diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 672fc83..324b9c0 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -4,14 +4,14 @@
   "owner": { "name": "Ljferrer", "url": "https://github.com/Ljferrer" },
   "metadata": {
     "description": "WAR — Work·Audit·Refine: Claude-native multi-agent execution of a multi-phase implementation plan.",
-    "version": "0.14.64"
+    "version": "0.14.65"
   },
   "plugins": [
     {
       "name": "work-audit-refine",
       "source": "./",
       "description": "Execute a multi-phase implementation plan with fresh worker agents, independent read-only auditors, and a serial refine/merge queue — phase by phase, gated by you, opening one PR at the end.",
-      "version": "0.14.64",
+      "version": "0.14.65",
       "author": { "name": "Ljferrer" },
       "keywords": ["agent-teams","workflows","orchestration","code-review","merge-queue","multi-agent","gastown"],
       "category": "workflow"
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 0989c33..d36f62e 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "work-audit-refine",
   "description": "WAR — Work·Audit·Refine. A Claude-native Agent-Teams + Workflows orchestration skill that executes a detailed multi-phase implementation plan: it breaks phases into GitHub issues, then per phase spins up fresh worker agents in isolated worktrees, independent read-only auditors (severity-gated, unanimous), and a serial refine/merge queue, landing each phase on a working branch and opening one PR to the landing branch at the end.",
-  "version": "0.14.64",
+  "version": "0.14.65",
   "author": { "name": "Ljferrer", "url": "https://github.com/Ljferrer" },
   "license": "MIT",
   "homepage": "https://github.com/Ljferrer/WorkAuditRefine",
diff --git a/README.md b/README.md
index e7427f3..c392a45 100644
--- a/README.md
+++ b/README.md
@@ -329,7 +329,7 @@ A version bump **must** update all four version slots across three files togethe
 
 ## Status
 
-**0.14.64** — Four changes to the per-phase Workflow engine's dispatch surfaces: stage-time args embedding, completed submodule floor/note coverage, the two routing corrections that coverage makes reachable, and a drift guard for a header comment that was about to rot. **(1) `stage-workflow.mjs --args <file>` embeds over-size phase args (#1134).** At real campaign size the assembled phase args cannot ride the Workflow tool call inline — the measured class is ~104.5 KB (`args.memory` blocks + verbatim plan slices + the Commander's Intent), and phase 1 of the measuring campaign shipped an operator-approved hand edit of the staged copy. That is now mechanized. `--args` takes its value as a **separate following token**, reads the file, JSON-parses it, and requires a non-null, non-array object — the ADR 0034 predicate mirrored from the template's own entry guard — **before any write**; it then performs an **optional third** exactly-once substitution, rewriting the template's object-arm args fallback tail (a new exported `ARGS_FALLBACK_ANCHOR`, imported by the anchor-guard test, never a second hardcoded copy) so the staged copy falls back to a prelude carrying the validated payload. The embedding is strictly the **absent-args fallback**: dispatched args, when passed, **always win**, so an `--args`-staged script is dispatched with **no** Workflow `args` at all — a dispatched `{}` is truthy and would beat the embedded fallback. The prelude is inserted **immediately after** the `export const meta = { … }` statement, never prepended: the Workflow tool refuses any script whose first *statement* is not `export const meta`, dying `Invalid workflow script` before a single agent is dispatched (reproduced live 2026-07-27 — a leading *comment* is fine, a leading `const` is not), and a test pins the position rather than mere presence, since a "prelude is present" check would have passed the broken prepend. Injection is step (3) by construction — the payload goes in **after** every exactly-once count has run, so an args payload that string-quotes any anchor's bytes cannot fork the stage. **Without the flag neither the fallback rewrite nor the prelude injection runs and the staged output is byte-identical to a stage predating it** — the existing restore-roundtrip tests, which whole-file byte-compare via reverse substitution, pass unmodified. Validation is fail-loud and pre-write: malformed JSON, each non-object parse (array, scalar, `null`), an unreadable file, `--args` missing its value token, and a duplicate `--args` each exit non-zero with a named `stage-workflow:`-prefixed stderr error and write no staged file; `--args --force` consumes `--force` as the filename **verbatim** and dies at the named read error (the peel runs before the `--force` filter and the positional split, and that ordering is pinned by tests, never incidental). The **attached** `--args=<file>` form is refused with the usage error, and that guard is load-bearing rather than decorative: without it the token is not a flag to this parser at all — it survives the `--force` filter and binds to the 5th positional `campaignOrdinal`, staging an args-**less** script at exit 0, which is precisely the incident this change exists to close. Write-if-absent is unchanged — an existing staged file is still reused byte-untouched at exit 0, with one added stderr warning that `--args` was ignored, and re-embedding **changed** args is a deliberate `--force` restage. This also closes the `resumeFromRunId` hazard: an `--args`-staged script needs **no** re-passed args on resume, because write-if-absent guarantees the same embedded bytes, where an args-less resume previously died at entry validation despite a healthy journal. **Two residuals are explicit:** a script staged **without** `--args` keeps today's behavior (its args-less resume still dies at entry, the fallback existing only when `--args` staged it), and no new resume path is sanctioned — `resumeFromRunId` stays `held:phase-incomplete`-only. `skills/war/SKILL.md`'s staging paragraph documents the whole flow — when to write the args JSON as a sibling of the staged script, the dispatch-with-no-args caveat, precedence, resume, the campaign-phases-default-to-`--args` decision rule, and the stage-failure runbook line (an exactly-once failure names the offending anchor label; `--force` cannot help) — while ADR 0037 decision 2 gains a dated **append-only** amendment and `CONTEXT.md`'s staged-phase-script entry is edited in place, each naming the optional third substitution; block-scoped assertions in `skill-doc-contracts.test.mjs` gate both, per medium. **(2) The submodule floor and note are complete across three dispatch families (#1114, landed as #1160).** Three sibling gaps left open when `2026-07-24-recovery-re-merge-dispatch-coherence` closed the MERGE-side retries are now closed, each converging the dispatched surface on what `agents/war-refiner.md` already declares ("always"). Both **re-land** prompts (`land:phase-<id>:environment-proceed` and `:baseline-proceed`) omitted `submodLandNote`, so a submodule phase whose first land gate-failed recoverable was re-dispatched land-blind; both now carry it. The **polish merge** (`merge:p<id>-polish`) named no submodule floor at all — it now carries the invocation **bare**, a coherence sweep never being a declared gitlink bump, and its skip sentence now says explicitly that the two skipped floors are skipped *because they are task-field-gated* while the submodule floor is unconditional and still runs. The **floor-retry re-merge** (`merge:<taskId>:floor-retry:r<n>`) omitted the invocation its own adjacent comments already claimed it carried; it now carries it with the gitlink-bump `--declared` conditional shape. Every gain is a prose append reusing in-scope constants, and `submodLandNote`/`submodMergeNote` remain `''` off the submodule path — so no non-submodule phase gains a submodule NOTE; the two floor invocations are unconditional by design and do add one line to the polish and floor-retry prompts on every phase — every existing non-submodule prompt *test* passes unmodified. **(3) Two operator-visible routing corrections, both reusing existing enum members.** A floor-retry re-merge returning `submodule-blocked` now **HARD-holds the phase** through an explicit arm (`reason: 'escalate'`); it previously fell to the generic `reason: floorMr.status` fallback, and because `submodule-blocked` is not a `HARD_ESCALATION_REASONS` member that routed **soft** — the phase landed minus the task, silently. A re-land returning `submodule-pr` — newly reachable now that both re-land prompts carry the land note — now yields `landDecision: 'held:submodule-pr'` with `pr_number`/`pr_remote` on the escalated entry; it previously fell to the `held:land-failed` else, mislabelling the hold **and** losing the PR ref the Lead's `gh`-resume reads. Both arms reuse members that already exist: `land-decision.mjs` is **byte-untouched**, no `MERGE_RESULT` status was added, no `HARD_ESCALATION_REASONS`/`KNOWN_LAND_DECISIONS` member changed, and no floor script was edited (ADR 0005). The fail-open **polish** routing is deliberately left alone — a polish merge returning `submodule-blocked` still routes the existing DISCARD arm, demoting the queue to follow-up and landing the pre-polish tip. **(4) `classificationClause`'s consumer-site list is arbitered, not narrated (#1151).** Its header comment enumerated the mirror sites in prose — the exact shape that rotted for `gateCaptureClause` (#1034) — so it is repaired while still accurate and its site list delegated to a new drift guard in `workflow-template.test.mjs`, a sibling of `captureUses`, which counts the helper's call-paren occurrences in the template, asserts exactly **3**, and names the three sites in its failure message. The anchor is the bare call-paren, deliberately wider than a first-argument pin: a 4th site passing any other base variable still trips it, a line-wrapped argument list still matches, and the definition itself cannot match, having ` = (` between the name and the paren. The rewritten comment names that guard as the arbiter and stays count-free — writing the call-paren byte-run into it would red the guard itself. **No `agents/*.md` or `hooks/` edit rides this release:** the standing refiner card already stated the target behavior, so the dispatched surfaces converged on it rather than the reverse.
+**0.14.65** — Three correctness fixes to the shared memory CLI (`skills/_shared/war-memory.mjs`), each bound at its own verb's boundary, plus the doc and lesson cascade they force. **(1) `query`'s `--top-k` and `--budget` refuse a bad value instead of silently binding a degraded one (#1145).** Both flags now carry the three-way argv-boundary resolution #1059 ratified for `tighten-plan`'s `--target`: flag absent ⇒ the default (the flagless path stays byte-identical), a positive finite string binds, anything else exits **1** with stderr naming the flag and the token it received. The pre-fix read was a truthy ternary — `argv['top-k'] ? Number(argv['top-k']) : DEFAULT_TOP_K` — so every bad **space-separated** value still bound *something*: a **bare** flag became `1` via `Number(true)`, quietly cutting a seat's prefetch to a single lesson; a non-numeric or zero `--top-k` emptied the block outright through `selectForBudget`'s `records.slice(0, topK)`; and a non-numeric `--budget` left it **uncapped**, because `bytes + size > budget` is never true against `NaN`, so the break never fires. The guards sit **above** the `walkCorpus` call, so a refused invocation writes nothing at all — no query-log line, no stdout block. No integer check: `--top-k 3.5` still binds and `slice` truncates it, mirroring `--target`'s predicate exactly (D3). **The `=`-attached form is a named, still-silent, deliberately frozen residual (D10)** — `parseArgv` is untouched, so `--top-k=abc` is keyed whole as `{'top-k=abc': true}`, `argv['top-k']` stays `undefined`, the guard never sees it, and the query runs on defaults. Three comment-coupled sites — `--target`, `--top-k`, `--budget` — and deliberately no shared helper. **(2) The redaction-lint walk is recursive (#1135) — the one change here that can turn a previously green tree red on upgrade.** `lint <dir>` now enumerates with `fs.readdirSync(dir, { recursive: true })`, so `.md` files in subdirectories — the committed `archive/` subtree above all — are linted like any other. A learnings tree whose top level is clean but which holds a redaction violation under `archive/` exited **0** before this release and exits **1** now, naming the file and the pattern, with the reported hit path carrying its subdirectory prefix: a real new failure for anyone whose archive had never been walked, and the remedy is to redact the named file, not to pin the old walk. Because every surface shares the one invocation, CI (`.github/workflows/memory-audit.yml`) and the gate wrapper (`skills/_shared/war-memory-lint.test.sh`) inherit the recursion with **zero edits** and stay byte-unchanged. The `catch { continue }` fail-open on an unreadable entry is preserved. **(3) `archive`'s concept-hub WARN counts slug-deduped citers (#1154).** The advisory WARN that fires when a hub with ≥ 2 hot inbound citers is about to lose its index row previously counted *records*, so a slug hot in **both** memory roots counted twice — the same lesson read as a hub at the `archive` verb while the `inbound` verb and `tightenPlan`'s cross-root Floor 2, both already slug-deduped, read it as one citer. `new Set(hotInbound.map((r) => r.slug)).size` now drives the ≥ 2 predicate **and** the printed number, so a cross-root twin alone no longer warns, and a twin plus one distinct citer prints **2**, not 3. The count noun reads **`inbound citers`**: the deduped number counts slugs, so naming it after records would be false. Still advisory, still non-blocking, still exit 0. **The cascade rides with the fixes rather than trailing them.** ADR 0028 quotes the WARN verbatim in its decision list, so it gains a dated **append-only** amendment recording the deduped counting and the new noun, while the original quote stands as the historical record — superseded, never rewritten. `/lessons-learned`'s Phase-3 hub-check thresholds and one doc-contract comment drop the record-flavored noun they had inherited: they document `war-memory inbound`, which was already slug-deduped, so a cross-root twin was being described as two of something when the tool counts it as one citer and no hub at all. And the two committed lessons behind this work are trued up — the archived `tighten --target` lesson replaces a paraphrased failure mode with the measured fuse mechanism (zsh does not word-split the unquoted `${TIGHTEN_TARGET:+…}` expansion, so the replacement arrives as one fused argv word, `--target 2000`, which `parseArgv` keys as `{"target 2000": true}` while `argv.target` itself stays `undefined` — the same silent outcome as never setting the variable, reached by a different route), and the `cmdQuery` truthy-ternary lesson carries a `RESOLVED` stamp citing this fix and the regressions that pin it.
 
