From 847b4129a53e4cb6e48a88532468ed453c9f20d2 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 00:47:21 +0100
Subject: [PATCH 1/8] docs: plan itd-104 and write spc-18 ideate spec

The 2026-07-27 grill settled the design; the spec records the
settlements plus the mechanism (three host-delegated legs, binary
validates cited record ids and writes the dated research verdict,
survivors graduate through the existing intent create). Freshly
minted id collided again (iss-80 class): renumbered to spc-18.

Assisted-by: Claude:claude-fable-5
---
 ...-before-it-becomes-a-record-entry-resea.md |  4 +-
 ...-before-it-becomes-a-record-entry-resea.md | 98 +++++++++++++++++++
 .abcd/work/DECISIONS.md                       |  1 +
 3 files changed, 101 insertions(+), 2 deletions(-)
 rename .abcd/development/intents/{drafts => planned}/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md (99%)
 create mode 100644 .abcd/development/specs/open/spc-18-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md

diff --git a/.abcd/development/intents/drafts/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md b/.abcd/development/intents/planned/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
similarity index 99%
rename from .abcd/development/intents/drafts/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
rename to .abcd/development/intents/planned/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
index abd2f3f..3af5963 100644
--- a/.abcd/development/intents/drafts/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
+++ b/.abcd/development/intents/planned/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
@@ -1,8 +1,8 @@
 ---
 id: itd-104
 slug: abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea
-spec_id: null
-kind: null
+spec_id: spc-18
+kind: standalone
 suggested_kind: null
 reclassification_history: []
 builds_on: []
diff --git a/.abcd/development/specs/open/spc-18-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md b/.abcd/development/specs/open/spc-18-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
new file mode 100644
index 0000000..e0d3de7
--- /dev/null
+++ b/.abcd/development/specs/open/spc-18-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md
@@ -0,0 +1,98 @@
+---
+id: spc-18
+slug: abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea
+intent: itd-104
+---
+# abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea
+
+## Summary
+
+spc-18 delivers itd-104's idea-admission protocol: `/abcd:ideate`, an
+optional three-leg gauntlet — primary-source research, a record grill, and an
+independent adversarial review — whose outcome is a registered verdict with
+rejected alternatives, recorded whether the idea survives or dies. Only a
+survivor graduates to a draft intent. The design decisions below were settled
+by the 2026-07-27 grill; this spec records them together with the mechanism —
+it does not reopen them.
+
+## Settled constraints (from the grill)
+
+- **Optional verb, never a gate.** Capture friction stays at one line: no
+  ideate step is required or suggested as blocking by the intent or capture
+  verbs. The routing help carries the nudge — ideate is named for big,
+  unproven ideas.
+- **The adversarial leg codifies fresh-context, off-policy, unknown
+  authorship** — the evaluator did not do the research and receives the idea
+  as an artefact of unknown authorship. This is the only measured debiasing
+  effect, per the salvaged 2026-07-14 research record, and it is the
+  evaluator-outside-the-loop principle applied to ideas.
+- **Two load-bearing steps survive automation** (from the proven manual run):
+  check the record first, and open the primary source.
+
+## Mechanism
+
+### Division of labour
+
+Ideate follows the host-delegated pattern the disembark family proved: the
+host runs the judgement legs as agents; the abcd binary is the deterministic
+frame that scaffolds the run, validates the legs' outputs, and writes the
+record. The binary never does LLM work; the host never writes the record
+directly.
+
+### The three legs, in order
+
+1. **Primary-source research.** A host agent researches the idea's
+   load-bearing claims, each checked against its primary source — a claim
+   carries its primary URL or document reference, never only a secondary
+   citation. Output: a claims table (claim, primary source, verified /
+   falsified / unverifiable).
+2. **Record grill.** A host agent reads the existing record — brief, intents
+   (all buckets), ADRs, principles — and answers: does an entry cover,
+   contradict, or supersede this idea? Every hit is cited by record id. The
+   binary validates at ingest that every cited id resolves in the repository
+   — a verdict citing a non-existent record is refused.
+3. **Adversarial review.** A fresh-context agent, off-policy, receiving the
+   idea and the two earlier legs' outputs as artefacts of unknown authorship,
+   tries to kill the idea. It did not conduct the research (evaluator outside
+   the loop).
+
+### Verdict record (spec-time decision)
+
+The verdict is a dated research record:
+`.abcd/development/research/YYYY-MM-DD-ideate-<idea-slug>.md`, written by the
+binary from a structured verdict the host supplies
+(`abcd ideate record <idea-slug> --verdict-json <file>`). It contains the
+idea as captured, the three legs' findings, the verdict
+(survives / killed / reframed), the rejected alternatives, and — for record
+grill hits — the cited record ids. A one-line dated entry in
+`.abcd/work/DECISIONS.md` points at it. No new record family: killed ideas
+are research outcomes, and the research directory is where a future session
+looks before re-proposing one. A surviving idea graduates through the
+existing quoted-text intent create — ideate mints no intents itself.
+
+### Wiring
+
+Both planes at delivery: the `abcd ideate` verb family (CLI) and the
+`/abcd:ideate` skill (`commands/abcd/ideate.md`) that orchestrates the three
+legs and feeds the verdict to the binary. The routing help in the intent and
+capture surfaces names ideate as the optional path for big, unproven ideas —
+a pointer, never a precondition.
+
+## Acceptance-criteria mapping
+
+- AC 1 (never blocking; routing help names it) → Settled constraints +
+  Wiring.
+- AC 2 (three legs in order; adversarial leg fresh-context, off-policy,
+  unknown authorship) → The three legs.
+- AC 3 (decision recorded with rejected alternatives either way; only
+  survivors graduate) → Verdict record.
+- AC 4 (record-grill hits cited by id, validated) → The three legs + Verdict
+  record.
+
+## Out of scope
+
+- Consuming a lifeboat or external document as the idea source (open
+  question retained; the idea arrives as quoted text in this spec).
+- Any change to capture or intent-create flow beyond the routing-help text.
+- Automation of the legs inside the binary — the legs are host agents by
+  boundary; the binary validates and records.
diff --git a/.abcd/work/DECISIONS.md b/.abcd/work/DECISIONS.md
index 7cc9a06..17998a5 100644
--- a/.abcd/work/DECISIONS.md
+++ b/.abcd/work/DECISIONS.md
@@ -862,3 +862,4 @@ parallel-agent merge contention bites.
 - 2026-07-27 — ADOPTED the canonical tagline: "A host-agnostic configuration layer for intent-driven development." Canonical identity home is the brief product chapter (01-product README, Identity section: title / tagline / pitch); README strapline, plugin manifest description, and AGENTS.md opening render from it. README's former strapline ("An opinionated, intent-driven development framework for product thinkers") is retired as a surface line; the product-thinker framing lives on in the README body. Rejected wordings: "for agent harnesses" (object shift, host/harness redundancy, plural over-promise), "over any agent harness" (drops the domain). Resolves iss-143; itd-102 generalises the drift check for managed repos.
 - 2026-07-27 — itd-93 parity tension resolved: Branch A. The scaffold template is the single source for release.yml/auto-release.yml; abcd-cli's live workflows are regenerated from it; the only sanctioned live diff is the additive workflow_dispatch rehearsal (trigger + non-publishing dry-run job). Rejected: substitution-gating the rehearsal off for abcd (weakens the parity guarantee on the one novel component).
 - 2026-07-27 — GRILLED itd-101/102/103/104 to settlement (six decisions, each now in its intent's Grill Settlements + acceptance criteria): itd-103 guard fails open loudly, blocker/warn tiers with committed-only overrides, shell-token-aware command-position matching with an itd-81-style TNR-floored corpus; itd-101 refresh is manual-with-nagging (scheduled CI later, own sign-off), staleness warns at 180d and blocks releases at 365d, human verifications age on the same clock; itd-102 identity lives in a parseable markdown block (config points at it), check is warn-tier and never rewrites; itd-104 ideate is an optional verb, never a pre-capture gate, with a fresh-context off-policy adversary. All four drafts are grill-settled and await intent plan.
+- 2026-07-28: itd-104 spec minted as spc-16 (third live iss-80 instance this run: 16 sits on unmerged #156, 17 on the itd-101 branch); renumbered to spc-18 by hand — ids on this branch deliberately skip 16 and 17.

From c5a42f363c0ac7036d85e8ed830106cacba7c1be Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:12:57 +0100
Subject: [PATCH 2/8] refactor: promote the untrusted-prose cleaner to termsafe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The lifeboat synthesis seam and the release ingest seam each carried their own
copy of the same primitive — neutralise line breaks and HTML comment markers,
sanitise, normalise whitespace, cap — and ingest.go's own comment asked that a
third caller promote it rather than write it again. The ideate ingest seam is
that third caller.

termsafe is the home because the cleaner IS Sanitize plus the two
neutralisations a file writer always makes and a terminal sanitiser has no
reason to. Two forms are kept because the two existing callers legitimately
differ: CleanProse trims, CleanProseLine collapses runs to one space for prose
landing in a line-structured file. Both callers keep their exact prior
behaviour.

Assisted-by: Claude:claude-opus-5[1m]
---
 .../core/lifeboat/synthesis_principles.go     | 17 ++--
 internal/core/release/ingest.go               | 23 ++---
 internal/termsafe/prose.go                    | 56 +++++++++++++
 internal/termsafe/prose_test.go               | 84 +++++++++++++++++++
 4 files changed, 151 insertions(+), 29 deletions(-)
 create mode 100644 internal/termsafe/prose.go
 create mode 100644 internal/termsafe/prose_test.go

diff --git a/internal/core/lifeboat/synthesis_principles.go b/internal/core/lifeboat/synthesis_principles.go
index 023be07..4eac9b6 100644
--- a/internal/core/lifeboat/synthesis_principles.go
+++ b/internal/core/lifeboat/synthesis_principles.go
@@ -34,6 +34,7 @@ import (
 
 	"github.com/REPPL/abcd-cli/internal/core/frontmatter"
 	"github.com/REPPL/abcd-cli/internal/fsutil"
+	"github.com/REPPL/abcd-cli/internal/termsafe"
 )
 
 // SynthesizePrinciples builds or ingests principles.json (+ principles.md) for a
@@ -399,19 +400,11 @@ func oracleOwnOutput(rel string) bool {
 func cleanSynthProse(s string) string { return cleanSynthProseN(s, maxSynthProseBytes) }
 
 // cleanSynthProseN is cleanSynthProse with an explicit byte cap, so a longer-form
-// field (the press-release body) can share one sanitiser at its own ceiling.
+// field (the press-release body) can share one sanitiser at its own ceiling. The
+// cleaning itself is termsafe's — the canonical home this seam and the release
+// ingest seam both route through, rather than keeping divergent copies.
 func cleanSynthProseN(s string, capBytes int) string {
-	s = strings.ReplaceAll(s, "\r", " ")
-	s = strings.ReplaceAll(s, "\n", " ")
-	s = strings.ReplaceAll(s, "<!--", "< !--")
-	s = strings.ReplaceAll(s, "-->", "-- >")
-	s = sanitize(s)
-	s = strings.TrimSpace(s)
-	if len(s) > capBytes {
-		s = strings.ToValidUTF8(s[:capBytes], "")
-		s = strings.TrimSpace(s)
-	}
-	return s
+	return termsafe.CleanProse(s, capBytes)
 }
 
 // filterSynthEvidence keeps only the refs that are members of valid, deduped and
diff --git a/internal/core/release/ingest.go b/internal/core/release/ingest.go
index e1a01cc..1d4d7d5 100644
--- a/internal/core/release/ingest.go
+++ b/internal/core/release/ingest.go
@@ -551,24 +551,13 @@ func insertSection(root string, section []string) (string, error) {
 	return content, nil
 }
 
-// cleanChangelogProse sanitises one untrusted composed line. It mirrors
-// lifeboat's cleanSynthProseN (the two are the same primitive at two trust
-// boundaries; a THIRD copy should promote it to a shared home rather than be
-// written again) and the collapse is load-bearing here in a way it is not there:
-// this prose lands in a file whose line structure is machine-read, so an embedded
-// newline could otherwise forge a heading, a section, or a whole release.
+// cleanChangelogProse sanitises one untrusted composed line through termsafe's
+// canonical prose cleaner. The LINE form is load-bearing here in a way the plain
+// form is not: this prose lands in a file whose line structure is machine-read, so
+// an embedded newline could otherwise forge a heading, a section, or a whole
+// release.
 func cleanChangelogProse(s string) string {
-	s = strings.ReplaceAll(s, "\r", " ")
-	s = strings.ReplaceAll(s, "\n", " ")
-	s = strings.ReplaceAll(s, "<!--", "< !--")
-	s = strings.ReplaceAll(s, "-->", "-- >")
-	s = termsafe.Sanitize(s)
-	s = strings.Join(strings.Fields(s), " ")
-	if len(s) > maxEntryProseBytes {
-		s = strings.ToValidUTF8(s[:maxEntryProseBytes], "")
-		s = strings.TrimSpace(s)
-	}
-	return s
+	return termsafe.CleanProseLine(s, maxEntryProseBytes)
 }
 
 // sectionList renders the registered sections for an error message, written from
diff --git a/internal/termsafe/prose.go b/internal/termsafe/prose.go
new file mode 100644
index 0000000..236ca64
--- /dev/null
+++ b/internal/termsafe/prose.go
@@ -0,0 +1,56 @@
+package termsafe
+
+// prose.go is the shared home for the untrusted-prose cleaner every host-delegated
+// ingest boundary needs before a model-supplied string is written into a durable
+// markdown or JSON record.
+//
+// It sits beside Sanitize because it IS Sanitize plus the two neutralisations a
+// terminal sanitiser has no reason to make, but a FILE writer always does:
+//
+//   - line breaks become spaces, so one prose field can never forge a second line
+//     (a changelog bullet, a markdown table row, a list item) in the record;
+//   - `<!--` and `-->` are broken apart, so prose can neither open nor close an
+//     HTML comment and swallow — or expose — the record around it.
+//
+// Two forms exist because two callers legitimately want different whitespace
+// handling, and the difference is visible in the record: CleanProse trims,
+// CleanProseLine collapses every run to one space. A field landing in a
+// line-structured file (a bullet, a table cell) wants the line form.
+//
+// This is the canonical home: internal/core/lifeboat and internal/core/release
+// route through it rather than keep divergent copies, and a new trust boundary
+// (internal/core/ideate) reuses it instead of writing a third.
+
+import "strings"
+
+// CleanProse neutralises one untrusted prose field and caps it at capBytes,
+// preserving interior whitespace runs. The cap is applied last and the result is
+// re-trimmed, so a cut landing mid-word leaves no dangling space; a cut landing
+// mid-rune drops the partial rune rather than emitting replacement bytes.
+func CleanProse(s string, capBytes int) string {
+	return cleanProse(s, capBytes, strings.TrimSpace)
+}
+
+// CleanProseLine is CleanProse for a field that must occupy exactly one line:
+// every whitespace run collapses to a single space before the cap is applied. Use
+// it wherever the prose lands in a file whose line structure is machine-read.
+func CleanProseLine(s string, capBytes int) string {
+	return cleanProse(s, capBytes, func(v string) string { return strings.Join(strings.Fields(v), " ") })
+}
+
+// cleanProse is the shared body: neutralise, sanitise, normalise whitespace the
+// caller's way, then cap. Written once so the two forms can only differ in the
+// one dimension they are meant to differ in.
+func cleanProse(s string, capBytes int, normalise func(string) string) string {
+	s = strings.ReplaceAll(s, "\r", " ")
+	s = strings.ReplaceAll(s, "\n", " ")
+	s = strings.ReplaceAll(s, "<!--", "< !--")
+	s = strings.ReplaceAll(s, "-->", "-- >")
+	s = Sanitize(s)
+	s = normalise(s)
+	if len(s) > capBytes {
+		s = strings.ToValidUTF8(s[:capBytes], "")
+		s = strings.TrimSpace(s)
+	}
+	return s
+}
diff --git a/internal/termsafe/prose_test.go b/internal/termsafe/prose_test.go
new file mode 100644
index 0000000..4934af0
--- /dev/null
+++ b/internal/termsafe/prose_test.go
@@ -0,0 +1,84 @@
+package termsafe
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestCleanProseNeutralisesStructure proves the shared prose cleaner does the
+// four things every untrusted-prose boundary needs: line breaks cannot forge
+// structure, HTML comment markers cannot open or close a comment, terminal
+// display attacks are masked, and the result is capped.
+func TestCleanProseNeutralisesStructure(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		cap  int
+		want string
+	}{
+		{"newline-to-space", "one\ntwo", 100, "one two"},
+		{"carriage-return-to-space", "one\rtwo", 100, "one two"},
+		{"comment-open-broken", "text <!-- hidden", 100, "text < !-- hidden"},
+		{"comment-close-broken", "hidden --> text", 100, "hidden -- > text"},
+		{"escape-masked", "red" + string(rune(0x1b)) + "[31m", 100, "red?[31m"},
+		{"trimmed", "   padded   ", 100, "padded"},
+		{"capped", strings.Repeat("a", 20), 8, "aaaaaaaa"},
+		{"cap-trims-trailing-space", "abcdefg hijk", 8, "abcdefg"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := CleanProse(c.in, c.cap); got != c.want {
+				t.Errorf("CleanProse(%q, %d) = %q, want %q", c.in, c.cap, got, c.want)
+			}
+		})
+	}
+}
+
+// TestCleanProseKeepsInteriorRuns proves CleanProse leaves interior whitespace
+// alone — it trims, it does not collapse. That is the difference from
+// CleanProseLine, and a caller picking the wrong one would silently reflow prose.
+func TestCleanProseKeepsInteriorRuns(t *testing.T) {
+	if got, want := CleanProse("a  b\tc", 100), "a  b c"; got != want {
+		t.Errorf("CleanProse kept-runs = %q, want %q", got, want)
+	}
+}
+
+// TestCleanProseLineCollapsesWhitespace proves the line form collapses every
+// whitespace run to one space, so prose landing in a line-structured file (a
+// changelog bullet, a markdown table cell) occupies exactly one line.
+func TestCleanProseLineCollapsesWhitespace(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		cap  int
+		want string
+	}{
+		{"runs-collapsed", "a  b\tc", 100, "a b c"},
+		{"newline-collapsed", "one\n\ntwo", 100, "one two"},
+		{"comment-open-broken", "text <!-- hidden", 100, "text < !-- hidden"},
+		{"capped-after-collapse", "aaaa  bbbb  cccc", 10, "aaaa bbbb"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := CleanProseLine(c.in, c.cap); got != c.want {
+				t.Errorf("CleanProseLine(%q, %d) = %q, want %q", c.in, c.cap, got, c.want)
+			}
+		})
+	}
+}
+
+// TestCleanProseTruncationStaysValidUTF8 proves a cap landing mid-rune does not
+// leave a broken code point behind — the truncated tail is dropped, never emitted
+// as replacement bytes.
+func TestCleanProseTruncationStaysValidUTF8(t *testing.T) {
+	// "é" is two bytes; a 3-byte cap over "aaé" lands mid-rune.
+	got := CleanProse("aaé", 3)
+	if got != "aa" {
+		t.Errorf("CleanProse mid-rune cap = %q, want %q", got, "aa")
+	}
+	for _, r := range got {
+		if r == '�' {
+			t.Fatalf("CleanProse emitted a replacement rune: %q", got)
+		}
+	}
+}

From 65154c2942dbc7ed99e65e1e6db4b92d96a3579b Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:14:36 +0100
Subject: [PATCH 3/8] feat: resolve cited record ids against the live
 repository record

An ingest boundary that accepts a citation has to answer "does this id name a
real record", and nothing in the tree answered it. recordid already owns the id
space and the filename grammar for the minting side, so the read side belongs
beside it rather than next to whichever consumer needs it first.

Only the four id-bearing families resolve (itd/spc/iss/adr); the brief and the
principles carry no per-entry id, so a reference to one is prose, never a
citation. The scan is shallow (family root plus one bucket level), budgeted, and
symlink-refusing, so a planted link cannot make a record appear to exist and a
pathological tree cannot dominate an ingest. An absent family is not an error; an
unreadable present one is, because reporting "no such record" for a store that
could not be read would refuse a correct citation.

