES=$required_count (all three must match)"
-  parity_fail=1
+# 9b. Dispatch parity — the three sources of truth must agree: dispatch/*.md
+#     bodies on disk, dispatch-table rows in AGENTS.md, and REQUIRED_DISPATCH
+#     (check #1). The check also asserts docs/gates/ is EMPTY — the dissolved-
+#     gate end state — so a half-done switchover (a leftover card) hard-fails.
+#     The logic lives in the sibling parity-dispatch.sh so the model-B sandbox
+#     test (evals/test-dispatch-parity.sh) can exercise it in isolation; this
+#     keeps the body completeness + existence guarantee that the old per-card
+#     gate-body check used to provide (each REQUIRED_DISPATCH entry must resolve
+#     to a real dispatch/<entry>.md).
+# ---------------------------------------------------------------------------
+. "$ROOT/audits/parity-dispatch.sh"
+parity_out=$(check_dispatch_parity "$ROOT"); parity_rc=$?
+if [[ $parity_rc -eq 0 ]]; then
+  pass "dispatch parity ${parity_out#PASS: dispatch parity }"
+else
+  printf '%s\n' "$parity_out" >&2
+  fail "dispatch parity mismatch (see FAIL lines above)"
 fi
-# Every index-named body path resolves to a real file.
-while IFS= read -r ref; do
-  [[ -f "$ROOT/$ref" ]] || { fail "AGENTS.md gate index references missing body: $ref"; parity_fail=1; }
-done < <(grep -oE 'docs/gates/[a-z0-9-]+\.md' "$AGENTS" | sort -u)
-[[ $parity_fail -eq 0 ]] && pass "gate parity (index=$index_rows ↔ disk=$disk_count ↔ REQUIRED_GATES=$required_count, all index refs resolve)"
 
 # ---------------------------------------------------------------------------
-# 10. AGENTS_INVARIANCE.md presence + basic shape (questionnaire layer).
+# 10. audits/agents-md.md presence + basic shape (questionnaire layer).
 # ---------------------------------------------------------------------------
-INV="$ROOT/AGENTS_INVARIANCE.md"
+INV="$ROOT/audits/agents-md.md"
 if [[ -f "$INV" ]]; then
   inv_scenarios=$(grep -cE '^### Scenario [0-9]+' "$INV")
   if [[ $inv_scenarios -ge 8 ]]; then
-    pass "AGENTS_INVARIANCE.md present ($inv_scenarios scenarios)"
+    pass "audits/agents-md.md present ($inv_scenarios scenarios)"
   else
-    fail "AGENTS_INVARIANCE.md only $inv_scenarios scenarios — expected ≥ 8"
+    fail "audits/agents-md.md only $inv_scenarios scenarios — expected ≥ 8"
   fi
 else
-  fail "AGENTS_INVARIANCE.md missing"
+  fail "audits/agents-md.md missing"
 fi
 
 # ---------------------------------------------------------------------------
@@ -235,33 +200,33 @@ done
 [[ $missing_stages -eq 0 ]] && pass "lifecycle stages (${#LIFECYCLE_HEADERS[@]} headers present)"
 
 # ---------------------------------------------------------------------------
-# 12. AGENTS_INVARIANCE.md — named scenarios must exist by title
+# 12. audits/agents-md.md — named scenarios must exist by title
 #     (NAMED_SCENARIOS in data). Catches the case where a scenario count
 #     stays ≥ threshold but a specific high-value scenario is renamed/removed.
 # ---------------------------------------------------------------------------
-INV="$ROOT/AGENTS_INVARIANCE.md"
+INV="$ROOT/audits/agents-md.md"
 missing_scenarios=0
 if [[ -f "$INV" ]]; then
   for s in "${NAMED_SCENARIOS[@]}"; do
-    grep -qF "$s" "$INV" || { fail "AGENTS_INVARIANCE.md missing scenario keyword: $s"; missing_scenarios=1; }
+    grep -qF "$s" "$INV" || { fail "audits/agents-md.md missing scenario keyword: $s"; missing_scenarios=1; }
   done
   # Parity — the keyword array must keep pace with the actual scenario count,
   # so a newly-added scenario can't sit unguarded (this is exactly how
   # scenarios 20-22 slipped past the keyword list before this check existed).
   actual_scenarios=$(grep -cE '^### Scenario [0-9]+' "$INV")
   if [[ "${#NAMED_SCENARIOS[@]}" -ne "$actual_scenarios" ]]; then
-    fail "named-scenario parity: array has ${#NAMED_SCENARIOS[@]} keywords but AGENTS_INVARIANCE.md has $actual_scenarios scenarios (every scenario needs a keyword guard)"
+    fail "named-scenario parity: array has ${#NAMED_SCENARIOS[@]} keywords but audits/agents-md.md has $actual_scenarios scenarios (every scenario needs a keyword guard)"
     missing_scenarios=1
   fi
   [[ $missing_scenarios -eq 0 ]] && pass "named scenarios (${#NAMED_SCENARIOS[@]} keywords ↔ $actual_scenarios scenarios, parity holds)"
 else
-  fail "AGENTS_INVARIANCE.md missing"
+  fail "audits/agents-md.md missing"
 fi
 
 # ---------------------------------------------------------------------------
 # 13. Hook trigger coverage — pre-commit AND pre-push must reference
-#     AGENTS.md AND docs/gates so ruleset changes can never silently
-#     bypass either layer.
+#     AGENTS.md AND dispatch/ so ruleset changes can never silently
+#     bypass either layer (dispatch/ replaces the dissolved docs/gates/).
 # ---------------------------------------------------------------------------
 PRE_COMMIT="$ROOT/.githooks/pre-commit"
 PRE_PUSH="$ROOT/.githooks/pre-push"
@@ -272,9 +237,9 @@ for hook in "$PRE_COMMIT" "$PRE_PUSH"; do
     fail "hook missing: .githooks/$name"; hook_fail=1; continue
   fi
   grep -qF "AGENTS.md"  "$hook" || { fail "$name missing AGENTS.md trigger reference"; hook_fail=1; }
-  grep -qF "docs/gates" "$hook" || { fail "$name missing docs/gates trigger reference"; hook_fail=1; }
+  grep -qF "dispatch/"  "$hook" || { fail "$name missing dispatch/ trigger reference"; hook_fail=1; }
 done
-[[ $hook_fail -eq 0 ]] && pass "hook triggers (.githooks/pre-commit + pre-push both gate AGENTS.md + docs/gates)"
+[[ $hook_fail -eq 0 ]] && pass "hook triggers (.githooks/pre-commit + pre-push both gate AGENTS.md + dispatch/)"
 
 # ---------------------------------------------------------------------------
 # 14. Rule extension protocol — AGENTS.md MUST document the 4-step recipe
diff --git a/scripts/audit-cross-tier-rates.sh b/audits/cross-tier-rates.sh
similarity index 97%
rename from scripts/audit-cross-tier-rates.sh
rename to audits/cross-tier-rates.sh
index 259134e..dd1c9ee 100755
--- a/scripts/audit-cross-tier-rates.sh
+++ b/audits/cross-tier-rates.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# audit-cross-tier-rates.sh — pin numeric parity of the four rate constants
+# cross-tier-rates.sh — pin numeric parity of the four rate constants
 # across Zig + three TypeScript surfaces.
 #
 # RULE UFS extension. The shipped billing surface depends on three constants
diff --git a/scripts/audit-data.sh b/audits/data.sh
similarity index 66%
rename from scripts/audit-data.sh
rename to audits/data.sh
index bb2665a..1d7a4ec 100644
--- a/scripts/audit-data.sh
+++ b/audits/data.sh
@@ -1,18 +1,18 @@
 # shellcheck shell=bash
-# Data tables for scripts/audit-agents-md.sh — the expectation lists every
+# Data tables for audits/agents-md.sh — the expectation lists every
 # check asserts against, plus the combined-audit awk program. Split out of
-# the main audit (LENGTH GATE: keeps audit-agents-md.sh under the 350-line
+# the main audit (LENGTH GATE: keeps agents-md.sh under the 350-line
 # cap; data and logic separate cleanly). Sourced, never executed directly.
 #
-# Adding a gate/scenario/rule? Update the matching array HERE; the audit's
-# gate-parity + named-scenario-parity checks fail loudly if a table drifts
-# out of sync with AGENTS.md / docs/gates / AGENTS_INVARIANCE.md.
+# Adding a dispatch entry/scenario/rule? Update the matching array HERE; the
+# audit's dispatch-parity + named-scenario-parity checks fail loudly if a table
+# drifts out of sync with AGENTS.md / dispatch/ / audits/agents-md.md.
 
 # Self-fingerprint — every label here MUST be emitted by a pass/fail call in
 # the audit. Deleting a check without updating this list trips the final
 # self-fingerprint check. This is the script auditing itself.
 EXPECTED_LABELS=(
-  "gate inventory"
+  "dispatch inventory"
   "trigger surface"
   "override syntax"
   "always-forbidden list"
@@ -21,9 +21,8 @@ EXPECTED_LABELS=(
   "cross-references"
   "audit fixture: dirty diff"
   "audit fixture: clean diff"
-  "gate bodies complete"
-  "gate parity"
-  "AGENTS_INVARIANCE.md present"
+  "dispatch parity"
+  "audits/agents-md.md present"
   "lifecycle stages"
   "named scenarios"
   "hook triggers"
@@ -32,17 +31,16 @@ EXPECTED_LABELS=(
   "size"
 )
 
-# Check 1 — every named gate must appear as an index-table row.
-REQUIRED_GATES=(
-  "Invariance Suite Gate"
-  "RULE NLR" "RULE NLG" "Legacy-Design Consult Guard"
-  "Schema Table Removal Guard" "File & Function Length Gate"
-  "Milestone-ID Gate" "Architecture Consult & Update Gate"
-  "ZIG GATE" "Pub Surface & Struct-Shape Gate"
-  "UI Component Substitution Gate" "DESIGN TOKEN GATE" "UFS GATE"
-  "GREPTILE GATE" "Verification Gate"
-  "LOGGING GATE" "LIFECYCLE GATE" "ERROR REGISTRY GATE"
-  "SPEC TEMPLATE GATE" "DOC READ GATE"
+# Check 1 (dispatch inventory) + check 9b (dispatch parity) — the 10 dispatch
+# entries that replaced the 20 dissolved gate cards. Source of truth for both
+# the inventory loop in agents-md.sh and check_dispatch_parity
+# (audits/parity-dispatch.sh). Each name has a dispatch/<name>.md and a row in
+# the AGENTS.md dispatch table (entry name in the 2nd column). Keep 1:1 with
+# dispatch/*.md.
+REQUIRED_DISPATCH=(
+  "write_zig" "write_ts_adhere_bun" "write_sql" "write_any"
+  "write_spec" "write_http" "write_auth" "write_changelog"
+  "verify" "name_architecture" "edit_rules"
 )
 
 # Check 2 — every source/config language has at least one mention.
@@ -66,15 +64,28 @@ HARNESS_KEYS=(
   "Architecture consult"
 )
 
-# Check 7 — dotfiles-resident docs referenced by AGENTS.md must exist on disk.
+# Check 7 — dotfiles-resident docs + dispatch façades referenced by AGENTS.md
+# must exist on disk. The per-language Zig/Bun standards docs were dropped —
+# dissolved into dispatch/write_zig.md and dispatch/write_ts_adhere_bun.md
+# respectively. The dispatch façades are listed so the AGENTS.md dispatch-table
+# refs are checked.
 DOTFILES_RESIDENT=(
   "docs/TEMPLATE.md"
   "docs/REST_API_DESIGN_GUIDELINES.md"
-  "docs/ZIG_RULES.md"
-  "docs/BUN_RULES.md"
   "docs/LOGGING_STANDARD.md"
   "docs/LIFECYCLE_PATTERNS.md"
   "docs/greptile-learnings/RULES.md"
+  "dispatch/write_zig.md"
+  "dispatch/write_ts_adhere_bun.md"
+  "dispatch/write_sql.md"
+  "dispatch/write_any.md"
+  "dispatch/write_spec.md"
+  "dispatch/write_http.md"
+  "dispatch/write_auth.md"
+  "dispatch/write_changelog.md"
+  "dispatch/verify.md"
+  "dispatch/name_architecture.md"
+  "dispatch/edit_rules.md"
 )
 
 # Check 11 — every lifecycle stage header is present in AGENTS.md.
@@ -90,7 +101,7 @@ LIFECYCLE_HEADERS=(
 )
 
 # Check 12 — each scenario must exist by keyword; array size must equal the
-# actual scenario count (parity). Keep this list 1:1 with AGENTS_INVARIANCE.md.
+# actual scenario count (parity). Keep this list 1:1 with audits/agents-md.md.
 NAMED_SCENARIOS=(
   "New spec"                 # Scenario 1
   "Brainstorming"            # Scenario 2
@@ -118,7 +129,7 @@ NAMED_SCENARIOS=(
 )
 
 # Check 14 — the Rule-extension protocol must enumerate all four wiring steps.
-RULE_EXTENSION_STEPS=( "doc-reads" "AGENTS_INVARIANCE.md" "DOTFILES_RESIDENT" "make audit" )
+RULE_EXTENSION_STEPS=( "doc-reads" "audits/agents-md.md" "DOTFILES_RESIDENT" "make audit" )
 
 # Check 8 — combined-audit smoke: flags MS-ID / PUB / UI violations in a diff.
 read -r -d '' AWK_PROG <<'AWKEOF' || true
diff --git a/scripts/audit-deinit-pairs.sh b/audits/deinit-pairs.sh
similarity index 97%
rename from scripts/audit-deinit-pairs.sh
rename to audits/deinit-pairs.sh
index 4c9a816..7135fd7 100755
--- a/scripts/audit-deinit-pairs.sh
+++ b/audits/deinit-pairs.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# audit-deinit-pairs.sh — verify init/deinit pairing for Zig structs.
+# deinit-pairs.sh — verify init/deinit pairing for Zig structs.
 #
-# Gate body: docs/gates/lifecycle.md
+# Dispatch façade: dispatch/write_zig.md (lifecycle / LIFECYCLE GATE)
 # Standalone tool — not wired into make lint or pre-commit (per Indy's
 # direction, gates fire pre-emptively via printed proof-blocks during
 # agent work; lint integration is intentionally absent).
@@ -217,7 +217,7 @@ fi
 # ---------------------------------------------------------------------------
 ok "scanned $files_scanned files; $inits_total init methods ($inits_value_type value-type, $inits_requires_cleanup require cleanup, $inits_unpaired unpaired)"
 if [[ $FAIL -ne 0 ]]; then
-  printf "\n🔴 LIFECYCLE GATE: violations found. See docs/gates/lifecycle.md.\n" >&2
+  printf "\n🔴 LIFECYCLE GATE: violations found. See dispatch/write_zig.md (lifecycle).\n" >&2
   exit 1
 fi
 ok "LIFECYCLE GATE: clean"
diff --git a/scripts/audit-design-tokens.sh b/audits/design-tokens.sh
similarity index 94%
rename from scripts/audit-design-tokens.sh
rename to audits/design-tokens.sh
index 6916db1..3d03ba4 100755
--- a/scripts/audit-design-tokens.sh
+++ b/audits/design-tokens.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-# audit-design-tokens.sh — enforce design-system token discipline across
+# design-tokens.sh — enforce design-system token discipline across
 # ui/packages/{app,website}/**/*.tsx.
 #
-# Gate body: docs/gates/design-token.md
+# Dispatch façade: dispatch/write_ts_adhere_bun.md (Design Tokens / DESIGN TOKEN GATE)
 # Fires in: HARNESS VERIFY (via `make harness-verify`).
 #
 # Rejects arbitrary Tailwind classes when an equivalent design-system
@@ -88,7 +88,7 @@ case "$MODE" in
     ;;
   *)
     echo "usage: $0 [--all|--staged]" >&2
-    echo "note: --diff was retired in M70 — see docs/gates/design-token.md (Scope)." >&2
+    echo "note: --diff was retired in M70 — see dispatch/write_ts_adhere_bun.md (Design Tokens → Scope)." >&2
     exit 2 ;;
 esac
 
@@ -139,5 +139,5 @@ echo "FAIL: design-token discipline ($FILES_WITH_VIOLATIONS file(s) with violati
 echo "      Replace each match with the suggested token utility, or add the inline override:"
 echo "        // DESIGN TOKEN: SKIPPED per user override (reason: <concrete reason>)"
 echo "      Token source: ui/packages/design-system/src/theme.css"
-echo "      Rule body:    docs/gates/design-token.md (proposed)"
+echo "      Rule body:    dispatch/write_ts_adhere_bun.md (Design Tokens)"
 exit 1
diff --git a/scripts/audit-error-codes.sh b/audits/error-codes.sh
similarity index 98%
rename from scripts/audit-error-codes.sh
rename to audits/error-codes.sh
index 632ba6d..04de0b1 100755
--- a/scripts/audit-error-codes.sh
+++ b/audits/error-codes.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# audit-error-codes.sh — orphan + dead code detection against the canonical
+# error-codes.sh — orphan + dead code detection against the canonical
 # error registry at src/zombied/errors/error_registry.zig, plus a raw-literal check
 # enforcing that UZ-<CAT>-<NNN> strings only appear in registry/allowlist
 # files (every other call site must reference the registry symbol).
 #
-# Gate body: docs/gates/error-registry.md
+# Dispatch façade: dispatch/write_any.md (Error Registry Gate)
 # Fires in: HARNESS VERIFY (via `make harness-verify`).
 #
 # TECHNICAL DEBT (acknowledged on migration to dotfiles, 2026-05-11):
diff --git a/scripts/fixtures/clean.diff b/audits/fixtures/clean.diff
similarity index 100%
rename from scripts/fixtures/clean.diff
rename to audits/fixtures/clean.diff
diff --git a/scripts/fixtures/dirty.diff b/audits/fixtures/dirty.diff
similarity index 100%
rename from scripts/fixtures/dirty.diff
rename to audits/fixtures/dirty.diff
diff --git a/scripts/audit-logging.sh b/audits/logging.sh
similarity index 95%
rename from scripts/audit-logging.sh
rename to audits/logging.sh
index 3925a77..f45d40d 100755
--- a/scripts/audit-logging.sh
+++ b/audits/logging.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# audit-logging.sh — flag log-emit drift against LOGGING_STANDARD.md.
+# logging.sh — flag log-emit drift against LOGGING_STANDARD.md.
 #
-# Gate body: docs/gates/logging.md
+# Dispatch façade: dispatch/write_any.md (Logging Gate)
 # Fires in: HARNESS VERIFY (via `make harness-verify`).
 #
 # TECHNICAL DEBT (acknowledged on migration to dotfiles, 2026-05-11):
@@ -135,7 +135,7 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
     FNR == 1 { in_test = 0 }
     /^test "/ { in_test = 1; next }
     /^}/ { in_test = 0; next }
-    /\bstd\.debug\.print\(/ { if (!in_test) printf "%s:%d\n", FILENAME, FNR }
+    /(^|[^A-Za-z0-9_])std\.debug\.print\(/ { if (!in_test) printf "%s:%d\n", FILENAME, FNR }
   ' "${zig_nontest[@]}")
 fi
 
@@ -149,7 +149,7 @@ if [[ ${#js_nontest[@]} -gt 0 ]]; then
     f="${match%%:*}"
     rest="${match#*:}"
     ln="${rest%%:*}"
-    fail "$f:$ln — \`console.*\` in non-test source (BUN_RULES §10, LOGGING_STANDARD §8)"
+    fail "$f:$ln — \`console.*\` in non-test source (write_ts_adhere_bun.md §10, LOGGING_STANDARD §8)"
     console_hits=$((console_hits + 1))
   done < <(grep -nHE '\bconsole\.(log|debug|info|warn|error)\(' "${js_nontest[@]}" 2>/dev/null || true)
 fi
@@ -209,7 +209,7 @@ fi
 # ---------------------------------------------------------------------------
 ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
 if [[ $FAIL -ne 0 ]]; then
-  printf "\n🔴 LOGGING GATE: blocking violations. See docs/gates/logging.md.\n" >&2
+  printf "\n🔴 LOGGING GATE: blocking violations. See dispatch/write_any.md (Logging Gate).\n" >&2
   exit 1
 fi
 [[ $INFO_COUNT -gt 0 ]] && note "$INFO_COUNT informational findings; not blocking. Use --strict to enforce."
diff --git a/scripts/audit-msid-ui.sh b/audits/msid-ui.sh
similarity index 91%
rename from scripts/audit-msid-ui.sh
rename to audits/msid-ui.sh
index 54a3a3d..a89717c 100755
--- a/scripts/audit-msid-ui.sh
+++ b/audits/msid-ui.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# audit-msid-ui.sh — single awk pass over the diff, running the two
+# msid-ui.sh — single awk pass over the diff, running the two
 # discipline checks that share a regex pass (MS-ID + UI substitution).
-# Previously `audit-combined.sh`; renamed once the PUB clause moved to
+# Previously `combined.sh`; renamed once the PUB clause moved to
 # zlint + agent chat-output discipline (see commit history).
 #
 # Emits per-line hits for:
@@ -15,7 +15,7 @@
 #
 # Note on PUB:
 #   This script no longer flags `pub` declarations. The PUB GATE
-#   (docs/gates/pub-surface.md) has two mechanical enforcers and one
+#   (dispatch/write_zig.md, pub-surface) has two mechanical enforcers and one
 #   human one; this script was a fourth, redundant layer:
 #     * Orphan check ("is anyone using this pub?") → zlint's
 #       `unused-decls: error` rule, run by `make lint` later in the
@@ -58,10 +58,10 @@
 #   --diff              diff against origin/main (vs BASE...HEAD)
 #             — used by `make harness-verify-all` periodic deep audit
 #
-# Gate bodies:
-#   docs/gates/milestone-id.md
-#   docs/gates/ui-substitution.md
-#   docs/gates/pub-surface.md  (handled by zlint + agent chat output, not this script)
+# Dispatch façades:
+#   dispatch/write_any.md (Milestone-ID Gate)
+#   dispatch/write_ts_adhere_bun.md (UI Component Substitution)
+#   dispatch/write_zig.md (pub-surface)  (handled by zlint + agent chat output, not this script)
 
 set -euo pipefail
 
@@ -105,7 +105,7 @@ hits=$($DIFF_CMD | awk '
     if (!ms_id_override &&
         f ~ /\.(zig|sql|ts|tsx|js|jsx|py|rs|go|sh|toml|yaml|json)$/ &&
         f !~ /^(docs|node_modules|vendor|third_party)\//) {
-      if (match(line, /M[0-9]+_[0-9]+|§[0-9]+(\.[0-9]+)+|\bT[0-9]+\b|\bdim [0-9]+\.[0-9]+\b/)) {
+      if (match(line, /M[0-9]+_[0-9]+|§[0-9]+(\.[0-9]+)+|(^|[^A-Za-z0-9_])T[0-9]+([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_])dim [0-9]+\.[0-9]+([^A-Za-z0-9_]|$)/)) {
         print "MS-ID  " f ": " line
       }
     }
diff --git a/audits/parity-dispatch.sh b/audits/parity-dispatch.sh
new file mode 100755
index 0000000..083674c
--- /dev/null
+++ b/audits/parity-dispatch.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# parity-dispatch.sh — the Stage-2 replacement for agents-md.sh's gate parity.
+#
+# Model B dissolves docs/gates/ (20 cards) into dispatch/ (10 entries). At the
+# Stage-2 switchover, agents-md.sh's gate-parity block (`index ↔ disk ↔
+# REQUIRED_GATES`, over docs/gates/) is deleted and this is sourced + called in
+# its place — line-neutral, so the ≤350 length gate on agents-md.sh still holds.
+#
+# Until then it is exercised only by evals/test-dispatch-parity.sh against a
+# model-B sandbox, proving the switchover audit goes GREEN and BITES before any
+# card is deleted. It does not run on the live (gate-mode) tree.
+#
+#   check_dispatch_parity <ROOT>   # echoes PASS/FAIL lines, returns 0/1
+#
+# Sources of truth (must agree):
+#   (a) disk     — dispatch/*.md   (each entry has exactly one latent .md)
+#   (b) index    — AGENTS.md dispatch-table rows (2nd cell a backticked entry)
+#   (c) expected — REQUIRED_DISPATCH (audits/data.sh)
+
+check_dispatch_parity() {
+  local root="$1" rc=0 e
+  local agents="$root/AGENTS.md"   # separate line: $root must be set before it expands here
+  local bt='`'                     # backtick held in a var (literal ` is fine, but keep it explicit)
+
+  local disk_count table_rows required_count
+  disk_count=$(find "$root/dispatch" -maxdepth 1 -name '*.md' 2>/dev/null | wc -l | tr -d ' ')
+  table_rows=$(grep -cE "^\|[^|]*\| *${bt}[a-z_]+${bt} *\|" "$agents" 2>/dev/null)
+  required_count=${#REQUIRED_DISPATCH[@]}
+
+  if [[ "$disk_count" -ne "$table_rows" || "$table_rows" -ne "$required_count" ]]; then
+    echo "FAIL: dispatch parity — disk=$disk_count ↔ table=$table_rows ↔ REQUIRED=$required_count (all three must match)"
+    rc=1
+  fi
+
+  for e in "${REQUIRED_DISPATCH[@]}"; do
+    [[ -f "$root/dispatch/$e.md" ]] \
+      || { echo "FAIL: dispatch entry has no body: dispatch/$e.md"; rc=1; }
+    grep -qE "^\|[^|]*\| *${bt}$e${bt} *\|" "$agents" 2>/dev/null \
+      || { echo "FAIL: dispatch entry absent from AGENTS.md table: $e"; rc=1; }
+  done
+
+  # docs/gates/ must be EMPTY in the dispatch model (the old empty-set guard
+  # inverts: a leftover card means the switchover is half-done).
+  local leftover
+  leftover=$(find "$root/docs/gates" -maxdepth 1 -name '*.md' 2>/dev/null | wc -l | tr -d ' ')
+  [[ "$leftover" -eq 0 ]] \
+    || { echo "FAIL: docs/gates/ still holds $leftover card(s) — switchover incomplete"; rc=1; }
+
+  [[ $rc -eq 0 ]] && echo "PASS: dispatch parity (disk=$disk_count ↔ table=$table_rows ↔ REQUIRED=$required_count; docs/gates/ empty)"
+  return $rc
+}
diff --git a/scripts/audit-spec-template.sh b/audits/spec-template.sh
similarity index 97%
rename from scripts/audit-spec-template.sh
rename to audits/spec-template.sh
index d33c0b7..8832849 100755
--- a/scripts/audit-spec-template.sh
+++ b/audits/spec-template.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# audit-spec-template.sh — enforce docs/TEMPLATE.md across every spec under
+# spec-template.sh — enforce docs/TEMPLATE.md across every spec under
 # docs/v*/{pending,active,done}/. Two check families:
 #
 #   1. PROHIBITED patterns (negative space) — TEMPLATE.md "Prohibited" section:
@@ -11,7 +11,7 @@
 #      FILLED. A spec that omits them forces the executing agent to guess intent.
 #      This is the half that makes a spec "built for the agent".
 #
-# Gate body: docs/gates/spec-template.md
+# Dispatch façade: dispatch/write_spec.md (SPEC TEMPLATE GATE)
 # Fires in: make lint (after audit-logging, before audit-error-codes).
 #
 # Modes:
@@ -180,7 +180,7 @@ for spec in "${SPECS[@]}"; do
 done
 
 if [[ $FAIL -ne 0 ]]; then
-  printf "\n🔴 SPEC TEMPLATE GATE: violations found. See docs/gates/spec-template.md.\n" >&2
+  printf "\n🔴 SPEC TEMPLATE GATE: violations found. See dispatch/write_spec.md.\n" >&2
   exit 1
 fi
 
diff --git a/scripts/audit-ufs.sh b/audits/ufs.sh
similarity index 89%
rename from scripts/audit-ufs.sh
rename to audits/ufs.sh
index 6b38d3a..a6335d8 100755
--- a/scripts/audit-ufs.sh
+++ b/audits/ufs.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# audit-ufs.sh — enforce RULE UFS (Unified Form for Symbols) across the worktree.
+# ufs.sh — enforce RULE UFS (Unified Form for Symbols) across the worktree.
 #
-# Gate body: docs/gates/ufs.md
+# Dispatch façade: dispatch/write_any.md (UFS Gate)
 # Fires in: make lint, HARNESS VERIFY.
 #
 # Generic detection — no manifest of known literals, so the audit scales
@@ -24,8 +24,8 @@
 #   it was blind to the index at pre-commit time.
 #
 # Usage:
-#   audit-ufs.sh           # full-codebase scan (default and only mode)
-#   audit-ufs.sh --all     # alias for default
+#   ufs.sh           # full-codebase scan (default and only mode)
+#   ufs.sh --all     # alias for default
 #
 # Exits 0 clean, 1 on any blocking violation.
 
@@ -37,7 +37,7 @@ case "${1:-}" in
   ""|--all|all) ;;
   *)
     printf "usage: %s [--all]\n" "$0" >&2
-    printf "note: --diff was retired in M70 — see docs/gates/ufs.md (Scope).\n" >&2
+    printf "note: --diff was retired in M70 — see dispatch/write_any.md (UFS Gate → Scope).\n" >&2
     exit 2
     ;;
 esac
@@ -97,7 +97,10 @@ done < <(awk '
   # literal types, and the cleanup belongs in a UI-aware spec). Skip
   # string-dup-file for ui/packages/*/src; cross-runtime-orphan still
   # runs against ui/ to catch ERR_* parity drift.
-  FILENAME ~ /^ui\/packages\/[^/]+\/(src|app|tests|components|lib|hooks)\// { next }
+  # macOS/BSD awk aborts on a `/` inside a `[...]` class in a regex *literal*
+  # ("nonterminated character class"); use a dynamic-regex STRING — identical
+  # match on gawk, portable on BWK awk (the macOS default). Do not re-inline.
+  FILENAME ~ "^ui/packages/[^/]+/(src|app|tests|components|lib|hooks)/" { next }
   FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0 }
   {
     line = $0
@@ -173,7 +176,10 @@ done < <(awk '
 #  - the line is NOT marked `// pin test: literal is the contract`
 #  - the line above is NOT marked `// pin test: literal is the contract`
 
-NUMERIC_RE='(\b1[_e]?0{3,12}\b|\b1_000(_000)*\b|\b10_000_000\b|\b100_000\b|\b1024\b|\b1048576\b|\b3600\b|\b86400\b)'
+# Boundaries are capturing groups, not \b: macOS/BSD awk treats \b as a backspace,
+# so word-boundary anchors silently match nothing. The leading/trailing boundary
+# chars are trimmed back off the extracted token below (see RSTART/RLENGTH use).
+NUMERIC_RE='(^|[^0-9A-Za-z_])(1[_e]?0{3,12}|1_000(_000)*|10_000_000|100_000|1024|1048576|3600|86400)([^0-9A-Za-z_]|$)'
 
 # Perf (M70): single awk across all files; FNR == 1 detects file boundary
 # so the "prev line carve-out" stays per-file. Process substitution keeps
@@ -191,7 +197,9 @@ done < <(awk -v re="$NUMERIC_RE" '
     sub(/\/\/.*$/, "", stripped)
     sub(/#.*$/, "", stripped)
     if (!is_pin_now && !is_pin_above && !is_const_decl && match(stripped, re)) {
-      printf "numeric-suspect %s:%d %s\n", FILENAME, FNR, substr(stripped, RSTART, RLENGTH)
+      tok = substr(stripped, RSTART, RLENGTH)
+      gsub(/^[^0-9]+|[^0-9_e]+$/, "", tok)   # trim the captured boundary chars
+      printf "numeric-suspect %s:%d %s\n", FILENAME, FNR, tok
     }
     prev = line
   }
diff --git a/bin/sync-agents b/bin/sync-agents
index 7ad9a66..b5af5bf 100755
--- a/bin/sync-agents
+++ b/bin/sync-agents
@@ -4,7 +4,7 @@
 # (~/.claude, ~/.codex, ~/.opencode, ~/.amp).
 #
 # Run after pulling new dotfiles changes that add or rename a rules file
-# (gate body, *_RULES.md, questionnaire). Idempotent — re-running is safe.
+# (dispatch entry, *_RULES.md, questionnaire). Idempotent — re-running is safe.
 #
 # Manifests below name every file/dir to propagate. Adding a new entry
 # is the only edit required when a new rules file lands.
@@ -28,13 +28,10 @@ fail() { printf '\033[31m✘\033[0m %s\n' "$1" >&2; }
 # ---------------------------------------------------------------------------
 PROJECT_LINKS=(
   "AGENTS.md:AGENTS.md"
-  "AGENTS_INVARIANCE.md:AGENTS_INVARIANCE.md"
+  "audits/agents-md.md:audits/agents-md.md"
   "docs/TEMPLATE.md:docs/TEMPLATE.md"
   "docs/REST_API_DESIGN_GUIDELINES.md:docs/REST_API_DESIGN_GUIDELINES.md"
   "docs/SCHEMA_CONVENTIONS.md:docs/SCHEMA_CONVENTIONS.md"
-  "docs/ZIG_RULES.md:docs/ZIG_RULES.md"
-  "docs/ZIG_STATIC_OPENSSL.md:docs/ZIG_STATIC_OPENSSL.md"
-  "docs/BUN_RULES.md:docs/BUN_RULES.md"
   "docs/LOGGING_STANDARD.md:docs/LOGGING_STANDARD.md"
   "docs/LIFECYCLE_PATTERNS.md:docs/LIFECYCLE_PATTERNS.md"
   "docs/CHANGELOG_VOICE.md:docs/CHANGELOG_VOICE.md"
@@ -42,22 +39,29 @@ PROJECT_LINKS=(
   "docs/VERIFY_TIERS.md:docs/VERIFY_TIERS.md"
   "docs/HARNESS_VERIFY_OUTPUT.md:docs/HARNESS_VERIFY_OUTPUT.md"
   "docs/greptile-learnings:docs/greptile-learnings"
-  "docs/gates:docs/gates"
+  # Dispatch façades — the dissolved gate cards + the per-language Zig/Bun
+  # standards docs, now a single per-surface façade-pair dir. Shipped as
+  # agent-facing files (read at EXECUTE; runnable on a touched file) — NOT wired
+  # into any product repo Makefile/hook (Reading A). The legacy per-language
+  # standards docs + the gate-card dir are no longer propagated.
+  "dispatch:dispatch"
   # Project-consumed audit scripts (invoked by each repo's Makefile / hooks).
   # Previously hand-symlinked into repos out-of-band; listed here so a single
   # `sync-agents` run is the source of truth and new repos/worktrees pick them
   # up automatically.
-  "scripts/audit-spec-template.sh:scripts/audit-spec-template.sh"
-  "scripts/audit-ufs.sh:scripts/audit-ufs.sh"
-  "scripts/audit-logging.sh:scripts/audit-logging.sh"
-  "scripts/audit-design-tokens.sh:scripts/audit-design-tokens.sh"
-  "scripts/audit-deinit-pairs.sh:scripts/audit-deinit-pairs.sh"
-  "scripts/audit-error-codes.sh:scripts/audit-error-codes.sh"
-  "scripts/audit-cross-tier-rates.sh:scripts/audit-cross-tier-rates.sh"
-  "scripts/audit-msid-ui.sh:scripts/audit-msid-ui.sh"
-  # audit-agents-md.sh, audit-data.sh, test-audit-agents-md.sh, and
-  # llmevals/ are dotfiles-internal — they validate AGENTS.md itself.
-  # Not propagated; downstream repos don't audit the ruleset.
+  "audits/spec-template.sh:audits/spec-template.sh"
+  "audits/ufs.sh:audits/ufs.sh"
+  "audits/logging.sh:audits/logging.sh"
+  "audits/design-tokens.sh:audits/design-tokens.sh"
+  "audits/deinit-pairs.sh:audits/deinit-pairs.sh"
+  "audits/error-codes.sh:audits/error-codes.sh"
+  "audits/cross-tier-rates.sh:audits/cross-tier-rates.sh"
+  "audits/msid-ui.sh:audits/msid-ui.sh"
+  # agents-md.sh, data.sh, parity-dispatch.sh, test-agents-md.sh, and evals/
+  # (llms + dispatch) are dotfiles-internal — they validate AGENTS.md + the
+  # dispatch façades themselves. Not propagated; downstream repos don't audit
+  # the ruleset. The agents-md.md questionnaire IS propagated (above) so a
+  # product-repo agent can run the prompt-invariance layer against AGENTS.md.
 )
 
