fix(v0.12): T04 State Engine reliability hardening and regression validation

.development-kit/workspace.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "dkf-framework": {
+      "path": ".",
+      "kind": "development-framework",
+      "dependencies": [],
+      "commands": {
+        "test": "npm run release:validate",
+        "test:orchestration": "npm run orchestration-core:validate"
+      },
+      "capabilities": [
+        "dkf-control-plane",
+        "node-runtime",
+        "release-validation"
+      ],
+      "verification": [
+        "test",
+        "test:orchestration"
+      ],
+      "adapter": null
+    }
+  }
+}

.github/workflows/ci.yml

@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
+  issues: read
 
 jobs:
   validate:
@@ -20,10 +22,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
 
@@ -83,6 +85,31 @@ jobs:
           npm run token-efficiency:test
           npm run token:audit:check
 
+      - name: Run Scale/Context Phase 0-1 baseline
+        run: node scripts/phase01-scale-context-baseline.mjs
+
+      - name: Validate Scale/Context v0.12 Phase 2 PLAN
+        run: node scripts/phase02-scale-context-plan-validate.mjs
+
+      - name: Validate v0.12 Cost Observatory increment
+        run: npm run cost-observatory:test
+
+      - name: Validate v0.12 Workspace Target Engine increment
+        run: npm run workspace-targets:test
+
+      - name: Validate v0.12 Execution Capsules & Context Cache increment
+        run: npm run execution-capsule:test
+
+      - name: Validate v0.12 State Engine V2 increment
+        run: npm run state-engine-v2:test
+
+      - name: Validate cross-owner legacy restore metadata
+        if: ${{ matrix.os == 'ubuntu-latest' && github.event.pull_request.head.repo.full_name == github.repository }}
+        run: sudo "$(command -v node)" --test --test-name-pattern='T04-H30' scripts/state-engine-v2-migration.test.mjs
+
+      - name: Benchmark v0.12 State Engine V2 append endurance
+        run: npm run state-engine-v2:benchmark
+
       - name: Validate Design Authority governance
         run: npm run design-authority:validate
 
@@ -91,3 +118,39 @@ jobs:
 
       - name: Validate exact release command
         run: npm run release:validate
+
+  t04_acceptance:
+    name: T04 independently reviewed acceptance
+    if: ${{ github.event_name == 'pull_request' && github.head_ref == 'fix/v0.12-t04-state-engine-hardening' }}
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    steps:
+      - name: Check out validated source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+
+      - name: Materialize source-bound T04 Development Contract
+        run: node scripts/phase06-state-engine-v2-contract.mjs
+
+      - name: Verify independent reviews and compute deterministic T04 acceptance
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node scripts/t04-hardening-acceptance-gate.mjs
+
+      - name: Retain independent risk-3 acceptance evidence
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
+        with:
+          name: t04-hardening-acceptance
+          path: .development-kit/runs/INC-DKF120-T04/T04-HARDENING-REVIEWED-20261009/
+          retention-days: 30
+          include-hidden-files: true
+          if-no-files-found: error

.gitignore

@@ -30,5 +30,7 @@ desktop.ini
 .development-kit/runs/
 .development-kit/decisions/
 .development-kit/secrets/
+.development-kit/telemetry/
+.development-kit/state/
 freebuff-chat-*.md
 

docs/03-reference/scripts/README.md

@@ -22,3 +22,13 @@ Development Kit ships **9 primary non-test Node.js scripts** in `scripts/`, expo
 - `install-antigravity.mjs` — exits 1 when no target is found and none requested; 0 otherwise
 