Assisted-by: Claude:claude-opus-5[1m]
---
 internal/core/recordid/resolve.go      | 198 +++++++++++++++++++++++++
 internal/core/recordid/resolve_test.go | 137 +++++++++++++++++
 2 files changed, 335 insertions(+)
 create mode 100644 internal/core/recordid/resolve.go
 create mode 100644 internal/core/recordid/resolve_test.go

diff --git a/internal/core/recordid/resolve.go b/internal/core/recordid/resolve.go
new file mode 100644
index 0000000..25eb8c4
--- /dev/null
+++ b/internal/core/recordid/resolve.go
@@ -0,0 +1,198 @@
+package recordid
+
+// resolve.go is the READ side of this package: given a repository, which record
+// ids actually exist?
+//
+// MaxAcrossRefs answers "what is the next free id"; a resolver answers "does the
+// id this payload cites name a real record". Both questions are about the same
+// id space and the same filename grammar, so they share a home — a second
+// resolver living next to a consumer (an ingest seam, a lint rule) would drift
+// from the minting side the first time a family moved.
+//
+// Only the four ID-BEARING families are resolvable. The brief and the principles
+// carry no per-entry id, so a citation of one cannot be validated by id at all;
+// a caller that needs to reference them does so in prose, never as a citation.
+//
+// The scan is deliberately SHALLOW (a family root plus one bucket level) and
+// symlink-refusing: the record families are flat-with-buckets by construction, an
+// unbounded walk would let a pathological tree dominate the cost of an ingest,
+// and following a link would let a planted symlink make a record appear to exist.
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"syscall"
+)
+
+// CitedIDRe is the canonical grammar of a cited record id: one of the four
+// id-bearing family prefixes, a hyphen, and a bare decimal N. It is exported
+// because every ingest boundary that accepts a citation must bound and shape the
+// string BEFORE it is looked up or echoed, and they must all agree on the shape.
+var CitedIDRe = regexp.MustCompile(`^(?:adr|itd|iss|spc)-[0-9]+$`)
+
+// adrFileRe matches an ADR filename NNNN-slug.md and captures the number. ADRs
+// are the one family whose file does not carry its own id spelling, so the id is
+// derived from the numeric prefix.
+var adrFileRe = regexp.MustCompile(`^([0-9]+)-[^/]*\.md$`)
+
+// maxScanEntries bounds how many directory entries one resolver may read across
+// every family. A repository with more records than this is pathological or
+// hostile; the scan refuses rather than growing unboundedly, and refusing is safe
+// because the caller fails closed on the error.
+const maxScanEntries = 20000
+
+// familyRoots names each id-bearing family's store, repo-relative and
+// slash-separated. Written once, in the order a reader expects them.
+var familyRoots = []struct {
+	prefix string
+	dir    string
+}{
+	{"itd", ".abcd/development/intents"},
+	{"spc", ".abcd/development/specs"},
+	{"iss", ".abcd/work/issues"},
+	{"adr", ".abcd/development/decisions/adrs"},
+}
+
+// Resolver is the live record-id set of one repository, read once. It is a
+// snapshot: build it at the start of a validation pass and use it throughout, so
+// every citation in one payload is judged against the same view of the record.
+type Resolver struct {
+	ids map[string]string
+}
+
+// NewResolver reads repoRoot's record families and returns the resolver over
+// them.
+//
+// An ABSENT family is not an error — a repository need not carry every store, and
+// its ids simply do not resolve. An unreadable family that IS present IS an
+// error: reporting "this id names no record" when the truth is "the store could
+// not be read" would refuse a correct citation, so the scan fails closed and lets
+// the caller say what actually happened.
+func NewResolver(repoRoot string) (*Resolver, error) {
+	r := &Resolver{ids: map[string]string{}}
+	budget := maxScanEntries
+	for _, fam := range familyRoots {
+		if err := r.scanFamily(repoRoot, fam.prefix, fam.dir, &budget); err != nil {
+			return nil, err
+		}
+	}
+	return r, nil
+}
+
+// Lookup returns the repo-relative path of the record id, and whether it exists.
+// A malformed id simply does not resolve — callers that must distinguish
+// "malformed" from "absent" check CitedIDRe first, which they do anyway to bound
+// the string before echoing it.
+func (r *Resolver) Lookup(id string) (string, bool) {
+	p, ok := r.ids[id]
+	return p, ok
+}
+
+// Len reports how many record ids resolved — the size of the live record.
+func (r *Resolver) Len() int { return len(r.ids) }
+
+// scanFamily reads one family root and, one level down, each of its buckets. It
+// decrements the shared entry budget so the ceiling is over the whole scan rather
+// than per family.
+func (r *Resolver) scanFamily(repoRoot, prefix, relDir string, budget *int) error {
+	entries, err := readDirIfPresent(filepath.Join(repoRoot, filepath.FromSlash(relDir)))
+	if err != nil {
+		return fmt.Errorf("recordid: reading %s: %w", relDir, err)
+	}
+	for _, e := range entries {
+		if *budget--; *budget < 0 {
+			return fmt.Errorf("recordid: more than %d record files; refusing to scan further", maxScanEntries)
+		}
+		// Never follow a link: a symlinked file could make a record appear to
+		// exist, and a symlinked directory could walk the scan out of the repo.
+		if e.Type()&os.ModeSymlink != 0 {
+			continue
+		}
+		if !e.IsDir() {
+			r.record(prefix, relDir, e.Name())
+			continue
+		}
+		bucketRel := path.Join(relDir, e.Name())
+		inner, err := readDirIfPresent(filepath.Join(repoRoot, filepath.FromSlash(bucketRel)))
+		if err != nil {
+			return fmt.Errorf("recordid: reading %s: %w", bucketRel, err)
+		}
+		for _, f := range inner {
+			if *budget--; *budget < 0 {
+				return fmt.Errorf("recordid: more than %d record files; refusing to scan further", maxScanEntries)
+			}
+			if f.IsDir() || f.Type()&os.ModeSymlink != 0 {
+				continue
+			}
+			r.record(prefix, bucketRel, f.Name())
+		}
+	}
+	return nil
+}
+
+// record derives name's id for its family and, when it has one, maps it to the
+// file. First writer wins, so a duplicate id across buckets keeps the first path
+// in scan order — the resolver answers "does it exist", and any duplicate is the
+// record-lint uniqueness rules' business, not this one's.
+func (r *Resolver) record(prefix, relDir, name string) {
+	id := fileID(prefix, name)
+	if id == "" {
+		return
+	}
+	if _, seen := r.ids[id]; seen {
+		return
+	}
+	r.ids[id] = path.Join(relDir, name)
+}
+
+// fileID derives a record id from a filename within its family. The three
+// slug-prefixed families spell their own id (itd-104-<slug>.md); ADRs carry a
+// zero-padded ordinal instead (0037-<slug>.md → adr-37).
+func fileID(prefix, name string) string {
+	if prefix == "adr" {
+		m := adrFileRe.FindStringSubmatch(name)
+		if m == nil {
+			return ""
+		}
+		n, err := strconv.Atoi(m[1])
+		if err != nil || n <= 0 {
+			return ""
+		}
+		return "adr-" + strconv.Itoa(n)
+	}
+	m := idRe(prefix).FindStringSubmatch(name)
+	if m == nil {
+		return ""
+	}
+	n, err := strconv.Atoi(m[1])
+	if err != nil || n <= 0 {
+		return ""
+	}
+	// Rebuilt from the parsed integer, never from the matched text, so a
+	// zero-padded filename cannot mint a second spelling of the same id.
+	return prefix + "-" + strconv.Itoa(n)
+}
+
+// readDirIfPresent reads a directory, treating "absent" and "not a directory" as
+// an empty listing and refusing a symlinked root outright. Every other fault is
+// returned so the caller fails closed.
+func readDirIfPresent(dir string) ([]os.DirEntry, error) {
+	fi, err := os.Lstat(dir)
+	if err != nil {
+		// Absent, or a prefix component that is not a directory: both mean "this
+		// family is not here", which is a legitimate repository shape.
+		if errors.Is(err, os.ErrNotExist) || errors.Is(err, syscall.ENOTDIR) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	if !fi.IsDir() || fi.Mode()&os.ModeSymlink != 0 {
+		return nil, nil
+	}
+	return os.ReadDir(dir)
+}
diff --git a/internal/core/recordid/resolve_test.go b/internal/core/recordid/resolve_test.go
new file mode 100644
index 0000000..7240902
--- /dev/null
+++ b/internal/core/recordid/resolve_test.go
@@ -0,0 +1,137 @@
+package recordid
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// seedRecords lays out a miniature record tree: the four id-bearing families in
+// their canonical homes, each with a bucket level, so the resolver is exercised
+// against the shape a real repository has.
+func seedRecords(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	files := []string{
+		".abcd/development/intents/drafts/itd-7-a-draft.md",
+		".abcd/development/intents/planned/itd-104-the-ideate-gate.md",
+		".abcd/development/intents/shipped/itd-88.md",
+		".abcd/development/specs/open/spc-18-ideate.md",
+		".abcd/development/specs/closed/spc-6-issue-capture.md",
+		".abcd/work/issues/open/iss-146-a-guard.md",
+		".abcd/work/issues/resolved/iss-32-consolidation.md",
+		".abcd/development/decisions/adrs/0001-three-layer-mental-model.md",
+		".abcd/development/decisions/adrs/0037-release-workflow.md",
+	}
+	for _, rel := range files {
+		abs := filepath.Join(root, filepath.FromSlash(rel))
+		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(abs, []byte("# record\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return root
+}
+
+// TestResolverFindsEveryFamily proves one resolver recognises all four cited
+// families — including an ADR, whose id lives in the NNNN- filename prefix and
+// not in the id grammar the filename uses.
+func TestResolverFindsEveryFamily(t *testing.T) {
+	root := seedRecords(t)
+	r, err := NewResolver(root)
+	if err != nil {
+		t.Fatalf("NewResolver: %v", err)
+	}
+	want := map[string]string{
+		"itd-7":   ".abcd/development/intents/drafts/itd-7-a-draft.md",
+		"itd-104": ".abcd/development/intents/planned/itd-104-the-ideate-gate.md",
+		"itd-88":  ".abcd/development/intents/shipped/itd-88.md",
+		"spc-18":  ".abcd/development/specs/open/spc-18-ideate.md",
+		"spc-6":   ".abcd/development/specs/closed/spc-6-issue-capture.md",
+		"iss-146": ".abcd/work/issues/open/iss-146-a-guard.md",
+		"iss-32":  ".abcd/work/issues/resolved/iss-32-consolidation.md",
+		"adr-1":   ".abcd/development/decisions/adrs/0001-three-layer-mental-model.md",
+		"adr-37":  ".abcd/development/decisions/adrs/0037-release-workflow.md",
+	}
+	for id, path := range want {
+		got, ok := r.Lookup(id)
+		if !ok {
+			t.Errorf("Lookup(%q): not resolved", id)
+			continue
+		}
+		if got != path {
+			t.Errorf("Lookup(%q) = %q, want %q", id, got, path)
+		}
+	}
+}
+
+// TestResolverRejectsAbsentAndMalformed proves an id that names no record does
+// not resolve, and that a well-formed-but-absent id is reported the same way as
+// a malformed one — the caller decides what to do with either.
+func TestResolverRejectsAbsentAndMalformed(t *testing.T) {
+	root := seedRecords(t)
+	r, err := NewResolver(root)
+	if err != nil {
+		t.Fatalf("NewResolver: %v", err)
+	}
+	for _, id := range []string{"itd-9999", "adr-2", "spc-1", "iss-1", "itd-0007", "", "itd", "ITD-7", "itd-7-a-draft"} {
+		if path, ok := r.Lookup(id); ok {
+			t.Errorf("Lookup(%q) resolved to %q; want unresolved", id, path)
+		}
+	}
+}
+
+// TestResolverEmptyRepo proves a repository with no record tree at all is not an
+// error: there are simply no ids to resolve.
+func TestResolverEmptyRepo(t *testing.T) {
+	r, err := NewResolver(t.TempDir())
+	if err != nil {
+		t.Fatalf("NewResolver over an empty repo: %v", err)
+	}
+	if n := r.Len(); n != 0 {
+		t.Errorf("Len() = %d over an empty repo, want 0", n)
+	}
+}
+
+// TestResolverIgnoresSymlinkedEntries proves the scan never follows a symlink,
+// so a planted link cannot make a record appear to exist (nor make the scan walk
+// out of the repository).
+func TestResolverIgnoresSymlinkedEntries(t *testing.T) {
+	root := seedRecords(t)
+	outside := t.TempDir()
+	if err := os.WriteFile(filepath.Join(outside, "itd-500-planted.md"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(root, ".abcd/development/intents/drafts/itd-500-planted.md")
+	if err := os.Symlink(filepath.Join(outside, "itd-500-planted.md"), link); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	dirLink := filepath.Join(root, ".abcd/development/intents/elsewhere")
+	if err := os.Symlink(outside, dirLink); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	r, err := NewResolver(root)
+	if err != nil {
+		t.Fatalf("NewResolver: %v", err)
+	}
+	if path, ok := r.Lookup("itd-500"); ok {
+		t.Errorf("a symlinked record resolved to %q; want unresolved", path)
+	}
+}
+
+// TestCitedIDReGrammar pins the cited-id grammar: the four id-bearing families,
+// bare decimal N, nothing else.
+func TestCitedIDReGrammar(t *testing.T) {
+	for _, ok := range []string{"itd-1", "iss-146", "spc-18", "adr-37"} {
+		if !CitedIDRe.MatchString(ok) {
+			t.Errorf("CitedIDRe rejected %q", ok)
+		}
+	}
+	for _, bad := range []string{"ITD-1", "itd_1", "itd-", "itd-1-slug", "prn-1", "fnd-1", "../itd-1", "itd-1 "} {
+		if CitedIDRe.MatchString(bad) {
+			t.Errorf("CitedIDRe accepted %q", bad)
+		}
+	}
+}

From 166f490af298451663e272550ff046a216d0b310 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:23:24 +0100
Subject: [PATCH 4/8] feat: ideate record validates and writes the
 idea-admission verdict
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

itd-104's core: the deterministic frame around the three-leg gauntlet. The host
runs the judgement — primary-source research, a grill against the existing
record, an independent adversarial review — and this validates what it produced
and writes the durable verdict. It never fetches a source and never calls a
model.

Four gates carry the acceptance criteria. The legs are an ordered array, not
three named fields, precisely so "three legs, in order" is a property of the
document the binary can check rather than one it assumes. Every grill hit is
cited by record id and every id must resolve in this repository; an id naming no
record refuses the whole verdict and names the id. The verdict is a closed enum.
And an empty rejected-alternatives list is admissible only behind an explicit
marker — silence by omission is the exact failure the record exists to prevent.

Refusals are whole-document, never cite-or-be-dropped: a verdict record with a
quietly-dropped falsified claim is worse than no record, because a later session
trusts it. Every refusal returns before the first write; the one write that can
strand a record (the decision-log pointer failing after the record lands) rolls
the record back.

Write containment is two-layer, per the itd-101 lesson: the slug grammar admits
no separator or dot segment before any path is built, and os.Root guards the leaf
lookup. A mutation run with the lexical layer removed confirms os.Root alone
still refuses a traversal slug.

Assisted-by: Claude:claude-opus-5[1m]
---
 internal/core/ideate/ideate.go      | 290 ++++++++++++++
 internal/core/ideate/record.go      | 492 ++++++++++++++++++++++++
 internal/core/ideate/record_test.go | 561 ++++++++++++++++++++++++++++
 internal/core/ideate/render.go      | 162 ++++++++
 4 files changed, 1505 insertions(+)
 create mode 100644 internal/core/ideate/ideate.go
 create mode 100644 internal/core/ideate/record.go
 create mode 100644 internal/core/ideate/record_test.go
 create mode 100644 internal/core/ideate/render.go