 # Project repos. Override per-invocation via:
diff --git a/dispatch/edit_rules.md b/dispatch/edit_rules.md
new file mode 100644
index 0000000..c781c2c
--- /dev/null
+++ b/dispatch/edit_rules.md
@@ -0,0 +1,92 @@
+# edit_rules.md — governance-edit dispatch / meta-gate (LATENT façade)
+
+This is the prose the AGENT reads **the moment it edits the governance itself**.
+It is the meta-dispatch: it watches every other dispatch entry's source-of-truth.
+Its **latent half is the questionnaire at [`audits/agents-md.md`](../audits/agents-md.md)**;
+its **deterministic half is [`audits/agents-md.sh`](../audits/agents-md.sh)** (run by
+the git hooks), and `make llmevals` proves a live agent still complies. (This is
+the former Invariance Suite gate absorbed into the dispatch model — the only
+dispatch entry whose `.sh` half is the system's own self-checker.)
+
+**Signal legend:**
+
+- 🟢 / 🔴 — `audits/agents-md.sh` mechanically passes/fails (parity, structure).
+- 🔵 DECIDE — the questionnaire's reading-comprehension layer; the agent answers
+  every `audits/agents-md.md` question against the *current* AGENTS.md.
+
+## Trigger — any Edit/Write in this session to
+
+- `AGENTS.md`
+- `audits/agents-md.md`
+- any dispatch entry under `dispatch/` (the rule prose) — *replaces the old
+  `docs/gates/` trigger now that gates have dissolved into dispatch*
+- `audits/agents-md.sh` or `audits/fixtures/*.diff`
+
+The trigger is **agent-self-edit**: the moment the agent itself modifies one of
+these files this session, this dispatch fires. (User-only edits do not fire it
+from the LLM's perspective — but the pre-push hook still gates them.)
+
+**Override:** none from the agent side. The user MAY bypass at push time with
+`SKIP_INVARIANCE_PUSH=1 git push ...`, documented with a reason in the most recent
+commit message. The agent MUST NOT self-bypass.
+
+## Required action (in-session, BEFORE declaring complete)
+
+1. **Script layer** — run `bash audits/agents-md.sh`. If exit ≠ 0, STOP, fix the
+   FAIL lines, retry. Do NOT proceed with a failing script.
+2. **Questionnaire layer** — read `audits/agents-md.md` and answer every question
+   against the current AGENTS.md (and dispatch prose). Each answer is YES or NO
+   with the justifying line(s).
+3. **Tabulated report** — emit the report (gates, rules, lifecycle, scenario
+   verdicts, OVERALL).
+4. **Sign-off** — only when **all questions YES** AND OVERALL is `PASS`. After the
+   commit lands, write the post-commit-HEAD attestation:
+
+   ```bash
+   printf '%s  %s  PASS\n' "$(git rev-parse --short HEAD)" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+     > .agents-invariance-signoff
+   ```
+
+   (Gitignored — a per-machine attestation, not tracked.)
+5. **Tell the user** — surface that the sign-off was written and `git push` is
+   unblocked. If any question is NO, surface the regression and STOP — the user
+   decides fix-or-override.
+
+## Sequencing relative to commit & push
+
+1. Edit governance files → 2. script ✓ → 3. questionnaire ✓ → 4. report ✓ →
+5. `git commit` (pre-commit re-runs the script, defence in depth) → 6. sign-off
+written against the new HEAD → 7. `git push` (pre-push reads the sign-off; PASS +
+matching SHA + < 24 h freshness → push proceeds).
+
+## Why this dispatch exists
+
+`AGENTS.md` + the dispatch entries are the agent's ruleset. Every other dispatch
+trusts that ruleset. If it drifts silently — an entry vanishes, a trigger drops a
+file class, an override path widens — every downstream dispatch is now wrong. The
+script catches mechanical regressions; the questionnaire catches semantic ones
+that need reading comprehension. Together they prove the ruleset still holds
+*before* the bad version reaches the remote.
+
+## Failure modes this dispatch guards against
+
+- A dispatch entry is moved or renamed; the AGENTS.md pointer rots; agents
+  silently skip it.
+- An override path quietly widens ("user-only" → "auto-mode covers"); autonomy
+  creep.
+- The always-forbidden list shrinks (e.g. someone removes `gitleaks` enforcement).
+- The skill-chain order shuffles (`/review-pr` before `/review`).
+- The HARNESS VERIFY block stops listing a dispatch row.
+- `audits/agents-md.md` itself loses scenarios.
+
+## Required output (in-session)
+
+```
+🚧 EDIT_RULES DISPATCH: <branch> @ <head-sha>
+  Step 1 (script):        ✅ ALL CHECKS PASSED
+  Step 2 (questionnaire): ✅ <N>/<N> YES
+  Step 3 (report):        emitted
+  Step 4 (sign-off):      ✅ written to .agents-invariance-signoff
+```
+
+Any 🔴 → STOP, surface, do NOT push.
diff --git a/dispatch/lib.sh b/dispatch/lib.sh
new file mode 100755
index 0000000..54ef625
--- /dev/null
+++ b/dispatch/lib.sh
@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# dispatch/lib.sh — shared framework for all language dispatch.
+#
+# A dispatch (Garry Tan's sense) is a DISPATCHER: given a touched file, it
+# resolves which deterministic gates apply and runs them. It never does the
+# work itself — the leaf helpers in audits/ do. This library gives every
+# dispatch one identical verdict-block format so they cannot drift.
+#
+# Three entry points, one source of truth (each dispatch sources this):
+#   EXECUTE        dispatch/<lang>.sh <file>      per-edit, latent early-warning
+#   HARNESS VERIFY dispatch/<lang>.sh --staged    end-of-turn aggregate (the anchor)
+#   COMMIT         pre-commit → dispatch/<lang>.sh --staged   mechanical backstop
+#
+# Signal semantics (printed in every row — see DISPATCH_ARCHITECTURE.md, Signal semantics):
+#   🟢 GREEN    deterministic check passed                → proceed         (exit 0)
+#   🔴 RED      deterministic check failed / helper absent → STOP, fix, rerun (exit 1)
+#   🔵 DECIDE   judgment-only; no script can decide        → agent reads §, makes
+#               the call, states the verdict in chat; blocks the TURN, not the
+#               script (exit 0). 🟡 is reserved for "violations addressed" in
+#               HARNESS_VERIFY_OUTPUT.md and is never emitted here.
+#   ⚪ N/A       delegated check — runs only in the product repo, not dotfiles
+#
+# Source this, then call:
+#   dispatch_init "<LANG>" <ext-glob...>      # e.g. dispatch_init "ZIG" '*.zig'
+#   dispatch_resolve_files "$@"               # populates DISPATCH_FILES[]
+#   dispatch_length_gate <cap>                # inline length check
+#   dispatch_run_helper <CODE> <script.sh>    # delegate to audits/<script.sh>
+#   dispatch_delegate <CODE> "<command>"      # print a DELEGATED row (in-repo only)
+#   dispatch_judgment <CODE> "<question>"     # print a 🔵 DECIDE (judgment) row
+#   dispatch_verdict                          # final ✅/❌ line; exits with status
+#
+# CODE is a rule code (UFS, FLL, TGU…). Every CODE prints with its gloss from
+# DISPATCH_GLOSS so output self-explains — no naked codes (audit-enforced).
+
+set -euo pipefail
+
+# DISPATCH_HOME — where the dispatch scripts physically live. Follows a
+# sync-agents symlink back to dotfiles, so it always locates lib.sh + the leaf
+# helpers correctly. This is NOT the repo being checked.
+DISPATCH_HOME="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DISPATCH_SCRIPTS="$DISPATCH_HOME/audits"
+# TARGET_ROOT — the repo being checked (the one we were invoked from). Derived
+# from the CWD's git toplevel, NOT BASH_SOURCE: a symlinked dispatch inside a
+# product repo must scope --staged discovery + length checks to THAT repo, not
+# dotfiles (DISPATCH_ARCHITECTURE.md §10). Falls back to DISPATCH_HOME outside a
+# git work tree.
+TARGET_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || printf '%s' "$DISPATCH_HOME")"
+DISPATCH_LANG=""
+DISPATCH_EXTS=()
+DISPATCH_FILES=()
+DISPATCH_RC=0
+
+# Rule-code gloss map — canonical short expansions (full text in RULES.md legend).
+# Keep in sync with RULES.md; dispatch-coverage.sh fails on a code with no
+# gloss entry. snake-of-record: CODE → "Short Gloss".
+declare -A DISPATCH_GLOSS=(
+  [NDC]="No Dead Code"
+  [NLR]="No Legacy Retained (touch-it-fix-it)"
+  [NLG]="No Legacy compat shims (pre-v2.0.0)"
+  [UFS]="Unified Form for Symbols (literals → named consts)"
+  [TGU]="Tagged-Union over optional-field structs"
+  [PRI]="Prompt-injection Resistance from user Input"
+  [ORP]="ORPhan sweep (cross-layer on rename/delete)"
+  [FLL]="File & Function Length Limits"
+  [TST-NAM]="TeST NAMing (milestone-free)"
+  [PUB]="Pub Surface & Struct-Shape"
+  [DRAIN]="pg.Conn drain-before-deinit"
+  [DEINIT]="init/deinit lifecycle pairing"
+  [ARCH]="Architecture consult before naming"
+  [XCOMPILE]="Cross-compile both linux targets"
+  [FSD]="File Shape Decision (file-as-struct vs operations-over-value)"
+  [DIDEM]="Deinit IDEMpotency (cleanup double-call safe / single-shot asserted)"
+  [TSC]="TypeScript/Bun lint conventions (const, import, naming, anti-patterns)"
+  [TSJ]="TypeScript/Bun judgment conventions (Bun-native, file ordering, error style)"
+  [UIS]="UI Substitution (design-system primitive over raw HTML)"
+  [DTK]="Design ToKens (named token utility over arbitrary value)"
+  [SCH]="SCHema teardown (pre-2.0 full removal; no ALTER/DROP/marker)"
+  [ITF]="Integration Test Fixtures (real schema, not TEMP-table mock)"
+  [LOG]="LOGging discipline (scoped event, error_code, severity, redaction)"
+  [MSID]="Milestone-ID ban in source (M{N}_{NNN} / §x.y / T{N} / dim)"
+  [ERR]="ERror Registry (UZ-XXX-NNN declared + referenced)"
+  [GRP]="GREptile rule audit (diff vs greptile-learnings/RULES.md codes)"
+  [LDC]="Legacy-Design Consult (A remove / B patch / C keep)"
+)
+
+# Look up a gloss; empty string if the code is unknown (audit will catch it).
+dispatch_gloss() { printf '%s' "${DISPATCH_GLOSS[$1]:-}"; }
+
+dispatch_init() {
+  DISPATCH_LANG="$1"; shift
+  DISPATCH_EXTS=("$@")
+}
+
+# Resolve targets: explicit file args, or --staged self-discovery via git.
+dispatch_resolve_files() {
+  DISPATCH_FILES=()
+  if [ "${1:-}" = "--staged" ]; then
+    local pathspecs=() e
+    for e in "${DISPATCH_EXTS[@]}"; do pathspecs+=("$e"); done
+    while IFS= read -r f; do [ -n "$f" ] && DISPATCH_FILES+=("$f"); done \
+      < <(git -C "$TARGET_ROOT" diff --cached --name-only --diff-filter=ACMRT -- "${pathspecs[@]}" \
+          | grep -vE '(^|/)(vendor|third_party|node_modules|\.zig-cache|dist|build|\.next)/' || true)
+  elif [ "$#" -ge 1 ]; then
+    local f matched
+    for f in "$@"; do
+      matched=0
+      for e in "${DISPATCH_EXTS[@]}"; do
+        case "$f" in ${e}) matched=1 ;; esac
+      done
+      if [ "$matched" -eq 1 ]; then DISPATCH_FILES+=("$f")
+      else printf 'dispatch: %s does not match %s scope: %s\n' "$DISPATCH_LANG" "${DISPATCH_EXTS[*]}" "$f" >&2; exit 2
+      fi
+    done
+  else
+    printf 'usage: dispatch/<lang>.sh <file> [...] | --staged\n' >&2
+    exit 2
+  fi
+}
+
+dispatch_header() {
+  if [ "${#DISPATCH_FILES[@]}" -eq 0 ]; then
+    printf '%s DISPATCH: no files in scope — nothing to dispatch.\n' "$DISPATCH_LANG"
+    exit 0
+  fi
+  printf '%s DISPATCH — %s file(s) in scope\n' "$DISPATCH_LANG" "${#DISPATCH_FILES[@]}"
+}
+
+# Inline length gate — intrinsic to the file, deterministic, no git history.
+# Code FLL; gloss printed so the human reading a commit knows the rule.
+dispatch_length_gate() {
+  local cap="$1" f n g; g="$(dispatch_gloss FLL)"
+  for f in "${DISPATCH_FILES[@]}"; do
+    local path="$TARGET_ROOT/$f"; [ -f "$path" ] || path="$f"; [ -f "$path" ] || continue
+    n="$(wc -l < "$path")"; n="${n//[[:space:]]/}"
+    if [ "$n" -gt "$cap" ]; then
+      printf '  FLL      🔴 %s — %s: %s lines (cap %s) — split before commit\n' "$g" "$f" "$n" "$cap"
+      DISPATCH_RC=1
+    else
+      printf '  FLL      🟢 %s — %s: %s/%s\n' "$g" "$f" "$n" "$cap"
+    fi
+  done
+}
+
+# Delegate to a deterministic leaf helper in audits/. Normalizes the verdict.
+# CODE prints with its gloss (no naked codes — audit-enforced).
+#
+# Leaf helpers have NON-UNIFORM arg contracts (e.g. audit-deinit-pairs takes
+# --staged; audit-ufs takes --all/no-arg after M70). The caller MUST pass the
+# mode the helper actually accepts as the 3rd arg — never assume --staged.
+#   dispatch_run_helper UFS    ufs.sh          --all
+#   dispatch_run_helper DEINIT deinit-pairs.sh --staged
+dispatch_run_helper() {
+  local code="$1" script="$2" mode="${3:-}" g; g="$(dispatch_gloss "$code")"
+  # An absent DETERMINISTIC helper is 🔴, never a silent ⚪/0: a deleted or
+  # un-synced leaf must NOT pass as a green no-op (DISPATCH_ARCHITECTURE.md §10).
+  # ⚪ is reserved for dispatch_delegate (checks that legitimately don't run here).
+  if [ ! -f "$DISPATCH_SCRIPTS/$script" ]; then
+    printf '  %-8s 🔴 %s — DETERMINISTIC helper absent (audits/%s) — cannot verify\n' "$code" "$g" "$script"
+    DISPATCH_RC=1
+    return 1
+  fi
+  local log="/tmp/dispatch-${DISPATCH_LANG}-${code}.log"
+  if bash "$DISPATCH_SCRIPTS/$script" $mode >"$log" 2>&1; then
+    printf '  %-8s 🟢 %s — pass (audits/%s %s)\n' "$code" "$g" "$script" "$mode"
+  else
+    printf '  %-8s 🔴 %s — fail (audits/%s %s) — see %s\n' "$code" "$g" "$script" "$mode" "$log"
+    DISPATCH_RC=1
+  fi
+}
+
+# A gate that can only run inside the project repo (not dotfiles). Print, don't run.
+dispatch_delegate() {
+  local code="$1" cmd="$2" g; g="$(dispatch_gloss "$code")"
+  printf '  %-8s ⚪ %s — DELEGATED → %s\n' "$code" "$g" "$cmd"
+}
+
+# A judgment gate that NO script can pass/fail (architecture, legacy-design,
+# greptile, tagged-unions). 🔵 DECIDE = open question, NOT a failure: exit stays 0
+# but the TURN is incomplete until the agent states a verdict in chat (Signal semantics).
+# 🔵 (not 🟡) so it never collides with HARNESS_VERIFY's "violations addressed" 🟡.
+# Faking determinism on a taste decision is the anti-goal.
+dispatch_judgment() {
+  local code="$1" question="$2" g; g="$(dispatch_gloss "$code")"
+  printf '  %-8s 🔵 DECIDE — %s: %s\n' "$code" "$g" "$question"
+}
+
+dispatch_verdict() {
+  if [ "$DISPATCH_RC" -eq 0 ]; then
+    printf '%s DISPATCH: ✅ all dispatched gates pass (delegations pending in-repo)\n' "$DISPATCH_LANG"
+  else
+    printf '%s DISPATCH: ❌ one or more gates failed — fix before commit\n' "$DISPATCH_LANG"
+  fi
+  exit "$DISPATCH_RC"
+}
diff --git a/dispatch/name_architecture.md b/dispatch/name_architecture.md
new file mode 100644
index 0000000..b35fae6
--- /dev/null
+++ b/dispatch/name_architecture.md
@@ -0,0 +1,79 @@
+# name_architecture.md — architecture-consult dispatch (LATENT façade)
+
+This is the prose the AGENT reads **before naming an architectural element or
+describing a data flow**. Like `verify`, it has **no deterministic `.sh` half** —
+no script can detect the moment an agent is *about to name a stream* or *assert a
+cardinality*. It is a pure **🔵 judgment** dispatch grounded in `docs/architecture/`.
+(This is the former Architecture Consult & Update gate absorbed into the dispatch model.)
+
+**Signal legend:**
+
+- 🔵 DECIDE — judgment-only; the agent greps the relevant `docs/architecture/`
+  topic file and grounds its naming/flow claim in it. Blocks the *turn*, not a
+  commit.
+
+## Trigger — grep/read the relevant `docs/architecture/` topic file before
+
+- Naming a stream / pub-sub channel / Redis key namespace / consumer group /
+  queue / RPC method / Postgres schema / table.
+- Asserting cardinality ("one row per X", "exactly one consumer per stream",
+  "fleet-wide vs per-tenant").
+- Describing a flow ("on crash → X reclaims via Y", "trigger source A lands on
+  stream B with actor C").
+- Answering a user question about how data flows between components.
+- Proposing a change to any of the above as part of a spec or implementation.
+- A new architecture-adjacent question that arises mid-task — re-consult per
+  topic, not once per task.
+
+**Override:** none — doc wins until reconciled.
+
+## Why
+
+`docs/architecture/` (the directory; topic files linked from
+`docs/architecture/README.md`) is canonical for stream/channel/queue names, table
+cardinality, ownership, and end-to-end flows. The failure mode is reinventing
+terms or asserting flow shapes from training data instead of grounding in the
+doc. Specs are *instances*; this doc is the *constant* — when they disagree, the
+doc wins until reconciled.
+
+## Behavior
+
+- **Doc answers** → proceed (no citation block).
+- **Doc silent** → proceed with extra care; land doc decision in same commit.
+- **Doc conflicts** → surface with a one-line citation (`grounded in §X.Y,
+  proposal extends/conflicts because <reason>`) and wait.
+- **Greenfield** → land initial doc + code in same commit.
+
+## Landing rule (non-negotiable)
+
+An architecture decision lands its `docs/architecture/` edit either:
+
+- **(a)** immediate doc-only commit on the active branch (preferred), OR
+- **(b)** same commit as the implementation.
+
+**Never** (c) follow-up commit AFTER the code.
+
+**Chat brainstorming counts as "describing a flow."** A multi-turn chat designing
+a new pattern (naming a channel, asserting cardinality, tracing a flow, defining
+an invariant) HAS fired the dispatch even if no code touched yet. Acceptable
+resolutions: (a) doc-only commit BEFORE the next agent action, or (b) Indy-acked
+deferral quote (per CHORE(close) deferral discipline) routing the capture into
+same-commit-with-code. The failure mode this clause names explicitly: encoding the
+brainstorm as a "punchlist task to land after the code ships" — that's exactly (c)
+and is forbidden. Pickup agents reading a task whose description says "capture
+architecture in docs/architecture/ AFTER <slice> lands" must rewrite it to
+same-commit OR doc-only-now before continuing.
+
+## Required output (only when doc conflicts or is silent)
+
+```
+ARCH: grounded in <topic-file>:<§X.Y> | proposal: <one-line> | status: <extends|conflicts|silent> | landing: <a|b>
+```
+
+When the doc directly answers, no output is required.
+
+## CHORE(close) check
+
+Every M-spec branch that touched flow-defining code produces a non-empty
+`git diff origin/main..HEAD -- docs/architecture/`. Else PR Session Notes documents
+why nothing architectural changed.
diff --git a/dispatch/verify.md b/dispatch/verify.md
new file mode 100644
index 0000000..0192f1b
--- /dev/null
+++ b/dispatch/verify.md
@@ -0,0 +1,96 @@
+# write — verify.md — verification dispatch (LATENT façade)
+
+This is the prose the AGENT reads **before emitting any message that asserts work
+is verified**. Unlike `write_zig` / `write_any`, `verify` has **no deterministic
+`.sh` half** — no script can detect the moment an agent is *about to claim done*.
+It is a pure **🔵 judgment** dispatch: the agent reads this, runs the canonical
+`make` targets, and emits the verdict block. The trigger is a *claim*, not a file
+edit. (This is the former Verification gate absorbed into the dispatch model.)
+
+**Signal legend:**
+
+- 🔵 DECIDE — judgment-only; the agent must run the targets below and report
+  honestly. No script gates this — it blocks the *turn*, not a commit.
+- ⚪ delegated — the `make` targets themselves live in the product repo; dotfiles
+  carries only the discipline of *which* targets are canonical and when.
+
+## Trigger
+
+Fires before any user-facing message asserting verification: *"tests pass",
+"ready to merge", "shipping", "ready for review", "CHORE(close) ready"* — or any
+equivalent.
+
+**Override:** `VERIFY GATE: <target> skipped per environment constraint (reason: ...)`.
+Only when a target is genuinely unrunnable (e.g. Docker missing for integration
+tests). Surface the limitation in the done message — never dress a skip as "tests
+pass".
+
+## Why `make` is canonical
+
+Package-scoped runners (`bun run test`, `vitest <file>`, `zig build test` without
+the integration tier) are **not** verification — they skip cross-package lint,
+cross-compile, pg-drain, and integration. `make` targets are the canonical gates.
+
+## Required runs
+
+| Target | When |
+|---|---|
+| `make lint` | Always. |
+| `make test` | Always (tier 1, unit-only by definition). |
+| `make test-integration` | Tier 2: diff touches HTTP handlers, schema, DB code, Redis code, or any `_integration_test.zig`. Focused subsets: `make test-integration-db` / `make test-integration-redis`. |
+| `make test-integration` | Tier 3: at least once per branch before declaring ship-ready, from a clean state (e.g. after `make down`) when tier 2 is intermittent — fresh DB proves no state carry-over. |
+| `make memleak` | Server lifecycle (`src/http/**`, `src/cmd/serve.zig`), allocator wiring, cross-thread heap ownership. |
+| `make bench` (local) | Diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
+| `API_BENCH_URL=https://api-dev.usezombie.com/healthz make bench` | After branch deploys to dev. |
+| Cross-compile `x86_64-linux` + `aarch64-linux` | Whenever `*.zig` touched. |
+| `make check-pg-drain` | Whenever `*.zig` touched. |
+
+`make test` never substitutes for tier 2/3. Tier 2 passing but tier 3 failing
+means state pollution — fix isolation before shipping.
+
+## Memleak evidence rule
+
+Before CHORE(close) reports green, paste the final `make memleak` result line into
+the PR Session Notes block OR cite the CI memleak job URL. Branches touching
+`src/http/**`, `src/cmd/serve.zig`, or allocator wiring MUST include the last 3
+lines verbatim. No "I ran it, trust me."
+
+## Bench knobs
+
+`make/test-bench.mk` env vars: `API_BENCH_METHOD`, `API_BENCH_DURATION_SEC`,
+`API_BENCH_CONCURRENCY`, `API_BENCH_TIMEOUT_MS`, `API_BENCH_MAX_ERROR_RATE`,
+`API_BENCH_MAX_P95_MS`, `API_BENCH_MAX_RSS_GROWTH_MB`.
+
+## Required output (done-message)
+
+**Success:**
+
+```
+✅ Verified: 🧪 lint ✓ · 🧪 test ✓ <N>p/<M>s · 🧩 test-integration ✓ (or N/A — no handler/schema/redis) · 🎯 cross-compile ✓ (zig only)
+```
+
+**Failure (any required target failed):**
+
+```
+🔴 NOT VERIFIED: <target> ✗ — <one-line reason>
+```
+
+**Skipped (environment constraint, not a pass):**
+
+```
+⚠️ <target> skipped per environment constraint (reason: ...)
+```
+
+A skipped target MUST be surfaced — never dressed up as "tests pass".
+
+## Emoji legend
+
+| Glyph | Meaning |
+|---|---|
+| ✅ | Verified — all required targets passed |
+| 🔴 | Verification failed — at least one target failed |
+| ⚠️ | Skipped per environment constraint — read the reason |
+| 🧪 | Lint / unit / integration test |
+| 🧩 | Integration test (cross-process) |
+| 🎯 | Cross-compile target |
+| 🔆 | Informational note (does not affect verdict) |
diff --git a/dispatch/write_any.md b/dispatch/write_any.md
new file mode 100644
index 0000000..95b631a
--- /dev/null
+++ b/dispatch/write_any.md
@@ -0,0 +1,680 @@
+# write_any.md — cross-cutting authoring latent façade
+
+This is the prose the AGENT reads before writing ANY source file (`*.zig` / `*.ts` / `*.tsx` / `*.js` / `*.jsx` / `*.py` / `*.rs` / `*.go` / `*.sh` / `*.sql`). These are the language-agnostic authoring invariants that apply identically to every surface — literal hygiene, length, observability, milestone-free naming, dead-code/legacy. They fire IN ADDITION to the language façade (`write_zig` / `write_ts_adhere_bun` / `write_sql`), not instead of it. It pairs with the deterministic façade `dispatch/write_any.sh`. Nine dissolving gate cards are merged verbatim below (headings demoted one level, each subsection tagged); the durable rule catalogue stays in `docs/greptile-learnings/RULES.md` (retained), which the Greptile Gate audits. Mechanical thresholds live once in the `.sh`; this file references rule codes, never restates the numbers.
+
+**Signal legend** (printed by `write_any.sh`):
+
+- 🟢 pass — deterministic check passed.
+- 🔴 fail — deterministic check failed (or helper absent); STOP, fix, rerun.
+- 🔵 DECIDE — judgment-only; no script can decide, the agent reads the section and makes the call (blocks the TURN, not the script).
+- ⚪ delegated — the checker runs only in the product repo, not in dotfiles.
+
+**Tag legend** — each section heading below carries one of:
+
+- `> [DETERMINISTIC → <CODE>]` — a machine can pass/fail it; the `.sh` row for `<CODE>` (e.g. `FLL`, `UFS`, `LOG`, `MSID`, `ERR`) enforces it. `TODO-CHECK` marks a mechanizable rule with no helper wired yet (build-the-check). `NEW:<name>` marks a proposed-but-not-yet-existing code.
+- `> [JUDGMENT → <CODE>]` — no script can decide; the agent decides at write time against the prose.
+- `> [container]` — a non-enforcement wrapper heading (e.g. "Merged from dissolved gate cards"); its tagged subsections carry the real codes, and the coherence audit (§6.3) skips it.
+
+See [`docs/DISPATCH_ARCHITECTURE.md`](../docs/DISPATCH_ARCHITECTURE.md) §3 for the tag grammar and semantic-anchor model.
+
+---
+
+# Cross-cutting authoring discipline
+
+## Scope
+
+> [JUDGMENT → GRP]
+
+Triggers on every `Edit`/`Write` to a source file in any language: `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.py`, `*.rs`, `*.go`, `*.sh`, `*.sql` (outside `vendor/`, `node_modules/`, `third_party/`, `.zig-cache/`, `dist/`, `build/`, `.next/`). Fires alongside — never instead of — the per-language façade. `.md` and everything under `docs/**` are exempt from the length sub-gate (see the card below).
+
+**Per-file lens.** This is the EXECUTE/HARNESS-VERIFY early-warning: it dispatches over the source files actually touched or `--staged`, so a turn that stages no in-scope source short-circuits with nothing to check. The full-tree audits (`audit-ufs` etc.) still fire unconditionally via the product repo's `make harness-verify` — the dispatch is the per-edit lens, not the codebase-wide backstop.
+
+## Merged from dissolved gate cards
+
+> [container]
+
+Nine cross-cutting gate cards dissolve into this façade. Each is preserved verbatim below (title demoted to a tagged `###`, subsections demoted to `####` and tagged with the card's code — except the file-length card's fn/method sub-cap, which is a `TODO-CHECK` subsection per §13). Five carry deterministic codes: `FLL` (inline) and `UFS`/`LOG`/`MSID` run here via leaf helpers, while `ERR` is deterministic-but-**delegated** — its leaf needs the product-repo `error_registry.zig`, so `write_any.sh` emits `⚪ DELEGATED` and the product harness runs it. Four are judgment gates (`GRP`/`NLR`/`NLG`/`LDC`).
+
+### File & Function Length Gate (LENGTH GATE)
+
+> [DETERMINISTIC → FLL]
+
+
+**Family:** Universal length discipline. **Source:** `docs/greptile-learnings/RULES.md` RULE FLL (File & Function Length).
+
+**Caps:** file ≤ 350 lines · function ≤ 50 lines · method ≤ 70 lines.
+
+**Triggers** — every Write/Edit that net-adds lines to a source file:
+`.zig`, `.js`, `.ts`, `.tsx`, `.jsx`, `.py`, `.rs`, `.go`, `.sh`, `.sql`, `.yaml`/`.toml` (when carrying code). If the file extension is ambiguous, the gate FIRES by default — opt-out requires the user override below.
+
+**Exempt:** `vendor/`, `node_modules/`, `third_party/` (upstream); `.md` files; **everything under `docs/**`** (documentation tree — any extension); published API artefacts under `public/` (loose ≤ 400-line advisory on path YAMLs); per-repo extensions in `docs/greptile-learnings/RULES.md`.
+
+**Override:** `LENGTH GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit.
+
+#### Pre-edit check (mandatory)
+
+> [DETERMINISTIC → FLL]
+
+1. `wc -l <file>` — current count (0 for new files).
+2. Net delta: `+added - removed`.
+3. Projected: `current + delta`.
+4. If projected > 350, **STOP**. Split first: extract a cohesive block to a sibling file using the repo's `<module>_<concern>.<ext>` convention (`zombie_list.js` beside `zombie.js`). Then apply the original edit.
+5. Function sub-gate: project post-edit line count for any touched function. If > 50 (function) or > 70 (method), split into named helpers **before** writing.
+
+#### Splitting conventions
+
+> [DETERMINISTIC → FLL]
+
+- Files named after the concern extracted (`zombie_list.js` not `zombie2.js`).
+- Helper function names describe the step (`normalizeCursor()` not `helperA()`).
+
+#### Required output
+
+> [DETERMINISTIC → FLL]
+
+Print only when projected ≥ 300 lines OR touched function within 10 of cap:
+
+```
+LENGTH GATE: <file> N+Δ=<N+Δ> (cap 350, headroom <H>) | fn:<name> <F> lines (cap 50/70) | proceed|split.
+```
+
+#### Self-audit (end-of-turn)
+
+> [DETERMINISTIC → FLL]
+
+```bash
+git diff --name-only origin/main \
+  | grep -v -E '\.md$|^docs/|^vendor/|_test\.|\.test\.|\.spec\.|/tests?/' \
+  | xargs -I{} sh -c 'wc -l "{}"' \
+  | awk '$1 > 350 { print "❌ " $2 ": " $1 " lines (limit 350)" }'
+```
+
+Non-empty output = hard fail.
+
+#### fn/method sub-cap is a separate check
+
+> [DETERMINISTIC → TODO-CHECK]
+
+`dispatch_length_gate` enforces only the **file** cap (FLL). The **fn ≤ 50 / method ≤ 70** sub-cap is mechanizable but has no leaf wired — flagged TODO-CHECK and named explicitly (not folded into the 350 file cap), per the dispatch acceptance criteria (§13).
+
+### Logging Gate (LOGGING GATE)
+
+> [DETERMINISTIC → LOG]
+
+
+**Family:** Observability discipline. **Source:** `docs/LOGGING_STANDARD.md`.
+
+**Triggers** — every `Edit`/`Write` that adds, removes, or changes a log emit:
+
+- `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/`/`*_test.zig` — `std.log.*`, `std.debug.print`, raw stderr writes, calls into the `log` named module (source: `src/logging/mod.zig`).
+- `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/`/`*.test.*`/`*.spec.*` — `console.*`, custom logger calls.
+- `*.sh` outside generated dirs — `echo`/`printf` to `&2`.
+
+**Override:** `LOGGING GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override.
+
+#### What this gate covers
+
+> [DETERMINISTIC → LOG]
+
+`docs/LOGGING_STANDARD.md` codifies the wire format (logfmt), severity ladder, error-code embedding, scope discipline, and PII redaction. Drift is silent until incident response hits ungreppable logs at 3 AM.
+
+#### Pre-edit check
+
+> [DETERMINISTIC → LOG]
+
+| Pattern | Rule |
+|---|---|
+| New `logging.scoped(.tag)` call | Scope is a Zig enum literal — adding a new tag is freeform. `event` must be snake_case `verb_noun`. |
+| New `err`/`warn` log mapping to a domain failure | `error_code=UZ-XXX-NNN` field required. Registry entry must land in same commit. |
+| Per-iteration / hot-loop log | Use `debug` (hidden by default), not `info`. |
+| `info` level | Event must appear in the `info` allow-list (see `LOGGING_STANDARD.md` §10A.L4). Otherwise downgrade to `debug` or justify. |
+| `console.log`/`std.debug.print` in non-test source | Forbidden. Convert to logger or delete before commit. |
+| `std.log.scoped` outside `src/logging/` | Migration target. The `log` named module's `scoped` API is the only non-test entry point; flip the file's alias and migrate every call site in the same commit. |
+| `msg=` field | ≤ 300 chars. Stack traces emit as separate `event=stack_trace` debug record. |
+| Multi-line values | Newlines must be `\n` literal (two chars), not raw newline byte. |
+
+Verify each rule applies or is N/A for this edit.
+
+#### Required output (default — one line)
+
+> [DETERMINISTIC → LOG]
+
+```
+LOGGING GATE: <file> | scope:<ok|new:.tag> event:<ok|new:.event> error_code:<ok|N/A> severity:<ok|escalation> redaction:<ok|N/A>
+```
+
+Comment-only edit:
+
+```
+LOGGING GATE: <file> | comment-only | N/A
+```
+
+Full multi-line block fires when a sub-rule reports a violation:
+
+```
+LOGGING GATE: <file>
+  LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (zig binding) | §8 (TS binding), §10A (tightenings)
+  Wire format: <logfmt ✓ | violation: <where>>
+  Required keys: <ts_ms,level,scope,event present ✓ | violation: <missing>>
+  Severity choice: <within rules ✓ | violation: <e.g. info on per-iteration path>>
+  Error-code embedding: <UZ-XXX-NNN present and registered ✓ | orphan: <code> | missing on err/warn>
+  PII discipline: <no secret materials ✓ | violation: <where>>
+  Field caps: <≤15 fields, msg≤300 chars ✓ | violation: <count>>
+  Newline encoding: <\n literal ✓ | raw newline at <line>>
+  Audit script: <logging.sh on staged diff: 0 findings ✓ | N findings>
+```
+
+#### Scope (M70)
+
+> [DETERMINISTIC → LOG]
+
+`logging.sh` walks the **full `src/` + `zombiectl/src/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
+
+#### End-of-turn audit
+
+> [DETERMINISTIC → LOG]
+
+`audits/logging.sh` runs as part of `make lint`. Mechanical enforcement; reviewer responsibility for severity-level subjective calls and PII spot-checks (allow-list and msg-length are mechanical).
+
+#### Family
+
+> [DETERMINISTIC → LOG]
+
+- `docs/LOGGING_STANDARD.md` — full standard, including §10A tightenings.
+- `dispatch/write_zig.md` — Zig discipline umbrella; §7 of the standard depends on it.
+- `dispatch/write_ts_adhere_bun.md` §10 — bans `console.log` in TS/JS source. This gate enforces.
+- the Error Registry Gate section of this façade — pairs with this gate on `error_code=` audits.
+
+### Milestone-ID Gate (MILESTONE ID)
+
+> [DETERMINISTIC → MSID]
+
+
+**Family:** Source-rot prevention. **Source:** `AGENTS.md` (project-side guard). Related: **RULE TST-NAM** (test identifiers are milestone-free) in `docs/greptile-learnings/RULES.md`.
+
+**Triggers — before saving any file matching:**
+
+- `**/*.zig` · `**/*.sql` · `**/*.ts` · `**/*.tsx` · `**/*.js` · `**/*.jsx` · `**/*.py` · `**/*.rs` · `**/*.go` · `**/*.sh`
+- Any config file (`*.toml`, `*.yaml`, `*.json`) outside `docs/`
+- Test files (the `_test.` / `.test.` / `.spec.` naming doesn't exempt — tests are code).
+
+**Exempt paths** (IDs allowed): `docs/`, `**/*.md` outside `node_modules/`/`vendor/`, `CLAUDE.md`/`AGENTS.md`/`audits/agents-md.md`.
+
+**Override:** `MILESTONE ID ALLOWED per user override (reason: ...)` in the immediately-preceding comment line.
+
+#### Why
+
+> [DETERMINISTIC → MSID]
+
+Milestone IDs (`M{N}_{NNN}`), section refs (`§X.Y`), and dimension tokens (`T7`, `dim 5.8.15`) belong in specs, PR descriptions, and scratchpads — never in source code, since the codebase outlives any individual milestone and these references rot.
+
+#### Pre-edit check
+
+> [DETERMINISTIC → MSID]
+
+Grep about-to-save content for:
+
+```
+M[0-9]+_[0-9]+
+§[0-9]+(\.[0-9]+)+
+\bT[0-9]+\b
+\bdim [0-9]+\.[0-9]+\b
+```
+
+If any match, **strip the reference before saving.** Rewrite to describe the code's purpose, not its spec lineage.
+
+#### Self-audit (end-of-turn)
+
+> [DETERMINISTIC → MSID]
+
+Covered by the combined awk audit in AGENTS.md HARNESS VERIFY section.
+
+### Error Registry Gate (ERROR REGISTRY GATE)
+
+> [DETERMINISTIC → ERR]
+
+
+**Family:** Observability discipline. **Source:** `docs/LOGGING_STANDARD.md` §5; canonical registry in `src/errors/error_registry.zig` (per-project, not in dotfiles).
+
+**Triggers** — every `Edit`/`Write` that:
+
+- Adds or modifies `error_code=UZ-XXX-NNN` in any source file under `src/**` or `zombiectl/**`.
+- Edits `src/errors/error_registry.zig`.
+- Touches HTTP error responses, executor frames, or CLI error surfaces.
+
+**Override:** `ERROR REGISTRY GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override.
+
+#### What this gate covers
+
+> [DETERMINISTIC → ERR]
+
+Every `err`/`warn` log mapping to a domain failure must carry an `error_code=UZ-XXX-NNN` registered in `src/errors/error_registry.zig`. Every CLI / HTTP / executor error surface must emit codes from the same registry. Drift produces ungreppable error chains across layers — operator can't trace `UZ-EXEC-012` from the CLI back to the executor frame back to the docs.
+
+#### Pre-edit check
+
+> [DETERMINISTIC → ERR]
+
+| Pattern | Rule |
+|---|---|
+| New `error_code=UZ-XXX-NNN` reference | Registry entry exists in `src/errors/error_registry.zig` in the same commit. **Blocking.** |
+| Adding a registry entry | Code follows `UZ-<CATEGORY>-<NNN>` pattern (categories: AUTH, EXEC, HTTP, REDIS, DB, CLI, EXTERNAL, INTERNAL). Hint and docs URL fields populated. |
+| Removing a registry entry | All references removed in same commit (RULE ORP — orphan sweep). |
+| Registry entry with no references in `src/**` or `zombiectl/**` | Informational — declared-but-unreferenced (dead code). |
+| Reference in source with no registry entry | Blocking — used-but-undeclared (orphan). |
+| HTTP error response | Body includes `code: "UZ-XXX-NNN"`. |
+| `zombiectl` error output | Human format: `error UZ-XXX-NNN: <message> (<context>)`. JSON format: `{ "code": "UZ-XXX-NNN", "message": ..., ... }` per `LOGGING_STANDARD.md` §8. |
+
+#### Required output (default — one line)
+
+> [DETERMINISTIC → ERR]
+
+```
+ERROR REGISTRY GATE: <file> | new-codes:<list|none> orphans:<0|N> dead-codes:<0|N informational> hint:<populated|missing>
+```
+
+Comment-only edit:
+
+```
+ERROR REGISTRY GATE: <file> | comment-only | N/A
+```
+
+Full multi-line block fires on violation:
+
+```
+ERROR REGISTRY GATE: <file>
+  Registry: src/errors/error_registry.zig
+  New codes added (this diff): <UZ-XXX-NNN, ...>
+  Code references added (this diff): <UZ-XXX-NNN at <file>:<line>, ...>
+  Orphan codes (used but not declared): <list — BLOCKING>
+  Dead codes (declared but unreferenced): <list — informational>
+  Hint/docs populated: <ok ✓ | missing for <code>>
+  Audit script: <error-codes.sh on staged diff: 0 findings ✓ | N findings>
+```
+
+#### Scope (M70)
+
+> [DETERMINISTIC → ERR]
+
+`error-codes.sh` walks the **full `src/` + `zombiectl/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
+
+#### End-of-turn audit
+
+> [DETERMINISTIC → ERR]
+
+`audits/error-codes.sh` runs as part of `make lint`. Greps `src/errors/error_registry.zig` for declared codes, then greps `src/**` and `zombiectl/**` for any `UZ-[A-Z]+-[0-9]+` literal that isn't in the registry. Reports orphans (blocking) and dead codes (informational).
+
+#### Family
+
+> [DETERMINISTIC → ERR]
+
+- `docs/LOGGING_STANDARD.md` §5 — error-code embedding rules in log records.
+- the Logging Gate section of this façade — pairs with this gate on `error_code=` audits.
+- `docs/REST_API_DESIGN_GUIDELINES.md` — HTTP error response shape includes `code`.
+- `docs/greptile-learnings/RULES.md` RULE ORP — orphan sweep on rename/delete.
+
+### UFS Gate (Unified Form for Symbols)
+
+> [DETERMINISTIC → UFS]
+
+
+**Family:** Constant discipline. **Source:** `AGENTS.md` (HARNESS VERIFY enforcement) + `dispatch/write_ts_adhere_bun.md §2` + `dispatch/write_zig.md` "RULE UFS" clauses.
+
+**Triggers** — every `Edit`/`Write` to source files under `src/`, `ui/packages/*/src/`, `ui/packages/*/app/`, `ui/packages/*/lib/`, `ui/packages/*/components/`, `ui/packages/*/pages/`, `ui/packages/*/tests/`, `zombiectl/src/`, `zombiectl/test/` matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`.
+
+**Override:** `UFS GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-only**; auto-mode does not cover.
+
+**Carve-out:** **Pin tests** keep their literals if and only if the literal IS the contract under test (`expect(formatDollars(4_710_000_000)).toBe("$4.71")`). Each pin must carry an inline `// pin test: literal is the contract` comment on or above the line.
+
+#### What this gate enforces
+
+> [DETERMINISTIC → UFS]
+
+Three discipline points, all part of RULE UFS:
+
+1. **Repeat literals → named constant.** Any string literal appearing ≥2 times in the same file (or in the same module/package — see scope ladder below) becomes a named const. Wire-format enum values (`"platform"`, `"self_managed"`, `"receive"`, `"stage"`, mode strings, posture labels, channel names, queue names, error code categories) are *always* named — even at first use, even in test fixtures.
+
+2. **Semantic numeric literals → named constant.** Numeric literals carrying meaning beyond their digits become named consts even at first use. Includes: conversion factors (powers-of-ten ≥ 1e3 used as multipliers/divisors), thresholds, sub-cent rates, time-unit factors, byte-unit factors, retry caps, sentinel offsets. Bare `1_000_000_000` in `nanos / 1_000_000_000` is a smell — `nanos / NANOS_PER_USD` is the rule.
+
+3. **Cross-runtime parity.** Any constant that exists in more than one runtime (Zig, TS, JS) **must share its identifier verbatim**, modulo case where a language idiom forces it (Zig snake_case → TS/JS SCREAMING_SNAKE is a single-runtime style choice; the *semantic* name is identical). When a literal in runtime A would benefit from a name and a sibling runtime already has that name, reuse it. When introducing a new constant, define it in every runtime that uses the same value, same commit. There is no per-constant carve-out: this applies to every cross-runtime constant, not a curated subset.
+
+The gate exists because RULE UFS is otherwise pure self-policing. Without an audit script, an inline literal in a 800-LOC editing session reliably slips past attention.
+
+#### Pre-edit checks
+
+> [DETERMINISTIC → UFS]
+
+Before saving an edit that introduces or relocates a literal:
+
+1. **Same-file repeat?** Grep within the file for the literal value. If it appears ≥1 time already, define a const at the top of the file (or in the module's `constants.ts`/`constants.zig`) and replace all occurrences.
+
+2. **Same-module repeat?** Grep within the module/package (`ui/packages/app/`, `zombiectl/src/`, `src/`). If repeated, define in the module's canonical types/constants file (`lib/types.ts`, `src/state/<topic>.zig`, `zombiectl/src/constants/<topic>.js`).
+
+3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep all three runtimes for an existing matching name. If found, reuse the name. If not, define in every runtime that uses the same value, same commit.
+
+4. **Carve-out check?** If the literal IS the contract a pin test verifies, write the `// pin test: literal is the contract` comment on or above the line. Otherwise, name it.
+
+#### Required output (per Edit/Write — one line by default)
+
+> [DETERMINISTIC → UFS]
+
+```
+UFS GATE: <file> | repeats:<count> | semantic-numerics:<count> | cross-runtime:<status> | pin-test-carve-outs:<count>
+```
+
+Multi-line block fires when repeats > 0 OR semantic-numerics > 0 OR cross-runtime status ≠ ok:
+
+```
+UFS GATE: <file>
+  Repeat string literals named: <list of value → CONSTANT_NAME pairs>
+  Repeat string literals KEPT (carve-out): <value> — <reason: pin test / single-use semantically irreducible / etc.>
+  Semantic numerics named: <list of value → CONSTANT_NAME pairs>
+  Semantic numerics KEPT: <value> — <reason>
+  Cross-runtime parity: <status — e.g. "NANOS_PER_USD added to Zig+TS+JS this commit" or "n/a — runtime-internal constant">
+```
+
+#### Scope (M70)
+
+> [DETERMINISTIC → UFS]
+
+`ufs.sh` walks the **full working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run.
+
+The previous `--diff` (`BASE...HEAD`) default was retired with M70. The forcing function was M68 commit `02c1f3cf`: pre-commit's `HEAD` is the prior commit, so `BASE...HEAD` was blind to nine cross-runtime mismatches the agent had staged but not yet committed. The full-codebase scope removes that blindspot.
+
+`--all` is accepted as a back-compat alias for the default. `--diff` is rejected with exit 2 + a pointer to this section.
+
+#### Self-audit (end-of-turn / HARNESS VERIFY)
+
+> [DETERMINISTIC → UFS]
+
+`audits/ufs.sh` is invoked at HARNESS VERIFY by the agent. Convention follows the sibling audit scripts (`logging.sh`, `error-codes.sh`, `deinit-pairs.sh`, `spec-template.sh`) — none of them wire into `make lint`; the agent runs each as part of the gate ceremony, with the result feeding the HARNESS VERIFY table. The script is generic — no manifest of known literals — so it scales as the codebase grows:
+
+```bash
+bash audits/ufs.sh          # full-codebase scan (default and only mode)
+bash audits/ufs.sh --all    # alias for default
+```
+
+The script emits a violations table. Empty table = pass. Each row is one of:
+
+- `string-dup-file <file> "<literal>" <count>` — same string ≥2× in one file
+- `string-dup-module <module> "<literal>" <count>` — same string ≥2× across a module/package
+- `numeric-suspect <file>:<line> <literal>` — power-of-ten or known unit-factor numeric not bound to a const (excludes anything on a `// pin test: literal is the contract` line)
+- `cross-runtime-orphan <const_name> <runtime>` — SCREAMING_SNAKE constant defined in one runtime, missing from a sibling runtime that the same diff touches
+
+Violations resolve by either (1) extracting to a named const + replacing all sites, (2) adding the constant in the missing sibling runtime same-commit, or (3) adding the `// pin test: literal is the contract` comment.
+
+#### HARNESS VERIFY row
+
+> [DETERMINISTIC → UFS]
+
+```
+| UFS GATE             | ✅ pass | 🟡 N violations addressed | 🔴 N unresolved |
+```
+
+🔴 unresolved → return to EXECUTE; the lifecycle does not advance.
+
+#### Failure mode this gate exists to prevent
+
+> [DETERMINISTIC → UFS]
+
+Indy's M66_001 §3 tail surfaced the failure clearly: `RULE UFS` lived as a single bullet in the former Bun rules §2 with no audit, no HARNESS VERIFY row, and no per-edit ceremony. Across an 800-LOC session the agent introduced ~20 inline literals (`"platform"`, `"self_managed"`, `"receive"`, `"stage"`, `mode: "byok"`, `1e9`, `1_000_000_000`, etc.) that the rule already covered but no mechanism caught. The rule is fine; the enforcement was missing. This gate adds the enforcement.
+
+### Greptile Gate (GREPTILE GATE)
+
+> [JUDGMENT → GRP]
+
+
+**Family:** Universal coding-rules audit. **Source:** `docs/greptile-learnings/RULES.md`.
+
+**Triggers:** fires twice per work unit — (1) per EXECUTE iteration when diff languages change (new layer/language enters the diff); (2) end-of-turn, before claiming complete.
+
+**Override:** `GREPTILE GATE: SKIPPED per user override (reason: ...)`. Violations stay in the diff and the user's override gets recorded in the spec's Discovery section.
+
+#### What this gate enforces
+
+> [JUDGMENT → GRP]
+
+`docs/greptile-learnings/RULES.md` is the universal coding-rules catalogue. The agent failure mode is grepping the spec verbatim instead of grepping the rules; this gate makes the rule audit a printable artefact.
+
+#### Common rules referenced
+
+> [JUDGMENT → GRP]
+
+| Code | Rule | Applies to |
+|---|---|---|
+| UFS | String literals are always constants | all source |
+| STS | No static strings in SQL schema | SQL |
+| EMS | Error messages follow a standard structure | Zig handlers |
+| NSQ | Named constants, schema-qualified SQL | SQL |
+| TGU | Tagged unions over optional-field structs | Zig |
+| VLT | Secrets belong in vault, not in entity tables | SQL/Zig |
+| CTM | Constant-time comparison for secrets | Zig |
+| CTC | Constant-time compare must not short-circuit on length | Zig |
+| FLL | File / function length caps | all source |
+| ORP | Cross-layer orphan sweep on rename/delete/format | all |
+| WAUTH | Workspace-IDOR safety | handlers |
+| TST-NAM | Test identifiers are milestone-free | tests |
+| PRI | No prompt injection from user input | LLM I/O |
+
+Read RULES.md for any code not in this short-list.
+
+#### Pre-print check
+
+> [JUDGMENT → GRP]
+
+1. Identify diff languages (`zig|ts|tsx|sql|sh|py|go|rs`).
+2. List rules whose `Applies to` overlaps. UFS applies to all source; STS to SQL; EMS to Zig handlers; etc.
+3. **String-literals (UFS) audit:**
+
+   ```bash
+   git diff -U0 origin/main | grep -oE '"[^"]{4,}"' | sort -u
+   ```
+
+   For each unique literal, grep `src/ ui/ zombiectl/` for an existing `const` / `pub const` / `export const` / `as const` / `Final[str]` / `readonly` declaration. Found → import. Novel + ≥2 sites → declare a const.
+
+#### Required output (one row per applicable rule, suppress non-applicable)
+
+> [JUDGMENT → GRP]
+
+```
+GREPTILE GATE: <iteration tag>  Diff langs: <…>
+| Code     | Verdict                                |
+| UFS      | clean | N violations: <list>           |
+| STS      | clean | N violations                   |
+| …        | …                                      |
+String-literals audit: <N literals scanned, M violations>
+```
+
+#### Anti-rationalisation clause
+
+> [JUDGMENT → GRP]
+
+"It's just a label" / "I'll only use it once" are not exceptions to UFS. The clause applies to every rule with a behaviour modifier — when you find yourself reaching for a justification, the rule wins.
+
+### RULE NLR — No Legacy Retained
+
+> [JUDGMENT → NLR]
+
+
+**Family:** Legacy-control. Sibling rules: **RULE NDC** (no dead code at write time), **RULE NLG** (no new legacy framing pre-v2.0.0), **Legacy-Design Consult Guard** (judgment calls on whole subsystems). **Source:** `docs/greptile-learnings/RULES.md` RULE NLR.
+
+**Triggers:** any Edit/Write to a file containing pre-existing legacy framing or dead code.
+
+**Override:** `RULE NLR: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-invokable only.** Concrete external-impact constraint OR explicit NLR DECISION resolution required. Generic "scope creep"/"too big" not valid.
+
+#### What this gate enforces
+
+> [JUDGMENT → NLR]
+
+Any edit to a file with pre-existing legacy framing or dead code MUST remove it in the same diff. Patterns covered:
+
+- `?*T = null` fields whose only caller always sets a non-null value (dead defense for a phantom caller).
+- `legacy_*` symbol names, `V2`-suffixed twin types, `if (legacy_caller)` branches.
+- `// legacy` / `// pre-M*` / `// bootstrap` comments.
+- Runtime warns saying `legacy path` / `deprecated` / `*_bootstrap_*`.
+- `pub` fns/fields with no in-tree consumer (verify with `grep -rn`).
+- `defer if (x) ... else null` patterns that compensate for an `?T` that should have been `T`.
+- Unused parameters, captures, unreachable branches.
+
+The carve-out "pre-existing violations are not the agent's responsibility" does **not** apply when the agent is already touching the file. You see it, you own it.
+
+#### Pre-edit check
+
+> [JUDGMENT → NLR]
+
+1. Before the first `Edit`/`Write` to a file, scan for the patterns above in the *whole file*, not just the lines you're touching.
+2. List violations in the gate output before the edit.
+3. Remove them in the same diff. Update every caller in the same commit.
+4. If cleanup is judged infeasible (large net-line delta, cross-package cascade, meaningfully different design path emerges), print the **NLR DECISION** block below and **wait**. The agent has no autonomous escape; the user is the only authority.
+
+#### Decision block
+
+> [JUDGMENT → NLR]
+
+```
+NLR DECISION: <file>
+  Cleanup-in-place cost: +<N> net lines, <M> files touched.
+  Alternative approach: <one-line description> (avoids the dirty file).
+  If alternative chosen, legacy that survives:
+    - <symbol/pattern>: <file:line>
+    - ...
+  WAITING for user: clean / alternative.
+```
+
+#### Required output (when violations found before edit)
+
+> [JUDGMENT → NLR]
+
+```
+NLR: <file> | violations: <list with file:line each> | action: clean-in-diff
+```
+
+#### Anti-evasion clause
+
+> [JUDGMENT → NLR]
+
+Three failure modes the agent MUST NOT use to skip cleanup:
+
+1. **Route-around design.** Picking an architecture that avoids the dirty file specifically to dodge cleanup. If NLR avoidance was a motivation, surface it.
+2. **Silent rejection.** Quietly choosing not to touch a file because cleanup looked expensive, without disclosing the decision.
+3. **Shim-and-skip.** Introducing a wrapper/adapter to sidestep a dirty interface — the new code becomes its own legacy debt; the original rots in place.
+
+If any of these patterns is in play, surface it via the NLR DECISION block. The user retains all discretion.
+
+#### Family
+
+> [JUDGMENT → NLR]
+
+- **RULE NDC** — prevention at write time (don't author dead code).
+- **RULE NLG** — ban new legacy framing pre-v2.0.0.
+- **Legacy-Design Consult Guard** — harder judgment calls ("should this whole subsystem exist") that need user input.
+- **RULE NLR** — mechanical cleanup on touch.
+
+### RULE NLG — No new Legacy framing
+
+> [JUDGMENT → NLG]
+
+
+**Family:** Legacy-control. Sibling rules: **RULE NDC**, **RULE NLR**, **Legacy-Design Consult Guard**. **Source:** `docs/greptile-learnings/RULES.md` RULE NLG.
+
+**Triggers:** introducing any new `legacy_*` name, `V2`-twin type, `if (legacy_caller)` branch, backward-compat shim, "rejecting legacy X" prose, or violation tracking-list while `cat VERSION` < `2.0.0`.
+
+**Override:** `RULE NLG: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-invokable only.** Requires a concrete external consumer that can't migrate same-commit (vanishingly rare pre-v2.0.0).
+
+#### What this gate enforces
+
+> [JUDGMENT → NLG]
+
+While `cat VERSION` < `2.0.0`, the project has no external consumers and no published API. Do not introduce *new* legacy concepts in any form:
+
+- No `legacy_*` error variant names.
+- No `if (legacy_caller)` branches.
+- No `V2`-suffixed twin types.
+- No backward-compat shims.
+- No "rejecting legacy X" prose in specs/docs/commit messages.
+
+Edit interfaces in place; update every caller in the same commit. Name errors by *what is wrong*, not *when it was wrong* (e.g. `runtime_keys_outside_block`, not `legacy_top_level_runtime`).
+
+#### Why
+
+> [JUDGMENT → NLG]
+
+Pre-alpha duplicates rot faster than documentation. Every `legacy_*` name introduces a phantom interface nobody owns; every future spec then has to reason about it. Schema Table Removal Guard already encodes this for SQL — RULE NLG generalises it to every interface (RPC, route, struct, error name, config key, spec prose).
+
+#### Tracking-list ban
+
+> [JUDGMENT → NLG]
+
+Any constant, doc structure, or carve-out list whose purpose is to catalog "violations to be cleaned up later" is itself an NLG violation. Banned name patterns: `LEGACY_`, `PENDING_`, `_VIOLATIONS`, `_CARVE_OUTS` (when meant for deferred cleanup), `TO_FIX_`, `DEFERRED_`, or any equivalent.
+
+Either fix every entry in the same diff that introduces or touches the list, or delete the list and let the next touch fix the underlying violations. The tracking list **legitimises deferral**; the rule exists to prevent that.
+
+**Vendor-immortal carve-outs** — paths or names dictated by external commitments that genuinely cannot be renamed (e.g. OAuth callback URLs that Slack/GitHub register with us) — are a separate class. Name those explicitly with `VENDOR_` or `EXTERNAL_` prefix so the distinction from "deferred cleanup" is mechanical, and add a comment line stating the external commitment that pins the name.
+
+#### Required output (when violation found)
+
+> [JUDGMENT → NLG]
+
+```
+NLG: <file>:<line> | new legacy framing: <description> | action: rename | suggested name: <what-is-wrong-form>
+```
+
+#### Full text
+
+> [JUDGMENT → NLG]
+
+`docs/greptile-learnings/RULES.md` RULE NLG.
+
+### Legacy-Design Consult Guard
+
+> [JUDGMENT → LDC]
+
+
+**Family:** Legacy-control. Sibling rules: **RULE NDC**, **RULE NLR**, **RULE NLG**. **Source:** `AGENTS.md` (project-side guard, not a greptile-derived rule).
+
+**Triggers** — STOP and consult before any of these:
+
+- Patching legacy to fit new architecture ("compensating code").
+- Keeping legacy for "backward compat" pre-alpha when there are no external consumers.
+- Defensive `orelse` / fail-open whose only reason is legacy nullability.
+- Authoring tests that exercise the legacy path.
+- Choosing patch-vs-remove silently — never your call.
+
+**Override:** none — user decides A/B/C in the consult block.
+
+#### Definition — "legacy design"
+
+> [JUDGMENT → LDC]
+
+Any code path, env-var, table, route, or API that the surrounding milestone work is deprecating, that predates the current architectural direction, or that exists solely as a smoke-test / bootstrap / pre-migration shim. Signals:
+
+- Comments like `// legacy`, `// pre-M*`, `// bootstrap`, `// TODO remove`, `// temporary`.
+- Runtime warn logs that announce themselves (`legacy path`, `deprecated`, `*_bootstrap_*`).
+- Env vars / principals / roles / schema cols whose only live consumer is a fallback branch or pre-signup/dev-only path.
+
+#### Required output
+
+> [JUDGMENT → LDC]
+
+```
+LEGACY CONSULT: <desc> | found:<file:line> | (A) remove [blast:<files>] / (B) patch [risk] / (C) keep [why] | rec:<A|B|C> because <reason> | WAITING.
+```
+
+Block on the user's reply. If the user previously approved one *class* of legacy decisions this session, note that and proceed — but every *new* class of finding still triggers a consult.
+
+#### Escape hatch
+
+> [JUDGMENT → LDC]
+
+Legacy findings unambiguously in-scope of the active spec's Dead Code Sweep or Out-of-Scope list skip the consult and follow the spec.
+
+#### Discovery capture
+
+> [JUDGMENT → LDC]
+
+Every triggered consult is logged in the active spec's **Discovery** section, or filed as a new pending spec in `docs/v{N}/pending/` if pushed to follow-up.
+
+#### Family
+
+> [JUDGMENT → LDC]
+
+NLR is the cleanup-on-touch arm; NLG bans new legacy framing pre-v2.0.0; this guard covers the harder judgment calls ("should this whole subsystem exist") that need the user's input.
diff --git a/dispatch/write_any.sh b/dispatch/write_any.sh
new file mode 100755
index 0000000..a8c48cc
--- /dev/null
+++ b/dispatch/write_any.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# dispatch/write_any.sh — the cross-cutting authoring dispatch, DETERMINISTIC façade.
+#
+# Pairs with dispatch/write_any.md (the LATENT façade — prose the agent reads).
+# Fires for ANY source file, IN ADDITION to the language façade (write_zig /
+# write_ts_adhere_bun / write_sql). Runs the mechanically-checkable cross-cutting
+# subset and emits ONE verdict block.
+#
+#   dispatch/write_any.sh <file> [...]   # explicit targets (EXECUTE)
+#   dispatch/write_any.sh --staged       # staged source (HARNESS VERIFY, pre-commit)
+#
+# Layering:  AGENTS.md → write_any.md (latent) → write_any.sh (this) → audits/*.sh
+# Signals:   🟢 pass · 🔴 fail (blocks) · 🔵 DECIDE (judgment; blocks the TURN, not the script) · ⚪ delegated
+# Exit:      0 = mechanical gates pass · 1 = ≥1 failed · 2 = usage error.
+#
+# Leaf modes are verified against each script's own arg-parser (lib.sh warns the
+# contracts are NON-UNIFORM): ufs.sh takes --all only (--staged retired M70);
+# logging.sh / error-codes.sh / msid-ui.sh all accept --staged.
+# The fn≤50/method≤70 sub-cap (write_any.md, file-length card) is a TODO-CHECK:
+# dispatch_length_gate enforces only the file cap; no fn/method leaf is wired yet.
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+dispatch_init "ANY" '*.zig' '*.ts' '*.tsx' '*.js' '*.jsx' '*.py' '*.rs' '*.go' '*.sh' '*.sql'
+dispatch_resolve_files "$@"
+dispatch_header
+
+# ── deterministic gates ────────────────────────────────────────────
+dispatch_length_gate 350                                       # FLL — file cap (fn/method 50/70 = TODO-CHECK)
+dispatch_run_helper "UFS"  "ufs.sh"          "--all"
+dispatch_run_helper "LOG"  "logging.sh"      "--staged"
+dispatch_run_helper "MSID" "msid-ui.sh"      "--staged"
+
+# ── delegations (run only in the product repo — need state absent from dotfiles) ──
+# ERR's leaf hard-exits if src/zombied/errors/error_registry.zig is absent (it
+# cross-references emitted codes against the registry), unlike UFS/LOG/MSID which
+# pass gracefully on empty input. So it can't run in dotfiles — delegate it; the
+# product repo's `make harness-verify` runs error-codes.sh against the real
+# registry. The .md keeps [DETERMINISTIC → ERR]: deterministic, just not run here.
+dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs src/zombied/errors/error_registry.zig)"
+
+# ── judgment gates (no script can decide; agent states verdict in chat) ──
+dispatch_judgment "GRP" "per-iteration (diff langs change) + end-of-turn: audit the diff against docs/greptile-learnings/RULES.md — one row per applicable code (UFS/ORP/TST-NAM/PRI/EMS/…); \"it's just a label\" is not an exception"
+dispatch_judgment "NLR" "touching a file with legacy framing / dead code? clean it in the same diff (touch-it-fix-it), or state the surviving legacy + why — never retain silently"
+dispatch_judgment "NLG" "new legacy_* / V2 twin / compat shim / tracking-list while VERSION < 2.0.0? rename to the what-is-wrong form; no new legacy framing pre-2.0"
+dispatch_judgment "LDC" "patching / keeping / testing a legacy-design path? consult Indy — A (remove) / B (patch) / C (keep) — before proceeding; no unilateral call"
+
+dispatch_verdict
diff --git a/dispatch/write_auth.md b/dispatch/write_auth.md
new file mode 100644
index 0000000..7246ea7
--- /dev/null
+++ b/dispatch/write_auth.md
@@ -0,0 +1,36 @@
+# write_auth.md — auth-flow surface dispatch (LATENT façade, fully delegated)
+
+This is the prose the AGENT reads **before touching any auth-flow, token-minting,
+or credential-typed code**. It is **fully ⚪ delegated**: the canonical rule doc
+`AUTH.md` lives in the **product repo**, not in dotfiles, so dotfiles cannot
+mechanically prove its coverage. This façade carries only the trigger + the routing
++ the cross-cutting auth invariants that hold regardless of repo.
+
+**Signal legend:**
+
+- ⚪ delegated — the auth rules + their checks live and run in the product repo
+  (usezombie `docs/AUTH.md`). Dotfiles routes to them and enforces the
+  always-forbidden credential rules (below) that apply everywhere.
+
+## Trigger — read the product repo's `docs/AUTH.md` before
+
+- Editing `src/auth/**`, `ui/packages/app/lib/auth/**`, token-minting handlers,
+  or any credential-typed spec dimension.
+
+**Override:** none — auth is a security boundary.
+
+## Always-forbidden (these hold in dotfiles too, per AGENTS.md Hard Safety)
+
+- **Plaintext secrets in entity tables** — store a vault `key_name` ref, resolve
+  via `crypto_store.load()` at runtime.
+- **Resolving/printing credentials** — never `op read 'op://...'` into logs or
+  output at runtime; never paste a resolved secret.
+- **Static credential strings in SQL schema** — no `DEFAULT 'value'` /
+  `CHECK (col IN (...))`; enforce in app via named constants.
+
+## What it routes to
+
+`docs/AUTH.md` **in the product repo** — token lifecycle, session shape, the
+auth middleware chain, and credential storage rules. Read it first for any
+auth-flow change; this façade exists so the dispatch table has a home for the
+trigger even though the rule body ships with the product, not dotfiles.
diff --git a/dispatch/write_changelog.md b/dispatch/write_changelog.md
new file mode 100644
index 0000000..5798195
--- /dev/null
+++ b/dispatch/write_changelog.md
@@ -0,0 +1,61 @@
+# write_changelog.md — changelog-voice dispatch (LATENT façade)
+
+This is the prose the AGENT reads **before writing any `<Update>` entry in the
+changelog** (`~/Projects/docs/changelog.mdx`). Like `verify` and
+`name_architecture`, it has **no deterministic `.sh` half** — voice is a judgment
+call no script can grade. It is a pure **🔵 judgment** dispatch: the agent reads
+this, drafts the entry, and self-audits against the rules below. The deep
+reference is `docs/CHANGELOG_VOICE.md` (Mintlify-style) — read it before writing.
+
+**Signal legend:**
+
+- 🔵 DECIDE — judgment-only; the agent writes to the voice below and self-audits.
+  No script gates it — it blocks the *turn* (the changelog entry), not a commit.
+- ⚪ delegated — the changelog itself lives in `~/Projects/docs` (its own repo +
+  own-branch flow per AGENTS.md Operational defaults); dotfiles carries only the
+  voice discipline.
+
+## Trigger — read `docs/CHANGELOG_VOICE.md` before
+
+Fires before adding or editing an `<Update>` block in `changelog.mdx`, or any
+user-visible release note. Internal-only changes get **no** changelog entry — the
+Changelog Claim Challenge applies: *"Would this be true if the test file
+vanished?"* Only test evidence (not a middleware/handler/CLI path) ≠ an earned
+user-visible claim.
+
+**Override:** none needed — judgment-only. A voice exception (e.g. quoting a
+vendor's marketing term verbatim) is stated inline in the entry, never dressed as
+a gate skip.
+
+## The voice (summary — `docs/CHANGELOG_VOICE.md` is canonical)
+
+- **One headline per entry.** The lead paragraph states *the change*, not the
+  announcement ("X now does Y", not "We're excited to announce Y").
+- **No marketing words** — `seamless` / `magical` / `powerful` / `robust` are banned.
+- **Bullets** follow `**Bold lead-noun** — consequence-first clause`.
+- **Never drop load-bearing facts** — error codes, endpoints, env vars, schema
+  names, money amounts stay verbatim.
+- **Internal cleanup** gets aggressive trimming, not a paragraph.
+- **History is archived, not rewritten** — past entries are an immutable record.
+- **Rate constants** stay pinned across the three files (`tenant_billing.zig`,
+  `rates.ts`, `rates.mdx`) — a changelog money/rate claim must match all three.
+
+## Required output (self-audit line before committing the changelog)
+
+```
+📝 CHANGELOG: <N> bullet(s) · no marketing words · load-bearing facts kept · history append-only
+```
+
+If the change is internal-only, emit instead:
+
+```
+📝 CHANGELOG: skipped — internal-only (no user-visible behaviour change)
+```
+
+## Family
+
+- `docs/CHANGELOG_VOICE.md` — the canonical Mintlify-style voice rules (deep reference).
+- `skills/release-template.md` — release template + version-bump matrix; re-source
+  each release, never paraphrase.
+- `verify` — runs before CHORE(close); a changelog claim must be backed by the
+  verification that dispatch reports.
diff --git a/dispatch/write_http.md b/dispatch/write_http.md
new file mode 100644
index 0000000..8548506
--- /dev/null
+++ b/dispatch/write_http.md
@@ -0,0 +1,40 @@
+# write_http.md — HTTP/REST surface dispatch (LATENT façade, route-and-delegate)
+
+This is the prose the AGENT reads **before adding, modifying, or removing any HTTP
+endpoint**. Unlike `write_zig`, it does **not** merge its rule doc — the canonical
+761-line checklist `docs/REST_API_DESIGN_GUIDELINES.md` is a self-contained
+product-surface design guide, so this façade *routes* to it rather than
+duplicating it. The deterministic checks run in the **product repo** (`make lint`
+/ `/review` against the REST guide), not in dotfiles — hence **⚪ delegated**.
+
+**Signal legend:**
+
+- ⚪ delegated — the REST checklist is enforced in the product repo (usezombie),
+  by `make lint` + adversarial `/review`/`/review-pr` against the guide. Dotfiles
+  carries only the routing + the discipline that the guide is a *checklist, not
+  background reading*.
+
+## Trigger — read `docs/REST_API_DESIGN_GUIDELINES.md` before
+
+- Editing `src/http/handlers/**`, `public/openapi/**`, or any `route_*` file.
+- Adding, modifying, or removing an HTTP endpoint or its OpenAPI shape.
+
+**Override:** none from dotfiles — the REST guide's own `MUST`/`SHOULD`
+semantics govern (a `MUST` violation blocks merge; a `SHOULD` deviation needs a
+one-line PR rationale).
+
+## What it routes to
+
+[`docs/REST_API_DESIGN_GUIDELINES.md`](../docs/REST_API_DESIGN_GUIDELINES.md) —
+canonical instruction set covering URL design (plural-noun resources, no verbs,
+allowed `:verb` categories), path params + trailing-slash rules, HTTP-method
+semantics + PATCH idempotency, the `202 + /v1/operations/{id}` long-running shape,
+request/response body shapes, error envelopes, pagination, and the pre-PR §10
+gate. Treat it as a checklist run at `CHORE(close)` before `gh pr create`.
+
+## Why route, not merge
+
+REST design rules bind the *product repo's* HTTP surface, which does not exist in
+dotfiles. Merging 761 lines here would duplicate a doc with no dotfiles consumer
+and create a second source of truth. The guide stays canonical; this façade is the
+dispatch entry that points the agent at it when the trigger fires.
diff --git a/dispatch/write_spec.md b/dispatch/write_spec.md
new file mode 100644
index 0000000..392b0ea
--- /dev/null
+++ b/dispatch/write_spec.md
@@ -0,0 +1,85 @@
+# write_spec.md — spec-authoring dispatch (LATENT façade)
+
+This is the prose the AGENT reads **before writing or editing a spec** under
+`docs/v*/{pending,active,done}/`. It pairs with the deterministic half
+`audits/spec.sh` (named `audits/spec-template.sh` until the Stage-2 rename),
+which runs in `make lint`. (This is the former Spec Template gate absorbed into
+the dispatch model — `docs/TEMPLATE.md` remains the canonical section source.)
+
+**Signal legend:**
+
+- 🟢 / 🔴 — `audits/spec.sh` mechanically passes/fails the prohibited-pattern and
+  required-section checks.
+- 🔵 DECIDE — whether a required section is *meaningfully filled* (not just
+  present) is the agent's judgment at author time.
+
+## Trigger — every Edit/Write to
+
+- Any spec under `docs/v*/{pending,active,done}/**/*.md`.
+- `docs/TEMPLATE.md` itself.
+- Any `*.md` whose body carries the spec frontmatter pattern (`^**Milestone:** M\d+`).
+
+**Override:** `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`.
+**User-invokable only.** Auto-mode does NOT cover it; reasons must cite a concrete
+external constraint (vendor doc requirement, regulatory format), never internal
+preference.
+
+## What this covers
+
+**Family 1 — prohibited patterns (negative space).** `docs/TEMPLATE.md`
+"Prohibited" forbids: time/effort estimates, effort columns, complexity ratings,
+percentage-complete fields, assigned owners, implementation dates. Specs created
+from the template don't carry the Prohibited section forward — only the body
+below the divider gets copied — so without enforcement these drift back in.
+
+**Family 2 — required-present + no-placeholder (positive space).** The
+agent-facing template mandates the determinism sections the executing agent reads
+to emit invariant output: PR Intent & comprehension handshake, Applicable Rules,
+Applicable Gates, Overview, Prior-Art / Reference Implementations, Files Changed,
+Decomposition & alternatives, Sections, Interfaces, Failure Modes, Invariants,
+Test Specification, Acceptance Criteria, Discovery. A spec missing one — or
+leaving template residue (`path/to/file.ext`, `test_<short_name>`,
+`{one-line reason}`) — forces the agent to guess intent.
+
+**Scope (no legacy carve-out).** Family 2 fires in `--staged` only — the spec
+being authored now (the agent's own output): BLOCK. Bulk scans (`--all` /
+`--include-done`, which `make harness-verify` runs) execute Family 1 only, so they
+behave identically over the corpus and never break an existing spec.
+
+## Pre-edit check
+
+| Pattern | Rule |
+|---|---|
+| `## Estimated effort` (any heading variant) | Forbidden. Delete the section. |
+| `## Effort` / `## Complexity` / `## Sizing` | Forbidden. Use Priority. |
+| `\b\d+\s*[-–]\s*\d+\s*h\b` (hour ranges like "10-14h") | Forbidden. |
+| `\b\d+\s*hours?\b` / `\b\d+\s*days?\b` / `\b\d+\s*min(utes?)?\b` | Forbidden. |
+| `\b(low|medium|high|small|large)\s*[:|-]\s*(effort|complexity)\b` | Forbidden. |
+| `\d+%\s*complete` / `\b\d+/\d+\b\s*tasks` | Forbidden — binary PENDING/IN_PROGRESS/DONE. |
+| `**Owner:**` / `**Assigned to:**` | Forbidden — use git history. |
+| `**Due:**` / `**Deadline:**` (with date) | Forbidden — use Priority. |
+| Missing a required determinism section in a **staged** spec | BLOCK — add it. |
+| Unfilled template residue in a **staged** spec | BLOCK — fill the section. |
+| Spec without the SPEC AUTHORING RULES banner | Informational — reminds future edits. |
+
+## Required output (default — one line)
+
+```
+SPEC TEMPLATE GATE: <file> | prohibited:<0|list> required-sections:<all-present|missing-list — staged only> placeholders:<0|list> banner:<yes|no>
+```
+
+Full multi-line block fires on violation (prohibited sections / time estimates /
+effort fields / %-complete / owner-date fields, each with line numbers, plus the
+`audits/spec.sh` staged-diff finding count).
+
+## Scope (M70)
+
+`audits/spec.sh` walks the **full pending+active spec set** via `git ls-files`;
+the index includes staged-but-uncommitted content, so a fix staged in pre-commit
+satisfies the check on the same hook run. `--staged` is the opt-in narrowing mode.
+
+## Family
+
+- `docs/TEMPLATE.md` — canonical Prohibited section + required sections.
+- `kishore-spec-new` skill — creates specs from the template; inserts the banner.
+- `audits/spec.sh` — mechanical regex enforcement, runs in `make lint`.
diff --git a/dispatch/write_sql.md b/dispatch/write_sql.md
new file mode 100644
index 0000000..aace781
--- /dev/null
+++ b/dispatch/write_sql.md
@@ -0,0 +1,111 @@
+# write_sql.md — SQL / schema latent façade
+
+This is the prose the AGENT reads before writing any `schema/*.sql` file. It pairs with the deterministic façade `dispatch/write_sql.sh` — the machine half that runs the mechanically-checkable subset and emits one verdict block. **Read `docs/SCHEMA_CONVENTIONS.md` first** — it is the source-of-truth for table/column naming, type choices, and schema-qualification (the analogue of `docs/REST_API_DESIGN_GUIDELINES.md` for `write_http`). The dissolving **Schema Table Removal Guard** card is merged verbatim below, while the durable SQL rules (`NSQ`, `STS`, `SGR`, `ITF`) stay in `docs/greptile-learnings/RULES.md` (retained) — referenced here, enforced by the GREPTILE GATE. Mechanical thresholds live once in the `.sh`; this file references rule codes, never restates the numbers.
+
+**Signal legend** (printed by `write_sql.sh`):
+
+- 🟢 pass — deterministic check passed.
+- 🔴 fail — deterministic check failed (or helper absent); STOP, fix, rerun.
+- 🔵 DECIDE — judgment-only; no script can decide, the agent reads the section and makes the call (blocks the TURN, not the script).
+- ⚪ delegated — the checker runs only in the product repo, not in dotfiles.
+
+**Tag legend** — each section heading below carries one of:
+
+- `> [DETERMINISTIC → <CODE>]` — a machine can pass/fail it; the `.sh` row for `<CODE>` (e.g. `FLL`) enforces it. `TODO-CHECK` marks a mechanizable rule with no helper wired yet (build-the-check). `NEW:<name>` marks a proposed-but-not-yet-existing code.
+- `> [JUDGMENT → <CODE>]` — no script can decide; the agent decides at write time against the prose.
+- `> [container]` — a non-enforcement wrapper heading (e.g. "Merged from dissolved gate cards"); its tagged subsections carry the real codes, and the coherence audit (§6.3) skips it.
+
+See [`docs/DISPATCH_ARCHITECTURE.md`](../docs/DISPATCH_ARCHITECTURE.md) §3 for the tag grammar and semantic-anchor model.
+
+---
+
+# SQL & schema authoring discipline
+
+## Scope
+
+> [JUDGMENT → SCH]
+
+Triggers on every `Edit`/`Write` to `schema/*.sql`, `schema/embed.zig` (`@embedFile` constants), and the canonical migration array in `src/cmd/common.zig`. **Before authoring DDL, read `docs/SCHEMA_CONVENTIONS.md`** (naming, types, schema-qualification). SQL embedded in handlers (`*.zig`) and integration-test fixtures is also governed by the companion rules below — those surfaces additionally fire `write_zig.md` and the GREPTILE GATE.
+
+## Merged from dissolved gate cards
+
+> [container]
+
+The **Schema Table Removal Guard** card dissolves into this façade; its prose is preserved verbatim below (title demoted to a tagged `###`, its subsections demoted to `####` and tagged `SCH`).
+
+### Schema Table Removal Guard (SCHEMA GUARD)
+
+> [JUDGMENT → SCH]
+
+**Family:** Schema discipline. **Source:** `AGENTS.md` (project-side guard). Related: **RULE STS** (no static strings in SQL schema), **RULE NSQ** (named constants, schema-qualified SQL) — both in `docs/greptile-learnings/RULES.md`.
+
+**Triggers** — before any of these, run `cat VERSION` and print the guard output:
+
+- Creating, editing, or deleting any file under `schema/*.sql`.
+- Editing `schema/embed.zig` (any `@embedFile` constant).
+- Editing the canonical migration array in `src/cmd/common.zig`.
+- Writing `DROP TABLE`, `ALTER TABLE`, or `SELECT 1;` into any SQL file.
+- Accepting a spec dimension prescribing a "DROP migration", "ALTER migration", or "version marker".
+
+**Override:** `SCHEMA GUARD: SKIPPED per user override (reason: ...)`. **User-invokable only.** Spec violates the guard → amend the spec first.
+
+#### Pre-v2.0.0 (teardown-rebuild era)
+
+> [JUDGMENT → SCH]
+
+To remove a table:
+
+1. `rm schema/NNN_foo.sql`
+2. Remove `@embedFile` from `schema/embed.zig`
+3. Remove the entry from the migration array in `src/cmd/common.zig` and update length + index-based tests.
+
+**Forbidden:** `ALTER TABLE`, `DROP TABLE`, `SELECT 1;` markers, comment-only files, "keep file for slot numbering". Slot gaps are fine — the DB is wiped on rebuild.
+
+#### v2.0.0+
+
+> [JUDGMENT → SCH]
+
+Proper `ALTER`/`DROP` migrations in new numbered files. No teardown.
+
+#### Required output
+
+> [JUDGMENT → SCH]
+
+```
+SCHEMA GUARD: VERSION=<v> (<2.0.0 ? teardown : alter)
+  rm:schema/<file>.sql
+  rm-embed:<const>
+  rm-migration:v<N>
+```
+
+For pre-v2.0.0 path, all three rm- lines appear. For v2.0.0+, replace with `migration:schema/<NNN>_<change>.sql`.
+
+## Companion SQL rules (retained in `docs/greptile-learnings/RULES.md`)
+
+> [container]
+
+These rules are **not** dissolved — they remain in `docs/greptile-learnings/RULES.md`. STS/NSQ/SGR are enforced by the GREPTILE GATE until a leaf check is wired (`TODO-CHECK`); ITF additionally surfaces as a `🔵 DECIDE` judgment row in `write_sql.sh`. Summarised here so the SQL author sees the full surface in one place; RULES.md stays canonical (read it for the full text + `Ref:` provenance).
+
+### RULE STS — No static strings in SQL schema
+
+> [DETERMINISTIC → TODO-CHECK]
+
+Never `DEFAULT` or `CHECK (… IN (…))` with hardcoded strings in schema — SQL cannot reference Zig/JS constants, so schema strings drift from code. Enforce value constraints via application constants. (RULES.md `RULE STS`.)
+
+### RULE NSQ — Named constants, schema-qualified SQL
+
+> [DETERMINISTIC → TODO-CHECK]
+
+No magic numbers; all SQL in handlers is schema-qualified (`core.table`, not `table`) — unqualified names fail when `search_path` differs across environments. (RULES.md `RULE NSQ`.)
+
+### RULE SGR — Migrations include GRANT statements
+
+> [DETERMINISTIC → TODO-CHECK]
+
+Every `CREATE TABLE` migration ends with `GRANT`s for every role that queries the table (`api_runtime` / `worker_runtime`), mirroring the table's callers. PostgreSQL denies by default — a missing grant fails only at first runtime use. (RULES.md `RULE SGR`.)
+
+### RULE ITF — Integration tests use the real schema
+
+> [JUDGMENT → ITF]
+
+An integration test touching a production table seeds rows through a shared `src/db/test_fixtures_<scope>.zig` module against the real schema — never a session-local `CREATE TEMP TABLE` mocking the production shape (the mock drifts and hides schema changes). Fixtures use semantic scope names, never milestone-numbered ones. (RULES.md `RULE ITF`.)
diff --git a/dispatch/write_sql.sh b/dispatch/write_sql.sh
new file mode 100755
index 0000000..6cf3fb9
--- /dev/null
+++ b/dispatch/write_sql.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# dispatch/write_sql.sh — the SQL / schema dispatch, DETERMINISTIC façade.
+#
+# Pairs with dispatch/write_sql.md (the LATENT façade — prose the agent reads).
+# This .sh runs the mechanically-checkable subset of the SQL/schema discipline and
+# emits ONE verdict block. The latent trigger ("about to write a schema/*.sql file")
+# dispatches here; everything below is deterministic and re-runnable.
+#
+#   dispatch/write_sql.sh <schema/file.sql> [...]   # explicit targets (EXECUTE)
+#   dispatch/write_sql.sh --staged                  # staged schema/*.sql (HARNESS VERIFY, pre-commit)
+#
+# Layering:  AGENTS.md → write_sql.md (latent) → write_sql.sh (this) → audits/*.sh
+# Signals:   🟢 pass · 🔴 fail (blocks) · 🔵 DECIDE (judgment; blocks the TURN, not the script) · ⚪ delegated
+# Exit:      0 = mechanical gates pass · 1 = ≥1 failed · 2 = usage error.
+#
+# Note: STS/NSQ/SGR are mechanizable SQL-hygiene rules with no leaf check wired yet
+# (write_sql.md tags them TODO-CHECK). They stay in docs/greptile-learnings/RULES.md
+# (retained) and the GREPTILE GATE enforces them by review until a leaf exists.
+# SCH's pre-2.0 forbidden-token floor (no ALTER/DROP/SELECT 1; in schema/*.sql) is
+# itself a build-the-check (TODO-CHECK) candidate; the teardown-vs-ALTER disposition
+# call above it stays JUDGMENT (which file to rm, which @embedFile, which migration index).
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+dispatch_init "SQL" 'schema/*.sql'
+dispatch_resolve_files "$@"
+dispatch_header
+
+# ── deterministic gates ────────────────────────────────────────────
+dispatch_length_gate 350                                       # FLL — file ≤ 350
+
+# ── judgment gates (no script can decide; agent states verdict in chat) ──
+dispatch_judgment "SCH" "removing/altering a table? cat VERSION — pre-2.0.0 = full teardown (rm schema/NNN.sql + @embedFile + migration-array entry + index tests), never ALTER/DROP/SELECT 1; ≥2.0.0 = numbered ALTER/DROP migration. print the SCHEMA GUARD block"
+dispatch_judgment "ITF" "integration test touching a production table? seed via src/db/test_fixtures_<scope>.zig against the real schema — never CREATE TEMP TABLE mocking the production shape"
+
+dispatch_verdict
diff --git a/docs/BUN_RULES.md b/dispatch/write_ts_adhere_bun.md
similarity index 51%
rename from docs/BUN_RULES.md
rename to dispatch/write_ts_adhere_bun.md
index 64097a6..b5cfb6c 100644
--- a/docs/BUN_RULES.md
+++ b/dispatch/write_ts_adhere_bun.md
@@ -1,11 +1,34 @@
-# BUN_RULES — TypeScript / Bun discipline
+# write_ts_adhere_bun.md — TypeScript / Bun latent façade
 
