FE-1091: Renderer golden coverage and prompt assembly lock, Part 2

.agents/skills/ln-build/SKILL.md

@@ -112,7 +112,7 @@ After the build lands and verification passes, ask:
 - [ ] Did this establish a new seam-level invariant?
 - [ ] Did this change a frontier-level cross-cutting obligation or verification architecture layer?
 - [ ] Did this complete the **last member frontier of an initiative (arc)** in `memory/PLAN.md` §Initiatives?
-- [ ] Did this change the topology of a directory that owns a `README.md` (moved/renamed/retired files, changed dependency direction, completed or invalidated a migration note, or shipped a state previously described as pending)?
+- [ ] Did this change the topology of a directory that owns a `TOPOLOGY.md` (moved/renamed/retired files, changed dependency direction, completed or invalidated a migration note, or shipped a state previously described as pending)?
 
 ### If all answers are no
 
@@ -139,7 +139,7 @@ Update only the touched traceability items.
    - If the change closes, blocks, or unblocks a frontier item, reflect that in `Sequencing`, the affected `Frontier Definitions` entry, or `Recently Completed`
    - If the build changed a frontier-level cross-cutting obligation, update the affected frontier definition explicitly; do not hide the change behind bare traceability IDs
    - Do not mirror detailed slice/card history into `memory/PLAN.md`; cards live in the scope file under `memory/cards/`. At most, the frontier definition may carry a lightweight `Current execution pointer` listing active scope file path(s).
-   - **Arc completion:** if this build completed the **last member frontier of an initiative (arc)** in `§Initiatives`, run that arc's **done-definition before** marking the arc done — including reconciling co-located topology READMEs and discharging any standing-obligation residue scoped to the arc (the residue that no future frontier would otherwise touch). Mark the arc `✓ done` only once the done-definition actually holds; if residue remains, the arc stays `◐ active` with the residue named.
+   - **Arc completion:** if this build completed the **last member frontier of an initiative (arc)** in `§Initiatives`, run that arc's **done-definition before** marking the arc done — including reconciling co-located topology files and discharging any standing-obligation residue scoped to the arc (the residue that no future frontier would otherwise touch). Mark the arc `✓ done` only once the done-definition actually holds; if residue remains, the arc stays `◐ active` with the residue named.
 
 2. **Assumptions**
    - evidence answered it → update to `validated` or `invalidated`
@@ -156,11 +156,11 @@ Update only the touched traceability items.
    - same seam-level invariant gained coverage → update
    - genuinely independent seam/rule/proof → add
 
-5. **Topology READMEs** (when the topology question is `yes`)
-   - update the `README.md` of every touched directory that owns one — ownership statement, layout sketch, dependency-direction assertion, and migration notes
-   - if a SPEC decision cited by the README was renumbered or retired during reconciliation, repair the citation in the same commit
-   - if a directory the build retires owned a README, delete the README with the directory
-   - if a new directory introduced by this slice will be a long-lived seam (multiple files, named in SPEC, or imported by other layers), draft a minimal topology README following the shape in `AGENTS.md` §topology READMEs — do not speculate; describe what exists
+5. **Topology files** (when the topology question is `yes`)
+   - update the `TOPOLOGY.md` of every touched directory that owns one — ownership statement, layout sketch, dependency-direction assertion, and migration notes
+   - if a SPEC decision cited by the topology file was renumbered or retired during reconciliation, repair the citation in the same commit
+   - if a directory the build retires owned a `TOPOLOGY.md`, delete the topology file with the directory
+   - if a new directory introduced by this slice will be a long-lived seam (multiple files, named in SPEC, or imported by other layers), draft a minimal topology file following the shape in `AGENTS.md` §topology files — do not speculate; describe what exists
 
 When uncertain between merge and add, add. When uncertain between update and no-op, update.
 

.agents/skills/ln-plan/SKILL.md

@@ -119,7 +119,7 @@ Each arc entry stays thin:
 - **id + status** (`✓ done` / `◐ active` / planned)
 - **Goals** — the through-line in 1–3 bullets (the user-facing "why")
 - **Members** — the frontier ids that compose it, with per-member status
-- **Done-definition** — the arc-level completion test, which **must** include reconciliation of co-located topology READMEs and discharge of any standing-obligation residue scoped to the arc
+- **Done-definition** — the arc-level completion test, which **must** include reconciliation of co-located topology files and discharge of any standing-obligation residue scoped to the arc
 - **Anchors** — the SPEC decision/assumption ids the arc rests on
 
 `ln-plan` creates and updates arcs (and the member roster as frontiers are added/retired); `ln-sync` closes them and verifies the done-definition actually holds; `ln-build` fires the arc-completion check when a build lands the last member frontier (see each skill). The done-definition is what closes the "standing obligation rides the triggering frontier = never" hole: arc completion is itself a trigger.