diff --git a/internal/core/ideate/ideate.go b/internal/core/ideate/ideate.go
new file mode 100644
index 0000000..0131461
--- /dev/null
+++ b/internal/core/ideate/ideate.go
@@ -0,0 +1,290 @@
+// Package ideate is the deterministic frame around abcd's idea-admission
+// protocol (itd-104, spc-18): the three-leg gauntlet an idea may be put through
+// before it is allowed to become a record entry.
+//
+// DIVISION OF LABOUR. Ideate follows the pattern the disembark synthesis family
+// proved. The HOST runs the judgement — primary-source research, a grill against
+// the existing record, and an independent adversarial review — as agents. This
+// package is the frame: it validates what those legs produced, proves every
+// citation names a real record, and writes the durable verdict. It never fetches
+// a source, never calls a model, and never decides whether an idea is any good.
+//
+// WHY A RECORD EITHER WAY. The verdict is written whether the idea survives or
+// dies, and it must carry the alternatives that were rejected. A killed idea with
+// no recorded reason is an idea that gets re-proposed in six months; the research
+// directory is where a session looks before re-proposing one. That is why an empty
+// rejected-alternatives list is admissible only behind an explicit marker —
+// silence by omission is exactly the failure the record exists to prevent.
+//
+// NEVER A GATE. Nothing here is reachable from capture or intent-create. Ideate is
+// an optional verb the routing help names for big, unproven ideas; skipping it is
+// never warned about, and no other verb requires it.
+package ideate
+
+import (
+	"regexp"
+	"time"
+)
+
+// SchemaVersion stamps the verdict payload. It is versioned independently of
+// every other abcd artifact, so a future breaking change to the shape is
+// detectable rather than silently misread by a host composing against the old one.
+const SchemaVersion = 1
+
+// MaxPayloadBytes caps the untrusted verdict document, mirroring the synthesis and
+// release-ingest ceilings. It is exported so a front door can bound its READ at
+// the same ceiling the core enforces — the front-door bound is a convenience, this
+// one is the guarantee.
+const MaxPayloadBytes = 1 << 20 // 1 MiB
+
+// MaxSlugLen bounds the idea slug, which reaches a filename. Paired with slugRe it
+// is the lexical half of the write-containment defence.
+const MaxSlugLen = 64
+
+// ResearchRelDir is the one directory a verdict record is ever written into, and
+// DecisionsRelDir is the log its dated pointer is appended to. Both are constants
+// rather than parameters: a configurable target would let a verdict land somewhere
+// no future session looks.
+const (
+	ResearchRelDir  = ".abcd/development/research"
+	DecisionsRelDir = ".abcd/work/DECISIONS.md"
+)
+
+const (
+	// maxClaims caps the research leg's claims table.
+	maxClaims = 200
+	// maxHits caps the record grill's hits.
+	maxHits = 200
+	// maxKillAttempts caps the adversarial leg's attempts.
+	maxKillAttempts = 200
+	// maxRejected caps the rejected-alternatives list.
+	maxRejected = 200
+	// maxProseBytes caps one prose field after cleaning (mirrors the synthesis
+	// prose ceiling).
+	maxProseBytes = 4096
+	// maxIdeaBytes caps the idea text — a longer-form field than a single claim.
+	maxIdeaBytes = 8192
+	// maxSourceBytes caps a claim's primary-source reference (a URL or a document
+	// citation, never a document).
+	maxSourceBytes = 1024
+	// maxRecordIDBytes bounds a cited id BEFORE it is matched or reported. The id
+	// grammar admits unbounded digits, so without a cap "itd-" followed by a
+	// megabyte of zeros is legal, fails resolution, and is echoed whole into the
+	// operator's terminal.
+	maxRecordIDBytes = 32
+	// maxDecisionsBytes caps the read of the decision log before its line is
+	// appended.
+	maxDecisionsBytes = 4 << 20 // 4 MiB
+)
+
+var (
+	// slugRe is the idea slug's grammar: lower-case kebab-case, no leading or
+	// trailing hyphen, no doubled hyphen. It admits no separator, no dot segment,
+	// and no absolute form, so a slug can never build a path outside the research
+	// directory — the lexical layer of the two-layer containment (os.Root is the
+	// other).
+	slugRe = regexp.MustCompile(`^[a-z0-9]+(?:-[a-z0-9]+)*$`)
+	// promptVersionRe validates the composing agents' prompt_version (itd-5), so a
+	// verdict record can be traced to the prompts that produced it.
+	promptVersionRe = regexp.MustCompile(`^[0-9]+\.[0-9]+\.[0-9]+$`)
+)
+
+// Verdict is the admission outcome. The set is CLOSED: an unregistered verdict is
+// a whole-document refusal, never a coercion, because the verdict is the one line
+// of the record a later session reads first.
+type Verdict string
+
+const (
+	// VerdictSurvives: the idea cleared all three legs and may graduate to a draft
+	// intent through the existing quoted-text create. Ideate mints no intent itself.
+	VerdictSurvives Verdict = "survives"
+	// VerdictKilled: a leg was fatal. The record is the reason it stays dead.
+	VerdictKilled Verdict = "killed"
+	// VerdictReframed: the idea as posed does not survive, but a reframing of it
+	// does; the record carries both.
+	VerdictReframed Verdict = "reframed"
+)
+
+var verdictEnum = map[Verdict]bool{VerdictSurvives: true, VerdictKilled: true, VerdictReframed: true}
+
+// Valid reports whether v is a registered verdict.
+func (v Verdict) Valid() bool { return verdictEnum[v] }
+
+// LegKind identifies one leg of the gauntlet. The three values are also the
+// REQUIRED ORDER: research grounds the idea, the grill checks it against what is
+// already written, and only then does an evaluator who did none of that work try
+// to kill it. Running them in any other order changes what each leg is looking at,
+// so the order is validated rather than assumed.
+type LegKind string
+
+const (
+	// LegResearch: every load-bearing claim checked against its primary source.
+	LegResearch LegKind = "research"
+	// LegRecordGrill: does the existing record cover, contradict, or supersede
+	// this? Every hit is cited by record id.
+	LegRecordGrill LegKind = "record-grill"
+	// LegAdversarialReview: a fresh-context, off-policy evaluator that did not
+	// conduct the research, receiving the idea as an artefact of unknown
+	// authorship, trying to kill it.
+	LegAdversarialReview LegKind = "adversarial-review"
+)
+
+// legOrder is both the membership set and the required order, written once so the
+// two can never disagree.
+var legOrder = []LegKind{LegResearch, LegRecordGrill, LegAdversarialReview}
+
+// ClaimStatus is what checking a claim against its primary source established.
+type ClaimStatus string
+
+const (
+	// ClaimVerified: the primary source supports the claim.
+	ClaimVerified ClaimStatus = "verified"
+	// ClaimFalsified: the primary source contradicts it. Three of these killed an
+	// idea in the proven manual run.
+	ClaimFalsified ClaimStatus = "falsified"
+	// ClaimUnverifiable: no primary source settles it either way. This is an
+	// honest outcome, not a pass.
+	ClaimUnverifiable ClaimStatus = "unverifiable"
+)
+
+var claimStatusEnum = map[ClaimStatus]bool{ClaimVerified: true, ClaimFalsified: true, ClaimUnverifiable: true}
+
+// Relation is how an existing record entry bears on the idea.
+type Relation string
+
+const (
+	// RelationCovered: the entry already says this.
+	RelationCovered Relation = "covered"
+	// RelationContradicted: the entry rules this out.
+	RelationContradicted Relation = "contradicted"
+	// RelationSuperseded: the entry has moved past this.
+	RelationSuperseded Relation = "superseded"
+)
+
+var relationEnum = map[Relation]bool{RelationCovered: true, RelationContradicted: true, RelationSuperseded: true}
+
+// KillOutcome is what one adversarial kill attempt achieved.
+type KillOutcome string
+
+const (
+	// KillSurvived: the idea withstood the attempt.
+	KillSurvived KillOutcome = "survived"
+	// KillPartial: the attempt landed but is not on its own fatal.
+	KillPartial KillOutcome = "partial"
+	// KillFatal: the attempt is fatal to the idea as posed.
+	KillFatal KillOutcome = "fatal"
+)
+
+var killOutcomeEnum = map[KillOutcome]bool{KillSurvived: true, KillPartial: true, KillFatal: true}
+
+// Claim is one load-bearing claim and the primary source it was checked against.
+//
+// The binary cannot judge whether a source is PRIMARY — that is the researching
+// agent's obligation, stated in its prompt. What the binary enforces is that a
+// source is named at all, for every claim including an unverifiable one: a claims
+// table row with no source is indistinguishable from an unchecked assertion.
+type Claim struct {
+	Claim         string      `json:"claim"`
+	PrimarySource string      `json:"primary_source"`
+	Status        ClaimStatus `json:"status"`
+}
+
+// GrillHit is one existing record entry that bears on the idea. Record is a cited
+// id and MUST resolve in the repository; Note is optional prose, and is where a
+// reference to a brief section or a principle lives, since neither carries a
+// per-entry id that could be cited.
+type GrillHit struct {
+	Record   string   `json:"record"`
+	Relation Relation `json:"relation"`
+	Note     string   `json:"note,omitempty"`
+}
+
+// KillAttempt is one adversarial attempt on the idea and what it achieved.
+type KillAttempt struct {
+	Attempt string      `json:"attempt"`
+	Outcome KillOutcome `json:"outcome"`
+}
+
+// Leg is one leg of the gauntlet. It is a union over the three kinds: each kind
+// populates exactly its own evidence field, and a leg carrying another kind's
+// field is a refusal — a payload that smuggles grill hits into the research leg is
+// not a leg abcd knows how to read.
+type Leg struct {
+	Kind         LegKind       `json:"kind"`
+	Claims       []Claim       `json:"claims,omitempty"`
+	Hits         []GrillHit    `json:"hits,omitempty"`
+	KillAttempts []KillAttempt `json:"kill_attempts,omitempty"`
+}
+
+// RejectedAlternative is one option considered and turned down, with the reason.
+// Both fields are required: an alternative with no reason records that a choice
+// existed without recording why it was not taken, which is the half of the entry
+// that stops the re-litigation.
+type RejectedAlternative struct {
+	Alternative string `json:"alternative"`
+	WhyRejected string `json:"why_rejected"`
+}
+
+// Payload is the whole untrusted host-composed verdict document.
+type Payload struct {
+	// SchemaVersion must equal SchemaVersion.
+	SchemaVersion int `json:"schema_version"`
+	// PromptVersion is the orchestrating prompt's semver (itd-5).
+	PromptVersion string `json:"prompt_version"`
+	// Idea is the idea as captured, in the words it entered the gauntlet with.
+	Idea string `json:"idea"`
+	// Legs are the three legs, IN ORDER. An array rather than three named fields
+	// precisely so the order is a property of the document the binary can check.
+	Legs []Leg `json:"legs"`
+	// Verdict is the admission outcome.
+	Verdict Verdict `json:"verdict"`
+	// RejectedAlternatives are the options turned down on the way to the verdict.
+	RejectedAlternatives []RejectedAlternative `json:"rejected_alternatives"`
+	// NoRejectedAlternatives is the EXPLICIT empty marker. An empty list is
+	// admissible only with this set; omission is not, and setting it beside a
+	// populated list is a contradiction the document is refused for.
+	NoRejectedAlternatives bool `json:"no_rejected_alternatives,omitempty"`
+}
+
+// ClaimTally counts the research leg's outcomes, so a reader of the result knows
+// what the claims table found without re-reading the record.
+type ClaimTally struct {
+	Verified     int `json:"verified"`
+	Falsified    int `json:"falsified"`
+	Unverifiable int `json:"unverifiable"`
+}
+
+// Total reports how many claims the research leg carried.
+func (t ClaimTally) Total() int { return t.Verified + t.Falsified + t.Unverifiable }
+
+// Result is the transport-agnostic outcome of `ideate record`. It is returned only
+// when the record was written; every refusal is an error, so a caller holding a
+// Result knows a durable record exists.
+type Result struct {
+	Slug    string  `json:"slug"`
+	Idea    string  `json:"idea"`
+	Verdict Verdict `json:"verdict"`
+	// Graduates reports whether this verdict admits the idea to a draft intent.
+	// Ideate mints nothing itself; this is the signal the surface relays.
+	Graduates bool `json:"graduates"`
+	// Path is the verdict record, repo-relative.
+	Path string `json:"path"`
+	// DecisionPath is the log the dated pointer was appended to, repo-relative.
+	DecisionPath string `json:"decision_path"`
+	// Claims tallies the research leg.
+	Claims ClaimTally `json:"claims"`
+	// GrillHits counts the record-grill hits.
+	GrillHits int `json:"grill_hits"`
+	// CitedRecords is the sorted set of record ids the grill cited, every one of
+	// them proved to resolve — the citation gate's proof, so a reviewer can check
+	// the record without re-running the resolution.
+	CitedRecords []string `json:"cited_records"`
+	// KillAttempts counts the adversarial leg's attempts.
+	KillAttempts int `json:"kill_attempts"`
+	// RejectedAlternatives counts the recorded alternatives.
+	RejectedAlternatives int `json:"rejected_alternatives"`
+}
+
+// recordDate renders the date a verdict record is filed under. UTC so the same
+// run files the same record everywhere.
+func recordDate(at time.Time) string { return at.UTC().Format("2006-01-02") }
diff --git a/internal/core/ideate/record.go b/internal/core/ideate/record.go
new file mode 100644
index 0000000..ad53401
--- /dev/null
+++ b/internal/core/ideate/record.go
@@ -0,0 +1,492 @@
+package ideate
+
+// record.go is the WRITE half of `abcd ideate record <idea-slug> --verdict-json`:
+// it takes the host-composed verdict, proves it is a complete, honestly-cited
+// three-leg run, and writes the durable record plus its pointer.
+//
+// The trust model is the release-ingest seam's, and so are the refusal semantics:
+// WHOLE-DOCUMENT, never cite-or-be-dropped. A dropped synthesis entry costs an
+// insight; a dropped leg, claim, or citation costs the record its meaning — a
+// verdict record with a quietly-removed falsified claim, or a quietly-removed
+// grill hit, is worse than no record at all, because a later session trusts it.
+// So any fault refuses the document and writes nothing.
+//
+// The boundary between the host and this core is exact:
+//
+//	the host owns  — the research, the grill, the adversarial review, the wording
+//	                 of every finding, and the verdict itself.
+//	the core owns  — the DATE, the FILENAME, the record's structure, the citation
+//	                 gate, the containment, and the pointer in the decision log.
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/REPPL/abcd-cli/internal/core/recordid"
+	"github.com/REPPL/abcd-cli/internal/fsutil"
+	"github.com/REPPL/abcd-cli/internal/termsafe"
+)
+
+// SlugError is the refusal for an idea slug that cannot safely become a filename.
+// It is typed because it is an OPERAND fault, not a payload fault: the fix is to
+// re-run with a different slug, not to re-compose the verdict.
+type SlugError struct {
+	Slug   string
+	Reason string
+}
+
+func (e *SlugError) Error() string {
+	return fmt.Sprintf("%q is not a usable idea slug (%s); a slug is lower-case kebab-case, at most %d characters, "+
+		"and carries no path separator or dot segment", termsafe.Sanitize(e.Slug), e.Reason, MaxSlugLen)
+}
+
+// CitationError is the record-grill citation gate's refusal: a hit names a record
+// id that does not resolve in this repository, so the grill is reporting on
+// something that is not there. It names every offending id, because a composer
+// handed one id at a time re-runs the whole gauntlet once per mistake.
+type CitationError struct {
+	Unresolved []string
+}
+
+func (e *CitationError) Error() string {
+	return "the record grill cites records that do not exist in this repository — nothing was written: " +
+		strings.Join(e.Unresolved, ", ") +
+		"\nevery grill hit is cited by id, and an id that names no record is a hit on nothing; re-run the grill against the live record"
+}
+
+// ExistsError is the no-overwrite refusal: a verdict record for this slug already
+// exists under today's date. A second run is either a re-run of the same gauntlet
+// (in which case the first record stands) or a different one (in which case it
+// deserves its own slug); silently replacing the first would erase a recorded
+// reason, which is the one thing this verb exists to preserve.
+type ExistsError struct {
+	Path string
+}
+
+func (e *ExistsError) Error() string {
+	return "a verdict record already exists at " + e.Path +
+		" — refusing to overwrite it; a re-run of the same idea keeps the first record, and a different run earns its own slug"
+}
+
+// MissingDecisionsError is the refusal for a repository with no decision log. The
+// pointer is not decoration: the log is where a session looks for what was already
+// decided, and a verdict record nothing points at is a record nobody finds.
+type MissingDecisionsError struct {
+	Path string
+}
+
+func (e *MissingDecisionsError) Error() string {
+	return "this repository has no " + e.Path +
+		" — the verdict record's dated pointer has nowhere to land, so nothing was written; create the decision log first"
+}
+
+// Record validates the host-composed verdict for slug and writes it.
+//
+// at is the clock, passed in rather than read: the date lands in a durable
+// filename and in a durable log line, so it is an input a test can pin instead of
+// a wall-clock read buried in a writer.
+//
+// Every refusal returns BEFORE the first write, with one exception that is handled
+// rather than accepted: if appending the pointer fails after the record landed,
+// the record is removed again, so a run never leaves half a decision behind.
+func Record(repoRoot, slug string, raw []byte, at time.Time) (Result, error) {
+	if err := validateSlug(slug); err != nil {
+		return Result{}, err
+	}
+	p, err := decodePayload(raw)
+	if err != nil {
+		return Result{}, err
+	}
+	v, err := validate(repoRoot, p)
+	if err != nil {
+		return Result{}, err
+	}
+	v.slug = slug
+
+	// The decision log is read BEFORE the record is written, so the commonest
+	// reason the pointer cannot land is a refusal rather than a rollback.
+	decisionsAbs := filepath.Join(repoRoot, filepath.FromSlash(DecisionsRelDir))
+	log, err := fsutil.ReadGuarded(decisionsAbs, maxDecisionsBytes)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return Result{}, &MissingDecisionsError{Path: DecisionsRelDir}
+		}
+		return Result{}, fmt.Errorf("reading %s: %w", DecisionsRelDir, err)
+	}
+
+	name := recordDate(at) + "-ideate-" + slug + ".md"
+	rel := path.Join(ResearchRelDir, name)
+	dirAbs := filepath.Join(repoRoot, filepath.FromSlash(ResearchRelDir))
+	if !fsutil.IsRealDir(dirAbs) {
+		return Result{}, fmt.Errorf("%s is not a directory in this repository", ResearchRelDir)
+	}
+
+	// Second containment layer. The slug grammar already makes name a single
+	// path element, so os.Root cannot be escaped lexically; the Root is here for
+	// the leaf lookup, where an lstat that does not follow is what distinguishes
+	// "absent" from "a symlink planted at the target".
+	root, err := os.OpenRoot(dirAbs)
+	if err != nil {
+		return Result{}, err
+	}
+	defer root.Close()
+	if _, err := root.Lstat(name); err == nil {
+		return Result{}, &ExistsError{Path: rel}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return Result{}, err
+	}
+
+	res := v.result(slug, rel)
+	if err := fsutil.WriteFileAtomic(filepath.Join(dirAbs, name), []byte(render(v, at)), 0o644); err != nil {
+		return Result{}, err
+	}
+	if err := appendPointer(decisionsAbs, log, res, at); err != nil {
+		// The record landed but its pointer did not. Roll the record back rather
+		// than leave a verdict no session will find, and say the rollback failed
+		// if it does, because that is the one case a human must fix by hand.
+		if rmErr := root.Remove(name); rmErr != nil {
+			return Result{}, fmt.Errorf("%w; THE ROLLBACK FAILED — remove %s by hand", err, rel)
+		}
+		return Result{}, err
+	}
+	return res, nil
+}
+
+// validateSlug is the lexical containment layer. It runs FIRST, before the payload
+// is even decoded, so an operand that could steer a write never travels further
+// into the verb than this line.
+func validateSlug(slug string) error {
+	switch {
+	case slug == "":
+		return &SlugError{Slug: slug, Reason: "it is empty"}
+	case len(slug) > MaxSlugLen:
+		return &SlugError{Slug: slug[:MaxSlugLen], Reason: fmt.Sprintf("it is %d bytes", len(slug))}
+	case !slugRe.MatchString(slug):
+		return &SlugError{Slug: slug, Reason: "it is not lower-case kebab-case"}
+	}
+	return nil
+}
+
+// decodePayload reads the untrusted document behind the shared guards: a size cap,
+// an unknown-field refusal (an invented key means the composer and this core
+// disagree about the contract), a trailing-data refusal, the three-branch schema
+// gate, and the prompt_version stamp.
+func decodePayload(raw []byte) (Payload, error) {
+	if len(raw) > MaxPayloadBytes {
+		return Payload{}, fmt.Errorf("verdict payload exceeds the %d-byte cap", MaxPayloadBytes)
+	}
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	var p Payload
+	if err := dec.Decode(&p); err != nil {
+		return Payload{}, fmt.Errorf("malformed verdict JSON: %v", err)
+	}
+	if dec.More() {
+		return Payload{}, errors.New("the verdict payload carries trailing data after the JSON document")
+	}
+	switch {
+	case p.SchemaVersion == 0:
+		return Payload{}, errors.New("verdict payload is missing schema_version")
+	case p.SchemaVersion > SchemaVersion:
+		return Payload{}, fmt.Errorf("verdict schema v%d; this abcd knows up to v%d — upgrade abcd",
+			p.SchemaVersion, SchemaVersion)
+	case p.SchemaVersion != SchemaVersion:
+		return Payload{}, fmt.Errorf("unsupported verdict schema_version %d", p.SchemaVersion)
+	}
+	if !promptVersionRe.MatchString(p.PromptVersion) {
+		return Payload{}, errors.New("verdict payload is missing a semver prompt_version")
+	}
+	return p, nil
+}
+
+// verdictDoc is the validated, cleaned document — the only shape the renderer and
+// the result builder ever see, so neither can reach a raw untrusted field.
+type verdictDoc struct {
+	slug         string
+	idea         string
+	verdict      Verdict
+	claims       []Claim
+	hits         []GrillHit
+	kills        []KillAttempt
+	rejected     []RejectedAlternative
+	noneRejected bool
+	cited        []string
+}
+
+// validate runs every gate over the decoded payload and returns the cleaned
+// document. The order is deliberate: cheap structural checks first, and the
+// citation gate — the only one that touches the filesystem — last, so a malformed
+// document never costs a record scan.
+func validate(repoRoot string, p Payload) (verdictDoc, error) {
+	var v verdictDoc
+
+	v.idea = termsafe.CleanProse(p.Idea, maxIdeaBytes)
+	if v.idea == "" {
+		return v, errors.New("the verdict payload carries no idea text; the record is about an idea, so the idea is required")
+	}
+	if !p.Verdict.Valid() {
+		return v, fmt.Errorf("out-of-enum verdict %q; a verdict is one of %s|%s|%s",
+			termsafe.Sanitize(string(p.Verdict)), VerdictSurvives, VerdictKilled, VerdictReframed)
+	}
+	v.verdict = p.Verdict
+
+	if len(p.Legs) != len(legOrder) {
+		return v, fmt.Errorf("the verdict carries %d legs; the gauntlet is exactly %d, in order (%s)",
+			len(p.Legs), len(legOrder), legList())
+	}
+	for i, leg := range p.Legs {
+		if leg.Kind != legOrder[i] {
+			return v, fmt.Errorf("leg %d is %q; the legs run in order (%s), and the order is what each leg is looking at",
+				i+1, termsafe.Sanitize(string(leg.Kind)), legList())
+		}
+	}
+	var err error
+	if v.claims, err = validateResearch(p.Legs[0]); err != nil {
+		return v, err
+	}
+	if v.hits, err = validateGrill(p.Legs[1]); err != nil {
+		return v, err
+	}
+	if v.kills, err = validateAdversarial(p.Legs[2]); err != nil {
+		return v, err
+	}
+	if v.rejected, v.noneRejected, err = validateRejected(p); err != nil {
+		return v, err
+	}
+	if v.cited, err = resolveCitations(repoRoot, v.hits); err != nil {
+		return v, err
+	}
+	return v, nil
+}
+
+// validateResearch checks the first leg: at least one claim, each with prose, a
+// named primary source, and a registered status.
+func validateResearch(leg Leg) ([]Claim, error) {
+	if len(leg.Hits) > 0 || len(leg.KillAttempts) > 0 {
+		return nil, errors.New("the research leg carries another leg's evidence; each leg carries only its own")
+	}
+	if len(leg.Claims) == 0 {
+		return nil, errors.New("the research leg carries no claims; a leg that checked nothing is not a leg")
+	}
+	if len(leg.Claims) > maxClaims {
+		return nil, fmt.Errorf("the research leg carries %d claims (max %d)", len(leg.Claims), maxClaims)
+	}
+	out := make([]Claim, 0, len(leg.Claims))
+	for i, c := range leg.Claims {
+		at := i + 1
+		text := termsafe.CleanProseLine(c.Claim, maxProseBytes)
+		if text == "" {
+			return nil, fmt.Errorf("claim %d has no text", at)
+		}
+		src := termsafe.CleanProseLine(c.PrimarySource, maxSourceBytes)
+		if src == "" {
+			return nil, fmt.Errorf("claim %d names no primary source; a claim checked against nothing is an assertion", at)
+		}
+		if !claimStatusEnum[c.Status] {
+			return nil, fmt.Errorf("claim %d has status %q; a claim is %s, %s, or %s",
+				at, termsafe.Sanitize(string(c.Status)), ClaimVerified, ClaimFalsified, ClaimUnverifiable)
+		}
+		out = append(out, Claim{Claim: text, PrimarySource: src, Status: c.Status})
+	}
+	return out, nil
+}
+
+// validateGrill checks the second leg. An EMPTY hit list is valid and meaningful:
+// "no entry in the record touches this idea" is a finding, and the commonest one
+// for a genuinely new idea. What is not valid is a hit that cites nothing usable.
+func validateGrill(leg Leg) ([]GrillHit, error) {
+	if len(leg.Claims) > 0 || len(leg.KillAttempts) > 0 {
+		return nil, errors.New("the record-grill leg carries another leg's evidence; each leg carries only its own")
+	}
+	if len(leg.Hits) > maxHits {
+		return nil, fmt.Errorf("the record grill carries %d hits (max %d)", len(leg.Hits), maxHits)
+	}
+	out := make([]GrillHit, 0, len(leg.Hits))
+	for i, h := range leg.Hits {
+		at := i + 1
+		// Bounded BEFORE the id is matched or quoted, so an over-long one is
+		// described rather than echoed.
+		if len(h.Record) > maxRecordIDBytes {
+			return nil, fmt.Errorf("grill hit %d cites a %d-byte record id (max %d)", at, len(h.Record), maxRecordIDBytes)
+		}
+		if !recordid.CitedIDRe.MatchString(h.Record) {
+			return nil, fmt.Errorf("grill hit %d cites %q, which is not a record id (want adr-N, itd-N, iss-N, or spc-N)",
+				at, termsafe.Sanitize(h.Record))
+		}
+		if !relationEnum[h.Relation] {
+			return nil, fmt.Errorf("grill hit %d (%s) has relation %q; a hit is %s, %s, or %s",
+				at, h.Record, termsafe.Sanitize(string(h.Relation)), RelationCovered, RelationContradicted, RelationSuperseded)
+		}
+		out = append(out, GrillHit{
+			Record:   h.Record,
+			Relation: h.Relation,
+			Note:     termsafe.CleanProseLine(h.Note, maxProseBytes),
+		})
+	}
+	return out, nil
+}
+
+// validateAdversarial checks the third leg: at least one attempt, each with prose
+// and a registered outcome. The leg's fresh-context, off-policy, unknown-authorship
+// conduct is the orchestrating prompt's obligation — the binary cannot observe how
+// an agent was run, and pretending to check it would be theatre.
+func validateAdversarial(leg Leg) ([]KillAttempt, error) {
+	if len(leg.Claims) > 0 || len(leg.Hits) > 0 {
+		return nil, errors.New("the adversarial-review leg carries another leg's evidence; each leg carries only its own")
+	}
+	if len(leg.KillAttempts) == 0 {
+		return nil, errors.New("the adversarial-review leg carries no kill attempts; an adversary that tried nothing reviewed nothing")
+	}
+	if len(leg.KillAttempts) > maxKillAttempts {
+		return nil, fmt.Errorf("the adversarial review carries %d attempts (max %d)", len(leg.KillAttempts), maxKillAttempts)
+	}
+	out := make([]KillAttempt, 0, len(leg.KillAttempts))
+	for i, k := range leg.KillAttempts {
+		at := i + 1
+		text := termsafe.CleanProseLine(k.Attempt, maxProseBytes)
+		if text == "" {
+			return nil, fmt.Errorf("kill attempt %d has no text", at)
+		}
+		if !killOutcomeEnum[k.Outcome] {
+			return nil, fmt.Errorf("kill attempt %d has outcome %q; an attempt is %s, %s, or %s",
+				at, termsafe.Sanitize(string(k.Outcome)), KillSurvived, KillPartial, KillFatal)
+		}
+		out = append(out, KillAttempt{Attempt: text, Outcome: k.Outcome})
+	}
+	return out, nil
+}
+
+// validateRejected enforces the explicit-empty-marker rule. Omission is refused
+// because the whole point of the record is that a later session can see WHAT was
+// turned down; a silently empty list is indistinguishable from a composer that
+// forgot, and the cost of that ambiguity is the idea being re-proposed.
+func validateRejected(p Payload) ([]RejectedAlternative, bool, error) {
+	if len(p.RejectedAlternatives) > maxRejected {
+		return nil, false, fmt.Errorf("the verdict carries %d rejected alternatives (max %d)",
+			len(p.RejectedAlternatives), maxRejected)
+	}
+	if len(p.RejectedAlternatives) == 0 {
+		if !p.NoRejectedAlternatives {
+			return nil, false, errors.New(
+				"the verdict records no rejected alternatives and does not say so explicitly — nothing was written; " +
+					"list them, or set \"no_rejected_alternatives\": true to declare on the record that none were considered " +
+					"(the record exists so the idea is not re-litigated, and silence cannot carry that)")
+		}
+		return nil, true, nil
+	}
+	if p.NoRejectedAlternatives {
+		return nil, false, errors.New(
+			"the verdict sets \"no_rejected_alternatives\" beside a populated list; the two contradict each other")
+	}
+	out := make([]RejectedAlternative, 0, len(p.RejectedAlternatives))
+	for i, r := range p.RejectedAlternatives {
+		at := i + 1
+		alt := termsafe.CleanProseLine(r.Alternative, maxProseBytes)
+		if alt == "" {
+			return nil, false, fmt.Errorf("rejected alternative %d has no text", at)
+		}
+		why := termsafe.CleanProseLine(r.WhyRejected, maxProseBytes)
+		if why == "" {
+			return nil, false, fmt.Errorf("rejected alternative %d (%s) records no reason; the reason is the half that stops the re-litigation", at, alt)