-Modelled on `ZIG_RULES.md`. Pre-design rules, decisive defaults, and the
+This is the prose the AGENT reads before writing any `*.ts` / `*.tsx` / `*.js` / `*.jsx` file. It pairs with the deterministic façade `dispatch/write_ts_adhere_bun.sh` — the machine half that runs the mechanically-checkable subset and emits one verdict block. This document consolidates the former Bun/TypeScript rules merged with the TypeScript-relevant dissolved gate-card deltas (UI substitution, design-token): every original rule line is preserved verbatim (one forward-looking repoint to `write_zig.md`), each `## ` section now carries exactly one enforcement tag, and the dissolved gate-card prose is appended under "Merged from dissolved gate cards." Mechanical thresholds live once in the `.sh`; this file references rule codes, never restates the numbers.
+
+**Signal legend** (printed by `write_ts_adhere_bun.sh`):
+
+- 🟢 pass — deterministic check passed.
+- 🔴 fail — deterministic check failed (or helper absent); STOP, fix, rerun.
+- 🔵 DECIDE — judgment-only; no script can decide, the agent reads the section and makes the call (blocks the TURN, not the script).
+- ⚪ delegated — the checker runs only in the product repo, not in dotfiles.
+
+**Tag legend** — each section heading below carries one of:
+
+- `> [DETERMINISTIC → <CODE>]` — a machine can pass/fail it; the `.sh` row for `<CODE>` (e.g. `UFS`, `FLL`, `UIS`, `DTK`, `TSC`) enforces it. `TODO-CHECK` marks a mechanizable rule with no helper wired yet (build-the-check). `NEW:<name>` marks a proposed-but-not-yet-existing code.
+- `> [JUDGMENT → <CODE>]` — no script can decide; the agent decides at write time against the prose.
+- `> [container]` — a non-enforcement wrapper heading (e.g. "Merged from dissolved gate cards"); its tagged subsections carry the real codes, and the coherence audit (§6.3) skips it.
+
+See [`docs/DISPATCH_ARCHITECTURE.md`](../docs/DISPATCH_ARCHITECTURE.md) §3 for the tag grammar and semantic-anchor model.
+
+---
+
+# Bun / TypeScript discipline
+
+Modelled on `write_zig.md`. Pre-design rules, decisive defaults, and the
 anti-patterns each rule exists to prevent. Every rule has a one-line
 "why" so you can judge edge cases.
 
 ## Scope
 
+> [JUDGMENT → TSJ]
+
 Triggers on every `Edit`/`Write` to:
 
 - `*.ts`, `*.tsx`, `*.js`, `*.jsx` outside `vendor/`, `node_modules/`, `.next/`, `dist/`, `build/`.
@@ -13,10 +36,12 @@ Triggers on every `Edit`/`Write` to:
 
 Out of scope: framework-generated files (Next.js generated types, Astro `.astro`).
 
-The **UI Component Substitution Gate** (`docs/gates/ui-substitution.md`) and **GREPTILE GATE** (which carries RULE UFS, RULE TGU, RULE PRI for TypeScript) sit on top of this file — they fire in addition to these rules, not instead of them.
+The **UI Component Substitution Gate** (the UI Component Substitution section below) and **GREPTILE GATE** (which carries RULE UFS, RULE TGU, RULE PRI for TypeScript) sit on top of this file — they fire in addition to these rules, not instead of them.
 
 ## §1 · TS FILE SHAPE DECISION (mandatory at PLAN)
 
+> [JUDGMENT → FSD]
+
 Before writing the first line of any new `*.ts`/`*.tsx` file under `src/`, `app/`, or `lib/`, print:
 
 ```
@@ -44,6 +69,10 @@ TS FILE SHAPE DECISION: <intended-path>
 
 ## §2 · `const` discipline
 
+> [DETERMINISTIC → UFS]
+
+_`UFS` is a universal rule **enforced once by `write_any`** (which fires for every source file); this façade carries its prose for the author but does not re-run `audit-ufs` — no redundant full-tree scan (`DISPATCH_ARCHITECTURE.md` §16, Decision 6)._
+
 - **`const` by default. `let` only when the variable is reassigned in the same scope.** Never `let` "because I might change it later". A future-tense `let` is dead-on-arrival.
 - **No `var`. Ever.** Hoisting is a bug nursery; the lint rule should be a hard error in `tsconfig`/`eslint.config.ts`.
 - **Module-level constants are `SCREAMING_SNAKE_CASE`** when they're tunables (timeouts, limits, magic numbers). `camelCase` when they're configuration values composed at runtime (`const config = {...}`).
@@ -55,6 +84,8 @@ TS FILE SHAPE DECISION: <intended-path>
 
 ## §3 · Import discipline
 
+> [DETERMINISTIC → TSC]
+
 - **`import type { X } from "..."`** for type-only imports. Bun's TypeScript transpile drops type-only imports without analysis — using value imports for types adds bundle weight and complicates tree-shaking.
 - **No default exports** for application code. Default exports break renaming, hide rebinding, and confuse `import` autocomplete. Exception: framework conventions that require it (Next.js page/layout, Astro components).
 - **Side-effect imports last** (`import "./bootstrap"`). Distinguish `import "./reset.css"` from value imports by physical position — eyeballs need that signal.
@@ -62,6 +93,8 @@ TS FILE SHAPE DECISION: <intended-path>
 
 ## §4 · Bun-native primitives over Node compat
 
+> [JUDGMENT → TSJ]
+
 | Task | Use | Avoid (unless explicit reason) |
 |---|---|---|
 | HTTP server | `Bun.serve({ fetch, port })` | `express`, `fastify`, `hono` (unless a specific middleware is needed) |
@@ -78,6 +111,8 @@ The Bun runtime is the constraint. If a dependency forces Node-compat, document
 
 ## §5 · Type discipline at parse boundaries
 
+> [JUDGMENT → TGU]
+
 - **Never `any`.** Use `unknown` and narrow.
 - **Narrow at parse boundaries** — when JSON crosses a network/storage boundary, validate with a real schema (Zod / Valibot / TypeBox). Trust nothing from outside the process.
 - **Branded types for IDs** (`type WorkspaceId = string & { readonly _brand: "WorkspaceId" }`). Prevents passing a `UserId` where a `WorkspaceId` is expected — a compile-time bug class that's expensive at runtime.
@@ -92,6 +127,8 @@ The Bun runtime is the constraint. If a dependency forces Node-compat, document
 
 ## §6 · File ordering
 
+> [DETERMINISTIC → TSC]
+
 ```ts
 // 1. Type-only imports
 import type { Workspace, User } from "./types";
@@ -118,6 +155,8 @@ Side-effect imports land **after** value imports if order matters; otherwise gro
 
 ## §7 · Naming
 
+> [DETERMINISTIC → TSC]
+
 | Construct | Convention | Example |
 |---|---|---|
 | Variable / function | camelCase | `parseWorkspace`, `cachedTokens` |
@@ -130,6 +169,8 @@ Side-effect imports land **after** value imports if order matters; otherwise gro
 
 ## §8 · `bun:test` discipline
 
+> [DETERMINISTIC → TODO-CHECK]
+
 - **One test file per source file**, sibling-named (`workspace-store.test.ts` next to `workspace-store.ts`). Mirrors RULE TST-NAM.
 - **Use `bun:test` exports** — `test`, `expect`, `describe`, `beforeEach`, `afterEach`, `mock`. Never import from `vitest`/`jest` even if the API looks identical.
 - **No milestone IDs in test names** (RULE TST-NAM). Tests describe behaviour, not provenance.
@@ -138,6 +179,8 @@ Side-effect imports land **after** value imports if order matters; otherwise gro
 
 ## §9 · Error handling
 
+> [JUDGMENT → TSJ]
+
 Pick one style per module — never mix:
 
 - **Throw** (`throw new TypeError(...)`) when the caller cannot reasonably handle the error and the program should die or unwind.
@@ -149,6 +192,8 @@ In a Result-style module, **never throw**. In a throw-style module, **never retu
 
 ## §10 · Anti-patterns (named, banned)
 
+> [DETERMINISTIC → TSC]
+
 | Pattern | Why banned |
 |---|---|
 | `let` for "I might change it later" | Future-tense reassignment is a bug pretending to be flexibility. |
@@ -162,6 +207,8 @@ In a Result-style module, **never throw**. In a throw-style module, **never retu
 
 ## §11 · Runtime resource discipline
 
+> [DETERMINISTIC → TODO-CHECK]
+
 TypeScript makes unbounded work look cheap. Bun will still allocate, queue, block, and leak process handles if the code shape is sloppy.
 
 ### Promise concurrency
@@ -210,6 +257,8 @@ Returning a `Response` from a helper transfers body consumption outside this tim
 
 ## §12 · Override syntax
 
+> [JUDGMENT → TSJ]
+
 Per-rule override:
 
 ```
@@ -220,7 +269,221 @@ immediately preceding the edit. **User-invokable only.** Generic "scope creep" /
 
 ## §13 · Family
 
+> [DETERMINISTIC → FLL]
+
 - Universal rules (RULE UFS, RULE TGU, RULE PRI, RULE FLL, RULE ORP, RULE TST-NAM) live in `docs/greptile-learnings/RULES.md` and apply to TypeScript via the **GREPTILE GATE**.
-- Frontend visual primitives live in `docs/gates/ui-substitution.md` (UI GATE).
-- Length caps live in `docs/gates/file-length.md` (LENGTH GATE — file ≤ 350, fn ≤ 50, method ≤ 70 — same as every other source language).
+- Frontend visual primitives live in the UI Component Substitution section of this façade (UI GATE).
+- Length caps live in `dispatch/write_any.md` (LENGTH GATE — file ≤ 350, fn ≤ 50, method ≤ 70 — same as every other source language).
 - This file is the **TypeScript / Bun-specific** layer that those universal rules cannot express. Read it once at session start, re-read on sub-task shape change.
+
+## Merged from dissolved gate cards
+
+> [container]
+
+The TypeScript-relevant gate cards (`ui-substitution`, `design-token`) dissolve into this façade. Their prose is preserved verbatim below (headings demoted one level; words unchanged), and — matching `write_zig.md` — each subsection carries its own enforcement tag (`UIS` for the UI gate, `DTK` for the design-token gate). The mechanical checks delegate to `make lint`: the audit scripts (`msid-ui.sh`, `design-tokens.sh`) scan `ui/packages/**`, which exists in the product repo, not in dotfiles, so the dispatch emits `⚪ DELEGATED` for them here.
+
+### UI Component Substitution (UI GATE)
+
+> [DETERMINISTIC → UIS]
+
+
+**Family:** Frontend design-system discipline. **Source:** `AGENTS.md` (project-side guard). Authoritative primitive set: `ui/packages/design-system/src/index.ts`.
+
+**Triggers** — every `Edit`/`Write` to a `*.tsx` / `*.jsx` under `ui/packages/app/` **or** `ui/packages/website/`. Both packages share the same design-system source of truth (`@usezombie/design-system`), so the same primitive-first standard applies. Tests (`*.test.tsx`) and Playwright specs (`tests/e2e/**`) are exempt — they assert on rendered DOM and frequently use raw selectors.
+
+**Override:** `UI GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit.
+
+#### What this gate enforces
+
+> [DETERMINISTIC → UIS]
+
+The design-system package (`ui/packages/design-system/src/index.ts` exports — `Section`, `Card`, `Badge`, `Button`, `Input`, `Dialog`, `Pagination`, `EmptyState`, `Tooltip`, `List`/`ListItem`, `WakePulse`, `Terminal`, `InstallBlock`, etc.) is the source of truth for visual primitives. Raw HTML in either dashboard or marketing files drifts from those tokens silently.
+
+**Marketing-display typography — primitives now exist.** `<DisplayXL>` (marketing hero `<h1>`, `text-fluid-hero`) and `<DisplayLG>` (section heads `<h2>`, `text-fluid-display-lg`) ship from `@usezombie/design-system` and compose `font-mono` + the fluid text/leading/tracking tokens internally. Use them on marketing-display surfaces. Raw `<h1>+utilities` is no longer the carve-out — UI GATE blocks it. The dashboard's `<PageTitle>` (`text-heading ≈ 18px`) remains the correct primitive for app surfaces.
+
+This gate enforces "use the primitive when one exists" without enumerating the primitives in this rule (so the rule scales as the design-system grows).
+
+#### Pre-edit check
+
+> [DETERMINISTIC → UIS]
+
+1. Read (or recall) the design-system index. Treat its exports as the substitute set.
+2. For each raw HTML element your edit adds (`<section>`, `<button>`, `<input>`, `<article>`, `<dialog>`, `<dl>`, `<table>`, `<nav>`, `<header>`, `<form>`, etc.), check the index for a matching primitive. If one exists, use it.
+3. Use `asChild` when you need the underlying HTML tag for semantics:
+
+   ```tsx
+   <Section asChild>
+     <section aria-label="...">…</section>
+   </Section>
+   ```
+
+#### Required output (default — one line)
+
+> [DETERMINISTIC → UIS]
+
+```
+UI GATE: <file> | primitives:<list> | raw-kept:<list with one-word reason each | none>
+```
+
+Multi-line block fires only when raw-kept is non-empty:
+
+```
+UI GATE: <file>
+  Primitives used: <list>
+  Raw HTML kept:
+    - <element>: <reason>  (e.g. "ul: no DS primitive")
+    - ...
+```
+
+#### Self-audit (end-of-turn)
+
+> [DETERMINISTIC → UIS]
+
+```bash
+git diff -U0 HEAD -- 'ui/packages/app/**/*.tsx' 'ui/packages/website/src/**/*.tsx' \
+  | grep -v -E '\.test\.tsx|tests/e2e/' \
+  | grep -E '^\+.*<(section|button|input|dialog|article|nav|header|form)\b' \
+  | head
+```
+
+Non-empty is a violation unless every match has a printed "Raw HTML kept" justification in the corresponding gate block.
+
+### Design Tokens (DESIGN TOKEN GATE)
+
+> [DETERMINISTIC → DTK]
+
+
+**Family:** Frontend design-system discipline (paired with the UI Component Substitution Gate). **Source:** `AGENTS.md` (project-side guard). Authoritative token surface: `ui/packages/design-system/src/theme.css` (Layer-2 `@theme inline`).
+
+**Triggers** — every `Edit`/`Write` to `*.tsx` / `*.jsx` under `ui/packages/app/` **or** `ui/packages/website/`. Tests (`*.test.tsx`) and Playwright specs (`tests/e2e/**`) are exempt — they assert on rendered DOM and frequently use raw selectors.
+
+**Override:** `// DESIGN TOKEN: SKIPPED per user override (reason: ...)` immediately preceding the affected line. Reasons must cite a concrete constraint — "bespoke per-surface grid template", "tight UI chrome width with no equivalent token", "external library prop expects px-string" — not "looks the same" / "shorter to write". Auto-mode does NOT cover the override.
+
+#### What this gate enforces
+
+> [DETERMINISTIC → DTK]
+
+The design-system package exposes named Tailwind utilities for every typographic and layout primitive (`text-display-xl`, `text-eyebrow`, `leading-prose`, `max-w-narrow`, `tracking-display-md`, `duration-snap`, etc.). Raw arbitrary values bypass the published scale. Over time that drift dilutes the system; the moment one surface ships `text-[14px] leading-[1.6]`, others copy the pattern.
+
+This gate blocks arbitrary classes **when an equivalent token utility exists**. It does NOT block:
+
+- Tailwind state selectors (`data-[active=true]:bg-accent`)
+- Pseudo-element `content-[...]`
+- Bespoke `grid-cols-[...]` / `grid-rows-[...]` (per-surface templates)
+- `calc(...)` expressions that consume a token (`h-[calc(100vh-var(--header-height))]`)
+- Token-using shadows (`shadow-[0_0_0_3px_var(--pulse-glow)]`)
+
+#### Pre-edit check
+
+> [DETERMINISTIC → DTK]
+
+1. Read (or recall) `ui/packages/design-system/src/theme.css` — the Layer-2 `@theme inline { ... }` block is the authoritative utility surface.
+
+2. The available token utilities are exactly the bridged names:
+
+   | Family | Utilities |
+   |---|---|
+   | Text size | `text-{label,eyebrow,body-sm,body,body-lg,heading,display-md,display-lg,display-xl}` |
+   | Fluid text | `text-fluid-{display-md,display-lg,hero}` |
+   | Tracking | `tracking-{display-xl,display-lg,display-md,eyebrow,label}` |
+   | Line-height | `leading-{display-xl,display-lg,display-md,heading,eyebrow,body-lg,body,body-sm,label,mono,prose}` |
+   | Max width | `max-w-{trim,narrow,measure,form,wide,content,tagline,prose}` |
+   | Min width | `min-w-{trim,narrow,measure,form,wide,content,tagline,prose}` |
+   | Spacing | `{p,m,gap,space-{x,y}}-{xs,sm,md,lg,xl,2xl,3xl,4xl,5xl,6xl}` |
+   | Motion | `duration-snap`, `ease-snap` |
+   | Radius | `rounded-{sm,md,lg}` |
+   | Color | semantic tokens only — `bg-{background,card,popover,primary,secondary,muted,accent,destructive,…}`, `text-{foreground,muted-foreground,text,text-muted,text-subtle,…}`, `border-{border,border-strong,input,ring}`, status tokens `text-{success,warn,error,info,evidence}` / `text-on-pulse` |
+
+3. For every arbitrary `*-[...]` class your edit adds, ask: **does a token utility exist?**
+   - If yes, use it.
+   - If no, the arbitrary is allowed without an override comment.
+   - If close but not exact, prefer the token. The system absorbs ±1–2 px differences; over hundreds of callsites the consistency dominates the per-callsite shift.
+
+#### Required output (default — one line)
+
+> [DETERMINISTIC → DTK]
+
+```
+DESIGN TOKEN GATE: <file> | arbitraries-kept: <list with one-word reason each | none>
+```
+
+Multi-line block fires only when `arbitraries-kept` is non-empty:
+
+```
+DESIGN TOKEN GATE: <file>
+  Arbitraries kept:
+    - <class>: <reason>  (e.g. "grid-cols-[2fr_1fr_1fr_1fr]: bespoke footer grid")
+    - <class>: <reason>
+    ...
+```
+
+#### Scope (M70)
+
+> [DETERMINISTIC → DTK]
+
+`design-tokens.sh` walks the **full ui/packages working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. The previous `--diff` (`BASE...HEAD`) default was retired with M70 — at pre-commit time `HEAD` is the prior commit, leaving the gate blind to the index.
+
+`--all` is accepted as a back-compat alias for the default. `--staged` is preserved as an opt-in narrowing mode for iterative dev loops. `--diff` is rejected with exit 2 + a pointer to this section.
+
+#### Self-audit (end-of-turn)
+
+> [DETERMINISTIC → DTK]
+
+```bash
+audits/design-tokens.sh           # full-codebase scan (default)
+audits/design-tokens.sh --staged  # opt-in narrowing for iterative dev
+```
+
+The script lives in the project repo at `audits/design-tokens.sh` (symlinked from `~/Projects/dotfiles/audits/`). It prints `file:line` + suggested token utility for every blocking violation and exits 1 on any.
+
+A clean run is required before HARNESS VERIFY can advance.
+
+The project repo is also expected to wire the audit into `make/quality.mk` `_website_lint` and `_app_lint` targets so `make lint` catches regressions:
+
+```make
+_website_lint:
+	@echo "→ [website] Running Oxlint + TypeScript check..."
+	@cd ui/packages/website && bun run lint
+	@cd ui/packages/website && bun run typecheck
+	@echo "→ [website] Running design-token audit..."
+	@audits/design-tokens.sh
+	@echo "✓ [website] Lint passed"
+```
+
+#### Family rules
+
+> [DETERMINISTIC → DTK]
+
+This gate composes with the UI Component Substitution Gate. Order of operations on a fresh `.tsx` edit:
+
+1. **UI GATE** — pick the primitive (`<Card>`, `<Section>`, `<Button>`, `<DisplayXL>`, …)
+2. **DESIGN TOKEN GATE** — pick the token utility (`text-body`, `leading-body`, `max-w-narrow`)
+3. **UFS GATE** — pick a named const for any repeated string literal
+4. **LENGTH GATE** — keep the file ≤350 lines
+
+A `.tsx` that passes all four reads as system-conformant without spelunking into the design-system source.
+
+#### Why a gate, not a lint rule
+
+> [DETERMINISTIC → DTK]
+
+Three reasons:
+
+1. **Cross-package coupling.** The token set lives in `ui/packages/design-system`; the consumers live in `ui/packages/{app,website}`. A single oxlint config can't see across the boundary cleanly. The audit script reads the diff and the theme.css utilities — it's the right shape.
+
+2. **Inline override.** Some `-[...]` classes are intentional and irreplaceable (bespoke grids, `calc(...)`, status-dot sizes). The comment-based override fits the existing gate idiom and gives reviewers a paper trail of *why* each arbitrary stayed.
+
+3. **HARNESS VERIFY integration.** Gates are the canonical end-of-turn audit point. Lint rules surface in editor noise but miss the agentic lifecycle. The gate's pre-edit one-liner + end-of-turn self-audit puts the discipline in the model's hot path.
+
+#### When tokens are missing
+
+> [DETERMINISTIC → DTK]
+
+If the arbitrary you want is a legitimate design value that simply has no token yet, **extend the design system in the same commit**:
+
+1. Add `--<family>-<name>` to `ui/packages/design-system/src/tokens.css`
+2. Forward to Tailwind via `@theme inline` in `ui/packages/design-system/src/theme.css`
+3. Migrate your callsite to the new utility
+4. Add the utility to the table above in this gate body (same dotfiles commit — Invariance Suite Gate applies)
+
+This is the path to a system that grows without dilution.
diff --git a/dispatch/write_ts_adhere_bun.sh b/dispatch/write_ts_adhere_bun.sh
new file mode 100755
index 0000000..aab0ea9
--- /dev/null
+++ b/dispatch/write_ts_adhere_bun.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# dispatch/write_ts_adhere_bun.sh — the TypeScript / Bun dispatch, DETERMINISTIC façade.
+#
+# Pairs with dispatch/write_ts_adhere_bun.md (the LATENT façade — prose the agent reads).
+# This .sh runs the mechanically-checkable subset of the TS/Bun discipline and
+# emits ONE verdict block. The latent trigger ("about to write a *.ts/*.tsx/*.js/*.jsx
+# file") dispatches here; everything below is deterministic and re-runnable — same
+# input, same verdict, no calendar/branch dependence.
+#
+#   dispatch/write_ts_adhere_bun.sh <file.ts> [...]   # explicit targets (EXECUTE)
+#   dispatch/write_ts_adhere_bun.sh --staged          # staged TS/JS (HARNESS VERIFY, pre-commit)
+#
+# Layering:  AGENTS.md → write_ts_adhere_bun.md (latent) → write_ts_adhere_bun.sh (this) → audits/*.sh
+# Signals:   🟢 pass · 🔴 fail (blocks) · 🔵 DECIDE (judgment; blocks the TURN, not the script) · ⚪ delegated
+# Exit:      0 = mechanical gates pass · 1 = ≥1 failed · 2 = usage error.
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+dispatch_init "TS" '*.ts' '*.tsx' '*.js' '*.jsx'
+dispatch_resolve_files "$@"
+dispatch_header
+
+# ── deterministic gates ────────────────────────────────────────────
+dispatch_length_gate 350                                       # FLL — write_ts_adhere_bun.md §13 (file ≤ 350)
+# UFS — universal rule enforced once by write_any (see write_any.sh); not re-run here
+
+# ── delegations (checker lives in the product repo, not dotfiles) ───
+dispatch_delegate "TSC" "make lint (oxlint + tsc — const/import/ordering/naming/anti-patterns)"
+dispatch_delegate "UIS" "make lint (msid-ui.sh — design-system primitive over raw HTML)"
+dispatch_delegate "DTK" "make lint (design-tokens.sh — token utility over arbitrary value)"
+
+# ── judgment gates (no script can decide; agent states verdict in chat) ──
+dispatch_judgment "FSD" "new *.ts/*.tsx under src|app|lib? class vs factory vs functions-module vs type-only — decide at PLAN, one-sentence why-not"
+dispatch_judgment "TGU" "result with distinct failure modes? discriminated union ({ok:true…}|{ok:false…}), not optional-field struct"
+dispatch_judgment "TSJ" "TS/Bun convention choices (Bun-native over Node-compat, file ordering, error style: throw XOR Result per module)? justify any Node-compat fallback against a concrete dependency constraint"
+
+dispatch_verdict
diff --git a/docs/ZIG_RULES.md b/dispatch/write_zig.md
similarity index 80%
rename from docs/ZIG_RULES.md
rename to dispatch/write_zig.md
index 9629dfb..6ad7bb3 100644
--- a/docs/ZIG_RULES.md
+++ b/dispatch/write_zig.md
@@ -1,3 +1,24 @@
+# write_zig.md — Zig latent façade
+
+This is the prose the AGENT reads before writing any `*.zig` file. It pairs with the deterministic façade `dispatch/write_zig.sh` — the machine half that runs the mechanically-checkable subset and emits one verdict block. This document consolidates the former Zig rules merged with the Zig-relevant dissolved gate-card deltas: every original rule line is preserved verbatim, each `## ` section now carries exactly one enforcement tag, and the dissolved gate-card prose is appended under "Merged from dissolved gate cards." Mechanical thresholds live once in the `.sh`; this file references rule codes, never restates the numbers.
+
+**Signal legend** (printed by `write_zig.sh`):
+
+- 🟢 pass — deterministic check passed.
+- 🔴 fail — deterministic check failed (or helper absent); STOP, fix, rerun.
+- 🔵 DECIDE — judgment-only; no script can decide, the agent reads the section and makes the call (blocks the TURN, not the script).
+- ⚪ delegated — the checker runs only in the product repo, not in dotfiles.
+
+**Tag legend** — each section heading below carries one of:
+
+- `> [DETERMINISTIC → <CODE>]` — a machine can pass/fail it; the `.sh` row for `<CODE>` (e.g. `UFS`, `DEINIT`, `DRAIN`, `XCOMPILE`, `PUB`) enforces it. `TODO-CHECK` marks a mechanizable rule with no helper wired yet (build-the-check). `NEW:<name>` marks a proposed-but-not-yet-existing code.
+- `> [JUDGMENT → <CODE>]` — no script can decide; the agent decides at write time against the prose.
+- `> [container]` — a non-enforcement wrapper heading (e.g. "Merged from dissolved gate cards"); its tagged subsections carry the real codes, and the coherence audit (§6.3) skips it.
+
+See [`docs/DISPATCH_ARCHITECTURE.md`](../docs/DISPATCH_ARCHITECTURE.md) §3 for the tag grammar and semantic-anchor model.
+
+---
+
 # Zig Rules
 
 Date: Mar 17, 2026
@@ -7,9 +28,11 @@ Status: Canonical Zig source of truth for agents and commits
 
 ## Verification workflow
 
-For every commit that touches `*.zig`, the agent runs the workflow below — no human approvals required mid-loop. ZIG_RULES.md is the human-discipline complement to `make lint`; rules already enforced by lint are not duplicated here. The agent owns the rules that lint cannot mechanically catch.
+> [JUDGMENT → ARCH]
+
+For every commit that touches `*.zig`, the agent runs the workflow below — no human approvals required mid-loop. This façade is the human-discipline complement to `make lint`; rules already enforced by lint are not duplicated here. The agent owns the rules that lint cannot mechanically catch.
 
-1. **Before write (trigger: about to edit / create `*.zig`):** scan ZIG_RULES.md section headers (`grep -n "^## " docs/ZIG_RULES.md`). Re-read any section whose topic the diff touches: concurrency for atomics / threads, allocator-ownership for new structs, doc-comments for new `pub` types, comptime assertions for new invariants, single-type-module pattern for new file structure, etc.
+1. **Before write (trigger: about to edit / create `*.zig`):** scan this façade's section headers (`grep -n "^## " dispatch/write_zig.md`). Re-read any section whose topic the diff touches: concurrency for atomics / threads, allocator-ownership for new structs, doc-comments for new `pub` types, comptime assertions for new invariants, single-type-module pattern for new file structure, etc.
 
 2. **During write:** for each surfaced uncertainty (atomic ordering choice, allocator pattern, naming, structural choice), state the rule and the choice in chat — don't decide silently.
 
@@ -23,12 +46,14 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
     - New allocator choice (`ArenaAllocator`, fixed buffer, page allocator, caller allocator, stored allocator) — confirm an `ALLOCATOR CHOICE:` line was printed before the edit.
     - New long-running worker, child process, socket/read loop, or blocking wait — confirm timeout, cancellation, and join/cleanup paths are named in the diff or adjacent comments.
 
-4. **After ZIG_RULES.md edits land:** every active branch with uncommitted Zig work must rerun steps 1–3 against the updated rules. Do not assume yesterday's audit covers today's rules. The agent is responsible for re-checking; the user is not the gate.
+4. **After `dispatch/write_zig.md` edits land:** every active branch with uncommitted Zig work must rerun steps 1–3 against the updated rules. Do not assume yesterday's audit covers today's rules. The agent is responsible for re-checking; the user is not the gate.
 
 5. **Test discovery hygiene:** when extracting tests to a new file, verify discovery by adding an import to `main.zig` (or a `test {}` façade block), per the "New File Rules" section below.
 
 ## Must
 
+> [DETERMINISTIC → DRAIN]
+
 - Run `make lint`, `make test`, and `gitleaks detect` before any commit that includes Zig changes.
 - Run `TEST_DATABASE_URL=postgres://usezombie:usezombie@localhost:5432/usezombiedb make test-integration-db` when touching DB-backed handlers, proposal flows, or temp-table-based Zig tests.
 - Read this file before creating any new `*.zig` file.
@@ -46,6 +71,8 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 
 ## Must Not
 
+> [DETERMINISTIC → DRAIN]
+
 - Do not write on a `pg.Conn` while a read result is still open.
 - Do not keep borrowed row data after drain/deinit.
 - Do not add extra drain logic after `q.next() == null`; that path is already naturally drained.
@@ -61,21 +88,27 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 
 ## Allowed Exceptions
 
+> [JUDGMENT → TGU]
+
 - `q.drain() catch {}` is allowed only for intentional DB cleanup paths and should stay adjacent to the drain/deinit sequence.
 - `catch {}` outside DB cleanup must be explicitly best-effort and easy to justify in review.
 - `undefined` in low-level initialization paths must be deliberate and, when non-obvious, documented with a short safety comment.
 
 ## ZLint Policy
 
+> [DETERMINISTIC → PUB]
+
 - This repo uses `zlint` as part of `make lint`.
 - Pinned version: `v0.7.9`.
-- **`unused-decls: error` is load-bearing.** PUB GATE (`docs/gates/pub-surface.md`) delegates mechanical consumer-grep to this rule — a `pub` without an in-tree consumer fails `make lint`. Disabling or downgrading it silently bypasses half the gate; if you must, amend PUB GATE in the same diff so the design call is captured elsewhere.
+- **`unused-decls: error` is load-bearing.** PUB GATE (the pub-surface section of this façade) delegates mechanical consumer-grep to this rule — a `pub` without an in-tree consumer fails `make lint`. Disabling or downgrading it silently bypasses half the gate; if you must, amend PUB GATE in the same diff so the design call is captured elsewhere.
 - `suppressed-errors` stays off because this repo intentionally uses narrow `pg` cleanup patterns that a generic rule cannot classify correctly.
 - `unsafe-undefined` is a good future tightening target once current low-level uses are cleaned up or annotated.
 - A disabled ZLint is not useful; prefer a scoped ruleset that passes today and tightens over time.
 
 ## Memory Safety Rules
 
+> [DETERMINISTIC → DEINIT]
+
 - When returning slices from a function that uses `defer resource.deinit()`, always `alloc.dupe()` the slices before the return statement. The defer fires after return evaluation but before the caller receives the value — returning a borrowed slice is a use-after-free.
 - For child process timeout enforcement, use a timer thread + `child.kill()`, not a poll loop around `child.wait()`. `child.wait()` blocks the calling thread — the timeout check after it is dead code.
 - Always free heap-allocated return values (`formatX`, `buildX`, `getToken`) with `defer alloc.free(result)` immediately after the call. Do not rely on arena allocators to mask leaks — arena-freed code may later be called outside an arena.
@@ -83,6 +116,8 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 
 ## Deterministic Resource Budget Gate
 
+> [DETERMINISTIC → TODO-CHECK]
+
 Every hot path needs a visible budget before code is written. This turns "optimize memory and Central Processing Unit (CPU)" into a reviewable shape instead of taste.
 
 **Triggers** — every Edit/Write to a `*.zig` file that net-adds any of these:
@@ -116,6 +151,8 @@ Rules:
 
 ## Allocator Choice Gate
 
+> [DETERMINISTIC → TODO-CHECK]
+
 Allocator choice is part of the API shape. Pick it before writing the allocation.
 
 **Required output before net-adding allocator-sensitive code:**
@@ -136,6 +173,8 @@ Rules:
 
 ## Out of Memory and Partial-Init Rules
 
+> [DETERMINISTIC → DEINIT]
+
 Out of Memory (OOM) is a normal failure path, not a cleanup surprise.
 
 - Every init/build function that allocates more than one resource uses the lifecycle-approved partial-init pattern: either attach an adjacent `errdefer` per owned resource, or attach one adjacent wrapper `errdefer` that frees all fields already transferred into the wrapper.
@@ -145,6 +184,8 @@ Out of Memory (OOM) is a normal failure path, not a cleanup surprise.
 
 ## Panic, Hang, and Shutdown Policy
 
+> [JUDGMENT → NEW:HANG]
+
 - Library, handler, worker, parser, and service code returns errors for user data, network failures, environment failures, and OOM. It does not `@panic` for recoverable failures.
 - `unreachable` is allowed only after a compiler-exhaustive switch or with an adjacent invariant comment explaining why runtime input cannot reach it.
 - `std.debug.assert` is for programmer bugs and invariants that should disappear in release builds. Never use it to validate external input.
@@ -153,6 +194,8 @@ Out of Memory (OOM) is a normal failure path, not a cleanup surprise.
 
 ## Type Design Rules
 
+> [JUDGMENT → TGU]
+
 - Use tagged unions (`union(enum)`) when a type has mutually-exclusive variants. Do not use structs with optional fields to represent variant data. The compiler enforces exhaustive switches on tagged unions, catching missing cases at compile time.
 - Use `[]const u8` for all immutable data (DB results, parsed input, config values). Reserve `[]u8` for data the function intends to mutate. Mutable slices mislead readers about ownership intent.
 - When a struct carries data from different sources (e.g. vault ref + Bearer token), consider whether a tagged union better represents the "exactly one of these" constraint.
@@ -160,6 +203,8 @@ Out of Memory (OOM) is a normal failure path, not a cleanup surprise.
 
 ## Buffer Type Selection (BUFFER GATE)
 
+> [DETERMINISTIC → TODO-CHECK]
+
 Three byte-accumulation tools are available; picking the wrong one creates realloc churn or unnecessary materialize-and-copy steps. Pick deliberately.
 
 **Triggers** — every Edit/Write to a `*.zig` file that net-adds byte-accumulation code (request bodies, JSON serialization, log construction, byte recorders, response builders, anything assembling many writes into one slice):
@@ -187,6 +232,8 @@ False positives: `std.ArrayList(u8)` used as a non-buffer list of bytes (rare).
 
 ## Progressive Cleanup (apply on file touch)
 
+> [DETERMINISTIC → PUB]
+
 When you touch a file during any workstream and see one of these patterns,
 fix it in the same commit. No spec needed — these are incremental improvements.
 
@@ -208,12 +255,16 @@ fix it in the same commit. No spec needed — these are incremental improvements
 
 ## New File Rules
 
+> [DETERMINISTIC → PUB]
+
 - Prefer extending an existing Zig module unless a new file clearly reduces coupling or keeps module size reviewable.
 - Decide ownership before writing helpers: allocator, free/deinit path, and whether data is owned or borrowed.
 - If the file touches `pg`, apply the query lifecycle rules above before writing the first helper.
 
 ## HTTP Integration Tests — Use TestHarness
 
+> [JUDGMENT → ARCH]
+
 Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zig` under `src/http/` MUST consume it.
 
 - **Do not** define a local `TestServer` / `RunningServer` struct, local `startTestServer()` / `startServer()`, local `sendReq()` / `sendRequest()`, or local `waitForServer()`. These are provided by `TestHarness` with a fluent Request/Response API.
@@ -225,6 +276,8 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Commands
 
+> [DETERMINISTIC → DRAIN]
+
 - `make lint`
 - `make test`
 - `TEST_DATABASE_URL=postgres://usezombie:usezombie@localhost:5432/usezombiedb make test-integration-db`
@@ -233,6 +286,8 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Zig 0.15.2 API Gotchas (M3_001)
 
+> [DETERMINISTIC → XCOMPILE]
+
 - `std.ArrayList(T).init(alloc)` does not compile. Use `var list: std.ArrayList(T) = .{};` and pass `alloc` per-method: `.append(alloc, item)`, `.deinit(alloc)`, `.toOwnedSlice(alloc)`.
 - `std.fmt.parseHex` does not exist. Use `std.fmt.hexToBytes(&out, hex_str)` to decode hex to bytes.
 - `std.fmt.fmtSliceHexLower` does not exist. Use `std.fmt.bytesToHex(bytes, .lower)` to encode bytes to hex.
@@ -240,6 +295,8 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Cross-Compile Verification (M22_001)
 
+> [DETERMINISTIC → XCOMPILE]
+
 - Run `zig build -Dtarget=x86_64-linux && zig build -Dtarget=aarch64-linux` before every commit that touches Zig files. Do not rely on macOS-only compilation.
 - `std.http.Client.open()` does not exist on Linux targets in Zig 0.15.2. Use `client.request()` + `response.reader()` + `readVec()` for cross-platform HTTP streaming.
 - `std.Io.Reader` on Linux has `readVec()`, not `read()`. Use `readVec(&[_][]u8{&buf})` for single-buffer reads.
@@ -247,23 +304,31 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## TLS Transport (M22_001)
 
+> [DETERMINISTIC → XCOMPILE]
+
 - After `tls_writer.flush()`, call `stream_writer.interface.flush()` to actually send encrypted bytes to the socket. The TLS flush only encrypts into the stream writer buffer — it does not send.
 - `SO_RCVTIMEO` on a socket fires `WouldBlock` at the socket level, but `Io.Reader` converts it to `ReadFailed` on both plain and TLS transports. Handle `ReadFailed` as timeout.
 - `EndOfStream` means clean disconnect — also return null (not fatal) in pub/sub readers.
 
 ## SSE Heartbeat Timing (M22_001)
 
+> [JUDGMENT → NEW:HANG]
+
 - The heartbeat interval must be LESS than `SO_RCVTIMEO` (socket read timeout). If `SO_RCVTIMEO = 25s` and heartbeat check is at `30s`, the first wakeup at `t=25s` skips the heartbeat (25 < 30) and the proxy drops the connection at `t=30s` before the second wakeup.
 - Correct invariant: `heartbeat_interval < SO_RCVTIMEO < proxy_idle_timeout`.
 
 ## Tagged Unions for Result Types (M4_001)
 
+> [JUDGMENT → TGU]
+
 - When a function returns a decision or outcome with distinct failure modes, use `union(enum)` with payloads — not a bare `enum`. Callers need the *reason*, not just the verdict.
 - Bare enums are fine for input classification (e.g., `GateDecision = enum { auto_approve, requires_approval, auto_kill }`) where every variant is handled identically. But for return values where callers branch on failure details, carry the context in the union.
 - Example: `GateCheckResult = union(enum) { passed: void, blocked: BlockReason, auto_killed: AutoKillTrigger }` — callers can produce specific error messages without re-deriving context.
 
 ## Removed Endpoint Stubs (M10_001)
 
+> [JUDGMENT → ARCH]
+
 - When a handler's backing table is dropped, replace it with a 410 stub — do not delete the function unless the route is also removed from the router.
 - Use `common.errorResponse(res, .gone, error_codes.ERR_*, "...", req_id)` as the entire body. No arena, no auth, no DB.
 - If the route is removed from the router at the same time (pre-production), delete the handler file too and remove all re-exports from `handler.zig`.
@@ -271,15 +336,21 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Comptime Eval Quota + Package Boundary (M11_001)
 
+> [DETERMINISTIC → XCOMPILE]
+
 - Comptime loops over large tables (e.g. 130 codes × 131 TABLE entries × `std.mem.eql`) need `@setEvalBranchQuota(N)` as the first line. Default is 1000. Formula: `N ≈ code_count × table_size × avg_string_len`. Round to next power-of-ten; comment the math.
 - `@embedFile` is sandboxed to `src/`. Any path escaping it (`../../public/openapi.json`) is a compile error. For files outside `src/`, write a Python/shell validator invoked via a `make` target wired into `lint-zig`.
 
 ## Sentinel Values Must Not Collide With Real Registry Codes (M11_001)
 
+> [DETERMINISTIC → TODO-CHECK]
+
 - In any code registry with a fallback sentinel (e.g. `UNKNOWN_ENTRY` in `error_table.zig`), the sentinel's `.code` must NOT match any real registered entry. Use a visually distinct value like `"UZ-UNKNOWN"`. Collision causes tests to pass with wrong semantics and the comptime coverage gate to fail. Add a test that verifies the sentinel is absent from TABLE.
 
 ## Module Split Pattern (M4_001)
 
+> [JUDGMENT → ARCH]
+
 - When a module hits the line limit, split by concern — not arbitrarily. Preferred extraction order:
   1. Types + parsing → `foo_types.zig` or `foo_config.zig` (re-exported by `foo.zig`)
   2. Tests → `foo_test.zig` (imported via `test { _ = @import("foo_test.zig"); }`)
@@ -289,18 +360,24 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Struct Init Partial Leak (M6_001)
 
+> [DETERMINISTIC → DEINIT]
+
 - Never build a struct literal with multiple `try dupeJsonStr()` calls in a single expression. If a later field's dupe fails, the already-duped fields leak.
 - Build field-by-field with `errdefer alloc.free(field)` after each dupe. Only assemble the struct after all fields are successfully allocated.
 - The `errdefer` chain unwinds in reverse order, freeing exactly what was allocated.
 
 ## Stack Buffer Return Safety (M6_001)
 
+> [DETERMINISTIC → DEINIT]
+
 - Never return a `[]const u8` slice that points into a stack-allocated buffer (`var buf: [N]u8`). The stack frame is deallocated when the function returns. The caller reads garbage.
 - If you need to return a substring from a stack buffer: either `alloc.dupe()` it, or remove the field from the return type.
 - This applies to any function-local array used as a normalization/scratch buffer.
 
 ## Multi-Step Init: errdefer Chain Pattern (bvisor)
 
+> [DETERMINISTIC → DEINIT]
+
 Every init function that allocates more than one resource must use a sequential errdefer chain — one errdefer immediately after each allocation:
 
 ```zig
@@ -330,6 +407,8 @@ Rules:
 