 ## License
 
diff --git a/docs/adr/0028-memory-store-integrity-tool-enforced.md b/docs/adr/0028-memory-store-integrity-tool-enforced.md
index cb327d9..1cbb3b9 100644
--- a/docs/adr/0028-memory-store-integrity-tool-enforced.md
+++ b/docs/adr/0028-memory-store-integrity-tool-enforced.md
@@ -91,6 +91,18 @@ judgment — which hub to keep, which lesson to compress — stays human.** Conc
   reach — the sweep greps the current tree; the drift-guard/`/lessons-learned` posture is the standing
   backstop.
 
+## Amendments
+
+- **2026-07-27 — the hub WARN counts slug-deduped `inbound citers`.** Decision item 2 above quotes the
+  WARN as first shipped: an undeduped record count with the noun `inbound refs`. A slug hot in *both*
+  roots is two records but one citer, so that count read `2` where the `inbound` verb (and `tightenPlan`'s
+  cross-root Floor 2) read `1`. As of
+  [`docs/plans/2026-07-26-war-memory-cli-correctness.md`](../plans/2026-07-26-war-memory-cli-correctness.md)
+  Task 1.1 (#1154), `cmdArchive` counts `new Set(hotInbound.map((r) => r.slug)).size` for both the ≥2
+  predicate and the printed number, and the noun reads **`inbound citers`** — the deduped count counts
+  slugs, so the old noun would be false. Advisory, non-blocking, exit 0: unchanged. The quote in item 2
+  stands as the historical record (superseded, never rewritten).
+
 ## References
 
 - Design spec:
diff --git a/docs/learnings/archive/tighten-target-flag-has-three-independent-silent-degradation-paths.md b/docs/learnings/archive/tighten-target-flag-has-three-independent-silent-degradation-paths.md
index 66eacb9..58810de 100644
--- a/docs/learnings/archive/tighten-target-flag-has-three-independent-silent-degradation-paths.md
+++ b/docs/learnings/archive/tighten-target-flag-has-three-independent-silent-degradation-paths.md
@@ -64,8 +64,10 @@ none of which raise a diagnostic:
 3. **Shell-dialect word-splitting**, at the doc layer: `skills/lessons-learned/SKILL.md`'s step-1
    fence threads the flag as `${TIGHTEN_TARGET:+--target "$TIGHTEN_TARGET"}` inside a ` ```bash `
    block. Bash splits the `:+` replacement text into two argv words as expected; **zsh does not**
-   (no `SH_WORD_SPLIT` by default), so under zsh the same line collapses to one argv token and the
-   flag is dropped entirely — same silent outcome as never setting `$TIGHTEN_TARGET`.
+   — lacking `SH_WORD_SPLIT` by default, it does not word-split the unquoted expansion, so the
+   whole replacement fuses into one argv word (`--target 2000` arrives as a single token), which
+   `parseArgv` keys as `{"target 2000": true}`; `argv.target` itself stays `undefined` — same
+   silent outcome as never setting `$TIGHTEN_TARGET`.
 
 **Why this matters:** all three degrade toward one of two silent states (default 17,000 B advisory,
 or the "verdict always warn" pre-select) with zero diagnostic — an operator who typos `--target`
@@ -126,12 +128,12 @@ Method explicitly froze as a shared blast-radius fence — not reopened by this
 it at `cmdTightenPlan`'s own boundary (e.g. also refuse when any argv key starts with `target=`),
 never by widening `parseArgv`.
 
-**Not yet extended to siblings:** `cmdQuery`'s `--top-k`/`--budget` resolve via the identical
-pre-fix truthy-ternary shape (`argv['top-k'] ? Number(...) : DEFAULT_TOP_K`, same for `budget`) at
-`skills/_shared/war-memory.mjs` lines 703-704 — this task's Method deliberately bound the fix to
-`cmdTightenPlan`'s boundary only ("bind each fix at its own boundary, never a shared one") and did
-not extend it to `cmdQuery`. See [[cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape]]
-for the standalone gotcha and its failure-direction difference (NaN `--top-k` empties the seat
-prefetch instead of over-selecting).
+**Extended to siblings (war-memory-cli-correctness/1.1, #1145):** `cmdQuery`'s `--top-k`/`--budget`
+now carry the same three-way `typeof`-gated resolution described above for `--target` — a shape
+copy at `cmdQuery`'s own boundary, not a shared helper (`parseArgv` stays frozen). See
+[[cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape]] for the RESOLVED
+sibling gotcha and the failure-direction difference that made it worth its own lesson (a bare
+`--top-k` had silently selected ONE lesson and a NaN/zero/negative value emptied the seat
+prefetch, unlike `--target`'s over-select failure mode).
 
 > archived 2026-07-27: resolved — moved to archive
diff --git a/docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md b/docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md
index 53b9040..f50552c 100644
--- a/docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md
+++ b/docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md
@@ -1,6 +1,6 @@
 ---
 name: cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape
-description: "cmdQuery's --top-k/--budget resolve via argv['top-k'] ? Number(...) : DEFAULT — the exact truthy-ternary silent-degradation shape #1059 closed for tighten-plan's --target, left open here on purpose (fix bound to cmdTightenPlan's boundary only); a bare/NaN --top-k silently empties the seat memory-prefetch block instead of over-selecting"
+description: "RESOLVED (war-memory-cli-correctness/1.1, #1145): cmdQuery's --top-k/--budget now carry the same three-way typeof-gated resolution #1059 ratified for tighten-plan's --target, closing the truthy-ternary shape (argv['top-k'] ? Number(...) : DEFAULT) this lesson flagged as deliberately left open; a bare --top-k no longer silently selects one lesson and a NaN/zero/negative value no longer empties the seat memory-prefetch block — both refuse loud instead"
 metadata: 
   node_type: memory
   type: project
@@ -69,3 +69,24 @@ three-way `typeof argv[x] === 'string'` resolution (undefined → default; strin
 
