fix(engine): fourteen defects found by running v0.21.0 on a live 30B, plus frontend assemblers

Everything here was found by driving the harness against a real local stack —
oMLX serving Qwen3-Coder-30B — rather than by reading the code. Each fix names
the measurement that produced it, and each carries a regression test that fails
without it.

── The gates were not gating ─────────────────────────────────────────────────

Executable acceptance criteria were discarded before they could run.
collapseToWorker rebuilt the surviving task without Criteria, so whenever the
splitter's tasks collapsed — the common shape on a small model — every criterion
the model authored was dropped. Measured: the 30B emitted correct criteria with
`go test ./...` as the verify command, and the run reached the reviewer with
nothing to check, indistinguishable from a task that passed.

A green test command that ran no tests counted as verification. classifySmoke
checked sr.OK before the no-tests check, and `go test ./...` on a tree with no
_test.go files exits ZERO — so the gate's own documented contract ("a 'nothing
to run' exit is NoTests, never Green") held only for runners that fail on empty.
Measured: a run told "both parts must have tests" wrote none and finished ✔ with
qa_gate green.

A forged criteria header could switch the criteria gate off. A worker that
merely echoed "## Acceptance criteria" suppressed the review-time gate, and with
nothing run CriteriaUnverifiedInOutput stayed false — the value that ALLOWS the
reviewer fast path. The section's provenance stamp is now required.

Criteria that could never run. Told only in the abstract to write a runnable
verify command, the 30B wrote `go test -v ./... | grep -E '(TestX|PASS|FAIL)'`;
the sanitizer refuses shell metacharacters, so every criterion on that board came
back UNVERIFIED. The splitter now gets the concrete ✓/✗ example, and its own
prompt budget — it is paid once per split, as the composer is paid once per run.

── The board could deadlock, and correction aimed at the wrong files ─────────

runWave is synchronous, so nothing is in flight at the top of the scheduler
loop — yet a task left in in_progress/in_review still made AgentWorkRemaining
report work in progress, and no path re-dispatches those columns. Measured: one
stranded task, four dependents frozen behind it, ~9 minutes of correct work
discarded and reported as a failure with the edit already on disk and compiling.
Orphans are re-queued, bounded by the existing attempt ceiling.

When the QA gate stayed red, the synthesized verdict carried the literal string
"qa_gate red" — and the corrective rewrite scopes its fix by mining file paths
out of those failure strings, so a verdict naming no file fell back to "whatever
finished most recently". Measured: three correction rounds scoped to pkg/tasks
while every compiler error was in cmd/server/main.go, which none of them was
allowed to touch.

A dev server was accepted as a verification. `npm run` is whitelisted because
`npm run lint` and `npm run typecheck` are exactly what the gate should run;
`npm run dev` shares that prefix and never returns. Measured: a splitter wrote
"npm run dev passes" as a tester task's acceptance, which is not a proposition
that can pass. Refusing the non-terminating scripts is what makes it safe to
admit `npm run`/`yarn run`/`pnpm run` as verify commands at all — so "the
project builds" can now be proven instead of reported UNVERIFIED.

── Routing was configured, displayed, and then not used ─────────────────────

runner.HasRole was wired only inside the escalation branch, so on any install
without a model_escalation ladder — nearly all of them — every feature that asks
"is this agent registered?" answered no.

normalizeExecRole applied execute.default_role only to an EMPTY role, but
Task.Normalize fills empty roles with "worker" first, so the chosen language
specialist was displayed in the composition and never used. Tasks now route to
the specialist that owns their files, which is also what lets a mixed Go + React
board run on two specialists at once.

doctor printed "agents inherit stack/global LLM" unconditionally — false as soon
as model_roles pins a role — and validated nothing, so a typo'd model passed at
100/100 and failed mid-run at the reviewer. Both routing keys are now shown,
every model they name is checked against what the endpoint serves, and an
unserved one is a readiness finding (measured: 100 → 86).

`slmcode agent list` showed 20 of 59 agents: block-defined agents were
registered by the orchestrator and invisible to the command that lists them.