 ## Ownership Encoding: raw pointer = borrowed, ref/unref = owned (bvisor)
 
+> [JUDGMENT → TGU]
+
 Zig has no borrow checker. Encode ownership in the type, not in documentation:
 
 ```zig
@@ -358,6 +437,8 @@ When a raw pointer field DOES need a comment (rare — borrowed from a peer, not
 
 ## Pg Query Wrapper: use PgQuery, not anytype (M10_004)
 
+> [DETERMINISTIC → DRAIN]
+
 **Do not pass `pg.Result` via `anytype` to helper functions.** The `anytype` pattern requires callers to remember `q.*.next()` vs `q.next()` depending on how the value was passed — a compile-silent footgun.
 
 Instead, use the `PgQuery` wrapper in `src/db/pg_query.zig`:
@@ -384,23 +465,31 @@ Rules:
 
 ## Build Verification: `make`, Not `zig build`
 
+> [DETERMINISTIC → XCOMPILE]
+
 - Verification commands are defined in `make` targets and CI runs `make`. Use `make test` (tier 1) and `make test-integration` (tier 2) for verification — **not** `zig build test` standalone. `zig build test` runs only the Zig unit set and silently skips the website / app / zombiectl unit tests + cross-language gates that the verification gate is defined against. Use `zig build` directly only for compilation, never for "did my change pass tests".
 - `make memleak` is required when the diff touches server lifecycle, allocator wiring, or cross-thread heap ownership. The macOS `leaks` tool prints a "not debuggable" line under System Integrity Protection — that is expected; the authoritative signal is the allocator-leak phase across `std.testing.allocator`-wrapped tests.
 
 ## Doc-Comments and Inline Comments
 
+> [JUDGMENT → NEW:DOC]
+
 - Use `//!` for module-level documentation at the top of a file. Reserve `///` for `pub` type, function, and field doc-comments. Reserve `//` for inline rationale.
 - Comments above fields explain *why* the field exists, not what its type is. Group related fields with `// === Section ===` separators.
 - Skip comments when a well-named identifier already explains intent. Add a comment only when removing it would confuse a future reader (hidden invariant, surprising workaround, non-obvious lifetime contract).
 
 ## Concurrency
 
+> [JUDGMENT → NEW:CONC]
+
 - Protect critical sections with `mutex.lock(); defer mutex.unlock();` in a bare block. Never wrap in `try` or error handling — `.lock()` blocks until acquired, it does not error. Use `.tryLock()` only on non-blocking fast paths.
 - Atomic loads and stores default to `.acq_rel`. Weaker orderings (`.acquire`, `.release`, `.monotonic`, `.unordered`) require an inline `// safe because: <reason>` comment so a reviewer can audit at a glance. The acquire-release pair on a single coordination flag is a fine pattern — but the comment is mandatory.
 - When two threads coordinate via a flag, document which side does the `.release` store and which does the `.acquire` load. The comment is the synchronization contract.
 
 ## Allocator Ownership in Structs
 
+> [DETERMINISTIC → DEINIT]
+
 Extends "Type Design Rules". Two patterns, both legitimate; pick deliberately and document the choice on the type:
 
 - **Stored allocator (default)** — any struct that owns heap memory (`ArrayList`, `HashMap`, duped strings) stores `alloc: std.mem.Allocator` as a field. `deinit(self: *Self) void` then frees without a separate parameter. Default to this pattern.
@@ -408,11 +497,17 @@ Extends "Type Design Rules". Two patterns, both legitimate; pick deliberately an
 
 ## Identifier Conventions
 
+> [DETERMINISTIC → TODO-CHECK]
+
 - snake_case throughout: file names, fields, functions, locals, constants. usezombie has no JS-interop boundary — there is no carve-out for camelCase fields. (Bun mixes the two for JS-mapped fields; we do not.)
 
 ## RULE UFS — Named constants for repeated and semantic literals
 
-Mirrors the BUN_RULES §2 clause; both runtimes follow the same rule.
+> [DETERMINISTIC → UFS]
+
+_`UFS` is a universal rule **enforced once by `write_any`** (which fires for every source file); this façade carries its prose for the author but does not re-run `audit-ufs` — no redundant full-tree scan (`DISPATCH_ARCHITECTURE.md` §16, Decision 6)._
+
+Mirrors the write_ts_adhere_bun.md §2 clause; both runtimes follow the same rule.
 
 - **String literals used in ≥2 sites become a named const or an enum.** Wire-format values (mode strings, charge types, posture labels) MUST live in an enum (`pub const Mode = enum { platform, self_managed }`) or a `pub const X: []const u8 = "…";` and be referenced by name everywhere else — including test fixtures and `std.mem.eql` arguments at parse boundaries.
 - **Numeric literals carrying semantic meaning become a named const** even at the first use site. Conversion factors (`NANOS_PER_USD`, `NANOS_PER_SECOND`, `BYTES_PER_MIB`), thresholds (`LOW_BALANCE_THRESHOLD_NANOS`, `MAX_RETRY_COUNT`), sub-cent rates, and time scaling factors all need names. `1_000_000_000` in a `wall_seconds * 1_000_000_000` expression is a smell — `wall_seconds * NANOS_PER_SECOND` is the rule. Carve-out: **pin tests** where the literal IS the contract keep the literal with a `// pin test: literal is the contract` comment.
@@ -421,11 +516,15 @@ Mirrors the BUN_RULES §2 clause; both runtimes follow the same rule.
 
 ## Comptime-Gated Assertions
 
+> [DETERMINISTIC → TODO-CHECK]
+
 - For runtime invariants that should be free in release builds, use `std.debug.assert(condition)` — debug-on, release-off automatically. Use this for capacity bounds, monotonic counter checks, and "this can't happen unless we have a bug" assertions.
 - For comptime-evaluable invariants on type shape (struct sizes, array lengths matching enum variant counts), use `comptime { std.debug.assert(@sizeOf(T) == N); }` adjacent to the type definition — see "Progressive Cleanup" above.
 
 ## Single-Type-Module Pattern
 
+> [DETERMINISTIC → PUB]
+
 **Binding — applies to new files AND to any existing single-primary-type file the moment an edit touches it, regardless of touch size.** When a `*.zig` file's primary purpose is exactly one struct, use the file-as-struct layout (`const Foo = @This();`). If your edit lands on an existing conventional single-primary-type file — even a one-line bug fix — the same diff that lands the change rearchitects the file to file-as-struct shape. The Pub Surface & Struct-Shape Gate (in `AGENTS.md`) requires the layout choice and any rearchitect plan to be declared before saving. Multi-type modules (tagged unions + helpers, protocols with multiple shapes, handler-collection files) keep conventional layout.
 
 The file-as-struct layout eliminates a level of nesting:
@@ -451,6 +550,8 @@ Multi-type modules (e.g. a protocol with `MessageType` + `Envelope` + `Decoded`)
 
 ## Bun-Inspired Conventions (apply on new code, do not retrofit blindly)
 
+> [JUDGMENT → TGU]
+
 These are recommended patterns surfaced from the Bun Zig codebase audit. They improve readability and eliminate boilerplate but do not need to be retrofitted into existing modules in a single sweep — apply when touching the file for other reasons.
 
 - **`inline fn` for ≤3-line getters and trivial conversions.** Field extractors, enum-to-string converters, comptime-evaluable switches — these benefit from inlining and the compiler does the right thing. Reserve uninlined `fn` for multi-line algorithms or anything with a loop body. (Bun example: `sys/Error.zig:62-68`.)
@@ -459,6 +560,8 @@ These are recommended patterns surfaced from the Bun Zig codebase audit. They im
 
 ## Module Boundaries & Shared Modules (`src/lib`)
 
+> [JUDGMENT → ARCH]
+
 **The boundary rule (Zig-enforced):** a module's relative `@import("…")` may only reach files **within the directory subtree of that module's root source file**. Reaching across with `../..` into a sibling tree fails to compile — `error: import of file outside module path`. A binary's module root is the directory of its `root_source_file` in `build.zig` (a binary rooted at `src/main.zig` can reach all of `src/`; one rooted at `src/runner/main.zig` is confined to `src/runner/`).
 
 **Why it exists — and why it is a feature, not friction:**
@@ -476,3 +579,79 @@ These are recommended patterns surfaced from the Bun Zig codebase audit. They im
 - A wire contract shared between a server binary and a client/daemon binary is the canonical inhabitant: putting it in `src/lib/` lets both build graphs compile it without either reaching into the other's tree.
 
 **Adding to `src/lib/` is gated (reason-then-approval).** Promoting a module into `src/lib/` widens the shared surface, so it is not an agent-unilateral move. Before creating a new `src/lib/<name>/`: (1) state the reason — which ≥2 build graphs consume it, and why it must be shared rather than duplicated or kept domain-local; (2) propose it to the owner with that reason; (3) create it only on approval. Helpers shared *within a single binary* stay under that domain's `common/` (e.g. `src/<domain>/common/`), not `src/lib/`.
+
+## Merged from dissolved gate cards
+
+> [container]
+
+Prose merged verbatim from the Zig-relevant `docs/gates/*.md` cards (zig, pub-surface, lifecycle). Each subsection carries its own enforcement tag.
+
+### Test files are in scope for the memory-safety discipline
+
+> [DETERMINISTIC → DEINIT]
+
+Tests are in scope — drain/errdefer/ownership rules apply equally.
+
+### File-shape tie-break: behavior-bound-to-state vs operations-over-value
+
+> [JUDGMENT → FSD]
+
+**Tie-break:** behavior-bound-to-state → file-as-struct; operations-over-value → conventional. **Escape clause:** "I can articulate in one sentence why this is operations-over-value." If you can't, file-as-struct wins.
+
+### FILE SHAPE DECISION is a PLAN-time obligation, not EXECUTE
+
+> [JUDGMENT → FSD]
+
+The file-shape verdict (file-as-struct vs conventional) is decided at PLAN, before the first Write/Edit creating or reshaping the file — not chosen by inertia at write time. A `conventional` verdict requires a one-sentence "why not file-as-struct." Skipping the decision is a PLAN violation, not just an EXECUTE one.
+
+### No inheritance of the shape verdict across symbols
+
+> [JUDGMENT → FSD]
+
+Each new pub surface needs its own shape verdict — cloning a sibling's "Public for the integration test in …" justification does NOT discharge it. The design call does not transfer between symbols; own the verdict per surface, do not inherit a sibling's justification.
+
+### PUB GATE firing conditions, pre-edit grep, and override
+
+> [DETERMINISTIC → PUB]
+
+**Threshold-cross — the gate fires on an existing file when:** (a) an Edit adds the file's first `pub` type, OR (b) adds a `pub fn ... self ...` method to a file currently dominated by `pub` free fns, OR (c) removes the last pub free fn from a multi-pub-fn file. It also fires on any new `*.zig` under `src/`, and on a user message saying "rethink the layout of `<file>`". For all other `*.zig` edits the block is skipped with a one-liner `PUB GATE: skipped — <one-line reason>` — never produce a `pub` change without either the full block OR the skip warning preceding the edit.
+
+**Pre-edit grep (new bytes only — any match fires the gate):** `^pub` (new top-level pub declaration), `^\s+pub fn` (new pub method on an existing struct), `ErrorUnion{… NewVariant,` (new variant on a pub error union), `= enum { … NewVariant,` (new variant on a pub enum). Mechanical consumer-grep is delegated to `zlint`'s `unused-decls: error`.
+
+**Override:** `PUB GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit (sub-gate override). The umbrella `FILE SHAPE DECISION` override requires the user's explicit ask **this turn** — auto-mode does NOT cover it.
+
+### Carve-out: PUB GATE vs LIFECYCLE GATE
+
+> [DETERMINISTIC → DEINIT]
+
+PUB GATE and LIFECYCLE GATE answer different questions and neither defers to the other. PUB GATE asks: should this symbol be `pub`, and does the file shape justify it? LIFECYCLE GATE asks: if `init` exists, does `deinit`? Is `errdefer` placed correctly? Is allocator ownership clear? Both gates may fire on the same `pub fn init` edit — print both verdicts; the pub-surface decision never satisfies the lifecycle-pairing decision and vice versa.
+
+### `defer` + `errdefer` on the same allocation — forbidden
+
+> [DETERMINISTIC → DEINIT]
+
+`defer` and `errdefer` on the *same* allocation is forbidden — pick one per `LIFECYCLE_PATTERNS.md` §6. (`errdefer` cleans up only on the error path; `defer` always cleans up. Both on one allocation double-frees on the error path, or frees a value the caller still owns on success.) The pairing audit surfaces this as `defer-mix:<ok|conflict>`.
+
+### Lifecycle-method recognition: renames do not bypass
+
+> [DETERMINISTIC → DEINIT]
+
+The init/deinit pairing audit treats all of `deinit`, `close`, `release`, `destroy`, `shutdown`, `dispose`, `free` as lifecycle (cleanup) methods. Renaming `deinit` to `close` or `release` does NOT bypass the pairing requirement — a struct owning heap memory or an opaque handle still needs an `init`-paired cleanup method under any of those names.
+
+### Empty-pair and arena-leakage informational flags
+
+> [DETERMINISTIC → DEINIT]
+
+Two non-blocking informational flags the pairing audit surfaces: (1) `init` body empty AND `deinit` body empty — likely a pair-for-shape that isn't actually needed; (2) an arena-allocated slice stored in a long-lived struct — the reviewer must either restructure the ownership or explicitly acknowledge the arena-lifetime mismatch. Neither blocks mechanically; both demand a reviewer decision rather than silent acceptance.
+
+### Scope (M70): full-tree audit, staged content satisfies the same hook run
+
+> [DETERMINISTIC → DEINIT]
+
+`deinit-pairs.sh` walks the full `src/` working tree via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
+
+### Deinit idempotency assertion (reviewer-owned)
+
+> [JUDGMENT → DIDEM]
+
+Every type with a cleanup contract should carry a test proving its cleanup method is idempotent (or its single-shot ownership is asserted) — the mechanical audit reports idempotency-test:<present|missing> but does not block on it; presence/absence is a reviewer responsibility, not a machine pass/fail. A struct whose `deinit` frees fields must have a test that exercises the success-cleanup path so the leak detector fires on a missed or double free.
diff --git a/dispatch/write_zig.sh b/dispatch/write_zig.sh
new file mode 100755
index 0000000..6cf9714
--- /dev/null
+++ b/dispatch/write_zig.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# dispatch/write_zig.sh — the Zig dispatch, DETERMINISTIC façade.
+#
+# Pairs with dispatch/write_zig.md (the LATENT façade — prose the agent reads).
+# This .sh runs the mechanically-checkable subset of the Zig discipline and
+# emits ONE verdict block. The latent trigger ("about to write a *.zig file")
+# dispatches here; everything below is deterministic and re-runnable — same
+# input, same verdict, no calendar/branch dependence.
+#
+#   dispatch/write_zig.sh <file.zig> [...]   # explicit targets (EXECUTE)
+#   dispatch/write_zig.sh --staged           # staged *.zig (HARNESS VERIFY, pre-commit)
+#
+# Layering:  AGENTS.md → write_zig.md (latent) → write_zig.sh (this) → audits/*.sh
+# Signals:   🟢 pass · 🔴 fail (blocks) · 🔵 DECIDE (judgment; blocks the TURN, not the script)
+# Exit:      0 = mechanical gates pass · 1 = ≥1 failed · 2 = usage error.
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+dispatch_init "ZIG" '*.zig'
+dispatch_resolve_files "$@"
+dispatch_header
+
+# ── deterministic gates ────────────────────────────────────────────
+dispatch_length_gate 350                                       # FLL — write_zig.md §Length
+# UFS — universal rule enforced once by write_any (see write_any.sh); not re-run here
+dispatch_run_helper "DEINIT" "deinit-pairs.sh" "--staged" # write_zig.md §Multi-Step Init
+
+# ── delegations (checker lives in the product repo, not dotfiles) ───
+dispatch_delegate "PUB"      "make lint (zlint unused-decls)"
+dispatch_delegate "DRAIN"    "make check-pg-drain (lint-zig.py)"
+dispatch_delegate "XCOMPILE" "zig build -Dtarget=x86_64-linux && aarch64-linux"
+
+# ── judgment gates (no script can decide; agent states verdict in chat) ──
+dispatch_judgment "TGU"  "result type with distinct failure modes? union(enum) with payload, not optional-field struct"
+dispatch_judgment "ARCH" "naming a stream/queue/schema? grep docs/architecture/ first"
+dispatch_judgment "FSD"  "new/reshaped *.zig file? file-as-struct vs operations-over-value — decide at PLAN, one-sentence why-not"
+dispatch_judgment "DIDEM" "type with a cleanup contract? a test proving deinit is idempotent (or single-shot ownership asserted)"
+
+dispatch_verdict
diff --git a/docs/CLI_DX_PILLARS.md b/docs/CLI_DX_PILLARS.md
deleted file mode 100644
index 7060828..0000000
--- a/docs/CLI_DX_PILLARS.md
+++ /dev/null
@@ -1,622 +0,0 @@
-<!--
-VENDORED into dotfiles from ~/Projects/oss/cli/docs/adr/0001-cli-dx-architecture-pillars.md
-(the supabase-style CLI's "7 Pillars" Architecture Decision Record). Kept here so CLI-category
-specs have a stable, in-repo prior-art reference — see docs/TEMPLATE.md "Prior-Art" and
-kishore-spec-new Step 2. The oss/cli copy is canonical; re-sync if it changes. Cross-ADR links
-below (e.g. 0007) resolve only in the source repo.
--->
-
-# 0001. CLI DX Architecture: The 7 Pillars
-
-**Status**: accepted
-**Date**: 2026-02-10
-
-## Problem Statement
-
-supabase is the primary entry point to Supabase, consumed by both humans and LLM agents. Traditional CLIs are designed for humans; modern CLIs must serve both without compromise.
-
-Problems we're solving:
-
-1. LLM agents need stable, structured output — but humans need readable, colorful, interactive output
-2. Performance perception matters (startup time, command latency)
-3. Testing CLI code is harder than testing libraries
-4. Observability is often bolted on after the fact
-5. Error messages are frequently unhelpful for both humans and machines
-
-## Decision
-
-We establish 7 architectural pillars that every CLI command must follow:
-
-| #   | Pillar                      | Core Principle                                                                    |
-| --- | --------------------------- | --------------------------------------------------------------------------------- |
-| 1   | Command as Typed Function   | Handlers return typed results. Rendering is separate.                             |
-| 2   | Input Design                | Args for "what", flags for "how". Clear precedence chain.                         |
-| 3   | Output Design               | Human-first rendering, machine-first data. Auto-detect audience via TTY.          |
-| 4   | Error Design                | What failed + why + how to fix. Machine-stable error codes.                       |
-| 5   | Observability & Performance | Structured traces from day 0. Performance budgets in CI. Lazy loading.            |
-| 6   | Testing Strategy            | 3-layer pyramid: unit, integration, E2E. E2E is the primary layer. High coverage. |
-| 7   | LLM-Native Design           | Auto-JSON for non-TTY. Discoverable help. Idempotent commands. Retry hints.       |
-
-## Rationale
-
-These pillars are grounded in research across CLI design guidelines (clig.dev), leading CLIs (GitHub CLI, Wrangler, Vercel CLI), testing strategies (@oclif/test, cli-testing-library), observability standards (OpenTelemetry), and LLM integration patterns. They represent the convergence of human DX and machine DX into a single, coherent architecture.
-
-## The 7 Pillars
-
-**Contents**:
-
-1. [Pillar 1: Command as Typed Function](#pillar-1-command-as-typed-function)
-2. [Pillar 2: Input Design](#pillar-2-input-design)
-3. [Pillar 3: Output Design](#pillar-3-output-design)
-4. [Pillar 4: Error Design](#pillar-4-error-design)
-5. [Pillar 5: Observability & Performance](#pillar-5-observability--performance)
-6. [Pillar 6: Testing Strategy](#pillar-6-testing-strategy)
-7. [Pillar 7: LLM-Native Design](#pillar-7-llm-native-design)
-
-### Pillar 1: Command as Typed Function
-
-Every CLI command is a function with typed inputs and typed outputs. Rendering (human-friendly terminal output vs machine-readable JSON) is a _separate concern_ from command logic.
-
-**Architecture**:
-
-```
-┌──────────────────────────────────────────────────┐
-│                Command Definition                 │
-│  (Stricli: typed flags, args, docs)               │
-└──────────────────┬───────────────────────────────┘
-                   │
-                   ▼
-┌──────────────────────────────────────────────────┐
-│                Command Handler                    │
-│  Pure logic: validate → execute → return Result   │
-│  NO console.log, NO process.exit, NO rendering    │
-└──────────────────┬───────────────────────────────┘
-                   │
-                   ▼
-┌──────────────────────────────────────────────────┐
-│                Output Renderer                    │
-│  Picks format based on --output flag or TTY:      │
-│  • "human" → tables, colors, spinners            │
-│  • "json"  → JSON to stdout                      │
-│  • "env"   → KEY=VALUE pairs (shell-friendly)    │
-└──────────────────────────────────────────────────┘
-```
-
-**Types**:
-
-```typescript
-type CommandResult<T> = { ok: true; data: T } | { ok: false; error: CommandError };
-
-type CommandError = {
-  code: string; // machine-stable: "AUTH_TOKEN_EXPIRED"
-  message: string; // human-readable: "Your access token has expired"
-  suggestion?: string; // actionable: "Run `supabase login` to refresh"
-  metadata?: unknown; // extra context for debugging
-};
-```
-
-**Example handler**:
-
-```typescript
-async function listProjects(flags: ProjectFlags): Promise<CommandResult<Project[]>> {
-  const client = await getApiClient();
-  const projects = await client.listProjects();
-  return { ok: true, data: projects };
-}
-```
-
-**Why this matters**:
-
-- **For humans**: the renderer shows tables, colors, spinners, interactive prompts
-- **For LLMs**: `supabase projects --output json` returns structured, parseable data
-- **For testing**: handlers are pure functions — test logic without terminal mocking
-- **For piping**: `supabase projects --output json | jq '.[] | .name'` just works
-
-### Pillar 2: Input Design
-
-**Arguments vs flags**:
-
-| Use                   | For                                                       |
-| --------------------- | --------------------------------------------------------- |
-| Positional arguments  | The primary "what": `supabase branches create my-branch`      |
-| Flags                 | Modifiers and options: `--target docker`, `--output json` |
-| Stdin                 | Bulk data: `cat migration.sql \| supabase db execute`         |
-| Config file           | Persistent defaults: `supabase.config.json`                   |
-| Environment variables | Secrets and CI overrides: `SUPABASE_ACCESS_TOKEN`         |
-
-**Precedence** (highest to lowest):
-
-```
-CLI flags → Environment variables → Config file → Intelligent defaults
-```
-
-**Global flags** (available on every command):
-
-```
---output <format>   Output format: human, json, env (default: auto-detect via TTY)
---project <ref>     Override project ref (instead of config file)
---debug             Show verbose output, timing, API requests
---no-color          Disable color output (also respects NO_COLOR env)
-```
-
-**Validation principles**:
-
-- Fail fast, fail clearly — validate all input before any side effects
-- Suggest corrections — "Unknown flag `--taget`. Did you mean `--target`?"
-- Show what's available — on enum errors, list all valid values
-
-### Pillar 3: Output Design
-
-**For humans — progressive disclosure**:
-
-Show the minimum needed, with escape hatches to see more.
-
-```
-$ supabase dev
-✓ Loaded config from supabase.config.json
-✓ Starting Docker containers...
-✓ Database ready on localhost:54322
-✓ API ready on localhost:54321
-◼ Watching schemas/**/*.sql for changes
-
-  Press q to quit, d for debug info
-```
-
-Use steps (checkmarks/crosses) to show progress, not log spam. Show _results_, not _process_. Use color meaningfully: green=success, red=error, yellow=warning, dim=secondary.
-
-**For machines — JSON output**:
-
-Every command's JSON output is a stable contract. Treat it like an API.
-
-```jsonc
-// Success
-{
-  "ok": true,
-  "data": [ ... ],
-  "metadata": {
-    "command": "projects list",
-    "duration_ms": 234,
-    "api_calls": 1
-  }
-}
-
-// Error
-{
-  "ok": false,
-  "error": {
-    "code": "AUTH_TOKEN_EXPIRED",
-    "message": "Your access token has expired",
-    "suggestion": "Run `supabase login` to refresh your token"
-  }
-}
-```
-
-**JSON stability rules**:
-
-- Never remove fields in minor versions
-- Never change a field's type
-- New fields are additive only
-- Null means "missing" — never omit the field entirely
-- Dates are ISO 8601 strings
-- IDs are always strings (even if numeric)
-
-**For shell scripting — env output**:
-
-```
-$ supabase status --output env
-SUPA_DB_URL=postgresql://postgres:postgres@localhost:54322/postgres
-SUPA_API_URL=http://localhost:54321
-SUPA_ANON_KEY=eyJ...
-SUPA_SERVICE_KEY=eyJ...
-```
-
-Enables `eval $(supabase status --output env)` for instant environment setup.
-
-**Output format detection** (priority order):
-
-1. Explicit `--output` flag (user chose)
-2. `SUPA_OUTPUT` env var (CI/automation default)
-3. `stdout.isTTY` check: TTY = "human", not TTY = "json"
-
-The TTY detection is critical: when an LLM agent runs `supabase projects`, stdout is not a TTY, so it automatically gets JSON. No `--json` flag needed. This matches the `gh` CLI gold standard.
-
-### Pillar 4: Error Design
-
-Errors are the most important output a CLI produces — they're the only output users truly read.
-
-**Error anatomy**:
-
-```
-$ supabase dev --target linked
-
-✗ Project not linked
-
-  No project is linked to this directory.
-  Run `supabase link` to connect to a Supabase project,
-  or use `supabase dev --target docker` for local development.
-```
-
-Every error has three parts:
-
-1. **What failed** (bold/red, one line): "Project not linked"
-2. **Why it failed** (normal text): "No project is linked to this directory"
-3. **How to fix it** (dim text, actionable): "Run `supabase link` to connect..."
-
-**Error codes**:
-
-Every error has a machine-stable code following the `CATEGORY_SPECIFIC_ISSUE` pattern:
-
-```typescript
-type ErrorCode =
-  | "AUTH_TOKEN_MISSING"
-  | "AUTH_TOKEN_EXPIRED"
-  | "PROJECT_NOT_LINKED"
-  | "PROJECT_NOT_FOUND"
-  | "DOCKER_NOT_AVAILABLE"
-  | "NETWORK_UNREACHABLE"
-  | "CONFIG_INVALID"
-  | "CONFIG_NOT_FOUND"
-  | "MIGRATION_CONFLICT";
-// ...
-```
-
-Error codes enable LLM agents to handle errors programmatically, documentation to link to specific error pages, and telemetry to track error frequency.
-
-**Exit codes**:
-
-| Code | Meaning            |
-| ---- | ------------------ |
-| 0    | Success            |
-| 1    | Any error          |
-| 130  | Interrupted (Ctrl+C) |
-
-Error categorization (auth vs network vs usage) is communicated through the structured error output (`error.code` field in JSON), not through exit codes. This matches the convention used by most production CLIs (Terraform, kubectl, Wrangler, Vercel).
-
-### Pillar 5: Observability & Performance
-
-Observability is not logging — it's the ability to understand what happened during any command execution, after the fact, without reproducing it.
-
-**Architecture**:
-
-```
-┌─────────────────────────────────────────┐
-│            Command Execution             │
-│                                          │
-│  ┌──────────┐  ┌──────────┐  ┌────────┐│
-│  │  Traces  │  │  Metrics │  │  Logs  ││
-│  │ (spans)  │  │(counters)│  │(struct)││
-│  └────┬─────┘  └────┬─────┘  └───┬────┘│
-└───────┼──────────────┼────────────┼─────┘
-        │              │            │
-        ▼              ▼            ▼
-┌─────────────────────────────────────────┐
-│           Telemetry Collector            │
-│  (in-process, batched, async export)     │
-└──────────────┬──────────────────────────┘
-               │
-     ┌─────────┼─────────┐
-     ▼         ▼         ▼
-  Local      Debug     Remote
-  file       output    export
-  (~/.supabase/  (--debug  (opt-in
-   traces/)   flag)    telemetry)
-```
-
-**Per-command metrics** (always collected, zero-overhead when not exported):
-
-| Metric                    | Purpose                                      |
-| ------------------------- | -------------------------------------------- |
-| `command.duration_ms`     | Track regressions in command speed           |
-| `command.name`            | Know which commands are used                 |
-| `command.exit_code`       | Error rates                                  |
-| `startup.duration_ms`     | CLI boot time (critical for perceived speed) |
-| `api.request_count`       | Network chattiness                           |
-| `api.request_duration_ms` | Backend latency vs CLI overhead              |
-| `api.request_errors`      | Backend reliability from CLI perspective     |
-
-**Per-phase spans** (trace-level detail):
-
-```
-supabase dev (total: 1.2s)
-├── config.load: 12ms
-├── target.resolve: 3ms
-├── docker.check: 45ms
-├── docker.start: 890ms
-│   ├── postgres: 340ms
-│   ├── postgrest: 210ms
-│   └── gotrue: 340ms
-├── healthcheck.wait: 230ms
-└── watcher.start: 8ms
-```
-
-**Implementation**: use a lightweight, custom tracing layer — not the full OpenTelemetry SDK, which adds startup latency.
-
-```typescript
-const span = trace.start("docker.start");
-await startContainers();
-span.end(); // records duration
-```
-
-**Telemetry consent**:
-
-Local diagnostics (traces written to `~/.supabase/traces/`, `--debug` output) are always available — they stay on the user's machine and require no consent.
-
-Remote telemetry is **opt-in by default** — it is never sent unless the user explicitly consents. See [ADR 0002](0002-cli-product-metrics.md) for consent implementation details.
-
-**Performance budgets** (CI-enforced):
-
-| Operation                            | Budget               |
-| ------------------------------------ | -------------------- |
-| CLI startup (parse args, no command) | < 50ms               |
-| `supabase --help`                        | < 100ms              |
-| `supabase status` (local, no network)    | < 200ms              |
-| `supabase projects` (network call)       | < 1s (excl. network) |
-
-**Lazy loading is essential**: use dynamic imports so `supabase branches list` doesn't load Docker modules or migration logic. Startup stays fast regardless of how many commands exist.
-
-```typescript
-func: async (flags: DevFlags) => {
-  const { runDev } = await import("./dev.handler");
-  return runDev(flags);
-};
-```
-
-### Pillar 6: Testing Strategy
-
-**The CLI testing pyramid**:
-
-```
-          ╱╲
-         ╱  ╲        E2E tests
-        ╱    ╲       (real subprocess, real stdout/stderr)
-       ╱──────╲
-      ╱        ╲     Integration tests
-     ╱          ╲    (in-process command execution, mocked I/O)
-    ╱────────────╲
-   ╱              ╲   Unit tests
-  ╱                ╲  (pure handler logic, no I/O)
- ╱──────────────────╲
-```
-
-**Layer 1: Unit tests** (fast, many) — test command handlers as pure functions. No terminal, no network, no filesystem.
-
-```typescript
-test("listProjects returns projects for org", async () => {
-  const api = mockApiClient({ projects: [{ id: "abc", name: "my-app" }] });
-  const result = await listProjects({ api });
-  expect(result).toEqual({
-    ok: true,
-    data: [{ id: "abc", name: "my-app" }],
-  });
-});
-
-test("listProjects returns error when not authenticated", async () => {
-  const api = mockApiClient({ authenticated: false });
-  const result = await listProjects({ api });
-  expect(result).toEqual({
-    ok: false,
-    error: { code: "AUTH_TOKEN_MISSING", message: expect.any(String) },
-  });
-});
-```
-
-**Layer 2: Integration tests** (medium speed) — test in-process command execution: arg parsing, flag combinations, output rendering, and return values. Uses mocked I/O (captured buffers, mock API server). No real subprocess.
-
-```typescript
-test("supabase projects --output json returns valid JSON", async () => {
-  const { stdout, exitCode } = await runCommand(["projects", "--output", "json"], {
-    env: { SUPABASE_ACCESS_TOKEN: "test-token" },
-    api: mockApiServer(),
-  });
-  expect(exitCode).toBe(0);
-  const parsed = JSON.parse(stdout);
-  expect(parsed.ok).toBe(true);
-  expect(parsed.data).toBeArray();
-});
-```
-
-**Layer 3: E2E tests** (the primary test layer) — spawn the CLI as a real child process via `Bun.spawn`, exercising the same interface that humans and LLMs interact with. This tests the full surface: process boot, arg parsing, TTY detection, stdout/stderr streams, exit codes, and signal handling.
-
-Running from source (`bun run apps/cli/src/index.ts`) is the right default — it exercises identical code paths to a compiled binary while keeping the feedback loop fast. A single smoke test on the compiled artifact in CI covers bundling edge cases.
-
-E2E tests must cover three categories:
-
-**a) TTY auto-detection** — the flagship LLM feature:
-
-```typescript
-test("non-TTY stdout produces JSON automatically", async () => {
-  const proc = Bun.spawn(["bun", "run", "apps/cli/src/index.ts", "projects"], {
-    env: { ...process.env, SUPABASE_ACCESS_TOKEN: "test-token" },
-    stdout: "pipe", // not a TTY → should auto-detect JSON
-  });
-  const stdout = await new Response(proc.stdout).text();
-  expect(() => JSON.parse(stdout)).not.toThrow();
-  expect(JSON.parse(stdout).ok).toBe(true);
-});
-```
-
-**b) Error paths** — LLMs hit errors constantly and rely on structured error output to recover:
-
-```typescript
-test("auth failure returns exit code 1 and structured error", async () => {
-  const proc = Bun.spawn(["bun", "run", "apps/cli/src/index.ts", "projects"], {
-    env: { ...process.env, SUPABASE_ACCESS_TOKEN: "" },
-    stdout: "pipe",
-  });
-  const stdout = await new Response(proc.stdout).text();
-  const parsed = JSON.parse(stdout);
-  expect(proc.exitCode).toBe(1);
-  expect(parsed.ok).toBe(false);
-  expect(parsed.error.code).toBe("AUTH_TOKEN_MISSING");
-  expect(parsed.error.suggestion).toBeDefined();
-});
-
-test("invalid flag returns exit code 1", async () => {
-  const proc = Bun.spawn(["bun", "run", "apps/cli/src/index.ts", "--bogus"], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  await proc.exited;
-  expect(proc.exitCode).toBe(1);
-});
-```
-
-**c) LLM workflow chains** — commands composed via JSON output, the way agents actually use the CLI:
-
-```typescript
-test("LLM workflow: list projects, then get status", async () => {
-  // Step 1: list projects
-  const list = Bun.spawn(["bun", "run", "apps/cli/src/index.ts", "projects"], {
-    stdout: "pipe",
-    env: { ...process.env, SUPABASE_ACCESS_TOKEN: "test-token" },
-  });
-  const projects = JSON.parse(await new Response(list.stdout).text());
-  expect(projects.ok).toBe(true);
-  expect(projects.data.length).toBeGreaterThan(0);
-
-  // Step 2: use output from step 1 to query a specific project
-  const ref = projects.data[0].ref;
-  const status = Bun.spawn(
-    ["bun", "run", "apps/cli/src/index.ts", "status", "--project", ref],
-    { stdout: "pipe", env: { ...process.env, SUPABASE_ACCESS_TOKEN: "test-token" } },
-  );
-  const result = JSON.parse(await new Response(status.stdout).text());
-  expect(result.ok).toBe(true);
-});
-```
-
-**d) Interactive and long-running flows** (CI only):
-
-```typescript
-test("supabase dev starts and shows ready status", async () => {
-  const proc = Bun.spawn(["bun", "run", "apps/cli/src/index.ts", "dev"], {
-    env: { ...process.env, SUPA_TARGET: "docker" },
-  });
-  const output = await readUntil(proc.stdout, "Ready", { timeout: 30_000 });
-  expect(output).toContain("Ready");
-  proc.kill();
-});
-```
-
-**Testing infrastructure**:
-
-| Concern          | Approach                                               |
-| ---------------- | ------------------------------------------------------ |
-| Test runner      | `bun:test` (native, fast)                              |
-| API mocking      | In-process mock server via `Bun.serve()` on port 0     |
-| Terminal mocking | Custom `TestRenderer` capturing component output       |
-| E2E execution    | `Bun.spawn` running CLI from source as real subprocess |
-| Fixtures         | `tests/fixtures/` with sample configs, API responses   |
-| CI gating        | All 3 layers must pass before merge                    |
-
-**Test coverage**:
-
-Track and enforce test coverage as a first-class metric. Target **high coverage** (90%+) across the codebase, with particular attention to:
-
-- Command handlers (business logic)
-- Error paths and edge cases
-- Output rendering for each format (human, json, env)
-
-Use `bun test --coverage` to generate coverage reports. Enforce minimum coverage thresholds in CI — PRs that drop coverage below the threshold cannot merge. Coverage is not a vanity metric here: since both humans and LLMs depend on every code path behaving correctly, untested code is a liability for both audiences.
-
-### Pillar 7: LLM-Native Design
-
-Beyond `--json`, specific patterns make a CLI excellent for LLM agents.
-
-**Auto-detection** (the most important feature): when an LLM agent runs `supabase projects`, stdout is piped (not a TTY). The CLI automatically switches to JSON output. Agents never need to remember `--output json`.
-
-**Discoverable via `--help`**: LLMs read help text to understand commands. Make it structured and complete:
-
-```
-$ supabase projects --help
-
-Usage: supabase projects [subcommand]
-
-Subcommands:
-  list     List all projects (default)
-  create   Create a new project
-
-Flags:
-  --output <format>   Output format: human, json, env (default: auto)
-  --org <id>          Filter by organization ID
-
-Examples:
-  supabase projects                     # List all projects
-  supabase projects --output json       # JSON output for scripting
-  supabase projects create --org abc    # Create project in org
-```
-
-**Idempotent where possible**: LLMs retry on failure. Commands should be safe to retry:
-
-- `supabase link --project abc` — links to project, no-op if already linked
-- `supabase migrations push` — pushes only unapplied migrations
-
-**Error recovery hints in JSON**:
-
-```json
-{
-  "ok": false,
-  "error": {
-    "code": "AUTH_TOKEN_EXPIRED",
-    "message": "Access token expired",
-    "suggestion": "Run `supabase login` to refresh",
-    "retry": false,
-    "docs_url": "https://supabase.com/docs/cli/auth"
-  }
-}
-```
-
-The `retry` field tells agents whether retrying might help (e.g., network timeout = true, auth expired = false).
-
-## Consequences
-
-### Positive
-
-- Commands work well for both humans and LLMs from a single codebase
-- Pure, testable handlers — test logic without mocking terminals
-- Multiple output formats without duplicating business logic
-- E2E tests validate the exact interface humans and LLMs interact with
-- Observability built in from day 0
-- Performance budgets prevent regressions
-
-### Negative
-
-- Requires discipline to follow all 7 pillars consistently
-- Output rendering adds a layer of indirection
-- High coverage threshold adds CI overhead
-- Performance budgets add CI overhead
-
-## Alternatives Considered
-
-1. **Human-first design with JSON bolted on** — leads to inconsistent output formats and poor LLM integration
-2. **Machine-first design with human formatting later** — makes UX secondary, results in poor human experience
-3. **Monolithic command handlers** — hard to test, impossible to support multiple output formats cleanly
-4. **Full OpenTelemetry from day 0** — adds startup latency; lightweight custom layer is better for CLI
-
-## Verification Checklist
-
-To validate these pillars are working:
-
-1. Write one command end-to-end (e.g., `supabase projects list`) implementing all pillars
-2. Run in terminal — human-readable output with colors and table formatting
-3. Pipe to jq — `supabase projects | jq .` produces valid, stable JSON
-4. Run with `--debug` — shows timing spans inline
-5. Run tests — unit, integration, E2E tests all pass
-6. Check performance — `time supabase --help` completes in < 100ms
-7. Simulate LLM — `echo "" | supabase projects` auto-detects non-TTY, outputs JSON
-
-## Related Decisions
-
-- [ADR 0000](0000-use-adr-to-record-decisions.md): Use ADR to Record Decisions
-- [ADR 0002](0002-cli-product-metrics.md): CLI Product Metrics
-- [ADR 0003](0003-self-documenting-cli.md): Self-Documenting CLI & Documentation Strategy
-- [ADR 0004](0004-cli-design-goals-and-workflows.md): CLI Design Goals & Development Workflows
-- [ADR 0005](0005-openapi-driven-code-generation.md): OpenAPI-Driven Code Generation (references pillars)
-- [ADR 0006](0006-environment-management.md): Environment Management (references pillars)
-- [ADR 0007](0007-realtime-progress-in-command-handlers.md): Real-time Progress (extends Pillar 1)
-
-## See Also
-
-- [clig.dev — CLI Guidelines](https://clig.dev/)
-- [GitHub CLI design patterns](https://cli.github.com/)
-- [MADR specification](https://adr.github.io/madr/)
diff --git a/docs/DISPATCH_ARCHITECTURE.md b/docs/DISPATCH_ARCHITECTURE.md
new file mode 100644
index 0000000..eebfdce
--- /dev/null
+++ b/docs/DISPATCH_ARCHITECTURE.md
@@ -0,0 +1,628 @@
+# Dispatch Architecture — operating-model (v3, EXECUTED)
+
+Date: Jun 04, 2026 (proposed) · Jun 05, 2026 (Stage-2 executed)
+Status: **v3 EXECUTED** — the Stage-2 atomic switchover landed on
+`feat/resolver-architecture` (PR #18): the 20 `docs/gates/` cards + `ZIG_RULES.md`
++ `BUN_RULES.md` dissolved into the 10 `dispatch/` entries; `docs/gates/` no longer
+exists; `audits/agents-md.sh` enforces dispatch parity on every commit. The body
+below is preserved as the design rationale **as proposed** (v2) — past-tense future
+sections ("will", "Stage 2 does…") describe the now-completed migration; it is the
+durable record of *why* the dispatch model exists, not a live to-do list.
+Owner: Orly (Oracle)
+Scope: `~/Projects/dotfiles` operating model + cross-repo rule-doc references
+
+> Design doc, not a milestone spec (dotfiles has no `docs/v*/` train). Lands on
+> `master` via `feat/dispatch-architecture`. **v2 supersedes v1** after a 7-lens
+> adversarial Chief Technology Officer (CTO) review (38 findings confirmed: 19
+> P0 / 16 P1 / 3 P2) returned **REWORK** — concept sound, migration plan
+> under-scoped ~10×, two determinism claims overstated. v2 keeps the façade-pair
+> core and rewrites the migration, the blast-radius accounting, and the claims to
+> match what the mechanisms actually deliver. Every change below is grounded in a
+> grep of the branch, not the review prose — file:line citations are real.
+> **Per-finding disposition (all 38 + resolved/partial status) is tracked in
+> [`DISPATCH_REVIEW_DISPOSITION.md`](./DISPATCH_REVIEW_DISPOSITION.md).**
+
+---
+
+## 0 · What changed from v1 (the review's verdict, absorbed)
+
+| v1 claim / gap | v2 correction |
+|---|---|
+| "the two façades **cannot drift**" (headline invariant) | Downgraded to **"no missing symbol + prose-pinned thresholds."** The coherence audit proves symbol presence, not that a check enforces the prose. Real semantic anchors added (§3, §6.3). |
+| §11 = cross-repo footnote | §8 = **primary in-dotfiles blast-radius inventory** (grounded, ~14 files). Cross-repo is downstream of it (§10). |
+| Dissolve `docs/gates/` + rename `*_RULES.md` (single act) | **Staged, non-destructive migration** (§9): scaffold → prove equivalence → atomic switchover. `make audit` never goes red mid-flight. Rollback defined. |
+| `make audit` "ALL CHECKS PASSED" as an acceptance bullet | The audit/hook/harness **rewrites are first-class deliverables** (§8, §13) and edit the harness → **explicit Indy sign-off required** (Hard-Safety rule). |
+| "nothing unique dies" on merge | A **mechanical merge-loss proof** (`merge-coverage.sh`, §6.5). No card deleted until its delta-landed assertion is green. |
+| `🟡` = JUDGMENT-open | **Glyph collision fixed** — `HARNESS_VERIFY_OUTPUT.md:19` already uses `🟡` for "violations addressed." v2 introduces **`🔵 DECIDE`** for judgment-open (§3.1). |
+| JUDGMENT "mitigated" / "blocks the turn" | Honestly scoped: **proven for DETERMINISTIC, attested-by-honor for JUDGMENT.** A `HARNESS_VERIFY` JUDGMENT row makes the *attestation* auditable (§11). |
+| Helper-absent → `⚪`, exit 0 | A DETERMINISTIC helper that is **absent hard-fails RED** (§10) — no silent green no-op. |
+| `.git/hooks/pre-commit` backstop | Wired to **`.githooks/pre-commit`** (`core.hooksPath` = `.githooks`, confirmed) — `.git/hooks/` never runs on a fresh clone. |
+| Dispatch run in dotfiles; leaf checks "just run" | **Execution-location model defined** (§10): `bin/sync-agents` **symlinks** (confirmed `:160,176`), so the dispatch runs in the product repo against a symlink back to dotfiles. `DISPATCH_ROOT` (target repo) is derived from `git rev-parse --show-toplevel`, NOT `BASH_SOURCE` — so a symlinked dispatch scopes to the repo it runs in, not dotfiles. |
+| fn≤50 / method≤70 sub-cap | **Not silently dropped** — `dispatch_length_gate` is file-cap only today (`lib.sh:107`); v2 names the sub-cap as a delegated/[JUDGMENT] decision in §13. |
+
+> **This doc is the TARGET STATE, not current code.** The dispatch WIP on this
+> branch (`dispatch/lib.sh`, `dispatch/write_zig.sh`) is v1-era: it still emits
+> `🟡` for judgment, returns `⚪`/exit 0 on an absent helper, derives
+> `DISPATCH_ROOT` from `BASH_SOURCE`, and wires `ufs.sh --all`. Every such
+> correction below is *specified here and implemented during the staged
+> migration* (§9), not already present. A second adversarial pass (Jun 04, 21
+> resolved / 17 partial) confirmed the partials are "doc correct, code pending" —
+> tracked as Stage-0 implementation work, not doc defects.
+
+---
+
+## 1 · Intent (the testable goal)
+
+**Goal (as a test name):** *"Writing a `*.zig` file dispatches a SMALL ORDERED
+façade set — the language façade (`dispatch/write_zig.md`) plus the one
+cross-cutting façade (`dispatch/write_any.md`) — the agent reads, and the
+matching deterministic `.sh` set the machine runs; every rule is tagged
+DETERMINISTIC (has a `.sh` check + a prose-pinned fixture) or JUDGMENT (has a
+Large Language Model (LLM) comprehension probe); the deterministic value lives
+once (in the `.sh`) and the prose references it, so a fixture catches prose↔check
+divergence; an audit ties tags ↔ checks ↔ evals ↔ merged-prose."*
+
+> Not literally "one façade" — a write triggers its language façade composed with
+> `write_any` (§5). Two façades, fixed and ordered, is still the single runnable
+> question v1 lacked; the scatter it kills was 20 cards + 478-line prose doc, not
+> "more than one file."
+
+**Why:** Today the Zig discipline is scattered: `docs/ZIG_RULES.md` (478 lines),
+`docs/gates/*.md` (20 cards), 10 `audits/*.sh`. Nothing makes "did I
+adhere to all Zig rules?" a runnable, testable question. This unifies them into
+a **façade pair per language** and proves adherence in both spaces.
+
+**What v2 does NOT claim:** that the `.md` and `.sh` *cannot* diverge in meaning.
+A symbol-presence audit cannot prove that. v2's mechanism for semantic coherence
+is **single-source thresholds + prose-pinned fixtures** (§3, §6.1), not the tag.
+
+## 2 · Core insight — a dispatch is a FAÇADE PAIR over one gate set
+
+A dispatch is not one file. It is the dispatcher *concept*, presenting two faces:
+
+```
+          ┌──────────── THE ZIG DISPATCH (one concept) ────────────┐
+LATENT ──▶ │  dispatch/write_zig.md   façade for the AGENT          │
+SPACE      │     prose dispatcher: "writing zig? adhere to this."    │
+           │     every § tagged [DETERMINISTIC → CODE] or [JUDGMENT] │
+           │            │ DETERMINISTIC tags link to ↓               │
+DETERM. ──▶│  dispatch/write_zig.sh   façade for the MACHINE        │
+SPACE      │     owns the threshold values; runs the checkable       │
+           │     subset → 🟢/🔴 + 🔵 judgment nudges                  │
+           │            │ calls ↓                                    │
+           │  audits/*.sh  +  inline checks (the leaf checks) │
+           └─────────────────────────────────────────────────────────┘
+```
+
+- **`write_zig.md`** = `docs/ZIG_RULES.md` **merged with the Zig-relevant
+  `docs/gates/*.md` deltas**, perfected and made more deterministic — not a bare
+  rename. It gains per-section enforcement tags; mechanical content moves to the
+  `.sh`; teaching prose stays.
+- **`write_zig.sh`** = the deterministic façade. **It owns every threshold value
+  verbatim** (`dispatch_length_gate 350`); the `.md` *references* the value
+  ("see `write_zig.sh::length`"), never restates the number. This is the v2
+  anti-drift mechanism — one source, not two copies bridged by a tag.
+
+**`gates/*.md` is DISSOLVED selectively, not wholesale** (§5 taxonomy): authoring
+gates merge into a façade `.md`; **process/meta gates stay in `AGENTS.md`**. Merge
+is **merge-then-delete with a proof gate** (§6.5): a card is deleted only after
+`merge-coverage.sh` confirms its non-boilerplate prose landed in a façade.
+
+## 3 · Enforcement tags + the semantic anchor
+
+Each section of the latent façade carries exactly one tag. **The tag grammar is
+frozen to one form** matching what `write_zig.sh` actually emits — a rule CODE,
+not a `::function` reference (v1 mixed `sh::X` and `write_zig.sh::<check>`; both
+are dropped):
+
+| Tag | Meaning | Enforced by | Eval kind |
+|---|---|---|---|
+| `[DETERMINISTIC → CODE]` | machine can pass/fail it | the `.sh` row for `CODE` (e.g. `FLL`, `UFS`) | prose-pinned fixture (pass + fail) |
+| `[JUDGMENT → CODE]` | no script can decide; agent decides at write time | agent reading the prose | LLM-judge scenario |
+| `[container]` | structural wrapper heading, not a rule | nothing — its tagged subsections carry the real codes | skipped (coherence audit §6.3) |
+
+Walk all ~40 ZIG sections + merged gate deltas; tag each. A DETERMINISTIC tag
+whose CODE has no `.sh` row is a *build-the-check* TODO; a section that genuinely
+can't be checked is honestly `[JUDGMENT]`. Structural wrapper headings (e.g.
+"Merged from dissolved gate cards") carry `[container]` — the sole non-rule tag —
+and the coherence audit skips them; their tagged subsections carry the real codes.
+
+**The semantic anchor (the v2 fix for "false determinism"):**
+1. **Single source.** The numeric/threshold lives ONLY in the `.sh`
+   (`dispatch_length_gate 350`). The `.md` says "≤ the cap in
+   `write_zig.sh::length`" — it carries no competing number to drift.
+2. **Prose-pinned fixture.** For any rule whose prose states a bound, a fixture
+   pins it: `length_351_fail.zig` MUST exit 1. If someone edits the `.sh` cap to
+   500, the 351 fixture flips to pass and `dispatch-evals` goes red. The
+   **fixture**, not the tag, is the drift detector.
+
+### 3.1 · Signal semantics (🟢 / 🔴 / 🔵) — and the glyph-collision fix
+
+`HARNESS_VERIFY_OUTPUT.md:19` already defines `🟡 = violations addressed` (a
+resolved-but-noted deterministic state, e.g. `LENGTH GATE | 🟡 files at cap`).
+v1 reused `🟡` for "judgment open question" — the **opposite** semantics (open vs
+resolved). v2 introduces a distinct glyph so one symbol never carries two
+meanings:
+
+| Signal | Meaning | Agent MUST | Exit |
+|---|---|---|---|
+| 🟢 GREEN | deterministic check passed | proceed | 0 |
+| 🔴 RED | deterministic check failed | STOP, fix code, re-run | 1 (blocks) |
+| 🟡 YELLOW | deterministic violation **addressed** (informational) | note it; existing meaning, unchanged | 0 |
+| 🔵 DECIDE | judgment-only rule; no script can decide | read linked §, make the call, **state the verdict in chat** | 0 (does NOT block script) |
+
+**Why a new glyph, not re-glyphing `🟡`:** re-glyphing the established
+"violations addressed" cells touches an audited doc and retrains every agent on a
+symbol they already know. `🔵` is additive — a new concept gets a new glyph. The
+fix still requires a one-line `HARNESS_VERIFY_OUTPUT.md` legend update and an
+`audits/agents-md.md` question pinning `🔵` (§8, §13).
+
+**🔵 blocks the TURN, not the script** — see §11 for how that is made auditable
+rather than honor-only.
+
+## 4 · Two worked gates (the concrete shape)
+
+**GATE 1 — LENGTH (deterministic, single-source threshold):**
+```
+write_zig.md §Length:
+  - `.zig` ≤ the cap in write_zig.sh::length; split by concern when over.
+    [DETERMINISTIC → FLL]   (the number lives in the .sh, not here)
+write_zig.sh:  dispatch_length_gate 350
+fixture:  length_351_fail.zig → exit 1   (pins the prose bound; flips if cap moves)
+run:  FLL 🔴 File & Function Length Limits — foo.zig: 360 (cap 350) — split
+→ machine decides. pass/fail. prose carries no drift-able number.
+```
+
+**GATE 2 — TAGGED-UNIONS (judgment, no script):**
+```
+write_zig.md §Tagged unions for result types:
+  - Result with distinct failure modes → union(enum) w/ payload, not
+    optional-field struct. Callers need the *reason*, not the verdict.
+    [JUDGMENT → TGU]
+write_zig.sh:  dispatch_judgment "TGU" "result w/ failure modes? union(enum)…"
+eval:  evals/llms — scenario asserts union(enum), not optional struct
+run:  TGU 🔵 DECIDE — result w/ failure modes? union(enum), not optional-field
+→ agent decides, states verdict in chat; HARNESS VERIFY audits the attestation.
+```
+
+## 5 · Dispatch set + gate disposition (all 20 mapped — no homeless gate)
+
+| Latent façade (.md) | Deterministic façade (.sh) | Triggers |
+|---|---|---|
+| `write_zig.md` | `write_zig.sh` | `*.zig` |
+| `write_ts_adhere_bun.md` | `write_ts_adhere_bun.sh` | `*.ts *.tsx *.js *.jsx` |
+| `write_sql.md` | `write_sql.sh` | `schema/*.sql` |
+| `write_any.md` | `write_any.sh` | any source (cross-cutting authoring rules) |
+
+**Disposition taxonomy — all 20 mapped; 15 dissolve, 5 stay (NOT emptied):**
+
+- **(A) Language-authoring gates → that language's façade.** `zig`, `pub-surface`,
+  `lifecycle` → `write_zig`; `ui-substitution`, `design-token` → `write_ts_adhere_bun`;
+  `schema-removal` → `write_sql`.
+- **(B) Cross-cutting authoring gates → `write_any`.** `file-length`, `logging`,
+  `milestone-id`, `error-registry`, `ufs`, `greptile`, and the legacy-workaround
+  family (`nlr`, `nlg`, `legacy-design`). **Principle (not a junk drawer):**
+  `write_any` holds *language-agnostic authoring invariants that apply identically
+  to every source file* — literal hygiene, length, observability, milestone-free
+  naming, dead-code/legacy. The discriminator vs (C): (B) is checked **per file at
+  write time**; (C) governs the **lifecycle/process**, never a single file's bytes.
+- **(C) Process / meta gates → STAY as `docs/gates/` bodies (NOT dissolved).**
+  `verification`, `invariance-suite`, `spec-template`, `architecture`, `doc-read`.
+  **Why they keep their `docs/gates/` cards (not inlined into `AGENTS.md`):**
+  `AGENTS.md` is 28744 / 29696 bytes — ~950 bytes headroom; five bodies cannot fit.
+  So `docs/gates/` is **never emptied** — it retains exactly these five cards. This
+  is also what de-fangs the "disk_count → 0 fails the parity check" risk (§9).
+
+**The new parity invariant (the hard part v1 hand-waved).** `agents-md.sh`
+check #9b becomes: `AGENTS.md dispatch-rows == (retained docs/gates/ bodies = 5)
++ (dispatch façades = 4)`, and the empty-set guard (`:177`) flips from "≥1 gate
+body" to "exactly the 5 process bodies present." `REQUIRED_GATES` (data.sh)
+splits into `REQUIRED_PROCESS_GATES` (5) + `REQUIRED_DISPATCH` (4). No gate is
+homeless, none double-homed, and the audit counts a well-defined mixed end-state.
+
+## 6 · EVALS — both spaces + two new proofs
+
+### 6.1 Deterministic façade evals — prose-pinned fixtures
+```
+evals/dispatch/fixtures/
+  length_350_pass.zig    → write_zig.sh expects exit 0
+  length_351_fail.zig    → expects exit 1   (PINS the prose bound)
+  ufs_dup_string.zig     → expects exit 1
+  deinit_missing.zig     → expects exit 1
+evals/dispatch/run.sh  → runs each fixture, diffs actual vs expected exit
+```
+Every `[DETERMINISTIC → CODE]` rule MUST have ≥1 pass + ≥1 fail fixture, and any
+rule whose prose states a bound MUST have a fixture that pins it (§3).
+
+### 6.2 Latent façade evals — COMPREHENSION probes (rewire the EXISTING harness)
+`evals/llms/run.sh` is a **cross-agent comprehension runner**
+(claude/codex/amp/opencode, `:69-78`). It grades by exact match on a
+`VERDICT: YES|NO` line over `fixtures.jsonl` (`:125-174`) — it is a *comprehension*
+grader, **not an adherence judge** over free-form code. v2 is honest about that:
+1. **Repoint context.** `build_context()` (`:83-90`) currently cats
+   `"$GATES_DIR"/*.md`. Repoint to cat **`dispatch/*.md` PLUS the retained
+   `docs/gates/*.md`** (the 5 process cards, §5). Without this, `cat
+   "$GATES_DIR"/*.md` dies on a changed dir. `GATES_DIR` at `:22`.
+2. **JUDGMENT evals are comprehension probes, not adherence proofs.** A probe asks:
+   *"given `write_zig.md`, does the model correctly answer the TGU judgment
+   question (union vs optional-struct)?"* — a YES/NO the existing grader can score.
+   It proves the model **understands** the rule, NOT that a real diff **adhered**.
+   **Real-diff adherence is checked at `/review` + greptile, not in CI** — claiming
+   a CI judge proves adherence was v1's category error. A true adherence judge
+   (elicit code → rubric-grade with a pinned model) is **out of scope for v2**;
+   flagged in §16 if you want it scoped later.
+
+### 6.3 Coherence audit — `evals/dispatch/coverage.sh` (honest scope)
+Proves **completeness and symbol-presence** — NOT prose semantics (that's §6.1's
+fixtures). Fails if any of:
+- a `[DETERMINISTIC → CODE]` tag has no row for `CODE` in **any** dispatch `.sh` (a *universal* code like `UFS` is wired once in its home façade — `write_any` — and satisfies the tag wherever the rule's prose appears; only a code wired in NO dispatch fails — §16 Decision 6);
+- a DETERMINISTIC rule has no pass+fail fixture — this audit checks fixture *presence* only; the boundary-*pinning* of a bounded rule (the `351` flips if the cap moves) is proven by `run.sh` executing the boundary fixtures against the live cap, NOT by this audit (§6.1);
+- a `[JUDGMENT]` rule has no comprehension probe (§6.2);
+- a `.sh` CODE row has no tag in the `.md` (orphan check);
+- **a CODE row delegates to a leaf helper that is absent / non-executable**
+  (closes the silent-green hole, §10);
+- a CODE appears in `.sh` output with no gloss-map entry (no naked codes).
+
+### 6.4 Rule-code glosses — ONE canonical list
+v1 already drifted: `lib.sh:45-61` carries codes (`FLL`/`LENGTH` duplicated;
+`PUB`/`DRAIN`/`DEINIT`/`ARCH`/`XCOMPILE`) absent from the `RULES.md` legend and the
+old §6.4 table. v2: **one canonical gloss list** in `RULES.md`; `lib.sh` mirrors it;
+`dispatch-coverage.sh` fails on any divergence. Drop the `FLL`/`LENGTH`
+duplicate. Delegated-only codes (`PUB`/`DRAIN`/`XCOMPILE`) get legend entries too.
+
+### 6.5 Merge-loss proof — `evals/dispatch/merge-coverage.sh` (NEW, keystone)
+For each of the 15 authoring cards scheduled for deletion: assert every
+non-boilerplate token-line appears in some `dispatch/*.md`, **or** is captured as
+an explicit drop. **Honest scope (same discipline as §6.3):** this proves
+*prose-token coverage*, NOT semantic equivalence and NOT trigger-enforcement —
+that a reworded-but-faithful merge and an enforcement-orphaned trigger are *both*
+risks the token scan alone won't catch. Three guards close the gameable holes the
+adversarial pass flagged:
+- **Frozen normalization** (not "normalized", hand-wave): lowercase → strip
+  markdown punctuation/backticks → collapse whitespace → tokenize to a word
+  multiset. The grammar is pinned in the script + a negative fixture proves an
+  orphaned sentence FAILS.
+- **No agent self-certification.** The "intentionally-dropped" branch requires an
+  **Indy ack-quote** in the PR (Pull Request) body (per the deferral-discipline
+  rule) — the merging agent may not author its own drop justification.
+- **Trigger-surface enforcement is separate.** Each dissolved card's machine
+  trigger (e.g. `milestone-id`'s `M[0-9]+_[0-9]+` regex, `ui-substitution`'s raw
+  element list) must reproduce as a `.sh` CODE row, verified by §6.3's tag↔check
+  wiring — token-coverage alone does not prove the trigger still fires.
+
+A card is not deleted until its delta-landed assertion is green. Preserve any
+`audits/agents-md.md` scenario that quotes a deleted body verbatim (§11).
+
+## 7 · Firing planes (corrected wiring + latency)
+
+| Plane | When | Invocation |
+|---|---|---|
+| Latent | EXECUTE, about to write | agent reads `write_zig.md`; runs `write_zig.sh <file>` (scoped to the touched file, NOT `--all`) |
+| Anchor | HARNESS VERIFY (end-of-turn) | `write_zig.sh --staged`; 🔴 → back to EXECUTE; 🔵 → state verdict |
+| Backstop | COMMIT | **`.githooks/pre-commit`** (core.hooksPath, confirmed) runs `dispatch/*.sh --staged` — **dotfiles repo only;** product repos keep the 8 leaf audits (Reading A, §10.7) |
+| Audit | pre-push + `make audit` | `dispatch-coverage.sh` + `merge-coverage.sh` wired into the SAME chain as `agents-md.sh` |
+| Evals | pre-push + `make` | `dispatch-evals/run.sh` + (opt-in) `make llmevals` |
+
+**Latency fix:** v1's `write_zig.sh` wired `ufs.sh --all` (full-tree scan)
+on every per-edit call — contradicting "instant on no-match." v2 scopes leaf runs
+to `DISPATCH_FILES` (teach `ufs.sh` a file-list mode; pass the staged set);
+`--all` runs only on the Audit/Evals planes. State a measured latency on
+`usezombie` before claiming "instant."
+
+## 8 · In-dotfiles blast radius (PRIMARY — grounded, ~14 files)
+
+The dissolution + rename touches the operating model's own enforcement spine.
+**Every edit below lands in the Stage-2 atomic commit (§9).** Citations verified
+against `feat/dispatch-architecture`:
+
+| File | Line(s) | What it pins | Must change to |
+|---|---|---|---|
+| `audits/agents-md.sh` | `:14` | `GATES_DIR=docs/gates` | derive from `dispatch/` |
+| ″ | `:46-65` (#1) | `REQUIRED_GATES` ⊂ AGENTS.md index | dispatch-set inventory |
+| ″ | `:171-187` (#8) | gate bodies; **`:177` empty-set guard** | dispatch-body completeness |
+| ″ | `:190-209` (#9b) | parity `index==disk==REQUIRED` | dispatch parity |
+| ″ | `:263-277` | both hooks must grep `docs/gates` | grep `dispatch/` |
+| ″ | `:130-133` | `DOTFILES_RESIDENT` docs exist | new resident paths |
+| `audits/data.sh` | `:36-46` | `REQUIRED_GATES` name array | dispatch set |
+| ″ | `:70-78` | `DOTFILES_RESIDENT` (ZIG/BUN/greptile RULES) | `dispatch/*.md` |
+| ″ | `:94-118` | `NAMED_SCENARIOS` 1:1 w/ invariance | mirror scenario edits |
+| `.githooks/pre-commit` | trigger glob | gates `AGENTS.md`/`docs/gates` edits | add `dispatch/` |
+| `.githooks/pre-push` | `:72` + guard | message + `docs/gates` guard | repoint + reword |
+| `evals/llms/run.sh` | `:22`, `:83-90` | `build_context` cats `docs/gates/*.md` | cat `dispatch/*.md` |
+| `evals/test-agents-md.sh` | `:39,46,165-167` | sandbox builds `docs/gates`+RULES; negative case asserts hook bites on dropped `docs/gates` | rewrite sandbox + negatives for dispatch model |
+| `bin/sync-agents` | `:35,37,45` | propagates `ZIG_RULES`/`BUN_RULES`/`docs/gates` → product repos | repoint + **add `dispatch/`** |
+| `AGENTS.md` | `:66,212` | `*.zig`→ZIG_RULES; /review→ZIG_RULES | →`write_zig.md` + Dispatch table |
+| `docs/EXECUTE_DOC_READS.md` | `:11,12` | zig→ZIG_RULES, ts→BUN_RULES | →façades |
+| `docs/greptile-learnings/RULES.md` | `:42,91` | cross-ref ZIG_RULES sections | →`write_zig.md` |
+| `docs/LIFECYCLE_PATTERNS.md` | `:3,311` | sister-doc refs ZIG_RULES | →`write_zig.md` |
+| `docs/LOGGING_STANDARD.md` | `:193,195,263,283-285` | BUN_RULES §9/§10, ZIG_RULES | →façades |
+| `docs/TEMPLATE.md` | `:139,142,154,356` | ZIG/BUN doc-read rows | →façades |
+| `docs/ZIG_RULES.md` | `:415` | refs BUN_RULES §2 | `git rm` (deleted; cross-ref already resolved in the merged `write_zig.md`) |
+| `audits/logging.sh` | `:152` | fail message cites `BUN_RULES §10` | →`write_ts_adhere_bun.md §logging` |
+| `skills/kishore-spec-new/SKILL.md` | `:63` | names `ZIG_RULES.md`/`BUN_RULES.md` as per-surface rule files | →façades (verify sync scope before assuming it ships to product repos) |
+| `docs/HARNESS_VERIFY_OUTPUT.md` | `:19,26-36` | `🟡 = violations addressed` | add `🔵 DECIDE` legend + JUDGMENT row (§11) |
+
+**Magnitude:** ~30+ edits across ~16 files, all in one atomic commit. This is the
+work v1 never scoped — it is the dominant cost, not a footnote.
+
+**Completeness is machine-enforced, not trust-the-table.** A
+`zero-dangling-ref` audit gates Stage 2: `grep -rIl 'ZIG_RULES\|BUN_RULES\|docs/gates/[a-z-]*\.md'`
+across the tree (minus this doc, git history, and the 5 retained process cards)
+must return **zero** hits. The table above is the human map; the grep is the gate
+— it catches any ref site (like `logging.sh` / `SKILL.md`) the table missed.
+
+**Product-repo files are out of scope (Reading A — Indy, confirmed).** This
+inventory is dotfiles-only: no product repo's `make/harness.mk` or
+`.githooks/pre-commit` is edited by the migration. The 8 leaf audits remain each
+repo's commit-plane + harness enforcement and reach it as `sync-agents`
+**symlinks**, so the one in-scope leaf edit (`logging.sh:152`, fail-message
+repoint) propagates with **zero product-repo commit**. Dispatch ship to product
+repos as **agent-facing files only** (§10.7) — never wired into a product Makefile
+or hook.
+
+## 9 · Migration plan — staged, non-destructive (the keystone fix)
+
+The Invariance Suite Gate is **no-override** and derives the gate set from disk
+with 3-way parity, so any intermediate state where `docs/gates/` is half-gone
+fails `make audit` — which the hooks run unconditionally, blocking the very commit.
+v2 therefore **never lets `make audit` go red mid-flight**:
+
+**Stage 0 — Scaffold (purely additive; gates + RULES untouched).** Create
+`dispatch/{lib,write_zig,write_ts_adhere_bun,write_sql,write_any}.{sh}` and the
+`.md` façades (merge ZIG_RULES + gate deltas) ALONGSIDE the still-present
+`docs/gates/` and `docs/ZIG_RULES.md`. Add `evals/dispatch/`,
+`dispatch-coverage.sh`, `merge-coverage.sh`. **`make audit` stays
+green** (nothing removed). One or more commits.
+
+**Stage 1 — Prove equivalence (still additive).** `merge-coverage.sh` green
+(every gate-card delta landed in a façade). `dispatch-evals/run.sh` green.
+`make llmevals` green against the new dispatch context. Dispatch and legacy gates
+both present and passing. **`make audit` stays green.** Commit.
+
+**Stage 2 — Atomic switchover (the ONLY harness-editing commit → Indy sign-off).**
+In ONE commit: all §8 edits + zero-dangling-ref grep green + `git rm
+docs/ZIG_RULES.md docs/BUN_RULES.md` — **deletion, not `git mv`**: the prose was
+already additively merged into `dispatch/write_zig.md` (657 lines) and
+`dispatch/write_ts_adhere_bun.md` in Stage 0, so a `git mv` would clobber the
+merged façades; `merge-coverage.sh` is the proof-of-no-loss — + `git rm` the **15
+authoring cards only** (the 5 process cards STAY, §5; only after §6.5 green) +
+`git rm` the now-spent **merge-coverage set** (`evals/dispatch/merge-coverage.sh`,
+`merge_coverage.py`, `merge-coverage-drops.tsv`, `fixtures/merge_orphan_card.md`)
+— one-shot migration scaffolding, dead once the cards are gone (RULE NDC) — +
+AGENTS.md gate-index → Dispatch table (4 rows) + slimmed 5-row process-gate index +
+`sync-agents` repoint & dispatch-add.
+
+**Why atomic IS green (the fresh-eyes "impossible" objection, resolved).** The
+pre-commit hook runs the *worktree's* `agents-md.sh` against the *worktree*.
+In this single commit the rewritten audit AND the new tree are both
+staged-and-saved together, so the **new** parity check (`5 process + 4 dispatch`,
+§5) evaluates the **new** state — never the old check against a half-migrated tree.
+`docs/gates/` is never emptied (5 cards stay), so the `:177` empty-set guard is
+satisfied throughout. Run `make audit && make test-audit` as a **pre-flight on the
+fully-staged worktree** before `git commit`; the hook then re-confirms. No
+`--no-verify`, ever.
+
+**Rollback.** Stages 0–1 are additive → nothing to revert. Stage 2 is one commit →
+`git revert` restores the full prior spine (gate cards live in git history; the
+merge was additive prose, so reverting loses no rule). No kill-switch needed
+because no destructive state exists before Stage 2.
+
+**Per Hard-Safety:** Stage 2 edits `audit-*.sh` + hooks (a harness/gate) → it
+requires **explicit Indy sign-off naming the files + reason**, captured in the PR
+Session Notes. The agent does not switch over unilaterally.
+
+## 10 · Execution-location & cross-repo delivery
+
+**The problem v1 ignored — and the symlink twist the adversarial pass caught:**
+`dispatch_resolve_files --staged` discovers files via `git -C "$DISPATCH_ROOT"`,
+where `DISPATCH_ROOT` is derived from `BASH_SOURCE` (`lib.sh:35`). But
+**`bin/sync-agents` SYMLINKS** (`ln -s`, confirmed `:160,176`) — it does not copy.
+So a dispatch "shipped" into `usezombie` is a symlink back to
+`~/Projects/dotfiles/dispatch/`, and a `BASH_SOURCE`-derived `DISPATCH_ROOT`
+resolves to **dotfiles**, not `usezombie` — the Zig checks scan dotfiles' empty
+tree and pass **vacuously**, exactly the bug propagation was supposed to cure.
+
+**v2 model — separate the two roots `lib.sh` currently conflates:**
+1. **`DISPATCH_HOME`** (where the scripts live, for `source lib.sh` + finding
+   `audits/`) — from `BASH_SOURCE`. Follows the symlink to dotfiles; that's
+   correct for *locating the code*.
+2. **`TARGET_ROOT`** (the repo being checked, for `--staged` git discovery AND the
+   leaf-check scope) — from **`git rev-parse --show-toplevel`** of the CWD (or the
+   file arg's dir). This resolves to `usezombie` when the symlinked dispatch is run
+   from inside `usezombie`, so discovery and the leaves (`ufs.sh` etc., which
+   already root off `--show-toplevel`) **agree on the same repo**. Robust whether
+   sync copies or symlinks.
+3. **Ship dispatch into each product repo via `bin/sync-agents`** (add a
+   `dispatch:dispatch` entry to the link list). With (2), the symlink is now safe.
+4. **Dotfiles = source-of-truth + fixture/eval host**, not where Zig checks run on
+   real code. `evals/dispatch/` fixtures are the only place these checks
+   are provable in dotfiles (it has no `*.zig`).
+5. **`dispatch_run_helper` hard-fails (🔴, `DISPATCH_RC=1`) on an absent
+   DETERMINISTIC helper** — never `⚪`/exit 0. `⚪` is reserved for
+   `dispatch_delegate`. `dispatch-coverage.sh` enforces helper presence (§6.3).
+6. Add a `sync-agents` propagation test + a **staleness note:** symlinks are always
+   current; a product-repo *real-file* override triggers sync-agents' existing
+   warn-and-skip (`:171`) — flagged, not silent. Add `dispatch/*.md` to
+   `DOTFILES_RESIDENT`.
+7. **Product repos are NOT rewired (Reading A — Indy, confirmed).** `sync-agents`
+   ships `dispatch/{*.md,*.sh}` into each product repo as **agent-facing files**
+   (read at EXECUTE; runnable on a touched file) — but **no product repo's
+   `make/harness.mk` or `.githooks/pre-commit` is edited.** The 8 leaf audits
+   (`audit-ufs` … `audit-msid-ui`, symlinked in) stay each repo's codebase-wide
+   mechanical net; dispatch are the per-file authoring lens + the dotfiles-side
+   coherence/merge audits (§6.3/§6.5). The §7 Backstop plane is therefore
+   **dotfiles-only** — it fires against `evals/dispatch/` fixtures (dotfiles
+   has no real `*.zig`/`*.ts`), which keeps the §8 zero-dangling-ref grep and the
+   Stage-2 sign-off scoped to dotfiles.
+
+## 11 · JUDGMENT enforcement — honest, and made auditable
+
+`dispatch_judgment` prints a `🔵` row and exits 0. No script can decide a taste
+question, and faking determinism on one is the anti-goal. So the claim is scoped
+honestly: **DETERMINISTIC rules are proven; JUDGMENT rules are attested.** v2
+makes the *attestation* auditable rather than pure honor-system:
+
+- Add a **JUDGMENT row to `HARNESS_VERIFY_OUTPUT.md`** (`HARNESS_KEYS` in
+  `data.sh:62-67`). **Honest scope:** the audit check is `grep -qF "$kw"
+  AGENTS.md` (`agents-md.sh:117`) — it verifies the row *exists* in the prose
+  (so HARNESS VERIFY always lists a judgment line), NOT that a *specific turn*
+  answered its `🔵`. Per-turn answering is **not machine-checked** — claiming
+  otherwise was the overclaim the coverage pass flagged.
+- **The machine backstop is the deferred ledger, not this row.** A turn-scoped
+  verdict ledger that `pre-commit` refuses until each `🔵` has a `CODE: applied|N/A`
+  ack is the only thing that mechanically blocks an unanswered judgment. Deferred
+  to §16 Q1 — without it, judgment adherence is attested + comprehension-probed
+  (§6.2), not enforced. Stated plainly, not dressed up.
+- **Cross-agent caveat:** headless non-Orly agents (codex/amp/opencode) emit `🔵`
+  to stdout with no chat audience; the comprehension probe (§6.2) is the only
+  signal for them. The turn-verdict ritual is interactive-Orly best-effort.
+
+**Invariance-questionnaire migration (part of Stage 2).** Dissolving the 15
+authoring cards can strand `audits/agents-md.md` scenarios that assert facts about
+those bodies. Before deletion: `grep` the questionnaire for every scenario that
+(a) quotes a dissolved body verbatim, (b) requires a per-body structural section
+(the review flagged a `Scope (M70)` requirement), or (c) triggers on "edits any
+`docs/gates/*.md`". Each must be **relocated, retired, or rebased onto the façade
+with an Indy ack** so it stays answerable-YES. The review named ~7.10/13.1/14.5/
+22.4/23.1 — **confirm exact IDs at execution** (the grep is the source of truth,
+not these numbers). `NAMED_SCENARIOS` parity (`data.sh:94-118`) keeps the
+keyword count honest but does not make a YES answer true — that's manual.
+
+§1/§9 language is downgraded accordingly: "proven, not promised" holds for the
+DETERMINISTIC half; the JUDGMENT half is "attested + eval-sampled."
+
+## 12 · Invariants (code-enforced)
+
+1. One verdict format — all `.sh` source `lib.sh`.
+2. **No missing symbol** (not "no drift") — coherence audit (§6.3).
+3. **No threshold drift** — single-source value + prose-pinned fixture (§3, §6.1).
+4. Determinism — caps intrinsic to file content, never git history.
+5. Every rule classified — no untagged section (audit-enforced).
+6. Every rule evaluable — DETERMINISTIC→fixture, JUDGMENT→judge (audit-enforced).
+7. No rule lost on merge — `merge-coverage.sh` (§6.5).
+8. No naked codes — one canonical gloss list (§6.4).
+9. No silent green — absent DETERMINISTIC helper → 🔴 (§10).
+10. One glyph, one meaning — `🟡` addressed, `🔵` decide (§3.1).
+
+## 13 · Acceptance criteria
+
+**Dispatch assets**
+- [ ] `dispatch/{lib,write_zig,write_ts_adhere_bun,write_sql,write_any}.{sh}` exist
+- [ ] `dispatch/{write_zig,write_ts_adhere_bun,write_sql,write_any}.md` exist; every § tagged; thresholds single-sourced in the `.sh`
+- [ ] `file-length` fn≤50 / method≤70 sub-cap **implemented as a leaf check OR honestly tagged `[JUDGMENT]`** — named explicitly, not collapsed into "300/350"
+- [ ] glyph `🔵 DECIDE` defined; `🟡` left as "violations addressed"
+
+**Evals & proofs**
+- [ ] `evals/dispatch/` fixtures: every DETERMINISTIC rule pass+fail; every prose bound pinned
+- [ ] `evals/llms/` JUDGMENT scenario per rule; `build_context` repointed to `dispatch/`
+- [ ] `evals/dispatch/coverage.sh` clean (tags↔checks↔evals↔helper-presence↔glosses)
+- [ ] `evals/dispatch/merge-coverage.sh` clean (every deleted card's delta landed)
+- [ ] one canonical gloss list (`RULES.md` ↔ `lib.sh`); `FLL`/`LENGTH` dup removed
+
+- [ ] `dispatch/lib.sh`: `DISPATCH_HOME` (BASH_SOURCE) vs `TARGET_ROOT` (`git rev-parse --show-toplevel`) split (§10); absent DETERMINISTIC helper → 🔴 not ⚪/0
+- [ ] `docs/EXECUTE_DOC_READS.md`: doc-reads trigger rows for the NET-NEW façades (`write_sql.md`, `write_any.md`), not just repointed zig/ts rows
+
+**Harness rewrites (first-class; Stage-2; Indy sign-off)**
+- [ ] `data.sh`: `REQUIRED_GATES` → `REQUIRED_PROCESS_GATES` (5) + `REQUIRED_DISPATCH` (4); `DOTFILES_RESIDENT`→`dispatch/*.md`; `NAMED_SCENARIOS` mirrors invariance edits
+- [ ] `agents-md.sh`: checks #1/#8/#9b derive the mixed end-state; parity `index == 5 process bodies + 4 dispatch`; empty-set guard → "exactly the 5 process cards present"; hook-trigger check greps `dispatch/` + `docs/gates/`
+- [ ] `.githooks/pre-commit` + `pre-push` repointed (NOT `.git/hooks/`)
+- [ ] `evals/test-agents-md.sh` rewritten: sandbox + negative cases prove the NEW coherence audit bites
+- [ ] `HARNESS_VERIFY_OUTPUT.md` JUDGMENT row + `🔵` legend; `audits/agents-md.md` question pinning `🔵` and the dispatch model
+- [ ] `bin/sync-agents` repointed + `dispatch:dispatch` added + propagation test
+
+**Migration & references**
+- [ ] Stage 0/1 commits keep `make audit` green; Stage 2 atomic; rollback note in PR
+- [ ] `zero-dangling-ref` grep gate green (§8) — machine-enforced, not trust-the-table
+- [ ] invariance-questionnaire migration done: stranded scenarios relocated/retired/rebased with Indy ack (§11)
+- [ ] all §8 sibling-doc references repointed in the Stage-2 diff (incl. `logging.sh`, `SKILL.md`)
+- [ ] cross-repo (`usezombie`) refs resolved via `sync-agents` propagation (§10)
+- [ ] `make audit` + `make test-audit` ALL CHECKS PASSED at Stage-2 boundary + invariance signoff
+
+## 14 · Failure modes → mitigations
+
+| Failure | Mitigation |
+|---|---|
+| `.md` prose value drifts from `.sh` | single-source threshold + prose-pinned fixture (§3) — not the tag |
+| DETERMINISTIC helper deleted/renamed → silent green | `dispatch_run_helper` → 🔴; coherence audit asserts helper presence (§10) |
+| `make audit` red mid-migration blocks the commit | staged, additive migration; red only conceivable inside the one atomic Stage-2 commit (§9) |
+| Unique gate prose lost on merge | `merge-coverage.sh` blocks deletion until delta lands (§6.5) |
+| `llmevals` dies on empty `docs/gates/` under `set -e` | `build_context` repointed to `dispatch/` in Stage 2 (§6.2, §8) |
+| Dispatch never reaches `usezombie` | added to `sync-agents`; dispatch ship into product repos (§10) |
+| `🔵` judgment silently ignored | HARNESS VERIFY JUDGMENT row audited; LLM-judge eval samples adherence (§11) |
+| Glyph ambiguity | `🟡` and `🔵` disjoint, pinned by invariance question (§3.1) |
+| Backstop never runs on fresh clone | wired to `.githooks/` (core.hooksPath), not `.git/hooks/` (§7) |
+
+## 15 · Discovery (consult log)
+
+- **Façade-pair insight (Indy, Jun 04):** dispatch = `.md`+`.sh` pair, not one file.
+- **Merge, not rename (Indy, Jun 04):** *"latentspace `dispatch/write_zig.md`
+  (merged perfected made more deterministic merge of the ZIG_RULES.md + the
+  gates/\*.md relevant to zig)"* → §2: façade `.md` is a merge of ZIG_RULES + zig
+  gate deltas; `zig.sh` renamed to `write_zig.sh` (the bare `zig.sh` name rejected).
+- **Manifest rejected:** `.sh` is executable truth; manifest duplicates.
+- **gates/\*.md dissolved selectively (v2):** authoring gates → façade; process
+  gates stay in AGENTS.md (§5) — v1's "all 20 → façades" was a category error.
+- **new=300/edited=350 rejected:** git-state-dependent → flat caps, intrinsic.
+- **Evals in both spaces (Indy, Jun 04):** fixtures + LLM-judge + coherence audit.
+- **Glosses (Indy, Jun 04):** gloss map + RULES.md legend + baked into output.
+- **Adversarial CTO review (Orly, Jun 04):** 7 lenses, 38 confirmed findings
+  (19 P0), verdict REWORK. v2 absorbs all P0/P1: staged migration (§9), primary
+  in-dotfiles blast radius (§8), downgraded drift claim + semantic anchor (§3),
+  merge-loss proof (§6.5), execution-location model (§10), glyph fix (§3.1),
+  honest JUDGMENT (§11), `.githooks` wiring (§7).
+- **Decisions made this turn (Orly, pick-and-proceed):** (a) `🔵` for judgment
+  rather than re-glyph `🟡` — additive, lower blast radius; (b) staged migration
+  over single atomic diff — keeps `make audit` green and gives free rollback;
+  (c) dispatch ship into product repos via `sync-agents` — the only way the Zig
+  checks run against real `*.zig`. Indy to confirm or redirect.
+- **Stage-2 sign-off (Indy, Jun 04, 2026):** *"stage-2 yes signed off"* — context:
+  authorizes the Stage-2 atomic switchover to edit `audit-*.sh` + `.githooks` (a
+  harness/gate), satisfying the Hard-Safety harness-patch rule. The `🔵` glyph and
+  the JUDGMENT ledger remain open (§16, Q1/Q2).
+
+## 16 · Decisions (was: open questions)
+
+1. **JUDGMENT hardening — DEFERRED** (Indy, Jun 04, 2026: *"I defer the ledger,
+   its complicated"*). v2 ships judgment as **attested + comprehension-probed**
+   (§11); the turn-scoped verdict ledger is a possible later hardening, not v2 scope.
+2. **`🔵` glyph — pending confirm** (default: accept `🔵 DECIDE`, leaving `🟡` as
+   "violations addressed"; alternative is re-glyphing `🟡` in
+   `HARNESS_VERIFY_OUTPUT.md`). Cosmetic/semantic only — a colored-circle swap.
+3. **Stage-2 sign-off — GRANTED** (Indy, Jun 04, 2026, §15): the Stage-2 atomic
+   switchover may edit `audit-*.sh` + `.githooks` per the Hard-Safety harness-patch
+   rule.
+4. **Code length cap = 350 — RECONCILED** (Indy, Jun 04, 2026): the file-length
+   gate card's `350` is canonical for all code (`.zig`/`.ts`/`.tsx`/`.js`/`.py`/
+   `.rs`/`.go`/`.sql`). `write_zig.sh`'s stray `300` corrected to `350`; the §3/§4/
+   §6.1 examples regenerated at `350`/`351`. Every dispatch's `dispatch_length_gate`
+   equals the gate's `350`, so the early-warning never diverges from enforcement.
+5. **`.md` doc/spec length caps — DEFERRED** (Indy, Jun 04, 2026): `.md` stays
+   exempt from the length gate (status quo). The long merged façades (`write_zig.md`
+   654L, `write_ts_adhere_bun.md` 486L) are therefore legal. Tiered doc/spec caps
+   (e.g. docs 350 / specs 400) are a possible post-Stage-2 task, not v2 scope.
+6. **UFS enforcement consolidated to `write_any`** (Indy, Jun 04, 2026): `UFS` is a
+   universal rule, so it is run-wired ONCE in `write_any.sh` (which fires for every
+   source file). The `dispatch_run_helper "UFS"` rows were removed from
+   `write_zig.sh` + `write_ts_adhere_bun.sh`; their verbatim UFS prose stays, tagged
+   `[DETERMINISTIC → UFS]` but annotated as enforced-by-`write_any`. This restores
+   §5's "none double-homed" (enforcement is single-homed) and kills the redundant
+   full-tree `audit-ufs` scan on multi-language touches. `dispatch-coverage.sh`
+   (§6.3) accepts a universal code wired in any one dispatch.
+7. **Eval harnesses relocated to top-level `evals/`** (Indy, Jun 05, 2026): the
+   deterministic dispatch fixtures + the cross-agent comprehension probes moved
+   `audits/{dispatch-evals,llmevals}/` → `evals/{dispatch-evals,llmevals}/` — a
+   first-class test home, sibling of `dispatch/`. The merge-coverage drops
+   ledger moved out of `dispatch/` (the Stage-2 sync payload, where a
+   dotfiles-internal migration artifact must not ship) into
+   `evals/dispatch/`. `audits/` retains the `audit-*.sh` family. All
+   functional + spec path refs repointed; `DISPATCH_REVIEW_DISPOSITION.md`'s
+   review quote of the old path is left as a historical record.
+8. **Merge-coverage is a Stage-2 deletion gate, not a Stage-0 `make audit` check**
+   (Orly, Jun 05, 2026, pick-and-proceed): `merge-coverage.sh` is built +
+   self-tested (the orphan fixture bites) but NOT wired into `make audit` — at
+   Stage 0 the 15 cards still exist, and "a card is not deleted until its
+   assertion is green" (§6.5). Against the real merge it shows 13/15 cards fully
+   covered; `zig`/`pub-surface`/`lifecycle` surface ~40 reworded-away prose tokens
+   (classified — no lost rules; the PUB/DEINIT rules are tagged in `write_zig.md`).
+   These need Indy drop-acks in `evals/dispatch/merge-coverage-drops.tsv`
+   before the cards are deleted; wiring into `make audit` follows the acks.
diff --git a/docs/DISPATCH_REVIEW_DISPOSITION.md b/docs/DISPATCH_REVIEW_DISPOSITION.md
new file mode 100644
index 0000000..7770612
--- /dev/null
+++ b/docs/DISPATCH_REVIEW_DISPOSITION.md
@@ -0,0 +1,66 @@
+# Dispatch Review — Finding Disposition
+
+Date: Jun 04, 2026
+Companion to `DISPATCH_ARCHITECTURE.md` (v2). Source: the 7-lens adversarial
+CTO review (38 confirmed, 22 refuted) + the v2 coverage check.
+
+Every **confirmed** finding, with its v2 disposition — so the 38 that survived
+cross-examination are tracked in the repo, not just in an ephemeral run log.
+
+- **resolved** — v2 has a concrete mechanism that closes it (section cited).
+- **partial** — v2 SPECIFIES the fix; implementation is pending (**Stage 0** /
+  §13 acceptance criteria). NOT a doc defect: the v1-era WIP code (`lib.sh`,
+  `write_zig.sh`) has not yet been reworked to the spec. The 17 partials ARE
+  the Stage-0 backlog.
+- **Refuted (22, excluded here):** raised criticisms the skeptic layer disproved
+  (bogus / already-handled / speculative). Not real problems — not tracked.
+
+Coverage: **21 resolved · 17 partial · 0 unresolved · 0 regressed** (of 38).
+Severity: P0 9R/10P · P1 10R/6P · P2 2R/1P.
+
+| # | Sev | Dimension | Finding | v2 status | v2 §refs |
+|---|---|---|---|---|---|
+| 1 | P0 | cross-repo | Dissolving docs/gates/ hard-fails the repo's own audit (gate-parity check) — the determinism | resolved | §0, §13, §8, §9 |
+| 2 | P0 | cross-repo | Dissolving gates breaks the LLM-judge eval golden-set the proposal claims to extend | partial | §13, §6.2, §8 |
+| 3 | P0 | cross-repo | dispatch/write_zig.sh delegates to leaf scripts that cannot run where the dispatch lives —  | partial | §0, §10, §10.3, §13, §6.3, §7 |
+| 4 | P0 | determinism-feasibility | `--staged` file discovery and leaf-check scope read two different git repos — CWD vs RESOLVE | partial | §0, §10, §10.4, §7 |
+| 5 | P0 | drift-coherence | Coherence audit proves symbol presence, not rule enforcement — the central anti-drift claim  | resolved | §0, §1, §12, §2, §3, §3.1, §4, §6.1, §6.3 |
+| 6 | P0 | drift-coherence | Missing leaf helper returns exit 0 with a ⚪ row — a deterministic check silently becomes a n | partial | §0, §10, §12, §14, §6.3 |
+| 7 | P0 | drift-coherence | Dissolving docs/gates/ and renaming ZIG_RULES.md/BUN_RULES.md detonates the in-repo invarian | resolved | §0, §11, §8, §9 |
+| 8 | P0 | ergonomics-robustness | Invariance audit's gate-parity check hard-fails the moment docs/gates/ is dissolved — the ve | resolved | §0, §13, §8, §9 |
+| 9 | P0 | ergonomics-robustness | DOTFILES_RESIDENT and seven referencing docs still point at docs/ZIG_RULES.md / BUN_RULES.md | partial | §6.5, §8 |
+| 10 | P0 | ergonomics-robustness | dispatch_run_helper returns 0 when the leaf script is absent — silent false-green in the rep | partial | §0, §10.2, §10.3, §12, §14, §6.1, §6.3 |
+| 11 | P0 | eval-loop | §6.2 "extend existing audits/llmevals/" is a category error — the existing harness is an ex | partial | §0, §13, §6.2, §6.3 |
+| 12 | P0 | eval-loop | Dissolving docs/gates/ deletes the context the existing llmevals harness embeds in every pro | resolved | §13, §14, §6.2, §8, §9 |
+| 13 | P0 | eval-loop | agents-md.sh is hard-bound to docs/gates/ in four checks; dissolving the directory mak | resolved | §13, §8, §9 |
+| 14 | P0 | gate-dissolution | Dissolving docs/gates/ hard-fails the no-override Invariance Suite Gate — the audit asserts  | partial | §0, §13, §5, §8, §9 |
+| 15 | P0 | gate-dissolution | Cross-cutting non-language gates have no coherent home in a per-language facade model — and  | resolved | §0, §5 |
+| 16 | P0 | gate-dissolution | "merge-then-delete, nothing unique dies" has no proving mechanism — the coherence audit chec | partial | §13, §14, §2, §6.5, §9 |
+| 17 | P0 | yellow-mechanism | Dissolving docs/gates/ detonates the deterministic invariance audit — every gate-parity, gat | resolved | §0, §13, §8, §9 |
+| 18 | P0 | yellow-mechanism | 🟡 JUDGMENT has zero machine backstop and the one prose backstop (HARNESS VERIFY) has no row  | partial | §0, §1, §11, §16 |
+| 19 | P0 | yellow-mechanism | DOTFILES_RESIDENT + cross-reference + cross-agent-eval all pin docs/ZIG_RULES.md & BUN_RULES | resolved | §8, §9 |
+| 20 | P1 | cross-repo | §11 cross-repo blast-radius enumeration is materially incomplete — it omits the audit/eval/s | resolved | §0, §10, §11, §13, §6.3, §8 |
+| 21 | P1 | cross-repo | The negative-test harness (test-audit) copies and asserts on specific gate bodies that the d | resolved | §13, §8, §9 |
+| 22 | P1 | cross-repo | audits/agents-md.md hardcodes docs/gates/ paths and a 'Scope (M70)' per-body requirement; d | partial | §6.5, §8 |
+| 23 | P1 | cross-repo | The dispatch absorbs the FILE cap but silently drops the function/method length sub-gate the | resolved | §0, §13, §5 |
+| 24 | P1 | determinism-feasibility | 🟡 'blocks the turn not the script' has no machine enforcement — the determinism anchor canno | partial | §0, §11, §3.1, §6.2 |
+| 25 | P1 | determinism-feasibility | Merge-then-delete of 20 gate cards into prose will silently drop machine-relevant trigger de | partial | §0, §13, §5, §6.3, §6.5, §9 |
+| 26 | P1 | drift-coherence | llmevals (latent-space eval) loses its rule context the moment gates dissolve — and the prop | resolved | §13, §14, §6.2, §8, §9 |
+| 27 | P1 | drift-coherence | 'Merge-then-delete, nothing unique dies' is an unverifiable promise — no mechanism diffs gat | resolved | §0, §12, §2, §6.5, §9 |
+| 28 | P1 | ergonomics-robustness | Hook path mismatch: proposal wires .git/hooks/pre-commit but the canonical, audited hook is  | resolved | §0, §13, §14, §7, §8 |
+| 29 | P1 | eval-loop | 🟡 YELLOW is redefined to mean the opposite of its established meaning in HARNESS_VERIFY_OUTP | resolved | §0, §11, §12, §13, §3.1, §4, §8 |
+| 30 | P1 | eval-loop | dispatch-coverage.sh asserts a scenario EXISTS, not that it is discriminating — one pa | partial | §3, §6.1, §6.3 |
+| 31 | P1 | gate-dissolution | llmevals harness cat's docs/gates/*.md into every model prompt under set -e — dissolving the | resolved | §13, §14, §6.2, §6.5, §8 |
+| 32 | P1 | gate-dissolution | DOTFILES_RESIDENT and EXECUTE_DOC_READS still hard-reference docs/ZIG_RULES.md and docs/BUN_ | resolved | §0, §11, §13, §8, §9 |
+| 33 | P1 | gate-dissolution | The 🟡-blocks-the-turn-not-the-script mechanism has no enforcer — it relies on agent self-rep | partial | §0, §11, §16, §3.1, §6.2 |
+| 34 | P1 | yellow-mechanism | The coherence audit (the proposal's keystone) does not exist and is under-specified to the p | resolved | §13, §3, §6.3 |
+| 35 | P1 | yellow-mechanism | Rule-extension protocol is now violated by the proposal's own structure and the gloss map re | partial | §13, §6.4, §8 |
+| 36 | P2 | cross-repo | Gloss map has a silent FLL/LENGTH duplication and the architecture-doc gloss table omits hal | resolved | §12, §13, §6.3, §6.4 |
+| 37 | P2 | ergonomics-robustness | pre-commit latency: 5 dispatch each shell out to git diff + multiple full-tree audits on ev | partial | §7 |
+| 38 | P2 | eval-loop | dispatch_run_helper calls ufs.sh --all on the WHOLE tree per edit, contradicting the " | resolved | §7 |
+
+**Refuted ≠ dropped.** The 22 refuted findings were independently disproven by
+a skeptic agent (try-to-refute pass); excluding them is the quality filter, not
+an oversight. As Stage 0 reworks the code + adds the eval/audit scripts, the
+partial rows flip to resolved.
+
diff --git a/docs/EXECUTE_DOC_READS.md b/docs/EXECUTE_DOC_READS.md
index 497df7d..5372cc3 100644
--- a/docs/EXECUTE_DOC_READS.md
+++ b/docs/EXECUTE_DOC_READS.md
@@ -1,20 +1,22 @@
 # EXECUTE — Doc reads by trigger
 
-> Parent: [`../AGENTS.md`](../AGENTS.md) §EXECUTE. DOC READ GATE (`docs/gates/doc-read.md`) enforces this table per edit; audit script: `scripts/audit-doc-reads.sh`.
+> Parent: [`../AGENTS.md`](../AGENTS.md) §EXECUTE. Each dispatch entry's trigger header reads its façade; this table is the canonical trigger→doc map, enforced per edit by the `📖 DOC READ: <path>` proof-line.
 
 Every triggered edit requires a `📖 DOC READ: <path>` proof-line citing §N applied, or the cited-skip variant when nothing in the doc applies. Skipping without a proof-line is a violation regardless of whether the edit happens to be clean.
 
 | Trigger | Read |
 |---|---|
 | Always (universal) | `docs/greptile-learnings/RULES.md`; re-read on sub-task shape change. |
+| Any source file (cross-cutting authoring) | `dispatch/write_any.md` — length, logging, milestone-id, error-registry, UFS, greptile read, legacy-workaround family. |
 | Spec's "Applicable Rules" | Each rule (canonical). Missing → standard set is floor; surface omission. |
-| `*.zig` | `docs/ZIG_RULES.md`. ZIG GATE per edit. |
-| `*.ts`/`*.tsx`/`*.js`/`*.jsx` | `docs/BUN_RULES.md` — TS FILE SHAPE DECISION (§1) at PLAN, const/import/Bun-primitive discipline, anti-patterns. |
+| `*.zig` | `dispatch/write_zig.md`. ZIG GATE per edit. |
+| `*.ts`/`*.tsx`/`*.js`/`*.jsx` | `dispatch/write_ts_adhere_bun.md` — TS FILE SHAPE DECISION (§1) at PLAN, const/import/Bun-primitive discipline, anti-patterns. |
 | Log emit (any language; see LOGGING GATE triggers) | `docs/LOGGING_STANDARD.md` — wire format (logfmt), severity ladder, error-code embedding, scope/event discipline, PII redaction, §10A tightenings. LOGGING GATE per edit. |
 | Lifecycle method in `*.zig` (`init|deinit|close|release|destroy|shutdown|dispose|free`) | `docs/LIFECYCLE_PATTERNS.md` — init/deinit pairing, errdefer placement, allocator ownership, defer/errdefer mutual exclusion, §10A tightenings. LIFECYCLE GATE per edit. |
 | `src/http/handlers/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (5-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
 | `ui/packages/**/*.{tsx,jsx,css}`, `app/**/*.{tsx,jsx,css}`, `components/**/*.{tsx,jsx,css}`, repo-root `globals.css`, or any file changing visual tokens / motion / typography | `DESIGN.md` (repo root) or `docs/DESIGN_SYSTEM.md` — whichever the repo carries. Design system source of truth: typography stack, color tokens, the single accent and its currency rule, motion signature, spacing/density, component principles, CLI palette mapping. DOC READ GATE per edit. |
-| `*.tsx` / `*.jsx` under `ui/packages/{app,website}/` | `docs/gates/design-token.md` — token-utility table (text/tracking/leading/max-w/min-w/spacing/motion/radius/color). DESIGN TOKEN GATE fires per edit; audit via project-side `scripts/audit-design-tokens.sh`. |
+| `*.tsx` / `*.jsx` under `ui/packages/{app,website}/` | `dispatch/write_ts_adhere_bun.md` (Design Tokens) — token-utility table (text/tracking/leading/max-w/min-w/spacing/motion/radius/color). DESIGN TOKEN GATE fires per edit; audit via project-side `audits/design-tokens.sh`. |
 | Auth-flow | `docs/AUTH.md`. |
-| Schema-touching | Re-print Schema Guard output. |
+| Changelog `<Update>` / release note (`changelog.mdx`) | `dispatch/write_changelog.md` → `docs/CHANGELOG_VOICE.md` — Mintlify voice; internal-only ⇒ no entry. |
+| `schema/*.sql` / migration | `dispatch/write_sql.md` + `docs/SCHEMA_CONVENTIONS.md` — naming/type conventions, schema/migration rules + Schema Table Removal Guard. Re-print Schema Guard output. |
 | Any spec under `docs/v*/{pending,active,done}/` or `docs/TEMPLATE.md` | `docs/TEMPLATE.md` "Prohibited" section — no time/effort estimates, no complexity ratings, no percentage-complete, no owners/dates. SPEC TEMPLATE GATE per edit. |
diff --git a/docs/LIFECYCLE_PATTERNS.md b/docs/LIFECYCLE_PATTERNS.md
index bf259e5..56fbd75 100644
--- a/docs/LIFECYCLE_PATTERNS.md
+++ b/docs/LIFECYCLE_PATTERNS.md
@@ -1,6 +1,6 @@
 # LIFECYCLE_PATTERNS — init/deinit/defer/errdefer convention for Zig
 
-The contract for memory ownership and cleanup in Zig structs. Sister doc to `ZIG_RULES.md` (which covers per-edit discipline) and `LOGGING_STANDARD.md` (which covers the cross-language wire format).
+The contract for memory ownership and cleanup in Zig structs. Sister doc to `dispatch/write_zig.md` (which covers per-edit discipline) and `LOGGING_STANDARD.md` (which covers the cross-language wire format).
 
 Pre-design rules, decisive defaults, and the anti-patterns each rule exists to prevent. Every rule has a one-line "why" so you can judge edge cases.
 
@@ -20,7 +20,7 @@ Out of scope:
 - Stack-only structs with no allocation (zero-cost values; no lifecycle).
 - Test-only mocks/stubs in `*_test.zig` that fake init/deinit for assertion purposes.
 
-The **LIFECYCLE GATE** (`docs/gates/lifecycle.md`) sits on top of this file and audits init/deinit pairing + errdefer placement on every Zig edit. It is **not** a substitute for the **PUB GATE** (`docs/gates/pub-surface.md`) — see §11 for the carve-out.
+The **LIFECYCLE GATE** (`dispatch/write_zig.md`, lifecycle) sits on top of this file and audits init/deinit pairing + errdefer placement on every Zig edit. It is **not** a substitute for the **PUB GATE** (`dispatch/write_zig.md`, pub-surface) — see §11 for the carve-out.
 
 ## §2 · Today's de-facto convention (survey-derived)
 
@@ -254,7 +254,7 @@ Anything else is a smell:
 
 The struct's `deinit` method is the single source of truth for cleanup. Call sites use `defer self.deinit()` (or `errdefer` if ownership might transfer mid-function) and never reach inside the struct.
 
-## §10 · Anti-patterns flagged by `audit-deinit-pairs.sh`
+## §10 · Anti-patterns flagged by `deinit-pairs.sh`
 
 | Pattern | Severity | Fix |
 |---|---|---|
@@ -281,9 +281,9 @@ Failure modes the audit script and reviewer must close. These are **not aspirati
 | LC7 | "Empty no-op `init` paired with empty no-op `deinit` to satisfy the gate" | Audit informational-flags when both `init` and `deinit` bodies are empty or single `_ = self;`. Pair exists for shape, not for state — likely should be a `const` value or removed. |
 | LC8 | "Auto-mode is on" | **Auto-mode does NOT cover gate skips.** Skip without explicit user-given override = automatic violation. |
 | LC9 | "Renamed-only file (no content change), gate doesn't fire" | Rename without content change does **not** fire LIFECYCLE GATE. Rename + content change does. Pure rename is a no-op for the gate. |
-| LC10 | "Two docs disagree (e.g. ZIG_RULES says X, LIFECYCLE_PATTERNS says Y)" | Precedence: gate body file > standards doc > spec. The gate body (`docs/gates/lifecycle.md`) is the canonical enforcement layer. |
+| LC10 | "Two docs disagree (e.g. write_zig.md says X, LIFECYCLE_PATTERNS says Y)" | Precedence: dispatch façade > standards doc > spec. The façade (`dispatch/write_zig.md`, lifecycle) is the canonical enforcement layer. |
 
-These are enforced by `audit-deinit-pairs.sh` (mechanical) and the gate body file (`docs/gates/lifecycle.md`, output discipline). When in conflict, the gate body file wins.
+These are enforced by `deinit-pairs.sh` (mechanical) and the dispatch façade (`dispatch/write_zig.md`, lifecycle — output discipline). When in conflict, the façade wins.
 
 ## §11 · Carve-out: PUB GATE vs LIFECYCLE GATE
 
@@ -291,8 +291,8 @@ Both gates touch the same `pub fn init` / `pub fn deinit` symbols, but ask diffe
 
 | Gate | Question |
 |---|---|
-| **PUB GATE** (`docs/gates/pub-surface.md`) | Should this symbol be `pub`? Does the file shape (file-as-struct vs functions-module) justify it? |
-| **LIFECYCLE GATE** (`docs/gates/lifecycle.md`) | If `init` exists, does `deinit`? Is `errdefer` placed correctly? Is allocator ownership clear? Is the call-site contract documented? |
+| **PUB GATE** (`dispatch/write_zig.md`, pub-surface) | Should this symbol be `pub`? Does the file shape (file-as-struct vs functions-module) justify it? |
+| **LIFECYCLE GATE** (`dispatch/write_zig.md`, lifecycle) | If `init` exists, does `deinit`? Is `errdefer` placed correctly? Is allocator ownership clear? Is the call-site contract documented? |
 
 When a `pub fn init` is added, **both gates may fire**. Print both blocks. Neither gate skips deferring to the other; the redundancy on this critical surface is a feature.
 
@@ -308,10 +308,9 @@ immediately preceding the edit. Generic "save for later" / "tactical decision" n
 
 ## §13 · Family
 
-- `ZIG_RULES.md` — Zig discipline umbrella. This doc is the lifecycle-specific layer below it.
+- `dispatch/write_zig.md` — Zig discipline umbrella (absorbs ZIG GATE + PUB + LIFECYCLE). This doc is the lifecycle-specific layer below it.
 - `LOGGING_STANDARD.md` §7 — orthogonal: how lifecycle hooks (init/deinit) emit observability records.
-- `docs/gates/zig.md` — ZIG GATE umbrella.
-- `docs/gates/pub-surface.md` — PUB GATE; carve-out in §11.
-- `docs/gates/file-length.md` — file ≤ 350, fn ≤ 50, method ≤ 70 (deinit/init don't escape these limits).
+- `dispatch/write_zig.md` (pub-surface) — PUB GATE; carve-out in §11.
+- `dispatch/write_any.md` (File & Function Length) — file ≤ 350, fn ≤ 50, method ≤ 70 (deinit/init don't escape these limits).
 - Universal rules (RULE UFS, RULE TGU, RULE ORP) live in `docs/greptile-learnings/RULES.md` and apply via the GREPTILE GATE.
 - This file is the **lifecycle convention** that those universal rules cannot express. Read it once at session start; re-read on sub-task shape change.
diff --git a/docs/LOGGING_STANDARD.md b/docs/LOGGING_STANDARD.md
index 205445b..340df68 100644
--- a/docs/LOGGING_STANDARD.md
+++ b/docs/LOGGING_STANDARD.md
@@ -15,10 +15,10 @@ Triggers on every `Edit`/`Write` that adds, removes, or changes a log emit:
 Out of scope (explicitly):
 
 - Test-only diagnostic prints inside `*_test.zig`, `*.test.ts`, `*.spec.ts`. Tests render to humans, not collectors; gates ignore.
-- Build/release scripts in `~/Projects/dotfiles/`, `scripts/release-*` — toolchain output, not application logs.
+- Build/release scripts in `~/Projects/dotfiles/`, `audits/release-*` — toolchain output, not application logs.
 - Generated framework noise (Next.js startup banners, Bun runtime warnings) — out of our control.
 
-The **LOGGING GATE** (`docs/gates/logging.md`) sits on top of this file — it fires in addition to the language-level rules in `ZIG_RULES.md` and `BUN_RULES.md`, not instead of them.
+The **LOGGING GATE** (`dispatch/write_any.md`, Logging Gate) sits on top of this file — it fires in addition to the language-level rules in `dispatch/write_zig.md` and `dispatch/write_ts_adhere_bun.md`, not instead of them.
 
 ## §2 · Today's de-facto standard (survey-derived)
 
@@ -158,7 +158,7 @@ The `comptime if ... return` makes the entire emit path disappear when the scope
 
 **Field encoding is allocation-free on the hot path** — the helper writes directly to a thread-local 4 KiB buffer and flushes on `\n`. Spillover to heap only on records exceeding 4 KiB, which is rare and warns at debug.
 
-**Anti-patterns flagged by `audit-logging.sh`:**
+**Anti-patterns flagged by `logging.sh`:**
 
 | Pattern | Why banned | Fix |
 |---|---|---|
@@ -190,9 +190,9 @@ Colors: red `error`, dim parens. Rendering inspired by Bun's `SystemError.format
 
 Schema mirrors Bun's `SystemError` extern struct (`bun:src/bun.js/bindings/SystemError.zig:1`) — `{ code, message, ...context, hint?, docs? }`. Our `code` is `UZ-XXX-NNN` (registry-defined) rather than errno; the *shape* is what we mirror.
 
-**Logging emit sites** in `zombiectl/src/**` use a thin Bun-runtime logger that produces logfmt records to `stderr`. `console.log` / `console.error` are forbidden in source per `BUN_RULES.md` §10 — `audit-logging.sh` enforces this for TS/JS.
+**Logging emit sites** in `zombiectl/src/**` use a thin Bun-runtime logger that produces logfmt records to `stderr`. `console.log` / `console.error` are forbidden in source per `dispatch/write_ts_adhere_bun.md` §10 — `logging.sh` enforces this for TS/JS.
 
-**Module-level error style** is governed by `BUN_RULES.md` §9 (one style per module — throw OR Result, never both). The error type itself is the same:
+**Module-level error style** is governed by `dispatch/write_ts_adhere_bun.md` §9 (one style per module — throw OR Result, never both). The error type itself is the same:
 