.agents/skills/ln-plan/references/earned.md

@@ -10,7 +10,7 @@ This is not "proving-posture sequencing with bigger steps." The decision kernel
 
 ## Closure move-set
 
-- **Materialize** — make a settled architectural decision visible in topology: file or directory placement, sub-tree split per [AGENTS.md](../../../../AGENTS.md) §fractal sub-tree pattern, or a topology README that locks a SPEC decision to a directory.
+- **Materialize** — make a settled architectural decision visible in topology: file or directory placement, sub-tree split per [AGENTS.md](../../../../AGENTS.md) §fractal sub-tree pattern, or a `TOPOLOGY.md` file that locks a SPEC decision to a directory.
 - **Consolidate** — bring scattered cognates of the same concept into one canonical site.
 - **Name canonically** — collapse aliases, near-synonyms, or drift terms to one term; update callers, docs, and tests in the same slice.
 - **Delete-as-progress** — retire obsolete code paths, fixtures, dummy data, compatibility shims, and superseded docs. Deletion is a first-class closure outcome, not janitorial overflow. Comment-rich `export {}` source files are not deletion candidates on unusedness alone; apply `AGENTS.md` §intentional topology stubs and prove the documented seam is obsolete or absorbed.
@@ -48,7 +48,7 @@ The earned posture is not a license for sprawl. Closure expands the slice *withi
 - **Name the specific closure target** in the frontier definition. "Tidy up X" is not a closure target; "collapse the dual `Foo` shapes to the `Foo` defined at `src/.../foo.ts`" is.
 - **Declare touched paths** at the scope-card layer with the same discipline as proving-mode slices. Bigger does not mean undeclared.
 - **Do not auto-implement adjacent work** because it would be "symmetric." Name adjacent work in the plan; let it earn its own frontier.
-- **Materialization is not ritual.** Topology READMEs and fractal sub-tree splits only fire when (a) the seam is already understood, (b) the structure carries real architectural meaning, and (c) the change reduces ambiguity or drift. Otherwise it is structural theatre.
+- **Materialization is not ritual.** Topology files and fractal sub-tree splits only fire when (a) the seam is already understood, (b) the structure carries real architectural meaning, and (c) the change reduces ambiguity or drift. Otherwise it is structural theatre.
 
 ## Regression: earned → proving
 

.agents/skills/ln-refactor/SKILL.md

@@ -20,7 +20,7 @@ The area to refactor: $ARGUMENTS
 
 1. Capture the problem. Explore the codebase to verify assertions. Present alternatives the user may not have considered. Hammer out exact scope — what changes, what stays.
 2. Check test coverage of the affected area. If coverage is insufficient for safe refactoring, the first step must be characterization tests (Feathers, *Working Effectively with Legacy Code*) — suggest `ln-build` for that before continuing.
-3. Break the refactor into tiny commits. Order by safety: renames first (align to the lexicon in `memory/SPEC.md` if it exists), then extractions (deepen shallow modules — Ousterhout), then interface alignments, then behavioral changes last. Each commit is a complete, passing state. When a commit moves, renames, retires, or replaces files inside a directory that owns a `README.md`, the README update belongs in **the same commit as the topology change** — never deferred to a follow-up (see `AGENTS.md` §topology READMEs).
+3. Break the refactor into tiny commits. Order by safety: renames first (align to the lexicon in `memory/SPEC.md` if it exists), then extractions (deepen shallow modules — Ousterhout), then interface alignments, then behavioral changes last. Each commit is a complete, passing state. When a commit moves, renames, retires, or replaces files inside a directory that owns a `TOPOLOGY.md`, the topology update belongs in **the same commit as the topology change** — never deferred to a follow-up (see `AGENTS.md` §topology files).
 4. Write the refactor plan to `memory/REFACTOR.md`. Delete the file when the refactor is complete or superseded.
 
 ## Output
@@ -52,7 +52,7 @@ Ordered list of tiny commits. Each described in plain English — no file paths
 - Interface changes
 - Architectural decisions
 - Schema changes, API contracts
-- Topology READMEs touched (which directory READMEs the refactor will update or retire)
+- Topology files touched (which directory READMEs the refactor will update or retire)
 
 No file paths or code snippets — they go stale. Record in `memory/SPEC.md` §Decisions when finalized.
 