 See [validation-architecture.md](../../04-architecture/validation-architecture.md) for how the scripts fit together.
+
+## Additional v0.12 Verification
+
+- **State Engine V2 endurance:** `npm run state-engine-v2:benchmark` — 300-transition disposable fixture on the Windows/Ubuntu CI matrix. See [state-engine-v2-benchmark.md](state-engine-v2-benchmark.md). The resulting timings are observations, not release performance acceptance.
+
+- **T04 risk-3 runtime acceptance:** `node scripts/t04-hardening-acceptance-gate.mjs` — GitHub Actions-only, after exact release gates; validates immutable reviewed source, creates persisted DKF verification/security/acceptance records and uploads CI evidence. See [t04-hardening-acceptance-gate.md](t04-hardening-acceptance-gate.md).
+
+- **T04 reviewer-thread safety:** `node --test scripts/t04-review-thread-blockers.test.mjs` — proves every unresolved code-review thread, including P2 and unclassified findings, blocks independent acceptance. See [t04-review-thread-blockers.md](t04-review-thread-blockers.md).
+
+- **Windows restore rollback:** `scripts/windows-durable-rename.ps1` — native Win32 write-through directory move used for recovery, with explicit platform guarantees and review limitations. See [windows-durable-rename.md](windows-durable-rename.md).

docs/03-reference/scripts/phase01-scale-context-baseline.md

@@ -0,0 +1,51 @@
+# phase01-scale-context-baseline.mjs
+
+## Purpose
+
+`scripts/phase01-scale-context-baseline.mjs` is an analysis-only baseline runner for the Development Kit Scale, Context & Iteration initiative.
+
+It measures the current framework before implementation changes are made. The script does not modify DKF production runtime behaviour, change package versions, publish releases, or mutate repository state outside temporary test fixtures.
+
+## What it measures
+
+The runner records:
+
+- repository, test, and canonical instruction-file inventory;
+- the existing deterministic token/context audit;
+- representative single-package context packaging;
+- representative multi-package context packaging;
+- representative calculation-heavy context packaging;
+- Autopilot state-file growth across 26 immutable revisions;
+- current observability gaps for provider token usage, repository reads/scans, agent invocations, and host tool calls.
+
+## Representative fixtures
+
+The fixtures are synthetic and deterministic. They exercise the existing DKF runtime APIs rather than claiming to reproduce provider billing or a specific production repository exactly.
+
+The multi-package fixture contains web, mobile, shared, calculation, and database-style paths. The calculation-heavy fixture establishes a baseline before domain/numerical gate profiles exist.
+
+## Usage
+
+Print JSON to standard output:
+
+```bash
+node scripts/phase01-scale-context-baseline.mjs
+```
+
+Optionally persist the JSON output:
+
+```bash
+node scripts/phase01-scale-context-baseline.mjs --out=path/to/baseline.json
+```
+
+## Measurement rules
+
+The runner reuses `scripts/token-audit.mjs` and the existing `runtime/orchestration/token-efficiency.mjs` estimator.
+
+Estimated token values therefore remain deterministic `ceil(characters / 4)` approximations and must not be represented as provider billing-token counts.
+
+Metrics that the current runtime cannot observe are emitted as unavailable with a reason instead of being estimated or fabricated.
+
+## Scope
+
+This script belongs to Phase 0/1 evidence gathering only. Later Cost Observatory work may extend or replace parts of this runner after the baseline has been preserved.

docs/03-reference/scripts/phase02-scale-context-plan-validate.md

@@ -0,0 +1,42 @@
+# phase02-scale-context-plan-validate.mjs
+
+## Purpose
+
+`scripts/phase02-scale-context-plan-validate.mjs` validates the machine-readable Development Kit v0.12.0 Scale, Context & Iteration PLAN using the existing deterministic `runtime/orchestration/plan-validator.mjs`.
+
+It is a Phase 2 planning validator. It does not implement v0.12 runtime functionality.
+
+## Authoritative PLAN model
+
+```text
+docs/04-architecture/dkf-scale-context-iteration-v0.12-plan-model.json
+```
+
+## Validation performed
+
+The script checks:
+
+- declared task count;
+- dependency references;
+- dependency cycles;
+- declared dependency graph versus computed graph;
+- required logical resource ownership;
+- duplicate resource ownership;
+- acceptance-criterion coverage;
+- configuration dependency validity.
+
+The acceptance-criterion authority comes from the reconciled v0.12 specification.
+
+## Usage
+
+```bash
+node scripts/phase02-scale-context-plan-validate.mjs
+```
+
+The command prints the complete deterministic validation report as JSON and exits non-zero when the PLAN is invalid.
+
+## Scope
+
+This validator intentionally reuses the existing DKF PLAN validation engine instead of creating a second planning model.
+
+A green result proves structural PLAN consistency. It does not replace specification review, architecture review, implementation verification, or Product Owner release approval.