 ```ts
 class ZombieError extends Error {
@@ -242,9 +242,9 @@ Failure modes the audit script and reviewer must close. These are **not aspirati
 
 | # | Rationalization | Closure |
 |---|---|---|
-| L1 | "Temporary debug print, I'll remove later" | `audit-logging.sh` greps `std.debug.print` and `console.log` / `console.debug` / `console.info` in non-test source unconditionally. Found in commit → gate fails. No "temporary" carve-out. |
+| L1 | "Temporary debug print, I'll remove later" | `logging.sh` greps `std.debug.print` and `console.log` / `console.debug` / `console.info` in non-test source unconditionally. Found in commit → gate fails. No "temporary" carve-out. |
 | L2 | "`std.log.scoped` is fine, `obs.scoped` is just a wrapper" | `std.log.scoped` is **forbidden** in `src/**/*.zig` outside `src/observability/`. Only `obs.scoped` is callable. Audit flags every `std.log.` call site. |
-| L3 | "I added `error_code=UZ-NEW-001` — registry entry coming next commit" | The registry entry **must land in the same commit** as the first reference. `audit-error-codes.sh` runs against the staged diff; missing entry = blocking. |
+| L3 | "I added `error_code=UZ-NEW-001` — registry entry coming next commit" | The registry entry **must land in the same commit** as the first reference. `error-codes.sh` runs against the staged diff; missing entry = blocking. |
 | L4 | "This per-iteration event matters for debugging — `info`-level" | `info` allow-list is fixed: `server_started`, `server_stopped`, `request_received`, `request_completed`, `worker_pool_resized`, `migration_applied`, `batch_started`, `batch_completed`. Anything else at `info` → audit warning; reviewer must justify or downgrade to `debug`. |
 | L5 | "Operator needs the full stack trace in `msg=`" | `msg=` capped at 300 chars; total fields per record capped at 15. Stack traces emit as a separate `event=stack_trace` record at `debug` level, correlated by `correlation_id`, not stuffed into `msg`. |
 | L6 | "Embedded newlines because I copy-pasted output" | Audit greps for raw newline byte inside quoted logfmt values. Must be `\n` literal (two chars). |
@@ -252,7 +252,7 @@ Failure modes the audit script and reviewer must close. These are **not aspirati
 | L8 | "I read this doc at session start; subsequent edits don't need re-print" | Gate fires **per-edit**. The printed `🚧 LOGGING GATE` block is required before every triggered Edit/Write, not once per session. |
 | L9 | "Fix-pass touches every line; printing per-line is noise" | Fix-pass produces **one combined gate block per file**, not per-line. The block lists all violations addressed in that file. Still required, just consolidated. |
 
-These are enforced by `audit-logging.sh` (mechanical) and the gate body file (`docs/gates/logging.md`, output discipline). When in conflict, the gate body file wins — it is the enforcement layer.
+These are enforced by `logging.sh` (mechanical) and the dispatch façade (`dispatch/write_any.md`, Logging Gate — output discipline). When in conflict, the façade wins — it is the enforcement layer.
 