 Related: [[tighten-target-flag-has-three-independent-silent-degradation-paths]] (the sibling fix this
 gotcha was found alongside, in the same audit pass).
+
+## RESOLVED (war-memory-cli-correctness/1.1, #1145)
+
+`cmdQuery` now carries the same three-way `typeof`-gated resolution ratified for
+`cmdTightenPlan`'s `--target` — a shape copy at `cmdQuery`'s own boundary, not a shared helper
+(`parseArgv` stays frozen): flag absent → the unchanged default; `typeof === 'string'` and
+`Number.isFinite(t) && t > 0` → the value binds; anything else (bare flag, non-numeric, zero,
+negative) → `war-memory query: --top-k requires a positive count (got '<token>')` (resp.
+`--budget requires a positive byte count`) on stderr, exit 1 — placed above the `walkCorpus` call,
+so a refusal appends no query-log line and prints no block. This closes exactly the gap this
+lesson flagged: a bare `--top-k` no longer takes `Number(true) === 1` into a one-lesson block, a
+`NaN` `--top-k` no longer reaches `selectForBudget`'s `slice(0, topK)` to silently empty the block,
+and a `NaN` `--budget` no longer silently uncaps it (`bytes + size > NaN` never breaks the loop).
+
+Covered by the `refusal (#1145): --<flag> <label> → exit 1, empty stdout, stderr names the flag +
+the token` parameterized test cases in `war-memory.test.mjs` (eight cases — bare, non-numeric,
+zero, negative, crossed with `--top-k`/`--budget`) plus the no-query-log-on-refusal assertion and
+the unchanged-path cases built from the imported `DEFAULT_TOP_K`/`DEFAULT_BUDGET` constants.
+
+Related: [[tighten-target-flag-has-three-independent-silent-degradation-paths]] — its own
+"Extended to siblings" paragraph now records this fix in past tense.
diff --git a/docs/learnings/old-absent-gate-half-relies-on-unrecorded-hand-grep-fails-silently.md b/docs/learnings/old-absent-gate-half-relies-on-unrecorded-hand-grep-fails-silently.md
new file mode 100644
index 0000000..870373c
--- /dev/null
+++ b/docs/learnings/old-absent-gate-half-relies-on-unrecorded-hand-grep-fails-silently.md
@@ -0,0 +1,71 @@
+---
+name: old-absent-gate-half-relies-on-unrecorded-hand-grep-fails-silently
+description: "A per-medium doc-consistency gate asserting both NEW-present (new wording landed) and OLD-absent (retired wording is gone from live surfaces) is only as strong as its weakest half — when OLD-absent is certified by an ad hoc, uncommitted manual grep rather than a committed assertion, that half is exactly the one that silently returns a false pass. End state 8 of war-memory-cli-correctness/phase-1 shipped NEW-present real but OLD-absent false, leaving 3 `inbound refs` stragglers on live skills/ surfaces; caught only at post-merge gate-audit."
+metadata: 
+  node_type: memory
+  type: project
+  provenance: code-verified
+  slug: old-absent-gate-half-relies-on-unrecorded-hand-grep-fails-silently
+  phase: "war-memory-cli-correctness/phase-1 task 1.1 gate-audit (execution-evidence lens), fixed at 086db74"
+  created: 2026-07-27
+  tags: 
+    - gate-audit
+    - doc-consistency
+    - end-state
+    - retired-token-sweep
+  keywords: 
+    - OLD-absent
+    - NEW-present
+    - per-medium gate
+    - retired-token sweep
+    - manual grep
+    - gate-audit
+    - End state 8
+    - hand-certified
+    - straggler
+    - inbound refs
+    - inbound citers
+    - ADR 0017
+  originSessionId: 0ad881e1-4bbc-43c6-8e45-8597d9cec1cf
+  modified: 2026-07-28T01:08:21.793Z
+---
+
+# An OLD-absent gate half certified by hand, not committed, is the half that silently fails
+
+**What happened (code-verified — `.claude/teams/2026-07-26-war-memory-cli-correctness-2026-07-27/ledger.json`,
+`gateAudit` + `retiredTokenSweep` fields; verify still present before acting):** phase-1's End state
+8 required a per-medium doc-consistency flip — `cmdArchive`'s hub-WARN noun renamed from the
+undeduped "inbound refs" to the slug-deduped "inbound citers" (task 1.1, #1154, D7), retired
+doc-wide across `skills/`, `hooks/`, `agents/`, `CONTEXT.md`, `README.md` (frozen artifacts and the
+historical ADR 0028 quote exempt). The NEW-present half — the ADR 0028 amendment and the SKILL.md
+rename — landed real (code-verified: `skills/lessons-learned/SKILL.md` now reads "inbound
+citers" throughout its hub-threshold section). The OLD-absent half was certified by an **unrecorded
+manual grep** in the done-report, and that grep returned the wrong answer: post-merge gate-audit
+(`execution-evidence` lens) found the Major finding "End state 8 OLD-absent false at tip — 3
+surviving `inbound refs` lines on live `skills/` surfaces."
+
+**Resolution:** Lead-adjudicated scope widening, fixed in-place at `086db74` rather than deferred
+(ADR 0017 — a validation in neither the gate, a floor, nor the backstops section may not be waived
+in prose). The gate was re-run green (990 JS tests + all shell + lint clean), and the ledger now
+carries a committed `retiredTokenSweep` record: `grep -in 'inbound refs'` → 0 hits across `skills/`,
+`hooks/`, `agents/`, `CONTEXT.md`, `README.md` at `086db74` (exempt surfaces named explicitly:
+`docs/plans`, `docs/specs`, `docs/red-team`, `docs/learnings/archive`, the ADR 0028 historical
+quote). Confirmed still true at the landed tip (verified via Grep of the live `_refinery` checkout).
+
+**Why this matters:** the NEW-present half of a rename/retirement gate tends to get real coverage
+almost for free — it's the surface the task actually builds and tests. The OLD-absent half is
+easy to treat as an afterthought sweep, run once by hand, and never re-verified — exactly the
+asymmetry that let 3 stragglers survive from round-0 red-team all the way to a landed merge before
+gate-audit caught them.
+
+**How to apply:** when a plan mandates a per-medium NEW-present/OLD-absent gate for a retired
+literal, insist the OLD-absent half is a **committed** grep assertion (a test, or a gate-log line
+the refiner captures) — not a hand-run grep quoted only in a worker's done-report. Case-sensitivity
+matters too: use `grep -in`, token-anchored, so a re-cased straggler doesn't false-negate the check.
+
+Related: [[archive-hub-warning-counts-cross-root-dupe-citer-twice]] (the underlying "refs vs
+citers" dedup-semantics substance this rename was fixing); [[plan-survey-token-sweep-misses-untagged-siblings]]
+(sibling gotcha, same family — a different failure mode: a grep sweep misses siblings that
+paraphrase the token rather than, as here, a hand-certified sweep simply mis-reporting literal
+matches); [[full-gates-green-end-state-soft-without-threaded-gate-log-artifact]] (same discipline:
+an End state's evidence claim needs a threaded artifact, not an assertion).
diff --git a/docs/learnings/redteam-sandbox-probe-branch-residue-blocks-next-provision.md b/docs/learnings/redteam-sandbox-probe-branch-residue-blocks-next-provision.md
new file mode 100644
index 0000000..c60096e
--- /dev/null
+++ b/docs/learnings/redteam-sandbox-probe-branch-residue-blocks-next-provision.md
@@ -0,0 +1,72 @@
+---
+name: redteam-sandbox-probe-branch-residue-blocks-next-provision
+description: "A red-team probe (ff-topology) that built a synthetic fast-forward git fixture inside the SHARED sandbox worktree — instead of a throwaway temp repo — left branches (not just commits) behind; `git reset --hard && git clean -fd` restored the working tree but only rewinds the currently checked-out branch, never deletes sibling branches the probe created. The residue was repo-global (the sandbox worktree shares the main .git) and collided with the next /war run's Provision barrier as a foreign integration ref (ADR 0003), forcing held:workflow-error, a manual branch delete, and a fresh relaunch."
+metadata: 
+  node_type: memory
+  type: project
+  provenance: code-verified
+  slug: redteam-sandbox-probe-branch-residue-blocks-next-provision
+  phase: "war-memory-cli-correctness/phase-1 (red-team round 0, wf_53228ce5-e83, 2026-07-27; prior workflow run wf_85641550-d11)"
+  created: 2026-07-27
+  tags: 
+    - red-team
+    - sandbox-worktree
+    - provision-barrier
+    - adr-0003
+    - branch-hygiene
+  keywords: 
+    - ff-topology
+    - sandbox escape
+    - git reset --hard
+    - git clean -fd
+    - branch residue
+    - foreign integration ref
+    - EX_FOREIGN
+    - Provision barrier
+    - held:workflow-error
+    - escape guard
+    - repo-global branch
+    - rogue rogue2
+  originSessionId: 0ad881e1-4bbc-43c6-8e45-8597d9cec1cf
+  modified: 2026-07-28T01:08:03.481Z
+---
+
+# A red-team sandbox escape's file restore does not undo the branches the probe created
+
+**What happened (code-verified):** the `ff-topology` probe (attack surface for red-team run
+`wf_53228ce5-e83`, phase 1 of `war-memory-cli-correctness`) needed a synthetic fast-forward git
+topology to exercise, and built it **inside the shared red-team sandbox worktree** instead of a
+disposable temp repo. The post-run escape guard caught it: 5 commits on top of the pinned base plus
+working-tree edits, including a deliberate detection-test mutation. `git reset --hard <base> && git
+clean -fd` restored the sandbox's files and the escape guard re-ran exit 0 — but this restore only
+rewinds the **currently checked-out branch's ref**, and (`clean -fd`) removes untracked files; it
+does **not** delete any *other* branch the probe created along the way. The rogue branch refs
+(named for the detection-test mutation, e.g. a `rogue`/`rogue2` pair) stayed in `refs/heads/`
+because a sandbox worktree shares the **main repo's `.git`** — any branch it creates is repo-global,
+not sandbox-local.
+
+**Consequence (code-verified via this run's `ledger.json`, `priorRun` field):** the very next `/war`
+launch for this same plan died at the **Provision barrier** with `held:workflow-error` — one of the
+residual branches collided with the integration branch Provision needed to create
+(`integration/<planSlug>/phase-N`), and `cmd_ensure_integration` refuses to reuse a branch it does
+not own (ADR 0003, `EX_FOREIGN`, exit 3). The recorded resolution: delete the foreign branch by
+hand and relaunch fresh — **never** `resumeFromRunId` on that dead run (a fresh run needs a fresh
+Provision, not a resume that re-hits the same foreign ref).
+
+**Why the restore looked complete but wasn't:** the escape guard's own check is a *working-tree*
+diff/dirty-file check (confirms the disposable repo's tracked+untracked file state matches the
+pinned base) — it has no branch-enumeration step, so a clean `git status` after `reset --hard` reads
+as "fully restored" even though new refs survive untouched.
+
+**How to apply:** after diagnosing and containing any red-team sandbox escape (any probe that
+touches git state — branches, tags, refs — not just files), run `git branch --list` (scoped to the
+run's own naming conventions, e.g. anything not already known-legitimate) as a **second** restore
+check, in addition to the working-tree escape guard. Delete any branch the incident window created
+before the next `/war`/`/red-team` launch touches Provision. This is a sandbox-hygiene gap in the
+probe itself, not a Provision bug — the fix belongs in "always build synthetic git fixtures in a
+disposable temp repo, never the shared sandbox worktree," with the branch sweep as the backstop for
+when that discipline slips.
+
+Related: [[provision-nonidempotent-orphan-integration-branch-blocks-relaunch]] (same failure
+signature — orphan/foreign integration branch blocks Provision — different root cause: a
+non-idempotent provision step there, a red-team sandbox escape here); [[provision-barrier-refiner-owned-not-worker-self-create]].
diff --git a/docs/learnings/release-blurb-quoted-code-literal-can-diverge-from-actual-identifier.md b/docs/learnings/release-blurb-quoted-code-literal-can-diverge-from-actual-identifier.md
new file mode 100644
index 0000000..06e5562
--- /dev/null
+++ b/docs/learnings/release-blurb-quoted-code-literal-can-diverge-from-actual-identifier.md
@@ -0,0 +1,71 @@
+---
+name: release-blurb-quoted-code-literal-can-diverge-from-actual-identifier
+description: "README Status blurb quotes `fs.readdirSync(dir, { recursive: true })` but cmdLint's real identifier is `t` — a grep for the rendered literal finds nothing"
+metadata: 
+  node_type: memory
+  type: project
+  provenance: code-verified
+  slug: release-blurb-quoted-code-literal-can-diverge-from-actual-identifier
+  phase: "2026-07-26-war-memory-cli-correctness/phase-2 task 2.1 (gate-audit Nit, disposition note)"
+  keywords: 
+    - release blurb
+    - README Status
+    - code literal in prose
+    - identifier mismatch
+    - cmdLint
+    - readdirSync
+    - grep the rendered literal
+    - blurb accuracy
+    - quoted code snippet drift
+  tags: 
+    - release-blurb
+    - docs
+    - plan-fidelity
+  created: 2026-07-27
+  originSessionId: 0ad881e1-4bbc-43c6-8e45-8597d9cec1cf
+  modified: 2026-07-28T01:29:44.641Z
+---
+
+# A release blurb quoting a code call can rename the variable, silently defeating a later grep
+
+**What happened (code-verified at the landed tip):** `war-memory-cli-correctness`'s Task 2.1
+release blurb (`README.md` `## Status`, item (2)) writes:
+
+> `lint <dir>` now enumerates with `fs.readdirSync(dir, { recursive: true })`
+
+but the real call in `skills/_shared/war-memory.mjs`'s `cmdLint` directory branch reads:
+
+```js
+files = fs.readdirSync(t, { recursive: true }).filter((f) => f.endsWith('.md')).map((f) => path.join(t, f));
+```
+
+The identifier is `t`, not `dir`. The audit found this a Nit, `disposition: note`,
+`phaseClose: false` — not a false code fact (the same sentence introduces `<dir>` as the CLI
+argument name, so a careful reader parses `dir` as *that* argument rather than a claim about the
+source identifier) — but a reader who greps the repo for the exact rendered literal
+(`fs.readdirSync(dir, { recursive: true })`) finds zero hits, because the only real occurrence
+uses `t`.
+
+**Verified still present at land** (via the `_refinery1` task worktree at
+`.claude/war/worktrees/2026-07-26-war-memory-cli-correctness-2026-07-27/_refinery/`, whose detached
+`HEAD` equals the landed tip `62956fd0b1f34d408ab1251a2b8fd8d5201ed444`): `README.md`'s `## Status`
+line still reads `fs.readdirSync(dir, { recursive: true })`, and `skills/_shared/war-memory.mjs`'s
+`cmdLint` directory branch still calls `fs.readdirSync(t, { recursive: true })`. Non-blocking; the
+task's two blurb requirements (recursive-walk phrasing, count-word consistency) were both satisfied
+regardless.
+
+**The pattern:** when a release blurb or Status line quotes a source call verbatim to ground a
+claim in code, copy the call's *actual identifier names*, not a reader-friendly placeholder that
+happens to collide with a nearby CLI-argument name (`<dir>` here). A near-miss like this is easy to
+wave off as cosmetic, but it silently defeats the exact kind of "grep the rendered literal to prove
+it's true" verification this repo relies on for blurb/lesson trueing-up sweeps (see
+[[plan-survey-token-sweep-misses-untagged-siblings]] for the sibling grep-is-a-floor discipline).
+Prefer quoting the call with its parameter elided (`fs.readdirSync(…, { recursive: true })`) when
+the exact identifier isn't the point, or use the real identifier if it is.
+
+## Related
+
+[[plan-survey-token-sweep-misses-untagged-siblings]] — grep sweeps are a floor, not a ceiling, for
+verifying blurb/lesson prose against code. [[release-blurb-headline-count-word-can-mismatch-its-own-enumeration]]
+and [[release-blurb-overstates-guard-semantics]] — sibling release-blurb-precision findings from
+earlier phases in this same family.
diff --git a/docs/plans/2026-07-26-war-memory-cli-correctness.md b/docs/plans/2026-07-26-war-memory-cli-correctness.md
index 88de166..076cc2c 100644
--- a/docs/plans/2026-07-26-war-memory-cli-correctness.md
+++ b/docs/plans/2026-07-26-war-memory-cli-correctness.md
@@ -5,18 +5,18 @@ Issues addressed: #1145, #1135, #1154, #1147 (theme: memory-tooling).
 