.agents/skills/ln-review/SKILL.md

@@ -65,7 +65,7 @@ If `memory/SPEC.md` §Oracle Strategy by Loop Tier exists, check whether recent
 
 Collect gaps as numbered findings (category: `oracle-coverage`).
 
-**Test-oracle hygiene for topology/prose sentinels.** Source/doc/resource substring tests are suspicious unless they either cross the production consumer that uses the resource (loader, prompt composition, package asset build, public API) or name a live topology contract from SPEC / a co-located README. Brunch intentionally materializes architecture into topology, so do not ban topology tests; distinguish named architecture sentinels from arbitrary path/prose locks. Route repairs to consumer-level tests, named boundary sentinels with decision citations, or deletion of completed-migration residue.
+**Test-oracle hygiene for topology/prose sentinels.** Source/doc/resource substring tests are suspicious unless they either cross the production consumer that uses the resource (loader, prompt composition, package asset build, public API) or name a live topology contract from SPEC / a co-located `TOPOLOGY.md`. Brunch intentionally materializes architecture into topology, so do not ban topology tests; distinguish named architecture sentinels from arbitrary path/prose locks. Route repairs to consumer-level tests, named boundary sentinels with decision citations, or deletion of completed-migration residue.
 
 **Notation aid.** Map test artifacts against acceptance leaves with `pseudo matrix` (coverage variant): rows = obligation leaves from a `pseudo tree` decomposition of the frontier acceptance, columns = test artifacts. Gaps surface as `.` cells; partial coverage as `~`. Compact, scannable, and the matrix itself becomes a coverage artifact reviewers can re-run.
 
@@ -120,10 +120,10 @@ Collect findings as numbered items (category: `topography`). Frame each as: what
 
 ### Topology README accuracy (category: `topography`)
 
-Directory `README.md` files under `src/**/` are canonical topology documentation (see `AGENTS.md` §topology READMEs). For each touched area, open the nearest README and check:
+Directory `TOPOLOGY.md` files under `src/**/` are canonical topology documentation (see `AGENTS.md` §topology files). For each touched area, open the nearest `TOPOLOGY.md` and check:
 
 - **Ownership statement** still matches what the directory actually owns and does not own
-- **SPEC decision IDs** cited (e.g. `D52-L`) still exist in `memory/SPEC.md` and still mean what the README implies they mean
+- **SPEC decision IDs** cited (e.g. `D52-L`) still exist in `memory/SPEC.md` and still mean what the topology file implies they mean
 - **Dependency-direction assertions** ("`graph/` imports from `db/`; no other layer imports `db/` directly") match the actual import graph in the touched files
 - **Layout sketches** still match the directory's contents — no retired files still listed, no new files unmentioned
 - **Migration notes** describe state that is still pending; shipped or abandoned migrations are stale and should retire

.agents/skills/ln-review/references/contract-lenses.md

@@ -19,7 +19,7 @@ Each finding routes to one of three repairs: **enforce it loudly** (fail on viol
 - A **tagged-union arm that is representable and boundary-accepted but has no semantics anywhere downstream** (validation checks kind membership only; derivation hits a default/zero branch) → a "dark variant" persists as permanently-inert data, silently (graduated 2026-06-11: `field`/`coverage` gap predicates were creatable but derived coverage 0 forever and could not be hand-answered). Repair: one exhaustive `never`-checked owner of per-arm semantics that both validation and derivation ride — every accepted arm gets an implementation or loud rejection at the boundary, and adding an arm without deciding its semantics fails to compile.
 - A **provider-visible string composed outside the ledgered render planes** (`content:` fields, custom entry copy, toolResult text built inline rather than in `renderers/` or the compose path) that restates behavior or decisions maintained elsewhere → the string is a duplicated behavioral claim with no wording oracle and no decision traceability, so decision revisions sweep the surrounding *comments* (reviewed) but not the *payload* (un-oracled), and the model acts on stale instructions (graduated 2026-06-12: `kickTurnMessage` still instructed the model that "a structured exchange offer was just presented" after revised D78-L retired the canned offer — the same module's docstring had been updated; elicitor gap guidance was similarly ad-hoc rather than source-of-truthed). Repair: name the contract — give the surface a ledger row (renderer ledger entry-copy rows) with a wording oracle (golden) or derive it from the source of truth; at minimum tag it with the decision ID it restates so revisions sweep it. Project-scoped lens: it is operative here because the provider-visible channel is enumerable and the golden/ledger discipline exists, and the stakes are high because these strings are control surfaces, not cosmetic copy. (Universal kernel, for calibration only: any string restating a contract maintained elsewhere drifts silently — but at that altitude it stops being searchable.)
 