docs/03-reference/scripts/phase03-cost-observatory-contract.md

@@ -0,0 +1,47 @@
+# phase03-cost-observatory-contract.mjs
+
+## Purpose
+
+`scripts/phase03-cost-observatory-contract.mjs` creates or reuses the Development Contract for **DKF120-T01 — Cost Observatory**.
+
+The contract is normal DKF runtime state and is persisted under:
+
+```text
+.development-kit/contracts/INC-DKF120-T01/
+```
+
+That directory remains git-ignored. The script itself is committed so contract construction is reproducible from the authoritative v0.12 sources.
+
+## Authoritative sources
+
+The contract binds:
+
+- the v0.12 Scale, Context & Iteration specification;
+- the v0.12 technical design;
+- the validated v0.12 implementation PLAN;
+- the Phase 0/1 baseline evidence.
+
+Whole-file fingerprints remain authoritative even when the contract requests selected sections for context delivery.
+
+## Acceptance criteria
+
+The T01 contract owns:
+
+- `DKF-120-AC-001`
+- `DKF-120-AC-002`
+- `DKF-120-AC-003`
+- `DKF-120-AC-033`
+
+## Usage
+
+```bash
+node scripts/phase03-cost-observatory-contract.mjs
+```
+
+The script validates the resulting contract and immediately verifies that it is not stale.
+
+If an existing contract has become stale, normal DKF stale-contract handling applies; the script does not silently overwrite it.
+
+## Boundary
+
+This script authorises only T01 Cost Observatory work. It does not authorise T02 or later v0.12 increments.

docs/03-reference/scripts/phase04-workspace-target-engine-contract.md

@@ -0,0 +1,60 @@
+# phase04-workspace-target-engine-contract.mjs
+
+## Purpose
+
+`scripts/phase04-workspace-target-engine-contract.mjs` creates or reuses the Development Contract for **DKF120-T02 — Workspace Target Engine**.
+
+The contract is persisted through the normal DKF runtime contract store under:
+
+```text
+.development-kit/contracts/INC-DKF120-T02/
+```
+
+That runtime directory remains git-ignored.
+
+## Bootstrap note
+
+T02 introduces Workspace Target Engine support itself.
+
+Therefore the T02 Development Contract is created **without** a workspace target binding. This is intentional bootstrap behaviour: target binding cannot be mandatory for the increment that first creates the target engine.
+
+After T02 acceptance, target-aware Development Contracts may bind:
+
+- primary target;
+- affected targets;
+- verification targets;
+- the exact workspace-registry fingerprint.
+
+A later change to that registry then makes the target-aware contract stale.
+
+## Authoritative sources
+
+The contract binds:
+
+- the v0.12 Scale, Context & Iteration specification;
+- the v0.12 technical design;
+- the validated v0.12 implementation PLAN;
+- accepted T01 evidence;
+- the Phase 0/1 multi-package baseline.
+
+## Acceptance criteria
+
+The T02 contract owns:
+
+- `DKF-120-AC-004`
+- `DKF-120-AC-005`
+- `DKF-120-AC-006`
+- `DKF-120-AC-007`
+- `DKF-120-AC-039`
+
+## Usage
+
+```bash
+node scripts/phase04-workspace-target-engine-contract.mjs
+```
+
+The script validates the contract, confirms its derived gates, and verifies that it is not stale.
+
+## Boundary
+
+This script authorises only T02 Workspace Target Engine work. It does not authorise T03 or later v0.12 increments.