 ## §11 · Anti-patterns (named, banned)
 
@@ -260,7 +260,7 @@ These are enforced by `audit-logging.sh` (mechanical) and the gate body file (`d
 |---|---|
 | Free-form English log lines | Not greppable, not parseable, no event tag. |
 | `std.debug.print` outside tests | No level, no scope, no fields — dev debugging that escaped to main. |
-| `console.log` in `zombiectl` source | Bypasses logger, breaks `--json` mode, violates `BUN_RULES.md` §10. |
+| `console.log` in `zombiectl` source | Bypasses logger, breaks `--json` mode, violates `dispatch/write_ts_adhere_bun.md` §10. |
 | Logging on hot per-iteration paths at `info` | Floods collectors. Use `debug` (gated off by default). |
 | `error_code=` missing on `err`/`warn` mapping to registry codes | Breaks traceability; future operator can't link log to docs. |
 | Logging credentials, tokens, or BYOK keys | Severe leak surface. Redaction harness mandatory. |
@@ -280,11 +280,11 @@ immediately preceding the edit. Generic "scope creep" is not a valid reason —
 
 ## §13 · Family
 
-- `BUN_RULES.md` §10 — banned `console.log` in TS/JS source. Cross-referenced by `audit-logging.sh`.
-- `BUN_RULES.md` §9 — module-level error style (throw vs Result) for `zombiectl`.
-- `ZIG_RULES.md` — Zig discipline umbrella; this doc's §7 is the logging-specific layer.
+- `dispatch/write_ts_adhere_bun.md` §10 — banned `console.log` in TS/JS source. Cross-referenced by `logging.sh`.
+- `dispatch/write_ts_adhere_bun.md` §9 — module-level error style (throw vs Result) for `zombiectl`.
+- `dispatch/write_zig.md` — Zig discipline umbrella; this doc's §7 is the logging-specific layer.
 - `LIFECYCLE_PATTERNS.md` — orthogonal: ownership/cleanup of structs, including allocator wiring for the thread-local log buffer.
 - M42_002 redaction harness (`src/executor/runner_progress.zig`) — secret-redaction precondition; this doc's §6 inherits.
 - Universal rules (RULE UFS, RULE TGU, RULE PRI, RULE FLL, RULE ORP, RULE TST-NAM) live in `docs/greptile-learnings/RULES.md`.
-- Length caps in `docs/gates/file-length.md`.
+- Length caps in `dispatch/write_any.md` (File & Function Length).
 - This file is the **wire-format and discipline contract** that those universal rules cannot express. Read it once at session start; re-read on sub-task shape change.
diff --git a/docs/REST_API_DESIGN_GUIDELINES.md b/docs/REST_API_DESIGN_GUIDELINES.md
index dc9fb09..37b92f7 100644
--- a/docs/REST_API_DESIGN_GUIDELINES.md
+++ b/docs/REST_API_DESIGN_GUIDELINES.md
@@ -414,7 +414,7 @@ public/openapi/
 3. Run `make openapi` — bundles YAML → JSON, runs Redocly lint, runs `check_openapi_errors.py`, runs `check_openapi_url_shape.py` (REST §1).
 4. Commit YAML + bundled JSON + `router.zig` together. Splitting these across commits leaves CI red.
 
-**Router ↔ openapi.json parity is reviewer-enforced.** There is no mechanical gate cross-checking that every `router.match()` arm has a documented openapi path or vice versa. When you add, rename, or remove a route, both surfaces must move in the same diff and the reviewer must verify it. The previous Python parity gate (`scripts/check_openapi_sync.py`) and its data file (`src/http/route_manifest.zig`) were retired in M61_002.
+**Router ↔ openapi.json parity is reviewer-enforced.** There is no mechanical gate cross-checking that every `router.match()` arm has a documented openapi path or vice versa. When you add, rename, or remove a route, both surfaces must move in the same diff and the reviewer must verify it. The previous Python parity gate (`audits/check_openapi_sync.py`) and its data file (`src/http/route_manifest.zig`) were retired in M61_002.
 
 **Agent-edit recipe:** see `public/openapi/AGENTS.md` for copy-paste-ready rename / append / remove / update-description workflows.
 
diff --git a/docs/TEMPLATE.md b/docs/TEMPLATE.md
index 527e6b2..5e88de2 100644
--- a/docs/TEMPLATE.md
+++ b/docs/TEMPLATE.md
@@ -64,7 +64,7 @@ A milestone is not complete until evidence is captured: commands, logs, screensh
 - `PENDING` — not started. `IN_PROGRESS` — being worked. `DONE` / ✅ — complete, verified, tested.
 - `DEFERRED` — designed/attempted and explicitly not shipped; lives in `done/` as a record. The **Discovery** section MUST capture the rationale and the reactivation conditions.
 
-## Prohibited (gate-enforced — `docs/gates/spec-template.md`)
+## Prohibited (gate-enforced — `dispatch/write_spec.md`)
 
 - No time/effort estimates ("5 min", "1 hour", "2 days"). No effort columns or complexity ratings. No percentage-complete. No assigned owners. No implementation dates.
 - Sizing signal is **Priority** (P0/P1/P2/P3); sequencing is **Dependencies**.
@@ -85,7 +85,7 @@ SPEC AUTHORING RULES (load-bearing — do not delete):
   percentage-complete, implementation dates, assigned owners.
 - Priority (P0/P1/P2/P3) is the only sizing signal; Dependencies are the only sequencing signal.
 - If a section below contradicts these rules, the rule wins — delete the section.
-- Enforced by SPEC TEMPLATE GATE (docs/gates/spec-template.md) and scripts/audit-spec-template.sh,
+- Enforced by SPEC TEMPLATE GATE (dispatch/write_spec.md) and audits/spec-template.sh,
   which also assert the determinism-critical sections below are present and filled (not left as {placeholders}).
 -->
 
@@ -136,10 +136,10 @@ Greenfield (no existing pattern)? Say so explicitly and point at the `docs/archi
 > The rule files the agent re-reads BEFORE EXECUTE and re-checks during VERIFY. Without this list the agent has no anchored prompt to consult them at the right moment. Add specific rule IDs where scope is narrow — naming the exact greptile rule IDs the diff trips is what makes the resulting PR review-clean by construction.
 
 - **`docs/greptile-learnings/RULES.md`** — universal repo discipline (always applies).
-- **`docs/ZIG_RULES.md`** — when the diff touches `*.zig` (name sections: pg-drain lifecycle, tagged-union results, multi-step `errdefer`, cross-compile).
+- **`dispatch/write_zig.md`** — when the diff touches `*.zig` (name sections: pg-drain lifecycle, tagged-union results, multi-step `errdefer`, cross-compile).
 - **`docs/REST_API_DESIGN_GUIDELINES.md`** — when the diff touches `src/http/handlers/**` or `public/openapi/**` (name §: URL design, route registration, handler signature).
 - **`docs/SCHEMA_CONVENTIONS.md`** — when the diff touches `schema/*.sql` or `schema/embed.zig`.
-- **`docs/BUN_RULES.md`** / **`docs/LOGGING_STANDARD.md`** / **`docs/LIFECYCLE_PATTERNS.md`** — when the relevant surface is touched.
+- **`dispatch/write_ts_adhere_bun.md`** / **`docs/LOGGING_STANDARD.md`** / **`docs/LIFECYCLE_PATTERNS.md`** — when the relevant surface is touched.
 
 Fully greenfield with no project rules → write "Standard set only — `docs/greptile-learnings/RULES.md`; no other rule files apply."
 
@@ -147,11 +147,11 @@ Fully greenfield with no project rules → write "Standard set only — `docs/gr
 
 ## Applicable Gates
 
-> Which Action-Triggered Guards (`AGENTS.md` gate index) this PR WILL trip, and how each stays clean. Pre-declaring them means the agent plans for them — it doesn't rediscover them mid-EXECUTE and stall. Rules ≠ Gates: rules are knowledge to read; gates are guards that fire on edits.
+> Which Action-Triggered Guards (`AGENTS.md` dispatch index) this PR WILL trip, and how each stays clean. Pre-declaring them means the agent plans for them — it doesn't rediscover them mid-EXECUTE and stall. Rules ≠ Gates: rules are knowledge to read; gates are guards that fire on edits.
 
 | Gate | Fires? | Satisfaction strategy |
 |------|--------|-----------------------|
-| ZIG GATE | yes/no — {why} | {e.g. cross-compile both linux targets; read ZIG_RULES} |
+| ZIG GATE | yes/no — {why} | {e.g. cross-compile both linux targets; read dispatch/write_zig.md} |
 | PUB / Struct-Shape | yes/no | {shape verdict per new pub surface} |
 | File & Function Length (≤350/≤50/≤70) | yes/no | {split plan if a file approaches the cap} |
 | UFS (repeated/semantic literals) | yes/no | {named constants; cross-runtime identifier shared verbatim} |
@@ -176,7 +176,7 @@ Touch nothing a gate watches → "N/A — docs/markdown only."
 
 > **SOUL.md rule: before proposing architecture, find the reference codebase — there almost always is one.** Name it so the agent mirrors a known-good pattern instead of inventing. State the alignment, or justify the divergence.
 
-- **CLI** → `docs/CLI_DX_PILLARS.md` (the "7 Pillars" ADR, vendored from the supabase-style `oss/cli`) — the pillars: command → handler → errors split; **handler purity** (no `console.log` / `process.exit` in handlers); **output as a service** (human vs JSON vs env rendering chosen by the renderer, not the handler); **structured JSON errors** with `suggestion`/`retry` fields; **3-tier test pyramid** (handler unit / in-process integration / subprocess e2e); **auto-JSON when stdout is piped** (LLM-native). State per CLI spec: which pillars this aligns with, and the reason for any divergence.
+- **CLI** → the **"7 Pillars"** of CLI developer experience (vendored from the supabase-style `oss/cli`): command → handler → errors split; **handler purity** (no `console.log` / `process.exit` in handlers); **output as a service** (human vs JSON vs env rendering chosen by the renderer, not the handler); **structured JSON errors** with `suggestion`/`retry` fields; **3-tier test pyramid** (handler unit / in-process integration / subprocess e2e); **auto-JSON when stdout is piped** (LLM-native). State per CLI spec: which pillars this aligns with, and the reason for any divergence.
 - **API** → `docs/REST_API_DESIGN_GUIDELINES.md` + the closest existing handler under `src/http/handlers/`.
 - **Schema** → the nearest existing migration + `docs/SCHEMA_CONVENTIONS.md`.
 - **UI** → design-system primitives + `theme.css` tokens.
@@ -353,7 +353,7 @@ No deletions → "N/A — no files deleted."
 | When | Skill | What it does | Required output |
 |------|-------|--------------|-----------------|
 | After implementation, before CHORE(close) | `/write-unit-test` | Audits diff coverage vs this Test Specification. Catches happy-path-only, missing negatives, fixture drift. | Clean. Iteration count + final coverage in Discovery. |
-| After tests pass, before CHORE(close) | `/review` | Adversarial diff review vs this spec, `docs/architecture/`, REST guide (HTTP), `docs/ZIG_RULES.md` (Zig), Failure Modes, Invariants. | Clean OR every finding dispositioned (fixed / deferred-with-quote / rejected-with-reason). |
+| After tests pass, before CHORE(close) | `/review` | Adversarial diff review vs this spec, `docs/architecture/`, REST guide (HTTP), `dispatch/write_zig.md` (Zig), Failure Modes, Invariants. | Clean OR every finding dispositioned (fixed / deferred-with-quote / rejected-with-reason). |
 | After `gh pr create` | `/review-pr` | Review-comments the open PR against the immutable diff (squash artifacts, post-rebase races, codegen drift). | Comments addressed (fixup/amend) before human review/merge. |
 
 Skipping any one violates CHORE(close). Skill unavailable (MCP down) → document the skip in Discovery AND the PR description with a timestamp and a "rerun before merge" note.
diff --git a/docs/VERIFY_TIERS.md b/docs/VERIFY_TIERS.md
index d714bd6..ee01595 100644
--- a/docs/VERIFY_TIERS.md
+++ b/docs/VERIFY_TIERS.md
@@ -1,6 +1,6 @@
 # VERIFY — Tiers, performance, hygiene
 
-> Parent: [`../AGENTS.md`](../AGENTS.md) §VERIFY. Verification Gate (`docs/gates/verification.md`) enforces; `make` targets are canonical.
+> Parent: [`../AGENTS.md`](../AGENTS.md) §VERIFY. Verification Gate (`dispatch/verify.md`) enforces; `make` targets are canonical.
 
 **FIRST: `/write-unit-test`** — audits diff coverage vs spec's Test Specification (or changed surface when no spec). Iterate until clean. Skipping = CHORE(close) violation.
 