 ## Commander's Intent
 
-- Purpose: Close the memory CLI's last silent-degradation flag pair (`cmdQuery`'s `--top-k`/`--budget`), make the one shared redaction-lint invocation cover the committed `archive/` subtree on every surface, converge `cmdArchive`'s concept-hub WARN onto the slug-deduped counting its two sibling surfaces already use, and true up the two committed lessons that describe these defects — so no memory-CLI surface degrades silently and no lesson misstates a live mechanism.
+- Purpose: Close the memory CLI's last silent-degradation flag pair (`cmdQuery`'s `--top-k`/`--budget`), make the one shared redaction-lint invocation cover the committed `archive/` subtree on every surface, converge `cmdArchive`'s concept-hub WARN onto the slug-deduped counting its two sibling surfaces already use, and true up the two committed lessons that describe these defects — so no memory-CLI surface degrades silently on a space-separated flag value and no lesson misstates a live mechanism (the `=`-attached flag form remains a known-silent, deliberately frozen residual — D10, named in End state 1).
 - Method: Bind each flag guard at `cmdQuery`'s own argv boundary by copying the ratified `--target` three-way resolution from `cmdTightenPlan` (shape copy, no shared helper; `parseArgv` is frozen); refusal = exit 1, stderr naming the flag and the received token, placed before the `walkCorpus` call so a refused invocation writes nothing (no `appendQueryLog` line, no stdout block). Land archive coverage inside `cmdLint`'s directory branch via `fs.readdirSync(t, { recursive: true })` so CI (`memory-audit.yml`) and the gate wrapper (`war-memory-lint.test.sh`) inherit it with zero edits — both stay byte-unchanged. Slug-dedupe the hub WARN (`new Set(hotInbound.map((r) => r.slug)).size` drives both the `>= 2` predicate and the printed count, whose noun becomes `inbound citers`) and update the adjacent comment to name the three-surface convergence. Correct lesson prose from the red-team-measured fuse mechanism (sourced from `docs/red-team/2026-07-24-memory-tooling-hardening.md`, not re-derived); the sibling lesson's RESOLVED stamp lands with-or-after the `cmdQuery` fix, never before (deps edge enforces this). Every mandated grep is a floor: pair it with a same-scope hand survey and list each straggler as a survey-derived correction (or state zero stragglers explicitly). New refusal test cases get their own banner — do not edit the existing `refusal (#1059)` block's narrative. `cmdQueriesBatch` and the Lead prefetch stay byte-identical; no `parseArgv` change; the `=`-attached-flag residual stays frozen.
 - End state:
-  1. A supplied-but-invalid `--top-k` or `--budget` on `query` (bare flag, non-numeric, zero, negative — eight cases across the two flags) exits 1 with empty stdout and stderr naming the flag and the received token; spawn-the-CLI regressions cover all eight and are red pre-fix.
+  1. A supplied-but-invalid space-separated `--top-k` or `--budget` value on `query` (bare flag, non-numeric, zero, negative — eight cases across the two flags) exits 1 with empty stdout and stderr naming the flag and the received token; spawn-the-CLI regressions cover all eight and are red pre-fix. The `=`-attached form (`--top-k=abc`) never reaches these guards — the frozen `parseArgv` keys it as a bare boolean flag and the query silently runs on defaults; that is a NAMED, still-silent, deliberately frozen residual (D10), out of scope by ratified spec decision.
   2. A refused `query` invocation appends no line to the query log (asserted on a fixture local root; delete-the-guard must red the test).
-  3. Unchanged paths hold: flagless `query` output equals an explicit `--top-k 10 --budget 4096` invocation's output on the same fixture (defaults unchanged — `DEFAULT_TOP_K` 10 / `DEFAULT_BUDGET` 4096); `--top-k 3` yields ≤ 3 lessons; a fractional `--top-k 3.5` binds (D3 — `slice` truncates to 3); a valid `--budget` still caps the block; no diff hunk in the change set touches `cmdQueriesBatch` (checked from the task diff at audit/merge).
+  3. Unchanged paths hold: flagless `query` output equals an explicit-defaults invocation built from the imported constants (`--top-k ${DEFAULT_TOP_K} --budget ${DEFAULT_BUDGET}` — never hand-typed literals) on the same fixture (defaults unchanged); `--top-k 3` yields ≤ 3 lessons; a fractional `--top-k 3.5` binds (D3 — `slice` truncates to 3); a valid `--budget` still caps the block; no diff hunk in the change set touches `cmdQueriesBatch` (checked from the task diff at audit/merge).
   4. Truthy-ternary retirement sweep: a grep of `skills/_shared/war-memory.mjs` for the `? Number(`-on-an-`argv`-read shape finds exactly the three `typeof`-gated guarded arms (`--target`, `--top-k`, `--budget`) and zero unguarded truthy ternaries (the guarded arms are sanctioned substrings, not false reds); the mandated same-scope hand survey (`cmdQuery`/`cmdQueriesBatch` comments, `war-memory.test.mjs` titles naming these flags, sibling verbs' flag reads) is reported with each straggler corrected or an explicit zero-straggler statement.
   5. `lint <dir>` walks recursively: a fixture with a credential-shaped violation nested under `<dir>/archive/` exits 1 naming file + pattern, the printed hit path carrying the `archive/` subdir prefix (red pre-fix — today `lint: clean`, exit 0); a clean nested fixture exits 0; the wrapper meta-test in `war-memory.test.mjs` shows `war-memory-lint.test.sh <fixture>` propagating exit 1 for the nested violation.
-  6. Live tree: `node skills/_shared/war-memory.mjs lint docs/learnings/` exits 0 with the recursive walk in place (re-verified at land per the backstop; a violation surfacing there is redacted in the same change set, never waived in prose).
+  6. Live tree: `node skills/_shared/war-memory.mjs lint docs/learnings/` exits 0 with the recursive walk in place — a HARD, gate-confirmable check, not a deferred one: the gate-discovered `war-memory-lint.test.sh` lints the live tree with recursion active inside Task 1.1's own merge gate, and its `== gate(bash): … ==` banner in the captured gate log is the audit evidence (a violation surfacing there is redacted in the same change set, never waived in prose; the backstop covers only the post-gate window).
   7. `.github/workflows/memory-audit.yml` and `skills/_shared/war-memory-lint.test.sh` are byte-unchanged by the change set (checked from the task diff: neither file appears in `git diff --name-only` against the phase base).
-  8. `cmdArchive`'s hub WARN is slug-deduped: a citer slug hot in both roots citing a hub produces no WARN (deduped count 1); two distinct hot citers produce a WARN printing count 2; one dupe citer plus one distinct citer produces a WARN printing 2, not 3 (the mixed case — pins predicate and printed count together); the WARN noun reads `inbound citers` (the deduped count counts slugs, so the old `inbound refs` noun would be false); the adjacent comment says the count is slug-deduped to match the `inbound` verb and `tightenPlan` Floor 2; existing `inboundCiters` hotOnly tests stay green.
-  9. The tighten lesson's failure-mode-3 item states the fuse mechanism (zsh does not word-split the unquoted expansion → one fused argv word `--target 2000` → `parseArgv` keys `{"target 2000": true}` → `argv.target` stays `undefined`; outcome coincides with never setting the variable, "same silent outcome" clause kept); a grep of the file for `dropped`/`collapses` finds zero mechanism-position claims; the "Not yet extended to siblings" paragraph is past-tense and cites the landed fix; the same-scope hand survey (full body plus the sibling lesson) is reported.
+  8. `cmdArchive`'s hub WARN is slug-deduped: a citer slug hot in both roots citing a hub produces no WARN (deduped count 1); two distinct hot citers produce a WARN printing count 2; one dupe citer plus one distinct citer produces a WARN printing 2, not 3 (the mixed case — pins predicate and printed count together); the WARN noun reads `inbound citers` (the deduped count counts slugs, so the old `inbound refs` noun would be false); the adjacent comment says the count is slug-deduped to match the `inbound` verb and `tightenPlan` Floor 2; the existing `inboundCiters` hotOnly UNIT tests stay green unmodified, while the existing spawn-the-CLI hub-WARN test is updated in-task (title + regex — it pins the message bytes, so the noun flip reds it by design); OLD-absent: a repo grep for the retired WARN literal (`inbound refs`) over live surfaces (`skills/`, `hooks/`, `agents/`, `CONTEXT.md`, `README.md`) returns zero hits — frozen artifacts (`docs/plans/`, `docs/specs/`, `docs/red-team/`, `docs/learnings/archive/`) and ADR 0028's historical quote (superseded by its dated amendment, which must be present) are exempt.
+  9. The tighten lesson's failure-mode-3 item states the fuse mechanism (zsh does not word-split the unquoted expansion → one fused argv word `--target 2000` → `parseArgv` keys `{"target 2000": true}` → `argv.target` stays `undefined`; outcome coincides with never setting the variable, "same silent outcome" clause kept); a case-insensitive grep (`grep -in`) of the file for `dropped`/`collapses` finds zero mechanism-position claims (case-insensitive so a re-cased straggler cannot slip the floor); the "Not yet extended to siblings" paragraph is past-tense and cites the landed fix; the same-scope hand survey (full body plus the sibling lesson) is reported.
   10. The `cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape` lesson's description is RESOLVED-prefixed and its body carries a `## RESOLVED` section citing this fix and its tests; the redaction lint passes on both edited lessons.
   11. All four version slots carry the next free patch above the live integration base; `version-slots.test.mjs` green.
   12. `node --test 'skills/**/*.test.mjs'` fully green.
@@ -32,12 +32,13 @@ Phase edge rationale: the release bump is its own trailing phase per the decompo
 