── Greenfield work could not start, and duplicated itself when it did ───────

Greenfield Go and web paths were dropped: isGreenfieldCreatePath accepted
main.py but not main.go, and knew no cmd/, pkg/ or web/. Measured: a full-stack
request finished 0 of 7 tasks with nothing on disk, because every planned path
was discarded and a worker forbidden to invent paths had nothing it was allowed
to write. Fixing it made the same request produce a compiling Go backend and a
React frontend. The fix itself is upstream's — see the rebase note below; what
remains here are the tests that pin the behaviour.

Two prompt few-shot examples were being copied as real work: the splitter
planned "add Sum to calc.go" verbatim from its own example on a greenfield
request, and the composer's handoff carried "verify with go test ./..." into a
React run for the same reason. Both are now shapes, not content.

Duplicate workers on one file each cost a full wave and opened a file the
previous one had rewritten. Same-file worker tasks now merge — on the primary
target or the whole set — with dependencies rewritten onto the survivor.
Measured: one query went from six tasks to three.

Workers wrote against types they had never read. Rule 1 said "ws_read a file
before editing it" — nothing about USING one. Measured: a worker scoped to
cmd/server/main.go used task.Title/CreatedAt/UpdatedAt on a Task a sibling task
had defined with three other fields.

── Frontend assemblers ──────────────────────────────────────────────────────

Two packs that build React UI by INSTALLING components with the library's own
CLI and wiring them up, instead of writing them from scratch: shadcn/ui and
Untitled UI. Hand-writing a dialog with focus traps is where a 7-32B model
spends its runway; imports, props and layout is what it is good at.

Both ship enabled — nothing to install, nothing to apply. The method is chosen
from evidence and announced: the request wins first (name a library, or say
"from scratch"), then the project's own markers, then greenfield defaults to
assembling; an existing app with no markers keeps writing by hand.

Each pack carries an assembly reviewer that rejects a component hand-rolled when
the registry already had it, and per-library gates. Both CLIs were driven for
real to write the agents: shadcn's `init` needs an explicit -b or it stops on an
interactive menu even with -y, and Untitled UI matches names fuzzily and wrongly
(`buttons` installs app-store-buttons, and it does not error).

Shell access is scoped rather than opened. npx stays an executor; five
subcommands of two named packages are allowed, matched structurally so
`npx shadcn add`, `npx --yes shadcn@latest add` and the legacy shadcn-ui name all
work. An `add` naming a URL, an @registry or a local path is refused — both CLIs
accept those where a component name goes, and they resolve to a registry nobody
reviewed. Also fixed: `npx tsc --noEmit` was refused (the packs' own typecheck
and qa_gate — those tools live in node_modules, never on PATH), and a bare
`npx tsc` prefix also admitted `npx tsc-evil`, since matching is HasPrefix.

── Verification ─────────────────────────────────────────────────────────────

Local gate green on the frozen tree: gofmt, vet, golangci-lint (0 issues), the
full unit suite, -race, go mod tidy, the Studio UI (lint/typecheck/test/build),
govulncheck (no vulnerabilities), and coverage at 67.6% against a 63.0% floor.

Live end-to-end against oMLX + Qwen3-Coder-30B: a Go bug fix with criteria
verified 3 passed / 0 failed / 0 unverified, worktree isolation leaving the
origin untouched and committing no harness state, per-role model routing, and
the shadcn assembler installing a component with the CLI and wiring it into a
page that typechecks.

── Rebased onto 32 upstream commits ─────────────────────────────────────────

Three conflicts, resolved in upstream's favour where it had built the better
mechanism:

- Greenfield paths. Upstream added a state-aware rule — isGreenfieldRoot plus
  looksLikeSourceTarget — that is permissive in a genuinely empty repository and
  conservative once there is code in it. That is strictly better than the
  unconditional allowlist here, which would have blessed a claimed-but-absent
  cmd/server/main.go in an ESTABLISHED repo. The additions to
  isGreenfieldCreatePath are dropped; the tests that cover the behaviour stay
  and pass against upstream's rule.
- Per-task specialist routing. Upstream staffs each task at board level
  (routeBoardToSpecialists), which sets task.Role. specializeExecRole only ever
  replaces a GENERIC role, so it defers to that and fills in where board-level
  staffing did not run — which is also what the frontend assembler hooks into.
- The QA-gate verdict. Upstream's integration-failure branch and the real
  failure payload are both kept: the guard decides WHETHER to re-enter the
  tester path, and the payload decides what it is told when it does.