+		}
+		out = append(out, RejectedAlternative{Alternative: alt, WhyRejected: why})
+	}
+	return out, false, nil
+}
+
+// resolveCitations is AC 4's gate: every record id the grill cited must name a
+// record that exists in this repository. It returns the sorted, deduped set as the
+// proof the result carries.
+//
+// It builds ONE resolver for the whole document, so every citation is judged
+// against the same view of the record.
+func resolveCitations(repoRoot string, hits []GrillHit) ([]string, error) {
+	if len(hits) == 0 {
+		return nil, nil
+	}
+	r, err := recordid.NewResolver(repoRoot)
+	if err != nil {
+		return nil, err
+	}
+	seen := map[string]bool{}
+	var cited, unresolved []string
+	for _, h := range hits {
+		if seen[h.Record] {
+			continue
+		}
+		seen[h.Record] = true
+		if _, ok := r.Lookup(h.Record); !ok {
+			unresolved = append(unresolved, h.Record)
+			continue
+		}
+		cited = append(cited, h.Record)
+	}
+	if len(unresolved) > 0 {
+		sort.Strings(unresolved)
+		return nil, &CitationError{Unresolved: unresolved}
+	}
+	sort.Strings(cited)
+	return cited, nil
+}
+
+// result builds the transport-agnostic outcome from the validated document.
+func (v verdictDoc) result(slug, rel string) Result {
+	res := Result{
+		Slug:                 slug,
+		Idea:                 v.idea,
+		Verdict:              v.verdict,
+		Graduates:            v.verdict == VerdictSurvives,
+		Path:                 rel,
+		DecisionPath:         DecisionsRelDir,
+		GrillHits:            len(v.hits),
+		CitedRecords:         v.cited,
+		KillAttempts:         len(v.kills),
+		RejectedAlternatives: len(v.rejected),
+	}
+	for _, c := range v.claims {
+		switch c.Status {
+		case ClaimVerified:
+			res.Claims.Verified++
+		case ClaimFalsified:
+			res.Claims.Falsified++
+		case ClaimUnverifiable:
+			res.Claims.Unverifiable++
+		}
+	}
+	return res
+}
+
+// appendPointer adds the one dated line that makes the verdict findable. It is a
+// single line by design: the decision log is a scannable index, and the record it
+// points at is where the reasoning lives.
+func appendPointer(decisionsAbs string, existing []byte, res Result, at time.Time) error {
+	body := string(existing)
+	if body != "" && !strings.HasSuffix(body, "\n") {
+		body += "\n"
+	}
+	// Only core-owned values reach the line: the date, the validated slug, the
+	// registered verdict, and the path this core built. No untrusted prose lands in
+	// the decision log at all — the idea's own words live in the record the line
+	// points at, where the renderer's escaping applies.
+	body += fmt.Sprintf("- %s — ideate: %s — verdict %s. The idea, the three legs, and the rejected alternatives: %s\n",
+		recordDate(at), res.Slug, res.Verdict, res.Path)
+	return fsutil.WriteFileAtomicPreserveMode(decisionsAbs, []byte(body))
+}
+
+// legList renders the required leg order for an error message, written from
+// legOrder so the message can never fall out of step with the enum.
+func legList() string {
+	names := make([]string, 0, len(legOrder))
+	for _, k := range legOrder {
+		names = append(names, string(k))
+	}
+	return strings.Join(names, " -> ")
+}
diff --git a/internal/core/ideate/record_test.go b/internal/core/ideate/record_test.go
new file mode 100644
index 0000000..a86b98c
--- /dev/null
+++ b/internal/core/ideate/record_test.go
@@ -0,0 +1,561 @@
+package ideate
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// at is the pinned clock every test writes with, so a record's filename and its
+// dated pointer are assertions rather than wall-clock reads.
+var at = time.Date(2026, 7, 28, 11, 30, 0, 0, time.UTC)
+
+// seedRepo lays out the minimum a verdict record needs: the research directory it
+// is written into, the decision log its pointer is appended to, and one intent
+// and one ADR a grill hit can legitimately cite.
+func seedRepo(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	mkdir := func(rel string) {
+		if err := os.MkdirAll(filepath.Join(root, filepath.FromSlash(rel)), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write := func(rel, body string) {
+		abs := filepath.Join(root, filepath.FromSlash(rel))
+		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(abs, []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mkdir(ResearchRelDir)
+	write(DecisionsRelDir, "# Decisions\n\n- 2026-07-01 — an earlier decision.\n")
+	write(".abcd/development/intents/planned/itd-104-ideate.md", "# itd-104\n")
+	write(".abcd/development/decisions/adrs/0035-lifeboat.md", "# adr-35\n")
+	return root
+}
+
+// validPayload is the reference payload: three legs in order, a resolvable
+// citation, a verdict, and rejected alternatives. Tests mutate a copy of it so
+// each refusal is one deviation from a known-good document.
+func validPayload() map[string]any {
+	return map[string]any{
+		"schema_version": SchemaVersion,
+		"prompt_version": "1.0.0",
+		"idea":           "abcd should gate a new idea before it becomes a record entry",
+		"legs": []any{
+			map[string]any{
+				"kind": "research",
+				"claims": []any{
+					map[string]any{
+						"claim":          "fresh-context evaluation is the only measured debiasing effect",
+						"primary_source": "https://example.invalid/paper.pdf",
+						"status":         "verified",
+					},
+					map[string]any{
+						"claim":          "self-review catches most of its own errors",
+						"primary_source": "https://example.invalid/other.pdf",
+						"status":         "falsified",
+					},
+				},
+			},
+			map[string]any{
+				"kind": "record-grill",
+				"hits": []any{
+					map[string]any{"record": "itd-104", "relation": "covered", "note": "the same admission gate, already filed"},
+					map[string]any{"record": "adr-35", "relation": "contradicted"},
+				},
+			},
+			map[string]any{
+				"kind": "adversarial-review",
+				"kill_attempts": []any{
+					map[string]any{"attempt": "the gate adds friction to capture", "outcome": "survived"},
+					map[string]any{"attempt": "no evidence the legs improve outcomes", "outcome": "partial"},
+				},
+			},
+		},
+		"verdict": "survives",
+		"rejected_alternatives": []any{
+			map[string]any{"alternative": "make ideate a blocking pre-capture gate", "why_rejected": "capture friction stays at one line"},
+		},
+	}
+}
+
+func encode(t *testing.T, v map[string]any) []byte {
+	t.Helper()
+	raw, err := json.Marshal(v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+func readFile(t *testing.T, root, rel string) string {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(root, filepath.FromSlash(rel)))
+	if err != nil {
+		t.Fatalf("reading %s: %v", rel, err)
+	}
+	return string(data)
+}
+
+// TestRecordWritesTheVerdictRecord is the happy path: the dated research record
+// lands with every leg rendered, and the decision log gains exactly one dated
+// pointer at it.
+func TestRecordWritesTheVerdictRecord(t *testing.T) {
+	root := seedRepo(t)
+	res, err := Record(root, "the-ideate-gate", encode(t, validPayload()), at)
+	if err != nil {
+		t.Fatalf("Record: %v", err)
+	}
+
+	wantPath := ".abcd/development/research/2026-07-28-ideate-the-ideate-gate.md"
+	if res.Path != wantPath {
+		t.Errorf("Path = %q, want %q", res.Path, wantPath)
+	}
+	if res.Verdict != VerdictSurvives {
+		t.Errorf("Verdict = %q, want %q", res.Verdict, VerdictSurvives)
+	}
+	if !res.Graduates {
+		t.Error("a surviving idea must be reported as graduating")
+	}
+	if got, want := res.CitedRecords, []string{"adr-35", "itd-104"}; strings.Join(got, ",") != strings.Join(want, ",") {
+		t.Errorf("CitedRecords = %v, want %v", got, want)
+	}
+
+	body := readFile(t, root, wantPath)
+	for _, want := range []string{
+		"# Ideate verdict — the-ideate-gate",
+		"abcd should gate a new idea before it becomes a record entry",
+		"Primary-source research",
+		"fresh-context evaluation is the only measured debiasing effect",
+		"| verified |",
+		"Record grill",
+		"itd-104",
+		"adr-35",
+		"Adversarial review",
+		"the gate adds friction to capture",
+		"Rejected alternatives",
+		"make ideate a blocking pre-capture gate",
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("the record is missing %q\n---\n%s", want, body)
+		}
+	}
+
+	log := readFile(t, root, DecisionsRelDir)
+	if !strings.Contains(log, "2026-07-28") || !strings.Contains(log, "the-ideate-gate") || !strings.Contains(log, wantPath) {
+		t.Errorf("the decision log has no dated pointer at the record:\n%s", log)
+	}
+	if n := strings.Count(log, wantPath); n != 1 {
+		t.Errorf("the decision log names the record %d times, want exactly 1", n)
+	}
+}
+
+// TestRecordRefusesUnresolvableCitation is AC 4: a grill hit citing a record that
+// does not exist refuses the whole verdict and NAMES the id, and nothing is
+// written.
+func TestRecordRefusesUnresolvableCitation(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["legs"].([]any)[1].(map[string]any)["hits"] = []any{
+		map[string]any{"record": "itd-9999", "relation": "covered"},
+	}
+	_, err := Record(root, "the-ideate-gate", encode(t, p), at)
+	var cite *CitationError
+	if !errors.As(err, &cite) {
+		t.Fatalf("Record error = %v, want a *CitationError", err)
+	}
+	if strings.Join(cite.Unresolved, ",") != "itd-9999" {
+		t.Errorf("Unresolved = %v, want [itd-9999]", cite.Unresolved)
+	}
+	if !strings.Contains(err.Error(), "itd-9999") {
+		t.Errorf("the refusal does not name the id: %v", err)
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesMalformedCitation proves a cited id that is not a record id at
+// all is refused before it is looked up — and is bounded before it is echoed.
+func TestRecordRefusesMalformedCitation(t *testing.T) {
+	root := seedRepo(t)
+	for _, bad := range []string{"../../etc/passwd", "itd-104-ideate", "ITD-104", "prn-1", strings.Repeat("i", 500)} {
+		p := validPayload()
+		p["legs"].([]any)[1].(map[string]any)["hits"] = []any{
+			map[string]any{"record": bad, "relation": "covered"},
+		}
+		if _, err := Record(root, "the-ideate-gate", encode(t, p), at); err == nil {
+			t.Errorf("a hit citing %q was accepted", bad)
+		}
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesUnsafeSlug proves a JSON-adjacent operand can never steer the
+// write out of the research directory: separators, dot segments, absolute forms,
+// and anything outside the slug grammar are refused before any path is built.
+func TestRecordRefusesUnsafeSlug(t *testing.T) {
+	root := seedRepo(t)
+	for _, bad := range []string{
+		"../../../etc/passwd", "..", ".", "a/b", "a\\b", "/absolute", "UPPER",
+		"", "-leading", "trailing-", "double--hyphen", "dot.segment", "sp ace",
+		strings.Repeat("a", MaxSlugLen+1),
+	} {
+		_, err := Record(root, bad, encode(t, validPayload()), at)
+		var se *SlugError
+		if !errors.As(err, &se) {
+			t.Errorf("slug %q: error = %v, want a *SlugError", bad, err)
+		}
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesLegsOutOfOrder is AC 2's machine-checked half: the three legs
+// must be present, and in order. A reordered, short, or duplicated leg list is a
+// refusal, not a reordering.
+func TestRecordRefusesLegsOutOfOrder(t *testing.T) {
+	root := seedRepo(t)
+	full := validPayload()["legs"].([]any)
+	cases := map[string][]any{
+		"reversed":       {full[2], full[1], full[0]},
+		"grill-first":    {full[1], full[0], full[2]},
+		"missing-third":  {full[0], full[1]},
+		"duplicated":     {full[0], full[0], full[1], full[2]},
+		"empty":          {},
+		"research-alone": {full[0]},
+	}
+	for name, legs := range cases {
+		p := validPayload()
+		p["legs"] = legs
+		if _, err := Record(root, "the-ideate-gate", encode(t, p), at); err == nil {
+			t.Errorf("%s: legs were accepted", name)
+		}
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesEmptyLegContent proves each leg must actually carry its own
+// evidence: a research leg with no claims, a grill leg with a hit missing its
+// relation, an adversarial leg with no kill attempt.
+func TestRecordRefusesEmptyLegContent(t *testing.T) {
+	root := seedRepo(t)
+	t.Run("no-claims", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[0].(map[string]any)["claims"] = []any{}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a research leg with no claims was accepted")
+		}
+	})
+	t.Run("claim-without-primary-source", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[0].(map[string]any)["claims"] = []any{
+			map[string]any{"claim": "a claim", "status": "verified"},
+		}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a claim with no primary source was accepted")
+		}
+	})
+	t.Run("claim-out-of-enum-status", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[0].(map[string]any)["claims"] = []any{
+			map[string]any{"claim": "a claim", "primary_source": "https://example.invalid/", "status": "probably"},
+		}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an out-of-enum claim status was accepted")
+		}
+	})
+	t.Run("hit-out-of-enum-relation", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[1].(map[string]any)["hits"] = []any{
+			map[string]any{"record": "itd-104", "relation": "mentions"},
+		}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an out-of-enum grill relation was accepted")
+		}
+	})
+	t.Run("no-kill-attempts", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[2].(map[string]any)["kill_attempts"] = []any{}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an adversarial leg with no kill attempt was accepted")
+		}
+	})
+	t.Run("foreign-leg-field", func(t *testing.T) {
+		p := validPayload()
+		p["legs"].([]any)[0].(map[string]any)["hits"] = []any{
+			map[string]any{"record": "itd-104", "relation": "covered"},
+		}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a research leg carrying grill hits was accepted")
+		}
+	})
+	assertNothingWritten(t, root)
+}
+
+// TestRecordAcceptsAnEmptyGrill proves "nothing in the record touches this idea"
+// is a legitimate grill outcome — the absence of hits is a finding, not a fault.
+func TestRecordAcceptsAnEmptyGrill(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["legs"].([]any)[1].(map[string]any)["hits"] = []any{}
+	res, err := Record(root, "the-ideate-gate", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("an empty grill was refused: %v", err)
+	}
+	if res.GrillHits != 0 || len(res.CitedRecords) != 0 {
+		t.Errorf("GrillHits = %d, CitedRecords = %v; want 0 and none", res.GrillHits, res.CitedRecords)
+	}
+	if !strings.Contains(readFile(t, root, res.Path), "No entry in the record") {
+		t.Error("the record does not say the grill found nothing")
+	}
+}
+
+// TestRecordRefusesOmittedRejectedAlternatives is AC 3's teeth: the record exists
+// to stop an idea being re-litigated, so an empty list is admissible only when
+// the host says so explicitly. Omission is a refusal, and so is a contradiction.
+func TestRecordRefusesOmittedRejectedAlternatives(t *testing.T) {
+	root := seedRepo(t)
+	t.Run("omitted", func(t *testing.T) {
+		p := validPayload()
+		delete(p, "rejected_alternatives")
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an omitted rejected-alternatives list was accepted")
+		}
+	})
+	t.Run("empty-without-marker", func(t *testing.T) {
+		p := validPayload()
+		p["rejected_alternatives"] = []any{}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an empty list with no explicit marker was accepted")
+		}
+	})
+	t.Run("marker-contradicts-list", func(t *testing.T) {
+		p := validPayload()
+		p["no_rejected_alternatives"] = true
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a marker contradicting a populated list was accepted")
+		}
+	})
+	t.Run("alternative-without-reason", func(t *testing.T) {
+		p := validPayload()
+		p["rejected_alternatives"] = []any{map[string]any{"alternative": "something"}}
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a rejected alternative with no reason was accepted")
+		}
+	})
+	assertNothingWritten(t, root)
+}
+
+// TestRecordAcceptsTheExplicitEmptyMarker proves the escape hatch works and says
+// so in the record, so a later reader knows the absence is deliberate.
+func TestRecordAcceptsTheExplicitEmptyMarker(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["rejected_alternatives"] = []any{}
+	p["no_rejected_alternatives"] = true
+	res, err := Record(root, "the-ideate-gate", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("the explicit empty marker was refused: %v", err)
+	}
+	if !strings.Contains(readFile(t, root, res.Path), "None were considered") {
+		t.Error("the record does not record the deliberate absence")
+	}
+}
+
+// TestRecordRecordsAKilledIdea is AC 3's other half: a dead idea is recorded just
+// as fully as a live one, and it is reported as NOT graduating.
+func TestRecordRecordsAKilledIdea(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["verdict"] = "killed"
+	res, err := Record(root, "a-dead-idea", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("Record: %v", err)
+	}
+	if res.Graduates {
+		t.Error("a killed idea must not be reported as graduating")
+	}
+	body := readFile(t, root, res.Path)
+	if !strings.Contains(body, "killed") {
+		t.Error("the record does not state the verdict")
+	}
+	if !strings.Contains(readFile(t, root, DecisionsRelDir), "a-dead-idea") {
+		t.Error("a killed idea earned no pointer in the decision log")
+	}
+}
+
+// TestRecordRefusesOutOfEnumVerdict proves the verdict is a closed set: an
+// unregistered verdict refuses the whole document rather than being coerced.
+func TestRecordRefusesOutOfEnumVerdict(t *testing.T) {
+	root := seedRepo(t)
+	for _, bad := range []string{"", "SURVIVES", "maybe", "shipped"} {
+		p := validPayload()
+		p["verdict"] = bad
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Errorf("verdict %q was accepted", bad)
+		}
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesMalformedPayload covers the shared untrusted-JSON guards: a
+// smuggled field, trailing data, the three schema branches, a missing
+// prompt_version, an empty idea, and an oversize document.
+func TestRecordRefusesMalformedPayload(t *testing.T) {
+	root := seedRepo(t)
+	t.Run("unknown-field", func(t *testing.T) {
+		p := validPayload()
+		p["surprise"] = "smuggled"
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an unknown field was accepted")
+		}
+	})
+	t.Run("trailing-data", func(t *testing.T) {
+		raw := append(encode(t, validPayload()), []byte(`{"another":"document"}`)...)
+		if _, err := Record(root, "s", raw, at); err == nil {
+			t.Error("trailing data was accepted")
+		}
+	})
+	t.Run("schema-missing", func(t *testing.T) {
+		p := validPayload()
+		delete(p, "schema_version")
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a missing schema_version was accepted")
+		}
+	})
+	t.Run("schema-too-new", func(t *testing.T) {
+		p := validPayload()
+		p["schema_version"] = SchemaVersion + 1
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a future schema_version was accepted")
+		}
+	})
+	t.Run("prompt-version-missing", func(t *testing.T) {
+		p := validPayload()
+		delete(p, "prompt_version")
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("a missing prompt_version was accepted")
+		}
+	})
+	t.Run("empty-idea", func(t *testing.T) {
+		p := validPayload()
+		p["idea"] = "   "
+		if _, err := Record(root, "s", encode(t, p), at); err == nil {
+			t.Error("an empty idea was accepted")
+		}
+	})
+	t.Run("oversize", func(t *testing.T) {
+		raw := make([]byte, MaxPayloadBytes+1)
+		if _, err := Record(root, "s", raw, at); err == nil {
+			t.Error("an oversize payload was accepted")
+		}
+	})
+	assertNothingWritten(t, root)
+}
+
+// TestRecordRefusesOverwritingAnExistingVerdict proves a second run for the same
+// slug on the same day cannot silently replace the first record.
+func TestRecordRefusesOverwritingAnExistingVerdict(t *testing.T) {
+	root := seedRepo(t)
+	res, err := Record(root, "the-ideate-gate", encode(t, validPayload()), at)
+	if err != nil {
+		t.Fatalf("first Record: %v", err)
+	}
+	before := readFile(t, root, res.Path)
+	logBefore := readFile(t, root, DecisionsRelDir)
+
+	p := validPayload()
+	p["verdict"] = "killed"
+	_, err = Record(root, "the-ideate-gate", encode(t, p), at)
+	var ex *ExistsError
+	if !errors.As(err, &ex) {
+		t.Fatalf("second Record error = %v, want an *ExistsError", err)
+	}
+	if got := readFile(t, root, res.Path); got != before {
+		t.Error("the existing verdict record was modified")
+	}
+	if got := readFile(t, root, DecisionsRelDir); got != logBefore {
+		t.Error("the refused run still appended to the decision log")
+	}
+}
+
+// TestRecordRefusesWhenTheDecisionLogIsAbsent proves the pointer is not optional:
+// without a decision log there is nowhere for a later session to find the record,
+// so the run refuses BEFORE writing anything.
+func TestRecordRefusesWhenTheDecisionLogIsAbsent(t *testing.T) {
+	root := seedRepo(t)
+	if err := os.Remove(filepath.Join(root, filepath.FromSlash(DecisionsRelDir))); err != nil {
+		t.Fatal(err)
+	}
+	_, err := Record(root, "the-ideate-gate", encode(t, validPayload()), at)
+	var md *MissingDecisionsError
+	if !errors.As(err, &md) {
+		t.Fatalf("Record error = %v, want a *MissingDecisionsError", err)
+	}
+	assertNothingWritten(t, root)
+}
+
+// TestRecordNeutralisesInjectedProse proves untrusted prose cannot forge markdown
+// structure in the record it lands in: no new line, no new table row, no opened
+// HTML comment, no terminal escape.
+func TestRecordNeutralisesInjectedProse(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["idea"] = "an idea\n## Forged heading\n<!-- swallow"
+	p["legs"].([]any)[0].(map[string]any)["claims"] = []any{
+		map[string]any{
+			"claim":          "a claim | forged | cell\nand a forged row",
+			"primary_source": "https://example.invalid/",
+			"status":         "verified",
+		},
+	}
+	res, err := Record(root, "injected", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("Record: %v", err)
+	}
+	body := readFile(t, root, res.Path)
+	if strings.Contains(body, "\n## Forged heading") {
+		t.Error("injected prose forged a heading")
+	}
+	if strings.Contains(body, "<!--") {
+		t.Error("injected prose opened an HTML comment")
+	}
+	if strings.Contains(body, "") {
+		t.Error("an escape sequence survived into the record")
+	}
+	// Every table cell's pipe must be escaped, so the claims table keeps exactly
+	// one row per claim.
+	for _, line := range strings.Split(body, "\n") {
+		if !strings.HasPrefix(line, "| ") || strings.HasPrefix(line, "|---") {
+			continue
+		}
+		if n := strings.Count(line, "|") - strings.Count(line, `\|`); n != 4 {
+			t.Errorf("table row has %d unescaped pipes, want 4: %q", n, line)
+		}
+	}
+	if !strings.Contains(readFile(t, root, DecisionsRelDir), "injected") {
+		t.Error("the decision pointer is missing")
+	}
+	if n := strings.Count(readFile(t, root, DecisionsRelDir), "\n- "); n != 2 {
+		t.Error("the decision log gained more than one bullet")
+	}
+}
+
+// assertNothingWritten proves a refusal left the research directory empty — every
+// refusal path must return before the write.
+func assertNothingWritten(t *testing.T, root string) {
+	t.Helper()
+	entries, err := os.ReadDir(filepath.Join(root, filepath.FromSlash(ResearchRelDir)))
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		t.Errorf("a refused run wrote %s", e.Name())
+	}
+}
diff --git a/internal/core/ideate/render.go b/internal/core/ideate/render.go
new file mode 100644
index 0000000..24c4163
--- /dev/null
+++ b/internal/core/ideate/render.go
@@ -0,0 +1,162 @@
+package ideate
+
+// render.go turns a validated verdict into the durable research record a human
+// reads. Two properties make it worth its own file.
+//
+// It is DETERMINISTIC: the same document and the same date render byte-identical
+// output, in a fixed order, with no wall-clock read of its own.
+//
+// And it is the last place untrusted prose can forge structure. Every field
+// arrives already line-cleaned (no newline, no HTML comment marker, no terminal
+// escape), so the one hazard left is markdown's own syntax — a pipe inside a table
+// cell would split the cell, and a leading marker would open a list or a heading.
+// cell() closes the first; the line-cleaning and the fixed prefixes close the rest.
+//
+// The prose is British English, because it lands in a document a person reads.
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// render writes the whole verdict record.
+func render(v verdictDoc, at time.Time) string {
+	var b strings.Builder
+
+	// The slug is already constrained to lower-case kebab-case, so it is the one
+	// value in this document that needs no escaping at all.
+	fmt.Fprintf(&b, "# Ideate verdict — %s\n\n", v.slug)
+	fmt.Fprintf(&b, "**Verdict: %s.** Recorded on %s by abcd's idea-admission protocol —\n", v.verdict, recordDate(at))
+	b.WriteString("primary-source research, a grill against the existing record, and an\n")
+	b.WriteString("independent adversarial review. This record exists so the idea is not\n")
+	b.WriteString("re-litigated: it stands whether the idea lived or died.\n\n")
+
+	b.WriteString("## The idea\n\n")
+	fmt.Fprintf(&b, "%s\n\n", blockText(v.idea))
+
+	renderResearch(&b, v)
+	renderGrill(&b, v)
+	renderAdversarial(&b, v)
+	renderRejected(&b, v)
+	renderOutcome(&b, v)
+
+	return b.String()
+}
+
+// renderResearch writes leg 1 as the claims table: one row per load-bearing
+// claim, the primary source it was checked against, and what that established.
+func renderResearch(b *strings.Builder, v verdictDoc) {
+	b.WriteString("## Leg 1 — Primary-source research\n\n")
+	b.WriteString("Every load-bearing claim checked against its primary source, never a\n")
+	b.WriteString("secondary citation.\n\n")
+	b.WriteString("| Claim | Primary source | Finding |\n|---|---|---|\n")
+	for _, c := range v.claims {
+		fmt.Fprintf(b, "| %s | %s | %s |\n", cell(c.Claim), cell(c.PrimarySource), c.Status)
+	}
+	b.WriteString("\n")
+}
+
+// renderGrill writes leg 2. An empty grill is stated rather than omitted: "nothing
+// in the record touches this" is the finding a later reader most needs to see.
+func renderGrill(b *strings.Builder, v verdictDoc) {
+	b.WriteString("## Leg 2 — Record grill\n\n")
+	b.WriteString("Does the brief, an intent, an ADR, or a principle already cover,\n")
+	b.WriteString("contradict, or supersede this idea? Every hit is cited by record id, and\n")
+	b.WriteString("every id resolved in this repository when the verdict was recorded.\n\n")
+	if len(v.hits) == 0 {
+		b.WriteString("No entry in the record covers, contradicts, or supersedes this idea.\n\n")
+		return
+	}
+	b.WriteString("| Record | Relation | Note |\n|---|---|---|\n")
+	for _, h := range v.hits {
+		note := h.Note
+		if note == "" {
+			note = "—"
+		}
+		fmt.Fprintf(b, "| %s | %s | %s |\n", h.Record, h.Relation, cell(note))
+	}
+	b.WriteString("\n")
+}
+
+// renderAdversarial writes leg 3, and states the conduct the leg is defined by —
+// the fresh-context, off-policy, unknown-authorship pattern that is the only
+// measured debiasing effect, and the reason this leg is worth running at all.
+func renderAdversarial(b *strings.Builder, v verdictDoc) {
+	b.WriteString("## Leg 3 — Adversarial review\n\n")
+	b.WriteString("Conducted fresh-context and off-policy by an evaluator that did not carry\n")
+	b.WriteString("out the research and received the idea as an artefact of unknown\n")
+	b.WriteString("authorship — the evaluator-outside-the-loop principle applied to ideas.\n\n")
+	for _, k := range v.kills {
+		fmt.Fprintf(b, "- **%s** — %s\n", k.Outcome, k.Attempt)
+	}
+	b.WriteString("\n")
+}
+
+// renderRejected writes the alternatives turned down. A deliberate absence is
+// stated in the same words the payload's explicit marker declares, so a reader
+// can tell "none were considered" from "nobody wrote them down".
+func renderRejected(b *strings.Builder, v verdictDoc) {
+	b.WriteString("## Rejected alternatives\n\n")
+	if v.noneRejected {
+		b.WriteString("None were considered. The absence is recorded deliberately, so a later\n")
+		b.WriteString("session knows nothing was weighed and discarded here.\n\n")
+		return
+	}
+	for _, r := range v.rejected {
+		fmt.Fprintf(b, "- **%s** — %s\n", cell(r.Alternative), r.WhyRejected)
+	}
+	b.WriteString("\n")
+}
+
+// renderOutcome states what the verdict means for the idea's future, so the
+// record answers the question its next reader arrives with.
+func renderOutcome(b *strings.Builder, v verdictDoc) {
+	b.WriteString("## What follows\n\n")
+	switch v.verdict {
+	case VerdictSurvives:
+		b.WriteString("The idea survives the gauntlet and may graduate to a draft intent through\n")
+		b.WriteString("the ordinary quoted-text create (`abcd intent \"<text>\"`). Ideate mints no\n")
+		b.WriteString("intent itself; graduation stays a deliberate act.\n")
+	case VerdictKilled:
+		b.WriteString("The idea is closed. Before proposing it again, read this record: the\n")
+		b.WriteString("findings above are why it did not survive, and re-proposing it costs\n")
+		b.WriteString("nothing only if something above has changed.\n")
+	case VerdictReframed:
+		b.WriteString("The idea as posed does not survive, but the reframing recorded above\n")
+		b.WriteString("does. Any graduation to a draft intent carries the reframing, not the\n")
+		b.WriteString("original wording.\n")
+	}
+}
+
+// cell escapes a value for a markdown table cell. Every field reaching here is
+// already line-cleaned, so the pipe is the only remaining character that could
+// change the document's structure — and an unescaped one would silently split a
+// claim into two columns and shift every later cell.
+func cell(s string) string { return strings.ReplaceAll(s, "|", `\|`) }
+
+// blockText escapes a value that starts a line of its own. Every other untrusted
+// field in this document sits behind a fixed prefix ("| ", "- ", "**"), so its
+// first character cannot begin a block; the idea is the one field rendered as a
+// bare paragraph, where a leading marker WOULD open a heading, a list, a quote, or
+// a code fence. A backslash is markdown's own escape for exactly these.
+func blockText(s string) string {
+	if s == "" {
+		return s
+	}
+	switch s[0] {
+	case '#', '-', '*', '+', '>', '|', '`', '~', '=', '_':
+		return `\` + s
+	}
+	// An ordered-list opener ("1. ", "12) ") is the one multi-character marker.
+	for i := 0; i < len(s); i++ {
+		if s[i] >= '0' && s[i] <= '9' {
+			continue
+		}
+		if i > 0 && (s[i] == '.' || s[i] == ')') {
+			return `\` + s
+		}
+		break
+	}
+	return s
+}