 ### Task 1.1: cmdQuery flag guards, cmdLint recursion, cmdArchive WARN dedupe
 
-- Files: `skills/_shared/war-memory.mjs`, `skills/_shared/war-memory.test.mjs`
+- Files: `skills/_shared/war-memory.mjs`, `skills/_shared/war-memory.test.mjs`, `docs/adr/0028-memory-store-integrity-tool-enforced.md`
 - Plan slice: Three fixes in `war-memory.mjs`, each bound at its owning verb's boundary, plus their regressions:
-  - **`cmdQuery` (#1145, D1–D3):** at function entry, before the `walkCorpus` call, replace the two truthy ternaries (`argv['top-k'] ? Number(...) : DEFAULT_TOP_K`, `argv.budget ? Number(...) : DEFAULT_BUDGET`) with two instances of the ratified three-way resolution, copying the `cmdTightenPlan` `--target` block's shape, in the existing declaration order (`--top-k` first, then `--budget` — a both-invalid invocation reports `--top-k`; source order is the pin, no dedicated ordering test): absent flag → default (byte-identical flagless path); `typeof === 'string'` and `Number.isFinite(t) && t > 0` → binds; anything else → stderr `war-memory query: --top-k requires a positive count (got '<token>')` (resp. `--budget requires a positive byte count`), exit 1. No integer check (D3 — mirror `--target`'s predicate exactly). Guard placement makes no-log-on-refusal hold for free; assert it anyway.
+  - **`cmdQuery` (#1145, D1–D3):** at function entry, before the `walkCorpus` call, replace the two truthy ternaries (`argv['top-k'] ? Number(...) : DEFAULT_TOP_K`, `argv.budget ? Number(...) : DEFAULT_BUDGET`) with two instances of the ratified three-way resolution, copying the `cmdTightenPlan` `--target` block's shape, in the existing declaration order (`--top-k` first, then `--budget` — a both-invalid invocation reports `--top-k`; source order is the pin, no dedicated ordering test): absent flag → default (byte-identical flagless path); `typeof === 'string'` and `Number.isFinite(t) && t > 0` → binds; anything else → stderr `war-memory query: --top-k requires a positive count (got '<token>')` (resp. `--budget requires a positive byte count`), exit 1. No integer check (D3 — mirror `--target`'s predicate exactly). Add a one-line coupling comment at each new guard arm naming `cmdTightenPlan`'s `--target` block as the ratified reference implementation, and extend that block's existing rationale comment to name its two new copies — three sites, comment-coupled both ways, no shared helper (`parseArgv` frozen). Guard placement makes no-log-on-refusal hold for free; assert it anyway.
   - **`cmdLint` (#1135, D5):** in the directory branch, swap the one-level `fs.readdirSync(t)` for `fs.readdirSync(t, { recursive: true })`; keep the `.endsWith('.md')` filter and `path.join` unchanged (correct on the subdir-prefixed relative paths recursion returns); preserve the `catch { continue }` fail-open (the wrapper is the loud surface for an unreadable target).
   - **`cmdArchive` (#1154, D7):** in the advisory concept-hub WARN, compute `const hubCiters = new Set(hotInbound.map((r) => r.slug)).size` and use it for both the `>= 2` predicate and the printed count; change the WARN's count noun from `inbound refs` to `inbound citers` (the deduped count counts slugs — one word, not a message redesign; see Notes); `hotOnly: true` stays; update the adjacent comment to say the count is slug-deduped to match the `inbound` verb and `tightenPlan` Floor 2.
-  - **Tests (`war-memory.test.mjs`):** spawn-the-CLI refusal regressions for both `query` flags mirroring the `refusal (#1059)` family shape, per-case stderr token fidelity included (bare → `'true'`, non-numeric, zero, negative × both flags — new banner, do not edit the #1059 block's narrative); unchanged-path cases (flagless output equals an explicit-defaults invocation on the same fixture; valid values bind and cap; `--top-k 3.5` binds, D3); no-query-log-on-refusal assertion (this also proves `appendQueryLog`'s `mkdirSync` never ran — both live behind the same call); lint fixtures with an `archive/`-nested violation (CLI case red pre-fix; assert the printed hit path carries the `archive/` prefix) and a clean nested case; the existing wrapper meta-test family extended to the nested-violation fixture; archive hub-WARN dedupe regression driven by spawning `archive <hub>` on a two-root fixture with stderr capture (cross-root-dupe citer ⇒ no WARN; two distinct citers ⇒ WARN counting 2; one dupe + one distinct citer ⇒ WARN counting 2, not 3), each case also asserting the archive operation itself succeeds around the WARN (exit 0, file moved, re-render completes).
+  - **ADR 0028 amendment (red-team 2026-07-27):** `docs/adr/0028-memory-store-integrity-tool-enforced.md` quotes the hub-WARN message verbatim (`inbound refs` noun, undeduped count). Append a dated amendment note recording that as of this fix the WARN prints a slug-deduped count with the `inbound citers` noun — append-only, never editing the historical quote (ADR convention: superseded, not rewritten). Per-medium gate (plan-1 precedent): the ADR asserts NEW-present (the amendment) only; OLD-absent runs on live surfaces (End state 8).
+  - **Tests (`war-memory.test.mjs`):** spawn-the-CLI refusal regressions for both `query` flags mirroring the `refusal (#1059)` family shape, per-case stderr token fidelity included (bare → `'true'`, non-numeric, zero, negative × both flags — new banner, do not edit the #1059 block's narrative); unchanged-path cases (flagless output equals an explicit-defaults invocation on the same fixture; valid values bind and cap; `--top-k 3.5` binds, D3); no-query-log-on-refusal assertion (this also proves `appendQueryLog`'s `mkdirSync` never ran — both live behind the same call); lint fixtures with an `archive/`-nested violation (CLI case red pre-fix; assert the printed hit path carries the `archive/` prefix) and a clean nested case; the existing wrapper meta-test family extended to the nested-violation fixture; archive hub-WARN dedupe regression driven by spawning `archive <hub>` on a two-root fixture with stderr capture (cross-root-dupe citer ⇒ no WARN; two distinct citers ⇒ WARN counting 2; one dupe + one distinct citer ⇒ WARN counting 2, not 3), each case also asserting the archive operation itself succeeds around the WARN (exit 0, file moved, re-render completes). The EXISTING spawn-the-CLI hub-WARN test (title `archive: concept-hub WARN on ≥2 hot inbound refs…`) pins the message bytes and MUST be updated in-task (title noun + assertion regex → `inbound citers`, deduped count) — it is the forced-red surface for the noun flip; the `refusal (#1059)` narrative stays untouched. The explicit-defaults equality case is built from the imported constants (`--top-k ${DEFAULT_TOP_K} --budget ${DEFAULT_BUDGET}`), never hand-typed literals (the test file already imports `DEFAULT_TOP_K`).
   - **Retirement sweep (floor):** grep `war-memory.mjs` for `? Number(` on `argv` reads — expected survivors: exactly the three `typeof`-gated guarded arms (`--target`, `--top-k`, `--budget`), zero unguarded; then hand-scan the same scope (comments, test titles naming these flags, sibling verbs' flag reads) and list each straggler as a survey-derived correction. `spec.topK ?? DEFAULT` reads in `cmdQueriesBatch` are out of scope (constraint 6).
 - requiresTest: true
 - requiresPackaging: false
@@ -46,12 +47,13 @@ Phase edge rationale: the release bump is its own trailing phase per the decompo
 
 ### Task 1.2: lesson prose truth-up (#1147 + D9)
 
-- Files: `docs/learnings/tighten-target-flag-has-three-independent-silent-degradation-paths.md`, `docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md`
+- Files: `docs/learnings/archive/tighten-target-flag-has-three-independent-silent-degradation-paths.md`, `docs/learnings/cmdquery-topk-budget-share-tighten-targets-pre-fix-truthy-ternary-shape.md`
+- **Path note (Lead adjudication, 2026-07-27):** the tighten lesson was archived on 2026-07-27 (PR #1167, operator-directed `RESOLVED` sweep) and now lives under `docs/learnings/archive/`. Archiving is a move, not a deletion — the lesson stays queryable via FTS, so its mechanism prose still misleads and still needs this correction. Edit it **in place at the archive path**; do NOT restore it to the hot set (that would re-breach the 17,000 B projection advisory this repo just cleared). The sibling `cmdquery-…` lesson is still hot at its declared path.
 - Plan slice: Two committed-lesson corrections, sourced from the red-team report (`docs/red-team/2026-07-24-memory-tooling-hardening.md`, Minors, "Purpose, zsh threading") and spec §4 — not re-derived:
   - **Tighten lesson, failure-mode-3 item:** replace the "collapses to one argv token and the flag is dropped entirely" sentence pair with the fuse mechanism (zsh, lacking `SH_WORD_SPLIT`, does not word-split the unquoted `${TIGHTEN_TARGET:+…}` expansion → one fused argv word `--target 2000` → `parseArgv` keys `{"target 2000": true}` → `argv.target` stays `undefined`; observable end state coincides with never setting the variable). Keep the "same silent outcome" clause — it was the accurate part.
   - **Tighten lesson, closing paragraph:** rewrite "Not yet extended to siblings" to past tense recording that the extension landed in Task 1.1's `cmdQuery` fix.
   - **Sibling cmdquery lesson (D9):** stamp RESOLVED — description prefix + appended `## RESOLVED` section citing Task 1.1's fix and its tests **by construct name** (plan-slug/task + issue: `war-memory-cli-correctness/1.1, #1145`, the guarded `cmdQuery` resolution, the new refusal-test banner — never a commit SHA or line number; SHAs don't exist stably until land and line anchors rot across the merge queue), mirroring the tighten lesson's landed RESOLVED shape. Per the ratified stamp convention the body stays frozen otherwise: the `deliberately left open` H1 and the pre-fix code snippet remain (the appended section is what corrects the record).
-  - **Stale-wording sweep (floor):** grep the tighten lesson for `dropped` and `collapses` and handle every match — mechanism-position claims are defects; negated/coincides-with mentions in the corrected wording are exempt. Then hand-scan the same scope (frontmatter description, all three failure-mode items, "Why this matters", `## RESOLVED`, residual paragraphs, plus the sibling lesson's full body) for paraphrase stragglers describing the zsh failure as flag loss, listing each as a survey-derived correction. (Spec-time survey: the sibling lesson carries no zsh claim.)
+  - **Stale-wording sweep (floor):** grep the tighten lesson case-insensitively for `dropped` and `collapses` (`grep -in 'dropped\|collapses'`) and handle every match — anchored on the tokens, never on line position (a re-cased or re-positioned straggler must still hit) — mechanism-position claims are defects; negated/coincides-with mentions in the corrected wording are exempt. Then hand-scan the same scope (frontmatter description, all three failure-mode items, "Why this matters", `## RESOLVED`, residual paragraphs, plus the sibling lesson's full body) for paraphrase stragglers describing the zsh failure as flag loss, listing each as a survey-derived correction. (Spec-time survey: the sibling lesson carries no zsh claim.)
   - Run the redaction lint on both edited files (`node skills/_shared/war-memory.mjs lint <file>` per file) and confirm clean.
 - requiresTest: false
 - requiresPackaging: false
@@ -71,8 +73,8 @@ Phase edge rationale: the release bump is its own trailing phase per the decompo
 
 ## Deferred validations (backstops)
 
-- Live-tree recursive lint re-run at land: `node skills/_shared/war-memory.mjs lint docs/learnings/` exits 0 with the recursive walk in place · why deferred: the 113-archived-files-clean claim is time-of-spec; the archive can pick up a violation before land · earliest loud surface: Task 1.1's own merge gate (the gate-discovered `war-memory-lint.test.sh` lints the live `docs/learnings/`, recursion active) — a hit there routes as a fix round on Task 1.1 with Lead-adjudicated scope widening to redact the offending archive file inside Phase 1 (fail-closed, never waived in prose, ADR 0017; the archive file joins the task diff as a survey-derived correction) · runner: Task 1.1 gate → refiner/Lead at Phase 1 land → CI `memory-audit.yml` on the PR.
-- Local-root recurrence copies of BOTH edited lessons still need the same corrections carried forward: the tighten lesson's local copy (same slug) carries the stale "silently dropping the flag" wording, and the cmdquery lesson's local copy (same slug, currently shadowing the repo row in the local MEMORY.md) carries no RESOLVED stamp · why deferred: the untracked local memory root is outside every worker's write scope (spec constraint 7 / §9) · runner: the next `/lessons-learned` pass / Gate-2 servitor cycle — which overwrites repo copies from local ones, so it must carry the fuse wording AND the RESOLVED stamp forward, never regress the repo copies corrected in Task 1.2.
+- Live-tree recursive lint re-run at land: `node skills/_shared/war-memory.mjs lint docs/learnings/` exits 0 with the recursive walk in place · why deferred (NARROWED at red-team 2026-07-27 — the task gate already runs this check pre-merge and blocking, so End state 6 is HARD there, not deferred; only the window between that gate and the PR merge is uncovered): archive drift landing after Task 1.1's merge gate — a gate hit routes as a fix round on Task 1.1 with Lead-adjudicated scope widening to redact the offending archive file inside Phase 1 (fail-closed, never waived in prose, ADR 0017; the archive file joins the task diff as a survey-derived correction) · runner: Task 1.1 gate → refiner/Lead at Phase 1 land → CI `memory-audit.yml` on the PR.
+- Local-root recurrence copies of BOTH edited lessons still need the same corrections carried forward: the tighten lesson's local copy (in the local `archive/` since the 2026-07-27 sweep) carries the stale flag-dropped wording, and the cmdquery lesson's local HOT copy carries no RESOLVED stamp — a later Gate-2 promotion of that stale local copy would overwrite-on-promote the Task 1.2-corrected repo copy · why deferred FROM THE WORKER only: the untracked local root is outside every worker's write scope (spec constraint 7 / §9) — but not outside the run's: · in-run runner (primary): this run's Phase 1 **servitor**, whose sole write path IS the local memory root; the recorded `resolved-lesson-stamp-freezes-body-so-it-can-contradict-the-new-description` convention ("How to apply" #2) sanctions mirroring a landed RESOLVED stamp onto the editable local copy · residual runner: the next `/lessons-learned` pass, for whatever the servitor does not reach (e.g. the archived local tighten copy, if the provenance hook denies archive-path writes) · **Lead duty at this run's Gate 2 (fail-closed):** exclude the tighten slug — and any slug whose repo copy lives under `docs/learnings/archive/` — from the promotion selection: promotion copies FLAT into `docs/learnings/` and would land the slug HOT, duplicating the archived copy and re-breaching the 17,000 B projection advisory.
 