Gate green on the rebased tree: lint, the full unit suite, -race, and coverage
at 69.0% against a 63.0% floor.

Author: piotrlaczkowski

README.md

@@ -49,6 +49,7 @@ Fork it. Break it. Point it at whatever LLM you have. 🚀
 | 📐 **Context budgeted in tokens, not bytes** | The pack budget is derived from the model's real context window minus system prompt, tool schemas and response reserve. Assembly is byte-deterministic with a stable prefix so local KV-cache prefixes actually hit. A tree-sitter-free repo map ranks files by PageRank over a symbol reference graph. |
 | 🧠 **It gets better at your repo** | Four memory layers, failure fingerprinting, and a repair-rule store: a given failure mode costs an LLM round-trip **once**. A Thompson-sampling bandit learns which harness settings work for your model family and language. All of it is plain JSON under `.slmcode/`, and deleting it is supported. |
 | 🛡️ **Gates that fail closed** | Disk state is authoritative — a claimed edit that is not on disk does not pass. Truncated reviewer JSON fails closed. The QA gate cannot report green when tests fail. A HITL gate with a human attached blocks instead of expiring into an auto-approval. |
+| 🎨 **Frontends get assembled, not hand-written** | Ask for React UI and SLMCode installs reviewed components with the library's own CLI — `npx shadcn@latest add button dialog` — then wires and styles them. Hand-writing a dialog with focus traps is where a 7–32B model burns its runway; imports, props and layout is what it is good at. Both **shadcn/ui** and **Untitled UI** ship enabled, with a reviewer that rejects a component you hand-rolled when the registry already had it. Say *from scratch* to opt out. |
 | 🖥️ **Two front ends** | A non-blocking terminal REPL (Esc to interrupt and redirect mid-run, `/` fuzzy command picker, real unified diffs, interactive `slmcode apply`) and **Studio**, an offline React SPA with a live SSE feed, a pending-change review UI and run traces. |
 
 ---

cmd/slmcode/cmd_agent.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/UnicoLab/slmcode/pkg/agents"
+	"github.com/UnicoLab/slmcode/pkg/blocks"
 	"github.com/UnicoLab/slmcode/pkg/cli"
 	"github.com/UnicoLab/slmcode/pkg/config"
 )
@@ -150,6 +151,14 @@ func agentList(cmd *cobra.Command, args []string) error {
 		return err
 	}
 	custom, _ := cli.LoadProjectCustoms(ws.Config.AgentsDir())
+	// Block-defined agents too, exactly as the orchestrator registers them.
+	// Without this the list shows only the ~20 built-ins and whatever is on
+	// disk under .slmcode/agents, while a run happily dispatches to go-worker,
+	// react-tester or shadcn-worker — agents this command told the operator do
+	// not exist. `slmcode agent list` is the roster; a roster that omits every
+	// language specialist and both frontend assemblers is how an operator
+	// concludes a feature is missing when it is merely undisplayed.
+	custom = append(custom, blockAgentSpecs(ws.Config.Root, custom)...)
 	cli.Header("Agents")
 	if ws.Config.ActiveStack != "" {
 		cli.KeyVal("active_stack", ws.Config.ActiveStack)
@@ -187,3 +196,31 @@ func applyAgentFields(c *agents.CustomSpec, fields map[string]string) {
 		}
 	}
 }
+
+// blockAgentSpecs returns the agent blocks the registry would register, minus
+// any id already present on disk — on-disk definitions win, the same precedence
+// the factory applies via ExtraCustoms.
+func blockAgentSpecs(root string, have []agents.CustomSpec) []agents.CustomSpec {
+	reg, err := blocks.Load(root)
+	if err != nil || reg == nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	for _, c := range have {
+		seen[strings.ToLower(strings.TrimSpace(c.ID))] = true
+	}
+	var out []agents.CustomSpec
+	for _, ab := range reg.Agents {
+		spec := ab.Spec
+		if err := agents.NormalizeCustom(&spec); err != nil {
+			continue
+		}
+		id := strings.ToLower(strings.TrimSpace(spec.ID))
+		if id == "" || seen[id] {
+			continue
+		}
+		seen[id] = true
+		out = append(out, spec)
+	}
+	return out
+}