From cf8194a6396e14b58fa06e37890167d3cc61f676 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:29:49 +0100
Subject: [PATCH 5/8] feat: wire abcd ideate to the CLI and the plugin surface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `ideate record` verb is the front door onto internal/core/ideate:
--verdict-json (file or stdin) behind the shared payload guards, one core call,
exit 0 recorded / exit 2 refused with nothing written. --verdict-json is
required rather than optional-with-a-fallback: the disembark synthesis verbs can
fall back because a packed lifeboat's own files carry evidence, and there is no
evidence-only verdict an idea could have — a binary that invented one would be
doing the judging.

commands/abcd/ideate.md carries the orchestration the binary deliberately cannot:
the three legs in order, and the conduct that makes leg 3 worth running. It
instructs the host to strip every authorship signal and all prior-leg framing
before handing the artefact to the adversary, because leaking authorship converts
an adversary into a colleague and that debiasing is the whole point of the leg.

The routing nudge lands in the two places a user is already deciding where an
idea goes: the bare `abcd intent` / `abcd capture` renders, and the "which
ledger?" paragraph of both command pages. It is a pointer and the wording is
load-bearing — no "should", no "first", no warning when it is skipped. A surface
test asserts both renders name ideate and that neither presents it as a gate.

Brief surface page 17 plus its registry row keep surface_coverage honest; the CLI
reference and the surface baseline are regenerated.

Assisted-by: Claude:claude-opus-5[1m]
---
 .../brief/04-surfaces/17-ideate.md            |  90 +++++++++
 .abcd/development/brief/04-surfaces/README.md |   1 +
 .abcd/development/release/surface.json        |  18 ++
 CHANGELOG.md                                  |  20 ++
 commands/abcd/capture.md                      |   4 +-
 commands/abcd/ideate.md                       | 150 ++++++++++++++
 commands/abcd/intent.md                       |   5 +-
 docs/reference/cli/commands.md                |  25 +++
 internal/surface/cli/cli.go                   |  13 ++
 internal/surface/cli/ideate.go                | 128 ++++++++++++
 internal/surface/cli/ideate_surface_test.go   | 187 ++++++++++++++++++
 11 files changed, 639 insertions(+), 2 deletions(-)
 create mode 100644 .abcd/development/brief/04-surfaces/17-ideate.md
 create mode 100644 commands/abcd/ideate.md
 create mode 100644 internal/surface/cli/ideate.go
 create mode 100644 internal/surface/cli/ideate_surface_test.go

diff --git a/.abcd/development/brief/04-surfaces/17-ideate.md b/.abcd/development/brief/04-surfaces/17-ideate.md
new file mode 100644
index 0000000..a035496
--- /dev/null
+++ b/.abcd/development/brief/04-surfaces/17-ideate.md
@@ -0,0 +1,90 @@
+# `/abcd:ideate` — Gate an Idea Before It Becomes a Record Entry
+
+`/abcd:ideate` puts a big, unproven idea through a three-leg admission gauntlet
+and records the verdict — whether the idea survives or dies. Only a survivor
+graduates to a draft intent, and ideate mints no intent itself.
+
+It is **optional and never a gate**. No other verb requires it, nothing warns
+when it is skipped, and capture friction stays at one line. The routing help in
+the `intent` and `capture` surfaces names it for big, unproven ideas; that is a
+pointer, not a precondition.
+
+## Division of labour
+
+Ideate follows the host-delegated pattern the `disembark` synthesis family
+proved. The **host** runs the three judgement legs as agents; the **binary** is
+the deterministic frame that validates their output, proves every citation, and
+writes the record. The binary never fetches a source, never calls a model, and
+never decides whether an idea is any good.
+
+## The three legs, in order
+
+| # | Leg | What it produces |
+|---|---|---|
+| 1 | Primary-source research | A claims table: each load-bearing claim, the **primary** source it was checked against, and the finding (`verified` / `falsified` / `unverifiable`) |
+| 2 | Record grill | Hits on the existing record (brief, intents in every bucket, ADRs, principles), each cited by record id with a relation (`covered` / `contradicted` / `superseded`) |
+| 3 | Adversarial review | Kill attempts, each with an outcome (`survived` / `partial` / `fatal`) |
+
+The order is validated, not assumed: the legs travel as an ordered array and a
+payload whose legs are missing, reordered, or duplicated is refused. Each leg
+changes what the next one is looking at, so running them out of order produces a
+different — and weaker — result.
+
+Leg 3 is defined by its **conduct**: fresh-context, off-policy, unknown
+authorship. The evaluator did not conduct the research and receives the idea as
+an artefact whose provenance it does not know. That is the
+evaluator-outside-the-loop principle applied to ideas, and it is the one measured
+debiasing effect the protocol rests on. The binary cannot observe how an agent
+was run, so this obligation lives in the command page's orchestration script,
+which instructs the host to strip authorship and prior-leg framing before the
+hand-off.
+
+## Behaviour
+
+```bash
+abcd ideate record <idea-slug> --verdict-json <file|-> --json
+```
+
+`--verdict-json` is **required**. Unlike the `disembark` synthesis verbs there is
+no deterministic fallback mode: those can fall back because a packed lifeboat's
+own files carry evidence, and there is no evidence-only verdict an idea could
+have. A binary that invented one would be doing the judging.
+
+The verb writes two things:
+
+- `.abcd/development/research/YYYY-MM-DD-ideate-<idea-slug>.md` — the verdict
+  record: the idea as captured, the three legs, the verdict, and the rejected
+  alternatives, rendered for a human.
+- one dated pointer line in `.abcd/work/DECISIONS.md`.
+
+No new record family: a killed idea is a research outcome, and the research
+directory is where a session looks before re-proposing one.
+
+Exit codes are the release-cut shape without the middle state: `0` recorded, `2`
+refused with nothing written. There is no exit 1, because a verdict is either
+recordable or it is not.
+
+## What the binary refuses
+
+| Refusal | Why |
+|---|---|
+| A cited record id that does not resolve in the repository | A grill hit on a record that does not exist is a hit on nothing. The refusal names every offending id |
+| A cited value that is not a record id at all | Bounded before it is matched or echoed |
+| Legs missing, reordered, or duplicated; a leg carrying another leg's evidence | The gauntlet is exactly three legs, in order |
+| An out-of-enum verdict, claim status, grill relation, or kill outcome | Each set is closed; an unregistered value is a whole-document refusal, never a coercion |
+| A claim naming no primary source | A claim checked against nothing is an assertion |
+| An empty `rejected_alternatives` list with no explicit `no_rejected_alternatives` marker | Silence and "nothing was weighed" are indistinguishable to a later reader, and the record exists to stop the idea being re-litigated |
+| A slug that is not lower-case kebab-case | The slug becomes a filename; the grammar is the lexical half of the write containment, `os.Root` the other |
+| A verdict record that already exists for this slug and date | Overwriting would erase a recorded reason, which is the one thing the verb exists to preserve |
+| A repository with no `.abcd/work/DECISIONS.md` | A record nothing points at is a record nobody finds — refused before anything is written |
+
+Refusals are **whole-document**, never cite-or-be-dropped. A verdict record with
+a quietly-dropped falsified claim or grill hit is worse than no record, because a
+later session trusts it.
+
+## References
+
+- Plugin command: [`commands/abcd/ideate.md`](../../../../commands/abcd/ideate.md)
+- Intent: [`itd-104`](../../intents/planned/itd-104-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md)
+- Spec: [`spc-18`](../../specs/open/spc-18-abcd-gates-a-new-idea-before-it-becomes-a-record-entry-resea.md)
+- Routing-help neighbours: [`05-intent.md`](05-intent.md), [`06-capture.md`](06-capture.md)
diff --git a/.abcd/development/brief/04-surfaces/README.md b/.abcd/development/brief/04-surfaces/README.md
index 4d6f353..8f82513 100644
--- a/.abcd/development/brief/04-surfaces/README.md
+++ b/.abcd/development/brief/04-surfaces/README.md
@@ -20,6 +20,7 @@ The brief's user-facing command surface is the set enumerated below (not all are
 | 14 | `/abcd:ingest` | shipped | Register a URL or document into the local sources corpus — host-delegated command, no Go verb | [`14-ingest.md`](14-ingest.md) |
 | 15 | `/abcd:prepare-this-repo` | shipped | Bring an owned repo up to abcd's conventions (interim bridge) — host-delegated command, no Go verb | [`15-prepare-this-repo.md`](15-prepare-this-repo.md) |
 | 16 | `/abcd:audit` | shipped | Check whether a repo conforms to the working conventions (three-tier layout, AGENTS.md router, durable decisions, docs currency, privacy hygiene) — read-only, tri-state exit; backs `prepare-this-repo` and gates CI (itd-85) | [`16-audit.md`](16-audit.md) |
+| 17 | `/abcd:ideate` | shipped | Idea-admission gauntlet (itd-104, spc-18): three host-run legs in a validated order — primary-source research, a record grill whose every hit is cited by an id the binary proves resolves, and a fresh-context/off-policy/unknown-authorship adversarial review — then `abcd ideate record <idea-slug> --verdict-json` writes the dated verdict record under `.abcd/development/research/` and one pointer line in `.abcd/work/DECISIONS.md`. Recorded whether the idea survives or dies, with rejected alternatives that an explicit marker is required to leave empty. Optional and never a gate: the `intent` and `capture` routing help names it, nothing requires it | [`17-ideate.md`](17-ideate.md) |
 
 The **Status** column is machine-checked: the `surface_coverage` record-lint rule asserts every `shipped` row has a backing surface (`commands/abcd/<name>.md` or `skills/<name>/`) and every `staged` row (a design target) has none — and, in reverse, that every real surface has a row here. The bare `/abcd` top-level is binary-backed (its command file is `commands/abcd.md`, not a `commands/abcd/<name>.md` entry) and is exempt from the file check. Keeping this column honest is how the brief's surface set stays reconciled with the shipped binary; the semantic half — whether each row's *prose* matches binary behaviour — stays a release-gate agent check.
 