diff --git a/docs/ZIG_STATIC_OPENSSL.md b/docs/ZIG_STATIC_OPENSSL.md
deleted file mode 100644
index ea6c9e1..0000000
--- a/docs/ZIG_STATIC_OPENSSL.md
+++ /dev/null
@@ -1,172 +0,0 @@
-# Zig + Static OpenSSL on Linux: The Error That Isn't About What You Think
-
-> Originally written as an internal reference. Reformatted for sharing.
-
----
-
-You build your Zig service. You deploy it. You get this:
-
-```
-bash: ./zombied: No such file or directory
-```
-
-The binary is there. `ls -la` confirms it. You double-check the path. Still "No such file or directory."
-
-This is one of those errors where the shell is technically right and completely misleading at the same time.
-
----
-
-## What's Actually Happening
-
-The kernel's `execve` syscall reads the `INTERP` program header from the ELF binary before executing it. That header names the dynamic linker — something like `/lib/ld-musl-x86_64.so.1`. The kernel needs to exec that linker first to load your binary.
-
-If the interpreter path doesn't exist: `ENOENT`. The shell reports it as "No such file or directory" — but it's talking about the *interpreter*, not your binary.
-
-```bash
-# Diagnose it:
-readelf -l ./zombied | grep INTERP
-# [Requesting program interpreter: /lib/ld-musl-x86_64.so.1]
-```
-
-You built a binary with musl's dynamic linker embedded. Deployed it to a glibc host (Fly.io bookworm, Debian bare-metal). `/lib/ld-musl-x86_64.so.1` doesn't exist there. `ENOENT`.
-
----
-
-## How You Got Here: The Root Cause Chain
-
-1. **Zig target `x86_64-linux` defaults to the musl ABI.**
-2. `pg.zig` calls `linkSystemLibrary("ssl")` when OpenSSL is enabled.
-3. On Debian bookworm, `libssl-dev` installs *shared* `.so` files (glibc-compiled) under `/usr/lib/x86_64-linux-gnu/`.
-4. Zig's linker prefers `.so` over `.a` — so your binary gets musl's `INTERP` header but links glibc's `libssl.so.3` dynamically.
-5. Broken on glibc hosts: musl interpreter missing. Broken on Alpine/musl hosts: glibc `libssl.so.3` missing.
-
-The binary works on exactly zero deployment targets.
-
----
-
-## Two Approaches That Don't Work
-
-**Remove the `.so` symlinks on Debian.** This forces the linker to use `.a` — but Debian's static archives are glibc-compiled. When linked into a musl-target binary you get:
-
-```
-undefined reference to `__fprintf_chk'
-undefined reference to `getcontext'
-```
-
-glibc-internal symbols. musl doesn't have them.
-
-**Switch to `x86_64-linux-gnu`.** Now you're targeting glibc explicitly. But `libcrypto.so` references `dlopen`, `pthread_*`, `fstat` — symbols that aren't available in a static glibc context. Zig's linker rejects it.
-
----
-
-## The Fix: Build Inside Alpine
-
-Alpine uses musl as its native libc. Its `openssl-libs-static` package ships `.a` archives compiled against musl. No ABI mismatch. No glibc symbols.
-
-```dockerfile
-FROM mirror.gcr.io/library/alpine:3.21
-
-RUN apk add --no-cache \
-    git openssl-dev openssl-libs-static \
-    ca-certificates xz binutils
-
-# Alpine stores libs flat under /usr/lib/ — symlink to the path build.zig expects.
-ARG ARCH=x86_64
-RUN mkdir -p /usr/lib/${ARCH}-linux-gnu /usr/include/${ARCH}-linux-gnu && \
-    ln -sf /usr/lib/libssl.a     /usr/lib/${ARCH}-linux-gnu/libssl.a && \
-    ln -sf /usr/lib/libcrypto.a  /usr/lib/${ARCH}-linux-gnu/libcrypto.a && \
-    ln -sf /usr/include/openssl  /usr/include/${ARCH}-linux-gnu/openssl
-```
-
-```bash
-zig build -Doptimize=ReleaseSafe -Dtarget=x86_64-linux
-```
-
-The output: zero `NEEDED` entries, no `INTERP` section. Runs on any Linux, any libc.
-
----
-
-## Verify Before You Ship
-
-Two checks. Both must pass before a binary ships:
-
-```bash
-# 1. Structural check (fast, no Docker needed)
-readelf -d ./zombied | grep NEEDED      # must be empty
-readelf -l ./zombied | grep INTERP      # must be empty
-
-# 2. Runtime check (catches edge cases the structural check misses)
-docker run --rm -v $(pwd)/dist:/test:ro debian:bookworm-slim \
-  ldd /test/zombied
-# → "not a dynamic executable"
-
-docker run --rm -v $(pwd)/dist:/test:ro debian:trixie-slim \
-  ldd /test/zombied
-# → "not a dynamic executable"
-
-docker run --rm -v $(pwd)/dist:/test:ro mirror.gcr.io/library/alpine:3.21 \
-  ldd /test/zombied
-# → "Not a valid dynamic program"
-```
-
-We run this in CI as `verify-runtime-compat` on every push and every release. If it doesn't pass locally in a Docker container, it won't pass in prod.
-
----
-
-## For GitHub Actions (ARM too)
-
-aarch64 runners can't run JS actions inside Alpine containers. Use the bare ARM runner and invoke Alpine via `docker run`:
-
-```yaml
-jobs:
-  build-linux:
-    strategy:
-      matrix:
-        include:
-          - { target: x86_64-linux,  os: ubuntu-latest,    arch: x86_64  }
-          - { target: aarch64-linux, os: ubuntu-24.04-arm, arch: aarch64 }
-    runs-on: ${{ matrix.os }}
-    container:
-      # Only works on x86_64; aarch64 uses the bare runner + docker run below
-      image: ${{ matrix.arch == 'x86_64' && 'mirror.gcr.io/library/alpine:3.21' || '' }}
-```
-
-For aarch64 specifically:
-
-```yaml
-- name: Build aarch64-linux inside Alpine
-  run: |
-    docker run --rm --platform linux/arm64 \
-      -v "$GITHUB_WORKSPACE:/src:ro" \
-      -v "$GITHUB_WORKSPACE/zig-out:/zig-out" \
-      mirror.gcr.io/library/alpine:3.21 \
-      sh -c 'apk add --no-cache openssl-dev openssl-libs-static ca-certificates xz wget binutils && ...'
-```
-
----
-
-## The Short Version (Twitter/X thread)
-
-**Thread: The "No such file or directory" error that is not about your binary**
-
-1/ You deploy a Zig binary. `bash: ./zombied: No such file or directory`. The file exists. ls confirms it. What's happening?
-
-2/ `execve` reads the ELF `INTERP` header before running your binary. That header names the dynamic linker. If the linker path doesn't exist on the target host: `ENOENT`. Shell blames your binary. Kernel blames the interpreter.
-
-3/ Root cause: Zig's `x86_64-linux` target defaults to musl ABI. But `libssl-dev` on Debian ships glibc `.so` files. Zig's linker picks `.so` over `.a`. Your binary gets musl's INTERP but links glibc's libssl. Broken everywhere.
-
-4/ The fix: build inside Alpine. Alpine's `openssl-libs-static` ships musl-native `.a` archives. No ABI mismatch. The output binary has zero NEEDED entries, no INTERP section. Runs on any Linux.
-
-5/ Two symlinks needed: Alpine stores libs under `/usr/lib/` flat. Zig's build script looks under `/usr/lib/x86_64-linux-gnu/`. Symlink them. That's it.
-
-6/ Always run `readelf -d ./binary | grep NEEDED` + `readelf -l ./binary | grep INTERP` before shipping. Both must be empty. If they're not, the binary is dynamic and will fail somewhere.
-
----
-
-## Local Verification
-
-```bash
-make build-linux-alpine
-```
-
-Runs the Alpine build inside Docker and asserts `readelf` passes before reporting success. Same as CI.
diff --git a/docs/gates/architecture.md b/docs/gates/architecture.md
deleted file mode 100644
index 87f02d2..0000000
--- a/docs/gates/architecture.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# 🚧 Architecture Consult & Update Gate
-
-**Family:** Architecture grounding. **Source:** `AGENTS.md` (project-side guard); canonical body of architectural decisions lives at `docs/architecture/` (the directory; topic files linked from `docs/architecture/README.md`).
-
-**Triggers** — grep/read the relevant `docs/architecture/` topic file before:
-
-- Naming a stream / pub-sub channel / Redis key namespace / consumer group / queue / RPC method / Postgres schema / table.
-- Asserting cardinality ("one row per X", "exactly one consumer per stream", "fleet-wide vs per-tenant").
-- Describing a flow ("on crash → X reclaims via Y", "trigger source A lands on stream B with actor C").
-- Answering a user question about how data flows between components.
-- Proposing a change to any of the above as part of a spec or implementation.
-- A new architecture-adjacent question that arises mid-task — re-consult per topic, not once per task.
-
-**Override:** none — doc wins until reconciled.
-
-## Why
-
-`docs/architecture/` (the directory; topic files linked from `docs/architecture/README.md`) is canonical for stream/channel/queue names, table cardinality, ownership, and end-to-end flows. The failure mode is reinventing terms or asserting flow shapes from training data instead of grounding in the doc. Specs are *instances*; this doc is the *constant* — when they disagree, the doc wins until reconciled.
-
-## Behavior
-
-- **Doc answers** → proceed (no citation block).
-- **Doc silent** → proceed with extra care; land doc decision in same commit.
-- **Doc conflicts** → surface with a one-line citation (`grounded in §X.Y, proposal extends/conflicts because <reason>`) and wait.
-- **Greenfield** → land initial doc + code in same commit.
-
-## Landing rule (non-negotiable)
-
-An architecture decision lands its `docs/architecture/` edit either:
-
-- **(a)** immediate doc-only commit on the active branch (preferred), OR
-- **(b)** same commit as the implementation.
-
-**Never** (c) follow-up commit AFTER the code.
-
-**Chat brainstorming counts as "describing a flow."** A multi-turn chat designing a new pattern (naming a channel, asserting cardinality, tracing a flow, defining an invariant) HAS fired the gate even if no code touched yet. Acceptable resolutions: (a) doc-only commit BEFORE the next agent action, or (b) Indy-acked deferral quote (per CHORE(close) deferral discipline) routing the capture into same-commit-with-code. The failure mode this clause names explicitly: encoding the brainstorm as a "punchlist task to land after the code ships" — that's exactly (c) and is forbidden. Pickup agents reading a task whose description says "capture architecture in docs/architecture/ AFTER <slice> lands" must rewrite it to same-commit OR doc-only-now before continuing.
-
-## Required output (only when doc conflicts or is silent)
-
-```
-ARCH: grounded in <topic-file>:<§X.Y> | proposal: <one-line> | status: <extends|conflicts|silent> | landing: <a|b>
-```
-
-When the doc directly answers, no output is required.
-
-## CHORE(close) check
-
-Every M-spec branch that touched flow-defining code produces a non-empty `git diff origin/main..HEAD -- docs/architecture/`. Else PR Session Notes documents why nothing architectural changed.
diff --git a/docs/gates/design-token.md b/docs/gates/design-token.md
deleted file mode 100644
index 7d8c5cf..0000000
--- a/docs/gates/design-token.md
+++ /dev/null
@@ -1,120 +0,0 @@
-# 🚧 DESIGN TOKEN GATE
-
-**Family:** Frontend design-system discipline (paired with the UI Component Substitution Gate). **Source:** `AGENTS.md` (project-side guard). Authoritative token surface: `ui/packages/design-system/src/theme.css` (Layer-2 `@theme inline`).
-
-**Triggers** — every `Edit`/`Write` to `*.tsx` / `*.jsx` under `ui/packages/app/` **or** `ui/packages/website/`. Tests (`*.test.tsx`) and Playwright specs (`tests/e2e/**`) are exempt — they assert on rendered DOM and frequently use raw selectors.
-
-**Override:** `// DESIGN TOKEN: SKIPPED per user override (reason: ...)` immediately preceding the affected line. Reasons must cite a concrete constraint — "bespoke per-surface grid template", "tight UI chrome width with no equivalent token", "external library prop expects px-string" — not "looks the same" / "shorter to write". Auto-mode does NOT cover the override.
-
-## What this gate enforces
-
-The design-system package exposes named Tailwind utilities for every typographic and layout primitive (`text-display-xl`, `text-eyebrow`, `leading-prose`, `max-w-narrow`, `tracking-display-md`, `duration-snap`, etc.). Raw arbitrary values bypass the published scale. Over time that drift dilutes the system; the moment one surface ships `text-[14px] leading-[1.6]`, others copy the pattern.
-
-This gate blocks arbitrary classes **when an equivalent token utility exists**. It does NOT block:
-
-- Tailwind state selectors (`data-[active=true]:bg-accent`)
-- Pseudo-element `content-[...]`
-- Bespoke `grid-cols-[...]` / `grid-rows-[...]` (per-surface templates)
-- `calc(...)` expressions that consume a token (`h-[calc(100vh-var(--header-height))]`)
-- Token-using shadows (`shadow-[0_0_0_3px_var(--pulse-glow)]`)
-
-## Pre-edit check
-
-1. Read (or recall) `ui/packages/design-system/src/theme.css` — the Layer-2 `@theme inline { ... }` block is the authoritative utility surface.
-
-2. The available token utilities are exactly the bridged names:
-
-   | Family | Utilities |
-   |---|---|
-   | Text size | `text-{label,eyebrow,body-sm,body,body-lg,heading,display-md,display-lg,display-xl}` |
-   | Fluid text | `text-fluid-{display-md,display-lg,hero}` |
-   | Tracking | `tracking-{display-xl,display-lg,display-md,eyebrow,label}` |
-   | Line-height | `leading-{display-xl,display-lg,display-md,heading,eyebrow,body-lg,body,body-sm,label,mono,prose}` |
-   | Max width | `max-w-{trim,narrow,measure,form,wide,content,tagline,prose}` |
-   | Min width | `min-w-{trim,narrow,measure,form,wide,content,tagline,prose}` |
-   | Spacing | `{p,m,gap,space-{x,y}}-{xs,sm,md,lg,xl,2xl,3xl,4xl,5xl,6xl}` |
-   | Motion | `duration-snap`, `ease-snap` |
-   | Radius | `rounded-{sm,md,lg}` |
-   | Color | semantic tokens only — `bg-{background,card,popover,primary,secondary,muted,accent,destructive,…}`, `text-{foreground,muted-foreground,text,text-muted,text-subtle,…}`, `border-{border,border-strong,input,ring}`, status tokens `text-{success,warn,error,info,evidence}` / `text-on-pulse` |
-
-3. For every arbitrary `*-[...]` class your edit adds, ask: **does a token utility exist?**
-   - If yes, use it.
-   - If no, the arbitrary is allowed without an override comment.
-   - If close but not exact, prefer the token. The system absorbs ±1–2 px differences; over hundreds of callsites the consistency dominates the per-callsite shift.
-
-## Required output (default — one line)
-
-```
-DESIGN TOKEN GATE: <file> | arbitraries-kept: <list with one-word reason each | none>
-```
-
-Multi-line block fires only when `arbitraries-kept` is non-empty:
-
-```
-DESIGN TOKEN GATE: <file>
-  Arbitraries kept:
-    - <class>: <reason>  (e.g. "grid-cols-[2fr_1fr_1fr_1fr]: bespoke footer grid")
-    - <class>: <reason>
-    ...
-```
-
-## Scope (M70)
-
-`audit-design-tokens.sh` walks the **full ui/packages working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. The previous `--diff` (`BASE...HEAD`) default was retired with M70 — at pre-commit time `HEAD` is the prior commit, leaving the gate blind to the index.
-
-`--all` is accepted as a back-compat alias for the default. `--staged` is preserved as an opt-in narrowing mode for iterative dev loops. `--diff` is rejected with exit 2 + a pointer to this section.
-
-## Self-audit (end-of-turn)
-
-```bash
-scripts/audit-design-tokens.sh           # full-codebase scan (default)
-scripts/audit-design-tokens.sh --staged  # opt-in narrowing for iterative dev
-```
-
-The script lives in the project repo at `scripts/audit-design-tokens.sh` (symlinked from `~/Projects/dotfiles/scripts/`). It prints `file:line` + suggested token utility for every blocking violation and exits 1 on any.
-
-A clean run is required before HARNESS VERIFY can advance.
-
-The project repo is also expected to wire the audit into `make/quality.mk` `_website_lint` and `_app_lint` targets so `make lint` catches regressions:
-
-```make
-_website_lint:
-	@echo "→ [website] Running Oxlint + TypeScript check..."
-	@cd ui/packages/website && bun run lint
-	@cd ui/packages/website && bun run typecheck
-	@echo "→ [website] Running design-token audit..."
-	@scripts/audit-design-tokens.sh
-	@echo "✓ [website] Lint passed"
-```
-
-## Family rules
-
-This gate composes with the UI Component Substitution Gate. Order of operations on a fresh `.tsx` edit:
-
-1. **UI GATE** — pick the primitive (`<Card>`, `<Section>`, `<Button>`, `<DisplayXL>`, …)
-2. **DESIGN TOKEN GATE** — pick the token utility (`text-body`, `leading-body`, `max-w-narrow`)
-3. **UFS GATE** — pick a named const for any repeated string literal
-4. **LENGTH GATE** — keep the file ≤350 lines
-
-A `.tsx` that passes all four reads as system-conformant without spelunking into the design-system source.
-
-## Why a gate, not a lint rule
-
-Three reasons:
-
-1. **Cross-package coupling.** The token set lives in `ui/packages/design-system`; the consumers live in `ui/packages/{app,website}`. A single oxlint config can't see across the boundary cleanly. The audit script reads the diff and the theme.css utilities — it's the right shape.
-
-2. **Inline override.** Some `-[...]` classes are intentional and irreplaceable (bespoke grids, `calc(...)`, status-dot sizes). The comment-based override fits the existing gate idiom and gives reviewers a paper trail of *why* each arbitrary stayed.
-
-3. **HARNESS VERIFY integration.** Gates are the canonical end-of-turn audit point. Lint rules surface in editor noise but miss the agentic lifecycle. The gate's pre-edit one-liner + end-of-turn self-audit puts the discipline in the model's hot path.
-
-## When tokens are missing
-
-If the arbitrary you want is a legitimate design value that simply has no token yet, **extend the design system in the same commit**:
-
-1. Add `--<family>-<name>` to `ui/packages/design-system/src/tokens.css`
-2. Forward to Tailwind via `@theme inline` in `ui/packages/design-system/src/theme.css`
-3. Migrate your callsite to the new utility
-4. Add the utility to the table above in this gate body (same dotfiles commit — Invariance Suite Gate applies)
-
-This is the path to a system that grows without dilution.
diff --git a/docs/gates/doc-read.md b/docs/gates/doc-read.md
deleted file mode 100644
index 4d6be56..0000000
--- a/docs/gates/doc-read.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# 🚧 DOC READ GATE
-
-**Family:** Discipline meta-gate. **Source:** `AGENTS.md` EXECUTE doc-reads table.
-
-**Triggers** — every `Edit`/`Write` whose file pattern matches a row in the EXECUTE doc-reads table. Currently:
-
-| File pattern | Doc to read |
-|---|---|
-| `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/` | `docs/ZIG_RULES.md` |
-| `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/` | `docs/BUN_RULES.md` |
-| Log emit (any language, see `LOGGING GATE` triggers) | `docs/LOGGING_STANDARD.md` |
-| Lifecycle method (init/deinit/close/release/etc. in `*.zig`) | `docs/LIFECYCLE_PATTERNS.md` |
-| `src/http/handlers/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` |
-| Auth-flow files | `docs/AUTH.md` |
-| Schema-touching files | (re-print Schema Guard output) |
-| Any spec under `docs/v*/{pending,active,done}/` | `docs/TEMPLATE.md` |
-| Always (universal) | `docs/greptile-learnings/RULES.md` |
-
-**Override:** `DOC READ: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override. Reason must cite a concrete external constraint (emergency hotfix with doc consulted out-of-band, vendored code immune to internal rules).
-
-## What this gate covers
-
-Promotes the EXECUTE doc-reads table from advisory to enforced. Without this gate, doc-reads silently became "I'll skim if I have token budget" — gates with required printed output (ZIG GATE, LENGTH GATE, etc.) had real enforcement; doc-reads did not. This gate closes the gap.
-
-## Required output (per triggered edit, before the edit happens)
-
-```
-📖 DOC READ: docs/<doc>.md (<line-count> lines, last updated <date if known>)
-  Trigger: edit to <path>
-  Sections checked: <list of §N referenced>
-  Citations applied to this edit:
-    - §<N>: <how this section's rule shows up in the diff>
-    - ...
-  Sections deemed not applicable (cited):
-    - §<N>: <one-line reason>
-```
-
-### Cited-skip variant (read happened; nothing applied)
-
-```
-📖 DOC READ: docs/<doc>.md (read; nothing applies)
-  Trigger: edit to <path>
-  Edit nature: <one-line description, e.g. "single-line typo fix in comment">
-  Reason no rule applies: <one-line citation, e.g. "no shape/import/typing change; pure data-literal update">
-```
-
-## Required output discipline
-
-- One `📖 DOC READ:` block per triggered doc per edit. If multiple docs trigger (e.g. a `*.zig` log emit triggers both `ZIG_RULES.md` and `LOGGING_STANDARD.md`), print both blocks back-to-back.
-- Cite by `§N` — proves the doc was actually consulted, not skimmed.
-- Skip-with-cited-reason is a first-class outcome. "Read, nothing applies, here's why" is valid output. Silence is not.
-
-## End-of-turn audit
-
-`scripts/audit-doc-reads.sh` runs as part of `make lint`:
-
-1. Read `git diff --name-only origin/main..HEAD`.
-2. For each file, look up which doc-read triggers fire.
-3. Search the agent's transcript / commit message body / PR description for matching `📖 DOC READ:` lines.
-4. Mismatch (file edited but no proof-line for an applicable trigger) → fail.
-
-The audit script does not validate citation correctness — that's reviewer responsibility. It only validates **existence** of the proof-line.
-
-## Family
-
-- `AGENTS.md` — canonical EXECUTE doc-reads table (this gate enforces).
-- `AGENTS_INVARIANCE.md` — invariance question pairs with this gate.
-- All listed standards docs (`ZIG_RULES.md`, `BUN_RULES.md`, `LOGGING_STANDARD.md`, `LIFECYCLE_PATTERNS.md`, `REST_API_DESIGN_GUIDELINES.md`, `AUTH.md`, `TEMPLATE.md`, `greptile-learnings/RULES.md`).
diff --git a/docs/gates/error-registry.md b/docs/gates/error-registry.md
deleted file mode 100644
index 0f82301..0000000
--- a/docs/gates/error-registry.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# 🚧 ERROR REGISTRY GATE
-
-**Family:** Observability discipline. **Source:** `docs/LOGGING_STANDARD.md` §5; canonical registry in `src/errors/error_registry.zig` (per-project, not in dotfiles).
-
-**Triggers** — every `Edit`/`Write` that:
-
-- Adds or modifies `error_code=UZ-XXX-NNN` in any source file under `src/**` or `zombiectl/**`.
-- Edits `src/errors/error_registry.zig`.
-- Touches HTTP error responses, executor frames, or CLI error surfaces.
-
-**Override:** `ERROR REGISTRY GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override.
-
-## What this gate covers
-
-Every `err`/`warn` log mapping to a domain failure must carry an `error_code=UZ-XXX-NNN` registered in `src/errors/error_registry.zig`. Every CLI / HTTP / executor error surface must emit codes from the same registry. Drift produces ungreppable error chains across layers — operator can't trace `UZ-EXEC-012` from the CLI back to the executor frame back to the docs.
-
-## Pre-edit check
-
-| Pattern | Rule |
-|---|---|
-| New `error_code=UZ-XXX-NNN` reference | Registry entry exists in `src/errors/error_registry.zig` in the same commit. **Blocking.** |
-| Adding a registry entry | Code follows `UZ-<CATEGORY>-<NNN>` pattern (categories: AUTH, EXEC, HTTP, REDIS, DB, CLI, EXTERNAL, INTERNAL). Hint and docs URL fields populated. |
-| Removing a registry entry | All references removed in same commit (RULE ORP — orphan sweep). |
-| Registry entry with no references in `src/**` or `zombiectl/**` | Informational — declared-but-unreferenced (dead code). |
-| Reference in source with no registry entry | Blocking — used-but-undeclared (orphan). |
-| HTTP error response | Body includes `code: "UZ-XXX-NNN"`. |
-| `zombiectl` error output | Human format: `error UZ-XXX-NNN: <message> (<context>)`. JSON format: `{ "code": "UZ-XXX-NNN", "message": ..., ... }` per `LOGGING_STANDARD.md` §8. |
-
-## Required output (default — one line)
-
-```
-ERROR REGISTRY GATE: <file> | new-codes:<list|none> orphans:<0|N> dead-codes:<0|N informational> hint:<populated|missing>
-```
-
-Comment-only edit:
-
-```
-ERROR REGISTRY GATE: <file> | comment-only | N/A
-```
-
-Full multi-line block fires on violation:
-
-```
-ERROR REGISTRY GATE: <file>
-  Registry: src/errors/error_registry.zig
-  New codes added (this diff): <UZ-XXX-NNN, ...>
-  Code references added (this diff): <UZ-XXX-NNN at <file>:<line>, ...>
-  Orphan codes (used but not declared): <list — BLOCKING>
-  Dead codes (declared but unreferenced): <list — informational>
-  Hint/docs populated: <ok ✓ | missing for <code>>
-  Audit script: <audit-error-codes.sh on staged diff: 0 findings ✓ | N findings>
-```
-
-## Scope (M70)
-
-`audit-error-codes.sh` walks the **full `src/` + `zombiectl/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
-
-## End-of-turn audit
-
-`scripts/audit-error-codes.sh` runs as part of `make lint`. Greps `src/errors/error_registry.zig` for declared codes, then greps `src/**` and `zombiectl/**` for any `UZ-[A-Z]+-[0-9]+` literal that isn't in the registry. Reports orphans (blocking) and dead codes (informational).
-
-## Family
-
-- `docs/LOGGING_STANDARD.md` §5 — error-code embedding rules in log records.
-- `docs/gates/logging.md` — pairs with this gate on `error_code=` audits.
-- `docs/REST_API_DESIGN_GUIDELINES.md` — HTTP error response shape includes `code`.
-- `docs/greptile-learnings/RULES.md` RULE ORP — orphan sweep on rename/delete.
diff --git a/docs/gates/file-length.md b/docs/gates/file-length.md
deleted file mode 100644
index d6f62f9..0000000
--- a/docs/gates/file-length.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# 🚧 File & Function Length Gate
-
-**Family:** Universal length discipline. **Source:** `docs/greptile-learnings/RULES.md` RULE FLL (File & Function Length).
-
-**Caps:** file ≤ 350 lines · function ≤ 50 lines · method ≤ 70 lines.
-
-**Triggers** — every Write/Edit that net-adds lines to a source file:
-`.zig`, `.js`, `.ts`, `.tsx`, `.jsx`, `.py`, `.rs`, `.go`, `.sh`, `.sql`, `.yaml`/`.toml` (when carrying code). If the file extension is ambiguous, the gate FIRES by default — opt-out requires the user override below.
-
-**Exempt:** `vendor/`, `node_modules/`, `third_party/` (upstream); `.md` files; **everything under `docs/**`** (documentation tree — any extension); published API artefacts under `public/` (loose ≤ 400-line advisory on path YAMLs); per-repo extensions in `docs/greptile-learnings/RULES.md`.
-
-**Override:** `LENGTH GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit.
-
-## Pre-edit check (mandatory)
-
-1. `wc -l <file>` — current count (0 for new files).
-2. Net delta: `+added - removed`.
-3. Projected: `current + delta`.
-4. If projected > 350, **STOP**. Split first: extract a cohesive block to a sibling file using the repo's `<module>_<concern>.<ext>` convention (`zombie_list.js` beside `zombie.js`). Then apply the original edit.
-5. Function sub-gate: project post-edit line count for any touched function. If > 50 (function) or > 70 (method), split into named helpers **before** writing.
-
-## Splitting conventions
-
-- Files named after the concern extracted (`zombie_list.js` not `zombie2.js`).
-- Helper function names describe the step (`normalizeCursor()` not `helperA()`).
-
-## Required output
-
-Print only when projected ≥ 300 lines OR touched function within 10 of cap:
-
-```
-LENGTH GATE: <file> N+Δ=<N+Δ> (cap 350, headroom <H>) | fn:<name> <F> lines (cap 50/70) | proceed|split.
-```
-
-## Self-audit (end-of-turn)
-
-```bash
-git diff --name-only origin/main \
-  | grep -v -E '\.md$|^docs/|^vendor/|_test\.|\.test\.|\.spec\.|/tests?/' \
-  | xargs -I{} sh -c 'wc -l "{}"' \
-  | awk '$1 > 350 { print "❌ " $2 ": " $1 " lines (limit 350)" }'
-```
-
-Non-empty output = hard fail.
diff --git a/docs/gates/greptile.md b/docs/gates/greptile.md
deleted file mode 100644
index a0807d8..0000000
--- a/docs/gates/greptile.md
+++ /dev/null
@@ -1,58 +0,0 @@
-# 🚧 GREPTILE GATE
-
-**Family:** Universal coding-rules audit. **Source:** `docs/greptile-learnings/RULES.md`.
-
-**Triggers:** fires twice per work unit — (1) per EXECUTE iteration when diff languages change (new layer/language enters the diff); (2) end-of-turn, before claiming complete.
-
-**Override:** `GREPTILE GATE: SKIPPED per user override (reason: ...)`. Violations stay in the diff and the user's override gets recorded in the spec's Discovery section.
-
-## What this gate enforces
-
-`docs/greptile-learnings/RULES.md` is the universal coding-rules catalogue. The agent failure mode is grepping the spec verbatim instead of grepping the rules; this gate makes the rule audit a printable artefact.
-
-## Common rules referenced
-
-| Code | Rule | Applies to |
-|---|---|---|
-| UFS | String literals are always constants | all source |
-| STS | No static strings in SQL schema | SQL |
-| EMS | Error messages follow a standard structure | Zig handlers |
-| NSQ | Named constants, schema-qualified SQL | SQL |
-| TGU | Tagged unions over optional-field structs | Zig |
-| VLT | Secrets belong in vault, not in entity tables | SQL/Zig |
-| CTM | Constant-time comparison for secrets | Zig |
-| CTC | Constant-time compare must not short-circuit on length | Zig |
-| FLL | File / function length caps | all source |
-| ORP | Cross-layer orphan sweep on rename/delete/format | all |
-| WAUTH | Workspace-IDOR safety | handlers |
-| TST-NAM | Test identifiers are milestone-free | tests |
-| PRI | No prompt injection from user input | LLM I/O |
-
-Read RULES.md for any code not in this short-list.
-
-## Pre-print check
-
-1. Identify diff languages (`zig|ts|tsx|sql|sh|py|go|rs`).
-2. List rules whose `Applies to` overlaps. UFS applies to all source; STS to SQL; EMS to Zig handlers; etc.
-3. **String-literals (UFS) audit:**
-
-   ```bash
-   git diff -U0 origin/main | grep -oE '"[^"]{4,}"' | sort -u
-   ```
-
-   For each unique literal, grep `src/ ui/ zombiectl/` for an existing `const` / `pub const` / `export const` / `as const` / `Final[str]` / `readonly` declaration. Found → import. Novel + ≥2 sites → declare a const.
-
-## Required output (one row per applicable rule, suppress non-applicable)
-
-```
-GREPTILE GATE: <iteration tag>  Diff langs: <…>
-| Code     | Verdict                                |
-| UFS      | clean | N violations: <list>           |
-| STS      | clean | N violations                   |
-| …        | …                                      |
-String-literals audit: <N literals scanned, M violations>
-```
-
-## Anti-rationalisation clause
-
-"It's just a label" / "I'll only use it once" are not exceptions to UFS. The clause applies to every rule with a behaviour modifier — when you find yourself reaching for a justification, the rule wins.
diff --git a/docs/gates/invariance-suite.md b/docs/gates/invariance-suite.md
deleted file mode 100644
index a1da65d..0000000
--- a/docs/gates/invariance-suite.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# 🚧 Invariance Suite Gate (meta-gate)
-
-**Family:** Meta-gate — protects the gate ruleset itself. Sibling: none (this gate has no peer; it watches every other gate's source-of-truth files).
-**Source:** `AGENTS.md` (project-side guard). Questionnaire body: `AGENTS_INVARIANCE.md` at repo root.
-
-**Triggers:** any Edit/Write in this session to **any one of**:
-
-- `AGENTS.md`
-- `AGENTS_INVARIANCE.md`
-- any file under `docs/gates/`
-- `scripts/audit-agents-md.sh` or `scripts/fixtures/*.diff`
-
-The trigger is **agent-self-edit**: the moment the agent *itself* modifies one of these files in the current session, this gate fires. (User-only edits do not fire it from the LLM's perspective — but the pre-push hook still gates them.)
-
-**Override:** none from the agent side. The user MAY bypass at push time with `SKIP_INVARIANCE_PUSH=1 git push ...`, documented with a reason in the most recent commit message. The agent MUST NOT self-bypass.
-
-## Required action (in-session, BEFORE declaring complete)
-
-The agent runs these steps in order. Each step's output appears in the user-facing message.
-
-1. **Script layer** — run `bash scripts/audit-agents-md.sh`. If exit ≠ 0, STOP, fix the FAIL lines, retry. Do NOT proceed to step 2 with a failing script.
-
-2. **Questionnaire layer** — read `AGENTS_INVARIANCE.md` and answer every question against the *current* `AGENTS.md` (and gate bodies). Each answer is YES or NO with the justifying line(s).
-
-3. **Tabulated report** — emit the Step-4 report from `AGENTS_INVARIANCE.md` (gates, rules, lifecycle, scenario verdicts, OVERALL).
-
-4. **Sign-off** — only when **all questions answered YES** AND the report's OVERALL row is `PASS`. After the commit lands, write:
-
-   ```bash
-   printf '%s  %s  PASS\n' "$(git rev-parse --short HEAD)" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-     > .agents-invariance-signoff
-   ```
-
-   (The file is gitignored — it's a per-machine attestation, not tracked.)
-
-5. **Tell the user** — surface that the sign-off was written and `git push` is now unblocked. If any question answered NO, surface the regression and STOP — the user decides whether to fix or override.
-
-## Sequencing relative to commit & push
-
-The sign-off must be tied to the **post-commit HEAD SHA**, so the order is:
-
-1. Edit ruleset files.
-2. Step 1 (script) ✓.
-3. Step 2 (questionnaire) ✓.
-4. Step 3 (report) ✓.
-5. `git commit` — pre-commit hook runs the script again (defence in depth).
-6. Step 4 (sign-off) — written against the new HEAD.
-7. `git push` — pre-push hook reads the sign-off; on PASS + matching SHA + < 24 h freshness, push proceeds.
-
-## Why this gate exists
-
-`AGENTS.md` is the agent's ruleset. Every other gate trusts that ruleset. If the ruleset drifts silently — a gate vanishes, a trigger silently drops a file class, an override path widens — every downstream gate is now wrong. The script catches mechanical regressions; the questionnaire catches semantic regressions that need reading comprehension. Together they prove the ruleset still holds *before* the bad version reaches the remote.
-
-## Failure modes the gate guards against
-
-- A gate body is moved or renamed; the AGENTS.md pointer rots; agents silently skip the gate.
-- An override path quietly widens (e.g. "user-only" → "auto-mode covers"); autonomy creep.
-- The always-forbidden list shrinks (e.g. someone removes `gitleaks` enforcement).
-- The skill-chain order shuffles (`/review-pr` runs before `/review`).
-- The HARNESS VERIFY block stops listing a gate row.
-- `AGENTS_INVARIANCE.md` itself loses scenarios.
-
-## Required output (in-session)
-
-```
-🚧 INVARIANCE SUITE GATE: <branch> @ <head-sha>
-  Step 1 (script):        ✅ ALL CHECKS PASSED
-  Step 2 (questionnaire): ✅ <N>/<N> YES
-  Step 3 (report):        emitted
-  Step 4 (sign-off):      ✅ written to .agents-invariance-signoff
-```
-
-Any 🔴 → STOP, surface, do NOT push.
diff --git a/docs/gates/legacy-design.md b/docs/gates/legacy-design.md
deleted file mode 100644
index 840e81a..0000000
--- a/docs/gates/legacy-design.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# 🚧 Legacy-Design Consult Guard
-
-**Family:** Legacy-control. Sibling rules: **RULE NDC**, **RULE NLR**, **RULE NLG**. **Source:** `AGENTS.md` (project-side guard, not a greptile-derived rule).
-
-**Triggers** — STOP and consult before any of these:
-
-- Patching legacy to fit new architecture ("compensating code").
-- Keeping legacy for "backward compat" pre-alpha when there are no external consumers.
-- Defensive `orelse` / fail-open whose only reason is legacy nullability.
-- Authoring tests that exercise the legacy path.
-- Choosing patch-vs-remove silently — never your call.
-
-**Override:** none — user decides A/B/C in the consult block.
-
-## Definition — "legacy design"
-
-Any code path, env-var, table, route, or API that the surrounding milestone work is deprecating, that predates the current architectural direction, or that exists solely as a smoke-test / bootstrap / pre-migration shim. Signals:
-
-- Comments like `// legacy`, `// pre-M*`, `// bootstrap`, `// TODO remove`, `// temporary`.
-- Runtime warn logs that announce themselves (`legacy path`, `deprecated`, `*_bootstrap_*`).
-- Env vars / principals / roles / schema cols whose only live consumer is a fallback branch or pre-signup/dev-only path.
-
-## Required output
-
-```
-LEGACY CONSULT: <desc> | found:<file:line> | (A) remove [blast:<files>] / (B) patch [risk] / (C) keep [why] | rec:<A|B|C> because <reason> | WAITING.
-```
-
-Block on the user's reply. If the user previously approved one *class* of legacy decisions this session, note that and proceed — but every *new* class of finding still triggers a consult.
-
-## Escape hatch
-
-Legacy findings unambiguously in-scope of the active spec's Dead Code Sweep or Out-of-Scope list skip the consult and follow the spec.
-
-## Discovery capture
-
-Every triggered consult is logged in the active spec's **Discovery** section, or filed as a new pending spec in `docs/v{N}/pending/` if pushed to follow-up.
-
-## Family
-
-NLR is the cleanup-on-touch arm; NLG bans new legacy framing pre-v2.0.0; this guard covers the harder judgment calls ("should this whole subsystem exist") that need the user's input.
diff --git a/docs/gates/lifecycle.md b/docs/gates/lifecycle.md
deleted file mode 100644
index b1d8df4..0000000
--- a/docs/gates/lifecycle.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# 🚧 LIFECYCLE GATE
-
-**Family:** Zig discipline (sister to ZIG GATE). **Source:** `docs/LIFECYCLE_PATTERNS.md`.
-
-**Triggers** — every `Edit`/`Write` to `*.zig` (incl. `*_test.zig`) outside `vendor/`/`third_party/`/`.zig-cache/` that:
-
-- Adds a `pub fn init(`, `pub fn deinit(`, `pub fn close(`, `pub fn release(`, `pub fn destroy(`, `pub fn shutdown(`, `pub fn dispose(`, `pub fn free(`.
-- Adds an `errdefer` or `defer` adjacent to an allocation.
-- Adds a struct field holding heap memory (`[]const u8` from a runtime `dupe`/`alloc`), an arena, or an opaque handle (`std.fs.File`, `std.Thread.Mutex`).
-- Reshapes any of the above on an existing struct.
-
-**Override:** `LIFECYCLE GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override.
-
-## What this gate covers
-
-`docs/LIFECYCLE_PATTERNS.md` codifies init/deinit pairing, errdefer placement, allocator ownership, defer-vs-errdefer choice, arena/GPA boundaries, and the call-site ownership-transfer convention. Drift produces leaks, double-frees, and use-after-free — caught only by memleak tests run from clean state.
-
-## Carve-out: PUB GATE vs LIFECYCLE GATE
-
-| Gate | Question |
-|---|---|
-| **PUB GATE** (`docs/gates/pub-surface.md`) | Should this symbol be `pub`? Does the file shape justify it? |
-| **LIFECYCLE GATE** (this file) | If `init` exists, does `deinit`? Is `errdefer` placed correctly? Is allocator ownership clear? |
-
-Both gates may fire on the same `pub fn init` edit. Print both blocks. Neither defers to the other.
-
-## Pre-edit check
-
-| Pattern | Rule |
-|---|---|
-| Struct with heap allocation OR opaque handle | `pub fn init` paired with `pub fn deinit`. No size threshold. |
-| `pub fn init` returning `*Self` | `errdefer allocator.destroy(self)` immediately after the `create`. |
-| Multiple allocations in init | Either chain-of-`errdefer` per allocation, or single `errdefer` freeing the wrapper that owns them. |
-| `errdefer` placement | Must lexically precede the allocation it protects. Last errdefer < last protected alloc. |
-| `defer` and `errdefer` on same alloc | Forbidden. Pick one per `LIFECYCLE_PATTERNS.md` §6. |
-| Allocator stored in struct | `deinit(self: *Self) void`. |
-| Allocator NOT stored | `deinit(self: *Self, allocator: std.mem.Allocator) void`. |
-| Arena-allocated slice stored in long-lived struct | Informational flag; reviewer must restructure or acknowledge. |
-| `init` body empty AND `deinit` body empty | Informational flag — pair-for-shape, likely unneeded. |
-| Renamed `deinit` (e.g. `close`, `release`) | Audit treats all listed names as lifecycle methods. Rename does not bypass. |
-
-## Required output (default — one line)
-
-```
-LIFECYCLE GATE: <file> | init/deinit:<ok|missing-deinit|missing-init> errdefer:<ok|batched|missing> defer-mix:<ok|conflict> allocator:<stored|param|n/a> idempotency-test:<present|missing>
-```
-
-Comment-only edit:
-
-```
-LIFECYCLE GATE: <file> | comment-only | N/A
-```
-
-Full multi-line block fires when a sub-rule reports a violation:
-
-```
-LIFECYCLE GATE: <file>
-  LIFECYCLE_PATTERNS.md sections consulted: §4 (init), §5 (deinit), §6 (defer/errdefer), §7 (ownership), §8 (arena/GPA), §10A (tightenings)
-  Init/deinit pair: <both present ✓ | missing deinit on <Struct> | missing init on <Struct>>
-  errdefer placement: <immediate ✓ | batched at line <N> | missing for <alloc at line N>>
-  defer/errdefer conflict: <none ✓ | both at <line>>
-  Allocator ownership: <stored ✓ | param ✓ | ambiguous: <where>>
-  Arena leakage risk: <none ✓ | flagged: <field>>
-  Idempotency assertion: <test exists ✓ | informational: missing for <Struct>>
-  Audit script: <audit-deinit-pairs.sh on staged diff: 0 findings ✓ | N findings>
-```
-
-## Scope (M70)
-
-`audit-deinit-pairs.sh` walks the **full `src/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
-
-## End-of-turn audit
-
-`scripts/audit-deinit-pairs.sh` runs as part of `make lint`. Mechanical enforcement on init/deinit pairs, errdefer placement, and lifecycle method recognition. Reviewer responsibility for idempotency assertions and arena-leakage acknowledgements.
-
-## Family
-
-- `docs/LIFECYCLE_PATTERNS.md` — full standard, including §10A tightenings.
-- `docs/ZIG_RULES.md` — Zig umbrella; ZIG GATE fires alongside.
-- `docs/gates/pub-surface.md` — PUB GATE; carve-out above.
-- `docs/gates/file-length.md` — LENGTH GATE; init/deinit don't escape file/method caps.
diff --git a/docs/gates/logging.md b/docs/gates/logging.md
deleted file mode 100644
index 5d89df4..0000000
--- a/docs/gates/logging.md
+++ /dev/null
@@ -1,72 +0,0 @@
-# 🚧 LOGGING GATE
-
-**Family:** Observability discipline. **Source:** `docs/LOGGING_STANDARD.md`.
-
-**Triggers** — every `Edit`/`Write` that adds, removes, or changes a log emit:
-
-- `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/`/`*_test.zig` — `std.log.*`, `std.debug.print`, raw stderr writes, calls into the `log` named module (source: `src/logging/mod.zig`).
-- `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/`/`*.test.*`/`*.spec.*` — `console.*`, custom logger calls.
-- `*.sh` outside generated dirs — `echo`/`printf` to `&2`.
-
-**Override:** `LOGGING GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override.
-
-## What this gate covers
-
-`docs/LOGGING_STANDARD.md` codifies the wire format (logfmt), severity ladder, error-code embedding, scope discipline, and PII redaction. Drift is silent until incident response hits ungreppable logs at 3 AM.
-
-## Pre-edit check
-
-| Pattern | Rule |
-|---|---|
-| New `logging.scoped(.tag)` call | Scope is a Zig enum literal — adding a new tag is freeform. `event` must be snake_case `verb_noun`. |
-| New `err`/`warn` log mapping to a domain failure | `error_code=UZ-XXX-NNN` field required. Registry entry must land in same commit. |
-| Per-iteration / hot-loop log | Use `debug` (hidden by default), not `info`. |
-| `info` level | Event must appear in the `info` allow-list (see `LOGGING_STANDARD.md` §10A.L4). Otherwise downgrade to `debug` or justify. |
-| `console.log`/`std.debug.print` in non-test source | Forbidden. Convert to logger or delete before commit. |
-| `std.log.scoped` outside `src/logging/` | Migration target. The `log` named module's `scoped` API is the only non-test entry point; flip the file's alias and migrate every call site in the same commit. |
-| `msg=` field | ≤ 300 chars. Stack traces emit as separate `event=stack_trace` debug record. |
-| Multi-line values | Newlines must be `\n` literal (two chars), not raw newline byte. |
-
-Verify each rule applies or is N/A for this edit.
-
-## Required output (default — one line)
-
-```
-LOGGING GATE: <file> | scope:<ok|new:.tag> event:<ok|new:.event> error_code:<ok|N/A> severity:<ok|escalation> redaction:<ok|N/A>
-```
-
-Comment-only edit:
-
-```
-LOGGING GATE: <file> | comment-only | N/A
-```
-
-Full multi-line block fires when a sub-rule reports a violation:
-
-```
-LOGGING GATE: <file>
-  LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (zig binding) | §8 (TS binding), §10A (tightenings)
-  Wire format: <logfmt ✓ | violation: <where>>
-  Required keys: <ts_ms,level,scope,event present ✓ | violation: <missing>>
-  Severity choice: <within rules ✓ | violation: <e.g. info on per-iteration path>>
-  Error-code embedding: <UZ-XXX-NNN present and registered ✓ | orphan: <code> | missing on err/warn>
-  PII discipline: <no secret materials ✓ | violation: <where>>
-  Field caps: <≤15 fields, msg≤300 chars ✓ | violation: <count>>
-  Newline encoding: <\n literal ✓ | raw newline at <line>>
-  Audit script: <audit-logging.sh on staged diff: 0 findings ✓ | N findings>
-```
-
-## Scope (M70)
-
-`audit-logging.sh` walks the **full `src/` + `zombiectl/src/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
-
-## End-of-turn audit
-
-`scripts/audit-logging.sh` runs as part of `make lint`. Mechanical enforcement; reviewer responsibility for severity-level subjective calls and PII spot-checks (allow-list and msg-length are mechanical).
-
-## Family
-
-- `docs/LOGGING_STANDARD.md` — full standard, including §10A tightenings.
-- `docs/ZIG_RULES.md` — Zig discipline umbrella; §7 of the standard depends on it.
-- `docs/BUN_RULES.md` §10 — bans `console.log` in TS/JS source. This gate enforces.
-- `docs/gates/error-registry.md` — pairs with this gate on `error_code=` audits.
diff --git a/docs/gates/milestone-id.md b/docs/gates/milestone-id.md
deleted file mode 100644
index bda2c2c..0000000
--- a/docs/gates/milestone-id.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# 🚧 Milestone-ID Gate
-
-**Family:** Source-rot prevention. **Source:** `AGENTS.md` (project-side guard). Related: **RULE TST-NAM** (test identifiers are milestone-free) in `docs/greptile-learnings/RULES.md`.
-
-**Triggers — before saving any file matching:**
-
-- `**/*.zig` · `**/*.sql` · `**/*.ts` · `**/*.tsx` · `**/*.js` · `**/*.jsx` · `**/*.py` · `**/*.rs` · `**/*.go` · `**/*.sh`
-- Any config file (`*.toml`, `*.yaml`, `*.json`) outside `docs/`
-- Test files (the `_test.` / `.test.` / `.spec.` naming doesn't exempt — tests are code).
-
-**Exempt paths** (IDs allowed): `docs/`, `**/*.md` outside `node_modules/`/`vendor/`, `CLAUDE.md`/`AGENTS.md`/`AGENTS_INVARIANCE.md`.
-
-**Override:** `MILESTONE ID ALLOWED per user override (reason: ...)` in the immediately-preceding comment line.
-
-## Why
-
-Milestone IDs (`M{N}_{NNN}`), section refs (`§X.Y`), and dimension tokens (`T7`, `dim 5.8.15`) belong in specs, PR descriptions, and scratchpads — never in source code, since the codebase outlives any individual milestone and these references rot.
-
-## Pre-edit check
-
-Grep about-to-save content for:
-
-```
-M[0-9]+_[0-9]+
-§[0-9]+(\.[0-9]+)+
-\bT[0-9]+\b
-\bdim [0-9]+\.[0-9]+\b
-```
-
-If any match, **strip the reference before saving.** Rewrite to describe the code's purpose, not its spec lineage.
-
-## Self-audit (end-of-turn)
-
-Covered by the combined awk audit in AGENTS.md HARNESS VERIFY section.
diff --git a/docs/gates/nlg.md b/docs/gates/nlg.md
deleted file mode 100644
index 1b3bfb1..0000000
--- a/docs/gates/nlg.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# 🚧 RULE NLG — No legacy framing pre-v2.0.0
-
-**Family:** Legacy-control. Sibling rules: **RULE NDC**, **RULE NLR**, **Legacy-Design Consult Guard**. **Source:** `docs/greptile-learnings/RULES.md` RULE NLG.
-
-**Triggers:** introducing any new `legacy_*` name, `V2`-twin type, `if (legacy_caller)` branch, backward-compat shim, "rejecting legacy X" prose, or violation tracking-list while `cat VERSION` < `2.0.0`.
-
-**Override:** `RULE NLG: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-invokable only.** Requires a concrete external consumer that can't migrate same-commit (vanishingly rare pre-v2.0.0).
-
-## What this gate enforces
-
-While `cat VERSION` < `2.0.0`, the project has no external consumers and no published API. Do not introduce *new* legacy concepts in any form:
-
-- No `legacy_*` error variant names.
-- No `if (legacy_caller)` branches.
-- No `V2`-suffixed twin types.
-- No backward-compat shims.
-- No "rejecting legacy X" prose in specs/docs/commit messages.
-
-Edit interfaces in place; update every caller in the same commit. Name errors by *what is wrong*, not *when it was wrong* (e.g. `runtime_keys_outside_block`, not `legacy_top_level_runtime`).
-
-## Why
-
-Pre-alpha duplicates rot faster than documentation. Every `legacy_*` name introduces a phantom interface nobody owns; every future spec then has to reason about it. Schema Table Removal Guard already encodes this for SQL — RULE NLG generalises it to every interface (RPC, route, struct, error name, config key, spec prose).
-
-## Tracking-list ban
-
-Any constant, doc structure, or carve-out list whose purpose is to catalog "violations to be cleaned up later" is itself an NLG violation. Banned name patterns: `LEGACY_`, `PENDING_`, `_VIOLATIONS`, `_CARVE_OUTS` (when meant for deferred cleanup), `TO_FIX_`, `DEFERRED_`, or any equivalent.
-
-Either fix every entry in the same diff that introduces or touches the list, or delete the list and let the next touch fix the underlying violations. The tracking list **legitimises deferral**; the rule exists to prevent that.
-
-**Vendor-immortal carve-outs** — paths or names dictated by external commitments that genuinely cannot be renamed (e.g. OAuth callback URLs that Slack/GitHub register with us) — are a separate class. Name those explicitly with `VENDOR_` or `EXTERNAL_` prefix so the distinction from "deferred cleanup" is mechanical, and add a comment line stating the external commitment that pins the name.
-
-## Required output (when violation found)
-
-```
-NLG: <file>:<line> | new legacy framing: <description> | action: rename | suggested name: <what-is-wrong-form>
-```
-
-## Full text
-
-`docs/greptile-learnings/RULES.md` RULE NLG.
diff --git a/docs/gates/nlr.md b/docs/gates/nlr.md
deleted file mode 100644
index 9df8f81..0000000
--- a/docs/gates/nlr.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# 🚧 RULE NLR — No legacy retained (touch-it-fix-it)
-
-**Family:** Legacy-control. Sibling rules: **RULE NDC** (no dead code at write time), **RULE NLG** (no new legacy framing pre-v2.0.0), **Legacy-Design Consult Guard** (judgment calls on whole subsystems). **Source:** `docs/greptile-learnings/RULES.md` RULE NLR.
-
-**Triggers:** any Edit/Write to a file containing pre-existing legacy framing or dead code.
-
-**Override:** `RULE NLR: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-invokable only.** Concrete external-impact constraint OR explicit NLR DECISION resolution required. Generic "scope creep"/"too big" not valid.
-
-## What this gate enforces
-
-Any edit to a file with pre-existing legacy framing or dead code MUST remove it in the same diff. Patterns covered:
-
-- `?*T = null` fields whose only caller always sets a non-null value (dead defense for a phantom caller).
-- `legacy_*` symbol names, `V2`-suffixed twin types, `if (legacy_caller)` branches.
-- `// legacy` / `// pre-M*` / `// bootstrap` comments.
-- Runtime warns saying `legacy path` / `deprecated` / `*_bootstrap_*`.
-- `pub` fns/fields with no in-tree consumer (verify with `grep -rn`).
-- `defer if (x) ... else null` patterns that compensate for an `?T` that should have been `T`.
-- Unused parameters, captures, unreachable branches.
-
-The carve-out "pre-existing violations are not the agent's responsibility" does **not** apply when the agent is already touching the file. You see it, you own it.
-
-## Pre-edit check
-
-1. Before the first `Edit`/`Write` to a file, scan for the patterns above in the *whole file*, not just the lines you're touching.
-2. List violations in the gate output before the edit.
-3. Remove them in the same diff. Update every caller in the same commit.
-4. If cleanup is judged infeasible (large net-line delta, cross-package cascade, meaningfully different design path emerges), print the **NLR DECISION** block below and **wait**. The agent has no autonomous escape; the user is the only authority.
-
-## Decision block
-
-```
-NLR DECISION: <file>
-  Cleanup-in-place cost: +<N> net lines, <M> files touched.
-  Alternative approach: <one-line description> (avoids the dirty file).
-  If alternative chosen, legacy that survives:
-    - <symbol/pattern>: <file:line>
-    - ...
-  WAITING for user: clean / alternative.
-```
-
-## Required output (when violations found before edit)
-
-```
-NLR: <file> | violations: <list with file:line each> | action: clean-in-diff
-```
-
-## Anti-evasion clause
-
-Three failure modes the agent MUST NOT use to skip cleanup:
-
-1. **Route-around design.** Picking an architecture that avoids the dirty file specifically to dodge cleanup. If NLR avoidance was a motivation, surface it.
-2. **Silent rejection.** Quietly choosing not to touch a file because cleanup looked expensive, without disclosing the decision.
-3. **Shim-and-skip.** Introducing a wrapper/adapter to sidestep a dirty interface — the new code becomes its own legacy debt; the original rots in place.
-
-If any of these patterns is in play, surface it via the NLR DECISION block. The user retains all discretion.
-
-## Family
-
-- **RULE NDC** — prevention at write time (don't author dead code).
-- **RULE NLG** — ban new legacy framing pre-v2.0.0.
-- **Legacy-Design Consult Guard** — harder judgment calls ("should this whole subsystem exist") that need user input.
-- **RULE NLR** — mechanical cleanup on touch.
diff --git a/docs/gates/pub-surface.md b/docs/gates/pub-surface.md
deleted file mode 100644
index aa7c824..0000000
--- a/docs/gates/pub-surface.md
+++ /dev/null
@@ -1,105 +0,0 @@
-# 🚧 Pub Surface & Struct-Shape Gate
-
-**Family:** Zig discipline (sub-gate of ZIG GATE). **Source:** `docs/ZIG_RULES.md`. **Parent:** `docs/gates/zig.md`.
-
-**Triggers — gate fires when:**
-
-1. Creating any new `*.zig` file under `src/` (out-of-scope: `*_test.zig`, `vendor/`, `third_party/`, `node_modules/`, `.zig-cache/`).
-2. **Threshold-cross on an existing file:**
-   - An Edit adds the file's first `pub` type, OR
-   - Adds a `pub fn ... self ...` method to a file currently dominated by `pub` free fns, OR
-   - Removes the last pub free fn from a multi-pub-fn file.
-3. Any user message saying "rethink the layout of `<file>`" or equivalent.
-
-For all other `*.zig` edits, the full block is skipped with a one-liner: `PUB GATE: skipped — <one-line reason>`. Never produce a `pub` change without either the full gate block OR the skip warning preceding the edit.
-
-**Override:** `PUB GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit (sub-gate override). The umbrella `FILE SHAPE DECISION` override requires user's explicit ask **this turn** — auto-mode does NOT cover it.
-
-## What this gate enforces
-
-Two `docs/ZIG_RULES.md` rules:
-
-1. **`pub` only when an external file imports the symbol** — default private; strip stale `pub`s when touching a file. *Mechanical enforcement is delegated to `zlint`'s `unused-decls: error` rule*, which fails `make lint` for any `pub` without an in-tree consumer. The gate body no longer requires a per-symbol consumer-grep in the proof block.
-2. **File-as-struct shape is the default for new behavior-bound-to-state files.** A file *is* a struct in Zig — modeling that shape exposes ownership and testability cheaply. Conventional layout (multi-type modules, parsers/DSLs, constants modules, pub-free-fn-dominant modules, tagged-union dispatch tables, "operations over a passive value") **must be justified at PLAN**, not chosen by inertia.
-
-**Tie-break:** behavior-bound-to-state → file-as-struct; operations-over-value → conventional. **Escape clause:** "I can articulate in one sentence why this is operations-over-value." If you can't, file-as-struct wins.
-
-**No inheritance:** each new pub surface needs its own *shape verdict* — cloning a sibling's "Public for the integration test in …" justification does NOT discharge. Mechanical consumer-grep is `zlint`'s job; the design call is yours, and it does not transfer between symbols.
-
-## File-as-struct layout
-
-```zig
-const Foo = @This();
-
-// fields
-allocator: std.mem.Allocator,
-state: State,
-
-// constructors
-pub fn init(...) Foo { ... }
-pub fn deinit(self: *Foo) void { ... }
-
-// queries
-pub fn isReady(self: Foo) bool { ... }
-
-// mutators
-pub fn step(self: *Foo) !void { ... }
-
-// imports at end
-const std = @import("std");
-const State = @import("state.zig");
-```
-
-## FILE SHAPE DECISION (mandatory at PLAN, before first Write/Edit creating or reshaping)
-
-```
-FILE SHAPE DECISION: <intended-path>
-  Trigger: <new file | existing file crossing threshold: <which>>
-  Purpose (one sentence): <what this file's job is>
-  Primary type (if any): <Name | none>
-  Methods bound to that type: <N> | Pub free fns: <M>
-  Verdict: <file-as-struct | conventional>
-  Why not the other: <one sentence — required when verdict is conventional>
-```
-
-Skipping this block is a PLAN violation, not just an EXECUTE one.
-
-## Pre-edit check (every `*.zig` Edit/Write)
-
-1. Grep new-bytes for new pub surface — any match in *new* bytes (not the existing file) → gate fires:
-   - `^pub` — new top-level pub declaration
-   - `^\s+pub fn` — new pub method on an existing struct
-   - new variant on a pub error union: `ErrorUnion{… NewVariant,`
-   - new variant on a pub enum: `= enum { … NewVariant,`
-2. Count primary types in the file (struct/union/enum the file is "about"); choose layout: file-as-struct (count = 1, all pub fns take `self`) or conventional (otherwise).
-3. List every new `pub` symbol the edit introduces and confirm its shape verdict matches the file's chosen layout. Each new symbol gets its own verdict — do not inherit from a sibling.
-
-Mechanical consumer-grep is no longer part of this checklist: `zlint`'s `unused-decls: error` rule (enabled in `zlint.json`, run by `make lint`) fails the build on any `pub` without an in-tree consumer. The gate body owns the design call (shape verdict + no inheritance); zlint owns "did you forget to strip a dead pub?"
-
-## Required output (when fires)
-
-```
-PUB GATE: <file> | types=<0|1|>1> | layout=<file-as-struct|conventional> (<why>)
-  New: <sym>, <sym>, …
-```
-
-If no new `pub` symbols and the file is not new, the gate is a no-op — skip the printable block.
-
-## Self-audit (end-of-turn)
-
-```bash
-git diff -U0 HEAD -- '*.zig' \
-  | grep -E '^\+pub |^\+\s+pub fn |^\+\s+[A-Z][a-zA-Z]+,$' \
-  | head
-```
-
-Non-empty = new pub surface this turn; verify a PUB GATE block (with shape verdict) was printed before each corresponding Edit/Write. The end-of-turn `make lint` run is also load-bearing: if `zlint` reports `unused-decls`, you skipped stripping a dead `pub` and the gate did not fail loud enough.
-
-For new-file FILE SHAPE coverage:
-
-```bash
-git diff --diff-filter=A --name-only origin/<base> -- 'src/**/*.zig' \
-  | grep -v -E '_test\.zig$|^vendor/|^third_party/'
-```
-
-Each path must have had a `FILE SHAPE DECISION` block printed before its first Write.
diff --git a/docs/gates/schema-removal.md b/docs/gates/schema-removal.md
deleted file mode 100644
index 36d44de..0000000
--- a/docs/gates/schema-removal.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# 🚧 Schema Table Removal Guard
-
-**Family:** Schema discipline. **Source:** `AGENTS.md` (project-side guard). Related: **RULE STS** (no static strings in SQL schema), **RULE NSQ** (named constants, schema-qualified SQL) — both in `docs/greptile-learnings/RULES.md`.
-
-**Triggers** — before any of these, run `cat VERSION` and print the guard output:
-
-- Creating, editing, or deleting any file under `schema/*.sql`.
-- Editing `schema/embed.zig` (any `@embedFile` constant).
-- Editing the canonical migration array in `src/cmd/common.zig`.
-- Writing `DROP TABLE`, `ALTER TABLE`, or `SELECT 1;` into any SQL file.
-- Accepting a spec dimension prescribing a "DROP migration", "ALTER migration", or "version marker".
-
-**Override:** `SCHEMA GUARD: SKIPPED per user override (reason: ...)`. **User-invokable only.** Spec violates the guard → amend the spec first.
-
-## Pre-v2.0.0 (teardown-rebuild era)
-
-To remove a table:
-
-1. `rm schema/NNN_foo.sql`
-2. Remove `@embedFile` from `schema/embed.zig`
-3. Remove the entry from the migration array in `src/cmd/common.zig` and update length + index-based tests.
-
-**Forbidden:** `ALTER TABLE`, `DROP TABLE`, `SELECT 1;` markers, comment-only files, "keep file for slot numbering". Slot gaps are fine — the DB is wiped on rebuild.
-
-## v2.0.0+
-
-Proper `ALTER`/`DROP` migrations in new numbered files. No teardown.
-
-## Required output
-
-```
-SCHEMA GUARD: VERSION=<v> (<2.0.0 ? teardown : alter)
-  rm:schema/<file>.sql
-  rm-embed:<const>
-  rm-migration:v<N>
-```
-
-For pre-v2.0.0 path, all three rm- lines appear. For v2.0.0+, replace with `migration:schema/<NNN>_<change>.sql`.
diff --git a/docs/gates/spec-template.md b/docs/gates/spec-template.md
deleted file mode 100644
index effe2b8..0000000
--- a/docs/gates/spec-template.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# 🚧 SPEC TEMPLATE GATE
-
-**Family:** Spec authoring discipline. **Source:** `docs/TEMPLATE.md` — the "Prohibited" section (negative space) **and** the agent-facing required sections (positive space).
-
-**Triggers** — every `Edit`/`Write` to:
-
-- Any spec under `docs/v*/{pending,active,done}/**/*.md`.
-- `docs/TEMPLATE.md` itself.
-- Any file matching `*.md` whose body contains the spec frontmatter pattern (`^**Milestone:** M\d+`).
-
-**Override:** `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.** Auto-mode does NOT cover this override. Reasons must cite a concrete external constraint (vendor doc requirement, regulatory format), never internal preference.
-
-## What this gate covers
-
-**Family 1 — prohibited patterns (negative space).** `docs/TEMPLATE.md` "Prohibited" section forbids: time/effort estimates, effort columns, complexity ratings, percentage-complete fields, assigned owners, implementation dates. Specs created from the template don't carry the Prohibited section forward — only the body below the divider gets copied. Without enforcement, prohibited sections drift back into specs (the original M62_001 spec carried an "Estimated effort" section in violation; this gate prevents recurrence).
-
-**Family 2 — required-present + no-placeholder (positive space).** The agent-facing template mandates the determinism sections the executing agent reads to emit invariant output: PR Intent & comprehension handshake, Applicable Rules, Applicable Gates, Overview, Prior-Art / Reference Implementations, Files Changed, Decomposition & alternatives, Sections, Interfaces, Failure Modes, Invariants, Test Specification, Acceptance Criteria, Discovery. A spec missing one — or leaving template residue (`path/to/file.ext`, `test_<short_name>`, `{one-line reason}`) — forces the agent to guess intent.
-
-**Scope (no legacy carve-out).** Family 2 fires in `--staged` only — the spec being authored/edited now (the agent's own output): BLOCK. The bulk scans (`--all`/`--include-done`, which `make harness-verify` runs) execute Family 1 only, so they behave identically over the whole corpus and never break an existing spec. Existing `usezombie` specs adopt the new sections when migrated later; until a spec is touched (staged), it is not retroactively failed.
-
-## Pre-edit check
-
-| Pattern | Rule |
-|---|---|
-| `## Estimated effort` (any heading variant) | Forbidden. Delete the section. |
-| `## Effort` / `## Complexity` / `## Sizing` | Forbidden. Use Priority. |
-| `\b\d+\s*[-–]\s*\d+\s*h\b` (hour ranges like "10-14h") | Forbidden. |
-| `\b\d+\s*hours?\b` / `\b\d+\s*days?\b` / `\b\d+\s*min(utes?)?\b` (time estimates) | Forbidden. |
-| `\b(low|medium|high|small|large)\s*[:|-]\s*(effort|complexity)\b` | Forbidden. |
-| `\d+%\s*complete` / `\b\d+/\d+\b\s*tasks` (percentage / fraction complete) | Forbidden — use binary PENDING/IN_PROGRESS/DONE. |
-| `**Owner:**` / `**Assigned to:**` | Forbidden — use git history. |
-| `**Due:**` / `**Deadline:**` (with date) | Forbidden — use Priority. |
-| Missing a required determinism section in a **staged** spec | BLOCK — add it (PR Intent / Applicable Gates / Prior-Art / Decomposition / …). |
-| Unfilled template residue (`path/to/file.ext`, `test_<short_name>`) in a **staged** spec | BLOCK — fill the section. |
-| Spec without the SPEC AUTHORING RULES banner (post-template-update) | Informational — banner reminds future edits of the rule. |
-
-## Required output (default — one line)
-
-```
-SPEC TEMPLATE GATE: <file> | prohibited:<0|list> required-sections:<all-present|missing-list — staged only> placeholders:<0|list> banner:<yes|no>
-```
-
-Full multi-line block fires on violation:
-
-```
-SPEC TEMPLATE GATE: <file>
-  TEMPLATE.md "Prohibited" section consulted: ✓
-  Prohibited sections found: <e.g. "## Estimated effort" at line N>
-  Time estimates found: <e.g. "10–14 h" at line N>
-  Effort/complexity fields found: <e.g. "**Effort:** medium" at line N>
-  Percentage-complete fields found: <e.g. "60% complete" at line N>
-  Owner/date fields found: <list>
-  Audit script: <audit-spec-template.sh on staged diff: 0 findings ✓ | N findings>
-```
-
-## Scope (M70)
-
-`audit-spec-template.sh` walks the **full pending+active spec set** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
-
-## End-of-turn audit
-
-`scripts/audit-spec-template.sh` runs as part of `make lint`. Mechanical regex enforcement against the patterns listed above. Failures block `make lint`.
-
-## Family
-
-- `docs/TEMPLATE.md` — canonical Prohibited section.
-- `kishore-spec-new` skill — creates specs from the template; banner is inserted at creation.
-- `AGENTS.md` EXECUTE doc-reads table — adds `docs/TEMPLATE.md` for any spec edit.
diff --git a/docs/gates/ufs.md b/docs/gates/ufs.md
deleted file mode 100644
index 5b6d9f2..0000000
--- a/docs/gates/ufs.md
+++ /dev/null
@@ -1,88 +0,0 @@
-# 🚧 UFS Gate — Unified Form for Symbols
-
-**Family:** Constant discipline. **Source:** `AGENTS.md` (HARNESS VERIFY enforcement) + `BUN_RULES.md §2` + `ZIG_RULES.md` "RULE UFS" clauses.
-
-**Triggers** — every `Edit`/`Write` to source files under `src/`, `ui/packages/*/src/`, `ui/packages/*/app/`, `ui/packages/*/lib/`, `ui/packages/*/components/`, `ui/packages/*/pages/`, `ui/packages/*/tests/`, `zombiectl/src/`, `zombiectl/test/` matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`.
-
-**Override:** `UFS GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-only**; auto-mode does not cover.
-
-**Carve-out:** **Pin tests** keep their literals if and only if the literal IS the contract under test (`expect(formatDollars(4_710_000_000)).toBe("$4.71")`). Each pin must carry an inline `// pin test: literal is the contract` comment on or above the line.
-
-## What this gate enforces
-
-Three discipline points, all part of RULE UFS:
-
-1. **Repeat literals → named constant.** Any string literal appearing ≥2 times in the same file (or in the same module/package — see scope ladder below) becomes a named const. Wire-format enum values (`"platform"`, `"self_managed"`, `"receive"`, `"stage"`, mode strings, posture labels, channel names, queue names, error code categories) are *always* named — even at first use, even in test fixtures.
-
-2. **Semantic numeric literals → named constant.** Numeric literals carrying meaning beyond their digits become named consts even at first use. Includes: conversion factors (powers-of-ten ≥ 1e3 used as multipliers/divisors), thresholds, sub-cent rates, time-unit factors, byte-unit factors, retry caps, sentinel offsets. Bare `1_000_000_000` in `nanos / 1_000_000_000` is a smell — `nanos / NANOS_PER_USD` is the rule.
-
-3. **Cross-runtime parity.** Any constant that exists in more than one runtime (Zig, TS, JS) **must share its identifier verbatim**, modulo case where a language idiom forces it (Zig snake_case → TS/JS SCREAMING_SNAKE is a single-runtime style choice; the *semantic* name is identical). When a literal in runtime A would benefit from a name and a sibling runtime already has that name, reuse it. When introducing a new constant, define it in every runtime that uses the same value, same commit. There is no per-constant carve-out: this applies to every cross-runtime constant, not a curated subset.
-
-The gate exists because RULE UFS is otherwise pure self-policing. Without an audit script, an inline literal in a 800-LOC editing session reliably slips past attention.
-
-## Pre-edit checks
-
-Before saving an edit that introduces or relocates a literal:
-
-1. **Same-file repeat?** Grep within the file for the literal value. If it appears ≥1 time already, define a const at the top of the file (or in the module's `constants.ts`/`constants.zig`) and replace all occurrences.
-
-2. **Same-module repeat?** Grep within the module/package (`ui/packages/app/`, `zombiectl/src/`, `src/`). If repeated, define in the module's canonical types/constants file (`lib/types.ts`, `src/state/<topic>.zig`, `zombiectl/src/constants/<topic>.js`).
-
-3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep all three runtimes for an existing matching name. If found, reuse the name. If not, define in every runtime that uses the same value, same commit.
-
-4. **Carve-out check?** If the literal IS the contract a pin test verifies, write the `// pin test: literal is the contract` comment on or above the line. Otherwise, name it.
-
-## Required output (per Edit/Write — one line by default)
-
-```
-UFS GATE: <file> | repeats:<count> | semantic-numerics:<count> | cross-runtime:<status> | pin-test-carve-outs:<count>
-```
-
-Multi-line block fires when repeats > 0 OR semantic-numerics > 0 OR cross-runtime status ≠ ok:
-
-```
-UFS GATE: <file>
-  Repeat string literals named: <list of value → CONSTANT_NAME pairs>
-  Repeat string literals KEPT (carve-out): <value> — <reason: pin test / single-use semantically irreducible / etc.>
-  Semantic numerics named: <list of value → CONSTANT_NAME pairs>
-  Semantic numerics KEPT: <value> — <reason>
-  Cross-runtime parity: <status — e.g. "NANOS_PER_USD added to Zig+TS+JS this commit" or "n/a — runtime-internal constant">
-```
-
-## Scope (M70)
-
-`audit-ufs.sh` walks the **full working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run.
-
-The previous `--diff` (`BASE...HEAD`) default was retired with M70. The forcing function was M68 commit `02c1f3cf`: pre-commit's `HEAD` is the prior commit, so `BASE...HEAD` was blind to nine cross-runtime mismatches the agent had staged but not yet committed. The full-codebase scope removes that blindspot.
-
-`--all` is accepted as a back-compat alias for the default. `--diff` is rejected with exit 2 + a pointer to this section.
-
-## Self-audit (end-of-turn / HARNESS VERIFY)
-
-`scripts/audit-ufs.sh` is invoked at HARNESS VERIFY by the agent. Convention follows the sibling audit scripts (`audit-logging.sh`, `audit-error-codes.sh`, `audit-deinit-pairs.sh`, `audit-spec-template.sh`) — none of them wire into `make lint`; the agent runs each as part of the gate ceremony, with the result feeding the HARNESS VERIFY table. The script is generic — no manifest of known literals — so it scales as the codebase grows:
-
-```bash
-bash scripts/audit-ufs.sh          # full-codebase scan (default and only mode)
-bash scripts/audit-ufs.sh --all    # alias for default
-```
-
-The script emits a violations table. Empty table = pass. Each row is one of:
-
-- `string-dup-file <file> "<literal>" <count>` — same string ≥2× in one file
-- `string-dup-module <module> "<literal>" <count>` — same string ≥2× across a module/package
-- `numeric-suspect <file>:<line> <literal>` — power-of-ten or known unit-factor numeric not bound to a const (excludes anything on a `// pin test: literal is the contract` line)
-- `cross-runtime-orphan <const_name> <runtime>` — SCREAMING_SNAKE constant defined in one runtime, missing from a sibling runtime that the same diff touches
-
-Violations resolve by either (1) extracting to a named const + replacing all sites, (2) adding the constant in the missing sibling runtime same-commit, or (3) adding the `// pin test: literal is the contract` comment.
-
-## HARNESS VERIFY row
-
-```
-| UFS GATE             | ✅ pass | 🟡 N violations addressed | 🔴 N unresolved |
-```
-
-🔴 unresolved → return to EXECUTE; the lifecycle does not advance.
-
-## Failure mode this gate exists to prevent
-
-Indy's M66_001 §3 tail surfaced the failure clearly: `RULE UFS` lived as a single bullet in `BUN_RULES.md §2` with no audit, no HARNESS VERIFY row, and no per-edit ceremony. Across an 800-LOC session the agent introduced ~20 inline literals (`"platform"`, `"self_managed"`, `"receive"`, `"stage"`, `mode: "byok"`, `1e9`, `1_000_000_000`, etc.) that the rule already covered but no mechanism caught. The rule is fine; the enforcement was missing. This gate adds the enforcement.
diff --git a/docs/gates/ui-substitution.md b/docs/gates/ui-substitution.md
deleted file mode 100644
index c535646..0000000
--- a/docs/gates/ui-substitution.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# 🚧 UI Component Substitution Gate
-
-**Family:** Frontend design-system discipline. **Source:** `AGENTS.md` (project-side guard). Authoritative primitive set: `ui/packages/design-system/src/index.ts`.
-
-**Triggers** — every `Edit`/`Write` to a `*.tsx` / `*.jsx` under `ui/packages/app/` **or** `ui/packages/website/`. Both packages share the same design-system source of truth (`@usezombie/design-system`), so the same primitive-first standard applies. Tests (`*.test.tsx`) and Playwright specs (`tests/e2e/**`) are exempt — they assert on rendered DOM and frequently use raw selectors.
-
-**Override:** `UI GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit.
-
-## What this gate enforces
-
-The design-system package (`ui/packages/design-system/src/index.ts` exports — `Section`, `Card`, `Badge`, `Button`, `Input`, `Dialog`, `Pagination`, `EmptyState`, `Tooltip`, `List`/`ListItem`, `WakePulse`, `Terminal`, `InstallBlock`, etc.) is the source of truth for visual primitives. Raw HTML in either dashboard or marketing files drifts from those tokens silently.
-
-**Marketing-display typography — primitives now exist.** `<DisplayXL>` (marketing hero `<h1>`, `text-fluid-hero`) and `<DisplayLG>` (section heads `<h2>`, `text-fluid-display-lg`) ship from `@usezombie/design-system` and compose `font-mono` + the fluid text/leading/tracking tokens internally. Use them on marketing-display surfaces. Raw `<h1>+utilities` is no longer the carve-out — UI GATE blocks it. The dashboard's `<PageTitle>` (`text-heading ≈ 18px`) remains the correct primitive for app surfaces.
-
-This gate enforces "use the primitive when one exists" without enumerating the primitives in this rule (so the rule scales as the design-system grows).
-
-## Pre-edit check
-
-1. Read (or recall) the design-system index. Treat its exports as the substitute set.
-2. For each raw HTML element your edit adds (`<section>`, `<button>`, `<input>`, `<article>`, `<dialog>`, `<dl>`, `<table>`, `<nav>`, `<header>`, `<form>`, etc.), check the index for a matching primitive. If one exists, use it.
-3. Use `asChild` when you need the underlying HTML tag for semantics:
-
-   ```tsx
-   <Section asChild>
-     <section aria-label="...">…</section>
-   </Section>
-   ```
-
-## Required output (default — one line)
-
-```
-UI GATE: <file> | primitives:<list> | raw-kept:<list with one-word reason each | none>
-```
-
-Multi-line block fires only when raw-kept is non-empty:
-
-```
-UI GATE: <file>
-  Primitives used: <list>
-  Raw HTML kept:
-    - <element>: <reason>  (e.g. "ul: no DS primitive")
-    - ...
-```
-
-## Self-audit (end-of-turn)
-
-```bash
-git diff -U0 HEAD -- 'ui/packages/app/**/*.tsx' 'ui/packages/website/src/**/*.tsx' \
-  | grep -v -E '\.test\.tsx|tests/e2e/' \
-  | grep -E '^\+.*<(section|button|input|dialog|article|nav|header|form)\b' \
-  | head
-```
-
-Non-empty is a violation unless every match has a printed "Raw HTML kept" justification in the corresponding gate block.
diff --git a/docs/gates/verification.md b/docs/gates/verification.md
deleted file mode 100644
index 5a0606e..0000000
--- a/docs/gates/verification.md
+++ /dev/null
@@ -1,71 +0,0 @@
-# 🚧 Verification Gate
-
-**Family:** Verification & ship-readiness. **Source:** `AGENTS.md` (project-side guard). Tier definitions and `make` target ownership live in this file.
-
-**Triggers** — fires before any user-facing message asserting work is verified: "tests pass", "ready to merge", "shipping", "ready for review", "CHORE(close) ready", or any equivalent.
-
-**Override:** `VERIFY GATE: <target> skipped per environment constraint (reason: ...)`. Only when a target is genuinely unrunnable (e.g. Docker missing for integration tests). Call out the limitation in the done message — not as "tests pass".
-
-## Why `make` is canonical
-
-Package-scoped runners (`bun run test`, `vitest <file>`, `zig build test` without integration tier) are **not** verification — they skip cross-package lint, cross-compile, pg-drain, and integration. `make` targets are the canonical gates.
-
-## Required runs
-
-| Target | When |
-|---|---|
-| `make lint` | Always. |
-| `make test` | Always (tier 1). |
-| `make test-integration` | Tier 2: when diff touches HTTP handlers, schema, DB code, Redis code, or any `_integration_test.zig` file. Use `make test-integration-db` / `make test-integration-redis` for focused subsets. |
-| `make test-integration` | Tier 3: at least once per branch before declaring ship-ready. From a clean state (e.g. after `make down`) when tier 2 is intermittent — fresh DB proves no state carry-over. |
-| `make memleak` | Server lifecycle (`src/http/**`, `src/cmd/serve.zig`), allocator wiring, cross-thread heap ownership. |
-| `make bench` (local) | When the diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
-| `API_BENCH_URL=https://api-dev.usezombie.com/healthz make bench` | After branch deploys to dev. |
-| Cross-compile `x86_64-linux` + `aarch64-linux` | Whenever `*.zig` touched. |
-| `make check-pg-drain` | Whenever `*.zig` touched. |
-
-`make test` is unit-only by definition; never substitutes for tier 2/3.
-
-Tier 2 passing but tier 3 failing means state pollution — fix isolation before shipping.
-
-## Memleak evidence rule
-
-Before CHORE(close) reports green, paste the final `make memleak` result line into the PR Session Notes block OR cite the CI memleak job URL. Branches touching `src/http/**`, `src/cmd/serve.zig`, or allocator wiring MUST include the last 3 lines verbatim. No "I ran it, trust me."
-
-## Bench knobs
-
-`make/test-bench.mk` env vars: `API_BENCH_METHOD`, `API_BENCH_DURATION_SEC`, `API_BENCH_CONCURRENCY`, `API_BENCH_TIMEOUT_MS`, `API_BENCH_MAX_ERROR_RATE`, `API_BENCH_MAX_P95_MS`, `API_BENCH_MAX_RSS_GROWTH_MB`.
-
-## Required output (done-message)
-
-**Success:**
-
-```
-✅ Verified: 🧪 lint ✓ · 🧪 test ✓ <N>p/<M>s · 🧩 test-integration ✓ (or N/A — no handler/schema/redis) · 🎯 cross-compile ✓ (zig only)
-```
-
-**Failure (any required target failed):**
-
-```
-🔴 NOT VERIFIED: <target> ✗ — <one-line reason>
-```
-
-**Skipped (environment constraint, not a pass):**
-
-```
-⚠️ <target> skipped per environment constraint (reason: ...)
-```
-
-A skipped target MUST be surfaced — never dressed up as "tests pass".
-
-## Emoji legend
-
-| Glyph | Meaning |
-|---|---|
-| ✅ | Verified — all required targets passed |
-| 🔴 | Verification failed — at least one target failed |
-| ⚠️ | Skipped per environment constraint — read the reason |
-| 🧪 | Lint / unit / integration test |
-| 🧩 | Integration test (cross-process) |
-| 🎯 | Cross-compile target |
-| 🔆 | Informational note (does not affect verdict) |
diff --git a/docs/gates/zig.md b/docs/gates/zig.md
deleted file mode 100644
index a26a916..0000000
--- a/docs/gates/zig.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# 🚧 ZIG GATE
-
-**Family:** Zig discipline (umbrella). **Source:** `docs/ZIG_RULES.md`. **Sub-gates:** Pub Surface & Struct-Shape (`docs/gates/pub-surface.md`), File & Function Length (`docs/gates/file-length.md`).
-
-**Triggers** — every `Edit`/`Write` to a `*.zig` file outside `vendor/`, `third_party/`, `.zig-cache/`. Tests are in scope — drain/errdefer/ownership rules apply equally.
-
-**Override:** `ZIG GATE: SKIPPED per user override (reason: ...)`. **User-invokable only.**
-
-## What this gate covers
-
-`docs/ZIG_RULES.md` codifies Zig discipline: drain/dupe, errdefer, ownership, sentinel, cross-compile, TLS, `pub` audit, file-as-struct shape, snake_case. Drift is silent until a leak/UAF/build break surfaces in production.
-
-The **Pub Surface & Struct-Shape Gate** (see `docs/gates/pub-surface.md`) and **File & Function Length Gate** (see `docs/gates/file-length.md`) are sub-gates of this one — the broader Zig discipline is the umbrella.
-
-## Pre-edit check
-
-Recall the relevant `docs/ZIG_RULES.md` section for the change pattern:
-
-| Pattern | Rule |
-|---|---|
-| DB code (`conn.query()` / `conn.exec()`) | Drain before deinit. `make check-pg-drain` verifies. |
-| Allocator | Dupe before parent deinit; errdefer in reverse construction order. |
-| New `pub` symbol | PUB GATE fires (see `docs/gates/pub-surface.md`). |
-| File growth | LENGTH GATE (see `docs/gates/file-length.md`). |
-| New file under `src/cmd/` | Cross-compile required: `zig build -Dtarget=x86_64-linux && zig build -Dtarget=aarch64-linux`. |
-
-Verify each rule applies or is N/A for this edit.
-
-## Required output (default — one line)
-
-```
-ZIG GATE: <file> | drain:<ok|N/A> errdefer:<ok|N/A> dupe:<ok|N/A> pub:<see PUB|N/A> length:<see LENGTH|N/A>
-```
-
-Comment-only edit:
-
-```
-ZIG GATE: <file> | comment-only | N/A
-```
-
-Full multi-line block fires only when a sub-rule reports a violation:
-
-```
-ZIG GATE: <file>
-  ZIG_RULES.md sections consulted: <e.g. drain, errdefer, pub, length, cross-compile>
-  Drain discipline: <conn.query → .drain() before deinit ✓ | violation: <where>>
-  Dupe before parent deinit: <ok | violation: <where>>
-  errdefer ordering: <reverse-construction | violation: <where>>
-  Sentinel/null handling: <ok | violation: <where>>
-  Pub surface: <see PUB GATE block | violation>
-  Length: <see LENGTH GATE block | violation>
-```
diff --git a/docs/greptile-learnings/RULES.md b/docs/greptile-learnings/RULES.md
index 1b1112a..a3ecd8a 100644
--- a/docs/greptile-learnings/RULES.md
+++ b/docs/greptile-learnings/RULES.md
@@ -9,6 +9,46 @@ Reference a rule as `RULE NDC`, `RULE OWN`, etc.
 
 ---
 
+## Rule-code gloss legend (canonical)
+
+The single source of truth for every rule-code gloss. `dispatch/lib.sh`
+(`DISPATCH_GLOSS`) mirrors this table verbatim, and
+`evals/dispatch/coverage.sh` fails on any divergence — a code present in
+one but not the other, or a gloss whose text differs by a byte. No naked codes:
+every code a dispatch `.sh` emits resolves to exactly one row here.
+
+| CODE | Gloss |
+|---|---|
+| NDC | No Dead Code |
+| NLR | No Legacy Retained (touch-it-fix-it) |
+| NLG | No Legacy compat shims (pre-v2.0.0) |
+| UFS | Unified Form for Symbols (literals → named consts) |
+| TGU | Tagged-Union over optional-field structs |
+| PRI | Prompt-injection Resistance from user Input |
+| ORP | ORPhan sweep (cross-layer on rename/delete) |
+| FLL | File & Function Length Limits |
+| TST-NAM | TeST NAMing (milestone-free) |
+| PUB | Pub Surface & Struct-Shape |
+| DRAIN | pg.Conn drain-before-deinit |
+| DEINIT | init/deinit lifecycle pairing |
+| ARCH | Architecture consult before naming |
+| XCOMPILE | Cross-compile both linux targets |
+| FSD | File Shape Decision (file-as-struct vs operations-over-value) |
+| DIDEM | Deinit IDEMpotency (cleanup double-call safe / single-shot asserted) |
+| TSC | TypeScript/Bun lint conventions (const, import, naming, anti-patterns) |
+| TSJ | TypeScript/Bun judgment conventions (Bun-native, file ordering, error style) |
+| UIS | UI Substitution (design-system primitive over raw HTML) |
+| DTK | Design ToKens (named token utility over arbitrary value) |
+| SCH | SCHema teardown (pre-2.0 full removal; no ALTER/DROP/marker) |
+| ITF | Integration Test Fixtures (real schema, not TEMP-table mock) |
+| LOG | LOGging discipline (scoped event, error_code, severity, redaction) |
+| MSID | Milestone-ID ban in source (M{N}_{NNN} / §x.y / T{N} / dim) |
+| ERR | ERror Registry (UZ-XXX-NNN declared + referenced) |
+| GRP | GREptile rule audit (diff vs greptile-learnings/RULES.md codes) |
+| LDC | Legacy-Design Consult (A remove / B patch / C keep) |
+
+---
+
 ## RULE NDC — No dead code
 
 **Rule:** Remove unused variables, imports, parameters, and unreachable branches immediately.
@@ -16,6 +56,13 @@ Reference a rule as `RULE NDC`, `RULE OWN`, etc.
 **Tags:** zig, js, all
 **Ref:** M1_001 unused deps in zombie.js; dead currentObj branch in simpleYamlParse. M30_002 dead CLI variables.
 
+## RULE NRC — No redundant comments
+
+**Rule:** Skip the comment when a well-named identifier, type, or signature already carries the intent. Add a comment only when removing it would leave a future agent (Orly included) genuinely confused — i.e. it explains a *why* the code itself cannot: a non-obvious constraint, an ordering dependency, the reason a workaround exists, or an invariant the types don't encode. Never write a comment that just restates the next line. Subtractive test: delete the comment; if nothing is lost, it was redundant.
+**Why:** Redundant comments drift out of sync with the code they narrate and train readers to skim past comments entirely — so the one load-bearing comment gets skipped too. A precise name is a comment that cannot drift; spend the words on the name, not the narration.
+**Tags:** all, zig, js, ts, py, sh, go, rs, style
+**Ref:** User directive (Indy, Jun 04, 2026) — a well-named identifier beats a comment; a comment earns its place only by preventing future-agent confusion.
+
 ## RULE NLR — No legacy retained (touch-it-fix-it)
 
 **Rule:** Any edit to a file that contains pre-existing legacy framing or dead code MUST remove the legacy/dead code in the same diff. Patterns: `?*T = null` fields with no real null caller, `legacy_*` symbol names, `V2`-twin types, `if (legacy_caller)` branches, `// legacy` / `// bootstrap` / `// pre-M*` comments, runtime warn logs saying "legacy path" / "deprecated", pub symbols with no in-tree consumer, defensive `?T` patterns compensating for what should be `T`. Verify "no caller" with `grep -rn`. The "pre-existing violations are not the agent's responsibility" carve-out does NOT apply when the agent is already opening the file. If cleanup > ~200 net lines, abort and file a cleanup spec first; do not commit a partial cleanup.
@@ -32,7 +79,7 @@ Reference a rule as `RULE NDC`, `RULE OWN`, etc.
 
 ## RULE OWN — One owner per resource — no double cleanup
 
-**Rule:** Every allocation has exactly one cleanup path — errdefer OR manual free, never both on the same pointer. For multi-step init, use the sequential errdefer chain (see ZIG_RULES.md "Multi-Step Init"). For shared ownership, use `ref()`/`unref()` with an atomic refcount — `unref()` destroys when count hits zero. Raw pointer field = borrowed (caller owns); refcounted field = owned (self manages).
+**Rule:** Every allocation has exactly one cleanup path — errdefer OR manual free, never both on the same pointer. For multi-step init, use the sequential errdefer chain (see dispatch/write_zig.md "Multi-Step Init"). For shared ownership, use `ref()`/`unref()` with an atomic refcount — `unref()` destroys when count hits zero. Raw pointer field = borrowed (caller owns); refcounted field = owned (self manages).
 **Why:** Two cleanup paths = double-free on the error path. The bvisor encoding (raw ptr = borrowed, refcount = owned) makes the ownership contract readable from the type alone.
 **Tags:** zig, memory
 **Ref:** M1_001 manual alloc.free() + errdefer on same pointer = double-free. bvisor Thread.zig, ThreadGroup.zig for ref/unref pattern.
@@ -81,7 +128,7 @@ Reference a rule as `RULE NDC`, `RULE OWN`, etc.
 
 ## RULE FLS — Flush all layers — drain all results
 
-**Rule:** After TLS flush, also flush the socket layer. Cast UUID/JSONB to ::text in SELECT. For pg results: use `PgQuery` (see ZIG_RULES.md "Pg Query Wrapper") — `defer q.deinit()` auto-drains. Manual `q.drain() catch {}; q.deinit()` on early-exit paths is eliminated by the wrapper.
+**Rule:** After TLS flush, also flush the socket layer. Cast UUID/JSONB to ::text in SELECT. For pg results: use `PgQuery` (see dispatch/write_zig.md "Pg Query Wrapper") — `defer q.deinit()` auto-drains. Manual `q.drain() catch {}; q.deinit()` on early-exit paths is eliminated by the wrapper.
 **Why:** TLS flush only encrypts into buffer; undrained slices dangle; ::text prevents binary/text divergence across OS.
 **Tags:** zig, tls, postgres
 **Ref:** M22_001 missing socket flush → infinite hang. M1_001 UUID read as binary on Linux CI, text on macOS. M10_004 PgQuery wraps drain into deinit.
@@ -451,7 +498,7 @@ This is intentionally manual — the structural diversity of "function body" acr
 **Rule:** Never use `@embedFile` to reach files outside `src/`. For external files (OpenAPI specs, config fixtures), write a Python/shell validator and wire it into a `make` target under `lint-zig`.
 **Why:** Zig's embed security model restricts `@embedFile` to the package directory. `@embedFile("../../public/openapi.json")` is a hard compile error, not a runtime failure. There is no workaround except an external script.
 **Tags:** zig, comptime, testing
-**Ref:** M11_001 §3.1 — OpenAPI ErrorBody validation moved to scripts/check_openapi_errors.py + make check-openapi-errors.
+**Ref:** M11_001 §3.1 — OpenAPI ErrorBody validation moved to audits/check_openapi_errors.py + make check-openapi-errors.
 