cmd/slmcode/cmd_util.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -494,9 +495,10 @@ func runDoctor() error {
 	if len(pinned) > 0 {
 		fmt.Println(cli.Warn(fmt.Sprintf("agents pinning LLM (override stack): %s", strings.Join(pinned, ", "))))
 		fmt.Println(cli.Dim("  tip: slmcode stack apply <name> --clear-agent-llm   or   slmcode agent clear-llm <id>"))
-	} else {
+	} else if len(ws.Config.ModelRoles) == 0 && len(ws.Config.ModelEscalation) == 0 {
 		fmt.Println(cli.Success("agents inherit stack/global LLM"))
 	}
+	reportModelRouting(ws.Config)
 	// .slmcode/auth.json holds provider API keys; `slmcode commit` runs
 	// `git add -A`, so an un-ignored .slmcode is a real leak path.
 	if gs := gitignoreStatus(ws.Config.Root, ws.Config.SlmDir()); gs["ok"] != true {
@@ -832,3 +834,71 @@ func providerRejectedAuth(check readiness.Check) bool {
 	code, _ := strconv.Atoi(m[1])
 	return code == 401 || code == 403
 }
+
+// reportModelRouting shows model_roles / model_escalation and checks that every
+// model they name is actually served.
+//
+// Two things were invisible before. "agents inherit stack/global LLM" was
+// printed unconditionally, which is simply false once model_roles pins a role —
+// the one line an operator reads to learn where their models go said the
+// opposite of the truth. And nothing validated the names: a typo in a pinned
+// model passed doctor at 100/100 and then failed mid-run, at the reviewer, after
+// minutes of real work. The model list is already fetched to answer "is the
+// main model available"; checking three more names against it costs nothing.
+func reportModelRouting(cfg *config.Config) {
+	if cfg == nil || (len(cfg.ModelRoles) == 0 && len(cfg.ModelEscalation) == 0) {
+		return
+	}
+	// Every distinct model the routing config names, in a stable order.
+	wanted := map[string][]string{} // model → the roles/rungs that name it
+	roles := make([]string, 0, len(cfg.ModelRoles))
+	for role := range cfg.ModelRoles {
+		roles = append(roles, role)
+	}
+	sort.Strings(roles)
+	for _, role := range roles {
+		m := strings.TrimSpace(cfg.ModelRoles[role])
+		if m != "" {
+			wanted[m] = append(wanted[m], "@"+role)
+		}
+	}
+	for i, m := range cfg.ModelEscalation {
+		if m = strings.TrimSpace(m); m != "" {
+			wanted[m] = append(wanted[m], fmt.Sprintf("escalation rung %d", i+1))
+		}
+	}
+	if len(wanted) == 0 {
+		return
+	}
+	for _, role := range roles {
+		cli.KeyVal("model_role", "@"+role+" → "+cfg.ModelRoles[role])
+	}
+	if len(cfg.ModelEscalation) > 0 {
+		cli.KeyVal("model_escalation", strings.Join(cfg.ModelEscalation, " → "))
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	served, err := models.Fetch(ctx, cfg)
+	if err != nil || len(served) == 0 {
+		fmt.Println(cli.Dim("  routed models not verified — the endpoint did not list its models"))
+		return
+	}
+	have := make(map[string]bool, len(served))
+	for _, m := range served {
+		have[strings.ToLower(strings.TrimSpace(m))] = true
+	}
+	var missing []string
+	for m, users := range wanted {
+		if !have[strings.ToLower(m)] {
+			missing = append(missing, fmt.Sprintf("%s (%s)", m, strings.Join(users, ", ")))
+		}
+	}
+	sort.Strings(missing)
+	if len(missing) > 0 {
+		fmt.Println(cli.Warn("routed model not served: " + strings.Join(missing, "; ")))
+		fmt.Println(cli.Dim("  the run will fail when it reaches that role — fix the name or load the model"))
+		return
+	}
+	fmt.Println(cli.Success(fmt.Sprintf("every routed model is served (%d)", len(wanted))))
+}