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index e40c0b2..f191b3f 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -403,6 +403,24 @@
       "hidden": false,
       "flags": []
     },
+    {
+      "path": "abcd ideate",
+      "hidden": false,
+      "flags": []
+    },
+    {
+      "path": "abcd ideate record",
+      "hidden": false,
+      "flags": [
+        {
+          "name": "verdict-json",
+          "shorthand": "",
+          "type": "string",
+          "required": false,
+          "hidden": false
+        }
+      ]
+    },
     {
       "path": "abcd intent",
       "hidden": false,
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4130a66..3e2aa7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,26 @@ called out in a **Breaking** section.
 
 ### Added
 
+- **`/abcd:ideate` — the idea-admission gauntlet** (itd-104, spc-18). A big,
+  unproven idea can be put through three legs before it becomes a record entry:
+  primary-source research (each load-bearing claim checked against its **primary**
+  source, never a secondary citation), a grill against the existing record, and an
+  adversarial review that is fresh-context, off-policy, and receives the idea as an
+  artefact of unknown authorship. The legs are host work; `abcd ideate record
+  <idea-slug> --verdict-json <file|->` is the deterministic frame that validates
+  them and writes the durable verdict — the dated record under
+  `.abcd/development/research/` plus one pointer line in `.abcd/work/DECISIONS.md`.
+  The verdict is recorded **whether the idea survives or dies**, and its rejected
+  alternatives may be empty only behind an explicit marker, because silence and
+  "nothing was weighed" read the same to a session tempted to re-propose the idea.
+  Every record-grill hit is **cited by id and proved to resolve** in the
+  repository: an id naming no record refuses the whole verdict and names the id.
+  The legs travel as an ordered array so "three legs, in order" is checked rather
+  than assumed, and refusals are whole-document — nothing is written unless
+  everything validates. Ideate is **optional and never a gate**: the `intent` and
+  `capture` routing help names it for big unproven ideas, and nothing requires it
+  or warns when it is skipped.
+
 - **`abcd launch scaffold` — the changelog-driven release-gate scaffolder**
   (itd-93, spc-14). Writes the fixed release machinery into a managed repo that
   lacks it: `.github/workflows/release.yml` (verify → build → publish, the verify
diff --git a/commands/abcd/capture.md b/commands/abcd/capture.md
index 7497d3e..5319903 100644
--- a/commands/abcd/capture.md
+++ b/commands/abcd/capture.md
@@ -25,7 +25,9 @@ Summarise the JSON for the user: `open_count` / `resolved_count` /
 
 **Which ledger?** A half-formed observation, question, or nitpick goes to
 `/abcd:capture "…"`; a user-facing change you want to ship goes to
-`/abcd:intent "…"`.
+`/abcd:intent "…"`. For a big, unproven idea there is an optional third route:
+`/abcd:ideate` runs the admission gauntlet and records the verdict either way.
+It is a pointer, never a precondition — capture friction stays at one line.
 
 ## Capture an issue
 
diff --git a/commands/abcd/ideate.md b/commands/abcd/ideate.md
new file mode 100644
index 0000000..6a6ee39
--- /dev/null
+++ b/commands/abcd/ideate.md
@@ -0,0 +1,150 @@
+---
+name: ideate
+description: Put a big, unproven idea through the three-leg admission gauntlet — primary-source research, a grill against the existing record, and an independent adversarial review — then record the verdict, whether the idea survives or dies.
+argument-hint: "<the idea, in one or two sentences>"
+---
+
+# `/abcd:ideate` — the idea-admission gauntlet
+
+An exciting idea is cheapest to kill in its first hour and most expensive to kill
+after it has minted intents, specs, and branches. This runs the admission
+interview and records the outcome.
+
+**Ideate is optional and never a gate.** Nothing requires it: `/abcd:capture` and
+`/abcd:intent` work exactly as they always do, and skipping ideate is not a
+mistake to warn about. Reach for it when an idea is big and unproven enough that
+being wrong about it would be expensive.
+
+**The binary does no judging.** The three legs below are yours to run. `abcd
+ideate record` validates what they produced, proves every citation names a real
+record, and writes the durable verdict. It never fetches a source and never
+forms an opinion.
+
+## The three legs, in order
+
+The order is not cosmetic — each leg changes what the next one is looking at —
+and `abcd ideate record` refuses a payload whose legs are missing or out of
+order.
+
+### Leg 1 — Primary-source research
+
+Research the idea's **load-bearing claims**: the ones that, if false, take the
+idea with them. For each, open the **primary** source — the paper, the
+specification, the API reference, the original data — and check the claim
+against it.
+
+A secondary citation is not a check. In the run this protocol comes from, three
+secondary-source claims were falsified once the primary was opened, one of them
+an extraction artefact that no source ever said.
+
+Produce, for each claim: the claim, the primary source (a URL or a document
+reference), and the finding — `verified`, `falsified`, or `unverifiable`. An
+honest `unverifiable` is a result; a missing source is not, and the binary
+refuses a claim that names none.
+
+### Leg 2 — Record grill
+
+Read the existing record before anything else is decided — the brief, the
+intents in **every** bucket (`drafts/`, `planned/`, `shipped/`, `disciplines/`,
+`superseded/`), the ADRs, and the principles. Answer one question: does an entry
+already **cover**, **contradict**, or **supersede** this idea?
+
+Every hit is **cited by record id** (`itd-N`, `spc-N`, `iss-N`, `adr-N`), and
+`abcd ideate record` refuses the whole verdict if an id does not resolve in this
+repository. Check the id before you write it down. The brief and the principles
+carry no per-entry id, so a hit that rests on one goes in the `note` field of
+the nearest citable record.
+
+Finding **nothing** is a legitimate and common outcome — say so; do not
+manufacture a hit.
+
+### Leg 3 — Adversarial review
+
+Hand the idea to a **fresh evaluator whose only job is to kill it**. Three
+properties make this leg worth running, and they are the whole point of it:
+
+- **Fresh context.** The evaluator must not be the session that ran legs 1 and 2.
+  Dispatch it as a separate agent with its own context.
+- **Off-policy.** Do not hand it the framing, the enthusiasm, or the conclusions
+  of the earlier legs. It receives the idea and the two legs' *findings*, not
+  their narrative.
+- **Unknown authorship.** **Strip every authorship signal before handing the
+  artefact over**: no "the user's idea", no "our proposal", no session history,
+  no mention of who wants this or how excited they are. The evaluator sees an
+  artefact of unknown provenance. This is the only measured debiasing effect in
+  the whole protocol; leaking authorship converts an adversary into a colleague.
+
+Ask it for concrete **kill attempts**, each with an outcome: `survived`,
+`partial` (it landed but is not on its own fatal), or `fatal`.
+
+## Record the verdict
+
+Compose the verdict document and hand it to the binary:
+
+```bash
+abcd ideate record <idea-slug> --verdict-json <path>   # or - for stdin
+```
+
+`<idea-slug>` is lower-case kebab-case (it becomes a filename). The document:
+
+```json
+{
+  "schema_version": 1,
+  "prompt_version": "1.0.0",
+  "idea": "the idea in the words it entered with",
+  "legs": [
+    {"kind": "research", "claims": [
+      {"claim": "…", "primary_source": "https://…", "status": "verified|falsified|unverifiable"}
+    ]},
+    {"kind": "record-grill", "hits": [
+      {"record": "itd-104", "relation": "covered|contradicted|superseded", "note": "optional"}
+    ]},
+    {"kind": "adversarial-review", "kill_attempts": [
+      {"attempt": "…", "outcome": "survived|partial|fatal"}
+    ]}
+  ],
+  "verdict": "survives|killed|reframed",
+  "rejected_alternatives": [
+    {"alternative": "…", "why_rejected": "…"}
+  ]
+}
+```
+
+**The verdict is recorded either way.** A killed idea earns exactly as full a
+record as a surviving one — that record is what stops the idea being talked back
+into six months from now.
+
+**Rejected alternatives are not optional.** If genuinely none were considered,
+say so explicitly with `"no_rejected_alternatives": true` and an empty list; the
+binary refuses an empty list that arrives by omission, because silence and "we
+weighed nothing" are indistinguishable to a later reader.
+
+## What the binary does with it
+
+It writes `.abcd/development/research/<date>-ideate-<slug>.md` — the idea, the
+three legs, the verdict, and the rejected alternatives, rendered for a human —
+and appends one dated pointer line to `.abcd/work/DECISIONS.md`.
+
+Exit codes:
+
+- **0** — recorded. Report the `verdict`, the `path`, and the `cited_records`
+  (the ids the grill cited, every one proved to resolve). Show the user the
+  written record.
+- **2** — refused, and **nothing was written**. Relay the diagnostic: an
+  unresolvable citation names the id, a payload fault names the field, and a
+  verdict record that already exists under today's date is refused rather than
+  overwritten (give the re-run its own slug, or keep the first record).
+
+## After a verdict
+
+- **survives** — the idea may graduate to a draft intent through the ordinary
+  path, `abcd intent "<text>"`. Ideate mints no intent itself; graduation stays a
+  deliberate act you take with the user.
+- **killed** — stop. Do not file an intent, and do not soften the record.
+- **reframed** — any graduation carries the reframing recorded in leg 3, not the
+  original wording.
+
+If the `abcd` binary is not on `PATH`, fall back to `go run ./cmd/abcd ideate …`
+from the repo root, or tell the user to build it with `make build`.
+
+**User input:** $ARGUMENTS
diff --git a/commands/abcd/intent.md b/commands/abcd/intent.md
index a24981d..a794c65 100644
--- a/commands/abcd/intent.md
+++ b/commands/abcd/intent.md
@@ -22,7 +22,10 @@ and the intent↔spec links. Nothing is created or moved by this invocation.
 
 **Which ledger?** A half-formed observation, question, or nitpick goes to
 `/abcd:capture "…"`; a user-facing change you want to ship goes to
-`/abcd:intent "…"`.
+`/abcd:intent "…"`. For a big, unproven idea there is an optional third route:
+`/abcd:ideate` runs the admission gauntlet and records the verdict either way.
+It is a pointer, never a precondition — filing a draft without it is a normal
+thing to do.
 
 ## Create a draft
 
diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 4309010..2d427d5 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -285,6 +285,31 @@ Show one stored transcript's metadata and redacted body
 
 **Usage:** `abcd history show <session-id-or-filename>`
 
+### `abcd ideate`
+
+Idea-admission protocol: record the verdict of the three-leg gauntlet
+
+**Usage:** `abcd ideate`
+
+Record the verdict of abcd's idea-admission protocol — primary-source research, a grill
+against the existing record, and an independent adversarial review.
+
+The legs are host work; `/abcd:ideate` orchestrates them. This verb validates what they
+produced and writes the durable verdict. Ideate is OPTIONAL and never a gate: no other
+verb requires it, and skipping it is never warned about.
+
+#### `abcd ideate record`
+
+Validate a host-composed verdict and write the dated research record
+
+**Usage:** `abcd ideate record <idea-slug> --verdict-json <file|-> [flags]`
+
+**Flags:**
+
+```
+      --verdict-json string   path to the host-composed verdict JSON (or - for stdin)
+```
+
 ### `abcd intent`
 
 Intent lifecycle; bare invocation is read-only status, quoted text files a draft
diff --git a/internal/surface/cli/cli.go b/internal/surface/cli/cli.go
index 85d4f37..21673de 100644
--- a/internal/surface/cli/cli.go
+++ b/internal/surface/cli/cli.go
@@ -145,6 +145,7 @@ func NewRootCommand() *cobra.Command {
 	root.AddCommand(newHistoryCommand(&asJSON))
 	root.AddCommand(newDocsCommand(&asJSON))
 	root.AddCommand(newIntentCommand(&asJSON))
+	root.AddCommand(newIdeateCommand(&asJSON))
 	root.AddCommand(newSpecCommand(&asJSON))
 	root.AddCommand(newDisembarkCommand(&asJSON))
 	root.AddCommand(newEmbarkCommand(&asJSON))
@@ -1113,6 +1114,7 @@ func newIntentCommand(asJSON *bool) *cobra.Command {
 					fmt.Fprintf(w, "  link: %s -> %s\n", termsafe.Sanitize(p.Intent), termsafe.Sanitize(p.Spec))
 				}
 				fmt.Fprint(w, ledgerDecisionRule)
+				fmt.Fprint(w, ideateRoutingRule)
 			})
 		},
 	}
@@ -1240,6 +1242,16 @@ func newIntentCommand(asJSON *bool) *cobra.Command {
 // for. It stays host-agnostic (binary command forms, no plugin/tool names).
 const ledgerDecisionRule = "  which ledger? half-formed observation, question, or nitpick -> `abcd capture \"…\"`; a user-facing change you want to ship -> `abcd intent \"…\"`\n"
 
+// ideateRoutingRule sits beside the ledger rule and names the optional third
+// route: a big, unproven idea can go through the admission gauntlet first
+// (itd-104 AC1).
+//
+// It is a POINTER, and the wording is load-bearing. Ideate is never a
+// precondition for capture or intent, so this line offers a route and never
+// implies one is missed — no "should", no "first", no warning when it is skipped.
+// The one line of capture friction the ledgers promise stays one line.
+const ideateRoutingRule = "  a big, unproven idea? `abcd ideate` runs the optional admission gauntlet and records the verdict either way\n"
+
 // createIntentFromText is the shared quoted-text create path behind both
 // `abcd intent "<text>"` and the deprecated `abcd intent new "<text>"` alias: it
 // files a new draft via intent.CreateFromText and renders the created record. The
@@ -1726,6 +1738,7 @@ func newCaptureCommand(asJSON *bool) *cobra.Command {
 						}
 					}
 					fmt.Fprint(w, ledgerDecisionRule)
+					fmt.Fprint(w, ideateRoutingRule)
 				})
 			}
 			// Guard: a mistyped subcommand (e.g. `capture resovle iss-1 …`)
diff --git a/internal/surface/cli/ideate.go b/internal/surface/cli/ideate.go
new file mode 100644
index 0000000..13a5ce5
--- /dev/null
+++ b/internal/surface/cli/ideate.go
@@ -0,0 +1,128 @@
+package cli
+
+// ideate.go is the front door onto internal/core/ideate — the write step of the
+// idea-admission protocol (itd-104, spc-18).
+//
+// The verb is deliberately SMALL. Everything the protocol is actually made of —
+// the primary-source research, the record grill, the adversarial review — is host
+// work orchestrated by `commands/abcd/ideate.md`; the binary's whole job is to
+// validate what those legs produced and write the durable verdict. So this file
+// reads a payload, calls one core function, and formats the outcome.
+//
+// Exit codes follow the launch-ship / disembark-synthesis shape: 0 when the record
+// landed, 2 for every structural refusal (a payload fault, an unresolvable
+// citation, an unusable slug, an existing record). There is no exit 1 here,
+// because ideate has no "refused cut" middle state — either the verdict is
+// recordable or it is not.
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/REPPL/abcd-cli/internal/core/ideate"
+	"github.com/spf13/cobra"
+)
+
+// newIdeateCommand builds the `ideate` sub-tree. The parent takes no arguments
+// and prints help: unlike capture or intent, ideate has no read-only status to
+// render — a gauntlet is a run, not a store.
+func newIdeateCommand(asJSON *bool) *cobra.Command {
+	ideateCmd := &cobra.Command{
+		Use:   "ideate",
+		Short: "Idea-admission protocol: record the verdict of the three-leg gauntlet",
+		Long: "Record the verdict of abcd's idea-admission protocol — primary-source research, a grill\n" +
+			"against the existing record, and an independent adversarial review.\n\n" +
+			"The legs are host work; `/abcd:ideate` orchestrates them. This verb validates what they\n" +
+			"produced and writes the durable verdict. Ideate is OPTIONAL and never a gate: no other\n" +
+			"verb requires it, and skipping it is never warned about.",
+		Args: cobra.NoArgs,
+	}
+
+	var verdictJSON string
+	recordCmd := &cobra.Command{
+		Use:   "record <idea-slug> --verdict-json <file|->",
+		Short: "Validate a host-composed verdict and write the dated research record",
+		Args: func(_ *cobra.Command, args []string) error {
+			if len(args) != 1 {
+				return &exitError{Code: 2, Msg: "ideate record: <idea-slug> is required"}
+			}
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			// The flag is REQUIRED, not optional-with-a-deterministic-fallback. The
+			// disembark synthesis verbs can fall back because a lifeboat's own files
+			// carry evidence; there is no evidence-only verdict an idea could have,
+			// and inventing one would be the binary doing the judging.
+			if verdictJSON == "" {
+				return &exitError{Code: 2, Msg: "ideate record: --verdict-json <file|-> is required; " +
+					"the three legs are host work, and the binary records only what they produced"}
+			}
+			raw, err := readIdeatePayload(cmd, verdictJSON)
+			if err != nil {
+				return &exitError{Code: 2, Msg: "ideate record: " + scrubPaths(err)}
+			}
+			// The clock is read HERE, at the front door, and passed in: the date lands
+			// in a durable filename and a durable log line, so the core takes it as an
+			// argument a test can pin rather than reading it from under a writer.
+			res, err := ideate.Record(cwd, args[0], raw, time.Now())
+			if err != nil {
+				return &exitError{Code: 2, Msg: "ideate record: " + scrubPaths(err)}
+			}
+			return render(cmd.OutOrStdout(), *asJSON, res, func(w io.Writer) {
+				fmt.Fprint(w, renderIdeateResult(res))
+			})
+		},
+	}
+	recordCmd.Flags().StringVar(&verdictJSON, "verdict-json", "",
+		"path to the host-composed verdict JSON (or - for stdin)")
+
+	ideateCmd.AddCommand(recordCmd)
+	return ideateCmd
+}
+
+// readIdeatePayload reads the untrusted verdict document behind the same trust
+// guards every other host-delegated ingest uses: a file must be regular,
+// non-symlink, and under the cap the core enforces; "-" reads stdin bounded to the
+// same ceiling.
+func readIdeatePayload(cmd *cobra.Command, spec string) ([]byte, error) {
+	if spec == "-" {
+		return io.ReadAll(io.LimitReader(cmd.InOrStdin(), ideate.MaxPayloadBytes))
+	}
+	return readGuardedOperand(spec, ideate.MaxPayloadBytes)
+}
+
+// renderIdeateResult is the human view of a recorded verdict. Every value in it is
+// core-owned (a validated slug, a registered verdict, counts, and paths this
+// binary built), so nothing here needs sanitising — the untrusted prose stayed in
+// the record, where the renderer escaped it.
+func renderIdeateResult(res ideate.Result) string {
+	out := fmt.Sprintf("ideate verdict recorded — %s\n", res.Slug)
+	out += fmt.Sprintf("  verdict:   %s\n", res.Verdict)
+	out += fmt.Sprintf("  record:    %s\n", res.Path)
+	out += fmt.Sprintf("  pointer:   %s\n", res.DecisionPath)
+	out += fmt.Sprintf("  claims:    %d (verified %d · falsified %d · unverifiable %d)\n",
+		res.Claims.Total(), res.Claims.Verified, res.Claims.Falsified, res.Claims.Unverifiable)
+	if len(res.CitedRecords) == 0 {
+		out += "  grill:     no entry in the record covers, contradicts, or supersedes this\n"
+	} else {
+		out += fmt.Sprintf("  grill:     %d hit(s), all cited ids resolved: %v\n", res.GrillHits, res.CitedRecords)
+	}
+	out += fmt.Sprintf("  adversary: %d kill attempt(s)\n", res.KillAttempts)
+	if res.RejectedAlternatives == 0 {
+		out += "  rejected:  none, recorded explicitly\n"
+	} else {
+		out += fmt.Sprintf("  rejected:  %d alternative(s) recorded\n", res.RejectedAlternatives)
+	}
+	if res.Graduates {
+		out += "  next:      the idea may graduate to a draft intent — `abcd intent \"<text>\"`\n"
+	} else {
+		out += "  next:      the idea does not graduate; the record is why\n"
+	}
+	return out
+}
diff --git a/internal/surface/cli/ideate_surface_test.go b/internal/surface/cli/ideate_surface_test.go
new file mode 100644
index 0000000..5ee4fa6
--- /dev/null
+++ b/internal/surface/cli/ideate_surface_test.go
@@ -0,0 +1,187 @@
+package cli
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/REPPL/abcd-cli/internal/core/ideate"
+)
+
+// ideateRepo lays out the minimum an `ideate record` run needs, so the surface
+// test proves the WIRING end to end rather than mocking the core.
+func ideateRepo(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	write := func(rel, body string) {
+		abs := filepath.Join(root, filepath.FromSlash(rel))
+		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(abs, []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.MkdirAll(filepath.Join(root, filepath.FromSlash(ideate.ResearchRelDir)), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	write(ideate.DecisionsRelDir, "# Decisions\n")
+	write(".abcd/development/intents/planned/itd-104-ideate.md",
+		"---\nid: itd-104\nslug: ideate\nspec_id: spc-18\nimpact: additive\n---\n\n# itd-104\n")
+	return root
+}
+
+// ideateVerdictJSON is a valid verdict document; cited is the record id the grill
+// hit cites, so a test can swap in an id that does not resolve.
+func ideateVerdictJSON(cited string) string {
+	return `{
+  "schema_version": 1,
+  "prompt_version": "1.0.0",
+  "idea": "abcd should gate a new idea before it becomes a record entry",
+  "legs": [
+    {"kind": "research", "claims": [
+      {"claim": "fresh-context evaluation is the measured debiasing effect",
+       "primary_source": "https://example.invalid/paper", "status": "verified"}
+    ]},
+    {"kind": "record-grill", "hits": [
+      {"record": "` + cited + `", "relation": "covered", "note": "already filed"}
+    ]},
+    {"kind": "adversarial-review", "kill_attempts": [
+      {"attempt": "the gauntlet adds friction", "outcome": "survived"}
+    ]}
+  ],
+  "verdict": "survives",
+  "rejected_alternatives": [
+    {"alternative": "make it a blocking pre-capture gate", "why_rejected": "capture friction stays at one line"}
+  ]
+}`
+}
+
+// writeVerdict stages a verdict payload on disk and returns its path.
+func writeVerdict(t *testing.T, body string) string {
+	t.Helper()
+	p := filepath.Join(t.TempDir(), "verdict.json")
+	if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// TestIdeateRecordWiredFromTheCLI is the wiring proof: the verb reaches
+// ideate.Record from the front door and a durable verdict record lands on disk.
+func TestIdeateRecordWiredFromTheCLI(t *testing.T) {
+	repo := ideateRepo(t)
+	t.Chdir(repo)
+
+	out := runCLI(t, "ideate", "record", "the-ideate-gate", "--verdict-json", writeVerdict(t, ideateVerdictJSON("itd-104")), "--json")
+	var res ideate.Result
+	if err := json.Unmarshal(out, &res); err != nil {
+		t.Fatalf("decode result: %v\n%s", err, out)
+	}
+	if res.Verdict != ideate.VerdictSurvives || !res.Graduates {
+		t.Errorf("verdict = %q graduates = %v; want survives/true", res.Verdict, res.Graduates)
+	}
+	if !strings.HasPrefix(res.Path, ideate.ResearchRelDir+"/") || !strings.HasSuffix(res.Path, "-ideate-the-ideate-gate.md") {
+		t.Errorf("path = %q; want a dated ideate record under %s", res.Path, ideate.ResearchRelDir)
+	}
+	if _, err := os.Stat(filepath.Join(repo, filepath.FromSlash(res.Path))); err != nil {
+		t.Errorf("the reported record is not on disk: %v", err)
+	}
+	if strings.Join(res.CitedRecords, ",") != "itd-104" {
+		t.Errorf("CitedRecords = %v, want [itd-104]", res.CitedRecords)
+	}
+
+	// The text render is what a human sees; it must name the verdict and the file.
+	text := string(runCLI(t, "ideate", "record", "a-second-idea", "--verdict-json", writeVerdict(t, ideateVerdictJSON("itd-104"))))
+	if !strings.Contains(text, "survives") || !strings.Contains(text, "a-second-idea") {
+		t.Errorf("text render is missing the verdict or the slug:\n%s", text)
+	}
+}
+
+// TestIdeateRecordRefusalsExitTwo proves every structural refusal reaches the
+// operator as exit 2 with a diagnostic that names the fault — the unresolvable
+// citation (AC 4) and the traversal slug being the two that matter most.
+func TestIdeateRecordRefusalsExitTwo(t *testing.T) {
+	repo := ideateRepo(t)
+	t.Chdir(repo)
+
+	cases := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{
+			"unresolvable-citation",
+			[]string{"ideate", "record", "the-ideate-gate", "--verdict-json", writeVerdict(t, ideateVerdictJSON("itd-9999"))},
+			"itd-9999",
+		},
+		{
+			"traversal-slug",
+			[]string{"ideate", "record", "../../../etc/passwd", "--verdict-json", writeVerdict(t, ideateVerdictJSON("itd-104"))},
+			"slug",
+		},
+		{
+			"verdict-json-required",
+			[]string{"ideate", "record", "the-ideate-gate"},
+			"--verdict-json",
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			out, err := runCLIErr(t, c.args...)
+			if err == nil {
+				t.Fatalf("the run succeeded; want a refusal\n%s", out)
+			}
+			if code := exitCodeOf(err); code != 2 {
+				t.Errorf("exit code = %d, want 2", code)
+			}
+			if !strings.Contains(err.Error(), c.want) {
+				t.Errorf("diagnostic %q does not name %q", err.Error(), c.want)
+			}
+		})
+	}
+	entries, err := os.ReadDir(filepath.Join(repo, filepath.FromSlash(ideate.ResearchRelDir)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		t.Errorf("a refused run wrote %s", e.Name())
+	}
+}
+
+// TestIdeateRecordReadsStdin proves the "-" payload form works, matching every
+// other host-delegated ingest verb.
+func TestIdeateRecordReadsStdin(t *testing.T) {
+	repo := ideateRepo(t)
+	t.Chdir(repo)
+	out := runCLIStdin(t, ideateVerdictJSON("itd-104"),
+		"ideate", "record", "from-stdin", "--verdict-json", "-", "--json")
+	if !strings.Contains(string(out), "from-stdin") {
+		t.Errorf("stdin payload was not recorded:\n%s", out)
+	}
+}
+
+// TestIdeateRoutingHintIsAPointerNotAGate is AC 1: the intent and capture status
+// renders NAME /abcd:ideate for a big unproven idea, and neither one blocks,
+// warns, or requires it.
+func TestIdeateRoutingHintIsAPointerNotAGate(t *testing.T) {
+	repo := ideateRepo(t)
+	t.Chdir(repo)
+	for _, verb := range []string{"intent", "capture"} {
+		out := string(runCLI(t, verb))
+		if !strings.Contains(out, "ideate") {
+			t.Errorf("bare `abcd %s` does not name ideate as a route:\n%s", verb, out)
+		}
+		for _, forbidden := range []string{"must", "required", "before you", "warning"} {
+			if strings.Contains(strings.ToLower(out), forbidden) {
+				t.Errorf("bare `abcd %s` presents ideate as a gate (%q):\n%s", verb, forbidden, out)
+			}
+		}
+	}
+	// Capture still writes an issue with no ideate step in the way.
+	if out, err := runCLIErr(t, "capture", "a plain observation", "--json"); err != nil {
+		t.Errorf("capture was blocked: %v\n%s", err, out)
+	}
+}