-- A **topology/prose sentinel test without a product-entrypoint or named-contract oracle** (`readFile` / `access` / `readdir` plus hardcoded `src/...`, README phrases, retired path checks, or arbitrary prompt-resource `toContain` needles) → the test freezes representation or completed-migration residue rather than the behavior a user/runtime observes. It can pass while the production consumer is unwired, or fail during a harmless topology refactor. **Discriminator:** if the assertion crosses the real consumer (loader, prompt composition, package asset build, public API) or explicitly names a live SPEC / topology README contract that cannot be cheaply expressed elsewhere, it is legitimate architecture coverage; otherwise it is a prose/path lock. Repair class **name or relocate the oracle**: move to a consumer-level test, keep a narrow named boundary sentinel with decision citation, or delete the residue once the migration is closed. Do not generalize to "no topology tests" — Brunch deliberately materializes architecture into topology.
+- A **topology/prose sentinel test without a product-entrypoint or named-contract oracle** (`readFile` / `access` / `readdir` plus hardcoded `src/...`, README phrases, retired path checks, or arbitrary prompt-resource `toContain` needles) → the test freezes representation or completed-migration residue rather than the behavior a user/runtime observes. It can pass while the production consumer is unwired, or fail during a harmless topology refactor. **Discriminator:** if the assertion crosses the real consumer (loader, prompt composition, package asset build, public API) or explicitly names a live SPEC / topology file contract that cannot be cheaply expressed elsewhere, it is legitimate architecture coverage; otherwise it is a prose/path lock. Repair class **name or relocate the oracle**: move to a consumer-level test, keep a narrow named boundary sentinel with decision citation, or delete the residue once the migration is closed. Do not generalize to "no topology tests" — Brunch deliberately materializes architecture into topology.
 
 - A **capability-readiness / permission gate whose required precondition can only be produced by the capability it gates** — a *circular-precondition gate* (bootstrap-deadlock smell). The gate reads as ordinary defensive readiness ("don't allow X until the frame for X exists"), but the only path to the required state runs *through* X, so a fresh/empty subject can never satisfy it and the gate never opens — silently, with no error, presenting as "the tool just isn't available" (graduated 2026-06-22: `mutate_graph` was gated on `propose-graph` readiness, which required `context`/`thesis`/`goal`/`constraint` nodes that only `mutate_graph` can create — a fresh or foundation-light spec could never establish its own frame; D86-L floored the write tools). **Discriminator (mechanical, clears false positives): does the gated action *produce* the gated-on state?** If yes → circular, floor it. If the gated action only *consumes* state it doesn't write (audit gated on graph truth; a downstream/generative lens gated on a grounded frame it defers creating elsewhere), the gate is legitimate — not every readiness gate is circular. Repair class **floor the bootstrapping capability**: make the state-producing action ungated so the precondition can ever become true; keep readiness *advisory* for it (scale epistemic status / surface an establishment offer) rather than withholding the tool. Search seam: cross the capability→required-state map against the capability→granted-tools/actions map and flag any capability whose granted action writes its own required state.
 

.agents/skills/ln-scope/SKILL.md

@@ -135,7 +135,7 @@ The canonical context a fresh builder thread must resolve **before** building th
 - memory/SPEC.md   — decisions / invariants / assumptions: <ids>  (e.g. D53-L, A4-L)
 - memory/PLAN.md    — frontier: <frontier-id>
 - HANDOFF.md        — <live state this card depends on>            (omit if none)
-- <topology README / other canonical doc> — <what to read there>  (omit if none)
+- <`TOPOLOGY.md` / other canonical doc> — <what to read there>  (omit if none)
 ```
 
 This block is the answer to "could a separate builder thread work this card cold?" If you cannot enumerate the reads that make the card resolvable, the card is under-scoped — not the reader under-briefed.
@@ -178,7 +178,7 @@ A tracer bullet should *tell you something*. Build it.
 **Earned posture.** A good closure slice answers at least one of:
 
 - What dual shape, ambiguity, or open decision does landing this **close**?
-- What settled decision does it **materialize** into topology (file/directory placement, sub-tree split, topology README)?
+- What settled decision does it **materialize** into topology (file/directory placement, sub-tree split, topology file)?
 - What term, API, or location does it **canonicalize**?
 - What obsolete code path, fixture, doc, or bridge does it **delete / retire**?
 - What invariant, contract, or shape does it **lock in** as the completion test?