docs/blocks.md

@@ -60,7 +60,7 @@ shareable: true           # marketplace-ready flag (default: true)
 
 ## Predefined Language Packs (Builtin)
 
-SLMCode ships **thirteen** language packs. Each one is a `pack` block composing a pipeline, a
+SLMCode ships **fifteen** packs. Each one is a `pack` block composing a pipeline, a
 quality block and language-aware agents; `slmcode init` picks one automatically (see
 [Detection](#detection-how-a-pack-is-chosen)).
 
@@ -79,9 +79,18 @@ quality block and language-aware agents; `slmcode init` picks one automatically
 | 🐘 `php` | php | `php-worker` `php-tester` | `vendor/bin/phpunit --colors=never` | `vendor/bin/phpunit --colors=never` |
 | 🕊️ `swift` | swift | `swift-worker` `swift-tester` | `swift build` | `swift test` |
 | ⚙️ `cpp` | cpp | `cpp-worker` `cpp-tester` | `cmake --build build` | `ctest --test-dir build --output-on-failure` |
+| 🧩 `shadcn` | typescript | `shadcn-worker` `shadcn-reviewer` `react-tester` | `npx tsc --noEmit` | `npx tsc --noEmit` |
+| 🎨 `untitledui` | typescript | `untitledui-worker` `untitledui-reviewer` `react-tester` | `npx tsc --noEmit` | `npx tsc --noEmit` |
 
 `slmcode blocks list` prints the live set; this table is a snapshot of it.
 
+!!! tip "shadcn and untitledui are *methods*, not languages"
+    The last two build React UI by **installing** components with the library's own
+    CLI and wiring them up, rather than writing them by hand. You do not have to
+    apply them: both are chosen automatically from the request and the project, and
+    their agents ship registered. Applying one just pins the choice for good.
+    See [Frontend: assemble or write](frontend.md).
+
 Every pack also pins skills (`pin_skills: true`) — always `atomic-coding`, `specialist-worker`
 and `specialist-tester`, plus language-specific ones: `go` adds `go-table-tests` and
 `go-concurrency`, `typescript` adds `typescript-strict`, `react` adds `react-hooks` and