From f25baca49ab7c2bf675e80efada206758eb226fa Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:49:38 +0100
Subject: [PATCH 6/8] fix: neutralise raw HTML tag openers in untrusted prose
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shared cleaner broke apart HTML comment markers but left a bare tag intact.
In CommonMark a `<` followed by a letter, `/`, `!`, or `?` opens an HTML BLOCK,
and several of those block types run to the end of the document if their closing
condition never arrives — so one `<script>` in a model-supplied field made every
later section of the record render as inert text inside an unclosed element,
while a forged section above it rendered normally. An artefact whose whole value
is that a later session trusts it must not be able to hide its own evidence.

Fixed in the one canonical primitive, so it lands at all three trust boundaries
at once: the release changelog ingest, the lifeboat synthesis writers, and the
ideate verdict. Inserting a space after the `<` is enough — CommonMark needs the
name, `/`, `!`, or `?` to follow immediately — and it subsumes the comment rule,
which produced the same `< !--` output.

The neutralisation now runs AFTER terminal sanitisation, which closes a second
hole the reordering revealed: Sanitize SUBSTITUTES a '?' for a masked rune rather
than deleting it, so `<` before an escape byte became `<?` — a processing
instruction — under the old order. A regression case pins exactly that.

Reported by the security review of this branch.

Assisted-by: Claude:claude-opus-5[1m]
---
 CHANGELOG.md                    | 14 ++++++++++++
 internal/termsafe/prose.go      | 37 ++++++++++++++++++++++++++-----
 internal/termsafe/prose_test.go | 39 +++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e2aa7b..d5ee400 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -102,6 +102,20 @@ called out in a **Breaking** section.
 
 ### Fixed
 
+- **Untrusted prose can no longer open raw HTML in a record abcd writes.** The
+  shared cleaner every host-delegated ingest routes through — the release
+  changelog ingest, the lifeboat synthesis writers, and the ideate verdict —
+  neutralised newlines and HTML comment markers but left a bare tag intact. In
+  CommonMark a `<` followed by a letter, `/`, `!`, or `?` opens an HTML block, and
+  several of those block types run to the end of the document: a single
+  `<script>` in one model-supplied field made every later section of the record
+  render as inert text inside an unclosed element, while a forged section above it
+  rendered normally — so an artefact whose whole value is that a later session
+  trusts it could hide its own evidence. Every tag opener is now broken apart in
+  the one canonical primitive, so the fix lands at all three boundaries at once.
+  The neutralisation runs **after** terminal sanitisation, which closes a second
+  hole: sanitising substitutes `?` for a masked rune, so `<` before an escape byte
+  previously became `<?` — a processing instruction — after the old ordering.
 - **The disembark probe's recursive file walk is bounded per directory, opens
   each child in O(1), and skips the common ecosystems' dependency trees**
   (iss-112, iss-114, iss-116). The walk now reads every directory with a bounded
diff --git a/internal/termsafe/prose.go b/internal/termsafe/prose.go
index 236ca64..7c604a0 100644
--- a/internal/termsafe/prose.go
+++ b/internal/termsafe/prose.go
@@ -9,8 +9,18 @@ package termsafe
 //
 //   - line breaks become spaces, so one prose field can never forge a second line
 //     (a changelog bullet, a markdown table row, a list item) in the record;
-//   - `<!--` and `-->` are broken apart, so prose can neither open nor close an
-//     HTML comment and swallow — or expose — the record around it.
+//   - anything that could OPEN raw HTML is broken apart — a tag, a closing tag, a
+//     declaration, a processing instruction, or a comment — so prose can neither
+//     open nor close an HTML construct and swallow the record around it.
+//
+// The HTML rule is not cosmetic. In CommonMark a `<` followed by a letter, `/`,
+// `!`, or `?` at the start of a line begins an HTML BLOCK, and several of those
+// block types run to the end of the document if their closing condition never
+// arrives: one `<script>` in a claim makes every later section of a verdict record
+// — the falsified claims, the grill hits, the adversary's findings — render as
+// inert text inside an unclosed element, while a forged table above it renders
+// normally. An artefact whose whole value is that a later session trusts it must
+// not be able to hide its own evidence.
 //
 // Two forms exist because two callers legitimately want different whitespace
 // handling, and the difference is visible in the record: CleanProse trims,
@@ -21,7 +31,16 @@ package termsafe
 // route through it rather than keep divergent copies, and a new trust boundary
 // (internal/core/ideate) reuses it instead of writing a third.
 
-import "strings"
+import (
+	"regexp"
+	"strings"
+)
+
+// htmlOpenerRe matches every way CommonMark lets a `<` begin raw HTML: a tag, a
+// closing tag, a declaration or comment (`<!`), or a processing instruction
+// (`<?`). A bare `<` with anything else after it — `a < b`, `<-`, a trailing one —
+// opens nothing and is left alone, so ordinary prose reads normally.
+var htmlOpenerRe = regexp.MustCompile(`<[A-Za-z!/?]`)
 
 // CleanProse neutralises one untrusted prose field and caps it at capBytes,
 // preserving interior whitespace runs. The cap is applied last and the result is
@@ -41,12 +60,20 @@ func CleanProseLine(s string, capBytes int) string {
 // cleanProse is the shared body: neutralise, sanitise, normalise whitespace the
 // caller's way, then cap. Written once so the two forms can only differ in the
 // one dimension they are meant to differ in.
+// The HTML neutralisation runs AFTER Sanitize, and the order is load-bearing:
+// Sanitize SUBSTITUTES a '?' for each masked rune rather than deleting it, so a
+// `<` followed by an escape byte becomes `<?` — a processing instruction, which
+// is an HTML block that runs until `?>`. Neutralising before Sanitize would
+// therefore let a masked control character forge the very construct this closes.
 func cleanProse(s string, capBytes int, normalise func(string) string) string {
 	s = strings.ReplaceAll(s, "\r", " ")
 	s = strings.ReplaceAll(s, "\n", " ")
-	s = strings.ReplaceAll(s, "<!--", "< !--")
-	s = strings.ReplaceAll(s, "-->", "-- >")
 	s = Sanitize(s)
+	// A space after the `<` is enough: CommonMark needs the name, `/`, `!`, or `?`
+	// to follow immediately. This subsumes the comment-open case — `<!--` becomes
+	// `< !--` — so the two rules are one.
+	s = htmlOpenerRe.ReplaceAllStringFunc(s, func(m string) string { return "< " + m[1:] })
+	s = strings.ReplaceAll(s, "-->", "-- >")
 	s = normalise(s)
 	if len(s) > capBytes {
 		s = strings.ToValidUTF8(s[:capBytes], "")
diff --git a/internal/termsafe/prose_test.go b/internal/termsafe/prose_test.go
index 4934af0..49bf73f 100644
--- a/internal/termsafe/prose_test.go
+++ b/internal/termsafe/prose_test.go
@@ -34,6 +34,45 @@ func TestCleanProseNeutralisesStructure(t *testing.T) {
 	}
 }
 
+// TestCleanProseNeutralisesRawHTML proves no prose field can open raw HTML in the
+// record it lands in. In CommonMark a `<` followed by a letter, `/`, `!`, or `?`
+// begins an HTML block, and several of those block types run to the end of the
+// document — so one unclosed tag can make every later section of a durable record
+// render as inert text while a forged section above it renders normally.
+func TestCleanProseNeutralisesRawHTML(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"script-tag", "<script>alert(1)</script>", "< script>alert(1)< /script>"},
+		{"table-tag", "<table><tr><td>forged", "< table>< tr>< td>forged"},
+		{"declaration", "<!DOCTYPE html>", "< !DOCTYPE html>"},
+		{"comment-open", "text <!-- hidden", "text < !-- hidden"},
+		{"processing-instruction", "<?php echo", "< ?php echo"},
+		{"closing-tag", "</div>", "< /div>"},
+		// A masked control byte becomes '?', so a `<` before one would otherwise
+		// FORM a processing instruction after sanitisation. Neutralising after
+		// Sanitize is what closes this.
+		{"escape-forms-instruction", "<" + string(rune(0x1b)) + "php", "< ?php"},
+		// Ordinary prose keeps its angle brackets: these open nothing.
+		{"comparison-kept", "a < b and c > d", "a < b and c > d"},
+		{"arrow-kept", "x <- y", "x <- y"},
+		{"trailing-kept", "ends with <", "ends with <"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := CleanProse(c.in, 200); got != c.want {
+				t.Errorf("CleanProse(%q) = %q, want %q", c.in, got, c.want)
+			}
+			if got := CleanProseLine(c.in, 200); strings.Contains(got, "<script") ||
+				strings.Contains(got, "<table") || strings.Contains(got, "<!") || strings.Contains(got, "<?") {
+				t.Errorf("CleanProseLine(%q) = %q still opens raw HTML", c.in, got)
+			}
+		})
+	}
+}
+
 // TestCleanProseKeepsInteriorRuns proves CleanProse leaves interior whitespace
 // alone — it trims, it does not collapse. That is the difference from
 // CleanProseLine, and a caller picking the wrong one would silently reflow prose.

From bf425b7564ce7f8bf4f75295c4f1f0b366ab7825 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:49:50 +0100
Subject: [PATCH 7/8] fix: contain the ideate record write against a symlinked
 ancestor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The write guarded only the LEAF: fsutil.IsRealDir lstats the full path, so the
kernel resolves every ancestor before the check sees them, and an os.Root opened
at an already-escaped directory constrains nothing. A repository whose
`.abcd/development` is a symlink therefore wrote the verdict record outside the
tree while the CLI reported a repo-relative path.

One os.Root is now opened at the REPOSITORY root and every path this verb
touches goes through it. os.Root refuses symlink traversal at every component,
so the escape is refused where it is attempted rather than after it succeeds.

Two changes ride with it, both from the same lines:

The research directory is created when absent instead of demanded. Nothing in
abcd establishes it and no convention check requires it, so refusing failed the
first run in every repository — after the three host legs had been paid for, and
with the verdict unrecoverable when it arrived on stdin.

The record is written with an EXCLUSIVE create through the Root
(fsutil.CreateExclusiveIn, the new canonical primitive for a contained
never-replace write) rather than a check followed by an atomic replace. The
exclusive create IS the no-overwrite guarantee, in one syscall, so two concurrent
runs of one slug cannot both pass a check. The decision log's read-modify-write
now runs under the house advisory lock, so a concurrent run cannot erase the
other's pointer and strand a record nothing points at.

Reported by the security and ruthless reviews of this branch.

Assisted-by: Claude:claude-opus-5[1m]
---
 .../brief/04-surfaces/17-ideate.md            |  8 ++
 .gitignore                                    |  3 +
 internal/core/ideate/ideate.go                | 11 +++
 internal/core/ideate/record.go                | 96 ++++++++++++-------
 internal/core/ideate/record_test.go           | 66 ++++++++++++-
 internal/core/ideate/render.go                |  4 +-
 internal/fsutil/fsutil.go                     | 45 +++++++++
 7 files changed, 197 insertions(+), 36 deletions(-)

diff --git a/.abcd/development/brief/04-surfaces/17-ideate.md b/.abcd/development/brief/04-surfaces/17-ideate.md
index a035496..1544bc6 100644
--- a/.abcd/development/brief/04-surfaces/17-ideate.md
+++ b/.abcd/development/brief/04-surfaces/17-ideate.md
@@ -77,6 +77,14 @@ recordable or it is not.
 | A slug that is not lower-case kebab-case | The slug becomes a filename; the grammar is the lexical half of the write containment, `os.Root` the other |
 | A verdict record that already exists for this slug and date | Overwriting would erase a recorded reason, which is the one thing the verb exists to preserve |
 | A repository with no `.abcd/work/DECISIONS.md` | A record nothing points at is a record nobody finds — refused before anything is written |
+| A symlinked component anywhere in `.abcd/development/research/` | The write goes through one `os.Root` opened at the repository root, which refuses symlink traversal at every level, not just the leaf |
+
+The research directory itself is **created when absent**: nothing else in abcd
+establishes it and no convention check requires it, so refusing would fail the
+first run in every repository — after the three host legs have already been paid
+for, and with the verdict unrecoverable when it arrived on stdin. The exclusive
+create is the no-overwrite guarantee, and the decision log's read-modify-write
+runs under the same advisory lock the ledger allocators use.
 
 Refusals are **whole-document**, never cite-or-be-dropped. A verdict record with
 a quietly-dropped falsified claim or grill hit is worse than no record, because a
diff --git a/.gitignore b/.gitignore
index e46f63d..600712f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,6 @@ go.work.sum
 
 # capture ledger allocator lock (runtime artefact)
 .abcd/work/issues/.iss-alloc.lock
+
+# decision-log append lock (runtime artefact)
+.abcd/work/.decisions.lock
diff --git a/internal/core/ideate/ideate.go b/internal/core/ideate/ideate.go
index 0131461..441b263 100644
--- a/internal/core/ideate/ideate.go
+++ b/internal/core/ideate/ideate.go
@@ -50,6 +50,17 @@ const (
 	DecisionsRelDir = ".abcd/work/DECISIONS.md"
 )
 
+// decisionsLockRel is the advisory lock serialising the decision log's
+// read-modify-write across concurrent abcd processes in one worktree. It is a
+// runtime artefact beside the log it guards, named like capture's allocator lock
+// and gitignored on the same footing.
+const decisionsLockRel = ".abcd/work/.decisions.lock"
+
+// decisionsLockTimeout bounds the wait for that lock. A verdict record is a
+// once-per-idea act, so contention is brief when it happens at all; waiting
+// longer than this means something is wedged, and saying so beats hanging.
+const decisionsLockTimeout = 5 * time.Second
+
 const (
 	// maxClaims caps the research leg's claims table.
 	maxClaims = 200
diff --git a/internal/core/ideate/record.go b/internal/core/ideate/record.go
index ad53401..ca470f6 100644
--- a/internal/core/ideate/record.go
+++ b/internal/core/ideate/record.go
@@ -111,50 +111,78 @@ func Record(repoRoot, slug string, raw []byte, at time.Time) (Result, error) {
 	}
 	v.slug = slug
 
