Strengthen workflow evidence contracts

en/.github/pull_request_template.md

@@ -34,7 +34,7 @@ plans, historical drafts, or local uncommitted content.
 
 ## 7. Review / Fix Record
 
-<!-- For each finding ID, record severity, evidence, judgment, fix, and recheck result. If there are no findings, list the high-risk areas checked. Do not add a duplicate reconciliation ledger. -->
+<!-- For each finding, record a stable ID, severity, first-seen round or source, evidence, judgment, fix, and recheck result. Finding states are OPEN / CLOSED / DEFERRED. REOPENED is an event, not a state; it preserves the original ID and appends evidence. CURRENT / SUPERSEDED describes only a candidate or evidence, never finding state or an overwritten earlier failure. A prior miss explanation must be evidence-backed, labeled hypothesis, or written as unknown. Formal raw records may live in comments while the body keeps an index. Record Promoted reusable rule: <authority / None>. If there are no findings, list the high-risk areas checked. Do not add a duplicate reconciliation ledger. -->
 
 ## 8. Known Limits, Open Decisions, and Rollback
 

en/AGENTS.md

@@ -92,4 +92,4 @@ session; do not create repository run state, receipts, or temporary process docu
 
 ## Project-specific Conventions
 
-<!-- project-fill: Derive project conventions from lint, formatter, compiler, build, or team configuration. If none are verifiable, write None and the configuration scope checked, then remove this marker. -->
+<!-- project-fill: Derive project conventions from machine enforcement such as lint, formatter, compiler, and build configuration, plus current repository or team instructions and accepted decisions that apply to this scope. Distinguish machine-enforced from owner-declared rules and identify authority, scope, and conflicts checked. Keep personal or session preferences only when explicitly adopted as project policy and persisted in repository authority. If none are verifiable, write None and the configuration and governance scope checked, then remove this marker. -->

en/PR_Checklist.md

@@ -19,6 +19,8 @@ explicitly requests it.
 
 - [ ] Select real commands from `TESTING.md` and current repository configuration; do not infer a runner or
   service from a template.
+- [ ] Ensure the decision to add or not add tests follows `TESTING.md` section 4; with no test diff, cite a
+  specific covering test and rerun evidence.
 - [ ] For each test, record exact command, scope, result, not-run reason, actual environment, and isolation
   method.
 - [ ] Ensure environment choice follows command side effects, CI capabilities, and project policy, with
@@ -33,6 +35,8 @@ explicitly requests it.
   left unchanged; do not edit every document merely for completeness.
 - [ ] Keep the authority direction `capability_contract.json → interact.md → business_user_guide.md` for
   capability changes. User-visible claims have current implementation or test evidence and stable anchors.
+- [ ] Reference Markdown anchors through the capability contract's contract-defined protocol without copying
+  its token here; do not present alignment as sentence-level binding or proof of capability semantics.
 - [ ] Check architecture impact across entrypoints, module boundaries, data flow, state, error models,
   external dependencies, artifacts, and side effects.
 - [ ] Replace or delete every active project-fill marker while preserving valid Markdown and JSON.
@@ -43,6 +47,12 @@ explicitly requests it.
   reviewer identity, scope, and limitations.
 - [ ] Fix every BLOCKER and actionable WARN that does not require a new product decision. Keep remaining
   issues in open decisions with evidence and impact.
+- [ ] Preserve material rounds, REOPENED findings, and SUPERSEDED candidates or evidence. Reopening keeps the
+  original finding ID, and finding state is not confused with evidence state.
+- [ ] Support a prior miss explanation with evidence or label it `hypothesis` / `unknown`; never invent cause
+  merely to fill a field.
+- [ ] Evaluate every material finding for promotion to a long-term rule or automated gate, and record why when
+  it is not promoted.
 - [ ] Rerun affected tests and mechanical checks after fixes, then recheck the final diff and Git state.
 
 ## PR Delivery

en/TESTING.md

@@ -5,6 +5,10 @@
 Derive every exact command from current repository scripts, task configuration, CI, build files, or test
 framework configuration, and verify it from the repository root or a recorded working directory. Do not
 infer a language, runner, service, or phase from this template.
+Prefer a verified repository-owned unified entrypoint when one exists and record what it actually covers;
+otherwise, do not create a wrapper only to satisfy this template. Review a wrapper as a separate project
+change only when repeated multi-command orchestration, service lifecycle, or cleanup steps provide independent
+maintenance value.
 