docs/changelog.md

@@ -592,6 +592,147 @@ the failures felt like noise rather than progress:
   they are and not to repeat the last one; and the same unresolved defect
   reopens its existing ticket instead of stacking a new one every gate run,
   which is what made the board look like it was losing ground.
+### Fixed — found by running v0.21.0 on a live 30B
+
+Everything in this subsection was found by driving the harness against a real
+local stack — oMLX serving Qwen3-Coder-30B — rather than by reading the code.
+Each item names the measurement that produced it.
+
+### Fixed — the harness
+
+- **Executable acceptance criteria were discarded before they could run.**
+  `collapseToWorker` rebuilt the surviving task without `Criteria`, so whenever
+  the splitter's tasks collapsed — the common shape on a small model — every
+  criterion the model authored was dropped. Measured: the 30B emitted correct
+  criteria with `go test ./...` as the verify command, and the run reached the
+  reviewer with nothing to check, indistinguishable from a task that passed.
+- **Harness state followed the sandbox under `--isolate worktree`.** Memory,
+  the derived graph and the metrics row take a project root and join
+  `<root>/.slmcode/…` themselves, so they never saw `StateDir`. The isolated
+  run wrote them into the throwaway worktree: an orphan directory survived every
+  run (a late write re-created the directory git had just removed), and
+  `git add -A` swept nine `.slmcode/**` files into the commit merged onto the
+  operator's branch. New `Config.StateRoot()`; the isolated commit now carries
+  only source.
+- **A green test command that ran no tests counted as verification.**
+  `classifySmoke` checked `sr.OK` before the no-tests check, and `go test ./...`
+  on a tree with no `_test.go` files exits **zero** — so the gate's own
+  documented contract ("a 'nothing to run' exit is NoTests, never Green") held
+  only for runners that fail on empty. Measured: a run told "both parts must
+  have tests" wrote none and finished ✔ with `qa_gate green`.
+- **The board could deadlock on an abandoned task.** `runWave` is synchronous,
+  so nothing is in flight at the top of the scheduler loop — yet a task left in
+  `in_progress`/`in_review` still made `AgentWorkRemaining` report work in
+  progress, and no path re-dispatches those columns. Measured: one stranded
+  task, four dependents frozen behind it, ~9 minutes of correct work discarded
+  and reported as a failure with the edit already on disk and compiling.
+  Orphans are now re-queued, bounded by the existing attempt ceiling.
+- **The composer could drop the coordinator.** `applyBudgetClass` is applied to
+  the heuristic composition only, so the class could budget `coord` and the
+  composer silently omit it — 3 live runs out of 3. Coordination is restored
+  because @coordinator acts on the *board*, which does not exist yet when the
+  composer decides.
+- **Per-file specialist routing and the model ladder were both dead by
+  default.** `runner.HasRole` was only wired inside the escalation branch, so
+  on any install without a `model_escalation` ladder — nearly all of them —
+  every feature that asks "is this agent registered?" answered no.
+- **A task's role never reached its language specialist.** `normalizeExecRole`
+  applied `execute.default_role` only to an *empty* role, but `Task.Normalize`
+  fills empty roles with `worker` first, so the chosen specialist was displayed
+  in the composition and never used. Tasks now route to the specialist that owns
+  their files, which is also what makes a mixed Go + React board run on two
+  specialists at once.
+- **Duplicate workers on one file.** Two tasks scoped to the same file cannot
+  share a wave (concurrent workers share one tree), so each cost a full wave and
+  the second opened a file the first had rewritten. Same-file worker tasks now
+  merge, with dependencies rewritten onto the survivor.
+- **Greenfield Go and web paths were dropped.** `isGreenfieldCreatePath`
+  accepted `main.py` but not `main.go`, and knew no `cmd/`, `pkg/` or `web/`.
+  Measured: a full-stack request finished **0 of 7 tasks with nothing on disk**,
+  because every planned path was discarded and a worker forbidden to invent
+  paths had nothing it was allowed to write. After the fix the same request
+  produced a compiling Go backend and a React frontend.
+- **Two prompt few-shot examples were being copied as real work.** The splitter
+  planned "add Sum to calc.go" — verbatim from its own example — on a greenfield
+  request, and the composer's handoff carried `verify with go test ./...` into a
+  React run for the same reason. Both examples are now shapes, not content.
+- **A refusal never said what it refused.** `"npx" can execute arbitrary code`
+  is unanswerable when npx runs a different program every invocation; refusals
+  now quote the command.
+- **`slmcode agent list` showed 20 of 59 agents.** Block-defined agents — every
+  language specialist and both frontend assemblers — were registered by the