-	// The decision log is read BEFORE the record is written, so the commonest
-	// reason the pointer cannot land is a refusal rather than a rollback.
-	decisionsAbs := filepath.Join(repoRoot, filepath.FromSlash(DecisionsRelDir))
-	log, err := fsutil.ReadGuarded(decisionsAbs, maxDecisionsBytes)
+	// ONE os.Root at the repository root, used for every path this verb touches.
+	// It is the containment boundary: os.Root refuses symlink traversal at EVERY
+	// component, not just the leaf, so a repository whose `.abcd/development` is a
+	// symlink cannot redirect the write outside the tree. A leaf-only check would
+	// pass such a tree, because the kernel resolves the ancestors before the check
+	// ever sees them.
+	root, err := os.OpenRoot(repoRoot)
 	if err != nil {
+		return Result{}, err
+	}
+	defer root.Close()
+
+	// The decision log is read BEFORE the record is written, so the commonest
+	// reason the pointer cannot land is a refusal rather than a rollback. The
+	// through-the-Root Lstat is what refuses a symlinked ANCESTOR; ReadGuarded's
+	// O_NOFOLLOW refuses a symlinked leaf. The gap between them is the benign
+	// TOCTOU of the trusted-worktree model.
+	if _, err := root.Lstat(DecisionsRelDir); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return Result{}, &MissingDecisionsError{Path: DecisionsRelDir}
 		}
 		return Result{}, fmt.Errorf("reading %s: %w", DecisionsRelDir, err)
 	}
-
+	decisionsAbs := filepath.Join(repoRoot, filepath.FromSlash(DecisionsRelDir))
 	name := recordDate(at) + "-ideate-" + slug + ".md"
 	rel := path.Join(ResearchRelDir, name)
-	dirAbs := filepath.Join(repoRoot, filepath.FromSlash(ResearchRelDir))
-	if !fsutil.IsRealDir(dirAbs) {
-		return Result{}, fmt.Errorf("%s is not a directory in this repository", ResearchRelDir)
-	}
-
-	// Second containment layer. The slug grammar already makes name a single
-	// path element, so os.Root cannot be escaped lexically; the Root is here for
-	// the leaf lookup, where an lstat that does not follow is what distinguishes
-	// "absent" from "a symlink planted at the target".
-	root, err := os.OpenRoot(dirAbs)
-	if err != nil {
-		return Result{}, err
-	}
-	defer root.Close()
-	if _, err := root.Lstat(name); err == nil {
-		return Result{}, &ExistsError{Path: rel}
-	} else if !errors.Is(err, os.ErrNotExist) {
-		return Result{}, err
-	}
-
 	res := v.result(slug, rel)
-	if err := fsutil.WriteFileAtomic(filepath.Join(dirAbs, name), []byte(render(v, at)), 0o644); err != nil {
-		return Result{}, err
-	}
-	if err := appendPointer(decisionsAbs, log, res, at); err != nil {
-		// The record landed but its pointer did not. Roll the record back rather
-		// than leave a verdict no session will find, and say the rollback failed
-		// if it does, because that is the one case a human must fix by hand.
-		if rmErr := root.Remove(name); rmErr != nil {
-			return Result{}, fmt.Errorf("%w; THE ROLLBACK FAILED — remove %s by hand", err, rel)
+
+	// Read the log, write the record, and append the pointer under ONE exclusive
+	// lock. The decision log is a read-modify-write over a shared file, which is
+	// the house rule's case: without the lock two concurrent runs both read the
+	// same log, both append, and the second write erases the first's pointer —
+	// leaving a verdict record that nothing points at, the exact state the
+	// rollback below exists to prevent.
+	err = fsutil.WithFileLock(filepath.Join(repoRoot, filepath.FromSlash(decisionsLockRel)), decisionsLockTimeout, func() error {
+		log, err := fsutil.ReadGuarded(decisionsAbs, maxDecisionsBytes)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				return &MissingDecisionsError{Path: DecisionsRelDir}
+			}
+			return fmt.Errorf("reading %s: %w", DecisionsRelDir, err)
+		}
+		// The research directory is CREATED when absent rather than demanded.
+		// Nothing in abcd establishes it and no convention check requires it, so
+		// refusing here would fail the first run in any repository — after the three
+		// host legs have already been paid for, and with the verdict unrecoverable
+		// when it arrived on stdin. Through the Root, a symlinked component still
+		// refuses.
+		if err := root.MkdirAll(ResearchRelDir, 0o755); err != nil {
+			return fmt.Errorf("preparing %s: %w", ResearchRelDir, err)
 		}
+		// The EXCLUSIVE create is the no-overwrite guarantee, and it is one syscall
+		// rather than a check followed by a write, so it holds even against a writer
+		// that is not taking this lock.
+		if err := fsutil.CreateExclusiveIn(root, rel, []byte(render(v, at)), 0o644); err != nil {
+			if errors.Is(err, os.ErrExist) {
+				return &ExistsError{Path: rel}
+			}
+			return err
+		}
+		if err := appendPointer(decisionsAbs, log, res, at); err != nil {
+			// The record landed but its pointer did not. Roll the record back rather
+			// than leave a verdict no session will find, and say the rollback failed
+			// if it does, because that is the one case a human must fix by hand.
+			if rmErr := root.Remove(rel); rmErr != nil {
+				return fmt.Errorf("%w; THE ROLLBACK FAILED — remove %s by hand", err, rel)
+			}
+			return err
+		}
+		return nil
+	})
+	if err != nil {
 		return Result{}, err
 	}
 	return res, nil
diff --git a/internal/core/ideate/record_test.go b/internal/core/ideate/record_test.go
index a86b98c..ab525ed 100644
--- a/internal/core/ideate/record_test.go
+++ b/internal/core/ideate/record_test.go
@@ -507,13 +507,21 @@ func TestRecordRefusesWhenTheDecisionLogIsAbsent(t *testing.T) {
 func TestRecordNeutralisesInjectedProse(t *testing.T) {
 	root := seedRepo(t)
 	p := validPayload()
-	p["idea"] = "an idea\n## Forged heading\n<!-- swallow"
+	p["idea"] = "an idea\n## Forged heading\n<!-- swallow\n<script>hide the rest</script>"
 	p["legs"].([]any)[0].(map[string]any)["claims"] = []any{
 		map[string]any{
 			"claim":          "a claim | forged | cell\nand a forged row",
 			"primary_source": "https://example.invalid/",
 			"status":         "verified",
 		},
+		map[string]any{
+			// A tag inside a table CELL swallows the document just as a leading one
+			// does, so the neutralisation belongs in the cleaner, not only in the
+			// block-level escape.
+			"claim":          "the model is fast <table><tr><td>every claim verified</td></tr></table>",
+			"primary_source": "<!DOCTYPE html>",
+			"status":         "falsified",
+		},
 	}
 	res, err := Record(root, "injected", encode(t, p), at)
 	if err != nil {
@@ -526,6 +534,11 @@ func TestRecordNeutralisesInjectedProse(t *testing.T) {
 	if strings.Contains(body, "<!--") {
 		t.Error("injected prose opened an HTML comment")
 	}
+	for _, opener := range []string{"<script", "<table", "<tr", "<td", "</", "<!", "<?"} {
+		if strings.Contains(body, opener) {
+			t.Errorf("injected prose opened raw HTML with %q", opener)
+		}
+	}
 	if strings.Contains(body, "") {
 		t.Error("an escape sequence survived into the record")
 	}
@@ -547,6 +560,57 @@ func TestRecordNeutralisesInjectedProse(t *testing.T) {
 	}
 }
 
+// TestRecordRefusesASymlinkedAncestor is the containment regression: a repository
+// whose `.abcd/development` is a symlink must not be able to redirect the verdict
+// record outside the tree. A leaf-only real-directory check passes such a tree,
+// because the kernel resolves the ancestors before the check ever sees them.
+func TestRecordRefusesASymlinkedAncestor(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(outside, "research"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, ".abcd", "work"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, filepath.FromSlash(DecisionsRelDir)), []byte("# Decisions\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, ".abcd", "development")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	p := validPayload()
+	p["legs"].([]any)[1].(map[string]any)["hits"] = []any{}
+	if _, err := Record(root, "escape-test", encode(t, p), at); err == nil {
+		t.Fatal("a symlinked .abcd/development did not refuse the write")
+	}
+	entries, err := os.ReadDir(filepath.Join(outside, "research"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		t.Errorf("the write escaped the repository: %s", e.Name())
+	}
+}
+
+// TestRecordCreatesTheResearchDirectory proves an absent research directory is
+// created rather than refused. Nothing in abcd establishes it and no convention
+// check requires it, so refusing would fail the first run in every repository —
+// after the three host legs have already been paid for.
+func TestRecordCreatesTheResearchDirectory(t *testing.T) {
+	root := seedRepo(t)
+	if err := os.RemoveAll(filepath.Join(root, filepath.FromSlash(ResearchRelDir))); err != nil {
+		t.Fatal(err)
+	}
+	res, err := Record(root, "first-run", encode(t, validPayload()), at)
+	if err != nil {
+		t.Fatalf("an absent research directory was refused: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(root, filepath.FromSlash(res.Path))); err != nil {
+		t.Errorf("the record is not on disk: %v", err)
+	}
+}
+
 // assertNothingWritten proves a refusal left the research directory empty — every
 // refusal path must return before the write.
 func assertNothingWritten(t *testing.T, root string) {
diff --git a/internal/core/ideate/render.go b/internal/core/ideate/render.go
index 24c4163..852e722 100644
--- a/internal/core/ideate/render.go
+++ b/internal/core/ideate/render.go
@@ -103,8 +103,10 @@ func renderRejected(b *strings.Builder, v verdictDoc) {
 		b.WriteString("session knows nothing was weighed and discarded here.\n\n")
 		return
 	}
+	// A list item is not a table cell: escaping its pipes would print a visible
+	// backslash for no gain, since nothing here can start a table.
 	for _, r := range v.rejected {
-		fmt.Fprintf(b, "- **%s** — %s\n", cell(r.Alternative), r.WhyRejected)
+		fmt.Fprintf(b, "- **%s** — %s\n", r.Alternative, r.WhyRejected)
 	}
 	b.WriteString("\n")
 }
diff --git a/internal/fsutil/fsutil.go b/internal/fsutil/fsutil.go
index 396760b..823c025 100644
--- a/internal/fsutil/fsutil.go
+++ b/internal/fsutil/fsutil.go
@@ -145,7 +145,52 @@ func syncParent(dir string) {
 // IsRealDir reports whether path is a directory and NOT a symlink. It lstats
 // (never following) so a symlink pointing at a directory reads as false — the
 // owned-directory guard the store re-runs on every mutating call.
+//
+// It checks the LEAF only: every ancestor component is resolved by the kernel,
+// so a symlinked parent passes. Where a write must be contained against a
+// symlinked ancestor too, route it through CreateExclusiveIn under an os.Root
+// opened at the trust boundary, which refuses symlink traversal at every level.
 func IsRealDir(path string) bool {
 	fi, err := os.Lstat(path)
 	return err == nil && fi.IsDir() && fi.Mode()&os.ModeSymlink == 0
 }
+
+// CreateExclusiveIn writes data to rel INSIDE root, failing if rel already
+// exists. It is the canonical primitive for a durable write that must (a) stay
+// contained under a directory even against a symlinked ancestor, and (b) never
+// replace an existing file.
+//
+// It is deliberately not WriteFileAtomic. That primitive's contract is atomic
+// REPLACEMENT — a temp file renamed over the target — which is the right shape
+// when a file is rewritten in place, and the wrong one here: the rename would
+// happily clobber, and the containment would depend on the caller having resolved
+// the directory safely rather than on the Root. Here the exclusive create IS both
+// guarantees at once. There is no partial-overwrite hazard to protect against,
+// because the file cannot already exist; a crash mid-write leaves a short file,
+// which the caller's own no-overwrite refusal surfaces on the next run rather than
+// silently completing.
+//
+// rel is slash-separated and relative to root. os.ErrExist is returned unwrapped
+// enough for errors.Is, so a caller can map it to its own typed refusal. A write
+// that fails after the create removes the partial file.
+func CreateExclusiveIn(root *os.Root, rel string, data []byte, perm os.FileMode) error {
+	f, err := root.OpenFile(rel, os.O_CREATE|os.O_EXCL|os.O_WRONLY, perm)
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		_ = root.Remove(rel)
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		_ = root.Remove(rel)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		_ = root.Remove(rel)
+		return err
+	}
+	return nil
+}

From 0d761ac3629279d03d1124db61382e49fe9072e5 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 28 Jul 2026 02:03:08 +0100
Subject: [PATCH 8/8] fix: untrusted prose cannot shift a table column or erase
 the idea
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two more ways the verdict record's own structure was reachable from prose.

cell() escaped the pipe but not the backslash. GFM reads `\|` inside a cell as an
escaped delimiter, so a claim containing `\|` became `\\|` — an escaped backslash
followed by a LIVE delimiter. That splits the row and pushes the core-owned
Finding column off the end, where GFM silently drops it, so the record displays
whatever word the prose put in third position instead of the status the payload
declared: a falsified claim rendering as verified. One replacer now escapes both
in a single pass.

blockText() did not escape a leading `[`. A paragraph shaped like a link
reference definition is CONSUMED by CommonMark and renders as nothing, so an idea
in that shape erased the record's own subject while the verdict and the three legs
still read normally.

Both are pinned by regression tests that fail against the previous commit, the
table one parsing the rendered row the way GFM does rather than counting pipes —
counting cannot see this class at all.

Three review nits ride along: CreateExclusiveIn fsyncs the parent so the record's
NAME is as durable as its content (otherwise a crash could leave the decision-log
pointer with no directory entry — a pointer to nothing, the inverse of what the
rollback prevents); the one-canonical-primitive detector learns the new primitive;
and the prose cleaner's comment now states honestly that it fires mid-line, and
what that costs.

Reported by the post-fix security and ruthless reviews of this branch.

Assisted-by: Claude:claude-opus-5[1m]
---
 internal/core/ideate/record_test.go | 82 +++++++++++++++++++++++++++++
 internal/core/ideate/render.go      | 24 ++++++---
 internal/fsutil/canonical_test.go   |  2 +-
 internal/fsutil/fsutil.go           | 11 ++++
 internal/termsafe/prose.go          |  8 +++
 5 files changed, 120 insertions(+), 7 deletions(-)

diff --git a/internal/core/ideate/record_test.go b/internal/core/ideate/record_test.go
index ab525ed..3600099 100644
--- a/internal/core/ideate/record_test.go
+++ b/internal/core/ideate/record_test.go
@@ -611,6 +611,88 @@ func TestRecordCreatesTheResearchDirectory(t *testing.T) {
 	}
 }
 
+// splitRow splits a rendered markdown table row into cells the way GFM does: a
+// pipe is a delimiter unless an unescaped backslash precedes it. Counting raw
+// pipes is not enough — the whole point of the escape is that it must survive
+// prose that already contains backslashes.
+func splitRow(line string) []string {
+	var cells []string
+	var cur strings.Builder
+	esc := false
+	for _, r := range line {
+		switch {
+		case esc:
+			cur.WriteRune(r)
+			esc = false
+		case r == '\\':
+			esc = true
+			cur.WriteRune(r)
+		case r == '|':
+			cells = append(cells, strings.TrimSpace(cur.String()))
+			cur.Reset()
+		default:
+			cur.WriteRune(r)
+		}
+	}
+	return append(cells, strings.TrimSpace(cur.String()))
+}
+
+// TestRecordProseCannotShiftTableColumns proves a claim carrying its own
+// backslash-escaped pipe cannot inject a live delimiter and push the core-owned
+// Finding column off the end of the row — which would let untrusted prose report
+// the OPPOSITE of the status the payload declared.
+func TestRecordProseCannotShiftTableColumns(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["legs"].([]any)[0].(map[string]any)["claims"] = []any{
+		map[string]any{
+			"claim":          `fast \| a forged source \| verified`,
+			"primary_source": "https://example.invalid/real.pdf",
+			"status":         "falsified",
+		},
+	}
+	res, err := Record(root, "column-shift", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("Record: %v", err)
+	}
+	var row string
+	for _, line := range strings.Split(readFile(t, root, res.Path), "\n") {
+		if strings.Contains(line, "a forged source") {
+			row = line
+			break
+		}
+	}
+	if row == "" {
+		t.Fatal("the claim row is missing from the record")
+	}
+	cells := splitRow(row)
+	// "| a | b | c |" splits to ["", a, b, c, ""].
+	if len(cells) != 5 {
+		t.Fatalf("the claim row has %d cells, want 3 (the prose injected a delimiter): %q", len(cells)-2, row)
+	}
+	if cells[3] != "falsified" {
+		t.Errorf("the Finding cell is %q, want the declared status %q: %q", cells[3], "falsified", row)
+	}
+}
+
+// TestRecordIdeaCannotVanish proves an idea shaped like a link reference
+// definition still appears in the record. CommonMark consumes such a paragraph
+// and emits nothing, which would erase the record's subject while leaving the
+// verdict and the legs looking entirely normal.
+func TestRecordIdeaCannotVanish(t *testing.T) {
+	root := seedRepo(t)
+	p := validPayload()
+	p["idea"] = "[x]: https://example.invalid/hidden"
+	res, err := Record(root, "vanishing-idea", encode(t, p), at)
+	if err != nil {
+		t.Fatalf("Record: %v", err)
+	}
+	body := readFile(t, root, res.Path)
+	if !strings.Contains(body, `\[x]: https://example.invalid/hidden`) {
+		t.Errorf("the idea is not escaped against a link reference definition:\n%s", body)
+	}
+}
+
 // assertNothingWritten proves a refusal left the research directory empty — every
 // refusal path must return before the write.
 func assertNothingWritten(t *testing.T, root string) {
diff --git a/internal/core/ideate/render.go b/internal/core/ideate/render.go
index 852e722..bd7d939 100644
--- a/internal/core/ideate/render.go
+++ b/internal/core/ideate/render.go
@@ -131,11 +131,19 @@ func renderOutcome(b *strings.Builder, v verdictDoc) {
 	}
 }
 
-// cell escapes a value for a markdown table cell. Every field reaching here is
-// already line-cleaned, so the pipe is the only remaining character that could
-// change the document's structure — and an unescaped one would silently split a
-// claim into two columns and shift every later cell.
-func cell(s string) string { return strings.ReplaceAll(s, "|", `\|`) }
+// cell escapes a value for a markdown table cell.
+//
+// The BACKSLASH is escaped alongside the pipe, and it is not optional. GFM reads
+// `\|` inside a cell as an escaped delimiter, so escaping the pipe alone turns a
+// prose `\|` into `\\|` — an escaped backslash followed by a LIVE delimiter. That
+// splits the claim into extra columns and pushes the core-owned Finding column off
+// the end of the row, where GFM silently drops it: the record would then show
+// whatever word the prose put in the third position instead of the status the
+// payload declared. One replacer does both in a single pass, so the pipe's own
+// escape can never be re-escaped.
+var cellEscaper = strings.NewReplacer(`\`, `\\`, "|", `\|`)
+
+func cell(s string) string { return cellEscaper.Replace(s) }
 
 // blockText escapes a value that starts a line of its own. Every other untrusted
 // field in this document sits behind a fixed prefix ("| ", "- ", "**"), so its
@@ -147,7 +155,11 @@ func blockText(s string) string {
 		return s
 	}
 	switch s[0] {
-	case '#', '-', '*', '+', '>', '|', '`', '~', '=', '_':
+	// '[' is here for a subtler reason than the rest: a paragraph shaped like a
+	// link reference definition (`[x]: https://…`) is CONSUMED by CommonMark and
+	// renders as nothing at all — so an idea in that shape would erase the record's
+	// own subject while the verdict and the three legs still read normally.
+	case '#', '-', '*', '+', '>', '|', '`', '~', '=', '_', '[':
 		return `\` + s
 	}
 	// An ordered-list opener ("1. ", "12) ") is the one multi-character marker.
diff --git a/internal/fsutil/canonical_test.go b/internal/fsutil/canonical_test.go
index c6d001f..d7d2567 100644
--- a/internal/fsutil/canonical_test.go
+++ b/internal/fsutil/canonical_test.go
@@ -12,7 +12,7 @@ import (
 // real-dir primitive — the exact names iss-32 consolidates. The canonical home
 // is internal/fsutil (exported WriteFileAtomic / IsRealDir); any lowercase
 // redefinition elsewhere is a divergent copy.
-var nonCanonicalPrimitiveRe = regexp.MustCompile(`func\s+(writeFileAtomic|durableWrite|isRealDir)\b`)
+var nonCanonicalPrimitiveRe = regexp.MustCompile(`func\s+(writeFileAtomic|durableWrite|isRealDir|createExclusiveIn)\b`)
 
 // TestNoNonCanonicalAtomicWritePrimitives is the one-canonical-primitive
 // detector: no package under internal/ (other than fsutil) may declare its own
diff --git a/internal/fsutil/fsutil.go b/internal/fsutil/fsutil.go
index 823c025..d6be35d 100644
--- a/internal/fsutil/fsutil.go
+++ b/internal/fsutil/fsutil.go
@@ -14,6 +14,7 @@ import (
 	"errors"
 	"io"
 	"os"
+	"path"
 	"path/filepath"
 	"syscall"
 )
@@ -192,5 +193,15 @@ func CreateExclusiveIn(root *os.Root, rel string, data []byte, perm os.FileMode)
 		_ = root.Remove(rel)
 		return err
 	}
+	// Fsync the PARENT too, for the same reason WriteFileAtomic does: syncing the
+	// file makes its CONTENT durable, not its NAME. A caller that writes this file
+	// and then durably records a pointer to it would otherwise survive a crash
+	// holding the pointer and no directory entry — a pointer to nothing, which is
+	// the exact state such a caller's rollback exists to prevent. Best-effort:
+	// some filesystems refuse a directory fsync.
+	if d, err := root.Open(path.Dir(rel)); err == nil {
+		_ = d.Sync()
+		_ = d.Close()
+	}
 	return nil
 }
diff --git a/internal/termsafe/prose.go b/internal/termsafe/prose.go
index 7c604a0..4d324d1 100644
--- a/internal/termsafe/prose.go
+++ b/internal/termsafe/prose.go
@@ -22,6 +22,14 @@ package termsafe
 // normally. An artefact whose whole value is that a later session trusts it must
 // not be able to hide its own evidence.
 //
+// The rule fires ANYWHERE in the string, not only at a line start, and that is
+// deliberate rather than an over-reach: the same swallow was demonstrated from
+// INSIDE a markdown table cell, where the opener is mid-line, and the cleaner
+// cannot know what surrounds the field it is handed. The cost is a fidelity
+// regression on legitimate angle-bracket prose — a changelog line's
+// `<repo>` placeholder reads `< repo>` — which is accepted: a slightly uglier
+// placeholder is cheaper than a record that can conceal its own contents.
+//
 // Two forms exist because two callers legitimately want different whitespace
 // handling, and the difference is visible in the record: CleanProse trims,
 // CleanProseLine collapses every run to one space. A field landing in a