 ## Notes / conscious deviations
 
@@ -89,10 +91,10 @@ Phase edge rationale: the release bump is its own trailing phase per the decompo
   - Red-pre-fix claims (End states 1, 5, 8) and the grep + hand-survey results (End states 4, 9) are worker done-report evidence — SOFT at gate-audit per the recorded convention, accepted; no committed drift guard on the survey results (survey is a floor, by design).
   - The no-log-on-refusal assertion subsumes a dir-not-created assertion: `mkdirSync` lives inside `appendQueryLog`, so an absent log proves the mkdir never ran.
   - Issue closure: #1145/#1135/#1154/#1147 are survey-swept (mapped in the 2026-07-26 survey manifest) — `/aftermath` Class-4 closes them against this plan's merged PR; not a `/war` checkpoint duty.
-  - Campaign contention (computed, not assumed): the one sibling plan (`2026-07-26-dispatch-args-and-floor-coverage`) shares only the three release-slot files — by design; the campaign is serial stack-and-plow, each release phase resolving the next free patch at its own land-time tip, so no patch-number race. No overlap on `war-memory.mjs`/`.test.mjs` or the two lessons. No in-campaign writer moves files into `docs/learnings/archive/`, so the wrapper's no-arg meta-test (which lints the live tree on every suite run) cannot red an unrelated worker mid-campaign.
+  - Campaign contention (RE-computed at red-team, 2026-07-27): the campaign has THREE sibling plans (roadmap: 4 plans, strict order 1 → 2 → 3 → 4; plan 1 already merged to master). All siblings share the three release-slot files by design — serial landing means each release phase resolves the next free patch at its own land-time tip, no patch-number race. No sibling touches `war-memory.mjs`/`.test.mjs` or either lesson. Real overlap beyond the slots: plan 4 (`standing-doc-and-remedy-truth-sweep`) edits `README.md` prose and `skills/war/assets/version-slots.test.mjs` in its NON-release Phase 1 — the same README `## Status` slot this plan's Task 2.1 replaces and the same arbiter suite End state 11 names. Mitigation: the strict landing order puts plan 4 after this plan, so Task 2.1 lands first and plan 4 rebases onto it; if the order ever slips, Task 2.1's blurb must satisfy whatever presence lock plan 4 has added to `version-slots.test.mjs` at the tip. The 2026-07-27 memory sweep DID move 25 lessons into `docs/learnings/archive/` before this plan's execution (145 archived files total; live-tree recursive lint re-verified clean, 0 hits) — the no-mid-campaign-archive claim holds only from this red-team forward.
   - Spec's "#1154 observed live 2026-07-27" is a UTC-clock date (the lesson files' own `modified` stamps read 2026-07-27T03:5xZ = 2026-07-26 evening local) — not a typo; no spec surgery.
   - Rollback is roll-forward only: the version-slots monotonic floor (ratified) blocks a coherent downgrade; a guard proving too strict for an exotic downstream value is a follow-up patch release. Accepted.
-  - Doc sweep run (comment-leader-stripped, per the recorded sweep lesson): no standing surface (ADR 0015, lessons-learned SKILL/references, seeding.md, CI header, wrapper header, `war-memory.mjs` file-top banner) describes the lint walk depth or the archive as unlinted, and no instruction surface (`skills/`, `agents/` `.md`) threads `--top-k`/`--budget` for agents to replay. Zero stragglers.
+  - Doc sweep run (comment-leader-stripped, per the recorded sweep lesson): no standing surface (ADR 0015, lessons-learned SKILL/references, seeding.md, CI header, wrapper header, `war-memory.mjs` file-top banner) describes the lint walk depth or the archive as unlinted, and no instruction surface (`skills/`, `agents/` `.md`) threads `--top-k`/`--budget` for agents to replay. Zero stragglers on those two scopes. Red-team widening (2026-07-27): that sweep never covered the WARN message STRING — a repo grep for it found `docs/adr/0028-memory-store-integrity-tool-enforced.md` quoting the WARN verbatim (`inbound refs` noun included); handled in Task 1.1 via the dated append-only ADR amendment, per-medium gated (NEW-present on the ADR, OLD-absent on live `skills/` surfaces — End state 8).
   - `/red-team` runs inside `/war-campaign` step 3 before execution; expected report path `docs/red-team/2026-07-26-war-memory-cli-correctness.md` (convention-derived from the kept Source spec line).
 
 ## Open decisions
diff --git a/docs/red-team/2026-07-26-war-memory-cli-correctness.md b/docs/red-team/2026-07-26-war-memory-cli-correctness.md
new file mode 100644
index 0000000..257d7b4
--- /dev/null
+++ b/docs/red-team/2026-07-26-war-memory-cli-correctness.md
@@ -0,0 +1,54 @@
+# Red-team report — war-memory CLI correctness & lint completeness
+
+- **Plan:** `docs/plans/2026-07-26-war-memory-cli-correctness.md` (patched in place; verified tip `4453863`)
+- **Source spec:** `docs/specs/2026-07-26-war-memory-cli-correctness-design.md`
+- **Run:** `wf_53228ce5-e83`, 2026-07-27, `artifactKind: impl-plan`, opus/high (config `agents.redteam`)
+- **Rounds:** round 0 (14 probes, 20 agents) → plan patch `4453863` → round 1 (single-agent re-verify of all 12 blocking findings)
+
+## Verdict: **CLEARED**
+
+All 14 probes on-target, none dropped, none off-target. 12 blocking findings (8 gate blockers, 4 additional `needsDecision`) patched into the plan and re-verified RESOLVED at `4453863`. All 5 Minors were absorbed by the same patches.
+
+## Attack surface
+
+6 spine lenses + 8 bespoke probes (snippet-fidelity, baseline-repro, anchor-check, lesson-prose-source-fidelity, ff-topology, default-flip-old-absent, unguarded-new-mirror, backstop-legitimacy). Executed 6 / analyzed 8; round-0 statuses: 4 pass, 5 fail, 5 warn.
+
+**Baselines proved live** (baseline-repro, snippet-fidelity — both `pass`, completed pre-incident): all four quoted pre-fix snippets verbatim-present; all "red pre-fix" claims genuinely red today (invalid `--top-k`/`--budget` bind or default silently at exit 0; nested `archive/` violation lints clean; a refused-shape query still logs).
+
+## Findings and resolutions applied (all at `4453863`)
+
+| # | Probe | Finding | Resolution |
+|---|-------|---------|------------|
+| 1 | executable-proof | Task 1.2's `dropped`/`collapses` grep guard is case-sensitive — a re-cased straggler false-negates | Sweep + End state 9 now mandate `grep -in`, token-anchored |
+| 2 | executable-proof / consistency-placeholders / default-flip-old-absent | ADR 0028 quotes the hub-WARN verbatim (`inbound refs`); no task owned it, no OLD-absent gate anywhere | ADR 0028 added to Task 1.1 Files; dated **append-only** amendment mandated; per-medium gate: NEW-present on the ADR, OLD-absent on live `skills/`/`hooks/`/`agents/`/`CONTEXT.md`/`README.md` (frozen artifacts + the historical ADR quote exempt) |
+| 3 | consistency-placeholders | Existing spawn-CLI hub-WARN test pins the message bytes — the noun flip reds it, and no plan step updated it | Named as required in-task edit (title + regex); End state 8's stay-green clause narrowed to the `inboundCiters` unit tests |
+| 4 | intent-vs-plan | End state 1's literal ("A supplied-but-invalid `--top-k`… exits 1") falsified by the `=`-attached residual the same plan freezes (D10) | Purpose + End state 1 narrowed to space-separated values; the `=`-attached form lifted into the Intent as a NAMED still-silent frozen residual. Widening `cmdQuery` to refuse `^(top-k|budget)=` keys was **declined** — D10 is a ratified spec freeze |
+| 5 | anchor-check / claims-vs-reality | Contention note claims "the one sibling plan" — the roadmap has three siblings, and plan 4 overlaps `README.md` + `version-slots.test.mjs` in its non-release Phase 1 | Bullet rewritten: three siblings, real overlap named, landing-order mitigation recorded |
+| 6 | backstop-legitimacy | Backstop 2's runner (Gate-2) is a propagation vector that would overwrite the Task 1.2-corrected repo copy and land the archived tighten slug hot | Rewritten: in-run runner = Phase 1 **servitor** (recorded `resolved-lesson-stamp…` convention); residual = next `/lessons-learned`; **Lead Gate-2 duty**: exclude the tighten slug (and any archived-repo-copy slug) from promotion |
+| 7 | backstop-legitimacy | Backstop 2's justification ruled out only the worker, not the run — the servitor's sole write path IS the local root | Justification re-scoped ("FROM THE WORKER only… but not outside the run's") |
+| 8 | backstop-legitimacy | Backstop 1 mis-filed as deferred — the task gate runs the recursive live-tree lint pre-merge and blocking | End state 6 re-filed HARD (gate-log banner = evidence); backstop narrowed to the post-gate window (runner: refiner/Lead at land → CI) |
+| 9 | unguarded-new-mirror | The cmdQuery guard shape-copy ships with no coupling to its reference implementation | Coupling comments mandated both ways (each guard arm ↔ `cmdTightenPlan`'s `--target` block) |
+| 10 | unguarded-new-mirror | End state 3 hand-types `10`/`4096` — an unguarded inline copy of two canonical exports | Explicit-defaults invocation built from the imported constants |
+| 11 | executable-proof (Minor) + intent-vs-plan (Minor) | Doc-sweep "Zero stragglers" claim was scoped too narrowly to support itself | Sweep note widened to the WARN message string; ADR 0028 discovery recorded |
+| 12 | — (decompose gate, pre-red-team) | Task 1.2's declared tighten-lesson path no longer resolves (archived 2026-07-27, PR #1167) | Re-anchored to `docs/learnings/archive/…` at `42d6912`; restore-to-hot declined (would re-breach the 17,000 B projection advisory) |
+
+## Adjudications
+
+| # | Delta | Ruling | Route | Moment |
+|---|-------|--------|-------|--------|
+| 1 | `=`-attached flag form (`--top-k=abc`) silently binds defaults even after Task 1.1 | Stays FROZEN (spec D10, ratified); End state 1/Purpose narrowed to space-separated form; residual is NAMED in the Intent, not waived in prose | in-artifact (`4453863`) | red-team round 0, 2026-07-27 |
+| 2 | ADR 0028's verbatim WARN quote goes stale on the noun flip | Append-only dated amendment in Task 1.1 (never edit the historical quote); per-medium gate — NEW-present on the ADR, OLD-absent on live surfaces (plan-1 ADR 0037 precedent) | in-artifact (`4453863`) | red-team round 0, 2026-07-27 |
+| 3 | Backstop 2's Gate-2 runner would regress Task 1.2's corrections and duplicate the archived tighten slug hot | In-run runner = Phase 1 servitor; **Lead MUST exclude the tighten slug (and any slug whose repo copy is archived) from this run's Gate-2 promotion selection** — fail-closed | in-artifact (`4453863`); Lead duty threaded to the run | red-team round 0, 2026-07-27 |
+| 4 | Tighten lesson archived mid-campaign (PR #1167) broke Task 1.2's declared path | Edit in place at `docs/learnings/archive/…`; do NOT restore hot | in-artifact (`42d6912`) | campaign decompose gate, 2026-07-27 |
+| 5 | Version literals | Phase 2 resolves the next free patch from the four slots at land tip (master shipped 0.14.64 via plan 1 ⇒ expect 0.14.65); plan/roadmap literals non-authoritative | standing (plan already states it) | red-team round 0, 2026-07-27 |
+
+## Incident — sandbox escape (contained, diagnosed, state restored)
+
+The post-run escape guard exited 1: the `ff-topology` probe built its synthetic fast-forward fixture **in the shared sandbox worktree** instead of a fresh temp repo — 5 commits on top of `42d6912` (incl. a deliberate `ROGUE2` detection-test mutation) plus working-tree edits. Self-confound gate run first (Lead actions since worktree creation were read-only ⇒ probe action). **Blast radius:** the disposable sandbox only — the real repo was clean (0 dirty files) and both remote tips unchanged. **Taint audit:** 5 probes (incl. both `pass` executed baselines) completed before the mutation window opened (16:25:51); every load-bearing round-0 finding rests on plan text or files the mutations never touched (mutations hit `war-memory.mjs`/`.test.mjs`/the cmdquery lesson; findings anchor on the plan, the roadmap, ADR 0028, and the tighten lesson). Sandbox `reset --hard` + `clean -fd` to `42d6912`; escape guard re-run **exit 0** before this verdict. `ff-topology` itself returned `pass` (0 findings): post-ff, `git diff --name-only <phase-base>..HEAD` and per-task ranges remain computable — End states 3/7 evidence anchors hold.
+
+## Residual risk
+
+- The `=`-attached flag form remains silent by ratified decision (D10) — named in the Intent; closing it requires a `parseArgv` change this plan forbids.
+- Worker done-report evidence (End states 1, 5, 8 red-pre-fix claims; End state 4/9 surveys) stays SOFT at gate-audit per the recorded convention — accepted in Notes.
+- Recursive `readdirSync` does not descend directory symlinks; unreadable subdirectory skips fail-open (both accepted, one line each, in Notes).
+- The plan's no-mid-campaign-archive claim now holds only from this red-team forward (the 2026-07-27 sweep predates it; live-tree lint re-verified clean over all 145 archived files, 0 hits).
diff --git a/skills/_shared/war-memory.mjs b/skills/_shared/war-memory.mjs
index 2dd7d8a..7fcef96 100644
--- a/skills/_shared/war-memory.mjs
+++ b/skills/_shared/war-memory.mjs
@@ -700,8 +700,35 @@ function readQueryHits(localRoot) {
 function cmdQuery(argv) {
   const roots = resolveRoots(argv);
   const text = argv._.slice(1).join(' ');
-  const topK = argv['top-k'] ? Number(argv['top-k']) : DEFAULT_TOP_K;
-  const budget = argv.budget ? Number(argv.budget) : DEFAULT_BUDGET;
+  // Both flag guards are shape copies of cmdTightenPlan's ratified `--target` block (#1059) —
+  // see its rationale comment; no shared helper (`parseArgv` is frozen). They sit ABOVE the
+  // walkCorpus call, so a refusal writes nothing: no query-log line, no prompt block (#1145).
+  let topK = DEFAULT_TOP_K; // flag absent ⇒ the default (unchanged path)
+  if (argv['top-k'] !== undefined) {
+    // ratified reference implementation: cmdTightenPlan's `--target` three-way resolution
+    const t = typeof argv['top-k'] === 'string' ? Number(argv['top-k']) : NaN;
+    if (Number.isFinite(t) && t > 0) {
+      topK = t;
+    } else {
+      process.stderr.write(
+        `war-memory query: --top-k requires a positive count (got '${argv['top-k']}')\n`
+      );
+      process.exit(1);
+    }
+  }
+  let budget = DEFAULT_BUDGET; // flag absent ⇒ the default (unchanged path)
+  if (argv.budget !== undefined) {
+    // ratified reference implementation: cmdTightenPlan's `--target` three-way resolution
+    const b = typeof argv.budget === 'string' ? Number(argv.budget) : NaN;
+    if (Number.isFinite(b) && b > 0) {
+      budget = b;
+    } else {
+      process.stderr.write(
+        `war-memory query: --budget requires a positive byte count (got '${argv.budget}')\n`
+      );
+      process.exit(1);
+    }
+  }
   const seat = argv.seat || null;
   const records = walkCorpus(roots);
   const db = buildIndex(records);
@@ -783,7 +810,10 @@ function cmdLint(argv) {
     try {
       const st = fs.statSync(t);
       if (st.isDirectory()) {
-        files = fs.readdirSync(t).filter((f) => f.endsWith('.md')).map((f) => path.join(t, f));
+        // Recursive (#1135): the committed `archive/` subtree is prose too, and every lint
+        // surface (CI, the gate wrapper, a bare interactive run) inherits the walk from here.
+        // `path.join` is correct on the subdir-prefixed relative paths recursion returns.
+        files = fs.readdirSync(t, { recursive: true }).filter((f) => f.endsWith('.md')).map((f) => path.join(t, f));
       } else {
         files = [t];
       }
@@ -837,12 +867,14 @@ function cmdArchive(argv) {
       continue;
     }
     // Advisory concept-hub WARN: archiving is link-safe (cold links still resolve), but a
-    // hub with ≥2 hot inbound refs loses its hot index row. Non-blocking — the keep-or-stub
-    // call stays human. Counted from the pre-move snapshot.
+    // hub with ≥2 hot inbound citers loses its hot index row. Non-blocking — the keep-or-stub
+    // call stays human. Counted from the pre-move snapshot, SLUG-DEDUPED (#1154) so a
+    // cross-root twin counts once — matching the `inbound` verb and tightenPlan's Floor 2.
     const hotInbound = inboundCiters(records, slug, { hotOnly: true });
-    if (hotInbound.length >= 2) {
+    const hubCiters = new Set(hotInbound.map((r) => r.slug)).size;
+    if (hubCiters >= 2) {
       process.stderr.write(
-        `WARN: archiving concept hub '${slug}' (${hotInbound.length} inbound refs) — ` +
+        `WARN: archiving concept hub '${slug}' (${hubCiters} inbound citers) — ` +
           `its index row disappears; consider keep-compress stub\n`
       );
     }
@@ -957,6 +989,8 @@ function cmdTightenPlan(argv) {
   // flag refuse: `Number(true) === 1` would otherwise pass `isFinite && > 0` and silently
   // pre-select the entire eligible list at `target: 1`. Refusal is inline (`requireLocal`'s
   // shape) — `main()` has no catch, so a throw would surface as a stack trace, not a diagnostic.
+  // This block is the RATIFIED reference implementation: cmdQuery copies its shape twice
+  // (`--top-k`, `--budget`, #1145). Three comment-coupled sites, deliberately no shared helper.
   let target = WARN_BYTES; // flag absent ⇒ the advisory default (unchanged path)
   if (argv.target !== undefined) {
     const t = typeof argv.target === 'string' ? Number(argv.target) : NaN;
diff --git a/skills/_shared/war-memory.test.mjs b/skills/_shared/war-memory.test.mjs
index 8d0cf8b..67e171f 100644
--- a/skills/_shared/war-memory.test.mjs
+++ b/skills/_shared/war-memory.test.mjs
@@ -35,6 +35,7 @@ import {
   TIGHTEN_YOUNG_DAYS,
   TIGHTEN_SLACK_BYTES,
   DEFAULT_TOP_K,
+  DEFAULT_BUDGET,
 } from './war-memory.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -592,14 +593,14 @@ test('archive <slug>: explicit-slug path is unchanged by the --candidates flip (
   rmSync(local, { recursive: true, force: true });
 });
 