 <!-- project-fill: List executable test commands, working directories, environment prerequisites, and scope from the current repository, then remove this marker. -->
 
@@ -43,17 +47,33 @@ infer a language, runner, service, or phase from this template.
 
 An alignment test belongs to the target project's test suite, not the documentation sync checker. It
 should recursively collect stable `anchor_id` values from every object in `capability_contract.json` and
-check uniqueness and Markdown references without hardcoding buckets, JSON paths, array positions, or
-requiring every contract entry to appear in the business guide.
+use the protocol defined by the contract rules to check uniqueness and Markdown references without
+hardcoding buckets, JSON paths, array positions, or requiring every contract entry to appear in the
+business guide.
 
-Use `test_anchor: null` with a concrete reason for declarations without automation. Register the real test
-anchor when a test exists. Before claiming an alignment test exists, verify its implementation and command
-in the target repository.
+When `test_anchor: null` is explicit, record both a nonempty, concrete `untested_reason` and a nonempty
+`pending_since`; register the real test anchor when a test exists. Anchor alignment proves only mechanical
+facts such as a structural reference, a valid ID, and no dangling target. It does not by itself prove
+sentence-level binding or that claim semantics are implemented. Before claiming an alignment test exists,
+verify its implementation and command in the target repository.
 
 <!-- project-fill: Cite the target project's real alignment test, command, and scope. If it is not implemented, write Not configured and the reason, then remove this marker. -->
 
 ## 4. Change Type to Required Evidence
 
+1. For a safely and deterministically reproducible escaped bug, establish the smallest regression test or
+   fixture that fails before the fix, then change the implementation.
+2. When a test cannot establish a failing test first, preserve pre-fix failure evidence and state why stable
+   automation is unavailable and what risk remains.
+3. For user-visible behavior, public contract, or schema changes, add or update the nearest-boundary contract
+   or scenario test by default.
+4. With no test diff, identify the specific existing test that covers the new risk and provide rerun evidence;
+   “an existing high-level test” is not sufficient.
+5. A behavior-preserving internal refactor may add no test, but rerun affected paths and record the
+   no-test-change reason.
+6. A documentation-only gate proves only the structure, parsing, or alignment it actually checks; it is not
+   runtime behavior validation.
+
 <!-- project-fill: Map code, configuration, schema, user behavior, artifact, and documentation changes to evidence levels using actual project risk, then remove this marker. -->
 
 ## 5. Side Effects and Isolation
@@ -82,5 +102,7 @@ test file.
 Record reusable test-decision rules supported by real failures, not incident chronology or volatile
 commands. If a failure came from layers passing independently while their combination failed, keep both a
 minimal regression and a scenario test that crosses the real boundary.
+Merge the same failure mode into a more general rule. Retire it only when a stronger test, automated gate,
+or authoritative rule fully carries the knowledge, never merely because the example is old.
 
 <!-- project-fill: Add lessons supported by real failures and not replaced by stronger rules or automation. If none exist, write None, then remove this marker. -->