 ## RULE SNT — ~~Registry sentinels must be distinct from real entries~~ ELIMINATED (M16_001)
 
@@ -821,7 +868,7 @@ const handleConfirm = useCallback(async () => {
 ## RULE MKP — Make recipes must not pipe into `tail`, `head`, `grep` without `set -o pipefail`
 
 **Rule:** Inside a Make recipe, do NOT pipe a command whose exit code matters into `tail`, `head`, `grep`, `cat`, or any other filter — Make's default shell (`/bin/sh`) evaluates pipelines with the exit code of the LAST command. A failing test/script piped through `| tail -3` returns 0 because `tail` always succeeds, and the recipe (and the enclosing `make lint` / `make openapi`) falsely succeeds. Either (a) drop the pipe, (b) run the command standalone and let Make's line-level exit-on-error abort on failure, or (c) if a filter is genuinely needed, use `bash -c 'set -o pipefail; cmd | filter'`.
-**Why:** Silent test swallow is a class-C outage — the gate claims green while regressions ship. Observed on M28_003 §2 where `@python3 scripts/test_check_openapi_sync.py 2>&1 | tail -3` in `make openapi` passed a failing-test injection without aborting. Greptile P1 caught it before merge; the root cause (Make + default `sh` POSIX pipefail semantics) is the same bug anywhere a recipe uses `|` to tidy long output.
+**Why:** Silent test swallow is a class-C outage — the gate claims green while regressions ship. Observed on M28_003 §2 where `@python3 audits/test_check_openapi_sync.py 2>&1 | tail -3` in `make openapi` passed a failing-test injection without aborting. Greptile P1 caught it before merge; the root cause (Make + default `sh` POSIX pipefail semantics) is the same bug anywhere a recipe uses `|` to tidy long output.
 **Tags:** make, ci, testing
 **Ref:** usezombie P2_INFRA_M28_003 §2 — `make/quality.mk:161` before fix piped the test runner through `tail -3`; fix in commit 66556e99 dropped the pipe, confirmed with injected `self.fail()` that `make: *** [openapi] Error 1` now fires correctly.
 
diff --git a/evals/dispatch/coverage.sh b/evals/dispatch/coverage.sh
new file mode 100755
index 0000000..a1e69ac
--- /dev/null
+++ b/evals/dispatch/coverage.sh
@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# evals/dispatch/coverage.sh — coherence audit for the dispatch façade
+# pairs (DISPATCH_ARCHITECTURE.md 6.3 + 6.4).
+#
+# Proves COMPLETENESS and SYMBOL-PRESENCE across five artifacts — the latent
+# .md tags, the deterministic .sh dispatch rows, the prose-pinned fixtures, the
+# comprehension probes, and the canonical gloss legend. It does NOT judge prose
+# semantics (that is the dispatch-evals fixtures' job, 6.1). Fails (exit 1) if:
+#
+#   (a) a [DETERMINISTIC → CODE] tag has no row for CODE in ANY dispatch .sh.
+#       Universal-code carve-out (Decision 6): a code wired once in its home
+#       façade (e.g. UFS in write_any) satisfies the tag wherever it appears.
+#   (b) a run-enforced DETERMINISTIC code has no pass+fail fixture in run.sh.
+#       Delegated codes (dispatch_delegate) and TODO-CHECK/NEW: are exempt.
+#   (c) a [JUDGMENT → CODE] tag has no comprehension probe in fixtures.jsonl.
+#   (d) a .sh CODE row has no tag in any dispatch .md (orphan check, global).
+#   (e) a dispatch_run_helper delegates to a leaf that is absent/non-executable.
+#   (f) a code emitted by a .sh row has no entry in lib.sh DISPATCH_GLOSS.
+#   (g) the RULES.md canonical gloss legend diverges from lib.sh DISPATCH_GLOSS.
+#
+# Exemptions are deliberate: TODO-CHECK marks a build-the-check stub; NEW:<name>
+# marks a proposed-not-yet-existing code; both predate any .sh row, fixture, or
+# probe by definition. Run from the dotfiles repo root (dotfiles-internal, like
+# dispatch-evals — not synced into product repos).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+RES="$ROOT/dispatch"
+SCR="$ROOT/audits"
+RULES="$ROOT/docs/greptile-learnings/RULES.md"
+EVALS="$ROOT/evals/dispatch/run.sh"
+PROBES="$ROOT/evals/llms/fixtures.jsonl"
+
+if [[ -t 1 ]]; then G=$'\033[32m'; R=$'\033[31m'; BO=$'\033[1m'; X=$'\033[0m'
+else G=''; R=''; BO=''; X=''; fi
+RC=0
+fail() { printf '    %s🔴 %s%s\n' "$R" "$1" "$X"; RC=1; }
+okln() { printf '    %s🟢%s %s\n' "$G" "$X" "$1"; }
+sec()  { printf '\n%s%s%s\n' "$BO" "$1" "$X"; }
+
+# ---- extraction (grep -oE + sed; no awk — macOS BWK-awk portability) --------
+# Tag codes by kind. The legend placeholder [DETERMINISTIC → <CODE>] is excluded
+# automatically: '<' is not in the code character class.
+det_tags() { grep -hoE '\[DETERMINISTIC → [A-Z0-9_:-]+\]' "$RES"/*.md \
+  | sed -E 's/.* → ([A-Z0-9_:-]+)\]/\1/' | sort -u; }
+jud_tags() { grep -hoE '\[JUDGMENT → [A-Z0-9_:-]+\]' "$RES"/*.md \
+  | sed -E 's/.* → ([A-Z0-9_:-]+)\]/\1/' | sort -u; }
+# A code is exempt from check (a)/(c) if it is a stub or proposed marker.
+real() { grep -vE '^(TODO-CHECK|NEW:)'; }
+
+# .sh dispatch rows, classified by the lib.sh helper that wraps them. Real .sh
+# codes are [A-Z0-9_-] only (no colon) — colon codes (NEW:*) are .md-tag-only
+# proposed markers, never legal in a live dispatch row; this class matches the
+# gloss/fixture extractors below so all .sh-code handling agrees.
+sh_runhelper() { grep -hoE '^dispatch_run_helper +"[A-Z0-9_-]+"' "$RES"/*.sh \
+  | sed -E 's/.*"([A-Z0-9_-]+)"/\1/' | sort -u; }
+sh_delegate() { grep -hoE '^dispatch_delegate +"[A-Z0-9_-]+"' "$RES"/*.sh \
+  | sed -E 's/.*"([A-Z0-9_-]+)"/\1/' | sort -u; }
+sh_judgment() { grep -hoE '^dispatch_judgment +"[A-Z0-9_-]+"' "$RES"/*.sh \
+  | sed -E 's/.*"([A-Z0-9_-]+)"/\1/' | sort -u; }
+sh_lengthgate() { grep -qE '^dispatch_length_gate ' "$RES"/*.sh && echo FLL; }
+# run_helper rows as "CODE script" pairs (for the leaf-presence check).
+sh_helper_pairs() { grep -hoE '^dispatch_run_helper +"[A-Z0-9_-]+" +"[^"]+"' "$RES"/*.sh \
+  | sed -E 's/^dispatch_run_helper +"([A-Z0-9_-]+)" +"([^"]+)".*/\1 \2/'; }
+
+# Run-enforced (needs fixture) vs all-emitted (needs tag + gloss).
+run_enforced() { { sh_lengthgate; sh_runhelper; } | sort -u; }
+all_sh_codes() { { sh_lengthgate; sh_runhelper; sh_delegate; sh_judgment; } | sort -u; }
+
+# Set membership: is $1 a line in the newline list on stdin?
+in_list() { grep -qxF "$1"; }
+
+# ---- check (a) — every DETERMINISTIC tag has a run/delegate .sh row ---------
+check_tag_to_check() {
+  sec "(a) DETERMINISTIC tag → .sh row (universal-code carve-out, global)"
+  local backed code; backed="$( { run_enforced; sh_delegate; } | sort -u )"
+  while IFS= read -r code; do
+    [ -z "$code" ] && continue
+    if printf '%s\n' "$backed" | in_list "$code"; then okln "$code — wired in some dispatch .sh"
+    else fail "$code — DETERMINISTIC tag with no run/delegate row in any dispatch .sh"; fi
+  done < <(det_tags | real)
+}
+
+# ---- check (b) — run-enforced code has pass+fail fixture --------------------
+check_fixture_coverage() {
+  sec "(b) run-enforced DETERMINISTIC code → pass+fail fixture (delegated exempt)"
+  local specs; specs="$(grep -oE '"[^"]+\.zig\|[^"]+\|[01]\|[A-Z0-9_-]+"' "$EVALS" | tr -d '"')"
+  local code has0 has1 line ex c
+  while IFS= read -r code; do
+    [ -z "$code" ] && continue
+    has0=0; has1=0
+    while IFS='|' read -r _ _ _ ex c; do
+      [ "$c" = "$code" ] || continue
+      [ "$ex" = "0" ] && has0=1; [ "$ex" = "1" ] && has1=1
+    done <<<"$specs"
+    if [ "$has0" = 1 ] && [ "$has1" = 1 ]; then okln "$code — pass + fail fixture present"
+    else fail "$code — missing $([ $has0 = 0 ] && echo pass) $([ $has1 = 0 ] && echo fail) fixture in dispatch-evals"; fi
+  done < <(run_enforced | real)
+}
+
+# ---- check (c) — every JUDGMENT tag has a comprehension probe ---------------
+check_probe_coverage() {
+  sec "(c) JUDGMENT tag → comprehension probe (fixtures.jsonl mode dispatch-judgment-<code>)"
+  local code lc
+  while IFS= read -r code; do
+    [ -z "$code" ] && continue
+    lc="$(printf '%s' "$code" | tr '[:upper:]' '[:lower:]')"
+    if grep -qF "\"mode\":\"dispatch-judgment-$lc\"" "$PROBES"; then okln "$code — probe present"
+    else fail "$code — JUDGMENT tag with no comprehension probe (expected mode dispatch-judgment-$lc)"; fi
+  done < <(jud_tags | real)
+}
+
+# ---- check (d) — orphan: every .sh code is tagged somewhere -----------------
+check_orphan() {
+  sec "(d) .sh code → tag in some dispatch .md (orphan check, global)"
+  local tags code; tags="$( { det_tags; jud_tags; } | sort -u )"
+  while IFS= read -r code; do
+    [ -z "$code" ] && continue
+    if printf '%s\n' "$tags" | in_list "$code"; then okln "$code — tagged in some .md"
+    else fail "$code — .sh dispatch row with no [.. → $code] tag in any dispatch .md"; fi
+  done < <(all_sh_codes)
+}
+
+# ---- check (e) — run_helper leaf present + executable -----------------------
+check_leaf_presence() {
+  sec "(e) dispatch_run_helper leaf present + executable"
+  local code script path
+  while read -r code script; do
+    [ -z "$code" ] && continue
+    path="$SCR/$script"
+    if [ -f "$path" ] && [ -x "$path" ]; then okln "$code → audits/$script (present, executable)"
+    else fail "$code → audits/$script absent or non-executable — silent-green hole"; fi
+  done < <(sh_helper_pairs)
+}
+
+# ---- check (f) — no naked codes: every .sh code has a lib.sh gloss ----------
+gloss_lib() { grep -E '^[[:space:]]*\[[A-Z0-9_-]+\]="' "$RES/lib.sh" \
+  | sed -E 's/^[[:space:]]*\[([A-Z0-9_-]+)\]="(.*)"[[:space:]]*$/\1\t\2/'; }
+check_gloss_presence() {
+  sec "(f) .sh code → lib.sh DISPATCH_GLOSS entry (no naked codes)"
+  local codes code; codes="$(gloss_lib | cut -f1)"
+  while IFS= read -r code; do
+    [ -z "$code" ] && continue
+    if printf '%s\n' "$codes" | in_list "$code"; then okln "$code — gloss present"
+    else fail "$code — emitted by a .sh row but has no DISPATCH_GLOSS entry"; fi
+  done < <(all_sh_codes)
+}
+
+# ---- check (g) — RULES.md canonical legend == lib.sh DISPATCH_GLOSS ---------
+gloss_rules() { sed -n '/^## Rule-code gloss legend (canonical)/,/^## RULE NDC/p' "$RULES" \
+  | grep -E '^\| [A-Z0-9_-]+ \|' | grep -vE '^\| CODE \|' \
+  | sed -E 's/^\| ([A-Z0-9_-]+) \| (.*) \|$/\1\t\2/'; }
+check_gloss_divergence() {
+  sec "(g) RULES.md canonical legend ↔ lib.sh DISPATCH_GLOSS (byte-identical map)"
+  local nl nr; nl="$(gloss_lib | wc -l | tr -d ' ')"; nr="$(gloss_rules | wc -l | tr -d ' ')"
+  if [ "$nl" -eq 0 ] || [ "$nr" -eq 0 ]; then
+    fail "gloss legend parsed to 0 rows (lib.sh=$nl, RULES.md=$nr) — heading/format reworded? empty≠identical"
+    return
+  fi
+  local d; d="$(diff <(gloss_lib | sort) <(gloss_rules | sort) || true)"
+  if [ -z "$d" ]; then okln "gloss maps identical ($nl codes)"
+  else fail "gloss divergence between lib.sh and RULES.md:"; printf '%s\n' "$d" | sed 's/^/        /'; fi
+}
+
+printf '%sDISPATCH COVERAGE AUDIT — façade-pair coherence (6.3 + 6.4)%s\n' "$BO" "$X"
+check_tag_to_check
+check_fixture_coverage
+check_probe_coverage
+check_orphan
+check_leaf_presence
+check_gloss_presence
+check_gloss_divergence
+
+if [ "$RC" -eq 0 ]; then printf '\n%s✅ DISPATCH COVERAGE: ALL CHECKS PASSED%s\n' "$G$BO" "$X"
+else printf '\n%s❌ DISPATCH COVERAGE: coherence gaps above — fix before commit%s\n' "$R$BO" "$X"; fi
+exit "$RC"
diff --git a/evals/dispatch/fixtures/deinit_missing.zig b/evals/dispatch/fixtures/deinit_missing.zig
new file mode 100644
index 0000000..af2b76f
--- /dev/null
+++ b/evals/dispatch/fixtures/deinit_missing.zig
@@ -0,0 +1,8 @@
+const std = @import("std");
+pub const Widget = struct {
+    items: []u32,
+    pub fn init(alloc: std.mem.Allocator) !Widget {
+        const items = try alloc.alloc(u32, 8);
+        return .{ .items = items };
+    }
+};
diff --git a/evals/dispatch/fixtures/deinit_ok.zig b/evals/dispatch/fixtures/deinit_ok.zig
new file mode 100644
index 0000000..8d921b4
--- /dev/null
+++ b/evals/dispatch/fixtures/deinit_ok.zig
@@ -0,0 +1,12 @@
+const std = @import("std");
+pub const Widget = struct {
+    items: []u32,
+    alloc: std.mem.Allocator,
+    pub fn init(alloc: std.mem.Allocator) !Widget {
+        const items = try alloc.alloc(u32, 8);
+        return .{ .items = items, .alloc = alloc };
+    }
+    pub fn deinit(self: *Widget) void {
+        self.alloc.free(self.items);
+    }
+};
diff --git a/evals/dispatch/fixtures/length_350_pass.zig b/evals/dispatch/fixtures/length_350_pass.zig
new file mode 100644
index 0000000..1ff69da
--- /dev/null
+++ b/evals/dispatch/fixtures/length_350_pass.zig
@@ -0,0 +1,350 @@
+// length fixture line 1 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 2 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 3 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 4 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 5 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 6 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 7 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 8 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 9 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 10 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 11 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 12 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 13 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 14 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 15 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 16 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 17 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 18 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 19 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 20 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 21 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 22 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 23 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 24 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 25 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 26 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 27 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 28 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 29 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 30 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 31 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 32 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 33 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 34 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 35 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 36 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 37 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 38 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 39 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 40 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 41 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 42 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 43 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 44 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 45 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 46 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 47 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 48 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 49 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 50 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 51 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 52 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 53 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 54 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 55 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 56 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 57 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 58 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 59 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 60 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 61 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 62 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 63 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 64 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 65 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 66 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 67 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 68 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 69 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 70 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 71 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 72 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 73 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 74 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 75 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 76 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 77 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 78 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 79 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 80 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 81 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 82 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 83 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 84 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 85 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 86 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 87 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 88 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 89 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 90 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 91 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 92 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 93 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 94 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 95 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 96 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 97 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 98 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 99 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 100 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 101 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 102 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 103 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 104 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 105 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 106 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 107 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 108 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 109 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 110 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 111 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 112 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 113 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 114 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 115 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 116 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 117 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 118 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 119 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 120 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 121 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 122 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 123 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 124 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 125 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 126 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 127 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 128 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 129 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 130 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 131 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 132 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 133 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 134 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 135 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 136 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 137 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 138 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 139 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 140 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 141 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 142 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 143 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 144 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 145 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 146 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 147 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 148 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 149 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 150 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 151 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 152 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 153 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 154 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 155 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 156 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 157 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 158 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 159 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 160 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 161 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 162 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 163 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 164 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 165 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 166 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 167 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 168 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 169 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 170 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 171 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 172 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 173 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 174 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 175 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 176 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 177 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 178 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 179 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 180 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 181 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 182 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 183 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 184 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 185 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 186 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 187 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 188 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 189 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 190 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 191 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 192 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 193 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 194 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 195 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 196 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 197 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 198 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 199 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 200 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 201 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 202 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 203 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 204 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 205 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 206 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 207 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 208 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 209 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 210 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 211 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 212 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 213 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 214 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 215 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 216 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 217 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 218 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 219 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 220 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 221 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 222 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 223 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 224 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 225 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 226 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 227 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 228 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 229 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 230 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 231 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 232 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 233 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 234 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 235 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 236 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 237 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 238 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 239 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 240 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 241 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 242 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 243 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 244 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 245 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 246 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 247 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 248 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 249 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 250 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 251 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 252 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 253 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 254 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 255 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 256 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 257 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 258 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 259 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 260 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 261 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 262 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 263 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 264 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 265 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 266 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 267 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 268 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 269 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 270 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 271 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 272 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 273 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 274 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 275 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 276 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 277 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 278 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 279 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 280 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 281 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 282 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 283 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 284 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 285 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 286 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 287 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 288 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 289 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 290 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 291 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 292 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 293 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 294 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 295 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 296 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 297 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 298 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 299 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 300 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 301 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 302 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 303 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 304 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 305 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 306 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 307 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 308 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 309 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 310 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 311 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 312 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 313 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 314 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 315 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 316 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 317 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 318 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 319 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 320 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 321 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 322 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 323 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 324 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 325 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 326 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 327 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 328 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 329 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 330 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 331 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 332 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 333 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 334 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 335 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 336 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 337 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 338 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 339 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 340 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 341 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 342 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 343 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 344 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 345 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 346 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 347 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 348 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 349 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 350 — pins the 350 file cap (write_zig.sh::length)
diff --git a/evals/dispatch/fixtures/length_351_fail.zig b/evals/dispatch/fixtures/length_351_fail.zig
new file mode 100644
index 0000000..017fbf5
--- /dev/null
+++ b/evals/dispatch/fixtures/length_351_fail.zig
@@ -0,0 +1,351 @@
+// length fixture line 1 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 2 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 3 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 4 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 5 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 6 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 7 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 8 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 9 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 10 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 11 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 12 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 13 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 14 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 15 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 16 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 17 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 18 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 19 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 20 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 21 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 22 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 23 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 24 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 25 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 26 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 27 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 28 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 29 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 30 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 31 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 32 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 33 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 34 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 35 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 36 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 37 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 38 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 39 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 40 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 41 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 42 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 43 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 44 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 45 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 46 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 47 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 48 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 49 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 50 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 51 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 52 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 53 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 54 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 55 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 56 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 57 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 58 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 59 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 60 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 61 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 62 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 63 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 64 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 65 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 66 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 67 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 68 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 69 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 70 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 71 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 72 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 73 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 74 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 75 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 76 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 77 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 78 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 79 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 80 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 81 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 82 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 83 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 84 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 85 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 86 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 87 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 88 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 89 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 90 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 91 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 92 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 93 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 94 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 95 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 96 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 97 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 98 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 99 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 100 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 101 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 102 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 103 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 104 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 105 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 106 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 107 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 108 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 109 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 110 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 111 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 112 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 113 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 114 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 115 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 116 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 117 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 118 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 119 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 120 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 121 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 122 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 123 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 124 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 125 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 126 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 127 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 128 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 129 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 130 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 131 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 132 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 133 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 134 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 135 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 136 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 137 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 138 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 139 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 140 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 141 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 142 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 143 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 144 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 145 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 146 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 147 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 148 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 149 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 150 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 151 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 152 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 153 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 154 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 155 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 156 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 157 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 158 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 159 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 160 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 161 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 162 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 163 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 164 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 165 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 166 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 167 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 168 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 169 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 170 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 171 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 172 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 173 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 174 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 175 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 176 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 177 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 178 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 179 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 180 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 181 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 182 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 183 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 184 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 185 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 186 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 187 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 188 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 189 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 190 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 191 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 192 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 193 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 194 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 195 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 196 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 197 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 198 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 199 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 200 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 201 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 202 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 203 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 204 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 205 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 206 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 207 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 208 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 209 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 210 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 211 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 212 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 213 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 214 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 215 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 216 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 217 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 218 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 219 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 220 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 221 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 222 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 223 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 224 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 225 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 226 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 227 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 228 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 229 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 230 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 231 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 232 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 233 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 234 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 235 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 236 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 237 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 238 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 239 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 240 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 241 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 242 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 243 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 244 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 245 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 246 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 247 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 248 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 249 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 250 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 251 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 252 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 253 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 254 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 255 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 256 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 257 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 258 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 259 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 260 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 261 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 262 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 263 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 264 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 265 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 266 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 267 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 268 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 269 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 270 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 271 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 272 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 273 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 274 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 275 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 276 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 277 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 278 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 279 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 280 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 281 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 282 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 283 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 284 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 285 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 286 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 287 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 288 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 289 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 290 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 291 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 292 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 293 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 294 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 295 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 296 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 297 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 298 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 299 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 300 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 301 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 302 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 303 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 304 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 305 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 306 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 307 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 308 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 309 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 310 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 311 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 312 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 313 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 314 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 315 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 316 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 317 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 318 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 319 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 320 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 321 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 322 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 323 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 324 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 325 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 326 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 327 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 328 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 329 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 330 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 331 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 332 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 333 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 334 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 335 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 336 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 337 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 338 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 339 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 340 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 341 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 342 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 343 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 344 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 345 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 346 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 347 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 348 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 349 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 350 — pins the 350 file cap (write_zig.sh::length)
+// length fixture line 351 — pins the 350 file cap (write_zig.sh::length)
diff --git a/evals/dispatch/fixtures/log_ok.zig b/evals/dispatch/fixtures/log_ok.zig
new file mode 100644
index 0000000..87b3e2a
--- /dev/null
+++ b/evals/dispatch/fixtures/log_ok.zig
@@ -0,0 +1 @@
+const value: u8 = 1;
diff --git a/evals/dispatch/fixtures/log_violation.zig b/evals/dispatch/fixtures/log_violation.zig
new file mode 100644
index 0000000..b6067d5
--- /dev/null
+++ b/evals/dispatch/fixtures/log_violation.zig
@@ -0,0 +1,2 @@
+const std = @import("std");
+pub fn f() void { std.debug.print("trace output", .{}); }
diff --git a/evals/dispatch/fixtures/msid_ok.zig b/evals/dispatch/fixtures/msid_ok.zig
new file mode 100644
index 0000000..87b3e2a
--- /dev/null
+++ b/evals/dispatch/fixtures/msid_ok.zig
@@ -0,0 +1 @@
+const value: u8 = 1;
diff --git a/evals/dispatch/fixtures/msid_violation.zig b/evals/dispatch/fixtures/msid_violation.zig
new file mode 100644
index 0000000..a82c821
--- /dev/null
+++ b/evals/dispatch/fixtures/msid_violation.zig
@@ -0,0 +1,2 @@
+// see M42_007 for the original behaviour
+const value: u8 = 1;
diff --git a/evals/dispatch/fixtures/ufs_dup_string.zig b/evals/dispatch/fixtures/ufs_dup_string.zig
new file mode 100644
index 0000000..a23f319
--- /dev/null
+++ b/evals/dispatch/fixtures/ufs_dup_string.zig
@@ -0,0 +1,2 @@
+const a = foo("repeated_marker_string");
+const b = bar("repeated_marker_string");
diff --git a/evals/dispatch/fixtures/ufs_ok.zig b/evals/dispatch/fixtures/ufs_ok.zig
new file mode 100644
index 0000000..5ffae87
--- /dev/null
+++ b/evals/dispatch/fixtures/ufs_ok.zig
@@ -0,0 +1,2 @@
+const a = foo("unique_string_one");
+const b = bar("unique_string_two");
diff --git a/evals/dispatch/run.sh b/evals/dispatch/run.sh
new file mode 100755
index 0000000..39fa659
--- /dev/null
+++ b/evals/dispatch/run.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# evals/dispatch/run.sh — prose-pinned deterministic-façade evals (DISPATCH_ARCHITECTURE.md 6.1).
+#
+# Each fixture is a source file crafted to trip EXACTLY ONE deterministic dispatch
+# code (or none, for the *_ok pass fixtures). The runner drops it into an isolated
+# git sandbox, stages it, runs the owning dispatch `--staged` from inside the
+# sandbox (so TARGET_ROOT = sandbox and the leaf checks scan the fixture, not
+# dotfiles), and diffs the actual exit against the expected one.
+#
+# Why a sandbox: the leaf checks (audit-ufs / audit-logging / audit-msid-ui /
+# audit-deinit-pairs) scan `git rev-parse --show-toplevel`'s tree (src/*.zig via
+# git ls-files / find src) — never a passed file path. A fixture must therefore
+# live in a git tree they actually scan.
+#
+# The boundary pairs (length_350_pass / length_351_fail) PIN the prose bound: edit
+# write_*.sh's dispatch_length_gate cap and the 351 fixture flips, turning this
+# runner red — the fixture, not a tag, is the drift detector (DISPATCH_ARCHITECTURE
+# §3). ERR is intentionally absent: it is deterministic-but-DELEGATED (its leaf
+# needs the product-repo error_registry.zig), so it has no in-dotfiles fixture
+# (§16 Decision 6 / the delegate is exercised by the product harness instead).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FX="$ROOT/evals/dispatch/fixtures"
+
+# fixture | dispatch | sandbox-dest | expected-exit | code-under-test
+SPECS=(
+  "length_350_pass.zig|write_zig|src/length_350_pass.zig|0|FLL"
+  "length_351_fail.zig|write_zig|src/length_351_fail.zig|1|FLL"
+  "ufs_ok.zig|write_any|src/ufs_ok.zig|0|UFS"
+  "ufs_dup_string.zig|write_any|src/ufs_dup_string.zig|1|UFS"
+  "log_ok.zig|write_any|src/log_ok.zig|0|LOG"
+  "log_violation.zig|write_any|src/log_violation.zig|1|LOG"
+  "msid_ok.zig|write_any|src/msid_ok.zig|0|MSID"
+  "msid_violation.zig|write_any|src/msid_violation.zig|1|MSID"
+  "deinit_ok.zig|write_zig|src/deinit_ok.zig|0|DEINIT"
+  "deinit_missing.zig|write_zig|src/deinit_missing.zig|1|DEINIT"
+)
+
+pass=0
+fail=0
+printf '\ndispatch-evals — prose-pinned deterministic fixtures\n\n'
+for spec in "${SPECS[@]}"; do
+  IFS='|' read -r fx dispatch dest exp code <<<"$spec"
+  sb="$(mktemp -d)"
+  git -C "$sb" init -q
+  git -C "$sb" config user.email evals@local
+  git -C "$sb" config user.name evals
+  mkdir -p "$sb/$(dirname "$dest")"
+  cp "$FX/$fx" "$sb/$dest"
+  git -C "$sb" add -A
+  ( cd "$sb" && bash "$ROOT/dispatch/$dispatch.sh" --staged ) >/dev/null 2>&1
+  act=$?
+  rm -rf "$sb"
+  if [ "$act" = "$exp" ]; then
+    printf '  PASS  %-5s %-22s %s --staged -> exit %s\n' "$code" "$fx" "$dispatch" "$act"
+    pass=$((pass + 1))
+  else
+    printf '  FAIL  %-5s %-22s %s --staged -> exit %s (expected %s)\n' "$code" "$fx" "$dispatch" "$act" "$exp"
+    fail=$((fail + 1))
+  fi
+done
+printf '\n%d passed, %d failed\n' "$pass" "$fail"
+[ "$fail" -eq 0 ]
diff --git a/scripts/llmevals/fixtures.jsonl b/evals/llms/fixtures.jsonl
similarity index 68%
rename from scripts/llmevals/fixtures.jsonl
rename to evals/llms/fixtures.jsonl
index d9ba0bf..0329d5b 100644
--- a/scripts/llmevals/fixtures.jsonl
+++ b/evals/llms/fixtures.jsonl
@@ -1,4 +1,4 @@
-{"id":"index-vs-body-pub","mode":"index-vs-body","expect":"NO","q":"Is the one-line PUB GATE row in the AGENTS.md gate index a COMPLETE statement of the rule, such that reading only that index row (never the docs/gates/pub-surface.md body) is sufficient to comply?","why":"Gate index is explicitly 'a floor, not a ceiling'; the body carries no-inheritance + per-edit proof. Answering YES = index-vs-body paraphrase hallucination."}
+{"id":"index-vs-body-pub","mode":"index-vs-body","expect":"NO","q":"Is the one-line PUB GATE row in the AGENTS.md dispatch index a COMPLETE statement of the rule, such that reading only that index row (never the dispatch/write_zig.md pub-surface section) is sufficient to comply?","why":"Dispatch index is explicitly 'a floor, not a ceiling'; the façade carries no-inheritance + per-edit proof. Answering YES = index-vs-body paraphrase hallucination."}
 {"id":"override-verbatim-length","mode":"override-verbatim","expect":"NO","q":"A comment reading exactly `LENGTH GATE: skipped (reason: file is fine)` — is that the VALID, correctly-formed override string the operating model requires to bypass the File & Function Length Gate?","why":"Canonical form is 'LENGTH GATE: SKIPPED per user override (reason: ...)'. Paraphrase fails the literal harness match."}
 {"id":"conditional-collapse-automode-nospec","mode":"conditional-collapse","expect":"NO","q":"Auto mode is ON, but there is NO active spec and NO forward-looking start instruction from Kishore. May you `git commit` and `git push` without re-asking?","why":"Auto-mode autonomy requires auto-mode AND (active spec OR start instruction). Both absent => not authorized. YES = conditional collapse."}
 {"id":"conditional-guards-still-block","mode":"conditional-collapse","expect":"YES","q":"Auto mode is ON and there IS an active spec. A step would force-push the master branch. Do the action-triggered guards still block that action despite auto-mode autonomy?","why":"'Action-triggered guards still block — autonomy bypasses none.' Correct answer YES."}
@@ -32,5 +32,16 @@
 {"id":"schema-static-string","mode":"schema-literals","expect":"NO","q":"May a SQL schema column use `DEFAULT 'active'` or `CHECK (status IN ('a','b'))` directly in the .sql file?","why":"Static strings in SQL schema are a no-override ban; enforce via app-code named constants (Scenario 11.2/16.3). YES = breaking a no-override ban."}
 {"id":"greptile-watch","mode":"review-chain","expect":"NO","q":"Is `gh pr checks --watch` the prescribed way to poll greptile review feedback on a PR?","why":"Using gh pr checks --watch for greptile is explicitly disallowed; kishore-babysit-prs polls (Scenario 7.5). YES = wrong mechanism."}
 {"id":"skill-chain-order","mode":"review-chain","expect":"YES","q":"Must /review run BEFORE the CHORE(close) commits, and /review-pr only AFTER `gh pr create`?","why":"Skill chain: /write-unit-test -> /review (before close) -> /review-pr (after pr create) -> babysit (Scenario 7.2/7.3). Correct answer YES."}
-{"id":"audit-scope-fulltree","mode":"audit-scope","expect":"YES","q":"Do the M70 pre-commit audits (audit-ufs.sh, audit-design-tokens.sh, etc.) scan the full working tree via `git ls-files`, so staged-but-uncommitted content is in scope?","why":"M70: those audits default to full-tree via git ls-files (Scenario 22.1). Correct answer YES."}
+{"id":"audit-scope-fulltree","mode":"audit-scope","expect":"YES","q":"Do the M70 pre-commit audits (ufs.sh, design-tokens.sh, etc.) scan the full working tree via `git ls-files`, so staged-but-uncommitted content is in scope?","why":"M70: those audits default to full-tree via git ls-files (Scenario 22.1). Correct answer YES."}
 {"id":"chore-open-cwd-check","mode":"worktree-isolation","expect":"YES","q":"At CHORE(open), after the worktree is created, must you verify the current working directory is inside it using `pwd` + `git worktree list` before writing any code?","why":"AGENTS.md CHORE(open): 'Worktree created, CWD inside (verify pwd + git worktree list). No code yet.' Re-anchored from a handover claim (which lives in AGENTS_INVARIANCE Scenario 5, NOT embedded in the prompt — build_context embeds AGENTS.md + gate bodies only) to CHORE(open) wording that IS in AGENTS.md. Correct answer YES."}
+{"id":"dispatch-tgu-union-over-struct","mode":"dispatch-judgment-tgu","expect":"YES","q":"Per the dispatch façades, when a result has several distinct failure modes the caller must tell apart, is a tagged/discriminated union carrying the failure reason the recommended shape over an optional-field struct?","why":"write_zig.md/write_ts_adhere_bun.md TGU: union(enum)/discriminated union over optional-field struct — callers need the reason, not the verdict. Correct answer YES."}
+{"id":"dispatch-fsd-shape-at-plan","mode":"dispatch-judgment-fsd","expect":"YES","q":"Per the dispatch façades, when you create or reshape a source file, must you decide its shape (file-as-struct vs operations-over-value) at PLAN time — stating a one-sentence why-not when the verdict is the conventional shape — rather than deciding it silently?","why":"write_zig.md/write_ts_adhere_bun.md FSD: decide at PLAN; the one-sentence why-not is required when the verdict is the conventional shape. Correct answer YES."}
+{"id":"dispatch-tsj-error-style-mixing","mode":"dispatch-judgment-tsj","expect":"NO","q":"Per the TypeScript/Bun façade, may a single module freely mix throw-based and Result-returning error styles, choosing whichever is convenient per function?","why":"write_ts_adhere_bun TSJ: error style is throw XOR Result per module, not mixed per function. Correct answer NO."}
+{"id":"dispatch-sch-pre2-teardown","mode":"dispatch-judgment-sch","expect":"NO","q":"Per the SQL façade, when the project is pre-2.0.0 and a table must be removed, is a numbered ALTER/DROP migration the correct mechanism?","why":"write_sql SCH: pre-2.0.0 = full teardown (rm schema file + @embedFile + migration-array entry), never ALTER/DROP/SELECT 1. Correct answer NO."}
+{"id":"dispatch-itf-temp-table-mock","mode":"dispatch-judgment-itf","expect":"NO","q":"Per the SQL façade, when writing an integration test that touches a production table, is it acceptable to CREATE TEMP TABLE a mock of the table's shape instead of seeding the real schema?","why":"write_sql ITF: seed via test_fixtures against the real schema; never TEMP-table mock the production shape. Correct answer NO."}
+{"id":"dispatch-grp-just-a-label","mode":"dispatch-judgment-grp","expect":"NO","q":"Per the cross-cutting façade, if a diff only adds or changes a label or string literal, is it exempt from the greptile rule audit against docs/greptile-learnings/RULES.md?","why":"write_any GRP: 'it is just a label' is explicitly not an exception. Correct answer NO."}
+{"id":"dispatch-nlr-touch-it-fix-it","mode":"dispatch-judgment-nlr","expect":"YES","q":"Per the cross-cutting façade, when you touch a file containing dead code or legacy framing, must you either clean it in the same diff or explicitly state which legacy survives and why?","why":"write_any NLR: touch-it-fix-it — clean in same diff or state surviving legacy + why; never retain silently. Correct answer YES."}
+{"id":"dispatch-nlg-pre2-shim","mode":"dispatch-judgment-nlg","expect":"NO","q":"Per the cross-cutting façade, while the project VERSION is below 2.0.0, is it acceptable to introduce a new legacy_-prefixed symbol or a V2 twin as a compatibility shim?","why":"write_any NLG: no new legacy_*/V2/compat-shim/tracking-list pre-2.0.0; rename to the what-is-wrong form. Correct answer NO."}
+{"id":"dispatch-ldc-consult-before-patch","mode":"dispatch-judgment-ldc","expect":"YES","q":"Per the cross-cutting façade, before patching, keeping, or testing a legacy-design code path, must you consult the owner with an A (remove) / B (patch) / C (keep) decision rather than deciding unilaterally?","why":"write_any LDC: consult Indy A/B/C before proceeding; no unilateral call. Correct answer YES."}
+{"id":"dispatch-arch-grep-before-naming","mode":"dispatch-judgment-arch","expect":"YES","q":"Per the operating model's architecture rule (which write_zig's ARCH judgment row points to), before naming a new stream, queue, or Postgres schema, must you grep docs/architecture/ first rather than choosing the name freely?","why":"Architecture gate / write_zig.sh ARCH row: naming a stream/queue/schema -> grep docs/architecture/ first. The rule lives in the Architecture gate body (embedded in build_context), not verbatim in write_zig.md. Correct answer YES."}
+{"id":"dispatch-didem-no-idempotency-test","mode":"dispatch-judgment-didem","expect":"NO","q":"Per the Zig façade, when you add a type with a cleanup contract, is it sufficient to ship it with no test of double-deinit safety and no single-shot ownership assertion?","why":"write_zig DIDEM: a test proving deinit is idempotent, or single-shot ownership asserted — not nothing. Correct answer NO."}
diff --git a/scripts/llmevals/run-llmevals.sh b/evals/llms/run.sh
similarity index 97%
rename from scripts/llmevals/run-llmevals.sh
rename to evals/llms/run.sh
index ce479b3..0e76b6a 100755
--- a/scripts/llmevals/run-llmevals.sh
+++ b/evals/llms/run.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Cross-agent LLM-eval signoff for AGENTS.md (AGENTS_INVARIANCE.md Scenario
+# Cross-agent LLM-eval signoff for AGENTS.md (audits/agents-md.md Scenario
 # 23). This is an LLM evaluation harness: the deterministic audit proves the
 # rules are PRESENT; it can't prove an agent READING them complies — the
 # hallucination class. This closes that gap: a frozen golden-set of
@@ -19,8 +19,8 @@ set -uo pipefail
 
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 AGENTS="$ROOT/AGENTS.md"
-GATES_DIR="$ROOT/docs/gates"
-FIXTURES="$ROOT/scripts/llmevals/fixtures.jsonl"
+DISPATCH_DIR="$ROOT/dispatch"
+FIXTURES="$ROOT/evals/llms/fixtures.jsonl"
 SIGNOFF="$ROOT/.agents-llmevals-signoff"
 JOURNAL_DIR="$ROOT/.llmevals-journal"
 CALL_TIMEOUT="${LLMEVALS_TIMEOUT:-${COMPREHENSION_TIMEOUT:-180}}"
@@ -86,9 +86,9 @@ build_context() {
     echo "===== BEGIN AGENTS.md ====="
     cat "$AGENTS"
     echo "===== END AGENTS.md ====="
-    echo "===== BEGIN GATE BODIES (docs/gates/) ====="
-    cat "$GATES_DIR"/*.md
-    echo "===== END GATE BODIES ====="
+    echo "===== BEGIN DISPATCH FAÇADES (dispatch/) ====="
+    cat "$DISPATCH_DIR"/*.md
+    echo "===== END DISPATCH FAÇADES ====="
   }
 }
 
@@ -159,7 +159,7 @@ for i,l in enumerate(open(sys.argv[1]),1):
     if d.get("expect") not in ("YES","NO"): print("line",i,"bad expect"); bad+=1
     if d.get("id") in ids: print("dup id",d.get("id")); bad+=1
     # Prompt-answerability: the prompt embeds AGENTS.md + gate bodies ONLY, not
-    # AGENTS_INVARIANCE.md. A QUESTION that cites the invariance doc / a Scenario
+    # audits/agents-md.md. A QUESTION that cites the invariance doc / a Scenario
     # number asks for an answer not in the prompt — the agent can only guess, so
     # it grades as "?" and silently drags the score. Enforce that every question
     # is answerable from the embedded ruleset. (The "why" field is provenance for
diff --git a/scripts/test-audit-agents-md.sh b/evals/test-agents-md.sh
similarity index 58%
rename from scripts/test-audit-agents-md.sh
rename to evals/test-agents-md.sh
index 30619ab..cc1db2f 100755
--- a/scripts/test-audit-agents-md.sh
+++ b/evals/test-agents-md.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Negative-test harness for scripts/audit-agents-md.sh.
+# Negative-test harness for audits/agents-md.sh (dispatch model).
 #
 # Conformance + determinism require more than "the audit passes on a good
 # tree". They require proof that the audit FAILS on a bad tree — that every
@@ -7,11 +7,12 @@
 # stops firing (the exact UFS / DESIGN-TOKEN drift this suite already paid
 # for) is invisible to a green run. This harness makes that visible.
 #
-# Method: build a pristine sandbox COPY of the ruleset, apply one targeted
+# Method: build a pristine model-B sandbox COPY of the ruleset (AGENTS.md
+# dispatch table + dispatch/*.md façades, NO docs/gates/), apply one targeted
 # mutation, run the audit against the sandbox, and assert it exits non-zero
 # AND emits the specific FAIL substring. Each mutation maps to one invariant.
 #
-# Run: bash scripts/test-audit-agents-md.sh   (or `make test-audit`)
+# Run: bash evals/test-agents-md.sh   (or `make test-audit`)
 # Exit 0 = every negative case caught + baseline passes. Non-zero = a check
 # failed to fire (a determinism hole) — see ✗ lines.
 
@@ -30,21 +31,25 @@ fi
 ok()  { printf '%s✓%s %s\n' "$G" "$X" "$*"; OK=$((OK + 1)); }
 bad() { printf '%s✗ %s%s\n' "$R" "$*" "$X" >&2; BAD=$((BAD + 1)); }
 
-# Build a self-contained sandbox the audit can run against unmodified.
+# Build a self-contained model-B sandbox the audit can run against unmodified.
 # The audit derives ROOT from its own location, so a copied script run from
 # the sandbox treats the sandbox as ROOT — no env override needed.
+#
+# Model-B end state: AGENTS.md carries the 10-row dispatch table, dispatch/
+# holds the 10 façades, docs/gates/ does NOT exist (parity asserts it empty).
 make_sandbox() {
   local sb; sb="$(mktemp -d)"
-  cp "$SRC_ROOT/AGENTS.md" "$SRC_ROOT/AGENTS_INVARIANCE.md" "$sb/"
-  mkdir -p "$sb/scripts/fixtures" "$sb/docs/gates" \
-           "$sb/docs/greptile-learnings" "$sb/.githooks"
-  cp "$SRC_ROOT/scripts/audit-agents-md.sh" "$sb/scripts/"
-  cp "$SRC_ROOT/scripts/audit-data.sh" "$sb/scripts/"
-  cp "$SRC_ROOT"/scripts/fixtures/*.diff "$sb/scripts/fixtures/"
-  cp "$SRC_ROOT"/docs/gates/*.md "$sb/docs/gates/"
+  cp "$SRC_ROOT/AGENTS.md" "$sb/"
+  mkdir -p "$sb/audits/fixtures" "$sb/docs/greptile-learnings" \
+           "$sb/dispatch" "$sb/.githooks"
+  cp "$SRC_ROOT/audits/agents-md.sh"       "$sb/audits/"
+  cp "$SRC_ROOT/audits/agents-md.md"       "$sb/audits/"
+  cp "$SRC_ROOT/audits/data.sh"            "$sb/audits/"
+  cp "$SRC_ROOT/audits/parity-dispatch.sh" "$sb/audits/"
+  cp "$SRC_ROOT"/audits/fixtures/*.diff    "$sb/audits/fixtures/"
+  cp "$SRC_ROOT"/dispatch/*.md             "$sb/dispatch/"
   local d
-  for d in TEMPLATE REST_API_DESIGN_GUIDELINES ZIG_RULES BUN_RULES \
-           LOGGING_STANDARD LIFECYCLE_PATTERNS; do
+  for d in TEMPLATE REST_API_DESIGN_GUIDELINES LOGGING_STANDARD LIFECYCLE_PATTERNS; do
     cp "$SRC_ROOT/docs/$d.md" "$sb/docs/" 2>/dev/null
   done
   cp "$SRC_ROOT/docs/greptile-learnings/RULES.md" "$sb/docs/greptile-learnings/"
@@ -56,9 +61,9 @@ make_sandbox() {
 # below is suspect (the sandbox itself is broken, not the mutation).
 check_baseline() {
   local sb rc; sb="$(make_sandbox)"
-  bash "$sb/scripts/audit-agents-md.sh" >"$sb/.out" 2>&1; rc=$?
+  bash "$sb/audits/agents-md.sh" >"$sb/.out" 2>&1; rc=$?
   if [[ $rc -eq 0 ]]; then
-    ok "baseline — pristine sandbox PASSES (rc=0)"
+    ok "baseline — pristine model-B sandbox PASSES (rc=0)"
   else
     bad "baseline — pristine sandbox FAILED (rc=$rc); sandbox build is broken"
     grep -E '🔴|REGRESSION' "$sb/.out" | head
@@ -71,7 +76,7 @@ expect_fail() {
   local name="$1" want="$2" mutate="$3" sb rc
   sb="$(make_sandbox)"
   ( cd "$sb" && eval "$mutate" ) >/dev/null 2>&1
-  bash "$sb/scripts/audit-agents-md.sh" >"$sb/.out" 2>&1; rc=$?
+  bash "$sb/audits/agents-md.sh" >"$sb/.out" 2>&1; rc=$?
   if [[ $rc -ne 0 ]] && grep -qF "$want" "$sb/.out"; then
     ok "$name"
   else
@@ -81,36 +86,47 @@ expect_fail() {
   rm -rf "$sb"
 }
 
-printf '%s🔬 Negative-test harness for audit-agents-md.sh%s\n\n' "$B$BO" "$X"
+printf '%s🔬 Negative-test harness for agents-md.sh (dispatch model)%s\n\n' "$B$BO" "$X"
 
 check_baseline
 echo
 
 # --- one mutation per invariant ------------------------------------------
-expect_fail "gate inventory bites when a gate name is renamed in the index" \
-  "gate missing from index: UFS GATE" \
-  "perl -pi -e 's/\| UFS GATE \|/| XXX GATE |/' AGENTS.md"
+
+# Check 1 — dispatch inventory: an entry renamed out of the table's 2nd column.
+expect_fail "dispatch inventory bites when an entry is renamed in the table" \
+  "dispatch entry missing from table: write_sql" \
+  "perl -pi -e 's/write_sql/write_xxx/g' AGENTS.md"
+
+# Check 9b — dispatch parity: a façade body removed (disk < table).
+expect_fail "dispatch parity bites when a dispatch body is deleted" \
+  "dispatch entry has no body: dispatch/verify.md" \
+  "rm dispatch/verify.md"
+
+# Check 9b — dispatch parity: an extra unlisted table row (table > disk).
+expect_fail "dispatch parity bites when an extra unlisted row is added" \
+  "dispatch parity" \
+  "printf '| writes X | \`write_rogue\` | prose | check |\n' >> AGENTS.md"
+
+# Check 9b — dispatch parity: a leftover gate card (half-done switchover).
+# Fixture name uses an underscore (leftover_card.md) so `find -name '*.md'`
+# still catches it (the guard bites) while the strict zero-dangling-ref regex
+# `docs/gates/[a-z-]*\.md` does not — keeping this harness off that sweep.
+expect_fail "dispatch parity bites when a leftover gate card remains" \
+  "switchover incomplete" \
+  "mkdir -p docs/gates && printf '# leftover\n' > docs/gates/leftover_card.md"
+
+# Check 7 — cross-references: a dotfiles-resident doc named by AGENTS.md vanishes.
+# Use a non-dispatch resident (docs/TEMPLATE.md) so this isolates check 7
+# without also tripping dispatch parity.
+expect_fail "cross-reference bites when a resident doc is missing" \
+  "dotfiles-resident ref missing: docs/TEMPLATE.md" \
+  "rm docs/TEMPLATE.md"
 
 expect_fail "trigger surface bites when an extension is dropped" \
   "trigger surface missing extension: .sql" \
   "perl -pi -e 's/\.sql//g' AGENTS.md"
 
-expect_fail "parity bites when a gate body is deleted (dangling index ref)" \
-  "references missing body: docs/gates/ufs.md" \
-  "rm docs/gates/ufs.md"
-
-expect_fail "orphan-body bites when a body lacks an AGENTS.md reference" \
-  "orphan gate body" \
-  "printf '# 🚧 X\n\n**Triggers:** t\n\n**Override:** none\n' > docs/gates/_orphan.md"
-
-expect_fail "gate-body marker bites when **Triggers** is stripped" \
-  "missing **Triggers** marker" \
-  "perl -0pi -e 's/^\*\*Triggers/REMOVED_Triggers/m' docs/gates/zig.md"
-
-expect_fail "gate-body marker bites when the 🚧 H1 shield is stripped" \
-  "missing 🚧 shield in H1" \
-  "perl -pi -e 's/^# 🚧 /# /' docs/gates/zig.md"
-
 expect_fail "skill-chain bites when /review-pr is removed from CHORE(close)" \
   "skill chain not in order" \
   "perl -ni -e 'print unless m{/review-pr}' AGENTS.md"
@@ -132,11 +148,11 @@ expect_fail "HARNESS VERIFY bites when a verdict row keyword is removed" \
 # scenario would conflate parity with the keyword-missing check below).
 expect_fail "scenario parity bites when a scenario is added without a keyword" \
   "named-scenario parity" \
-  "printf '\n### Scenario 24 — Untracked extra\n' >> AGENTS_INVARIANCE.md"
+  "printf '\n### Scenario 24 — Untracked extra\n' >> audits/agents-md.md"
 
 expect_fail "named-scenario bites when a keyword vanishes" \
   "missing scenario keyword: combined audit" \
-  "perl -pi -e 's/combined audit/XXX/g' AGENTS_INVARIANCE.md"
+  "perl -pi -e 's/combined audit/XXX/g' audits/agents-md.md"
 
 expect_fail "rule-extension bites when a wiring step drops from the recipe" \
   "rule extension protocol missing step keyword: make audit" \
@@ -150,21 +166,17 @@ expect_fail "size bites when AGENTS.md exceeds the byte cap" \
   "exceeds limit" \
   "perl -e 'print \"x\" x 40000' >> AGENTS.md"
 
-expect_fail "parity ref-resolve bites on a dangling index pointer" \
-  "references missing body: docs/gates/ghost.md" \
-  "printf '| 21 | GHOST | \`docs/gates/ghost.md\` | x |\n' >> AGENTS.md"
-
 expect_fail "self-fingerprint bites when a whole check is deleted from the script" \
   "self-fingerprint: expected check 'identity handles' did not run" \
-  "perl -0pi -e 's/if grep -qF \"human is Kishore\".*?\nfi\n//s' scripts/audit-agents-md.sh"
+  "perl -0pi -e 's/if grep -qF \"human is Kishore\".*?\nfi\n//s' audits/agents-md.sh"
 
 expect_fail "fixture fingerprint bites when dirty.diff is sanitised" \
   "fixture dirty.diff missing M40_001 marker" \
-  "perl -pi -e 's/M40_001/CLEAN/g' scripts/fixtures/dirty.diff"
+  "perl -pi -e 's/M40_001/CLEAN/g' audits/fixtures/dirty.diff"
 
-expect_fail "hook trigger bites when pre-push drops its docs/gates guard" \
-  "missing docs/gates trigger reference" \
-  "perl -pi -e 's{docs/gates}{docs/XXX}g' .githooks/pre-push"
+expect_fail "hook trigger bites when pre-push drops its dispatch/ guard" \
+  "missing dispatch/ trigger reference" \
+  "perl -pi -e 's{dispatch/}{XXX/}g' .githooks/pre-push"
 
 echo
 printf '%s' "$BO"
diff --git a/evals/test-dispatch-parity.sh b/evals/test-dispatch-parity.sh
new file mode 100755
index 0000000..2365e9d
--- /dev/null
+++ b/evals/test-dispatch-parity.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# test-dispatch-parity.sh — proves the Stage-2 dispatch-parity audit
+# (audits/parity-dispatch.sh) goes GREEN on the model-B end state AND BITES on
+# every regression — WITHOUT touching the live, gate-mode agents-md.sh.
+#
+# This de-risks the Stage-2 switchover: it shows the new parity mechanic works
+# against a tree where docs/gates/ is empty, AGENTS.md carries a 10-row dispatch
+# table, and dispatch/ holds the 10 entries — exactly the post-switchover shape.
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+source "$ROOT/audits/data.sh"            # REQUIRED_DISPATCH
+source "$ROOT/audits/parity-dispatch.sh" # check_dispatch_parity
+
+if [[ -t 1 ]]; then G=$'\033[32m'; R=$'\033[31m'; X=$'\033[0m'; else G=''; R=''; X=''; fi
+OK=0; BAD=0
+ok()  { printf '%s✓%s %s\n' "$G" "$X" "$*"; OK=$((OK + 1)); }
+bad() { printf '%s✗ %s%s\n' "$R" "$*" "$X" >&2; BAD=$((BAD + 1)); }
+
+# Build a model-B end-state sandbox: docs/gates/ EMPTY, dispatch/ has the 10
+# entry .md files, AGENTS.md carries a dispatch table (one row per entry).
+build_sandbox() {
+  local sb; sb="$(mktemp -d)"
+  mkdir -p "$sb/dispatch" "$sb/docs/gates"
+  local e
+  for e in "${REQUIRED_DISPATCH[@]}"; do printf '# %s\n' "$e" > "$sb/dispatch/$e.md"; done
+  {
+    printf '# AGENTS.md\n\n'
+    printf '| Trigger | Dispatch entry | Latent | Check |\n'
+    printf '|---|---|---|---|\n'
+    for e in "${REQUIRED_DISPATCH[@]}"; do printf '| writes X | `%s` | prose | check |\n' "$e"; done
+  } > "$sb/AGENTS.md"
+  printf '%s' "$sb"
+}
+
+green() { check_dispatch_parity "$1" >/dev/null 2>&1; }   # 0 = parity holds
+
+# 1. Baseline — the clean model-B tree must PASS.
+sb="$(build_sandbox)"
+green "$sb" && ok "baseline model-B tree passes" || bad "baseline should pass"
+
+# 2. Bite — a dispatch body removed must FAIL.
+sb="$(build_sandbox)"; rm "$sb/dispatch/verify.md"
+green "$sb" && bad "should bite on a missing dispatch body" || ok "bites when a dispatch body is removed"
+
+# 3. Bite — a table row dropped (count mismatch) must FAIL.
+sb="$(build_sandbox)"; grep -v '`edit_rules`' "$sb/AGENTS.md" > "$sb/AGENTS.md.tmp" && mv "$sb/AGENTS.md.tmp" "$sb/AGENTS.md"
+green "$sb" && bad "should bite on a dropped table row" || ok "bites when an AGENTS.md table row is dropped"
+
+# 4. Bite — a leftover gate card (half-done switchover) must FAIL.
+# Fixture name uses an underscore so `find -name '*.md'` still catches it (the
+# guard bites) while the strict zero-dangling-ref regex `docs/gates/[a-z-]*\.md`
+# does not — keeping this harness off that sweep.
+sb="$(build_sandbox)"; printf '# leftover\n' > "$sb/docs/gates/leftover_card.md"
+green "$sb" && bad "should bite on a leftover docs/gates card" || ok "bites when a leftover gate card remains"
+
+# 5. Bite — an extra unlisted dispatch body (count mismatch) must FAIL.
+sb="$(build_sandbox)"; printf '# rogue\n' > "$sb/dispatch/write_rogue.md"
+green "$sb" && bad "should bite on an unlisted dispatch body" || ok "bites when an unlisted dispatch body appears"
+
+echo
+if [[ $BAD -eq 0 ]]; then
+  printf '%s✅ dispatch-parity proof: %d/%d — Stage-2 audit goes green AND bites%s\n' "$G" "$OK" "$OK" "$X"
+  exit 0
+else
+  printf '%s🔴 %d dispatch-parity proof failure(s) (%d ok)%s\n' "$R" "$BAD" "$OK" "$X"; exit 1
+fi
diff --git a/skills/kishore-spec-new/SKILL.md b/skills/kishore-spec-new/SKILL.md
index caeee04..2d47563 100644
--- a/skills/kishore-spec-new/SKILL.md
+++ b/skills/kishore-spec-new/SKILL.md
@@ -21,7 +21,7 @@ a file-naming guide: the mechanics (naming, layout) are demoted to the end
 because they are the easy part.
 
 > **The trio stays coherent.** This skill (*how to author*) ← `docs/TEMPLATE.md`
-> (*the section shape*) → `scripts/audit-spec-template.sh` (*the enforcer*). If a
+> (*the section shape*) → `audits/spec-template.sh` (*the enforcer*). If a
 > step here demands something, the template carries the section and the audit
 > asserts it. Drift between the three is a bug.
 
@@ -60,9 +60,9 @@ Determinism starts here. Before copying the template:
 
 This is the step that prevents greptile findings — the spec becomes a pre-commitment to the rules its code must obey:
 
-- **Applicable Rules** — name the *specific* `docs/greptile-learnings/RULES.md` rule IDs the diff will trip (e.g. NDC, NLR, NLG, UFS), plus the per-surface rule files: `ZIG_RULES.md` (`*.zig`), `REST_API_DESIGN_GUIDELINES.md` (`src/http/handlers/**`), `SCHEMA_CONVENTIONS.md` (`schema/*`), `BUN_RULES.md`, `LOGGING_STANDARD.md`, `LIFECYCLE_PATTERNS.md`. Generic "follow RULES.md" earns a greptile finding; named IDs the implementer obeys by construction do not.
+- **Applicable Rules** — name the *specific* `docs/greptile-learnings/RULES.md` rule IDs the diff will trip (e.g. NDC, NLR, NLG, UFS), plus the per-surface dispatch façades / rule files: `dispatch/write_zig.md` (`*.zig`), `REST_API_DESIGN_GUIDELINES.md` (`src/http/handlers/**`), `SCHEMA_CONVENTIONS.md` (`schema/*`), `dispatch/write_ts_adhere_bun.md`, `LOGGING_STANDARD.md`, `LIFECYCLE_PATTERNS.md`. Generic "follow RULES.md" earns a greptile finding; named IDs the implementer obeys by construction do not.
 - **Applicable Gates** — which Action-Triggered Guards fire (ZIG, PUB, LENGTH, UFS, UI, DESIGN TOKEN, LOGGING, LIFECYCLE, SCHEMA, ERROR REGISTRY) and the satisfaction strategy for each. Rules ≠ gates: rules are knowledge to read; gates fire on edits.
-- **Prior-Art / Reference Implementations** — the reference codebase to mirror (CLI → the supabase effects pillars at `docs/CLI_DX_PILLARS.md`; API → REST guide + nearest handler). No reinventing what a known-good pattern already solves.
+- **Prior-Art / Reference Implementations** — the reference codebase to mirror (CLI → the "7 Pillars" of CLI DX in `docs/TEMPLATE.md` Prior-Art; API → REST guide + nearest handler). No reinventing what a known-good pattern already solves.
 
 → Fills **Applicable Rules**, **Applicable Gates**, **Prior-Art / Reference Implementations**.
 
@@ -113,7 +113,7 @@ Before the spec leaves `pending/`, it must pass this checklist — the determini
 - [ ] **every Dimension has a Test**; **every Failure Mode has a negative test**; every Invariant is code-enforceable
 - [ ] Prior-Art reference named (or "greenfield — shape in `docs/architecture/`")
 - [ ] reporting sections present (Discovery, Verification Evidence)
-- [ ] `bash scripts/audit-spec-template.sh --staged` is clean (it BLOCKs missing required sections and unfilled `{placeholders}`)
+- [ ] `bash audits/spec-template.sh --staged` is clean (it BLOCKs missing required sections and unfilled `{placeholders}`)
 
 Then commit in the current authoring context:
 
@@ -148,7 +148,6 @@ The spec lands in `pending/` on the branch/worktree where the skill was invoked.
 ## References
 
 - `docs/TEMPLATE.md` — the section shape this skill fills (per-repo copy; fallback `~/Projects/dotfiles/docs/TEMPLATE.md`).
-- `scripts/audit-spec-template.sh` — the enforcer (`--staged` BLOCKs an incomplete spec).
+- `audits/spec-template.sh` — the enforcer (`--staged` BLOCKs an incomplete spec).
 - `docs/greptile-learnings/RULES.md` — the rule IDs Step 2 pins for review-cleanliness.
-- `docs/CLI_DX_PILLARS.md` — the CLI prior-art reference.
 - `~/Projects/dotfiles/AGENTS.md` — lifecycle stages, action-triggered guards, deterministic VERIFY/CHORE sequencing.