-test('archive: concept-hub WARN on ≥2 hot inbound refs, still exits 0; <2 stays silent (criterion 4)', () => {
+test('archive: concept-hub WARN on ≥2 hot inbound citers, still exits 0; <2 stays silent (criterion 4)', () => {
   const local = tmpDir();
   lessonFile(local, 'hub', { description: 'hub' });
   lessonFile(local, 'ref-a', { description: 'a', body: 'per [[hub]]' });
   lessonFile(local, 'ref-b', { description: 'b', body: 'see [[hub]]' });
   const r = spawnSync('node', [CLI, 'archive', 'hub', '--local', local], { encoding: 'utf8' });
   assert.equal(r.status, 0, r.stderr); // advisory only — never blocks
-  assert.match(r.stderr, /WARN: archiving concept hub 'hub' \(2 inbound refs\)/);
+  assert.match(r.stderr, /WARN: archiving concept hub 'hub' \(2 inbound citers\)/);
   assert.ok(existsSync(join(local, 'archive', 'hub.md')), 'archive still happened');
 
   // one inbound ref → below the ≥2 threshold → no hub WARN.
@@ -613,6 +614,74 @@ test('archive: concept-hub WARN on ≥2 hot inbound refs, still exits 0; <2 stay
   rmSync(local2, { recursive: true, force: true });
 });
 
+// ============================================================================
+// (Task 1.1 / #1154) The hub WARN counts CITERS, slug-deduped — one Set drives
+// both the ≥2 predicate and the printed number, converging cmdArchive onto the
+// `inbound` verb and tightenPlan's cross-root Floor 2. Red pre-fix: the raw
+// record count made a slug hot in BOTH roots read as two, so a single-citer
+// archive printed a "concept hub (2 …)" WARN that the `inbound` verb flatly
+// contradicted (the recorded ground-truth-the-hub trap). The retired noun is
+// deliberately NOT spelled here — quoting it would self-match its own sweep.
+// ============================================================================
+
+// Two-root hub fixture: `hub` is hot in the LOCAL root (so the archive moves the
+// local copy); each [slug, roots] entry writes one citing lesson per named root —
+// listing a slug in both roots makes it a cross-root twin, ONE citer.
+function hubFixture(citers) {
+  const local = tmpDir('war-hub-local-');
+  const repo = tmpDir('war-hub-repo-');
+  lessonFile(local, 'hub', { description: 'a concept hub' });
+  for (const [slug, roots] of citers) {
+    for (const which of roots) {
+      lessonFile(which === 'repo' ? repo : local, slug, {
+        description: `${slug} summary`,
+        meta: { type: 'project' },
+        body: 'builds on [[hub]] heavily',
+      });
+    }
+  }
+  return { local, repo };
+}
+
+function archiveHub({ local, repo }) {
+  return spawnSync('node', [CLI, 'archive', 'hub', '--local', local, '--repo', repo], { encoding: 'utf8' });
+}
+
+// The WARN is advisory: every case must still archive and re-render around it.
+function assertHubArchived(r, local) {
+  assert.equal(r.status, 0, `advisory WARN must never block, got ${r.status}\n${r.stderr}`);
+  assert.ok(existsSync(join(local, 'archive', 'hub.md')), 'hub file moved into archive/');
+  assert.ok(!existsSync(join(local, 'hub.md')), 'and left the hot root');
+  assert.match(r.stdout, /rendered .*MEMORY\.md/); // the trailing re-render completed
+}
+
+test('hub WARN (#1154): a cross-root twin citer counts ONCE → below the ≥2 line, no WARN', () => {
+  const { local, repo } = hubFixture([['twin-citer', ['local', 'repo']]]);
+  const r = archiveHub({ local, repo });
+  assertHubArchived(r, local);
+  assert.doesNotMatch(r.stderr, /concept hub/, 'two records, one citer — pre-fix this printed a false 2');
+  for (const d of [local, repo]) rmSync(d, { recursive: true, force: true });
+});
+
+test('hub WARN (#1154): two DISTINCT hot citers (one per root) → WARN counting 2 inbound citers', () => {
+  const { local, repo } = hubFixture([['citer-a', ['local']], ['citer-b', ['repo']]]);
+  const r = archiveHub({ local, repo });
+  assertHubArchived(r, local);
+  assert.match(r.stderr, /WARN: archiving concept hub 'hub' \(2 inbound citers\)/);
+  for (const d of [local, repo]) rmSync(d, { recursive: true, force: true });
+});
+
+test('hub WARN (#1154): one twin + one distinct citer → 3 records, WARN counting 2 (not 3)', () => {
+  // The mixed case pins predicate and printed count together: dedupe must not simply
+  // suppress the WARN, and the number must be the citer count, not the record count.
+  const { local, repo } = hubFixture([['twin-citer', ['local', 'repo']], ['citer-b', ['local']]]);
+  const r = archiveHub({ local, repo });
+  assertHubArchived(r, local);
+  assert.match(r.stderr, /WARN: archiving concept hub 'hub' \(2 inbound citers\)/);
+  assert.doesNotMatch(r.stderr, /\(3 inbound/, 'the raw record count (3) must never reach the message');
+  for (const d of [local, repo]) rmSync(d, { recursive: true, force: true });
+});
+
 // ============================================================================
 // (8) Consolidate — near-dupe pair flagged, no auto-merge.
 // ============================================================================
@@ -1223,6 +1292,100 @@ test('unchanged path (#1059): the flagless invocation keeps the advisory default
   rmSync(local, { recursive: true, force: true });
 });
 