en/capability_contract.json

@@ -7,9 +7,11 @@
     "Every fill entry must be replaced with verified project content or deleted before validation.",
     "Every active statement must have evidence in the current implementation, configuration, tests, committed artifacts, or reproducible results.",
     "Future or proposed behavior must use an explicit non-active status and must not be presented as currently available.",
-    "Markdown documents reference stable anchor_id values only, never JSON paths, array indexes, or schema-internal paths.",
+    "Markdown documents use only `<!-- capability-anchor: <ANCHOR_ID> -->` to reference stable anchor_id values; the marker name and ANCHOR_ID are case-sensitive, ANCHOR_ID must match `[A-Za-z0-9_.-]+`, and a target checker may tolerate whitespace differences inside the comment, but a JSON path, array position, or schema-internal path cannot replace the anchor ID.",
+    "Other anchor, ref, contract, or wiki-link forms are unsupported and do not establish an alignment reference; this generic protocol does not guarantee that any consumer exhaustively detects or rejects unknown aliases.",
+    "An anchor reference proves only that a registered ID is referenced structurally; it does not by itself prove sentence-level binding, business semantics, or implementation.",
     "Deprecated anchors remain registered for their original meaning and must never be reused.",
-    "A contract without automation uses test_anchor: null and records a concrete untested_reason or pending_since value."
+    "A contract that explicitly uses test_anchor: null must record both a nonempty, concrete untested_reason and a nonempty pending_since value; this registers a coverage gap and does not mean the claim is verified."
   ],
   "contracts": {
     "capabilities": [
@@ -24,7 +26,7 @@
         "test_anchor": null,
         "test_status": "not_automated",
         "untested_reason": "__PROJECT_FILL__: replace with the reason automation is absent, or replace test_anchor and remove this field",
-        "pending_since": "__PROJECT_FILL__: replace with the applicable date or remove this field",
+        "pending_since": "__PROJECT_FILL__: replace with the date the coverage gap was registered; keep this field while test_anchor is null",
         "since": "__PROJECT_FILL__: replace with the first verified version or date"
       }
     ],
@@ -40,7 +42,7 @@
         "test_anchor": null,
         "test_status": "not_automated",
         "untested_reason": "__PROJECT_FILL__: replace with the reason automation is absent, or replace test_anchor and remove this field",
-        "pending_since": "__PROJECT_FILL__: replace with the applicable date or remove this field",
+        "pending_since": "__PROJECT_FILL__: replace with the date the coverage gap was registered; keep this field while test_anchor is null",
         "since": "__PROJECT_FILL__: replace with the first verified version or date"
       }
     ],
@@ -56,7 +58,7 @@
         "test_anchor": null,
         "test_status": "not_automated",
         "untested_reason": "__PROJECT_FILL__: replace with the reason automation is absent, or replace test_anchor and remove this field",
-        "pending_since": "__PROJECT_FILL__: replace with the applicable date or remove this field",
+        "pending_since": "__PROJECT_FILL__: replace with the date the coverage gap was registered; keep this field while test_anchor is null",
         "since": "__PROJECT_FILL__: replace with the first verified version or date"
       }
     ],
@@ -72,7 +74,7 @@
         "test_anchor": null,
         "test_status": "not_automated",
         "untested_reason": "__PROJECT_FILL__: replace with the reason automation is absent, or replace test_anchor and remove this field",
-        "pending_since": "__PROJECT_FILL__: replace with the applicable date or remove this field",
+        "pending_since": "__PROJECT_FILL__: replace with the date the coverage gap was registered; keep this field while test_anchor is null",
         "since": "__PROJECT_FILL__: replace with the first verified version or date"
       }
     ],

en/docs/development_workflow/README.md

@@ -72,6 +72,28 @@ external shallow clone, then pins target HEAD and upstream SHA for the entire ru
 - Keep temporary PR body Markdown outside the repository. Commit, push, and draft-PR creation occur through
   general GitHub publishing capability only after successful checks and only when the user asks.
 
+### DEC-007 Summary
+
+[DEC-007](../../../zh/docs/development_workflow/decisions.md) refines DEC-006 without restoring proxy
+controls. It classifies descriptive facts, normative policies, personal or session preferences, and mixed
+claims by meaning; configuration proves enforcement but does not silently supersede policy intent, and a
+task preference persists only after explicit owner adoption in repository authority.
+
+The capability contract is the single definition point for the canonical anchor form, case-sensitive ID
+grammar, and whitespace tolerance. Unsupported forms do not establish alignment, the generic protocol does
+not promise exhaustive alias detection, and structural references do not prove claim semantics. An explicit
+`test_anchor: null` requires both a nonempty `untested_reason` and `pending_since`; the authoring-rule change
+does not raise `schema_version` from `0.1.0`. TESTING defines minimum evidence for escaped bugs, public
+contracts, no-test diffs, refactors, and documentation-only gates, while the checklist enforces the
+add-or-not-add test decision.
+Findings keep stable IDs and first-seen evidence; REOPENED is an event, CURRENT / SUPERSEDED applies only to
+candidates or evidence, and prior misses are evidence-backed, labeled hypothesis, or recorded as unknown.
+
+With the same target base, upstream candidate, language, and round-one document bytes, Case A round two passes
+only as `PASS_NOOP`; an added valid correction is `ROUND1_INCOMPLETE`, and unsupported prose drift is
+`ROUND2_DRIFT`. Either failure restarts both rounds from a clean target. This decision adds no parser, ledger,
+receipt, run state, installer behavior, or `sync_docs.py` / CLI feature.
+
 Key implementation files:
 
 - `../../../zh/skills/workflow-docs-sync/SKILL.md`: orchestration contract.