+  orchestrator and invisible to the command that lists the roster.
+
+- **`npx tsc --noEmit` was refused.** The bare `tsc` and `eslint` were already
+  builtin-safe, but their npx forms were not — and in a JS/TS project those
+  tools live in `node_modules`, never on PATH, so the npx spelling is the only
+  one that runs. It is the react and shadcn packs' own typecheck and `qa_gate`.
+  Measured: a live assembler run was refused for its own smoke command.
+- **A whitelisted prefix matched past a word boundary.** `npx tsc` also admitted
+  `npx tsc-evil` — any package whose name merely starts the same way — because
+  matching is a plain prefix test. The builtin list already carries trailing
+  spaces (`tsc `, `eslint `, `find `) for exactly this; the npx entries now do
+  too, and the same hole is closed in the `react` and `typescript` quality
+  packs.
+- **A forged criteria header could switch the criteria gate off.** A worker that
+  merely echoed `## Acceptance criteria` — plausible, since the reviewer
+  contract in its own prompt names that heading — suppressed the review-time
+  gate, and with nothing run `CriteriaUnverifiedInOutput` stayed false, which is
+  the value that ALLOWS the reviewer fast path. The section's provenance stamp
+  is now required, so a genuine section is still recognized (and its commands
+  still not re-run) while a typed one is not.
+- **`model_roles` and `model_escalation` were invisible to `doctor`.** It
+  printed "agents inherit stack/global LLM" unconditionally — false as soon as a
+  role is pinned — and validated nothing, so a typo'd model passed at 100/100
+  and failed mid-run at the reviewer. Both are now shown, every model they name
+  is checked against what the endpoint serves, and an unserved one is a
+  readiness finding (measured: 100 → 86) rather than a surprise.
+- **Criteria that could never run.** Told only in the abstract to write a
+  runnable verify command, a live 30B wrote
+  `go test -v ./... | grep -E '(TestX|PASS|FAIL)'`; the sanitizer refuses shell
+  metacharacters, so every criterion on that board came back UNVERIFIED. The
+  splitter now gets the concrete ✓/✗ example, and its own prompt budget — it is
+  paid once per split, like the composer is paid once per run.
+
+- **Correction rounds aimed at the wrong files.** When the QA gate stayed red,
+  the synthesized tester verdict carried the literal string `"qa_gate red"` —
+  and the corrective rewrite scopes its fix by mining file paths out of those
+  failure strings, so a verdict naming no file fell back to "whatever finished
+  most recently". Measured on a greenfield Go build: three correction rounds
+  scoped to `pkg/tasks` while every compiler error was in `cmd/server/main.go`,
+  which none of them was allowed to touch. The gate's own output is now carried
+  through, so the fix is scoped at the file that is actually broken.
+- **Workers wrote against types they had never read.** Rule 1 said "ws_read a
+  file before editing it" — nothing about *using* one. Measured: a worker
+  scoped to `cmd/server/main.go` used `task.Title`, `task.CreatedAt` and
+  `task.UpdatedAt` on a `Task` that a sibling task had defined with three other
+  fields, and the package would not compile. Reads were never scope-limited;
+  the worker simply had no instruction to use them for cross-file APIs.
+
+### Added — frontend assemblers
+
+- **`shadcn` and `untitledui` packs: build React UI by INSTALLING components.**
+  Hand-writing a dialog with focus traps is where a 7–32B model spends its
+  runway; installing a reviewed one and wiring it up is imports, props and
+  layout. Both ship enabled — nothing to install, nothing to apply — with a
+  worker, an assembly reviewer that rejects a component you hand-rolled when the
+  registry already had it, a pipeline and quality gates.
+- **The method is chosen from evidence and announced.** Your request wins first
+  (name a library, or say *from scratch*), then the project's own markers, then
+  greenfield defaults to assembling; an existing app with no markers keeps
+  writing by hand. The run prints which and why.
+- **Scoped shell access.** `npx` stays an executor; five subcommands of two
+  named packages are allowed, matched structurally so `npx shadcn add`,
+  `npx --yes shadcn@latest add` and the legacy `shadcn-ui` name all work. An
+  `add` naming a URL, an `@registry`, or a local path is refused — both CLIs
+  accept those in the same position as a component name, and they resolve to a
+  registry nobody reviewed.
+- The assembler agents carry each CLI's real contract, verified by running them:
+  shadcn's `init` needs an explicit `-b` or it stops on an interactive menu even
+  with `-y`; Untitled UI matches names fuzzily and wrongly (`buttons` installs
+  `app-store-buttons`, and it does not error).
+- See [Frontend: assemble or write](frontend.md).
+
 ## v0.21.0 — 2026-08-27
 
 Adapts the structural ideas from [zeroshot](https://github.com/the-open-engine/zeroshot)'s