+// ============================================================================
+// (Task 1.1 / #1145) `query`'s `--top-k` and `--budget` carry the SAME three-way
+// argv-boundary resolution #1059 ratified for `--target` — the two flags that fix
+// deliberately left open. Red pre-fix, every case exiting 0 with no diagnostic:
+// a bare `--top-k` took `Number(true) === 1` (a one-lesson block), while `abc`/`0`/
+// `-500` reached `records.slice(0, NaN | 0 | -500)` and rendered an EMPTY block —
+// a silently lesson-less seat prefetch. `--budget abc` (NaN) silently uncapped the
+// block instead. `parseArgv` is byte-untouched, so the flagless path is unchanged.
+// ============================================================================
+
+// Four hot facts sharing a query token — a real corpus, so any run reaching the
+// printer emits a block: an empty stdout can only come from the guard firing first.
+function queryFlagFixture() {
+  const local = tmpDir('war-query-flags-');
+  for (const s of ['alpha-fact', 'beta-fact', 'gamma-fact', 'delta-fact']) {
+    lessonFile(local, s, { description: `${s} ordering token summary`, meta: { provenance: 'code-verified' } });
+  }
+  return local;
+}
+
+const lessonLines = (stdout) => stdout.split('\n').filter((l) => l.startsWith('- ['));
+
+for (const [flag, noun] of [['top-k', 'positive count'], ['budget', 'positive byte count']]) {
+  for (const [label, valueArgs, token] of [
+    ['bare (parseArgv maps a valueless flag to boolean true)', [], 'true'],
+    ['abc (non-numeric ⇒ NaN)', ['abc'], 'abc'],
+    ['0 (zero is not positive)', ['0'], '0'],
+    ['-500 (negative)', ['-500'], '-500'],
+  ]) {
+    test(`refusal (#1145): --${flag} ${label} → exit 1, empty stdout, stderr names the flag + the token`, () => {
+      const local = queryFlagFixture();
+      const r = spawnSync(
+        'node',
+        [CLI, 'query', 'ordering token', '--local', local, `--${flag}`, ...valueArgs],
+        { encoding: 'utf8' }
+      );
+      assert.equal(r.status, 1, `expected the guard's exit 1, got ${r.status}\n${r.stdout}\n${r.stderr}`);
+      // Empty, not merely short: a refusal must not print a partial prompt block.
+      assert.equal(r.stdout, '', `expected no block bytes on stdout, got: ${r.stdout}`);
+      assert.match(r.stderr, /war-memory query:/); // the verb, per the requireLocal diagnostic shape
+      assert.ok(r.stderr.includes(`--${flag}`), `stderr must name the flag, got: ${r.stderr}`);
+      assert.ok(r.stderr.includes(noun), `stderr must name what the flag wants, got: ${r.stderr}`);
+      assert.ok(r.stderr.includes(`'${token}'`), `stderr must render the received token, got: ${r.stderr}`);
+      // The guard sits ABOVE walkCorpus, so a refusal writes nothing — and since the
+      // log dir's mkdirSync lives inside appendQueryLog, an absent log proves it too.
+      assert.equal(
+        existsSync(join(local, 'war-memory-queries.jsonl')), false,
+        'a refused query must append no query-log line'
+      );
+      rmSync(local, { recursive: true, force: true });
+    });
+  }
+}
+
+test('unchanged path (#1145): flagless output is byte-identical to an explicit-defaults invocation', () => {
+  const local = queryFlagFixture();
+  const args = [CLI, 'query', 'ordering token', '--local', local];
+  const flagless = spawnSync('node', args, { encoding: 'utf8' });
+  // built from the imported constants — a hand-typed literal would pass a changed default
+  const explicit = spawnSync(
+    'node',
+    [...args, '--top-k', String(DEFAULT_TOP_K), '--budget', String(DEFAULT_BUDGET)],
+    { encoding: 'utf8' }
+  );
+  assert.equal(flagless.status, 0, flagless.stderr);
+  assert.equal(explicit.status, 0, explicit.stderr);
+  assert.ok(lessonLines(flagless.stdout).length > 0, 'fixture must render a block for this to mean anything');
+  assert.equal(flagless.stdout, explicit.stdout);
+  rmSync(local, { recursive: true, force: true });
+});
+
+test('unchanged path (#1145): a valid --top-k caps the block; a fractional value BINDS (D3 — no integer check)', () => {
+  const local = queryFlagFixture(); // four matching lessons
+  const three = spawnSync('node', [CLI, 'query', 'ordering token', '--local', local, '--top-k', '3'], { encoding: 'utf8' });
+  assert.equal(three.status, 0, three.stderr);
+  assert.equal(lessonLines(three.stdout).length, 3);
+  // 3.5 mirrors --target's predicate exactly (finite and > 0): it binds, and slice truncates.
+  const frac = spawnSync('node', [CLI, 'query', 'ordering token', '--local', local, '--top-k', '3.5'], { encoding: 'utf8' });
+  assert.equal(frac.status, 0, `a fractional --top-k must NOT refuse\n${frac.stderr}`);
+  assert.equal(lessonLines(frac.stdout).length, 3);
+  rmSync(local, { recursive: true, force: true });
+});
+
+test('unchanged path (#1145): a valid --budget still caps the rendered block', () => {
+  const local = queryFlagFixture();
+  const wide = spawnSync('node', [CLI, 'query', 'ordering token', '--local', local], { encoding: 'utf8' });
+  const tight = spawnSync('node', [CLI, 'query', 'ordering token', '--local', local, '--budget', '90'], { encoding: 'utf8' });
+  assert.equal(tight.status, 0, tight.stderr);
+  const [w, t] = [lessonLines(wide.stdout).length, lessonLines(tight.stdout).length];
+  assert.ok(t >= 1, 'the byte budget always emits at least one lesson');
+  assert.ok(t < w, `a tight budget must cap the block (${t} vs ${w})`);
+  rmSync(local, { recursive: true, force: true });
+});
+
 // ============================================================================
 // (Task 1.1 / #992) tightenPlan's returned `verdict` is the STRICTER of the advisory
 // projection read and the effective `--target`. buildProjection is byte-untouched, so
@@ -1318,6 +1481,45 @@ test('safe-swap cross-check: buildProjection 2-col render PASSes verify; strippi
   rmSync(repo, { recursive: true, force: true });
 });
 
+// ============================================================================
+// (Task 1.1 / #1135) `lint <dir>` walks the target RECURSIVELY, so the committed
+// `archive/` subtree is covered on every surface that shares the one invocation
+// (CI, the gate wrapper, a bare interactive run) with zero edits to either.
+// Red pre-fix: the one-level readdirSync never opened archive/, so a nested
+// violation printed "lint: clean" at exit 0 — a fail-closed gate reporting green.
+// Fixture hygiene: violating shapes are ASSEMBLED AT RUNTIME under this test's own
+// mkdtemp dir, never committed .md, so they cannot trip the repo's own lint.
+// ============================================================================
+
+test('lint <dir>: an archive/-nested violation exits 1, hit path carrying the archive/ prefix (#1135)', () => {
+  const dir = tmpDir('war-lint-nested-red-');
+  lessonFile(dir, 'clean-hot', { description: 'clean prose', body: 'The renderer refuses above either hard axis.' });
+  lessonFile(join(dir, 'archive'), 'archived-violator', {
+    description: 'an archived fixture lesson',
+    body: `pasted ${'ghp_' + 'd'.repeat(36)} into the note`, // assembled here, never committed
+  });
+  const r = spawnSync('node', [CLI, 'lint', dir], { encoding: 'utf8' });
+  assert.equal(r.status, 1, `expected the fail-closed exit 1, got ${r.status}\n${r.stdout}\n${r.stderr}`);
+  assert.match(r.stdout, /github-token/); // names the pattern class
+  // ...and the FILE by its subdir-prefixed path: proof the recursion found it, not a flattened walk
+  assert.ok(
+    r.stdout.includes(join(dir, 'archive', 'archived-violator.md')),
+    `hit path must carry the archive/ prefix, got: ${r.stdout}`
+  );
+  assert.doesNotMatch(r.stdout, /lint: clean/);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test('lint <dir>: a clean nested tree still exits 0 (recursion invents no hit) (#1135)', () => {
+  const dir = tmpDir('war-lint-nested-green-');
+  lessonFile(dir, 'clean-hot', { description: 'clean prose', body: 'Archive is a file move, never a deletion.' });
+  lessonFile(join(dir, 'archive'), 'clean-cold', { description: 'clean cold prose', body: 'Cold links still resolve.' });
+  const r = spawnSync('node', [CLI, 'lint', dir], { encoding: 'utf8' });
+  assert.equal(r.status, 0, `expected exit 0, got ${r.status}\n${r.stdout}\n${r.stderr}`);
+  assert.match(r.stdout, /lint: clean/);
+  rmSync(dir, { recursive: true, force: true });
+});
+
 // ============================================================================
 // (#1081) The gate-DISCOVERED redaction-lint wrapper, war-memory-lint.test.sh.
 // In a real gate the wrapper only ever runs the live docs/learnings/ (green), so
@@ -1343,6 +1545,25 @@ test('lint wrapper: violating fixture → exit 1, offending file + pattern class
   rmSync(dir, { recursive: true, force: true });
 });
 
+test('lint wrapper: archive/-NESTED violating fixture → exit 1 propagated, subdir path on stdout (#1135)', () => {
+  // The wrapper is byte-unchanged by #1135 — it inherits the recursive walk through the
+  // one shared `lint` invocation. This case is what proves the inheritance at the surface
+  // a real gate actually runs (CI's memory-audit.yml rides the same call).
+  const dir = tmpDir('war-lint-wrapper-nested-');
+  const homeShaped = ['', 'Users', 'fixture-person', 'notes', 'draft.md'].join('/'); // assembled here, never committed
+  lessonFile(dir, 'clean-hot', { description: 'fixture lesson', body: 'no findings at the top level' });
+  lessonFile(join(dir, 'archive'), 'nested-violator', {
+    description: 'archived fixture lesson',
+    body: `captured at ${homeShaped} during the run`,
+  });
+  const r = spawnSync('bash', [LINT_WRAPPER, dir], { encoding: 'utf8' });
+  assert.equal(r.status, 1, `expected the CLI's fail-closed exit 1, got ${r.status}\n${r.stdout}\n${r.stderr}`);
+  assert.match(r.stdout, /nested-violator\.md/); // names the offending FILE
+  assert.match(r.stdout, /home-path/); // ...and the pattern class
+  assert.ok(r.stdout.includes(join('archive', 'nested-violator.md')), 'hit path carries the archive/ prefix');
+  rmSync(dir, { recursive: true, force: true });
+});
+
 test('lint wrapper: clean fixture → exit 0 and "lint: clean" on stdout', () => {
   const dir = tmpDir('war-lint-green-');
   lessonFile(dir, 'clean-lesson', { description: 'clean prose', body: 'The renderer refuses above either hard axis.' });
diff --git a/skills/lessons-learned/SKILL.md b/skills/lessons-learned/SKILL.md
index a24bbc1..27f148a 100644
--- a/skills/lessons-learned/SKILL.md
+++ b/skills/lessons-learned/SKILL.md
@@ -253,8 +253,8 @@ Before archiving anything, **check inbound links** for every `retire` / `merge`
 node "${CLAUDE_PLUGIN_ROOT}/skills/_shared/war-memory.mjs" inbound <slug> --local "$STAGING" --repo "$REPO_ROOT"
 ```
 
-- **0–1 inbound refs, no durable residue** → safe to retire.
-- **≥ 2 inbound refs** → it is a **concept hub**. A memory can be dead as a *bug warning* yet load-bearing as a *concept anchor* that siblings cite as "same family as …". **Do not delete it.** Downgrade to `keep-compress`: shrink it to a one-line `**RESOLVED (instance) — kept as concept anchor.**` stub and keep its index row.
+- **0–1 inbound citers, no durable residue** → safe to retire.
+- **≥ 2 inbound citers** → it is a **concept hub**. A memory can be dead as a *bug warning* yet load-bearing as a *concept anchor* that siblings cite as "same family as …". **Do not delete it.** Downgrade to `keep-compress`: shrink it to a one-line `**RESOLVED (instance) — kept as concept anchor.**` stub and keep its index row.
 
 **`retire` and `merge` archive, they do not delete.** A surviving hub-downgrade runs **first** (a `keep-compress` stub is never archived). For every candidate that survives the downgrade check, the action is `war-memory archive <slug>` — the lesson leaves the hot set but stays queryable in `archive/`. Knowledge is archived, never deleted (Commander's Intent: *knowledge is archived, never deleted*). A `merge` also folds the source's residue into the target first (Phase 4), then archives the source with a `merged into [[target]]` note.
 
diff --git a/skills/lessons-learned/lessons-learned-doc-contract.test.mjs b/skills/lessons-learned/lessons-learned-doc-contract.test.mjs
index 4fa23aa..3b713a5 100644
--- a/skills/lessons-learned/lessons-learned-doc-contract.test.mjs
+++ b/skills/lessons-learned/lessons-learned-doc-contract.test.mjs
@@ -85,7 +85,7 @@ test('doc-contract: verifier prompt carries the HOT/COLD/MISSING link trichotomy
   assert.match(skill, /trichotomy/i, 'the link trichotomy must be stated as such')
 })
 
-// (6) Phase 3 counts inbound refs via `war-memory inbound`, not the retired prose grep.
+// (6) Phase 3 counts inbound citers via `war-memory inbound`, not the retired prose grep.
 //     If someone reverts to `grep -rl "\[\[<slug>\]\]"`, the inbound invocation disappears
 //     and this fails. Anchored on the CLI verb + subcommand, case-tolerant on spacing.
 test('doc-contract: Phase 3 hub check invokes war-memory inbound (not the prose grep)', () => {